@agent-native/core 0.146.2 → 0.146.4

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,9 +59,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/action-routes.d.ts

@@ -45,6 +45,8 @@ export interface ActionRouteAuthAdapter {
 export interface MountActionRoutesOptions {
     /** Resolve owner email from the H3 event (for data scoping). */
     getOwnerFromEvent?: (event: any) => string | Promise<string>;
+    /** Hosting app/template id used for app-owned action resources. */
+    appId?: string;
     /** Resolve display name from the H3 event, when available. */
     getUserNameFromEvent?: (event: any) => string | undefined | Promise<string | undefined>;
     /** Resolve org ID from the H3 event (for org scoping). */

package/dist/server/action-routes.js

@@ -423,6 +423,7 @@ export function mountActionRoutes(nitroApp, actions, options) {
                     const result = await entry.run(params, {
                         userEmail,
                         orgId: orgId ?? null,
+                        appId: options?.appId,
                         caller,
                         requestHeaders: event.headers,
                         actionName: name,

package/dist/server/agent-chat-plugin.js

@@ -673,7 +673,7 @@ export function createAgentChatPlugin(options) {
             try {
                 if (automationGroupEnabled) {
                     const { createAutomationToolEntries } = await import("../triggers/actions.js");
-                    automationTools = createAutomationToolEntries(() => requireCurrentRunOwner("manage automations"));
+                    automationTools = createAutomationToolEntries(() => requireCurrentRunOwner("manage automations"), options?.appId);
                 }
             }
             catch { }
@@ -1914,6 +1914,7 @@ export function createAgentChatPlugin(options) {
                 mountActionRoutes(nitroApp, httpActions, {
                     getOwnerFromEvent,
                     getUserNameFromEvent,
+                    appId: options?.appId,
                     resolveOrgId: options?.resolveOrgId,
                     actionRouteAuth: options?.actionRouteAuth,
                 });
@@ -2243,7 +2244,7 @@ export function createAgentChatPlugin(options) {
             try {
                 if (automationGroupEnabled) {
                     const { createJobTools } = await import("../jobs/tools.js");
-                    jobTools = createJobTools();
+                    jobTools = createJobTools(options?.appId);
                 }
             }
             catch { }

package/dist/server/builder-browser.js

@@ -5,6 +5,7 @@ import { getAuthSecret, resolveSignupTrackingIdentity, } from "./better-auth-ins
 import { getAppBasePath, getOrigin } from "./google-oauth.js";
 const DEFAULT_BUILDER_APP_HOST = "https://builder.io";
 const DEFAULT_BUILDER_API_HOST = "https://api.builder.io";
+const BUILDER_API_REQUEST_TIMEOUT_MS = 30_000;
 const BUILDER_BROWSER_HOST = "agent-native-browser";
 const BUILDER_BROWSER_CLIENT_ID = "Agent Native Browser";
 export const BUILDER_CALLBACK_PATH = "/_agent-native/builder/callback";
@@ -1359,6 +1360,21 @@ async function resolveBuilderApiCredentials() {
         publicKey: creds.publicKey,
     };
 }
+async function fetchBuilderApi(input, init, operation) {
+    try {
+        return await fetch(input, {
+            ...init,
+            signal: AbortSignal.timeout(BUILDER_API_REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        const errorName = error instanceof Error ? error.name : "";
+        if (errorName === "AbortError" || errorName === "TimeoutError") {
+            throw new Error(`Builder ${operation} timed out after ${BUILDER_API_REQUEST_TIMEOUT_MS}ms`, { cause: error });
+        }
+        throw error;
+    }
+}
 async function readBuilderApiObject(response, operation) {
     let parsed;
     try {
@@ -1400,10 +1416,10 @@ export async function findBuilderProjectForRepo(args) {
     const url = new URL("/projects", getBuilderApiHost());
     url.searchParams.set("apiKey", creds.publicKey);
     url.searchParams.set("includeHidden", "true");
-    const response = await fetch(url, {
+    const response = await fetchBuilderApi(url, {
         method: "GET",
         headers: { Authorization: `Bearer ${creds.privateKey}` },
-    });
+    }, "project lookup");
     const parsed = await readBuilderApiObject(response, "project lookup");
     if (!response.ok) {
         throw new Error(builderApiErrorMessage(parsed, `Builder project lookup failed (${response.status})`));
@@ -1432,7 +1448,7 @@ export async function createBuilderProject(args) {
     const creds = await resolveBuilderApiCredentials();
     const url = new URL("/projects/create", getBuilderApiHost());
     url.searchParams.set("apiKey", creds.publicKey);
-    const response = await fetch(url, {
+    const response = await fetchBuilderApi(url, {
         method: "POST",
         headers: {
             Authorization: `Bearer ${creds.privateKey}`,
@@ -1442,7 +1458,7 @@ export async function createBuilderProject(args) {
             source: { kind: "repo", repoUrl },
             name,
         }),
-    });
+    }, "project creation");
     const parsed = await readBuilderApiObject(response, "project creation");
     if (!response.ok) {
         throw new Error(builderApiErrorMessage(parsed, `Builder project creation failed (${response.status})`));
@@ -1526,14 +1542,14 @@ export async function runBuilderAgent(args) {
             body.userEmail = actor.userEmail;
         if (actor.userId)
             body.userId = actor.userId;
-        const response = await fetch(url, {
+        const response = await fetchBuilderApi(url, {
             method: "POST",
             headers: {
                 Authorization: `Bearer ${creds.privateKey}`,
                 "Content-Type": "application/json",
             },
             body: JSON.stringify(body),
-        });
+        }, "agent run");
         const parsed = (await response.json().catch(() => ({})));
         return { response, parsed };
     };
@@ -1582,7 +1598,7 @@ export async function requestBuilderBrowserConnection(args) {
     if (creds.userId) {
         url.searchParams.set("userId", creds.userId);
     }
-    const response = await fetch(url, {
+    const response = await fetchBuilderApi(url, {
         method: "POST",
         headers: {
             Authorization: `Bearer ${creds.privateKey}`,
@@ -1596,7 +1612,7 @@ export async function requestBuilderBrowserConnection(args) {
             proxyDefaultOrigin: args.proxyDefaultOrigin || undefined,
             proxyDst: args.proxyDestination || undefined,
         }),
-    });
+    }, "browser connection request");
     const body = (await response.json().catch(() => ({})));
     if (!response.ok) {
         const error = typeof body.error === "string"

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;

package/dist/templates/chat/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/dist/templates/chat/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/dist/templates/chat/netlify.toml

@@ -1,6 +1,6 @@
 [build]
 ignore = "node ./scripts/netlify-ignore-build.mjs chat"
-command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter chat build"
+command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter chat build && if [ \"${CONTEXT:-}\" = \"production\" ]; then pnpm --filter chat migrate:production; fi"
 publish = "templates/chat/dist"
 functions = "templates/chat/.netlify/functions-internal"
 

package/dist/templates/chat/package.json

@@ -5,6 +5,7 @@
   "description": "Minimal chat-first agent-native app template.",
   "type": "module",
   "scripts": {
+    "migrate:production": "tsx scripts/migrate-production.ts",
     "dev": "agent-native dev --open",
     "build": "agent-native build",
     "start": "agent-native start",

package/dist/templates/chat/scripts/migrate-production.ts

@@ -0,0 +1,31 @@
+import { closeDbExec, withMigrationRuntime } from "@agent-native/core/db";
+import { runFrameworkReleaseMigrations } from "@agent-native/core/server";
+
+/**
+ * Release-time schema entrypoint.
+ *
+ * Every deploy runs this once, and request functions never touch schema. That
+ * ordering is not an optimization: on serverless, "migrate on first use" means
+ * migrate on EVERY cold start, and a production incident traced a multi-hour
+ * outage to schema introspection running 4-6 times concurrently on the request
+ * path.
+ *
+ * `withMigrationRuntime()` is load-bearing. The Netlify BUILD environment sets
+ * NETLIFY=true, so this script looks like a serverless request to the guard in
+ * `runMigrations` — it is allowed to migrate only because it claims duty here.
+ * A release entrypoint that forgets the wrapper silently does nothing.
+ *
+ * If this app owns tables of its own, export its migration runner from
+ * `server/plugins/db.ts` and call it inside the same block.
+ */
+async function main(): Promise<void> {
+  await withMigrationRuntime(async () => {
+    await runFrameworkReleaseMigrations(null);
+  });
+}
+
+try {
+  await main();
+} finally {
+  await closeDbExec();
+}

package/dist/templates/chat/tsconfig.json

@@ -13,6 +13,7 @@
     "app/**/*",
     "server/**/*",
     "shared/**/*",
+    "scripts/**/*",
     "vite.config.ts",
     "react-router.config.ts",
     ".react-router/types/**/*",

package/dist/templates/default/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/dist/templates/default/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/dist/templates/default/package.json

@@ -11,6 +11,7 @@
     "agent-native:doctor": "agent-native doctor",
     "action": "agent-native action",
     "script": "agent-native script",
+    "migrate:production": "tsx scripts/migrate-production.ts",
     "skills:update": "agent-native skills update scaffold --project",
     "upgrade:agent-native": "agent-native upgrade"
   },

package/dist/templates/default/scripts/migrate-production.ts

@@ -0,0 +1,31 @@
+import { closeDbExec, withMigrationRuntime } from "@agent-native/core/db";
+import { runFrameworkReleaseMigrations } from "@agent-native/core/server";
+
+/**
+ * Release-time schema entrypoint.
+ *
+ * Every deploy runs this once, and request functions never touch schema. That
+ * ordering is not an optimization: on serverless, "migrate on first use" means
+ * migrate on EVERY cold start, and a production incident traced a multi-hour
+ * outage to schema introspection running 4-6 times concurrently on the request
+ * path.
+ *
+ * `withMigrationRuntime()` is load-bearing. The Netlify BUILD environment sets
+ * NETLIFY=true, so this script looks like a serverless request to the guard in
+ * `runMigrations` — it is allowed to migrate only because it claims duty here.
+ * A release entrypoint that forgets the wrapper silently does nothing.
+ *
+ * If this app owns tables of its own, export its migration runner from
+ * `server/plugins/db.ts` and call it inside the same block.
+ */
+async function main(): Promise<void> {
+  await withMigrationRuntime(async () => {
+    await runFrameworkReleaseMigrations(null);
+  });
+}
+
+try {
+  await main();
+} finally {
+  await closeDbExec();
+}

package/dist/templates/default/tsconfig.json

@@ -4,6 +4,7 @@
     "app/**/*",
     "server/**/*",
     "shared/**/*",
+    "scripts/**/*",
     "vite.config.ts",
     "react-router.config.ts",
     ".react-router/types/**/*",

package/dist/templates/headless/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/dist/templates/workspace-core/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/dist/templates/workspace-core/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/dist/templates/workspace-root/AGENTS.md

@@ -36,7 +36,8 @@ Preview before `--apply`, commit `agent-native.ejections.json`, and never edit
 To bring an older workspace current, run `pnpm upgrade:agent-native` or
 `npx @agent-native/core@latest upgrade` from the workspace root. That bumps
 `@agent-native/*` deps, installs, refreshes scaffold skills, and typechecks.
-Do **not** add `pnpm.overrides` / patches against `@agent-native/*` or edit
+Do **not** run `pnpm patch` / `pnpm patch-commit`, add
+`pnpm.patchedDependencies`, commit dependency patches, or edit
 `node_modules/@agent-native/*` when an upgrade fails — fix app code or ask.
 See the `upgrade-agent-native` and `self-modifying-code` skills.
 After a manual core bump only, `pnpm skills:update` (or

package/dist/triggers/actions/list-automations.js

@@ -35,7 +35,7 @@ export default defineAction({
         const userEmail = ctx?.userEmail;
         if (!userEmail)
             throw new Error("Not authenticated.");
-        const definitions = await listAutomationDefinitions({ userEmail, orgId: ctx?.orgId }, scope);
+        const definitions = await listAutomationDefinitions({ userEmail, orgId: ctx?.orgId, appId: ctx?.appId }, scope);
         return definitions.map(({ resource, name, meta, body, canUpdate }) => ({
             id: resource.id,
             name,

package/dist/triggers/actions/manage-automation.js

@@ -17,7 +17,11 @@ export default defineAction({
         const userEmail = ctx?.userEmail;
         if (!userEmail)
             throw new Error("Not authenticated.");
-        const actor = { userEmail, orgId: ctx?.orgId };
+        const actor = {
+            userEmail,
+            orgId: ctx?.orgId,
+            appId: ctx?.appId,
+        };
         if (operation === "delete") {
             await deleteAutomation(actor, scope, name);
             await refreshEventSubscriptions();

package/dist/triggers/actions.d.ts

@@ -9,4 +9,4 @@
  * with an `action` discriminator to keep the tool registry compact.
  */
 import type { ActionEntry } from "../agent/production-agent.js";
-export declare function createAutomationToolEntries(getCurrentUser: () => string): Record<string, ActionEntry>;
+export declare function createAutomationToolEntries(getCurrentUser: () => string, appId?: string): Record<string, ActionEntry>;