@aglyn/plugins-workflows 1.0.0-beta.228 → 1.0.0-beta.230

package/src/lib/engine/webhook-delivery.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The `webhookPost` step's transport (AGL-3628), behind its own module so
+ * the engine can load it lazily: it brings `undici`, which only that step
+ * needs and which cannot load under jsdom. The engine imports
+ * `@aglyn/tenant-data-admin` statically elsewhere, so it must lazy-load a
+ * module of its own rather than that library directly.
+ */
+export { describeConfiguredUrlRefusal, fetchConfiguredPublicUrl, } from '@aglyn/tenant-data-admin/server/configured-url-fetch';

package/src/lib/engine/webhook-delivery.js

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The `webhookPost` step's transport (AGL-3628), behind its own module so
+ * the engine can load it lazily: it brings `undici`, which only that step
+ * needs and which cannot load under jsdom. The engine imports
+ * `@aglyn/tenant-data-admin` statically elsewhere, so it must lazy-load a
+ * module of its own rather than that library directly.
+ */ export { describeConfiguredUrlRefusal, fetchConfiguredPublicUrl } from "@aglyn/tenant-data-admin/server/configured-url-fetch";
+
+//# sourceMappingURL=webhook-delivery.js.map

package/src/lib/engine/webhook-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/engine/webhook-delivery.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The `webhookPost` step's transport (AGL-3628), behind its own module so\n * the engine can load it lazily: it brings `undici`, which only that step\n * needs and which cannot load under jsdom. The engine imports\n * `@aglyn/tenant-data-admin` statically elsewhere, so it must lazy-load a\n * module of its own rather than that library directly.\n */\nexport {\n  describeConfiguredUrlRefusal,\n  fetchConfiguredPublicUrl,\n} from '@aglyn/tenant-data-admin/server/configured-url-fetch'\n"],"names":["describeConfiguredUrlRefusal","fetchConfiguredPublicUrl"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;CAMC,GACD,SACEA,4BAA4B,EAC5BC,wBAAwB,QACnB,uDAAsD"}

package/src/lib/model/webhooks.d.ts

@@ -24,7 +24,7 @@
 export interface HostWebhook {
     name: string;
     direction: 'outbound' | 'inbound';
-    /** Outbound delivery URL (https only; checked again at send time). */
+    /** Outbound delivery URL (https only; resolved and checked at send time). */
     url?: string;
     /** Shared secret: signs outbound bodies, verifies inbound callers. */
     secret?: string;
@@ -32,5 +32,11 @@ export interface HostWebhook {
     workflowName?: string;
     enabled?: boolean;
 }
-/** Outbound URLs must be public https — first-line SSRF guard. */
+/**
+ * A hint for the webhooks card's URL field: https, and not an obvious private
+ * IPv4 literal. It is NOT the SSRF guard — it reads only the URL's text, so
+ * an IPv6 literal, a decimal IPv4 or a name that resolves inward all pass it.
+ * Delivery goes through `fetchConfiguredPublicUrl` (`@aglyn/tenant-data-admin`),
+ * which resolves, pins and refuses redirects.
+ */
 export declare const WEBHOOK_URL_PATTERN: RegExp;

package/src/lib/model/webhooks.js

@@ -19,6 +19,12 @@
  * inbound entries mint `/api/hooks/{hostId}/{hookId}` endpoints that run
  * a workflow with the posted JSON in scope. Business tier (`webhooks`
  * flag); Pro can be enabled per-tenant via entitlement overrides.
- */ /** Outbound URLs must be public https — first-line SSRF guard. */ export const WEBHOOK_URL_PATTERN = /^https:\/\/(?!localhost)(?!127\.)(?!0\.)(?!10\.)(?!172\.(1[6-9]|2\d|3[01])\.)(?!192\.168\.)(?!169\.254\.)[^\s]+$/i;
+ */ /**
+ * A hint for the webhooks card's URL field: https, and not an obvious private
+ * IPv4 literal. It is NOT the SSRF guard — it reads only the URL's text, so
+ * an IPv6 literal, a decimal IPv4 or a name that resolves inward all pass it.
+ * Delivery goes through `fetchConfiguredPublicUrl` (`@aglyn/tenant-data-admin`),
+ * which resolves, pins and refuses redirects.
+ */ export const WEBHOOK_URL_PATTERN = /^https:\/\/(?!localhost)(?!127\.)(?!0\.)(?!10\.)(?!172\.(1[6-9]|2\d|3[01])\.)(?!192\.168\.)(?!169\.254\.)[^\s]+$/i;
 
 //# sourceMappingURL=webhooks.js.map

package/src/lib/model/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/model/webhooks.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Webhooks (AGL-149) at `hosts/{hostId}/webhooks/{id}`. Outbound entries\n * are targets a `webhookPost` action step delivers to (HMAC-signed);\n * inbound entries mint `/api/hooks/{hostId}/{hookId}` endpoints that run\n * a workflow with the posted JSON in scope. Business tier (`webhooks`\n * flag); Pro can be enabled per-tenant via entitlement overrides.\n */\nexport interface HostWebhook {\n  name: string\n  direction: 'outbound' | 'inbound'\n  /** Outbound delivery URL (https only; checked again at send time). */\n  url?: string\n  /** Shared secret: signs outbound bodies, verifies inbound callers. */\n  secret?: string\n  /** Inbound: workflow (by name) enrolled with the payload in scope. */\n  workflowName?: string\n  enabled?: boolean\n}\n\n/** Outbound URLs must be public https — first-line SSRF guard. */\nexport const WEBHOOK_URL_PATTERN =\n  /^https:\\/\\/(?!localhost)(?!127\\.)(?!0\\.)(?!10\\.)(?!172\\.(1[6-9]|2\\d|3[01])\\.)(?!192\\.168\\.)(?!169\\.254\\.)[^\\s]+$/i\n"],"names":["WEBHOOK_URL_PATTERN"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;CAMC,GAaD,gEAAgE,GAChE,OAAO,MAAMA,sBACX,oHAAmH"}
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/model/webhooks.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Webhooks (AGL-149) at `hosts/{hostId}/webhooks/{id}`. Outbound entries\n * are targets a `webhookPost` action step delivers to (HMAC-signed);\n * inbound entries mint `/api/hooks/{hostId}/{hookId}` endpoints that run\n * a workflow with the posted JSON in scope. Business tier (`webhooks`\n * flag); Pro can be enabled per-tenant via entitlement overrides.\n */\nexport interface HostWebhook {\n  name: string\n  direction: 'outbound' | 'inbound'\n  /** Outbound delivery URL (https only; resolved and checked at send time). */\n  url?: string\n  /** Shared secret: signs outbound bodies, verifies inbound callers. */\n  secret?: string\n  /** Inbound: workflow (by name) enrolled with the payload in scope. */\n  workflowName?: string\n  enabled?: boolean\n}\n\n/**\n * A hint for the webhooks card's URL field: https, and not an obvious private\n * IPv4 literal. It is NOT the SSRF guard — it reads only the URL's text, so\n * an IPv6 literal, a decimal IPv4 or a name that resolves inward all pass it.\n * Delivery goes through `fetchConfiguredPublicUrl` (`@aglyn/tenant-data-admin`),\n * which resolves, pins and refuses redirects.\n */\nexport const WEBHOOK_URL_PATTERN =\n  /^https:\\/\\/(?!localhost)(?!127\\.)(?!0\\.)(?!10\\.)(?!172\\.(1[6-9]|2\\d|3[01])\\.)(?!192\\.168\\.)(?!169\\.254\\.)[^\\s]+$/i\n"],"names":["WEBHOOK_URL_PATTERN"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;CAMC,GAaD;;;;;;CAMC,GACD,OAAO,MAAMA,sBACX,oHAAmH"}

package/src/lib/plugin.js

@@ -21,7 +21,7 @@ import { StaffOrgAutomationsCard, StaffSiteAutomationsCard } from "./components/
 import { WORKFLOWS_CONSOLE_SECTIONS, WORKFLOWS_ORG_CONSOLE_SECTIONS } from "./components/workflows-console-sections.js";
 import { registerPluginZone } from "@aglyn/aglyn/plugin-manager/plugin-zones";
 import { registerPluginTransferResourceUi } from "@aglyn/aglyn/plugin-manager/plugin-transfer-resources";
-import { AUTOMATION_EDITOR_ZONE, AUTOMATION_RUN_ZONE, HOST_AUTOMATIONS_ZONE, WORKFLOW_USAGE_ZONE } from "./components/workflow-zones.js";
+import { AUTOMATION_EDITOR_ZONE, AUTOMATION_RUN_ZONE, HOST_AUTOMATIONS_ZONE, ORG_AUTOMATIONS_ZONE, WORKFLOW_USAGE_ZONE } from "./components/workflow-zones.js";
 import { BUNDLE_ID } from "./constants/bundle-common.js";
 import { registerWorkflowsRecordLists } from "./model/workflows-record-lists.js";
 import { registerWorkflowsRecordRoutes } from "./model/workflows-record-routes.js";
@@ -68,7 +68,16 @@ import { WORKFLOWS_SEARCH_SOURCES } from "./model/workflows-search-sources.js";
         label: 'Automation page actions',
         surface: 'console',
         layout: 'bare',
-        description: 'On the Automation page, beside Add action and Recipes: another way to start an automation. `openAction` opens a listed action in the Actions editor; a widget here writes nothing through the page.'
+        description: 'On the Automation page, beside Add action and Recipes, and in the Workflows card’s header or empty state: another way to start an automation. `openAction` opens a listed action in the Actions editor; a widget here writes nothing through the page.'
+    }, {
+        pluginId: BUNDLE_ID
+    });
+    registerPluginZone({
+        zone: ORG_AUTOMATIONS_ZONE,
+        label: 'Org automations actions',
+        surface: 'console',
+        layout: 'bare',
+        description: 'In the header of the workspace’s Org automations card, for a member who may write them: another way to start an org automation. `triggers` and `steps` are what one may start on and hold; `propose` opens an automation in the section’s editor, unsaved and switched off. A widget here writes nothing.'
     }, {
         pluginId: BUNDLE_ID
     });
@@ -77,7 +86,7 @@ import { WORKFLOWS_SEARCH_SOURCES } from "./model/workflows-search-sources.js";
         label: 'An automation’s editor',
         surface: 'console',
         layout: 'bare',
-        description: 'Inside the editor of one saved automation, an action or a workflow. A widget here reads the automation as it is stored and changes nothing in the editor.'
+        description: 'Inside the editor of one saved automation, an action or a workflow. A widget here reads the automation as it is stored and changes nothing in the editor; in an action’s editor, `openAction` opens another listed action, such as a copy the widget drafted, in its place.'
     }, {
         pluginId: BUNDLE_ID
     });

package/src/lib/plugin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiSitemap } from '@aglyn/shared-data-mdi'\nimport { lazy } from 'react'\nimport { HostActivityCard } from './components/host-activity-card.component'\nimport {\n  StaffOrgAutomationsCard,\n  StaffSiteAutomationsCard,\n} from './components/staff-automations-card.component'\nimport {\n  WORKFLOWS_CONSOLE_SECTIONS,\n  WORKFLOWS_ORG_CONSOLE_SECTIONS,\n} from './components/workflows-console-sections'\nimport { registerPluginZone } from '@aglyn/aglyn/plugin-manager/plugin-zones'\nimport { registerPluginTransferResourceUi } from '@aglyn/aglyn/plugin-manager/plugin-transfer-resources'\nimport {\n  AUTOMATION_EDITOR_ZONE,\n  AUTOMATION_RUN_ZONE,\n  HOST_AUTOMATIONS_ZONE,\n  WORKFLOW_USAGE_ZONE,\n} from './components/workflow-zones'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { registerWorkflowsRecordLists } from './model/workflows-record-lists'\nimport { registerWorkflowsRecordRoutes } from './model/workflows-record-routes'\nimport { WORKFLOWS_SEARCH_SOURCES } from './model/workflows-search-sources'\n\n/** Code-split: the Automation console page only loads when opened. */\nconst WorkflowsConsolePage = lazy(\n  () => import('./components/workflows-console-page'),\n)\n\n/**\n * Workflows feature plugin (AGL-395). Console-only — workflows, actions,\n * and webhooks run server-side (event pipelines, `/api/hooks`), not through\n * a canvas element, so there is no UI bundle. The console half declares the\n * Automation nav + page through the ConsoleExtension registry, gated by the\n * `workflows` entitlement (the Actions/Webhooks tabs run their own per-plan\n * checks off the passed `org`). Where a workflow is used is asked of the\n * platform's scan and drawn in a zone this plugin hosts.\n *\n * `pluginId`, `featureFlag` and `navTabId` all still read `workflows`: they\n * are stored — an org's enabled-plugin ids, the plan's entitlement flags, the\n * Remote Config release flag — and a section's name is not a reason to orphan\n * them. Only what a reader sees carries the new name.\n */\nexport function registerWorkflowsConsole(): void {\n  // How the Import & export hub names org automations in a workspace package (AGL-3535).\n  registerPluginTransferResourceUi(\n    'workflows.org-automations',\n    { label: 'Org automations', icon: { path: mdiSitemap.path } },\n    { pluginId: BUNDLE_ID },\n  )\n  registerWorkflowsRecordRoutes()\n  registerWorkflowsRecordLists()\n  registerPluginZone(\n    {\n      zone: WORKFLOW_USAGE_ZONE,\n      label: 'Where a workflow is used',\n      surface: 'console',\n      description:\n        'On the Automation page, after a reader asks where a workflow is used. A widget here lays out the scan the page already ran; it is handed the site, the answer and a way to close, and it writes nothing.',\n    },\n    // Named, because a spec calls this registrar without the loader.\n    { pluginId: BUNDLE_ID },\n  )\n  // The zones the Automation page draws in its own layouts (AGL-2919): one\n  // item in the Actions row, inside an open editor, on a failed run's row.\n  registerPluginZone(\n    {\n      zone: HOST_AUTOMATIONS_ZONE,\n      label: 'Automation page actions',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'On the Automation page, beside Add action and Recipes: another way to start an automation. `openAction` opens a listed action in the Actions editor; a widget here writes nothing through the page.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: AUTOMATION_EDITOR_ZONE,\n      label: 'An automation’s editor',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'Inside the editor of one saved automation, an action or a workflow. A widget here reads the automation as it is stored and changes nothing in the editor.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: AUTOMATION_RUN_ZONE,\n      label: 'A failed automation run',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'On each failed run in an automation’s run history. A widget here reads the run as it was recorded and changes nothing.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  Aglyn.registerConsoleExtension({\n    // Host activity feed (AGL-419): rendered by the shell's\n    // 'hostActivity' widget slot (dashboard + editor view page).\n    widgets: [\n      {\n        slot: 'hostActivity',\n        widgetId: 'workflows-host-activity',\n        title: 'Recent Activity',\n        Component: HostActivityCard,\n      },\n      // The staff site and organization pages' automations (AGL-3379), read\n      // only: staff see what runs on a site without joining it.\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.staffSite,\n        widgetId: 'workflows-staff-site-automations',\n        title: 'Automations',\n        Component: StaffSiteAutomationsCard,\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.adminOrgDetail,\n        widgetId: 'workflows-staff-org-automations',\n        title: 'Organization automations',\n        Component: StaffOrgAutomationsCard,\n      },\n    ],\n    pluginId: BUNDLE_ID,\n    displayName: 'Automation',\n    featureFlag: 'workflows',\n    searchSources: WORKFLOWS_SEARCH_SOURCES,\n    navItems: [\n      {\n        label: 'Automation',\n        // Workflows, Actions and Webhooks are the tabs INSIDE this section, so\n        // the section is named for what they have in common. `/workflows` —\n        // the address before the section had its own name — is redirected here\n        // by this plugin's `consoleRedirects`.\n        href: '/automation',\n        // Sections as ROUTES (AGL-2501): each is a real URL the shell\n        // resolves and gates, so the page mounts the one being read.\n        sections: WORKFLOWS_CONSOLE_SECTIONS,\n        // Reuse the existing release-flag nav-tab so staff-preview gating is\n        // unchanged now that the tab comes from the plugin (AGL-395).\n        navTabId: 'nav-tab-workflows',\n        icon: { path: mdiSitemap.path },\n        header: {\n          title: 'Automation',\n          icon: { path: mdiSitemap.path },\n          docsTopic: 'workflows',\n        },\n        Component: WorkflowsConsolePage,\n      },\n    ],\n    /*\n     * The ORGANIZATION's Automation hub (AGL-3302), at `/[orgSlug]/automation`:\n     * the org automations placed across the organization's sites, and every\n     * site's own workflows, actions and webhooks side by side. The same page\n     * component, mounted with no site; the site tab's release flag gates both\n     * levels, so one flag rolls the surface out at once.\n     */\n    orgNavItems: [\n      {\n        label: 'Automation',\n        href: '/automation',\n        sections: WORKFLOWS_ORG_CONSOLE_SECTIONS,\n        navTabId: 'nav-tab-workflows',\n        icon: { path: mdiSitemap.path },\n        header: {\n          title: 'Automation',\n          icon: { path: mdiSitemap.path },\n          docsTopic: 'workflows',\n        },\n        Component: WorkflowsConsolePage,\n      },\n    ],\n  })\n}\n\n// Activity feed consumed directly by the app (dashboard + screen view).\nexport { default as HostActivityCard } from './components/host-activity-card.component'\nexport type { HostActivityCardProps } from './components/host-activity-card.component'\n"],"names":["Aglyn","mdiSitemap","lazy","HostActivityCard","StaffOrgAutomationsCard","StaffSiteAutomationsCard","WORKFLOWS_CONSOLE_SECTIONS","WORKFLOWS_ORG_CONSOLE_SECTIONS","registerPluginZone","registerPluginTransferResourceUi","AUTOMATION_EDITOR_ZONE","AUTOMATION_RUN_ZONE","HOST_AUTOMATIONS_ZONE","WORKFLOW_USAGE_ZONE","BUNDLE_ID","registerWorkflowsRecordLists","registerWorkflowsRecordRoutes","WORKFLOWS_SEARCH_SOURCES","WorkflowsConsolePage","registerWorkflowsConsole","label","icon","path","pluginId","zone","surface","description","layout","registerConsoleExtension","widgets","slot","widgetId","title","Component","CONSOLE_WIDGET_SLOTS","staffSite","adminOrgDetail","displayName","featureFlag","searchSources","navItems","href","sections","navTabId","header","docsTopic","orgNavItems","default"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,UAAU,QAAQ,yBAAwB;AACnD,SAASC,IAAI,QAAQ,QAAO;AAC5B,SAASC,gBAAgB,QAAQ,+CAA2C;AAC5E,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,mDAA+C;AACtD,SACEC,0BAA0B,EAC1BC,8BAA8B,QACzB,6CAAyC;AAChD,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,gCAAgC,QAAQ,wDAAuD;AACxG,SACEC,sBAAsB,EACtBC,mBAAmB,EACnBC,qBAAqB,EACrBC,mBAAmB,QACd,iCAA6B;AACpC,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,4BAA4B,QAAQ,oCAAgC;AAC7E,SAASC,6BAA6B,QAAQ,qCAAiC;AAC/E,SAASC,wBAAwB,QAAQ,sCAAkC;AAE3E,oEAAoE,GACpE,MAAMC,uBAAuBhB,KAC3B,IAAM,MAAM,CAAC;AAGf;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASiB;IACd,uFAAuF;IACvFV,iCACE,6BACA;QAAEW,OAAO;QAAmBC,MAAM;YAAEC,MAAMrB,WAAWqB,IAAI;QAAC;IAAE,GAC5D;QAAEC,UAAUT;IAAU;IAExBE;IACAD;IACAP,mBACE;QACEgB,MAAMX;QACNO,OAAO;QACPK,SAAS;QACTC,aACE;IACJ,GACA,iEAAiE;IACjE;QAAEH,UAAUT;IAAU;IAExB,yEAAyE;IACzE,yEAAyE;IACzEN,mBACE;QACEgB,MAAMZ;QACNQ,OAAO;QACPK,SAAS;QACTE,QAAQ;QACRD,aACE;IACJ,GACA;QAAEH,UAAUT;IAAU;IAExBN,mBACE;QACEgB,MAAMd;QACNU,OAAO;QACPK,SAAS;QACTE,QAAQ;QACRD,aACE;IACJ,GACA;QAAEH,UAAUT;IAAU;IAExBN,mBACE;QACEgB,MAAMb;QACNS,OAAO;QACPK,SAAS;QACTE,QAAQ;QACRD,aACE;IACJ,GACA;QAAEH,UAAUT;IAAU;IAExBd,MAAM4B,wBAAwB,CAAC;QAC7B,wDAAwD;QACxD,6DAA6D;QAC7DC,SAAS;YACP;gBACEC,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAW9B;YACb;YACA,sEAAsE;YACtE,0DAA0D;YAC1D;gBACE2B,MAAM9B,MAAMkC,oBAAoB,CAACC,SAAS;gBAC1CJ,UAAU;gBACVC,OAAO;gBACPC,WAAW5B;YACb;YACA;gBACEyB,MAAM9B,MAAMkC,oBAAoB,CAACE,cAAc;gBAC/CL,UAAU;gBACVC,OAAO;gBACPC,WAAW7B;YACb;SACD;QACDmB,UAAUT;QACVuB,aAAa;QACbC,aAAa;QACbC,eAAetB;QACfuB,UAAU;YACR;gBACEpB,OAAO;gBACP,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,uCAAuC;gBACvCqB,MAAM;gBACN,8DAA8D;gBAC9D,6DAA6D;gBAC7DC,UAAUpC;gBACV,qEAAqE;gBACrE,8DAA8D;gBAC9DqC,UAAU;gBACVtB,MAAM;oBAAEC,MAAMrB,WAAWqB,IAAI;gBAAC;gBAC9BsB,QAAQ;oBACNZ,OAAO;oBACPX,MAAM;wBAAEC,MAAMrB,WAAWqB,IAAI;oBAAC;oBAC9BuB,WAAW;gBACb;gBACAZ,WAAWf;YACb;SACD;QACD;;;;;;KAMC,GACD4B,aAAa;YACX;gBACE1B,OAAO;gBACPqB,MAAM;gBACNC,UAAUnC;gBACVoC,UAAU;gBACVtB,MAAM;oBAAEC,MAAMrB,WAAWqB,IAAI;gBAAC;gBAC9BsB,QAAQ;oBACNZ,OAAO;oBACPX,MAAM;wBAAEC,MAAMrB,WAAWqB,IAAI;oBAAC;oBAC9BuB,WAAW;gBACb;gBACAZ,WAAWf;YACb;SACD;IACH;AACF;AAEA,wEAAwE;AACxE,SAAS6B,WAAW5C,gBAAgB,QAAQ,+CAA2C"}
+{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiSitemap } from '@aglyn/shared-data-mdi'\nimport { lazy } from 'react'\nimport { HostActivityCard } from './components/host-activity-card.component'\nimport {\n  StaffOrgAutomationsCard,\n  StaffSiteAutomationsCard,\n} from './components/staff-automations-card.component'\nimport {\n  WORKFLOWS_CONSOLE_SECTIONS,\n  WORKFLOWS_ORG_CONSOLE_SECTIONS,\n} from './components/workflows-console-sections'\nimport { registerPluginZone } from '@aglyn/aglyn/plugin-manager/plugin-zones'\nimport { registerPluginTransferResourceUi } from '@aglyn/aglyn/plugin-manager/plugin-transfer-resources'\nimport {\n  AUTOMATION_EDITOR_ZONE,\n  AUTOMATION_RUN_ZONE,\n  HOST_AUTOMATIONS_ZONE,\n  ORG_AUTOMATIONS_ZONE,\n  WORKFLOW_USAGE_ZONE,\n} from './components/workflow-zones'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { registerWorkflowsRecordLists } from './model/workflows-record-lists'\nimport { registerWorkflowsRecordRoutes } from './model/workflows-record-routes'\nimport { WORKFLOWS_SEARCH_SOURCES } from './model/workflows-search-sources'\n\n/** Code-split: the Automation console page only loads when opened. */\nconst WorkflowsConsolePage = lazy(\n  () => import('./components/workflows-console-page'),\n)\n\n/**\n * Workflows feature plugin (AGL-395). Console-only — workflows, actions,\n * and webhooks run server-side (event pipelines, `/api/hooks`), not through\n * a canvas element, so there is no UI bundle. The console half declares the\n * Automation nav + page through the ConsoleExtension registry, gated by the\n * `workflows` entitlement (the Actions/Webhooks tabs run their own per-plan\n * checks off the passed `org`). Where a workflow is used is asked of the\n * platform's scan and drawn in a zone this plugin hosts.\n *\n * `pluginId`, `featureFlag` and `navTabId` all still read `workflows`: they\n * are stored — an org's enabled-plugin ids, the plan's entitlement flags, the\n * Remote Config release flag — and a section's name is not a reason to orphan\n * them. Only what a reader sees carries the new name.\n */\nexport function registerWorkflowsConsole(): void {\n  // How the Import & export hub names org automations in a workspace package (AGL-3535).\n  registerPluginTransferResourceUi(\n    'workflows.org-automations',\n    { label: 'Org automations', icon: { path: mdiSitemap.path } },\n    { pluginId: BUNDLE_ID },\n  )\n  registerWorkflowsRecordRoutes()\n  registerWorkflowsRecordLists()\n  registerPluginZone(\n    {\n      zone: WORKFLOW_USAGE_ZONE,\n      label: 'Where a workflow is used',\n      surface: 'console',\n      description:\n        'On the Automation page, after a reader asks where a workflow is used. A widget here lays out the scan the page already ran; it is handed the site, the answer and a way to close, and it writes nothing.',\n    },\n    // Named, because a spec calls this registrar without the loader.\n    { pluginId: BUNDLE_ID },\n  )\n  // The zones the Automation page draws in its own layouts (AGL-2919): one\n  // item in the Actions row, inside an open editor, on a failed run's row.\n  registerPluginZone(\n    {\n      zone: HOST_AUTOMATIONS_ZONE,\n      label: 'Automation page actions',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'On the Automation page, beside Add action and Recipes, and in the Workflows card’s header or empty state: another way to start an automation. `openAction` opens a listed action in the Actions editor; a widget here writes nothing through the page.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: ORG_AUTOMATIONS_ZONE,\n      label: 'Org automations actions',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'In the header of the workspace’s Org automations card, for a member who may write them: another way to start an org automation. `triggers` and `steps` are what one may start on and hold; `propose` opens an automation in the section’s editor, unsaved and switched off. A widget here writes nothing.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: AUTOMATION_EDITOR_ZONE,\n      label: 'An automation’s editor',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'Inside the editor of one saved automation, an action or a workflow. A widget here reads the automation as it is stored and changes nothing in the editor; in an action’s editor, `openAction` opens another listed action, such as a copy the widget drafted, in its place.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: AUTOMATION_RUN_ZONE,\n      label: 'A failed automation run',\n      surface: 'console',\n      layout: 'bare',\n      description:\n        'On each failed run in an automation’s run history. A widget here reads the run as it was recorded and changes nothing.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  Aglyn.registerConsoleExtension({\n    // Host activity feed (AGL-419): rendered by the shell's\n    // 'hostActivity' widget slot (dashboard + editor view page).\n    widgets: [\n      {\n        slot: 'hostActivity',\n        widgetId: 'workflows-host-activity',\n        title: 'Recent Activity',\n        Component: HostActivityCard,\n      },\n      // The staff site and organization pages' automations (AGL-3379), read\n      // only: staff see what runs on a site without joining it.\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.staffSite,\n        widgetId: 'workflows-staff-site-automations',\n        title: 'Automations',\n        Component: StaffSiteAutomationsCard,\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.adminOrgDetail,\n        widgetId: 'workflows-staff-org-automations',\n        title: 'Organization automations',\n        Component: StaffOrgAutomationsCard,\n      },\n    ],\n    pluginId: BUNDLE_ID,\n    displayName: 'Automation',\n    featureFlag: 'workflows',\n    searchSources: WORKFLOWS_SEARCH_SOURCES,\n    navItems: [\n      {\n        label: 'Automation',\n        // Workflows, Actions and Webhooks are the tabs INSIDE this section, so\n        // the section is named for what they have in common. `/workflows` —\n        // the address before the section had its own name — is redirected here\n        // by this plugin's `consoleRedirects`.\n        href: '/automation',\n        // Sections as ROUTES (AGL-2501): each is a real URL the shell\n        // resolves and gates, so the page mounts the one being read.\n        sections: WORKFLOWS_CONSOLE_SECTIONS,\n        // Reuse the existing release-flag nav-tab so staff-preview gating is\n        // unchanged now that the tab comes from the plugin (AGL-395).\n        navTabId: 'nav-tab-workflows',\n        icon: { path: mdiSitemap.path },\n        header: {\n          title: 'Automation',\n          icon: { path: mdiSitemap.path },\n          docsTopic: 'workflows',\n        },\n        Component: WorkflowsConsolePage,\n      },\n    ],\n    /*\n     * The ORGANIZATION's Automation hub (AGL-3302), at `/[orgSlug]/automation`:\n     * the org automations placed across the organization's sites, and every\n     * site's own workflows, actions and webhooks side by side. The same page\n     * component, mounted with no site; the site tab's release flag gates both\n     * levels, so one flag rolls the surface out at once.\n     */\n    orgNavItems: [\n      {\n        label: 'Automation',\n        href: '/automation',\n        sections: WORKFLOWS_ORG_CONSOLE_SECTIONS,\n        navTabId: 'nav-tab-workflows',\n        icon: { path: mdiSitemap.path },\n        header: {\n          title: 'Automation',\n          icon: { path: mdiSitemap.path },\n          docsTopic: 'workflows',\n        },\n        Component: WorkflowsConsolePage,\n      },\n    ],\n  })\n}\n\n// Activity feed consumed directly by the app (dashboard + screen view).\nexport { default as HostActivityCard } from './components/host-activity-card.component'\nexport type { HostActivityCardProps } from './components/host-activity-card.component'\n"],"names":["Aglyn","mdiSitemap","lazy","HostActivityCard","StaffOrgAutomationsCard","StaffSiteAutomationsCard","WORKFLOWS_CONSOLE_SECTIONS","WORKFLOWS_ORG_CONSOLE_SECTIONS","registerPluginZone","registerPluginTransferResourceUi","AUTOMATION_EDITOR_ZONE","AUTOMATION_RUN_ZONE","HOST_AUTOMATIONS_ZONE","ORG_AUTOMATIONS_ZONE","WORKFLOW_USAGE_ZONE","BUNDLE_ID","registerWorkflowsRecordLists","registerWorkflowsRecordRoutes","WORKFLOWS_SEARCH_SOURCES","WorkflowsConsolePage","registerWorkflowsConsole","label","icon","path","pluginId","zone","surface","description","layout","registerConsoleExtension","widgets","slot","widgetId","title","Component","CONSOLE_WIDGET_SLOTS","staffSite","adminOrgDetail","displayName","featureFlag","searchSources","navItems","href","sections","navTabId","header","docsTopic","orgNavItems","default"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,UAAU,QAAQ,yBAAwB;AACnD,SAASC,IAAI,QAAQ,QAAO;AAC5B,SAASC,gBAAgB,QAAQ,+CAA2C;AAC5E,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,mDAA+C;AACtD,SACEC,0BAA0B,EAC1BC,8BAA8B,QACzB,6CAAyC;AAChD,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,gCAAgC,QAAQ,wDAAuD;AACxG,SACEC,sBAAsB,EACtBC,mBAAmB,EACnBC,qBAAqB,EACrBC,oBAAoB,EACpBC,mBAAmB,QACd,iCAA6B;AACpC,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,4BAA4B,QAAQ,oCAAgC;AAC7E,SAASC,6BAA6B,QAAQ,qCAAiC;AAC/E,SAASC,wBAAwB,QAAQ,sCAAkC;AAE3E,oEAAoE,GACpE,MAAMC,uBAAuBjB,KAC3B,IAAM,MAAM,CAAC;AAGf;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASkB;IACd,uFAAuF;IACvFX,iCACE,6BACA;QAAEY,OAAO;QAAmBC,MAAM;YAAEC,MAAMtB,WAAWsB,IAAI;QAAC;IAAE,GAC5D;QAAEC,UAAUT;IAAU;IAExBE;IACAD;IACAR,mBACE;QACEiB,MAAMX;QACNO,OAAO;QACPK,SAAS;QACTC,aACE;IACJ,GACA,iEAAiE;IACjE;QAAEH,UAAUT;IAAU;IAExB,yEAAyE;IACzE,yEAAyE;IACzEP,mBACE;QACEiB,MAAMb;QACNS,OAAO;QACPK,SAAS;QACTE,QAAQ;QACRD,aACE;IACJ,GACA;QAAEH,UAAUT;IAAU;IAExBP,mBACE;QACEiB,MAAMZ;QACNQ,OAAO;QACPK,SAAS;QACTE,QAAQ;QACRD,aACE;IACJ,GACA;QAAEH,UAAUT;IAAU;IAExBP,mBACE;QACEiB,MAAMf;QACNW,OAAO;QACPK,SAAS;QACTE,QAAQ;QACRD,aACE;IACJ,GACA;QAAEH,UAAUT;IAAU;IAExBP,mBACE;QACEiB,MAAMd;QACNU,OAAO;QACPK,SAAS;QACTE,QAAQ;QACRD,aACE;IACJ,GACA;QAAEH,UAAUT;IAAU;IAExBf,MAAM6B,wBAAwB,CAAC;QAC7B,wDAAwD;QACxD,6DAA6D;QAC7DC,SAAS;YACP;gBACEC,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACPC,WAAW/B;YACb;YACA,sEAAsE;YACtE,0DAA0D;YAC1D;gBACE4B,MAAM/B,MAAMmC,oBAAoB,CAACC,SAAS;gBAC1CJ,UAAU;gBACVC,OAAO;gBACPC,WAAW7B;YACb;YACA;gBACE0B,MAAM/B,MAAMmC,oBAAoB,CAACE,cAAc;gBAC/CL,UAAU;gBACVC,OAAO;gBACPC,WAAW9B;YACb;SACD;QACDoB,UAAUT;QACVuB,aAAa;QACbC,aAAa;QACbC,eAAetB;QACfuB,UAAU;YACR;gBACEpB,OAAO;gBACP,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,uCAAuC;gBACvCqB,MAAM;gBACN,8DAA8D;gBAC9D,6DAA6D;gBAC7DC,UAAUrC;gBACV,qEAAqE;gBACrE,8DAA8D;gBAC9DsC,UAAU;gBACVtB,MAAM;oBAAEC,MAAMtB,WAAWsB,IAAI;gBAAC;gBAC9BsB,QAAQ;oBACNZ,OAAO;oBACPX,MAAM;wBAAEC,MAAMtB,WAAWsB,IAAI;oBAAC;oBAC9BuB,WAAW;gBACb;gBACAZ,WAAWf;YACb;SACD;QACD;;;;;;KAMC,GACD4B,aAAa;YACX;gBACE1B,OAAO;gBACPqB,MAAM;gBACNC,UAAUpC;gBACVqC,UAAU;gBACVtB,MAAM;oBAAEC,MAAMtB,WAAWsB,IAAI;gBAAC;gBAC9BsB,QAAQ;oBACNZ,OAAO;oBACPX,MAAM;wBAAEC,MAAMtB,WAAWsB,IAAI;oBAAC;oBAC9BuB,WAAW;gBACb;gBACAZ,WAAWf;YACb;SACD;IACH;AACF;AAEA,wEAAwE;AACxE,SAAS6B,WAAW7C,gBAAgB,QAAQ,+CAA2C"}

package/src/lib/server/automation-run-figures.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginFigureReader } from '@aglyn/aglyn/plugin-manager/plugin-figures';
+/**
+ * A site's automation runs as a figure table another plugin reads by id
+ * (AGL-3603) — the AI plugin's insights answer "which automations failed?"
+ * from it.
+ *
+ * Every run an action, a workflow or an organization automation makes is a
+ * row in the site's activity log carrying `result` (`succeeded` or `failed`)
+ * and `target` — the same rows the run history lists. The totals are COUNT
+ * aggregates over `result` in the window (the `activity` composite on
+ * `result` + `createdAt`), so they are exact however busy the site is; the
+ * per-automation split reads at most `AUTOMATION_RUN_FIGURES_WINDOW_CEILING`
+ * runs of each result, projected to `target`, and says so when that read
+ * low. A run's event payload names a person and is never read.
+ */
+type Firestore = FirebaseFirestore.Firestore;
+/** Runs of one result one window reads for the per-automation split. */
+export declare const AUTOMATION_RUN_FIGURES_WINDOW_CEILING = 500;
+export declare function automationRunFigureReader(firestore: () => Firestore): PluginFigureReader;
+/** Registers the automation runs reader from the console surface, where insight jobs run. */
+export declare function registerAutomationRunFigureReader(firestore: () => Firestore): void;
+export {};

package/src/lib/server/automation-run-figures.js

@@ -0,0 +1,182 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { PLUGIN_FIGURE_MAX_ROWS, pluginFigureChange, pluginFigureWindows, registerPluginFigureReader } from "@aglyn/aglyn/plugin-manager/plugin-figures";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+/** Runs of one result one window reads for the per-automation split. */ export const AUTOMATION_RUN_FIGURES_WINDOW_CEILING = 500;
+const WINDOWS = [
+    7,
+    14,
+    30,
+    90
+];
+function runsOf(firestore, hostId, result, startMs, endMs) {
+    return firestore.collection('hosts').doc(hostId).collection('activity').where('result', '==', result).where('createdAt', '>=', new Date(startMs)).where('createdAt', '<', new Date(endMs));
+}
+async function countOf(query) {
+    const snapshot = await query.count().get();
+    return Number(snapshot.data().count) || 0;
+}
+/** Runs of one result in the window, by the automation they belong to, read to the ceiling. */ async function byAutomation(query) {
+    const snapshot = await query.orderBy('createdAt', 'desc').select('target').limit(AUTOMATION_RUN_FIGURES_WINDOW_CEILING + 1).get();
+    const names = new Map();
+    for (const doc of snapshot.docs.slice(0, AUTOMATION_RUN_FIGURES_WINDOW_CEILING)){
+        var _doc_get, _names_get;
+        const target = (_doc_get = doc.get('target')) != null ? _doc_get : {};
+        const name = typeof target.name === 'string' && target.name.trim() || 'An automation with no name';
+        names.set(name, ((_names_get = names.get(name)) != null ? _names_get : 0) + 1);
+    }
+    return {
+        names,
+        truncated: snapshot.docs.length > AUTOMATION_RUN_FIGURES_WINDOW_CEILING
+    };
+}
+const failureRate = (counts)=>{
+    const total = counts.succeeded + counts.failed;
+    return total > 0 ? Math.round(counts.failed / total * 1000) / 10 : null;
+};
+export function automationRunFigureReader(firestore) {
+    return {
+        id: 'automations.runs',
+        label: 'Automation runs',
+        description: 'Runs of the site’s automations — actions, workflows and organization automations — over the window: how many succeeded and failed, the failure rate, and the change in runs from the window before, in total and by automation.',
+        scope: 'site',
+        windows: WINDOWS,
+        read: async (request)=>{
+            if (!request.hostId) return {
+                ok: false,
+                status: 400,
+                error: 'Open a site to read its automation runs'
+            };
+            if (!WINDOWS.includes(request.days)) {
+                return {
+                    ok: false,
+                    status: 400,
+                    error: 'That window is not one automation runs are read over'
+                };
+            }
+            const db = firestore();
+            const hostId = request.hostId;
+            const { current, previous } = pluginFigureWindows(request.now, request.days);
+            const [succeeded, failed, before, okRuns, failedRuns] = await Promise.all([
+                countOf(runsOf(db, hostId, 'succeeded', current.startMs, current.endMs)),
+                countOf(runsOf(db, hostId, 'failed', current.startMs, current.endMs)),
+                Promise.all([
+                    countOf(runsOf(db, hostId, 'succeeded', previous.startMs, previous.endMs)),
+                    countOf(runsOf(db, hostId, 'failed', previous.startMs, previous.endMs))
+                ]).then(([a, b])=>a + b),
+                byAutomation(runsOf(db, hostId, 'succeeded', current.startMs, current.endMs)),
+                byAutomation(runsOf(db, hostId, 'failed', current.startMs, current.endMs))
+            ]);
+            const automations = new Map();
+            for (const [name, count] of okRuns.names){
+                var _ref;
+                var _automations_get;
+                automations.set(name, {
+                    succeeded: count,
+                    failed: (_ref = (_automations_get = automations.get(name)) == null ? void 0 : _automations_get.failed) != null ? _ref : 0
+                });
+            }
+            for (const [name, count] of failedRuns.names){
+                var _ref1;
+                var _automations_get1;
+                automations.set(name, {
+                    succeeded: (_ref1 = (_automations_get1 = automations.get(name)) == null ? void 0 : _automations_get1.succeeded) != null ? _ref1 : 0,
+                    failed: count
+                });
+            }
+            // The most failures first: that is the question a person asks of runs.
+            const ranked = [
+                ...automations.entries()
+            ].sort((a, b)=>b[1].failed - a[1].failed || b[1].succeeded - a[1].succeeded || a[0].localeCompare(b[0]));
+            const totals = {
+                succeeded,
+                failed
+            };
+            return {
+                ok: true,
+                table: {
+                    title: 'Automation runs',
+                    source: {
+                        label: 'Automation',
+                        path: 'automation'
+                    },
+                    period: {
+                        from: current.from,
+                        to: current.to,
+                        days: request.days
+                    },
+                    columns: [
+                        {
+                            key: 'automation',
+                            label: 'Automation',
+                            kind: 'text'
+                        },
+                        {
+                            key: 'succeeded',
+                            label: 'Succeeded',
+                            kind: 'count'
+                        },
+                        {
+                            key: 'failed',
+                            label: 'Failed',
+                            kind: 'count'
+                        },
+                        {
+                            key: 'failureRate',
+                            label: 'Failure rate',
+                            kind: 'percent'
+                        },
+                        {
+                            key: 'change',
+                            label: 'Change in runs',
+                            kind: 'change'
+                        }
+                    ],
+                    rows: [
+                        {
+                            automation: 'All automations',
+                            succeeded,
+                            failed,
+                            failureRate: failureRate(totals),
+                            change: pluginFigureChange(succeeded + failed, before)
+                        },
+                        ...ranked.slice(0, PLUGIN_FIGURE_MAX_ROWS - 1).map(([automation, counts])=>({
+                                automation,
+                                succeeded: counts.succeeded,
+                                failed: counts.failed,
+                                failureRate: failureRate(counts),
+                                change: null
+                            }))
+                    ],
+                    omitted: Math.max(0, ranked.length - (PLUGIN_FIGURE_MAX_ROWS - 1)),
+                    notes: [
+                        'A run is counted on the day it ran. A run waiting on a later step counts as succeeded so far.',
+                        ...okRuns.truncated || failedRuns.truncated ? [
+                            `The split by automation counts the most recent ${AUTOMATION_RUN_FIGURES_WINDOW_CEILING.toLocaleString('en-US')} runs of each result; the All automations row counts every run.`
+                        ] : []
+                    ]
+                }
+            };
+        }
+    };
+}
+/** Registers the automation runs reader from the console surface, where insight jobs run. */ export function registerAutomationRunFigureReader(firestore) {
+    registerPluginFigureReader(automationRunFigureReader(firestore), {
+        pluginId: BUNDLE_ID
+    });
+}
+
+//# sourceMappingURL=automation-run-figures.js.map

package/src/lib/server/automation-run-figures.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/server/automation-run-figures.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  PLUGIN_FIGURE_MAX_ROWS,\n  pluginFigureChange,\n  pluginFigureWindows,\n  registerPluginFigureReader,\n  type PluginFigureReader,\n} from '@aglyn/aglyn/plugin-manager/plugin-figures'\nimport { BUNDLE_ID } from '../constants/bundle-common'\n\n/**\n * A site's automation runs as a figure table another plugin reads by id\n * (AGL-3603) — the AI plugin's insights answer \"which automations failed?\"\n * from it.\n *\n * Every run an action, a workflow or an organization automation makes is a\n * row in the site's activity log carrying `result` (`succeeded` or `failed`)\n * and `target` — the same rows the run history lists. The totals are COUNT\n * aggregates over `result` in the window (the `activity` composite on\n * `result` + `createdAt`), so they are exact however busy the site is; the\n * per-automation split reads at most `AUTOMATION_RUN_FIGURES_WINDOW_CEILING`\n * runs of each result, projected to `target`, and says so when that read\n * low. A run's event payload names a person and is never read.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\n/** Runs of one result one window reads for the per-automation split. */\nexport const AUTOMATION_RUN_FIGURES_WINDOW_CEILING = 500\n\nconst WINDOWS: readonly number[] = [7, 14, 30, 90]\n\ninterface AutomationCounts {\n  succeeded: number\n  failed: number\n}\n\nfunction runsOf(\n  firestore: Firestore,\n  hostId: string,\n  result: 'succeeded' | 'failed',\n  startMs: number,\n  endMs: number,\n): FirebaseFirestore.Query {\n  return firestore\n    .collection('hosts')\n    .doc(hostId)\n    .collection('activity')\n    .where('result', '==', result)\n    .where('createdAt', '>=', new Date(startMs))\n    .where('createdAt', '<', new Date(endMs))\n}\n\nasync function countOf(query: FirebaseFirestore.Query): Promise<number> {\n  const snapshot = await query.count().get()\n  return Number(snapshot.data().count) || 0\n}\n\n/** Runs of one result in the window, by the automation they belong to, read to the ceiling. */\nasync function byAutomation(\n  query: FirebaseFirestore.Query,\n): Promise<{ names: Map<string, number>; truncated: boolean }> {\n  const snapshot = await query\n    .orderBy('createdAt', 'desc')\n    .select('target')\n    .limit(AUTOMATION_RUN_FIGURES_WINDOW_CEILING + 1)\n    .get()\n  const names = new Map<string, number>()\n  for (const doc of snapshot.docs.slice(0, AUTOMATION_RUN_FIGURES_WINDOW_CEILING)) {\n    const target = (doc.get('target') ?? {}) as { name?: unknown; id?: unknown }\n    const name =\n      (typeof target.name === 'string' && target.name.trim()) || 'An automation with no name'\n    names.set(name, (names.get(name) ?? 0) + 1)\n  }\n  return { names, truncated: snapshot.docs.length > AUTOMATION_RUN_FIGURES_WINDOW_CEILING }\n}\n\nconst failureRate = (counts: AutomationCounts): number | null => {\n  const total = counts.succeeded + counts.failed\n  return total > 0 ? Math.round((counts.failed / total) * 1_000) / 10 : null\n}\n\nexport function automationRunFigureReader(firestore: () => Firestore): PluginFigureReader {\n  return {\n    id: 'automations.runs',\n    label: 'Automation runs',\n    description:\n      'Runs of the site’s automations — actions, workflows and organization automations — over the window: how many succeeded and failed, the failure rate, and the change in runs from the window before, in total and by automation.',\n    scope: 'site',\n    windows: WINDOWS,\n    read: async (request) => {\n      if (!request.hostId) return { ok: false, status: 400, error: 'Open a site to read its automation runs' }\n      if (!WINDOWS.includes(request.days)) {\n        return { ok: false, status: 400, error: 'That window is not one automation runs are read over' }\n      }\n      const db = firestore()\n      const hostId = request.hostId\n      const { current, previous } = pluginFigureWindows(request.now, request.days)\n      const [succeeded, failed, before, okRuns, failedRuns] = await Promise.all([\n        countOf(runsOf(db, hostId, 'succeeded', current.startMs, current.endMs)),\n        countOf(runsOf(db, hostId, 'failed', current.startMs, current.endMs)),\n        Promise.all([\n          countOf(runsOf(db, hostId, 'succeeded', previous.startMs, previous.endMs)),\n          countOf(runsOf(db, hostId, 'failed', previous.startMs, previous.endMs)),\n        ]).then(([a, b]) => a + b),\n        byAutomation(runsOf(db, hostId, 'succeeded', current.startMs, current.endMs)),\n        byAutomation(runsOf(db, hostId, 'failed', current.startMs, current.endMs)),\n      ])\n      const automations = new Map<string, AutomationCounts>()\n      for (const [name, count] of okRuns.names) {\n        automations.set(name, { succeeded: count, failed: automations.get(name)?.failed ?? 0 })\n      }\n      for (const [name, count] of failedRuns.names) {\n        automations.set(name, { succeeded: automations.get(name)?.succeeded ?? 0, failed: count })\n      }\n      // The most failures first: that is the question a person asks of runs.\n      const ranked = [...automations.entries()].sort(\n        (a, b) => b[1].failed - a[1].failed || b[1].succeeded - a[1].succeeded || a[0].localeCompare(b[0]),\n      )\n      const totals = { succeeded, failed }\n      return {\n        ok: true,\n        table: {\n          title: 'Automation runs',\n          source: { label: 'Automation', path: 'automation' },\n          period: { from: current.from, to: current.to, days: request.days },\n          columns: [\n            { key: 'automation', label: 'Automation', kind: 'text' },\n            { key: 'succeeded', label: 'Succeeded', kind: 'count' },\n            { key: 'failed', label: 'Failed', kind: 'count' },\n            { key: 'failureRate', label: 'Failure rate', kind: 'percent' },\n            { key: 'change', label: 'Change in runs', kind: 'change' },\n          ],\n          rows: [\n            {\n              automation: 'All automations',\n              succeeded,\n              failed,\n              failureRate: failureRate(totals),\n              change: pluginFigureChange(succeeded + failed, before),\n            },\n            ...ranked.slice(0, PLUGIN_FIGURE_MAX_ROWS - 1).map(([automation, counts]) => ({\n              automation,\n              succeeded: counts.succeeded,\n              failed: counts.failed,\n              failureRate: failureRate(counts),\n              change: null,\n            })),\n          ],\n          omitted: Math.max(0, ranked.length - (PLUGIN_FIGURE_MAX_ROWS - 1)),\n          notes: [\n            'A run is counted on the day it ran. A run waiting on a later step counts as succeeded so far.',\n            ...(okRuns.truncated || failedRuns.truncated\n              ? [\n                  `The split by automation counts the most recent ${AUTOMATION_RUN_FIGURES_WINDOW_CEILING.toLocaleString('en-US')} runs of each result; the All automations row counts every run.`,\n                ]\n              : []),\n          ],\n        },\n      }\n    },\n  }\n}\n\n/** Registers the automation runs reader from the console surface, where insight jobs run. */\nexport function registerAutomationRunFigureReader(firestore: () => Firestore): void {\n  registerPluginFigureReader(automationRunFigureReader(firestore), { pluginId: BUNDLE_ID })\n}\n"],"names":["PLUGIN_FIGURE_MAX_ROWS","pluginFigureChange","pluginFigureWindows","registerPluginFigureReader","BUNDLE_ID","AUTOMATION_RUN_FIGURES_WINDOW_CEILING","WINDOWS","runsOf","firestore","hostId","result","startMs","endMs","collection","doc","where","Date","countOf","query","snapshot","count","get","Number","data","byAutomation","orderBy","select","limit","names","Map","docs","slice","target","name","trim","set","truncated","length","failureRate","counts","total","succeeded","failed","Math","round","automationRunFigureReader","id","label","description","scope","windows","read","request","ok","status","error","includes","days","db","current","previous","now","before","okRuns","failedRuns","Promise","all","then","a","b","automations","ranked","entries","sort","localeCompare","totals","table","title","source","path","period","from","to","columns","key","kind","rows","automation","change","map","omitted","max","notes","toLocaleString","registerAutomationRunFigureReader","pluginId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,sBAAsB,EACtBC,kBAAkB,EAClBC,mBAAmB,EACnBC,0BAA0B,QAErB,6CAA4C;AACnD,SAASC,SAAS,QAAQ,gCAA4B;AAmBtD,sEAAsE,GACtE,OAAO,MAAMC,wCAAwC,IAAG;AAExD,MAAMC,UAA6B;IAAC;IAAG;IAAI;IAAI;CAAG;AAOlD,SAASC,OACPC,SAAoB,EACpBC,MAAc,EACdC,MAA8B,EAC9BC,OAAe,EACfC,KAAa;IAEb,OAAOJ,UACJK,UAAU,CAAC,SACXC,GAAG,CAACL,QACJI,UAAU,CAAC,YACXE,KAAK,CAAC,UAAU,MAAML,QACtBK,KAAK,CAAC,aAAa,MAAM,IAAIC,KAAKL,UAClCI,KAAK,CAAC,aAAa,KAAK,IAAIC,KAAKJ;AACtC;AAEA,eAAeK,QAAQC,KAA8B;IACnD,MAAMC,WAAW,MAAMD,MAAME,KAAK,GAAGC,GAAG;IACxC,OAAOC,OAAOH,SAASI,IAAI,GAAGH,KAAK,KAAK;AAC1C;AAEA,6FAA6F,GAC7F,eAAeI,aACbN,KAA8B;IAE9B,MAAMC,WAAW,MAAMD,MACpBO,OAAO,CAAC,aAAa,QACrBC,MAAM,CAAC,UACPC,KAAK,CAACtB,wCAAwC,GAC9CgB,GAAG;IACN,MAAMO,QAAQ,IAAIC;IAClB,KAAK,MAAMf,OAAOK,SAASW,IAAI,CAACC,KAAK,CAAC,GAAG1B,uCAAwC;YAC/DS,UAGCc;QAHjB,MAAMI,UAAUlB,WAAAA,IAAIO,GAAG,CAAC,qBAARP,WAAqB,CAAC;QACtC,MAAMmB,OACJ,AAAC,OAAOD,OAAOC,IAAI,KAAK,YAAYD,OAAOC,IAAI,CAACC,IAAI,MAAO;QAC7DN,MAAMO,GAAG,CAACF,MAAM,EAACL,aAAAA,MAAMP,GAAG,CAACY,iBAAVL,aAAmB,KAAK;IAC3C;IACA,OAAO;QAAEA;QAAOQ,WAAWjB,SAASW,IAAI,CAACO,MAAM,GAAGhC;IAAsC;AAC1F;AAEA,MAAMiC,cAAc,CAACC;IACnB,MAAMC,QAAQD,OAAOE,SAAS,GAAGF,OAAOG,MAAM;IAC9C,OAAOF,QAAQ,IAAIG,KAAKC,KAAK,CAAC,AAACL,OAAOG,MAAM,GAAGF,QAAS,QAAS,KAAK;AACxE;AAEA,OAAO,SAASK,0BAA0BrC,SAA0B;IAClE,OAAO;QACLsC,IAAI;QACJC,OAAO;QACPC,aACE;QACFC,OAAO;QACPC,SAAS5C;QACT6C,MAAM,OAAOC;YACX,IAAI,CAACA,QAAQ3C,MAAM,EAAE,OAAO;gBAAE4C,IAAI;gBAAOC,QAAQ;gBAAKC,OAAO;YAA0C;YACvG,IAAI,CAACjD,QAAQkD,QAAQ,CAACJ,QAAQK,IAAI,GAAG;gBACnC,OAAO;oBAAEJ,IAAI;oBAAOC,QAAQ;oBAAKC,OAAO;gBAAuD;YACjG;YACA,MAAMG,KAAKlD;YACX,MAAMC,SAAS2C,QAAQ3C,MAAM;YAC7B,MAAM,EAAEkD,OAAO,EAAEC,QAAQ,EAAE,GAAG1D,oBAAoBkD,QAAQS,GAAG,EAAET,QAAQK,IAAI;YAC3E,MAAM,CAAChB,WAAWC,QAAQoB,QAAQC,QAAQC,WAAW,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBACxEjD,QAAQV,OAAOmD,IAAIjD,QAAQ,aAAakD,QAAQhD,OAAO,EAAEgD,QAAQ/C,KAAK;gBACtEK,QAAQV,OAAOmD,IAAIjD,QAAQ,UAAUkD,QAAQhD,OAAO,EAAEgD,QAAQ/C,KAAK;gBACnEqD,QAAQC,GAAG,CAAC;oBACVjD,QAAQV,OAAOmD,IAAIjD,QAAQ,aAAamD,SAASjD,OAAO,EAAEiD,SAAShD,KAAK;oBACxEK,QAAQV,OAAOmD,IAAIjD,QAAQ,UAAUmD,SAASjD,OAAO,EAAEiD,SAAShD,KAAK;iBACtE,EAAEuD,IAAI,CAAC,CAAC,CAACC,GAAGC,EAAE,GAAKD,IAAIC;gBACxB7C,aAAajB,OAAOmD,IAAIjD,QAAQ,aAAakD,QAAQhD,OAAO,EAAEgD,QAAQ/C,KAAK;gBAC3EY,aAAajB,OAAOmD,IAAIjD,QAAQ,UAAUkD,QAAQhD,OAAO,EAAEgD,QAAQ/C,KAAK;aACzE;YACD,MAAM0D,cAAc,IAAIzC;YACxB,KAAK,MAAM,CAACI,MAAMb,MAAM,IAAI2C,OAAOnC,KAAK,CAAE;;oBACU0C;gBAAlDA,YAAYnC,GAAG,CAACF,MAAM;oBAAEQ,WAAWrB;oBAAOsB,MAAM,WAAE4B,mBAAAA,YAAYjD,GAAG,CAACY,0BAAhBqC,iBAAuB5B,MAAM,mBAAI;gBAAE;YACvF;YACA,KAAK,MAAM,CAACT,MAAMb,MAAM,IAAI4C,WAAWpC,KAAK,CAAE;;oBACT0C;gBAAnCA,YAAYnC,GAAG,CAACF,MAAM;oBAAEQ,SAAS,YAAE6B,oBAAAA,YAAYjD,GAAG,CAACY,0BAAhBqC,kBAAuB7B,SAAS,oBAAI;oBAAGC,QAAQtB;gBAAM;YAC1F;YACA,uEAAuE;YACvE,MAAMmD,SAAS;mBAAID,YAAYE,OAAO;aAAG,CAACC,IAAI,CAC5C,CAACL,GAAGC,IAAMA,CAAC,CAAC,EAAE,CAAC3B,MAAM,GAAG0B,CAAC,CAAC,EAAE,CAAC1B,MAAM,IAAI2B,CAAC,CAAC,EAAE,CAAC5B,SAAS,GAAG2B,CAAC,CAAC,EAAE,CAAC3B,SAAS,IAAI2B,CAAC,CAAC,EAAE,CAACM,aAAa,CAACL,CAAC,CAAC,EAAE;YAEnG,MAAMM,SAAS;gBAAElC;gBAAWC;YAAO;YACnC,OAAO;gBACLW,IAAI;gBACJuB,OAAO;oBACLC,OAAO;oBACPC,QAAQ;wBAAE/B,OAAO;wBAAcgC,MAAM;oBAAa;oBAClDC,QAAQ;wBAAEC,MAAMtB,QAAQsB,IAAI;wBAAEC,IAAIvB,QAAQuB,EAAE;wBAAEzB,MAAML,QAAQK,IAAI;oBAAC;oBACjE0B,SAAS;wBACP;4BAAEC,KAAK;4BAAcrC,OAAO;4BAAcsC,MAAM;wBAAO;wBACvD;4BAAED,KAAK;4BAAarC,OAAO;4BAAasC,MAAM;wBAAQ;wBACtD;4BAAED,KAAK;4BAAUrC,OAAO;4BAAUsC,MAAM;wBAAQ;wBAChD;4BAAED,KAAK;4BAAerC,OAAO;4BAAgBsC,MAAM;wBAAU;wBAC7D;4BAAED,KAAK;4BAAUrC,OAAO;4BAAkBsC,MAAM;wBAAS;qBAC1D;oBACDC,MAAM;wBACJ;4BACEC,YAAY;4BACZ9C;4BACAC;4BACAJ,aAAaA,YAAYqC;4BACzBa,QAAQvF,mBAAmBwC,YAAYC,QAAQoB;wBACjD;2BACGS,OAAOxC,KAAK,CAAC,GAAG/B,yBAAyB,GAAGyF,GAAG,CAAC,CAAC,CAACF,YAAYhD,OAAO,GAAM,CAAA;gCAC5EgD;gCACA9C,WAAWF,OAAOE,SAAS;gCAC3BC,QAAQH,OAAOG,MAAM;gCACrBJ,aAAaA,YAAYC;gCACzBiD,QAAQ;4BACV,CAAA;qBACD;oBACDE,SAAS/C,KAAKgD,GAAG,CAAC,GAAGpB,OAAOlC,MAAM,GAAIrC,CAAAA,yBAAyB,CAAA;oBAC/D4F,OAAO;wBACL;2BACI7B,OAAO3B,SAAS,IAAI4B,WAAW5B,SAAS,GACxC;4BACE,CAAC,+CAA+C,EAAE/B,sCAAsCwF,cAAc,CAAC,SAAS,+DAA+D,CAAC;yBACjL,GACD,EAAE;qBACP;gBACH;YACF;QACF;IACF;AACF;AAEA,2FAA2F,GAC3F,OAAO,SAASC,kCAAkCtF,SAA0B;IAC1EL,2BAA2B0C,0BAA0BrC,YAAY;QAAEuF,UAAU3F;IAAU;AACzF"}

package/src/lib/server-console.js

@@ -14,10 +14,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ import { registerPluginApiRoute } from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin/server/firebase-admin";
 import { registerWorkflowsServerDeclarations } from "./declarations.server.js";
 import { registerAutomationDraftWriter } from "./server-automation-drafts.js";
 import { ACTION_TEST_RUN_API_ROUTE, actionTestRunHandler } from "./server/action-test-run-route.js";
 import { ORG_AUTOMATION_API_ROUTES, orgAutomationPauseHandler, orgAutomationsManageHandler, orgAutomationsManageSubject } from "./server/org-automations-routes.js";
+import { registerAutomationRunFigureReader } from "./server/automation-run-figures.js";
 /**
  * The workflows plugin's console server surface (AGL-2919).
  *
@@ -43,6 +45,9 @@ import { ORG_AUTOMATION_API_ROUTES, orgAutomationPauseHandler, orgAutomationsMan
     registerPluginApiRoute(ORG_AUTOMATION_API_ROUTES.pause, orgAutomationPauseHandler);
     // So does a test run: a site with Automation switched off has no such door.
     registerPluginApiRoute(ACTION_TEST_RUN_API_ROUTE, actionTestRunHandler);
+    // Automation runs as a figure table (AGL-3603), for the AI plugin's
+    // insights to read by id; the console runs insight jobs.
+    registerAutomationRunFigureReader(()=>firebaseAdmin.app().firestore());
 }
 
 //# sourceMappingURL=server-console.js.map

package/src/lib/server-console.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginApiRoute } from '@aglyn/aglyn/server'\nimport { registerWorkflowsServerDeclarations } from './declarations.server'\nimport { registerAutomationDraftWriter } from './server-automation-drafts'\nimport {\n  ACTION_TEST_RUN_API_ROUTE,\n  actionTestRunHandler,\n} from './server/action-test-run-route'\nimport {\n  ORG_AUTOMATION_API_ROUTES,\n  orgAutomationPauseHandler,\n  orgAutomationsManageHandler,\n  orgAutomationsManageSubject,\n} from './server/org-automations-routes'\n\n/**\n * The workflows plugin's console server surface (AGL-2919).\n *\n * The tenant surface (`registerWorkflowsApi`) serves the inbound webhook a\n * visitor-facing integration calls. This one serves what only the console\n * does: the automation draft writer another plugin reaches through the core's\n * resource-drafts seam, which the AI jobs that write through it — inline at a\n * door and on the beat — find registered in the console process alone\n * (AGL-3026); the doors that write the organization's automations\n * (AGL-3302); and the Actions card's test run (AGL-3309).\n */\nexport function registerWorkflowsConsoleApi(): void {\n  // The console raises host events too — a CRM stage moved, a deal won, a\n  // task completed — so the engine's listener is registered here as well as\n  // at boot (see `declarations.server.ts`).\n  registerWorkflowsServerDeclarations()\n  registerAutomationDraftWriter()\n  // The organization hub names its org and no site, so the route names that\n  // org as its subject for the release gate.\n  registerPluginApiRoute(\n    ORG_AUTOMATION_API_ROUTES.manage,\n    orgAutomationsManageHandler,\n    { subject: orgAutomationsManageSubject },\n  )\n  // A site's own pause names the site, and is gated by that site's switch.\n  registerPluginApiRoute(ORG_AUTOMATION_API_ROUTES.pause, orgAutomationPauseHandler)\n  // So does a test run: a site with Automation switched off has no such door.\n  registerPluginApiRoute(ACTION_TEST_RUN_API_ROUTE, actionTestRunHandler)\n}\n"],"names":["registerPluginApiRoute","registerWorkflowsServerDeclarations","registerAutomationDraftWriter","ACTION_TEST_RUN_API_ROUTE","actionTestRunHandler","ORG_AUTOMATION_API_ROUTES","orgAutomationPauseHandler","orgAutomationsManageHandler","orgAutomationsManageSubject","registerWorkflowsConsoleApi","manage","subject","pause"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,mCAAmC,QAAQ,2BAAuB;AAC3E,SAASC,6BAA6B,QAAQ,gCAA4B;AAC1E,SACEC,yBAAyB,EACzBC,oBAAoB,QACf,oCAAgC;AACvC,SACEC,yBAAyB,EACzBC,yBAAyB,EACzBC,2BAA2B,EAC3BC,2BAA2B,QACtB,qCAAiC;AAExC;;;;;;;;;;CAUC,GACD,OAAO,SAASC;IACd,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1CR;IACAC;IACA,0EAA0E;IAC1E,2CAA2C;IAC3CF,uBACEK,0BAA0BK,MAAM,EAChCH,6BACA;QAAEI,SAASH;IAA4B;IAEzC,yEAAyE;IACzER,uBAAuBK,0BAA0BO,KAAK,EAAEN;IACxD,4EAA4E;IAC5EN,uBAAuBG,2BAA2BC;AACpD"}
+{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerPluginApiRoute } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { registerWorkflowsServerDeclarations } from './declarations.server'\nimport { registerAutomationDraftWriter } from './server-automation-drafts'\nimport {\n  ACTION_TEST_RUN_API_ROUTE,\n  actionTestRunHandler,\n} from './server/action-test-run-route'\nimport {\n  ORG_AUTOMATION_API_ROUTES,\n  orgAutomationPauseHandler,\n  orgAutomationsManageHandler,\n  orgAutomationsManageSubject,\n} from './server/org-automations-routes'\nimport { registerAutomationRunFigureReader } from './server/automation-run-figures'\n\n/**\n * The workflows plugin's console server surface (AGL-2919).\n *\n * The tenant surface (`registerWorkflowsApi`) serves the inbound webhook a\n * visitor-facing integration calls. This one serves what only the console\n * does: the automation draft writer another plugin reaches through the core's\n * resource-drafts seam, which the AI jobs that write through it — inline at a\n * door and on the beat — find registered in the console process alone\n * (AGL-3026); the doors that write the organization's automations\n * (AGL-3302); and the Actions card's test run (AGL-3309).\n */\nexport function registerWorkflowsConsoleApi(): void {\n  // The console raises host events too — a CRM stage moved, a deal won, a\n  // task completed — so the engine's listener is registered here as well as\n  // at boot (see `declarations.server.ts`).\n  registerWorkflowsServerDeclarations()\n  registerAutomationDraftWriter()\n  // The organization hub names its org and no site, so the route names that\n  // org as its subject for the release gate.\n  registerPluginApiRoute(\n    ORG_AUTOMATION_API_ROUTES.manage,\n    orgAutomationsManageHandler,\n    { subject: orgAutomationsManageSubject },\n  )\n  // A site's own pause names the site, and is gated by that site's switch.\n  registerPluginApiRoute(ORG_AUTOMATION_API_ROUTES.pause, orgAutomationPauseHandler)\n  // So does a test run: a site with Automation switched off has no such door.\n  registerPluginApiRoute(ACTION_TEST_RUN_API_ROUTE, actionTestRunHandler)\n  // Automation runs as a figure table (AGL-3603), for the AI plugin's\n  // insights to read by id; the console runs insight jobs.\n  registerAutomationRunFigureReader(() => firebaseAdmin.app().firestore())\n}\n"],"names":["registerPluginApiRoute","firebaseAdmin","registerWorkflowsServerDeclarations","registerAutomationDraftWriter","ACTION_TEST_RUN_API_ROUTE","actionTestRunHandler","ORG_AUTOMATION_API_ROUTES","orgAutomationPauseHandler","orgAutomationsManageHandler","orgAutomationsManageSubject","registerAutomationRunFigureReader","registerWorkflowsConsoleApi","manage","subject","pause","app","firestore"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,aAAa,QAAQ,iDAAgD;AAC9E,SAASC,mCAAmC,QAAQ,2BAAuB;AAC3E,SAASC,6BAA6B,QAAQ,gCAA4B;AAC1E,SACEC,yBAAyB,EACzBC,oBAAoB,QACf,oCAAgC;AACvC,SACEC,yBAAyB,EACzBC,yBAAyB,EACzBC,2BAA2B,EAC3BC,2BAA2B,QACtB,qCAAiC;AACxC,SAASC,iCAAiC,QAAQ,qCAAiC;AAEnF;;;;;;;;;;CAUC,GACD,OAAO,SAASC;IACd,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1CT;IACAC;IACA,0EAA0E;IAC1E,2CAA2C;IAC3CH,uBACEM,0BAA0BM,MAAM,EAChCJ,6BACA;QAAEK,SAASJ;IAA4B;IAEzC,yEAAyE;IACzET,uBAAuBM,0BAA0BQ,KAAK,EAAEP;IACxD,4EAA4E;IAC5EP,uBAAuBI,2BAA2BC;IAClD,oEAAoE;IACpE,yDAAyD;IACzDK,kCAAkC,IAAMT,cAAcc,GAAG,GAAGC,SAAS;AACvE"}