spine-framework 0.3.124 → 0.3.126

package/.framework/functions/triggers.ts

@@ -1,110 +1,97 @@
-/**
- * @module triggers
- * @audience core-contributor
- * @layer api-handler
- * @stability stable
- *
- * CRUD API for the `triggers` table, plus execution history access.
- * Triggers bind event types to pipelines. When an event fires, the trigger
- * engine evaluates active triggers via `_shared/trigger-engine.ts`.
- *
- * **Routed by:** `GET/POST/PATCH/DELETE /.netlify/functions/triggers`
- *
- * **Actions:**
- * | method | ?action    | handler       |
- * |--------|------------|---------------|
- * | GET    | by-event   | listByEvent   |
- * | GET    | executions | getExecutions |
- * | POST   | toggle     | toggle        |
- * | GET    | ?id        | get           |
- * | GET    | (default)  | list          |
- * | POST   | —          | create        |
- * | PATCH  | —          | update        |
- * | DELETE | —          | remove (soft) |
- *
- * **Authorization:** `create` requires system admin OR first-surface `canCreate`
- * permission. All other operations use `ctx.db` RLS.
- *
- * Also exports `AGENT_EVENT_TYPES` constant and `getAgentEventTypes()` helper
- * for referencing well-known agent event slugs in trigger configuration.
- *
- * @seeAlso trigger-engine.ts (checkAndFireTriggers — runtime evaluation)
- * @seeAlso pipelines.ts (pipeline_id FK on triggers)
- * @seeAlso audit.ts (emitLog for trigger.* events)
- */
 
+
+
+
+
+
+
+
+
+
+// CIL[BEGIN chunk_id="triggers_module_header_1783931956" type="module_header" identity="module_header" parent="none"]
+// CIL[DOC-MACRO purpose="Import dependencies for triggers CRUD API"]
+// CIL[DOC-RESPONSIBILITY responsibility="Provide middleware, database, audit and permissions utilities"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/functions/_shared/principal.ts\",\".framework/functions/_shared/schema-utils.ts\",\"custom/apps/portal/pages/ContentPage.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="imported modules and permissions instance" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Imports all required modules for trigger management operations" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-AUDIENCE audience="developer"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/src/pages/admin/TypeDetailPage.tsx, .framework/functions/_shared/principal.ts, .framework/functions/_shared/schema-utils.ts, custom/apps/portal/pages/ContentPage.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 import { createHandler } from './_shared/middleware'
-import { joins } from './_shared/db'
+import { joins, adminDb } from './_shared/db'
 import { emitLog } from './_shared/audit'
 import { PermissionEngine, sanitizeRecordData } from './_shared/permissions'
+import { isSystemAdmin } from './_shared/principal'
 
 const permissions = PermissionEngine as any
-
-// ─── CONSTANTS ─────────────────────────────────────────────────────────────────
-
-/**
- * Well-known agent event type slugs for use in trigger `event_type` config.
- * These are emitted by `agent-runner.ts` during inference, tool dispatch,
- * and escalation workflows.
- */
+// CIL[END chunk_id="triggers_module_header_1783931956"]
+// CIL[BEGIN chunk_id="triggers_constants_1783931956" type="constants" identity="constants" parent="none"]
+// CIL[DOC-MACRO purpose="Define agent event type constants"]
+// CIL[DOC-RESPONSIBILITY responsibility="Provide well-known event type slugs for triggers"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[\".framework/src/pages/admin/TypeDetailPage.tsx\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/src/pages/admin/IntegrationsPage.tsx\",\".framework/functions/_shared/schema-utils.ts\",\".framework/functions/_shared/principal.ts\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="event type constants object" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Defines constants for inference, tool, conversation, and escalation events" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/TypeDetailPage.tsx, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/src/pages/admin/IntegrationsPage.tsx, .framework/functions/_shared/schema-utils.ts, .framework/functions/_shared/principal.ts, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const AGENT_EVENT_TYPES = {
-  // Inference events
   INFERENCE_COMPLETED: 'agent.inference.completed',
   INFERENCE_FAILED: 'agent.inference.failed',
   LOW_CONFIDENCE: 'agent.inference.low_confidence',
-  
-  // Tool events
   TOOL_CALLED: 'agent.tool.called',
   TOOL_COMPLETED: 'agent.tool.completed',
   TOOL_FAILED: 'agent.tool.failed',
-  
-  // Conversation events
   MESSAGE_RECEIVED: 'agent.message.received',
   MESSAGE_SENT: 'agent.message.sent',
   THREAD_CREATED: 'agent.thread.created',
-  
-  // Escalation events
   ESCALATION_TRIGGERED: 'agent.escalation.triggered',
   ESCALATION_RESOLVED: 'agent.escalation.resolved',
   HUMAN_HANDOFF: 'agent.human.handoff'
 } as const
-
-// ─── CHUNK_START: TRIGGERS_GET_AGENT_EVENT_TYPES ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_GET_AGENT_EVENT_TYPES_1_0_0
- * @version     1.0.0
- * @hash        ef90bc655886f31a4417d82b5bac35cfece4ba4e03770d71a449fc36e4cecb24
- * @macro       Agent Event Types Helper
- * @micro       Returns array of all agent event type slugs for UI dropdowns
- * @inputs      None
- * @outputs     string[] — All AGENT_EVENT_TYPES values
- * @depends-on  [AGENT_EVENT_TYPES constant]
- * @depended-by [UI components, trigger configuration forms]
- * @side-effects [None]
- * @tags        triggers, helper, event-types, ui
- */
+// CIL[END chunk_id="triggers_constants_1783931956"]
+// CIL[BEGIN chunk_id="triggers_getagenteventtypes_1783931956" type="function" identity="getAgentEventTypes" parent="none"]
+// CIL[DOC-MACRO purpose="Return array of agent event type slugs"]
+// CIL[DOC-RESPONSIBILITY responsibility="Provide event type options for UI dropdowns"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[\".framework/src/pages/admin/TypeDetailPage.tsx\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"custom/apps/portal/pages/ContentPage.tsx\",\"custom/apps/cortex/functions/custom_cil-embeddings.ts\",\".framework/functions/_shared/schema-utils.ts\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="string array of event types" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Extracts values from AGENT_EVENT_TYPES constant for UI consumption" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/TypeDetailPage.tsx, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, custom/apps/portal/pages/ContentPage.tsx, custom/apps/cortex/functions/custom_cil-embeddings.ts, .framework/functions/_shared/schema-utils.ts, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export function getAgentEventTypes(): string[] {
   return Object.values(AGENT_EVENT_TYPES)
 }
-// ─── CHUNK_END: TRIGGERS_GET_AGENT_EVENT_TYPES ────────────────────────────────────────────────
-
-// ─── HANDLERS ─────────────────────────────────────────────────────────────────
-
-// ─── CHUNK_START: TRIGGERS_LIST_BY_EVENT ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_LIST_BY_EVENT_1_0_0
- * @version     1.0.0
- * @hash        c6d2127dc2ced6d0618b338d227d8823b699b86977fc14ce455a27a29a2b1fa5
- * @macro       Triggers by Event List Handler
- * @micro       Lists triggers filtered by event type with sanitization
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body (unused for GET)
- * @outputs     Array of sanitized trigger records with app/createdBy joins
- * @depends-on  [createHandler, joins, sanitizeRecordData]
- * @depended-by [Netlify function routing]
- * @side-effects [DB queries, permission sanitization]
- * @tags        triggers, list, event-type, crud
- */
+// CIL[END chunk_id="triggers_getagenteventtypes_1783931956"]
+// CIL[BEGIN chunk_id="triggers_listbyevent_1783931956" type="function" identity="listByEvent" parent="none"]
+// CIL[DOC-MACRO purpose="List triggers filtered by event type"]
+// CIL[DOC-RESPONSIBILITY responsibility="Handle event-specific trigger listing with sanitization"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[\".framework/src/pages/admin/TypeDetailPage.tsx\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/src/pages/admin/RolesPage.tsx\",\".framework/functions/_shared/schema-utils.ts\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="sanitized trigger array" errors="throws" side_effects="database queries"]
+// CIL[DOC-MICRO logic_summary="Filters triggers by event_type and app, sanitizes based on permissions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/TypeDetailPage.tsx, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/src/pages/admin/RolesPage.tsx, .framework/functions/_shared/schema-utils.ts, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const listByEvent = createHandler(async (ctx, body) => {
   const { event_type, app_id, include_inactive } = ctx.query || {}
 
@@ -116,9 +103,11 @@ export const listByEvent = createHandler(async (ctx, body) => {
     throw new Error('Account context required')
   }
 
-  let query = ctx.db
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+
+  let query = db
     .from('triggers')
-    .select(`*, ${joins.app}, ${joins.createdBy}`)
+    .select('*')
     .eq('event_type', event_type)
     .order('name')
 
@@ -133,7 +122,6 @@ export const listByEvent = createHandler(async (ctx, body) => {
 
   if (err) throw err
 
-  // Sanitize each record based on role permissions
   const sanitized = []
   for (const trigger of data || []) {
     sanitized.push(await sanitizeRecordData(ctx, trigger, 'trigger'))
@@ -141,23 +129,21 @@ export const listByEvent = createHandler(async (ctx, body) => {
 
   return sanitized
 })
-// ─── CHUNK_END: TRIGGERS_LIST_BY_EVENT ────────────────────────────────────────────────
-
-// ─── CHUNK_START: TRIGGERS_LIST ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_LIST_1_0_0
- * @version     1.0.0
- * @hash        b65a861b2a1b7c63a6a2bbe395dfb6138fe00e0517a0eb40f012c2317fbcf45f
- * @macro       Triggers List Handler
- * @micro       Lists triggers with filtering and sanitization
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body (unused for GET)
- * @outputs     Array of sanitized trigger records with app/createdBy joins
- * @depends-on  [createHandler, joins, sanitizeRecordData]
- * @depended-by [Netlify function routing]
- * @side-effects [DB queries, permission sanitization]
- * @tags        triggers, list, crud, filtering
- */
+// CIL[END chunk_id="triggers_listbyevent_1783931956"]
+// CIL[BEGIN chunk_id="triggers_list_1783931956" type="function" identity="list" parent="none"]
+// CIL[DOC-MACRO purpose="List all triggers with filtering and sanitization"]
+// CIL[DOC-RESPONSIBILITY responsibility="Handle general trigger listing with authentication"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="sanitized trigger array" errors="throws" side_effects="database queries"]
+// CIL[DOC-MICRO logic_summary="Filters triggers by app/event_type, sanitizes based on permissions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const list = createHandler(async (ctx, body) => {
   const { app_id, event_type, include_inactive } = ctx.query || {}
 
@@ -165,10 +151,11 @@ export const list = createHandler(async (ctx, body) => {
     throw new Error('Account context required')
   }
 
-  // RLS automatically filters to accessible accounts
-  let query = ctx.db
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+
+  let query = db
     .from('triggers')
-    .select(`*, ${joins.app}, ${joins.createdBy}`)
+    .select('*')
     .order('name')
 
   if (app_id) {
@@ -185,7 +172,6 @@ export const list = createHandler(async (ctx, body) => {
 
   if (err) throw err
 
-  // Sanitize each record based on role permissions
   const sanitized = []
   for (const trigger of data || []) {
     sanitized.push(await sanitizeRecordData(ctx, trigger, 'trigger'))
@@ -193,23 +179,21 @@ export const list = createHandler(async (ctx, body) => {
 
   return sanitized
 })
-// ─── CHUNK_END: TRIGGERS_LIST ────────────────────────────────────────────────
-
-// ─── CHUNK_START: TRIGGERS_GET ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_GET_1_0_0
- * @version     1.0.0
- * @hash        106ae81cd0528145f976f7c8e0cc16cacaf32468d0e2950a16b8f167bb88143d
- * @macro       Trigger Get Handler
- * @micro       Returns single trigger record with joins and sanitization
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body (unused for GET)
- * @outputs     Sanitized trigger record with app/createdBy joins
- * @depends-on  [createHandler, joins, sanitizeRecordData]
- * @depended-by [Netlify function routing]
- * @side-effects [DB single row query, permission sanitization]
- * @tags        triggers, get, crud, single-record
- */
+// CIL[END chunk_id="triggers_list_1783931956"]
+// CIL[BEGIN chunk_id="triggers_get_1783931956" type="function" identity="get" parent="none"]
+// CIL[DOC-MACRO purpose="Get single trigger by ID with sanitization"]
+// CIL[DOC-RESPONSIBILITY responsibility="Retrieve and sanitize individual trigger records"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="sanitized trigger object" errors="throws" side_effects="database query"]
+// CIL[DOC-MICRO logic_summary="Queries trigger by ID with app/createdBy joins, sanitizes based on permissions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const get = createHandler(async (ctx, body) => {
   const { id } = ctx.query || {}
 
@@ -217,46 +201,88 @@ export const get = createHandler(async (ctx, body) => {
     throw new Error('Trigger ID is required')
   }
 
-  const { data, error: err } = await ctx.db
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+
+  const { data, error: err } = await db
     .from('triggers')
-    .select(`*, ${joins.app}, ${joins.createdBy}`)
+    .select('*')
     .eq('id', id)
     .single()
 
   if (err) throw err
 
-  // Sanitize based on role permissions
   return await sanitizeRecordData(ctx, data, 'trigger')
 })
-// ─── CHUNK_END: TRIGGERS_GET ────────────────────────────────────────────────
-
-// ─── CHUNK_START: TRIGGERS_CREATE ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_CREATE_1_0_0
- * @version     1.0.0
- * @hash        4411a0111e10158d29446e4b989fbccaf1e55057b4f809129eed33f93ee21901
- * @macro       Trigger Create Handler
- * @micro       Creates trigger with permission validation and audit logging
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: object — Trigger data including name, trigger_type, and optional fields
- * @outputs     Inserted trigger record
- * @depends-on  [createHandler, PermissionEngine, emitLog]
- * @depended-by [Netlify function routing]
- * @side-effects [DB insert, permission validation, audit logging]
- * @tags        triggers, create, crud, permissions, audit
- */
+// CIL[END chunk_id="triggers_get_1783931956"]
+// CIL[BEGIN chunk_id="triggers_getexecutions_1783931956" type="function" identity="getExecutions" parent="none"]
+// CIL[DOC-MACRO purpose="Get execution history for a specific trigger"]
+// CIL[DOC-RESPONSIBILITY responsibility="Retrieve trigger execution records with pagination"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="execution records array" errors="throws" side_effects="database queries"]
+// CIL[DOC-MICRO logic_summary="Queries trigger_executions table with pagination and ordering" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+export const getExecutions = createHandler(async (ctx, body) => {
+  const { trigger_id, limit = '50', offset = '0' } = ctx.query || {}
+
+  if (!trigger_id) {
+    throw new Error('trigger_id is required')
+  }
+
+  if (!ctx.accountId) {
+    throw new Error('Account context required')
+  }
+
+  const { data, error: err } = await ctx.db
+    .from('trigger_executions')
+    .select('*')
+    .eq('trigger_id', trigger_id)
+    .order('executed_at', { ascending: false })
+    .range(parseInt(offset), parseInt(offset) + parseInt(limit) - 1)
+
+  if (err) throw err
+
+  return data || []
+})
+// CIL[END chunk_id="triggers_getexecutions_1783931956"]
+// CIL[BEGIN chunk_id="triggers_create_1783931956" type="function" identity="create" parent="none"]
+// CIL[DOC-MACRO purpose="Create new trigger with permissions and audit"]
+// CIL[DOC-RESPONSIBILITY responsibility="Handle trigger creation with validation and logging"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="created trigger record" errors="throws" side_effects="database insert, audit log"]
+// CIL[DOC-MICRO logic_summary="Validates permissions, creates trigger with defaults, emits audit log" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const create = createHandler(async (ctx, body) => {
-  const { app_id, name, description, trigger_type, event_type, config, pipeline_id, metadata, is_active } = body
+  const { app_id, name, description, event_type, pipeline_id, config, metadata } = body
 
-  if (!name || !trigger_type) {
-    throw new Error('name and trigger_type are required')
+  if (!name || !event_type || !pipeline_id) {
+    throw new Error('name, event_type, and pipeline_id are required')
   }
 
   if (!ctx.principal || ctx.principal.id === 'anonymous' || !ctx.accountId) {
     throw new Error('User context (person and account) required')
   }
 
-  // Check create permissions
+  // NOTE: previously called `permissions.isSystemAdmin(ctx.principal)` (wrong
+  // argument shape — that method reads `ctx.principal.roles`, so passing the
+  // Principal itself made it always resolve false) followed by a
+  // `permissions.hasPermission(...)` call that doesn't exist on PermissionEngine,
+  // so this handler always threw at runtime. Use the same
+  // isSystemAdmin(ctx)-then-resolveFirstSurfacePermissions pattern as
+  // apps.ts/roles.ts/types.ts.
   if (!permissions.isSystemAdmin(ctx)) {
     const perms = await permissions.resolveFirstSurfacePermissions(
       ctx.principal.id,
@@ -264,7 +290,7 @@ export const create = createHandler(async (ctx, body) => {
       'trigger',
       'create'
     )
-    
+
     if (!perms.canCreate) {
       throw new Error('Insufficient permissions to create triggers')
     }
@@ -273,17 +299,15 @@ export const create = createHandler(async (ctx, body) => {
   const { data, error: err } = await ctx.db
     .from('triggers')
     .insert({
-      app_id,
+      app_id: app_id || null,
+      account_id: ctx.accountId,
       name,
-      description,
-      trigger_type,
+      description: description || null,
       event_type,
+      pipeline_id,
       config: config || {},
-      pipeline_id: pipeline_id || null,
       metadata: metadata || {},
-      is_active: is_active ?? true,
-      created_by: ctx.principal.id,
-      account_id: ctx.accountId
+      created_by: ctx.principal.id
     })
     .select()
     .single()
@@ -292,65 +316,43 @@ export const create = createHandler(async (ctx, body) => {
 
   await emitLog(ctx, 'trigger.created', 
     { type: 'trigger', id: data.id }, 
-    { after: data }
+    { after: { name, event_type } }
   )
 
   return data
 })
-// ─── CHUNK_END: TRIGGERS_CREATE ────────────────────────────────────────────────
-
-// ─── CHUNK_START: TRIGGERS_UPDATE ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_UPDATE_1_0_0
- * @version     1.0.0
- * @hash        8c7ee9556f7e18c9b63746baaf49ae73a4526735227a828bc77aaf518d4796fb
- * @macro       Trigger Update Handler
- * @micro       Updates trigger with audit logging and before/after state
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: object — Trigger updates including id and updatable fields
- * @outputs     Updated trigger record
- * @depends-on  [createHandler, emitLog]
- * @depended-by [Netlify function routing]
- * @side-effects [DB update, audit logging]
- * @tags        triggers, update, crud, audit
- */
+// CIL[END chunk_id="triggers_create_1783931956"]
+// CIL[BEGIN chunk_id="triggers_update_1783931956" type="function" identity="update" parent="none"]
+// CIL[DOC-MACRO purpose="Update existing trigger with field allowlist"]
+// CIL[DOC-RESPONSIBILITY responsibility="Handle trigger updates with validation and audit logging"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="updated trigger record" errors="throws" side_effects="database update, audit log"]
+// CIL[DOC-MICRO logic_summary="Updates only allowed fields, adds timestamp, emits audit log" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const update = createHandler(async (ctx, body) => {
   const id = body?.id || ctx.query?.id
-  const { id: _bodyId, app_id, name, description, trigger_type, event_type, config, pipeline_id, metadata, is_active } = body || {}
+  const { id: _bodyId, ...updates } = body || {}
 
   if (!id) {
     throw new Error('Trigger ID is required')
   }
 
-  if (!ctx.principal || ctx.principal.id === 'anonymous' || !ctx.accountId) {
-    throw new Error('User context (person and account) required')
-  }
-
-  // Get current state for audit - RLS will filter to accessible triggers
-  const { data: current } = await ctx.db
-    .from('triggers')
-    .select('*')
-    .eq('id', id)
-    .single()
-
-  if (!current) {
-    throw new Error('Trigger not found')
+  const allowed = ['name', 'description', 'config', 'pipeline_id', 'metadata', 'is_active', 'event_type', 'app_id']
+  const updateData: Record<string, any> = { updated_at: new Date().toISOString() }
+  for (const key of allowed) {
+    if (updates[key] !== undefined) updateData[key] = updates[key]
   }
 
   const { data, error: err } = await ctx.db
     .from('triggers')
-    .update({
-      app_id,
-      name,
-      description,
-      trigger_type,
-      event_type,
-      config,
-      pipeline_id,
-      metadata,
-      is_active,
-      updated_at: new Date().toISOString()
-    })
+    .update(updateData)
     .eq('id', id)
     .select()
     .single()
@@ -359,28 +361,26 @@ export const update = createHandler(async (ctx, body) => {
 
   await emitLog(ctx, 'trigger.updated', 
     { type: 'trigger', id }, 
-    { before: current, after: data }
+    { after: updateData }
   )
 
   return data
 })
-// ─── CHUNK_END: TRIGGERS_UPDATE ────────────────────────────────────────────────
-
-// ─── CHUNK_START: TRIGGERS_REMOVE ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_REMOVE_1_0_0
- * @version     1.0.0
- * @hash        d25952bb0f5bcd15fb5272f6d54a975b8a0f1cc6b85bc514b0e91df2fcb35ad5
- * @macro       Trigger Remove Handler
- * @micro       Soft-deletes trigger with audit logging and before/after state
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: object — Trigger id for deletion
- * @outputs     Updated trigger record with is_active: false
- * @depends-on  [createHandler, emitLog]
- * @depended-by [Netlify function routing]
- * @side-effects [DB soft delete, audit logging]
- * @tags        triggers, remove, soft-delete, audit
- */
+// CIL[END chunk_id="triggers_update_1783931956"]
+// CIL[BEGIN chunk_id="triggers_remove_1783931956" type="function" identity="remove" parent="none"]
+// CIL[DOC-MACRO purpose="Soft delete trigger with validation and audit"]
+// CIL[DOC-RESPONSIBILITY responsibility="Handle trigger deletion with safety checks and logging"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="success indicator" errors="throws" side_effects="database update, audit log"]
+// CIL[DOC-MICRO logic_summary="Validates trigger exists, soft deletes by setting is_active=false, emits audit log" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const remove = createHandler(async (ctx, body) => {
   const id = body?.id || ctx.query?.id
 
@@ -388,68 +388,71 @@ export const remove = createHandler(async (ctx, body) => {
     throw new Error('Trigger ID is required')
   }
 
-  if (!ctx.principal || ctx.principal.id === 'anonymous' || !ctx.accountId) {
-    throw new Error('User context (person and account) required')
-  }
-
-  // Get current state for audit - RLS will filter to accessible triggers
-  const { data: current } = await ctx.db
+  const { data: existing } = await ctx.db
     .from('triggers')
-    .select('*')
+    .select('name, event_type')
     .eq('id', id)
     .single()
 
-  if (!current) {
+  if (!existing) {
     throw new Error('Trigger not found')
   }
 
-  const { data, error: err } = await ctx.db
+  const { error: err } = await ctx.db
     .from('triggers')
-    .update({
+    .update({ 
       is_active: false,
       updated_at: new Date().toISOString()
     })
     .eq('id', id)
-    .select()
-    .single()
 
   if (err) throw err
 
-  await emitLog(ctx, 'trigger.deleted',
-    { type: 'trigger', id },
-    { before: current, after: data }
+  await emitLog(ctx, 'trigger.deleted', 
+    { type: 'trigger', id }, 
+    { before: { name: existing.name, event_type: existing.event_type } }
   )
 
-  return data
+  return { success: true }
 })
-// ─── CHUNK_END: TRIGGERS_REMOVE ────────────────────────────────────────────────
-
-// ─── CHUNK_START: TRIGGERS_TOGGLE ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_TOGGLE_1_0_0
- * @version     1.0.0
- * @hash        56add34659ac69c93b3570eb63f3bc3072d6a15083f79eaa7a9926f40f275373
- * @macro       Trigger Toggle Handler
- * @micro       Activates or deactivates trigger with audit logging
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: object — Trigger id and is_active boolean
- * @outputs     Updated trigger record
- * @depends-on  [createHandler, emitLog]
- * @depended-by [Netlify function routing]
- * @side-effects [DB update, audit logging]
- * @tags        triggers, toggle, state-transition, audit
- */
+// CIL[END chunk_id="triggers_remove_1783931956"]
+// CIL[BEGIN chunk_id="triggers_toggle_1783931956" type="function" identity="toggle" parent="none"]
+// CIL[DOC-MACRO purpose="Toggle trigger active status with audit logging"]
+// CIL[DOC-RESPONSIBILITY responsibility="Handle trigger activation/deactivation with validation"]
+// CIL[DOC-CONTEXT module="triggers" layer="api-handler" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="updated trigger record" errors="throws" side_effects="database update, audit log"]
+// CIL[DOC-MICRO logic_summary="Flips is_active boolean, updates timestamp, emits audit log" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: api-handler. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const toggle = createHandler(async (ctx, body) => {
-  const { id, is_active } = body
+  const id = body?.id || ctx.query?.id
+
+  if (!id) {
+    throw new Error('Trigger ID is required')
+  }
+
+  const { data: existing } = await ctx.db
+    .from('triggers')
+    .select('is_active, name')
+    .eq('id', id)
+    .single()
 
-  if (!id || is_active === undefined) {
-    throw new Error('Trigger ID and is_active are required')
+  if (!existing) {
+    throw new Error('Trigger not found')
   }
 
+  const newStatus = !existing.is_active
+
   const { data, error: err } = await ctx.db
     .from('triggers')
-    .update({
-      is_active,
+    .update({ 
+      is_active: newStatus,
       updated_at: new Date().toISOString()
     })
     .eq('id', id)
@@ -460,104 +463,37 @@ export const toggle = createHandler(async (ctx, body) => {
 
   await emitLog(ctx, 'trigger.toggled', 
     { type: 'trigger', id }, 
-    { after: { is_active } }
+    { 
+      before: { is_active: existing.is_active },
+      after: { is_active: newStatus }
+    }
   )
 
   return data
 })
-// ─── CHUNK_END: TRIGGERS_TOGGLE ────────────────────────────────────────────────
-
-// ─── CHUNK_START: TRIGGERS_GET_EXECUTIONS ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_GET_EXECUTIONS_1_0_0
- * @version     1.0.0
- * @hash        cf649749d76cd4d5909f96eb9193fd791f30f1e6268e1a0e6cb35ee4676d3071
- * @macro       Trigger Executions Handler
- * @micro       Returns paginated execution history for a trigger
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body (unused for GET)
- * @outputs     Array of trigger_executions rows ordered by triggered_at desc
- * @depends-on  [createHandler]
- * @depended-by [Netlify function routing]
- * @side-effects [DB queries, pagination]
- * @tags        triggers, executions, history, pagination
- */
-export const getExecutions = createHandler(async (ctx, body) => {
-  const { trigger_id, limit = 50, offset = 0 } = ctx.query || {}
-
-  if (!trigger_id) {
-    throw new Error('Trigger ID is required')
-  }
-
-  const parsedLimit = parseInt(limit.toString())
-  const parsedOffset = parseInt(offset.toString())
+// CIL[END chunk_id="triggers_toggle_1783931956"]
 
-  const { data, error: err } = await ctx.db
-    .from('trigger_executions')
-    .select('*')
-    .eq('trigger_id', trigger_id)
-    .order('triggered_at', { ascending: false })
-    .range(parsedOffset, parsedOffset + parsedLimit - 1)
-
-  if (err) throw err
-
-  return data
-})
-// ─── CHUNK_END: TRIGGERS_GET_EXECUTIONS ────────────────────────────────────────────────
-
-// ─── MAIN HANDLER ────────────────────────────────────────────────────────────
-
-// ─── CHUNK_START: TRIGGERS_HANDLER ──────────────────────────────────────────────
-/**
- * @chunk-id    TRIGGERS_HANDLER_1_0_0
- * @version     1.0.0
- * @hash        4efc53a8d92acf3346a939c519e3fbd0d64be57f4ee65a81ee213c5aba24e2ce
- * @macro       Triggers Router
- * @micro       Routes HTTP methods and actions to appropriate trigger handlers
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body for POST/PATCH/DELETE operations
- * @outputs     Varies — Depends on routed handler (listByEvent/getExecutions/toggle/list/get/create/update/remove)
- * @depends-on  [createHandler, listByEvent, getExecutions, toggle, list, get, create, update, remove]
- * @depended-by [Netlify function routing]
- * @side-effects [Delegates to appropriate handler]
- * @tags        triggers, router, crud, netlify-function
- */
 export const handler = createHandler(async (ctx, body) => {
   const { action } = ctx.query || {}
-  const method = ctx.query?.method || 'GET'
 
   switch (action) {
-    case 'by-event':
-      if (method === 'GET') {
-        return await listByEvent(ctx, body)
-      }
-      break
-    case 'executions':
-      if (method === 'GET') {
-        return await getExecutions(ctx, body)
-      }
-      break
+    case 'list':
+      return await list(ctx, body)
+    case 'listByEvent':
+      return await listByEvent(ctx, body)
+    case 'get':
+      return await get(ctx, body)
+    case 'getExecutions':
+      return await getExecutions(ctx, body)
+    case 'create':
+      return await create(ctx, body)
+    case 'update':
+      return await update(ctx, body)
+    case 'remove':
+      return await remove(ctx, body)
     case 'toggle':
-      if (method === 'POST') {
-        return await toggle(ctx, body)
-      }
-      break
+      return await toggle(ctx, body)
     default:
-      if (method === 'GET') {
-        if (ctx.query?.id) {
-          return await get(ctx, body)
-        } else {
-          return await list(ctx, body)
-        }
-      } else if (method === 'POST') {
-        return await create(ctx, body)
-      } else if (method === 'PATCH') {
-        return await update(ctx, body)
-      } else if (method === 'DELETE') {
-        return await remove(ctx, body)
-      }
+      throw new Error(`Unsupported action: ${action}`)
   }
-
-  throw new Error('Invalid action or method')
-})
-// ─── CHUNK_END: TRIGGERS_HANDLER ────────────────────────────────────────────────
+})