@aglyn/plugins-workflows 1.0.0-beta.143

package/src/lib/components/workflows-console-page.d.ts

@@ -0,0 +1,25 @@
+import type { ConsolePluginPageProps } from '@aglyn/aglyn';
+/**
+ * Automation page (AGL-101/148/149 → AGL-395): the automation surface —
+ * workflow builder, event-triggered actions, and webhooks — owned by the
+ * workflows plugin and rendered by the shell's generic plugin route. Each card
+ * runs its own entitlement check (workflows / actions / webhooks are distinct
+ * plan flags), so the shell's resolved `org` doc flows into all three.
+ *
+ * Sections are ROUTES (AGL-2501). `HubTabs lazy` already mounted one panel, so
+ * this is not a read saving — `workflows-console-read-cost.spec.tsx` was
+ * written BEFORE the conversion precisely to hold that line, and reports the
+ * same counts after. What routing adds is that the URL names the section: it is
+ * linkable, the back button walks sections, the breadcrumb says where you are,
+ * and "mount only what is open" is structural rather than a `lazy` flag.
+ *
+ * The section ids are unchanged by the Automation rename: they are the
+ * addresses people bookmark and the docs link to. A workflow belongs to the
+ * site and an ACTION belongs to the site too; an interaction belongs to the
+ * document that holds it and is edited on the element, not here.
+ */
+export declare function WorkflowsConsolePage(props: ConsolePluginPageProps): import("react").JSX.Element;
+export declare namespace WorkflowsConsolePage {
+    var displayName: string;
+}
+export default WorkflowsConsolePage;

package/src/lib/components/workflows-console-page.js

@@ -0,0 +1,112 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { HubSections } from "@aglyn/shared-ui-next";
+import { Stack } from "@mui/material";
+import HostActionsCard from "./host-actions-card.component.js";
+import HostWebhooksCard from "./host-webhooks-card.component.js";
+import HostWorkflowsCard from "./host-workflows-card.component.js";
+import RunQuotaLine from "./run-quota-line.component.js";
+/**
+ * The body of one workflows section, built only when that section is the one
+ * being read (AGL-2501).
+ *
+ * A function rather than a map of nodes on purpose: a `Record<id, ReactNode>`
+ * would CONSTRUCT all three every render, and each card opens its Firestore
+ * listens on mount — which is the entire cost this page exists to stop paying.
+ * Only the returned branch is ever built.
+ */ function sectionBody(section, hostId, org) {
+    switch(section){
+        case 'workflows':
+            return(/*
+         * `N runs this month · M included` (AGL-2171), which the run-history
+         * mockup puts opposite the heading. The quota silently stops
+         * automations running once it is reached, and the only place it was
+         * reported was the Billing page.
+         */ /*#__PURE__*/ _jsxs(Stack, {
+                spacing: 1,
+                children: [
+                    /*#__PURE__*/ _jsx(RunQuotaLine, {
+                        hostId: hostId,
+                        org: org,
+                        counter: "workflowRuns"
+                    }),
+                    /*#__PURE__*/ _jsx(HostWorkflowsCard, {
+                        hostId: hostId,
+                        org: org
+                    })
+                ]
+            }));
+        case 'actions':
+            return /*#__PURE__*/ _jsxs(Stack, {
+                spacing: 1,
+                children: [
+                    /*#__PURE__*/ _jsx(RunQuotaLine, {
+                        hostId: hostId,
+                        org: org,
+                        counter: "actionRuns"
+                    }),
+                    /*#__PURE__*/ _jsx(HostActionsCard, {
+                        hostId: hostId,
+                        org: org
+                    })
+                ]
+            });
+        case 'webhooks':
+            return /*#__PURE__*/ _jsx(HostWebhooksCard, {
+                hostId: hostId,
+                org: org
+            });
+        default:
+            return null;
+    }
+}
+/**
+ * Automation page (AGL-101/148/149 → AGL-395): the automation surface —
+ * workflow builder, event-triggered actions, and webhooks — owned by the
+ * workflows plugin and rendered by the shell's generic plugin route. Each card
+ * runs its own entitlement check (workflows / actions / webhooks are distinct
+ * plan flags), so the shell's resolved `org` doc flows into all three.
+ *
+ * Sections are ROUTES (AGL-2501). `HubTabs lazy` already mounted one panel, so
+ * this is not a read saving — `workflows-console-read-cost.spec.tsx` was
+ * written BEFORE the conversion precisely to hold that line, and reports the
+ * same counts after. What routing adds is that the URL names the section: it is
+ * linkable, the back button walks sections, the breadcrumb says where you are,
+ * and "mount only what is open" is structural rather than a `lazy` flag.
+ *
+ * The section ids are unchanged by the Automation rename: they are the
+ * addresses people bookmark and the docs link to. A workflow belongs to the
+ * site and an ACTION belongs to the site too; an interaction belongs to the
+ * document that holds it and is edited on the element, not here.
+ */ export function WorkflowsConsolePage(props) {
+    const { hostId, org, section, sections, basePath } = props;
+    /*
+   * Nothing until the URL names a section. The shell redirects a bare hub URL
+   * to the landing section and holds a spinner while it does, so this state is
+   * transient — and rendering a default section here instead would pay for its
+   * listens on a URL that is already being replaced.
+   */ if (!section || !(sections == null ? void 0 : sections.length) || !basePath) return null;
+    return /*#__PURE__*/ _jsx(HubSections, {
+        sections: sections,
+        children: sectionBody(section, hostId, org)
+    });
+}
+WorkflowsConsolePage.displayName = 'WorkflowsConsolePage';
+export default WorkflowsConsolePage;
+
+//# sourceMappingURL=workflows-console-page.js.map

package/src/lib/components/workflows-console-page.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/components/workflows-console-page.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport type { AglynOrgBilling, ConsolePluginPageProps } from '@aglyn/aglyn'\nimport { HubSections } from '@aglyn/shared-ui-next'\nimport { Stack } from '@mui/material'\nimport type { ReactNode } from 'react'\nimport HostActionsCard from './host-actions-card.component'\nimport HostWebhooksCard from './host-webhooks-card.component'\nimport HostWorkflowsCard from './host-workflows-card.component'\nimport RunQuotaLine from './run-quota-line.component'\nimport type { WorkflowsConsoleSectionId } from './workflows-console-sections'\n\n/**\n * The body of one workflows section, built only when that section is the one\n * being read (AGL-2501).\n *\n * A function rather than a map of nodes on purpose: a `Record<id, ReactNode>`\n * would CONSTRUCT all three every render, and each card opens its Firestore\n * listens on mount — which is the entire cost this page exists to stop paying.\n * Only the returned branch is ever built.\n */\nfunction sectionBody(\n  section: WorkflowsConsoleSectionId,\n  hostId: string,\n  org: Partial<AglynOrgBilling> | undefined,\n): ReactNode {\n  switch (section) {\n    case 'workflows':\n      return (\n        /*\n         * `N runs this month · M included` (AGL-2171), which the run-history\n         * mockup puts opposite the heading. The quota silently stops\n         * automations running once it is reached, and the only place it was\n         * reported was the Billing page.\n         */\n        <Stack spacing={1}>\n          <RunQuotaLine hostId={hostId} org={org} counter=\"workflowRuns\" />\n          <HostWorkflowsCard hostId={hostId} org={org} />\n        </Stack>\n      )\n    case 'actions':\n      return (\n        <Stack spacing={1}>\n          {/* `actionRunsPerMonth` had NO customer-facing surface at all\n              before this — staff panel and usage-alerts only. */}\n          <RunQuotaLine hostId={hostId} org={org} counter=\"actionRuns\" />\n          <HostActionsCard hostId={hostId} org={org} />\n        </Stack>\n      )\n    case 'webhooks':\n      return <HostWebhooksCard hostId={hostId} org={org} />\n    default:\n      return null\n  }\n}\n\n/**\n * Automation page (AGL-101/148/149 → AGL-395): the automation surface —\n * workflow builder, event-triggered actions, and webhooks — owned by the\n * workflows plugin and rendered by the shell's generic plugin route. Each card\n * runs its own entitlement check (workflows / actions / webhooks are distinct\n * plan flags), so the shell's resolved `org` doc flows into all three.\n *\n * Sections are ROUTES (AGL-2501). `HubTabs lazy` already mounted one panel, so\n * this is not a read saving — `workflows-console-read-cost.spec.tsx` was\n * written BEFORE the conversion precisely to hold that line, and reports the\n * same counts after. What routing adds is that the URL names the section: it is\n * linkable, the back button walks sections, the breadcrumb says where you are,\n * and \"mount only what is open\" is structural rather than a `lazy` flag.\n *\n * The section ids are unchanged by the Automation rename: they are the\n * addresses people bookmark and the docs link to. A workflow belongs to the\n * site and an ACTION belongs to the site too; an interaction belongs to the\n * document that holds it and is edited on the element, not here.\n */\nexport function WorkflowsConsolePage(props: ConsolePluginPageProps) {\n  const { hostId, org, section, sections, basePath } = props\n\n  /*\n   * Nothing until the URL names a section. The shell redirects a bare hub URL\n   * to the landing section and holds a spinner while it does, so this state is\n   * transient — and rendering a default section here instead would pay for its\n   * listens on a URL that is already being replaced.\n   */\n  if (!section || !sections?.length || !basePath) return null\n\n  return (\n    <HubSections sections={sections}>\n      {sectionBody(section as WorkflowsConsoleSectionId, hostId, org)}\n    </HubSections>\n  )\n}\nWorkflowsConsolePage.displayName = 'WorkflowsConsolePage'\n\nexport default WorkflowsConsolePage\n"],"names":["HubSections","Stack","HostActionsCard","HostWebhooksCard","HostWorkflowsCard","RunQuotaLine","sectionBody","section","hostId","org","spacing","counter","WorkflowsConsolePage","props","sections","basePath","length","displayName"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;AAGA,SAASA,WAAW,QAAQ,wBAAuB;AACnD,SAASC,KAAK,QAAQ,gBAAe;AAErC,OAAOC,qBAAqB,mCAA+B;AAC3D,OAAOC,sBAAsB,oCAAgC;AAC7D,OAAOC,uBAAuB,qCAAiC;AAC/D,OAAOC,kBAAkB,gCAA4B;AAGrD;;;;;;;;CAQC,GACD,SAASC,YACPC,OAAkC,EAClCC,MAAc,EACdC,GAAyC;IAEzC,OAAQF;QACN,KAAK;YACH,OACE;;;;;SAKC,iBACD,MAACN;gBAAMS,SAAS;;kCACd,KAACL;wBAAaG,QAAQA;wBAAQC,KAAKA;wBAAKE,SAAQ;;kCAChD,KAACP;wBAAkBI,QAAQA;wBAAQC,KAAKA;;;;QAG9C,KAAK;YACH,qBACE,MAACR;gBAAMS,SAAS;;kCAGd,KAACL;wBAAaG,QAAQA;wBAAQC,KAAKA;wBAAKE,SAAQ;;kCAChD,KAACT;wBAAgBM,QAAQA;wBAAQC,KAAKA;;;;QAG5C,KAAK;YACH,qBAAO,KAACN;gBAAiBK,QAAQA;gBAAQC,KAAKA;;QAChD;YACE,OAAO;IACX;AACF;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASG,qBAAqBC,KAA6B;IAChE,MAAM,EAAEL,MAAM,EAAEC,GAAG,EAAEF,OAAO,EAAEO,QAAQ,EAAEC,QAAQ,EAAE,GAAGF;IAErD;;;;;GAKC,GACD,IAAI,CAACN,WAAW,EAACO,4BAAAA,SAAUE,MAAM,KAAI,CAACD,UAAU,OAAO;IAEvD,qBACE,KAACf;QAAYc,UAAUA;kBACpBR,YAAYC,SAAsCC,QAAQC;;AAGjE;AACAG,qBAAqBK,WAAW,GAAG;AAEnC,eAAeL,qBAAoB"}

package/src/lib/components/workflows-console-sections.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { ConsoleNavSection } from '@aglyn/aglyn';
+export type WorkflowsConsoleSectionId = 'workflows' | 'actions' | 'webhooks';
+/**
+ * The workflows console's sections, in rail order (AGL-2501).
+ *
+ * One list, read twice and never copied: `plugin.ts` registers it on the nav
+ * item so the shell can route and gate each section, and the page switches its
+ * body on the id the shell resolves back.
+ *
+ * Ids are the `?tab=` ids this page already deep-linked by, kept deliberately
+ * so a bookmark that named a tab names the same section as a route.
+ *
+ * No `navTabId` on any of them: they inherit the Workflows nav item's gate,
+ * which is `nav-tab-workflows`. The per-card ENTITLEMENT checks are unchanged
+ * and still live in the cards — workflows, actions and webhooks are distinct
+ * plan flags, and a plan is not a release flag.
+ */
+export declare const WORKFLOWS_CONSOLE_SECTIONS: readonly ConsoleNavSection[];

package/src/lib/components/workflows-console-sections.js

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The workflows console's sections, in rail order (AGL-2501).
+ *
+ * One list, read twice and never copied: `plugin.ts` registers it on the nav
+ * item so the shell can route and gate each section, and the page switches its
+ * body on the id the shell resolves back.
+ *
+ * Ids are the `?tab=` ids this page already deep-linked by, kept deliberately
+ * so a bookmark that named a tab names the same section as a route.
+ *
+ * No `navTabId` on any of them: they inherit the Workflows nav item's gate,
+ * which is `nav-tab-workflows`. The per-card ENTITLEMENT checks are unchanged
+ * and still live in the cards — workflows, actions and webhooks are distinct
+ * plan flags, and a plan is not a release flag.
+ */ export const WORKFLOWS_CONSOLE_SECTIONS = [
+    {
+        id: 'workflows',
+        label: 'Workflows'
+    },
+    {
+        id: 'actions',
+        label: 'Actions'
+    },
+    {
+        id: 'webhooks',
+        label: 'Webhooks'
+    }
+] /*
+ * Rail ORDER decides where `/workflows` lands: the shell redirects a bare hub
+ * URL to the first section in this list the reader may open (AGL-2501). There
+ * is deliberately no separate default constant — a second place to say which
+ * section is first is a second place for it to disagree with the rail.
+ */ ;
+
+//# sourceMappingURL=workflows-console-sections.js.map

package/src/lib/components/workflows-console-sections.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/components/workflows-console-sections.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { ConsoleNavSection } from '@aglyn/aglyn'\n\nexport type WorkflowsConsoleSectionId = 'workflows' | 'actions' | 'webhooks'\n\n/**\n * The workflows console's sections, in rail order (AGL-2501).\n *\n * One list, read twice and never copied: `plugin.ts` registers it on the nav\n * item so the shell can route and gate each section, and the page switches its\n * body on the id the shell resolves back.\n *\n * Ids are the `?tab=` ids this page already deep-linked by, kept deliberately\n * so a bookmark that named a tab names the same section as a route.\n *\n * No `navTabId` on any of them: they inherit the Workflows nav item's gate,\n * which is `nav-tab-workflows`. The per-card ENTITLEMENT checks are unchanged\n * and still live in the cards — workflows, actions and webhooks are distinct\n * plan flags, and a plan is not a release flag.\n */\nexport const WORKFLOWS_CONSOLE_SECTIONS: readonly ConsoleNavSection[] = [\n  { id: 'workflows', label: 'Workflows' },\n  { id: 'actions', label: 'Actions' },\n  { id: 'webhooks', label: 'Webhooks' },\n]\n\n/*\n * Rail ORDER decides where `/workflows` lands: the shell redirects a bare hub\n * URL to the first section in this list the reader may open (AGL-2501). There\n * is deliberately no separate default constant — a second place to say which\n * section is first is a second place for it to disagree with the rail.\n */\n"],"names":["WORKFLOWS_CONSOLE_SECTIONS","id","label"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAMD;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMA,6BAA2D;IACtE;QAAEC,IAAI;QAAaC,OAAO;IAAY;IACtC;QAAED,IAAI;QAAWC,OAAO;IAAU;IAClC;QAAED,IAAI;QAAYC,OAAO;IAAW;CACrC,CAED;;;;;CAKC,IAPA"}

package/src/lib/constants/bundle-common.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ */
+export declare const BUNDLE_ID = "workflows";

package/src/lib/constants/bundle-common.js

@@ -0,0 +1,9 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ */ export const BUNDLE_ID = 'workflows';
+
+//# sourceMappingURL=bundle-common.js.map

package/src/lib/constants/bundle-common.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/constants/bundle-common.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n */\n\nexport const BUNDLE_ID = 'workflows'\n"],"names":["BUNDLE_ID"],"mappings":"AAAA;;;;;;CAMC,GAED,OAAO,MAAMA,YAAY,YAAW"}

package/src/lib/declarations.server.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type HostEventListener } from '@aglyn/tenant-runtime/host-event-listeners';
+/**
+ * The automation engine, as the runtime hears it.
+ *
+ * Light by construction: the engine is imported when the first event
+ * arrives, not when the process starts, so a process that never sees an
+ * event pays for this object and nothing else.
+ */
+export declare const workflowsHostEventListener: HostEventListener;
+/**
+ * The plugin's SERVER declarations: what the server must know at boot,
+ * before any door of the plugin has been called.
+ *
+ * The engine's host-event listener, because the doors that raise the events
+ * mostly never load this plugin. A form submission and a page view are core
+ * routes; a contact captured by a Stripe webhook is a core capture door. Each
+ * calls `emitHostEvent`, and the listener has to be registered before the
+ * first of them arrives — which is what running this from both apps'
+ * `instrumentation.ts` gives.
+ *
+ * Also called from the plugin's own API register functions, so a process
+ * whose boot did not run it still registers the listener the first time a
+ * plugin door loads. Registering twice replaces in place.
+ */
+export declare function registerWorkflowsServerDeclarations(): void;

package/src/lib/declarations.server.js

@@ -0,0 +1,54 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // The registry from its own module, not the runtime barrel: boot needs the
+// registry and nothing else, and the barrel reaches the data layer.
+import { registerHostEventListener } from "@aglyn/tenant-runtime/host-event-listeners";
+import { BUNDLE_ID } from "./constants/bundle-common.js";
+/**
+ * The automation engine, as the runtime hears it.
+ *
+ * Light by construction: the engine is imported when the first event
+ * arrives, not when the process starts, so a process that never sees an
+ * event pays for this object and nothing else.
+ */ export const workflowsHostEventListener = {
+    async onEvent (hostId, event, payload) {
+        const { runEventAutomations } = await import("./engine/run-event-automations.js");
+        return await runEventAutomations(hostId, event, payload);
+    },
+    async onDispatch (hostId, automationId, event, payload) {
+        const { runSingleAction } = await import("./engine/run-event-actions.js");
+        return await runSingleAction(hostId, automationId, event, payload);
+    }
+};
+/**
+ * The plugin's SERVER declarations: what the server must know at boot,
+ * before any door of the plugin has been called.
+ *
+ * The engine's host-event listener, because the doors that raise the events
+ * mostly never load this plugin. A form submission and a page view are core
+ * routes; a contact captured by a Stripe webhook is a core capture door. Each
+ * calls `emitHostEvent`, and the listener has to be registered before the
+ * first of them arrives — which is what running this from both apps'
+ * `instrumentation.ts` gives.
+ *
+ * Also called from the plugin's own API register functions, so a process
+ * whose boot did not run it still registers the listener the first time a
+ * plugin door loads. Registering twice replaces in place.
+ */ export function registerWorkflowsServerDeclarations() {
+    registerHostEventListener(BUNDLE_ID, workflowsHostEventListener);
+}
+
+//# sourceMappingURL=declarations.server.js.map

package/src/lib/declarations.server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/declarations.server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// The registry from its own module, not the runtime barrel: boot needs the\n// registry and nothing else, and the barrel reaches the data layer.\nimport {\n  type HostEventListener,\n  registerHostEventListener,\n} from '@aglyn/tenant-runtime/host-event-listeners'\nimport { BUNDLE_ID } from './constants/bundle-common'\n\n/**\n * The automation engine, as the runtime hears it.\n *\n * Light by construction: the engine is imported when the first event\n * arrives, not when the process starts, so a process that never sees an\n * event pays for this object and nothing else.\n */\nexport const workflowsHostEventListener: HostEventListener = {\n  async onEvent(hostId, event, payload) {\n    const { runEventAutomations } = await import('./engine/run-event-automations')\n    return await runEventAutomations(hostId, event, payload)\n  },\n  async onDispatch(hostId, automationId, event, payload) {\n    const { runSingleAction } = await import('./engine/run-event-actions')\n    return await runSingleAction(hostId, automationId, event, payload)\n  },\n}\n\n/**\n * The plugin's SERVER declarations: what the server must know at boot,\n * before any door of the plugin has been called.\n *\n * The engine's host-event listener, because the doors that raise the events\n * mostly never load this plugin. A form submission and a page view are core\n * routes; a contact captured by a Stripe webhook is a core capture door. Each\n * calls `emitHostEvent`, and the listener has to be registered before the\n * first of them arrives — which is what running this from both apps'\n * `instrumentation.ts` gives.\n *\n * Also called from the plugin's own API register functions, so a process\n * whose boot did not run it still registers the listener the first time a\n * plugin door loads. Registering twice replaces in place.\n */\nexport function registerWorkflowsServerDeclarations(): void {\n  registerHostEventListener(BUNDLE_ID, workflowsHostEventListener)\n}\n"],"names":["registerHostEventListener","BUNDLE_ID","workflowsHostEventListener","onEvent","hostId","event","payload","runEventAutomations","onDispatch","automationId","runSingleAction","registerWorkflowsServerDeclarations"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,2EAA2E;AAC3E,oEAAoE;AACpE,SAEEA,yBAAyB,QACpB,6CAA4C;AACnD,SAASC,SAAS,QAAQ,+BAA2B;AAErD;;;;;;CAMC,GACD,OAAO,MAAMC,6BAAgD;IAC3D,MAAMC,SAAQC,MAAM,EAAEC,KAAK,EAAEC,OAAO;QAClC,MAAM,EAAEC,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC;QAC7C,OAAO,MAAMA,oBAAoBH,QAAQC,OAAOC;IAClD;IACA,MAAME,YAAWJ,MAAM,EAAEK,YAAY,EAAEJ,KAAK,EAAEC,OAAO;QACnD,MAAM,EAAEI,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC;QACzC,OAAO,MAAMA,gBAAgBN,QAAQK,cAAcJ,OAAOC;IAC5D;AACF,EAAC;AAED;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASK;IACdX,0BAA0BC,WAAWC;AACvC"}

package/src/lib/engine/crm-action-steps.d.ts

@@ -0,0 +1,129 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type CrmActionStep, type CrmActivityLink } from '@aglyn/aglyn/server';
+import type { HostEventPayload } from '@aglyn/tenant-runtime/host-event-listeners';
+/**
+ * The CRM steps of an action run (AGL-2605): what `setContactStage`,
+ * `addContactTag`, `assignContactOwner`, `createCrmTask` and
+ * `logCrmActivity` actually write.
+ *
+ * Split out of `run-event-actions.ts` because the five share one shape the
+ * other server steps do not: each begins by finding THE PERSON the event is
+ * about, and each writes either inside the site's facet on that person or a
+ * record stamped with the site's scope. One resolver and one scope
+ * expression, used five times, rather than five copies drifting apart.
+ *
+ * ## The person is the event's, never the step's
+ *
+ * A step carries no contact reference. The contact is whoever the event
+ * names — by `contactId` when the emitting door knew the document, and by
+ * `email` otherwise, which is what every pre-CRM event carries. Both
+ * lookups are scoped to what THIS site may see: a document the id names
+ * but the site cannot read is treated as absent, exactly as the scoped
+ * query would have treated it, so an event replayed against the wrong site
+ * reaches nobody.
+ *
+ * ## A missing person is a reported no-op
+ *
+ * Nothing is written and the step's error names the reason, which lands in
+ * the run summary beside the trigger — the same place "why didn't it
+ * fire?" is answered for every other step. Silence here would make a
+ * mis-wired trigger (a form with no email field) indistinguishable from a
+ * working one.
+ */
+export interface CrmStepEnv {
+    hostId: string;
+    /** The owning org's billing doc, already read by the run's gate. */
+    org: unknown;
+    orgId: string | null;
+}
+export interface CrmStepOutcome {
+    /** The reason nothing was written, when nothing was. */
+    error?: string;
+    /** The one fact worth carrying into the run summary. */
+    detail?: string;
+    /**
+     * An event this step's write earned, for the CALLER to fan out under its
+     * own depth guard. Not emitted from here: a stage set by an automation is
+     * itself a stage change, and the action listening for it must run — but
+     * through the same nesting cap a `customEvent` chain has, or an action
+     * that sets the stage it listens for would run until the meter ran dry.
+     */
+    emit?: {
+        event: 'contactStageChanged';
+        payload: HostEventPayload;
+    };
+}
+/**
+ * Runs one CRM step for the person the event names. Never throws for a
+ * missing person, an unknown owner or a site with no org — those are
+ * answered as `error` so the run records them; a Firestore failure
+ * propagates to the executor's catch like every other step's would.
+ */
+export declare function runCrmActionStep(env: CrmStepEnv, actionId: string, step: CrmActionStep, payload: HostEventPayload, nowMs?: number): Promise<CrmStepOutcome>;
+/**
+ * The activity row a `sendEmail` step's message will be logged as, prepared
+ * BEFORE the send (AGL-2615): the minted reference whose id rides the
+ * message as a tag, the links it files under, and the scope it is stamped
+ * with. `null` when the message earns no row.
+ */
+export interface PreparedCrmEmailActivity {
+    ref: FirebaseFirestore.DocumentReference;
+    /** The provider tags the delivery webhook finds the row by. */
+    tags: {
+        name: string;
+        value: string;
+    }[];
+    link: CrmActivityLink;
+    visibleTo: string[];
+}
+/**
+ * Whether — and where — an automation's email lands on a timeline.
+ *
+ * A `sendEmail` step is not a CRM step: it mails whatever address the event
+ * carries, to a person who may be nobody the CRM knows. It earns a row on
+ * exactly one condition, that the message is ADDRESSED TO THE CONTACT the
+ * event is about — the person `resolveEventContact` finds, at the address
+ * the row holds. A welcome sequence to a new contact is that; an internal
+ * alert routed to a merchant's own address through `toField` is not, and a
+ * row for it would put the merchant's inbox on a customer's history.
+ *
+ * Prepared ahead of the send, for the reason the console route mints its
+ * id first: the webhook has nothing but the tags on the message to find
+ * the row with. Nothing is written here. A record at the activity ceiling
+ * earns no row — the message still goes, because the ceiling bounds the
+ * log and not the mail — and neither does a site with no org to hold one.
+ *
+ * **Never throws.** The row is bookkeeping beside a send, and a lookup that
+ * fails must not become a message that never left — the posture every
+ * meter beside `sendEmail` takes. A failure here is logged and the message
+ * goes out untagged.
+ */
+export declare function prepareCrmEmailActivity(env: CrmStepEnv, to: string, payload: HostEventPayload): Promise<PreparedCrmEmailActivity | null>;
+/**
+ * Writes the prepared row, once the provider has accepted the message.
+ *
+ * The same shape the console route logs — `buildCrmEmailActivity` is the
+ * one builder — with the automation as its source and nobody as its
+ * author. **Never throws**: the message has left, and a row that could not
+ * be written is a gap on the timeline rather than a failed step.
+ */
+export declare function logCrmEmailActivity(env: CrmStepEnv, prepared: PreparedCrmEmailActivity, message: {
+    subject: string;
+    body: string;
+    to: string;
+}, actionId: string, nowMs?: number): Promise<void>;