@aglyn/plugins-workflows 1.0.0-beta.183 → 1.0.0-beta.184

package/src/lib/model/action-test-run.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE ACTIONS CARD'S TEST RUN (AGL-3309), as both ends of it spell it.
+ *
+ * Pure and client-safe: the card posts to the path, and the console route
+ * registers at it and builds the payload the action's steps see.
+ */
+/** The console door, under the plugin's `automations` API prefix. */
+export declare const ACTION_TEST_RUN_API_ROUTE = "automations/actions/test-run";
+/** The page a test run reports when the caller names none. */
+export declare const ACTION_TEST_RUN_PATH = "/console-test";
+/**
+ * The payload a test run's steps see.
+ *
+ * The caller's fields, bounded as the page runtime's dispatch bounds a
+ * visitor's — identifier names, twenty at most, each value cut to 500
+ * characters — over a sample `path`, and `test: 'true'` whatever the caller
+ * sent, so a filter, a condition or a step's template can tell a test from a
+ * visitor and nothing can pass one off as the other.
+ */
+export declare function actionTestRunPayload(raw: unknown): Record<string, string>;

package/src/lib/model/action-test-run.js

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * THE ACTIONS CARD'S TEST RUN (AGL-3309), as both ends of it spell it.
+ *
+ * Pure and client-safe: the card posts to the path, and the console route
+ * registers at it and builds the payload the action's steps see.
+ */ /** The console door, under the plugin's `automations` API prefix. */ export const ACTION_TEST_RUN_API_ROUTE = 'automations/actions/test-run';
+/** The page a test run reports when the caller names none. */ export const ACTION_TEST_RUN_PATH = '/console-test';
+/** A payload field name: an identifier, as the page runtime's dispatch takes one. */ const PAYLOAD_KEY = /^[a-zA-Z][a-zA-Z0-9_]{0,39}$/;
+/** How many of the caller's fields are read. */ const PAYLOAD_MAX_FIELDS = 20;
+/** How long one field's value may be. */ const PAYLOAD_MAX_VALUE_LENGTH = 500;
+/**
+ * The payload a test run's steps see.
+ *
+ * The caller's fields, bounded as the page runtime's dispatch bounds a
+ * visitor's — identifier names, twenty at most, each value cut to 500
+ * characters — over a sample `path`, and `test: 'true'` whatever the caller
+ * sent, so a filter, a condition or a step's template can tell a test from a
+ * visitor and nothing can pass one off as the other.
+ */ export function actionTestRunPayload(raw) {
+    const payload = {
+        path: ACTION_TEST_RUN_PATH
+    };
+    if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+        for (const [key, value] of Object.entries(raw).slice(0, PAYLOAD_MAX_FIELDS)){
+            if (PAYLOAD_KEY.test(key)) {
+                payload[key] = String(value).slice(0, PAYLOAD_MAX_VALUE_LENGTH);
+            }
+        }
+    }
+    payload['test'] = 'true';
+    return payload;
+}
+
+//# sourceMappingURL=action-test-run.js.map

package/src/lib/model/action-test-run.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/model/action-test-run.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE ACTIONS CARD'S TEST RUN (AGL-3309), as both ends of it spell it.\n *\n * Pure and client-safe: the card posts to the path, and the console route\n * registers at it and builds the payload the action's steps see.\n */\n\n/** The console door, under the plugin's `automations` API prefix. */\nexport const ACTION_TEST_RUN_API_ROUTE = 'automations/actions/test-run'\n\n/** The page a test run reports when the caller names none. */\nexport const ACTION_TEST_RUN_PATH = '/console-test'\n\n/** A payload field name: an identifier, as the page runtime's dispatch takes one. */\nconst PAYLOAD_KEY = /^[a-zA-Z][a-zA-Z0-9_]{0,39}$/\n\n/** How many of the caller's fields are read. */\nconst PAYLOAD_MAX_FIELDS = 20\n\n/** How long one field's value may be. */\nconst PAYLOAD_MAX_VALUE_LENGTH = 500\n\n/**\n * The payload a test run's steps see.\n *\n * The caller's fields, bounded as the page runtime's dispatch bounds a\n * visitor's — identifier names, twenty at most, each value cut to 500\n * characters — over a sample `path`, and `test: 'true'` whatever the caller\n * sent, so a filter, a condition or a step's template can tell a test from a\n * visitor and nothing can pass one off as the other.\n */\nexport function actionTestRunPayload(raw: unknown): Record<string, string> {\n  const payload: Record<string, string> = { path: ACTION_TEST_RUN_PATH }\n  if (raw && typeof raw === 'object' && !Array.isArray(raw)) {\n    for (const [key, value] of Object.entries(raw).slice(0, PAYLOAD_MAX_FIELDS)) {\n      if (PAYLOAD_KEY.test(key)) {\n        payload[key] = String(value).slice(0, PAYLOAD_MAX_VALUE_LENGTH)\n      }\n    }\n  }\n  payload['test'] = 'true'\n  return payload\n}\n"],"names":["ACTION_TEST_RUN_API_ROUTE","ACTION_TEST_RUN_PATH","PAYLOAD_KEY","PAYLOAD_MAX_FIELDS","PAYLOAD_MAX_VALUE_LENGTH","actionTestRunPayload","raw","payload","path","Array","isArray","key","value","Object","entries","slice","test","String"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;CAKC,GAED,mEAAmE,GACnE,OAAO,MAAMA,4BAA4B,+BAA8B;AAEvE,4DAA4D,GAC5D,OAAO,MAAMC,uBAAuB,gBAAe;AAEnD,mFAAmF,GACnF,MAAMC,cAAc;AAEpB,8CAA8C,GAC9C,MAAMC,qBAAqB;AAE3B,uCAAuC,GACvC,MAAMC,2BAA2B;AAEjC;;;;;;;;CAQC,GACD,OAAO,SAASC,qBAAqBC,GAAY;IAC/C,MAAMC,UAAkC;QAAEC,MAAMP;IAAqB;IACrE,IAAIK,OAAO,OAAOA,QAAQ,YAAY,CAACG,MAAMC,OAAO,CAACJ,MAAM;QACzD,KAAK,MAAM,CAACK,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACR,KAAKS,KAAK,CAAC,GAAGZ,oBAAqB;YAC3E,IAAID,YAAYc,IAAI,CAACL,MAAM;gBACzBJ,OAAO,CAACI,IAAI,GAAGM,OAAOL,OAAOG,KAAK,CAAC,GAAGX;YACxC;QACF;IACF;IACAG,OAAO,CAAC,OAAO,GAAG;IAClB,OAAOA;AACT"}

package/src/lib/server/action-test-run-route.d.ts

@@ -0,0 +1,91 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * TESTING ONE OF A SITE'S ACTIONS FROM THE CONSOLE (AGL-3309).
+ *
+ * The Actions card's Test button runs an action with an in-page trigger as
+ * though the trigger had fired on the site, and says what came back. A
+ * published page reaches the same engine path through `events/dispatch`,
+ * which is a TENANT route — served on the site's own origin, to anonymous
+ * visitors — and the console is another app on another origin whose
+ * dispatcher never loads it. This is the console's door to that path, and
+ * unlike the page's it knows who is asking.
+ *
+ * ## Who may
+ *
+ * A site admin or editor, read off the host's `memberRoles`, or staff. The
+ * publish roles rather than the content roles, because a test run is a LIVE
+ * run: its emails are sent, its webhooks posted and its rows written, as a
+ * visitor's would be. An author edits and makes nothing live, and so does not
+ * run automations either.
+ *
+ * The site's plugin switch is the dispatcher's: the request names its site as
+ * a top-level `hostId`, so a site with Automation switched off has no such
+ * door.
+ *
+ * ## What runs
+ *
+ * The stored action, through `runSingleActionOutcome` — the single-action path
+ * a page's dispatch takes — so the switch, the conditions, the plan gate and
+ * the month's run allowance are the ones a real run meets, the run is metered
+ * on the site's `actionRuns`, and it lands in the action's Runs history like
+ * any other. It is marked rather than simulated: see `actionTestRunPayload`.
+ * When a gate stops it, the refusal names the gate, because a test that ran
+ * nothing must not read as one that ran.
+ *
+ * Only an in-page trigger: a server event (a form submitted, an order placed)
+ * carries fields no sample stands in for, and its runs come from the doors
+ * that raise it.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+import type { HostEventPayload } from '@aglyn/tenant-runtime/host-event-listeners';
+import type { SingleActionOutcome } from '../engine/run-event-actions';
+export { ACTION_TEST_RUN_API_ROUTE } from '../model/action-test-run';
+/**
+ * Test runs one person may start on one site in a minute.
+ *
+ * Every test is a real run with real sends, so this is the feature's own
+ * bucket beneath the console dispatcher's general one: a person iterating on
+ * an action tests every few seconds at most, and past this is a script.
+ */
+export declare const ACTION_TEST_RUNS_PER_MINUTE = 10;
+/** What the door reaches outside this module; specs hand in their own. */
+export interface ActionTestRunDeps {
+    firestore(): FirebaseFirestore.Firestore;
+    verifyIdToken(token: string): Promise<{
+        uid: string;
+        staff?: unknown;
+    }>;
+    consumeRateLimit(key: string, options: {
+        limit: number;
+        windowMs: number;
+    }): Promise<{
+        allowed: boolean;
+        resetMs: number;
+    }>;
+    runAction(hostId: string, actionId: string, event: string, payload: HostEventPayload): Promise<SingleActionOutcome>;
+    now(): number;
+}
+/**
+ * `automations/actions/test-run`: run one of a site's actions now.
+ *
+ * Body `{ hostId, actionId, payload? }`. Answers `{ ok: true, alerts }` when
+ * the action's steps ran — the site alerts they produced, for the card to show
+ * — and otherwise an `error` saying what stopped it.
+ */
+export declare function createActionTestRunHandler(overrides?: Partial<ActionTestRunDeps>): PluginApiHandler;
+export declare const actionTestRunHandler: PluginApiHandler;

package/src/lib/server/action-test-run-route.js

@@ -0,0 +1,243 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * TESTING ONE OF A SITE'S ACTIONS FROM THE CONSOLE (AGL-3309).
+ *
+ * The Actions card's Test button runs an action with an in-page trigger as
+ * though the trigger had fired on the site, and says what came back. A
+ * published page reaches the same engine path through `events/dispatch`,
+ * which is a TENANT route — served on the site's own origin, to anonymous
+ * visitors — and the console is another app on another origin whose
+ * dispatcher never loads it. This is the console's door to that path, and
+ * unlike the page's it knows who is asking.
+ *
+ * ## Who may
+ *
+ * A site admin or editor, read off the host's `memberRoles`, or staff. The
+ * publish roles rather than the content roles, because a test run is a LIVE
+ * run: its emails are sent, its webhooks posted and its rows written, as a
+ * visitor's would be. An author edits and makes nothing live, and so does not
+ * run automations either.
+ *
+ * The site's plugin switch is the dispatcher's: the request names its site as
+ * a top-level `hostId`, so a site with Automation switched off has no such
+ * door.
+ *
+ * ## What runs
+ *
+ * The stored action, through `runSingleActionOutcome` — the single-action path
+ * a page's dispatch takes — so the switch, the conditions, the plan gate and
+ * the month's run allowance are the ones a real run meets, the run is metered
+ * on the site's `actionRuns`, and it lands in the action's Runs history like
+ * any other. It is marked rather than simulated: see `actionTestRunPayload`.
+ * When a gate stops it, the refusal names the gate, because a test that ran
+ * nothing must not read as one that ran.
+ *
+ * Only an in-page trigger: a server event (a form submitted, an order placed)
+ * carries fields no sample stands in for, and its runs come from the doors
+ * that raise it.
+ */ import { hostRoleCanPublish, isSiteEventType, planLabelGrantingFeature } from "@aglyn/aglyn/server";
+/*
+ * The MODULES, not the barrel, as for the org automation doors beside this
+ * one: `@aglyn/tenant-data-admin`'s index reaches the Next render cache.
+ */ import { isDocumentId } from "@aglyn/tenant-data-admin/server/document-id";
+import firebaseAdmin from "@aglyn/tenant-data-admin/server/firebase-admin";
+import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { consumeRateLimit } from "@aglyn/tenant-data-admin/server/rate-limit-store";
+import { actionTestRunPayload } from "../model/action-test-run.js";
+export { ACTION_TEST_RUN_API_ROUTE } from "../model/action-test-run.js";
+/**
+ * Test runs one person may start on one site in a minute.
+ *
+ * Every test is a real run with real sends, so this is the feature's own
+ * bucket beneath the console dispatcher's general one: a person iterating on
+ * an action tests every few seconds at most, and past this is a script.
+ */ export const ACTION_TEST_RUNS_PER_MINUTE = 10;
+const ACTION_TEST_RUN_WINDOW_MS = 60000;
+function defaultDeps() {
+    return {
+        firestore: ()=>firebaseAdmin.app().firestore(),
+        verifyIdToken: async (token)=>{
+            const decoded = await firebaseAdmin.app().auth().verifyIdToken(token);
+            return {
+                uid: decoded.uid,
+                staff: decoded['staff']
+            };
+        },
+        consumeRateLimit: (key, options)=>consumeRateLimit(key, options),
+        // Imported by the first test run rather than with the console surface,
+        // as the host-event listener imports it.
+        runAction: async (hostId, actionId, event, payload)=>{
+            const { runSingleActionOutcome } = await import("../engine/run-event-actions.js");
+            return await runSingleActionOutcome(hostId, actionId, event, payload);
+        },
+        now: ()=>Date.now()
+    };
+}
+/** The bearer token a request carries, or null. */ function bearerToken(headers) {
+    var _headers_authorization;
+    const authorization = String((_headers_authorization = headers['authorization']) != null ? _headers_authorization : '');
+    return authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) || null : null;
+}
+/** The status and words for each gate that can stop a test run. */ function refusalFor(skipped, outcome, payload) {
+    switch(skipped){
+        case 'missing':
+            return {
+                status: 404,
+                error: 'That action no longer exists'
+            };
+        case 'disabled':
+            return {
+                status: 409,
+                error: 'Switch the action on to test it'
+            };
+        case 'event':
+            return {
+                status: 409,
+                error: 'The action changed while it was being tested — try again'
+            };
+        case 'conditions':
+            return {
+                status: 422,
+                error: `Nothing ran: a test run on ${String(payload['path'])} does not ` + 'meet this action’s conditions'
+            };
+        case 'plan':
+            var _planLabelGrantingFeature;
+            return {
+                status: 403,
+                error: `Actions need the ${(_planLabelGrantingFeature = planLabelGrantingFeature('actions')) != null ? _planLabelGrantingFeature : 'Pro'} ` + 'plan — see Billing to upgrade'
+            };
+        case 'allowance':
+            return {
+                status: 402,
+                error: `This site has used its ${outcome.limit} action runs for the month`
+            };
+        default:
+            return {
+                status: 500,
+                error: 'The test run could not be completed. Try again.'
+            };
+    }
+}
+/**
+ * `automations/actions/test-run`: run one of a site's actions now.
+ *
+ * Body `{ hostId, actionId, payload? }`. Answers `{ ok: true, alerts }` when
+ * the action's steps ran — the site alerts they produced, for the card to show
+ * — and otherwise an `error` saying what stopped it.
+ */ export function createActionTestRunHandler(overrides = {}) {
+    return async (req, res)=>{
+        var _ref, _ref1;
+        var _req_body, _req_body1;
+        const deps = _extends({}, defaultDeps(), overrides);
+        if (req.method !== 'POST') {
+            return res.status(405).json({
+                error: 'Method not allowed'
+            });
+        }
+        const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+        const actionId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.actionId) != null ? _ref1 : '');
+        if (!isDocumentId(hostId)) {
+            return res.status(400).json({
+                error: 'Invalid hostId'
+            });
+        }
+        if (!isDocumentId(actionId)) {
+            return res.status(400).json({
+                error: 'Invalid actionId'
+            });
+        }
+        const token = bearerToken(req.headers);
+        if (!token) return res.status(401).json({
+            error: 'Unauthenticated'
+        });
+        let caller;
+        try {
+            caller = await deps.verifyIdToken(token);
+        } catch (error) {
+            // A refused credential is the caller's 401; a failure to check one is
+            // ours and keeps a 5xx (AGL-2852).
+            if (isRefusedIdToken(error)) {
+                return res.status(401).json({
+                    error: 'Unauthenticated'
+                });
+            }
+            console.error('[workflows] test run could not verify the caller', error);
+            return res.status(500).json({
+                error: 'The sign-in could not be checked. Try again.'
+            });
+        }
+        try {
+            var _host_get, _ref2, _outcome_skipped;
+            var _stored_data_trigger, _stored_data, _req_body2;
+            const firestore = deps.firestore();
+            const hostRef = firestore.collection('hosts').doc(hostId);
+            const host = await hostRef.get();
+            if (!host.exists) return res.status(404).json({
+                error: 'Unknown site'
+            });
+            const role = ((_host_get = host.get('memberRoles')) != null ? _host_get : {})[caller.uid];
+            if (caller.staff !== true && !hostRoleCanPublish(role)) {
+                return res.status(403).json({
+                    error: 'Only a site admin or editor can test an action'
+                });
+            }
+            const rate = await deps.consumeRateLimit(`workflows-test-run:${hostId}:${caller.uid}`, {
+                limit: ACTION_TEST_RUNS_PER_MINUTE,
+                windowMs: ACTION_TEST_RUN_WINDOW_MS
+            });
+            if (!rate.allowed) {
+                res.setHeader('Retry-After', String(Math.max(1, Math.ceil((rate.resetMs - deps.now()) / 1000))));
+                return res.status(429).json({
+                    error: 'Too many test runs — wait a minute and try again'
+                });
+            }
+            const stored = await hostRef.collection('actions').doc(actionId).get();
+            if (!stored.exists || stored.get('deletedAt')) {
+                return res.status(404).json({
+                    error: 'That action no longer exists'
+                });
+            }
+            const event = String((_ref2 = (_stored_data = stored.data()) == null ? void 0 : (_stored_data_trigger = _stored_data.trigger) == null ? void 0 : _stored_data_trigger.event) != null ? _ref2 : '');
+            if (!isSiteEventType(event)) {
+                return res.status(400).json({
+                    error: 'Only an action with an in-page trigger can be tested here'
+                });
+            }
+            const payload = actionTestRunPayload((_req_body2 = req.body) == null ? void 0 : _req_body2.payload);
+            const outcome = await deps.runAction(hostId, actionId, event, payload);
+            if (outcome.ran) {
+                return res.status(200).json({
+                    ok: true,
+                    alerts: outcome.alerts
+                });
+            }
+            const refusal = refusalFor((_outcome_skipped = outcome.skipped) != null ? _outcome_skipped : 'failed', outcome, payload);
+            return res.status(refusal.status).json({
+                error: refusal.error
+            });
+        } catch (error) {
+            console.error('[workflows] test run failed', hostId, actionId, error);
+            return res.status(500).json({
+                error: 'The test run could not be completed. Try again.'
+            });
+        }
+    };
+}
+export const actionTestRunHandler = createActionTestRunHandler();
+
+//# sourceMappingURL=action-test-run-route.js.map

package/src/lib/server/action-test-run-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/server/action-test-run-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * TESTING ONE OF A SITE'S ACTIONS FROM THE CONSOLE (AGL-3309).\n *\n * The Actions card's Test button runs an action with an in-page trigger as\n * though the trigger had fired on the site, and says what came back. A\n * published page reaches the same engine path through `events/dispatch`,\n * which is a TENANT route — served on the site's own origin, to anonymous\n * visitors — and the console is another app on another origin whose\n * dispatcher never loads it. This is the console's door to that path, and\n * unlike the page's it knows who is asking.\n *\n * ## Who may\n *\n * A site admin or editor, read off the host's `memberRoles`, or staff. The\n * publish roles rather than the content roles, because a test run is a LIVE\n * run: its emails are sent, its webhooks posted and its rows written, as a\n * visitor's would be. An author edits and makes nothing live, and so does not\n * run automations either.\n *\n * The site's plugin switch is the dispatcher's: the request names its site as\n * a top-level `hostId`, so a site with Automation switched off has no such\n * door.\n *\n * ## What runs\n *\n * The stored action, through `runSingleActionOutcome` — the single-action path\n * a page's dispatch takes — so the switch, the conditions, the plan gate and\n * the month's run allowance are the ones a real run meets, the run is metered\n * on the site's `actionRuns`, and it lands in the action's Runs history like\n * any other. It is marked rather than simulated: see `actionTestRunPayload`.\n * When a gate stops it, the refusal names the gate, because a test that ran\n * nothing must not read as one that ran.\n *\n * Only an in-page trigger: a server event (a form submitted, an order placed)\n * carries fields no sample stands in for, and its runs come from the doors\n * that raise it.\n */\n\nimport {\n  type HostAction,\n  hostRoleCanPublish,\n  isSiteEventType,\n  type PluginApiHandler,\n  planLabelGrantingFeature,\n} from '@aglyn/aglyn/server'\n/*\n * The MODULES, not the barrel, as for the org automation doors beside this\n * one: `@aglyn/tenant-data-admin`'s index reaches the Next render cache.\n */\nimport { isDocumentId } from '@aglyn/tenant-data-admin/server/document-id'\nimport firebaseAdmin from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { consumeRateLimit } from '@aglyn/tenant-data-admin/server/rate-limit-store'\nimport type { HostEventPayload } from '@aglyn/tenant-runtime/host-event-listeners'\nimport type {\n  SingleActionOutcome,\n  SingleActionSkip,\n} from '../engine/run-event-actions'\nimport { actionTestRunPayload } from '../model/action-test-run'\n\nexport { ACTION_TEST_RUN_API_ROUTE } from '../model/action-test-run'\n\n/**\n * Test runs one person may start on one site in a minute.\n *\n * Every test is a real run with real sends, so this is the feature's own\n * bucket beneath the console dispatcher's general one: a person iterating on\n * an action tests every few seconds at most, and past this is a script.\n */\nexport const ACTION_TEST_RUNS_PER_MINUTE = 10\n\nconst ACTION_TEST_RUN_WINDOW_MS = 60_000\n\n/** What the door reaches outside this module; specs hand in their own. */\nexport interface ActionTestRunDeps {\n  firestore(): FirebaseFirestore.Firestore\n  verifyIdToken(token: string): Promise<{ uid: string; staff?: unknown }>\n  consumeRateLimit(\n    key: string,\n    options: { limit: number; windowMs: number },\n  ): Promise<{ allowed: boolean; resetMs: number }>\n  runAction(\n    hostId: string,\n    actionId: string,\n    event: string,\n    payload: HostEventPayload,\n  ): Promise<SingleActionOutcome>\n  now(): number\n}\n\nfunction defaultDeps(): ActionTestRunDeps {\n  return {\n    firestore: () =>\n      firebaseAdmin.app().firestore() as unknown as FirebaseFirestore.Firestore,\n    verifyIdToken: async (token) => {\n      const decoded = await firebaseAdmin.app().auth().verifyIdToken(token)\n      return { uid: decoded.uid, staff: decoded['staff'] }\n    },\n    consumeRateLimit: (key, options) => consumeRateLimit(key, options),\n    // Imported by the first test run rather than with the console surface,\n    // as the host-event listener imports it.\n    runAction: async (hostId, actionId, event, payload) => {\n      const { runSingleActionOutcome } = await import('../engine/run-event-actions')\n      return await runSingleActionOutcome(hostId, actionId, event, payload)\n    },\n    now: () => Date.now(),\n  }\n}\n\n/** The bearer token a request carries, or null. */\nfunction bearerToken(headers: Partial<Record<string, string | string[]>>): string | null {\n  const authorization = String(headers['authorization'] ?? '')\n  return authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length) || null\n    : null\n}\n\n/** The status and words for each gate that can stop a test run. */\nfunction refusalFor(\n  skipped: SingleActionSkip,\n  outcome: SingleActionOutcome,\n  payload: HostEventPayload,\n): { status: number; error: string } {\n  switch (skipped) {\n    case 'missing':\n      return { status: 404, error: 'That action no longer exists' }\n    case 'disabled':\n      return { status: 409, error: 'Switch the action on to test it' }\n    case 'event':\n      return {\n        status: 409,\n        error: 'The action changed while it was being tested — try again',\n      }\n    case 'conditions':\n      return {\n        status: 422,\n        error:\n          `Nothing ran: a test run on ${String(payload['path'])} does not ` +\n          'meet this action’s conditions',\n      }\n    case 'plan':\n      return {\n        status: 403,\n        error:\n          `Actions need the ${planLabelGrantingFeature('actions') ?? 'Pro'} ` +\n          'plan — see Billing to upgrade',\n      }\n    case 'allowance':\n      return {\n        status: 402,\n        error: `This site has used its ${outcome.limit} action runs for the month`,\n      }\n    default:\n      return { status: 500, error: 'The test run could not be completed. Try again.' }\n  }\n}\n\n/**\n * `automations/actions/test-run`: run one of a site's actions now.\n *\n * Body `{ hostId, actionId, payload? }`. Answers `{ ok: true, alerts }` when\n * the action's steps ran — the site alerts they produced, for the card to show\n * — and otherwise an `error` saying what stopped it.\n */\nexport function createActionTestRunHandler(\n  overrides: Partial<ActionTestRunDeps> = {},\n): PluginApiHandler {\n  return async (req, res) => {\n    const deps = { ...defaultDeps(), ...overrides }\n    if (req.method !== 'POST') {\n      return res.status(405).json({ error: 'Method not allowed' })\n    }\n    const hostId = String(req.body?.hostId ?? '')\n    const actionId = String(req.body?.actionId ?? '')\n    if (!isDocumentId(hostId)) {\n      return res.status(400).json({ error: 'Invalid hostId' })\n    }\n    if (!isDocumentId(actionId)) {\n      return res.status(400).json({ error: 'Invalid actionId' })\n    }\n    const token = bearerToken(req.headers)\n    if (!token) return res.status(401).json({ error: 'Unauthenticated' })\n\n    let caller: { uid: string; staff?: unknown }\n    try {\n      caller = await deps.verifyIdToken(token)\n    } catch (error) {\n      // A refused credential is the caller's 401; a failure to check one is\n      // ours and keeps a 5xx (AGL-2852).\n      if (isRefusedIdToken(error)) {\n        return res.status(401).json({ error: 'Unauthenticated' })\n      }\n      console.error('[workflows] test run could not verify the caller', error)\n      return res\n        .status(500)\n        .json({ error: 'The sign-in could not be checked. Try again.' })\n    }\n\n    try {\n      const firestore = deps.firestore()\n      const hostRef = firestore.collection('hosts').doc(hostId)\n      const host = await hostRef.get()\n      if (!host.exists) return res.status(404).json({ error: 'Unknown site' })\n      const role = (host.get('memberRoles') ?? {})[caller.uid]\n      if (caller.staff !== true && !hostRoleCanPublish(role)) {\n        return res\n          .status(403)\n          .json({ error: 'Only a site admin or editor can test an action' })\n      }\n\n      const rate = await deps.consumeRateLimit(\n        `workflows-test-run:${hostId}:${caller.uid}`,\n        { limit: ACTION_TEST_RUNS_PER_MINUTE, windowMs: ACTION_TEST_RUN_WINDOW_MS },\n      )\n      if (!rate.allowed) {\n        res.setHeader(\n          'Retry-After',\n          String(Math.max(1, Math.ceil((rate.resetMs - deps.now()) / 1000))),\n        )\n        return res\n          .status(429)\n          .json({ error: 'Too many test runs — wait a minute and try again' })\n      }\n\n      const stored = await hostRef.collection('actions').doc(actionId).get()\n      if (!stored.exists || stored.get('deletedAt')) {\n        return res.status(404).json({ error: 'That action no longer exists' })\n      }\n      const event = String(\n        (stored.data() as HostAction | undefined)?.trigger?.event ?? '',\n      )\n      if (!isSiteEventType(event)) {\n        return res.status(400).json({\n          error: 'Only an action with an in-page trigger can be tested here',\n        })\n      }\n\n      const payload = actionTestRunPayload(req.body?.payload)\n      const outcome = await deps.runAction(hostId, actionId, event, payload)\n      if (outcome.ran) {\n        return res.status(200).json({ ok: true, alerts: outcome.alerts })\n      }\n      const refusal = refusalFor(outcome.skipped ?? 'failed', outcome, payload)\n      return res.status(refusal.status).json({ error: refusal.error })\n    } catch (error) {\n      console.error('[workflows] test run failed', hostId, actionId, error)\n      return res\n        .status(500)\n        .json({ error: 'The test run could not be completed. Try again.' })\n    }\n  }\n}\n\nexport const actionTestRunHandler = createActionTestRunHandler()\n"],"names":["hostRoleCanPublish","isSiteEventType","planLabelGrantingFeature","isDocumentId","firebaseAdmin","isRefusedIdToken","consumeRateLimit","actionTestRunPayload","ACTION_TEST_RUN_API_ROUTE","ACTION_TEST_RUNS_PER_MINUTE","ACTION_TEST_RUN_WINDOW_MS","defaultDeps","firestore","app","verifyIdToken","token","decoded","auth","uid","staff","key","options","runAction","hostId","actionId","event","payload","runSingleActionOutcome","now","Date","bearerToken","headers","authorization","String","startsWith","slice","length","refusalFor","skipped","outcome","status","error","limit","createActionTestRunHandler","overrides","req","res","deps","method","json","body","caller","console","host","stored","hostRef","collection","doc","get","exists","role","rate","windowMs","allowed","setHeader","Math","max","ceil","resetMs","data","trigger","ran","ok","alerts","refusal","actionTestRunHandler"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCC,GAED,SAEEA,kBAAkB,EAClBC,eAAe,EAEfC,wBAAwB,QACnB,sBAAqB;AAC5B;;;CAGC,GACD,SAASC,YAAY,QAAQ,8CAA6C;AAC1E,OAAOC,mBAAmB,iDAAgD;AAC1E,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,gBAAgB,QAAQ,mDAAkD;AAMnF,SAASC,oBAAoB,QAAQ,8BAA0B;AAE/D,SAASC,yBAAyB,QAAQ,8BAA0B;AAEpE;;;;;;CAMC,GACD,OAAO,MAAMC,8BAA8B,GAAE;AAE7C,MAAMC,4BAA4B;AAmBlC,SAASC;IACP,OAAO;QACLC,WAAW,IACTR,cAAcS,GAAG,GAAGD,SAAS;QAC/BE,eAAe,OAAOC;YACpB,MAAMC,UAAU,MAAMZ,cAAcS,GAAG,GAAGI,IAAI,GAAGH,aAAa,CAACC;YAC/D,OAAO;gBAAEG,KAAKF,QAAQE,GAAG;gBAAEC,OAAOH,OAAO,CAAC,QAAQ;YAAC;QACrD;QACAV,kBAAkB,CAACc,KAAKC,UAAYf,iBAAiBc,KAAKC;QAC1D,uEAAuE;QACvE,yCAAyC;QACzCC,WAAW,OAAOC,QAAQC,UAAUC,OAAOC;YACzC,MAAM,EAAEC,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC;YAChD,OAAO,MAAMA,uBAAuBJ,QAAQC,UAAUC,OAAOC;QAC/D;QACAE,KAAK,IAAMC,KAAKD,GAAG;IACrB;AACF;AAEA,iDAAiD,GACjD,SAASE,YAAYC,OAAmD;QACzCA;IAA7B,MAAMC,gBAAgBC,QAAOF,yBAAAA,OAAO,CAAC,gBAAgB,YAAxBA,yBAA4B;IACzD,OAAOC,cAAcE,UAAU,CAAC,aAC5BF,cAAcG,KAAK,CAAC,UAAUC,MAAM,KAAK,OACzC;AACN;AAEA,iEAAiE,GACjE,SAASC,WACPC,OAAyB,EACzBC,OAA4B,EAC5Bb,OAAyB;IAEzB,OAAQY;QACN,KAAK;YACH,OAAO;gBAAEE,QAAQ;gBAAKC,OAAO;YAA+B;QAC9D,KAAK;YACH,OAAO;gBAAED,QAAQ;gBAAKC,OAAO;YAAkC;QACjE,KAAK;YACH,OAAO;gBACLD,QAAQ;gBACRC,OAAO;YACT;QACF,KAAK;YACH,OAAO;gBACLD,QAAQ;gBACRC,OACE,CAAC,2BAA2B,EAAER,OAAOP,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,GACjE;YACJ;QACF,KAAK;gBAIqBxB;YAHxB,OAAO;gBACLsC,QAAQ;gBACRC,OACE,CAAC,iBAAiB,GAAEvC,4BAAAA,yBAAyB,sBAAzBA,4BAAuC,MAAM,CAAC,CAAC,GACnE;YACJ;QACF,KAAK;YACH,OAAO;gBACLsC,QAAQ;gBACRC,OAAO,CAAC,uBAAuB,EAAEF,QAAQG,KAAK,CAAC,0BAA0B,CAAC;YAC5E;QACF;YACE,OAAO;gBAAEF,QAAQ;gBAAKC,OAAO;YAAkD;IACnF;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASE,2BACdC,YAAwC,CAAC,CAAC;IAE1C,OAAO,OAAOC,KAAKC;;YAKKD,WACEA;QALxB,MAAME,OAAO,aAAKpC,eAAkBiC;QACpC,IAAIC,IAAIG,MAAM,KAAK,QAAQ;YACzB,OAAOF,IAAIN,MAAM,CAAC,KAAKS,IAAI,CAAC;gBAAER,OAAO;YAAqB;QAC5D;QACA,MAAMlB,SAASU,gBAAOY,YAAAA,IAAIK,IAAI,qBAARL,UAAUtB,MAAM,mBAAI;QAC1C,MAAMC,WAAWS,iBAAOY,aAAAA,IAAIK,IAAI,qBAARL,WAAUrB,QAAQ,oBAAI;QAC9C,IAAI,CAACrB,aAAaoB,SAAS;YACzB,OAAOuB,IAAIN,MAAM,CAAC,KAAKS,IAAI,CAAC;gBAAER,OAAO;YAAiB;QACxD;QACA,IAAI,CAACtC,aAAaqB,WAAW;YAC3B,OAAOsB,IAAIN,MAAM,CAAC,KAAKS,IAAI,CAAC;gBAAER,OAAO;YAAmB;QAC1D;QACA,MAAM1B,QAAQe,YAAYe,IAAId,OAAO;QACrC,IAAI,CAAChB,OAAO,OAAO+B,IAAIN,MAAM,CAAC,KAAKS,IAAI,CAAC;YAAER,OAAO;QAAkB;QAEnE,IAAIU;QACJ,IAAI;YACFA,SAAS,MAAMJ,KAAKjC,aAAa,CAACC;QACpC,EAAE,OAAO0B,OAAO;YACd,sEAAsE;YACtE,mCAAmC;YACnC,IAAIpC,iBAAiBoC,QAAQ;gBAC3B,OAAOK,IAAIN,MAAM,CAAC,KAAKS,IAAI,CAAC;oBAAER,OAAO;gBAAkB;YACzD;YACAW,QAAQX,KAAK,CAAC,oDAAoDA;YAClE,OAAOK,IACJN,MAAM,CAAC,KACPS,IAAI,CAAC;gBAAER,OAAO;YAA+C;QAClE;QAEA,IAAI;gBAKYY,kBAuCad;gBAbzB,sBAACe,cAQkCT;YAtCrC,MAAMjC,YAAYmC,KAAKnC,SAAS;YAChC,MAAM2C,UAAU3C,UAAU4C,UAAU,CAAC,SAASC,GAAG,CAAClC;YAClD,MAAM8B,OAAO,MAAME,QAAQG,GAAG;YAC9B,IAAI,CAACL,KAAKM,MAAM,EAAE,OAAOb,IAAIN,MAAM,CAAC,KAAKS,IAAI,CAAC;gBAAER,OAAO;YAAe;YACtE,MAAMmB,OAAO,EAACP,YAAAA,KAAKK,GAAG,CAAC,0BAATL,YAA2B,CAAC,EAAE,CAACF,OAAOjC,GAAG,CAAC;YACxD,IAAIiC,OAAOhC,KAAK,KAAK,QAAQ,CAACnB,mBAAmB4D,OAAO;gBACtD,OAAOd,IACJN,MAAM,CAAC,KACPS,IAAI,CAAC;oBAAER,OAAO;gBAAiD;YACpE;YAEA,MAAMoB,OAAO,MAAMd,KAAKzC,gBAAgB,CACtC,CAAC,mBAAmB,EAAEiB,OAAO,CAAC,EAAE4B,OAAOjC,GAAG,EAAE,EAC5C;gBAAEwB,OAAOjC;gBAA6BqD,UAAUpD;YAA0B;YAE5E,IAAI,CAACmD,KAAKE,OAAO,EAAE;gBACjBjB,IAAIkB,SAAS,CACX,eACA/B,OAAOgC,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAAC,AAACN,CAAAA,KAAKO,OAAO,GAAGrB,KAAKnB,GAAG,EAAC,IAAK;gBAE7D,OAAOkB,IACJN,MAAM,CAAC,KACPS,IAAI,CAAC;oBAAER,OAAO;gBAAmD;YACtE;YAEA,MAAMa,SAAS,MAAMC,QAAQC,UAAU,CAAC,WAAWC,GAAG,CAACjC,UAAUkC,GAAG;YACpE,IAAI,CAACJ,OAAOK,MAAM,IAAIL,OAAOI,GAAG,CAAC,cAAc;gBAC7C,OAAOZ,IAAIN,MAAM,CAAC,KAAKS,IAAI,CAAC;oBAAER,OAAO;gBAA+B;YACtE;YACA,MAAMhB,QAAQQ,iBACXqB,eAAAA,OAAOe,IAAI,wBAAZ,uBAAA,AAACf,aAA0CgB,OAAO,qBAAlD,qBAAoD7C,KAAK,oBAAI;YAE/D,IAAI,CAACxB,gBAAgBwB,QAAQ;gBAC3B,OAAOqB,IAAIN,MAAM,CAAC,KAAKS,IAAI,CAAC;oBAC1BR,OAAO;gBACT;YACF;YAEA,MAAMf,UAAUnB,sBAAqBsC,aAAAA,IAAIK,IAAI,qBAARL,WAAUnB,OAAO;YACtD,MAAMa,UAAU,MAAMQ,KAAKzB,SAAS,CAACC,QAAQC,UAAUC,OAAOC;YAC9D,IAAIa,QAAQgC,GAAG,EAAE;gBACf,OAAOzB,IAAIN,MAAM,CAAC,KAAKS,IAAI,CAAC;oBAAEuB,IAAI;oBAAMC,QAAQlC,QAAQkC,MAAM;gBAAC;YACjE;YACA,MAAMC,UAAUrC,YAAWE,mBAAAA,QAAQD,OAAO,YAAfC,mBAAmB,UAAUA,SAASb;YACjE,OAAOoB,IAAIN,MAAM,CAACkC,QAAQlC,MAAM,EAAES,IAAI,CAAC;gBAAER,OAAOiC,QAAQjC,KAAK;YAAC;QAChE,EAAE,OAAOA,OAAO;YACdW,QAAQX,KAAK,CAAC,+BAA+BlB,QAAQC,UAAUiB;YAC/D,OAAOK,IACJN,MAAM,CAAC,KACPS,IAAI,CAAC;gBAAER,OAAO;YAAkD;QACrE;IACF;AACF;AAEA,OAAO,MAAMkC,uBAAuBhC,6BAA4B"}

package/src/lib/server-console.d.ts

@@ -22,7 +22,7 @@
  * does: the automation draft writer another plugin reaches through the core's
  * resource-drafts seam, which the AI jobs that write through it — inline at a
  * door and on the beat — find registered in the console process alone
- * (AGL-3026); and the doors that write the organization's automations
- * (AGL-3302).
+ * (AGL-3026); the doors that write the organization's automations
+ * (AGL-3302); and the Actions card's test run (AGL-3309).
  */
 export declare function registerWorkflowsConsoleApi(): void;

package/src/lib/server-console.js

@@ -16,6 +16,7 @@
  */ import { registerPluginApiRoute } from "@aglyn/aglyn/server";
 import { registerWorkflowsServerDeclarations } from "./declarations.server.js";
 import { registerAutomationDraftWriter } from "./server-automation-drafts.js";
+import { ACTION_TEST_RUN_API_ROUTE, actionTestRunHandler } from "./server/action-test-run-route.js";
 import { ORG_AUTOMATION_API_ROUTES, orgAutomationPauseHandler, orgAutomationsManageHandler, orgAutomationsManageSubject } from "./server/org-automations-routes.js";
 /**
  * The workflows plugin's console server surface (AGL-2919).
@@ -25,8 +26,8 @@ import { ORG_AUTOMATION_API_ROUTES, orgAutomationPauseHandler, orgAutomationsMan
  * does: the automation draft writer another plugin reaches through the core's
  * resource-drafts seam, which the AI jobs that write through it — inline at a
  * door and on the beat — find registered in the console process alone
- * (AGL-3026); and the doors that write the organization's automations
- * (AGL-3302).
+ * (AGL-3026); the doors that write the organization's automations
+ * (AGL-3302); and the Actions card's test run (AGL-3309).
  */ export function registerWorkflowsConsoleApi() {
     // The console raises host events too — a CRM stage moved, a deal won, a
     // task completed — so the engine's listener is registered here as well as
@@ -40,6 +41,8 @@ import { ORG_AUTOMATION_API_ROUTES, orgAutomationPauseHandler, orgAutomationsMan
     });
     // A site's own pause names the site, and is gated by that site's switch.
     registerPluginApiRoute(ORG_AUTOMATION_API_ROUTES.pause, orgAutomationPauseHandler);
+    // So does a test run: a site with Automation switched off has no such door.
+    registerPluginApiRoute(ACTION_TEST_RUN_API_ROUTE, actionTestRunHandler);
 }
 
 //# sourceMappingURL=server-console.js.map

package/src/lib/server-console.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginApiRoute } from '@aglyn/aglyn/server'\nimport { registerWorkflowsServerDeclarations } from './declarations.server'\nimport { registerAutomationDraftWriter } from './server-automation-drafts'\nimport {\n  ORG_AUTOMATION_API_ROUTES,\n  orgAutomationPauseHandler,\n  orgAutomationsManageHandler,\n  orgAutomationsManageSubject,\n} from './server/org-automations-routes'\n\n/**\n * The workflows plugin's console server surface (AGL-2919).\n *\n * The tenant surface (`registerWorkflowsApi`) serves the inbound webhook a\n * visitor-facing integration calls. This one serves what only the console\n * does: the automation draft writer another plugin reaches through the core's\n * resource-drafts seam, which the AI jobs that write through it — inline at a\n * door and on the beat — find registered in the console process alone\n * (AGL-3026); and the doors that write the organization's automations\n * (AGL-3302).\n */\nexport function registerWorkflowsConsoleApi(): void {\n  // The console raises host events too — a CRM stage moved, a deal won, a\n  // task completed — so the engine's listener is registered here as well as\n  // at boot (see `declarations.server.ts`).\n  registerWorkflowsServerDeclarations()\n  registerAutomationDraftWriter()\n  // The organization hub names its org and no site, so the route names that\n  // org as its subject for the release gate.\n  registerPluginApiRoute(\n    ORG_AUTOMATION_API_ROUTES.manage,\n    orgAutomationsManageHandler,\n    { subject: orgAutomationsManageSubject },\n  )\n  // A site's own pause names the site, and is gated by that site's switch.\n  registerPluginApiRoute(ORG_AUTOMATION_API_ROUTES.pause, orgAutomationPauseHandler)\n}\n"],"names":["registerPluginApiRoute","registerWorkflowsServerDeclarations","registerAutomationDraftWriter","ORG_AUTOMATION_API_ROUTES","orgAutomationPauseHandler","orgAutomationsManageHandler","orgAutomationsManageSubject","registerWorkflowsConsoleApi","manage","subject","pause"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,mCAAmC,QAAQ,2BAAuB;AAC3E,SAASC,6BAA6B,QAAQ,gCAA4B;AAC1E,SACEC,yBAAyB,EACzBC,yBAAyB,EACzBC,2BAA2B,EAC3BC,2BAA2B,QACtB,qCAAiC;AAExC;;;;;;;;;;CAUC,GACD,OAAO,SAASC;IACd,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1CN;IACAC;IACA,0EAA0E;IAC1E,2CAA2C;IAC3CF,uBACEG,0BAA0BK,MAAM,EAChCH,6BACA;QAAEI,SAASH;IAA4B;IAEzC,yEAAyE;IACzEN,uBAAuBG,0BAA0BO,KAAK,EAAEN;AAC1D"}
+{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginApiRoute } from '@aglyn/aglyn/server'\nimport { registerWorkflowsServerDeclarations } from './declarations.server'\nimport { registerAutomationDraftWriter } from './server-automation-drafts'\nimport {\n  ACTION_TEST_RUN_API_ROUTE,\n  actionTestRunHandler,\n} from './server/action-test-run-route'\nimport {\n  ORG_AUTOMATION_API_ROUTES,\n  orgAutomationPauseHandler,\n  orgAutomationsManageHandler,\n  orgAutomationsManageSubject,\n} from './server/org-automations-routes'\n\n/**\n * The workflows plugin's console server surface (AGL-2919).\n *\n * The tenant surface (`registerWorkflowsApi`) serves the inbound webhook a\n * visitor-facing integration calls. This one serves what only the console\n * does: the automation draft writer another plugin reaches through the core's\n * resource-drafts seam, which the AI jobs that write through it — inline at a\n * door and on the beat — find registered in the console process alone\n * (AGL-3026); the doors that write the organization's automations\n * (AGL-3302); and the Actions card's test run (AGL-3309).\n */\nexport function registerWorkflowsConsoleApi(): void {\n  // The console raises host events too — a CRM stage moved, a deal won, a\n  // task completed — so the engine's listener is registered here as well as\n  // at boot (see `declarations.server.ts`).\n  registerWorkflowsServerDeclarations()\n  registerAutomationDraftWriter()\n  // The organization hub names its org and no site, so the route names that\n  // org as its subject for the release gate.\n  registerPluginApiRoute(\n    ORG_AUTOMATION_API_ROUTES.manage,\n    orgAutomationsManageHandler,\n    { subject: orgAutomationsManageSubject },\n  )\n  // A site's own pause names the site, and is gated by that site's switch.\n  registerPluginApiRoute(ORG_AUTOMATION_API_ROUTES.pause, orgAutomationPauseHandler)\n  // So does a test run: a site with Automation switched off has no such door.\n  registerPluginApiRoute(ACTION_TEST_RUN_API_ROUTE, actionTestRunHandler)\n}\n"],"names":["registerPluginApiRoute","registerWorkflowsServerDeclarations","registerAutomationDraftWriter","ACTION_TEST_RUN_API_ROUTE","actionTestRunHandler","ORG_AUTOMATION_API_ROUTES","orgAutomationPauseHandler","orgAutomationsManageHandler","orgAutomationsManageSubject","registerWorkflowsConsoleApi","manage","subject","pause"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,mCAAmC,QAAQ,2BAAuB;AAC3E,SAASC,6BAA6B,QAAQ,gCAA4B;AAC1E,SACEC,yBAAyB,EACzBC,oBAAoB,QACf,oCAAgC;AACvC,SACEC,yBAAyB,EACzBC,yBAAyB,EACzBC,2BAA2B,EAC3BC,2BAA2B,QACtB,qCAAiC;AAExC;;;;;;;;;;CAUC,GACD,OAAO,SAASC;IACd,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1CR;IACAC;IACA,0EAA0E;IAC1E,2CAA2C;IAC3CF,uBACEK,0BAA0BK,MAAM,EAChCH,6BACA;QAAEI,SAASH;IAA4B;IAEzC,yEAAyE;IACzER,uBAAuBK,0BAA0BO,KAAK,EAAEN;IACxD,4EAA4E;IAC5EN,uBAAuBG,2BAA2BC;AACpD"}