@aglyn/plugins-workflows 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/declarations.server.js

@@ -16,6 +16,9 @@
  */ // The registry from its own module, not the runtime barrel: boot needs the
 // registry and nothing else, and the barrel reaches the data layer.
 import { registerHostEventListener } from "@aglyn/tenant-runtime/host-event-listeners";
+import { registerVariableComputer } from "@aglyn/aglyn/plugin-manager/computed-variables";
+import { registerPluginDependentsSource } from "@aglyn/aglyn/plugin-manager/plugin-dependents";
+import { registerPluginRecordIndex } from "@aglyn/aglyn/plugin-manager/plugin-record-index";
 import { BUNDLE_ID } from "./constants/bundle-common.js";
 /**
  * The automation engine, as the runtime hears it.
@@ -55,11 +58,47 @@ import { BUNDLE_ID } from "./constants/bundle-common.js";
  * first of them arrives — which is what running this from both apps'
  * `instrumentation.ts` gives.
  *
+ * The indexes of the site's workflows, webhooks and actions, so another
+ * surface — an AI job — reads them without reaching for this plugin's
+ * collections; the workflows that call a function, which the "Used by"
+ * scan asks this plugin for; and the site variables a workflow computes,
+ * which every published page's compose asks for.
+ *
  * Also called from the plugin's own API register functions, so a process
  * whose boot did not run it still registers the listener the first time a
  * plugin door loads. Registering twice replaces in place.
  */ export function registerWorkflowsServerDeclarations() {
     registerHostEventListener(BUNDLE_ID, workflowsHostEventListener);
+    // The readers and the Admin SDK arrive with the first read, not with the boot.
+    registerPluginRecordIndex('workflow', lazyIndex('workflowRecordIndex'), {
+        pluginId: BUNDLE_ID
+    });
+    registerPluginRecordIndex('webhook', lazyIndex('webhookRecordIndex'), {
+        pluginId: BUNDLE_ID
+    });
+    registerPluginRecordIndex('action', lazyIndex('actionRecordIndex'), {
+        pluginId: BUNDLE_ID
+    });
+    registerPluginDependentsSource({
+        kinds: [
+            'function'
+        ],
+        find: async (request)=>(await import("./server/workflow-dependents.js")).findFunctionDependents(request)
+    }, {
+        pluginId: BUNDLE_ID
+    });
+    registerVariableComputer({
+        prepare: async (hostId)=>(await import("./server/workflow-variables.js")).prepareWorkflowVariables(hostId)
+    }, {
+        pluginId: BUNDLE_ID
+    });
+}
+function lazyIndex(name) {
+    const load = async ()=>(await import("./server/automation-record-index.js"))[name];
+    return {
+        list: async (request)=>(await load()).list(request),
+        get: async (request)=>(await load()).get(request)
+    };
 }
 
 //# sourceMappingURL=declarations.server.js.map

package/src/lib/declarations.server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/declarations.server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// The registry from its own module, not the runtime barrel: boot needs the\n// registry and nothing else, and the barrel reaches the data layer.\nimport {\n  type HostEventListener,\n  registerHostEventListener,\n} from '@aglyn/tenant-runtime/host-event-listeners'\nimport { BUNDLE_ID } from './constants/bundle-common'\n\n/**\n * The automation engine, as the runtime hears it.\n *\n * Light by construction: the engine is imported when the first event\n * arrives, not when the process starts, so a process that never sees an\n * event pays for this object and nothing else.\n */\nexport const workflowsHostEventListener: HostEventListener = {\n  async onEvent(hostId, event, payload, context) {\n    const [{ runEventAutomations }, { withRunTriggerActor }] = await Promise.all([\n      import('./engine/run-event-automations'),\n      import('./engine/run-trigger-actor'),\n    ])\n    // Every run this event causes records who caused it (AGL-3376).\n    return await withRunTriggerActor(context?.actor, () =>\n      runEventAutomations(hostId, event, payload),\n    )\n  },\n  async onDispatch(hostId, automationId, event, payload, context) {\n    const [{ runSingleAction }, { withRunTriggerActor }] = await Promise.all([\n      import('./engine/run-event-actions'),\n      import('./engine/run-trigger-actor'),\n    ])\n    // A page-fired automation is always a visitor on the published page.\n    return await withRunTriggerActor(context?.actor ?? { kind: 'visitor' }, () =>\n      runSingleAction(hostId, automationId, event, payload),\n    )\n  },\n}\n\n/**\n * The plugin's SERVER declarations: what the server must know at boot,\n * before any door of the plugin has been called.\n *\n * The engine's host-event listener, because the doors that raise the events\n * mostly never load this plugin. A form submission and a page view are core\n * routes; a contact captured by a Stripe webhook is a core capture door. Each\n * calls `emitHostEvent`, and the listener has to be registered before the\n * first of them arrives — which is what running this from both apps'\n * `instrumentation.ts` gives.\n *\n * Also called from the plugin's own API register functions, so a process\n * whose boot did not run it still registers the listener the first time a\n * plugin door loads. Registering twice replaces in place.\n */\nexport function registerWorkflowsServerDeclarations(): void {\n  registerHostEventListener(BUNDLE_ID, workflowsHostEventListener)\n}\n"],"names":["registerHostEventListener","BUNDLE_ID","workflowsHostEventListener","onEvent","hostId","event","payload","context","runEventAutomations","withRunTriggerActor","Promise","all","actor","onDispatch","automationId","runSingleAction","kind","registerWorkflowsServerDeclarations"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,2EAA2E;AAC3E,oEAAoE;AACpE,SAEEA,yBAAyB,QACpB,6CAA4C;AACnD,SAASC,SAAS,QAAQ,+BAA2B;AAErD;;;;;;CAMC,GACD,OAAO,MAAMC,6BAAgD;IAC3D,MAAMC,SAAQC,MAAM,EAAEC,KAAK,EAAEC,OAAO,EAAEC,OAAO;QAC3C,MAAM,CAAC,EAAEC,mBAAmB,EAAE,EAAE,EAAEC,mBAAmB,EAAE,CAAC,GAAG,MAAMC,QAAQC,GAAG,CAAC;YAC3E,MAAM,CAAC;YACP,MAAM,CAAC;SACR;QACD,gEAAgE;QAChE,OAAO,MAAMF,oBAAoBF,2BAAAA,QAASK,KAAK,EAAE,IAC/CJ,oBAAoBJ,QAAQC,OAAOC;IAEvC;IACA,MAAMO,YAAWT,MAAM,EAAEU,YAAY,EAAET,KAAK,EAAEC,OAAO,EAAEC,OAAO;;QAC5D,MAAM,CAAC,EAAEQ,eAAe,EAAE,EAAE,EAAEN,mBAAmB,EAAE,CAAC,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACvE,MAAM,CAAC;YACP,MAAM,CAAC;SACR;QACD,qEAAqE;QACrE,OAAO,MAAMF,4BAAoBF,2BAAAA,QAASK,KAAK,mBAAI;YAAEI,MAAM;QAAU,GAAG,IACtED,gBAAgBX,QAAQU,cAAcT,OAAOC;IAEjD;AACF,EAAC;AAED;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASW;IACdjB,0BAA0BC,WAAWC;AACvC"}
+{"version":3,"sources":["../../../../../../libs/plugins/workflows/src/lib/declarations.server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// The registry from its own module, not the runtime barrel: boot needs the\n// registry and nothing else, and the barrel reaches the data layer.\nimport {\n  type HostEventListener,\n  registerHostEventListener,\n} from '@aglyn/tenant-runtime/host-event-listeners'\nimport { registerVariableComputer } from '@aglyn/aglyn/plugin-manager/computed-variables'\nimport { registerPluginDependentsSource } from '@aglyn/aglyn/plugin-manager/plugin-dependents'\nimport {\n  registerPluginRecordIndex,\n  type PluginRecordIndex,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-index'\nimport { BUNDLE_ID } from './constants/bundle-common'\n\n/**\n * The automation engine, as the runtime hears it.\n *\n * Light by construction: the engine is imported when the first event\n * arrives, not when the process starts, so a process that never sees an\n * event pays for this object and nothing else.\n */\nexport const workflowsHostEventListener: HostEventListener = {\n  async onEvent(hostId, event, payload, context) {\n    const [{ runEventAutomations }, { withRunTriggerActor }] = await Promise.all([\n      import('./engine/run-event-automations'),\n      import('./engine/run-trigger-actor'),\n    ])\n    // Every run this event causes records who caused it (AGL-3376).\n    return await withRunTriggerActor(context?.actor, () =>\n      runEventAutomations(hostId, event, payload),\n    )\n  },\n  async onDispatch(hostId, automationId, event, payload, context) {\n    const [{ runSingleAction }, { withRunTriggerActor }] = await Promise.all([\n      import('./engine/run-event-actions'),\n      import('./engine/run-trigger-actor'),\n    ])\n    // A page-fired automation is always a visitor on the published page.\n    return await withRunTriggerActor(context?.actor ?? { kind: 'visitor' }, () =>\n      runSingleAction(hostId, automationId, event, payload),\n    )\n  },\n}\n\n/**\n * The plugin's SERVER declarations: what the server must know at boot,\n * before any door of the plugin has been called.\n *\n * The engine's host-event listener, because the doors that raise the events\n * mostly never load this plugin. A form submission and a page view are core\n * routes; a contact captured by a Stripe webhook is a core capture door. Each\n * calls `emitHostEvent`, and the listener has to be registered before the\n * first of them arrives — which is what running this from both apps'\n * `instrumentation.ts` gives.\n *\n * The indexes of the site's workflows, webhooks and actions, so another\n * surface — an AI job — reads them without reaching for this plugin's\n * collections; the workflows that call a function, which the \"Used by\"\n * scan asks this plugin for; and the site variables a workflow computes,\n * which every published page's compose asks for.\n *\n * Also called from the plugin's own API register functions, so a process\n * whose boot did not run it still registers the listener the first time a\n * plugin door loads. Registering twice replaces in place.\n */\nexport function registerWorkflowsServerDeclarations(): void {\n  registerHostEventListener(BUNDLE_ID, workflowsHostEventListener)\n  // The readers and the Admin SDK arrive with the first read, not with the boot.\n  registerPluginRecordIndex('workflow', lazyIndex('workflowRecordIndex'), { pluginId: BUNDLE_ID })\n  registerPluginRecordIndex('webhook', lazyIndex('webhookRecordIndex'), { pluginId: BUNDLE_ID })\n  registerPluginRecordIndex('action', lazyIndex('actionRecordIndex'), { pluginId: BUNDLE_ID })\n  registerPluginDependentsSource(\n    {\n      kinds: ['function'],\n      find: async (request) =>\n        (await import('./server/workflow-dependents')).findFunctionDependents(request),\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerVariableComputer(\n    {\n      prepare: async (hostId) =>\n        (await import('./server/workflow-variables')).prepareWorkflowVariables(hostId),\n    },\n    { pluginId: BUNDLE_ID },\n  )\n}\n\ntype IndexName = 'workflowRecordIndex' | 'webhookRecordIndex' | 'actionRecordIndex'\n\nfunction lazyIndex(name: IndexName): PluginRecordIndex {\n  const load = async () => (await import('./server/automation-record-index'))[name]\n  return {\n    list: async (request) => (await load()).list(request),\n    get: async (request) => (await load()).get(request),\n  }\n}\n"],"names":["registerHostEventListener","registerVariableComputer","registerPluginDependentsSource","registerPluginRecordIndex","BUNDLE_ID","workflowsHostEventListener","onEvent","hostId","event","payload","context","runEventAutomations","withRunTriggerActor","Promise","all","actor","onDispatch","automationId","runSingleAction","kind","registerWorkflowsServerDeclarations","lazyIndex","pluginId","kinds","find","request","findFunctionDependents","prepare","prepareWorkflowVariables","name","load","list","get"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,2EAA2E;AAC3E,oEAAoE;AACpE,SAEEA,yBAAyB,QACpB,6CAA4C;AACnD,SAASC,wBAAwB,QAAQ,iDAAgD;AACzF,SAASC,8BAA8B,QAAQ,gDAA+C;AAC9F,SACEC,yBAAyB,QAEpB,kDAAiD;AACxD,SAASC,SAAS,QAAQ,+BAA2B;AAErD;;;;;;CAMC,GACD,OAAO,MAAMC,6BAAgD;IAC3D,MAAMC,SAAQC,MAAM,EAAEC,KAAK,EAAEC,OAAO,EAAEC,OAAO;QAC3C,MAAM,CAAC,EAAEC,mBAAmB,EAAE,EAAE,EAAEC,mBAAmB,EAAE,CAAC,GAAG,MAAMC,QAAQC,GAAG,CAAC;YAC3E,MAAM,CAAC;YACP,MAAM,CAAC;SACR;QACD,gEAAgE;QAChE,OAAO,MAAMF,oBAAoBF,2BAAAA,QAASK,KAAK,EAAE,IAC/CJ,oBAAoBJ,QAAQC,OAAOC;IAEvC;IACA,MAAMO,YAAWT,MAAM,EAAEU,YAAY,EAAET,KAAK,EAAEC,OAAO,EAAEC,OAAO;;QAC5D,MAAM,CAAC,EAAEQ,eAAe,EAAE,EAAE,EAAEN,mBAAmB,EAAE,CAAC,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACvE,MAAM,CAAC;YACP,MAAM,CAAC;SACR;QACD,qEAAqE;QACrE,OAAO,MAAMF,4BAAoBF,2BAAAA,QAASK,KAAK,mBAAI;YAAEI,MAAM;QAAU,GAAG,IACtED,gBAAgBX,QAAQU,cAAcT,OAAOC;IAEjD;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASW;IACdpB,0BAA0BI,WAAWC;IACrC,+EAA+E;IAC/EF,0BAA0B,YAAYkB,UAAU,wBAAwB;QAAEC,UAAUlB;IAAU;IAC9FD,0BAA0B,WAAWkB,UAAU,uBAAuB;QAAEC,UAAUlB;IAAU;IAC5FD,0BAA0B,UAAUkB,UAAU,sBAAsB;QAAEC,UAAUlB;IAAU;IAC1FF,+BACE;QACEqB,OAAO;YAAC;SAAW;QACnBC,MAAM,OAAOC,UACX,AAAC,CAAA,MAAM,MAAM,CAAC,kCAA8B,EAAGC,sBAAsB,CAACD;IAC1E,GACA;QAAEH,UAAUlB;IAAU;IAExBH,yBACE;QACE0B,SAAS,OAAOpB,SACd,AAAC,CAAA,MAAM,MAAM,CAAC,iCAA6B,EAAGqB,wBAAwB,CAACrB;IAC3E,GACA;QAAEe,UAAUlB;IAAU;AAE1B;AAIA,SAASiB,UAAUQ,IAAe;IAChC,MAAMC,OAAO,UAAY,AAAC,CAAA,MAAM,MAAM,CAAC,sCAAkC,CAAE,CAACD,KAAK;IACjF,OAAO;QACLE,MAAM,OAAON,UAAY,AAAC,CAAA,MAAMK,MAAK,EAAGC,IAAI,CAACN;QAC7CO,KAAK,OAAOP,UAAY,AAAC,CAAA,MAAMK,MAAK,EAAGE,GAAG,CAACP;IAC7C;AACF"}

package/src/lib/engine/run-event-actions.d.ts

@@ -14,7 +14,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { type HostAction, type HostActionAlert, type HostActionStep, type HostFunction, type HostVariable, type HostWorkflow, type PluginJobHostGate } from '@aglyn/aglyn/server';
+import { type HostAction, type HostActionAlert, type HostActionStep, type HostFunction, type HostVariable, type PluginJobHostGate } from '@aglyn/aglyn/server';
+import { type HostWorkflow } from '../model/workflows';
 import { type FlowEnrollment, type FlowSweepCursor, type FlowSweepResult } from './flow-enrollments';
 import type { HostEventPayload } from '@aglyn/tenant-runtime/host-event-listeners';
 import { type AutomationWorkflow, type WorkflowStep } from './workflow-steps';

package/src/lib/engine/run-event-actions.js

@@ -14,7 +14,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { ACTION_MAX_EVENT_DEPTH, ACTION_MAX_STEPS, checkEntitlement, consentGroupForHost, planLabelGrantingFeature, checkQuota, WEBHOOK_URL_PATTERN, evaluateExpression, evaluateStepGuard, evaluateTriggerConditions, FLOW_TIMED_OUT_FIELD, flowEmailTopicId, hostPublicOrigin, isClientActionStep, isCrmActionStep, isFlowSuspendingStep, buildDatasetRecordValues, datasetDisplayName, contactCampaignFieldPath, datasetIntegrityFields, datasetIntegrityUpdate, describeStepOutcome, effectiveDatasetModel, normalizeTriggerConditions, resolveOrgEntitlements, runWorkflow, WORKFLOW_MAX_STEPS } from "@aglyn/aglyn/server";
+ */ import { ACTION_MAX_EVENT_DEPTH, ACTION_MAX_STEPS, checkEntitlement, consentGroupForHost, planLabelGrantingFeature, checkQuota, WEBHOOK_URL_PATTERN, evaluateExpression, evaluateStepGuard, evaluateTriggerConditions, FLOW_TIMED_OUT_FIELD, flowEmailTopicId, hostPublicOrigin, isClientActionStep, isCrmActionStep, isFlowSuspendingStep, datasetDisplayName, describeDatasetRecordErrors, contactCampaignFieldPath, datasetIntegrityFields, datasetIntegrityUpdate, describeStepOutcome, effectiveDatasetModel, ensureDeclaredCustomFieldTypes, normalizeTriggerConditions, prepareDatasetRecordWrite, resolveOrgEntitlements } from "@aglyn/aglyn/server";
 import { isDeferrableSendResult, isEmailConfigured, sendEmail, sendFailureReason } from "@aglyn/shared-util-email";
 import { dataStorageRefusal, enrollListMember, firebaseAdmin, flowEmailRefusal, getOrgForHost, hostSendingIdentity, meterHostEmail, notifyHostManagers, consentGroupForSite, orgDataCollectionForHost, orgDataQueryForHost, resolveOrgIdForHost } from "@aglyn/tenant-data-admin";
 import { announceDatasetRecordChange } from "@aglyn/tenant-data-admin/server/dataset-live-pages";
@@ -30,6 +30,7 @@ import { renderSiteTextEmail } from "@aglyn/tenant-data-admin/server/host-email-
 import { createHmac } from "crypto";
 import { FieldValue } from "firebase-admin/firestore";
 import { runSummaryFields } from "../model/run-history.js";
+import { runWorkflow, WORKFLOW_MAX_STEPS } from "../model/workflows.js";
 import { eventRunSuspension } from "./site-suspension.js";
 import { advanceFlowEnrollment, claimFlowEnrollment, deferFlowEnrollment, endFlowEnrollment, enrollInFlow, findFlowEnrollmentsAwaiting, sweepDueFlowEnrollments } from "./flow-enrollments.js";
 import { logCrmEmailActivity, prepareCrmEmailActivity, runCrmActionStep } from "./crm-action-steps.js";
@@ -384,7 +385,11 @@ async function datasetAppendRefusal(env, datasetRef) {
                 model: datasetDoc.get('model'),
                 fields: Array.isArray(datasetDoc.get('fields')) ? datasetDoc.get('fields') : []
             };
-            const values = buildDatasetRecordValues(appendDataset, payload);
+            const appendModel = effectiveDatasetModel(appendDataset);
+            // A plugin's field validator runs only once its plugin registered it.
+            await ensureDeclaredCustomFieldTypes(appendModel);
+            const write = prepareDatasetRecordWrite(appendDataset, payload);
+            const values = write.values;
             // Same name precedence `findDatasetByName` resolves in.
             const appendLabel = (datasetDisplayName({
                 displayName: datasetDoc.get('displayName'),
@@ -394,14 +399,23 @@ async function datasetAppendRefusal(env, datasetRef) {
             // to write. An error rather than a quiet success: a run history that
             // says `saved to Leads` while nothing saves is how a mismatched field
             // name goes unnoticed.
-            if (!Object.keys(values).length) {
+            if (!write.matched.length) {
                 return failed(`no event field matches a field in dataset "${appendLabel || step.datasetId}"`);
             }
+            // Held to the model like every other record write (AGL-2773): a value
+            // its field cannot hold refuses the whole record, and the run says
+            // which field and why instead of `saved to Leads`.
+            if (Object.keys(write.errors).length) {
+                return failed(`record failed validation for dataset "${appendLabel || step.datasetId}": ${describeDatasetRecordErrors(write.errors)}`);
+            }
+            if (!Object.keys(values).length) {
+                return failed(`every event field matching dataset "${appendLabel || step.datasetId}" is empty`);
+            }
             const refusal = await datasetAppendRefusal(env, datasetDoc.ref);
             if (refusal) return failed(refusal);
             await datasetDoc.ref.collection('records').add(_extends({
                 values
-            }, datasetIntegrityFields(effectiveDatasetModel(appendDataset), values), {
+            }, datasetIntegrityFields(appendModel, values), {
                 createdAt: FieldValue.serverTimestamp()
             }));
             await announceDatasetStepWrite(env, datasetDoc.id);
@@ -421,15 +435,22 @@ async function datasetAppendRefusal(env, datasetRef) {
                 fields: Array.isArray(datasetDoc.get('fields')) ? datasetDoc.get('fields') : []
             };
             const updateModel = effectiveDatasetModel(updateDataset);
-            const values = buildDatasetRecordValues(updateDataset, payload);
+            await ensureDeclaredCustomFieldTypes(updateModel);
+            const updateLabel = String(datasetDisplayName({
+                displayName: datasetDoc.get('displayName'),
+                name: datasetDoc.get('name')
+            }) || step.datasetName || step.datasetId || '').slice(0, 60);
+            // Checked before the lookup, as an append: the fields this write
+            // supplies are held to the model whichever leg runs below, and a
+            // refusal costs no read.
+            const incoming = prepareDatasetRecordWrite(updateDataset, payload);
             // Nothing to merge or append — an error, for the reason the append
             // branch above gives.
-            if (!Object.keys(values).length) {
-                const updateLabel = datasetDisplayName({
-                    displayName: datasetDoc.get('displayName'),
-                    name: datasetDoc.get('name')
-                }) || step.datasetName || step.datasetId;
-                return failed(`no event field matches a field in dataset "${String(updateLabel != null ? updateLabel : '').slice(0, 60)}"`);
+            if (!incoming.matched.length) {
+                return failed(`no event field matches a field in dataset "${updateLabel}"`);
+            }
+            if (!Object.keys(incoming.values).length) {
+                return failed(`every event field matching dataset "${updateLabel}" is empty`);
             }
             const email = String((_payload_email = payload.email) != null ? _payload_email : '').trim();
             // `records.values` is exempt from indexing, so this lookup is served
@@ -439,7 +460,16 @@ async function datasetAppendRefusal(env, datasetRef) {
             const existing = email ? await datasetDoc.ref.collection('records').where('values.email', '==', email).limit(1).get() : null;
             if (existing && !existing.empty) {
                 var _existing_docs__get;
-                const merged = _extends({}, (_existing_docs__get = existing.docs[0].get('values')) != null ? _existing_docs__get : {}, values);
+                // A merge holds only the fields this write sent to the model: a row
+                // stored as text before AGL-2773 is not refused for a legacy value
+                // this run never touched.
+                const write = prepareDatasetRecordWrite(updateDataset, payload, {
+                    existing: (_existing_docs__get = existing.docs[0].get('values')) != null ? _existing_docs__get : {}
+                });
+                if (Object.keys(write.errors).length) {
+                    return failed(`record failed validation for dataset "${updateLabel}": ${describeDatasetRecordErrors(write.errors)}`);
+                }
+                const merged = write.values;
                 await existing.docs[0].ref.set(_extends({
                     values: merged
                 }, datasetIntegrityUpdate(updateModel, merged, FieldValue.delete()), {
@@ -460,12 +490,16 @@ async function datasetAppendRefusal(env, datasetRef) {
             } else {
                 // The APPEND leg of update-or-append, and the only one of the two
                 // that adds a row — the merge above rewrites a record that already
-                // counts against the band.
+                // counts against the band. A new row is held to the whole model,
+                // required fields included, like any other append.
+                if (Object.keys(incoming.errors).length) {
+                    return failed(`record failed validation for dataset "${updateLabel}": ${describeDatasetRecordErrors(incoming.errors)}`);
+                }
                 const refusal = await datasetAppendRefusal(env, datasetDoc.ref);
                 if (refusal) return failed(refusal);
                 await datasetDoc.ref.collection('records').add(_extends({
-                    values
-                }, datasetIntegrityFields(updateModel, values), {
+                    values: incoming.values
+                }, datasetIntegrityFields(updateModel, incoming.values), {
                     createdAt: FieldValue.serverTimestamp()
                 }));
             }