@agent-native/core 0.130.2 → 0.131.3

package/dist/triggers/routes.js

@@ -1,14 +1,23 @@
 import { defineEventHandler, getMethod, setResponseStatus, } from "h3";
+import { canUpdateAutomationResource } from "../automations/service.js";
 import { getDbExec } from "../db/client.js";
 import { nextOccurrence, describeCron, isValidCron } from "../jobs/cron.js";
+import { buildJobResourceContent, parseJobResource, } from "../jobs/frontmatter.js";
 import { getOrgContext } from "../org/context.js";
-import { resourceGetByPath, resourceListAllOwners, resourcePut, SHARED_OWNER, } from "../resources/store.js";
+import { organizationIdFromResourceOwner, organizationResourceOwner, resourceGetByPath, resourceListAllOwners, resourcePut, SHARED_OWNER, } from "../resources/store.js";
 import { getSession } from "../server/auth.js";
 import { readBody } from "../server/h3-helpers.js";
-import { buildTriggerContent, parseTriggerFrontmatter, refreshEventSubscriptions, } from "./dispatcher.js";
+import { refreshEventSubscriptions } from "./dispatcher.js";
 function automationName(path) {
     return path.replace(/^jobs\//, "").replace(/\.md$/, "");
 }
+function asTriggerFrontmatter(meta) {
+    return {
+        ...meta,
+        triggerType: meta.triggerType ?? "schedule",
+        mode: meta.mode ?? "agentic",
+    };
+}
 function normalizeAutomationPath(input) {
     const rawPath = input.path ?? (input.name ? `jobs/${input.name}.md` : "");
     const path = rawPath.replace(/^\/+/, "");
@@ -48,11 +57,31 @@ function nextRunForMeta(meta) {
     }
     return undefined;
 }
-async function currentUserCanUpdateAutomation(event, userEmail, resourceOwner, meta) {
+async function currentUserCanUpdateAutomation(event, userEmail, resource, meta) {
+    const resourceOwner = resource.owner;
     if (resourceOwner === userEmail)
         return true;
+    const resourceOrgId = organizationIdFromResourceOwner(resourceOwner);
+    if (resourceOrgId) {
+        try {
+            const org = await getOrgContext(event);
+            if (org.orgId !== resourceOrgId)
+                return false;
+            return await canUpdateAutomationResource({ userEmail, orgId: resourceOrgId }, resource);
+        }
+        catch {
+            return false;
+        }
+    }
     if (resourceOwner !== SHARED_OWNER)
         return false;
+    if (meta.orgId) {
+        const activeOrgId = await getOrgContext(event)
+            .then((context) => context.orgId)
+            .catch(() => null);
+        if (activeOrgId !== meta.orgId)
+            return false;
+    }
     if (meta.createdBy &&
         meta.createdBy.toLowerCase() === userEmail.toLowerCase()) {
         return true;
@@ -81,13 +110,14 @@ async function currentUserCanUpdateAutomation(event, userEmail, resourceOwner, m
     }
 }
 async function resourceToAutomationItem(event, userEmail, resource) {
-    const { meta, body } = parseTriggerFrontmatter(resource.content);
+    const parsed = parseJobResource(resource.content);
+    const meta = asTriggerFrontmatter(parsed.meta);
     return {
         id: resource.id,
         name: automationName(resource.path),
         path: resource.path,
         owner: resource.owner,
-        canUpdate: await currentUserCanUpdateAutomation(event, userEmail, resource.owner, meta),
+        canUpdate: await currentUserCanUpdateAutomation(event, userEmail, resource, meta),
         triggerType: meta.triggerType,
         event: meta.event,
         schedule: meta.schedule || undefined,
@@ -101,14 +131,31 @@ async function resourceToAutomationItem(event, userEmail, resource) {
         lastError: meta.lastError,
         nextRun: nextRunForMeta(meta),
         createdBy: meta.createdBy,
-        body,
+        body: parsed.body,
     };
 }
 export async function listAutomationsForOwner(event, userEmail) {
     const allResources = await resourceListAllOwners("jobs/");
-    const resources = allResources.filter((resource) => (resource.owner === userEmail || resource.owner === SHARED_OWNER) &&
-        resource.path.endsWith(".md") &&
-        !resource.path.endsWith(".keep"));
+    const activeOrgId = await getOrgContext(event)
+        .then((context) => context.orgId)
+        .catch(() => null);
+    const activeOrgOwner = activeOrgId
+        ? organizationResourceOwner(activeOrgId)
+        : null;
+    const resources = allResources.filter((resource) => {
+        if (!resource.path.endsWith(".md") || resource.path.endsWith(".keep")) {
+            return false;
+        }
+        if (resource.owner !== userEmail &&
+            resource.owner !== SHARED_OWNER &&
+            resource.owner !== activeOrgOwner) {
+            return false;
+        }
+        if (resource.owner !== SHARED_OWNER)
+            return true;
+        const { meta } = parseJobResource(resource.content);
+        return !meta.orgId || meta.orgId === activeOrgId;
+    });
     return Promise.all(resources.map((resource) => resourceToAutomationItem(event, userEmail, resource)));
 }
 export async function setAutomationEnabledForOwner(event, userEmail, input) {
@@ -118,28 +165,40 @@ export async function setAutomationEnabledForOwner(event, userEmail, input) {
         });
     }
     const path = normalizeAutomationPath(input);
-    const requestedOwner = input.owner === SHARED_OWNER ? SHARED_OWNER : userEmail;
+    const activeOrgId = await getOrgContext(event)
+        .then((context) => context.orgId)
+        .catch(() => null);
+    const activeOrgOwner = activeOrgId
+        ? organizationResourceOwner(activeOrgId)
+        : null;
+    const requestedOwner = input.owner === SHARED_OWNER
+        ? SHARED_OWNER
+        : input.owner === activeOrgOwner
+            ? activeOrgOwner
+            : userEmail;
     const resource = await resourceGetByPath(requestedOwner, path);
     if (!resource) {
         throw Object.assign(new Error("Automation not found"), { statusCode: 404 });
     }
-    const { meta, body } = parseTriggerFrontmatter(resource.content);
-    const allowed = await currentUserCanUpdateAutomation(event, userEmail, resource.owner, meta);
+    const parsed = parseJobResource(resource.content);
+    const meta = asTriggerFrontmatter(parsed.meta);
+    const allowed = await currentUserCanUpdateAutomation(event, userEmail, resource, meta);
     if (!allowed) {
         throw Object.assign(new Error("Only the automation creator or an org admin can update it."), { statusCode: 403 });
     }
-    meta.enabled = input.enabled;
-    if (meta.enabled &&
+    parsed.meta.enabled = input.enabled;
+    if (parsed.meta.enabled &&
         meta.triggerType !== "event" &&
         meta.schedule &&
         isValidCron(meta.schedule)) {
-        meta.nextRun = nextOccurrence(meta.schedule).toISOString();
+        parsed.meta.nextRun = nextOccurrence(meta.schedule).toISOString();
     }
-    await resourcePut(resource.owner, resource.path, buildTriggerContent(meta, body));
+    const updatedContent = buildJobResourceContent(parsed.meta, parsed.body);
+    await resourcePut(resource.owner, resource.path, updatedContent);
     await refreshEventSubscriptions();
     return resourceToAutomationItem(event, userEmail, {
         ...resource,
-        content: buildTriggerContent(meta, body),
+        content: updatedContent,
     });
 }
 function routeError(event, err, fallback) {

package/dist/triggers/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/triggers/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,EACX,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAgCzB,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAgC;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACzB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EACnB,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,+CAA+C,CAAC,EAC1D;YACE,UAAU,EAAE,GAAG;SAChB,CACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,IACE,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,WAAW,KAAK,OAAO;QAC5B,IAAI,CAAC,QAAQ;QACb,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC1B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAAc,EACd,SAAiB,EACjB,aAAqB,EACrB,IAAwB;IAExB,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,aAAa,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAEjD,IACE,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,SAAiB,EACjB,QAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,MAAM,8BAA8B,CAC7C,KAAK,EACL,SAAS,EACT,QAAQ,CAAC,KAAK,EACd,IAAI,CACL;QACD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACpC,mBAAmB,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAc,EACd,SAAiB;IAEjB,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CACnC,CAAC,QAAQ,EAAE,EAAE,CACX,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,YAAY,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CACnC,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAChB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACzB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CACrD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAc,EACd,SAAiB,EACjB,KAAgC;IAEhC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE;YAC1D,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,cAAc,GAClB,KAAK,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAClD,KAAK,EACL,SAAS,EACT,QAAQ,CAAC,KAAK,EACd,IAAI,CACL,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,4DAA4D,CAAC,EACvE,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC7B,IACE,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,WAAW,KAAK,OAAO;QAC5B,IAAI,CAAC,QAAQ;QACb,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC1B,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,WAAW,CACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,IAAI,EACb,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAChC,CAAC;IACF,MAAM,yBAAyB,EAAE,CAAC;IAElC,OAAO,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE;QAChD,GAAG,QAAQ;QACX,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,GAAY,EAAE,QAAgB;IAChE,MAAM,UAAU,GACd,OAAQ,GAAW,EAAE,UAAU,KAAK,QAAQ;QAC1C,CAAC,CAAE,GAAW,CAAC,UAAU;QACzB,CAAC,CAAC,GAAG,CAAC;IACV,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACrC,OAAO,EAAE,KAAK,EAAG,GAAW,EAAE,OAAO,IAAI,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACvD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACb,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,IACE,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,KAAK,MAAM,EACjB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;gBACF,IAAI,CACF,kBAAkB,EAClB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,EACzB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,4BAA4B,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CACvC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CACX,CAAqC,CAAC;gBACvC,OAAO,MAAM,4BAA4B,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;oBAC9D,KAAK,EAAE,IAAI,EAAE,KAAK;oBAClB,IAAI,EAAE,IAAI,EAAE,IAAI;oBAChB,IAAI,EAAE,IAAI,EAAE,IAAI;oBAChB,OAAO,EAAG,IAAY,EAAE,OAAO;iBACH,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { getDbExec } from \"../db/client.js\";\nimport { nextOccurrence, describeCron, isValidCron } from \"../jobs/cron.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport {\n  resourceGetByPath,\n  resourceListAllOwners,\n  resourcePut,\n  SHARED_OWNER,\n  type Resource,\n} from \"../resources/store.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  buildTriggerContent,\n  parseTriggerFrontmatter,\n  refreshEventSubscriptions,\n} from \"./dispatcher.js\";\nimport type { TriggerFrontmatter } from \"./types.js\";\n\nexport interface AutomationRouteItem {\n  id: string;\n  name: string;\n  path: string;\n  owner: string;\n  canUpdate: boolean;\n  triggerType: TriggerFrontmatter[\"triggerType\"];\n  event?: string;\n  schedule?: string;\n  scheduleDescription?: string;\n  condition?: string;\n  mode: TriggerFrontmatter[\"mode\"];\n  domain?: string;\n  enabled: boolean;\n  lastStatus?: TriggerFrontmatter[\"lastStatus\"];\n  lastRun?: string;\n  lastError?: string;\n  nextRun?: string;\n  createdBy?: string;\n  body: string;\n}\n\ninterface SetAutomationEnabledInput {\n  owner?: string;\n  path?: string;\n  name?: string;\n  enabled: boolean;\n}\n\nfunction automationName(path: string): string {\n  return path.replace(/^jobs\\//, \"\").replace(/\\.md$/, \"\");\n}\n\nfunction normalizeAutomationPath(input: SetAutomationEnabledInput): string {\n  const rawPath = input.path ?? (input.name ? `jobs/${input.name}.md` : \"\");\n  const path = rawPath.replace(/^\\/+/, \"\");\n  if (\n    !path.startsWith(\"jobs/\") ||\n    !path.endsWith(\".md\") ||\n    path.endsWith(\".keep\") ||\n    path.includes(\"..\")\n  ) {\n    throw Object.assign(\n      new Error(\"A valid jobs/*.md automation path is required\"),\n      {\n        statusCode: 400,\n      },\n    );\n  }\n  return path;\n}\n\nfunction scheduleDescription(schedule: string | undefined): string | undefined {\n  if (!schedule) return undefined;\n  try {\n    return describeCron(schedule);\n  } catch {\n    return schedule;\n  }\n}\n\nfunction nextRunForMeta(meta: TriggerFrontmatter): string | undefined {\n  if (meta.nextRun) return meta.nextRun;\n  if (\n    meta.enabled &&\n    meta.triggerType !== \"event\" &&\n    meta.schedule &&\n    isValidCron(meta.schedule)\n  ) {\n    try {\n      return nextOccurrence(meta.schedule).toISOString();\n    } catch {\n      return undefined;\n    }\n  }\n  return undefined;\n}\n\nasync function currentUserCanUpdateAutomation(\n  event: H3Event,\n  userEmail: string,\n  resourceOwner: string,\n  meta: TriggerFrontmatter,\n): Promise<boolean> {\n  if (resourceOwner === userEmail) return true;\n  if (resourceOwner !== SHARED_OWNER) return false;\n\n  if (\n    meta.createdBy &&\n    meta.createdBy.toLowerCase() === userEmail.toLowerCase()\n  ) {\n    return true;\n  }\n\n  let orgId = meta.orgId;\n  if (!orgId) {\n    try {\n      orgId = (await getOrgContext(event)).orgId ?? undefined;\n    } catch {\n      orgId = undefined;\n    }\n  }\n  if (!orgId) return false;\n\n  try {\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n      args: [orgId, userEmail.toLowerCase()],\n    });\n    const role = String((rows[0] as any)?.role ?? \"\").toLowerCase();\n    return role === \"owner\" || role === \"admin\";\n  } catch {\n    return false;\n  }\n}\n\nasync function resourceToAutomationItem(\n  event: H3Event,\n  userEmail: string,\n  resource: Resource,\n): Promise<AutomationRouteItem> {\n  const { meta, body } = parseTriggerFrontmatter(resource.content);\n  return {\n    id: resource.id,\n    name: automationName(resource.path),\n    path: resource.path,\n    owner: resource.owner,\n    canUpdate: await currentUserCanUpdateAutomation(\n      event,\n      userEmail,\n      resource.owner,\n      meta,\n    ),\n    triggerType: meta.triggerType,\n    event: meta.event,\n    schedule: meta.schedule || undefined,\n    scheduleDescription: scheduleDescription(meta.schedule),\n    condition: meta.condition,\n    mode: meta.mode,\n    domain: meta.domain,\n    enabled: meta.enabled,\n    lastStatus: meta.lastStatus,\n    lastRun: meta.lastRun,\n    lastError: meta.lastError,\n    nextRun: nextRunForMeta(meta),\n    createdBy: meta.createdBy,\n    body,\n  };\n}\n\nexport async function listAutomationsForOwner(\n  event: H3Event,\n  userEmail: string,\n): Promise<AutomationRouteItem[]> {\n  const allResources = await resourceListAllOwners(\"jobs/\");\n  const resources = allResources.filter(\n    (resource) =>\n      (resource.owner === userEmail || resource.owner === SHARED_OWNER) &&\n      resource.path.endsWith(\".md\") &&\n      !resource.path.endsWith(\".keep\"),\n  );\n  return Promise.all(\n    resources.map((resource) =>\n      resourceToAutomationItem(event, userEmail, resource),\n    ),\n  );\n}\n\nexport async function setAutomationEnabledForOwner(\n  event: H3Event,\n  userEmail: string,\n  input: SetAutomationEnabledInput,\n): Promise<AutomationRouteItem> {\n  if (typeof input.enabled !== \"boolean\") {\n    throw Object.assign(new Error(\"enabled must be a boolean\"), {\n      statusCode: 400,\n    });\n  }\n\n  const path = normalizeAutomationPath(input);\n  const requestedOwner =\n    input.owner === SHARED_OWNER ? SHARED_OWNER : userEmail;\n  const resource = await resourceGetByPath(requestedOwner, path);\n  if (!resource) {\n    throw Object.assign(new Error(\"Automation not found\"), { statusCode: 404 });\n  }\n\n  const { meta, body } = parseTriggerFrontmatter(resource.content);\n  const allowed = await currentUserCanUpdateAutomation(\n    event,\n    userEmail,\n    resource.owner,\n    meta,\n  );\n  if (!allowed) {\n    throw Object.assign(\n      new Error(\"Only the automation creator or an org admin can update it.\"),\n      { statusCode: 403 },\n    );\n  }\n\n  meta.enabled = input.enabled;\n  if (\n    meta.enabled &&\n    meta.triggerType !== \"event\" &&\n    meta.schedule &&\n    isValidCron(meta.schedule)\n  ) {\n    meta.nextRun = nextOccurrence(meta.schedule).toISOString();\n  }\n\n  await resourcePut(\n    resource.owner,\n    resource.path,\n    buildTriggerContent(meta, body),\n  );\n  await refreshEventSubscriptions();\n\n  return resourceToAutomationItem(event, userEmail, {\n    ...resource,\n    content: buildTriggerContent(meta, body),\n  });\n}\n\nfunction routeError(event: H3Event, err: unknown, fallback: string) {\n  const statusCode =\n    typeof (err as any)?.statusCode === \"number\"\n      ? (err as any).statusCode\n      : 500;\n  setResponseStatus(event, statusCode);\n  return { error: (err as any)?.message ?? fallback };\n}\n\nexport function createAutomationsHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    const method = getMethod(event);\n    const pathname = (event.path || event.url?.pathname || \"\")\n      .split(\"?\")[0]\n      .replace(/^\\/+/, \"\")\n      .replace(/\\/+$/, \"\");\n\n    const session = await getSession(event).catch(() => null);\n    if (!session?.email) {\n      setResponseStatus(event, 401);\n      return { error: \"Unauthenticated\" };\n    }\n\n    if (\n      (pathname === \"fire-test\" || pathname.endsWith(\"/fire-test\")) &&\n      method === \"POST\"\n    ) {\n      try {\n        const { emit } = await import(\"../event-bus/index.js\");\n        const body = (await readBody(event).catch(() => ({}))) as Record<\n          string,\n          unknown\n        >;\n        emit(\n          \"test.event.fired\",\n          { data: body.data ?? {} },\n          { owner: session.email },\n        );\n        return { ok: true };\n      } catch (err) {\n        return routeError(event, err, \"Failed to emit test event\");\n      }\n    }\n\n    if (method === \"GET\") {\n      try {\n        return await listAutomationsForOwner(event, session.email);\n      } catch (err) {\n        return routeError(event, err, \"Failed to list automations\");\n      }\n    }\n\n    if (method === \"PATCH\" || method === \"PUT\") {\n      try {\n        const body = (await readBody(event).catch(\n          () => ({}),\n        )) as SetAutomationEnabledInput | null;\n        return await setAutomationEnabledForOwner(event, session.email, {\n          owner: body?.owner,\n          path: body?.path,\n          name: body?.name,\n          enabled: (body as any)?.enabled,\n        } as SetAutomationEnabledInput);\n      } catch (err) {\n        return routeError(event, err, \"Failed to update automation\");\n      }\n    }\n\n    setResponseStatus(event, 405);\n    return { error: \"Method not allowed\" };\n  });\n}\n"]}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/triggers/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GAEjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,EACX,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAgC5D,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAoB;IAChD,OAAO;QACL,GAAG,IAAI;QACP,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,UAAU;QAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAgC;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACzB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EACnB,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,+CAA+C,CAAC,EAC1D;YACE,UAAU,EAAE,GAAG;SAChB,CACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA4B;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,IACE,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,WAAW,KAAK,OAAO;QAC5B,IAAI,CAAC,QAAQ;QACb,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC1B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,KAAc,EACd,SAAiB,EACjB,QAAkB,EAClB,IAAwB;IAExB,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;IACrC,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,aAAa,GAAG,+BAA+B,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,KAAK,KAAK,aAAa;gBAAE,OAAO,KAAK,CAAC;YAC9C,OAAO,MAAM,2BAA2B,CACtC,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,EACnC,QAAQ,CACT,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,aAAa,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAEjD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC;aAC3C,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;aAChC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,WAAW,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IAED,IACE,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,SAAiB,EACjB,QAAkB;IAElB,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,MAAM,8BAA8B,CAC7C,KAAK,EACL,SAAS,EACT,QAAQ,EACR,IAAI,CACL;QACD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACpC,mBAAmB,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAc,EACd,SAAiB;IAEjB,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC;SAC3C,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SAChC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,cAAc,GAAG,WAAW;QAChC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,QAAQ,CAAC,KAAK,KAAK,SAAS;YAC5B,QAAQ,CAAC,KAAK,KAAK,YAAY;YAC/B,QAAQ,CAAC,KAAK,KAAK,cAAc,EACjC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,GAAG,CAChB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACzB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CACrD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAc,EACd,SAAiB,EACjB,KAAgC;IAEhC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE;YAC1D,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC;SAC3C,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SAChC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,cAAc,GAAG,WAAW;QAChC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,cAAc,GAClB,KAAK,CAAC,KAAK,KAAK,YAAY;QAC1B,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,cAAc;YAC9B,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAClD,KAAK,EACL,SAAS,EACT,QAAQ,EACR,IAAI,CACL,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,4DAA4D,CAAC,EACvE,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,IACE,MAAM,CAAC,IAAI,CAAC,OAAO;QACnB,IAAI,CAAC,WAAW,KAAK,OAAO;QAC5B,IAAI,CAAC,QAAQ;QACb,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC1B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,yBAAyB,EAAE,CAAC;IAElC,OAAO,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE;QAChD,GAAG,QAAQ;QACX,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,GAAY,EAAE,QAAgB;IAChE,MAAM,UAAU,GACd,OAAQ,GAAW,EAAE,UAAU,KAAK,QAAQ;QAC1C,CAAC,CAAE,GAAW,CAAC,UAAU;QACzB,CAAC,CAAC,GAAG,CAAC;IACV,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACrC,OAAO,EAAE,KAAK,EAAG,GAAW,EAAE,OAAO,IAAI,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACvD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACb,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,IACE,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,KAAK,MAAM,EACjB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;gBACF,IAAI,CACF,kBAAkB,EAClB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,EACzB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,4BAA4B,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CACvC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CACX,CAAqC,CAAC;gBACvC,OAAO,MAAM,4BAA4B,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;oBAC9D,KAAK,EAAE,IAAI,EAAE,KAAK;oBAClB,IAAI,EAAE,IAAI,EAAE,IAAI;oBAChB,IAAI,EAAE,IAAI,EAAE,IAAI;oBAChB,OAAO,EAAG,IAAY,EAAE,OAAO;iBACH,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { canUpdateAutomationResource } from \"../automations/service.js\";\nimport { getDbExec } from \"../db/client.js\";\nimport { nextOccurrence, describeCron, isValidCron } from \"../jobs/cron.js\";\nimport {\n  buildJobResourceContent,\n  parseJobResource,\n  type JobFrontmatter,\n} from \"../jobs/frontmatter.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport {\n  organizationIdFromResourceOwner,\n  organizationResourceOwner,\n  resourceGetByPath,\n  resourceListAllOwners,\n  resourcePut,\n  SHARED_OWNER,\n  type Resource,\n} from \"../resources/store.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { refreshEventSubscriptions } from \"./dispatcher.js\";\nimport type { TriggerFrontmatter } from \"./types.js\";\n\nexport interface AutomationRouteItem {\n  id: string;\n  name: string;\n  path: string;\n  owner: string;\n  canUpdate: boolean;\n  triggerType: TriggerFrontmatter[\"triggerType\"];\n  event?: string;\n  schedule?: string;\n  scheduleDescription?: string;\n  condition?: string;\n  mode: TriggerFrontmatter[\"mode\"];\n  domain?: string;\n  enabled: boolean;\n  lastStatus?: TriggerFrontmatter[\"lastStatus\"];\n  lastRun?: string;\n  lastError?: string;\n  nextRun?: string;\n  createdBy?: string;\n  body: string;\n}\n\ninterface SetAutomationEnabledInput {\n  owner?: string;\n  path?: string;\n  name?: string;\n  enabled: boolean;\n}\n\nfunction automationName(path: string): string {\n  return path.replace(/^jobs\\//, \"\").replace(/\\.md$/, \"\");\n}\n\nfunction asTriggerFrontmatter(meta: JobFrontmatter): TriggerFrontmatter {\n  return {\n    ...meta,\n    triggerType: meta.triggerType ?? \"schedule\",\n    mode: meta.mode ?? \"agentic\",\n  };\n}\n\nfunction normalizeAutomationPath(input: SetAutomationEnabledInput): string {\n  const rawPath = input.path ?? (input.name ? `jobs/${input.name}.md` : \"\");\n  const path = rawPath.replace(/^\\/+/, \"\");\n  if (\n    !path.startsWith(\"jobs/\") ||\n    !path.endsWith(\".md\") ||\n    path.endsWith(\".keep\") ||\n    path.includes(\"..\")\n  ) {\n    throw Object.assign(\n      new Error(\"A valid jobs/*.md automation path is required\"),\n      {\n        statusCode: 400,\n      },\n    );\n  }\n  return path;\n}\n\nfunction scheduleDescription(schedule: string | undefined): string | undefined {\n  if (!schedule) return undefined;\n  try {\n    return describeCron(schedule);\n  } catch {\n    return schedule;\n  }\n}\n\nfunction nextRunForMeta(meta: TriggerFrontmatter): string | undefined {\n  if (meta.nextRun) return meta.nextRun;\n  if (\n    meta.enabled &&\n    meta.triggerType !== \"event\" &&\n    meta.schedule &&\n    isValidCron(meta.schedule)\n  ) {\n    try {\n      return nextOccurrence(meta.schedule).toISOString();\n    } catch {\n      return undefined;\n    }\n  }\n  return undefined;\n}\n\nasync function currentUserCanUpdateAutomation(\n  event: H3Event,\n  userEmail: string,\n  resource: Resource,\n  meta: TriggerFrontmatter,\n): Promise<boolean> {\n  const resourceOwner = resource.owner;\n  if (resourceOwner === userEmail) return true;\n  const resourceOrgId = organizationIdFromResourceOwner(resourceOwner);\n  if (resourceOrgId) {\n    try {\n      const org = await getOrgContext(event);\n      if (org.orgId !== resourceOrgId) return false;\n      return await canUpdateAutomationResource(\n        { userEmail, orgId: resourceOrgId },\n        resource,\n      );\n    } catch {\n      return false;\n    }\n  }\n  if (resourceOwner !== SHARED_OWNER) return false;\n\n  if (meta.orgId) {\n    const activeOrgId = await getOrgContext(event)\n      .then((context) => context.orgId)\n      .catch(() => null);\n    if (activeOrgId !== meta.orgId) return false;\n  }\n\n  if (\n    meta.createdBy &&\n    meta.createdBy.toLowerCase() === userEmail.toLowerCase()\n  ) {\n    return true;\n  }\n\n  let orgId = meta.orgId;\n  if (!orgId) {\n    try {\n      orgId = (await getOrgContext(event)).orgId ?? undefined;\n    } catch {\n      orgId = undefined;\n    }\n  }\n  if (!orgId) return false;\n\n  try {\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n      args: [orgId, userEmail.toLowerCase()],\n    });\n    const role = String((rows[0] as any)?.role ?? \"\").toLowerCase();\n    return role === \"owner\" || role === \"admin\";\n  } catch {\n    return false;\n  }\n}\n\nasync function resourceToAutomationItem(\n  event: H3Event,\n  userEmail: string,\n  resource: Resource,\n): Promise<AutomationRouteItem> {\n  const parsed = parseJobResource(resource.content);\n  const meta = asTriggerFrontmatter(parsed.meta);\n  return {\n    id: resource.id,\n    name: automationName(resource.path),\n    path: resource.path,\n    owner: resource.owner,\n    canUpdate: await currentUserCanUpdateAutomation(\n      event,\n      userEmail,\n      resource,\n      meta,\n    ),\n    triggerType: meta.triggerType,\n    event: meta.event,\n    schedule: meta.schedule || undefined,\n    scheduleDescription: scheduleDescription(meta.schedule),\n    condition: meta.condition,\n    mode: meta.mode,\n    domain: meta.domain,\n    enabled: meta.enabled,\n    lastStatus: meta.lastStatus,\n    lastRun: meta.lastRun,\n    lastError: meta.lastError,\n    nextRun: nextRunForMeta(meta),\n    createdBy: meta.createdBy,\n    body: parsed.body,\n  };\n}\n\nexport async function listAutomationsForOwner(\n  event: H3Event,\n  userEmail: string,\n): Promise<AutomationRouteItem[]> {\n  const allResources = await resourceListAllOwners(\"jobs/\");\n  const activeOrgId = await getOrgContext(event)\n    .then((context) => context.orgId)\n    .catch(() => null);\n  const activeOrgOwner = activeOrgId\n    ? organizationResourceOwner(activeOrgId)\n    : null;\n  const resources = allResources.filter((resource) => {\n    if (!resource.path.endsWith(\".md\") || resource.path.endsWith(\".keep\")) {\n      return false;\n    }\n    if (\n      resource.owner !== userEmail &&\n      resource.owner !== SHARED_OWNER &&\n      resource.owner !== activeOrgOwner\n    ) {\n      return false;\n    }\n    if (resource.owner !== SHARED_OWNER) return true;\n    const { meta } = parseJobResource(resource.content);\n    return !meta.orgId || meta.orgId === activeOrgId;\n  });\n  return Promise.all(\n    resources.map((resource) =>\n      resourceToAutomationItem(event, userEmail, resource),\n    ),\n  );\n}\n\nexport async function setAutomationEnabledForOwner(\n  event: H3Event,\n  userEmail: string,\n  input: SetAutomationEnabledInput,\n): Promise<AutomationRouteItem> {\n  if (typeof input.enabled !== \"boolean\") {\n    throw Object.assign(new Error(\"enabled must be a boolean\"), {\n      statusCode: 400,\n    });\n  }\n\n  const path = normalizeAutomationPath(input);\n  const activeOrgId = await getOrgContext(event)\n    .then((context) => context.orgId)\n    .catch(() => null);\n  const activeOrgOwner = activeOrgId\n    ? organizationResourceOwner(activeOrgId)\n    : null;\n  const requestedOwner =\n    input.owner === SHARED_OWNER\n      ? SHARED_OWNER\n      : input.owner === activeOrgOwner\n        ? activeOrgOwner\n        : userEmail;\n  const resource = await resourceGetByPath(requestedOwner, path);\n  if (!resource) {\n    throw Object.assign(new Error(\"Automation not found\"), { statusCode: 404 });\n  }\n\n  const parsed = parseJobResource(resource.content);\n  const meta = asTriggerFrontmatter(parsed.meta);\n  const allowed = await currentUserCanUpdateAutomation(\n    event,\n    userEmail,\n    resource,\n    meta,\n  );\n  if (!allowed) {\n    throw Object.assign(\n      new Error(\"Only the automation creator or an org admin can update it.\"),\n      { statusCode: 403 },\n    );\n  }\n\n  parsed.meta.enabled = input.enabled;\n  if (\n    parsed.meta.enabled &&\n    meta.triggerType !== \"event\" &&\n    meta.schedule &&\n    isValidCron(meta.schedule)\n  ) {\n    parsed.meta.nextRun = nextOccurrence(meta.schedule).toISOString();\n  }\n\n  const updatedContent = buildJobResourceContent(parsed.meta, parsed.body);\n  await resourcePut(resource.owner, resource.path, updatedContent);\n  await refreshEventSubscriptions();\n\n  return resourceToAutomationItem(event, userEmail, {\n    ...resource,\n    content: updatedContent,\n  });\n}\n\nfunction routeError(event: H3Event, err: unknown, fallback: string) {\n  const statusCode =\n    typeof (err as any)?.statusCode === \"number\"\n      ? (err as any).statusCode\n      : 500;\n  setResponseStatus(event, statusCode);\n  return { error: (err as any)?.message ?? fallback };\n}\n\nexport function createAutomationsHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    const method = getMethod(event);\n    const pathname = (event.path || event.url?.pathname || \"\")\n      .split(\"?\")[0]\n      .replace(/^\\/+/, \"\")\n      .replace(/\\/+$/, \"\");\n\n    const session = await getSession(event).catch(() => null);\n    if (!session?.email) {\n      setResponseStatus(event, 401);\n      return { error: \"Unauthenticated\" };\n    }\n\n    if (\n      (pathname === \"fire-test\" || pathname.endsWith(\"/fire-test\")) &&\n      method === \"POST\"\n    ) {\n      try {\n        const { emit } = await import(\"../event-bus/index.js\");\n        const body = (await readBody(event).catch(() => ({}))) as Record<\n          string,\n          unknown\n        >;\n        emit(\n          \"test.event.fired\",\n          { data: body.data ?? {} },\n          { owner: session.email },\n        );\n        return { ok: true };\n      } catch (err) {\n        return routeError(event, err, \"Failed to emit test event\");\n      }\n    }\n\n    if (method === \"GET\") {\n      try {\n        return await listAutomationsForOwner(event, session.email);\n      } catch (err) {\n        return routeError(event, err, \"Failed to list automations\");\n      }\n    }\n\n    if (method === \"PATCH\" || method === \"PUT\") {\n      try {\n        const body = (await readBody(event).catch(\n          () => ({}),\n        )) as SetAutomationEnabledInput | null;\n        return await setAutomationEnabledForOwner(event, session.email, {\n          owner: body?.owner,\n          path: body?.path,\n          name: body?.name,\n          enabled: (body as any)?.enabled,\n        } as SetAutomationEnabledInput);\n      } catch (err) {\n        return routeError(event, err, \"Failed to update automation\");\n      }\n    }\n\n    setResponseStatus(event, 405);\n    return { error: \"Method not allowed\" };\n  });\n}\n"]}

package/dist/triggers/types.d.ts

@@ -5,15 +5,10 @@
  * and scheduler infrastructure. Event-triggered jobs are skipped by the
  * cron scheduler and dispatched by the event bus instead.
  */
-export interface TriggerFrontmatter {
-    schedule: string;
-    enabled: boolean;
+import type { JobExecutionMode, JobFrontmatter, JobTriggerType } from "../jobs/frontmatter.js";
+export interface TriggerFrontmatter extends JobFrontmatter {
     /** "schedule" = cron-based (legacy jobs). "event" = fires on bus event. */
-    triggerType: "schedule" | "event";
-    /** For event triggers: the event name to subscribe to. */
-    event?: string;
-    /** Natural-language condition evaluated by Haiku before dispatch. */
-    condition?: string;
+    triggerType: JobTriggerType;
     /**
      * "agentic" = full runAgentLoop; the only mode `manage-automations` will
      * define/update going forward. "deterministic" was removed from the
@@ -21,21 +16,7 @@ export interface TriggerFrontmatter {
      * before the removal may still carry it, and the dispatcher's
      * warn-and-skip branch keeps them inert by design — do not make them fire.
      */
-    mode: "agentic" | "deterministic";
-    /** Domain tag for filtering in per-template UIs. */
-    domain?: string;
-    /**
-     * Optional application-owned policy id carried into actions by the trusted
-     * trigger dispatcher. It is not model-supplied action input.
-     */
-    delegatedPolicyId?: string;
-    createdBy?: string;
-    orgId?: string;
-    runAs?: "creator" | "shared";
-    lastRun?: string;
-    lastStatus?: "success" | "error" | "running" | "skipped";
-    lastError?: string;
-    nextRun?: string;
+    mode: JobExecutionMode;
 }
 export interface TriggerDispatchContext {
     triggerName: string;

package/dist/triggers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/triggers/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,EAAE,UAAU,GAAG,OAAO,CAAC;IAClC,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,GAAG,eAAe,CAAC;IAClC,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/triggers/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,cAAc,EACf,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,2EAA2E;IAC3E,WAAW,EAAE,cAAc,CAAC;IAC5B;;;;;;OAMG;IACH,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB"}

package/dist/triggers/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/triggers/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Extended frontmatter for triggers (superset of JobFrontmatter).\n *\n * Stored as markdown resources under `jobs/` — reuses the same storage\n * and scheduler infrastructure. Event-triggered jobs are skipped by the\n * cron scheduler and dispatched by the event bus instead.\n */\n\nexport interface TriggerFrontmatter {\n  schedule: string;\n  enabled: boolean;\n  /** \"schedule\" = cron-based (legacy jobs). \"event\" = fires on bus event. */\n  triggerType: \"schedule\" | \"event\";\n  /** For event triggers: the event name to subscribe to. */\n  event?: string;\n  /** Natural-language condition evaluated by Haiku before dispatch. */\n  condition?: string;\n  /**\n   * \"agentic\" = full runAgentLoop; the only mode `manage-automations` will\n   * define/update going forward. \"deterministic\" was removed from the\n   * advertised surface (never implemented) and is legacy-only: rows created\n   * before the removal may still carry it, and the dispatcher's\n   * warn-and-skip branch keeps them inert by design — do not make them fire.\n   */\n  mode: \"agentic\" | \"deterministic\";\n  /** Domain tag for filtering in per-template UIs. */\n  domain?: string;\n  /**\n   * Optional application-owned policy id carried into actions by the trusted\n   * trigger dispatcher. It is not model-supplied action input.\n   */\n  delegatedPolicyId?: string;\n  createdBy?: string;\n  orgId?: string;\n  runAs?: \"creator\" | \"shared\";\n  lastRun?: string;\n  lastStatus?: \"success\" | \"error\" | \"running\" | \"skipped\";\n  lastError?: string;\n  nextRun?: string;\n}\n\nexport interface TriggerDispatchContext {\n  triggerName: string;\n  triggerBody: string;\n  meta: TriggerFrontmatter;\n  eventPayload?: unknown;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/triggers/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Extended frontmatter for triggers (superset of JobFrontmatter).\n *\n * Stored as markdown resources under `jobs/` — reuses the same storage\n * and scheduler infrastructure. Event-triggered jobs are skipped by the\n * cron scheduler and dispatched by the event bus instead.\n */\n\nimport type {\n  JobExecutionMode,\n  JobFrontmatter,\n  JobTriggerType,\n} from \"../jobs/frontmatter.js\";\n\nexport interface TriggerFrontmatter extends JobFrontmatter {\n  /** \"schedule\" = cron-based (legacy jobs). \"event\" = fires on bus event. */\n  triggerType: JobTriggerType;\n  /**\n   * \"agentic\" = full runAgentLoop; the only mode `manage-automations` will\n   * define/update going forward. \"deterministic\" was removed from the\n   * advertised surface (never implemented) and is legacy-only: rows created\n   * before the removal may still carry it, and the dispatcher's\n   * warn-and-skip branch keeps them inert by design — do not make them fire.\n   */\n  mode: JobExecutionMode;\n}\n\nexport interface TriggerDispatchContext {\n  triggerName: string;\n  triggerBody: string;\n  meta: TriggerFrontmatter;\n  eventPayload?: unknown;\n}\n"]}

package/docs/content/agent-surfaces.mdx

@@ -59,7 +59,7 @@ The shared page currently provides twelve tabs across two groups:
 | Resources | **Remote agents** | A2A connections to other agent-native apps — this replaces what the Connections tab used to also show                                                                                                                |
 | Agent     | **Snapshots**     | A scope preview, token budget, ordered system sections grouped by provenance/governance/source, and the latest live-thread snapshot. Renamed from "Context"; old `#context` links redirect here.                     |
 | Agent     | **Connections**   | MCP server management only                                                                                                                                                                                           |
-| Agent     | **Jobs**          | Scoped recurring jobs and automations, with the existing pause/resume, details, and delete flows. Automations are personal-only today.                                                                               |
+| Agent     | **Automations**   | Personal and organization Scheduled/Event automations with pause/resume, details, and delete flows. The stable compatibility URL remains `/agent#jobs`.                                                              |
 | Agent     | **Settings**      | Agent model, API keys, limits, voice, and automation settings                                                                                                                                                        |
 | Agent     | **Access**        | The app MCP URL, an A2A agent card when available, and shared setup guides for Claude, ChatGPT, Cursor, Claude Code, Codex, and other clients. Links to `/mcp/connect` for the full connect flow and token fallback. |
 
@@ -165,9 +165,9 @@ is no "browse-everything-at-a-glance" view; if users need that, start from
 
 When you add the built-in Chat shell, the framework provides five management
 surfaces you don't have to build: **Chat** (the main input), **Resources**
-(skills, memory, instructions, sub-agents, connected MCP servers, scheduled
-jobs), **Job history**, **Thread history**, and **Settings**. Those are usually
-enough — talk to it, see what it's done, configure how it behaves. Reach for
+(skills, memory, instructions, sub-agents, and connected MCP servers),
+**Automations**, **Thread history**, and **Settings**. Those are usually enough
+— talk to it, see what it's done, configure how it behaves. Reach for
 [Chat](/docs/template-chat) when you're ready to add that browser UI, or the
 [Dispatch template](/docs/template-dispatch) for a workspace-style starting
 point with Slack/Telegram, scheduled jobs, and shared secrets out of the box.

package/docs/content/automations.mdx

@@ -5,9 +5,17 @@ description: "Event-triggered and scheduled automations with natural-language co
 
 # Automations
 
-An **automation** is a rule: _when X happens, do Y_ — described in natural language. The agent executes the instructions, so automations have access to every action, tool, and MCP server the agent can use in an interactive chat.
-
-Automations extend [recurring jobs](/docs/recurring-jobs) with **event triggers**, **natural-language conditions**, and **outbound HTTP** via the `web-request` tool. They use the same `jobs/<name>.md` file format, storage, and "create three ways" workflow as recurring jobs — see [Recurring Jobs](/docs/recurring-jobs#job-file) for the shared format. This page covers only what's new for event-driven automations.
+An **automation** is an agent-executed task that fires on a schedule or when an
+event occurs: _when X happens, do Y_. **Scheduled** and **Event** are the two
+trigger types, not separate products. The agent executes the instructions with
+the same action and tool lifecycle as interactive chat; connected MCP access is
+limited to the automation's explicit `mcpTools` allowlist.
+
+The framework originally exposed scheduled automations as **Recurring Jobs**.
+That name, the `jobs/<name>.md` storage path, and the `manage-jobs` tool remain
+for compatibility. New product guidance uses **Automations** as the umbrella;
+see [Recurring Jobs](/docs/recurring-jobs) when maintaining a legacy
+schedule-only integration or working with scheduler internals.
 
 <Diagram id="doc-block-jdto24" title="When X happens, do Y" summary="An event fires on the bus, an optional natural-language condition gates it, and the agent runs the automation body with full tool access.">
 
@@ -72,9 +80,21 @@ Event triggers can include a `condition` — a natural-language string evaluated
 
 The agent discovers available events, confirms the plan, and writes the automation for you.
 
-### From the settings UI
+### From the Automations UI
+
+Open **Automations** on the full-page Agent surface. It is the primary place to
+view scheduled and event-triggered automations, inspect status, pause or resume
+them, and delete them. Its compatibility URL remains `/agent#jobs`, so existing
+links and bookmarks continue to work.
+
+<Callout tone="info">
+
+**Personal and organization automations use the same management surface.**
+Organization event automations are visible to members but always run as their
+creator. An administrator can manage the definition, but cannot change who it
+runs as.
 
-Automations appear in the settings panel. Users can view, enable/disable, and delete them there.
+</Callout>
 
 The third path — writing the `jobs/<name>.md` file by hand via `resourcePut` — works exactly as it does for [recurring jobs](/docs/recurring-jobs#creating). For an event-driven automation you add the event-trigger frontmatter below to that same file. An event-triggered job sets `schedule: ""` and supplies `triggerType: event`, an `event` name, and an optional `condition`:
 
@@ -124,6 +144,26 @@ Automations share every field in the [recurring-jobs frontmatter table](/docs/re
 
 For an event trigger, `schedule` is `""` (empty); for a schedule trigger it carries the cron expression. The dispatcher also writes the same managed `lastRun` / `lastStatus` / `lastError` fields the scheduler does, plus a `"skipped"` status when a condition evaluates to false.
 
+`model` selects a per-automation model. `mcpTools` is an explicit list of MCP
+tool names such as `mcp__server__tool`. The shared execution runner exposes
+only those configured MCP tools and fails clearly if a named tool or its
+connected grant is unavailable.
+
+### Organization execution identity {#organization-identity}
+
+Organization Scheduled and Event automations are shared for visibility and
+management, not execution identity:
+
+- `createdBy` is required for an organization event automation, and `runAs` is
+  `creator`.
+- Event automations match only events emitted for that creator. An
+  organization-scoped automation is not an organization-wide event broadcast.
+- Organization administrators may update or delete the automation, but cannot
+  replace `createdBy` or retarget its identity.
+- Before execution, the framework verifies that the creator still exists and
+  remains an organization member. If the creator was removed—or membership
+  cannot be verified—the automation does not run.
+
 ## The event bus {#event-bus}
 
 Integrations register events at module load time. The bus validates payloads against [Standard Schema](https://standardschema.dev) definitions and dispatches to subscribers.
@@ -178,7 +218,9 @@ emit(
 );
 ```
 
-The `owner` in the emit metadata scopes which automations fire — only automations owned by the same user (or shared automations) are evaluated.
+The `owner` in the emit metadata scopes which automations fire. Personal and
+organization event automations both require an exact match with their
+`createdBy` identity.
 
 ## Conditions {#conditions}
 
@@ -247,7 +289,8 @@ Keys are ad-hoc secrets created by users or the agent for automation use (e.g. `
 
 ## Agent tools {#agent-tools}
 
-All automation operations are accessed through a single `manage-automations` tool with an `action` parameter:
+Trigger-aware personal and organization operations use `manage-automations`
+with an `action` parameter:
 
 | Action        | Purpose                                                              |
 | ------------- | -------------------------------------------------------------------- |
@@ -260,6 +303,10 @@ All automation operations are accessed through a single `manage-automations` too
 
 Additional tool: `web-request` — outbound HTTP with `${keys.NAME}` substitution.
 
+`define` and `update` accept personal or organization `scope`, a `model`
+override, and an `mcpTools` allowlist. `manage-jobs` remains the compatibility
+tool for existing schedule-only integrations and delivery metadata.
+
 ## API endpoints {#api}
 
 | Endpoint                               | Method | Description                     |
@@ -283,7 +330,7 @@ Confirm an automation's wiring and condition without waiting for a real provider
 
 ## How dispatch works {#dispatch}
 
-<Diagram id="doc-block-1ee1cky" title="The dispatch path" summary="From a fired event to a completed agent run, gated by ownership scope and the natural-language condition.">
+<Diagram id="doc-block-1ee1cky" title="The dispatch path" summary="Event and schedule acquisition stay separate, then converge on one identity-checked background execution lifecycle.">
 
 ```html
 <div class="disp">
@@ -299,7 +346,8 @@ Confirm an automation's wiring and condition without waiting for a real provider
   <div class="diagram-card">
     <span class="diagram-pill">scope</span
     ><small class="diagram-muted"
-      >keep only those owned by the event's owner (or shared)</small
+      >match <code>createdBy</code> to the event owner; verify org
+      membership</small
     >
   </div>
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&darr;</div>
@@ -314,8 +362,8 @@ Confirm an automation's wiring and condition without waiting for a real provider
   <div class="diagram-card accent">
     <span class="diagram-pill accent">run</span
     ><small class="diagram-muted"
-      ><code>runAgentLoop</code> with body as prompt, payload as context, 5-min
-      timeout</small
+      >shared runner resolves identity, model, MCP allowlist, continuation,
+      delivery, and usage</small
     >
   </div>
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&darr;</div>
@@ -380,6 +428,7 @@ notification to my webhook."_
 
 ```yaml filename="jobs/notify-on-plan-comment.md"
 ---
+schedule: ""
 triggerType: event
 event: plan.commented
 condition: "resolutionTarget is human or resolutionTarget is null"
@@ -400,7 +449,7 @@ for the full `plan.commented` payload reference and all four plan events.
 
 ## What's next
 
-- [**Recurring Jobs**](/docs/recurring-jobs) — schedule-triggered automations reuse the same scheduler
+- [**Recurring Jobs**](/docs/recurring-jobs) — legacy compatibility and advanced scheduled-job fields
 - [**Actions**](/docs/actions) — automations can call any registered action via the agent loop
 - [**Workflow Connectors**](/docs/automation-connectors) — pre-configured n8n/Zapier-style workflow invocation, for when ad-hoc `web-request` isn't a strict enough contract
 - [**Security**](/docs/security) — input validation and secret handling

package/docs/content/deployment.mdx

@@ -582,7 +582,13 @@ write tools:
 export default createAgentChatPlugin({
   // Default: "read"
   databaseTools: "read", // "write" | "read" | "off"
-  extensionTools: false,
+  extensionTools: true,
+});
+```
+
+```ts filename="server/plugins/core-routes.ts"
+export default createCoreRoutesPlugin({
+  extensionTools: true,
 });
 ```
 
@@ -593,9 +599,10 @@ export default createAgentChatPlugin({
   current user/org and schema changes are blocked.
 - `databaseTools: "off"` or `false` — removes raw database tools from the
   agent surface so the app's actions are the only data access path.
-- `extensionTools: false` — removes framework extension-management actions and
-  prompt guidance (`create-extension`, `update-extension`, etc.) for apps that
-  do not want the agent creating sandboxed mini-apps.
+- `extensionTools: true` — opts the app into framework extension-management
+  actions and prompt guidance (`create-extension`, `update-extension`, etc.).
+  Set it on both plugins to also allow authenticated REST creation. Extensions
+  are disabled by default.
 
 ## Production Code Execution {#production-code-execution}
 

package/docs/content/extensions.mdx

@@ -1,11 +1,18 @@
 ---
 title: "Extensions"
-description: "Mini-apps your users build inside your template — a custom KPI tile in Analytics, a meeting-prep checklist in Calendar, a contact CRM widget in Mail. No deploys, no code edits, no schema changes."
+description: "An optional toolkit capability for one-off, sandboxed custom blocks. App code remains the default for durable product behavior."
 ---
 
 # Extensions
 
-Extensions are **mini-apps your users build inside your template**.
+Extensions are an **optional toolkit capability for sandboxed custom blocks**.
+They are disabled by default. A template must opt in before its agent can create
+or manage them; Analytics uses this capability for explicitly requested,
+one-off custom visualizations.
+
+For durable behavior, edit the app code. A custom block is an agent-authored
+patch: useful when speed and local specificity matter, but not the default way
+to add a reusable product feature.
 
 When the agent needs a one-time interactive answer inside the chat itself, use
 [Generative UI](/docs/generative-ui) instead. Generative UI uses the same
@@ -37,10 +44,12 @@ Three things make extensions work:
 - **Full access to the template's data.** Extensions can call the same actions the agent calls — `list-emails` in Mail, `list-decks` in Slides, `list-recordings` in Clips — so they have everything the host app has.
 - **Built-in storage.** Each extension has its own per-user / per-org key-value store, so it can save state without you adding a new SQL table.
 
-If a template should not expose user-authored extensions, set
-`extensionTools: false` on `createAgentChatPlugin()`. That removes the
-agent-facing extension actions and prompt guidance while leaving the rest of the
-app agent intact.
+Extensions are disabled by default. To expose user-authored extensions, set
+`extensionTools: true` on both `createAgentChatPlugin()` and
+`createCoreRoutesPlugin()`. The first adds the agent-facing actions and prompt
+guidance; the second permits authenticated creation through
+`POST /_agent-native/extensions`. The sandbox runtime and existing read, edit,
+and deep-link routes remain available for compatibility either way.
 
 <Diagram id="doc-block-l8xkep" title="The sandbox bridge" summary={"Extension HTML runs in an isolated iframe and reaches the host only through a fixed set of bridge helpers — every call is scoped and access-checked."}>
 
@@ -649,33 +658,30 @@ The framework lets the agent edit the app's source code directly — components,
 routes, styles, and business logic. Use this question when either path could
 solve the request:
 
-- **Start with an extension** for a self-contained, relatively one-off widget:
-  a custom visualization or interaction, a dashboard tile, a standalone
-  utility, or an add-on in an existing slot. It is fast, requires no source
-  change, build, or deploy, and can be private or shared.
-- **Use app code** for a core feature of the template, a change to native UI,
-  layout, routes, or business logic, or anything that should be reused broadly
-  across dashboards or users. If the host has no suitable slot or the request
-  needs a new slot, use code.
-- **Promote repeated extensions.** If people keep rebuilding the same
-  extension, or maintaining copies in many places would be worse than one
-  shared implementation, move it into app code as a reusable native feature.
-
-|                       | Extension                                         | App code edit                        |
-| --------------------- | ------------------------------------------------- | ------------------------------------ |
-| **Created by**        | Agent (or user) at runtime                        | Agent editing source files           |
-| **Stored in**         | The database                                      | The git repository                   |
-| **Requires a build**  | No                                                | Yes                                  |
-| **Requires a deploy** | No                                                | Yes                                  |
-| **Scope**             | One user (or shared with org)                     | The entire product, every user       |
-| **Best for**          | Personal widgets, custom KPIs, per-team utilities | Core features that ship to all users |
-
-Rule of thumb: **if an extension can solve the problem, generally start there.**
-Use code when the extension boundary does not fit or when broad reuse and
-product-wide availability justify a native implementation. For example, a
-one-off custom visualization on a dashboard is a good extension; a new pie,
-multi-bar, or line chart type that should be available across dashboards
-belongs in the template code.
+- **Start with app code** for product behavior, native UI, layout, routes,
+  business logic, or anything that should be reused across dashboards or users.
+- **Use a custom block only when the app opts in** and the user explicitly wants
+  a bespoke, one-off visualization or interaction in an existing extension
+  surface. It is fast and requires no build or deploy, but remains a sandboxed
+  agent-authored patch.
+- **Promote durable custom blocks.** If a block becomes useful beyond its
+  original one-off context, use **Promote to app code** to hand it to the normal
+  source-change workflow. Keep the original block in place until the code
+  change is reviewed and deployed.
+
+|                       | Extension                      | App code edit                  |
+| --------------------- | ------------------------------ | ------------------------------ |
+| **Created by**        | Agent (or user) at runtime     | Agent editing source files     |
+| **Stored in**         | The database                   | The git repository             |
+| **Requires a build**  | No                             | Yes                            |
+| **Requires a deploy** | No                             | Yes                            |
+| **Scope**             | One user (or shared with org)  | The entire product, every user |
+| **Best for**          | Explicit one-off custom blocks | Durable product behavior       |
+
+Rule of thumb: **default to app code.** In an app that explicitly enables
+extensions, a one-off custom visualization on a dashboard can be a Custom
+Block; a new pie, multi-bar, or line chart type that should be available across
+dashboards belongs in the template code.
 
 If what you actually need is a cached, refreshable data source for an existing chart or table — not a new interactive widget — see [Data Programs](/docs/data-programs) instead; it shares this page's sandbox and security posture but has no UI of its own.