@openinc/parse-server-opendash 4.1.8 → 4.2.0

package/dist/features/openservice/serviceSchedules/calendarSync/service/syncPlanToCalendar.d.ts

@@ -0,0 +1,26 @@
+import { CalendarManager } from "../../../schedules/calendarSync/service/CalendarManager.js";
+import { Service_Schedule, Tenant } from "../../../../../types/index.js";
+import type { ServiceSyncConfigValues } from "../types/ServiceSyncTypes.js";
+/**
+ * Write a maintenance plan into the tenant's Outlook calendar.
+ *
+ * The counterpart of `ServiceCalendarSyncPoller`; called from the
+ * `Service_Schedule` afterSave hook. Silent when the tenant has no calendar
+ * connection — the sync is opt-in per tenant, and a missing connection is not
+ * an error.
+ *
+ * Four cases, in this order:
+ *
+ * 1. plan archived or inactive → the appointment is removed; maintenance that
+ *    no longer happens must not sit in someone's calendar;
+ * 2. plan has no date (manual, sensor- or meter-driven) → same, there is
+ *    nothing to show;
+ * 3. plan already linked → the event is updated in place, keeping the time of
+ *    day someone gave it in Outlook;
+ * 4. otherwise → a new event, and a meta entry that links the two.
+ */
+export declare function syncPlanToCalendar(plan: Service_Schedule): Promise<void>;
+export declare function connectionForTenant(tenant: Tenant | undefined): Promise<{
+    manager: CalendarManager;
+    values: ServiceSyncConfigValues;
+} | null>;

package/dist/features/openservice/serviceSchedules/calendarSync/service/syncPlanToCalendar.js

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncPlanToCalendar = syncPlanToCalendar;
+exports.connectionForTenant = connectionForTenant;
+const node_1 = __importDefault(require("parse/node"));
+const CalendarManager_js_1 = require("../../../schedules/calendarSync/service/CalendarManager.js");
+const index_js_1 = require("../../../../../types/index.js");
+const planToEvent_js_1 = require("../functions/planToEvent.js");
+const ServiceSyncTypes_js_1 = require("../types/ServiceSyncTypes.js");
+const serviceCalendarMeta_js_1 = require("./serviceCalendarMeta.js");
+/**
+ * Write a maintenance plan into the tenant's Outlook calendar.
+ *
+ * The counterpart of `ServiceCalendarSyncPoller`; called from the
+ * `Service_Schedule` afterSave hook. Silent when the tenant has no calendar
+ * connection — the sync is opt-in per tenant, and a missing connection is not
+ * an error.
+ *
+ * Four cases, in this order:
+ *
+ * 1. plan archived or inactive → the appointment is removed; maintenance that
+ *    no longer happens must not sit in someone's calendar;
+ * 2. plan has no date (manual, sensor- or meter-driven) → same, there is
+ *    nothing to show;
+ * 3. plan already linked → the event is updated in place, keeping the time of
+ *    day someone gave it in Outlook;
+ * 4. otherwise → a new event, and a meta entry that links the two.
+ */
+async function syncPlanToCalendar(plan) {
+    const connection = await connectionForTenant(plan.get("tenant"));
+    if (!connection)
+        return;
+    const meta = await (0, serviceCalendarMeta_js_1.findMetaForPlan)(plan.id);
+    const values = meta ? (0, serviceCalendarMeta_js_1.metaValues)(meta) : undefined;
+    const eventId = values?.microsoftCalendarEventId;
+    const retired = !!plan.get("deletedAt") || plan.get("active") === false;
+    const event = retired
+        ? undefined
+        : (0, planToEvent_js_1.planToEvent)({
+            title: plan.get("title"),
+            cadence: plan.get("cadence"),
+            steps: plan.get("steps"),
+            notifications: plan.get("notifications"),
+            equipmentName: await equipmentLabel(plan),
+            snapshot: values?.microsoftCalendarEvent,
+        });
+    if (!event) {
+        if (meta && eventId) {
+            await connection.manager.deleteEvent(eventId);
+            await meta.destroy({ useMasterKey: true });
+        }
+        return;
+    }
+    if (meta && eventId) {
+        const updated = await connection.manager.updateEvent(eventId, event);
+        if (updated?.changeKey) {
+            await (0, serviceCalendarMeta_js_1.updateChangeKey)(meta, updated.changeKey, updated);
+        }
+        return;
+    }
+    const created = await connection.manager.createEvent(event);
+    if (!created?.id)
+        return;
+    await (0, serviceCalendarMeta_js_1.saveMeta)(plan.id, created.id, created.changeKey, plan.get("tenant"), created);
+}
+/** The machine's label, for the subject prefix — `undefined` if it has none. */
+async function equipmentLabel(plan) {
+    const equipment = plan.get("equipment");
+    if (!equipment)
+        return undefined;
+    // A pointer straight from a save is unfetched; the label lives on the object.
+    if (!equipment.get("label")) {
+        try {
+            await equipment.fetch({ useMasterKey: true });
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return equipment.get("label") || undefined;
+}
+async function connectionForTenant(tenant) {
+    if (!tenant)
+        return null;
+    const config = await new node_1.default.Query(index_js_1.Config)
+        .equalTo("key", ServiceSyncTypes_js_1.OUTLOOK_CONFIG_KEY)
+        .equalTo("tenant", tenant)
+        .first({ useMasterKey: true });
+    if (!config)
+        return null;
+    let values;
+    try {
+        values = JSON.parse(config.get("value"));
+    }
+    catch {
+        console.error(`[ServiceCalendarSync] Config ${config.id} does not contain valid JSON`);
+        return null;
+    }
+    const manager = new CalendarManager_js_1.CalendarManager({
+        tenantId: values.tenant_id,
+        clientID: values.client_id,
+        clientSecret: values.client_secret,
+        userMail: values.user_email,
+    });
+    const valid = manager.isValid;
+    if (valid !== true) {
+        console.warn(`[ServiceCalendarSync] Connection unusable: ${valid}`);
+        return null;
+    }
+    return { manager, values };
+}

package/dist/features/openservice/serviceSchedules/calendarSync/types/ServiceSyncTypes.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Config key of the Outlook integration. Shared with v1 — one calendar
+ * connection per tenant serves both generations.
+ */
+export declare const OUTLOOK_CONFIG_KEY = "OPENSERVICE_MICROSOFT_OUTLOOK_INTEGRATION";
+/**
+ * The stored configuration of one tenant's calendar connection.
+ *
+ * `default_source_id` is v1's fallback (a `Maintenance_Source`);
+ * `default_equipment_id` is its v2 counterpart (`OD3_Service_Equipment`). Both
+ * live in the same row because the connection is the same — the poller for each
+ * generation reads the key it understands.
+ */
+export type ServiceSyncConfigValues = {
+    tenant_id: string;
+    client_id: string;
+    client_secret: string;
+    user_email: string;
+    /** v1 fallback source. */
+    default_source_id?: string;
+    /** v2 fallback machine for events that name none. */
+    default_equipment_id?: string;
+    /** Delta cursor of the v1 poller. */
+    delta_link?: string;
+    /** Delta cursor of the v2 poller — separate, so the two never steal each other's. */
+    delta_link_v2?: string;
+};
+/**
+ * The recurrence of a v2 maintenance plan, as stored in
+ * `OD3_Service_Schedule.cadence`.
+ *
+ * Mirrored from `@opendash/plugin-openservice-core` (a browser package); the
+ * authoritative definition is the Parse schema. Only `rrule` and `manual` are
+ * active in v2.0, and only `rrule` can be represented in a calendar.
+ */
+export type ServiceCadence = {
+    kind: "rrule" | "sensor" | "meter" | "event" | "manual";
+    /** RFC 5545 recurrence rule, without the `RRULE:` prefix. */
+    rrule?: string;
+    /** ISO timestamp of the series start. */
+    dtstart?: string;
+    /** ISO timestamp the series ends at (inclusive). */
+    until?: string;
+};
+/** A notification rule of a plan (`notifications`), as far as the sync needs it. */
+export type ServiceNotificationRule = {
+    id: string;
+    trigger: "before" | "due";
+    offsetDays?: number;
+    assignedRoles?: boolean;
+    serviceProviders?: boolean;
+    userIds?: string[];
+    roleIds?: string[];
+    contactIds?: string[];
+};

package/dist/features/openservice/serviceSchedules/calendarSync/types/ServiceSyncTypes.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OUTLOOK_CONFIG_KEY = void 0;
+/**
+ * Config key of the Outlook integration. Shared with v1 — one calendar
+ * connection per tenant serves both generations.
+ */
+exports.OUTLOOK_CONFIG_KEY = "OPENSERVICE_MICROSOFT_OUTLOOK_INTEGRATION";

package/dist/features/openservice/serviceSchedules/initServiceSchedulesFeature.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Start the v2 side of the Outlook sync — one poller per configured tenant.
+ *
+ * The connections are read once at boot, like v1 does: a tenant that switches
+ * the sync on gets it after the next server start. The pollers are kept so a
+ * future reload can stop them instead of doubling them up.
+ */
+export declare function initServiceSchedulesFeature(): Promise<void>;
+/** Stop every poller — for tests and for a graceful shutdown. */
+export declare function stopServiceSchedulesFeature(): void;

package/dist/features/openservice/serviceSchedules/initServiceSchedulesFeature.js

@@ -0,0 +1,39 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initServiceSchedulesFeature = initServiceSchedulesFeature;
+exports.stopServiceSchedulesFeature = stopServiceSchedulesFeature;
+const node_1 = __importDefault(require("parse/node"));
+const index_js_1 = require("../../../types/index.js");
+const ServiceCalendarSyncPoller_js_1 = require("./calendarSync/service/ServiceCalendarSyncPoller.js");
+const ServiceSyncTypes_js_1 = require("./calendarSync/types/ServiceSyncTypes.js");
+/** How often the delta feed is asked for changes. */
+const POLL_INTERVAL_MS = 60 * 1000;
+const pollers = [];
+/**
+ * Start the v2 side of the Outlook sync — one poller per configured tenant.
+ *
+ * The connections are read once at boot, like v1 does: a tenant that switches
+ * the sync on gets it after the next server start. The pollers are kept so a
+ * future reload can stop them instead of doubling them up.
+ */
+async function initServiceSchedulesFeature() {
+    const configs = await new node_1.default.Query(index_js_1.Config)
+        .equalTo("key", ServiceSyncTypes_js_1.OUTLOOK_CONFIG_KEY)
+        .includeAll()
+        .findAll({ useMasterKey: true });
+    for (const config of configs) {
+        pollers.push(new ServiceCalendarSyncPoller_js_1.ServiceCalendarSyncPoller(config).start(POLL_INTERVAL_MS));
+    }
+    if (pollers.length > 0) {
+        console.log(`[ServiceCalendarSync] Started for ${pollers.length} calendar connection(s)`);
+    }
+}
+/** Stop every poller — for tests and for a graceful shutdown. */
+function stopServiceSchedulesFeature() {
+    for (const poller of pollers)
+        poller.stop();
+    pollers.length = 0;
+}

package/dist/features/openservice/serviceTickets/alarmActions/functions/alarmTicketFields.d.ts

@@ -0,0 +1,35 @@
+import { type AlarmEvent, type AlarmTicketParams } from "../types/AlarmTicketTypes.js";
+/**
+ * Alarm + action parameters → the text fields of a ticket.
+ *
+ * Pure, so the wording and — more importantly — the `origin` marker can be
+ * checked without a database. The marker is what makes the whole thing
+ * idempotent: it identifies the alarm, and one open ticket per marker is the
+ * default.
+ */
+/** Title, description and origin of the ticket a fired alarm produces. */
+export interface AlarmTicketFields {
+    title: string;
+    description: string;
+    origin: string;
+}
+export declare function alarmTicketFields(event: AlarmEvent, params?: AlarmTicketParams): AlarmTicketFields;
+/**
+ * The `origin` marker: `alarm:<key>`.
+ *
+ * Same idea as the schedule plugin's `schedule:<id>:<occurrence>` — a
+ * free-form, greppable string that says where a ticket came from and can be
+ * queried back (`equalTo("origin", …)`). The key is the alarm's id when the
+ * executor knows it, otherwise source and sensor, which stay stable across
+ * firings of the same alarm.
+ */
+export declare function alarmOrigin(event: AlarmEvent): string;
+/**
+ * A stable identity for the alarm — the one thing a payload must carry.
+ *
+ * Returns `undefined` when the executor reports neither an alarm id nor a
+ * sensor: such a call cannot be deduplicated and is rejected rather than
+ * silently creating a ticket on every firing.
+ */
+export declare function alarmKey(event: AlarmEvent): string | undefined;
+export declare function firedAt(event: AlarmEvent): Date;

package/dist/features/openservice/serviceTickets/alarmActions/functions/alarmTicketFields.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.alarmTicketFields = alarmTicketFields;
+exports.alarmOrigin = alarmOrigin;
+exports.alarmKey = alarmKey;
+exports.firedAt = firedAt;
+const AlarmTicketTypes_js_1 = require("../types/AlarmTicketTypes.js");
+function alarmTicketFields(event, params = {}) {
+    return {
+        title: renderTitle(event, params),
+        description: renderDescription(event, params),
+        origin: alarmOrigin(event),
+    };
+}
+/**
+ * The `origin` marker: `alarm:<key>`.
+ *
+ * Same idea as the schedule plugin's `schedule:<id>:<occurrence>` — a
+ * free-form, greppable string that says where a ticket came from and can be
+ * queried back (`equalTo("origin", …)`). The key is the alarm's id when the
+ * executor knows it, otherwise source and sensor, which stay stable across
+ * firings of the same alarm.
+ */
+function alarmOrigin(event) {
+    return `alarm:${alarmKey(event)}`;
+}
+/**
+ * A stable identity for the alarm — the one thing a payload must carry.
+ *
+ * Returns `undefined` when the executor reports neither an alarm id nor a
+ * sensor: such a call cannot be deduplicated and is rejected rather than
+ * silently creating a ticket on every firing.
+ */
+function alarmKey(event) {
+    if (event.alarmId)
+        return event.alarmId;
+    const sensor = [event.item_source, event.item_id].filter(Boolean).join("/");
+    if (!sensor)
+        return undefined;
+    return event.item_dimension != null
+        ? `${sensor}#${event.item_dimension}`
+        : sensor;
+}
+/** `{{alarm}}` / `{{sensor}}` / `{{value}}` in the configured title. */
+function renderTitle(event, params) {
+    const template = params.title?.trim();
+    const sensor = sensorLabel(event);
+    if (!template) {
+        // No template: the alarm's own name is the most recognisable thing there
+        // is, and a ticket must have a title.
+        return event.name || (sensor ? `Alarm: ${sensor}` : "Alarm");
+    }
+    return template
+        .replace(/\{\{\s*alarm\s*\}\}/gi, event.name ?? "")
+        .replace(/\{\{\s*sensor\s*\}\}/gi, sensor)
+        .replace(/\{\{\s*value\s*\}\}/gi, formatValue(event.value))
+        .replace(/\s+/g, " ")
+        .trim();
+}
+/**
+ * The configured note plus what the alarm actually reported.
+ *
+ * The details are appended rather than templated, because the person handling
+ * the ticket needs to know which sensor, which value and when — and forgetting
+ * a placeholder in the form should not lose that.
+ */
+function renderDescription(event, params) {
+    const lines = [];
+    const note = params.description?.trim();
+    if (note)
+        lines.push(note, "");
+    const sensor = sensorLabel(event);
+    if (event.name)
+        lines.push(`Alarm: ${event.name}`);
+    if (sensor)
+        lines.push(`Sensor: ${sensor}`);
+    if (event.value !== undefined)
+        lines.push(`Wert: ${formatValue(event.value)}`);
+    if (event.condition)
+        lines.push(`Regel: ${event.condition}`);
+    lines.push(`Ausgelöst: ${firedAt(event).toISOString()}`);
+    lines.push(`Quelle: ${AlarmTicketTypes_js_1.ALARM_TICKET_ACTION_ID}`);
+    return lines.join("\n");
+}
+function firedAt(event) {
+    if (event.firedAt) {
+        const parsed = new Date(event.firedAt);
+        if (!Number.isNaN(parsed.getTime()))
+            return parsed;
+    }
+    return new Date();
+}
+function sensorLabel(event) {
+    const sensor = [event.item_source, event.item_id].filter(Boolean).join("/");
+    return event.item_dimension != null && sensor
+        ? `${sensor} [${event.item_dimension}]`
+        : sensor;
+}
+function formatValue(value) {
+    if (value === undefined || value === null)
+        return "";
+    return String(value);
+}

package/dist/features/openservice/serviceTickets/alarmActions/index.d.ts

@@ -0,0 +1,7 @@
+export { alarmKey, alarmOrigin, alarmTicketFields, firedAt, } from "./functions/alarmTicketFields.js";
+export type { AlarmTicketFields } from "./functions/alarmTicketFields.js";
+export { createAlarmTicket, tenantForSecret, } from "./service/createAlarmTicket.js";
+export type { AlarmTicketResult } from "./service/createAlarmTicket.js";
+export { ensureAlarmTicketAction } from "./service/ensureAlarmTicketAction.js";
+export { ALARM_TICKET_ACTION_ID, ALARM_TICKET_SECRET_CONFIG_KEY, } from "./types/AlarmTicketTypes.js";
+export type { AlarmEvent, AlarmTicketParams, } from "./types/AlarmTicketTypes.js";

package/dist/features/openservice/serviceTickets/alarmActions/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALARM_TICKET_SECRET_CONFIG_KEY = exports.ALARM_TICKET_ACTION_ID = exports.ensureAlarmTicketAction = exports.tenantForSecret = exports.createAlarmTicket = exports.firedAt = exports.alarmTicketFields = exports.alarmOrigin = exports.alarmKey = void 0;
+var alarmTicketFields_js_1 = require("./functions/alarmTicketFields.js");
+Object.defineProperty(exports, "alarmKey", { enumerable: true, get: function () { return alarmTicketFields_js_1.alarmKey; } });
+Object.defineProperty(exports, "alarmOrigin", { enumerable: true, get: function () { return alarmTicketFields_js_1.alarmOrigin; } });
+Object.defineProperty(exports, "alarmTicketFields", { enumerable: true, get: function () { return alarmTicketFields_js_1.alarmTicketFields; } });
+Object.defineProperty(exports, "firedAt", { enumerable: true, get: function () { return alarmTicketFields_js_1.firedAt; } });
+var createAlarmTicket_js_1 = require("./service/createAlarmTicket.js");
+Object.defineProperty(exports, "createAlarmTicket", { enumerable: true, get: function () { return createAlarmTicket_js_1.createAlarmTicket; } });
+Object.defineProperty(exports, "tenantForSecret", { enumerable: true, get: function () { return createAlarmTicket_js_1.tenantForSecret; } });
+var ensureAlarmTicketAction_js_1 = require("./service/ensureAlarmTicketAction.js");
+Object.defineProperty(exports, "ensureAlarmTicketAction", { enumerable: true, get: function () { return ensureAlarmTicketAction_js_1.ensureAlarmTicketAction; } });
+var AlarmTicketTypes_js_1 = require("./types/AlarmTicketTypes.js");
+Object.defineProperty(exports, "ALARM_TICKET_ACTION_ID", { enumerable: true, get: function () { return AlarmTicketTypes_js_1.ALARM_TICKET_ACTION_ID; } });
+Object.defineProperty(exports, "ALARM_TICKET_SECRET_CONFIG_KEY", { enumerable: true, get: function () { return AlarmTicketTypes_js_1.ALARM_TICKET_SECRET_CONFIG_KEY; } });

package/dist/features/openservice/serviceTickets/alarmActions/service/createAlarmTicket.d.ts

@@ -0,0 +1,33 @@
+import { Tenant } from "../../../../../types/index.js";
+import { type AlarmEvent, type AlarmTicketParams } from "../types/AlarmTicketTypes.js";
+/** Outcome of one fired alarm. */
+export interface AlarmTicketResult {
+    ticketId: string;
+    /** `false` when an open ticket for this alarm already existed. */
+    created: boolean;
+    origin: string;
+    equipmentId?: string;
+}
+/**
+ * Create the ticket a fired alarm asks for — or return the one that is already
+ * open for it.
+ *
+ * **One open ticket per alarm** is the default (`params.duplicate` opts out).
+ * A sensor that crosses its threshold every few minutes would otherwise bury
+ * the inbox, and the person on shift needs one work item, not a log. Closing
+ * the ticket arms the alarm again, which is the behaviour people expect from
+ * every other alerting tool.
+ *
+ * Deliberately thin: number, ACL, assignment notifications and the tenant's
+ * watcher rules all happen in the `Service_Ticket` hooks, on every write path.
+ */
+export declare function createAlarmTicket(tenant: Tenant, event: AlarmEvent, params?: AlarmTicketParams): Promise<AlarmTicketResult>;
+/**
+ * The tenant a call belongs to, identified by its shared secret.
+ *
+ * The executor lives outside this server and is not trusted to name a tenant —
+ * so the secret does it. One `OD3_Config` row per tenant
+ * (`OPENSERVICE_ALARM_TICKET_SECRET`); no row means the tenant has not switched
+ * the endpoint on, and the call is refused.
+ */
+export declare function tenantForSecret(secret: string): Promise<Tenant | undefined>;

package/dist/features/openservice/serviceTickets/alarmActions/service/createAlarmTicket.js

@@ -0,0 +1,179 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAlarmTicket = createAlarmTicket;
+exports.tenantForSecret = tenantForSecret;
+const node_1 = __importDefault(require("parse/node"));
+const index_js_1 = require("../../../../../types/index.js");
+const alarmTicketFields_js_1 = require("../functions/alarmTicketFields.js");
+const AlarmTicketTypes_js_1 = require("../types/AlarmTicketTypes.js");
+/**
+ * Create the ticket a fired alarm asks for — or return the one that is already
+ * open for it.
+ *
+ * **One open ticket per alarm** is the default (`params.duplicate` opts out).
+ * A sensor that crosses its threshold every few minutes would otherwise bury
+ * the inbox, and the person on shift needs one work item, not a log. Closing
+ * the ticket arms the alarm again, which is the behaviour people expect from
+ * every other alerting tool.
+ *
+ * Deliberately thin: number, ACL, assignment notifications and the tenant's
+ * watcher rules all happen in the `Service_Ticket` hooks, on every write path.
+ */
+async function createAlarmTicket(tenant, event, params = {}) {
+    if (!(0, alarmTicketFields_js_1.alarmKey)(event)) {
+        throw new node_1.default.Error(node_1.default.Error.INVALID_QUERY, "The alarm payload identifies no alarm: pass alarmId, or item_source/item_id.");
+    }
+    const fields = (0, alarmTicketFields_js_1.alarmTicketFields)(event, params);
+    if (!params.duplicate) {
+        const open = await findOpenTicket(tenant, fields.origin);
+        if (open) {
+            return {
+                ticketId: open.id,
+                created: false,
+                origin: fields.origin,
+                equipmentId: open.get("equipment")?.id,
+            };
+        }
+    }
+    const status = await resolveDefaultStatus(tenant);
+    if (!status) {
+        throw new node_1.default.Error(node_1.default.Error.INVALID_QUERY, `No "${AlarmTicketTypes_js_1.DEFAULT_STATUS_CATEGORY}" status configured for this tenant — cannot create a ticket.`);
+    }
+    const equipment = await resolveEquipment(tenant, event, params);
+    const ticket = new index_js_1.Service_Ticket();
+    ticket.set("deleted", false);
+    ticket.set("tenant", tenant);
+    ticket.set("status", status);
+    ticket.set("title", fields.title);
+    ticket.set("description", fields.description);
+    ticket.set("origin", fields.origin);
+    // The moment the alarm fired, not the moment we got the call — a queued or
+    // retried webhook must not move the incident.
+    ticket.set("startDate", (0, alarmTicketFields_js_1.firedAt)(event));
+    if (equipment)
+        ticket.set("equipment", equipment);
+    if (params.priority != null)
+        ticket.set("priority", params.priority);
+    if (params.projectId) {
+        const project = new index_js_1.Service_Project();
+        project.id = params.projectId;
+        ticket.set("project", project);
+    }
+    // Assignment arrays hold plain ids in this schema (see the `pointerIds`
+    // helper in the ticket hook, which accepts both).
+    if (params.assignedUserIds?.length) {
+        ticket.set("assignedUsers", params.assignedUserIds);
+    }
+    if (params.assignedRoleIds?.length) {
+        ticket.set("assignedRoles", params.assignedRoleIds);
+    }
+    if (params.tagIds?.length)
+        ticket.set("tags", params.tagIds);
+    await ticket.save(null, { useMasterKey: true });
+    return {
+        ticketId: ticket.id,
+        created: true,
+        origin: fields.origin,
+        equipmentId: equipment?.id,
+    };
+}
+/**
+ * An unfinished ticket of this alarm, if there is one.
+ *
+ * "Unfinished" is decided by the **status category**, not by `closedAt`: a
+ * tenant can name its statuses whatever it likes, the category is the contract
+ * (`done` / `cancelled` — the same list core uses).
+ */
+async function findOpenTicket(tenant, origin) {
+    const tickets = await new node_1.default.Query(index_js_1.Service_Ticket)
+        .equalTo("tenant", tenant)
+        .equalTo("origin", origin)
+        .equalTo("deleted", false)
+        .include("status")
+        .descending("createdAt")
+        .limit(20)
+        .find({ useMasterKey: true });
+    return tickets.find((ticket) => {
+        const category = ticket.get("status")?.get("category");
+        return !AlarmTicketTypes_js_1.DONE_STATUS_CATEGORIES.includes(category);
+    });
+}
+/** The tenant's inbox status, else a global one — never another tenant's. */
+async function resolveDefaultStatus(tenant) {
+    const statuses = await new node_1.default.Query(index_js_1.Service_Status)
+        .equalTo("category", AlarmTicketTypes_js_1.DEFAULT_STATUS_CATEGORY)
+        .equalTo("deleted", false)
+        .ascending("order")
+        .find({ useMasterKey: true });
+    return (statuses.find((status) => status.get("tenant")?.id === tenant.id) ?? statuses.find((status) => !status.get("tenant")));
+}
+/**
+ * The machine the ticket belongs to.
+ *
+ * 1. what was configured on the alarm — the only reliable source, because
+ *    **nothing in the data model links a sensor to a machine**;
+ * 2. otherwise a machine whose `sourceTags` name the sensor or its source.
+ *    That is a convention, not a relation, so it is a fallback: `sourceTags`
+ *    was meant for source scoping, and a site-level tag can match several
+ *    machines — the first one wins, which is a guess.
+ *
+ * No machine is not an error: `equipment` is optional on a ticket, and an
+ * unassigned alarm ticket in the inbox is better than one on the wrong machine.
+ */
+async function resolveEquipment(tenant, event, params) {
+    if (params.equipmentId) {
+        const explicit = await new node_1.default.Query(index_js_1.Service_Equipment)
+            .equalTo("objectId", params.equipmentId)
+            .first({ useMasterKey: true });
+        if (explicit)
+            return explicit;
+        console.warn(`[AlarmTicket] Configured machine ${params.equipmentId} does not exist`);
+    }
+    const candidates = [event.item_id, event.item_source].filter((value) => !!value);
+    if (candidates.length === 0)
+        return undefined;
+    const query = new node_1.default.Query(index_js_1.Service_Equipment)
+        .equalTo("tenant", tenant)
+        .notEqualTo("deleted", true)
+        // `sourceTags` is an Array column: Mongo reads "contained in" as "the array
+        // holds one of these". The generated type only knows `any[]`, hence the cast.
+        .containedIn("sourceTags", candidates);
+    return (await query.first({ useMasterKey: true })) ?? undefined;
+}
+/**
+ * The tenant a call belongs to, identified by its shared secret.
+ *
+ * The executor lives outside this server and is not trusted to name a tenant —
+ * so the secret does it. One `OD3_Config` row per tenant
+ * (`OPENSERVICE_ALARM_TICKET_SECRET`); no row means the tenant has not switched
+ * the endpoint on, and the call is refused.
+ */
+async function tenantForSecret(secret) {
+    if (!secret)
+        return undefined;
+    const configs = await new node_1.default.Query(index_js_1.Config)
+        .equalTo("key", AlarmTicketTypes_js_1.ALARM_TICKET_SECRET_CONFIG_KEY)
+        .include("tenant")
+        .find({ useMasterKey: true });
+    const match = configs.find((config) => {
+        const value = config.get("value");
+        return typeof value === "string" && constantTimeEqual(value.trim(), secret);
+    });
+    return match?.get("tenant") ?? undefined;
+}
+/**
+ * Compare without leaking the answer through timing — the caller controls one
+ * side of this comparison and may try many.
+ */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}

package/dist/features/openservice/serviceTickets/alarmActions/service/ensureAlarmTicketAction.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Make "create a ticket" selectable in the alarm dialog.
+ *
+ * Alarm actions are **data**, not code: `OD3_AlarmAction` rows that the
+ * monitoring adapter loads into the frontend, where the chosen row's
+ * `formFields` are rendered as the action's settings form (see
+ * `plugins/monitoring/src/components/AlarmCreate.tsx`). There is no plugin-side
+ * `registerAlarmAction`, so the row is seeded here — find-or-create by `topic`,
+ * like the other open.SERVICE bootstraps.
+ *
+ * The row is **global** (no tenant): the action makes sense for every tenant,
+ * and the tenant of a fired alarm is established by its secret, not by this
+ * row.
+ *
+ * ⚠️ `type` / `target` / `payload` are the executor's half of the contract —
+ * the component that evaluates alarms lives outside this server. The values
+ * below assume a webhook-style executor that POSTs `payload` (placeholders
+ * filled from the alarm) to `target`. If the executor expects something else,
+ * this row is where it is corrected; the receiving endpoint accepts any caller
+ * that brings the secret.
+ */
+export declare function ensureAlarmTicketAction(): Promise<void>;