@aglyn/plugins-workflows 1.0.0-beta.179 → 1.0.0-beta.181

package/src/lib/components/use-org-automation-step-pickers.js

@@ -0,0 +1,108 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { datasetPickerOptions } from "@aglyn/aglyn";
+import { scopeCovers } from "@aglyn/aglyn/app-utils/scope-tokens";
+import { useFirestore, useFirestoreCollection } from "@aglyn/tenant-feature-instance";
+/*
+ * The MODULE, not the barrel, for the two pure helpers — the cards' specs
+ * mock `@aglyn/tenant-feature-instance` wholesale, and a query builder
+ * imported through that barrel disappears under the mock.
+ */ import { ceilingedWindow, collectionCeiling } from "@aglyn/tenant-feature-instance/hooks/host-collection-queries";
+import { collection, documentId, limit, orderBy, query } from "firebase/firestore";
+import { useMemo } from "react";
+import { EDITOR_OPTION_CEILING } from "./use-automation-step-pickers.js";
+/**
+ * WHAT AN ORG AUTOMATION'S STEPS CAN BE POINTED AT (AGL-3302).
+ *
+ * The site editor's pickers read one site's records; an org automation runs
+ * on every site it is placed on, so its pickers read the ORGANIZATION's —
+ * the lists, the datasets and the campaign containers — and offer only what
+ * every one of those sites can use. A dataset or a campaign shared with some
+ * of the org's sites and not the others would resolve on one site and fail
+ * the step on the next, so a record is offered only when its own sharing
+ * covers the automation's placement (`scopeCovers`). A list belongs to the
+ * whole organization and is always offered.
+ *
+ * The site-only pickers — workflows, overlays, webhooks — are empty: no step
+ * an org automation may hold points at one.
+ *
+ * Read on the same latch and at the same ceiling as the site editor's, and
+ * paid only by an author who opens the editor.
+ */ export function useOrgAutomationStepPickers(orgId, editorOpened, placement) {
+    const firestore = useFirestore();
+    /*
+   * Unfiltered, ordered by id: the org hub admits only org-wide members, who
+   * read every dataset, and `documentId()` ordering is served by the
+   * automatic index where a field order would need a composite one.
+   */ const { data: datasetRead } = useFirestoreCollection(()=>editorOpened && orgId ? query(collection(firestore, 'orgs', orgId, 'datasets'), orderBy(documentId()), limit(EDITOR_OPTION_CEILING + 1)) : null, [
+        firestore,
+        orgId,
+        editorOpened
+    ], {
+        idField: '$id'
+    });
+    const { rows: datasetDocs, truncated: datasetsTruncated } = ceilingedWindow(datasetRead, EDITOR_OPTION_CEILING);
+    const { data: listRead } = useFirestoreCollection(()=>editorOpened && orgId ? collectionCeiling(collection(firestore, 'orgs', orgId, 'lists'), EDITOR_OPTION_CEILING) : null, [
+        firestore,
+        orgId,
+        editorOpened
+    ], {
+        idField: '$id'
+    });
+    const { rows: listDocs, truncated: listsTruncated } = ceilingedWindow(listRead, EDITOR_OPTION_CEILING);
+    const { data: campaignRead } = useFirestoreCollection(()=>editorOpened && orgId ? collectionCeiling(collection(firestore, 'orgs', orgId, 'emailCampaigns'), EDITOR_OPTION_CEILING) : null, [
+        firestore,
+        orgId,
+        editorOpened
+    ], {
+        idField: '$id'
+    });
+    const { rows: campaignDocs, truncated: campaignsTruncated } = ceilingedWindow(campaignRead, EDITOR_OPTION_CEILING);
+    const pickers = useMemo(()=>{
+        const covers = (row)=>scopeCovers(row == null ? void 0 : row.visibleTo, placement);
+        return {
+            workflowOptions: [],
+            overlayOptions: [],
+            webhookOptions: [],
+            datasetOptions: datasetPickerOptions((datasetDocs != null ? datasetDocs : []).filter(covers)),
+            listOptions: (listDocs != null ? listDocs : []).filter((list)=>!list.deletedAt && list.name).map((list)=>({
+                    id: list.$id,
+                    name: list.name
+                })).sort((a, b)=>a.name.localeCompare(b.name)),
+            campaignOptions: (campaignDocs != null ? campaignDocs : []).filter((campaign)=>!campaign.deletedAt && campaign.name).filter(covers).map((campaign)=>({
+                    id: campaign.$id,
+                    name: campaign.name
+                })).sort((a, b)=>a.name.localeCompare(b.name))
+        };
+    }, [
+        datasetDocs,
+        listDocs,
+        campaignDocs,
+        placement
+    ]);
+    const truncated = [
+        datasetsTruncated ? 'datasets' : null,
+        listsTruncated ? 'audiences' : null,
+        campaignsTruncated ? 'campaigns' : null
+    ].filter((name)=>name !== null);
+    return {
+        pickers,
+        truncated
+    };
+}
+
+//# sourceMappingURL=use-org-automation-step-pickers.js.map

package/src/lib/components/use-org-automation-step-pickers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/components/use-org-automation-step-pickers.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport { datasetPickerOptions } from '@aglyn/aglyn'\nimport { scopeCovers } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport {\n  useFirestore,\n  useFirestoreCollection,\n} from '@aglyn/tenant-feature-instance'\n/*\n * The MODULE, not the barrel, for the two pure helpers — the cards' specs\n * mock `@aglyn/tenant-feature-instance` wholesale, and a query builder\n * imported through that barrel disappears under the mock.\n */\nimport {\n  ceilingedWindow,\n  collectionCeiling,\n} from '@aglyn/tenant-feature-instance/hooks/host-collection-queries'\nimport {\n  collection,\n  documentId,\n  limit,\n  orderBy,\n  query,\n} from 'firebase/firestore'\nimport { useMemo } from 'react'\nimport type { AutomationStepPickers } from './automation-step-fields.component'\nimport {\n  type AutomationStepPickerData,\n  EDITOR_OPTION_CEILING,\n} from './use-automation-step-pickers'\n\n/**\n * WHAT AN ORG AUTOMATION'S STEPS CAN BE POINTED AT (AGL-3302).\n *\n * The site editor's pickers read one site's records; an org automation runs\n * on every site it is placed on, so its pickers read the ORGANIZATION's —\n * the lists, the datasets and the campaign containers — and offer only what\n * every one of those sites can use. A dataset or a campaign shared with some\n * of the org's sites and not the others would resolve on one site and fail\n * the step on the next, so a record is offered only when its own sharing\n * covers the automation's placement (`scopeCovers`). A list belongs to the\n * whole organization and is always offered.\n *\n * The site-only pickers — workflows, overlays, webhooks — are empty: no step\n * an org automation may hold points at one.\n *\n * Read on the same latch and at the same ceiling as the site editor's, and\n * paid only by an author who opens the editor.\n */\nexport function useOrgAutomationStepPickers(\n  orgId: string,\n  editorOpened: boolean,\n  placement: readonly string[],\n): AutomationStepPickerData {\n  const firestore = useFirestore()\n  /*\n   * Unfiltered, ordered by id: the org hub admits only org-wide members, who\n   * read every dataset, and `documentId()` ordering is served by the\n   * automatic index where a field order would need a composite one.\n   */\n  const { data: datasetRead } = useFirestoreCollection<any>(\n    () =>\n      editorOpened && orgId\n        ? query(\n            collection(firestore, 'orgs', orgId, 'datasets'),\n            orderBy(documentId()),\n            limit(EDITOR_OPTION_CEILING + 1),\n          )\n        : null,\n    [firestore, orgId, editorOpened],\n    { idField: '$id' },\n  )\n  const { rows: datasetDocs, truncated: datasetsTruncated } =\n    ceilingedWindow<any>(datasetRead, EDITOR_OPTION_CEILING)\n  const { data: listRead } = useFirestoreCollection<any>(\n    () =>\n      editorOpened && orgId\n        ? collectionCeiling(\n            collection(firestore, 'orgs', orgId, 'lists'),\n            EDITOR_OPTION_CEILING,\n          )\n        : null,\n    [firestore, orgId, editorOpened],\n    { idField: '$id' },\n  )\n  const { rows: listDocs, truncated: listsTruncated } = ceilingedWindow<any>(\n    listRead,\n    EDITOR_OPTION_CEILING,\n  )\n  const { data: campaignRead } = useFirestoreCollection<any>(\n    () =>\n      editorOpened && orgId\n        ? collectionCeiling(\n            collection(firestore, 'orgs', orgId, 'emailCampaigns'),\n            EDITOR_OPTION_CEILING,\n          )\n        : null,\n    [firestore, orgId, editorOpened],\n    { idField: '$id' },\n  )\n  const { rows: campaignDocs, truncated: campaignsTruncated } =\n    ceilingedWindow<any>(campaignRead, EDITOR_OPTION_CEILING)\n\n  const pickers = useMemo<AutomationStepPickers>(() => {\n    const covers = (row: any) =>\n      scopeCovers(row?.visibleTo as string[] | undefined, placement)\n    return {\n      workflowOptions: [],\n      overlayOptions: [],\n      webhookOptions: [],\n      datasetOptions: datasetPickerOptions((datasetDocs ?? []).filter(covers)),\n      listOptions: (listDocs ?? [])\n        .filter((list: any) => !list.deletedAt && list.name)\n        .map((list: any) => ({ id: list.$id as string, name: list.name as string }))\n        .sort((a, b) => a.name.localeCompare(b.name)),\n      campaignOptions: (campaignDocs ?? [])\n        .filter((campaign: any) => !campaign.deletedAt && campaign.name)\n        .filter(covers)\n        .map((campaign: any) => ({\n          id: campaign.$id as string,\n          name: campaign.name as string,\n        }))\n        .sort((a, b) => a.name.localeCompare(b.name)),\n    }\n  }, [datasetDocs, listDocs, campaignDocs, placement])\n\n  const truncated = [\n    datasetsTruncated ? 'datasets' : null,\n    listsTruncated ? 'audiences' : null,\n    campaignsTruncated ? 'campaigns' : null,\n  ].filter((name): name is string => name !== null)\n  return { pickers, truncated }\n}\n"],"names":["datasetPickerOptions","scopeCovers","useFirestore","useFirestoreCollection","ceilingedWindow","collectionCeiling","collection","documentId","limit","orderBy","query","useMemo","EDITOR_OPTION_CEILING","useOrgAutomationStepPickers","orgId","editorOpened","placement","firestore","data","datasetRead","idField","rows","datasetDocs","truncated","datasetsTruncated","listRead","listDocs","listsTruncated","campaignRead","campaignDocs","campaignsTruncated","pickers","covers","row","visibleTo","workflowOptions","overlayOptions","webhookOptions","datasetOptions","filter","listOptions","list","deletedAt","name","map","id","$id","sort","a","b","localeCompare","campaignOptions","campaign"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;AAEA,SAASA,oBAAoB,QAAQ,eAAc;AACnD,SAASC,WAAW,QAAQ,sCAAqC;AACjE,SACEC,YAAY,EACZC,sBAAsB,QACjB,iCAAgC;AACvC;;;;CAIC,GACD,SACEC,eAAe,EACfC,iBAAiB,QACZ,+DAA8D;AACrE,SACEC,UAAU,EACVC,UAAU,EACVC,KAAK,EACLC,OAAO,EACPC,KAAK,QACA,qBAAoB;AAC3B,SAASC,OAAO,QAAQ,QAAO;AAE/B,SAEEC,qBAAqB,QAChB,mCAA+B;AAEtC;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASC,4BACdC,KAAa,EACbC,YAAqB,EACrBC,SAA4B;IAE5B,MAAMC,YAAYf;IAClB;;;;GAIC,GACD,MAAM,EAAEgB,MAAMC,WAAW,EAAE,GAAGhB,uBAC5B,IACEY,gBAAgBD,QACZJ,MACEJ,WAAWW,WAAW,QAAQH,OAAO,aACrCL,QAAQF,eACRC,MAAMI,wBAAwB,MAEhC,MACN;QAACK;QAAWH;QAAOC;KAAa,EAChC;QAAEK,SAAS;IAAM;IAEnB,MAAM,EAAEC,MAAMC,WAAW,EAAEC,WAAWC,iBAAiB,EAAE,GACvDpB,gBAAqBe,aAAaP;IACpC,MAAM,EAAEM,MAAMO,QAAQ,EAAE,GAAGtB,uBACzB,IACEY,gBAAgBD,QACZT,kBACEC,WAAWW,WAAW,QAAQH,OAAO,UACrCF,yBAEF,MACN;QAACK;QAAWH;QAAOC;KAAa,EAChC;QAAEK,SAAS;IAAM;IAEnB,MAAM,EAAEC,MAAMK,QAAQ,EAAEH,WAAWI,cAAc,EAAE,GAAGvB,gBACpDqB,UACAb;IAEF,MAAM,EAAEM,MAAMU,YAAY,EAAE,GAAGzB,uBAC7B,IACEY,gBAAgBD,QACZT,kBACEC,WAAWW,WAAW,QAAQH,OAAO,mBACrCF,yBAEF,MACN;QAACK;QAAWH;QAAOC;KAAa,EAChC;QAAEK,SAAS;IAAM;IAEnB,MAAM,EAAEC,MAAMQ,YAAY,EAAEN,WAAWO,kBAAkB,EAAE,GACzD1B,gBAAqBwB,cAAchB;IAErC,MAAMmB,UAAUpB,QAA+B;QAC7C,MAAMqB,SAAS,CAACC,MACdhC,YAAYgC,uBAAAA,IAAKC,SAAS,EAA0BlB;QACtD,OAAO;YACLmB,iBAAiB,EAAE;YACnBC,gBAAgB,EAAE;YAClBC,gBAAgB,EAAE;YAClBC,gBAAgBtC,qBAAqB,CAACsB,sBAAAA,cAAe,EAAE,EAAEiB,MAAM,CAACP;YAChEQ,aAAa,CAACd,mBAAAA,WAAY,EAAE,EACzBa,MAAM,CAAC,CAACE,OAAc,CAACA,KAAKC,SAAS,IAAID,KAAKE,IAAI,EAClDC,GAAG,CAAC,CAACH,OAAe,CAAA;oBAAEI,IAAIJ,KAAKK,GAAG;oBAAYH,MAAMF,KAAKE,IAAI;gBAAW,CAAA,GACxEI,IAAI,CAAC,CAACC,GAAGC,IAAMD,EAAEL,IAAI,CAACO,aAAa,CAACD,EAAEN,IAAI;YAC7CQ,iBAAiB,CAACtB,uBAAAA,eAAgB,EAAE,EACjCU,MAAM,CAAC,CAACa,WAAkB,CAACA,SAASV,SAAS,IAAIU,SAAST,IAAI,EAC9DJ,MAAM,CAACP,QACPY,GAAG,CAAC,CAACQ,WAAmB,CAAA;oBACvBP,IAAIO,SAASN,GAAG;oBAChBH,MAAMS,SAAST,IAAI;gBACrB,CAAA,GACCI,IAAI,CAAC,CAACC,GAAGC,IAAMD,EAAEL,IAAI,CAACO,aAAa,CAACD,EAAEN,IAAI;QAC/C;IACF,GAAG;QAACrB;QAAaI;QAAUG;QAAcb;KAAU;IAEnD,MAAMO,YAAY;QAChBC,oBAAoB,aAAa;QACjCG,iBAAiB,cAAc;QAC/BG,qBAAqB,cAAc;KACpC,CAACS,MAAM,CAAC,CAACI,OAAyBA,SAAS;IAC5C,OAAO;QAAEZ;QAASR;IAAU;AAC9B"}

package/src/lib/components/use-org-automations-api.d.ts

@@ -0,0 +1,16 @@
+import { ORG_AUTOMATION_API_ROUTES } from '../model/org-automations';
+/**
+ * ONE AUTHORIZED POST TO AN ORG AUTOMATION DOOR (AGL-3302).
+ *
+ * Every write the org hub and the site panel make goes through a server
+ * route — the collection is closed to client writes — so each is the same
+ * request against one of the two doors. The route decides who may; this
+ * resolves with its answer, and throws the route's own words when it refuses,
+ * for the caller's snackbar.
+ *
+ * The user is read through a ref so the callback keeps one identity while the
+ * session object changes beneath it; the token is fetched at call time either
+ * way. The path is chosen from the two the plugin serves, never taken from a
+ * caller, so a component cannot point the console's credentials elsewhere.
+ */
+export declare function useOrgAutomationsApi(): (door: keyof typeof ORG_AUTOMATION_API_ROUTES, body: Record<string, unknown>) => Promise<Record<string, any>>;

package/src/lib/components/use-org-automations-api.js

@@ -0,0 +1,55 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { authorizedFetch } from "@aglyn/shared-util-http/authorized-token";
+import { useUser } from "@aglyn/tenant-feature-instance";
+import { useCallback, useRef } from "react";
+import { ORG_AUTOMATION_API_ROUTES } from "../model/org-automations.js";
+/**
+ * ONE AUTHORIZED POST TO AN ORG AUTOMATION DOOR (AGL-3302).
+ *
+ * Every write the org hub and the site panel make goes through a server
+ * route — the collection is closed to client writes — so each is the same
+ * request against one of the two doors. The route decides who may; this
+ * resolves with its answer, and throws the route's own words when it refuses,
+ * for the caller's snackbar.
+ *
+ * The user is read through a ref so the callback keeps one identity while the
+ * session object changes beneath it; the token is fetched at call time either
+ * way. The path is chosen from the two the plugin serves, never taken from a
+ * caller, so a component cannot point the console's credentials elsewhere.
+ */ export function useOrgAutomationsApi() {
+    const { data: user } = useUser();
+    const userRef = useRef(user);
+    userRef.current = user;
+    return useCallback(async (door, body)=>{
+        const response = await authorizedFetch(userRef.current, `/api/${ORG_AUTOMATION_API_ROUTES[door]}`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify(body)
+        });
+        const payload = await response.json().catch(()=>({}));
+        if (!response.ok) {
+            var _ref;
+            throw new Error(String((_ref = payload == null ? void 0 : payload['error']) != null ? _ref : 'The request could not be completed'));
+        }
+        return payload;
+    }, []);
+}
+
+//# sourceMappingURL=use-org-automations-api.js.map

package/src/lib/components/use-org-automations-api.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/components/use-org-automations-api.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport { authorizedFetch } from '@aglyn/shared-util-http/authorized-token'\nimport { useUser } from '@aglyn/tenant-feature-instance'\nimport { useCallback, useRef } from 'react'\nimport { ORG_AUTOMATION_API_ROUTES } from '../model/org-automations'\n\n/**\n * ONE AUTHORIZED POST TO AN ORG AUTOMATION DOOR (AGL-3302).\n *\n * Every write the org hub and the site panel make goes through a server\n * route — the collection is closed to client writes — so each is the same\n * request against one of the two doors. The route decides who may; this\n * resolves with its answer, and throws the route's own words when it refuses,\n * for the caller's snackbar.\n *\n * The user is read through a ref so the callback keeps one identity while the\n * session object changes beneath it; the token is fetched at call time either\n * way. The path is chosen from the two the plugin serves, never taken from a\n * caller, so a component cannot point the console's credentials elsewhere.\n */\nexport function useOrgAutomationsApi(): (\n  door: keyof typeof ORG_AUTOMATION_API_ROUTES,\n  body: Record<string, unknown>,\n) => Promise<Record<string, any>> {\n  const { data: user } = useUser()\n  const userRef = useRef(user)\n  userRef.current = user\n  return useCallback(async (door, body) => {\n    const response = await authorizedFetch(\n      userRef.current as never,\n      `/api/${ORG_AUTOMATION_API_ROUTES[door]}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      },\n    )\n    const payload = (await response.json().catch(() => ({}))) as Record<\n      string,\n      any\n    >\n    if (!response.ok) {\n      throw new Error(\n        String(payload?.['error'] ?? 'The request could not be completed'),\n      )\n    }\n    return payload\n  }, [])\n}\n"],"names":["authorizedFetch","useUser","useCallback","useRef","ORG_AUTOMATION_API_ROUTES","useOrgAutomationsApi","data","user","userRef","current","door","body","response","method","headers","JSON","stringify","payload","json","catch","ok","Error","String"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;AAEA,SAASA,eAAe,QAAQ,2CAA0C;AAC1E,SAASC,OAAO,QAAQ,iCAAgC;AACxD,SAASC,WAAW,EAAEC,MAAM,QAAQ,QAAO;AAC3C,SAASC,yBAAyB,QAAQ,8BAA0B;AAEpE;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASC;IAId,MAAM,EAAEC,MAAMC,IAAI,EAAE,GAAGN;IACvB,MAAMO,UAAUL,OAAOI;IACvBC,QAAQC,OAAO,GAAGF;IAClB,OAAOL,YAAY,OAAOQ,MAAMC;QAC9B,MAAMC,WAAW,MAAMZ,gBACrBQ,QAAQC,OAAO,EACf,CAAC,KAAK,EAAEL,yBAAyB,CAACM,KAAK,EAAE,EACzC;YACEG,QAAQ;YACRC,SAAS;gBAAE,gBAAgB;YAAmB;YAC9CH,MAAMI,KAAKC,SAAS,CAACL;QACvB;QAEF,MAAMM,UAAW,MAAML,SAASM,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;QAIrD,IAAI,CAACP,SAASQ,EAAE,EAAE;;YAChB,MAAM,IAAIC,MACRC,eAAOL,2BAAAA,OAAS,CAAC,QAAQ,mBAAI;QAEjC;QACA,OAAOA;IACT,GAAG,EAAE;AACP"}

package/src/lib/components/workflows-console-page.js

@@ -17,10 +17,15 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { HubSections } from "@aglyn/shared-ui-next";
 import { Stack } from "@mui/material";
+import { useMemo } from "react";
 import HostActionsCard from "./host-actions-card.component.js";
 import HostWebhooksCard from "./host-webhooks-card.component.js";
 import HostWorkflowsCard from "./host-workflows-card.component.js";
+import OrgAutomationsCard from "./org-automations-card.component.js";
+import OrgSiteAutomationList from "./org-site-automation-list.component.js";
 import RunQuotaLine from "./run-quota-line.component.js";
+import SiteOrgAutomationsPanel from "./site-org-automations-panel.component.js";
+import { workflowsOrgMount } from "./workflows-org-mount.js";
 /**
  * The body of one workflows section, built only when that section is the one
  * being read (AGL-2501).
@@ -63,6 +68,9 @@ import RunQuotaLine from "./run-quota-line.component.js";
                     /*#__PURE__*/ _jsx(HostActionsCard, {
                         hostId: hostId,
                         org: org
+                    }),
+                    /*#__PURE__*/ _jsx(SiteOrgAutomationsPanel, {
+                        hostId: hostId
                     })
                 ]
             });
@@ -75,6 +83,41 @@ import RunQuotaLine from "./run-quota-line.component.js";
             return null;
     }
 }
+/**
+ * The body of one ORGANIZATION-level section (AGL-3302): the org automations,
+ * and every site's own workflows, actions and webhooks listed with the site
+ * each belongs to.
+ *
+ * No run allowance line: the allowance is each site's, and an org
+ * automation's runs count on the site they run on — each site's own
+ * Automation reports its meter.
+ */ function orgSectionBody(section, mount, org, canEdit) {
+    switch(section){
+        case 'automations':
+            return /*#__PURE__*/ _jsx(OrgAutomationsCard, {
+                mount: mount,
+                org: org,
+                canEdit: canEdit
+            });
+        case 'workflows':
+        case 'actions':
+            return /*#__PURE__*/ _jsx(OrgSiteAutomationList, {
+                mount: mount,
+                kind: section,
+                canRead: true
+            });
+        case 'webhooks':
+            // A webhook holds its site's secret: the rules admit a site's admins
+            // and editors, which every org-wide member but a viewer is.
+            return /*#__PURE__*/ _jsx(OrgSiteAutomationList, {
+                mount: mount,
+                kind: "webhooks",
+                canRead: canEdit
+            });
+        default:
+            return null;
+    }
+}
 /**
  * Automation page (AGL-101/148/149 → AGL-395): the automation surface —
  * workflow builder, event-triggered actions, and webhooks — owned by the
@@ -94,13 +137,32 @@ import RunQuotaLine from "./run-quota-line.component.js";
  * site and an ACTION belongs to the site too; an interaction belongs to the
  * document that holds it and is edited on the element, not here.
  */ export function WorkflowsConsolePage(props) {
-    const { hostId, org, section, sections, basePath } = props;
+    const { hostId, orgMount, org, permissions, section, sections, basePath } = props;
+    /*
+   * Mounted with no site: the organization's hub (AGL-3302). Memoised so the
+   * cards below, which key their listeners on the mount's org, see one object.
+   */ const mount = useMemo(()=>hostId == null ? workflowsOrgMount(orgMount, basePath) : null, [
+        hostId,
+        orgMount,
+        basePath
+    ]);
     /*
    * Nothing until the URL names a section. The shell redirects a bare hub URL
    * to the landing section and holds a spinner while it does, so this state is
    * transient — and rendering a default section here instead would pay for its
    * listens on a URL that is already being replaced.
    */ if (!section || !(sections == null ? void 0 : sections.length) || !basePath) return null;
+    if (hostId == null) {
+        // No site and no org to stand in for it: nothing this page can scope.
+        if (!mount) return null;
+        return /*#__PURE__*/ _jsx(HubSections, {
+            sections: sections,
+            children: orgSectionBody(section, mount, org, // An org viewer's `editHosts` is false; every other org role's is
+            // true. The server routes decide — this keeps a viewer from being
+            // offered controls that are about to refuse them.
+            (permissions == null ? void 0 : permissions.editHosts) !== false)
+        });
+    }
     return /*#__PURE__*/ _jsx(HubSections, {
         sections: sections,
         children: sectionBody(section, hostId, org)

package/src/lib/components/workflows-console-page.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/components/workflows-console-page.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport type { AglynOrgBilling, ConsolePluginPageProps } from '@aglyn/aglyn'\nimport { HubSections } from '@aglyn/shared-ui-next'\nimport { Stack } from '@mui/material'\nimport type { ReactNode } from 'react'\nimport HostActionsCard from './host-actions-card.component'\nimport HostWebhooksCard from './host-webhooks-card.component'\nimport HostWorkflowsCard from './host-workflows-card.component'\nimport RunQuotaLine from './run-quota-line.component'\nimport type { WorkflowsConsoleSectionId } from './workflows-console-sections'\n\n/**\n * The body of one workflows section, built only when that section is the one\n * being read (AGL-2501).\n *\n * A function rather than a map of nodes on purpose: a `Record<id, ReactNode>`\n * would CONSTRUCT all three every render, and each card opens its Firestore\n * listens on mount — which is the entire cost this page exists to stop paying.\n * Only the returned branch is ever built.\n */\nfunction sectionBody(\n  section: WorkflowsConsoleSectionId,\n  hostId: string,\n  org: Partial<AglynOrgBilling> | undefined,\n): ReactNode {\n  switch (section) {\n    case 'workflows':\n      return (\n        /*\n         * `N runs this month · M included` (AGL-2171), which the run-history\n         * mockup puts opposite the heading. The quota silently stops\n         * automations running once it is reached, and the only place it was\n         * reported was the Billing page.\n         */\n        <Stack spacing={1}>\n          <RunQuotaLine hostId={hostId} org={org} counter=\"workflowRuns\" />\n          <HostWorkflowsCard hostId={hostId} org={org} />\n        </Stack>\n      )\n    case 'actions':\n      return (\n        <Stack spacing={1}>\n          {/* `actionRunsPerMonth` had NO customer-facing surface at all\n              before this — staff panel and usage-alerts only. */}\n          <RunQuotaLine hostId={hostId} org={org} counter=\"actionRuns\" />\n          <HostActionsCard hostId={hostId} org={org} />\n        </Stack>\n      )\n    case 'webhooks':\n      return <HostWebhooksCard hostId={hostId} org={org} />\n    default:\n      return null\n  }\n}\n\n/**\n * Automation page (AGL-101/148/149 → AGL-395): the automation surface —\n * workflow builder, event-triggered actions, and webhooks — owned by the\n * workflows plugin and rendered by the shell's generic plugin route. Each card\n * runs its own entitlement check (workflows / actions / webhooks are distinct\n * plan flags), so the shell's resolved `org` doc flows into all three.\n *\n * Sections are ROUTES (AGL-2501). `HubTabs lazy` already mounted one panel, so\n * this is not a read saving — `workflows-console-read-cost.spec.tsx` was\n * written BEFORE the conversion precisely to hold that line, and reports the\n * same counts after. What routing adds is that the URL names the section: it is\n * linkable, the back button walks sections, the breadcrumb says where you are,\n * and \"mount only what is open\" is structural rather than a `lazy` flag.\n *\n * The section ids are unchanged by the Automation rename: they are the\n * addresses people bookmark and the docs link to. A workflow belongs to the\n * site and an ACTION belongs to the site too; an interaction belongs to the\n * document that holds it and is edited on the element, not here.\n */\nexport function WorkflowsConsolePage(props: ConsolePluginPageProps) {\n  const { hostId, org, section, sections, basePath } = props\n\n  /*\n   * Nothing until the URL names a section. The shell redirects a bare hub URL\n   * to the landing section and holds a spinner while it does, so this state is\n   * transient — and rendering a default section here instead would pay for its\n   * listens on a URL that is already being replaced.\n   */\n  if (!section || !sections?.length || !basePath) return null\n\n  return (\n    <HubSections sections={sections}>\n      {sectionBody(section as WorkflowsConsoleSectionId, hostId, org)}\n    </HubSections>\n  )\n}\nWorkflowsConsolePage.displayName = 'WorkflowsConsolePage'\n\nexport default WorkflowsConsolePage\n"],"names":["HubSections","Stack","HostActionsCard","HostWebhooksCard","HostWorkflowsCard","RunQuotaLine","sectionBody","section","hostId","org","spacing","counter","WorkflowsConsolePage","props","sections","basePath","length","displayName"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;AAGA,SAASA,WAAW,QAAQ,wBAAuB;AACnD,SAASC,KAAK,QAAQ,gBAAe;AAErC,OAAOC,qBAAqB,mCAA+B;AAC3D,OAAOC,sBAAsB,oCAAgC;AAC7D,OAAOC,uBAAuB,qCAAiC;AAC/D,OAAOC,kBAAkB,gCAA4B;AAGrD;;;;;;;;CAQC,GACD,SAASC,YACPC,OAAkC,EAClCC,MAAc,EACdC,GAAyC;IAEzC,OAAQF;QACN,KAAK;YACH,OACE;;;;;SAKC,iBACD,MAACN;gBAAMS,SAAS;;kCACd,KAACL;wBAAaG,QAAQA;wBAAQC,KAAKA;wBAAKE,SAAQ;;kCAChD,KAACP;wBAAkBI,QAAQA;wBAAQC,KAAKA;;;;QAG9C,KAAK;YACH,qBACE,MAACR;gBAAMS,SAAS;;kCAGd,KAACL;wBAAaG,QAAQA;wBAAQC,KAAKA;wBAAKE,SAAQ;;kCAChD,KAACT;wBAAgBM,QAAQA;wBAAQC,KAAKA;;;;QAG5C,KAAK;YACH,qBAAO,KAACN;gBAAiBK,QAAQA;gBAAQC,KAAKA;;QAChD;YACE,OAAO;IACX;AACF;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASG,qBAAqBC,KAA6B;IAChE,MAAM,EAAEL,MAAM,EAAEC,GAAG,EAAEF,OAAO,EAAEO,QAAQ,EAAEC,QAAQ,EAAE,GAAGF;IAErD;;;;;GAKC,GACD,IAAI,CAACN,WAAW,EAACO,4BAAAA,SAAUE,MAAM,KAAI,CAACD,UAAU,OAAO;IAEvD,qBACE,KAACf;QAAYc,UAAUA;kBACpBR,YAAYC,SAAsCC,QAAQC;;AAGjE;AACAG,qBAAqBK,WAAW,GAAG;AAEnC,eAAeL,qBAAoB"}
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/components/workflows-console-page.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport type { AglynOrgBilling, ConsolePluginPageProps } from '@aglyn/aglyn'\nimport { HubSections } from '@aglyn/shared-ui-next'\nimport { Stack } from '@mui/material'\nimport { useMemo, type ReactNode } from 'react'\nimport HostActionsCard from './host-actions-card.component'\nimport HostWebhooksCard from './host-webhooks-card.component'\nimport HostWorkflowsCard from './host-workflows-card.component'\nimport OrgAutomationsCard from './org-automations-card.component'\nimport OrgSiteAutomationList from './org-site-automation-list.component'\nimport RunQuotaLine from './run-quota-line.component'\nimport SiteOrgAutomationsPanel from './site-org-automations-panel.component'\nimport type { WorkflowsConsoleSectionId } from './workflows-console-sections'\nimport {\n  workflowsOrgMount,\n  type WorkflowsOrgMount,\n} from './workflows-org-mount'\n\n/**\n * The body of one workflows section, built only when that section is the one\n * being read (AGL-2501).\n *\n * A function rather than a map of nodes on purpose: a `Record<id, ReactNode>`\n * would CONSTRUCT all three every render, and each card opens its Firestore\n * listens on mount — which is the entire cost this page exists to stop paying.\n * Only the returned branch is ever built.\n */\nfunction sectionBody(\n  section: WorkflowsConsoleSectionId,\n  hostId: string,\n  org: Partial<AglynOrgBilling> | undefined,\n): ReactNode {\n  switch (section) {\n    case 'workflows':\n      return (\n        /*\n         * `N runs this month · M included` (AGL-2171), which the run-history\n         * mockup puts opposite the heading. The quota silently stops\n         * automations running once it is reached, and the only place it was\n         * reported was the Billing page.\n         */\n        <Stack spacing={1}>\n          <RunQuotaLine hostId={hostId} org={org} counter=\"workflowRuns\" />\n          <HostWorkflowsCard hostId={hostId} org={org} />\n        </Stack>\n      )\n    case 'actions':\n      return (\n        <Stack spacing={1}>\n          {/* `actionRunsPerMonth` had NO customer-facing surface at all\n              before this — staff panel and usage-alerts only. */}\n          <RunQuotaLine hostId={hostId} org={org} counter=\"actionRuns\" />\n          <HostActionsCard hostId={hostId} org={org} />\n          {/* What the organization runs on this site beside the site's own\n              actions, and the site's pause for each (AGL-3302). */}\n          <SiteOrgAutomationsPanel hostId={hostId} />\n        </Stack>\n      )\n    case 'webhooks':\n      return <HostWebhooksCard hostId={hostId} org={org} />\n    default:\n      return null\n  }\n}\n\n/**\n * The body of one ORGANIZATION-level section (AGL-3302): the org automations,\n * and every site's own workflows, actions and webhooks listed with the site\n * each belongs to.\n *\n * No run allowance line: the allowance is each site's, and an org\n * automation's runs count on the site they run on — each site's own\n * Automation reports its meter.\n */\nfunction orgSectionBody(\n  section: WorkflowsConsoleSectionId,\n  mount: WorkflowsOrgMount,\n  org: Partial<AglynOrgBilling> | undefined,\n  canEdit: boolean,\n): ReactNode {\n  switch (section) {\n    case 'automations':\n      return <OrgAutomationsCard mount={mount} org={org} canEdit={canEdit} />\n    case 'workflows':\n    case 'actions':\n      return <OrgSiteAutomationList mount={mount} kind={section} canRead />\n    case 'webhooks':\n      // A webhook holds its site's secret: the rules admit a site's admins\n      // and editors, which every org-wide member but a viewer is.\n      return (\n        <OrgSiteAutomationList mount={mount} kind=\"webhooks\" canRead={canEdit} />\n      )\n    default:\n      return null\n  }\n}\n\n/**\n * Automation page (AGL-101/148/149 → AGL-395): the automation surface —\n * workflow builder, event-triggered actions, and webhooks — owned by the\n * workflows plugin and rendered by the shell's generic plugin route. Each card\n * runs its own entitlement check (workflows / actions / webhooks are distinct\n * plan flags), so the shell's resolved `org` doc flows into all three.\n *\n * Sections are ROUTES (AGL-2501). `HubTabs lazy` already mounted one panel, so\n * this is not a read saving — `workflows-console-read-cost.spec.tsx` was\n * written BEFORE the conversion precisely to hold that line, and reports the\n * same counts after. What routing adds is that the URL names the section: it is\n * linkable, the back button walks sections, the breadcrumb says where you are,\n * and \"mount only what is open\" is structural rather than a `lazy` flag.\n *\n * The section ids are unchanged by the Automation rename: they are the\n * addresses people bookmark and the docs link to. A workflow belongs to the\n * site and an ACTION belongs to the site too; an interaction belongs to the\n * document that holds it and is edited on the element, not here.\n */\nexport function WorkflowsConsolePage(props: ConsolePluginPageProps) {\n  const { hostId, orgMount, org, permissions, section, sections, basePath } =\n    props\n  /*\n   * Mounted with no site: the organization's hub (AGL-3302). Memoised so the\n   * cards below, which key their listeners on the mount's org, see one object.\n   */\n  const mount = useMemo(\n    () => (hostId == null ? workflowsOrgMount(orgMount, basePath) : null),\n    [hostId, orgMount, basePath],\n  )\n\n  /*\n   * Nothing until the URL names a section. The shell redirects a bare hub URL\n   * to the landing section and holds a spinner while it does, so this state is\n   * transient — and rendering a default section here instead would pay for its\n   * listens on a URL that is already being replaced.\n   */\n  if (!section || !sections?.length || !basePath) return null\n\n  if (hostId == null) {\n    // No site and no org to stand in for it: nothing this page can scope.\n    if (!mount) return null\n    return (\n      <HubSections sections={sections}>\n        {orgSectionBody(\n          section as WorkflowsConsoleSectionId,\n          mount,\n          org,\n          // An org viewer's `editHosts` is false; every other org role's is\n          // true. The server routes decide — this keeps a viewer from being\n          // offered controls that are about to refuse them.\n          permissions?.editHosts !== false,\n        )}\n      </HubSections>\n    )\n  }\n\n  return (\n    <HubSections sections={sections}>\n      {sectionBody(section as WorkflowsConsoleSectionId, hostId, org)}\n    </HubSections>\n  )\n}\nWorkflowsConsolePage.displayName = 'WorkflowsConsolePage'\n\nexport default WorkflowsConsolePage\n"],"names":["HubSections","Stack","useMemo","HostActionsCard","HostWebhooksCard","HostWorkflowsCard","OrgAutomationsCard","OrgSiteAutomationList","RunQuotaLine","SiteOrgAutomationsPanel","workflowsOrgMount","sectionBody","section","hostId","org","spacing","counter","orgSectionBody","mount","canEdit","kind","canRead","WorkflowsConsolePage","props","orgMount","permissions","sections","basePath","length","editHosts","displayName"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;AAGA,SAASA,WAAW,QAAQ,wBAAuB;AACnD,SAASC,KAAK,QAAQ,gBAAe;AACrC,SAASC,OAAO,QAAwB,QAAO;AAC/C,OAAOC,qBAAqB,mCAA+B;AAC3D,OAAOC,sBAAsB,oCAAgC;AAC7D,OAAOC,uBAAuB,qCAAiC;AAC/D,OAAOC,wBAAwB,sCAAkC;AACjE,OAAOC,2BAA2B,0CAAsC;AACxE,OAAOC,kBAAkB,gCAA4B;AACrD,OAAOC,6BAA6B,4CAAwC;AAE5E,SACEC,iBAAiB,QAEZ,2BAAuB;AAE9B;;;;;;;;CAQC,GACD,SAASC,YACPC,OAAkC,EAClCC,MAAc,EACdC,GAAyC;IAEzC,OAAQF;QACN,KAAK;YACH,OACE;;;;;SAKC,iBACD,MAACX;gBAAMc,SAAS;;kCACd,KAACP;wBAAaK,QAAQA;wBAAQC,KAAKA;wBAAKE,SAAQ;;kCAChD,KAACX;wBAAkBQ,QAAQA;wBAAQC,KAAKA;;;;QAG9C,KAAK;YACH,qBACE,MAACb;gBAAMc,SAAS;;kCAGd,KAACP;wBAAaK,QAAQA;wBAAQC,KAAKA;wBAAKE,SAAQ;;kCAChD,KAACb;wBAAgBU,QAAQA;wBAAQC,KAAKA;;kCAGtC,KAACL;wBAAwBI,QAAQA;;;;QAGvC,KAAK;YACH,qBAAO,KAACT;gBAAiBS,QAAQA;gBAAQC,KAAKA;;QAChD;YACE,OAAO;IACX;AACF;AAEA;;;;;;;;CAQC,GACD,SAASG,eACPL,OAAkC,EAClCM,KAAwB,EACxBJ,GAAyC,EACzCK,OAAgB;IAEhB,OAAQP;QACN,KAAK;YACH,qBAAO,KAACN;gBAAmBY,OAAOA;gBAAOJ,KAAKA;gBAAKK,SAASA;;QAC9D,KAAK;QACL,KAAK;YACH,qBAAO,KAACZ;gBAAsBW,OAAOA;gBAAOE,MAAMR;gBAASS,OAAO;;QACpE,KAAK;YACH,qEAAqE;YACrE,4DAA4D;YAC5D,qBACE,KAACd;gBAAsBW,OAAOA;gBAAOE,MAAK;gBAAWC,SAASF;;QAElE;YACE,OAAO;IACX;AACF;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASG,qBAAqBC,KAA6B;IAChE,MAAM,EAAEV,MAAM,EAAEW,QAAQ,EAAEV,GAAG,EAAEW,WAAW,EAAEb,OAAO,EAAEc,QAAQ,EAAEC,QAAQ,EAAE,GACvEJ;IACF;;;GAGC,GACD,MAAML,QAAQhB,QACZ,IAAOW,UAAU,OAAOH,kBAAkBc,UAAUG,YAAY,MAChE;QAACd;QAAQW;QAAUG;KAAS;IAG9B;;;;;GAKC,GACD,IAAI,CAACf,WAAW,EAACc,4BAAAA,SAAUE,MAAM,KAAI,CAACD,UAAU,OAAO;IAEvD,IAAId,UAAU,MAAM;QAClB,sEAAsE;QACtE,IAAI,CAACK,OAAO,OAAO;QACnB,qBACE,KAAClB;YAAY0B,UAAUA;sBACpBT,eACCL,SACAM,OACAJ,KACA,kEAAkE;YAClE,kEAAkE;YAClE,kDAAkD;YAClDW,CAAAA,+BAAAA,YAAaI,SAAS,MAAK;;IAInC;IAEA,qBACE,KAAC7B;QAAY0B,UAAUA;kBACpBf,YAAYC,SAAsCC,QAAQC;;AAGjE;AACAQ,qBAAqBQ,WAAW,GAAG;AAEnC,eAAeR,qBAAoB"}

package/src/lib/components/workflows-console-sections.d.ts

@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 import type { ConsoleNavSection } from '@aglyn/aglyn';
-export type WorkflowsConsoleSectionId = 'workflows' | 'actions' | 'webhooks';
+export type WorkflowsConsoleSectionId = 'workflows' | 'actions' | 'webhooks' | 'automations';
 /**
  * The workflows console's sections, in rail order (AGL-2501).
  *
@@ -32,3 +32,21 @@ export type WorkflowsConsoleSectionId = 'workflows' | 'actions' | 'webhooks';
  * plan flags, and a plan is not a release flag.
  */
 export declare const WORKFLOWS_CONSOLE_SECTIONS: readonly ConsoleNavSection[];
+/**
+ * The ORGANIZATION-level Automation hub's sections, at `/[orgSlug]/automation`
+ * (AGL-3302).
+ *
+ * Org automations come first because they are the one thing that lives here
+ * and nowhere else: the organization writes them once and places them on the
+ * sites it chooses. The other three are the sites' own workflows, actions and
+ * webhooks listed side by side with the site each belongs to — each row opens
+ * in that site's hub, where it is edited, because a workflow calls its site's
+ * functions and a webhook holds its site's secret.
+ *
+ * The ids are the site rail's for the three it shares, so a link built for
+ * one level reads the same at the other. `automations` takes the `actions`
+ * entitlement: an org automation is built from the actions builder's steps,
+ * so the plan that carries one carries the other, and the shell draws the
+ * section locked — with its upgrade notice — for a plan without it.
+ */
+export declare const WORKFLOWS_ORG_CONSOLE_SECTIONS: readonly ConsoleNavSection[];

package/src/lib/components/workflows-console-sections.js

@@ -40,11 +40,46 @@
         id: 'webhooks',
         label: 'Webhooks'
     }
-] /*
+];
+/*
  * Rail ORDER decides where `/workflows` lands: the shell redirects a bare hub
  * URL to the first section in this list the reader may open (AGL-2501). There
  * is deliberately no separate default constant — a second place to say which
  * section is first is a second place for it to disagree with the rail.
- */ ;
+ */ /**
+ * The ORGANIZATION-level Automation hub's sections, at `/[orgSlug]/automation`
+ * (AGL-3302).
+ *
+ * Org automations come first because they are the one thing that lives here
+ * and nowhere else: the organization writes them once and places them on the
+ * sites it chooses. The other three are the sites' own workflows, actions and
+ * webhooks listed side by side with the site each belongs to — each row opens
+ * in that site's hub, where it is edited, because a workflow calls its site's
+ * functions and a webhook holds its site's secret.
+ *
+ * The ids are the site rail's for the three it shares, so a link built for
+ * one level reads the same at the other. `automations` takes the `actions`
+ * entitlement: an org automation is built from the actions builder's steps,
+ * so the plan that carries one carries the other, and the shell draws the
+ * section locked — with its upgrade notice — for a plan without it.
+ */ export const WORKFLOWS_ORG_CONSOLE_SECTIONS = [
+    {
+        id: 'automations',
+        label: 'Org automations',
+        featureFlag: 'actions'
+    },
+    {
+        id: 'workflows',
+        label: 'Workflows'
+    },
+    {
+        id: 'actions',
+        label: 'Actions'
+    },
+    {
+        id: 'webhooks',
+        label: 'Webhooks'
+    }
+];
 
 //# sourceMappingURL=workflows-console-sections.js.map

package/src/lib/components/workflows-console-sections.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/components/workflows-console-sections.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { ConsoleNavSection } from '@aglyn/aglyn'\n\nexport type WorkflowsConsoleSectionId = 'workflows' | 'actions' | 'webhooks'\n\n/**\n * The workflows console's sections, in rail order (AGL-2501).\n *\n * One list, read twice and never copied: `plugin.ts` registers it on the nav\n * item so the shell can route and gate each section, and the page switches its\n * body on the id the shell resolves back.\n *\n * Ids are the `?tab=` ids this page already deep-linked by, kept deliberately\n * so a bookmark that named a tab names the same section as a route.\n *\n * No `navTabId` on any of them: they inherit the Workflows nav item's gate,\n * which is `nav-tab-workflows`. The per-card ENTITLEMENT checks are unchanged\n * and still live in the cards — workflows, actions and webhooks are distinct\n * plan flags, and a plan is not a release flag.\n */\nexport const WORKFLOWS_CONSOLE_SECTIONS: readonly ConsoleNavSection[] = [\n  { id: 'workflows', label: 'Workflows' },\n  { id: 'actions', label: 'Actions' },\n  { id: 'webhooks', label: 'Webhooks' },\n]\n\n/*\n * Rail ORDER decides where `/workflows` lands: the shell redirects a bare hub\n * URL to the first section in this list the reader may open (AGL-2501). There\n * is deliberately no separate default constant — a second place to say which\n * section is first is a second place for it to disagree with the rail.\n */\n"],"names":["WORKFLOWS_CONSOLE_SECTIONS","id","label"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAMD;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMA,6BAA2D;IACtE;QAAEC,IAAI;QAAaC,OAAO;IAAY;IACtC;QAAED,IAAI;QAAWC,OAAO;IAAU;IAClC;QAAED,IAAI;QAAYC,OAAO;IAAW;CACrC,CAED;;;;;CAKC,IAPA"}
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/components/workflows-console-sections.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { ConsoleNavSection } from '@aglyn/aglyn'\n\nexport type WorkflowsConsoleSectionId =\n  | 'workflows'\n  | 'actions'\n  | 'webhooks'\n  // The ORGANIZATION hub's own section (AGL-3302); no site rail carries it.\n  | 'automations'\n\n/**\n * The workflows console's sections, in rail order (AGL-2501).\n *\n * One list, read twice and never copied: `plugin.ts` registers it on the nav\n * item so the shell can route and gate each section, and the page switches its\n * body on the id the shell resolves back.\n *\n * Ids are the `?tab=` ids this page already deep-linked by, kept deliberately\n * so a bookmark that named a tab names the same section as a route.\n *\n * No `navTabId` on any of them: they inherit the Workflows nav item's gate,\n * which is `nav-tab-workflows`. The per-card ENTITLEMENT checks are unchanged\n * and still live in the cards — workflows, actions and webhooks are distinct\n * plan flags, and a plan is not a release flag.\n */\nexport const WORKFLOWS_CONSOLE_SECTIONS: readonly ConsoleNavSection[] = [\n  { id: 'workflows', label: 'Workflows' },\n  { id: 'actions', label: 'Actions' },\n  { id: 'webhooks', label: 'Webhooks' },\n]\n\n/*\n * Rail ORDER decides where `/workflows` lands: the shell redirects a bare hub\n * URL to the first section in this list the reader may open (AGL-2501). There\n * is deliberately no separate default constant — a second place to say which\n * section is first is a second place for it to disagree with the rail.\n */\n\n/**\n * The ORGANIZATION-level Automation hub's sections, at `/[orgSlug]/automation`\n * (AGL-3302).\n *\n * Org automations come first because they are the one thing that lives here\n * and nowhere else: the organization writes them once and places them on the\n * sites it chooses. The other three are the sites' own workflows, actions and\n * webhooks listed side by side with the site each belongs to — each row opens\n * in that site's hub, where it is edited, because a workflow calls its site's\n * functions and a webhook holds its site's secret.\n *\n * The ids are the site rail's for the three it shares, so a link built for\n * one level reads the same at the other. `automations` takes the `actions`\n * entitlement: an org automation is built from the actions builder's steps,\n * so the plan that carries one carries the other, and the shell draws the\n * section locked — with its upgrade notice — for a plan without it.\n */\nexport const WORKFLOWS_ORG_CONSOLE_SECTIONS: readonly ConsoleNavSection[] = [\n  { id: 'automations', label: 'Org automations', featureFlag: 'actions' },\n  { id: 'workflows', label: 'Workflows' },\n  { id: 'actions', label: 'Actions' },\n  { id: 'webhooks', label: 'Webhooks' },\n]\n"],"names":["WORKFLOWS_CONSOLE_SECTIONS","id","label","WORKFLOWS_ORG_CONSOLE_SECTIONS","featureFlag"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAWD;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMA,6BAA2D;IACtE;QAAEC,IAAI;QAAaC,OAAO;IAAY;IACtC;QAAED,IAAI;QAAWC,OAAO;IAAU;IAClC;QAAED,IAAI;QAAYC,OAAO;IAAW;CACrC,CAAA;AAED;;;;;CAKC,GAED;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMC,iCAA+D;IAC1E;QAAEF,IAAI;QAAeC,OAAO;QAAmBE,aAAa;IAAU;IACtE;QAAEH,IAAI;QAAaC,OAAO;IAAY;IACtC;QAAED,IAAI;QAAWC,OAAO;IAAU;IAClC;QAAED,IAAI;QAAYC,OAAO;IAAW;CACrC,CAAA"}

package/src/lib/components/workflows-org-mount.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { ConsolePluginOrgHost, ConsolePluginOrgMount } from '@aglyn/aglyn';
+/**
+ * The organization the Automation hub is mounted over at `/[orgSlug]/automation`
+ * (AGL-3302): the shell's org mount, with the hub's own path beside it.
+ *
+ * Handed to each org card as a prop rather than through a context — the org
+ * cards are the page's direct children, and a card that needs no site never
+ * has to wonder whether it is under one.
+ */
+export interface WorkflowsOrgMount {
+    orgId: string;
+    orgSlug: string;
+    /** The org's sites, as the shell resolved them. */
+    hosts: readonly ConsolePluginOrgHost[];
+    /** False until `hosts` has settled; an empty list before then means nothing. */
+    hostsReady: boolean;
+    /** `/[orgSlug]/hosts` — every site's own hub hangs beneath it. */
+    hostsPath: string;
+    /** The org Automation hub's own path, `/[orgSlug]/automation`. */
+    basePath: string;
+}
+/** The shell's org mount, as the Automation cards read it. */
+export declare function workflowsOrgMount(orgMount: ConsolePluginOrgMount | undefined, basePath: string | undefined): WorkflowsOrgMount | null;
+/** A site's display name from the mount, or its id when the mount lacks it. */
+export declare function orgSiteName(mount: Pick<WorkflowsOrgMount, 'hosts'>, hostId: string): string;
+/**
+ * One site's own Automation hub — `/[orgSlug]/hosts/{subdomain}/automation`,
+ * optionally at one of its sections — or `null` when the site is not in the
+ * mount or has no subdomain yet, which a row names and does not link.
+ */
+export declare function orgSiteAutomationPath(mount: Pick<WorkflowsOrgMount, 'hosts' | 'hostsPath'>, hostId: string, section?: string): string | null;
+/** The org's sites as picker options, by name. */
+export declare function orgSiteOptions(mount: Pick<WorkflowsOrgMount, 'hosts'>): Array<{
+    value: string;
+    label: string;
+}>;

package/src/lib/components/workflows-org-mount.js

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /** The shell's org mount, as the Automation cards read it. */ export function workflowsOrgMount(orgMount, basePath) {
+    if (!orgMount || !basePath) return null;
+    return {
+        orgId: orgMount.orgId,
+        orgSlug: orgMount.orgSlug,
+        hosts: orgMount.hosts,
+        hostsReady: orgMount.hostsReady,
+        hostsPath: orgMount.hostsPath,
+        basePath
+    };
+}
+/** A site's display name from the mount, or its id when the mount lacks it. */ export function orgSiteName(mount, hostId) {
+    var _mount_hosts_find;
+    return ((_mount_hosts_find = mount.hosts.find((host)=>host.id === hostId)) == null ? void 0 : _mount_hosts_find.name) || hostId;
+}
+/**
+ * One site's own Automation hub — `/[orgSlug]/hosts/{subdomain}/automation`,
+ * optionally at one of its sections — or `null` when the site is not in the
+ * mount or has no subdomain yet, which a row names and does not link.
+ */ export function orgSiteAutomationPath(mount, hostId, section) {
+    var _mount_hosts_find;
+    const subdomain = (_mount_hosts_find = mount.hosts.find((host)=>host.id === hostId)) == null ? void 0 : _mount_hosts_find.subdomain;
+    if (!subdomain) return null;
+    const hub = `${mount.hostsPath}/${encodeURIComponent(subdomain)}/automation`;
+    return section ? `${hub}/${section}` : hub;
+}
+/** The org's sites as picker options, by name. */ export function orgSiteOptions(mount) {
+    return mount.hosts.map((host)=>({
+            value: host.id,
+            label: host.name || host.subdomain || host.id
+        }));
+}
+
+//# sourceMappingURL=workflows-org-mount.js.map

package/src/lib/components/workflows-org-mount.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/components/workflows-org-mount.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { ConsolePluginOrgHost, ConsolePluginOrgMount } from '@aglyn/aglyn'\n\n/**\n * The organization the Automation hub is mounted over at `/[orgSlug]/automation`\n * (AGL-3302): the shell's org mount, with the hub's own path beside it.\n *\n * Handed to each org card as a prop rather than through a context — the org\n * cards are the page's direct children, and a card that needs no site never\n * has to wonder whether it is under one.\n */\nexport interface WorkflowsOrgMount {\n  orgId: string\n  orgSlug: string\n  /** The org's sites, as the shell resolved them. */\n  hosts: readonly ConsolePluginOrgHost[]\n  /** False until `hosts` has settled; an empty list before then means nothing. */\n  hostsReady: boolean\n  /** `/[orgSlug]/hosts` — every site's own hub hangs beneath it. */\n  hostsPath: string\n  /** The org Automation hub's own path, `/[orgSlug]/automation`. */\n  basePath: string\n}\n\n/** The shell's org mount, as the Automation cards read it. */\nexport function workflowsOrgMount(\n  orgMount: ConsolePluginOrgMount | undefined,\n  basePath: string | undefined,\n): WorkflowsOrgMount | null {\n  if (!orgMount || !basePath) return null\n  return {\n    orgId: orgMount.orgId,\n    orgSlug: orgMount.orgSlug,\n    hosts: orgMount.hosts,\n    hostsReady: orgMount.hostsReady,\n    hostsPath: orgMount.hostsPath,\n    basePath,\n  }\n}\n\n/** A site's display name from the mount, or its id when the mount lacks it. */\nexport function orgSiteName(\n  mount: Pick<WorkflowsOrgMount, 'hosts'>,\n  hostId: string,\n): string {\n  return mount.hosts.find((host) => host.id === hostId)?.name || hostId\n}\n\n/**\n * One site's own Automation hub — `/[orgSlug]/hosts/{subdomain}/automation`,\n * optionally at one of its sections — or `null` when the site is not in the\n * mount or has no subdomain yet, which a row names and does not link.\n */\nexport function orgSiteAutomationPath(\n  mount: Pick<WorkflowsOrgMount, 'hosts' | 'hostsPath'>,\n  hostId: string,\n  section?: string,\n): string | null {\n  const subdomain = mount.hosts.find((host) => host.id === hostId)?.subdomain\n  if (!subdomain) return null\n  const hub = `${mount.hostsPath}/${encodeURIComponent(subdomain)}/automation`\n  return section ? `${hub}/${section}` : hub\n}\n\n/** The org's sites as picker options, by name. */\nexport function orgSiteOptions(\n  mount: Pick<WorkflowsOrgMount, 'hosts'>,\n): Array<{ value: string; label: string }> {\n  return mount.hosts.map((host) => ({\n    value: host.id,\n    label: host.name || host.subdomain || host.id,\n  }))\n}\n"],"names":["workflowsOrgMount","orgMount","basePath","orgId","orgSlug","hosts","hostsReady","hostsPath","orgSiteName","mount","hostId","find","host","id","name","orgSiteAutomationPath","section","subdomain","hub","encodeURIComponent","orgSiteOptions","map","value","label"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAyBD,4DAA4D,GAC5D,OAAO,SAASA,kBACdC,QAA2C,EAC3CC,QAA4B;IAE5B,IAAI,CAACD,YAAY,CAACC,UAAU,OAAO;IACnC,OAAO;QACLC,OAAOF,SAASE,KAAK;QACrBC,SAASH,SAASG,OAAO;QACzBC,OAAOJ,SAASI,KAAK;QACrBC,YAAYL,SAASK,UAAU;QAC/BC,WAAWN,SAASM,SAAS;QAC7BL;IACF;AACF;AAEA,6EAA6E,GAC7E,OAAO,SAASM,YACdC,KAAuC,EACvCC,MAAc;QAEPD;IAAP,OAAOA,EAAAA,oBAAAA,MAAMJ,KAAK,CAACM,IAAI,CAAC,CAACC,OAASA,KAAKC,EAAE,KAAKH,4BAAvCD,kBAAgDK,IAAI,KAAIJ;AACjE;AAEA;;;;CAIC,GACD,OAAO,SAASK,sBACdN,KAAqD,EACrDC,MAAc,EACdM,OAAgB;QAEEP;IAAlB,MAAMQ,aAAYR,oBAAAA,MAAMJ,KAAK,CAACM,IAAI,CAAC,CAACC,OAASA,KAAKC,EAAE,KAAKH,4BAAvCD,kBAAgDQ,SAAS;IAC3E,IAAI,CAACA,WAAW,OAAO;IACvB,MAAMC,MAAM,GAAGT,MAAMF,SAAS,CAAC,CAAC,EAAEY,mBAAmBF,WAAW,WAAW,CAAC;IAC5E,OAAOD,UAAU,GAAGE,IAAI,CAAC,EAAEF,SAAS,GAAGE;AACzC;AAEA,gDAAgD,GAChD,OAAO,SAASE,eACdX,KAAuC;IAEvC,OAAOA,MAAMJ,KAAK,CAACgB,GAAG,CAAC,CAACT,OAAU,CAAA;YAChCU,OAAOV,KAAKC,EAAE;YACdU,OAAOX,KAAKE,IAAI,IAAIF,KAAKK,SAAS,IAAIL,KAAKC,EAAE;QAC/C,CAAA;AACF"}

package/src/lib/engine/flow-enrollments.d.ts

@@ -17,10 +17,17 @@
 import type { PluginJobHostGate } from '@aglyn/aglyn/server';
 import type { WorkflowStep } from './workflow-steps';
 /**
- * `hosts/{hostId}/flowEnrollments/{actionId__personKey}` for an action, and
- * `{workflow-<workflowId>__personKey}` for a workflow.
+ * `hosts/{hostId}/flowEnrollments/{actionId__personKey}` for an action,
+ * `{workflow-<workflowId>__personKey}` for a workflow, and
+ * `{org-<automationId>__personKey}` for an org automation waiting on the site
+ * it ran on.
  */
 export declare const FLOW_ENROLLMENTS_SUBCOLLECTION = "flowEnrollments";
+/**
+ * What is waiting, when it is not a site action: `workflow` for a workflow's
+ * run and `org` for an org automation's (AGL-3302).
+ */
+export type FlowEnrollmentAutomation = 'workflow' | 'org';
 /**
  * Documents one sweep may READ across every site.
  *
@@ -62,12 +69,19 @@ export type FlowEnrollmentEnding =
 export interface FlowEnrollment {
     hostId: string;
     /**
-     * What is waiting: `workflow` for a workflow's run, absent for an action's
-     * — which is every enrollment written before a workflow could wait, so an
-     * absent field is read as an action for as long as those rows exist.
+     * What is waiting: `workflow` for a workflow's run, `org` for an org
+     * automation's, absent for an action's — which is every enrollment written
+     * before a workflow could wait, so an absent field is read as an action for
+     * as long as those rows exist.
+     */
+    automation?: FlowEnrollmentAutomation;
+    /**
+     * The organization whose automation this is, on an `org` enrollment: the
+     * resume re-reads `orgs/{orgId}/automations/{actionId}`, and refuses to
+     * continue for a site that has since left the organization.
      */
-    automation?: 'workflow';
-    /** The automation's document id: the action's, or the workflow's. */
+    orgId?: string;
+    /** The automation's document id: the action's, the workflow's or the org automation's. */
     actionId: string;
     actionName: string;
     status: FlowEnrollmentStatus;
@@ -125,11 +139,13 @@ export interface FlowEnrollment {
  * enrollments would key on something narrower than the person (the cart, the
  * order), which is a change to this function and to nothing else.
  */
-export declare function flowEnrollmentId(actionId: string, key: string, automation?: 'workflow'): string;
+export declare function flowEnrollmentId(actionId: string, key: string, automation?: FlowEnrollmentAutomation): string;
 export interface EnrollInFlowOptions {
     hostId: string;
-    /** `workflow` for a workflow's run; absent for an action's. */
-    automation?: 'workflow';
+    /** `workflow` for a workflow's run, `org` for an org automation's; absent for an action's. */
+    automation?: FlowEnrollmentAutomation;
+    /** The owning organization, on an `org` enrollment. */
+    orgId?: string;
     /** The automation's document id. */
     actionId: string;
     action: {