@aglyn/plugins-ai 1.0.0-beta.143

package/src/lib/server/ai-jobs-gate.js

@@ -0,0 +1,106 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement } from "@aglyn/aglyn/server";
+// By their own entry points rather than the barrel, for the reason the chat
+// route gives for the runtime: the route specs replace the barrel with a
+// closed-world factory, and a leaf that is mocked at its own seam is one
+// the spec can drive rung by rung.
+import { emailUnverifiedResponse, firebaseAdmin, isImpersonationSession } from "@aglyn/tenant-data-admin/server/firebase-admin";
+import { lockdownRefusal } from "@aglyn/tenant-data-admin/server/lockdown";
+import { getOrgForUser } from "@aglyn/tenant-data-admin/server/organizations";
+import { isServerReleaseFlagOnForOrg } from "@aglyn/tenant-data-admin/server/release-flags";
+import { invalidIdTokenResponse } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+function bearerToken(request) {
+    var _request_headers_get;
+    const authorization = (_request_headers_get = request.headers.get('authorization')) != null ? _request_headers_get : '';
+    return authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+}
+export async function aiJobsGate(request, rawOrgId) {
+    var _resolved_org;
+    const idToken = bearerToken(request);
+    if (!idToken) {
+        return Response.json({
+            error: 'Unauthenticated'
+        }, {
+            status: 401
+        });
+    }
+    const app = firebaseAdmin.app();
+    let decoded;
+    try {
+        decoded = await app.auth().verifyIdToken(idToken);
+    } catch (error) {
+        // A refused credential is the caller's fault and a 401; anything else
+        // is ours and propagates so the door answers 500 rather than telling
+        // every user their credential is bad during an outage (AGL-1993).
+        const unauthenticated = invalidIdTokenResponse(error);
+        if (unauthenticated) return unauthenticated;
+        throw error;
+    }
+    if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+        return emailUnverifiedResponse();
+    }
+    const staff = decoded['staff'] === true;
+    const orgId = rawOrgId.trim();
+    if (!orgId) {
+        return Response.json({
+            error: 'Open a workspace before using this feature'
+        }, {
+            status: 400
+        });
+    }
+    const resolved = await getOrgForUser(decoded.uid, orgId);
+    if (!resolved || resolved.orgId !== orgId) {
+        return Response.json({
+            error: 'You are not a member of that organization'
+        }, {
+            status: 403
+        });
+    }
+    const org = (_resolved_org = resolved.org) != null ? _resolved_org : {};
+    if (!staff && !await isServerReleaseFlagOnForOrg('release_ai_generative', orgId)) {
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    }
+    if (!checkEntitlement(org, 'aiGenerative')) {
+        return Response.json({
+            error: "This workspace's plan does not include that feature",
+            reason: 'entitlement'
+        }, {
+            status: 403
+        });
+    }
+    const locked = await lockdownRefusal({
+        request,
+        staff,
+        uid: decoded.uid,
+        org: org
+    });
+    if (locked) return locked;
+    return {
+        uid: decoded.uid,
+        decoded,
+        staff,
+        orgId,
+        org,
+        firestore: app.firestore()
+    };
+}
+
+//# sourceMappingURL=ai-jobs-gate.js.map

package/src/lib/server/ai-jobs-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-jobs-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { DecodedIdToken } from 'firebase-admin/auth'\nimport { checkEntitlement } from '@aglyn/aglyn/server'\nimport type { AglynOrganization } from '@aglyn/aglyn/foundation/definitions/organization.types'\n// By their own entry points rather than the barrel, for the reason the chat\n// route gives for the runtime: the route specs replace the barrel with a\n// closed-world factory, and a leaf that is mocked at its own seam is one\n// the spec can drive rung by rung.\nimport {\n  emailUnverifiedResponse,\n  firebaseAdmin,\n  isImpersonationSession,\n} from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { lockdownRefusal } from '@aglyn/tenant-data-admin/server/lockdown'\nimport { getOrgForUser } from '@aglyn/tenant-data-admin/server/organizations'\nimport { isServerReleaseFlagOnForOrg } from '@aglyn/tenant-data-admin/server/release-flags'\nimport { invalidIdTokenResponse } from '@aglyn/tenant-data-admin/server/id-token-refusal'\n\n/**\n * The gate the READ and CANCEL doors of AI jobs climb (AGL-2904).\n *\n * `aiGateLadder` is the ladder a door that SPENDS climbs: it is POST-only\n * and ends by taking a reservation, because its whole purpose is to bound\n * provider spend. Listing a workspace's jobs, watching one, or canceling\n * one spends nothing and answers a GET, so those doors climb the same\n * rungs up to the lockdown verdict and stop there — no rate window and no\n * reservation. The rungs are in the ladder's order, for the ladder's\n * reason: each one refused discloses nothing a lower rung would.\n *\n *   401  no bearer token, or a token the verifier refused\n *   403  email unverified (an impersonation session is exempt)\n *   400  the request did not NAME the org (AGL-1934)\n *   403  the caller is not a member of that org\n *   404  the release flag is off — a released-off feature does not exist;\n *        a verified staff claim previews through it\n *   403  the org's plan lacks `aiGenerative`\n *   423  lockdown: the scope verdict (platform/org/user)\n */\nexport interface AiJobsGateContext {\n  uid: string\n  decoded: DecodedIdToken\n  staff: boolean\n  orgId: string\n  org: Partial<AglynOrganization>\n  firestore: FirebaseFirestore.Firestore\n}\n\nfunction bearerToken(request: Request): string | undefined {\n  const authorization = request.headers.get('authorization') ?? ''\n  return authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n}\n\nexport async function aiJobsGate(\n  request: Request,\n  rawOrgId: string,\n): Promise<Response | AiJobsGateContext> {\n  const idToken = bearerToken(request)\n  if (!idToken) {\n    return Response.json({ error: 'Unauthenticated' }, { status: 401 })\n  }\n  const app = firebaseAdmin.app()\n  let decoded: DecodedIdToken\n  try {\n    decoded = await app.auth().verifyIdToken(idToken)\n  } catch (error) {\n    // A refused credential is the caller's fault and a 401; anything else\n    // is ours and propagates so the door answers 500 rather than telling\n    // every user their credential is bad during an outage (AGL-1993).\n    const unauthenticated = invalidIdTokenResponse(error)\n    if (unauthenticated) return unauthenticated\n    throw error\n  }\n  if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n    return emailUnverifiedResponse()\n  }\n  const staff = decoded['staff'] === true\n\n  const orgId = rawOrgId.trim()\n  if (!orgId) {\n    return Response.json(\n      { error: 'Open a workspace before using this feature' },\n      { status: 400 },\n    )\n  }\n  const resolved = await getOrgForUser(decoded.uid, orgId)\n  if (!resolved || resolved.orgId !== orgId) {\n    return Response.json(\n      { error: 'You are not a member of that organization' },\n      { status: 403 },\n    )\n  }\n  const org = resolved.org ?? {}\n\n  if (!staff && !(await isServerReleaseFlagOnForOrg('release_ai_generative', orgId))) {\n    return Response.json({ error: 'Not found' }, { status: 404 })\n  }\n  if (!checkEntitlement(org, 'aiGenerative')) {\n    return Response.json(\n      {\n        error: \"This workspace's plan does not include that feature\",\n        reason: 'entitlement',\n      },\n      { status: 403 },\n    )\n  }\n  const locked = await lockdownRefusal({\n    request,\n    staff,\n    uid: decoded.uid,\n    org: org as Record<string, unknown>,\n  })\n  if (locked) return locked\n\n  return {\n    uid: decoded.uid,\n    decoded,\n    staff,\n    orgId,\n    org,\n    firestore: app.firestore(),\n  }\n}\n"],"names":["checkEntitlement","emailUnverifiedResponse","firebaseAdmin","isImpersonationSession","lockdownRefusal","getOrgForUser","isServerReleaseFlagOnForOrg","invalidIdTokenResponse","bearerToken","request","authorization","headers","get","startsWith","slice","length","undefined","aiJobsGate","rawOrgId","resolved","idToken","Response","json","error","status","app","decoded","auth","verifyIdToken","unauthenticated","email_verified","staff","orgId","trim","uid","org","reason","locked","firestore"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,gBAAgB,QAAQ,sBAAqB;AAEtD,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,mCAAmC;AACnC,SACEC,uBAAuB,EACvBC,aAAa,EACbC,sBAAsB,QACjB,iDAAgD;AACvD,SAASC,eAAe,QAAQ,2CAA0C;AAC1E,SAASC,aAAa,QAAQ,gDAA+C;AAC7E,SAASC,2BAA2B,QAAQ,gDAA+C;AAC3F,SAASC,sBAAsB,QAAQ,mDAAkD;AA+BzF,SAASC,YAAYC,OAAgB;QACbA;IAAtB,MAAMC,iBAAgBD,uBAAAA,QAAQE,OAAO,CAACC,GAAG,CAAC,4BAApBH,uBAAwC;IAC9D,OAAOC,cAAcG,UAAU,CAAC,aAC5BH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;AACN;AAEA,OAAO,eAAeC,WACpBR,OAAgB,EAChBS,QAAgB;QAqCJC;IAnCZ,MAAMC,UAAUZ,YAAYC;IAC5B,IAAI,CAACW,SAAS;QACZ,OAAOC,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAkB,GAAG;YAAEC,QAAQ;QAAI;IACnE;IACA,MAAMC,MAAMvB,cAAcuB,GAAG;IAC7B,IAAIC;IACJ,IAAI;QACFA,UAAU,MAAMD,IAAIE,IAAI,GAAGC,aAAa,CAACR;IAC3C,EAAE,OAAOG,OAAO;QACd,sEAAsE;QACtE,qEAAqE;QACrE,kEAAkE;QAClE,MAAMM,kBAAkBtB,uBAAuBgB;QAC/C,IAAIM,iBAAiB,OAAOA;QAC5B,MAAMN;IACR;IACA,IAAI,CAACG,QAAQI,cAAc,IAAI,CAAC3B,uBAAuBuB,UAAU;QAC/D,OAAOzB;IACT;IACA,MAAM8B,QAAQL,OAAO,CAAC,QAAQ,KAAK;IAEnC,MAAMM,QAAQd,SAASe,IAAI;IAC3B,IAAI,CAACD,OAAO;QACV,OAAOX,SAASC,IAAI,CAClB;YAAEC,OAAO;QAA6C,GACtD;YAAEC,QAAQ;QAAI;IAElB;IACA,MAAML,WAAW,MAAMd,cAAcqB,QAAQQ,GAAG,EAAEF;IAClD,IAAI,CAACb,YAAYA,SAASa,KAAK,KAAKA,OAAO;QACzC,OAAOX,SAASC,IAAI,CAClB;YAAEC,OAAO;QAA4C,GACrD;YAAEC,QAAQ;QAAI;IAElB;IACA,MAAMW,OAAMhB,gBAAAA,SAASgB,GAAG,YAAZhB,gBAAgB,CAAC;IAE7B,IAAI,CAACY,SAAS,CAAE,MAAMzB,4BAA4B,yBAAyB0B,QAAS;QAClF,OAAOX,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IACA,IAAI,CAACxB,iBAAiBmC,KAAK,iBAAiB;QAC1C,OAAOd,SAASC,IAAI,CAClB;YACEC,OAAO;YACPa,QAAQ;QACV,GACA;YAAEZ,QAAQ;QAAI;IAElB;IACA,MAAMa,SAAS,MAAMjC,gBAAgB;QACnCK;QACAsB;QACAG,KAAKR,QAAQQ,GAAG;QAChBC,KAAKA;IACP;IACA,IAAIE,QAAQ,OAAOA;IAEnB,OAAO;QACLH,KAAKR,QAAQQ,GAAG;QAChBR;QACAK;QACAC;QACAG;QACAG,WAAWb,IAAIa,SAAS;IAC1B;AACF"}

package/src/lib/server/ai-jobs-resume.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export declare function POST(request: Request, context: {
+    params: Promise<{
+        jobId: string;
+    }>;
+}): Promise<Response>;
+export declare const dynamic = "force-dynamic";
+export declare const maxDuration = 60;

package/src/lib/server/ai-jobs-resume.js

@@ -0,0 +1,209 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // lockdown-423: via libs/plugins/ai/src/lib/runtime/ai-gate.ts
+// The POST climbs `aiGateLadder`, whose lockdown rung is the verdict.
+import { randomUUID } from "crypto";
+import { aiJobAdmissionRefusal, aiJobSiteRefusal } from "../jobs/ai-job-admission.js";
+import { AI_JOB_INLINE_BUDGET_MS, aiJobNextStepMinimumMs, aiJobSummary, getAiJob, resumeAiJob, runAiJobStep, writeAiJobAudit } from "../jobs/ai-jobs.js";
+import { aiGateLadder } from "../runtime/ai-gate.js";
+import { releaseAssistMessage } from "../usage/assist-usage.js";
+/**
+ * Resume a job that stopped for a person (AGL-2935): confirm its plan, or
+ * try again the step whose answer broke a building rule on its re-ask.
+ *
+ * A door that SPENDS — the next step calls the provider — so it climbs the
+ * whole ladder the create door climbs: `aiGenerative`,
+ * `release_ai_generative`, the `ai-generate` switch, `ai.generate` on the
+ * job's site, a per-uid window and a reservation. It then runs the next
+ * step inline on that reservation, the way the create door runs the first,
+ * and hands the reservation back whenever no step runs here.
+ *
+ * The body names the org and the job's site. A site that is not the job's
+ * is refused, so a collaborator's permission on one site never confirms a
+ * job on another. Audited per resume that changed something.
+ */ const AI_JOBS_RESUME_RATE_LIMIT = {
+    key: 'ai-jobs-resume',
+    limit: 10,
+    windowMs: 60000
+};
+export async function POST(request, context) {
+    var _ref, _existing_hostId, _gate_decoded_email, _ref1, _gate_decoded_email1;
+    var _existing_review;
+    let payload;
+    try {
+        payload = await request.json();
+    } catch (unused) {
+        payload = null;
+    }
+    const rawHost = payload == null ? void 0 : payload['hostId'];
+    const hostId = typeof rawHost === 'string' && rawHost ? rawHost : null;
+    const gate = await aiGateLadder({
+        request,
+        orgId: String((_ref = payload == null ? void 0 : payload['orgId']) != null ? _ref : ''),
+        hostId
+    }, {
+        feature: 'aiGenerative',
+        releaseFlag: 'release_ai_generative',
+        lockdownFeature: 'ai-generate',
+        permission: 'ai.generate',
+        rateLimit: AI_JOBS_RESUME_RATE_LIMIT
+    });
+    if (gate instanceof Response) return gate;
+    // No token is spent until a step runs, so every exit before one hands the
+    // message back.
+    const release = ()=>releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(()=>undefined);
+    const { jobId } = await context.params;
+    const existing = await getAiJob(gate.firestore, gate.orgId, jobId);
+    if (!existing) {
+        await release();
+        return Response.json({
+            error: 'Unknown job'
+        }, {
+            status: 404
+        });
+    }
+    if (((_existing_hostId = existing.hostId) != null ? _existing_hostId : null) !== hostId) {
+        await release();
+        return Response.json({
+            error: 'That job belongs to another site'
+        }, {
+            status: 400
+        });
+    }
+    // A confirmed plan runs the step that writes, and an allowance free when the
+    // job was created may be used by now (AGL-2909): the kind is asked again
+    // before anything runs, and a refusal leaves the job waiting for review.
+    if (existing.status === 'needs_review') {
+        let refusal;
+        try {
+            var _ref2, _existing_hostId1, _existing_hostId2, _existing_inputs, _existing_plan;
+            // A site that switched AI off first (AGL-3028), then the kind's own check.
+            refusal = (_ref2 = await aiJobSiteRefusal({
+                firestore: gate.firestore,
+                org: gate.org,
+                hostId: (_existing_hostId1 = existing.hostId) != null ? _existing_hostId1 : null
+            })) != null ? _ref2 : await aiJobAdmissionRefusal(existing.kind, {
+                firestore: gate.firestore,
+                orgId: gate.orgId,
+                hostId: (_existing_hostId2 = existing.hostId) != null ? _existing_hostId2 : null,
+                inputs: (_existing_inputs = existing.inputs) != null ? _existing_inputs : {},
+                org: gate.org,
+                // The plan being confirmed, for a kind that builds only some plans.
+                plan: (_existing_plan = existing.plan) != null ? _existing_plan : null,
+                uid: gate.uid
+            });
+        } catch (error) {
+            await release();
+            console.error('ai job admission failed', {
+                orgId: gate.orgId,
+                jobId,
+                error
+            });
+            return Response.json({
+                error: 'The AI job could not be resumed'
+            }, {
+                status: 500
+            });
+        }
+        if (refusal) {
+            await release();
+            return Response.json({
+                error: refusal.error,
+                job: aiJobSummary(existing, new Date())
+            }, {
+                status: refusal.status
+            });
+        }
+    }
+    const now = new Date();
+    const { job, changed } = await resumeAiJob(gate.firestore, gate.orgId, jobId, {
+        uid: gate.uid
+    }, now);
+    if (!changed) {
+        await release();
+        return Response.json({
+            error: 'This job is not waiting for review',
+            job: aiJobSummary(job, now)
+        }, {
+            status: 409
+        });
+    }
+    await writeAiJobAudit(gate.firestore, {
+        action: 'ai.job.resume',
+        actorUid: gate.uid,
+        actorEmail: (_gate_decoded_email = gate.decoded.email) != null ? _gate_decoded_email : null,
+        orgId: gate.orgId,
+        jobId,
+        after: {
+            status: job.status,
+            reason: (_ref1 = (_existing_review = existing.review) == null ? void 0 : _existing_review.reason) != null ? _ref1 : null,
+            kind: existing.kind
+        }
+    });
+    if (job.status !== 'queued') {
+        await release();
+        return Response.json({
+            job: aiJobSummary(job, now)
+        }, {
+            status: 200
+        });
+    }
+    // A step that needs more time than this request has (AGL-2907) is left
+    // queued for the beat, which starts it with a budget of its own: a provider
+    // call this request's timeout cut off would be billed upstream and metered
+    // nowhere.
+    if (aiJobNextStepMinimumMs(job) > AI_JOB_INLINE_BUDGET_MS) {
+        await release();
+        return Response.json({
+            job: aiJobSummary(job, now)
+        }, {
+            status: 200
+        });
+    }
+    const run = await runAiJobStep(gate.firestore, gate.orgId, jobId, {
+        owner: `route:${randomUUID()}`,
+        now,
+        reservation: gate.reservation,
+        org: gate.org,
+        signal: AbortSignal.timeout(AI_JOB_INLINE_BUDGET_MS),
+        actor: {
+            uid: gate.uid,
+            email: (_gate_decoded_email1 = gate.decoded.email) != null ? _gate_decoded_email1 : null
+        },
+        // The workspace's AI pause lets staff through, as the ladder above did.
+        staff: gate.staff
+    });
+    if (run.outcome === 'not-claimable') {
+        // The beat claimed the step between the resume and this run; it runs
+        // there, on a reservation of its own.
+        await release();
+        const latest = await getAiJob(gate.firestore, gate.orgId, jobId);
+        return Response.json({
+            job: aiJobSummary(latest != null ? latest : job, now)
+        }, {
+            status: 200
+        });
+    }
+    return Response.json({
+        job: aiJobSummary(run.job)
+    }, {
+        status: 200
+    });
+}
+export const dynamic = 'force-dynamic';
+export const maxDuration = 60;
+
+//# sourceMappingURL=ai-jobs-resume.js.map

package/src/lib/server/ai-jobs-resume.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-jobs-resume.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// lockdown-423: via libs/plugins/ai/src/lib/runtime/ai-gate.ts\n// The POST climbs `aiGateLadder`, whose lockdown rung is the verdict.\n\nimport { randomUUID } from 'crypto'\nimport { aiJobAdmissionRefusal, aiJobSiteRefusal } from '../jobs/ai-job-admission'\nimport {\n  AI_JOB_INLINE_BUDGET_MS,\n  aiJobNextStepMinimumMs,\n  aiJobSummary,\n  getAiJob,\n  resumeAiJob,\n  runAiJobStep,\n  writeAiJobAudit,\n} from '../jobs/ai-jobs'\nimport { aiGateLadder } from '../runtime/ai-gate'\nimport { releaseAssistMessage } from '../usage/assist-usage'\n\n/**\n * Resume a job that stopped for a person (AGL-2935): confirm its plan, or\n * try again the step whose answer broke a building rule on its re-ask.\n *\n * A door that SPENDS — the next step calls the provider — so it climbs the\n * whole ladder the create door climbs: `aiGenerative`,\n * `release_ai_generative`, the `ai-generate` switch, `ai.generate` on the\n * job's site, a per-uid window and a reservation. It then runs the next\n * step inline on that reservation, the way the create door runs the first,\n * and hands the reservation back whenever no step runs here.\n *\n * The body names the org and the job's site. A site that is not the job's\n * is refused, so a collaborator's permission on one site never confirms a\n * job on another. Audited per resume that changed something.\n */\n\nconst AI_JOBS_RESUME_RATE_LIMIT = { key: 'ai-jobs-resume', limit: 10, windowMs: 60_000 }\n\nexport async function POST(\n  request: Request,\n  context: { params: Promise<{ jobId: string }> },\n): Promise<Response> {\n  let payload: Record<string, unknown> | null\n  try {\n    payload = (await request.json()) as Record<string, unknown>\n  } catch {\n    payload = null\n  }\n  const rawHost = payload?.['hostId']\n  const hostId = typeof rawHost === 'string' && rawHost ? rawHost : null\n  const gate = await aiGateLadder(\n    { request, orgId: String(payload?.['orgId'] ?? ''), hostId },\n    {\n      feature: 'aiGenerative',\n      releaseFlag: 'release_ai_generative',\n      lockdownFeature: 'ai-generate',\n      permission: 'ai.generate',\n      rateLimit: AI_JOBS_RESUME_RATE_LIMIT,\n    },\n  )\n  if (gate instanceof Response) return gate\n  // No token is spent until a step runs, so every exit before one hands the\n  // message back.\n  const release = () =>\n    releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(() => undefined)\n\n  const { jobId } = await context.params\n  const existing = await getAiJob(gate.firestore, gate.orgId, jobId)\n  if (!existing) {\n    await release()\n    return Response.json({ error: 'Unknown job' }, { status: 404 })\n  }\n  if ((existing.hostId ?? null) !== hostId) {\n    await release()\n    return Response.json({ error: 'That job belongs to another site' }, { status: 400 })\n  }\n  // A confirmed plan runs the step that writes, and an allowance free when the\n  // job was created may be used by now (AGL-2909): the kind is asked again\n  // before anything runs, and a refusal leaves the job waiting for review.\n  if (existing.status === 'needs_review') {\n    let refusal: Awaited<ReturnType<typeof aiJobAdmissionRefusal>>\n    try {\n      // A site that switched AI off first (AGL-3028), then the kind's own check.\n      refusal =\n        (await aiJobSiteRefusal({\n          firestore: gate.firestore,\n          org: gate.org,\n          hostId: existing.hostId ?? null,\n        })) ??\n        (await aiJobAdmissionRefusal(existing.kind, {\n          firestore: gate.firestore,\n          orgId: gate.orgId,\n          hostId: existing.hostId ?? null,\n          inputs: existing.inputs ?? {},\n          org: gate.org,\n          // The plan being confirmed, for a kind that builds only some plans.\n          plan: existing.plan ?? null,\n          uid: gate.uid,\n        }))\n    } catch (error) {\n      await release()\n      console.error('ai job admission failed', { orgId: gate.orgId, jobId, error })\n      return Response.json({ error: 'The AI job could not be resumed' }, { status: 500 })\n    }\n    if (refusal) {\n      await release()\n      return Response.json(\n        { error: refusal.error, job: aiJobSummary(existing, new Date()) },\n        { status: refusal.status },\n      )\n    }\n  }\n  const now = new Date()\n  const { job, changed } = await resumeAiJob(\n    gate.firestore,\n    gate.orgId,\n    jobId,\n    { uid: gate.uid },\n    now,\n  )\n  if (!changed) {\n    await release()\n    return Response.json(\n      { error: 'This job is not waiting for review', job: aiJobSummary(job, now) },\n      { status: 409 },\n    )\n  }\n  await writeAiJobAudit(gate.firestore, {\n    action: 'ai.job.resume',\n    actorUid: gate.uid,\n    actorEmail: gate.decoded.email ?? null,\n    orgId: gate.orgId,\n    jobId,\n    after: {\n      status: job.status,\n      reason: existing.review?.reason ?? null,\n      kind: existing.kind,\n    },\n  })\n  if (job.status !== 'queued') {\n    await release()\n    return Response.json({ job: aiJobSummary(job, now) }, { status: 200 })\n  }\n  // A step that needs more time than this request has (AGL-2907) is left\n  // queued for the beat, which starts it with a budget of its own: a provider\n  // call this request's timeout cut off would be billed upstream and metered\n  // nowhere.\n  if (aiJobNextStepMinimumMs(job) > AI_JOB_INLINE_BUDGET_MS) {\n    await release()\n    return Response.json({ job: aiJobSummary(job, now) }, { status: 200 })\n  }\n\n  const run = await runAiJobStep(gate.firestore, gate.orgId, jobId, {\n    owner: `route:${randomUUID()}`,\n    now,\n    reservation: gate.reservation,\n    org: gate.org,\n    signal: AbortSignal.timeout(AI_JOB_INLINE_BUDGET_MS),\n    actor: { uid: gate.uid, email: gate.decoded.email ?? null },\n    // The workspace's AI pause lets staff through, as the ladder above did.\n    staff: gate.staff,\n  })\n  if (run.outcome === 'not-claimable') {\n    // The beat claimed the step between the resume and this run; it runs\n    // there, on a reservation of its own.\n    await release()\n    const latest = await getAiJob(gate.firestore, gate.orgId, jobId)\n    return Response.json({ job: aiJobSummary(latest ?? job, now) }, { status: 200 })\n  }\n  return Response.json({ job: aiJobSummary(run.job) }, { status: 200 })\n}\n\nexport const dynamic = 'force-dynamic'\nexport const maxDuration = 60\n"],"names":["randomUUID","aiJobAdmissionRefusal","aiJobSiteRefusal","AI_JOB_INLINE_BUDGET_MS","aiJobNextStepMinimumMs","aiJobSummary","getAiJob","resumeAiJob","runAiJobStep","writeAiJobAudit","aiGateLadder","releaseAssistMessage","AI_JOBS_RESUME_RATE_LIMIT","key","limit","windowMs","POST","request","context","existing","gate","payload","json","rawHost","hostId","orgId","String","feature","releaseFlag","lockdownFeature","permission","rateLimit","Response","release","firestore","reservation","catch","undefined","jobId","params","error","status","refusal","org","kind","inputs","plan","uid","console","job","Date","now","changed","action","actorUid","actorEmail","decoded","email","after","reason","review","run","owner","signal","AbortSignal","timeout","actor","staff","outcome","latest","dynamic","maxDuration"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,+DAA+D;AAC/D,sEAAsE;AAEtE,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,qBAAqB,EAAEC,gBAAgB,QAAQ,8BAA0B;AAClF,SACEC,uBAAuB,EACvBC,sBAAsB,EACtBC,YAAY,EACZC,QAAQ,EACRC,WAAW,EACXC,YAAY,EACZC,eAAe,QACV,qBAAiB;AACxB,SAASC,YAAY,QAAQ,wBAAoB;AACjD,SAASC,oBAAoB,QAAQ,2BAAuB;AAE5D;;;;;;;;;;;;;;CAcC,GAED,MAAMC,4BAA4B;IAAEC,KAAK;IAAkBC,OAAO;IAAIC,UAAU;AAAO;AAEvF,OAAO,eAAeC,KACpBC,OAAgB,EAChBC,OAA+C;cAgC1CC,kBA0DSC,4BA4BmBA;QAvBrBD;IA7FZ,IAAIE;IACJ,IAAI;QACFA,UAAW,MAAMJ,QAAQK,IAAI;IAC/B,EAAE,eAAM;QACND,UAAU;IACZ;IACA,MAAME,UAAUF,2BAAAA,OAAS,CAAC,SAAS;IACnC,MAAMG,SAAS,OAAOD,YAAY,YAAYA,UAAUA,UAAU;IAClE,MAAMH,OAAO,MAAMV,aACjB;QAAEO;QAASQ,OAAOC,eAAOL,2BAAAA,OAAS,CAAC,QAAQ,mBAAI;QAAKG;IAAO,GAC3D;QACEG,SAAS;QACTC,aAAa;QACbC,iBAAiB;QACjBC,YAAY;QACZC,WAAWnB;IACb;IAEF,IAAIQ,gBAAgBY,UAAU,OAAOZ;IACrC,0EAA0E;IAC1E,gBAAgB;IAChB,MAAMa,UAAU,IACdtB,qBAAqBS,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEL,KAAKe,WAAW,EAAEC,KAAK,CAAC,IAAMC;IAEjF,MAAM,EAAEC,KAAK,EAAE,GAAG,MAAMpB,QAAQqB,MAAM;IACtC,MAAMpB,WAAW,MAAMb,SAASc,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa;IAC5D,IAAI,CAACnB,UAAU;QACb,MAAMc;QACN,OAAOD,SAASV,IAAI,CAAC;YAAEkB,OAAO;QAAc,GAAG;YAAEC,QAAQ;QAAI;IAC/D;IACA,IAAI,EAACtB,mBAAAA,SAASK,MAAM,YAAfL,mBAAmB,UAAUK,QAAQ;QACxC,MAAMS;QACN,OAAOD,SAASV,IAAI,CAAC;YAAEkB,OAAO;QAAmC,GAAG;YAAEC,QAAQ;QAAI;IACpF;IACA,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,IAAItB,SAASsB,MAAM,KAAK,gBAAgB;QACtC,IAAIC;QACJ,IAAI;gBAGC,OAGSvB,mBAKAA,mBACAA,kBAGFA;YAdV,2EAA2E;YAC3EuB,WACG,QAAA,MAAMxC,iBAAiB;gBACtBgC,WAAWd,KAAKc,SAAS;gBACzBS,KAAKvB,KAAKuB,GAAG;gBACbnB,MAAM,GAAEL,oBAAAA,SAASK,MAAM,YAAfL,oBAAmB;YAC7B,cAJC,QAKA,MAAMlB,sBAAsBkB,SAASyB,IAAI,EAAE;gBAC1CV,WAAWd,KAAKc,SAAS;gBACzBT,OAAOL,KAAKK,KAAK;gBACjBD,MAAM,GAAEL,oBAAAA,SAASK,MAAM,YAAfL,oBAAmB;gBAC3B0B,MAAM,GAAE1B,mBAAAA,SAAS0B,MAAM,YAAf1B,mBAAmB,CAAC;gBAC5BwB,KAAKvB,KAAKuB,GAAG;gBACb,oEAAoE;gBACpEG,IAAI,GAAE3B,iBAAAA,SAAS2B,IAAI,YAAb3B,iBAAiB;gBACvB4B,KAAK3B,KAAK2B,GAAG;YACf;QACJ,EAAE,OAAOP,OAAO;YACd,MAAMP;YACNe,QAAQR,KAAK,CAAC,2BAA2B;gBAAEf,OAAOL,KAAKK,KAAK;gBAAEa;gBAAOE;YAAM;YAC3E,OAAOR,SAASV,IAAI,CAAC;gBAAEkB,OAAO;YAAkC,GAAG;gBAAEC,QAAQ;YAAI;QACnF;QACA,IAAIC,SAAS;YACX,MAAMT;YACN,OAAOD,SAASV,IAAI,CAClB;gBAAEkB,OAAOE,QAAQF,KAAK;gBAAES,KAAK5C,aAAac,UAAU,IAAI+B;YAAQ,GAChE;gBAAET,QAAQC,QAAQD,MAAM;YAAC;QAE7B;IACF;IACA,MAAMU,MAAM,IAAID;IAChB,MAAM,EAAED,GAAG,EAAEG,OAAO,EAAE,GAAG,MAAM7C,YAC7Ba,KAAKc,SAAS,EACdd,KAAKK,KAAK,EACVa,OACA;QAAES,KAAK3B,KAAK2B,GAAG;IAAC,GAChBI;IAEF,IAAI,CAACC,SAAS;QACZ,MAAMnB;QACN,OAAOD,SAASV,IAAI,CAClB;YAAEkB,OAAO;YAAsCS,KAAK5C,aAAa4C,KAAKE;QAAK,GAC3E;YAAEV,QAAQ;QAAI;IAElB;IACA,MAAMhC,gBAAgBW,KAAKc,SAAS,EAAE;QACpCmB,QAAQ;QACRC,UAAUlC,KAAK2B,GAAG;QAClBQ,UAAU,GAAEnC,sBAAAA,KAAKoC,OAAO,CAACC,KAAK,YAAlBrC,sBAAsB;QAClCK,OAAOL,KAAKK,KAAK;QACjBa;QACAoB,OAAO;YACLjB,QAAQQ,IAAIR,MAAM;YAClBkB,MAAM,YAAExC,mBAAAA,SAASyC,MAAM,qBAAfzC,iBAAiBwC,MAAM,oBAAI;YACnCf,MAAMzB,SAASyB,IAAI;QACrB;IACF;IACA,IAAIK,IAAIR,MAAM,KAAK,UAAU;QAC3B,MAAMR;QACN,OAAOD,SAASV,IAAI,CAAC;YAAE2B,KAAK5C,aAAa4C,KAAKE;QAAK,GAAG;YAAEV,QAAQ;QAAI;IACtE;IACA,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,WAAW;IACX,IAAIrC,uBAAuB6C,OAAO9C,yBAAyB;QACzD,MAAM8B;QACN,OAAOD,SAASV,IAAI,CAAC;YAAE2B,KAAK5C,aAAa4C,KAAKE;QAAK,GAAG;YAAEV,QAAQ;QAAI;IACtE;IAEA,MAAMoB,MAAM,MAAMrD,aAAaY,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa,OAAO;QAChEwB,OAAO,CAAC,MAAM,EAAE9D,cAAc;QAC9BmD;QACAhB,aAAaf,KAAKe,WAAW;QAC7BQ,KAAKvB,KAAKuB,GAAG;QACboB,QAAQC,YAAYC,OAAO,CAAC9D;QAC5B+D,OAAO;YAAEnB,KAAK3B,KAAK2B,GAAG;YAAEU,KAAK,GAAErC,uBAAAA,KAAKoC,OAAO,CAACC,KAAK,YAAlBrC,uBAAsB;QAAK;QAC1D,wEAAwE;QACxE+C,OAAO/C,KAAK+C,KAAK;IACnB;IACA,IAAIN,IAAIO,OAAO,KAAK,iBAAiB;QACnC,qEAAqE;QACrE,sCAAsC;QACtC,MAAMnC;QACN,MAAMoC,SAAS,MAAM/D,SAASc,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa;QAC1D,OAAON,SAASV,IAAI,CAAC;YAAE2B,KAAK5C,aAAagE,iBAAAA,SAAUpB,KAAKE;QAAK,GAAG;YAAEV,QAAQ;QAAI;IAChF;IACA,OAAOT,SAASV,IAAI,CAAC;QAAE2B,KAAK5C,aAAawD,IAAIZ,GAAG;IAAE,GAAG;QAAER,QAAQ;IAAI;AACrE;AAEA,OAAO,MAAM6B,UAAU,gBAAe;AACtC,OAAO,MAAMC,cAAc,GAAE"}

package/src/lib/server/ai-jobs-route.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type AiJobKind } from '../model/ai-jobs.types';
+export interface CreateAiJobBody {
+    orgId: string;
+    hostId: string | null;
+    kind: AiJobKind;
+    brief: string;
+    inputs: Record<string, string | number | boolean>;
+    /** A catalog model the creator picked (AGL-2942), or `null` for Auto. */
+    model: string | null;
+}
+/** Validate + clamp the request body; a string names what is wrong. */
+export declare function parseCreateAiJobBody(payload: unknown): CreateAiJobBody | string;
+export declare function POST(request: Request): Promise<Response>;
+export declare function GET(request: Request): Promise<Response>;
+export declare const dynamic = "force-dynamic";
+export declare const maxDuration = 60;