@fragno-dev/backoffice-api 0.0.0-stage → 0.0.0

package/dist/v0/automation.d.ts

@@ -0,0 +1,730 @@
+import { BackofficePermissionRequirement } from "./shared/permissions.js";
+import { z } from "zod";
+//#region src/v0/automation.d.ts
+type AutomationExternalEntityRef<TSource extends string = string, TType extends string = string> = {
+  scope: "external";
+  source: TSource;
+  type: TType;
+  id: string;
+};
+type AutomationEntityRef<TType extends string = string> = {
+  scope: "internal";
+  type: TType;
+  id: string;
+} | AutomationExternalEntityRef<string, TType>;
+type AutomationActorRole = "initiator" | "principal" | "delegate" | "assistant";
+type AutomationActor<TRole extends AutomationActorRole = AutomationActorRole> = AutomationEntityRef & {
+  role: TRole;
+};
+type AutomationActors = Readonly<{
+  initiator: AutomationActor<"initiator">;
+  principal: AutomationActor<"principal"> | null;
+  delegation: readonly (AutomationActor<"delegate"> | AutomationActor<"assistant">)[];
+}>;
+declare const automationEntityRefsEqual: (left: AutomationEntityRef, right: AutomationEntityRef) => boolean;
+declare const automationDelegatedActorSchema: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+  scope: z.ZodLiteral<"internal">;
+  type: z.ZodString;
+  id: z.ZodString;
+  role: z.ZodLiteral<"delegate">;
+}, z.core.$strict>, z.ZodObject<{
+  scope: z.ZodLiteral<"external">;
+  source: z.ZodString;
+  type: z.ZodString;
+  id: z.ZodString;
+  role: z.ZodLiteral<"delegate">;
+}, z.core.$strict>], "scope">>, z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+  scope: z.ZodLiteral<"internal">;
+  type: z.ZodString;
+  id: z.ZodString;
+  role: z.ZodLiteral<"assistant">;
+}, z.core.$strict>, z.ZodObject<{
+  scope: z.ZodLiteral<"external">;
+  source: z.ZodString;
+  type: z.ZodString;
+  id: z.ZodString;
+  role: z.ZodLiteral<"assistant">;
+}, z.core.$strict>], "scope">>], "role">>;
+declare const automationActorsSchema: z.ZodType<AutomationActors>;
+/**
+ * Explicit grants narrow the user's authority. `inherit` leaves the user's current permissions
+ * unrestricted by the route delegate.
+ */
+type AutomationUserRouteGrants = readonly BackofficePermissionRequirement[] | "inherit";
+/**
+ * Selects whose current permissions authorize protected work started by an automation route.
+ *
+ * A delegate is an additional capability boundary, not an impersonated principal. The kernel
+ * requires both the principal and every delegate to grant an operation, so delegation can narrow
+ * authority but can never give the principal permissions they do not already have.
+ */
+type AutomationAuthorityMode = {
+  /**
+   * Run on behalf of the internal user principal carried by the triggering event.
+   *
+   * The user remains the principal and the stable route automation identity is appended as a
+   * delegate. For each protected operation, the authority resolver looks up the user's current
+   * role, status, and organization membership, then resolves the internal automation delegate
+   * from the owning route's current grants. The kernel requires both resulting grant sets to
+   * contain the operation. Missing, disabled, or changed routes and missing, invalid, banned,
+   * or no-longer-authorized users therefore fail closed. The delegate can restrict but never
+   * elevate the user.
+   */
+  kind: "delegated-user";
+  grants: AutomationUserRouteGrants;
+} | {
+  /**
+   * Resolve the external initiator's active identity binding before starting the workflow.
+   *
+   * The linked internal user becomes the principal and the stable route automation identity is
+   * appended as a delegate. Events without an active binding do not start the workflow.
+   */
+  kind: "linked-user";
+  grants: AutomationUserRouteGrants;
+} | {
+  /**
+   * Run as an organization-owned automation independently of the triggering user's authority.
+   *
+   * The stable `automation-route:<routeId>` identity becomes the principal while the original
+   * initiator remains provenance and supplies no authority. For each protected operation, the
+   * authority resolver reads the owning route's current grants. The stable route ID provides
+   * identity for persistence and auditing while making grant changes and route disablement
+   * visible to already-running workflows. The route can therefore continue after its creator or
+   * triggering user loses organization access, while remaining limited to its current explicit
+   * grants.
+   */
+  kind: "organization-automation";
+  grants: readonly BackofficePermissionRequirement[];
+};
+declare const automationScheduleCadenceSchema: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+  kind: z.ZodLiteral<"once">;
+  at: z.ZodISODateTime;
+}, z.core.$strip>, z.ZodObject<{
+  kind: z.ZodLiteral<"cron">;
+  expression: z.ZodString;
+  timeZone: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>], "kind">>;
+type AutomationScheduleCadence = z.infer<typeof automationScheduleCadenceSchema>;
+type AutomationActorIdentityMatcher = {
+  scope: "internal";
+  source?: never;
+  type?: string;
+  id?: string;
+} | {
+  scope: "external";
+  source?: string;
+  type?: string;
+  id?: string;
+};
+type AutomationActorMatcher = (AutomationActorIdentityMatcher & {
+  participation: "initiator";
+}) | (AutomationActorIdentityMatcher & {
+  participation: "principal";
+}) | (AutomationActorIdentityMatcher & {
+  participation: "delegation";
+  role?: Extract<AutomationActorRole, "delegate" | "assistant">;
+});
+type AutomationEventMatcher = {
+  actor: AutomationActorMatcher;
+} | {
+  path: string;
+  op: "exists";
+} | {
+  path: string;
+  op: "eq" | "neq" | "startsWith" | "includes";
+  value: unknown;
+} | {
+  all: AutomationEventMatcher[];
+} | {
+  any: AutomationEventMatcher[];
+} | {
+  not: AutomationEventMatcher;
+};
+type AutomationRouteRootOwnerTemplate = {
+  kind: "org";
+  orgIdTemplate: string;
+} | {
+  kind: "user";
+  userIdTemplate: string;
+};
+type AutomationRouteAppScopeTemplate = {
+  kind: "app";
+  owner: AutomationRouteRootOwnerTemplate;
+  appIdTemplate: string;
+};
+/** Renders to a target scope; app and project scopes name their owner as a scope template too. */
+type AutomationRouteScopeTemplate = {
+  kind: "system";
+} | AutomationRouteRootOwnerTemplate | AutomationRouteAppScopeTemplate | {
+  kind: "project";
+  owner: AutomationRouteRootOwnerTemplate | AutomationRouteAppScopeTemplate;
+  projectIdTemplate: string;
+};
+type AutomationStartWorkflowAction = {
+  kind: "start_workflow";
+  authority: AutomationAuthorityMode;
+  workflowScriptPath: string;
+  instanceIdTemplate: string;
+};
+type AutomationWorkflowEventTarget = {
+  kind: "instance_id";
+  template: string;
+} | {
+  kind: "stored_instance_id";
+  keyTemplate: string;
+};
+type AutomationSendWorkflowEventAction = {
+  kind: "send_workflow_event";
+  target: AutomationWorkflowEventTarget;
+  eventType: string;
+  payload?: unknown;
+};
+type AutomationForwardEventAction = {
+  kind: "forward_event";
+  targetScope: AutomationRouteScopeTemplate;
+  idTemplate?: string;
+};
+type AutomationEventPayloadProjection = {
+  kind: "projection";
+  fields: Record<string, string>;
+};
+type AutomationReclassifyEventAction = {
+  kind: "reclassify_event";
+  source: string;
+  eventType: string;
+  payload: AutomationEventPayloadProjection;
+};
+/** Delivers the event to an agent in the route's scope as a turn run with the route's authority. */
+type AutomationNotifyAgentAction = {
+  kind: "notify_agent";
+  agentName: string;
+  authority: AutomationAuthorityMode;
+};
+type AutomationRouteAction = AutomationStartWorkflowAction | AutomationSendWorkflowEventAction | AutomationForwardEventAction | AutomationReclassifyEventAction | AutomationNotifyAgentAction;
+/** The authority an action runs its work with, or null for actions that only move events. */
+declare function automationRouteActionAuthority(action: AutomationRouteAction): AutomationAuthorityMode | null;
+type AutomationRouteEventTrigger = {
+  kind: "event";
+  source: string;
+  eventType: string;
+  matcher: AutomationEventMatcher | null;
+};
+type AutomationRouteScheduleTrigger = {
+  kind: "schedule";
+  cadence: AutomationScheduleCadence;
+};
+type AutomationRouteTrigger = AutomationRouteEventTrigger | AutomationRouteScheduleTrigger;
+type AutomationRouteManagedBy = {
+  kind: "marketplace";
+  listingId: string;
+  resourceKey: string;
+  version: string;
+};
+type AutomationRouteMetadata = {
+  createdByActors: AutomationActors;
+  updatedByActors: AutomationActors;
+  managedBy: AutomationRouteManagedBy | null;
+};
+/** Persisted routes may predate the authority rules enforced on create and activation. */
+type AutomationRouteDefinition = {
+  trigger: AutomationRouteTrigger;
+  action: AutomationRouteAction;
+  id: string;
+  name: string;
+  enabled: boolean;
+  priority: number;
+  description?: string | null;
+  metadata?: AutomationRouteMetadata | null;
+  nextOccurrenceAt: string | null;
+};
+declare const isAutomationActorProvenancePath: (path: string) => boolean;
+/** Scheduled routes have no triggering user, so only organization authority can start workflows. */
+declare const AUTOMATION_ROUTE_AUTHORITY_ERROR_MESSAGE = "Scheduled workflows and agent notifications require organization-automation authority. Linked-user authority requires an external sender; delegated-user authority requires a user principal.";
+declare const automationRouteActionSchema: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+  kind: z.ZodLiteral<"start_workflow">;
+  authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"delegated-user">;
+    grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"linked-user">;
+    grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+  }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"organization-automation">;
+    grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+  }, z.core.$strict>>], "kind">>;
+  workflowScriptPath: z.ZodString;
+  instanceIdTemplate: z.ZodString;
+}, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+  kind: z.ZodLiteral<"send_workflow_event">;
+  target: z.ZodType<AutomationWorkflowEventTarget, unknown, z.core.$ZodTypeInternals<AutomationWorkflowEventTarget, unknown>>;
+  eventType: z.ZodString;
+  payload: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+  kind: z.ZodLiteral<"forward_event">;
+  targetScope: z.ZodType<AutomationRouteScopeTemplate, unknown, z.core.$ZodTypeInternals<AutomationRouteScopeTemplate, unknown>>;
+  idTemplate: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>, z.ZodLazy<z.ZodObject<{
+  kind: z.ZodLiteral<"reclassify_event">;
+  source: z.ZodString;
+  eventType: z.ZodString;
+  payload: z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"projection">;
+    fields: z.ZodRecord<z.ZodString, z.ZodString>;
+  }, z.core.$strict>>;
+}, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+  kind: z.ZodLiteral<"notify_agent">;
+  agentName: z.ZodLazy<z.ZodString>;
+  authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"delegated-user">;
+    grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"linked-user">;
+    grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+  }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"organization-automation">;
+    grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+  }, z.core.$strict>>], "kind">>;
+}, z.core.$strict>>], "kind">>;
+declare const automationRouteManagedBySchema: z.ZodType<AutomationRouteManagedBy>;
+declare const automationRouteSchema: z.ZodType<AutomationRouteDefinition>;
+declare const automationRouteCreateInputSchema: z.ZodLazy<z.ZodIntersection<z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodString;
+  enabled: z.ZodDefault<z.ZodBoolean>;
+  priority: z.ZodDefault<z.ZodNumber>;
+  description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  managedBy: z.ZodOptional<z.ZodNullable<z.ZodType<AutomationRouteManagedBy, unknown, z.core.$ZodTypeInternals<AutomationRouteManagedBy, unknown>>>>;
+}, z.core.$strip>, z.ZodLazy<z.ZodUnion<readonly [z.ZodObject<{
+  trigger: z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"event">;
+    source: z.ZodString;
+    eventType: z.ZodString;
+    matcher: z.ZodDefault<z.ZodNullable<z.ZodType<AutomationEventMatcher, unknown, z.core.$ZodTypeInternals<AutomationEventMatcher, unknown>>>>;
+  }, z.core.$strip>>;
+  action: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"start_workflow">;
+    authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"delegated-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"linked-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"organization-automation">;
+      grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+    }, z.core.$strict>>], "kind">>;
+    workflowScriptPath: z.ZodString;
+    instanceIdTemplate: z.ZodString;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"send_workflow_event">;
+    target: z.ZodType<AutomationWorkflowEventTarget, unknown, z.core.$ZodTypeInternals<AutomationWorkflowEventTarget, unknown>>;
+    eventType: z.ZodString;
+    payload: z.ZodOptional<z.ZodUnknown>;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"forward_event">;
+    targetScope: z.ZodType<AutomationRouteScopeTemplate, unknown, z.core.$ZodTypeInternals<AutomationRouteScopeTemplate, unknown>>;
+    idTemplate: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"reclassify_event">;
+    source: z.ZodString;
+    eventType: z.ZodString;
+    payload: z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"projection">;
+      fields: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"notify_agent">;
+    agentName: z.ZodLazy<z.ZodString>;
+    authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"delegated-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"linked-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"organization-automation">;
+      grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+    }, z.core.$strict>>], "kind">>;
+  }, z.core.$strict>>], "kind">>;
+}, z.core.$strip>, z.ZodObject<{
+  trigger: z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"schedule">;
+    cadence: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"once">;
+      at: z.ZodISODateTime;
+    }, z.core.$strip>, z.ZodObject<{
+      kind: z.ZodLiteral<"cron">;
+      expression: z.ZodString;
+      timeZone: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>], "kind">>;
+  }, z.core.$strip>>;
+  action: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"start_workflow">;
+    workflowScriptPath: z.ZodString;
+    instanceIdTemplate: z.ZodString;
+    authority: z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"organization-automation">;
+      grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"send_workflow_event">;
+    target: z.ZodType<AutomationWorkflowEventTarget, unknown, z.core.$ZodTypeInternals<AutomationWorkflowEventTarget, unknown>>;
+    eventType: z.ZodString;
+    payload: z.ZodOptional<z.ZodUnknown>;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"forward_event">;
+    targetScope: z.ZodType<AutomationRouteScopeTemplate, unknown, z.core.$ZodTypeInternals<AutomationRouteScopeTemplate, unknown>>;
+    idTemplate: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"reclassify_event">;
+    source: z.ZodString;
+    eventType: z.ZodString;
+    payload: z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"projection">;
+      fields: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>, z.ZodObject<{
+    kind: z.ZodLiteral<"notify_agent">;
+    agentName: z.ZodLazy<z.ZodString>;
+    authority: z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"organization-automation">;
+      grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>]>;
+}, z.core.$strip>]>>>>;
+declare const automationRouteUpdatePayloadSchema: z.ZodLazy<z.ZodObject<{
+  description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  name: z.ZodOptional<z.ZodString>;
+  enabled: z.ZodOptional<z.ZodBoolean>;
+  priority: z.ZodOptional<z.ZodNumber>;
+  managedBy: z.ZodOptional<z.ZodNullable<z.ZodType<AutomationRouteManagedBy, unknown, z.core.$ZodTypeInternals<AutomationRouteManagedBy, unknown>>>>;
+  trigger: z.ZodOptional<z.ZodType<AutomationRouteTrigger, unknown, z.core.$ZodTypeInternals<AutomationRouteTrigger, unknown>>>;
+  action: z.ZodOptional<z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"start_workflow">;
+    authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"delegated-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"linked-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"organization-automation">;
+      grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+    }, z.core.$strict>>], "kind">>;
+    workflowScriptPath: z.ZodString;
+    instanceIdTemplate: z.ZodString;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"send_workflow_event">;
+    target: z.ZodType<AutomationWorkflowEventTarget, unknown, z.core.$ZodTypeInternals<AutomationWorkflowEventTarget, unknown>>;
+    eventType: z.ZodString;
+    payload: z.ZodOptional<z.ZodUnknown>;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"forward_event">;
+    targetScope: z.ZodType<AutomationRouteScopeTemplate, unknown, z.core.$ZodTypeInternals<AutomationRouteScopeTemplate, unknown>>;
+    idTemplate: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"reclassify_event">;
+    source: z.ZodString;
+    eventType: z.ZodString;
+    payload: z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"projection">;
+      fields: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"notify_agent">;
+    agentName: z.ZodLazy<z.ZodString>;
+    authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"delegated-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"linked-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"organization-automation">;
+      grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+    }, z.core.$strict>>], "kind">>;
+  }, z.core.$strict>>], "kind">>>;
+}, z.core.$strip>>;
+declare const automationRouteUpdateInputSchema: z.ZodLazy<z.ZodLazy<z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodOptional<z.ZodString>;
+  enabled: z.ZodOptional<z.ZodBoolean>;
+  priority: z.ZodOptional<z.ZodNumber>;
+  trigger: z.ZodOptional<z.ZodType<AutomationRouteTrigger, unknown, z.core.$ZodTypeInternals<AutomationRouteTrigger, unknown>>>;
+  action: z.ZodOptional<z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"start_workflow">;
+    authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"delegated-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"linked-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"organization-automation">;
+      grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+    }, z.core.$strict>>], "kind">>;
+    workflowScriptPath: z.ZodString;
+    instanceIdTemplate: z.ZodString;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"send_workflow_event">;
+    target: z.ZodType<AutomationWorkflowEventTarget, unknown, z.core.$ZodTypeInternals<AutomationWorkflowEventTarget, unknown>>;
+    eventType: z.ZodString;
+    payload: z.ZodOptional<z.ZodUnknown>;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"forward_event">;
+    targetScope: z.ZodType<AutomationRouteScopeTemplate, unknown, z.core.$ZodTypeInternals<AutomationRouteScopeTemplate, unknown>>;
+    idTemplate: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"reclassify_event">;
+    source: z.ZodString;
+    eventType: z.ZodString;
+    payload: z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"projection">;
+      fields: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"notify_agent">;
+    agentName: z.ZodLazy<z.ZodString>;
+    authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"delegated-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"linked-user">;
+      grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+    }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"organization-automation">;
+      grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+    }, z.core.$strict>>], "kind">>;
+  }, z.core.$strict>>], "kind">>>;
+  description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  managedBy: z.ZodOptional<z.ZodNullable<z.ZodType<AutomationRouteManagedBy, unknown, z.core.$ZodTypeInternals<AutomationRouteManagedBy, unknown>>>>;
+}, z.core.$strip>>>;
+type AutomationRouteCreateInput = z.infer<typeof automationRouteCreateInputSchema>;
+type AutomationRouteUpdateInput = z.infer<typeof automationRouteUpdateInputSchema>;
+declare const automationRouterOperations: {
+  "router.list": {
+    description: string;
+    permissions: {
+      readonly namespace: "router";
+      readonly permission: "read";
+    }[];
+    input: z.ZodVoid;
+    output: z.ZodLazy<z.ZodArray<z.ZodType<AutomationRouteDefinition, unknown, z.core.$ZodTypeInternals<AutomationRouteDefinition, unknown>>>>;
+  };
+  "router.get": {
+    description: string;
+    permissions: {
+      readonly namespace: "router";
+      readonly permission: "read";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      id: z.ZodString;
+    }, z.core.$strip>>;
+    output: z.ZodLazy<z.ZodNullable<z.ZodType<AutomationRouteDefinition, unknown, z.core.$ZodTypeInternals<AutomationRouteDefinition, unknown>>>>;
+  };
+  "router.create": {
+    description: string;
+    permissions: {
+      readonly namespace: "router";
+      readonly permission: "modify";
+    }[];
+    input: z.ZodLazy<z.ZodIntersection<z.ZodObject<{
+      id: z.ZodString;
+      name: z.ZodString;
+      enabled: z.ZodDefault<z.ZodBoolean>;
+      priority: z.ZodDefault<z.ZodNumber>;
+      description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+      managedBy: z.ZodOptional<z.ZodNullable<z.ZodType<AutomationRouteManagedBy, unknown, z.core.$ZodTypeInternals<AutomationRouteManagedBy, unknown>>>>;
+    }, z.core.$strip>, z.ZodLazy<z.ZodUnion<readonly [z.ZodObject<{
+      trigger: z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"event">;
+        source: z.ZodString;
+        eventType: z.ZodString;
+        matcher: z.ZodDefault<z.ZodNullable<z.ZodType<AutomationEventMatcher, unknown, z.core.$ZodTypeInternals<AutomationEventMatcher, unknown>>>>;
+      }, z.core.$strip>>;
+      action: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"start_workflow">;
+        authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+          kind: z.ZodLiteral<"delegated-user">;
+          grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+        }, z.core.$strict>, z.ZodObject<{
+          kind: z.ZodLiteral<"linked-user">;
+          grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+        }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"organization-automation">;
+          grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+        }, z.core.$strict>>], "kind">>;
+        workflowScriptPath: z.ZodString;
+        instanceIdTemplate: z.ZodString;
+      }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"send_workflow_event">;
+        target: z.ZodType<AutomationWorkflowEventTarget, unknown, z.core.$ZodTypeInternals<AutomationWorkflowEventTarget, unknown>>;
+        eventType: z.ZodString;
+        payload: z.ZodOptional<z.ZodUnknown>;
+      }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"forward_event">;
+        targetScope: z.ZodType<AutomationRouteScopeTemplate, unknown, z.core.$ZodTypeInternals<AutomationRouteScopeTemplate, unknown>>;
+        idTemplate: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"reclassify_event">;
+        source: z.ZodString;
+        eventType: z.ZodString;
+        payload: z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"projection">;
+          fields: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>;
+      }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"notify_agent">;
+        agentName: z.ZodLazy<z.ZodString>;
+        authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+          kind: z.ZodLiteral<"delegated-user">;
+          grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+        }, z.core.$strict>, z.ZodObject<{
+          kind: z.ZodLiteral<"linked-user">;
+          grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+        }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"organization-automation">;
+          grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+        }, z.core.$strict>>], "kind">>;
+      }, z.core.$strict>>], "kind">>;
+    }, z.core.$strip>, z.ZodObject<{
+      trigger: z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"schedule">;
+        cadence: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+          kind: z.ZodLiteral<"once">;
+          at: z.ZodISODateTime;
+        }, z.core.$strip>, z.ZodObject<{
+          kind: z.ZodLiteral<"cron">;
+          expression: z.ZodString;
+          timeZone: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>], "kind">>;
+      }, z.core.$strip>>;
+      action: z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"start_workflow">;
+        workflowScriptPath: z.ZodString;
+        instanceIdTemplate: z.ZodString;
+        authority: z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"organization-automation">;
+          grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+        }, z.core.$strict>>;
+      }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"send_workflow_event">;
+        target: z.ZodType<AutomationWorkflowEventTarget, unknown, z.core.$ZodTypeInternals<AutomationWorkflowEventTarget, unknown>>;
+        eventType: z.ZodString;
+        payload: z.ZodOptional<z.ZodUnknown>;
+      }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"forward_event">;
+        targetScope: z.ZodType<AutomationRouteScopeTemplate, unknown, z.core.$ZodTypeInternals<AutomationRouteScopeTemplate, unknown>>;
+        idTemplate: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"reclassify_event">;
+        source: z.ZodString;
+        eventType: z.ZodString;
+        payload: z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"projection">;
+          fields: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>;
+      }, z.core.$strict>>, z.ZodObject<{
+        kind: z.ZodLiteral<"notify_agent">;
+        agentName: z.ZodLazy<z.ZodString>;
+        authority: z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"organization-automation">;
+          grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+        }, z.core.$strict>>;
+      }, z.core.$strict>]>;
+    }, z.core.$strip>]>>>>;
+    output: z.ZodType<AutomationRouteDefinition, unknown, z.core.$ZodTypeInternals<AutomationRouteDefinition, unknown>>;
+  };
+  "router.update": {
+    description: string;
+    permissions: {
+      readonly namespace: "router";
+      readonly permission: "modify";
+    }[];
+    input: z.ZodLazy<z.ZodLazy<z.ZodObject<{
+      id: z.ZodString;
+      name: z.ZodOptional<z.ZodString>;
+      enabled: z.ZodOptional<z.ZodBoolean>;
+      priority: z.ZodOptional<z.ZodNumber>;
+      trigger: z.ZodOptional<z.ZodType<AutomationRouteTrigger, unknown, z.core.$ZodTypeInternals<AutomationRouteTrigger, unknown>>>;
+      action: z.ZodOptional<z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"start_workflow">;
+        authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+          kind: z.ZodLiteral<"delegated-user">;
+          grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+        }, z.core.$strict>, z.ZodObject<{
+          kind: z.ZodLiteral<"linked-user">;
+          grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+        }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"organization-automation">;
+          grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+        }, z.core.$strict>>], "kind">>;
+        workflowScriptPath: z.ZodString;
+        instanceIdTemplate: z.ZodString;
+      }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"send_workflow_event">;
+        target: z.ZodType<AutomationWorkflowEventTarget, unknown, z.core.$ZodTypeInternals<AutomationWorkflowEventTarget, unknown>>;
+        eventType: z.ZodString;
+        payload: z.ZodOptional<z.ZodUnknown>;
+      }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"forward_event">;
+        targetScope: z.ZodType<AutomationRouteScopeTemplate, unknown, z.core.$ZodTypeInternals<AutomationRouteScopeTemplate, unknown>>;
+        idTemplate: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"reclassify_event">;
+        source: z.ZodString;
+        eventType: z.ZodString;
+        payload: z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"projection">;
+          fields: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>;
+      }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"notify_agent">;
+        agentName: z.ZodLazy<z.ZodString>;
+        authority: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+          kind: z.ZodLiteral<"delegated-user">;
+          grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+        }, z.core.$strict>, z.ZodObject<{
+          kind: z.ZodLiteral<"linked-user">;
+          grants: z.ZodUnion<readonly [z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>, z.ZodLiteral<"inherit">]>;
+        }, z.core.$strict>, z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"organization-automation">;
+          grants: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+        }, z.core.$strict>>], "kind">>;
+      }, z.core.$strict>>], "kind">>>;
+      description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+      managedBy: z.ZodOptional<z.ZodNullable<z.ZodType<AutomationRouteManagedBy, unknown, z.core.$ZodTypeInternals<AutomationRouteManagedBy, unknown>>>>;
+    }, z.core.$strip>>>;
+    output: z.ZodLazy<z.ZodNullable<z.ZodType<AutomationRouteDefinition, unknown, z.core.$ZodTypeInternals<AutomationRouteDefinition, unknown>>>>;
+  };
+  "router.delete": {
+    description: string;
+    permissions: {
+      readonly namespace: "router";
+      readonly permission: "modify";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      id: z.ZodString;
+    }, z.core.$strip>>;
+    output: z.ZodLazy<z.ZodObject<{
+      deleted: z.ZodLiteral<true>;
+    }, z.core.$strip>>;
+  };
+  "router.trigger-now": {
+    description: string;
+    permissions: {
+      readonly namespace: "router";
+      readonly permission: "modify";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      id: z.ZodString;
+    }, z.core.$strip>>;
+    output: z.ZodLazy<z.ZodNullable<z.ZodObject<{
+      accepted: z.ZodLiteral<true>;
+      eventId: z.ZodString;
+    }, z.core.$strip>>>;
+  };
+};
+//#endregion
+export { AUTOMATION_ROUTE_AUTHORITY_ERROR_MESSAGE, AutomationActor, AutomationActorIdentityMatcher, AutomationActorMatcher, AutomationActors, AutomationAuthorityMode, AutomationEntityRef, AutomationEventMatcher, AutomationEventPayloadProjection, AutomationExternalEntityRef, AutomationForwardEventAction, AutomationNotifyAgentAction, AutomationReclassifyEventAction, AutomationRouteAction, AutomationRouteCreateInput, AutomationRouteDefinition, AutomationRouteEventTrigger, AutomationRouteManagedBy, AutomationRouteMetadata, AutomationRouteScheduleTrigger, AutomationRouteScopeTemplate, AutomationRouteTrigger, AutomationRouteUpdateInput, AutomationScheduleCadence, AutomationSendWorkflowEventAction, AutomationStartWorkflowAction, AutomationWorkflowEventTarget, automationActorsSchema, automationDelegatedActorSchema, automationEntityRefsEqual, automationRouteActionAuthority, automationRouteActionSchema, automationRouteCreateInputSchema, automationRouteManagedBySchema, automationRouteSchema, automationRouteUpdateInputSchema, automationRouteUpdatePayloadSchema, automationRouterOperations, automationScheduleCadenceSchema, isAutomationActorProvenancePath };
+//# sourceMappingURL=automation.d.ts.map