Let an agent propose an automation

import type { WorkflowDefinition, WorkflowIssue, WorkflowNode } from "@/components/candor/workflow-editor"

/** Your app's lists: what can start a workflow, what a step can do, and what a condition can test. */
export const EVENTS = ["invoice.received", "invoice.disputed"]
export const ACTIONS = ["request-approval", "mark-ready", "pay", "notify", "hold"]
export const FIELDS = ["amount", "supplier", "reference"]

/**
 * The rules your app holds a workflow to, run in the browser as the person edits (WorkflowEditor's `validate`) and
 * again on the server before it saves. Each issue names the node it is about, so the editor shows it there.
 */
export function checkWorkflow(definition: WorkflowDefinition): WorkflowIssue[] {
  const issues: WorkflowIssue[] = []
  if (definition.trigger.kind === "event" && definition.trigger.event !== null && !EVENTS.includes(definition.trigger.event))
    issues.push({ trigger: true, message: "This event doesn't exist in the app. Choose another." })
  // A payment needs an approval before it on every path that reaches it.
  const walk = (nodes: WorkflowNode[], approved: boolean): boolean => {
    let ok = approved
    for (const node of nodes) {
      if (node.kind === "step") {
        if (node.action !== null && !ACTIONS.includes(node.action)) issues.push({ node: node.id, message: "This action doesn't exist in the app. Choose another." })
        if (node.action === "request-approval") ok = true
        if (node.action === "pay" && !ok) issues.push({ node: node.id, message: "A payment needs an approval step before it on the same path." })
      } else {
        for (const rule of node.rules) if (!FIELDS.includes(rule.field)) issues.push({ node: node.id, message: `There's no field called ${rule.field}.` })
        const a = walk(node.whenTrue, ok)
        const b = walk(node.whenFalse, ok)
        ok = a && b
      }
    }
    return ok
  }
  walk(definition.nodes, false)
  return issues
}

import { changeHash } from "@/lib/candor/change-hash"
import type { WorkflowDefinition } from "@/components/candor/workflow-editor"
import { checkWorkflow } from "@/lib/workflow-checks"
import { db } from "@/lib/db" // yours: proposals, saved workflows, the audit log
import { viewerOf } from "@/lib/auth" // yours: who is asking

/** Save a workflow a person edited from an agent's proposal. The body is `{ definition, hash }`. */
export async function PUT(request: Request, { params }: { params: Promise<{ id: string }> }) {
  const { id } = await params
  const viewer = await viewerOf(request)
  if (!viewer) return Response.json({ error: "Sign in to save workflows." }, { status: 401 })
  // Check the shape with zod (or your own schema) before trusting it; this sketch assumes it's a WorkflowDefinition.
  const { definition, hash } = (await request.json()) as { definition: WorkflowDefinition; hash: string }

  // The same canonical JSON as the browser's, so the hash names exactly the definition that arrived.
  if ((await changeHash(definition)) !== hash) return Response.json({ error: "The workflow doesn't match its hash. Reload and save again." }, { status: 409 })

  // Your rules again, on the server: the browser's check is for the person, this one is the gate.
  const issues = checkWorkflow(definition)
  if (issues.some((i) => i.severity !== "warning")) return Response.json({ issues }, { status: 422 })

  const proposal = await db.workflowProposal(id)
  if (!proposal) return Response.json({ error: "There's no such proposal." }, { status: 404 })
  const at = new Date().toISOString()
  // Store the definition with its hash and who saved it. What runs is read from here by its hash, never from the proposal.
  await db.saveWorkflow({ proposalId: id, definition, hash, savedBy: viewer.id, at, agent: proposal.agentId })
  await db.audit({ at, who: viewer.id, what: `Saved workflow ${id} (sha256:${hash}), proposed by ${proposal.agentName}.` })
  return Response.json({ saved: true })
}

"use client"

import * as React from "react"
import { WorkflowEditor, type WorkflowDefinition, type WorkflowIssue } from "@/components/candor/workflow-editor"
import { checkWorkflow } from "@/lib/workflow-checks"
import { actions, events, fields } from "@/lib/workflow-lists" // yours: the labels for the ids in workflow-checks

export function EditWorkflow({ id, proposal, agentName }: { id: string; proposal: WorkflowDefinition; agentName: string }) {
  const [failure, setFailure] = React.useState<string>()
  return (
    <WorkflowEditor
      title="New automation"
      agent={agentName}
      proposal={proposal}
      events={events}
      actions={actions}
      fields={fields}
      validate={checkWorkflow}
      error={failure}
      onSave={async (definition, hash) => {
        setFailure(undefined)
        let res: Response
        try {
          res = await fetch(`/api/workflows/${id}`, {
            method: "PUT",
            headers: { "content-type": "application/json" },
            body: JSON.stringify({ definition, hash }),
          })
        } catch {
          setFailure("No answer from the server, so it isn't known whether the workflow was saved. Reload to see.")
          throw new Error("no answer")
        }
        const body = (await res.json()) as { issues?: WorkflowIssue[]; error?: string }
        // The server's own problems go back to the editor, which shows each on its node.
        if (res.status === 422 && body.issues) return body.issues
        if (!res.ok) {
          setFailure(body.error ?? "The workflow wasn't saved.")
          throw new Error(body.error)
        }
      }}
    />
  )
}