@aglyn/plugins-workflows 1.0.0-beta.218 → 1.0.0-beta.220

package/src/lib/model/step-outcomes.js

@@ -0,0 +1,70 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Past-tense phrases for a run summary (AGL-2171).
+ *
+ * `HOST_ACTION_STEP_LABELS` (core `actions.ts`) names what a step WILL do, in the
+ * imperative, for a `Do` select — "Send an email". A run history is the
+ * opposite tense and a different audience: it says what already happened,
+ * on one line, several steps at a time. `/product/workflows` advertises
+ * exactly that shape — `Sent email · saved to Leads · webhook 200`.
+ *
+ * Two maps rather than one derived from the other, because "Send a webhook
+ * (Business)" cannot be mechanically turned into "webhook" — the plan
+ * suffix is part of the picker's label and has no business in a log line.
+ * Only the steps a SERVER run can perform appear here; the client-side
+ * steps run in the visitor's browser and never reach the activity write.
+ */ export const HOST_ACTION_STEP_OUTCOMES = {
+    runWorkflow: 'ran workflow',
+    siteAlert: 'showed an alert',
+    customEvent: 'fired an event',
+    datasetAppend: 'saved to dataset',
+    updateDataset: 'updated dataset',
+    webhookPost: 'webhook',
+    sendEmail: 'sent email',
+    notifyAdmins: 'notified admins',
+    enrollList: 'enrolled in list',
+    assignCampaign: 'assigned to campaign',
+    wait: 'waiting',
+    waitForEvent: 'waiting for',
+    exitFlow: 'ended the flow',
+    setContactStage: 'set stage',
+    addContactTag: 'tagged',
+    assignContactOwner: 'assigned owner',
+    createCrmTask: 'created task',
+    logCrmActivity: 'logged activity'
+};
+/**
+ * One step's line in a run summary, with the detail that makes it useful.
+ *
+ * `saved to Leads` beats `saved to dataset`, and `webhook 200` beats
+ * `webhook` — the status code is the entire reason anyone opens a run
+ * history after a webhook, and it was being discarded on the line it
+ * arrived.
+ */ export function describeStepOutcome(type, detail) {
+    var _HOST_ACTION_STEP_OUTCOMES_type;
+    const base = (_HOST_ACTION_STEP_OUTCOMES_type = HOST_ACTION_STEP_OUTCOMES[type]) != null ? _HOST_ACTION_STEP_OUTCOMES_type : String(type);
+    const trimmed = detail == null ? void 0 : detail.trim();
+    if (!trimmed) return base;
+    if (type === 'datasetAppend' || type === 'updateDataset') {
+        // `saved to dataset` + `Leads` reads as `saved to Leads`, not
+        // `saved to dataset Leads`.
+        return `${base.replace(/ dataset$/, '')} ${trimmed}`;
+    }
+    return `${base} ${trimmed}`;
+}
+
+//# sourceMappingURL=step-outcomes.js.map

package/src/lib/model/step-outcomes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/model/step-outcomes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { HostActionStepType } from '@aglyn/aglyn/app-utils/actions'\n\n/**\n * Past-tense phrases for a run summary (AGL-2171).\n *\n * `HOST_ACTION_STEP_LABELS` (core `actions.ts`) names what a step WILL do, in the\n * imperative, for a `Do` select — \"Send an email\". A run history is the\n * opposite tense and a different audience: it says what already happened,\n * on one line, several steps at a time. `/product/workflows` advertises\n * exactly that shape — `Sent email · saved to Leads · webhook 200`.\n *\n * Two maps rather than one derived from the other, because \"Send a webhook\n * (Business)\" cannot be mechanically turned into \"webhook\" — the plan\n * suffix is part of the picker's label and has no business in a log line.\n * Only the steps a SERVER run can perform appear here; the client-side\n * steps run in the visitor's browser and never reach the activity write.\n */\nexport const HOST_ACTION_STEP_OUTCOMES: Partial<\n  Record<HostActionStepType, string>\n> = {\n  runWorkflow: 'ran workflow',\n  siteAlert: 'showed an alert',\n  customEvent: 'fired an event',\n  datasetAppend: 'saved to dataset',\n  updateDataset: 'updated dataset',\n  webhookPost: 'webhook',\n  sendEmail: 'sent email',\n  notifyAdmins: 'notified admins',\n  enrollList: 'enrolled in list',\n  assignCampaign: 'assigned to campaign',\n  wait: 'waiting',\n  waitForEvent: 'waiting for',\n  exitFlow: 'ended the flow',\n  setContactStage: 'set stage',\n  addContactTag: 'tagged',\n  assignContactOwner: 'assigned owner',\n  createCrmTask: 'created task',\n  logCrmActivity: 'logged activity',\n}\n\n/**\n * One step's line in a run summary, with the detail that makes it useful.\n *\n * `saved to Leads` beats `saved to dataset`, and `webhook 200` beats\n * `webhook` — the status code is the entire reason anyone opens a run\n * history after a webhook, and it was being discarded on the line it\n * arrived.\n */\nexport function describeStepOutcome(\n  type: HostActionStepType,\n  detail?: string,\n): string {\n  const base = HOST_ACTION_STEP_OUTCOMES[type] ?? String(type)\n  const trimmed = detail?.trim()\n  if (!trimmed) return base\n  if (type === 'datasetAppend' || type === 'updateDataset') {\n    // `saved to dataset` + `Leads` reads as `saved to Leads`, not\n    // `saved to dataset Leads`.\n    return `${base.replace(/ dataset$/, '')} ${trimmed}`\n  }\n  return `${base} ${trimmed}`\n}\n"],"names":["HOST_ACTION_STEP_OUTCOMES","runWorkflow","siteAlert","customEvent","datasetAppend","updateDataset","webhookPost","sendEmail","notifyAdmins","enrollList","assignCampaign","wait","waitForEvent","exitFlow","setContactStage","addContactTag","assignContactOwner","createCrmTask","logCrmActivity","describeStepOutcome","type","detail","base","String","trimmed","trim","replace"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAID;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMA,4BAET;IACFC,aAAa;IACbC,WAAW;IACXC,aAAa;IACbC,eAAe;IACfC,eAAe;IACfC,aAAa;IACbC,WAAW;IACXC,cAAc;IACdC,YAAY;IACZC,gBAAgB;IAChBC,MAAM;IACNC,cAAc;IACdC,UAAU;IACVC,iBAAiB;IACjBC,eAAe;IACfC,oBAAoB;IACpBC,eAAe;IACfC,gBAAgB;AAClB,EAAC;AAED;;;;;;;CAOC,GACD,OAAO,SAASC,oBACdC,IAAwB,EACxBC,MAAe;QAEFrB;IAAb,MAAMsB,QAAOtB,kCAAAA,yBAAyB,CAACoB,KAAK,YAA/BpB,kCAAmCuB,OAAOH;IACvD,MAAMI,UAAUH,0BAAAA,OAAQI,IAAI;IAC5B,IAAI,CAACD,SAAS,OAAOF;IACrB,IAAIF,SAAS,mBAAmBA,SAAS,iBAAiB;QACxD,8DAA8D;QAC9D,4BAA4B;QAC5B,OAAO,GAAGE,KAAKI,OAAO,CAAC,aAAa,IAAI,CAAC,EAAEF,SAAS;IACtD;IACA,OAAO,GAAGF,KAAK,CAAC,EAAEE,SAAS;AAC7B"}

package/src/lib/model/webhooks.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Webhooks (AGL-149) at `hosts/{hostId}/webhooks/{id}`. Outbound entries
+ * are targets a `webhookPost` action step delivers to (HMAC-signed);
+ * inbound entries mint `/api/hooks/{hostId}/{hookId}` endpoints that run
+ * a workflow with the posted JSON in scope. Business tier (`webhooks`
+ * flag); Pro can be enabled per-tenant via entitlement overrides.
+ */
+export interface HostWebhook {
+    name: string;
+    direction: 'outbound' | 'inbound';
+    /** Outbound delivery URL (https only; checked again at send time). */
+    url?: string;
+    /** Shared secret: signs outbound bodies, verifies inbound callers. */
+    secret?: string;
+    /** Inbound: workflow (by name) enrolled with the payload in scope. */
+    workflowName?: string;
+    enabled?: boolean;
+}
+/** Outbound URLs must be public https — first-line SSRF guard. */
+export declare const WEBHOOK_URL_PATTERN: RegExp;

package/src/lib/model/webhooks.js

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Webhooks (AGL-149) at `hosts/{hostId}/webhooks/{id}`. Outbound entries
+ * are targets a `webhookPost` action step delivers to (HMAC-signed);
+ * inbound entries mint `/api/hooks/{hostId}/{hookId}` endpoints that run
+ * a workflow with the posted JSON in scope. Business tier (`webhooks`
+ * flag); Pro can be enabled per-tenant via entitlement overrides.
+ */ /** Outbound URLs must be public https — first-line SSRF guard. */ export const WEBHOOK_URL_PATTERN = /^https:\/\/(?!localhost)(?!127\.)(?!0\.)(?!10\.)(?!172\.(1[6-9]|2\d|3[01])\.)(?!192\.168\.)(?!169\.254\.)[^\s]+$/i;
+
+//# sourceMappingURL=webhooks.js.map

package/src/lib/model/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/model/webhooks.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Webhooks (AGL-149) at `hosts/{hostId}/webhooks/{id}`. Outbound entries\n * are targets a `webhookPost` action step delivers to (HMAC-signed);\n * inbound entries mint `/api/hooks/{hostId}/{hookId}` endpoints that run\n * a workflow with the posted JSON in scope. Business tier (`webhooks`\n * flag); Pro can be enabled per-tenant via entitlement overrides.\n */\nexport interface HostWebhook {\n  name: string\n  direction: 'outbound' | 'inbound'\n  /** Outbound delivery URL (https only; checked again at send time). */\n  url?: string\n  /** Shared secret: signs outbound bodies, verifies inbound callers. */\n  secret?: string\n  /** Inbound: workflow (by name) enrolled with the payload in scope. */\n  workflowName?: string\n  enabled?: boolean\n}\n\n/** Outbound URLs must be public https — first-line SSRF guard. */\nexport const WEBHOOK_URL_PATTERN =\n  /^https:\\/\\/(?!localhost)(?!127\\.)(?!0\\.)(?!10\\.)(?!172\\.(1[6-9]|2\\d|3[01])\\.)(?!192\\.168\\.)(?!169\\.254\\.)[^\\s]+$/i\n"],"names":["WEBHOOK_URL_PATTERN"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;CAMC,GAaD,gEAAgE,GAChE,OAAO,MAAMA,sBACX,oHAAmH"}

package/src/lib/model/workflows-record-lists.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Called from the console registrar, owner named for a spec that calls it directly. */
+export declare function registerWorkflowsRecordLists(): void;

package/src/lib/model/workflows-record-lists.js

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerPluginRecordListSource } from "@aglyn/aglyn/plugin-manager/plugin-record-lists";
+import { collection, documentId, limit, orderBy, query } from "firebase/firestore";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+import { AUTOMATION_COLLECTIONS, automationIndexedRecord } from "./automation-record.js";
+/**
+ * A site's workflows, webhooks and actions, listed in the console for another
+ * plugin's picker or check (AGL-3080) — a computed variable choosing the
+ * workflow that fills it, a reference check confirming one still exists.
+ *
+ * All three are a site's: asked at the organization, a source answers none,
+ * and none is ever installed from a listing. Ordered by document id, so the
+ * window is the same one every bounded list reads. Each record is
+ * `automationIndexedRecord`'s, the server indexes' shape.
+ */ function automationListSource(kind) {
+    return {
+        query (firestore, request) {
+            return request.hostId && !request.installedFrom ? query(collection(firestore, 'hosts', request.hostId, AUTOMATION_COLLECTIONS[kind]), orderBy(documentId()), limit(request.limit)) : null;
+        },
+        record: (id, data)=>automationIndexedRecord(kind, id, data)
+    };
+}
+/** Called from the console registrar, owner named for a spec that calls it directly. */ export function registerWorkflowsRecordLists() {
+    for (const kind of Object.keys(AUTOMATION_COLLECTIONS)){
+        registerPluginRecordListSource(kind, automationListSource(kind), {
+            pluginId: BUNDLE_ID
+        });
+    }
+}
+
+//# sourceMappingURL=workflows-record-lists.js.map

package/src/lib/model/workflows-record-lists.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/model/workflows-record-lists.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordListSource,\n  type PluginRecordListSource,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-lists'\nimport { collection, documentId, limit, orderBy, query } from 'firebase/firestore'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport {\n  AUTOMATION_COLLECTIONS,\n  automationIndexedRecord,\n  type AutomationRecordKind,\n} from './automation-record'\n\n/**\n * A site's workflows, webhooks and actions, listed in the console for another\n * plugin's picker or check (AGL-3080) — a computed variable choosing the\n * workflow that fills it, a reference check confirming one still exists.\n *\n * All three are a site's: asked at the organization, a source answers none,\n * and none is ever installed from a listing. Ordered by document id, so the\n * window is the same one every bounded list reads. Each record is\n * `automationIndexedRecord`'s, the server indexes' shape.\n */\nfunction automationListSource(kind: AutomationRecordKind): PluginRecordListSource {\n  return {\n    query(firestore, request) {\n      return request.hostId && !request.installedFrom\n        ? query(\n            collection(firestore, 'hosts', request.hostId, AUTOMATION_COLLECTIONS[kind]),\n            orderBy(documentId()),\n            limit(request.limit),\n          )\n        : null\n    },\n    record: (id, data) => automationIndexedRecord(kind, id, data),\n  }\n}\n\n/** Called from the console registrar, owner named for a spec that calls it directly. */\nexport function registerWorkflowsRecordLists(): void {\n  for (const kind of Object.keys(AUTOMATION_COLLECTIONS) as AutomationRecordKind[]) {\n    registerPluginRecordListSource(kind, automationListSource(kind), { pluginId: BUNDLE_ID })\n  }\n}\n"],"names":["registerPluginRecordListSource","collection","documentId","limit","orderBy","query","BUNDLE_ID","AUTOMATION_COLLECTIONS","automationIndexedRecord","automationListSource","kind","firestore","request","hostId","installedFrom","record","id","data","registerWorkflowsRecordLists","Object","keys","pluginId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,8BAA8B,QAEzB,kDAAiD;AACxD,SAASC,UAAU,EAAEC,UAAU,EAAEC,KAAK,EAAEC,OAAO,EAAEC,KAAK,QAAQ,qBAAoB;AAClF,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SACEC,sBAAsB,EACtBC,uBAAuB,QAElB,yBAAqB;AAE5B;;;;;;;;;CASC,GACD,SAASC,qBAAqBC,IAA0B;IACtD,OAAO;QACLL,OAAMM,SAAS,EAAEC,OAAO;YACtB,OAAOA,QAAQC,MAAM,IAAI,CAACD,QAAQE,aAAa,GAC3CT,MACEJ,WAAWU,WAAW,SAASC,QAAQC,MAAM,EAAEN,sBAAsB,CAACG,KAAK,GAC3EN,QAAQF,eACRC,MAAMS,QAAQT,KAAK,KAErB;QACN;QACAY,QAAQ,CAACC,IAAIC,OAAST,wBAAwBE,MAAMM,IAAIC;IAC1D;AACF;AAEA,sFAAsF,GACtF,OAAO,SAASC;IACd,KAAK,MAAMR,QAAQS,OAAOC,IAAI,CAACb,wBAAmD;QAChFP,+BAA+BU,MAAMD,qBAAqBC,OAAO;YAAEW,UAAUf;QAAU;IACzF;AACF"}

package/src/lib/model/workflows-record-routes.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Called from the console registrar. The owner is named rather than read off
+ * the loader's marker, so the routes register the same way under a spec that
+ * calls the registrar directly.
+ */
+export declare function registerWorkflowsRecordRoutes(): void;

package/src/lib/model/workflows-record-routes.js

@@ -0,0 +1,73 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { buildRoute, Route } from "@aglyn/aglyn/app-utils/console-routes";
+import { registerPluginRecordRoute } from "@aglyn/aglyn/plugin-manager/plugin-record-routes";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+/**
+ * Where a site's workflows, actions and webhooks are read, published for
+ * every other surface — the same three kinds this plugin indexes.
+ *
+ * The CRM installs an action recipe and names where it landed; an assistant
+ * job opens the actions list its drafted automation was saved to. Each asks
+ * the record-route registry for the kind rather than spelling this plugin's
+ * nav slug, and gets `null` (text instead of a link) where it is not loaded.
+ *
+ * None of the three has a page of its own: each is edited in its section of
+ * the Automation page, so a record's address is its section. The
+ * organization's hub lists every site's records under the same section ids,
+ * so both levels answer.
+ */ /** The nav slug the shell resolves this plugin's hub by, at either level. */ const AUTOMATION_SLUG = 'automation';
+function section({ orgSlug, host }, id) {
+    const hub = host ? buildRoute(Route.HOST_PLUGIN, {
+        orgSlug,
+        host,
+        pluginSlug: AUTOMATION_SLUG
+    }) : buildRoute(Route.ORG_PLUGIN, {
+        orgSlug,
+        pluginSlug: AUTOMATION_SLUG
+    });
+    return `${hub}/${id}`;
+}
+/**
+ * Called from the console registrar. The owner is named rather than read off
+ * the loader's marker, so the routes register the same way under a spec that
+ * calls the registrar directly.
+ */ export function registerWorkflowsRecordRoutes() {
+    const owner = {
+        pluginId: BUNDLE_ID
+    };
+    for (const [kind, id] of [
+        [
+            'workflow',
+            'workflows'
+        ],
+        [
+            'action',
+            'actions'
+        ],
+        [
+            'webhook',
+            'webhooks'
+        ]
+    ]){
+        registerPluginRecordRoute(kind, {
+            list: (context)=>section(context, id),
+            record: (context)=>section(context, id)
+        }, owner);
+    }
+}
+
+//# sourceMappingURL=workflows-record-routes.js.map

package/src/lib/model/workflows-record-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/model/workflows-record-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { buildRoute, Route } from '@aglyn/aglyn/app-utils/console-routes'\nimport {\n  registerPluginRecordRoute,\n  type PluginRecordRouteContext,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-routes'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport type { WorkflowsConsoleSectionId } from '../components/workflows-console-sections'\n\n/**\n * Where a site's workflows, actions and webhooks are read, published for\n * every other surface — the same three kinds this plugin indexes.\n *\n * The CRM installs an action recipe and names where it landed; an assistant\n * job opens the actions list its drafted automation was saved to. Each asks\n * the record-route registry for the kind rather than spelling this plugin's\n * nav slug, and gets `null` (text instead of a link) where it is not loaded.\n *\n * None of the three has a page of its own: each is edited in its section of\n * the Automation page, so a record's address is its section. The\n * organization's hub lists every site's records under the same section ids,\n * so both levels answer.\n */\n\n/** The nav slug the shell resolves this plugin's hub by, at either level. */\nconst AUTOMATION_SLUG = 'automation'\n\nfunction section(\n  { orgSlug, host }: PluginRecordRouteContext,\n  id: WorkflowsConsoleSectionId,\n): string {\n  const hub = host\n    ? buildRoute(Route.HOST_PLUGIN, { orgSlug, host, pluginSlug: AUTOMATION_SLUG })\n    : buildRoute(Route.ORG_PLUGIN, { orgSlug, pluginSlug: AUTOMATION_SLUG })\n  return `${hub}/${id}`\n}\n\n/**\n * Called from the console registrar. The owner is named rather than read off\n * the loader's marker, so the routes register the same way under a spec that\n * calls the registrar directly.\n */\nexport function registerWorkflowsRecordRoutes(): void {\n  const owner = { pluginId: BUNDLE_ID }\n  for (const [kind, id] of [\n    ['workflow', 'workflows'],\n    ['action', 'actions'],\n    ['webhook', 'webhooks'],\n  ] as const) {\n    registerPluginRecordRoute(\n      kind,\n      { list: (context) => section(context, id), record: (context) => section(context, id) },\n      owner,\n    )\n  }\n}\n"],"names":["buildRoute","Route","registerPluginRecordRoute","BUNDLE_ID","AUTOMATION_SLUG","section","orgSlug","host","id","hub","HOST_PLUGIN","pluginSlug","ORG_PLUGIN","registerWorkflowsRecordRoutes","owner","pluginId","kind","list","context","record"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,EAAEC,KAAK,QAAQ,wCAAuC;AACzE,SACEC,yBAAyB,QAEpB,mDAAkD;AACzD,SAASC,SAAS,QAAQ,gCAA4B;AAGtD;;;;;;;;;;;;;CAaC,GAED,2EAA2E,GAC3E,MAAMC,kBAAkB;AAExB,SAASC,QACP,EAAEC,OAAO,EAAEC,IAAI,EAA4B,EAC3CC,EAA6B;IAE7B,MAAMC,MAAMF,OACRP,WAAWC,MAAMS,WAAW,EAAE;QAAEJ;QAASC;QAAMI,YAAYP;IAAgB,KAC3EJ,WAAWC,MAAMW,UAAU,EAAE;QAAEN;QAASK,YAAYP;IAAgB;IACxE,OAAO,GAAGK,IAAI,CAAC,EAAED,IAAI;AACvB;AAEA;;;;CAIC,GACD,OAAO,SAASK;IACd,MAAMC,QAAQ;QAAEC,UAAUZ;IAAU;IACpC,KAAK,MAAM,CAACa,MAAMR,GAAG,IAAI;QACvB;YAAC;YAAY;SAAY;QACzB;YAAC;YAAU;SAAU;QACrB;YAAC;YAAW;SAAW;KACxB,CAAW;QACVN,0BACEc,MACA;YAAEC,MAAM,CAACC,UAAYb,QAAQa,SAASV;YAAKW,QAAQ,CAACD,UAAYb,QAAQa,SAASV;QAAI,GACrFM;IAEJ;AACF"}

package/src/lib/model/workflows-search-sources.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { ConsoleSearchSource } from '@aglyn/aglyn';
+/**
+ * What the console's search finds in a site's automation (AGL-3080): its
+ * workflows, by name, opening on the site's Automation page — the address,
+ * never the `/workflows` one it redirects from.
+ */
+export declare const WORKFLOWS_SEARCH_SOURCES: readonly ConsoleSearchSource[];

package/src/lib/model/workflows-search-sources.js

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { buildRoute, Route } from "@aglyn/aglyn/app-utils/console-routes";
+/**
+ * What the console's search finds in a site's automation (AGL-3080): its
+ * workflows, by name, opening on the site's Automation page — the address,
+ * never the `/workflows` one it redirects from.
+ */ export const WORKFLOWS_SEARCH_SOURCES = [
+    {
+        id: 'workflows',
+        group: 'Workflows',
+        noun: 'workflows',
+        scope: 'host',
+        collection: 'workflows',
+        nameField: 'name',
+        entitlementKey: 'workflowsPerHost',
+        order: 150,
+        href: (_row, { orgSlug, host })=>host ? buildRoute(Route.HOST_AUTOMATION, {
+                orgSlug,
+                host
+            }) : null
+    }
+];
+
+//# sourceMappingURL=workflows-search-sources.js.map

package/src/lib/model/workflows-search-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/model/workflows-search-sources.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *   http://www.apache.org/licenses/LICENSE-2.0\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { ConsoleSearchSource } from '@aglyn/aglyn'\nimport { buildRoute, Route } from '@aglyn/aglyn/app-utils/console-routes'\n\n/**\n * What the console's search finds in a site's automation (AGL-3080): its\n * workflows, by name, opening on the site's Automation page — the address,\n * never the `/workflows` one it redirects from.\n */\nexport const WORKFLOWS_SEARCH_SOURCES: readonly ConsoleSearchSource[] = [\n  {\n    id: 'workflows',\n    group: 'Workflows',\n    noun: 'workflows',\n    scope: 'host',\n    collection: 'workflows',\n    nameField: 'name',\n    entitlementKey: 'workflowsPerHost',\n    order: 150,\n    href: (_row, { orgSlug, host }) =>\n      host ? buildRoute(Route.HOST_AUTOMATION, { orgSlug, host }) : null,\n  },\n]\n"],"names":["buildRoute","Route","WORKFLOWS_SEARCH_SOURCES","id","group","noun","scope","collection","nameField","entitlementKey","order","href","_row","orgSlug","host","HOST_AUTOMATION"],"mappings":"AAAA;;;;;;;;;;;;CAYC,GAGD,SAASA,UAAU,EAAEC,KAAK,QAAQ,wCAAuC;AAEzE;;;;CAIC,GACD,OAAO,MAAMC,2BAA2D;IACtE;QACEC,IAAI;QACJC,OAAO;QACPC,MAAM;QACNC,OAAO;QACPC,YAAY;QACZC,WAAW;QACXC,gBAAgB;QAChBC,OAAO;QACPC,MAAM,CAACC,MAAM,EAAEC,OAAO,EAAEC,IAAI,EAAE,GAC5BA,OAAOd,WAAWC,MAAMc,eAAe,EAAE;gBAAEF;gBAASC;YAAK,KAAK;IAClE;CACD,CAAA"}

package/src/lib/model/workflows.d.ts

@@ -0,0 +1,102 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type HostFunction } from '@aglyn/aglyn/app-utils/functions';
+import type { HostEventType } from '@aglyn/aglyn/app-utils/host-events';
+import type { HostVariable } from '@aglyn/aglyn/app-utils/variables';
+/**
+ * Workflows (Workflow Builder, AGL-101): named pipelines of host-function
+ * calls. Each step evaluates its argument expressions over host variables
+ * and previous step results, runs the function through the safe evaluator,
+ * and stores the result under its name for later steps. Pure and bounded —
+ * no I/O, no loops. Site-event triggers arrive in v2.
+ */
+export interface HostWorkflowTrigger {
+    event: HostEventType;
+    /**
+     * Optional expression over the event payload (plus variables); the
+     * workflow only runs when it evaluates truthy (e.g. `path == "/pricing"`).
+     */
+    filter?: string;
+}
+export interface HostWorkflowStep {
+    /**
+     * Host function to run — by doc id (AGL-261), rename-safe. Steps saved
+     * before AGL-261 carry only `functionName`; executors resolve id first.
+     */
+    functionId?: string;
+    /** Legacy name reference, kept as the display hint; `functionId` wins. */
+    functionName: string;
+    /**
+     * One expression per function parameter, evaluated over variables and
+     * previous step results (e.g. `price * qty`, `step1 + 10`).
+     */
+    args: string[];
+    /** Scope name the step's result binds to; defaults to `step<N>`. */
+    resultName?: string;
+}
+/** `hosts/{hostId}/workflows/{id}` doc. */
+export interface HostWorkflow {
+    name: string;
+    steps: HostWorkflowStep[];
+    /** Scope name whose final value the workflow returns. */
+    returnValue?: string;
+    /** Event trigger (AGL-128); absent means manual/embedded use only. */
+    trigger?: HostWorkflowTrigger | null;
+}
+export declare const WORKFLOW_MAX_STEPS = 25;
+/** Max nesting across workflow→function→workflow cross-calls (AGL-129). */
+export declare const CROSS_MAX_DEPTH = 3;
+/** How deep one custom event may chain into another automation's run. */
+export declare const ACTION_MAX_EVENT_DEPTH = 3;
+export type WorkflowRunResult = {
+    ok: true;
+    value: number | string | boolean;
+    results: Record<string, number | string | boolean>;
+} | {
+    ok: false;
+    error: string;
+    step?: number;
+};
+export interface WorkflowRunContext {
+    /** All host workflows by name, enabling function→workflow calls. */
+    workflows?: Record<string, HostWorkflow>;
+    /** Cross-call nesting depth; internal — callers omit it. */
+    depth?: number;
+}
+export declare function runWorkflow(workflow: HostWorkflow, functions: Record<string, HostFunction>, variables?: Record<string, HostVariable>, 
+/**
+ * Extra scope entries seeded ahead of the steps — event payloads (path,
+ * formName, field values) land here (AGL-128). Wins over variables.
+ */
+extraScope?: Record<string, number | string | boolean>, context?: WorkflowRunContext): WorkflowRunResult;
+/**
+ * The reference a computed site variable carries to the workflow that
+ * computes it: the workflow's document id (AGL-261), and the name it had when
+ * it was picked, which a variable computed before ids existed carries alone.
+ * Written by the variables editor; read here.
+ */
+export interface WorkflowComputedVariable extends HostVariable {
+    workflowId?: string;
+    workflowName?: string;
+}
+/**
+ * Computed variables (AGL-129): a variable naming a workflow takes that
+ * workflow's result as its value at compose time — by id first, then by
+ * name; failures keep the stored fallback value. Each computed variable
+ * evaluates once, bounded by the shared depth guard.
+ */
+export declare function resolveComputedVariables(variables: Record<string, HostVariable>, functions: Record<string, HostFunction>, workflows: Record<string, HostWorkflow>): Record<string, HostVariable>;