@agent-native/core 0.15.12 → 0.16.0

package/dist/sharing/actions/share-resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"share-resource.js","sourceRoot":"","sources":["../../../src/sharing/actions/share-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,CAAC,MAAM,KAAK,cAAc;YACxB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxB,MAAM,KAAK,iBAAiB;YAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnD,MAAM,mBAAmB,GACvB,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,mBAAmB;gBAChC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE;gBACzB,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;YAC3C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,WAA+B,EAC/B,YAAgC,EAChC,MAAM,GAAG,mBAAmB,EAAE;IAE9B,KAAK,MAAM,SAAS,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,GAAG,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,IAAI,GAAG,EAAE;IACvB,MAAM,KAAK,GACT,gEAAgE,CAAC;IACnE,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,yEAAyE;QAC9E,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACnC,GAAG,EAAE,oGAAoG;QACzG,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,mFAAmF;IACrF,sEAAsE;IACtE,qEAAqE;IACrE,gEAAgE;IAChE,sDAAsD;IACtD,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,CAAC,oDAAoD,CAAC;QACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC/D,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;aACrB,QAAQ,CAAC,2DAA2D,CAAC;QACxE,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;aACnC,OAAO,CAAC,QAAQ,CAAC;aACjB,QAAQ,CAAC,gBAAgB,CAAC;QAC7B,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,2EAA2E,CAC5E;QACH,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,gGAAgG,CACjG;KACJ,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;QACF,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;QAEtD,IAAI,GAAG,CAAC,6BAA6B,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAkC,CAAC;YAC1E,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,wFAAwF,CAC3G,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBAClC,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACvE,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,IAAI,cAAc,CACtB,GAAG,IAAI,CAAC,WAAW,kFAAkF,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxC,8DAA8D;gBAC9D,gEAAgE;gBAChE,6DAA6D;gBAC7D,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;oBACvC,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,qEAAqE,CACxF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;aACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EACrD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAClD,CACF,CAAC;QAEJ,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,EAAE;iBACL,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;iBACvB,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;YACtC,EAAE;YACF,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QAEH,IACE,IAAI,CAAC,MAAM,KAAK,KAAK;YACrB,IAAI,CAAC,aAAa,KAAK,MAAM;YAC7B,iBAAiB,EAAE;YACnB,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC;gBAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;qBACxB,MAAM,EAAE;qBACR,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;qBACvB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBACpD,MAAM,aAAa,GAChB,QAAQ,EAAE,CAAC,QAAQ,CAAwB,IAAI,IAAI,CAAC,YAAY,CAAC;gBACpE,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBACrC,MAAM,YAAY,GAChB,QAAQ,IAAI,GAAG,CAAC,eAAe;oBAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC;oBAC/B,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,eAAe,GAAG,2BAA2B,CACjD,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,MAAM,CACP,CAAC;gBACF,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,cAAc,CAAC;gBACtE,MAAM,OAAO,GAAG,GAAG,KAAK,YAAY,aAAa,iBAAiB,OAAO,EAAE,CAAC;gBAC5E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;oBACjC,SAAS,EAAE,OAAO;oBAClB,OAAO,EAAE,0BAA0B;oBACnC,UAAU,EAAE;wBACV,GAAG,WAAW,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,aAAa,CAAC,kBAAkB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBAChI,8DAA8D,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;qBAC/F;oBACD,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;oBAC/D,MAAM,EAAE,6BAA6B,KAAK,gBAAgB,IAAI,CAAC,IAAI,UAAU;iBAC9E,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,qDAAqD,EACrD,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { z } from \"zod\";\nimport { defineAction } from \"../../action.js\";\nimport { getRequestUserEmail } from \"../../server/request-context.js\";\nimport { assertAccess, ForbiddenError } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\nimport { sendEmail, isEmailConfigured } from \"../../server/email.js\";\nimport { renderEmail, emailStrong } from \"../../server/email-template.js\";\nimport { getAppProductionUrl } from \"../../server/app-url.js\";\nimport { getDbExec } from \"../../db/client.js\";\n\nexport function isSyntheticQaEmail(email: string): boolean {\n  const trimmed = email.trim().toLowerCase();\n  const at = trimmed.lastIndexOf(\"@\");\n  if (at <= 0) return false;\n  const local = trimmed.slice(0, at);\n  const domain = trimmed.slice(at + 1);\n  return (\n    local.includes(\"+qa\") &&\n    (domain === \"example.test\" ||\n      domain.endsWith(\".test\") ||\n      domain === \"example.invalid\" ||\n      domain.endsWith(\".invalid\"))\n  );\n}\n\nfunction appPath(path: string): string {\n  if (!path.startsWith(\"/\")) return path;\n  const raw = process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH || \"\";\n  const base = raw.trim().replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  if (!base) return path;\n  const normalizedBase = `/${base}`;\n  if (path === normalizedBase || path.startsWith(`${normalizedBase}/`)) {\n    return path;\n  }\n  return `${normalizedBase}${path}`;\n}\n\nfunction safeNotificationUrl(value: string, appUrl: string): string | null {\n  const trimmed = value.trim();\n  if (!trimmed) return null;\n\n  try {\n    const base = new URL(appUrl);\n    if (trimmed.startsWith(\"/\")) {\n      const path = appPath(trimmed);\n      const basePath = base.pathname.replace(/\\/+$/, \"\");\n      const alreadyIncludesBase =\n        basePath && basePath !== \"/\" && path.startsWith(`${basePath}/`);\n      const joined = alreadyIncludesBase\n        ? `${base.origin}${path}`\n        : `${appUrl.replace(/\\/+$/, \"\")}${path}`;\n      return new URL(joined).toString();\n    }\n\n    const url = new URL(trimmed);\n    if (![\"http:\", \"https:\"].includes(url.protocol)) return null;\n    if (url.origin !== base.origin) return null;\n    return url.toString();\n  } catch {\n    return null;\n  }\n}\n\nexport function resolveShareNotificationUrl(\n  explicitUrl: string | undefined,\n  fallbackPath: string | undefined,\n  appUrl = getAppProductionUrl(),\n): string {\n  for (const candidate of [explicitUrl, fallbackPath]) {\n    if (!candidate) continue;\n    const url = safeNotificationUrl(candidate, appUrl);\n    if (url) return url;\n  }\n  return appUrl;\n}\n\nfunction nanoid(size = 12): string {\n  const chars =\n    \"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz\";\n  let id = \"\";\n  const bytes = crypto.getRandomValues(new Uint8Array(size));\n  for (const byte of bytes) id += chars[byte % chars.length];\n  return id;\n}\n\n/**\n * Returns true if the given email is either an active member of `orgId` or\n * has a pending invitation to `orgId`. Used by resources whose registration\n * sets `requireOrgMemberForUserShares` (currently extensions) to refuse\n * cross-org user shares.\n *\n * Both `org_members` and `org_invitations` store email case-insensitively\n * via `LOWER()` in the rest of the framework, so we follow the same\n * convention here.\n */\nasync function isOrgMemberOrInvited(\n  orgId: string,\n  email: string,\n): Promise<boolean> {\n  const lower = email.trim().toLowerCase();\n  if (!lower || !orgId) return false;\n  const client = getDbExec();\n  const member = await client.execute({\n    sql: `SELECT 1 FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n    args: [orgId, lower],\n  });\n  if (member.rows.length > 0) return true;\n  const invited = await client.execute({\n    sql: `SELECT 1 FROM org_invitations WHERE org_id = ? AND LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n    args: [orgId, lower],\n  });\n  return invited.rows.length > 0;\n}\n\nexport default defineAction({\n  description:\n    \"Grant a user or org access to a shareable resource. Owner or admin role required.\",\n  // (audit H5) Sharing-grant operations are admin-tier and let a caller\n  // expand who can read/write a resource. Refuse from the tools iframe\n  // bridge so a malicious shared tool can't silently re-share its\n  // viewer's resources to an attacker-controlled email.\n  toolCallable: false,\n  schema: z.object({\n    resourceType: z\n      .string()\n      .describe(\"Registered resource type, e.g. 'document', 'form'.\"),\n    resourceId: z.string().describe(\"Id of the resource to share.\"),\n    principalType: z\n      .enum([\"user\", \"org\"])\n      .describe(\"'user' for an individual, 'org' for a whole organization.\"),\n    principalId: z\n      .string()\n      .describe(\"Email (user) or org id (org) of the principal.\"),\n    role: z\n      .enum([\"viewer\", \"editor\", \"admin\"])\n      .default(\"viewer\")\n      .describe(\"Role to grant.\"),\n    notify: z\n      .boolean()\n      .default(true)\n      .describe(\n        \"Whether to email the user about a new individual share. Defaults to true.\",\n      ),\n    resourceUrl: z\n      .string()\n      .optional()\n      .describe(\n        \"Optional app-relative or same-origin URL recipients should open. External origins are ignored.\",\n      ),\n  }),\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    const access = await assertAccess(\n      args.resourceType,\n      args.resourceId,\n      \"admin\",\n    );\n    const actor = getRequestUserEmail();\n    if (!actor) throw new ForbiddenError(\"Not signed in\");\n\n    if (reg.requireOrgMemberForUserShares) {\n      const resourceOrgId = access.resource?.orgId as string | undefined | null;\n      if (!resourceOrgId) {\n        throw new ForbiddenError(\n          `${reg.displayName} can only be shared from within an organization. Create or join an organization first.`,\n        );\n      }\n      if (args.principalType === \"user\") {\n        const ok = await isOrgMemberOrInvited(resourceOrgId, args.principalId);\n        if (!ok) {\n          throw new ForbiddenError(\n            `${args.principalId} is not in your organization. Invite them to the organization first, then share.`,\n          );\n        }\n      } else if (args.principalType === \"org\") {\n        // Cross-org org shares would let an outside org's members run\n        // extension code in the viewer's auth context — the same threat\n        // model that blocks public + cross-org user shares. Pin org-\n        // principal shares to the resource's own org.\n        if (args.principalId !== resourceOrgId) {\n          throw new ForbiddenError(\n            `${reg.displayName} can only be shared with its own organization, not a different one.`,\n          );\n        }\n      }\n    }\n\n    const db = reg.getDb() as any;\n    const [existing] = await db\n      .select()\n      .from(reg.sharesTable)\n      .where(\n        and(\n          eq(reg.sharesTable.resourceId, args.resourceId),\n          eq(reg.sharesTable.principalType, args.principalType),\n          eq(reg.sharesTable.principalId, args.principalId),\n        ),\n      );\n\n    if (existing) {\n      await db\n        .update(reg.sharesTable)\n        .set({ role: args.role })\n        .where(eq(reg.sharesTable.id, existing.id));\n      return { id: existing.id, updated: true };\n    }\n\n    const id = nanoid();\n    await db.insert(reg.sharesTable).values({\n      id,\n      resourceId: args.resourceId,\n      principalType: args.principalType,\n      principalId: args.principalId,\n      role: args.role,\n      createdBy: actor,\n      createdAt: new Date().toISOString(),\n    });\n\n    if (\n      args.notify !== false &&\n      args.principalType === \"user\" &&\n      isEmailConfigured() &&\n      !isSyntheticQaEmail(args.principalId)\n    ) {\n      try {\n        const titleCol = reg.titleColumn ?? \"title\";\n        const [resource] = await db\n          .select()\n          .from(reg.resourceTable)\n          .where(eq(reg.resourceTable.id, args.resourceId));\n        const resourceTitle: string =\n          (resource?.[titleCol] as string | undefined) ?? args.resourceType;\n        const appUrl = getAppProductionUrl();\n        const resourcePath =\n          resource && reg.getResourcePath\n            ? reg.getResourcePath(resource)\n            : undefined;\n        const notificationUrl = resolveShareNotificationUrl(\n          args.resourceUrl,\n          resourcePath,\n          appUrl,\n        );\n        const appName =\n          process.env.APP_NAME || process.env.VITE_APP_NAME || \"Agent Native\";\n        const subject = `${actor} shared \"${resourceTitle}\" with you on ${appName}`;\n        const { html, text } = renderEmail({\n          preheader: subject,\n          heading: \"You've been given access\",\n          paragraphs: [\n            `${emailStrong(actor)} has shared the ${reg.displayName} ${emailStrong(resourceTitle)} with you as a ${emailStrong(args.role)}.`,\n            `Use the button below to open it. If prompted, sign in with ${emailStrong(args.principalId)}.`,\n          ],\n          cta: { label: `Open ${reg.displayName}`, url: notificationUrl },\n          footer: `You received this because ${actor} granted you ${args.role} access.`,\n        });\n        await sendEmail({ to: args.principalId, subject, html, text });\n      } catch (err) {\n        console.error(\n          \"[share-resource] failed to send share notification:\",\n          err,\n        );\n      }\n    }\n\n    return { id, updated: false };\n  },\n});\n"]}
+{"version":3,"file":"share-resource.js","sourceRoot":"","sources":["../../../src/sharing/actions/share-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,CAAC,MAAM,KAAK,cAAc;YACxB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxB,MAAM,KAAK,iBAAiB;YAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnD,MAAM,mBAAmB,GACvB,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,mBAAmB;gBAChC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE;gBACzB,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;YAC3C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,WAA+B,EAC/B,YAAgC,EAChC,MAAM,GAAG,mBAAmB,EAAE;IAE9B,KAAK,MAAM,SAAS,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,GAAG,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,IAAI,GAAG,EAAE;IACvB,MAAM,KAAK,GACT,gEAAgE,CAAC;IACnE,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,yEAAyE;QAC9E,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACnC,GAAG,EAAE,oGAAoG;QACzG,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,mFAAmF;IACrF,sEAAsE;IACtE,qEAAqE;IACrE,gEAAgE;IAChE,sDAAsD;IACtD,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,CAAC,oDAAoD,CAAC;QACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC/D,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;aACrB,QAAQ,CAAC,2DAA2D,CAAC;QACxE,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;aACnC,OAAO,CAAC,QAAQ,CAAC;aACjB,QAAQ,CAAC,gBAAgB,CAAC;QAC7B,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,2EAA2E,CAC5E;QACH,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,gGAAgG,CACjG;KACJ,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;QACF,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,sBAAsB,GAAG,MAAM,8BAA8B,CACjE,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,IAAI,GAAG,CAAC,6BAA6B,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAkC,CAAC;YAC1E,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,wFAAwF,CAC3G,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBAClC,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACvE,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,IAAI,cAAc,CACtB,GAAG,IAAI,CAAC,WAAW,kFAAkF,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxC,8DAA8D;gBAC9D,gEAAgE;gBAChE,6DAA6D;gBAC7D,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;oBACvC,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,qEAAqE,CACxF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;aACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EACrD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAClD,CACF,CAAC;QAEJ,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,EAAE;iBACL,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;iBACvB,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;YACtC,EAAE;YACF,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;QAEF,IACE,IAAI,CAAC,MAAM,KAAK,KAAK;YACrB,IAAI,CAAC,aAAa,KAAK,MAAM;YAC7B,iBAAiB,EAAE;YACnB,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC;gBAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;qBACxB,MAAM,EAAE;qBACR,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;qBACvB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBACpD,MAAM,aAAa,GAChB,QAAQ,EAAE,CAAC,QAAQ,CAAwB,IAAI,IAAI,CAAC,YAAY,CAAC;gBACpE,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBACrC,MAAM,YAAY,GAChB,QAAQ,IAAI,GAAG,CAAC,eAAe;oBAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC;oBAC/B,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,eAAe,GAAG,2BAA2B,CACjD,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,MAAM,CACP,CAAC;gBACF,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,cAAc,CAAC;gBACtE,MAAM,OAAO,GAAG,GAAG,KAAK,YAAY,aAAa,iBAAiB,OAAO,EAAE,CAAC;gBAC5E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;oBACjC,SAAS,EAAE,OAAO;oBAClB,OAAO,EAAE,0BAA0B;oBACnC,UAAU,EAAE;wBACV,GAAG,WAAW,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,aAAa,CAAC,kBAAkB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBAChI,8DAA8D,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;qBAC/F;oBACD,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;oBAC/D,MAAM,EAAE,6BAA6B,KAAK,gBAAgB,IAAI,CAAC,IAAI,UAAU;iBAC9E,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,qDAAqD,EACrD,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { z } from \"zod\";\nimport { defineAction } from \"../../action.js\";\nimport { getRequestUserEmail } from \"../../server/request-context.js\";\nimport { assertAccess, ForbiddenError } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\nimport { sendEmail, isEmailConfigured } from \"../../server/email.js\";\nimport { renderEmail, emailStrong } from \"../../server/email-template.js\";\nimport { getAppProductionUrl } from \"../../server/app-url.js\";\nimport { getDbExec } from \"../../db/client.js\";\nimport {\n  getExtensionShareChangeTargets,\n  notifyExtensionShareChanged,\n} from \"./extension-change.js\";\n\nexport function isSyntheticQaEmail(email: string): boolean {\n  const trimmed = email.trim().toLowerCase();\n  const at = trimmed.lastIndexOf(\"@\");\n  if (at <= 0) return false;\n  const local = trimmed.slice(0, at);\n  const domain = trimmed.slice(at + 1);\n  return (\n    local.includes(\"+qa\") &&\n    (domain === \"example.test\" ||\n      domain.endsWith(\".test\") ||\n      domain === \"example.invalid\" ||\n      domain.endsWith(\".invalid\"))\n  );\n}\n\nfunction appPath(path: string): string {\n  if (!path.startsWith(\"/\")) return path;\n  const raw = process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH || \"\";\n  const base = raw.trim().replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  if (!base) return path;\n  const normalizedBase = `/${base}`;\n  if (path === normalizedBase || path.startsWith(`${normalizedBase}/`)) {\n    return path;\n  }\n  return `${normalizedBase}${path}`;\n}\n\nfunction safeNotificationUrl(value: string, appUrl: string): string | null {\n  const trimmed = value.trim();\n  if (!trimmed) return null;\n\n  try {\n    const base = new URL(appUrl);\n    if (trimmed.startsWith(\"/\")) {\n      const path = appPath(trimmed);\n      const basePath = base.pathname.replace(/\\/+$/, \"\");\n      const alreadyIncludesBase =\n        basePath && basePath !== \"/\" && path.startsWith(`${basePath}/`);\n      const joined = alreadyIncludesBase\n        ? `${base.origin}${path}`\n        : `${appUrl.replace(/\\/+$/, \"\")}${path}`;\n      return new URL(joined).toString();\n    }\n\n    const url = new URL(trimmed);\n    if (![\"http:\", \"https:\"].includes(url.protocol)) return null;\n    if (url.origin !== base.origin) return null;\n    return url.toString();\n  } catch {\n    return null;\n  }\n}\n\nexport function resolveShareNotificationUrl(\n  explicitUrl: string | undefined,\n  fallbackPath: string | undefined,\n  appUrl = getAppProductionUrl(),\n): string {\n  for (const candidate of [explicitUrl, fallbackPath]) {\n    if (!candidate) continue;\n    const url = safeNotificationUrl(candidate, appUrl);\n    if (url) return url;\n  }\n  return appUrl;\n}\n\nfunction nanoid(size = 12): string {\n  const chars =\n    \"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz\";\n  let id = \"\";\n  const bytes = crypto.getRandomValues(new Uint8Array(size));\n  for (const byte of bytes) id += chars[byte % chars.length];\n  return id;\n}\n\n/**\n * Returns true if the given email is either an active member of `orgId` or\n * has a pending invitation to `orgId`. Used by resources whose registration\n * sets `requireOrgMemberForUserShares` (currently extensions) to refuse\n * cross-org user shares.\n *\n * Both `org_members` and `org_invitations` store email case-insensitively\n * via `LOWER()` in the rest of the framework, so we follow the same\n * convention here.\n */\nasync function isOrgMemberOrInvited(\n  orgId: string,\n  email: string,\n): Promise<boolean> {\n  const lower = email.trim().toLowerCase();\n  if (!lower || !orgId) return false;\n  const client = getDbExec();\n  const member = await client.execute({\n    sql: `SELECT 1 FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n    args: [orgId, lower],\n  });\n  if (member.rows.length > 0) return true;\n  const invited = await client.execute({\n    sql: `SELECT 1 FROM org_invitations WHERE org_id = ? AND LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n    args: [orgId, lower],\n  });\n  return invited.rows.length > 0;\n}\n\nexport default defineAction({\n  description:\n    \"Grant a user or org access to a shareable resource. Owner or admin role required.\",\n  // (audit H5) Sharing-grant operations are admin-tier and let a caller\n  // expand who can read/write a resource. Refuse from the tools iframe\n  // bridge so a malicious shared tool can't silently re-share its\n  // viewer's resources to an attacker-controlled email.\n  toolCallable: false,\n  schema: z.object({\n    resourceType: z\n      .string()\n      .describe(\"Registered resource type, e.g. 'document', 'form'.\"),\n    resourceId: z.string().describe(\"Id of the resource to share.\"),\n    principalType: z\n      .enum([\"user\", \"org\"])\n      .describe(\"'user' for an individual, 'org' for a whole organization.\"),\n    principalId: z\n      .string()\n      .describe(\"Email (user) or org id (org) of the principal.\"),\n    role: z\n      .enum([\"viewer\", \"editor\", \"admin\"])\n      .default(\"viewer\")\n      .describe(\"Role to grant.\"),\n    notify: z\n      .boolean()\n      .default(true)\n      .describe(\n        \"Whether to email the user about a new individual share. Defaults to true.\",\n      ),\n    resourceUrl: z\n      .string()\n      .optional()\n      .describe(\n        \"Optional app-relative or same-origin URL recipients should open. External origins are ignored.\",\n      ),\n  }),\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    const access = await assertAccess(\n      args.resourceType,\n      args.resourceId,\n      \"admin\",\n    );\n    const actor = getRequestUserEmail();\n    if (!actor) throw new ForbiddenError(\"Not signed in\");\n    const beforeExtensionTargets = await getExtensionShareChangeTargets(\n      args.resourceType,\n      args.resourceId,\n    );\n\n    if (reg.requireOrgMemberForUserShares) {\n      const resourceOrgId = access.resource?.orgId as string | undefined | null;\n      if (!resourceOrgId) {\n        throw new ForbiddenError(\n          `${reg.displayName} can only be shared from within an organization. Create or join an organization first.`,\n        );\n      }\n      if (args.principalType === \"user\") {\n        const ok = await isOrgMemberOrInvited(resourceOrgId, args.principalId);\n        if (!ok) {\n          throw new ForbiddenError(\n            `${args.principalId} is not in your organization. Invite them to the organization first, then share.`,\n          );\n        }\n      } else if (args.principalType === \"org\") {\n        // Cross-org org shares would let an outside org's members run\n        // extension code in the viewer's auth context — the same threat\n        // model that blocks public + cross-org user shares. Pin org-\n        // principal shares to the resource's own org.\n        if (args.principalId !== resourceOrgId) {\n          throw new ForbiddenError(\n            `${reg.displayName} can only be shared with its own organization, not a different one.`,\n          );\n        }\n      }\n    }\n\n    const db = reg.getDb() as any;\n    const [existing] = await db\n      .select()\n      .from(reg.sharesTable)\n      .where(\n        and(\n          eq(reg.sharesTable.resourceId, args.resourceId),\n          eq(reg.sharesTable.principalType, args.principalType),\n          eq(reg.sharesTable.principalId, args.principalId),\n        ),\n      );\n\n    if (existing) {\n      await db\n        .update(reg.sharesTable)\n        .set({ role: args.role })\n        .where(eq(reg.sharesTable.id, existing.id));\n      await notifyExtensionShareChanged(\n        args.resourceType,\n        args.resourceId,\n        beforeExtensionTargets,\n      );\n      return { id: existing.id, updated: true };\n    }\n\n    const id = nanoid();\n    await db.insert(reg.sharesTable).values({\n      id,\n      resourceId: args.resourceId,\n      principalType: args.principalType,\n      principalId: args.principalId,\n      role: args.role,\n      createdBy: actor,\n      createdAt: new Date().toISOString(),\n    });\n    await notifyExtensionShareChanged(\n      args.resourceType,\n      args.resourceId,\n      beforeExtensionTargets,\n    );\n\n    if (\n      args.notify !== false &&\n      args.principalType === \"user\" &&\n      isEmailConfigured() &&\n      !isSyntheticQaEmail(args.principalId)\n    ) {\n      try {\n        const titleCol = reg.titleColumn ?? \"title\";\n        const [resource] = await db\n          .select()\n          .from(reg.resourceTable)\n          .where(eq(reg.resourceTable.id, args.resourceId));\n        const resourceTitle: string =\n          (resource?.[titleCol] as string | undefined) ?? args.resourceType;\n        const appUrl = getAppProductionUrl();\n        const resourcePath =\n          resource && reg.getResourcePath\n            ? reg.getResourcePath(resource)\n            : undefined;\n        const notificationUrl = resolveShareNotificationUrl(\n          args.resourceUrl,\n          resourcePath,\n          appUrl,\n        );\n        const appName =\n          process.env.APP_NAME || process.env.VITE_APP_NAME || \"Agent Native\";\n        const subject = `${actor} shared \"${resourceTitle}\" with you on ${appName}`;\n        const { html, text } = renderEmail({\n          preheader: subject,\n          heading: \"You've been given access\",\n          paragraphs: [\n            `${emailStrong(actor)} has shared the ${reg.displayName} ${emailStrong(resourceTitle)} with you as a ${emailStrong(args.role)}.`,\n            `Use the button below to open it. If prompted, sign in with ${emailStrong(args.principalId)}.`,\n          ],\n          cta: { label: `Open ${reg.displayName}`, url: notificationUrl },\n          footer: `You received this because ${actor} granted you ${args.role} access.`,\n        });\n        await sendEmail({ to: args.principalId, subject, html, text });\n      } catch (err) {\n        console.error(\n          \"[share-resource] failed to send share notification:\",\n          err,\n        );\n      }\n    }\n\n    return { id, updated: false };\n  },\n});\n"]}

package/dist/sharing/actions/unshare-resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unshare-resource.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/unshare-resource.ts"],"names":[],"mappings":";AAMA,wBA0BG"}
+{"version":3,"file":"unshare-resource.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/unshare-resource.ts"],"names":[],"mappings":";AAUA,wBAmCG"}

package/dist/sharing/actions/unshare-resource.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { defineAction } from "../../action.js";
 import { assertAccess } from "../access.js";
 import { requireShareableResource } from "../registry.js";
+import { getExtensionShareChangeTargets, notifyExtensionShareChanged, } from "./extension-change.js";
 export default defineAction({
     description: "Revoke a previously granted share. Owner or admin role required.",
     // (audit H5) Mirror share-resource: refuse from the tools iframe bridge.
@@ -16,10 +17,12 @@ export default defineAction({
     run: async (args) => {
         const reg = requireShareableResource(args.resourceType);
         await assertAccess(args.resourceType, args.resourceId, "admin");
+        const beforeExtensionTargets = await getExtensionShareChangeTargets(args.resourceType, args.resourceId);
         const db = reg.getDb();
         await db
             .delete(reg.sharesTable)
             .where(and(eq(reg.sharesTable.resourceId, args.resourceId), eq(reg.sharesTable.principalType, args.principalType), eq(reg.sharesTable.principalId, args.principalId)));
+        await notifyExtensionShareChanged(args.resourceType, args.resourceId, beforeExtensionTargets);
         return { ok: true };
     },
 });

package/dist/sharing/actions/unshare-resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"unshare-resource.js","sourceRoot":"","sources":["../../../src/sharing/actions/unshare-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,kEAAkE;IACpE,yEAAyE;IACzE,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;KACxB,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,EAAE;aACL,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EACrD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAClD,CACF,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { z } from \"zod\";\nimport { defineAction } from \"../../action.js\";\nimport { assertAccess } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\n\nexport default defineAction({\n  description:\n    \"Revoke a previously granted share. Owner or admin role required.\",\n  // (audit H5) Mirror share-resource: refuse from the tools iframe bridge.\n  toolCallable: false,\n  schema: z.object({\n    resourceType: z.string(),\n    resourceId: z.string(),\n    principalType: z.enum([\"user\", \"org\"]),\n    principalId: z.string(),\n  }),\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    await assertAccess(args.resourceType, args.resourceId, \"admin\");\n    const db = reg.getDb() as any;\n    await db\n      .delete(reg.sharesTable)\n      .where(\n        and(\n          eq(reg.sharesTable.resourceId, args.resourceId),\n          eq(reg.sharesTable.principalType, args.principalType),\n          eq(reg.sharesTable.principalId, args.principalId),\n        ),\n      );\n    return { ok: true };\n  },\n});\n"]}
+{"version":3,"file":"unshare-resource.js","sourceRoot":"","sources":["../../../src/sharing/actions/unshare-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,kEAAkE;IACpE,yEAAyE;IACzE,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;KACxB,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,sBAAsB,GAAG,MAAM,8BAA8B,CACjE,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,EAAE;aACL,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EACrD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAClD,CACF,CAAC;QACJ,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport { z } from \"zod\";\nimport { defineAction } from \"../../action.js\";\nimport { assertAccess } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\nimport {\n  getExtensionShareChangeTargets,\n  notifyExtensionShareChanged,\n} from \"./extension-change.js\";\n\nexport default defineAction({\n  description:\n    \"Revoke a previously granted share. Owner or admin role required.\",\n  // (audit H5) Mirror share-resource: refuse from the tools iframe bridge.\n  toolCallable: false,\n  schema: z.object({\n    resourceType: z.string(),\n    resourceId: z.string(),\n    principalType: z.enum([\"user\", \"org\"]),\n    principalId: z.string(),\n  }),\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    await assertAccess(args.resourceType, args.resourceId, \"admin\");\n    const beforeExtensionTargets = await getExtensionShareChangeTargets(\n      args.resourceType,\n      args.resourceId,\n    );\n    const db = reg.getDb() as any;\n    await db\n      .delete(reg.sharesTable)\n      .where(\n        and(\n          eq(reg.sharesTable.resourceId, args.resourceId),\n          eq(reg.sharesTable.principalType, args.principalType),\n          eq(reg.sharesTable.principalId, args.principalId),\n        ),\n      );\n    await notifyExtensionShareChanged(\n      args.resourceType,\n      args.resourceId,\n      beforeExtensionTargets,\n    );\n    return { ok: true };\n  },\n});\n"]}

package/dist/templates/default/AGENTS.md

@@ -25,10 +25,10 @@ Use `getSession(event)` server-side and `useSession()` client-side.
 
 Resources are SQL-backed persistent files for notes, learnings, and context.
 
-**At the start of every conversation, read these resources (both personal and shared scopes):**
+**At the start of every conversation, read these resources (workspace, shared, and personal scopes as relevant):**
 
-1. **`AGENTS.md`** -- user-specific context. Read both `--scope personal` and `--scope shared`.
-2. **`LEARNINGS.md`** -- user preferences, corrections, and patterns. Read both scopes.
+1. **`AGENTS.md`** -- inherited workspace defaults, app/team instructions, and user-specific context.
+2. **`LEARNINGS.md`** -- user preferences, corrections, and patterns. Read personal and shared scopes.
 
 **Update `LEARNINGS.md` when you learn something important.**
 

package/dist/templates/workspace-core/AGENTS.md

@@ -27,6 +27,13 @@ agent should know.
   notes, scripts, task plans, or intermediate outputs, but should promote them
   to normal workspace visibility only when the user explicitly asks to keep or
   manage the file.
+- Runtime-editable global resources can be managed from Dispatch Resources.
+  Use `AGENTS.md` or `instructions/<slug>.md` for always-on guardrails,
+  `skills/<slug>/SKILL.md` for workspace skills, `context/<slug>.md` for
+  personas/positioning/messaging/company facts/brand guidelines, and
+  `agents/<slug>.md` for custom agent profiles. Scope them to All apps when
+  every workspace app should inherit them. All-app resources are inherited at
+  runtime; do not copy or sync them into individual apps.
 
 ## Adding Apps
 

package/dist/templates/workspace-root/AGENTS.md

@@ -24,6 +24,13 @@ coding agents can discover the same workspace-wide guidance from the root.
   manage the file.
 - Durable instructions, skills, jobs, memories, custom agents, and files the
   user explicitly asked to save belong in normal workspace visibility.
+- Runtime-editable global resources are managed from Dispatch Resources. Use
+  `AGENTS.md` or `instructions/<slug>.md` for always-on guardrails,
+  `skills/<slug>/SKILL.md` for workspace skills, `context/<slug>.md` for
+  personas/positioning/messaging/company facts/brand guidelines, and
+  `agents/<slug>.md` for custom agent profiles.
+- Set Dispatch resources to All apps when every workspace app should inherit
+  them. Use selected-app grants only for resources that should not be global.
 
 ## Workspace Scope
 

package/dist/templates/workspace-root/README.md

@@ -36,6 +36,28 @@ the shared package (`@{{APP_NAME}}/shared`).
 The workspace root also links `.agents/skills` to the shared package so coding
 agents launched from the root can discover the same workspace-wide skills.
 
+Runtime-editable global resources live in Dispatch, not in `packages/shared`.
+Use Dispatch **Resources** for company context and guardrails that admins should
+change without a code deploy:
+
+- `AGENTS.md` or `instructions/<slug>.md` for instructions every app agent loads
+- `skills/<slug>/SKILL.md` for workspace skills
+- `context/<slug>.md` for personas, positioning, messaging, company facts, and brand guidelines
+- `agents/<slug>.md` for reusable custom agent profiles
+
+Set those resources to **All apps** when every workspace app should receive
+them; use selected-app grants for app-specific packs.
+
+Starter global resources:
+
+```text
+context/company.md              # company overview, ICP, products, canonical links
+context/brand.md                # brand voice, visual identity, spelling, terms to avoid
+context/messaging.md            # positioning, value props, proof points, objections
+instructions/guardrails.md      # compliance, escalation, and approval rules
+skills/company-voice/SKILL.md   # copywriting/review guidance for customer-facing work
+```
+
 ## Getting started
 
 ```bash
@@ -55,6 +77,9 @@ localhost or dev ports because the active gateway origin owns the port.
 Dispatch vault keys are workspace-wide by default: every saved vault key is
 available to every workspace app and can be synced from Dispatch. Switch the
 Vault page to manual access only when you need explicit per-app key grants.
+Dispatch resources are inherited rather than synced: All-app resources live
+once at workspace scope and every app agent reads them at runtime. Use selected
+resource grants only for genuinely app-specific context.
 
 ## Workspace org identity
 

package/dist/triggers/dispatcher.d.ts

@@ -16,7 +16,9 @@ export interface TriggerDispatcherDeps {
     getActions: () => Record<string, ActionEntry>;
     getSystemPrompt: (owner: string) => Promise<string>;
     apiKey?: string;
-    model: string;
+    model?: string;
+    /** App/template id used for org-scoped per-app model defaults. */
+    appId?: string;
 }
 /**
  * Initialize the trigger dispatcher. Call once at server startup.

package/dist/triggers/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/triggers/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAKtC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKrD,iBAAS,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;CACd,CAsFA;AAED,iBAAS,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAsB3E;AAID,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9C,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAMD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAwB/D;AAoPD,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/triggers/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAQtC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKrD,iBAAS,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;CACd,CAsFA;AAED,iBAAS,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAsB3E;AAID,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9C,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAwB/D;AA2PD,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/triggers/dispatcher.js

@@ -9,7 +9,7 @@ import { subscribe } from "../event-bus/index.js";
 import { resourceListAllOwners, resourcePut } from "../resources/store.js";
 import { runWithRequestContext } from "../server/request-context.js";
 import { runAgentLoop, actionsToEngineTools, getOwnerActiveApiKey, } from "../agent/production-agent.js";
-import { createAnthropicEngine } from "../agent/engine/index.js";
+import { getStoredModelForEngine, resolveEngine, } from "../agent/engine/index.js";
 import { createThread } from "../chat-threads/store.js";
 import { evaluateCondition } from "./condition-evaluator.js";
 // Re-use the job frontmatter parser — triggers extend the same format.
@@ -289,7 +289,13 @@ async function dispatchAgentic(resource, meta, body, payload, eventMeta, apiKey)
             const actions = _deps.getActions();
             const systemPrompt = await _deps.getSystemPrompt(jobUserEmail);
             const tools = actionsToEngineTools(actions);
-            const engine = createAnthropicEngine({ apiKey });
+            const engine = await resolveEngine({
+                apiKey,
+                appId: _deps.appId,
+            });
+            const model = _deps.model ??
+                (await getStoredModelForEngine(engine, { appId: _deps.appId })) ??
+                engine.defaultModel;
             const thread = await createThread(jobUserEmail, {
                 title: `Trigger: ${triggerName} — ${now.toLocaleDateString()}`,
             });
@@ -323,7 +329,7 @@ ${body}`;
             try {
                 await runAgentLoop({
                     engine,
-                    model: _deps.model,
+                    model,
                     systemPrompt,
                     tools,
                     messages,

package/dist/triggers/dispatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/triggers/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,uEAAuE;AACvE,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAE5D,SAAS,uBAAuB,CAAC,OAAe;IAI9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE;gBACJ,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,KAAK;gBACd,WAAW,EAAE,UAAU;gBACvB,IAAI,EAAE,SAAS;aAChB;YACD,IAAI,EAAE,OAAO;SACd,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAuB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,UAAU;QACvB,IAAI,EAAE,SAAS;KAChB,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,SAAS;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,UAAU;gBACb,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACtB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,OAAO,GAAG,KAAK,KAAK,OAAO,CAAC;gBACjC,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,CAAC,WAAW;oBACd,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;gBACjE,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;gBACnB,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,IAAI;oBACP,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvE,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;gBACpB,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;gBACnB,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,KAAK;oBACR,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChE,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,MAAM;YACR,KAAK,YAAY;gBACf,IAAI,CAAC,UAAU,GAAG,KAAyC,CAAC;gBAC5D,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,SAAS;QAChB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,SAAS;QAChB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAWD,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAC5C,IAAI,KAAK,GAAiC,IAAI,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA2B;IAE3B,KAAK,GAAG,IAAI,CAAC;IACb,MAAM,yBAAyB,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/D,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAC1C,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAC3C,CAAC;gBACF,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,SAAiB,EACjB,OAAgB,EAChB,SAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACjD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACpD,4DAA4D;YAC5D,+DAA+D;YAC/D,IACE,SAAS,CAAC,KAAK;gBACf,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;gBAC3B,CAAC,CAAC,KAAK,KAAK,YAAY,EACxB,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CACL,IAAI,CAAC,WAAW,KAAK,OAAO;gBAC5B,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,IAAI,CAAC,OAAO;gBACZ,IAAI,CAAC,UAAU,KAAK,SAAS,CAC9B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAE3B,2CAA2C;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC;YAC/C,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,MAAM,GACV,UAAU,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CACV,sCAAsC,QAAQ,CAAC,IAAI,cAAc,CAClE,CAAC;gBACF,SAAS;YACX,CAAC;YAED,qBAAqB;YACrB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,WAAW;YACX,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,0DAA0D,QAAQ,CAAC,IAAI,cAAc,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,SAAS,IAAI,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CACrC,YAAoB,EACpB,QAA4B;IAE5B,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8CAA8C;YACnD,IAAI,EAAE,CAAC,YAAY,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,YAAY,oBAAoB,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;gBACpC,GAAG,EAAE,gFAAgF;gBACrF,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;aAC/B,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,SAAS,YAAY,mCAAmC,QAAQ,GAAG;iBAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC9C,IACE,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC9B,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAC/B,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,CAAC,IAAI,CACV,qDAAqD,YAAY,IAAI,EACrE,GAAG,EAAE,OAAO,CACb,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAA0D,EAC1D,IAAwB,EACxB,IAAY,EACZ,OAAgB,EAChB,SAAoB,EACpB,MAAc;IAEd,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IAEzC,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CACV,gCAAgC,WAAW,MAAM,QAAQ,CAAC,MAAM,IAAI;YAClE,mEAAmE,CACtE,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,MAAM,WAAW,CACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,IAAI,EACb,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAChC,CAAC;QACF,OAAO;IACT,CAAC;IAED,kBAAkB;IAClB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC3B,MAAM,WAAW,CACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,IAAI,EACb,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAChC,CAAC;IAEF,MAAM,qBAAqB,CACzB,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,EAC5C,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,KAAM,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,MAAM,KAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE;gBAC9C,KAAK,EAAE,YAAY,WAAW,MAAM,GAAG,CAAC,kBAAkB,EAAE,EAAE;aAC/D,CAAC,CAAC;YAEH,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,WAAW,GAAG,wBAAwB,WAAW;SACtD,IAAI,CAAC,KAAK;YACP,SAAS,CAAC,OAAO;YACjB,SAAS,CAAC,SAAS;;;EAG7B,UAAU;;;;EAIV,IAAI,EAAE,CAAC;YAED,MAAM,QAAQ,GAAG;gBACf;oBACE,IAAI,EAAE,MAAe;oBACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;iBACxD;aACF,CAAC;YAEF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAEpE,MAAM,MAAM,GAAqB,EAAE,CAAC;YAEpC,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,KAAM,CAAC,KAAK;oBACnB,YAAY;oBACZ,KAAK;oBACL,QAAQ;oBACR,OAAO;oBACP,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;oBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YAED,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,MAAM,WAAW,CACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,IAAI,EACb,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAChC,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,0BAA0B,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;YAC1B,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC;YAChE,MAAM,WAAW,CACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,IAAI,EACb,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAChC,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,eAAe,WAAW,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC","sourcesContent":["/**\n * Trigger dispatcher — bridges the event bus to the automation system.\n *\n * On startup, loads all event-triggered jobs from the resources store,\n * subscribes to their events, and dispatches them (condition eval → agent\n * loop) when matching events fire.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { subscribe } from \"../event-bus/index.js\";\nimport type { EventMeta } from \"../event-bus/types.js\";\nimport { resourceListAllOwners, resourcePut } from \"../resources/store.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport {\n  runAgentLoop,\n  actionsToEngineTools,\n  getOwnerActiveApiKey,\n  type ActionEntry,\n} from \"../agent/production-agent.js\";\nimport { createAnthropicEngine } from \"../agent/engine/index.js\";\nimport { createThread } from \"../chat-threads/store.js\";\nimport type { AgentChatEvent } from \"../agent/types.js\";\nimport { evaluateCondition } from \"./condition-evaluator.js\";\nimport type { TriggerFrontmatter } from \"./types.js\";\n\n// Re-use the job frontmatter parser — triggers extend the same format.\nconst FRONTMATTER_RE = /^---\\n([\\s\\S]*?)\\n---\\n?([\\s\\S]*)$/;\n\nfunction parseTriggerFrontmatter(content: string): {\n  meta: TriggerFrontmatter;\n  body: string;\n} {\n  const match = content.match(FRONTMATTER_RE);\n  if (!match) {\n    return {\n      meta: {\n        schedule: \"\",\n        enabled: false,\n        triggerType: \"schedule\",\n        mode: \"agentic\",\n      },\n      body: content,\n    };\n  }\n\n  const yamlBlock = match[1];\n  const body = match[2].trim();\n\n  const meta: TriggerFrontmatter = {\n    schedule: \"\",\n    enabled: true,\n    triggerType: \"schedule\",\n    mode: \"agentic\",\n  };\n\n  for (const line of yamlBlock.split(\"\\n\")) {\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx === -1) continue;\n    const key = line.slice(0, colonIdx).trim();\n    let value = line.slice(colonIdx + 1).trim();\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    switch (key) {\n      case \"schedule\":\n        meta.schedule = value;\n        break;\n      case \"enabled\":\n        meta.enabled = value !== \"false\";\n        break;\n      case \"triggerType\":\n        meta.triggerType =\n          value === \"event\" || value === \"schedule\" ? value : \"schedule\";\n        break;\n      case \"event\":\n        meta.event = value;\n        break;\n      case \"condition\":\n        meta.condition = value;\n        break;\n      case \"mode\":\n        meta.mode =\n          value === \"deterministic\" || value === \"agentic\" ? value : \"agentic\";\n        break;\n      case \"domain\":\n        meta.domain = value;\n        break;\n      case \"createdBy\":\n        meta.createdBy = value;\n        break;\n      case \"orgId\":\n        meta.orgId = value;\n        break;\n      case \"runAs\":\n        meta.runAs =\n          value === \"shared\" || value === \"creator\" ? value : undefined;\n        break;\n      case \"lastRun\":\n        meta.lastRun = value;\n        break;\n      case \"lastStatus\":\n        meta.lastStatus = value as TriggerFrontmatter[\"lastStatus\"];\n        break;\n      case \"lastError\":\n        meta.lastError = value;\n        break;\n      case \"nextRun\":\n        meta.nextRun = value;\n        break;\n    }\n  }\n\n  return { meta, body };\n}\n\nfunction buildTriggerContent(meta: TriggerFrontmatter, body: string): string {\n  const lines = [\"---\"];\n  lines.push(`schedule: \"${meta.schedule}\"`);\n  lines.push(`enabled: ${meta.enabled}`);\n  lines.push(`triggerType: ${meta.triggerType}`);\n  if (meta.event) lines.push(`event: ${meta.event}`);\n  if (meta.condition)\n    lines.push(`condition: \"${meta.condition.replace(/\"/g, '\\\\\"')}\"`);\n  lines.push(`mode: ${meta.mode}`);\n  if (meta.domain) lines.push(`domain: ${meta.domain}`);\n  if (meta.createdBy) lines.push(`createdBy: ${meta.createdBy}`);\n  if (meta.orgId) lines.push(`orgId: ${meta.orgId}`);\n  if (meta.runAs) lines.push(`runAs: ${meta.runAs}`);\n  if (meta.lastRun) lines.push(`lastRun: ${meta.lastRun}`);\n  if (meta.lastStatus) lines.push(`lastStatus: ${meta.lastStatus}`);\n  if (meta.lastError)\n    lines.push(`lastError: \"${meta.lastError.replace(/\"/g, '\\\\\"')}\"`);\n  if (meta.nextRun) lines.push(`nextRun: ${meta.nextRun}`);\n  lines.push(\"---\");\n  lines.push(\"\");\n  lines.push(body);\n  return lines.join(\"\\n\");\n}\n\n// ─── Dispatcher deps (same pattern as SchedulerDeps) ────────────────────────\n\nexport interface TriggerDispatcherDeps {\n  getActions: () => Record<string, ActionEntry>;\n  getSystemPrompt: (owner: string) => Promise<string>;\n  apiKey?: string;\n  model: string;\n}\n\n// Track active subscriptions to avoid double-subscribing\nconst _subscribedEvents = new Set<string>();\nlet _deps: TriggerDispatcherDeps | null = null;\n\n/**\n * Initialize the trigger dispatcher. Call once at server startup.\n * Loads all event-triggered jobs and subscribes to their events.\n */\nexport async function initTriggerDispatcher(\n  deps: TriggerDispatcherDeps,\n): Promise<void> {\n  _deps = deps;\n  await refreshEventSubscriptions();\n}\n\n/**\n * Refresh event subscriptions from the resource store.\n * Call after creating/updating triggers.\n */\nexport async function refreshEventSubscriptions(): Promise<void> {\n  try {\n    const jobResources = await resourceListAllOwners(\"jobs/\");\n    const eventNames = new Set<string>();\n\n    for (const resource of jobResources) {\n      if (!resource.path.endsWith(\".md\")) continue;\n      const { meta } = parseTriggerFrontmatter(resource.content);\n      if (meta.triggerType === \"event\" && meta.event && meta.enabled) {\n        eventNames.add(meta.event);\n      }\n    }\n\n    for (const eventName of eventNames) {\n      if (!_subscribedEvents.has(eventName)) {\n        subscribe(eventName, (payload, eventMeta) =>\n          handleEvent(eventName, payload, eventMeta),\n        );\n        _subscribedEvents.add(eventName);\n      }\n    }\n  } catch (err) {\n    console.error(\"[triggers] Failed to refresh event subscriptions:\", err);\n  }\n}\n\nasync function handleEvent(\n  eventName: string,\n  payload: unknown,\n  eventMeta: EventMeta,\n): Promise<void> {\n  if (!_deps) return;\n\n  try {\n    const jobResources = await resourceListAllOwners(\"jobs/\");\n    const matchingTriggers = jobResources.filter((r) => {\n      if (!r.path.endsWith(\".md\")) return false;\n      const { meta } = parseTriggerFrontmatter(r.content);\n      // Scope: only dispatch triggers owned by the event's owner,\n      // or shared triggers. Prevents cross-tenant trigger execution.\n      if (\n        eventMeta.owner &&\n        r.owner !== eventMeta.owner &&\n        r.owner !== \"__shared__\"\n      ) {\n        return false;\n      }\n      return (\n        meta.triggerType === \"event\" &&\n        meta.event === eventName &&\n        meta.enabled &&\n        meta.lastStatus !== \"running\"\n      );\n    });\n\n    for (const resource of matchingTriggers) {\n      const { meta, body } = parseTriggerFrontmatter(resource.content);\n      if (!body.trim()) continue;\n\n      // Resolve API key for condition evaluation\n      const owner = meta.createdBy || resource.owner;\n      const userApiKey = await getOwnerActiveApiKey(owner);\n      const apiKey =\n        userApiKey || _deps.apiKey || process.env.ANTHROPIC_API_KEY;\n      if (!apiKey) {\n        console.warn(\n          `[triggers] No API key for trigger \"${resource.path}\" — skipping`,\n        );\n        continue;\n      }\n\n      // Evaluate condition\n      const matches = await evaluateCondition(meta.condition, payload, apiKey);\n      if (!matches) continue;\n\n      // Dispatch\n      if (meta.mode === \"agentic\") {\n        await dispatchAgentic(resource, meta, body, payload, eventMeta, apiKey);\n      } else {\n        console.warn(\n          `[triggers] Deterministic mode not yet implemented for \"${resource.path}\" — skipping`,\n        );\n      }\n    }\n  } catch (err) {\n    console.error(`[triggers] Error handling event \"${eventName}\":`, err);\n  }\n}\n\n/**\n * Validate that the run-as user still exists and (if scoped to an org) is\n * still a member of that org. Mirrors the recurring-jobs scheduler check\n * (audit 12 #10): event-triggered automations must stop firing when the\n * creator is removed/demoted.\n */\nasync function isTriggerRunAsStillValid(\n  jobUserEmail: string,\n  jobOrgId: string | undefined,\n): Promise<{ ok: boolean; reason?: string }> {\n  if (jobUserEmail === \"__shared__\") return { ok: true };\n  try {\n    const { getDbExec } = await import(\"../db/client.js\");\n    const db = getDbExec();\n    const userResult = await db.execute({\n      sql: `SELECT 1 FROM \"user\" WHERE email = ? LIMIT 1`,\n      args: [jobUserEmail],\n    });\n    if (!userResult.rows || userResult.rows.length === 0) {\n      return { ok: false, reason: `user \"${jobUserEmail}\" no longer exists` };\n    }\n    if (jobOrgId) {\n      const memberResult = await db.execute({\n        sql: `SELECT 1 FROM org_members WHERE org_id = ? AND LOWER(email) = LOWER(?) LIMIT 1`,\n        args: [jobOrgId, jobUserEmail],\n      });\n      if (!memberResult.rows || memberResult.rows.length === 0) {\n        return {\n          ok: false,\n          reason: `user \"${jobUserEmail}\" is no longer a member of org \"${jobOrgId}\"`,\n        };\n      }\n    }\n    return { ok: true };\n  } catch (err: any) {\n    const msg = err?.message?.toLowerCase() ?? \"\";\n    if (\n      msg.includes(\"does not exist\") ||\n      msg.includes(\"no such table\") ||\n      msg.includes(\"undefined table\")\n    ) {\n      return { ok: true };\n    }\n    console.warn(\n      `[triggers] User/membership validation failed for \"${jobUserEmail}\":`,\n      err?.message,\n    );\n    return { ok: true };\n  }\n}\n\nasync function dispatchAgentic(\n  resource: { path: string; owner: string; content: string },\n  meta: TriggerFrontmatter,\n  body: string,\n  payload: unknown,\n  eventMeta: EventMeta,\n  apiKey: string,\n): Promise<void> {\n  if (!_deps) return;\n\n  const triggerName = resource.path.replace(/^jobs\\//, \"\").replace(/\\.md$/, \"\");\n  const now = new Date();\n\n  const jobUserEmail = meta.createdBy || resource.owner;\n  const jobOrgId = meta.orgId ?? undefined;\n\n  // SECURITY (audit 12 #10): re-validate the run-as user/membership on\n  // every dispatch. Sharing revocation, user deletion, and org-member\n  // removal must take effect for already-scheduled triggers. Skip the\n  // dispatch on failure; leave the trigger entry alone for admin review.\n  const validity = await isTriggerRunAsStillValid(jobUserEmail, jobOrgId);\n  if (!validity.ok) {\n    console.warn(\n      `[triggers] Skipping trigger \"${triggerName}\": ${validity.reason}. ` +\n        `User/membership no longer valid — leaving entry for admin review.`,\n    );\n    meta.lastRun = now.toISOString();\n    meta.lastStatus = \"skipped\";\n    meta.lastError = validity.reason;\n    await resourcePut(\n      resource.owner,\n      resource.path,\n      buildTriggerContent(meta, body),\n    );\n    return;\n  }\n\n  // Mark as running\n  meta.lastRun = now.toISOString();\n  meta.lastStatus = \"running\";\n  meta.lastError = undefined;\n  await resourcePut(\n    resource.owner,\n    resource.path,\n    buildTriggerContent(meta, body),\n  );\n\n  await runWithRequestContext(\n    { userEmail: jobUserEmail, orgId: jobOrgId },\n    async () => {\n      try {\n        const actions = _deps!.getActions();\n        const systemPrompt = await _deps!.getSystemPrompt(jobUserEmail);\n        const tools = actionsToEngineTools(actions);\n\n        const engine = createAnthropicEngine({ apiKey });\n        const thread = await createThread(jobUserEmail, {\n          title: `Trigger: ${triggerName} — ${now.toLocaleDateString()}`,\n        });\n\n        let payloadStr: string;\n        try {\n          payloadStr = JSON.stringify(payload, null, 2);\n        } catch {\n          payloadStr = String(payload);\n        }\n\n        const triggerText = `[Automation Trigger: ${triggerName}]\nEvent: ${meta.event}\nEvent ID: ${eventMeta.eventId}\nFired at: ${eventMeta.emittedAt}\n\nEvent payload:\n${payloadStr}\n\nExecute the following automation instructions:\n\n${body}`;\n\n        const messages = [\n          {\n            role: \"user\" as const,\n            content: [{ type: \"text\" as const, text: triggerText }],\n          },\n        ];\n\n        const controller = new AbortController();\n        const timeout = setTimeout(() => controller.abort(), 5 * 60 * 1000);\n\n        const events: AgentChatEvent[] = [];\n\n        try {\n          await runAgentLoop({\n            engine,\n            model: _deps!.model,\n            systemPrompt,\n            tools,\n            messages,\n            actions,\n            send: (event) => events.push(event),\n            signal: controller.signal,\n          });\n        } finally {\n          clearTimeout(timeout);\n        }\n\n        meta.lastStatus = \"success\";\n        await resourcePut(\n          resource.owner,\n          resource.path,\n          buildTriggerContent(meta, body),\n        );\n\n        console.log(`[triggers] \"${triggerName}\" completed successfully`);\n      } catch (err: any) {\n        meta.lastStatus = \"error\";\n        meta.lastError = err?.message?.slice(0, 200) || \"Unknown error\";\n        await resourcePut(\n          resource.owner,\n          resource.path,\n          buildTriggerContent(meta, body),\n        );\n        console.error(`[triggers] \"${triggerName}\" failed:`, err?.message);\n      }\n    },\n  );\n}\n\nexport { parseTriggerFrontmatter, buildTriggerContent };\n"]}
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/triggers/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,uEAAuE;AACvE,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAE5D,SAAS,uBAAuB,CAAC,OAAe;IAI9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE;gBACJ,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,KAAK;gBACd,WAAW,EAAE,UAAU;gBACvB,IAAI,EAAE,SAAS;aAChB;YACD,IAAI,EAAE,OAAO;SACd,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAuB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,UAAU;QACvB,IAAI,EAAE,SAAS;KAChB,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,SAAS;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,UAAU;gBACb,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACtB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,OAAO,GAAG,KAAK,KAAK,OAAO,CAAC;gBACjC,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,CAAC,WAAW;oBACd,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;gBACjE,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;gBACnB,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,IAAI;oBACP,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvE,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;gBACpB,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;gBACnB,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,KAAK;oBACR,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChE,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,MAAM;YACR,KAAK,YAAY;gBACf,IAAI,CAAC,UAAU,GAAG,KAAyC,CAAC;gBAC5D,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,SAAS;QAChB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,SAAS;QAChB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAaD,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAC5C,IAAI,KAAK,GAAiC,IAAI,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA2B;IAE3B,KAAK,GAAG,IAAI,CAAC;IACb,MAAM,yBAAyB,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/D,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAC1C,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAC3C,CAAC;gBACF,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,SAAiB,EACjB,OAAgB,EAChB,SAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACjD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACpD,4DAA4D;YAC5D,+DAA+D;YAC/D,IACE,SAAS,CAAC,KAAK;gBACf,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;gBAC3B,CAAC,CAAC,KAAK,KAAK,YAAY,EACxB,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CACL,IAAI,CAAC,WAAW,KAAK,OAAO;gBAC5B,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,IAAI,CAAC,OAAO;gBACZ,IAAI,CAAC,UAAU,KAAK,SAAS,CAC9B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAE3B,2CAA2C;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC;YAC/C,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,MAAM,GACV,UAAU,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CACV,sCAAsC,QAAQ,CAAC,IAAI,cAAc,CAClE,CAAC;gBACF,SAAS;YACX,CAAC;YAED,qBAAqB;YACrB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,WAAW;YACX,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,0DAA0D,QAAQ,CAAC,IAAI,cAAc,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,SAAS,IAAI,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CACrC,YAAoB,EACpB,QAA4B;IAE5B,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8CAA8C;YACnD,IAAI,EAAE,CAAC,YAAY,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,YAAY,oBAAoB,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;gBACpC,GAAG,EAAE,gFAAgF;gBACrF,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;aAC/B,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,SAAS,YAAY,mCAAmC,QAAQ,GAAG;iBAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC9C,IACE,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC9B,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAC/B,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,CAAC,IAAI,CACV,qDAAqD,YAAY,IAAI,EACrE,GAAG,EAAE,OAAO,CACb,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAA0D,EAC1D,IAAwB,EACxB,IAAY,EACZ,OAAgB,EAChB,SAAoB,EACpB,MAAc;IAEd,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IAEzC,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CACV,gCAAgC,WAAW,MAAM,QAAQ,CAAC,MAAM,IAAI;YAClE,mEAAmE,CACtE,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,MAAM,WAAW,CACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,IAAI,EACb,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAChC,CAAC;QACF,OAAO;IACT,CAAC;IAED,kBAAkB;IAClB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC3B,MAAM,WAAW,CACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,IAAI,EACb,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAChC,CAAC;IAEF,MAAM,qBAAqB,CACzB,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,EAC5C,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,KAAM,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,MAAM,KAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,MAAM;gBACN,KAAK,EAAE,KAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,MAAM,KAAK,GACT,KAAM,CAAC,KAAK;gBACZ,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAChE,MAAM,CAAC,YAAY,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE;gBAC9C,KAAK,EAAE,YAAY,WAAW,MAAM,GAAG,CAAC,kBAAkB,EAAE,EAAE;aAC/D,CAAC,CAAC;YAEH,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,WAAW,GAAG,wBAAwB,WAAW;SACtD,IAAI,CAAC,KAAK;YACP,SAAS,CAAC,OAAO;YACjB,SAAS,CAAC,SAAS;;;EAG7B,UAAU;;;;EAIV,IAAI,EAAE,CAAC;YAED,MAAM,QAAQ,GAAG;gBACf;oBACE,IAAI,EAAE,MAAe;oBACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;iBACxD;aACF,CAAC;YAEF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAEpE,MAAM,MAAM,GAAqB,EAAE,CAAC;YAEpC,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC;oBACjB,MAAM;oBACN,KAAK;oBACL,YAAY;oBACZ,KAAK;oBACL,QAAQ;oBACR,OAAO;oBACP,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;oBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YAED,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,MAAM,WAAW,CACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,IAAI,EACb,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAChC,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,0BAA0B,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;YAC1B,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC;YAChE,MAAM,WAAW,CACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,IAAI,EACb,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAChC,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,eAAe,WAAW,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC","sourcesContent":["/**\n * Trigger dispatcher — bridges the event bus to the automation system.\n *\n * On startup, loads all event-triggered jobs from the resources store,\n * subscribes to their events, and dispatches them (condition eval → agent\n * loop) when matching events fire.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { subscribe } from \"../event-bus/index.js\";\nimport type { EventMeta } from \"../event-bus/types.js\";\nimport { resourceListAllOwners, resourcePut } from \"../resources/store.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport {\n  runAgentLoop,\n  actionsToEngineTools,\n  getOwnerActiveApiKey,\n  type ActionEntry,\n} from \"../agent/production-agent.js\";\nimport {\n  getStoredModelForEngine,\n  resolveEngine,\n} from \"../agent/engine/index.js\";\nimport { createThread } from \"../chat-threads/store.js\";\nimport type { AgentChatEvent } from \"../agent/types.js\";\nimport { evaluateCondition } from \"./condition-evaluator.js\";\nimport type { TriggerFrontmatter } from \"./types.js\";\n\n// Re-use the job frontmatter parser — triggers extend the same format.\nconst FRONTMATTER_RE = /^---\\n([\\s\\S]*?)\\n---\\n?([\\s\\S]*)$/;\n\nfunction parseTriggerFrontmatter(content: string): {\n  meta: TriggerFrontmatter;\n  body: string;\n} {\n  const match = content.match(FRONTMATTER_RE);\n  if (!match) {\n    return {\n      meta: {\n        schedule: \"\",\n        enabled: false,\n        triggerType: \"schedule\",\n        mode: \"agentic\",\n      },\n      body: content,\n    };\n  }\n\n  const yamlBlock = match[1];\n  const body = match[2].trim();\n\n  const meta: TriggerFrontmatter = {\n    schedule: \"\",\n    enabled: true,\n    triggerType: \"schedule\",\n    mode: \"agentic\",\n  };\n\n  for (const line of yamlBlock.split(\"\\n\")) {\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx === -1) continue;\n    const key = line.slice(0, colonIdx).trim();\n    let value = line.slice(colonIdx + 1).trim();\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    switch (key) {\n      case \"schedule\":\n        meta.schedule = value;\n        break;\n      case \"enabled\":\n        meta.enabled = value !== \"false\";\n        break;\n      case \"triggerType\":\n        meta.triggerType =\n          value === \"event\" || value === \"schedule\" ? value : \"schedule\";\n        break;\n      case \"event\":\n        meta.event = value;\n        break;\n      case \"condition\":\n        meta.condition = value;\n        break;\n      case \"mode\":\n        meta.mode =\n          value === \"deterministic\" || value === \"agentic\" ? value : \"agentic\";\n        break;\n      case \"domain\":\n        meta.domain = value;\n        break;\n      case \"createdBy\":\n        meta.createdBy = value;\n        break;\n      case \"orgId\":\n        meta.orgId = value;\n        break;\n      case \"runAs\":\n        meta.runAs =\n          value === \"shared\" || value === \"creator\" ? value : undefined;\n        break;\n      case \"lastRun\":\n        meta.lastRun = value;\n        break;\n      case \"lastStatus\":\n        meta.lastStatus = value as TriggerFrontmatter[\"lastStatus\"];\n        break;\n      case \"lastError\":\n        meta.lastError = value;\n        break;\n      case \"nextRun\":\n        meta.nextRun = value;\n        break;\n    }\n  }\n\n  return { meta, body };\n}\n\nfunction buildTriggerContent(meta: TriggerFrontmatter, body: string): string {\n  const lines = [\"---\"];\n  lines.push(`schedule: \"${meta.schedule}\"`);\n  lines.push(`enabled: ${meta.enabled}`);\n  lines.push(`triggerType: ${meta.triggerType}`);\n  if (meta.event) lines.push(`event: ${meta.event}`);\n  if (meta.condition)\n    lines.push(`condition: \"${meta.condition.replace(/\"/g, '\\\\\"')}\"`);\n  lines.push(`mode: ${meta.mode}`);\n  if (meta.domain) lines.push(`domain: ${meta.domain}`);\n  if (meta.createdBy) lines.push(`createdBy: ${meta.createdBy}`);\n  if (meta.orgId) lines.push(`orgId: ${meta.orgId}`);\n  if (meta.runAs) lines.push(`runAs: ${meta.runAs}`);\n  if (meta.lastRun) lines.push(`lastRun: ${meta.lastRun}`);\n  if (meta.lastStatus) lines.push(`lastStatus: ${meta.lastStatus}`);\n  if (meta.lastError)\n    lines.push(`lastError: \"${meta.lastError.replace(/\"/g, '\\\\\"')}\"`);\n  if (meta.nextRun) lines.push(`nextRun: ${meta.nextRun}`);\n  lines.push(\"---\");\n  lines.push(\"\");\n  lines.push(body);\n  return lines.join(\"\\n\");\n}\n\n// ─── Dispatcher deps (same pattern as SchedulerDeps) ────────────────────────\n\nexport interface TriggerDispatcherDeps {\n  getActions: () => Record<string, ActionEntry>;\n  getSystemPrompt: (owner: string) => Promise<string>;\n  apiKey?: string;\n  model?: string;\n  /** App/template id used for org-scoped per-app model defaults. */\n  appId?: string;\n}\n\n// Track active subscriptions to avoid double-subscribing\nconst _subscribedEvents = new Set<string>();\nlet _deps: TriggerDispatcherDeps | null = null;\n\n/**\n * Initialize the trigger dispatcher. Call once at server startup.\n * Loads all event-triggered jobs and subscribes to their events.\n */\nexport async function initTriggerDispatcher(\n  deps: TriggerDispatcherDeps,\n): Promise<void> {\n  _deps = deps;\n  await refreshEventSubscriptions();\n}\n\n/**\n * Refresh event subscriptions from the resource store.\n * Call after creating/updating triggers.\n */\nexport async function refreshEventSubscriptions(): Promise<void> {\n  try {\n    const jobResources = await resourceListAllOwners(\"jobs/\");\n    const eventNames = new Set<string>();\n\n    for (const resource of jobResources) {\n      if (!resource.path.endsWith(\".md\")) continue;\n      const { meta } = parseTriggerFrontmatter(resource.content);\n      if (meta.triggerType === \"event\" && meta.event && meta.enabled) {\n        eventNames.add(meta.event);\n      }\n    }\n\n    for (const eventName of eventNames) {\n      if (!_subscribedEvents.has(eventName)) {\n        subscribe(eventName, (payload, eventMeta) =>\n          handleEvent(eventName, payload, eventMeta),\n        );\n        _subscribedEvents.add(eventName);\n      }\n    }\n  } catch (err) {\n    console.error(\"[triggers] Failed to refresh event subscriptions:\", err);\n  }\n}\n\nasync function handleEvent(\n  eventName: string,\n  payload: unknown,\n  eventMeta: EventMeta,\n): Promise<void> {\n  if (!_deps) return;\n\n  try {\n    const jobResources = await resourceListAllOwners(\"jobs/\");\n    const matchingTriggers = jobResources.filter((r) => {\n      if (!r.path.endsWith(\".md\")) return false;\n      const { meta } = parseTriggerFrontmatter(r.content);\n      // Scope: only dispatch triggers owned by the event's owner,\n      // or shared triggers. Prevents cross-tenant trigger execution.\n      if (\n        eventMeta.owner &&\n        r.owner !== eventMeta.owner &&\n        r.owner !== \"__shared__\"\n      ) {\n        return false;\n      }\n      return (\n        meta.triggerType === \"event\" &&\n        meta.event === eventName &&\n        meta.enabled &&\n        meta.lastStatus !== \"running\"\n      );\n    });\n\n    for (const resource of matchingTriggers) {\n      const { meta, body } = parseTriggerFrontmatter(resource.content);\n      if (!body.trim()) continue;\n\n      // Resolve API key for condition evaluation\n      const owner = meta.createdBy || resource.owner;\n      const userApiKey = await getOwnerActiveApiKey(owner);\n      const apiKey =\n        userApiKey || _deps.apiKey || process.env.ANTHROPIC_API_KEY;\n      if (!apiKey) {\n        console.warn(\n          `[triggers] No API key for trigger \"${resource.path}\" — skipping`,\n        );\n        continue;\n      }\n\n      // Evaluate condition\n      const matches = await evaluateCondition(meta.condition, payload, apiKey);\n      if (!matches) continue;\n\n      // Dispatch\n      if (meta.mode === \"agentic\") {\n        await dispatchAgentic(resource, meta, body, payload, eventMeta, apiKey);\n      } else {\n        console.warn(\n          `[triggers] Deterministic mode not yet implemented for \"${resource.path}\" — skipping`,\n        );\n      }\n    }\n  } catch (err) {\n    console.error(`[triggers] Error handling event \"${eventName}\":`, err);\n  }\n}\n\n/**\n * Validate that the run-as user still exists and (if scoped to an org) is\n * still a member of that org. Mirrors the recurring-jobs scheduler check\n * (audit 12 #10): event-triggered automations must stop firing when the\n * creator is removed/demoted.\n */\nasync function isTriggerRunAsStillValid(\n  jobUserEmail: string,\n  jobOrgId: string | undefined,\n): Promise<{ ok: boolean; reason?: string }> {\n  if (jobUserEmail === \"__shared__\") return { ok: true };\n  try {\n    const { getDbExec } = await import(\"../db/client.js\");\n    const db = getDbExec();\n    const userResult = await db.execute({\n      sql: `SELECT 1 FROM \"user\" WHERE email = ? LIMIT 1`,\n      args: [jobUserEmail],\n    });\n    if (!userResult.rows || userResult.rows.length === 0) {\n      return { ok: false, reason: `user \"${jobUserEmail}\" no longer exists` };\n    }\n    if (jobOrgId) {\n      const memberResult = await db.execute({\n        sql: `SELECT 1 FROM org_members WHERE org_id = ? AND LOWER(email) = LOWER(?) LIMIT 1`,\n        args: [jobOrgId, jobUserEmail],\n      });\n      if (!memberResult.rows || memberResult.rows.length === 0) {\n        return {\n          ok: false,\n          reason: `user \"${jobUserEmail}\" is no longer a member of org \"${jobOrgId}\"`,\n        };\n      }\n    }\n    return { ok: true };\n  } catch (err: any) {\n    const msg = err?.message?.toLowerCase() ?? \"\";\n    if (\n      msg.includes(\"does not exist\") ||\n      msg.includes(\"no such table\") ||\n      msg.includes(\"undefined table\")\n    ) {\n      return { ok: true };\n    }\n    console.warn(\n      `[triggers] User/membership validation failed for \"${jobUserEmail}\":`,\n      err?.message,\n    );\n    return { ok: true };\n  }\n}\n\nasync function dispatchAgentic(\n  resource: { path: string; owner: string; content: string },\n  meta: TriggerFrontmatter,\n  body: string,\n  payload: unknown,\n  eventMeta: EventMeta,\n  apiKey: string,\n): Promise<void> {\n  if (!_deps) return;\n\n  const triggerName = resource.path.replace(/^jobs\\//, \"\").replace(/\\.md$/, \"\");\n  const now = new Date();\n\n  const jobUserEmail = meta.createdBy || resource.owner;\n  const jobOrgId = meta.orgId ?? undefined;\n\n  // SECURITY (audit 12 #10): re-validate the run-as user/membership on\n  // every dispatch. Sharing revocation, user deletion, and org-member\n  // removal must take effect for already-scheduled triggers. Skip the\n  // dispatch on failure; leave the trigger entry alone for admin review.\n  const validity = await isTriggerRunAsStillValid(jobUserEmail, jobOrgId);\n  if (!validity.ok) {\n    console.warn(\n      `[triggers] Skipping trigger \"${triggerName}\": ${validity.reason}. ` +\n        `User/membership no longer valid — leaving entry for admin review.`,\n    );\n    meta.lastRun = now.toISOString();\n    meta.lastStatus = \"skipped\";\n    meta.lastError = validity.reason;\n    await resourcePut(\n      resource.owner,\n      resource.path,\n      buildTriggerContent(meta, body),\n    );\n    return;\n  }\n\n  // Mark as running\n  meta.lastRun = now.toISOString();\n  meta.lastStatus = \"running\";\n  meta.lastError = undefined;\n  await resourcePut(\n    resource.owner,\n    resource.path,\n    buildTriggerContent(meta, body),\n  );\n\n  await runWithRequestContext(\n    { userEmail: jobUserEmail, orgId: jobOrgId },\n    async () => {\n      try {\n        const actions = _deps!.getActions();\n        const systemPrompt = await _deps!.getSystemPrompt(jobUserEmail);\n        const tools = actionsToEngineTools(actions);\n\n        const engine = await resolveEngine({\n          apiKey,\n          appId: _deps!.appId,\n        });\n        const model =\n          _deps!.model ??\n          (await getStoredModelForEngine(engine, { appId: _deps!.appId })) ??\n          engine.defaultModel;\n        const thread = await createThread(jobUserEmail, {\n          title: `Trigger: ${triggerName} — ${now.toLocaleDateString()}`,\n        });\n\n        let payloadStr: string;\n        try {\n          payloadStr = JSON.stringify(payload, null, 2);\n        } catch {\n          payloadStr = String(payload);\n        }\n\n        const triggerText = `[Automation Trigger: ${triggerName}]\nEvent: ${meta.event}\nEvent ID: ${eventMeta.eventId}\nFired at: ${eventMeta.emittedAt}\n\nEvent payload:\n${payloadStr}\n\nExecute the following automation instructions:\n\n${body}`;\n\n        const messages = [\n          {\n            role: \"user\" as const,\n            content: [{ type: \"text\" as const, text: triggerText }],\n          },\n        ];\n\n        const controller = new AbortController();\n        const timeout = setTimeout(() => controller.abort(), 5 * 60 * 1000);\n\n        const events: AgentChatEvent[] = [];\n\n        try {\n          await runAgentLoop({\n            engine,\n            model,\n            systemPrompt,\n            tools,\n            messages,\n            actions,\n            send: (event) => events.push(event),\n            signal: controller.signal,\n          });\n        } finally {\n          clearTimeout(timeout);\n        }\n\n        meta.lastStatus = \"success\";\n        await resourcePut(\n          resource.owner,\n          resource.path,\n          buildTriggerContent(meta, body),\n        );\n\n        console.log(`[triggers] \"${triggerName}\" completed successfully`);\n      } catch (err: any) {\n        meta.lastStatus = \"error\";\n        meta.lastError = err?.message?.slice(0, 200) || \"Unknown error\";\n        await resourcePut(\n          resource.owner,\n          resource.path,\n          buildTriggerContent(meta, body),\n        );\n        console.error(`[triggers] \"${triggerName}\" failed:`, err?.message);\n      }\n    },\n  );\n}\n\nexport { parseTriggerFrontmatter, buildTriggerContent };\n"]}

package/dist/workspace-connections/index.d.ts

@@ -0,0 +1,2 @@
+export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, type ListWorkspaceConnectionProviderCatalogForAppOptions, type ListWorkspaceConnectionGrantsOptions, type ListWorkspaceConnectionsOptions, type ListWorkspaceConnectionsForAppOptions, type ResolvedWorkspaceConnectionForApp, type ResolveWorkspaceConnectionForAppOptions, type SerializedWorkspaceConnectionGrant, type SerializedWorkspaceConnection, type SummarizeWorkspaceConnectionProviderForAppOptions, type SummarizeWorkspaceConnectionProviderReadinessOptions, type UpsertWorkspaceConnectionGrantInput, type UpsertWorkspaceConnectionInput, type WorkspaceConnectionAppAccess, type WorkspaceConnectionAppAccessMode, type WorkspaceConnection, type WorkspaceConnectionCredentialRef, type WorkspaceConnectionExplicitGrantSummary, type WorkspaceConnectionForApp, type WorkspaceConnectionForAppSummary, type WorkspaceConnectionGrant, type WorkspaceConnectionGrantAvailability, type WorkspaceConnectionGrantState, type WorkspaceConnectionProviderAppSummary, type WorkspaceConnectionProviderLike, type WorkspaceConnectionProviderCatalogForApp, type WorkspaceConnectionProviderCatalogForAppItem, type WorkspaceConnectionProviderReadiness, type WorkspaceConnectionProviderReadinessStatus, type WorkspaceConnectionPublicCredentialRef, type WorkspaceConnectionStatus, workspaceConnectionIsAvailableToApp, } from "./store.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/workspace-connections/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/workspace-connections/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,EACtB,2BAA2B,EAC3B,4CAA4C,EAC5C,6BAA6B,EAC7B,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EAChC,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,0CAA0C,EAC1C,6CAA6C,EAC7C,8BAA8B,EAC9B,yBAAyB,EACzB,KAAK,mDAAmD,EACxD,KAAK,oCAAoC,EACzC,KAAK,+BAA+B,EACpC,KAAK,qCAAqC,EAC1C,KAAK,iCAAiC,EACtC,KAAK,uCAAuC,EAC5C,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,KAAK,iDAAiD,EACtD,KAAK,oDAAoD,EACzD,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,uCAAuC,EAC5C,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,EAC7B,KAAK,oCAAoC,EACzC,KAAK,6BAA6B,EAClC,KAAK,qCAAqC,EAC1C,KAAK,+BAA+B,EACpC,KAAK,wCAAwC,EAC7C,KAAK,4CAA4C,EACjD,KAAK,oCAAoC,EACzC,KAAK,0CAA0C,EAC/C,KAAK,sCAAsC,EAC3C,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,YAAY,CAAC"}

package/dist/workspace-connections/index.js

@@ -0,0 +1,2 @@
+export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, workspaceConnectionIsAvailableToApp, } from "./store.js";
+//# sourceMappingURL=index.js.map

package/dist/workspace-connections/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/workspace-connections/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,EACtB,2BAA2B,EAC3B,4CAA4C,EAC5C,6BAA6B,EAC7B,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EAChC,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,0CAA0C,EAC1C,6CAA6C,EAC7C,8BAA8B,EAC9B,yBAAyB,EA+BzB,mCAAmC,GACpC,MAAM,YAAY,CAAC","sourcesContent":["export {\n  deleteWorkspaceConnection,\n  ensureWorkspaceConnectionsTable,\n  getWorkspaceConnectionAppAccess,\n  getWorkspaceConnection,\n  getWorkspaceConnectionGrant,\n  listWorkspaceConnectionProviderCatalogForApp,\n  listWorkspaceConnectionGrants,\n  listWorkspaceConnections,\n  listWorkspaceConnectionsForApp,\n  resolveWorkspaceConnectionForApp,\n  revokeWorkspaceConnectionGrant,\n  serializeWorkspaceConnectionGrant,\n  serializeWorkspaceConnection,\n  summarizeWorkspaceConnectionProviderForApp,\n  summarizeWorkspaceConnectionProviderReadiness,\n  upsertWorkspaceConnectionGrant,\n  upsertWorkspaceConnection,\n  type ListWorkspaceConnectionProviderCatalogForAppOptions,\n  type ListWorkspaceConnectionGrantsOptions,\n  type ListWorkspaceConnectionsOptions,\n  type ListWorkspaceConnectionsForAppOptions,\n  type ResolvedWorkspaceConnectionForApp,\n  type ResolveWorkspaceConnectionForAppOptions,\n  type SerializedWorkspaceConnectionGrant,\n  type SerializedWorkspaceConnection,\n  type SummarizeWorkspaceConnectionProviderForAppOptions,\n  type SummarizeWorkspaceConnectionProviderReadinessOptions,\n  type UpsertWorkspaceConnectionGrantInput,\n  type UpsertWorkspaceConnectionInput,\n  type WorkspaceConnectionAppAccess,\n  type WorkspaceConnectionAppAccessMode,\n  type WorkspaceConnection,\n  type WorkspaceConnectionCredentialRef,\n  type WorkspaceConnectionExplicitGrantSummary,\n  type WorkspaceConnectionForApp,\n  type WorkspaceConnectionForAppSummary,\n  type WorkspaceConnectionGrant,\n  type WorkspaceConnectionGrantAvailability,\n  type WorkspaceConnectionGrantState,\n  type WorkspaceConnectionProviderAppSummary,\n  type WorkspaceConnectionProviderLike,\n  type WorkspaceConnectionProviderCatalogForApp,\n  type WorkspaceConnectionProviderCatalogForAppItem,\n  type WorkspaceConnectionProviderReadiness,\n  type WorkspaceConnectionProviderReadinessStatus,\n  type WorkspaceConnectionPublicCredentialRef,\n  type WorkspaceConnectionStatus,\n  workspaceConnectionIsAvailableToApp,\n} from \"./store.js\";\n"]}