@aglyn/plugins-workflows 1.0.0-beta.143

package/src/lib/server-automation-drafts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/server-automation-drafts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  ACTIONS_MAX_PER_HOST,\n  hostActionDocument,\n  type HostAction,\n  type HostActionStep,\n  type HostActionStepType,\n  type HostActionTriggerCondition,\n  validateHostAction,\n} from '@aglyn/aglyn/app-utils/actions'\nimport { automationPlaceholders } from '@aglyn/aglyn/app-utils/automation-placeholders'\nimport { hostRoleCanWrite } from '@aglyn/aglyn/app-utils/organizations'\nimport { checkEntitlement } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport type { AglynOrgBilling } from '@aglyn/aglyn/foundation/definitions/org-billing.types'\nimport {\n  registerPluginResourceDraftWriter,\n  type PluginDraftCheck,\n  type PluginDraftRecord,\n  type PluginDraftRefusal,\n  type PluginDraftWrite,\n  type PluginResourceDraftWriter,\n} from '@aglyn/aglyn/plugin-manager/plugin-resource-drafts'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from './constants/bundle-common'\n\n/**\n * AN AUTOMATION ANOTHER PLUGIN ASKS FOR (AGL-2919).\n *\n * The draft writer this plugin registers for the `automation` resource on the\n * core's resource-drafts seam. A plugin that produces an automation — a\n * generator working from a description, an importer bringing flows over from\n * another tool — asks for the writer by name and gets this plugin's rules,\n * never a copy of them:\n *\n *  - THE DOCUMENT is `hosts/{hostId}/actions/{id}` in the stored shape the\n *    Actions editor saves (`hostActionDocument`), with only the fields each\n *    step type holds. It is listed on the Automation page's Actions, opens in\n *    that editor, and runs through the same executor as one a person made.\n *  - IT IS OFF. A draft is written `enabled: false` whatever the caller sent,\n *    so nothing it describes runs until a person switches it on.\n *  - THE SCHEMA is the editor's own validator, `validateHostAction`, which the\n *    executor's writers share. A placeholder the draft could not fill — a\n *    bracketed list name, a bracketed condition value — passes it, because it\n *    is a value a person replaces, and the facts name every one.\n *  - THE ROOM is the flat platform cap on live actions, counted inside the\n *    transaction with the arithmetic `/api/hosts/resources` uses.\n *  - THE ROLE is the resources route's: a member who may write the site's\n *    content. THE PLAN is the Actions editor's: the `actions` entitlement.\n *\n * Nothing is enabled, sent or run, and the writer touches the one new document.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\n/** The resource name this writer is registered under. */\nexport const AUTOMATION_DRAFT_RESOURCE = 'automation'\n\n/** The longest name the Actions editor stores. */\nexport const AUTOMATION_DRAFT_NAME_MAX_CHARS = 60\n\n/** A draft's name when the caller asks for none. */\nexport const AUTOMATION_DRAFT_DEFAULT_NAME = 'New automation'\n\n/** The resources route's refusal for a member who may not write the site. */\nexport const AUTOMATION_DRAFT_ROLE_REFUSAL = 'Editing requires the editor role'\n\n/** What a person is told when their plan has no actions builder. It names the page that sells one. */\nexport const AUTOMATION_DRAFT_PLAN_REFUSAL =\n  'Automations are not included on this workspace’s plan. Upgrade in Billing to build them.'\n\n/** The resources route's refusal at the cap. */\nexport const AUTOMATION_DRAFT_LIMIT_REFUSAL =\n  `interactions and actions are capped at ${ACTIONS_MAX_PER_HOST} per site — ` +\n  'delete some to make room'\n\n/** A trigger bound to one element, which makes an action an interaction of its page. */\nconst LEAF_SELECTOR = /^\\[data-aglyn=\"leaf:.+\"\\]$/\n\n/**\n * The fields each step type holds, besides `type` and the step's own `when`.\n * Total over the step types, so a type the model gains is a compile error here\n * until its fields are named, rather than a draft that silently drops them.\n */\nexport const AUTOMATION_STEP_FIELDS: Readonly<Record<HostActionStepType, readonly string[]>> = {\n  runWorkflow: ['workflowId', 'workflowName'],\n  siteAlert: ['message', 'severity'],\n  customEvent: ['eventName'],\n  datasetAppend: ['datasetId', 'datasetName'],\n  webhookPost: ['webhookId', 'webhookName'],\n  showOverlay: ['overlayId', 'overlayName'],\n  stickyNav: ['selector'],\n  addClass: ['selector', 'className'],\n  removeClass: ['selector', 'className'],\n  toggleClass: ['selector', 'className'],\n  showElement: ['selector', 'delayMs', 'dismissOn'],\n  hideElement: ['selector', 'delayMs'],\n  toggleElement: ['selector', 'delayMs', 'dismissOn'],\n  setAttribute: ['selector', 'name', 'value'],\n  removeAttribute: ['selector', 'name'],\n  scrollTo: ['selector', 'behavior', 'offsetPx'],\n  playVideo: ['selector'],\n  openDrawer: ['drawerNodeId'],\n  closeDrawer: ['drawerNodeId'],\n  toggleDrawer: ['drawerNodeId'],\n  openMenu: ['menuNodeId'],\n  closeMenu: ['menuNodeId'],\n  toggleMenu: ['menuNodeId'],\n  showHtml: ['html'],\n  runJs: ['code'],\n  redirect: ['url', 'screenId'],\n  trackGaEvent: ['eventName', 'params'],\n  sendEmail: ['subject', 'body', 'toField', 'topicId'],\n  notifyAdmins: ['title', 'body'],\n  enrollList: ['listId', 'listName'],\n  updateDataset: ['datasetId', 'datasetName'],\n  assignCampaign: ['campaignId', 'campaignName'],\n  wait: ['delayMinutes'],\n  waitForEvent: ['eventName', 'timeoutMinutes'],\n  exitFlow: [],\n  setContactStage: ['lifecycleStage'],\n  addContactTag: ['tag'],\n  assignContactOwner: ['ownerUid', 'ownerEmail', 'roundRobin'],\n  createCrmTask: ['title', 'kind', 'dueInDays', 'assigneeUid', 'assigneeEmail'],\n  logCrmActivity: ['kind', 'body'],\n}\n\n/** The trigger keys an automation stores. */\nconst TRIGGER_FIELDS = [\n  'event',\n  'filter',\n  'conditions',\n  'combinator',\n  'selector',\n  'threshold',\n  'pathPattern',\n  'oncePerVisitor',\n  'oncePerSession',\n  'cooldownMinutes',\n  'everyTime',\n] as const\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\n/** The keys of `source` that `keys` names and that hold something. */\nfunction picked(source: Record<string, unknown>, keys: readonly string[]): Record<string, unknown> {\n  const out: Record<string, unknown> = {}\n  for (const key of keys) {\n    if (source[key] !== undefined && source[key] !== null) out[key] = source[key]\n  }\n  return out\n}\n\nfunction conditionOf(value: unknown): HostActionTriggerCondition | null {\n  if (!isRecord(value)) return null\n  return picked(value, ['field', 'op', 'value']) as unknown as HostActionTriggerCondition\n}\n\nexport type AutomationDraftContentRead =\n  | { ok: true; action: HostAction }\n  | { ok: false; problems: string[] }\n\n/**\n * What a caller sends as `content` — `{ action }` — read into the action this\n * writer would store: the trigger's and each step's own fields and nothing\n * else, named, OFF, and held to the editor's validator.\n */\nexport function readAutomationDraftContent(\n  content: Readonly<Record<string, unknown>>,\n): AutomationDraftContentRead {\n  const raw = content['action']\n  if (!isRecord(raw)) return { ok: false, problems: ['The draft holds no automation'] }\n  const trigger = raw['trigger']\n  const steps = raw['steps']\n  if (!isRecord(trigger)) return { ok: false, problems: ['Pick a trigger event'] }\n  if (!Array.isArray(steps)) return { ok: false, problems: ['Add at least one step'] }\n  const problems: string[] = []\n  const knownTypes = new Set(Object.keys(AUTOMATION_STEP_FIELDS))\n  const cleanSteps: HostActionStep[] = []\n  steps.forEach((step, index) => {\n    const type = isRecord(step) ? step['type'] : undefined\n    if (typeof type !== 'string' || !knownTypes.has(type)) {\n      problems.push(`Step ${index + 1}: not a step the Actions editor offers`)\n      return\n    }\n    const source = step as Record<string, unknown>\n    const when = isRecord(source['when'])\n      ? {\n          conditions: (Array.isArray(source['when']['conditions']) ? source['when']['conditions'] : [])\n            .map(conditionOf)\n            .filter((clause): clause is HostActionTriggerCondition => clause !== null),\n          ...(typeof source['when']['combinator'] === 'string'\n            ? { combinator: source['when']['combinator'] }\n            : {}),\n        }\n      : null\n    cleanSteps.push({\n      type,\n      ...picked(source, AUTOMATION_STEP_FIELDS[type as HostActionStepType]),\n      ...(when && when.conditions.length ? { when } : {}),\n    } as HostActionStep)\n  })\n  const cleanTrigger = picked(trigger, TRIGGER_FIELDS)\n  if (Array.isArray(cleanTrigger['conditions'])) {\n    cleanTrigger['conditions'] = (cleanTrigger['conditions'] as unknown[])\n      .map(conditionOf)\n      .filter((clause): clause is HostActionTriggerCondition => clause !== null)\n  }\n  // An element's own interaction belongs to the page that holds the element,\n  // and is authored there; the Actions list does not show one.\n  if (typeof cleanTrigger['selector'] === 'string' && LEAF_SELECTOR.test(cleanTrigger['selector'])) {\n    problems.push('An interaction on one element is set up on that element, not as an automation')\n  }\n  const name = String(raw['name'] ?? '')\n    .replace(/\\s+/g, ' ')\n    .trim()\n    .slice(0, AUTOMATION_DRAFT_NAME_MAX_CHARS)\n  const action: HostAction = {\n    name: name || AUTOMATION_DRAFT_DEFAULT_NAME,\n    trigger: cleanTrigger as unknown as HostAction['trigger'],\n    steps: cleanSteps,\n    enabled: false,\n  }\n  const invalid = validateHostAction(action)\n  if (invalid) problems.push(invalid)\n  return problems.length ? { ok: false, problems } : { ok: true, action }\n}\n\n/** What the writer reports about an automation beyond its identity. */\nfunction factsOf(action: Pick<HostAction, 'trigger' | 'steps' | 'enabled'>): Record<string, unknown> {\n  return {\n    event: action.trigger?.event ?? '',\n    steps: (action.steps ?? []).length,\n    enabled: action.enabled === true,\n    placeholders: automationPlaceholders(action).length,\n  }\n}\n\n/** Whether content is an automation this site could store: well-formed, off, and valid. */\nexport function checkAutomationDraftContent(\n  content: Readonly<Record<string, unknown>>,\n): PluginDraftCheck {\n  const read = readAutomationDraftContent(content)\n  return read.ok === false ? read : { ok: true, facts: factsOf(read.action) }\n}\n\nfunction recordOf(snapshot: FirebaseFirestore.DocumentSnapshot): PluginDraftRecord {\n  const data = (snapshot.data() ?? {}) as HostAction\n  return {\n    id: snapshot.id,\n    name: String(data.name ?? ''),\n    versionId: null,\n    facts: factsOf(data),\n  }\n}\n\nfunction roleRefusal(host: FirebaseFirestore.DocumentSnapshot, uid: string): PluginDraftRefusal | null {\n  const role = (host.get('memberRoles') ?? {})[uid]\n  return hostRoleCanWrite(role) ? null : { status: 403, error: AUTOMATION_DRAFT_ROLE_REFUSAL }\n}\n\nfunction planRefusal(org: Readonly<Record<string, unknown>> | null): PluginDraftRefusal | null {\n  return checkEntitlement(org as Partial<AglynOrgBilling> | null, 'actions')\n    ? null\n    : { status: 403, error: AUTOMATION_DRAFT_PLAN_REFUSAL }\n}\n\n/** The live actions the site holds: a soft-deleted one frees its slot. */\nfunction liveCount(rows: FirebaseFirestore.QuerySnapshot): number {\n  return rows.docs.filter((row) => row.get('deletedAt') == null).length\n}\n\nfunction roomRefusal(live: number): PluginDraftRefusal | null {\n  return live >= ACTIONS_MAX_PER_HOST ? { status: 403, error: AUTOMATION_DRAFT_LIMIT_REFUSAL } : null\n}\n\nexport interface AutomationDraftWriterDeps {\n  /** The Admin SDK handle; specs hand in a double. */\n  firestore?: () => Firestore\n}\n\nexport function createAutomationDraftWriter(\n  deps: AutomationDraftWriterDeps = {},\n): PluginResourceDraftWriter {\n  const firestore = deps.firestore ?? (() => firebaseAdmin.app().firestore() as unknown as Firestore)\n  return {\n    refusal: async (context) => {\n      const hostRef = firestore().collection('hosts').doc(context.hostId)\n      const host = await hostRef.get()\n      if (!host.exists) return { status: 404, error: 'Unknown site' }\n      return (\n        roleRefusal(host, context.uid) ??\n        planRefusal(context.org) ??\n        roomRefusal(liveCount(await hostRef.collection('actions').select('deletedAt').get()))\n      )\n    },\n\n    check: (content) => checkAutomationDraftContent(content),\n\n    read: async ({ hostId, id }) => {\n      const snapshot = await firestore().collection('hosts').doc(hostId).collection('actions').doc(id).get()\n      return snapshot.exists ? recordOf(snapshot) : null\n    },\n\n    write: async (request): Promise<PluginDraftWrite> => {\n      const read = readAutomationDraftContent(request.content)\n      if (read.ok === false) return { ok: false, status: 400, error: read.problems[0] }\n      const db = firestore()\n      const hostRef = db.collection('hosts').doc(request.hostId)\n      const actionRef = hostRef.collection('actions').doc(request.id)\n      const name =\n        String(request.name ?? '')\n          .replace(/\\s+/g, ' ')\n          .trim()\n          .slice(0, AUTOMATION_DRAFT_NAME_MAX_CHARS) || read.action.name\n      const action: HostAction = { ...read.action, name, enabled: false, recipe: null }\n      return db.runTransaction(async (tx): Promise<PluginDraftWrite> => {\n        // Every read before any write, which Firestore requires.\n        const [host, existing, rows] = await Promise.all([\n          tx.get(hostRef),\n          tx.get(actionRef),\n          tx.get(hostRef.collection('actions').select('deletedAt')),\n        ])\n        if (!host.exists) return { ok: false, status: 404, error: 'Unknown site' }\n        if (existing.exists) return { ok: true, replayed: true, ...recordOf(existing) }\n        const refusal =\n          roleRefusal(host, request.uid) ?? planRefusal(request.org) ?? roomRefusal(liveCount(rows))\n        if (refusal) return { ok: false, ...refusal }\n        tx.create(actionRef, {\n          ...hostActionDocument(action),\n          createdAt: request.now,\n          updatedAt: request.now,\n          createdBy: request.uid,\n        })\n        return { ok: true, replayed: false, id: request.id, name, versionId: null, facts: factsOf(action) }\n      })\n    },\n  }\n}\n\nexport const automationDraftWriter = createAutomationDraftWriter()\n\n/**\n * Registers the writer; the console surface calls it, since only the console\n * runs AI jobs (AGL-3026). Idempotent: a second call replaces the first.\n */\nexport function registerAutomationDraftWriter(): void {\n  registerPluginResourceDraftWriter(AUTOMATION_DRAFT_RESOURCE, automationDraftWriter, {\n    pluginId: BUNDLE_ID,\n  })\n}\n"],"names":["ACTIONS_MAX_PER_HOST","hostActionDocument","validateHostAction","automationPlaceholders","hostRoleCanWrite","checkEntitlement","registerPluginResourceDraftWriter","firebaseAdmin","BUNDLE_ID","AUTOMATION_DRAFT_RESOURCE","AUTOMATION_DRAFT_NAME_MAX_CHARS","AUTOMATION_DRAFT_DEFAULT_NAME","AUTOMATION_DRAFT_ROLE_REFUSAL","AUTOMATION_DRAFT_PLAN_REFUSAL","AUTOMATION_DRAFT_LIMIT_REFUSAL","LEAF_SELECTOR","AUTOMATION_STEP_FIELDS","runWorkflow","siteAlert","customEvent","datasetAppend","webhookPost","showOverlay","stickyNav","addClass","removeClass","toggleClass","showElement","hideElement","toggleElement","setAttribute","removeAttribute","scrollTo","playVideo","openDrawer","closeDrawer","toggleDrawer","openMenu","closeMenu","toggleMenu","showHtml","runJs","redirect","trackGaEvent","sendEmail","notifyAdmins","enrollList","updateDataset","assignCampaign","wait","waitForEvent","exitFlow","setContactStage","addContactTag","assignContactOwner","createCrmTask","logCrmActivity","TRIGGER_FIELDS","isRecord","value","Array","isArray","picked","source","keys","out","key","undefined","conditionOf","readAutomationDraftContent","content","raw","ok","problems","trigger","steps","knownTypes","Set","Object","cleanSteps","forEach","step","index","type","has","push","when","conditions","map","filter","clause","combinator","length","cleanTrigger","test","name","String","replace","trim","slice","action","enabled","invalid","factsOf","event","placeholders","checkAutomationDraftContent","read","facts","recordOf","snapshot","data","id","versionId","roleRefusal","host","uid","role","get","status","error","planRefusal","org","liveCount","rows","docs","row","roomRefusal","live","createAutomationDraftWriter","deps","firestore","app","refusal","context","hostRef","collection","doc","hostId","exists","select","check","write","request","db","actionRef","recipe","runTransaction","tx","existing","Promise","all","replayed","create","createdAt","now","updatedAt","createdBy","automationDraftWriter","registerAutomationDraftWriter","pluginId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,oBAAoB,EACpBC,kBAAkB,EAKlBC,kBAAkB,QACb,iCAAgC;AACvC,SAASC,sBAAsB,QAAQ,iDAAgD;AACvF,SAASC,gBAAgB,QAAQ,uCAAsC;AACvE,SAASC,gBAAgB,QAAQ,2CAA0C;AAE3E,SACEC,iCAAiC,QAM5B,qDAAoD;AAC3D,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,+BAA2B;AA+BrD,uDAAuD,GACvD,OAAO,MAAMC,4BAA4B,aAAY;AAErD,gDAAgD,GAChD,OAAO,MAAMC,kCAAkC,GAAE;AAEjD,kDAAkD,GAClD,OAAO,MAAMC,gCAAgC,iBAAgB;AAE7D,2EAA2E,GAC3E,OAAO,MAAMC,gCAAgC,mCAAkC;AAE/E,oGAAoG,GACpG,OAAO,MAAMC,gCACX,2FAA0F;AAE5F,8CAA8C,GAC9C,OAAO,MAAMC,iCACX,CAAC,uCAAuC,EAAEd,qBAAqB,YAAY,CAAC,GAC5E,2BAA0B;AAE5B,sFAAsF,GACtF,MAAMe,gBAAgB;AAEtB;;;;CAIC,GACD,OAAO,MAAMC,yBAAkF;IAC7FC,aAAa;QAAC;QAAc;KAAe;IAC3CC,WAAW;QAAC;QAAW;KAAW;IAClCC,aAAa;QAAC;KAAY;IAC1BC,eAAe;QAAC;QAAa;KAAc;IAC3CC,aAAa;QAAC;QAAa;KAAc;IACzCC,aAAa;QAAC;QAAa;KAAc;IACzCC,WAAW;QAAC;KAAW;IACvBC,UAAU;QAAC;QAAY;KAAY;IACnCC,aAAa;QAAC;QAAY;KAAY;IACtCC,aAAa;QAAC;QAAY;KAAY;IACtCC,aAAa;QAAC;QAAY;QAAW;KAAY;IACjDC,aAAa;QAAC;QAAY;KAAU;IACpCC,eAAe;QAAC;QAAY;QAAW;KAAY;IACnDC,cAAc;QAAC;QAAY;QAAQ;KAAQ;IAC3CC,iBAAiB;QAAC;QAAY;KAAO;IACrCC,UAAU;QAAC;QAAY;QAAY;KAAW;IAC9CC,WAAW;QAAC;KAAW;IACvBC,YAAY;QAAC;KAAe;IAC5BC,aAAa;QAAC;KAAe;IAC7BC,cAAc;QAAC;KAAe;IAC9BC,UAAU;QAAC;KAAa;IACxBC,WAAW;QAAC;KAAa;IACzBC,YAAY;QAAC;KAAa;IAC1BC,UAAU;QAAC;KAAO;IAClBC,OAAO;QAAC;KAAO;IACfC,UAAU;QAAC;QAAO;KAAW;IAC7BC,cAAc;QAAC;QAAa;KAAS;IACrCC,WAAW;QAAC;QAAW;QAAQ;QAAW;KAAU;IACpDC,cAAc;QAAC;QAAS;KAAO;IAC/BC,YAAY;QAAC;QAAU;KAAW;IAClCC,eAAe;QAAC;QAAa;KAAc;IAC3CC,gBAAgB;QAAC;QAAc;KAAe;IAC9CC,MAAM;QAAC;KAAe;IACtBC,cAAc;QAAC;QAAa;KAAiB;IAC7CC,UAAU,EAAE;IACZC,iBAAiB;QAAC;KAAiB;IACnCC,eAAe;QAAC;KAAM;IACtBC,oBAAoB;QAAC;QAAY;QAAc;KAAa;IAC5DC,eAAe;QAAC;QAAS;QAAQ;QAAa;QAAe;KAAgB;IAC7EC,gBAAgB;QAAC;QAAQ;KAAO;AAClC,EAAC;AAED,2CAA2C,GAC3C,MAAMC,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,SAASC,SAASC,KAAc;IAC9B,OAAO,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACC,MAAMC,OAAO,CAACF;AACvE;AAEA,oEAAoE,GACpE,SAASG,OAAOC,MAA+B,EAAEC,IAAuB;IACtE,MAAMC,MAA+B,CAAC;IACtC,KAAK,MAAMC,OAAOF,KAAM;QACtB,IAAID,MAAM,CAACG,IAAI,KAAKC,aAAaJ,MAAM,CAACG,IAAI,KAAK,MAAMD,GAAG,CAACC,IAAI,GAAGH,MAAM,CAACG,IAAI;IAC/E;IACA,OAAOD;AACT;AAEA,SAASG,YAAYT,KAAc;IACjC,IAAI,CAACD,SAASC,QAAQ,OAAO;IAC7B,OAAOG,OAAOH,OAAO;QAAC;QAAS;QAAM;KAAQ;AAC/C;AAMA;;;;CAIC,GACD,OAAO,SAASU,2BACdC,OAA0C;QA6CtBC;IA3CpB,MAAMA,MAAMD,OAAO,CAAC,SAAS;IAC7B,IAAI,CAACZ,SAASa,MAAM,OAAO;QAAEC,IAAI;QAAOC,UAAU;YAAC;SAAgC;IAAC;IACpF,MAAMC,UAAUH,GAAG,CAAC,UAAU;IAC9B,MAAMI,QAAQJ,GAAG,CAAC,QAAQ;IAC1B,IAAI,CAACb,SAASgB,UAAU,OAAO;QAAEF,IAAI;QAAOC,UAAU;YAAC;SAAuB;IAAC;IAC/E,IAAI,CAACb,MAAMC,OAAO,CAACc,QAAQ,OAAO;QAAEH,IAAI;QAAOC,UAAU;YAAC;SAAwB;IAAC;IACnF,MAAMA,WAAqB,EAAE;IAC7B,MAAMG,aAAa,IAAIC,IAAIC,OAAOd,IAAI,CAAChD;IACvC,MAAM+D,aAA+B,EAAE;IACvCJ,MAAMK,OAAO,CAAC,CAACC,MAAMC;QACnB,MAAMC,OAAOzB,SAASuB,QAAQA,IAAI,CAAC,OAAO,GAAGd;QAC7C,IAAI,OAAOgB,SAAS,YAAY,CAACP,WAAWQ,GAAG,CAACD,OAAO;YACrDV,SAASY,IAAI,CAAC,CAAC,KAAK,EAAEH,QAAQ,EAAE,sCAAsC,CAAC;YACvE;QACF;QACA,MAAMnB,SAASkB;QACf,MAAMK,OAAO5B,SAASK,MAAM,CAAC,OAAO,IAChC;YACEwB,YAAY,AAAC3B,CAAAA,MAAMC,OAAO,CAACE,MAAM,CAAC,OAAO,CAAC,aAAa,IAAIA,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,EAAE,AAAD,EACxFyB,GAAG,CAACpB,aACJqB,MAAM,CAAC,CAACC,SAAiDA,WAAW;WACnE,OAAO3B,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,WACxC;YAAE4B,YAAY5B,MAAM,CAAC,OAAO,CAAC,aAAa;QAAC,IAC3C,CAAC,KAEP;QACJgB,WAAWM,IAAI,CAAC;YACdF;WACGrB,OAAOC,QAAQ/C,sBAAsB,CAACmE,KAA2B,GAChEG,QAAQA,KAAKC,UAAU,CAACK,MAAM,GAAG;YAAEN;QAAK,IAAI,CAAC;IAErD;IACA,MAAMO,eAAe/B,OAAOY,SAASjB;IACrC,IAAIG,MAAMC,OAAO,CAACgC,YAAY,CAAC,aAAa,GAAG;QAC7CA,YAAY,CAAC,aAAa,GAAG,AAACA,YAAY,CAAC,aAAa,CACrDL,GAAG,CAACpB,aACJqB,MAAM,CAAC,CAACC,SAAiDA,WAAW;IACzE;IACA,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,OAAOG,YAAY,CAAC,WAAW,KAAK,YAAY9E,cAAc+E,IAAI,CAACD,YAAY,CAAC,WAAW,GAAG;QAChGpB,SAASY,IAAI,CAAC;IAChB;IACA,MAAMU,OAAOC,QAAOzB,YAAAA,GAAG,CAAC,OAAO,YAAXA,YAAe,IAChC0B,OAAO,CAAC,QAAQ,KAChBC,IAAI,GACJC,KAAK,CAAC,GAAGzF;IACZ,MAAM0F,SAAqB;QACzBL,MAAMA,QAAQpF;QACd+D,SAASmB;QACTlB,OAAOI;QACPsB,SAAS;IACX;IACA,MAAMC,UAAUpG,mBAAmBkG;IACnC,IAAIE,SAAS7B,SAASY,IAAI,CAACiB;IAC3B,OAAO7B,SAASmB,MAAM,GAAG;QAAEpB,IAAI;QAAOC;IAAS,IAAI;QAAED,IAAI;QAAM4B;IAAO;AACxE;AAEA,qEAAqE,GACrE,SAASG,QAAQH,MAAyD;cAG9DA;QADDA;IADT,OAAO;QACLI,KAAK,WAAEJ,kBAAAA,OAAO1B,OAAO,qBAAd0B,gBAAgBI,KAAK,mBAAI;QAChC7B,OAAO,EAACyB,gBAAAA,OAAOzB,KAAK,YAAZyB,gBAAgB,EAAE,EAAER,MAAM;QAClCS,SAASD,OAAOC,OAAO,KAAK;QAC5BI,cAActG,uBAAuBiG,QAAQR,MAAM;IACrD;AACF;AAEA,yFAAyF,GACzF,OAAO,SAASc,4BACdpC,OAA0C;IAE1C,MAAMqC,OAAOtC,2BAA2BC;IACxC,OAAOqC,KAAKnC,EAAE,KAAK,QAAQmC,OAAO;QAAEnC,IAAI;QAAMoC,OAAOL,QAAQI,KAAKP,MAAM;IAAE;AAC5E;AAEA,SAASS,SAASC,QAA4C;QAC9CA,gBAGCC;IAHf,MAAMA,QAAQD,iBAAAA,SAASC,IAAI,cAAbD,iBAAmB,CAAC;IAClC,OAAO;QACLE,IAAIF,SAASE,EAAE;QACfjB,MAAMC,QAAOe,aAAAA,KAAKhB,IAAI,YAATgB,aAAa;QAC1BE,WAAW;QACXL,OAAOL,QAAQQ;IACjB;AACF;AAEA,SAASG,YAAYC,IAAwC,EAAEC,GAAW;QAC1DD;IAAd,MAAME,OAAO,EAACF,YAAAA,KAAKG,GAAG,CAAC,0BAATH,YAA2B,CAAC,EAAE,CAACC,IAAI;IACjD,OAAOhH,iBAAiBiH,QAAQ,OAAO;QAAEE,QAAQ;QAAKC,OAAO5G;IAA8B;AAC7F;AAEA,SAAS6G,YAAYC,GAA6C;IAChE,OAAOrH,iBAAiBqH,KAAwC,aAC5D,OACA;QAAEH,QAAQ;QAAKC,OAAO3G;IAA8B;AAC1D;AAEA,wEAAwE,GACxE,SAAS8G,UAAUC,IAAqC;IACtD,OAAOA,KAAKC,IAAI,CAACpC,MAAM,CAAC,CAACqC,MAAQA,IAAIR,GAAG,CAAC,gBAAgB,MAAM1B,MAAM;AACvE;AAEA,SAASmC,YAAYC,IAAY;IAC/B,OAAOA,QAAQhI,uBAAuB;QAAEuH,QAAQ;QAAKC,OAAO1G;IAA+B,IAAI;AACjG;AAOA,OAAO,SAASmH,4BACdC,OAAkC,CAAC,CAAC;QAElBA;IAAlB,MAAMC,aAAYD,kBAAAA,KAAKC,SAAS,YAAdD,kBAAmB,IAAM3H,cAAc6H,GAAG,GAAGD,SAAS;IACxE,OAAO;QACLE,SAAS,OAAOC;gBAKZpB,MAAAA;YAJF,MAAMqB,UAAUJ,YAAYK,UAAU,CAAC,SAASC,GAAG,CAACH,QAAQI,MAAM;YAClE,MAAMvB,OAAO,MAAMoB,QAAQjB,GAAG;YAC9B,IAAI,CAACH,KAAKwB,MAAM,EAAE,OAAO;gBAAEpB,QAAQ;gBAAKC,OAAO;YAAe;YAC9D,QACEN,QAAAA,eAAAA,YAAYC,MAAMmB,QAAQlB,GAAG,aAA7BF,eACAO,YAAYa,QAAQZ,GAAG,aADvBR,OAEAa,YAAYJ,UAAU,MAAMY,QAAQC,UAAU,CAAC,WAAWI,MAAM,CAAC,aAAatB,GAAG;QAErF;QAEAuB,OAAO,CAACvE,UAAYoC,4BAA4BpC;QAEhDqC,MAAM,OAAO,EAAE+B,MAAM,EAAE1B,EAAE,EAAE;YACzB,MAAMF,WAAW,MAAMqB,YAAYK,UAAU,CAAC,SAASC,GAAG,CAACC,QAAQF,UAAU,CAAC,WAAWC,GAAG,CAACzB,IAAIM,GAAG;YACpG,OAAOR,SAAS6B,MAAM,GAAG9B,SAASC,YAAY;QAChD;QAEAgC,OAAO,OAAOC;gBAOHA;YANT,MAAMpC,OAAOtC,2BAA2B0E,QAAQzE,OAAO;YACvD,IAAIqC,KAAKnC,EAAE,KAAK,OAAO,OAAO;gBAAEA,IAAI;gBAAO+C,QAAQ;gBAAKC,OAAOb,KAAKlC,QAAQ,CAAC,EAAE;YAAC;YAChF,MAAMuE,KAAKb;YACX,MAAMI,UAAUS,GAAGR,UAAU,CAAC,SAASC,GAAG,CAACM,QAAQL,MAAM;YACzD,MAAMO,YAAYV,QAAQC,UAAU,CAAC,WAAWC,GAAG,CAACM,QAAQ/B,EAAE;YAC9D,MAAMjB,OACJC,QAAO+C,gBAAAA,QAAQhD,IAAI,YAAZgD,gBAAgB,IACpB9C,OAAO,CAAC,QAAQ,KAChBC,IAAI,GACJC,KAAK,CAAC,GAAGzF,oCAAoCiG,KAAKP,MAAM,CAACL,IAAI;YAClE,MAAMK,SAAqB,aAAKO,KAAKP,MAAM;gBAAEL;gBAAMM,SAAS;gBAAO6C,QAAQ;;YAC3E,OAAOF,GAAGG,cAAc,CAAC,OAAOC;oBAU5BlC,MAAAA;gBATF,yDAAyD;gBACzD,MAAM,CAACC,MAAMkC,UAAUzB,KAAK,GAAG,MAAM0B,QAAQC,GAAG,CAAC;oBAC/CH,GAAG9B,GAAG,CAACiB;oBACPa,GAAG9B,GAAG,CAAC2B;oBACPG,GAAG9B,GAAG,CAACiB,QAAQC,UAAU,CAAC,WAAWI,MAAM,CAAC;iBAC7C;gBACD,IAAI,CAACzB,KAAKwB,MAAM,EAAE,OAAO;oBAAEnE,IAAI;oBAAO+C,QAAQ;oBAAKC,OAAO;gBAAe;gBACzE,IAAI6B,SAASV,MAAM,EAAE,OAAO;oBAAEnE,IAAI;oBAAMgF,UAAU;mBAAS3C,SAASwC;gBACpE,MAAMhB,WACJnB,QAAAA,eAAAA,YAAYC,MAAM4B,QAAQ3B,GAAG,aAA7BF,eAAkCO,YAAYsB,QAAQrB,GAAG,aAAzDR,OAA8Da,YAAYJ,UAAUC;gBACtF,IAAIS,SAAS,OAAO;oBAAE7D,IAAI;mBAAU6D;gBACpCe,GAAGK,MAAM,CAACR,WAAW,aAChBhJ,mBAAmBmG;oBACtBsD,WAAWX,QAAQY,GAAG;oBACtBC,WAAWb,QAAQY,GAAG;oBACtBE,WAAWd,QAAQ3B,GAAG;;gBAExB,OAAO;oBAAE5C,IAAI;oBAAMgF,UAAU;oBAAOxC,IAAI+B,QAAQ/B,EAAE;oBAAEjB;oBAAMkB,WAAW;oBAAML,OAAOL,QAAQH;gBAAQ;YACpG;QACF;IACF;AACF;AAEA,OAAO,MAAM0D,wBAAwB7B,8BAA6B;AAElE;;;CAGC,GACD,OAAO,SAAS8B;IACdzJ,kCAAkCG,2BAA2BqJ,uBAAuB;QAClFE,UAAUxJ;IACZ;AACF"}

package/src/lib/server-console.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The workflows plugin's console server surface (AGL-2919).
+ *
+ * The tenant surface (`registerWorkflowsApi`) serves the inbound webhook a
+ * visitor-facing integration calls. This one serves what only the console
+ * does: the automation draft writer another plugin reaches through the core's
+ * resource-drafts seam, which the AI jobs that write through it — inline at a
+ * door and on the beat — find registered in the console process alone
+ * (AGL-3026).
+ */
+export declare function registerWorkflowsConsoleApi(): void;

package/src/lib/server-console.js

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerWorkflowsServerDeclarations } from "./declarations.server.js";
+import { registerAutomationDraftWriter } from "./server-automation-drafts.js";
+/**
+ * The workflows plugin's console server surface (AGL-2919).
+ *
+ * The tenant surface (`registerWorkflowsApi`) serves the inbound webhook a
+ * visitor-facing integration calls. This one serves what only the console
+ * does: the automation draft writer another plugin reaches through the core's
+ * resource-drafts seam, which the AI jobs that write through it — inline at a
+ * door and on the beat — find registered in the console process alone
+ * (AGL-3026).
+ */ export function registerWorkflowsConsoleApi() {
+    // The console raises host events too — a CRM stage moved, a deal won, a
+    // task completed — so the engine's listener is registered here as well as
+    // at boot (see `declarations.server.ts`).
+    registerWorkflowsServerDeclarations();
+    registerAutomationDraftWriter();
+}
+
+//# sourceMappingURL=server-console.js.map

package/src/lib/server-console.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/server-console.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerWorkflowsServerDeclarations } from './declarations.server'\nimport { registerAutomationDraftWriter } from './server-automation-drafts'\n\n/**\n * The workflows plugin's console server surface (AGL-2919).\n *\n * The tenant surface (`registerWorkflowsApi`) serves the inbound webhook a\n * visitor-facing integration calls. This one serves what only the console\n * does: the automation draft writer another plugin reaches through the core's\n * resource-drafts seam, which the AI jobs that write through it — inline at a\n * door and on the beat — find registered in the console process alone\n * (AGL-3026).\n */\nexport function registerWorkflowsConsoleApi(): void {\n  // The console raises host events too — a CRM stage moved, a deal won, a\n  // task completed — so the engine's listener is registered here as well as\n  // at boot (see `declarations.server.ts`).\n  registerWorkflowsServerDeclarations()\n  registerAutomationDraftWriter()\n}\n"],"names":["registerWorkflowsServerDeclarations","registerAutomationDraftWriter","registerWorkflowsConsoleApi"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,mCAAmC,QAAQ,2BAAuB;AAC3E,SAASC,6BAA6B,QAAQ,gCAA4B;AAE1E;;;;;;;;;CASC,GACD,OAAO,SAASC;IACd,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1CF;IACAC;AACF"}

package/src/lib/server.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Registers the workflows plugin's public API routes (AGL-396), and the
+ * engine's host-event listener beside them for a process whose boot did not
+ * (see `declarations.server.ts`).
+ */
+export declare function registerWorkflowsApi(): void;
+/**
+ * The console half (AGL-2919), re-exported so one entry point serves both
+ * surfaces: the manifest generator resolves every server surface through
+ * `@aglyn/plugins-workflows/server`, and a second entry point would be a second
+ * thing to keep in step with plugins.config.json.
+ */
+export { registerWorkflowsConsoleApi } from './server-console';

package/src/lib/server.js

@@ -0,0 +1,298 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement, resolveOrgEntitlements, runWorkflow } from "@aglyn/aglyn/server";
+import { registerPluginApiRoute, registerPluginJob } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { timingSafeEqual } from "crypto";
+import { FieldValue } from "firebase-admin/firestore";
+import { BUNDLE_ID as WORKFLOWS_BUNDLE_ID } from "./constants/bundle-common.js";
+import { registerWorkflowsServerDeclarations } from "./declarations.server.js";
+import { automationRunEnv, executeWorkflow, runDueFlowEnrollments, workflowContextFromDocs } from "./engine/run-event-actions.js";
+import { workflowHasActionSteps } from "./engine/workflow-steps.js";
+/*==========================================
+ * THE BEAT THAT MAKES A WAIT STEP REAL.
+ *
+ * A `wait` step suspends a run into a `flowEnrollments` row and returns; this
+ * is the only thing that ever comes back for it. Without a registration here
+ * the wait step would be a delay that never ends — the exact failure
+ * `process-abandoned.ts` documents next door, where a Pro entitlement sat
+ * behind an HTTP door nothing ever POSTed to.
+ *
+ * Module scope, like the commerce and bookings registrations: the runner
+ * route reaches plugin jobs through `ensureAll(['tenantApi'])`, so a
+ * registration inside `registerWorkflowsApi()` would depend on which entry
+ * point happened to be loaded.
+ *
+ * ## Every minute, and why that is cheap
+ *
+ * `FLOW_WAIT_MIN_MINUTES` is one, so the beat has to be one — a fifteen-minute
+ * sweep would make the shortest wait anybody can author wrong by up to
+ * fourteen minutes. It costs one collection-group query per minute, which
+ * returns nothing at all on a platform with no flow due, because the query
+ * asks for `resumeAtMs <= now` rather than for the enrolled population.
+ *
+ * Bounded and idempotent, the two properties the runner requires: the scan
+ * budget bounds one pass, and a transactional claim means an overlapping or
+ * repeated beat cannot run the same person's step twice.
+ *=========================================*/ registerPluginJob({
+    pluginId: WORKFLOWS_BUNDLE_ID,
+    name: 'resume-flow-waits',
+    intervalMinutes: 1,
+    description: 'Continue automations whose wait step has ended, and time out those ' + 'waiting for an event that never arrived.',
+    lockdown: {
+        scope: 'per-host'
+    },
+    handler: async (gate)=>{
+        await runDueFlowEnrollments(gate);
+    }
+});
+// Best-effort per-instance rate limit (mirrors forms/submit).
+const recentByHook = new Map();
+const RATE_WINDOW_MS = 60000;
+const RATE_MAX = 30;
+function rateLimited(key) {
+    var _recentByHook_get;
+    const now = Date.now();
+    const hits = ((_recentByHook_get = recentByHook.get(key)) != null ? _recentByHook_get : []).filter((t)=>now - t < RATE_WINDOW_MS);
+    hits.push(now);
+    recentByHook.set(key, hits);
+    return hits.length > RATE_MAX;
+}
+function secretsMatch(expected, provided) {
+    if (!expected || expected.length !== provided.length) return false;
+    return timingSafeEqual(new Uint8Array(Buffer.from(expected)), new Uint8Array(Buffer.from(provided)));
+}
+/**
+ * Inbound webhook endpoint (AGL-149): external systems POST JSON to
+ * `/api/hooks/{hostId}/{hookId}` with the hook's secret in
+ * `x-aglyn-secret`; a valid call enrolls the configured workflow with the
+ * payload's top-level primitives in scope. Business tier (`webhooks`
+ * flag); runs bill against the workflow-runs meter like any other run —
+ * `workflowRunsPerMonth` is checked before the run and
+ * `hosts/{id}/counters/workflowRuns` is incremented after it (AGL-2228).
+ * That sentence was here before either half of it was true.
+ */ const inboundHookHandler = async (req, res)=>{
+    var _req_query_hostId, _req_query_hookId;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_req_query_hostId = req.query['hostId']) != null ? _req_query_hostId : '');
+    const hookId = String((_req_query_hookId = req.query['hookId']) != null ? _req_query_hookId : '');
+    if (!hostId || !hookId) {
+        return res.status(400).json({
+            error: 'Invalid webhook address'
+        });
+    }
+    if (rateLimited(`${hostId}/${hookId}`)) {
+        return res.status(429).json({
+            error: 'Too many requests'
+        });
+    }
+    try {
+        var _req_headers_xaglynsecret, _hook_secret, _get, _req_body, _ref, _hook_name, _hook_name1;
+        var _hook_workflowName;
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hookSnapshot = await hostRef.collection('webhooks').doc(hookId).get();
+        const hook = hookSnapshot.data();
+        if (!hook || hookSnapshot.get('deletedAt') || hook.direction !== 'inbound' || hook.enabled === false) {
+            return res.status(404).json({
+                error: 'Unknown webhook'
+            });
+        }
+        const provided = String((_req_headers_xaglynsecret = req.headers['x-aglyn-secret']) != null ? _req_headers_xaglynsecret : '');
+        if (!secretsMatch((_hook_secret = hook.secret) != null ? _hook_secret : '', provided)) {
+            return res.status(401).json({
+                error: 'Bad secret'
+            });
+        }
+        // Plan/quota gates ride the owning org's doc (AGL-238).
+        const owner = await getOrgForHost(hostId);
+        const org = owner == null ? void 0 : owner.org;
+        if (!checkEntitlement(org, 'webhooks')) {
+            return res.status(403).json({
+                error: 'Webhooks are not enabled on this site'
+            });
+        }
+        /*
+     * The MONTHLY RUN CAP, which this handler's own docblock claimed for
+     * years — "runs bill against the workflow-runs meter like any other run"
+     * — and did not have. It read neither `workflowRunsPerMonth` nor
+     * `hosts/{id}/counters/workflowRuns`, and it wrote neither, so an inbound
+     * hook was a workflow execution that no cap could refuse and no meter
+     * could see: the customer's usage card, the usage-alerts cron and the
+     * COGS rollup all read a counter this path never moved.
+     *
+     * The refusal is a 402 rather than the silent `return` of
+     * `runEventWorkflows`: that path is fired from a visitor request whose
+     * success must not depend on the workflow, where this one is an
+     * integration calling us on purpose and a caller that gets a 200 for a
+     * run that did not happen will keep sending. `Retry-After` is deliberately
+     * absent — the month, not a delay, is what clears this.
+     *
+     * The plan-less/unreadable org resolves as FREE
+     * (`workflowRunsPerMonth: 0`), so an org doc we cannot read refuses rather
+     * than runs. `checkEntitlement(webhooks)` above already refuses free on
+     * today's price list; this is not a second gate on the same fact, because
+     * a staff `entitlementOverrides` can grant `webhooks` without granting
+     * runs, and because the cap is what bounds a BUSINESS org's spend.
+     *
+     * Read-then-write, like the event path, and bounded the same way: the
+     * per-hook limiter above is 30/60s, so the overshoot a race can buy is
+     * bounded by concurrency rather than unbounded by design. Making it
+     * atomic means a transaction around the whole run and is the same trade
+     * `runEventWorkflows` declined.
+     */ const monthKey = new Date().toISOString().slice(0, 7);
+        const runCounterRef = hostRef.collection('counters').doc('workflowRuns');
+        const runLimit = resolveOrgEntitlements(org).workflowRunsPerMonth;
+        const runsUsed = Number((_get = (await runCounterRef.get()).get(monthKey)) != null ? _get : 0);
+        if (!(runsUsed + 1 <= runLimit)) {
+            return res.status(402).json({
+                error: `This site has used its ${runLimit} workflow runs for the month`
+            });
+        }
+        // Top-level primitives from the JSON body join the workflow scope.
+        const body = typeof req.body === 'string' ? JSON.parse(req.body || '{}') : (_req_body = req.body) != null ? _req_body : {};
+        const scope = {};
+        for (const [key, value] of Object.entries(body)){
+            if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
+                scope[key.slice(0, 64)] = typeof value === 'string' ? value.slice(0, 2000) : value;
+            }
+        }
+        const [functionDocs, variableDocs, workflowDocs] = await Promise.all([
+            hostRef.collection('functions').limit(100).get(),
+            hostRef.collection('variables').limit(100).get(),
+            hostRef.collection('workflows').limit(100).get()
+        ]);
+        const byName = (docs)=>{
+            const map = {};
+            for (const doc of docs){
+                const data = doc.data();
+                if ((data == null ? void 0 : data.name) && !data.deletedAt) map[data.name] = data;
+            }
+            return map;
+        };
+        const workflows = byName(workflowDocs.docs);
+        const workflow = workflows[(_ref = (_hook_workflowName = hook.workflowName) == null ? void 0 : _hook_workflowName.trim()) != null ? _ref : ''];
+        if (!workflow) {
+            return res.status(422).json({
+                error: 'No workflow bound to this hook'
+            });
+        }
+        const hookEvent = `hook:${(_hook_name = hook.name) != null ? _hook_name : hookId}`;
+        /*
+     * A workflow of function calls is evaluated, as it always has been. One
+     * with Actions steps is PERFORMED by the engine's executor — the posted
+     * JSON is its payload — under the Actions tier gates, step by step, and
+     * it is still one run on the meter below. Its working set is built from
+     * the documents read above rather than read again.
+     */ const outcome = workflowHasActionSteps(workflow) ? await (async ()=>{
+            var _ref, _workflow_name;
+            const workflowDoc = workflowDocs.docs.find((doc)=>{
+                var _hook_workflowName;
+                return !doc.get('deletedAt') && doc.get('name') === ((_hook_workflowName = hook.workflowName) == null ? void 0 : _hook_workflowName.trim());
+            });
+            const execution = await executeWorkflow(automationRunEnv({
+                hostId,
+                hostRef,
+                owner,
+                depth: 0,
+                loadWorkflowContext: async ()=>workflowContextFromDocs(functionDocs.docs, variableDocs.docs, workflowDocs.docs)
+            }), {
+                kind: 'workflow',
+                id: (_ref = workflowDoc == null ? void 0 : workflowDoc.id) != null ? _ref : '',
+                name: (_workflow_name = workflow.name) != null ? _workflow_name : ''
+            }, workflow, hookEvent, scope);
+            return {
+                error: execution.errors.length ? execution.errors.join('; ') : null,
+                value: execution.value,
+                summary: execution.outcomes.length ? execution.outcomes.join(' · ') : `Ran ${hook.workflowName}`
+            };
+        })() : (()=>{
+            const run = runWorkflow(workflow, byName(functionDocs.docs), byName(variableDocs.docs), _extends({
+                event: hookEvent
+            }, scope), {
+                workflows
+            });
+            return run.ok === false ? {
+                error: run.error,
+                value: undefined,
+                summary: ''
+            } : {
+                error: null,
+                value: run.value,
+                summary: `Ran ${hook.workflowName}`
+            };
+        })();
+        const failed = outcome.error !== null;
+        await hostRef.collection('activity').add({
+            actorId: null,
+            actorEmail: null,
+            action: failed ? `Inbound webhook run failed: ${outcome.error}`.slice(0, 300) : `Inbound webhook ran "${hook.workflowName}"`,
+            // The run-history shape (AGL-2222) — without `result` this execution
+            // is invisible to the Runs table, which reads a verdict and not prose.
+            result: failed ? 'failed' : 'succeeded',
+            trigger: hookEvent,
+            summary: failed ? String(outcome.error).slice(0, 300) : outcome.summary.slice(0, 300),
+            target: {
+                type: 'workflow',
+                id: hookId,
+                name: (_hook_name1 = hook.name) != null ? _hook_name1 : ''
+            },
+            createdAt: FieldValue.serverTimestamp()
+        }).catch(()=>undefined);
+        // The run happened, so it counts — including a FAILED one, exactly as
+        // `runEventWorkflows` counts its failures. A run that executed and threw
+        // spent the same compute as one that returned a value; only a run that
+        // never started (the cap above, a missing workflow) must not count.
+        await runCounterRef.set({
+            [monthKey]: FieldValue.increment(1)
+        }, {
+            merge: true
+        }).catch(()=>undefined);
+        if (failed) return res.status(422).json({
+            error: outcome.error
+        });
+        return res.status(200).json({
+            ok: true,
+            value: outcome.value
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Webhook failed'
+        });
+    }
+};
+/**
+ * Registers the workflows plugin's public API routes (AGL-396), and the
+ * engine's host-event listener beside them for a process whose boot did not
+ * (see `declarations.server.ts`).
+ */ export function registerWorkflowsApi() {
+    registerWorkflowsServerDeclarations();
+    registerPluginApiRoute('hooks/[hostId]/[hookId]', inboundHookHandler);
+}
+/**
+ * The console half (AGL-2919), re-exported so one entry point serves both
+ * surfaces: the manifest generator resolves every server surface through
+ * `@aglyn/plugins-workflows/server`, and a second entry point would be a second
+ * thing to keep in step with plugins.config.json.
+ */ export { registerWorkflowsConsoleApi } from "./server-console.js";
+
+//# sourceMappingURL=server.js.map

package/src/lib/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkEntitlement,\n  type HostFunction,\n  type HostVariable,\n  type HostWebhook,\n  type HostWorkflow,\n  resolveOrgEntitlements,\n  runWorkflow,\n} from '@aglyn/aglyn/server'\nimport {\n  registerPluginApiRoute,\n  registerPluginJob,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { timingSafeEqual } from 'crypto'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { BUNDLE_ID as WORKFLOWS_BUNDLE_ID } from './constants/bundle-common'\nimport { registerWorkflowsServerDeclarations } from './declarations.server'\nimport {\n  automationRunEnv,\n  executeWorkflow,\n  runDueFlowEnrollments,\n  workflowContextFromDocs,\n} from './engine/run-event-actions'\nimport {\n  type AutomationWorkflow,\n  workflowHasActionSteps,\n} from './engine/workflow-steps'\n\n/*==========================================\n * THE BEAT THAT MAKES A WAIT STEP REAL.\n *\n * A `wait` step suspends a run into a `flowEnrollments` row and returns; this\n * is the only thing that ever comes back for it. Without a registration here\n * the wait step would be a delay that never ends — the exact failure\n * `process-abandoned.ts` documents next door, where a Pro entitlement sat\n * behind an HTTP door nothing ever POSTed to.\n *\n * Module scope, like the commerce and bookings registrations: the runner\n * route reaches plugin jobs through `ensureAll(['tenantApi'])`, so a\n * registration inside `registerWorkflowsApi()` would depend on which entry\n * point happened to be loaded.\n *\n * ## Every minute, and why that is cheap\n *\n * `FLOW_WAIT_MIN_MINUTES` is one, so the beat has to be one — a fifteen-minute\n * sweep would make the shortest wait anybody can author wrong by up to\n * fourteen minutes. It costs one collection-group query per minute, which\n * returns nothing at all on a platform with no flow due, because the query\n * asks for `resumeAtMs <= now` rather than for the enrolled population.\n *\n * Bounded and idempotent, the two properties the runner requires: the scan\n * budget bounds one pass, and a transactional claim means an overlapping or\n * repeated beat cannot run the same person's step twice.\n *=========================================*/\nregisterPluginJob({\n  pluginId: WORKFLOWS_BUNDLE_ID,\n  name: 'resume-flow-waits',\n  intervalMinutes: 1,\n  description:\n    'Continue automations whose wait step has ended, and time out those ' +\n    'waiting for an event that never arrived.',\n  lockdown: { scope: 'per-host' },\n  handler: async (gate) => {\n    await runDueFlowEnrollments(gate)\n  },\n})\n\n// Best-effort per-instance rate limit (mirrors forms/submit).\nconst recentByHook = new Map<string, number[]>()\nconst RATE_WINDOW_MS = 60_000\nconst RATE_MAX = 30\n\nfunction rateLimited(key: string): boolean {\n  const now = Date.now()\n  const hits = (recentByHook.get(key) ?? []).filter(\n    (t) => now - t < RATE_WINDOW_MS,\n  )\n  hits.push(now)\n  recentByHook.set(key, hits)\n  return hits.length > RATE_MAX\n}\n\nfunction secretsMatch(expected: string, provided: string): boolean {\n  if (!expected || expected.length !== provided.length) return false\n  return timingSafeEqual(\n    new Uint8Array(Buffer.from(expected)),\n    new Uint8Array(Buffer.from(provided)),\n  )\n}\n\n/**\n * Inbound webhook endpoint (AGL-149): external systems POST JSON to\n * `/api/hooks/{hostId}/{hookId}` with the hook's secret in\n * `x-aglyn-secret`; a valid call enrolls the configured workflow with the\n * payload's top-level primitives in scope. Business tier (`webhooks`\n * flag); runs bill against the workflow-runs meter like any other run —\n * `workflowRunsPerMonth` is checked before the run and\n * `hosts/{id}/counters/workflowRuns` is incremented after it (AGL-2228).\n * That sentence was here before either half of it was true.\n */\nconst inboundHookHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.query['hostId'] ?? '')\n  const hookId = String(req.query['hookId'] ?? '')\n  if (!hostId || !hookId) {\n    return res.status(400).json({ error: 'Invalid webhook address' })\n  }\n  if (rateLimited(`${hostId}/${hookId}`)) {\n    return res.status(429).json({ error: 'Too many requests' })\n  }\n\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hookSnapshot = await hostRef.collection('webhooks').doc(hookId).get()\n    const hook = hookSnapshot.data() as HostWebhook | undefined\n    if (\n      !hook ||\n      hookSnapshot.get('deletedAt') ||\n      hook.direction !== 'inbound' ||\n      hook.enabled === false\n    ) {\n      return res.status(404).json({ error: 'Unknown webhook' })\n    }\n    const provided = String(req.headers['x-aglyn-secret'] ?? '')\n    if (!secretsMatch(hook.secret ?? '', provided)) {\n      return res.status(401).json({ error: 'Bad secret' })\n    }\n\n    // Plan/quota gates ride the owning org's doc (AGL-238).\n    const owner = await getOrgForHost(hostId)\n    const org = owner?.org\n    if (!checkEntitlement(org as any, 'webhooks')) {\n      return res\n        .status(403)\n        .json({ error: 'Webhooks are not enabled on this site' })\n    }\n    /*\n     * The MONTHLY RUN CAP, which this handler's own docblock claimed for\n     * years — \"runs bill against the workflow-runs meter like any other run\"\n     * — and did not have. It read neither `workflowRunsPerMonth` nor\n     * `hosts/{id}/counters/workflowRuns`, and it wrote neither, so an inbound\n     * hook was a workflow execution that no cap could refuse and no meter\n     * could see: the customer's usage card, the usage-alerts cron and the\n     * COGS rollup all read a counter this path never moved.\n     *\n     * The refusal is a 402 rather than the silent `return` of\n     * `runEventWorkflows`: that path is fired from a visitor request whose\n     * success must not depend on the workflow, where this one is an\n     * integration calling us on purpose and a caller that gets a 200 for a\n     * run that did not happen will keep sending. `Retry-After` is deliberately\n     * absent — the month, not a delay, is what clears this.\n     *\n     * The plan-less/unreadable org resolves as FREE\n     * (`workflowRunsPerMonth: 0`), so an org doc we cannot read refuses rather\n     * than runs. `checkEntitlement(webhooks)` above already refuses free on\n     * today's price list; this is not a second gate on the same fact, because\n     * a staff `entitlementOverrides` can grant `webhooks` without granting\n     * runs, and because the cap is what bounds a BUSINESS org's spend.\n     *\n     * Read-then-write, like the event path, and bounded the same way: the\n     * per-hook limiter above is 30/60s, so the overshoot a race can buy is\n     * bounded by concurrency rather than unbounded by design. Making it\n     * atomic means a transaction around the whole run and is the same trade\n     * `runEventWorkflows` declined.\n     */\n    const monthKey = new Date().toISOString().slice(0, 7)\n    const runCounterRef = hostRef.collection('counters').doc('workflowRuns')\n    const runLimit = resolveOrgEntitlements(org as any).workflowRunsPerMonth\n    const runsUsed = Number((await runCounterRef.get()).get(monthKey) ?? 0)\n    if (!(runsUsed + 1 <= runLimit)) {\n      return res.status(402).json({\n        error: `This site has used its ${runLimit} workflow runs for the month`,\n      })\n    }\n\n    // Top-level primitives from the JSON body join the workflow scope.\n    const body =\n      typeof req.body === 'string'\n        ? JSON.parse(req.body || '{}')\n        : (req.body ?? {})\n    const scope: Record<string, string | number | boolean> = {}\n    for (const [key, value] of Object.entries(body)) {\n      if (\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean'\n      ) {\n        scope[key.slice(0, 64)] =\n          typeof value === 'string' ? value.slice(0, 2000) : value\n      }\n    }\n\n    const [functionDocs, variableDocs, workflowDocs] = await Promise.all([\n      hostRef.collection('functions').limit(100).get(),\n      hostRef.collection('variables').limit(100).get(),\n      hostRef.collection('workflows').limit(100).get(),\n    ])\n    const byName = <T extends { name?: string; deletedAt?: unknown }>(\n      docs: FirebaseFirestore.QueryDocumentSnapshot[],\n    ) => {\n      const map: Record<string, T> = {}\n      for (const doc of docs) {\n        const data = doc.data() as T\n        if (data?.name && !data.deletedAt) map[data.name] = data\n      }\n      return map\n    }\n    const workflows = byName<HostWorkflow>(workflowDocs.docs)\n    const workflow = workflows[hook.workflowName?.trim() ?? '']\n    if (!workflow) {\n      return res.status(422).json({ error: 'No workflow bound to this hook' })\n    }\n\n    const hookEvent = `hook:${hook.name ?? hookId}`\n    /*\n     * A workflow of function calls is evaluated, as it always has been. One\n     * with Actions steps is PERFORMED by the engine's executor — the posted\n     * JSON is its payload — under the Actions tier gates, step by step, and\n     * it is still one run on the meter below. Its working set is built from\n     * the documents read above rather than read again.\n     */\n    const outcome: { error: string | null; value: unknown; summary: string } =\n      workflowHasActionSteps(workflow)\n        ? await (async () => {\n            const workflowDoc = workflowDocs.docs.find(\n              (doc) =>\n                !doc.get('deletedAt') &&\n                doc.get('name') === hook.workflowName?.trim(),\n            )\n            const execution = await executeWorkflow(\n              automationRunEnv({\n                hostId,\n                hostRef,\n                owner,\n                depth: 0,\n                loadWorkflowContext: async () =>\n                  workflowContextFromDocs(\n                    functionDocs.docs,\n                    variableDocs.docs,\n                    workflowDocs.docs,\n                  ),\n              }),\n              {\n                kind: 'workflow',\n                id: workflowDoc?.id ?? '',\n                name: workflow.name ?? '',\n              },\n              workflow as AutomationWorkflow,\n              hookEvent,\n              scope,\n            )\n            return {\n              error: execution.errors.length\n                ? execution.errors.join('; ')\n                : null,\n              value: execution.value,\n              summary: execution.outcomes.length\n                ? execution.outcomes.join(' · ')\n                : `Ran ${hook.workflowName}`,\n            }\n          })()\n        : (() => {\n            const run = runWorkflow(\n              workflow,\n              byName<HostFunction>(functionDocs.docs),\n              byName<HostVariable>(variableDocs.docs),\n              { event: hookEvent, ...scope },\n              { workflows },\n            )\n            return run.ok === false\n              ? { error: run.error, value: undefined, summary: '' }\n              : {\n                  error: null,\n                  value: run.value,\n                  summary: `Ran ${hook.workflowName}`,\n                }\n          })()\n    const failed = outcome.error !== null\n    await hostRef\n      .collection('activity')\n      .add({\n        actorId: null,\n        actorEmail: null,\n        action: failed\n          ? `Inbound webhook run failed: ${outcome.error}`.slice(0, 300)\n          : `Inbound webhook ran \"${hook.workflowName}\"`,\n        // The run-history shape (AGL-2222) — without `result` this execution\n        // is invisible to the Runs table, which reads a verdict and not prose.\n        result: failed ? 'failed' : 'succeeded',\n        trigger: hookEvent,\n        summary: failed\n          ? String(outcome.error).slice(0, 300)\n          : outcome.summary.slice(0, 300),\n        target: { type: 'workflow', id: hookId, name: hook.name ?? '' },\n        createdAt: FieldValue.serverTimestamp(),\n      })\n      .catch(() => undefined)\n\n    // The run happened, so it counts — including a FAILED one, exactly as\n    // `runEventWorkflows` counts its failures. A run that executed and threw\n    // spent the same compute as one that returned a value; only a run that\n    // never started (the cap above, a missing workflow) must not count.\n    await runCounterRef\n      .set({ [monthKey]: FieldValue.increment(1) }, { merge: true })\n      .catch(() => undefined)\n\n    if (failed) return res.status(422).json({ error: outcome.error })\n    return res.status(200).json({ ok: true, value: outcome.value })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Webhook failed' })\n  }\n}\n\n/**\n * Registers the workflows plugin's public API routes (AGL-396), and the\n * engine's host-event listener beside them for a process whose boot did not\n * (see `declarations.server.ts`).\n */\nexport function registerWorkflowsApi(): void {\n  registerWorkflowsServerDeclarations()\n  registerPluginApiRoute('hooks/[hostId]/[hookId]', inboundHookHandler)\n}\n\n/**\n * The console half (AGL-2919), re-exported so one entry point serves both\n * surfaces: the manifest generator resolves every server surface through\n * `@aglyn/plugins-workflows/server`, and a second entry point would be a second\n * thing to keep in step with plugins.config.json.\n */\nexport { registerWorkflowsConsoleApi } from './server-console'\n"],"names":["checkEntitlement","resolveOrgEntitlements","runWorkflow","registerPluginApiRoute","registerPluginJob","firebaseAdmin","getOrgForHost","timingSafeEqual","FieldValue","BUNDLE_ID","WORKFLOWS_BUNDLE_ID","registerWorkflowsServerDeclarations","automationRunEnv","executeWorkflow","runDueFlowEnrollments","workflowContextFromDocs","workflowHasActionSteps","pluginId","name","intervalMinutes","description","lockdown","scope","handler","gate","recentByHook","Map","RATE_WINDOW_MS","RATE_MAX","rateLimited","key","now","Date","hits","get","filter","t","push","set","length","secretsMatch","expected","provided","Uint8Array","Buffer","from","inboundHookHandler","req","res","method","status","json","error","hostId","String","query","hookId","hook","firestore","app","hostRef","collection","doc","hookSnapshot","data","direction","enabled","headers","secret","owner","org","monthKey","toISOString","slice","runCounterRef","runLimit","workflowRunsPerMonth","runsUsed","Number","body","JSON","parse","value","Object","entries","functionDocs","variableDocs","workflowDocs","Promise","all","limit","byName","docs","map","deletedAt","workflows","workflow","workflowName","trim","hookEvent","outcome","workflowDoc","find","execution","depth","loadWorkflowContext","kind","id","errors","join","summary","outcomes","run","event","ok","undefined","failed","add","actorId","actorEmail","action","result","trigger","target","type","createdAt","serverTimestamp","catch","increment","merge","console","registerWorkflowsApi","registerWorkflowsConsoleApi"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,gBAAgB,EAKhBC,sBAAsB,EACtBC,WAAW,QACN,sBAAqB;AAC5B,SACEC,sBAAsB,EACtBC,iBAAiB,QAEZ,sBAAqB;AAC5B,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,SAASC,eAAe,QAAQ,SAAQ;AACxC,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,aAAaC,mBAAmB,QAAQ,+BAA2B;AAC5E,SAASC,mCAAmC,QAAQ,2BAAuB;AAC3E,SACEC,gBAAgB,EAChBC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,QAClB,gCAA4B;AACnC,SAEEC,sBAAsB,QACjB,6BAAyB;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;2CAyB2C,GAC3CZ,kBAAkB;IAChBa,UAAUP;IACVQ,MAAM;IACNC,iBAAiB;IACjBC,aACE,wEACA;IACFC,UAAU;QAAEC,OAAO;IAAW;IAC9BC,SAAS,OAAOC;QACd,MAAMV,sBAAsBU;IAC9B;AACF;AAEA,8DAA8D;AAC9D,MAAMC,eAAe,IAAIC;AACzB,MAAMC,iBAAiB;AACvB,MAAMC,WAAW;AAEjB,SAASC,YAAYC,GAAW;QAEhBL;IADd,MAAMM,MAAMC,KAAKD,GAAG;IACpB,MAAME,OAAO,EAACR,oBAAAA,aAAaS,GAAG,CAACJ,gBAAjBL,oBAAyB,EAAE,EAAEU,MAAM,CAC/C,CAACC,IAAML,MAAMK,IAAIT;IAEnBM,KAAKI,IAAI,CAACN;IACVN,aAAaa,GAAG,CAACR,KAAKG;IACtB,OAAOA,KAAKM,MAAM,GAAGX;AACvB;AAEA,SAASY,aAAaC,QAAgB,EAAEC,QAAgB;IACtD,IAAI,CAACD,YAAYA,SAASF,MAAM,KAAKG,SAASH,MAAM,EAAE,OAAO;IAC7D,OAAOhC,gBACL,IAAIoC,WAAWC,OAAOC,IAAI,CAACJ,YAC3B,IAAIE,WAAWC,OAAOC,IAAI,CAACH;AAE/B;AAEA;;;;;;;;;CASC,GACD,MAAMI,qBAAuC,OAAOC,KAAKC;QAIjCD,mBACAA;IAJtB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,QAAOP,oBAAAA,IAAIQ,KAAK,CAAC,SAAS,YAAnBR,oBAAuB;IAC7C,MAAMS,SAASF,QAAOP,oBAAAA,IAAIQ,KAAK,CAAC,SAAS,YAAnBR,oBAAuB;IAC7C,IAAI,CAACM,UAAU,CAACG,QAAQ;QACtB,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA0B;IACjE;IACA,IAAIvB,YAAY,GAAGwB,OAAO,CAAC,EAAEG,QAAQ,GAAG;QACtC,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoB;IAC3D;IAEA,IAAI;YAasBL,2BACNU,cA4CM,MAWjBV,iBAkCmBU,YAgFwBA;YArFvBA;QAjG3B,MAAMC,YAAYrD,cAAcsD,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACT;QAClD,MAAMU,eAAe,MAAMH,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAACN,QAAQtB,GAAG;QACzE,MAAMuB,OAAOM,aAAaC,IAAI;QAC9B,IACE,CAACP,QACDM,aAAa7B,GAAG,CAAC,gBACjBuB,KAAKQ,SAAS,KAAK,aACnBR,KAAKS,OAAO,KAAK,OACjB;YACA,OAAOlB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,MAAMV,WAAWY,QAAOP,4BAAAA,IAAIoB,OAAO,CAAC,iBAAiB,YAA7BpB,4BAAiC;QACzD,IAAI,CAACP,cAAaiB,eAAAA,KAAKW,MAAM,YAAXX,eAAe,IAAIf,WAAW;YAC9C,OAAOM,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAa;QACpD;QAEA,wDAAwD;QACxD,MAAMiB,QAAQ,MAAM/D,cAAc+C;QAClC,MAAMiB,MAAMD,yBAAAA,MAAOC,GAAG;QACtB,IAAI,CAACtE,iBAAiBsE,KAAY,aAAa;YAC7C,OAAOtB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAAwC;QAC3D;QACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BC,GACD,MAAMmB,WAAW,IAAIvC,OAAOwC,WAAW,GAAGC,KAAK,CAAC,GAAG;QACnD,MAAMC,gBAAgBd,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAAC;QACzD,MAAMa,WAAW1E,uBAAuBqE,KAAYM,oBAAoB;QACxE,MAAMC,WAAWC,QAAO,OAAA,AAAC,CAAA,MAAMJ,cAAcxC,GAAG,EAAC,EAAGA,GAAG,CAACqC,qBAAhC,OAA6C;QACrE,IAAI,CAAEM,CAAAA,WAAW,KAAKF,QAAO,GAAI;YAC/B,OAAO3B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO,CAAC,uBAAuB,EAAEuB,SAAS,4BAA4B,CAAC;YACzE;QACF;QAEA,mEAAmE;QACnE,MAAMI,OACJ,OAAOhC,IAAIgC,IAAI,KAAK,WAChBC,KAAKC,KAAK,CAAClC,IAAIgC,IAAI,IAAI,SACtBhC,YAAAA,IAAIgC,IAAI,YAARhC,YAAY,CAAC;QACpB,MAAMzB,QAAmD,CAAC;QAC1D,KAAK,MAAM,CAACQ,KAAKoD,MAAM,IAAIC,OAAOC,OAAO,CAACL,MAAO;YAC/C,IACE,OAAOG,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU,WACjB;gBACA5D,KAAK,CAACQ,IAAI2C,KAAK,CAAC,GAAG,IAAI,GACrB,OAAOS,UAAU,WAAWA,MAAMT,KAAK,CAAC,GAAG,QAAQS;YACvD;QACF;QAEA,MAAM,CAACG,cAAcC,cAAcC,aAAa,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACnE7B,QAAQC,UAAU,CAAC,aAAa6B,KAAK,CAAC,KAAKxD,GAAG;YAC9C0B,QAAQC,UAAU,CAAC,aAAa6B,KAAK,CAAC,KAAKxD,GAAG;YAC9C0B,QAAQC,UAAU,CAAC,aAAa6B,KAAK,CAAC,KAAKxD,GAAG;SAC/C;QACD,MAAMyD,SAAS,CACbC;YAEA,MAAMC,MAAyB,CAAC;YAChC,KAAK,MAAM/B,OAAO8B,KAAM;gBACtB,MAAM5B,OAAOF,IAAIE,IAAI;gBACrB,IAAIA,CAAAA,wBAAAA,KAAM9C,IAAI,KAAI,CAAC8C,KAAK8B,SAAS,EAAED,GAAG,CAAC7B,KAAK9C,IAAI,CAAC,GAAG8C;YACtD;YACA,OAAO6B;QACT;QACA,MAAME,YAAYJ,OAAqBJ,aAAaK,IAAI;QACxD,MAAMI,WAAWD,SAAS,UAACtC,qBAAAA,KAAKwC,YAAY,qBAAjBxC,mBAAmByC,IAAI,qBAAM,GAAG;QAC3D,IAAI,CAACF,UAAU;YACb,OAAOhD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACxE;QAEA,MAAM+C,YAAY,CAAC,KAAK,GAAE1C,aAAAA,KAAKvC,IAAI,YAATuC,aAAaD,QAAQ;QAC/C;;;;;;KAMC,GACD,MAAM4C,UACJpF,uBAAuBgF,YACnB,MAAM,AAAC,CAAA;sBAsBKA;YArBV,MAAMK,cAAcd,aAAaK,IAAI,CAACU,IAAI,CACxC,CAACxC;oBAEqBL;uBADpB,CAACK,IAAI5B,GAAG,CAAC,gBACT4B,IAAI5B,GAAG,CAAC,cAAYuB,qBAAAA,KAAKwC,YAAY,qBAAjBxC,mBAAmByC,IAAI;;YAE/C,MAAMK,YAAY,MAAM1F,gBACtBD,iBAAiB;gBACfyC;gBACAO;gBACAS;gBACAmC,OAAO;gBACPC,qBAAqB,UACnB1F,wBACEsE,aAAaO,IAAI,EACjBN,aAAaM,IAAI,EACjBL,aAAaK,IAAI;YAEvB,IACA;gBACEc,MAAM;gBACNC,EAAE,UAAEN,+BAAAA,YAAaM,EAAE,mBAAI;gBACvBzF,IAAI,GAAE8E,iBAAAA,SAAS9E,IAAI,YAAb8E,iBAAiB;YACzB,GACAA,UACAG,WACA7E;YAEF,OAAO;gBACL8B,OAAOmD,UAAUK,MAAM,CAACrE,MAAM,GAC1BgE,UAAUK,MAAM,CAACC,IAAI,CAAC,QACtB;gBACJ3B,OAAOqB,UAAUrB,KAAK;gBACtB4B,SAASP,UAAUQ,QAAQ,CAACxE,MAAM,GAC9BgE,UAAUQ,QAAQ,CAACF,IAAI,CAAC,SACxB,CAAC,IAAI,EAAEpD,KAAKwC,YAAY,EAAE;YAChC;QACF,CAAA,MACA,AAAC,CAAA;YACC,MAAMe,MAAM9G,YACV8F,UACAL,OAAqBN,aAAaO,IAAI,GACtCD,OAAqBL,aAAaM,IAAI,GACtC;gBAAEqB,OAAOd;eAAc7E,QACvB;gBAAEyE;YAAU;YAEd,OAAOiB,IAAIE,EAAE,KAAK,QACd;gBAAE9D,OAAO4D,IAAI5D,KAAK;gBAAE8B,OAAOiC;gBAAWL,SAAS;YAAG,IAClD;gBACE1D,OAAO;gBACP8B,OAAO8B,IAAI9B,KAAK;gBAChB4B,SAAS,CAAC,IAAI,EAAErD,KAAKwC,YAAY,EAAE;YACrC;QACN,CAAA;QACN,MAAMmB,SAAShB,QAAQhD,KAAK,KAAK;QACjC,MAAMQ,QACHC,UAAU,CAAC,YACXwD,GAAG,CAAC;YACHC,SAAS;YACTC,YAAY;YACZC,QAAQJ,SACJ,CAAC,4BAA4B,EAAEhB,QAAQhD,KAAK,EAAE,CAACqB,KAAK,CAAC,GAAG,OACxD,CAAC,qBAAqB,EAAEhB,KAAKwC,YAAY,CAAC,CAAC,CAAC;YAChD,qEAAqE;YACrE,uEAAuE;YACvEwB,QAAQL,SAAS,WAAW;YAC5BM,SAASvB;YACTW,SAASM,SACL9D,OAAO8C,QAAQhD,KAAK,EAAEqB,KAAK,CAAC,GAAG,OAC/B2B,QAAQU,OAAO,CAACrC,KAAK,CAAC,GAAG;YAC7BkD,QAAQ;gBAAEC,MAAM;gBAAYjB,IAAInD;gBAAQtC,IAAI,GAAEuC,cAAAA,KAAKvC,IAAI,YAATuC,cAAa;YAAG;YAC9DoE,WAAWrH,WAAWsH,eAAe;QACvC,GACCC,KAAK,CAAC,IAAMZ;QAEf,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,MAAMzC,cACHpC,GAAG,CAAC;YAAE,CAACiC,SAAS,EAAE/D,WAAWwH,SAAS,CAAC;QAAG,GAAG;YAAEC,OAAO;QAAK,GAC3DF,KAAK,CAAC,IAAMZ;QAEf,IAAIC,QAAQ,OAAOpE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOgD,QAAQhD,KAAK;QAAC;QAC/D,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE+D,IAAI;YAAMhC,OAAOkB,QAAQlB,KAAK;QAAC;IAC/D,EAAE,OAAO9B,OAAO;QACd8E,QAAQ9E,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF;AAEA;;;;CAIC,GACD,OAAO,SAAS+E;IACdxH;IACAR,uBAAuB,2BAA2B2C;AACpD;AAEA;;;;;CAKC,GACD,SAASsF,2BAA2B,QAAQ,sBAAkB"}