@uniformdev/automations-sdk 20.72.3-alpha.14 → 20.72.3-alpha.23

package/dist/api/index.d.mts

@@ -415,38 +415,45 @@ interface paths {
                                 name: string;
                                 /** @description Optional description. */
                                 description: string | null;
-                                /** @description How the automation is triggered. */
-                                trigger: {
+                                /** @description The triggers this automation subscribes to. */
+                                triggers: {
+                                    /** @description How the automation is triggered. */
+                                    config: {
+                                        /**
+                                         * @description The internal webhook event name that triggers this automation.
+                                         * @enum {string}
+                                         */
+                                        type: "asset.deleted" | "asset.published" | "composition.changed" | "composition.deleted" | "composition.published" | "composition.release.changed" | "composition.release.deleted" | "composition.release.published" | "composition.release.restored" | "entry.changed" | "entry.deleted" | "entry.published" | "entry.release.changed" | "entry.release.deleted" | "entry.release.published" | "entry.release.restored" | "manifest.published" | "projectmap.delete" | "projectmap.node.delete" | "projectmap.node.insert" | "projectmap.node.update" | "projectmap.update" | "redirect.delete" | "redirect.insert" | "redirect.update" | "release.changed" | "release.deleted" | "release.launch_started" | "release.launched" | "workflow.transition";
+                                        /** @description Optional CEL boolean expression evaluated against { input, trigger }; the automation runs only when it is true. */
+                                        filter?: string;
+                                    } | {
+                                        /** @enum {string} */
+                                        type: "schedule";
+                                        /** @description RFC 5545 recurrence rule for when the automation runs. */
+                                        rrule: string;
+                                        /** @description IANA timezone used to evaluate the recurrence rule. */
+                                        timezone: string;
+                                    } | {
+                                        /** @enum {string} */
+                                        type: "incomingWebhook";
+                                        /** @description Optional CEL boolean expression evaluated against { input, trigger }; the automation runs only when it is true. */
+                                        filter?: string;
+                                    } | {
+                                        /** @enum {string} */
+                                        type: "aiTool";
+                                        /** @description JSON Schema describing the AI tool arguments. */
+                                        inputSchema: {
+                                            [key: string]: unknown;
+                                        };
+                                    };
                                     /**
-                                     * @description The internal webhook event name that triggers this automation.
-                                     * @enum {string}
+                                     * Format: date-time
+                                     * @description Next upcoming run for this trigger; null for non-schedule triggers.
                                      */
-                                    type: "asset.deleted" | "asset.published" | "composition.changed" | "composition.deleted" | "composition.published" | "composition.release.changed" | "composition.release.deleted" | "composition.release.published" | "composition.release.restored" | "entry.changed" | "entry.deleted" | "entry.published" | "entry.release.changed" | "entry.release.deleted" | "entry.release.published" | "entry.release.restored" | "manifest.published" | "projectmap.delete" | "projectmap.node.delete" | "projectmap.node.insert" | "projectmap.node.update" | "projectmap.update" | "redirect.delete" | "redirect.insert" | "redirect.update" | "release.changed" | "release.deleted" | "release.launch_started" | "release.launched" | "workflow.transition";
-                                } | {
-                                    /** @enum {string} */
-                                    type: "schedule";
-                                    /** @description RFC 5545 recurrence rule for when the automation runs. */
-                                    rrule: string;
-                                    /** @description IANA timezone used to evaluate the recurrence rule. */
-                                    timezone: string;
-                                } | {
-                                    /** @enum {string} */
-                                    type: "incomingWebhook";
-                                } | {
-                                    /** @enum {string} */
-                                    type: "aiTool";
-                                    /** @description JSON Schema describing the AI tool arguments. */
-                                    inputSchema: {
-                                        [key: string]: unknown;
-                                    };
-                                };
+                                    nextRunAt: string | null;
+                                }[];
                                 /** @description Whether the automation is enabled. */
                                 enabled: boolean;
-                                /**
-                                 * Format: date-time
-                                 * @description Next scheduled run time, or null when not applicable.
-                                 */
-                                nextRunAt: string | null;
                                 /**
                                  * Format: date-time
                                  * @description When the automation code was last deployed.
@@ -503,13 +510,15 @@ interface paths {
                         name: string;
                         /** @description For automations triggered as an AI tool, this is used to determine when an LLM should call the automation. For other triggers, this is for your reference and optional. */
                         description?: string;
-                        /** @description How the automation is triggered. */
-                        trigger: {
+                        /** @description The triggers this automation subscribes to. */
+                        triggers: ({
                             /**
                              * @description The internal webhook event name that triggers this automation.
                              * @enum {string}
                              */
                             type: "asset.deleted" | "asset.published" | "composition.changed" | "composition.deleted" | "composition.published" | "composition.release.changed" | "composition.release.deleted" | "composition.release.published" | "composition.release.restored" | "entry.changed" | "entry.deleted" | "entry.published" | "entry.release.changed" | "entry.release.deleted" | "entry.release.published" | "entry.release.restored" | "manifest.published" | "projectmap.delete" | "projectmap.node.delete" | "projectmap.node.insert" | "projectmap.node.update" | "projectmap.update" | "redirect.delete" | "redirect.insert" | "redirect.update" | "release.changed" | "release.deleted" | "release.launch_started" | "release.launched" | "workflow.transition";
+                            /** @description Optional CEL boolean expression evaluated against { input, trigger }; the automation runs only when it is true. */
+                            filter?: string;
                         } | {
                             /** @enum {string} */
                             type: "schedule";
@@ -520,6 +529,8 @@ interface paths {
                         } | {
                             /** @enum {string} */
                             type: "incomingWebhook";
+                            /** @description Optional CEL boolean expression evaluated against { input, trigger }; the automation runs only when it is true. */
+                            filter?: string;
                         } | {
                             /** @enum {string} */
                             type: "aiTool";
@@ -527,7 +538,7 @@ interface paths {
                             inputSchema: {
                                 [key: string]: unknown;
                             };
-                        };
+                        })[];
                         /** @description Role grants for the automation identity. The caller must hold each requested role (or be a team admin). When omitted, the automation will not receive Uniform API access credentials. */
                         permissions?: {
                             /** @description Role grant(s) on the project the automation is deployed to. */
@@ -733,7 +744,8 @@ interface components {
 
 type AutomationsListResponse = paths['/api/v1/automations']['get']['responses']['200']['content']['application/json'];
 type AutomationSummary = AutomationsListResponse['automations'][number];
-type AutomationTriggerType = AutomationSummary['trigger']['type'];
+type AutomationTrigger = AutomationSummary['triggers'][number];
+type AutomationTriggerType = AutomationTrigger['config']['type'];
 type AutomationsDeployBody = paths['/api/v1/automations']['put']['requestBody']['content']['application/json'];
 /** Deploy input without the project ID, which the client injects from its options. */
 type AutomationsDeployInput = Omit<AutomationsDeployBody, 'projectId'>;
@@ -801,4 +813,4 @@ declare class AutomationsClient extends ApiClient<AutomationsClientOptions> {
     listRunLogs(runId: string): Promise<AutomationRunLogEntry[]>;
 }
 
-export { type AutomationRunLogEntry, type AutomationRunStatus, type AutomationRunSummary, type AutomationRunTriggerResponse, type AutomationRunsListResponse, type AutomationSummary, type AutomationTriggerType, AutomationsClient, type AutomationsClientOptions, type AutomationsDeployBody, type AutomationsDeployInput, type AutomationsListResponse };
+export { type AutomationRunLogEntry, type AutomationRunStatus, type AutomationRunSummary, type AutomationRunTriggerResponse, type AutomationRunsListResponse, type AutomationSummary, type AutomationTrigger, type AutomationTriggerType, AutomationsClient, type AutomationsClientOptions, type AutomationsDeployBody, type AutomationsDeployInput, type AutomationsListResponse };

package/dist/index.d.mts

@@ -11,6 +11,15 @@ import 'zod';
  */
 type EventTriggerConfig<TEvent extends WebhookEventName = WebhookEventName> = {
     type: TEvent;
+    /**
+     * Optional CEL ({@link https://github.com/google/cel-spec | Common Expression Language})
+     * boolean expression evaluated against `{ input, trigger }` at dispatch time. The automation
+     * only runs when it evaluates to `true`; non-matching events are discarded and no run will be recorded.
+     * `input` is the event payload; `trigger` is this trigger config.
+     *
+     * Note: a failure to parse or evaluate the filter will cause a failed automation run to be recorded for diagnostics.
+     */
+    filter?: string;
 };
 /** Trigger configuration for a schedule automation. */
 type ScheduleTriggerConfig = {
@@ -23,6 +32,15 @@ type ScheduleTriggerConfig = {
 /** Trigger configuration for an incoming webhook automation. */
 type IncomingWebhookTriggerConfig = {
     type: 'incomingWebhook';
+    /**
+     * Optional CEL ({@link https://github.com/google/cel-spec | Common Expression Language})
+     * boolean expression evaluated against `{ input, trigger }` at ingress time. The automation
+     * only runs when it evaluates to `true`; uninteresting requests are dropped and no run will be recorded.
+     * `input` is the request envelope (`{ method, headers, query, rawBody }`); `trigger` is this trigger config.
+     *
+     * Note: a failure to parse or evaluate the filter will cause a failed automation run to be recorded for diagnostics.
+     */
+    filter?: string;
 };
 /** Trigger configuration for an automation invocable as an AI tool by Scout. */
 type AiToolTriggerConfig = {
@@ -30,6 +48,23 @@ type AiToolTriggerConfig = {
 };
 /** Canonical authored trigger configuration. */
 type TriggerConfig = EventTriggerConfig | ScheduleTriggerConfig | IncomingWebhookTriggerConfig | AiToolTriggerConfig;
+/**
+ * Triggers that compose freely within a single automation. Events, schedule, and
+ * incomingWebhook all run under the automation's machine identity and reduce to a
+ * fixed-shape, `eventType`-discriminated run input, so any combination is valid.
+ * `aiTool` is excluded — it runs as the invoking caller and must be the sole trigger.
+ */
+type ComposableTriggerConfig = EventTriggerConfig | ScheduleTriggerConfig | IncomingWebhookTriggerConfig;
+/**
+ * Synthetic run input for a schedule-fired run. Carries an `eventType` discriminant
+ * (disjoint from every webhook event name) so scheduled runs join the same
+ * discriminated union as event and incoming-webhook runs in the handler.
+ */
+type ScheduleRunInput = {
+    eventType: 'schedule';
+    /** ISO-8601 timestamp of when the schedule fired this run. */
+    firedAt: string;
+};
 /** A plain JSON Schema object (used when the argument contract is authored as JSON Schema directly). */
 type JsonSchemaObject = Record<string, unknown>;
 /**
@@ -61,39 +96,40 @@ type AutomationMetadataBase = {
     permissions?: AutomationPermissions;
 };
 /**
- * Authored metadata for an event-triggered automation. Parameterize `TEvent`
- * with a webhook event name; {@link defineAutomation} then infers the handler's
- * `trigger` and `input` from the metadata.
+ * Authored metadata for an automation driven by one or more composable triggers
+ * (events, schedule, incomingWebhook). {@link defineAutomation} infers the handler's
+ * `input` as a single discriminated union across every declared trigger.
+ *
+ * Composition rules (enforced at deploy time; see the deploy API):
+ * - `triggers` must be non-empty;
+ * - at most one `schedule` trigger;
+ * - at most one `incomingWebhook` trigger;
+ * - no duplicate event names.
  */
-type EventAutomationMetadata<TEvent extends WebhookEventName = WebhookEventName> = AutomationMetadataBase & {
-    trigger: EventTriggerConfig<TEvent>;
-};
-/** Authored metadata for a schedule-triggered automation. */
-type ScheduleAutomationMetadata = AutomationMetadataBase & {
-    trigger: ScheduleTriggerConfig;
-};
-/** Authored metadata for an incoming-webhook automation. */
-type IncomingWebhookAutomationMetadata = AutomationMetadataBase & {
-    trigger: IncomingWebhookTriggerConfig;
+type ComposedAutomationMetadata = AutomationMetadataBase & {
+    /** One or more triggers this automation subscribes to. Non-empty (enforced as a tuple). */
+    triggers: [ComposableTriggerConfig, ...ComposableTriggerConfig[]];
 };
 /**
  * Authored metadata for an automation exposed as an AI tool to Scout.
  *
- * `description` is required (it drives tool selection by the LLM) and `inputSchema`
- * declares the tool's argument contract. When `inputSchema` is a zod schema,
- * {@link defineAutomation} infers the handler's `input` from it.
+ * `aiTool` must be the sole trigger (it runs as the invoking caller, not the machine
+ * identity). `description` is required (it drives tool selection by the LLM) and
+ * `inputSchema` declares the tool's argument contract. When `inputSchema` is a zod
+ * schema, {@link defineAutomation} infers the handler's `input` from it.
  */
 type AiToolAutomationMetadata = AutomationMetadataBase & {
     /** Required for AI tools — the LLM uses it to decide when to call the automation. */
     description: string;
-    trigger: AiToolTriggerConfig;
+    /** aiTool is exclusive — it must be the only trigger. */
+    triggers: [AiToolTriggerConfig];
     /**
      * Argument contract surfaced to the LLM. A zod schema or a JSON Schema object.
      */
     inputSchema: AiToolInputSchema;
 };
 /** Authored metadata declared via {@link defineAutomation}. */
-type AutomationMetadata = EventAutomationMetadata | ScheduleAutomationMetadata | IncomingWebhookAutomationMetadata | AiToolAutomationMetadata;
+type AutomationMetadata = ComposedAutomationMetadata | AiToolAutomationMetadata;
 
 /**
  * Per-run Uniform API connection parameters.
@@ -159,9 +195,13 @@ interface AutomationLogger {
  * @typeParam TTrigger - The authored trigger configuration.
  */
 interface AutomationContext<TInput = unknown, TTrigger extends TriggerConfig = TriggerConfig> {
-    /** The automation's trigger definition. */
+    /** The specific trigger that fired this run (one of the automation's declared triggers). */
     trigger: TTrigger;
-    /** The input payload for this run (event payload, incoming webhook request, or none for schedule). */
+    /**
+     * The input payload for this run: the event payload, the incoming-webhook request,
+     * or `{ eventType: 'schedule', firedAt }` for a scheduled run. When the automation
+     * declares multiple triggers this is a discriminated union — narrow on `input.eventType`.
+     */
     input: TInput;
     /** Structured logger; entries appear in the run log. */
     log: AutomationLogger;
@@ -180,11 +220,18 @@ interface AutomationContext<TInput = unknown, TTrigger extends TriggerConfig = T
  *
  * @typeParam TInput - The input payload type.
  * @typeParam TTrigger - The trigger configuration.
+ * @typeParam TContextExtras - Extra context guarantees derived from authored metadata, intersected
+ * onto the context (see `CredentialsFromAutomationMetadata`). Defaults to no extra guarantees.
  */
-type AutomationHandler<TInput = unknown, TTrigger extends TriggerConfig = TriggerConfig> = (context: AutomationContext<TInput, TTrigger>) => Promise<AutomationResult | void> | AutomationResult | void;
+type AutomationHandler<TInput = unknown, TTrigger extends TriggerConfig = TriggerConfig, TContextExtras = unknown> = (context: AutomationContext<TInput, TTrigger> & TContextExtras) => Promise<AutomationResult | void> | AutomationResult | void;
 
 /** HTTP request details passed to an incoming-webhook automation handler. */
 type IncomingWebhookInput = {
+    /**
+     * Discriminant so incoming-webhook runs join the same `eventType`-discriminated
+     * union as event and schedule runs. Disjoint from every webhook event name.
+     */
+    eventType: 'incomingWebhook';
     /** HTTP method of the incoming request (e.g. `POST`). */
     method: string;
     /** Normalized request headers (lower-cased keys). */
@@ -200,9 +247,9 @@ type IncomingWebhookInput = {
  * {@link defineAutomation} wraps a handler to accept this shape.
  */
 interface AutomationInvokePayload {
-    /** The automation's declared trigger configuration. */
+    /** The specific trigger that fired this run. */
     trigger: TriggerConfig;
-    /** Input for this run. */
+    /** Input for this run (event payload, incoming-webhook request, or `{ eventType: 'schedule', firedAt }`). */
     input: unknown;
     /**
      * Per-run Uniform API credentials. Present when the automation has an assigned role,
@@ -219,28 +266,69 @@ interface AutomationInvokePayload {
 type AutomationInvoker = (payload: AutomationInvokePayload) => Promise<AutomationResult & {
     logs: AutomationLogEntry[];
 }>;
+/** True when `T` contains a trigger whose `type` is `K`. */
+type HasTrigger<T extends readonly TriggerConfig[], K> = [Extract<T[number], {
+    type: K;
+}>] extends [never] ? false : true;
+/** Union of the webhook event names present in `T` (excludes schedule/incomingWebhook/aiTool). */
+type EventNamesOf<T extends readonly TriggerConfig[]> = Extract<T[number], {
+    type: WebhookEventName;
+}>['type'];
 /**
- * Resolves the handler input type from authored metadata: AI-tool arguments (from
- * the declared `inputSchema`), event payload, incoming-webhook request details, or
- * `unknown` for schedule triggers.
+ * The combined handler input for a set of composable triggers: one discriminated
+ * union over `eventType` covering every declared event payload, plus a synthetic
+ * `schedule` / `incomingWebhook` member when those triggers are present. Every webhook
+ * payload already carries a literal `eventType`, and `'schedule'`/`'incomingWebhook'`
+ * are disjoint from all event names, so `switch (input.eventType)` narrows cleanly.
+ */
+type CombinedRunInput<T extends readonly TriggerConfig[]> = WebhookPayloadFor<EventNamesOf<T>> | (HasTrigger<T, 'schedule'> extends true ? ScheduleRunInput : never) | (HasTrigger<T, 'incomingWebhook'> extends true ? IncomingWebhookInput : never);
+/**
+ * Resolves the handler input type from authored metadata: AI-tool arguments (from the
+ * declared `inputSchema`) when `aiTool` is the sole trigger, otherwise a single
+ * discriminated union across every declared composable trigger.
  */
 type InputFromAutomationMetadata<M extends AutomationMetadata> = M extends {
-    trigger: {
+    triggers: readonly [{
         type: 'aiTool';
-    };
+    }];
+} ? M extends {
     inputSchema: infer S;
-} ? S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : unknown : M extends {
-    trigger: infer TTrigger;
-} ? TTrigger extends {
-    type: infer TType;
-} ? TType extends WebhookEventName ? WebhookPayloadFor<TType> : TType extends 'incomingWebhook' ? IncomingWebhookInput : unknown : unknown : unknown;
+} ? S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : unknown : unknown : M extends {
+    triggers: infer T extends readonly TriggerConfig[];
+} ? CombinedRunInput<T> : unknown;
 /**
- * Resolves the handler trigger type from authored metadata (the literal
- * `metadata.trigger` object).
+ * Resolves the handler trigger type from authored metadata: the union of the
+ * automation's declared triggers (the *fired* trigger for a run is one of them).
  */
 type TriggerFromAutomationMetadata<M extends AutomationMetadata> = M extends {
-    trigger: infer TTrigger;
-} ? TTrigger : TriggerConfig;
+    triggers: infer T extends readonly TriggerConfig[];
+} ? T[number] : TriggerConfig;
+/**
+ * Whether a run of an automation with metadata `M` is guaranteed per-run Uniform credentials:
+ * either it declares `permissions` (so it gets a machine identity and a minted per-run token), or
+ * it is an `aiTool` (invoked with the calling user's own credential).
+ */
+type RunHasUniformCredentials<M extends AutomationMetadata> = M extends {
+    permissions: object;
+} ? true : HasTrigger<TriggersOf<M>, 'aiTool'>;
+/**
+ * The credential guarantee intersected onto the handler context: `uniformCredentials` is required
+ * (non-optional) when the authored metadata guarantees it, and adds nothing otherwise — an
+ * automation with no `permissions` genuinely has no Uniform API access, so `AutomationContext`
+ * leaves the property optional there.
+ *
+ * The runtime upholds this: {@link defineAutomation} refuses to invoke a handler whose metadata
+ * promises credentials when the invoke payload arrives without them.
+ */
+type CredentialsFromAutomationMetadata<M extends AutomationMetadata> = RunHasUniformCredentials<M> extends true ? {
+    uniformCredentials: UniformConnectionParams;
+} : unknown;
+/** The declared triggers of `M`, or the open trigger union when it declares none statically. */
+type TriggersOf<M extends AutomationMetadata> = M extends {
+    triggers: infer T extends readonly TriggerConfig[];
+} ? T : readonly TriggerConfig[];
+/** The handler signature implied by authored metadata: input, fired trigger, and credentials. */
+type HandlerFromAutomationMetadata<M extends AutomationMetadata> = AutomationHandler<InputFromAutomationMetadata<M>, TriggerFromAutomationMetadata<M>, CredentialsFromAutomationMetadata<M>>;
 /** A fully defined automation module: a callable invoke function with authored metadata attached. */
 type AutomationDefinition<M extends AutomationMetadata = AutomationMetadata> = AutomationInvoker & {
     metadata: M;
@@ -254,21 +342,32 @@ type AutomationDefinition<M extends AutomationMetadata = AutomationMetadata> = A
  *
  * export default defineAutomation({
  *   metadata: {
- *     name: 'On entry save',
- *     trigger: { type: 'entry.changed' },
+ *     name: 'Sync on publish',
+ *     triggers: [{ type: 'entry.published' }, { type: 'composition.published' }],
  *   },
- *   handler: async ({ trigger, input, log }) => {
- *     // trigger.type is 'entry.changed'; input is that event's payload
+ *   handler: async ({ input, log }) => {
+ *     // input is a discriminated union; narrow on input.eventType
+ *     switch (input.eventType) {
+ *       case 'entry.published': /* input narrowed *\/ break;
+ *       case 'composition.published': /* input narrowed *\/ break;
+ *     }
  *   },
  * });
  * ```
  *
+ * Authoring is always via `triggers` (an array), even for a single trigger. Composition
+ * rules (non-empty; at most one schedule; at most one incomingWebhook; `aiTool` exclusive;
+ * no duplicate event names) are enforced at deploy time.
+ *
+ * When the metadata declares `permissions` (or an `aiTool` trigger), `context.uniformCredentials`
+ * is typed as always present, so handlers can construct API clients without a null check.
+ *
  * @param config - Authored metadata and handler implementation.
  * @returns A callable default export with a `metadata` property.
  */
 declare function defineAutomation<const M extends AutomationMetadata>(config: {
     metadata: M;
-    handler: AutomationHandler<InputFromAutomationMetadata<M>, TriggerFromAutomationMetadata<M>>;
+    handler: HandlerFromAutomationMetadata<M>;
 }): AutomationDefinition<M>;
 
-export { type AiToolAutomationMetadata, type AiToolInputSchema, type AiToolTriggerConfig, type AutomationContext, type AutomationDefinition, type AutomationHandler, type AutomationInvokePayload, type AutomationInvoker, AutomationLogEntry, type AutomationLogLevel, type AutomationLogger, type AutomationMetadata, type AutomationPermissions, AutomationResult, type EventAutomationMetadata, type EventTriggerConfig, type IncomingWebhookAutomationMetadata, type IncomingWebhookInput, type IncomingWebhookTriggerConfig, type InputFromAutomationMetadata, type JsonSchemaObject, type ScheduleAutomationMetadata, type ScheduleTriggerConfig, type TriggerConfig, type TriggerFromAutomationMetadata, type UniformConnectionParams, defineAutomation };
+export { type AiToolAutomationMetadata, type AiToolInputSchema, type AiToolTriggerConfig, type AutomationContext, type AutomationDefinition, type AutomationHandler, type AutomationInvokePayload, type AutomationInvoker, AutomationLogEntry, type AutomationLogLevel, type AutomationLogger, type AutomationMetadata, type AutomationPermissions, AutomationResult, type ComposableTriggerConfig, type ComposedAutomationMetadata, type CredentialsFromAutomationMetadata, type EventTriggerConfig, type HandlerFromAutomationMetadata, type IncomingWebhookInput, type IncomingWebhookTriggerConfig, type InputFromAutomationMetadata, type JsonSchemaObject, type ScheduleRunInput, type ScheduleTriggerConfig, type TriggerConfig, type TriggerFromAutomationMetadata, type UniformConnectionParams, defineAutomation };

package/dist/index.mjs

@@ -18,7 +18,7 @@ function captureLog(logs, level, message) {
       break;
   }
 }
-async function runAutomationHandler(handler, payload) {
+async function runAutomationHandler(handler, payload, options = {}) {
   var _a, _b;
   const logs = [];
   const log = {
@@ -34,6 +34,14 @@ async function runAutomationHandler(handler, payload) {
   if (payload.uniformCredentials) {
     context.uniformCredentials = payload.uniformCredentials;
   }
+  if (options.requireUniformCredentials && !payload.uniformCredentials) {
+    captureLog(
+      logs,
+      "error",
+      "This automation declares permissions but the run received no Uniform credentials, so it was not invoked. Re-deploy the automation to reprovision its identity."
+    );
+    return { outcome: "failure", logs };
+  }
   try {
     const result = await handler(context);
     return { outcome: (_a = result == null ? void 0 : result.outcome) != null ? _a : "success", logs };
@@ -45,8 +53,16 @@ async function runAutomationHandler(handler, payload) {
 }
 
 // src/defineAutomation.ts
+function metadataRequiresUniformCredentials(metadata) {
+  if ("permissions" in metadata && metadata.permissions) {
+    return true;
+  }
+  const triggers = "triggers" in metadata ? metadata.triggers : void 0;
+  return Array.isArray(triggers) && triggers.some((trigger) => (trigger == null ? void 0 : trigger.type) === "aiTool");
+}
 function defineAutomation(config) {
-  const invoker = (payload) => runAutomationHandler(config.handler, payload);
+  const requireUniformCredentials = metadataRequiresUniformCredentials(config.metadata);
+  const invoker = (payload) => runAutomationHandler(config.handler, payload, { requireUniformCredentials });
   return Object.assign(invoker, { metadata: config.metadata });
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniformdev/automations-sdk",
-  "version": "20.72.3-alpha.14+1e232e59cd",
+  "version": "20.72.3-alpha.23+cbe06f1e8a",
   "description": "Uniform Automations SDK",
   "license": "SEE LICENSE IN LICENSE.txt",
   "exports": {
@@ -40,8 +40,8 @@
   ],
   "dependencies": {
     "@standard-schema/spec": "^1.1.0",
-    "@uniformdev/context": "20.72.3-alpha.14+1e232e59cd",
-    "@uniformdev/webhooks": "20.72.3-alpha.14+1e232e59cd"
+    "@uniformdev/context": "20.72.3-alpha.23+cbe06f1e8a",
+    "@uniformdev/webhooks": "20.72.3-alpha.23+cbe06f1e8a"
   },
   "peerDependencies": {
     "ai": "^6.0.0",
@@ -62,5 +62,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "1e232e59cd3ded97b85b063986cc95e954b8c937"
+  "gitHead": "cbe06f1e8a5bb93b0e3cae6b1c8774f21c10506e"
 }