@agent-native/scheduling 0.1.60 → 0.1.61-nightly-20260910160638

package/dist/actions/get-event-type.js

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core/action";
+import { assertAccess } from "@agent-native/core/sharing";
 import { z } from "zod";
 import { getEventTypeById, getEventTypeBySlug, } from "../server/event-types-repo.js";
 export default defineAction({
@@ -10,8 +11,10 @@ export default defineAction({
         teamId: z.string().optional(),
     }),
     run: async (args) => {
-        if (args.id)
+        if (args.id) {
+            await assertAccess("event-type", args.id, "viewer");
             return { eventType: await getEventTypeById(args.id) };
+        }
         if (args.slug) {
             return {
                 eventType: await getEventTypeBySlug({

package/dist/actions/get-event-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-event-type.js","sourceRoot":"","sources":["../../src/actions/get-event-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAEvC,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,+CAA+C;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO;gBACL,SAAS,EAAE,MAAM,kBAAkB,CAAC;oBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"get-event-type.js","sourceRoot":"","sources":["../../src/actions/get-event-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAEvC,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,+CAA+C;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO;gBACL,SAAS,EAAE,MAAM,kBAAkB,CAAC;oBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;CACF,CAAC,CAAC"}

package/dist/actions/list-routing-form-responses.js

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core/action";
+import { assertAccess } from "@agent-native/core/sharing";
 import { eq, desc } from "drizzle-orm";
 import { z } from "zod";
 import { getSchedulingContext } from "../server/context.js";
@@ -6,6 +7,7 @@ export default defineAction({
     description: "List responses to a routing form",
     schema: z.object({ formId: z.string(), limit: z.number().optional() }),
     run: async (args) => {
+        await assertAccess("routing-form", args.formId, "viewer");
         const { getDb, schema } = getSchedulingContext();
         const rows = await getDb()
             .select()

package/dist/actions/list-routing-form-responses.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-routing-form-responses.js","sourceRoot":"","sources":["../../src/actions/list-routing-form-responses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,kCAAkC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;aACjC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;aAC1D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;aACpD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QAC5B,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBAC/B,GAAG,CAAC;gBACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;aACjC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"list-routing-form-responses.js","sourceRoot":"","sources":["../../src/actions/list-routing-form-responses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,kCAAkC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;aACjC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;aAC1D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;aACpD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QAC5B,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBAC/B,GAAG,CAAC;gBACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;aACjC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/scheduling",
-  "version": "0.1.60",
+  "version": "0.1.61-nightly-20260910160638",
   "description": "Scheduling primitives for agent-native apps — event types, availability, bookings, team scheduling, workflows, and routing forms.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -56,7 +56,7 @@
     "nanoid": "^5.1.9",
     "rrule": "^2.8.1",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "^0.19.6"
+    "@agent-native/toolkit": "^0.19.7-nightly-20260910160638"
   },
   "devDependencies": {
     "@tabler/icons-react": "^3.41.1",
@@ -66,10 +66,10 @@
     "react": "^19.2.5",
     "typescript-7": "npm:typescript@^7.0.2",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.178.0"
+    "@agent-native/core": "0.178.1-nightly-20260910160638"
   },
   "peerDependencies": {
-    "@agent-native/core": ">=0.8.0",
+    "@agent-native/core": "0.178.1-nightly-20260910160638",
     "@tabler/icons-react": "^3.41.1",
     "drizzle-orm": ">=0.45",
     "react": ">=18",

package/src/actions/event-type-authz.spec.ts

@@ -23,6 +23,8 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import * as schema from "../schema/index.js";
 import { setSchedulingContext } from "../server/context.js";
 import duplicateEventType from "./duplicate-event-type.js";
+import getEventType from "./get-event-type.js";
+import listRoutingFormResponses from "./list-routing-form-responses.js";
 import revokePrivateLink from "./revoke-private-link.js";
 
 const OWNER_EMAIL = "owner@example.com";
@@ -115,6 +117,48 @@ beforeEach(async () => {
       notified_at TEXT
     );
   `);
+  await execute(`
+    CREATE TABLE routing_forms (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      description TEXT,
+      team_id TEXT,
+      disabled BOOLEAN NOT NULL DEFAULT false,
+      fields TEXT NOT NULL DEFAULT '[]',
+      rules TEXT NOT NULL DEFAULT '[]',
+      fallback TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      owner_email TEXT NOT NULL DEFAULT 'local@localhost',
+      org_id TEXT,
+      visibility TEXT NOT NULL DEFAULT 'private'
+    );
+  `);
+  await execute(`
+    CREATE TABLE routing_form_shares (
+      id TEXT PRIMARY KEY,
+      resource_id TEXT NOT NULL,
+      principal_type TEXT NOT NULL,
+      principal_id TEXT NOT NULL,
+      role TEXT NOT NULL DEFAULT 'viewer',
+      created_by TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      notified_at TEXT
+    );
+  `);
+  await execute(`
+    CREATE TABLE routing_form_responses (
+      id TEXT PRIMARY KEY,
+      form_id TEXT NOT NULL,
+      response TEXT NOT NULL,
+      booking_id TEXT,
+      matched_rule_id TEXT,
+      routed_to TEXT,
+      submitter_email TEXT,
+      submitter_ip TEXT,
+      created_at TEXT NOT NULL
+    );
+  `);
 
   const db = createGetDb(schema)();
   setSchedulingContext({
@@ -133,6 +177,13 @@ beforeEach(async () => {
     displayName: "Event Type",
     getDb: () => db,
   });
+  registerShareableResource({
+    type: "routing-form",
+    resourceTable: schema.routingForms,
+    sharesTable: schema.routingFormShares,
+    displayName: "Routing Form",
+    getDb: () => db,
+  });
 
   const now = new Date().toISOString();
   await execute({
@@ -150,6 +201,23 @@ beforeEach(async () => {
       "private",
     ],
   });
+  await execute({
+    sql: `INSERT INTO routing_forms (
+      id, name, created_at, updated_at, owner_email, visibility
+    ) VALUES (?, ?, ?, ?, ?, ?)`,
+    args: ["form-1", "Test Form", now, now, OWNER_EMAIL, "private"],
+  });
+  await execute({
+    sql: `INSERT INTO routing_form_responses (
+      id, form_id, response, created_at
+    ) VALUES (?, ?, ?, ?)`,
+    args: [
+      "resp-1",
+      "form-1",
+      JSON.stringify({ email: "lead@example.com" }),
+      now,
+    ],
+  });
   await execute({
     sql: `INSERT INTO hashed_links (id, hash, event_type_id, created_at) VALUES (?, ?, ?, ?)`,
     args: ["link-1", HASH, EVENT_TYPE_ID, now],
@@ -221,3 +289,41 @@ describe("duplicate-event-type authorization", () => {
     expect(await eventTypeCount()).toBe(2);
   });
 });
+
+describe("get-event-type authorization", () => {
+  it("rejects an outsider querying by id without access", async () => {
+    await expect(
+      runWithRequestContext({ userEmail: OUTSIDER_EMAIL }, () =>
+        getEventType.run({ id: EVENT_TYPE_ID }),
+      ),
+    ).rejects.toBeInstanceOf(ForbiddenError);
+  });
+
+  it("allows the owner to get an event type by id", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OWNER_EMAIL },
+      () => getEventType.run({ id: EVENT_TYPE_ID }),
+    );
+    expect(result.eventType?.id).toBe(EVENT_TYPE_ID);
+    expect(result.eventType?.title).toBe("30 Min Meeting");
+  });
+});
+
+describe("list-routing-form-responses authorization", () => {
+  it("rejects an outsider with no access to the routing form", async () => {
+    await expect(
+      runWithRequestContext({ userEmail: OUTSIDER_EMAIL }, () =>
+        listRoutingFormResponses.run({ formId: "form-1" }),
+      ),
+    ).rejects.toBeInstanceOf(ForbiddenError);
+  });
+
+  it("allows the owner to list form responses", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OWNER_EMAIL },
+      () => listRoutingFormResponses.run({ formId: "form-1" }),
+    );
+    expect(result.responses).toHaveLength(1);
+    expect(result.responses[0].id).toBe("resp-1");
+  });
+});

package/src/actions/get-event-type.ts

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core/action";
+import { assertAccess } from "@agent-native/core/sharing";
 import { z } from "zod";
 
 import {
@@ -15,7 +16,10 @@ export default defineAction({
     teamId: z.string().optional(),
   }),
   run: async (args) => {
-    if (args.id) return { eventType: await getEventTypeById(args.id) };
+    if (args.id) {
+      await assertAccess("event-type", args.id, "viewer");
+      return { eventType: await getEventTypeById(args.id) };
+    }
     if (args.slug) {
       return {
         eventType: await getEventTypeBySlug({

package/src/actions/list-routing-form-responses.ts

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core/action";
+import { assertAccess } from "@agent-native/core/sharing";
 import { eq, desc } from "drizzle-orm";
 import { z } from "zod";
 
@@ -8,6 +9,7 @@ export default defineAction({
   description: "List responses to a routing form",
   schema: z.object({ formId: z.string(), limit: z.number().optional() }),
   run: async (args) => {
+    await assertAccess("routing-form", args.formId, "viewer");
     const { getDb, schema } = getSchedulingContext();
     const rows = await getDb()
       .select()