@agent-native/core 0.118.0 → 0.119.0

package/corpus/templates/crm/actions/_crm-dashboard.ts

@@ -1,69 +0,0 @@
-import { createHash } from "node:crypto";
-
-import type { ActionRunContext } from "@agent-native/core/action";
-import type { AccessContext } from "@agent-native/core/sharing";
-
-import type { CrmDashboardConfig } from "../server/db/index.js";
-
-export const CRM_PIPELINE_DASHBOARD_TITLE = "Pipeline";
-export const CRM_PIPELINE_PROGRAM_NAME = "crm-pipeline-by-stage";
-export const CRM_PIPELINE_PROGRAM_TITLE = "CRM pipeline by stage";
-export const CRM_PIPELINE_REFRESH_TTL_MS = 5 * 60_000;
-
-export const CRM_PIPELINE_PROGRAM_COLUMNS = [
-  { name: "stage", type: "string" },
-  { name: "pipelineValue", type: "number" },
-  { name: "opportunities", type: "number" },
-] as const;
-
-export const CRM_PIPELINE_PROGRAM_CODE = `const result = await appAction("get-crm-pipeline-data");
-emit(result.rows, ${JSON.stringify(CRM_PIPELINE_PROGRAM_COLUMNS, null, 2)});`;
-
-export function requireDashboardAccess(
-  ctx?: ActionRunContext,
-): AccessContext & { userEmail: string } {
-  const userEmail = ctx?.userEmail?.trim().toLowerCase();
-  if (!userEmail) {
-    throw new Error("CRM dashboards require an authenticated user.");
-  }
-  return { userEmail, orgId: ctx?.orgId ?? undefined };
-}
-
-export function crmPipelineDashboardId(ctx: AccessContext): string {
-  const owner = ctx.userEmail?.trim().toLowerCase();
-  if (!owner) throw new Error("CRM dashboards require an authenticated user.");
-  const scope = `${ctx.orgId ?? "personal"}:${owner}`;
-  return `crm-pipeline-${createHash("sha256").update(scope).digest("hex").slice(0, 24)}`;
-}
-
-export function createPipelineDashboardConfig(
-  programId: string,
-): CrmDashboardConfig {
-  const query = JSON.stringify({ programId });
-  return {
-    version: 1,
-    panels: [
-      {
-        id: "pipeline-total",
-        title: "Pipeline value",
-        source: "program",
-        query,
-        chartType: "metric",
-      },
-      {
-        id: "pipeline-by-stage",
-        title: "Pipeline by stage",
-        source: "program",
-        query,
-        chartType: "bar",
-      },
-      {
-        id: "pipeline-table",
-        title: "Stage detail",
-        source: "program",
-        query,
-        chartType: "table",
-      },
-    ],
-  };
-}

package/corpus/templates/crm/actions/_crm-data-program-actions.ts

@@ -1,15 +0,0 @@
-import { initDataPrograms } from "@agent-native/core/data-programs";
-
-import { CRM_APP_ID } from "../server/lib/provider-api.js";
-import getCrmPipelineData from "./get-crm-pipeline-data.js";
-
-export function getCrmDataProgramActions() {
-  return { "get-crm-pipeline-data": getCrmPipelineData };
-}
-
-export function initCrmDataPrograms(): void {
-  initDataPrograms({
-    appId: CRM_APP_ID,
-    getActions: getCrmDataProgramActions,
-  });
-}

package/corpus/templates/crm/actions/_crm-signal-utils.ts

@@ -1,79 +0,0 @@
-import type { ActionRunContext } from "@agent-native/core/action";
-import { accessFilter, assertAccess } from "@agent-native/core/sharing";
-import { and, eq, inArray } from "drizzle-orm";
-
-import { getDb, schema } from "../server/db/index.js";
-import type { CallEvidenceExcerpt } from "../server/lib/intelligence/evidence.js";
-import {
-  requireCrmScope,
-  scopedCrmIdempotencyKey,
-} from "./_crm-action-utils.js";
-
-export async function loadCrmSignalEvidence(args: {
-  recordId: string;
-  evidenceIds?: string[];
-  role?: "viewer" | "editor";
-}) {
-  await assertAccess("crm-record", args.recordId, args.role ?? "viewer");
-  const db = getDb();
-  const predicates = [
-    eq(schema.crmCallEvidence.recordId, args.recordId),
-    accessFilter(schema.crmCallEvidence, schema.crmCallEvidenceShares),
-  ];
-  if (args.evidenceIds?.length) {
-    predicates.push(inArray(schema.crmCallEvidence.id, args.evidenceIds));
-  }
-  const rows = await db
-    .select()
-    .from(schema.crmCallEvidence)
-    .where(and(...predicates))
-    .limit(20);
-  if (
-    args.evidenceIds?.length &&
-    rows.length !== new Set(args.evidenceIds).size
-  ) {
-    throw new Error("One or more call-evidence references are unavailable.");
-  }
-  return rows;
-}
-
-export function evidenceExcerpts(
-  rows: Awaited<ReturnType<typeof loadCrmSignalEvidence>>,
-): CallEvidenceExcerpt[] {
-  return rows.flatMap((row) => {
-    const quote = row.quote.trim() || row.summary.trim();
-    if (!quote) return [];
-    return [
-      {
-        evidenceRef: row.id,
-        quote,
-        ...(row.speaker ? { speaker: row.speaker } : {}),
-        startSeconds: row.startSeconds ?? 0,
-        ...(row.endSeconds !== null ? { endSeconds: row.endSeconds } : {}),
-      },
-    ];
-  });
-}
-
-export async function crmSignalIdempotencyKey(
-  ctx: ActionRunContext | undefined,
-  recordId: string,
-  key: string,
-) {
-  const scope = requireCrmScope(ctx);
-  return {
-    scope,
-    key: await scopedCrmIdempotencyKey({
-      ownerEmail: scope.ownerEmail,
-      orgId: scope.orgId,
-      recordId,
-      key: `signal:${key}`,
-    }),
-  };
-}
-
-export function signalTupleError(message: string): never {
-  const error = new Error(message) as Error & { statusCode?: number };
-  error.statusCode = 404;
-  throw error;
-}

package/corpus/templates/crm/actions/apply-crm-proposals.ts

@@ -1,203 +0,0 @@
-import { defineAction, type ActionRunContext } from "@agent-native/core/action";
-import { accessFilter, assertAccess } from "@agent-native/core/sharing";
-import { and, eq } from "drizzle-orm";
-import { z } from "zod";
-
-import { isConnectedCrmProvider } from "../server/crm/adapter.js";
-import { getDb, schema } from "../server/db/index.js";
-import {
-  isSafeCrmMutationFields,
-  parseJsonRecord,
-  requireCrmScope,
-} from "./_crm-action-utils.js";
-
-function conditionalMutationMessage(provider: "hubspot" | "salesforce") {
-  const label = provider === "hubspot" ? "HubSpot" : "Salesforce";
-  return `${label} did not apply this update because this connection has not proved an atomic expected-revision write path. Refresh the record and make this change in ${label}.`;
-}
-
-function updateAffectedRows(result: unknown): number {
-  if (!result || typeof result !== "object") return 0;
-  const value = result as {
-    rowsAffected?: unknown;
-    rowCount?: unknown;
-    count?: unknown;
-    changes?: unknown;
-    meta?: { changes?: unknown };
-  };
-  for (const count of [
-    value.rowsAffected,
-    value.rowCount,
-    value.count,
-    value.changes,
-    value.meta?.changes,
-  ]) {
-    if (typeof count === "number") return count;
-  }
-  return 0;
-}
-
-export default defineAction({
-  description:
-    "Review one pending HubSpot or Salesforce provider proposal. The initial release records approval and fails closed unless the connection proves an atomic expected-revision write path; otherwise make the change upstream after review.",
-  schema: z.object({
-    proposalId: z.string().trim().min(1).max(128),
-  }),
-  needsApproval: true,
-  audit: {
-    target: (_args, result) => {
-      const response = result as {
-        recordId: string;
-        ownerEmail: string;
-        orgId: string | null;
-        visibility: "private" | "org";
-      };
-      return {
-        type: "crm-record",
-        id: response.recordId,
-        ownerEmail: response.ownerEmail,
-        orgId: response.orgId,
-        visibility: response.visibility,
-      };
-    },
-    summary: (args) => `Reviewed CRM proposal ${args.proposalId}`,
-    recordInputs: false,
-  },
-  run: async (args, ctx?: ActionRunContext) => {
-    await assertAccess("crm-mutation", args.proposalId, "editor");
-    const db = getDb();
-    const [proposal] = await db
-      .select()
-      .from(schema.crmMutations)
-      .where(
-        and(
-          eq(schema.crmMutations.id, args.proposalId),
-          accessFilter(
-            schema.crmMutations,
-            schema.crmMutationShares,
-            undefined,
-            "editor",
-          ),
-        ),
-      )
-      .limit(1);
-    if (!proposal) throw new Error("CRM proposal was not found.");
-    if (proposal.target !== "provider" || proposal.operation !== "update") {
-      throw new Error(
-        "Only pending provider update proposals can be reviewed in this phase.",
-      );
-    }
-    if (proposal.status !== "pending") {
-      throw new Error(
-        `CRM proposal is ${proposal.status} and cannot be reviewed.`,
-      );
-    }
-    if (!proposal.recordId || !proposal.connectionId) {
-      throw new Error(
-        "CRM proposal is missing its record or connection reference.",
-      );
-    }
-    await assertAccess("crm-record", proposal.recordId, "editor");
-    await assertAccess("crm-connection", proposal.connectionId, "editor");
-    const [[record], [connection]] = await Promise.all([
-      db
-        .select()
-        .from(schema.crmRecords)
-        .where(
-          and(
-            eq(schema.crmRecords.id, proposal.recordId),
-            accessFilter(
-              schema.crmRecords,
-              schema.crmRecordShares,
-              undefined,
-              "editor",
-            ),
-          ),
-        )
-        .limit(1),
-      db
-        .select()
-        .from(schema.crmConnections)
-        .where(
-          and(
-            eq(schema.crmConnections.id, proposal.connectionId),
-            accessFilter(
-              schema.crmConnections,
-              schema.crmConnectionShares,
-              undefined,
-              "editor",
-            ),
-          ),
-        )
-        .limit(1),
-    ]);
-    if (!record || record.tombstone || !connection) {
-      throw new Error(
-        "CRM proposal no longer has an available record and connection.",
-      );
-    }
-    if (!isConnectedCrmProvider(connection.provider)) {
-      throw new Error(
-        "Only HubSpot and Salesforce provider proposals are enabled in this release.",
-      );
-    }
-    if (!connection.workspaceConnectionId) {
-      throw new Error(
-        "CRM connection is missing its workspace connection reference.",
-      );
-    }
-    if (!proposal.expectedRemoteRevision) {
-      throw new Error(
-        "CRM proposal has no remote revision and must be recreated from a refreshed record.",
-      );
-    }
-    const patch = parseJsonRecord(proposal.patchJson);
-    const fields = patch.fields;
-    if (!fields || typeof fields !== "object" || Array.isArray(fields)) {
-      throw new Error("CRM proposal has an invalid field patch.");
-    }
-    const fieldPatch = fields as Record<string, unknown>;
-    if (!isSafeCrmMutationFields(fieldPatch)) {
-      throw new Error("CRM proposal contains an unsafe field patch.");
-    }
-
-    const scope = requireCrmScope(ctx);
-    const now = new Date().toISOString();
-    const message = conditionalMutationMessage(connection.provider);
-    const claim = await db
-      .update(schema.crmMutations)
-      .set({
-        status: "rejected",
-        approvedBy: scope.ownerEmail,
-        approvedAt: now,
-        error: message,
-        updatedAt: now,
-      })
-      .where(
-        and(
-          eq(schema.crmMutations.id, proposal.id),
-          eq(schema.crmMutations.status, "pending"),
-          accessFilter(
-            schema.crmMutations,
-            schema.crmMutationShares,
-            undefined,
-            "editor",
-          ),
-        ),
-      );
-    if (updateAffectedRows(claim) !== 1) {
-      throw new Error(
-        "CRM proposal was already claimed by another application attempt.",
-      );
-    }
-    return {
-      proposalId: proposal.id,
-      recordId: record.id,
-      status: "rejected" as const,
-      message,
-      ownerEmail: record.ownerEmail,
-      orgId: record.orgId,
-      visibility: record.visibility,
-    };
-  },
-});

package/corpus/templates/crm/actions/attach-call-evidence.ts

@@ -1,170 +0,0 @@
-import { defineAction } from "@agent-native/core/action";
-import { assertAccess } from "@agent-native/core/sharing";
-import { and, eq, inArray } from "drizzle-orm";
-import { z } from "zod";
-
-import { isSafeCrmEvidenceExcerpt } from "../server/crm/crm-field-firewall.js";
-import { getDb, schema } from "../server/db/index.js";
-import { isDurableClipsEvidenceUrl } from "../shared/crm-automation-recipes.js";
-import { requireCrmScope } from "./_crm-action-utils.js";
-
-const httpsUrl = z
-  .string()
-  .url()
-  .max(2_048)
-  .refine(
-    (value) => /^https:\/\//i.test(value),
-    "sourceUrl must be an https URL",
-  );
-
-export default defineAction({
-  description:
-    "Attach bounded call evidence to a CRM record. Store only an artifact reference, URL, optional short quote, speaker, timestamp, and summary; never submit a transcript or media payload.",
-  schema: z
-    .object({
-      recordId: z.string().trim().min(1).max(128).optional(),
-      recordIds: z
-        .array(z.string().trim().min(1).max(128))
-        .min(1)
-        .max(20)
-        .optional(),
-      interactionId: z.string().trim().min(1).max(128).optional(),
-      artifactId: z.string().trim().min(1).max(256),
-      sourceUrl: httpsUrl,
-      sourceApp: z.string().trim().min(1).max(80).default("clips"),
-      artifactType: z.string().trim().min(1).max(80).default("call-evidence"),
-      quote: z
-        .string()
-        .trim()
-        .max(1_200)
-        .refine(
-          isSafeCrmEvidenceExcerpt,
-          "quote must be a bounded human-readable excerpt, not transcript, media, binary, base64, or data-url content",
-        )
-        .optional(),
-      speaker: z.string().trim().max(240).optional(),
-      startSeconds: z.number().finite().min(0).max(86_400).optional(),
-      endSeconds: z.number().finite().min(0).max(86_400).optional(),
-      summary: z
-        .string()
-        .trim()
-        .max(2_000)
-        .refine(
-          isSafeCrmEvidenceExcerpt,
-          "summary must be a bounded human-readable excerpt, not transcript, media, binary, base64, or data-url content",
-        )
-        .optional(),
-      capturedAt: z.string().datetime({ offset: true }).optional(),
-    })
-    .superRefine((value, issue) => {
-      if (
-        (!value.recordId && !value.recordIds) ||
-        (value.recordId && value.recordIds)
-      ) {
-        issue.addIssue({
-          code: "custom",
-          message: "Provide exactly one of recordId or recordIds",
-          path: ["recordId"],
-        });
-      }
-      if (
-        value.endSeconds !== undefined &&
-        value.startSeconds !== undefined &&
-        value.endSeconds < value.startSeconds
-      ) {
-        issue.addIssue({
-          code: "custom",
-          message: "endSeconds must be after startSeconds",
-          path: ["endSeconds"],
-        });
-      }
-      if (
-        value.sourceApp.trim().toLowerCase() === "clips" &&
-        !isDurableClipsEvidenceUrl(value.sourceUrl)
-      ) {
-        issue.addIssue({
-          code: "custom",
-          message:
-            "Clips evidence must use a durable /share/<id> or /r/<id> page URL without an access token, media endpoint, or transcript fragment",
-          path: ["sourceUrl"],
-        });
-      }
-    }),
-  audit: {
-    target: (args, result) => {
-      const value = result as {
-        evidence?: Array<{
-          ownerEmail: string;
-          orgId: string | null;
-          visibility: "private" | "org";
-        }>;
-        ownerEmail: string;
-        orgId: string | null;
-        visibility: "private" | "org";
-      };
-      const evidence = value.evidence?.[0] ?? value;
-      return {
-        type: "crm-record",
-        id: args.recordId ?? args.recordIds?.[0] ?? "unknown",
-        ownerEmail: evidence.ownerEmail,
-        orgId: evidence.orgId,
-        visibility: evidence.visibility,
-      };
-    },
-    summary: (args) =>
-      `Attached call evidence to ${args.recordIds?.length ?? 1} CRM record${args.recordIds?.length === 1 ? "" : "s"}`,
-    recordInputs: false,
-  },
-  run: async (args, ctx) => {
-    const recordIds = args.recordId
-      ? [args.recordId]
-      : [...new Set(args.recordIds ?? [])];
-    await Promise.all(
-      recordIds.map((recordId) =>
-        assertAccess("crm-record", recordId, "editor"),
-      ),
-    );
-    if (args.interactionId)
-      await assertAccess("crm-interaction", args.interactionId, "viewer");
-    const db = getDb();
-    const scope = requireCrmScope(ctx);
-    const now = new Date().toISOString();
-    const rows = recordIds.map((recordId) => ({
-      id: crypto.randomUUID(),
-      interactionId: args.interactionId ?? null,
-      recordId,
-      sourceApp: args.sourceApp,
-      artifactType: args.artifactType,
-      artifactId: args.artifactId,
-      sourceUrl: args.sourceUrl,
-      quote: args.quote ?? "",
-      speaker: args.speaker ?? null,
-      startSeconds: args.startSeconds ?? null,
-      endSeconds: args.endSeconds ?? null,
-      summary: args.summary ?? "",
-      capturedAt: args.capturedAt ?? now,
-      ...scope,
-      createdAt: now,
-      updatedAt: now,
-    }));
-    await db.transaction(async (tx) => {
-      await tx.insert(schema.crmCallEvidence).values(rows);
-    });
-    const evidence = await db
-      .select()
-      .from(schema.crmCallEvidence)
-      .where(
-        and(
-          inArray(
-            schema.crmCallEvidence.id,
-            rows.map((row) => row.id),
-          ),
-          eq(schema.crmCallEvidence.ownerEmail, scope.ownerEmail),
-        ),
-      )
-      .limit(recordIds.length);
-    if (evidence.length !== recordIds.length)
-      throw new Error("Call evidence could not be verified after saving.");
-    return args.recordId ? evidence[0] : { evidence };
-  },
-});

package/corpus/templates/crm/actions/configure-crm-connection.ts

@@ -1,126 +0,0 @@
-import { defineAction, type ActionRunContext } from "@agent-native/core/action";
-import { accessFilter, assertAccess } from "@agent-native/core/sharing";
-import { and, eq } from "drizzle-orm";
-import { z } from "zod";
-
-import { createConnectedCrmAdapter } from "../server/crm/adapter.js";
-import { getDb, schema } from "../server/db/index.js";
-import { requireCrmScope, toJson } from "./_crm-action-utils.js";
-
-const idList = z.array(z.string().trim().min(1).max(160)).max(50).default([]);
-
-export default defineAction({
-  description:
-    "Register an authorized HubSpot or Salesforce workspace Connection as a scoped CRM companion connection. Provider credentials remain in workspace Connections.",
-  schema: z.object({
-    provider: z.enum(["hubspot", "salesforce"]).default("hubspot"),
-    workspaceConnectionId: z.string().trim().min(1).max(160).optional(),
-    label: z.string().trim().min(1).max(160).optional(),
-    mode: z.enum(["connected", "hybrid"]).default("connected"),
-    selectedPipelineIds: idList,
-    selectedObjectTypes: z
-      .array(z.string().trim().min(1).max(120))
-      .min(1)
-      .max(50)
-      .optional(),
-  }),
-  audit: {
-    target: (_args, result) => {
-      const connection = result as {
-        id: string;
-        ownerEmail: string;
-        orgId: string | null;
-        visibility: "private" | "org";
-      };
-      return {
-        type: "crm-connection",
-        id: connection.id,
-        ownerEmail: connection.ownerEmail,
-        orgId: connection.orgId,
-        visibility: connection.visibility,
-      };
-    },
-    summary: (_args, result) =>
-      `Configured CRM connection ${(result as { id?: string })?.id ?? ""}`,
-    recordInputs: false,
-  },
-  run: async (args, ctx?: ActionRunContext) => {
-    const scope = requireCrmScope(ctx);
-    const adapter = await createConnectedCrmAdapter({
-      provider: args.provider,
-      connectionId: args.workspaceConnectionId,
-      userEmail: scope.ownerEmail,
-      orgId: scope.orgId,
-    });
-    const id = adapter.connection.connectionId;
-    const db = getDb();
-    const [existing] = await db
-      .select({ id: schema.crmConnections.id })
-      .from(schema.crmConnections)
-      .where(
-        and(
-          eq(schema.crmConnections.workspaceConnectionId, id),
-          accessFilter(schema.crmConnections, schema.crmConnectionShares),
-        ),
-      )
-      .limit(1);
-    const now = new Date().toISOString();
-    const selectedObjectTypes =
-      args.selectedObjectTypes ??
-      (args.provider === "hubspot"
-        ? ["companies", "contacts", "deals"]
-        : ["Account", "Contact", "Opportunity"]);
-    const accessScopeKey = `workspace:${id}:${adapter.connection.actorId ?? scope.ownerEmail}`;
-    const values = {
-      provider: args.provider,
-      workspaceConnectionId: id,
-      label:
-        args.label ?? (args.provider === "hubspot" ? "HubSpot" : "Salesforce"),
-      accountId: adapter.connection.accountId ?? null,
-      mode: args.mode,
-      status: "connected" as const,
-      selectedPipelinesJson: toJson(args.selectedPipelineIds, 8_000),
-      selectedObjectTypesJson: toJson(selectedObjectTypes, 8_000),
-      accessScopeKey,
-      accessScopeJson: toJson(
-        {
-          key: accessScopeKey,
-          actorId: adapter.connection.actorId,
-          mode: adapter.connection.actorId ? "user" : "service-account",
-          recordVisibility: adapter.connection.actorId ? "actor" : "unknown",
-        },
-        4_000,
-      ),
-      lastError: null,
-      updatedAt: now,
-    };
-    const localId = existing?.id ?? id;
-
-    if (existing) {
-      await assertAccess("crm-connection", existing.id, "editor");
-      await db
-        .update(schema.crmConnections)
-        .set(values)
-        .where(
-          and(
-            eq(schema.crmConnections.id, existing.id),
-            accessFilter(
-              schema.crmConnections,
-              schema.crmConnectionShares,
-              undefined,
-              "editor",
-            ),
-          ),
-        );
-    } else {
-      await db.insert(schema.crmConnections).values({
-        id: localId,
-        ...values,
-        ...scope,
-        createdAt: now,
-      });
-    }
-
-    return { id: localId, ...scope, provider: args.provider };
-  },
-});