@aglyn/plugins-ai 1.0.0-beta.143

package/src/lib/server/ai-jobs-beat-route.js

@@ -0,0 +1,86 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // lockdown-423: exempt — server-internal cron (x-cron-secret) with no user
+// caller and no org of its own; it asks the ai-generate switch, which
+// composes the platform lock, before it claims a step.
+import { writeCronBeat } from "@aglyn/aglyn/server";
+import { firebaseAdmin, safeEqual } from "@aglyn/tenant-data-admin";
+import { AI_JOBS_BEAT_CRON_ID, runAiJobsBeat } from "../jobs/ai-jobs-beat.js";
+/**
+ * THE AI JOBS BEAT (AGL-3026): `POST /api/admin/ai-jobs-beat`.
+ *
+ * Cloud Scheduler calls it every minute through `consoleAiJobsBeat` in
+ * `cloud/functions`, carrying the console's `CRON_SECRET` as
+ * `x-cron-secret`: the same secret, headers and refusals as the console's
+ * other scheduled sweeps, so rotating the secret is still one act. It answers
+ * 405 to anything but a POST, 501 while the secret is unset, so an
+ * unconfigured deployment cannot be made to spend, and 401 for anything but
+ * the secret.
+ *
+ * The console app serves it from a route of its own at the same path, which
+ * gives a sweep the function time the slowest step needs; the plugin
+ * dispatcher's ceiling is a door's. See `AI_JOB_SWEEP_BUDGET_MS`.
+ *
+ * It answers 200 with what the beat did, a beat the switch held included:
+ * a lock is an operator's decision rather than a fault, and the caller logs
+ * every refusal it gets.
+ */ export async function POST(request) {
+    if (request.method !== 'POST') {
+        return Response.json({
+            error: 'Method not allowed'
+        }, {
+            status: 405
+        });
+    }
+    const secret = process.env.CRON_SECRET;
+    if (!secret) {
+        return Response.json({
+            error: 'The AI jobs beat is not configured (CRON_SECRET).'
+        }, {
+            status: 501
+        });
+    }
+    // Either spelling the console's scheduled routes accept (`cron-auth.ts`):
+    // the header an external scheduler sends, or a bearer.
+    if (!safeEqual(request.headers.get('x-cron-secret'), secret) && !safeEqual(request.headers.get('authorization'), `Bearer ${secret}`)) {
+        return Response.json({
+            error: 'Unauthenticated'
+        }, {
+            status: 401
+        });
+    }
+    // The mark `/api/health/crons` reads to notice this job going away
+    // (AGL-1955). Stamped on the invocation rather than on the work, and before
+    // the switch: a beat the switch holds is still a beat that fired, and an
+    // idle queue looks exactly like a dead schedule otherwise.
+    await writeCronBeat(firebaseAdmin.app().firestore(), AI_JOBS_BEAT_CRON_ID);
+    try {
+        return Response.json(await runAiJobsBeat(), {
+            status: 200
+        });
+    } catch (error) {
+        // A step's own failure is isolated inside the sweep; this is the queue
+        // read or the switch itself failing, and the next beat asks again.
+        console.error('ai jobs beat failed', error);
+        return Response.json({
+            error: 'The AI jobs beat failed'
+        }, {
+            status: 500
+        });
+    }
+}
+
+//# sourceMappingURL=ai-jobs-beat-route.js.map

package/src/lib/server/ai-jobs-beat-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-jobs-beat-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// lockdown-423: exempt — server-internal cron (x-cron-secret) with no user\n// caller and no org of its own; it asks the ai-generate switch, which\n// composes the platform lock, before it claims a step.\n\nimport { writeCronBeat } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, safeEqual } from '@aglyn/tenant-data-admin'\nimport { AI_JOBS_BEAT_CRON_ID, runAiJobsBeat } from '../jobs/ai-jobs-beat'\n\n/**\n * THE AI JOBS BEAT (AGL-3026): `POST /api/admin/ai-jobs-beat`.\n *\n * Cloud Scheduler calls it every minute through `consoleAiJobsBeat` in\n * `cloud/functions`, carrying the console's `CRON_SECRET` as\n * `x-cron-secret`: the same secret, headers and refusals as the console's\n * other scheduled sweeps, so rotating the secret is still one act. It answers\n * 405 to anything but a POST, 501 while the secret is unset, so an\n * unconfigured deployment cannot be made to spend, and 401 for anything but\n * the secret.\n *\n * The console app serves it from a route of its own at the same path, which\n * gives a sweep the function time the slowest step needs; the plugin\n * dispatcher's ceiling is a door's. See `AI_JOB_SWEEP_BUDGET_MS`.\n *\n * It answers 200 with what the beat did, a beat the switch held included:\n * a lock is an operator's decision rather than a fault, and the caller logs\n * every refusal it gets.\n */\nexport async function POST(request: Request): Promise<Response> {\n  if (request.method !== 'POST') {\n    return Response.json({ error: 'Method not allowed' }, { status: 405 })\n  }\n  const secret = process.env.CRON_SECRET\n  if (!secret) {\n    return Response.json(\n      { error: 'The AI jobs beat is not configured (CRON_SECRET).' },\n      { status: 501 },\n    )\n  }\n  // Either spelling the console's scheduled routes accept (`cron-auth.ts`):\n  // the header an external scheduler sends, or a bearer.\n  if (\n    !safeEqual(request.headers.get('x-cron-secret'), secret) &&\n    !safeEqual(request.headers.get('authorization'), `Bearer ${secret}`)\n  ) {\n    return Response.json({ error: 'Unauthenticated' }, { status: 401 })\n  }\n  // The mark `/api/health/crons` reads to notice this job going away\n  // (AGL-1955). Stamped on the invocation rather than on the work, and before\n  // the switch: a beat the switch holds is still a beat that fired, and an\n  // idle queue looks exactly like a dead schedule otherwise.\n  await writeCronBeat(firebaseAdmin.app().firestore(), AI_JOBS_BEAT_CRON_ID)\n  try {\n    return Response.json(await runAiJobsBeat(), { status: 200 })\n  } catch (error) {\n    // A step's own failure is isolated inside the sweep; this is the queue\n    // read or the switch itself failing, and the next beat asks again.\n    console.error('ai jobs beat failed', error)\n    return Response.json({ error: 'The AI jobs beat failed' }, { status: 500 })\n  }\n}\n"],"names":["writeCronBeat","firebaseAdmin","safeEqual","AI_JOBS_BEAT_CRON_ID","runAiJobsBeat","POST","request","method","Response","json","error","status","secret","process","env","CRON_SECRET","headers","get","app","firestore","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,2EAA2E;AAC3E,sEAAsE;AACtE,uDAAuD;AAEvD,SAASA,aAAa,QAAQ,sBAAqB;AACnD,SAASC,aAAa,EAAEC,SAAS,QAAQ,2BAA0B;AACnE,SAASC,oBAAoB,EAAEC,aAAa,QAAQ,0BAAsB;AAE1E;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,eAAeC,KAAKC,OAAgB;IACzC,IAAIA,QAAQC,MAAM,KAAK,QAAQ;QAC7B,OAAOC,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAqB,GAAG;YAAEC,QAAQ;QAAI;IACtE;IACA,MAAMC,SAASC,QAAQC,GAAG,CAACC,WAAW;IACtC,IAAI,CAACH,QAAQ;QACX,OAAOJ,SAASC,IAAI,CAClB;YAAEC,OAAO;QAAoD,GAC7D;YAAEC,QAAQ;QAAI;IAElB;IACA,0EAA0E;IAC1E,uDAAuD;IACvD,IACE,CAACT,UAAUI,QAAQU,OAAO,CAACC,GAAG,CAAC,kBAAkBL,WACjD,CAACV,UAAUI,QAAQU,OAAO,CAACC,GAAG,CAAC,kBAAkB,CAAC,OAAO,EAAEL,QAAQ,GACnE;QACA,OAAOJ,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAkB,GAAG;YAAEC,QAAQ;QAAI;IACnE;IACA,mEAAmE;IACnE,4EAA4E;IAC5E,yEAAyE;IACzE,2DAA2D;IAC3D,MAAMX,cAAcC,cAAciB,GAAG,GAAGC,SAAS,IAAIhB;IACrD,IAAI;QACF,OAAOK,SAASC,IAAI,CAAC,MAAML,iBAAiB;YAAEO,QAAQ;QAAI;IAC5D,EAAE,OAAOD,OAAO;QACd,uEAAuE;QACvE,mEAAmE;QACnEU,QAAQV,KAAK,CAAC,uBAAuBA;QACrC,OAAOF,SAASC,IAAI,CAAC;YAAEC,OAAO;QAA0B,GAAG;YAAEC,QAAQ;QAAI;IAC3E;AACF"}

package/src/lib/server/ai-jobs-cancel.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Cancel a job (AGL-2904). Idempotent: a job already terminal answers as
+ * it is, unchanged. A step in flight is not interrupted — the runner that
+ * holds its lease records what it cost and finds the job canceled when it
+ * goes to complete it — so a cancel is never a way to spend tokens the
+ * document does not show. Audited per cancel that changed something.
+ */
+export declare function POST(request: Request, context: {
+    params: Promise<{
+        jobId: string;
+    }>;
+}): Promise<Response>;
+export declare const dynamic = "force-dynamic";
+export declare const maxDuration = 60;

package/src/lib/server/ai-jobs-cancel.js

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // lockdown-423: via libs/plugins/ai/src/lib/server/ai-jobs-gate.ts
+import { aiJobSummary, cancelAiJob, getAiJob, writeAiJobAudit } from "../jobs/ai-jobs.js";
+import { aiJobsGate } from "./ai-jobs-gate.js";
+/**
+ * Cancel a job (AGL-2904). Idempotent: a job already terminal answers as
+ * it is, unchanged. A step in flight is not interrupted — the runner that
+ * holds its lease records what it cost and finds the job canceled when it
+ * goes to complete it — so a cancel is never a way to spend tokens the
+ * document does not show. Audited per cancel that changed something.
+ */ export async function POST(request, context) {
+    var _ref, _gate_decoded_email;
+    let payload;
+    try {
+        payload = await request.json();
+    } catch (unused) {
+        payload = null;
+    }
+    const gate = await aiJobsGate(request, String((_ref = payload == null ? void 0 : payload.orgId) != null ? _ref : ''));
+    if (gate instanceof Response) return gate;
+    const { jobId } = await context.params;
+    const existing = await getAiJob(gate.firestore, gate.orgId, jobId);
+    if (!existing) return Response.json({
+        error: 'Unknown job'
+    }, {
+        status: 404
+    });
+    const now = new Date();
+    // The machine writes the org feed's row with this actor when the cancel
+    // changed something; the staff audit row below is this route's own.
+    const { job, changed } = await cancelAiJob(gate.firestore, gate.orgId, jobId, now, {
+        uid: gate.uid,
+        email: (_gate_decoded_email = gate.decoded.email) != null ? _gate_decoded_email : null
+    });
+    if (changed) {
+        var _gate_decoded_email1;
+        await writeAiJobAudit(gate.firestore, {
+            action: 'ai.job.cancel',
+            actorUid: gate.uid,
+            actorEmail: (_gate_decoded_email1 = gate.decoded.email) != null ? _gate_decoded_email1 : null,
+            orgId: gate.orgId,
+            jobId,
+            after: {
+                status: 'canceled',
+                wasStatus: existing.status,
+                kind: existing.kind
+            }
+        });
+    }
+    return Response.json({
+        job: aiJobSummary(job, now),
+        changed
+    }, {
+        status: 200
+    });
+}
+export const dynamic = 'force-dynamic';
+export const maxDuration = 60;
+
+//# sourceMappingURL=ai-jobs-cancel.js.map

package/src/lib/server/ai-jobs-cancel.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-jobs-cancel.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// lockdown-423: via libs/plugins/ai/src/lib/server/ai-jobs-gate.ts\n\nimport {\n  aiJobSummary,\n  cancelAiJob,\n  getAiJob,\n  writeAiJobAudit,\n} from '../jobs/ai-jobs'\nimport { aiJobsGate } from './ai-jobs-gate'\n\n/**\n * Cancel a job (AGL-2904). Idempotent: a job already terminal answers as\n * it is, unchanged. A step in flight is not interrupted — the runner that\n * holds its lease records what it cost and finds the job canceled when it\n * goes to complete it — so a cancel is never a way to spend tokens the\n * document does not show. Audited per cancel that changed something.\n */\nexport async function POST(\n  request: Request,\n  context: { params: Promise<{ jobId: string }> },\n): Promise<Response> {\n  let payload: Record<string, unknown> | null\n  try {\n    payload = (await request.json()) as Record<string, unknown>\n  } catch {\n    payload = null\n  }\n  const gate = await aiJobsGate(request, String(payload?.orgId ?? ''))\n  if (gate instanceof Response) return gate\n  const { jobId } = await context.params\n  const existing = await getAiJob(gate.firestore, gate.orgId, jobId)\n  if (!existing) return Response.json({ error: 'Unknown job' }, { status: 404 })\n  const now = new Date()\n  // The machine writes the org feed's row with this actor when the cancel\n  // changed something; the staff audit row below is this route's own.\n  const { job, changed } = await cancelAiJob(gate.firestore, gate.orgId, jobId, now, {\n    uid: gate.uid,\n    email: gate.decoded.email ?? null,\n  })\n  if (changed) {\n    await writeAiJobAudit(gate.firestore, {\n      action: 'ai.job.cancel',\n      actorUid: gate.uid,\n      actorEmail: gate.decoded.email ?? null,\n      orgId: gate.orgId,\n      jobId,\n      after: { status: 'canceled', wasStatus: existing.status, kind: existing.kind },\n    })\n  }\n  return Response.json({ job: aiJobSummary(job, now), changed }, { status: 200 })\n}\n\nexport const dynamic = 'force-dynamic'\nexport const maxDuration = 60\n"],"names":["aiJobSummary","cancelAiJob","getAiJob","writeAiJobAudit","aiJobsGate","POST","request","context","gate","payload","json","String","orgId","Response","jobId","params","existing","firestore","error","status","now","Date","job","changed","uid","email","decoded","action","actorUid","actorEmail","after","wasStatus","kind","dynamic","maxDuration"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,mEAAmE;AAEnE,SACEA,YAAY,EACZC,WAAW,EACXC,QAAQ,EACRC,eAAe,QACV,qBAAiB;AACxB,SAASC,UAAU,QAAQ,oBAAgB;AAE3C;;;;;;CAMC,GACD,OAAO,eAAeC,KACpBC,OAAgB,EAChBC,OAA+C;cAkBtCC;IAhBT,IAAIC;IACJ,IAAI;QACFA,UAAW,MAAMH,QAAQI,IAAI;IAC/B,EAAE,eAAM;QACND,UAAU;IACZ;IACA,MAAMD,OAAO,MAAMJ,WAAWE,SAASK,eAAOF,2BAAAA,QAASG,KAAK,mBAAI;IAChE,IAAIJ,gBAAgBK,UAAU,OAAOL;IACrC,MAAM,EAAEM,KAAK,EAAE,GAAG,MAAMP,QAAQQ,MAAM;IACtC,MAAMC,WAAW,MAAMd,SAASM,KAAKS,SAAS,EAAET,KAAKI,KAAK,EAAEE;IAC5D,IAAI,CAACE,UAAU,OAAOH,SAASH,IAAI,CAAC;QAAEQ,OAAO;IAAc,GAAG;QAAEC,QAAQ;IAAI;IAC5E,MAAMC,MAAM,IAAIC;IAChB,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,EAAEC,GAAG,EAAEC,OAAO,EAAE,GAAG,MAAMtB,YAAYO,KAAKS,SAAS,EAAET,KAAKI,KAAK,EAAEE,OAAOM,KAAK;QACjFI,KAAKhB,KAAKgB,GAAG;QACbC,KAAK,GAAEjB,sBAAAA,KAAKkB,OAAO,CAACD,KAAK,YAAlBjB,sBAAsB;IAC/B;IACA,IAAIe,SAAS;YAIGf;QAHd,MAAML,gBAAgBK,KAAKS,SAAS,EAAE;YACpCU,QAAQ;YACRC,UAAUpB,KAAKgB,GAAG;YAClBK,UAAU,GAAErB,uBAAAA,KAAKkB,OAAO,CAACD,KAAK,YAAlBjB,uBAAsB;YAClCI,OAAOJ,KAAKI,KAAK;YACjBE;YACAgB,OAAO;gBAAEX,QAAQ;gBAAYY,WAAWf,SAASG,MAAM;gBAAEa,MAAMhB,SAASgB,IAAI;YAAC;QAC/E;IACF;IACA,OAAOnB,SAASH,IAAI,CAAC;QAAEY,KAAKtB,aAAasB,KAAKF;QAAMG;IAAQ,GAAG;QAAEJ,QAAQ;IAAI;AAC/E;AAEA,OAAO,MAAMc,UAAU,gBAAe;AACtC,OAAO,MAAMC,cAAc,GAAE"}

package/src/lib/server/ai-jobs-events-route.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * One job's progress as server-sent events (AGL-2904): a `state` event
+ * now, a re-read every two seconds until the job is terminal, and a
+ * `reconnect` event at 55 s so no stream outlives the route's
+ * `maxDuration`. The read gate answers who may watch; the job id is only
+ * ever resolved under the org the request named, so a member of one
+ * workspace cannot watch another's job by guessing an id.
+ */
+export declare function GET(request: Request, context: {
+    params: Promise<{
+        jobId: string;
+    }>;
+}): Promise<Response>;
+export declare const dynamic = "force-dynamic";
+export declare const maxDuration = 60;

package/src/lib/server/ai-jobs-events-route.js

@@ -0,0 +1,51 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // lockdown-423: via libs/plugins/ai/src/lib/server/ai-jobs-gate.ts
+import { aiJobSummary, getAiJob } from "../jobs/ai-jobs.js";
+import { aiJobEventResponse, aiJobEventStream } from "./ai-jobs-events.js";
+import { aiJobsGate } from "./ai-jobs-gate.js";
+/**
+ * One job's progress as server-sent events (AGL-2904): a `state` event
+ * now, a re-read every two seconds until the job is terminal, and a
+ * `reconnect` event at 55 s so no stream outlives the route's
+ * `maxDuration`. The read gate answers who may watch; the job id is only
+ * ever resolved under the org the request named, so a member of one
+ * workspace cannot watch another's job by guessing an id.
+ */ export async function GET(request, context) {
+    var _url_searchParams_get;
+    const url = new URL(request.url);
+    const gate = await aiJobsGate(request, (_url_searchParams_get = url.searchParams.get('orgId')) != null ? _url_searchParams_get : '');
+    if (gate instanceof Response) return gate;
+    const { jobId } = await context.params;
+    const read = async ()=>{
+        const job = await getAiJob(gate.firestore, gate.orgId, jobId);
+        return job ? aiJobSummary(job) : null;
+    };
+    const initial = await read();
+    if (!initial) return Response.json({
+        error: 'Unknown job'
+    }, {
+        status: 404
+    });
+    return aiJobEventResponse(aiJobEventStream(initial, {
+        read,
+        signal: request.signal
+    }));
+}
+export const dynamic = 'force-dynamic';
+export const maxDuration = 60;
+
+//# sourceMappingURL=ai-jobs-events-route.js.map

package/src/lib/server/ai-jobs-events-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-jobs-events-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// lockdown-423: via libs/plugins/ai/src/lib/server/ai-jobs-gate.ts\n\nimport {\n  aiJobSummary,\n  getAiJob,\n} from '../jobs/ai-jobs'\nimport { aiJobEventResponse, aiJobEventStream } from './ai-jobs-events'\nimport { aiJobsGate } from './ai-jobs-gate'\n\n/**\n * One job's progress as server-sent events (AGL-2904): a `state` event\n * now, a re-read every two seconds until the job is terminal, and a\n * `reconnect` event at 55 s so no stream outlives the route's\n * `maxDuration`. The read gate answers who may watch; the job id is only\n * ever resolved under the org the request named, so a member of one\n * workspace cannot watch another's job by guessing an id.\n */\nexport async function GET(\n  request: Request,\n  context: { params: Promise<{ jobId: string }> },\n): Promise<Response> {\n  const url = new URL(request.url)\n  const gate = await aiJobsGate(request, url.searchParams.get('orgId') ?? '')\n  if (gate instanceof Response) return gate\n  const { jobId } = await context.params\n  const read = async () => {\n    const job = await getAiJob(gate.firestore, gate.orgId, jobId)\n    return job ? aiJobSummary(job) : null\n  }\n  const initial = await read()\n  if (!initial) return Response.json({ error: 'Unknown job' }, { status: 404 })\n  return aiJobEventResponse(\n    aiJobEventStream(initial, { read, signal: request.signal }),\n  )\n}\n\nexport const dynamic = 'force-dynamic'\nexport const maxDuration = 60\n"],"names":["aiJobSummary","getAiJob","aiJobEventResponse","aiJobEventStream","aiJobsGate","GET","request","context","url","URL","gate","searchParams","get","Response","jobId","params","read","job","firestore","orgId","initial","json","error","status","signal","dynamic","maxDuration"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,mEAAmE;AAEnE,SACEA,YAAY,EACZC,QAAQ,QACH,qBAAiB;AACxB,SAASC,kBAAkB,EAAEC,gBAAgB,QAAQ,sBAAkB;AACvE,SAASC,UAAU,QAAQ,oBAAgB;AAE3C;;;;;;;CAOC,GACD,OAAO,eAAeC,IACpBC,OAAgB,EAChBC,OAA+C;QAGRC;IADvC,MAAMA,MAAM,IAAIC,IAAIH,QAAQE,GAAG;IAC/B,MAAME,OAAO,MAAMN,WAAWE,UAASE,wBAAAA,IAAIG,YAAY,CAACC,GAAG,CAAC,oBAArBJ,wBAAiC;IACxE,IAAIE,gBAAgBG,UAAU,OAAOH;IACrC,MAAM,EAAEI,KAAK,EAAE,GAAG,MAAMP,QAAQQ,MAAM;IACtC,MAAMC,OAAO;QACX,MAAMC,MAAM,MAAMhB,SAASS,KAAKQ,SAAS,EAAER,KAAKS,KAAK,EAAEL;QACvD,OAAOG,MAAMjB,aAAaiB,OAAO;IACnC;IACA,MAAMG,UAAU,MAAMJ;IACtB,IAAI,CAACI,SAAS,OAAOP,SAASQ,IAAI,CAAC;QAAEC,OAAO;IAAc,GAAG;QAAEC,QAAQ;IAAI;IAC3E,OAAOrB,mBACLC,iBAAiBiB,SAAS;QAAEJ;QAAMQ,QAAQlB,QAAQkB,MAAM;IAAC;AAE7D;AAEA,OAAO,MAAMC,UAAU,gBAAe;AACtC,OAAO,MAAMC,cAAc,GAAE"}

package/src/lib/server/ai-jobs-events.d.ts

@@ -0,0 +1,55 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { AiJobSummary } from '../model/ai-jobs.types';
+/**
+ * One job's progress as a server-sent event stream (AGL-2904).
+ *
+ * The console has no Firestore listener on `aiJobs` — the collection is
+ * client-readable, but the drawer reads through the route so the same
+ * membership, flag and entitlement rungs answer every read — so progress
+ * is a poll the SERVER runs on the client's behalf: one `state` event the
+ * moment the stream opens, then a re-read every `intervalMs` that emits
+ * only when the document moved, until the job is terminal or the stream
+ * has been open for `deadlineMs`. At the deadline a `reconnect` event
+ * tells the drawer to open a fresh stream, which keeps every stream inside
+ * the route's `maxDuration` rather than trusting the platform to cut it.
+ *
+ * The client hanging up ends the poll through `signal`, so a closed tab
+ * does not keep a function reading a document nobody is watching.
+ */
+export declare const AI_JOB_EVENTS_INTERVAL_MS = 2000;
+export declare const AI_JOB_EVENTS_DEADLINE_MS = 55000;
+export type AiJobEvent = {
+    type: 'state';
+    job: AiJobSummary;
+} | {
+    type: 'gone';
+} | {
+    type: 'reconnect';
+};
+export interface AiJobEventStreamOptions {
+    /** The job as it is now, or `null` once it no longer exists. */
+    read: () => Promise<AiJobSummary | null>;
+    /** Ends the poll — the request's own signal in the route. */
+    signal?: AbortSignal;
+    now?: () => number;
+    sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    intervalMs?: number;
+    deadlineMs?: number;
+}
+export declare function aiJobEventStream(initial: AiJobSummary, options: AiJobEventStreamOptions): ReadableStream<Uint8Array>;
+export declare function aiJobEventResponse(stream: ReadableStream<Uint8Array>): Response;

package/src/lib/server/ai-jobs-events.js

@@ -0,0 +1,144 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { AI_JOB_TERMINAL_STATUSES } from "../model/ai-jobs.types.js";
+/**
+ * One job's progress as a server-sent event stream (AGL-2904).
+ *
+ * The console has no Firestore listener on `aiJobs` — the collection is
+ * client-readable, but the drawer reads through the route so the same
+ * membership, flag and entitlement rungs answer every read — so progress
+ * is a poll the SERVER runs on the client's behalf: one `state` event the
+ * moment the stream opens, then a re-read every `intervalMs` that emits
+ * only when the document moved, until the job is terminal or the stream
+ * has been open for `deadlineMs`. At the deadline a `reconnect` event
+ * tells the drawer to open a fresh stream, which keeps every stream inside
+ * the route's `maxDuration` rather than trusting the platform to cut it.
+ *
+ * The client hanging up ends the poll through `signal`, so a closed tab
+ * does not keep a function reading a document nobody is watching.
+ */ export const AI_JOB_EVENTS_INTERVAL_MS = 2000;
+export const AI_JOB_EVENTS_DEADLINE_MS = 55000;
+function defaultSleep(ms, signal) {
+    return new Promise((resolve)=>{
+        if (signal == null ? void 0 : signal.aborted) {
+            resolve();
+            return;
+        }
+        const timer = setTimeout(()=>{
+            signal == null ? void 0 : signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            resolve();
+        }
+        signal == null ? void 0 : signal.addEventListener('abort', onAbort, {
+            once: true
+        });
+    });
+}
+/** Whether a re-read is worth an event: the status or the clock moved. */ function changed(previous, next) {
+    return previous.status !== next.status || previous.updatedAt !== next.updatedAt || previous.running !== next.running || previous.outputs.length !== next.outputs.length;
+}
+export function aiJobEventStream(initial, options) {
+    var _options_now, _options_sleep, _options_intervalMs, _options_deadlineMs;
+    const now = (_options_now = options.now) != null ? _options_now : Date.now;
+    const sleep = (_options_sleep = options.sleep) != null ? _options_sleep : defaultSleep;
+    const intervalMs = (_options_intervalMs = options.intervalMs) != null ? _options_intervalMs : AI_JOB_EVENTS_INTERVAL_MS;
+    const deadlineMs = (_options_deadlineMs = options.deadlineMs) != null ? _options_deadlineMs : AI_JOB_EVENTS_DEADLINE_MS;
+    const encoder = new TextEncoder();
+    let closed = false;
+    return new ReadableStream({
+        async start (controller) {
+            const emit = (event)=>{
+                if (closed) return;
+                controller.enqueue(encoder.encode(`data: ${JSON.stringify(event)}\n\n`));
+            };
+            const close = ()=>{
+                if (closed) return;
+                closed = true;
+                controller.close();
+            };
+            const openedAt = now();
+            let last = initial;
+            emit({
+                type: 'state',
+                job: initial
+            });
+            if (AI_JOB_TERMINAL_STATUSES.includes(initial.status)) {
+                close();
+                return;
+            }
+            for(;;){
+                var _options_signal;
+                await sleep(intervalMs, options.signal);
+                if (closed || ((_options_signal = options.signal) == null ? void 0 : _options_signal.aborted)) {
+                    close();
+                    return;
+                }
+                let next;
+                try {
+                    next = await options.read();
+                } catch (error) {
+                    // A transient read failure is not the job failing; the next
+                    // interval asks again, and the deadline bounds how long for.
+                    console.error('ai job events read failed', error);
+                    next = last;
+                }
+                if (!next) {
+                    emit({
+                        type: 'gone'
+                    });
+                    close();
+                    return;
+                }
+                if (changed(last, next)) {
+                    emit({
+                        type: 'state',
+                        job: next
+                    });
+                    last = next;
+                }
+                if (AI_JOB_TERMINAL_STATUSES.includes(next.status)) {
+                    close();
+                    return;
+                }
+                if (now() - openedAt >= deadlineMs) {
+                    emit({
+                        type: 'reconnect'
+                    });
+                    close();
+                    return;
+                }
+            }
+        },
+        cancel () {
+            closed = true;
+        }
+    });
+}
+export function aiJobEventResponse(stream) {
+    return new Response(stream, {
+        status: 200,
+        headers: {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            Connection: 'keep-alive'
+        }
+    });
+}
+
+//# sourceMappingURL=ai-jobs-events.js.map

package/src/lib/server/ai-jobs-events.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-jobs-events.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AI_JOB_TERMINAL_STATUSES } from '../model/ai-jobs.types'\nimport type { AiJobSummary } from '../model/ai-jobs.types'\n\n/**\n * One job's progress as a server-sent event stream (AGL-2904).\n *\n * The console has no Firestore listener on `aiJobs` — the collection is\n * client-readable, but the drawer reads through the route so the same\n * membership, flag and entitlement rungs answer every read — so progress\n * is a poll the SERVER runs on the client's behalf: one `state` event the\n * moment the stream opens, then a re-read every `intervalMs` that emits\n * only when the document moved, until the job is terminal or the stream\n * has been open for `deadlineMs`. At the deadline a `reconnect` event\n * tells the drawer to open a fresh stream, which keeps every stream inside\n * the route's `maxDuration` rather than trusting the platform to cut it.\n *\n * The client hanging up ends the poll through `signal`, so a closed tab\n * does not keep a function reading a document nobody is watching.\n */\nexport const AI_JOB_EVENTS_INTERVAL_MS = 2_000\nexport const AI_JOB_EVENTS_DEADLINE_MS = 55_000\n\nexport type AiJobEvent =\n  | { type: 'state'; job: AiJobSummary }\n  | { type: 'gone' }\n  | { type: 'reconnect' }\n\nexport interface AiJobEventStreamOptions {\n  /** The job as it is now, or `null` once it no longer exists. */\n  read: () => Promise<AiJobSummary | null>\n  /** Ends the poll — the request's own signal in the route. */\n  signal?: AbortSignal\n  now?: () => number\n  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>\n  intervalMs?: number\n  deadlineMs?: number\n}\n\nfunction defaultSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve) => {\n    if (signal?.aborted) {\n      resolve()\n      return\n    }\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort)\n      resolve()\n    }, ms)\n    function onAbort() {\n      clearTimeout(timer)\n      resolve()\n    }\n    signal?.addEventListener('abort', onAbort, { once: true })\n  })\n}\n\n/** Whether a re-read is worth an event: the status or the clock moved. */\nfunction changed(previous: AiJobSummary, next: AiJobSummary): boolean {\n  return (\n    previous.status !== next.status ||\n    previous.updatedAt !== next.updatedAt ||\n    previous.running !== next.running ||\n    previous.outputs.length !== next.outputs.length\n  )\n}\n\nexport function aiJobEventStream(\n  initial: AiJobSummary,\n  options: AiJobEventStreamOptions,\n): ReadableStream<Uint8Array> {\n  const now = options.now ?? Date.now\n  const sleep = options.sleep ?? defaultSleep\n  const intervalMs = options.intervalMs ?? AI_JOB_EVENTS_INTERVAL_MS\n  const deadlineMs = options.deadlineMs ?? AI_JOB_EVENTS_DEADLINE_MS\n  const encoder = new TextEncoder()\n  let closed = false\n  return new ReadableStream<Uint8Array>({\n    async start(controller) {\n      const emit = (event: AiJobEvent) => {\n        if (closed) return\n        controller.enqueue(encoder.encode(`data: ${JSON.stringify(event)}\\n\\n`))\n      }\n      const close = () => {\n        if (closed) return\n        closed = true\n        controller.close()\n      }\n      const openedAt = now()\n      let last = initial\n      emit({ type: 'state', job: initial })\n      if (AI_JOB_TERMINAL_STATUSES.includes(initial.status)) {\n        close()\n        return\n      }\n      for (;;) {\n        await sleep(intervalMs, options.signal)\n        if (closed || options.signal?.aborted) {\n          close()\n          return\n        }\n        let next: AiJobSummary | null\n        try {\n          next = await options.read()\n        } catch (error) {\n          // A transient read failure is not the job failing; the next\n          // interval asks again, and the deadline bounds how long for.\n          console.error('ai job events read failed', error)\n          next = last\n        }\n        if (!next) {\n          emit({ type: 'gone' })\n          close()\n          return\n        }\n        if (changed(last, next)) {\n          emit({ type: 'state', job: next })\n          last = next\n        }\n        if (AI_JOB_TERMINAL_STATUSES.includes(next.status)) {\n          close()\n          return\n        }\n        if (now() - openedAt >= deadlineMs) {\n          emit({ type: 'reconnect' })\n          close()\n          return\n        }\n      }\n    },\n    cancel() {\n      closed = true\n    },\n  })\n}\n\nexport function aiJobEventResponse(stream: ReadableStream<Uint8Array>): Response {\n  return new Response(stream, {\n    status: 200,\n    headers: {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache, no-transform',\n      Connection: 'keep-alive',\n    },\n  })\n}\n"],"names":["AI_JOB_TERMINAL_STATUSES","AI_JOB_EVENTS_INTERVAL_MS","AI_JOB_EVENTS_DEADLINE_MS","defaultSleep","ms","signal","Promise","resolve","aborted","timer","setTimeout","removeEventListener","onAbort","clearTimeout","addEventListener","once","changed","previous","next","status","updatedAt","running","outputs","length","aiJobEventStream","initial","options","now","Date","sleep","intervalMs","deadlineMs","encoder","TextEncoder","closed","ReadableStream","start","controller","emit","event","enqueue","encode","JSON","stringify","close","openedAt","last","type","job","includes","read","error","console","cancel","aiJobEventResponse","stream","Response","headers","Connection"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,wBAAwB,QAAQ,4BAAwB;AAGjE;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,4BAA4B,KAAK;AAC9C,OAAO,MAAMC,4BAA4B,MAAM;AAkB/C,SAASC,aAAaC,EAAU,EAAEC,MAAoB;IACpD,OAAO,IAAIC,QAAQ,CAACC;QAClB,IAAIF,0BAAAA,OAAQG,OAAO,EAAE;YACnBD;YACA;QACF;QACA,MAAME,QAAQC,WAAW;YACvBL,0BAAAA,OAAQM,mBAAmB,CAAC,SAASC;YACrCL;QACF,GAAGH;QACH,SAASQ;YACPC,aAAaJ;YACbF;QACF;QACAF,0BAAAA,OAAQS,gBAAgB,CAAC,SAASF,SAAS;YAAEG,MAAM;QAAK;IAC1D;AACF;AAEA,wEAAwE,GACxE,SAASC,QAAQC,QAAsB,EAAEC,IAAkB;IACzD,OACED,SAASE,MAAM,KAAKD,KAAKC,MAAM,IAC/BF,SAASG,SAAS,KAAKF,KAAKE,SAAS,IACrCH,SAASI,OAAO,KAAKH,KAAKG,OAAO,IACjCJ,SAASK,OAAO,CAACC,MAAM,KAAKL,KAAKI,OAAO,CAACC,MAAM;AAEnD;AAEA,OAAO,SAASC,iBACdC,OAAqB,EACrBC,OAAgC;QAEpBA,cACEA,gBACKA,qBACAA;IAHnB,MAAMC,OAAMD,eAAAA,QAAQC,GAAG,YAAXD,eAAeE,KAAKD,GAAG;IACnC,MAAME,SAAQH,iBAAAA,QAAQG,KAAK,YAAbH,iBAAiBvB;IAC/B,MAAM2B,cAAaJ,sBAAAA,QAAQI,UAAU,YAAlBJ,sBAAsBzB;IACzC,MAAM8B,cAAaL,sBAAAA,QAAQK,UAAU,YAAlBL,sBAAsBxB;IACzC,MAAM8B,UAAU,IAAIC;IACpB,IAAIC,SAAS;IACb,OAAO,IAAIC,eAA2B;QACpC,MAAMC,OAAMC,UAAU;YACpB,MAAMC,OAAO,CAACC;gBACZ,IAAIL,QAAQ;gBACZG,WAAWG,OAAO,CAACR,QAAQS,MAAM,CAAC,CAAC,MAAM,EAAEC,KAAKC,SAAS,CAACJ,OAAO,IAAI,CAAC;YACxE;YACA,MAAMK,QAAQ;gBACZ,IAAIV,QAAQ;gBACZA,SAAS;gBACTG,WAAWO,KAAK;YAClB;YACA,MAAMC,WAAWlB;YACjB,IAAImB,OAAOrB;YACXa,KAAK;gBAAES,MAAM;gBAASC,KAAKvB;YAAQ;YACnC,IAAIzB,yBAAyBiD,QAAQ,CAACxB,QAAQN,MAAM,GAAG;gBACrDyB;gBACA;YACF;YACA,OAAS;oBAEOlB;gBADd,MAAMG,MAAMC,YAAYJ,QAAQrB,MAAM;gBACtC,IAAI6B,YAAUR,kBAAAA,QAAQrB,MAAM,qBAAdqB,gBAAgBlB,OAAO,GAAE;oBACrCoC;oBACA;gBACF;gBACA,IAAI1B;gBACJ,IAAI;oBACFA,OAAO,MAAMQ,QAAQwB,IAAI;gBAC3B,EAAE,OAAOC,OAAO;oBACd,4DAA4D;oBAC5D,6DAA6D;oBAC7DC,QAAQD,KAAK,CAAC,6BAA6BA;oBAC3CjC,OAAO4B;gBACT;gBACA,IAAI,CAAC5B,MAAM;oBACToB,KAAK;wBAAES,MAAM;oBAAO;oBACpBH;oBACA;gBACF;gBACA,IAAI5B,QAAQ8B,MAAM5B,OAAO;oBACvBoB,KAAK;wBAAES,MAAM;wBAASC,KAAK9B;oBAAK;oBAChC4B,OAAO5B;gBACT;gBACA,IAAIlB,yBAAyBiD,QAAQ,CAAC/B,KAAKC,MAAM,GAAG;oBAClDyB;oBACA;gBACF;gBACA,IAAIjB,QAAQkB,YAAYd,YAAY;oBAClCO,KAAK;wBAAES,MAAM;oBAAY;oBACzBH;oBACA;gBACF;YACF;QACF;QACAS;YACEnB,SAAS;QACX;IACF;AACF;AAEA,OAAO,SAASoB,mBAAmBC,MAAkC;IACnE,OAAO,IAAIC,SAASD,QAAQ;QAC1BpC,QAAQ;QACRsC,SAAS;YACP,gBAAgB;YAChB,iBAAiB;YACjBC,YAAY;QACd;IACF;AACF"}

package/src/lib/server/ai-jobs-gate.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { DecodedIdToken } from 'firebase-admin/auth';
+import type { AglynOrganization } from '@aglyn/aglyn/foundation/definitions/organization.types';
+/**
+ * The gate the READ and CANCEL doors of AI jobs climb (AGL-2904).
+ *
+ * `aiGateLadder` is the ladder a door that SPENDS climbs: it is POST-only
+ * and ends by taking a reservation, because its whole purpose is to bound
+ * provider spend. Listing a workspace's jobs, watching one, or canceling
+ * one spends nothing and answers a GET, so those doors climb the same
+ * rungs up to the lockdown verdict and stop there — no rate window and no
+ * reservation. The rungs are in the ladder's order, for the ladder's
+ * reason: each one refused discloses nothing a lower rung would.
+ *
+ *   401  no bearer token, or a token the verifier refused
+ *   403  email unverified (an impersonation session is exempt)
+ *   400  the request did not NAME the org (AGL-1934)
+ *   403  the caller is not a member of that org
+ *   404  the release flag is off — a released-off feature does not exist;
+ *        a verified staff claim previews through it
+ *   403  the org's plan lacks `aiGenerative`
+ *   423  lockdown: the scope verdict (platform/org/user)
+ */
+export interface AiJobsGateContext {
+    uid: string;
+    decoded: DecodedIdToken;
+    staff: boolean;
+    orgId: string;
+    org: Partial<AglynOrganization>;
+    firestore: FirebaseFirestore.Firestore;
+}
+export declare function aiJobsGate(request: Request, rawOrgId: string): Promise<Response | AiJobsGateContext>;