@aglyn/plugins-workflows 1.0.0-beta.179 → 1.0.0-beta.181

package/src/lib/server/org-automations-routes.js

@@ -0,0 +1,474 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * WRITING AN ORG AUTOMATION, and pausing one on a site (AGL-3302).
+ *
+ * `orgs/{orgId}/automations` is closed to every client write, the way the
+ * outreach collections are: an org automation runs on every site it is
+ * placed on, as that site, so its trigger, its steps and its placement are
+ * decisions the server checks — the vocabulary, the organization's sites, the
+ * plan — and nothing a browser may write around.
+ *
+ * ## Two doors
+ *
+ * `automations/manage` is the organization's: it creates, edits, switches on
+ * and off, and deletes. It names the org and NO site, so it declares a
+ * subject resolver for the dispatchers' release gate and asks the org's
+ * plugin switch itself; the caller must be an org-wide owner, admin or
+ * editor.
+ *
+ * `automations/pause` is the SITE's — the host level control. It names the
+ * site, so the dispatcher applies that site's plugin switch as for any site
+ * request, and it changes one thing: whether this automation is paused on
+ * THIS site. The site's own admins and editors may use it, and so may an
+ * org-wide editor; nobody may pause a site through it but the one named.
+ */ import { createResourceUid } from "@aglyn/aglyn/app-utils/create-resource-uid";
+import { hostIdsFromScope, visibleToHost } from "@aglyn/aglyn/app-utils/scope-tokens";
+import { isPluginEnabled } from "@aglyn/aglyn/plugin-manager/enabled-plugins";
+import { checkEntitlement, isOrgWideMember, planLabelGrantingFeature } from "@aglyn/aglyn/server";
+/*
+ * The MODULES, not the barrel: `@aglyn/tenant-data-admin`'s index reaches the
+ * Next render cache, and everything these doors need is the Admin SDK handle,
+ * the id predicate and the org reads.
+ */ import { isDocumentId } from "@aglyn/tenant-data-admin/server/document-id";
+import firebaseAdmin from "@aglyn/tenant-data-admin/server/firebase-admin";
+import { getOrgDoc, logHostActivity, logOrgActivity, resolveOrgIdForHost, resolveOrgMembership } from "@aglyn/tenant-data-admin/server/organizations";
+import { FieldValue } from "firebase-admin/firestore";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+import { ORG_AUTOMATION_ACTIVITY_TARGET, ORG_AUTOMATION_API_ROUTES, ORG_AUTOMATIONS_COLLECTION, ORG_AUTOMATIONS_MAX, orgAutomationPausedHostIds, prunePausedHostIds, readOrgAutomation } from "../model/org-automations.js";
+export { ORG_AUTOMATION_API_ROUTES };
+/** What `automations/manage` may be asked to do. */ export const ORG_AUTOMATION_MANAGE_ACTIONS = [
+    'create',
+    'update',
+    'setEnabled',
+    'delete'
+];
+/** The org roles that may write the organization's automations. */ const ORG_MANAGE_ROLES = [
+    'owner',
+    'admin',
+    'editor'
+];
+/** The site roles that may pause an org automation on their own site. */ const SITE_PAUSE_ROLES = [
+    'admin',
+    'editor'
+];
+function defaultDeps() {
+    return {
+        firestore: ()=>firebaseAdmin.app().firestore(),
+        verifyIdToken: async (token)=>{
+            var _decoded_email;
+            const decoded = await firebaseAdmin.app().auth().verifyIdToken(token);
+            return {
+                uid: decoded.uid,
+                email: (_decoded_email = decoded.email) != null ? _decoded_email : null
+            };
+        },
+        resolveOrgMembership: async (uid, orgId)=>await resolveOrgMembership(uid, orgId),
+        getOrgDoc: async (orgId)=>{
+            var _ref;
+            return (_ref = await getOrgDoc(orgId)) != null ? _ref : null;
+        },
+        resolveOrgIdForHost,
+        logOrgActivity: (orgId, actor, action, target)=>logOrgActivity(orgId, actor, action, target),
+        logHostActivity: (hostId, actor, action, target)=>logHostActivity(hostId, actor, action, target),
+        newId: createResourceUid
+    };
+}
+/** The bearer token a request carries, or null. */ function bearerToken(headers) {
+    var _headers_authorization;
+    const authorization = String((_headers_authorization = headers['authorization']) != null ? _headers_authorization : '');
+    return authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) || null : null;
+}
+function automationsOf(firestore, orgId) {
+    return firestore.collection('orgs').doc(orgId).collection(ORG_AUTOMATIONS_COLLECTION);
+}
+/**
+ * Whether every site a placement names belongs to this organization — asked
+ * of `hostIndex`, the mirror `resolveOrgIdForHost` reads, in one round trip.
+ * `['org']` names no site and always answers yes.
+ */ async function placementIsTheOrgs(firestore, orgId, visibleTo) {
+    const hostIds = hostIdsFromScope(visibleTo);
+    if (!hostIds.length) return true;
+    if (!hostIds.every(isDocumentId)) return false;
+    const entries = await firestore.getAll(...hostIds.map((hostId)=>firestore.collection('hostIndex').doc(hostId)));
+    return entries.every((entry)=>entry.exists && entry.get('orgId') === orgId);
+}
+/**
+ * The organization a `automations/manage` request is for, read off its JSON
+ * body, so the dispatchers' release gate asks about the right organization.
+ * Consulted only for a request that names no site. Unverified, exactly as a
+ * `hostId` is: the handler refuses anyone who is not an org-wide member.
+ */ export async function orgAutomationsManageSubject(request) {
+    if (request.method !== 'POST') return null;
+    const body = await request.json().catch(()=>null);
+    const orgId = typeof (body == null ? void 0 : body.orgId) === 'string' ? body.orgId : '';
+    return isDocumentId(orgId) ? {
+        orgId
+    } : null;
+}
+/**
+ * `automations/manage`: create, edit, switch on or off, and delete one of the
+ * organization's automations.
+ *
+ * A DELETE is soft — `deletedAt` stamped and the automation switched off —
+ * because the id is what every run history row and every waiting person
+ * names: the rows keep a name to show, and the people waiting inside it are
+ * stopped by the resume's kill switch on their next beat. Deleting and
+ * switching off are never refused for want of a plan, so an organization
+ * that downgraded can always stop what it built.
+ */ export function createOrgAutomationsManageHandler(overrides = {}) {
+    return async (req, res)=>{
+        var _ref, _ref1, _ref2;
+        var _req_body, _req_body1, _req_body2;
+        const deps = _extends({}, defaultDeps(), overrides);
+        if (req.method !== 'POST') {
+            return res.status(405).json({
+                error: 'Method not allowed'
+            });
+        }
+        const orgId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.orgId) != null ? _ref : '');
+        const action = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.action) != null ? _ref1 : '');
+        if (!isDocumentId(orgId)) {
+            return res.status(400).json({
+                error: 'Invalid orgId'
+            });
+        }
+        if (!ORG_AUTOMATION_MANAGE_ACTIONS.includes(action)) {
+            return res.status(400).json({
+                error: 'Unknown action'
+            });
+        }
+        const automationId = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.automationId) != null ? _ref2 : '');
+        if (action !== 'create' && !isDocumentId(automationId)) {
+            return res.status(400).json({
+                error: 'Invalid automationId'
+            });
+        }
+        const token = bearerToken(req.headers);
+        if (!token) return res.status(401).json({
+            error: 'Unauthenticated'
+        });
+        try {
+            var _member_role, _caller_email;
+            var _req_body3;
+            const caller = await deps.verifyIdToken(token).catch(()=>null);
+            if (!caller) return res.status(401).json({
+                error: 'Unauthenticated'
+            });
+            const membership = await deps.resolveOrgMembership(caller.uid, orgId);
+            const member = membership == null ? void 0 : membership.member;
+            if (!member || !isOrgWideMember(member) || !ORG_MANAGE_ROLES.includes(String((_member_role = member.role) != null ? _member_role : ''))) {
+                return res.status(403).json({
+                    error: 'Not an organization owner, admin or editor'
+                });
+            }
+            /*
+       * A request naming no site reaches here past only the release gate —
+       * the dispatcher's per-site switch needs a site — so the organization's
+       * own switch is asked here.
+       */ const org = await deps.getOrgDoc(orgId);
+            if (!org || !isPluginEnabled(org, BUNDLE_ID)) {
+                return res.status(404).json({
+                    error: 'Not found'
+                });
+            }
+            const enabling = action === 'create' || action === 'update' || action === 'setEnabled' && ((_req_body3 = req.body) == null ? void 0 : _req_body3.enabled) === true;
+            if (enabling && !checkEntitlement(org, 'actions')) {
+                var _planLabelGrantingFeature;
+                return res.status(403).json({
+                    error: `Org automations need the ${(_planLabelGrantingFeature = planLabelGrantingFeature('actions')) != null ? _planLabelGrantingFeature : 'Pro'} plan`
+                });
+            }
+            const firestore = deps.firestore();
+            const collection = automationsOf(firestore, orgId);
+            const actor = {
+                uid: caller.uid,
+                email: (_caller_email = caller.email) != null ? _caller_email : null
+            };
+            const logged = (verb, id, name)=>deps.logOrgActivity(orgId, actor, verb, {
+                    type: ORG_AUTOMATION_ACTIVITY_TARGET,
+                    id,
+                    name
+                });
+            if (action === 'create' || action === 'update') {
+                var _req_body4;
+                const read = readOrgAutomation((_req_body4 = req.body) == null ? void 0 : _req_body4.automation);
+                if (read.ok === false) {
+                    return res.status(400).json({
+                        error: read.problem
+                    });
+                }
+                const fields = read.value;
+                if (!await placementIsTheOrgs(firestore, orgId, fields.visibleTo)) {
+                    return res.status(400).json({
+                        error: 'A site you chose is not in this organization'
+                    });
+                }
+                if (action === 'create') {
+                    /*
+           * Counted before the write rather than inside a transaction. The
+           * cap bounds storage, not money, so the overshoot two simultaneous
+           * saves can buy is one document — the trade the site actions cap
+           * makes for the same reason.
+           */ const live = (await collection.where('deletedAt', '==', null).count().get()).data().count;
+                    if (live >= ORG_AUTOMATIONS_MAX) {
+                        return res.status(409).json({
+                            error: `An organization holds at most ${ORG_AUTOMATIONS_MAX} org ` + 'automations — delete one you no longer use first'
+                        });
+                    }
+                    const id = deps.newId();
+                    await collection.doc(id).create(_extends({}, fields, {
+                        pausedHostIds: [],
+                        deletedAt: null,
+                        createdAt: FieldValue.serverTimestamp(),
+                        createdBy: caller.uid,
+                        updatedAt: FieldValue.serverTimestamp(),
+                        updatedBy: caller.uid
+                    }));
+                    await logged('Created an org automation', id, fields.name);
+                    return res.status(200).json({
+                        automationId: id
+                    });
+                }
+                const outcome = await firestore.runTransaction(async (transaction)=>{
+                    const ref = collection.doc(automationId);
+                    const current = await transaction.get(ref);
+                    if (!current.exists || current.get('deletedAt')) return 'missing';
+                    transaction.update(ref, _extends({}, fields, {
+                        // A site the automation no longer runs on has nothing left to
+                        // pause: its entry goes, so a later placement starts unpaused.
+                        pausedHostIds: prunePausedHostIds(orgAutomationPausedHostIds(current.data()), fields.visibleTo),
+                        updatedAt: FieldValue.serverTimestamp(),
+                        updatedBy: caller.uid
+                    }));
+                    return 'updated';
+                });
+                if (outcome === 'missing') {
+                    return res.status(404).json({
+                        error: 'Unknown org automation'
+                    });
+                }
+                await logged('Edited an org automation', automationId, fields.name);
+                return res.status(200).json({
+                    automationId
+                });
+            }
+            if (action === 'setEnabled') {
+                var _req_body5;
+                if (typeof ((_req_body5 = req.body) == null ? void 0 : _req_body5.enabled) !== 'boolean') {
+                    return res.status(400).json({
+                        error: 'Say whether it is enabled'
+                    });
+                }
+                const enabled = req.body.enabled;
+                const name = await firestore.runTransaction(async (transaction)=>{
+                    var _current_get;
+                    const ref = collection.doc(automationId);
+                    const current = await transaction.get(ref);
+                    if (!current.exists || current.get('deletedAt')) return null;
+                    transaction.update(ref, {
+                        enabled,
+                        updatedAt: FieldValue.serverTimestamp(),
+                        updatedBy: caller.uid
+                    });
+                    return String((_current_get = current.get('name')) != null ? _current_get : '');
+                });
+                if (name === null) {
+                    return res.status(404).json({
+                        error: 'Unknown org automation'
+                    });
+                }
+                await logged(enabled ? 'Switched on an org automation' : 'Switched off an org automation', automationId, name);
+                return res.status(200).json({
+                    automationId,
+                    enabled
+                });
+            }
+            // delete
+            const deleted = await firestore.runTransaction(async (transaction)=>{
+                var _current_get;
+                const ref = collection.doc(automationId);
+                const current = await transaction.get(ref);
+                if (!current.exists) return null;
+                // Deleting twice is the same request answered again.
+                if (current.get('deletedAt')) return {
+                    name: '',
+                    again: true
+                };
+                transaction.update(ref, {
+                    deletedAt: FieldValue.serverTimestamp(),
+                    deletedBy: caller.uid,
+                    // Off as well, so the engine's query — which asks for switched-on
+                    // automations only — never spends one of its places on it.
+                    enabled: false,
+                    updatedAt: FieldValue.serverTimestamp(),
+                    updatedBy: caller.uid
+                });
+                return {
+                    name: String((_current_get = current.get('name')) != null ? _current_get : ''),
+                    again: false
+                };
+            });
+            if (!deleted) {
+                return res.status(404).json({
+                    error: 'Unknown org automation'
+                });
+            }
+            if (!deleted.again) {
+                await logged('Deleted an org automation', automationId, deleted.name);
+            }
+            return res.status(200).json({
+                automationId,
+                deleted: true
+            });
+        } catch (error) {
+            console.error('[org automations] manage failed', orgId, action, error);
+            return res.status(500).json({
+                error: 'The request could not be completed'
+            });
+        }
+    };
+}
+/**
+ * `automations/pause`: pause or resume one org automation on ONE site.
+ *
+ * `pausedHostIds` is changed with `arrayUnion`/`arrayRemove` of the named
+ * site alone, inside a transaction that first confirms the automation runs
+ * there — so a site's editor can take their own site out of an org
+ * automation and put it back, and can never touch another site's entry or
+ * the automation itself. Pausing stops the people already waiting inside it
+ * on this site as well, on their next beat: the resume reads a pause as the
+ * kill switch.
+ *
+ * Never refused for want of a plan: a pause is how a site stops something,
+ * and stopping is always allowed.
+ */ export function createOrgAutomationPauseHandler(overrides = {}) {
+    return async (req, res)=>{
+        var _ref, _ref1;
+        var _req_body, _req_body1, _req_body2;
+        const deps = _extends({}, defaultDeps(), overrides);
+        if (req.method !== 'POST') {
+            return res.status(405).json({
+                error: 'Method not allowed'
+            });
+        }
+        const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+        const automationId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.automationId) != null ? _ref1 : '');
+        const paused = (_req_body2 = req.body) == null ? void 0 : _req_body2.paused;
+        if (!isDocumentId(hostId)) {
+            return res.status(400).json({
+                error: 'Invalid hostId'
+            });
+        }
+        if (!isDocumentId(automationId)) {
+            return res.status(400).json({
+                error: 'Invalid automationId'
+            });
+        }
+        if (typeof paused !== 'boolean') {
+            return res.status(400).json({
+                error: 'Say whether it is paused'
+            });
+        }
+        const token = bearerToken(req.headers);
+        if (!token) return res.status(401).json({
+            error: 'Unauthenticated'
+        });
+        try {
+            var _ref2, _caller_uid, _host_get, _caller_email;
+            var _req_body3;
+            const caller = await deps.verifyIdToken(token).catch(()=>null);
+            if (!caller) return res.status(401).json({
+                error: 'Unauthenticated'
+            });
+            const firestore = deps.firestore();
+            const host = await firestore.collection('hosts').doc(hostId).get();
+            if (!host.exists) return res.status(404).json({
+                error: 'Unknown site'
+            });
+            const orgId = await deps.resolveOrgIdForHost(hostId);
+            if (!orgId) {
+                return res.status(409).json({
+                    error: 'This site is not part of an organization, so it runs no org automations.'
+                });
+            }
+            const requestedOrgId = String((_ref2 = (_req_body3 = req.body) == null ? void 0 : _req_body3.orgId) != null ? _ref2 : '');
+            if (requestedOrgId && requestedOrgId !== orgId) {
+                return res.status(400).json({
+                    error: 'That site is not in this organization'
+                });
+            }
+            /*
+       * The site's own admins and editors, read off the host's `memberRoles`
+       * projection — the same answer every site door asks — or an org-wide
+       * editor, asked of the membership itself so a projection that has not
+       * caught up cannot refuse the organization's own managers.
+       */ const siteRole = String((_caller_uid = ((_host_get = host.get('memberRoles')) != null ? _host_get : {})[caller.uid]) != null ? _caller_uid : '');
+            let allowed = SITE_PAUSE_ROLES.includes(siteRole);
+            if (!allowed) {
+                var _ref3;
+                const membership = await deps.resolveOrgMembership(caller.uid, orgId);
+                const member = membership == null ? void 0 : membership.member;
+                allowed = Boolean(member) && isOrgWideMember(member) && ORG_MANAGE_ROLES.includes(String((_ref3 = member == null ? void 0 : member.role) != null ? _ref3 : ''));
+            }
+            if (!allowed) {
+                return res.status(403).json({
+                    error: 'Not an admin or editor of this site'
+                });
+            }
+            const name = await firestore.runTransaction(async (transaction)=>{
+                var _current_get;
+                const ref = automationsOf(firestore, orgId).doc(automationId);
+                const current = await transaction.get(ref);
+                if (!current.exists || current.get('deletedAt') || !visibleToHost(current.get('visibleTo'), hostId)) {
+                    return null;
+                }
+                transaction.update(ref, {
+                    pausedHostIds: paused ? FieldValue.arrayUnion(hostId) : FieldValue.arrayRemove(hostId)
+                });
+                return String((_current_get = current.get('name')) != null ? _current_get : '');
+            });
+            if (name === null) {
+                return res.status(404).json({
+                    error: 'No org automation by that id runs on this site'
+                });
+            }
+            await deps.logHostActivity(hostId, {
+                uid: caller.uid,
+                email: (_caller_email = caller.email) != null ? _caller_email : null
+            }, paused ? 'Paused an org automation on this site' : 'Resumed an org automation on this site', {
+                type: 'workflow',
+                id: automationId,
+                name
+            });
+            return res.status(200).json({
+                automationId,
+                hostId,
+                paused
+            });
+        } catch (error) {
+            console.error('[org automations] pause failed', hostId, automationId, error);
+            return res.status(500).json({
+                error: 'The request could not be completed'
+            });
+        }
+    };
+}
+export const orgAutomationsManageHandler = createOrgAutomationsManageHandler();
+export const orgAutomationPauseHandler = createOrgAutomationPauseHandler();
+
+//# sourceMappingURL=org-automations-routes.js.map

package/src/lib/server/org-automations-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/server/org-automations-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WRITING AN ORG AUTOMATION, and pausing one on a site (AGL-3302).\n *\n * `orgs/{orgId}/automations` is closed to every client write, the way the\n * outreach collections are: an org automation runs on every site it is\n * placed on, as that site, so its trigger, its steps and its placement are\n * decisions the server checks — the vocabulary, the organization's sites, the\n * plan — and nothing a browser may write around.\n *\n * ## Two doors\n *\n * `automations/manage` is the organization's: it creates, edits, switches on\n * and off, and deletes. It names the org and NO site, so it declares a\n * subject resolver for the dispatchers' release gate and asks the org's\n * plugin switch itself; the caller must be an org-wide owner, admin or\n * editor.\n *\n * `automations/pause` is the SITE's — the host level control. It names the\n * site, so the dispatcher applies that site's plugin switch as for any site\n * request, and it changes one thing: whether this automation is paused on\n * THIS site. The site's own admins and editors may use it, and so may an\n * org-wide editor; nobody may pause a site through it but the one named.\n */\n\nimport { createResourceUid } from '@aglyn/aglyn/app-utils/create-resource-uid'\nimport { hostIdsFromScope, visibleToHost } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport { isPluginEnabled } from '@aglyn/aglyn/plugin-manager/enabled-plugins'\nimport {\n  type AglynOrgMember,\n  checkEntitlement,\n  isOrgWideMember,\n  type PluginApiHandler,\n  type PluginApiRequestSubject,\n  planLabelGrantingFeature,\n} from '@aglyn/aglyn/server'\n/*\n * The MODULES, not the barrel: `@aglyn/tenant-data-admin`'s index reaches the\n * Next render cache, and everything these doors need is the Admin SDK handle,\n * the id predicate and the org reads.\n */\nimport { isDocumentId } from '@aglyn/tenant-data-admin/server/document-id'\nimport firebaseAdmin from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport {\n  getOrgDoc,\n  logHostActivity,\n  logOrgActivity,\n  resolveOrgIdForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin/server/organizations'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport {\n  ORG_AUTOMATION_ACTIVITY_TARGET,\n  ORG_AUTOMATION_API_ROUTES,\n  ORG_AUTOMATIONS_COLLECTION,\n  ORG_AUTOMATIONS_MAX,\n  orgAutomationPausedHostIds,\n  prunePausedHostIds,\n  readOrgAutomation,\n} from '../model/org-automations'\n\nexport { ORG_AUTOMATION_API_ROUTES }\n\n/** What `automations/manage` may be asked to do. */\nexport const ORG_AUTOMATION_MANAGE_ACTIONS = [\n  'create',\n  'update',\n  'setEnabled',\n  'delete',\n] as const\n\ntype ManageAction = (typeof ORG_AUTOMATION_MANAGE_ACTIONS)[number]\n\n/** The org roles that may write the organization's automations. */\nconst ORG_MANAGE_ROLES = ['owner', 'admin', 'editor'] as const\n\n/** The site roles that may pause an org automation on their own site. */\nconst SITE_PAUSE_ROLES = ['admin', 'editor'] as const\n\n/** What the doors reach outside this module; specs hand in their own. */\nexport interface OrgAutomationRouteDeps {\n  firestore(): FirebaseFirestore.Firestore\n  verifyIdToken(token: string): Promise<{ uid: string; email?: string | null }>\n  resolveOrgMembership(\n    uid: string,\n    orgId: string,\n  ): Promise<{ orgId: string; member: Partial<AglynOrgMember> } | null>\n  getOrgDoc(orgId: string): Promise<Record<string, unknown> | null>\n  resolveOrgIdForHost(hostId: string): Promise<string | null>\n  logOrgActivity(\n    orgId: string,\n    actor: { uid: string; email?: string | null },\n    action: string,\n    target: { type: typeof ORG_AUTOMATION_ACTIVITY_TARGET; id: string; name?: string },\n  ): Promise<void>\n  logHostActivity(\n    hostId: string,\n    actor: { uid: string; email?: string | null },\n    action: string,\n    target: { type: 'workflow'; id: string; name?: string },\n  ): Promise<void>\n  newId(): string\n}\n\nfunction defaultDeps(): OrgAutomationRouteDeps {\n  return {\n    firestore: () =>\n      firebaseAdmin.app().firestore() as unknown as FirebaseFirestore.Firestore,\n    verifyIdToken: async (token) => {\n      const decoded = await firebaseAdmin.app().auth().verifyIdToken(token)\n      return { uid: decoded.uid, email: decoded.email ?? null }\n    },\n    resolveOrgMembership: async (uid, orgId) =>\n      (await resolveOrgMembership(uid, orgId)) as never,\n    getOrgDoc: async (orgId) =>\n      ((await getOrgDoc(orgId)) as Record<string, unknown> | null) ?? null,\n    resolveOrgIdForHost,\n    logOrgActivity: (orgId, actor, action, target) =>\n      logOrgActivity(orgId, actor, action, target),\n    logHostActivity: (hostId, actor, action, target) =>\n      logHostActivity(hostId, actor, action, target),\n    newId: createResourceUid,\n  }\n}\n\n/** The bearer token a request carries, or null. */\nfunction bearerToken(headers: Partial<Record<string, string | string[]>>): string | null {\n  const authorization = String(headers['authorization'] ?? '')\n  return authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length) || null\n    : null\n}\n\nfunction automationsOf(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): FirebaseFirestore.CollectionReference {\n  return firestore\n    .collection('orgs')\n    .doc(orgId)\n    .collection(ORG_AUTOMATIONS_COLLECTION)\n}\n\n/**\n * Whether every site a placement names belongs to this organization — asked\n * of `hostIndex`, the mirror `resolveOrgIdForHost` reads, in one round trip.\n * `['org']` names no site and always answers yes.\n */\nasync function placementIsTheOrgs(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  visibleTo: readonly string[],\n): Promise<boolean> {\n  const hostIds = hostIdsFromScope(visibleTo)\n  if (!hostIds.length) return true\n  if (!hostIds.every(isDocumentId)) return false\n  const entries = await firestore.getAll(\n    ...hostIds.map((hostId) => firestore.collection('hostIndex').doc(hostId)),\n  )\n  return entries.every((entry) => entry.exists && entry.get('orgId') === orgId)\n}\n\n/**\n * The organization a `automations/manage` request is for, read off its JSON\n * body, so the dispatchers' release gate asks about the right organization.\n * Consulted only for a request that names no site. Unverified, exactly as a\n * `hostId` is: the handler refuses anyone who is not an org-wide member.\n */\nexport async function orgAutomationsManageSubject(\n  request: Request,\n): Promise<PluginApiRequestSubject | null> {\n  if (request.method !== 'POST') return null\n  const body = (await request.json().catch(() => null)) as {\n    orgId?: unknown\n  } | null\n  const orgId = typeof body?.orgId === 'string' ? body.orgId : ''\n  return isDocumentId(orgId) ? { orgId } : null\n}\n\n/**\n * `automations/manage`: create, edit, switch on or off, and delete one of the\n * organization's automations.\n *\n * A DELETE is soft — `deletedAt` stamped and the automation switched off —\n * because the id is what every run history row and every waiting person\n * names: the rows keep a name to show, and the people waiting inside it are\n * stopped by the resume's kill switch on their next beat. Deleting and\n * switching off are never refused for want of a plan, so an organization\n * that downgraded can always stop what it built.\n */\nexport function createOrgAutomationsManageHandler(\n  overrides: Partial<OrgAutomationRouteDeps> = {},\n): PluginApiHandler {\n  return async (req, res) => {\n    const deps = { ...defaultDeps(), ...overrides }\n    if (req.method !== 'POST') {\n      return res.status(405).json({ error: 'Method not allowed' })\n    }\n    const orgId = String(req.body?.orgId ?? '')\n    const action = String(req.body?.action ?? '') as ManageAction\n    if (!isDocumentId(orgId)) {\n      return res.status(400).json({ error: 'Invalid orgId' })\n    }\n    if (!(ORG_AUTOMATION_MANAGE_ACTIONS as readonly string[]).includes(action)) {\n      return res.status(400).json({ error: 'Unknown action' })\n    }\n    const automationId = String(req.body?.automationId ?? '')\n    if (action !== 'create' && !isDocumentId(automationId)) {\n      return res.status(400).json({ error: 'Invalid automationId' })\n    }\n    const token = bearerToken(req.headers)\n    if (!token) return res.status(401).json({ error: 'Unauthenticated' })\n\n    try {\n      const caller = await deps.verifyIdToken(token).catch(() => null)\n      if (!caller) return res.status(401).json({ error: 'Unauthenticated' })\n      const membership = await deps.resolveOrgMembership(caller.uid, orgId)\n      const member = membership?.member\n      if (\n        !member ||\n        !isOrgWideMember(member) ||\n        !(ORG_MANAGE_ROLES as readonly string[]).includes(String(member.role ?? ''))\n      ) {\n        return res\n          .status(403)\n          .json({ error: 'Not an organization owner, admin or editor' })\n      }\n      /*\n       * A request naming no site reaches here past only the release gate —\n       * the dispatcher's per-site switch needs a site — so the organization's\n       * own switch is asked here.\n       */\n      const org = await deps.getOrgDoc(orgId)\n      if (!org || !isPluginEnabled(org as never, BUNDLE_ID)) {\n        return res.status(404).json({ error: 'Not found' })\n      }\n      const enabling =\n        action === 'create' ||\n        action === 'update' ||\n        (action === 'setEnabled' && req.body?.enabled === true)\n      if (enabling && !checkEntitlement(org as never, 'actions')) {\n        return res.status(403).json({\n          error: `Org automations need the ${planLabelGrantingFeature('actions') ?? 'Pro'} plan`,\n        })\n      }\n\n      const firestore = deps.firestore()\n      const collection = automationsOf(firestore, orgId)\n      const actor = { uid: caller.uid, email: caller.email ?? null }\n      const logged = (verb: string, id: string, name: string) =>\n        deps.logOrgActivity(orgId, actor, verb, {\n          type: ORG_AUTOMATION_ACTIVITY_TARGET,\n          id,\n          name,\n        })\n\n      if (action === 'create' || action === 'update') {\n        const read = readOrgAutomation(req.body?.automation)\n        if (read.ok === false) {\n          return res.status(400).json({ error: read.problem })\n        }\n        const fields = read.value\n        if (!(await placementIsTheOrgs(firestore, orgId, fields.visibleTo))) {\n          return res\n            .status(400)\n            .json({ error: 'A site you chose is not in this organization' })\n        }\n        if (action === 'create') {\n          /*\n           * Counted before the write rather than inside a transaction. The\n           * cap bounds storage, not money, so the overshoot two simultaneous\n           * saves can buy is one document — the trade the site actions cap\n           * makes for the same reason.\n           */\n          const live = (\n            await collection.where('deletedAt', '==', null).count().get()\n          ).data().count\n          if (live >= ORG_AUTOMATIONS_MAX) {\n            return res.status(409).json({\n              error:\n                `An organization holds at most ${ORG_AUTOMATIONS_MAX} org ` +\n                'automations — delete one you no longer use first',\n            })\n          }\n          const id = deps.newId()\n          await collection.doc(id).create({\n            ...fields,\n            pausedHostIds: [],\n            deletedAt: null,\n            createdAt: FieldValue.serverTimestamp(),\n            createdBy: caller.uid,\n            updatedAt: FieldValue.serverTimestamp(),\n            updatedBy: caller.uid,\n          })\n          await logged('Created an org automation', id, fields.name)\n          return res.status(200).json({ automationId: id })\n        }\n        const outcome = await firestore.runTransaction(async (transaction) => {\n          const ref = collection.doc(automationId)\n          const current = await transaction.get(ref)\n          if (!current.exists || current.get('deletedAt')) return 'missing'\n          transaction.update(ref, {\n            ...fields,\n            // A site the automation no longer runs on has nothing left to\n            // pause: its entry goes, so a later placement starts unpaused.\n            pausedHostIds: prunePausedHostIds(\n              orgAutomationPausedHostIds(current.data()),\n              fields.visibleTo,\n            ),\n            updatedAt: FieldValue.serverTimestamp(),\n            updatedBy: caller.uid,\n          })\n          return 'updated'\n        })\n        if (outcome === 'missing') {\n          return res.status(404).json({ error: 'Unknown org automation' })\n        }\n        await logged('Edited an org automation', automationId, fields.name)\n        return res.status(200).json({ automationId })\n      }\n\n      if (action === 'setEnabled') {\n        if (typeof req.body?.enabled !== 'boolean') {\n          return res.status(400).json({ error: 'Say whether it is enabled' })\n        }\n        const enabled = req.body.enabled as boolean\n        const name = await firestore.runTransaction(async (transaction) => {\n          const ref = collection.doc(automationId)\n          const current = await transaction.get(ref)\n          if (!current.exists || current.get('deletedAt')) return null\n          transaction.update(ref, {\n            enabled,\n            updatedAt: FieldValue.serverTimestamp(),\n            updatedBy: caller.uid,\n          })\n          return String(current.get('name') ?? '')\n        })\n        if (name === null) {\n          return res.status(404).json({ error: 'Unknown org automation' })\n        }\n        await logged(\n          enabled ? 'Switched on an org automation' : 'Switched off an org automation',\n          automationId,\n          name,\n        )\n        return res.status(200).json({ automationId, enabled })\n      }\n\n      // delete\n      const deleted = await firestore.runTransaction(async (transaction) => {\n        const ref = collection.doc(automationId)\n        const current = await transaction.get(ref)\n        if (!current.exists) return null\n        // Deleting twice is the same request answered again.\n        if (current.get('deletedAt')) return { name: '', again: true }\n        transaction.update(ref, {\n          deletedAt: FieldValue.serverTimestamp(),\n          deletedBy: caller.uid,\n          // Off as well, so the engine's query — which asks for switched-on\n          // automations only — never spends one of its places on it.\n          enabled: false,\n          updatedAt: FieldValue.serverTimestamp(),\n          updatedBy: caller.uid,\n        })\n        return { name: String(current.get('name') ?? ''), again: false }\n      })\n      if (!deleted) {\n        return res.status(404).json({ error: 'Unknown org automation' })\n      }\n      if (!deleted.again) {\n        await logged('Deleted an org automation', automationId, deleted.name)\n      }\n      return res.status(200).json({ automationId, deleted: true })\n    } catch (error) {\n      console.error('[org automations] manage failed', orgId, action, error)\n      return res\n        .status(500)\n        .json({ error: 'The request could not be completed' })\n    }\n  }\n}\n\n/**\n * `automations/pause`: pause or resume one org automation on ONE site.\n *\n * `pausedHostIds` is changed with `arrayUnion`/`arrayRemove` of the named\n * site alone, inside a transaction that first confirms the automation runs\n * there — so a site's editor can take their own site out of an org\n * automation and put it back, and can never touch another site's entry or\n * the automation itself. Pausing stops the people already waiting inside it\n * on this site as well, on their next beat: the resume reads a pause as the\n * kill switch.\n *\n * Never refused for want of a plan: a pause is how a site stops something,\n * and stopping is always allowed.\n */\nexport function createOrgAutomationPauseHandler(\n  overrides: Partial<OrgAutomationRouteDeps> = {},\n): PluginApiHandler {\n  return async (req, res) => {\n    const deps = { ...defaultDeps(), ...overrides }\n    if (req.method !== 'POST') {\n      return res.status(405).json({ error: 'Method not allowed' })\n    }\n    const hostId = String(req.body?.hostId ?? '')\n    const automationId = String(req.body?.automationId ?? '')\n    const paused = req.body?.paused\n    if (!isDocumentId(hostId)) {\n      return res.status(400).json({ error: 'Invalid hostId' })\n    }\n    if (!isDocumentId(automationId)) {\n      return res.status(400).json({ error: 'Invalid automationId' })\n    }\n    if (typeof paused !== 'boolean') {\n      return res.status(400).json({ error: 'Say whether it is paused' })\n    }\n    const token = bearerToken(req.headers)\n    if (!token) return res.status(401).json({ error: 'Unauthenticated' })\n\n    try {\n      const caller = await deps.verifyIdToken(token).catch(() => null)\n      if (!caller) return res.status(401).json({ error: 'Unauthenticated' })\n      const firestore = deps.firestore()\n      const host = await firestore.collection('hosts').doc(hostId).get()\n      if (!host.exists) return res.status(404).json({ error: 'Unknown site' })\n      const orgId = await deps.resolveOrgIdForHost(hostId)\n      if (!orgId) {\n        return res.status(409).json({\n          error: 'This site is not part of an organization, so it runs no org automations.',\n        })\n      }\n      const requestedOrgId = String(req.body?.orgId ?? '')\n      if (requestedOrgId && requestedOrgId !== orgId) {\n        return res.status(400).json({ error: 'That site is not in this organization' })\n      }\n      /*\n       * The site's own admins and editors, read off the host's `memberRoles`\n       * projection — the same answer every site door asks — or an org-wide\n       * editor, asked of the membership itself so a projection that has not\n       * caught up cannot refuse the organization's own managers.\n       */\n      const siteRole = String((host.get('memberRoles') ?? {})[caller.uid] ?? '')\n      let allowed = (SITE_PAUSE_ROLES as readonly string[]).includes(siteRole)\n      if (!allowed) {\n        const membership = await deps.resolveOrgMembership(caller.uid, orgId)\n        const member = membership?.member\n        allowed =\n          Boolean(member) &&\n          isOrgWideMember(member) &&\n          (ORG_MANAGE_ROLES as readonly string[]).includes(String(member?.role ?? ''))\n      }\n      if (!allowed) {\n        return res\n          .status(403)\n          .json({ error: 'Not an admin or editor of this site' })\n      }\n\n      const name = await firestore.runTransaction(async (transaction) => {\n        const ref = automationsOf(firestore, orgId).doc(automationId)\n        const current = await transaction.get(ref)\n        if (\n          !current.exists ||\n          current.get('deletedAt') ||\n          !visibleToHost(current.get('visibleTo') as string[] | undefined, hostId)\n        ) {\n          return null\n        }\n        transaction.update(ref, {\n          pausedHostIds: paused\n            ? FieldValue.arrayUnion(hostId)\n            : FieldValue.arrayRemove(hostId),\n        })\n        return String(current.get('name') ?? '')\n      })\n      if (name === null) {\n        return res\n          .status(404)\n          .json({ error: 'No org automation by that id runs on this site' })\n      }\n      await deps.logHostActivity(\n        hostId,\n        { uid: caller.uid, email: caller.email ?? null },\n        paused\n          ? 'Paused an org automation on this site'\n          : 'Resumed an org automation on this site',\n        { type: 'workflow', id: automationId, name },\n      )\n      return res.status(200).json({ automationId, hostId, paused })\n    } catch (error) {\n      console.error('[org automations] pause failed', hostId, automationId, error)\n      return res\n        .status(500)\n        .json({ error: 'The request could not be completed' })\n    }\n  }\n}\n\nexport const orgAutomationsManageHandler = createOrgAutomationsManageHandler()\nexport const orgAutomationPauseHandler = createOrgAutomationPauseHandler()\n"],"names":["createResourceUid","hostIdsFromScope","visibleToHost","isPluginEnabled","checkEntitlement","isOrgWideMember","planLabelGrantingFeature","isDocumentId","firebaseAdmin","getOrgDoc","logHostActivity","logOrgActivity","resolveOrgIdForHost","resolveOrgMembership","FieldValue","BUNDLE_ID","ORG_AUTOMATION_ACTIVITY_TARGET","ORG_AUTOMATION_API_ROUTES","ORG_AUTOMATIONS_COLLECTION","ORG_AUTOMATIONS_MAX","orgAutomationPausedHostIds","prunePausedHostIds","readOrgAutomation","ORG_AUTOMATION_MANAGE_ACTIONS","ORG_MANAGE_ROLES","SITE_PAUSE_ROLES","defaultDeps","firestore","app","verifyIdToken","token","decoded","auth","uid","email","orgId","actor","action","target","hostId","newId","bearerToken","headers","authorization","String","startsWith","slice","length","automationsOf","collection","doc","placementIsTheOrgs","visibleTo","hostIds","every","entries","getAll","map","entry","exists","get","orgAutomationsManageSubject","request","method","body","json","catch","createOrgAutomationsManageHandler","overrides","req","res","deps","status","error","includes","automationId","member","caller","membership","role","org","enabling","enabled","logged","verb","id","name","type","read","automation","ok","problem","fields","value","live","where","count","data","create","pausedHostIds","deletedAt","createdAt","serverTimestamp","createdBy","updatedAt","updatedBy","outcome","runTransaction","transaction","ref","current","update","deleted","again","deletedBy","console","createOrgAutomationPauseHandler","paused","host","requestedOrgId","siteRole","allowed","Boolean","arrayUnion","arrayRemove","orgAutomationsManageHandler","orgAutomationPauseHandler"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,SAASA,iBAAiB,QAAQ,6CAA4C;AAC9E,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,sCAAqC;AACrF,SAASC,eAAe,QAAQ,8CAA6C;AAC7E,SAEEC,gBAAgB,EAChBC,eAAe,EAGfC,wBAAwB,QACnB,sBAAqB;AAC5B;;;;CAIC,GACD,SAASC,YAAY,QAAQ,8CAA6C;AAC1E,OAAOC,mBAAmB,iDAAgD;AAC1E,SACEC,SAAS,EACTC,eAAe,EACfC,cAAc,EACdC,mBAAmB,EACnBC,oBAAoB,QACf,gDAA+C;AACtD,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SACEC,8BAA8B,EAC9BC,yBAAyB,EACzBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,0BAA0B,EAC1BC,kBAAkB,EAClBC,iBAAiB,QACZ,8BAA0B;AAEjC,SAASL,yBAAyB,GAAE;AAEpC,kDAAkD,GAClD,OAAO,MAAMM,gCAAgC;IAC3C;IACA;IACA;IACA;CACD,CAAS;AAIV,iEAAiE,GACjE,MAAMC,mBAAmB;IAAC;IAAS;IAAS;CAAS;AAErD,uEAAuE,GACvE,MAAMC,mBAAmB;IAAC;IAAS;CAAS;AA2B5C,SAASC;IACP,OAAO;QACLC,WAAW,IACTnB,cAAcoB,GAAG,GAAGD,SAAS;QAC/BE,eAAe,OAAOC;gBAEcC;YADlC,MAAMA,UAAU,MAAMvB,cAAcoB,GAAG,GAAGI,IAAI,GAAGH,aAAa,CAACC;YAC/D,OAAO;gBAAEG,KAAKF,QAAQE,GAAG;gBAAEC,KAAK,GAAEH,iBAAAA,QAAQG,KAAK,YAAbH,iBAAiB;YAAK;QAC1D;QACAlB,sBAAsB,OAAOoB,KAAKE,QAC/B,MAAMtB,qBAAqBoB,KAAKE;QACnC1B,WAAW,OAAO0B;gBACd;oBAAA,OAAA,MAAM1B,UAAU0B,kBAAhB,OAA8D;;QAClEvB;QACAD,gBAAgB,CAACwB,OAAOC,OAAOC,QAAQC,SACrC3B,eAAewB,OAAOC,OAAOC,QAAQC;QACvC5B,iBAAiB,CAAC6B,QAAQH,OAAOC,QAAQC,SACvC5B,gBAAgB6B,QAAQH,OAAOC,QAAQC;QACzCE,OAAOxC;IACT;AACF;AAEA,iDAAiD,GACjD,SAASyC,YAAYC,OAAmD;QACzCA;IAA7B,MAAMC,gBAAgBC,QAAOF,yBAAAA,OAAO,CAAC,gBAAgB,YAAxBA,yBAA4B;IACzD,OAAOC,cAAcE,UAAU,CAAC,aAC5BF,cAAcG,KAAK,CAAC,UAAUC,MAAM,KAAK,OACzC;AACN;AAEA,SAASC,cACPrB,SAAsC,EACtCQ,KAAa;IAEb,OAAOR,UACJsB,UAAU,CAAC,QACXC,GAAG,CAACf,OACJc,UAAU,CAAC/B;AAChB;AAEA;;;;CAIC,GACD,eAAeiC,mBACbxB,SAAsC,EACtCQ,KAAa,EACbiB,SAA4B;IAE5B,MAAMC,UAAUpD,iBAAiBmD;IACjC,IAAI,CAACC,QAAQN,MAAM,EAAE,OAAO;IAC5B,IAAI,CAACM,QAAQC,KAAK,CAAC/C,eAAe,OAAO;IACzC,MAAMgD,UAAU,MAAM5B,UAAU6B,MAAM,IACjCH,QAAQI,GAAG,CAAC,CAAClB,SAAWZ,UAAUsB,UAAU,CAAC,aAAaC,GAAG,CAACX;IAEnE,OAAOgB,QAAQD,KAAK,CAAC,CAACI,QAAUA,MAAMC,MAAM,IAAID,MAAME,GAAG,CAAC,aAAazB;AACzE;AAEA;;;;;CAKC,GACD,OAAO,eAAe0B,4BACpBC,OAAgB;IAEhB,IAAIA,QAAQC,MAAM,KAAK,QAAQ,OAAO;IACtC,MAAMC,OAAQ,MAAMF,QAAQG,IAAI,GAAGC,KAAK,CAAC,IAAM;IAG/C,MAAM/B,QAAQ,QAAO6B,wBAAAA,KAAM7B,KAAK,MAAK,WAAW6B,KAAK7B,KAAK,GAAG;IAC7D,OAAO5B,aAAa4B,SAAS;QAAEA;IAAM,IAAI;AAC3C;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASgC,kCACdC,YAA6C,CAAC,CAAC;IAE/C,OAAO,OAAOC,KAAKC;;YAKID,WACCA,YAOMA;QAZ5B,MAAME,OAAO,aAAK7C,eAAkB0C;QACpC,IAAIC,IAAIN,MAAM,KAAK,QAAQ;YACzB,OAAOO,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAqB;QAC5D;QACA,MAAMtC,QAAQS,gBAAOyB,YAAAA,IAAIL,IAAI,qBAARK,UAAUlC,KAAK,mBAAI;QACxC,MAAME,SAASO,iBAAOyB,aAAAA,IAAIL,IAAI,qBAARK,WAAUhC,MAAM,oBAAI;QAC1C,IAAI,CAAC9B,aAAa4B,QAAQ;YACxB,OAAOmC,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAgB;QACvD;QACA,IAAI,CAAC,AAAClD,8BAAoDmD,QAAQ,CAACrC,SAAS;YAC1E,OAAOiC,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAiB;QACxD;QACA,MAAME,eAAe/B,iBAAOyB,aAAAA,IAAIL,IAAI,qBAARK,WAAUM,YAAY,oBAAI;QACtD,IAAItC,WAAW,YAAY,CAAC9B,aAAaoE,eAAe;YACtD,OAAOL,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAuB;QAC9D;QACA,MAAM3C,QAAQW,YAAY4B,IAAI3B,OAAO;QACrC,IAAI,CAACZ,OAAO,OAAOwC,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;YAAEQ,OAAO;QAAkB;QAEnE,IAAI;gBAQyDG,cA2BnBC;gBATVR;YAzB9B,MAAMQ,SAAS,MAAMN,KAAK1C,aAAa,CAACC,OAAOoC,KAAK,CAAC,IAAM;YAC3D,IAAI,CAACW,QAAQ,OAAOP,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAkB;YACpE,MAAMK,aAAa,MAAMP,KAAK1D,oBAAoB,CAACgE,OAAO5C,GAAG,EAAEE;YAC/D,MAAMyC,SAASE,8BAAAA,WAAYF,MAAM;YACjC,IACE,CAACA,UACD,CAACvE,gBAAgBuE,WACjB,CAAC,AAACpD,iBAAuCkD,QAAQ,CAAC9B,QAAOgC,eAAAA,OAAOG,IAAI,YAAXH,eAAe,MACxE;gBACA,OAAON,IACJE,MAAM,CAAC,KACPP,IAAI,CAAC;oBAAEQ,OAAO;gBAA6C;YAChE;YACA;;;;OAIC,GACD,MAAMO,MAAM,MAAMT,KAAK9D,SAAS,CAAC0B;YACjC,IAAI,CAAC6C,OAAO,CAAC7E,gBAAgB6E,KAAcjE,YAAY;gBACrD,OAAOuD,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;oBAAEQ,OAAO;gBAAY;YACnD;YACA,MAAMQ,WACJ5C,WAAW,YACXA,WAAW,YACVA,WAAW,gBAAgBgC,EAAAA,aAAAA,IAAIL,IAAI,qBAARK,WAAUa,OAAO,MAAK;YACpD,IAAID,YAAY,CAAC7E,iBAAiB4E,KAAc,YAAY;oBAErB1E;gBADrC,OAAOgE,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;oBAC1BQ,OAAO,CAAC,yBAAyB,GAAEnE,4BAAAA,yBAAyB,sBAAzBA,4BAAuC,MAAM,KAAK,CAAC;gBACxF;YACF;YAEA,MAAMqB,YAAY4C,KAAK5C,SAAS;YAChC,MAAMsB,aAAaD,cAAcrB,WAAWQ;YAC5C,MAAMC,QAAQ;gBAAEH,KAAK4C,OAAO5C,GAAG;gBAAEC,KAAK,GAAE2C,gBAAAA,OAAO3C,KAAK,YAAZ2C,gBAAgB;YAAK;YAC7D,MAAMM,SAAS,CAACC,MAAcC,IAAYC,OACxCf,KAAK5D,cAAc,CAACwB,OAAOC,OAAOgD,MAAM;oBACtCG,MAAMvE;oBACNqE;oBACAC;gBACF;YAEF,IAAIjD,WAAW,YAAYA,WAAW,UAAU;oBACfgC;gBAA/B,MAAMmB,OAAOlE,mBAAkB+C,aAAAA,IAAIL,IAAI,qBAARK,WAAUoB,UAAU;gBACnD,IAAID,KAAKE,EAAE,KAAK,OAAO;oBACrB,OAAOpB,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;wBAAEQ,OAAOe,KAAKG,OAAO;oBAAC;gBACpD;gBACA,MAAMC,SAASJ,KAAKK,KAAK;gBACzB,IAAI,CAAE,MAAM1C,mBAAmBxB,WAAWQ,OAAOyD,OAAOxC,SAAS,GAAI;oBACnE,OAAOkB,IACJE,MAAM,CAAC,KACPP,IAAI,CAAC;wBAAEQ,OAAO;oBAA+C;gBAClE;gBACA,IAAIpC,WAAW,UAAU;oBACvB;;;;;WAKC,GACD,MAAMyD,OAAO,AACX,CAAA,MAAM7C,WAAW8C,KAAK,CAAC,aAAa,MAAM,MAAMC,KAAK,GAAGpC,GAAG,EAAC,EAC5DqC,IAAI,GAAGD,KAAK;oBACd,IAAIF,QAAQ3E,qBAAqB;wBAC/B,OAAOmD,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;4BAC1BQ,OACE,CAAC,8BAA8B,EAAEtD,oBAAoB,KAAK,CAAC,GAC3D;wBACJ;oBACF;oBACA,MAAMkE,KAAKd,KAAK/B,KAAK;oBACrB,MAAMS,WAAWC,GAAG,CAACmC,IAAIa,MAAM,CAAC,aAC3BN;wBACHO,eAAe,EAAE;wBACjBC,WAAW;wBACXC,WAAWvF,WAAWwF,eAAe;wBACrCC,WAAW1B,OAAO5C,GAAG;wBACrBuE,WAAW1F,WAAWwF,eAAe;wBACrCG,WAAW5B,OAAO5C,GAAG;;oBAEvB,MAAMkD,OAAO,6BAA6BE,IAAIO,OAAON,IAAI;oBACzD,OAAOhB,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;wBAAEU,cAAcU;oBAAG;gBACjD;gBACA,MAAMqB,UAAU,MAAM/E,UAAUgF,cAAc,CAAC,OAAOC;oBACpD,MAAMC,MAAM5D,WAAWC,GAAG,CAACyB;oBAC3B,MAAMmC,UAAU,MAAMF,YAAYhD,GAAG,CAACiD;oBACtC,IAAI,CAACC,QAAQnD,MAAM,IAAImD,QAAQlD,GAAG,CAAC,cAAc,OAAO;oBACxDgD,YAAYG,MAAM,CAACF,KAAK,aACnBjB;wBACH,8DAA8D;wBAC9D,+DAA+D;wBAC/DO,eAAe9E,mBACbD,2BAA2B0F,QAAQb,IAAI,KACvCL,OAAOxC,SAAS;wBAElBoD,WAAW1F,WAAWwF,eAAe;wBACrCG,WAAW5B,OAAO5C,GAAG;;oBAEvB,OAAO;gBACT;gBACA,IAAIyE,YAAY,WAAW;oBACzB,OAAOpC,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;wBAAEQ,OAAO;oBAAyB;gBAChE;gBACA,MAAMU,OAAO,4BAA4BR,cAAciB,OAAON,IAAI;gBAClE,OAAOhB,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;oBAAEU;gBAAa;YAC7C;YAEA,IAAItC,WAAW,cAAc;oBAChBgC;gBAAX,IAAI,SAAOA,aAAAA,IAAIL,IAAI,qBAARK,WAAUa,OAAO,MAAK,WAAW;oBAC1C,OAAOZ,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;wBAAEQ,OAAO;oBAA4B;gBACnE;gBACA,MAAMS,UAAUb,IAAIL,IAAI,CAACkB,OAAO;gBAChC,MAAMI,OAAO,MAAM3D,UAAUgF,cAAc,CAAC,OAAOC;wBASnCE;oBARd,MAAMD,MAAM5D,WAAWC,GAAG,CAACyB;oBAC3B,MAAMmC,UAAU,MAAMF,YAAYhD,GAAG,CAACiD;oBACtC,IAAI,CAACC,QAAQnD,MAAM,IAAImD,QAAQlD,GAAG,CAAC,cAAc,OAAO;oBACxDgD,YAAYG,MAAM,CAACF,KAAK;wBACtB3B;wBACAsB,WAAW1F,WAAWwF,eAAe;wBACrCG,WAAW5B,OAAO5C,GAAG;oBACvB;oBACA,OAAOW,QAAOkE,eAAAA,QAAQlD,GAAG,CAAC,mBAAZkD,eAAuB;gBACvC;gBACA,IAAIxB,SAAS,MAAM;oBACjB,OAAOhB,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;wBAAEQ,OAAO;oBAAyB;gBAChE;gBACA,MAAMU,OACJD,UAAU,kCAAkC,kCAC5CP,cACAW;gBAEF,OAAOhB,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;oBAAEU;oBAAcO;gBAAQ;YACtD;YAEA,SAAS;YACT,MAAM8B,UAAU,MAAMrF,UAAUgF,cAAc,CAAC,OAAOC;oBAe9BE;gBAdtB,MAAMD,MAAM5D,WAAWC,GAAG,CAACyB;gBAC3B,MAAMmC,UAAU,MAAMF,YAAYhD,GAAG,CAACiD;gBACtC,IAAI,CAACC,QAAQnD,MAAM,EAAE,OAAO;gBAC5B,qDAAqD;gBACrD,IAAImD,QAAQlD,GAAG,CAAC,cAAc,OAAO;oBAAE0B,MAAM;oBAAI2B,OAAO;gBAAK;gBAC7DL,YAAYG,MAAM,CAACF,KAAK;oBACtBT,WAAWtF,WAAWwF,eAAe;oBACrCY,WAAWrC,OAAO5C,GAAG;oBACrB,kEAAkE;oBAClE,2DAA2D;oBAC3DiD,SAAS;oBACTsB,WAAW1F,WAAWwF,eAAe;oBACrCG,WAAW5B,OAAO5C,GAAG;gBACvB;gBACA,OAAO;oBAAEqD,MAAM1C,QAAOkE,eAAAA,QAAQlD,GAAG,CAAC,mBAAZkD,eAAuB;oBAAKG,OAAO;gBAAM;YACjE;YACA,IAAI,CAACD,SAAS;gBACZ,OAAO1C,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;oBAAEQ,OAAO;gBAAyB;YAChE;YACA,IAAI,CAACuC,QAAQC,KAAK,EAAE;gBAClB,MAAM9B,OAAO,6BAA6BR,cAAcqC,QAAQ1B,IAAI;YACtE;YACA,OAAOhB,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEU;gBAAcqC,SAAS;YAAK;QAC5D,EAAE,OAAOvC,OAAO;YACd0C,QAAQ1C,KAAK,CAAC,mCAAmCtC,OAAOE,QAAQoC;YAChE,OAAOH,IACJE,MAAM,CAAC,KACPP,IAAI,CAAC;gBAAEQ,OAAO;YAAqC;QACxD;IACF;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAAS2C,gCACdhD,YAA6C,CAAC,CAAC;IAE/C,OAAO,OAAOC,KAAKC;;YAKKD,WACMA,YACbA;QANf,MAAME,OAAO,aAAK7C,eAAkB0C;QACpC,IAAIC,IAAIN,MAAM,KAAK,QAAQ;YACzB,OAAOO,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAqB;QAC5D;QACA,MAAMlC,SAASK,gBAAOyB,YAAAA,IAAIL,IAAI,qBAARK,UAAU9B,MAAM,mBAAI;QAC1C,MAAMoC,eAAe/B,iBAAOyB,aAAAA,IAAIL,IAAI,qBAARK,WAAUM,YAAY,oBAAI;QACtD,MAAM0C,UAAShD,aAAAA,IAAIL,IAAI,qBAARK,WAAUgD,MAAM;QAC/B,IAAI,CAAC9G,aAAagC,SAAS;YACzB,OAAO+B,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAiB;QACxD;QACA,IAAI,CAAClE,aAAaoE,eAAe;YAC/B,OAAOL,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAuB;QAC9D;QACA,IAAI,OAAO4C,WAAW,WAAW;YAC/B,OAAO/C,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAA2B;QAClE;QACA,MAAM3C,QAAQW,YAAY4B,IAAI3B,OAAO;QACrC,IAAI,CAACZ,OAAO,OAAOwC,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;YAAEQ,OAAO;QAAkB;QAEnE,IAAI;uBAsBsB,aAAC6C,WAwCGzC;gBAlDER;YAX9B,MAAMQ,SAAS,MAAMN,KAAK1C,aAAa,CAACC,OAAOoC,KAAK,CAAC,IAAM;YAC3D,IAAI,CAACW,QAAQ,OAAOP,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAkB;YACpE,MAAM9C,YAAY4C,KAAK5C,SAAS;YAChC,MAAM2F,OAAO,MAAM3F,UAAUsB,UAAU,CAAC,SAASC,GAAG,CAACX,QAAQqB,GAAG;YAChE,IAAI,CAAC0D,KAAK3D,MAAM,EAAE,OAAOW,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEQ,OAAO;YAAe;YACtE,MAAMtC,QAAQ,MAAMoC,KAAK3D,mBAAmB,CAAC2B;YAC7C,IAAI,CAACJ,OAAO;gBACV,OAAOmC,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;oBAC1BQ,OAAO;gBACT;YACF;YACA,MAAM8C,iBAAiB3E,iBAAOyB,aAAAA,IAAIL,IAAI,qBAARK,WAAUlC,KAAK,oBAAI;YACjD,IAAIoF,kBAAkBA,mBAAmBpF,OAAO;gBAC9C,OAAOmC,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;oBAAEQ,OAAO;gBAAwC;YAC/E;YACA;;;;;OAKC,GACD,MAAM+C,WAAW5E,QAAO,cAAA,EAAC0E,YAAAA,KAAK1D,GAAG,CAAC,0BAAT0D,YAA2B,CAAC,EAAE,CAACzC,OAAO5C,GAAG,CAAC,YAA3C,cAA+C;YACvE,IAAIwF,UAAU,AAAChG,iBAAuCiD,QAAQ,CAAC8C;YAC/D,IAAI,CAACC,SAAS;;gBACZ,MAAM3C,aAAa,MAAMP,KAAK1D,oBAAoB,CAACgE,OAAO5C,GAAG,EAAEE;gBAC/D,MAAMyC,SAASE,8BAAAA,WAAYF,MAAM;gBACjC6C,UACEC,QAAQ9C,WACRvE,gBAAgBuE,WAChB,AAACpD,iBAAuCkD,QAAQ,CAAC9B,gBAAOgC,0BAAAA,OAAQG,IAAI,oBAAI;YAC5E;YACA,IAAI,CAAC0C,SAAS;gBACZ,OAAOnD,IACJE,MAAM,CAAC,KACPP,IAAI,CAAC;oBAAEQ,OAAO;gBAAsC;YACzD;YAEA,MAAMa,OAAO,MAAM3D,UAAUgF,cAAc,CAAC,OAAOC;oBAenCE;gBAdd,MAAMD,MAAM7D,cAAcrB,WAAWQ,OAAOe,GAAG,CAACyB;gBAChD,MAAMmC,UAAU,MAAMF,YAAYhD,GAAG,CAACiD;gBACtC,IACE,CAACC,QAAQnD,MAAM,IACfmD,QAAQlD,GAAG,CAAC,gBACZ,CAAC1D,cAAc4G,QAAQlD,GAAG,CAAC,cAAsCrB,SACjE;oBACA,OAAO;gBACT;gBACAqE,YAAYG,MAAM,CAACF,KAAK;oBACtBV,eAAekB,SACXvG,WAAW6G,UAAU,CAACpF,UACtBzB,WAAW8G,WAAW,CAACrF;gBAC7B;gBACA,OAAOK,QAAOkE,eAAAA,QAAQlD,GAAG,CAAC,mBAAZkD,eAAuB;YACvC;YACA,IAAIxB,SAAS,MAAM;gBACjB,OAAOhB,IACJE,MAAM,CAAC,KACPP,IAAI,CAAC;oBAAEQ,OAAO;gBAAiD;YACpE;YACA,MAAMF,KAAK7D,eAAe,CACxB6B,QACA;gBAAEN,KAAK4C,OAAO5C,GAAG;gBAAEC,KAAK,GAAE2C,gBAAAA,OAAO3C,KAAK,YAAZ2C,gBAAgB;YAAK,GAC/CwC,SACI,0CACA,0CACJ;gBAAE9B,MAAM;gBAAYF,IAAIV;gBAAcW;YAAK;YAE7C,OAAOhB,IAAIE,MAAM,CAAC,KAAKP,IAAI,CAAC;gBAAEU;gBAAcpC;gBAAQ8E;YAAO;QAC7D,EAAE,OAAO5C,OAAO;YACd0C,QAAQ1C,KAAK,CAAC,kCAAkClC,QAAQoC,cAAcF;YACtE,OAAOH,IACJE,MAAM,CAAC,KACPP,IAAI,CAAC;gBAAEQ,OAAO;YAAqC;QACxD;IACF;AACF;AAEA,OAAO,MAAMoD,8BAA8B1D,oCAAmC;AAC9E,OAAO,MAAM2D,4BAA4BV,kCAAiC"}

package/src/lib/server-console.d.ts

@@ -22,6 +22,7 @@
  * does: the automation draft writer another plugin reaches through the core's
  * resource-drafts seam, which the AI jobs that write through it — inline at a
  * door and on the beat — find registered in the console process alone
- * (AGL-3026).
+ * (AGL-3026); and the doors that write the organization's automations
+ * (AGL-3302).
  */
 export declare function registerWorkflowsConsoleApi(): void;

package/src/lib/server-console.js

@@ -13,8 +13,10 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { registerWorkflowsServerDeclarations } from "./declarations.server.js";
+ */ import { registerPluginApiRoute } from "@aglyn/aglyn/server";
+import { registerWorkflowsServerDeclarations } from "./declarations.server.js";
 import { registerAutomationDraftWriter } from "./server-automation-drafts.js";
+import { ORG_AUTOMATION_API_ROUTES, orgAutomationPauseHandler, orgAutomationsManageHandler, orgAutomationsManageSubject } from "./server/org-automations-routes.js";
 /**
  * The workflows plugin's console server surface (AGL-2919).
  *
@@ -23,13 +25,21 @@ import { registerAutomationDraftWriter } from "./server-automation-drafts.js";
  * does: the automation draft writer another plugin reaches through the core's
  * resource-drafts seam, which the AI jobs that write through it — inline at a
  * door and on the beat — find registered in the console process alone
- * (AGL-3026).
+ * (AGL-3026); and the doors that write the organization's automations
+ * (AGL-3302).
  */ export function registerWorkflowsConsoleApi() {
     // The console raises host events too — a CRM stage moved, a deal won, a
     // task completed — so the engine's listener is registered here as well as
     // at boot (see `declarations.server.ts`).
     registerWorkflowsServerDeclarations();
     registerAutomationDraftWriter();
+    // The organization hub names its org and no site, so the route names that
+    // org as its subject for the release gate.
+    registerPluginApiRoute(ORG_AUTOMATION_API_ROUTES.manage, orgAutomationsManageHandler, {
+        subject: orgAutomationsManageSubject
+    });
+    // A site's own pause names the site, and is gated by that site's switch.
+    registerPluginApiRoute(ORG_AUTOMATION_API_ROUTES.pause, orgAutomationPauseHandler);
 }
 
 //# sourceMappingURL=server-console.js.map

package/src/lib/server-console.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerWorkflowsServerDeclarations } from './declarations.server'\nimport { registerAutomationDraftWriter } from './server-automation-drafts'\n\n/**\n * The workflows plugin's console server surface (AGL-2919).\n *\n * The tenant surface (`registerWorkflowsApi`) serves the inbound webhook a\n * visitor-facing integration calls. This one serves what only the console\n * does: the automation draft writer another plugin reaches through the core's\n * resource-drafts seam, which the AI jobs that write through it — inline at a\n * door and on the beat — find registered in the console process alone\n * (AGL-3026).\n */\nexport function registerWorkflowsConsoleApi(): void {\n  // The console raises host events too — a CRM stage moved, a deal won, a\n  // task completed — so the engine's listener is registered here as well as\n  // at boot (see `declarations.server.ts`).\n  registerWorkflowsServerDeclarations()\n  registerAutomationDraftWriter()\n}\n"],"names":["registerWorkflowsServerDeclarations","registerAutomationDraftWriter","registerWorkflowsConsoleApi"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,mCAAmC,QAAQ,2BAAuB;AAC3E,SAASC,6BAA6B,QAAQ,gCAA4B;AAE1E;;;;;;;;;CASC,GACD,OAAO,SAASC;IACd,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1CF;IACAC;AACF"}
+{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginApiRoute } from '@aglyn/aglyn/server'\nimport { registerWorkflowsServerDeclarations } from './declarations.server'\nimport { registerAutomationDraftWriter } from './server-automation-drafts'\nimport {\n  ORG_AUTOMATION_API_ROUTES,\n  orgAutomationPauseHandler,\n  orgAutomationsManageHandler,\n  orgAutomationsManageSubject,\n} from './server/org-automations-routes'\n\n/**\n * The workflows plugin's console server surface (AGL-2919).\n *\n * The tenant surface (`registerWorkflowsApi`) serves the inbound webhook a\n * visitor-facing integration calls. This one serves what only the console\n * does: the automation draft writer another plugin reaches through the core's\n * resource-drafts seam, which the AI jobs that write through it — inline at a\n * door and on the beat — find registered in the console process alone\n * (AGL-3026); and the doors that write the organization's automations\n * (AGL-3302).\n */\nexport function registerWorkflowsConsoleApi(): void {\n  // The console raises host events too — a CRM stage moved, a deal won, a\n  // task completed — so the engine's listener is registered here as well as\n  // at boot (see `declarations.server.ts`).\n  registerWorkflowsServerDeclarations()\n  registerAutomationDraftWriter()\n  // The organization hub names its org and no site, so the route names that\n  // org as its subject for the release gate.\n  registerPluginApiRoute(\n    ORG_AUTOMATION_API_ROUTES.manage,\n    orgAutomationsManageHandler,\n    { subject: orgAutomationsManageSubject },\n  )\n  // A site's own pause names the site, and is gated by that site's switch.\n  registerPluginApiRoute(ORG_AUTOMATION_API_ROUTES.pause, orgAutomationPauseHandler)\n}\n"],"names":["registerPluginApiRoute","registerWorkflowsServerDeclarations","registerAutomationDraftWriter","ORG_AUTOMATION_API_ROUTES","orgAutomationPauseHandler","orgAutomationsManageHandler","orgAutomationsManageSubject","registerWorkflowsConsoleApi","manage","subject","pause"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,mCAAmC,QAAQ,2BAAuB;AAC3E,SAASC,6BAA6B,QAAQ,gCAA4B;AAC1E,SACEC,yBAAyB,EACzBC,yBAAyB,EACzBC,2BAA2B,EAC3BC,2BAA2B,QACtB,qCAAiC;AAExC;;;;;;;;;;CAUC,GACD,OAAO,SAASC;IACd,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1CN;IACAC;IACA,0EAA0E;IAC1E,2CAA2C;IAC3CF,uBACEG,0BAA0BK,MAAM,EAChCH,6BACA;QAAEI,SAASH;IAA4B;IAEzC,yEAAyE;IACzEN,uBAAuBG,0BAA0BO,KAAK,EAAEN;AAC1D"}