Agents API

withPermissionRoute(
  request,
  {
    anyPermission: ['agents.read'],  // or 'agents.write' for mutations
    authMode: 'lightweight',         // read endpoints use lightweight
  },
  async (req: AppRouteRequest) => { ... }
)

// GET /api/agents
const agents = await prisma.agent.findMany({
  where: { organizationId },
  orderBy: { updatedAt: 'desc' },
});

// POST /api/agents
const agent = await prisma.agent.create({
  data: {
    organizationId,
    name: data.name,
    description: data.description,
    // ...other fields
  },
});

// GET /api/agents/[id]
const agent = await prisma.agent.findFirst({
  where: { id: agentId, organizationId },
});
if (!agent) return NextResponse.json({ error: 'Not found' }, { status: 404 });

import {
  getAvailableAgentSkillSlug,
  assertAgentBelongsToOrganization,
  normalizeAgentSkillSlug,
  AGENT_SKILL_STATUS_VALUES,
  AGENT_SKILL_ACTION_TYPES,
  listSkillPacksForAgent,
  applySkillPack,
  createAgentSkillOptimizationApprovals,
} from '@zappway/lib/agent-skills';

// scope: 'agent' → agentId = params.id
// scope: 'organization' → agentId = null
agentId: data.scope === 'organization' ? null : agentId,

UniqueConstraint: organizationId_slug

const conflict = await prisma.agentSkill.findUnique({
  where: { organizationId_slug: { organizationId, slug: nextSlug } },
  select: { id: true },
});
if (conflict && conflict.id !== current.id) return 409;

import type { AgentSkillsResponse } from '@zappway/lib/types/agent-skills';
// Response: { skills: AgentSkill[], approvals: ActionApproval[] }

const reverseTools = await tx.tool.findMany({
  where: { agentId: targetAgentId, type: 'agent' },
  select: { config: true },
});
const hasCycle = reverseTools.some(
  (t) => (t.config as Record<string, unknown> | null)?.targetAgentId === parentAgentId
);
if (hasCycle) return 400 'CYCLE_BLOCKED';

// Stored in tool.config (Prisma.InputJsonObject)
{
  targetAgentId: string,
  specialistRule: {
    toolId: string,
    targetAgentId: string,
    reason: string,
    confidence: number,
    signalsDetected: string[],
    matchedDocuments: string[],
    status: 'active',
    createdAt: string, // ISO
  }
}

if (data.action === 'deactivate') {
  delete config.specialistRule;
  await prisma.tool.update({ where: { id: data.toolId }, data: { config } });
}