@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/actions.js

@@ -0,0 +1,1031 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { resolveAuthoredEventName, sanitizeEventParams } from "./analytics-events.js";
+import { sanitizeAuthorHtml } from "./author-html.js";
+import { CRM_TASK_MAX_DUE_DAYS, isContactLifecycleStage, isCrmActivityKind, isCrmTaskKind } from "./crm-kinds.js";
+import { HOST_EVENT_TYPES } from "./workflows.js";
+/**
+ * Actions builder (AGL-148): HubSpot-style event → action automation on
+ * top of the AGL-128 event triggers. An action listens for a host event
+ * (built-in or a custom name fired by another action), optionally filters
+ * on the payload, and runs an ordered step list. Pure types + validation
+ * here; the executor lives server-side where the I/O is (tenant utils).
+ */ /**
+ * Client-side site events (AGL-256) the tenant page runtime emits:
+ * element interactions, scroll behavior, dwell time, and exit intent.
+ * Trigger config (selector/threshold/path) rides the action's trigger.
+ */ export const SITE_EVENT_TYPES = [
+    'scrollDepth',
+    'scrollToElement',
+    'elementClick',
+    'elementVisible',
+    // Hover choreography (AGL-562): delegated enter/leave on the trigger
+    // selector — the nav-menu/drawer show-hide building blocks.
+    'elementHoverEnter',
+    'elementHoverLeave',
+    'exitIntent',
+    'timeOnPage',
+    'pageVisit'
+];
+/** Site events that watch a specific element and need a selector. */ export const ELEMENT_SCOPED_SITE_EVENTS = [
+    'scrollToElement',
+    'elementClick',
+    'elementVisible',
+    'elementHoverEnter',
+    'elementHoverLeave'
+];
+export function isSiteEventType(event) {
+    return SITE_EVENT_TYPES.includes(event);
+}
+/** Structured condition operators (AGL-557). */ export const TRIGGER_CONDITION_OPS = [
+    'equals',
+    'contains',
+    'notEmpty'
+];
+/**
+ * Evaluates a structured trigger condition (AGL-557). String-coerces the
+ * payload value; `equals`/`contains` compare trimmed + case-insensitive
+ * so checkbox values like "Yes" match an author-typed "yes". A missing
+ * field never matches (and is "empty" for `notEmpty`); an absent or
+ * field-less condition always passes, mirroring the filter's default.
+ */ export function evaluateTriggerCondition(condition, payload) {
+    var _condition_value;
+    var _condition_field;
+    const field = condition == null ? void 0 : (_condition_field = condition.field) == null ? void 0 : _condition_field.trim();
+    if (!condition || !field) return true;
+    const raw = (payload != null ? payload : {})[field];
+    const actual = (raw == null ? '' : String(raw)).trim().toLowerCase();
+    if (condition.op === 'notEmpty') return actual.length > 0;
+    const expected = String((_condition_value = condition.value) != null ? _condition_value : '').trim().toLowerCase();
+    if (condition.op === 'equals') return actual === expected;
+    if (condition.op === 'contains') {
+        return expected.length > 0 && actual.includes(expected);
+    }
+    return false;
+}
+/** How chained trigger conditions combine (AGL-565). */ export const TRIGGER_COMBINATORS = [
+    'and',
+    'or'
+];
+/** Cap on chained conditions per trigger (AGL-565). */ export const ACTION_MAX_CONDITIONS = 5;
+/**
+ * Normalizes a trigger's condition clauses to a list (AGL-565): the
+ * `conditions` array wins when present; a legacy single `condition`
+ * (AGL-557) becomes a one-element list. Read-time only — persisted docs
+ * are never migrated, so pre-565 single-condition docs keep working
+ * unchanged.
+ */ export function normalizeTriggerConditions(trigger) {
+    const conditions = trigger == null ? void 0 : trigger.conditions;
+    if (Array.isArray(conditions)) return conditions.filter(Boolean);
+    return (trigger == null ? void 0 : trigger.condition) ? [
+        trigger.condition
+    ] : [];
+}
+/**
+ * Evaluates a trigger's condition list with its combinator (AGL-565):
+ * `and` (the default) requires every condition to pass, `or` any one.
+ * Per-condition semantics are unchanged from AGL-557
+ * (`evaluateTriggerCondition`), and an empty list always passes — which
+ * covers every pre-565 doc without conditions.
+ */ export function evaluateTriggerConditions(trigger, payload) {
+    const conditions = normalizeTriggerConditions(trigger);
+    if (!conditions.length) return true;
+    return (trigger == null ? void 0 : trigger.combinator) === 'or' ? conditions.some((condition)=>evaluateTriggerCondition(condition, payload)) : conditions.every((condition)=>evaluateTriggerCondition(condition, payload));
+}
+/**
+ * The scope key a resumed flow carries to say the wait ended on the CLOCK
+ * rather than on the event it was watching for.
+ *
+ * This is how a `waitForEvent` gets its timeout branch without a nested step
+ * list: the flow resumes either way, and the step after it carries a `when`
+ * naming this field. Underscored because it shares a namespace with the
+ * event payload's own fields, which are merchant-authored form field names.
+ */ export const FLOW_TIMED_OUT_FIELD = '_waitTimedOut';
+/**
+ * Evaluates a step's own guard, with the trigger's semantics.
+ *
+ * An absent or clause-less guard passes, exactly as an absent trigger
+ * condition does — so every step written before guards existed keeps running.
+ */ export function evaluateStepGuard(guard, scope) {
+    var _ref;
+    const conditions = ((_ref = guard == null ? void 0 : guard.conditions) != null ? _ref : []).filter(Boolean);
+    if (!conditions.length) return true;
+    return (guard == null ? void 0 : guard.combinator) === 'or' ? conditions.some((condition)=>evaluateTriggerCondition(condition, scope)) : conditions.every((condition)=>evaluateTriggerCondition(condition, scope));
+}
+/** Steps the tenant page runtime executes client-side (AGL-257). */ export const CLIENT_ACTION_STEP_TYPES = new Set([
+    'showOverlay',
+    'stickyNav',
+    'addClass',
+    'removeClass',
+    'toggleClass',
+    'showElement',
+    'hideElement',
+    'toggleElement',
+    'openDrawer',
+    'closeDrawer',
+    'toggleDrawer',
+    'openMenu',
+    'closeMenu',
+    'toggleMenu',
+    'setAttribute',
+    'removeAttribute',
+    'scrollTo',
+    'playVideo',
+    'showHtml',
+    'runJs',
+    'redirect',
+    'trackGaEvent',
+    'siteAlert'
+]);
+export function isClientActionStep(step) {
+    return CLIENT_ACTION_STEP_TYPES.has(step.type);
+}
+/**
+ * The steps that suspend a run and continue it later, from a job beat.
+ *
+ * Named as a set rather than checked inline because three surfaces have to
+ * agree on it: the executor stops here and writes an enrollment, the client
+ * payload is truncated here, and the validator refuses a flow that waits
+ * without a person to wait for.
+ */ export const FLOW_SUSPENDING_STEP_TYPES = new Set([
+    'wait',
+    'waitForEvent'
+]);
+export function isFlowSuspendingStep(step) {
+    return FLOW_SUSPENDING_STEP_TYPES.has(step.type);
+}
+/**
+ * The steps that act on the CRM (AGL-2605) — named as a set because the
+ * executor dispatches all five to one module and the docs list them as one
+ * group, and a step added to the union but not here would be a server step
+ * the executor silently skipped.
+ */ export const CRM_ACTION_STEP_TYPES = new Set([
+    'setContactStage',
+    'addContactTag',
+    'assignContactOwner',
+    'createCrmTask',
+    'logCrmActivity'
+]);
+export function isCrmActionStep(step) {
+    return CRM_ACTION_STEP_TYPES.has(step.type);
+}
+/** Longest tag an automation may write — the console's own tag field cap. */ export const CONTACT_TAG_MAX_LENGTH = 60;
+/*
+ * THE RECIPES (AGL-2626).
+ *
+ * A recipe is a ready-to-edit action — a trigger, its conditions and an
+ * ordered step list — built from the vocabulary the editor already offers
+ * and handed to the editor as a draft. Nothing is written until the person
+ * saves, and every field is theirs to change first: the recipe decides
+ * where the editor starts, not what the site runs.
+ *
+ * Defined here, beside the step catalog, rather than in the builder, so the
+ * docs page that lists the recipes and the menu that offers them read ONE
+ * list, and so a step the catalog renames or retires breaks a recipe at
+ * compile time rather than in a menu nobody tests.
+ *
+ * Definitions only. Three of the four are complete as written. `tagByForm`
+ * needs a form, and a form belongs to a site (`hosts/{hostId}/forms`), so
+ * the picker that supplies it is the builder's business and host-scoped by
+ * nature. That is the seam an org-level mount keeps: the recipes are the
+ * same at either level, and only the form picker knows where it is.
+ */ export const CRM_ACTION_RECIPE_IDS = [
+    'welcomeNewLead',
+    'followUpWonDeal',
+    'reengageStaleLead',
+    'tagByForm'
+];
+/**
+ * How long the stale-lead recipe holds before it decides a lead has gone
+ * quiet. A week: long enough that a rep who is working the lead has had a
+ * chance to move its stage, short enough that a lead nobody touched is
+ * still warm when the reminder lands.
+ */ export const STALE_LEAD_WAIT_MINUTES = 7 * 24 * 60;
+/**
+ * The tag a form's captures get: the form's own name, cut to the tag cap.
+ * The name is what the person calls the form, so it is the tag they would
+ * have typed; the editor is open to change it before anything is saved.
+ */ export function crmRecipeTagForForm(formName) {
+    return formName.trim().slice(0, CONTACT_TAG_MAX_LENGTH);
+}
+export const CRM_ACTION_RECIPES = [
+    {
+        id: 'welcomeNewLead',
+        title: 'Welcome a new lead',
+        description: 'When a form makes a new contact: rotate in an owner, book a call for ' + 'tomorrow, send a thank-you, and tag them website.',
+        /*
+     * The owner first, because the task that follows names no assignee and
+     * so goes to whoever owns the contact when it is created — the member
+     * the rotation just chose. Round robin rather than a named member: a
+     * recipe cannot know who is on the team, and the pool under CRM →
+     * Settings is the one place that does. On a workspace with no pool the
+     * step fails and the run continues, so the call, the email and the tag
+     * still land and the run history says who was not assigned.
+     *
+     * The email comes before any wait, which makes it an immediate reply to
+     * what the visitor just did — transactional, sent from the org's own
+     * identity, to the address the event carries.
+     */ build: ()=>({
+                recipe: 'welcomeNewLead',
+                name: 'Welcome a new lead',
+                trigger: {
+                    event: 'contactCreated',
+                    conditions: [
+                        {
+                            field: 'source',
+                            op: 'equals',
+                            value: 'form'
+                        }
+                    ],
+                    combinator: 'and'
+                },
+                steps: [
+                    {
+                        type: 'assignContactOwner',
+                        roundRobin: true
+                    },
+                    {
+                        type: 'createCrmTask',
+                        title: 'Call the new lead',
+                        kind: 'call',
+                        dueInDays: 1
+                    },
+                    {
+                        type: 'sendEmail',
+                        subject: 'Thanks for getting in touch',
+                        body: 'Thanks for reaching out — we have your message, and someone ' + 'from our team will be in touch within a day.'
+                    },
+                    {
+                        type: 'addContactTag',
+                        tag: 'website'
+                    }
+                ],
+                enabled: true
+            })
+    },
+    {
+        id: 'followUpWonDeal',
+        title: 'Follow up a won deal',
+        description: 'When a deal is won — which makes the contact a Customer on its own — ' + 'book a check-in call a week out.',
+        /*
+     * No stage step (AGL-2641): the win itself floors the contact at
+     * `customer` before `dealWon` is announced, so a step setting the stage
+     * here would at best repeat the write and at worst move an evangelist
+     * back to customer — a SET, which is what the step is, and not the
+     * floor the win applies. The recipe books the follow-up and nothing
+     * else.
+     */ build: ()=>({
+                recipe: 'followUpWonDeal',
+                name: 'Follow up a won deal',
+                trigger: {
+                    event: 'dealWon'
+                },
+                steps: [
+                    {
+                        type: 'createCrmTask',
+                        title: 'Check in with the new customer',
+                        kind: 'call',
+                        dueInDays: 7
+                    }
+                ],
+                enabled: true
+            })
+    },
+    {
+        id: 'reengageStaleLead',
+        title: 'Re-engage a stale lead',
+        description: 'When a contact becomes a lead: wait a week, and if their stage has ' + 'not moved, book a call to bring them back.',
+        /*
+     * "Unless the stage moved on" is the wait's own event: the flow watches
+     * for the next stage change on this person and gives up after a week.
+     * Resumed by the clock, the run carries `_waitTimedOut`, and the task
+     * step's guard reads it; resumed by the event, the field is absent and
+     * the task is skipped — the lead was worked, and nobody is told to
+     * re-engage somebody who just moved to Sales qualified.
+     */ build: ()=>({
+                recipe: 'reengageStaleLead',
+                name: 'Re-engage a stale lead',
+                trigger: {
+                    event: 'contactStageChanged',
+                    conditions: [
+                        {
+                            field: 'lifecycleStage',
+                            op: 'equals',
+                            value: 'lead'
+                        }
+                    ],
+                    combinator: 'and'
+                },
+                steps: [
+                    {
+                        type: 'waitForEvent',
+                        eventName: 'contactStageChanged',
+                        timeoutMinutes: STALE_LEAD_WAIT_MINUTES
+                    },
+                    {
+                        type: 'createCrmTask',
+                        title: 'Re-engage a lead that has gone quiet',
+                        kind: 'call',
+                        dueInDays: 1,
+                        when: {
+                            conditions: [
+                                {
+                                    field: FLOW_TIMED_OUT_FIELD,
+                                    op: 'notEmpty'
+                                }
+                            ]
+                        }
+                    }
+                ],
+                enabled: true
+            })
+    },
+    {
+        id: 'tagByForm',
+        title: 'Tag by form',
+        description: 'When a form you pick makes a new contact: tag them with the form’s ' + 'name.',
+        needs: 'form',
+        build: (input)=>{
+            var _ref;
+            const form = input == null ? void 0 : input.form;
+            return {
+                recipe: 'tagByForm',
+                name: form ? `Tag ${form.name.trim()} submissions` : 'Tag by form',
+                trigger: {
+                    event: 'contactCreated',
+                    conditions: [
+                        {
+                            field: 'formId',
+                            op: 'equals',
+                            value: (_ref = form == null ? void 0 : form.id) != null ? _ref : ''
+                        }
+                    ],
+                    combinator: 'and'
+                },
+                steps: [
+                    {
+                        type: 'addContactTag',
+                        tag: form ? crmRecipeTagForForm(form.name) : ''
+                    }
+                ],
+                enabled: true
+            };
+        }
+    }
+];
+/** The recipe with this id, or null for a string that names none. */ export function crmActionRecipe(id) {
+    var _CRM_ACTION_RECIPES_find;
+    return (_CRM_ACTION_RECIPES_find = CRM_ACTION_RECIPES.find((recipe)=>recipe.id === id)) != null ? _CRM_ACTION_RECIPES_find : null;
+}
+/**
+ * The recipe a STORED action came from, read off its document (AGL-2639).
+ *
+ * Three answers, and the third is the one that matters. A known id: the
+ * action was installed from, or begun as, that recipe. `null`: the action
+ * was begun blank, or from a recipe this build no longer knows — the
+ * editor wrote the field and said "no recipe". `undefined`: the document
+ * carries no `recipe` field at all, which is every action saved before the
+ * stamp existed. Such an action may well have started from a recipe — the
+ * menu opened the editor prefilled long before anything recorded it — so a
+ * reader that needs to know whether a site has a recipe treats `undefined`
+ * as UNKNOWN, never as absent, and never writes a `null` over it.
+ */ export function hostActionRecipeId(action) {
+    var _ref;
+    var _crmActionRecipe;
+    const stamp = action == null ? void 0 : action.recipe;
+    if (stamp === undefined) return undefined;
+    return (_ref = (_crmActionRecipe = crmActionRecipe(stamp)) == null ? void 0 : _crmActionRecipe.id) != null ? _ref : null;
+}
+export function hostActionDocument(action) {
+    var _trigger_conditions, _trigger_combinator;
+    const { recipe } = action, rest = _object_without_properties_loose(action, [
+        "recipe"
+    ]);
+    const trigger = action.trigger;
+    return _extends({}, rest, {
+        trigger: _extends({}, trigger, {
+            oncePerVisitor: trigger.oncePerVisitor === true,
+            oncePerSession: trigger.oncePerSession === true,
+            cooldownMinutes: Number(trigger.cooldownMinutes) >= 1 ? Number(trigger.cooldownMinutes) : null,
+            everyTime: trigger.everyTime === true,
+            condition: null,
+            conditions: (_trigger_conditions = trigger.conditions) != null ? _trigger_conditions : null,
+            combinator: (_trigger_combinator = trigger.combinator) != null ? _trigger_combinator : null
+        }),
+        enabled: action.enabled !== false
+    }, recipe !== undefined ? {
+        recipe
+    } : {});
+}
+/**
+ * The step list as the visitor's browser may see it.
+ *
+ * A client step AFTER a wait must never reach the page. The client engine
+ * runs its slice of the list immediately, so shipping the whole list would
+ * make "wait three days, then show the popup" show the popup at once — the
+ * delay would appear to work on the server, be ignored in the browser, and
+ * the two halves of one authored flow would disagree about when it happened.
+ *
+ * Truncating rather than filtering: everything past the first wait belongs to
+ * a run that has not happened yet, whichever side would have executed it.
+ */ export function hostActionStepsForClient(steps) {
+    const list = steps != null ? steps : [];
+    const suspendAt = list.findIndex(isFlowSuspendingStep);
+    return [
+        ...suspendAt < 0 ? list : list.slice(0, suspendAt)
+    ];
+}
+/**
+ * Basic presentational interactions (AGL-577): the subset of client steps
+ * that are pure DOM choreography — menu/drawer open-close, element
+ * show/hide, class toggles, sticky nav, navigation, and client-only
+ * alerts. They carry NO server cost and touch NO data, so they run on
+ * every plan (the `interactions` feature, on by default everywhere).
+ *
+ * The powerful client steps stay behind the `actions` entitlement:
+ * `showOverlay` (marketing overlays), `showHtml` (arbitrary HTML
+ * injection), and `trackGaEvent` (analytics). `runJs` keeps its own
+ * higher `webhooks` (Business) gate. Server steps
+ * (sendEmail/notifyAdmins/enrollList/updateDataset/assignCampaign) are
+ * re-checked against `actions` server-side in `runEventActions`.
+ */ export const BASIC_CLIENT_ACTION_STEP_TYPES = new Set([
+    'stickyNav',
+    'addClass',
+    'removeClass',
+    'toggleClass',
+    'showElement',
+    'hideElement',
+    'toggleElement',
+    'openDrawer',
+    'closeDrawer',
+    'toggleDrawer',
+    'openMenu',
+    'closeMenu',
+    'toggleMenu',
+    'setAttribute',
+    'removeAttribute',
+    // Moving the page and pressing a player the author placed: no data, no
+    // server, and nothing a Video element's own poster does not already do
+    // on every plan.
+    'scrollTo',
+    'playVideo',
+    'redirect',
+    'siteAlert'
+]);
+/** A client step available on all plans (no `actions` entitlement). */ export function isBasicClientActionStep(step) {
+    return BASIC_CLIENT_ACTION_STEP_TYPES.has(step.type);
+}
+/**
+ * Whether a client step may run for the given entitlement tier (AGL-577).
+ * This is the single source of truth the page enricher uses to trim the
+ * client-automation payload per plan:
+ *
+ * - Basic presentational steps → always (every plan).
+ * - `runJs` → `allowJs` (Business `webhooks` tier).
+ * - Remaining advanced client steps (overlay / showHtml / analytics) →
+ *   `actionsEntitled` (`actions` tier).
+ *
+ * Server steps are not client steps and always return false here; they
+ * are dispatched and re-authorized server-side.
+ */ export function isClientStepEntitled(step, entitlements) {
+    if (!isClientActionStep(step)) return false;
+    if (isBasicClientActionStep(step)) return true;
+    if (step.type === 'runJs') return entitlements.allowJs;
+    return entitlements.actionsEntitled;
+}
+export const ACTION_MAX_STEPS = 10;
+/** Custom-event chaining depth cap (mirrors CROSS_MAX_DEPTH). */ export const ACTION_MAX_EVENT_DEPTH = 3;
+/**
+ * Cap on the parameters one `trackGaEvent` step may carry (AGL-1587).
+ *
+ * Not a storage concern. These pairs are the least trustworthy analytics
+ * input on the platform — both halves are typed by a site author and land in
+ * that site's own GA4 property — and a bounded list is one an author can read
+ * back in full before publishing, which is the only review a parameter ever
+ * gets. GA4 caps custom parameters per event as well and drops the overflow
+ * without saying so, so an unbounded editor would let an author configure
+ * parameters that are never delivered and never explained. Ten, the same
+ * ceiling {@link ACTION_MAX_STEPS} puts on the step list itself.
+ */ export const ACTION_MAX_EVENT_PARAMS = 10;
+/**
+ * Longest analytics parameter NAME GA4 accepts; it drops a longer one on
+ * arrival, so a name over this is silence rather than a truncated dimension.
+ * The value half is capped by `ANALYTICS_PARAM_MAX_LENGTH`, which truncates
+ * instead of dropping.
+ */ export const ACTION_EVENT_PARAM_NAME_MAX_LENGTH = 40;
+/** Self-dismiss triggers for shown elements (AGL-589). */ export const ELEMENT_DISMISS_OPTIONS = [
+    'escape',
+    'outsideClick'
+];
+/** Visibility grace-delay ceiling — enough for hover travel, no dead UIs. */ export const ELEMENT_VISIBILITY_MAX_DELAY_MS = 5000;
+/**
+ * How a `scrollTo` step moves the page. Stored in documents; never rename a
+ * value. `instant` rather than the DOM's `auto`, because `auto` defers to the
+ * site's CSS `scroll-behavior` — a site that sets `smooth` there would animate
+ * a scroll the author asked to be instant.
+ */ export const SCROLL_TO_BEHAVIORS = [
+    'smooth',
+    'instant'
+];
+/**
+ * The largest offset a `scrollTo` step may leave above its target.
+ *
+ * The offset exists to clear a sticky header, which is tens of pixels and
+ * rarely more than a few hundred with an announcement bar stacked on it. A
+ * thousand leaves room for any header while still refusing the extra digit
+ * that would park the target off the bottom of the screen.
+ */ export const SCROLL_TO_MAX_OFFSET_PX = 1000;
+/** Custom event names: short, no collision with built-ins. */ export const CUSTOM_EVENT_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]{1,39}$/;
+/**
+ * The shortest and longest a flow may wait.
+ *
+ * The floor is a minute because the resume beat runs on a minute, so anything
+ * under one is a delay the scheduler cannot honor and would only read as
+ * imprecision. The ceiling is ninety days: long enough for the win-back that
+ * is the longest sequence anybody writes, and short enough that an enrollment
+ * is not an unbounded lease on a document. A person waiting inside a flow is
+ * storage the merchant is not looking at, and a wait measured in years is
+ * indistinguishable from one nobody will ever collect.
+ */ export const FLOW_WAIT_MIN_MINUTES = 1;
+export const FLOW_WAIT_MAX_MINUTES = 90 * 24 * 60;
+/**
+ * The attribute names an interaction may write (AGL-2546).
+ *
+ * An unrestricted attribute setter is a self-XSS vector authored through the
+ * interactions UI: it reaches `href`, `src`, `onclick`, `formaction` and
+ * `style`, and on a site with collaborators the author and the victim need
+ * not be the same person. `aria-*` and `data-*` carry the entire
+ * accessibility use case and none of that exposure.
+ *
+ * Deliberately NOT solved by an entitlement gate. `runJs` is Business-gated
+ * because it is dangerous at any tier; this has to work on every plan,
+ * because a screen-reader user's access to a menu is not a paid feature.
+ */ export const INTERACTION_ATTRIBUTE_NAME_PATTERN = /^(?:aria|data)-[a-z][a-z0-9-]*$/;
+/**
+ * Whether an interaction is allowed to write this attribute name.
+ *
+ * Case-insensitive because HTML attribute names are, and a rejected name is
+ * a no-op rather than an error: a step that cannot run must not break the
+ * steps after it in the same automation.
+ */ export function isInteractionAttributeAllowed(name) {
+    return typeof name === 'string' && INTERACTION_ATTRIBUTE_NAME_PATTERN.test(name.trim().toLowerCase());
+}
+export const HOST_ACTION_STEP_LABELS = {
+    runWorkflow: 'Run a workflow',
+    siteAlert: 'Show a site alert',
+    customEvent: 'Fire a custom event',
+    datasetAppend: 'Write to a dataset',
+    webhookPost: 'Send a webhook (Business)',
+    showOverlay: 'Show a popup or bar',
+    stickyNav: 'Make navigation sticky',
+    addClass: 'Add a CSS class',
+    toggleClass: 'Toggle a CSS class',
+    removeClass: 'Remove a CSS class',
+    showElement: 'Show an element',
+    hideElement: 'Hide an element',
+    toggleElement: 'Show/hide an element',
+    openDrawer: 'Open a drawer',
+    closeDrawer: 'Close a drawer',
+    toggleDrawer: 'Open/close a drawer',
+    openMenu: 'Open a menu',
+    closeMenu: 'Close a menu',
+    toggleMenu: 'Open/close a menu',
+    setAttribute: 'Set an ARIA or data attribute',
+    removeAttribute: 'Remove an ARIA or data attribute',
+    scrollTo: 'Scroll to element',
+    playVideo: 'Play a video',
+    showHtml: 'Show custom HTML',
+    runJs: 'Run custom JS (Business)',
+    redirect: 'Redirect the visitor',
+    trackGaEvent: 'Track an analytics event',
+    sendEmail: 'Send an email',
+    notifyAdmins: 'Notify site admins',
+    enrollList: 'Enroll in a list',
+    updateDataset: 'Update a dataset record',
+    assignCampaign: 'Assign to a campaign',
+    wait: 'Wait',
+    waitForEvent: 'Wait for something to happen',
+    exitFlow: 'End the flow here',
+    setContactStage: 'Set the contact’s lifecycle stage',
+    addContactTag: 'Tag the contact',
+    assignContactOwner: 'Assign the contact an owner',
+    createCrmTask: 'Create a CRM task',
+    logCrmActivity: 'Log a CRM activity'
+};
+/**
+ * Past-tense phrases for a run summary (AGL-2171).
+ *
+ * `HOST_ACTION_STEP_LABELS` above names what a step WILL do, in the
+ * imperative, for a `Do` select — "Send an email". A run history is the
+ * opposite tense and a different audience: it says what already happened,
+ * on one line, several steps at a time. `/product/workflows` advertises
+ * exactly that shape — `Sent email · saved to Leads · webhook 200`.
+ *
+ * Two maps rather than one derived from the other, because "Send a webhook
+ * (Business)" cannot be mechanically turned into "webhook" — the plan
+ * suffix is part of the picker's label and has no business in a log line.
+ * Only the steps a SERVER run can perform appear here; the client-side
+ * steps run in the visitor's browser and never reach the activity write.
+ */ export const HOST_ACTION_STEP_OUTCOMES = {
+    runWorkflow: 'ran workflow',
+    siteAlert: 'showed an alert',
+    customEvent: 'fired an event',
+    datasetAppend: 'saved to dataset',
+    updateDataset: 'updated dataset',
+    webhookPost: 'webhook',
+    sendEmail: 'sent email',
+    notifyAdmins: 'notified admins',
+    enrollList: 'enrolled in list',
+    assignCampaign: 'assigned to campaign',
+    wait: 'waiting',
+    waitForEvent: 'waiting for',
+    exitFlow: 'ended the flow',
+    setContactStage: 'set stage',
+    addContactTag: 'tagged',
+    assignContactOwner: 'assigned owner',
+    createCrmTask: 'created task',
+    logCrmActivity: 'logged activity'
+};
+/**
+ * One step's line in a run summary, with the detail that makes it useful.
+ *
+ * `saved to Leads` beats `saved to dataset`, and `webhook 200` beats
+ * `webhook` — the status code is the entire reason anyone opens a run
+ * history after a webhook, and it was being discarded on the line it
+ * arrived.
+ */ export function describeStepOutcome(type, detail) {
+    var _HOST_ACTION_STEP_OUTCOMES_type;
+    const base = (_HOST_ACTION_STEP_OUTCOMES_type = HOST_ACTION_STEP_OUTCOMES[type]) != null ? _HOST_ACTION_STEP_OUTCOMES_type : String(type);
+    const trimmed = detail == null ? void 0 : detail.trim();
+    if (!trimmed) return base;
+    if (type === 'datasetAppend' || type === 'updateDataset') {
+        // `saved to dataset` + `Leads` reads as `saved to Leads`, not
+        // `saved to dataset Leads`.
+        return `${base.replace(/ dataset$/, '')} ${trimmed}`;
+    }
+    return `${base} ${trimmed}`;
+}
+/** A whole number of minutes inside the wait band. */ export function isFlowWaitMinutes(value) {
+    return Number.isInteger(value) && value >= FLOW_WAIT_MIN_MINUTES && value <= FLOW_WAIT_MAX_MINUTES;
+}
+/** True for a custom (non-built-in) event name an action may fire. */ export function isCustomEventName(event) {
+    return !HOST_EVENT_TYPES.includes(event) && CUSTOM_EVENT_PATTERN.test(event);
+}
+/**
+ * Validates an action doc shape; returns a human-readable error or null.
+ * Server and console share this so bad steps never persist or run.
+ */ export function validateHostAction(action) {
+    var _ref, _action_steps;
+    var _action_name, _action_trigger_event, _action_trigger, _action_trigger_selector, _action_trigger1, _action_trigger2, _action_trigger3, _action_trigger4;
+    if (!((_action_name = action.name) == null ? void 0 : _action_name.trim())) return 'Name the action';
+    // A stamp is provenance, and provenance naming a recipe that does not
+    // exist is a document nothing can read back; `null` and absent both pass.
+    if (action.recipe != null && !crmActionRecipe(action.recipe)) {
+        return 'Unknown recipe';
+    }
+    const event = (_ref = (_action_trigger = action.trigger) == null ? void 0 : (_action_trigger_event = _action_trigger.event) == null ? void 0 : _action_trigger_event.trim()) != null ? _ref : '';
+    if (!event) return 'Pick a trigger event';
+    if (!HOST_EVENT_TYPES.includes(event) && !isSiteEventType(event) && !isCustomEventName(event)) {
+        return 'Custom event names are 2–40 letters, digits, dashes';
+    }
+    // Site-event trigger config (AGL-256; hover events AGL-562).
+    if (ELEMENT_SCOPED_SITE_EVENTS.includes(event) && !((_action_trigger1 = action.trigger) == null ? void 0 : (_action_trigger_selector = _action_trigger1.selector) == null ? void 0 : _action_trigger_selector.trim())) {
+        return 'This trigger needs a CSS selector';
+    }
+    if ([
+        'scrollDepth',
+        'timeOnPage'
+    ].includes(event) && !(Number((_action_trigger2 = action.trigger) == null ? void 0 : _action_trigger2.threshold) > 0)) {
+        return event === 'scrollDepth' ? 'Set the scroll percentage (1–100)' : 'Set the seconds on page';
+    }
+    // Frequency caps (AGL-274).
+    if (((_action_trigger3 = action.trigger) == null ? void 0 : _action_trigger3.cooldownMinutes) != null && !(Number(action.trigger.cooldownMinutes) >= 1)) {
+        return 'Cooldown must be at least 1 minute';
+    }
+    // Structured payload conditions (AGL-557; chained AGL-565).
+    const combinator = (_action_trigger4 = action.trigger) == null ? void 0 : _action_trigger4.combinator;
+    if (combinator != null && !TRIGGER_COMBINATORS.includes(combinator)) {
+        return 'Combine conditions with AND or OR';
+    }
+    const conditions = normalizeTriggerConditions(action.trigger);
+    if (conditions.length > ACTION_MAX_CONDITIONS) {
+        return `Conditions are capped at ${ACTION_MAX_CONDITIONS}`;
+    }
+    for (const [index, condition] of conditions.entries()){
+        var _condition_field, _condition_value;
+        // Single-condition messages stay exactly as AGL-557 shipped them;
+        // the row marker only appears once there are rows to tell apart.
+        const where = conditions.length > 1 ? ` (condition ${index + 1})` : '';
+        if (!TRIGGER_CONDITION_OPS.includes(condition.op)) {
+            return `Pick a condition operator${where}`;
+        }
+        if (!((_condition_field = condition.field) == null ? void 0 : _condition_field.trim())) {
+            return `Name the field the condition checks${where}`;
+        }
+        if (condition.op !== 'notEmpty' && !((_condition_value = condition.value) == null ? void 0 : _condition_value.trim())) {
+            return `Enter the value the condition compares against${where}`;
+        }
+    }
+    const steps = (_action_steps = action.steps) != null ? _action_steps : [];
+    if (!steps.length) return 'Add at least one step';
+    if (steps.length > ACTION_MAX_STEPS) {
+        return `Actions are capped at ${ACTION_MAX_STEPS} steps`;
+    }
+    for (const [index, step] of steps.entries()){
+        var _ref1;
+        var _step_when, _step_when1, _step_workflowId, _step_workflowName, _step_message, _step_datasetId, _step_datasetName, _step_webhookId, _step_webhookName, _step_selector, _step_selector1, _step_code, _step_url, _step_title, _step_overlayId, _step_overlayName, _step_listId, _step_listName, _step_datasetId1, _step_datasetName1, _step_campaignId, _step_campaignName;
+        const label = `Step ${index + 1}`;
+        // A step's own guard, checked with the same messages the trigger's
+        // clauses get — one condition editor, one set of complaints about it.
+        const guardClauses = ((_ref1 = (_step_when = step.when) == null ? void 0 : _step_when.conditions) != null ? _ref1 : []).filter(Boolean);
+        if (guardClauses.length > ACTION_MAX_CONDITIONS) {
+            return `${label}: conditions are capped at ${ACTION_MAX_CONDITIONS}`;
+        }
+        if (((_step_when1 = step.when) == null ? void 0 : _step_when1.combinator) != null && !TRIGGER_COMBINATORS.includes(step.when.combinator)) {
+            return `${label}: combine conditions with AND or OR`;
+        }
+        for (const clause of guardClauses){
+            var _clause_field, _clause_value;
+            if (!TRIGGER_CONDITION_OPS.includes(clause.op)) {
+                return `${label}: pick a condition operator`;
+            }
+            if (!((_clause_field = clause.field) == null ? void 0 : _clause_field.trim())) {
+                return `${label}: name the field the condition checks`;
+            }
+            if (clause.op !== 'notEmpty' && !((_clause_value = clause.value) == null ? void 0 : _clause_value.trim())) {
+                return `${label}: enter the value the condition compares against`;
+            }
+        }
+        if (step.type === 'wait' && !isFlowWaitMinutes(step.delayMinutes)) {
+            return `${label}: wait between ${FLOW_WAIT_MIN_MINUTES} minute and ${FLOW_WAIT_MAX_MINUTES} minutes`;
+        }
+        if (step.type === 'waitForEvent') {
+            var _ref2;
+            var _step_eventName;
+            const waited = (_ref2 = (_step_eventName = step.eventName) == null ? void 0 : _step_eventName.trim()) != null ? _ref2 : '';
+            if (!waited || !HOST_EVENT_TYPES.includes(waited) && !isCustomEventName(waited)) {
+                return `${label}: pick the event to wait for`;
+            }
+            if (!isFlowWaitMinutes(step.timeoutMinutes)) {
+                return `${label}: give up after ${FLOW_WAIT_MIN_MINUTES}–${FLOW_WAIT_MAX_MINUTES} minutes`;
+            }
+        }
+        if (step.type === 'runWorkflow' && !((_step_workflowId = step.workflowId) == null ? void 0 : _step_workflowId.trim()) && !((_step_workflowName = step.workflowName) == null ? void 0 : _step_workflowName.trim())) {
+            return `${label}: pick a workflow`;
+        }
+        if (step.type === 'siteAlert' && !((_step_message = step.message) == null ? void 0 : _step_message.trim())) {
+            return `${label}: enter the alert message`;
+        }
+        if (step.type === 'customEvent') {
+            var _ref3;
+            var _step_eventName1;
+            if (!isCustomEventName((_ref3 = (_step_eventName1 = step.eventName) == null ? void 0 : _step_eventName1.trim()) != null ? _ref3 : '')) {
+                return `${label}: custom event names are 2–40 letters, digits, dashes`;
+            }
+        }
+        if (step.type === 'datasetAppend' && !((_step_datasetId = step.datasetId) == null ? void 0 : _step_datasetId.trim()) && !((_step_datasetName = step.datasetName) == null ? void 0 : _step_datasetName.trim())) {
+            return `${label}: pick a dataset`;
+        }
+        if (step.type === 'webhookPost' && !((_step_webhookId = step.webhookId) == null ? void 0 : _step_webhookId.trim()) && !((_step_webhookName = step.webhookName) == null ? void 0 : _step_webhookName.trim())) {
+            return `${label}: pick a webhook`;
+        }
+        // Client + server steps (AGL-257).
+        if (step.type === 'addClass' || step.type === 'removeClass' || step.type === 'toggleClass') {
+            var _step_selector2, _step_className;
+            if (!((_step_selector2 = step.selector) == null ? void 0 : _step_selector2.trim())) return `${label}: enter a CSS selector`;
+            if (!((_step_className = step.className) == null ? void 0 : _step_className.trim())) return `${label}: enter the class name`;
+        }
+        // Element show/hide steps (AGL-562) always target a selector; drawer
+        // (AGL-562) and menu (AGL-568) commands may omit the target (the
+        // page's first drawer/menu answers).
+        if ((step.type === 'showElement' || step.type === 'hideElement' || step.type === 'toggleElement') && !((_step_selector = step.selector) == null ? void 0 : _step_selector.trim())) {
+            return `${label}: pick the element to show or hide`;
+        }
+        if (step.type === 'showElement' || step.type === 'hideElement' || step.type === 'toggleElement') {
+            // Choreography options (AGL-589).
+            const delay = step.delayMs;
+            if (delay != null && !(Number.isInteger(delay) && delay >= 0 && delay <= ELEMENT_VISIBILITY_MAX_DELAY_MS)) {
+                return `${label}: delay must be 0–${ELEMENT_VISIBILITY_MAX_DELAY_MS}ms`;
+            }
+            const dismiss = step.dismissOn;
+            if (dismiss != null && !(Array.isArray(dismiss) && dismiss.every((option)=>ELEMENT_DISMISS_OPTIONS.includes(option)))) {
+                return `${label}: dismiss options are escape and outsideClick`;
+            }
+        }
+        // One-target steps (AGL-2867). The runtime does nothing for a target it
+        // cannot find, so a missing one is refused here, where it can be fixed.
+        if (step.type === 'scrollTo') {
+            var _step_selector3;
+            if (!((_step_selector3 = step.selector) == null ? void 0 : _step_selector3.trim())) {
+                return `${label}: pick the element to scroll to`;
+            }
+            const behavior = step.behavior;
+            if (behavior != null && !SCROLL_TO_BEHAVIORS.includes(behavior)) {
+                return `${label}: scroll smoothly or instantly`;
+            }
+            const offset = step.offsetPx;
+            if (offset != null && !(Number.isInteger(offset) && offset >= 0 && offset <= SCROLL_TO_MAX_OFFSET_PX)) {
+                return `${label}: the offset must be 0–${SCROLL_TO_MAX_OFFSET_PX}px`;
+            }
+        }
+        if (step.type === 'playVideo' && !((_step_selector1 = step.selector) == null ? void 0 : _step_selector1.trim())) {
+            return `${label}: pick the video to play`;
+        }
+        if (step.type === 'showHtml') {
+            var _step_html;
+            if (!((_step_html = step.html) == null ? void 0 : _step_html.trim())) return `${label}: enter the HTML`;
+            // AGL-2486: the author-facing half of the runtime sanitizer, exactly as
+            // the reserved analytics name below is the author-facing half of the
+            // runtime refusal. `site-runtime.tsx` runs this HTML through
+            // `sanitizeAuthorHtml` for a VISITOR, where the only thing it can do
+            // with markup it refuses is drop it and say nothing — so an author who
+            // pastes an embed snippet gets a step that runs, reports success, and
+            // shows nothing. The refusal is reported HERE, where the person who
+            // can fix it is looking, and it is the SAME function that will run at
+            // render rather than a second description of its rules.
+            const removals = [];
+            const safe = sanitizeAuthorHtml(step.html, removals);
+            if (!safe.trim()) {
+                var _ref4;
+                var _removals_;
+                return `${label}: none of this HTML can be shown on a published page — ${(_ref4 = (_removals_ = removals[0]) == null ? void 0 : _removals_.message) != null ? _ref4 : 'it is removed by the sanitizer.'}`;
+            }
+            if (removals.length) {
+                return `${label}: ${removals[0].message}${removals.length > 1 ? ` (+${removals.length - 1} more)` : ''}`;
+            }
+        }
+        if (step.type === 'runJs' && !((_step_code = step.code) == null ? void 0 : _step_code.trim())) {
+            return `${label}: enter the JavaScript`;
+        }
+        if (step.type === 'redirect' && !((_step_url = step.url) == null ? void 0 : _step_url.trim()) && !step.screenId) {
+            return `${label}: pick a screen or enter the destination URL`;
+        }
+        if (step.type === 'trackGaEvent') {
+            var _step_params, _step_params1;
+            var _step_eventName2;
+            if (!((_step_eventName2 = step.eventName) == null ? void 0 : _step_eventName2.trim())) {
+                return `${label}: name the analytics event`;
+            }
+            // AGL-1587: the author-facing half of the runtime refusal. The runtime
+            // can only drop a bad name silently — it is executing for a VISITOR —
+            // so the name is checked HERE, where the person who can fix it is.
+            const resolved = resolveAuthoredEventName(step.eventName);
+            if (resolved.reason === 'reserved') {
+                return `${label}: "${step.eventName.trim()}" is a reserved analytics event name — pick another`;
+            }
+            if (!resolved.name) {
+                return `${label}: the analytics event name must start with a letter`;
+            }
+            const params = Object.entries((_step_params = step.params) != null ? _step_params : {});
+            if (params.length > ACTION_MAX_EVENT_PARAMS) {
+                return `${label}: analytics parameters are capped at ${ACTION_MAX_EVENT_PARAMS}`;
+            }
+            for (const [key, value] of params){
+                if (!key.trim()) return `${label}: name every analytics parameter`;
+                if (key.trim().length > ACTION_EVENT_PARAM_NAME_MAX_LENGTH) {
+                    return `${label}: the "${key.trim().slice(0, 16)}…" parameter name is over ${ACTION_EVENT_PARAM_NAME_MAX_LENGTH} characters, which GA4 drops`;
+                }
+                if (!String(value != null ? value : '').trim()) {
+                    return `${label}: enter a value for the "${key.trim()}" parameter`;
+                }
+            }
+            // The author-facing half of the runtime sanitizer, the same shape the
+            // reserved name above and the `showHtml` check take. `trackAuthoredEvent`
+            // strips a parameter that can carry personal data and says nothing about
+            // it, because it is executing for a VISITOR — so an author who binds a
+            // form field into a parameter gets a step that runs, reports success,
+            // and delivers an event missing the dimension it was created for. The
+            // strip is reported HERE, by running the REAL `sanitizeEventParams`
+            // rather than a second description of its rules, so the two can never
+            // disagree about which parameter survives.
+            const kept = sanitizeEventParams((_step_params1 = step.params) != null ? _step_params1 : undefined);
+            const stripped = params.find(([key])=>!(key in kept));
+            if (stripped) {
+                return `${label}: the "${stripped[0]}" parameter is never sent — an analytics parameter must not carry a visitor's own details`;
+            }
+        }
+        if (step.type === 'sendEmail') {
+            var _step_subject, _step_body;
+            if (!((_step_subject = step.subject) == null ? void 0 : _step_subject.trim())) return `${label}: enter the subject`;
+            if (!((_step_body = step.body) == null ? void 0 : _step_body.trim())) return `${label}: enter the email body`;
+        }
+        if (step.type === 'notifyAdmins' && !((_step_title = step.title) == null ? void 0 : _step_title.trim())) {
+            return `${label}: enter the notification title`;
+        }
+        if (step.type === 'showOverlay' && !((_step_overlayId = step.overlayId) == null ? void 0 : _step_overlayId.trim()) && !((_step_overlayName = step.overlayName) == null ? void 0 : _step_overlayName.trim())) {
+            return `${label}: pick an overlay`;
+        }
+        if (step.type === 'enrollList' && !((_step_listId = step.listId) == null ? void 0 : _step_listId.trim()) && !((_step_listName = step.listName) == null ? void 0 : _step_listName.trim())) {
+            return `${label}: pick a list`;
+        }
+        if (step.type === 'updateDataset' && !((_step_datasetId1 = step.datasetId) == null ? void 0 : _step_datasetId1.trim()) && !((_step_datasetName1 = step.datasetName) == null ? void 0 : _step_datasetName1.trim())) {
+            return `${label}: pick a dataset`;
+        }
+        if (step.type === 'assignCampaign' && !((_step_campaignId = step.campaignId) == null ? void 0 : _step_campaignId.trim()) && !((_step_campaignName = step.campaignName) == null ? void 0 : _step_campaignName.trim())) {
+            return `${label}: pick a campaign`;
+        }
+        // CRM steps (AGL-2605). A stage or a kind outside its vocabulary is
+        // refused here rather than stored: the executor treats the value as
+        // trusted and would write it into a facet every stage report counts.
+        if (step.type === 'setContactStage' && !isContactLifecycleStage(step.lifecycleStage)) {
+            return `${label}: pick a lifecycle stage`;
+        }
+        if (step.type === 'addContactTag') {
+            var _ref5;
+            var _step_tag;
+            const tag = (_ref5 = (_step_tag = step.tag) == null ? void 0 : _step_tag.trim()) != null ? _ref5 : '';
+            if (!tag) return `${label}: enter the tag`;
+            if (tag.length > CONTACT_TAG_MAX_LENGTH) {
+                return `${label}: tags are at most ${CONTACT_TAG_MAX_LENGTH} characters`;
+            }
+        }
+        if (step.type === 'assignContactOwner') {
+            var _step_ownerUid, _step_ownerEmail, _step_ownerUid1, _step_ownerEmail1;
+            const named = Boolean(((_step_ownerUid = step.ownerUid) == null ? void 0 : _step_ownerUid.trim()) || ((_step_ownerEmail = step.ownerEmail) == null ? void 0 : _step_ownerEmail.trim()));
+            if (step.roundRobin === true && named) {
+                return `${label}: pick round robin or a member, not both`;
+            }
+            if (step.roundRobin !== true && !((_step_ownerUid1 = step.ownerUid) == null ? void 0 : _step_ownerUid1.trim()) && !((_step_ownerEmail1 = step.ownerEmail) == null ? void 0 : _step_ownerEmail1.trim().includes('@'))) {
+                return `${label}: enter the owner’s email address`;
+            }
+        }
+        if (step.type === 'createCrmTask') {
+            var _ref6;
+            var _step_title1, _step_assigneeEmail;
+            if (!((_step_title1 = step.title) == null ? void 0 : _step_title1.trim())) return `${label}: give the task a title`;
+            if (!isCrmTaskKind(step.kind)) return `${label}: pick the kind of task`;
+            if (!Number.isInteger(step.dueInDays) || step.dueInDays < 0 || step.dueInDays > CRM_TASK_MAX_DUE_DAYS) {
+                return `${label}: due in 0–${CRM_TASK_MAX_DUE_DAYS} days`;
+            }
+            // Optional — but an address that is not one would resolve to nobody at
+            // run time, and the task would land unassigned with no word why.
+            const assigneeEmail = (_ref6 = (_step_assigneeEmail = step.assigneeEmail) == null ? void 0 : _step_assigneeEmail.trim()) != null ? _ref6 : '';
+            if (assigneeEmail && !assigneeEmail.includes('@')) {
+                return `${label}: enter the assignee’s email address`;
+            }
+        }
+        if (step.type === 'logCrmActivity') {
+            var _step_body1;
+            if (!isCrmActivityKind(step.kind)) {
+                return `${label}: pick the kind of activity`;
+            }
+            if (!((_step_body1 = step.body) == null ? void 0 : _step_body1.trim())) return `${label}: write what happened`;
+        }
+    }
+    return null;
+}
+export const WEBHOOK_MAX_PER_HOST = 5;
+/**
+ * How many LIVE action documents one host may hold (AGL-2266).
+ *
+ * `hosts/{hostId}/actions` was in NO exclusion list in
+ * `cloud/firebase-firestore.rules`, so the host catch-all's `allow create`
+ * granted it to any editor, client-direct, on any plan — and the import
+ * route's own table said so in as many words: *"no `RESOURCES` entry and no
+ * quota key anywhere; all three creators write the document client-direct."*
+ * A free org could therefore mint unbounded Firestore documents from the
+ * browser against a $0 subscription. Unbounded infrastructure, not a bypass of
+ * anything we sell, which is `WEBHOOK_MAX_PER_HOST`'s (AGL-1360) and
+ * `NON_PAGE_SCREEN_MAX_PER_HOST`'s (AGL-1399) shape exactly: a flat PLATFORM
+ * cap with no `OrgEntitlements` key, no variation by plan, and nothing on the
+ * price list to explain.
+ *
+ * ## Not gated on the `actions` entitlement, deliberately
+ *
+ * `actions` is a Pro feature and `interactions` is free, and BOTH write this
+ * collection — the interaction builder and the besigner's preset wiring create
+ * the same document type the Pro actions card does. Gating creation on the
+ * paid flag would take element interactions away from every free and starter
+ * site, which is a pricing change wearing a cap's clothes. The runtime already
+ * checks the entitlement where it decides what may RUN
+ * (`run-event-actions.ts`), which is the right place for it.
+ *
+ * ## Why 500
+ *
+ * Sized to the busiest plausible site rather than to today's data. An action
+ * is authored per interactive element, so a heavy marketing site with dropdown
+ * choreography on every section reaches tens; presets wire a handful at a
+ * time. 500 is far past anything authoring produces and well short of what a
+ * script in a loop wants, which is the only property a flat cap needs. Live
+ * documents only — the interactions provider soft-deletes with `deletedAt`, so
+ * counting tombstones would be AGL-1173's bug one collection over, where
+ * removing an interaction never frees its slot.
+ */ export const ACTIONS_MAX_PER_HOST = 500;
+/** Outbound URLs must be public https — first-line SSRF guard. */ export const WEBHOOK_URL_PATTERN = /^https:\/\/(?!localhost)(?!127\.)(?!0\.)(?!10\.)(?!172\.(1[6-9]|2\d|3[01])\.)(?!192\.168\.)(?!169\.254\.)[^\s]+$/i;
+
+//# sourceMappingURL=actions.js.map