@aglyn/plugins-workflows 1.0.0-beta.220 → 1.0.0-beta.222

package/src/lib/engine/run-event-actions.js

@@ -14,15 +14,15 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { ACTION_MAX_STEPS, checkEntitlement, consentGroupForHost, planLabelGrantingFeature, checkQuota, evaluateExpression, evaluateStepGuard, evaluateTriggerConditions, FLOW_TIMED_OUT_FIELD, flowSubscriptionTopicId, hostPublicOrigin, isClientActionStep, isFlowSuspendingStep, datasetDisplayName, describeDatasetRecordErrors, contactContainerFieldPath, datasetIntegrityFields, datasetIntegrityUpdate, effectiveDatasetModel, ensureDeclaredCustomFieldTypes, normalizeTriggerConditions, prepareDatasetRecordWrite, resolveOrgEntitlements } from "@aglyn/aglyn/server";
+ */ import { ACTION_MAX_STEPS, checkEntitlement, consentGroupForHost, planLabelGrantingFeature, evaluateExpression, evaluateStepGuard, evaluateTriggerConditions, flowSubscriptionTopicId, hostPublicOrigin, isClientActionStep, normalizeTriggerConditions, resolveOrgEntitlements } from "@aglyn/aglyn/server";
 import { isDeferrableSendResult, isEmailConfigured, sendEmail, sendFailureReason } from "@aglyn/shared-util-email";
-import { dataStorageRefusal, enrollListMember, firebaseAdmin, flowEmailRefusal, getOrgForHost, hostSendingIdentity, meterHostEmail, notifyHostManagers, consentGroupForSite, orgDataCollectionForHost, orgDataQueryForHost, resolveOrgIdForHost } from "@aglyn/tenant-data-admin";
-import { announceDatasetRecordChange } from "@aglyn/tenant-data-admin/server/dataset-live-pages";
+import { enrollListMember, firebaseAdmin, flowEmailRefusal, getOrgForHost, hostSendingIdentity, meterHostEmail, notifyHostManagers, consentGroupForSite, resolveOrgIdForHost } from "@aglyn/tenant-data-admin";
 import { activitySearchTokens } from "@aglyn/aglyn/app-utils/activity-search";
 import { visibleToHost } from "@aglyn/aglyn/app-utils/scope-tokens";
-// The leaf, not the barrel: this library's specs substitute the barrel
-// wholesale, and the lookup must reach the real index logic under them.
-import { findContactByEmail } from "@aglyn/tenant-data-admin/server/contact-email-index";
+// The person behind an address, and their filing under a campaign, through
+// the plugin that keeps people (AGL-3080): the engine opens none of its
+// collections.
+import { filePluginPersonUnder, findPluginPerson } from "@aglyn/aglyn/plugin-manager/plugin-person-records";
 import { findOrgContainersByName, readOrgContainers } from "@aglyn/tenant-data-admin/server/org-containers";
 // The leaf again, for the phishing screen's hold (AGL-3356): the control
 // that stops a send must be the real one under a spec that mocks the barrel.
@@ -35,14 +35,17 @@ import { ACTION_MAX_EVENT_DEPTH, runWorkflow, WORKFLOW_MAX_STEPS } from "../mode
 import { describeStepOutcome } from "../model/step-outcomes.js";
 import { WEBHOOK_URL_PATTERN } from "../model/webhooks.js";
 import { eventRunSuspension } from "./site-suspension.js";
+import { recordRuns, runMonthKey, runsUsedThisMonth } from "./run-meter.js";
 import { advanceFlowEnrollment, claimFlowEnrollment, deferFlowEnrollment, endFlowEnrollment, enrollInFlow, findFlowEnrollmentsAwaiting, sweepDueFlowEnrollments } from "./flow-enrollments.js";
-import { isCrmActionStep, logCrmEmailActivity, prepareCrmEmailActivity, runCrmActionStep } from "./crm-action-steps.js";
-import { resolveDatasetDoc } from "@aglyn/tenant-runtime/resolve-dataset";
 import { resumeWorkflowEnrollment, runEventWorkflows } from "./run-event-workflows.js";
 import { ORG_AUTOMATION_RUN_TARGET, orgAutomationStepRefusal } from "../model/org-automations.js";
 import { findOrgAutomationsForEvent, resumeOrgAutomationEnrollment } from "./run-org-automations.js";
 import { isWorkflowActionStep, workflowActionStepRefusal, workflowHasActionSteps, workflowStepTypeLabel } from "./workflow-steps.js";
 import { runTriggeredByFields } from "./run-trigger-actor.js";
+// By path, not the barrel: only a server run asks.
+import { pluginServerStepExecutor } from "@aglyn/aglyn/plugin-manager/plugin-server-steps";
+import { preparePluginRecordEmail } from "@aglyn/aglyn/plugin-manager/plugin-record-timeline";
+import { FLOW_TIMED_OUT_FIELD, isFlowSuspendingStep } from "../model/host-actions.js";
 /** Bounded fan-out per event, mirroring the workflow runner. */ const MAX_TRIGGERED_ACTIONS = 10;
 /**
  * The run environment for one automation run: the org's plan gates resolved
@@ -57,7 +60,6 @@ import { runTriggeredByFields } from "./run-trigger-actor.js";
         alerts: (_input_alerts = input.alerts) != null ? _input_alerts : [],
         actionsAllowed: checkEntitlement(org, 'actions'),
         webhooksAllowed: checkEntitlement(org, 'webhooks'),
-        crmAllowed: checkEntitlement(org, 'crm'),
         depth: input.depth,
         org,
         orgId: (_ref1 = (_input_owner1 = input.owner) == null ? void 0 : _input_owner1.orgId) != null ? _ref1 : null,
@@ -111,76 +113,6 @@ export function makeWorkflowContextLoader(hostRef) {
         workflows
     };
 }
-/**
- * Whether this dataset may take ANOTHER record, on the plan of the org that
- * owns the site — the row band and the byte band, in that order. Null when
- * the append may proceed; a reason string when it may not.
- *
- * ## Why an append needs a gate at all
- *
- * Every other door onto `datasets/{id}/records` already has one: the console
- * route re-checks `recordsPerDataset` inside the creating transaction, the
- * `/v1` record route checks it below its idempotency claim, and the public
- * form-submission leg checks the rows and the bytes. A workflow step wrote
- * with no check of either — and it is the door a visitor drives hardest,
- * because an action fires per event on a published site. A cap enforced at
- * three of four doors is not a cap; it is the shape of the one that is left.
- *
- * ## What it does NOT do
- *
- * It refuses the WRITE, never the dataset. A dataset already holding more
- * rows than the plan includes keeps every row it has and keeps being read —
- * nothing here deletes, truncates, or hides anything, and nothing may be
- * added that does. What is refused is the next row, which is the same
- * boundary the other three doors draw, and the reason a plan change cannot
- * cost a customer data they already have.
- *
- * The update leg of `updateDataset` is deliberately NOT gated: merging fields
- * into a record that already exists adds no row, so refusing it would refuse
- * the state of being over rather than the raise.
- *
- * ## What it costs
- *
- * Nothing on the plans that sell the data store. The row count is read only
- * when `recordsPerDataset` is FINITE, so an uncapped plan pays nothing; and
- * `dataStorageRefusal` answers null with no read at all whenever the plan
- * carries an `extraDataGbMonthlyUsd` rate, which every metered plan does. The
- * reads are paid on the shapes that can actually refuse.
- */ /**
- * Refresh the live pages showing the dataset this step just wrote to
- * (AGL-3113).
- *
- * An automation that appends a row is the same change to a visitor as a form
- * submission or a console edit: the pages repeating over the dataset go on
- * serving the rows they were built from. Announced from the step rather than
- * from the run, so a workflow whose steps write two different datasets
- * refreshes both — the announce coalesces repeats of the SAME dataset itself,
- * which is what a run hitting one dataset several times needs.
- *
- * Silent without an org: datasets are org-scoped, so a host with no resolvable
- * org has no dataset to have written to. Best effort, and never thrown: the
- * row is already stored.
- */ async function announceDatasetStepWrite(env, datasetId) {
-    if (!env.orgId) return;
-    await announceDatasetRecordChange({
-        firestore: firebaseAdmin.app().firestore(),
-        orgId: env.orgId,
-        datasetId
-    });
-}
-async function datasetAppendRefusal(env, datasetRef) {
-    const limit = resolveOrgEntitlements(env.org).recordsPerDataset;
-    if (Number.isFinite(limit)) {
-        const used = (await datasetRef.collection('records').count().get()).data().count;
-        if (!checkQuota(env.org, 'recordsPerDataset', used).allowed) {
-            return `dataset is full (${limit} records on this plan)`;
-        }
-    }
-    if (!env.orgId) return null;
-    const bytes = await dataStorageRefusal(env.org, firebaseAdmin.app().firestore().collection('orgs').doc(env.orgId));
-    if (!bytes) return null;
-    return `dataset storage is full (${bytes.includedMb} MB on this plan)`;
-}
 /**
  * Folds one step's verdict into its run's tally, in the run-history phrasing
  * every automation shares; true when the run stops at this step.
@@ -210,12 +142,29 @@ async function datasetAppendRefusal(env, datasetRef) {
             return true;
     }
 }
+/**
+ * Raises an event a step's write earned — a stage an automation set IS a
+ * stage change, and whatever listens for one must hear it.
+ *
+ * Fanned out here, one level deeper under the same depth guard a
+ * `customEvent` chain runs under, rather than through `emitHostEvent`, which
+ * starts every chain at depth zero and would let an automation that causes
+ * the event it listens for run forever. Workflows take the guard too.
+ */ async function raiseEarnedEvent(env, emit) {
+    const payload = emit.payload;
+    const [fromWorkflows, fromActions] = await Promise.all([
+        // A step names any event a listener may hear: a declared one or a custom one.
+        runEventWorkflows(env.hostId, emit.event, payload, env.depth + 1),
+        runEventActions(env.hostId, emit.event, payload, env.depth + 1)
+    ]);
+    env.alerts.push(...fromActions, ...fromWorkflows);
+}
 /**
  * Runs ONE Actions step on the server: the executor every automation shares.
  *
  * An action's step list runs through it one step at a time, and so does
  * every Actions step inside a workflow — so the two engines cannot disagree
- * about what `sendEmail` or `datasetAppend` does, what a step is gated on, or
+ * about what `sendEmail` or `webhookPost` does, what a step is gated on, or
  * how its outcome reads in the run history. There is no second copy of any
  * branch below.
  *
@@ -227,8 +176,8 @@ async function datasetAppendRefusal(env, datasetRef) {
     const { hostId, hostRef, alerts, depth } = env;
     const { event, payload, enrollmentRef } = context;
     /**
-   * The one fact worth carrying into the summary — the dataset's name,
-   * the webhook's status. Set by the branch that knows it.
+   * The one fact worth carrying into the summary — the webhook's status, or
+   * whatever a plugin's step answers. Set by the branch that knows it.
    */ let detail;
     const failed = (error)=>({
             kind: 'failed',
@@ -375,140 +324,6 @@ async function datasetAppendRefusal(env, datasetRef) {
             // until AGL-2171. A 200 and a 204 are both `ok`, and knowing which is
             // the whole reason anyone opens a run history after a webhook.
             detail = String(lastStatus != null ? lastStatus : '');
-        } else if (step.type === 'datasetAppend') {
-            // Id-first lookup (AGL-261/556); the name query is the legacy path.
-            const datasetsRef = await orgDataCollectionForHost(hostId, 'datasets');
-            const datasetDoc = await resolveDatasetDoc(datasetsRef, step, hostId);
-            if (!(datasetDoc == null ? void 0 : datasetDoc.exists) || datasetDoc.get('deletedAt')) {
-                return failed(`unknown dataset "${step.datasetName || step.datasetId}"`);
-            }
-            // Restrict to the model's field ids (AGL-556) — covers model-only
-            // datasets whose flat v1 `fields` mirror is absent.
-            const appendDataset = {
-                model: datasetDoc.get('model'),
-                fields: Array.isArray(datasetDoc.get('fields')) ? datasetDoc.get('fields') : []
-            };
-            const appendModel = effectiveDatasetModel(appendDataset);
-            // A plugin's field validator runs only once its plugin registered it.
-            await ensureDeclaredCustomFieldTypes(appendModel);
-            const write = prepareDatasetRecordWrite(appendDataset, payload);
-            const values = write.values;
-            // Same name precedence `findDatasetByName` resolves in.
-            const appendLabel = (datasetDisplayName({
-                displayName: datasetDoc.get('displayName'),
-                name: datasetDoc.get('name')
-            }) || step.datasetName || '').slice(0, 60);
-            // No event field matched a field of the dataset, so there is nothing
-            // to write. An error rather than a quiet success: a run history that
-            // says `saved to Leads` while nothing saves is how a mismatched field
-            // name goes unnoticed.
-            if (!write.matched.length) {
-                return failed(`no event field matches a field in dataset "${appendLabel || step.datasetId}"`);
-            }
-            // Held to the model like every other record write (AGL-2773): a value
-            // its field cannot hold refuses the whole record, and the run says
-            // which field and why instead of `saved to Leads`.
-            if (Object.keys(write.errors).length) {
-                return failed(`record failed validation for dataset "${appendLabel || step.datasetId}": ${describeDatasetRecordErrors(write.errors)}`);
-            }
-            if (!Object.keys(values).length) {
-                return failed(`every event field matching dataset "${appendLabel || step.datasetId}" is empty`);
-            }
-            const refusal = await datasetAppendRefusal(env, datasetDoc.ref);
-            if (refusal) return failed(refusal);
-            await datasetDoc.ref.collection('records').add(_extends({
-                values
-            }, datasetIntegrityFields(appendModel, values), {
-                createdAt: FieldValue.serverTimestamp()
-            }));
-            await announceDatasetStepWrite(env, datasetDoc.id);
-            // `saved to Leads` beats `saved to dataset` (AGL-2171).
-            detail = appendLabel;
-        } else if (step.type === 'updateDataset') {
-            var _payload_email;
-            // Update-or-append (AGL-257): matches the record whose `email`
-            // field equals the payload's email; appends when nothing matches.
-            const datasetsRef = await orgDataCollectionForHost(hostId, 'datasets');
-            const datasetDoc = await resolveDatasetDoc(datasetsRef, step, hostId);
-            if (!(datasetDoc == null ? void 0 : datasetDoc.exists) || datasetDoc.get('deletedAt')) {
-                return failed(`unknown dataset "${step.datasetName || step.datasetId}"`);
-            }
-            const updateDataset = {
-                model: datasetDoc.get('model'),
-                fields: Array.isArray(datasetDoc.get('fields')) ? datasetDoc.get('fields') : []
-            };
-            const updateModel = effectiveDatasetModel(updateDataset);
-            await ensureDeclaredCustomFieldTypes(updateModel);
-            const updateLabel = String(datasetDisplayName({
-                displayName: datasetDoc.get('displayName'),
-                name: datasetDoc.get('name')
-            }) || step.datasetName || step.datasetId || '').slice(0, 60);
-            // Checked before the lookup, as an append: the fields this write
-            // supplies are held to the model whichever leg runs below, and a
-            // refusal costs no read.
-            const incoming = prepareDatasetRecordWrite(updateDataset, payload);
-            // Nothing to merge or append — an error, for the reason the append
-            // branch above gives.
-            if (!incoming.matched.length) {
-                return failed(`no event field matches a field in dataset "${updateLabel}"`);
-            }
-            if (!Object.keys(incoming.values).length) {
-                return failed(`every event field matching dataset "${updateLabel}" is empty`);
-            }
-            const email = String((_payload_email = payload.email) != null ? _payload_email : '').trim();
-            // `records.values` is exempt from indexing, so this lookup is served
-            // only by the `values.email` field override in
-            // cloud/firebase-firestore.indexes.json. Without that override
-            // production refuses the query and neither leg below runs.
-            const existing = email ? await datasetDoc.ref.collection('records').where('values.email', '==', email).limit(1).get() : null;
-            if (existing && !existing.empty) {
-                var _existing_docs__get;
-                // A merge holds only the fields this write sent to the model: a row
-                // stored as text before AGL-2773 is not refused for a legacy value
-                // this run never touched.
-                const write = prepareDatasetRecordWrite(updateDataset, payload, {
-                    existing: (_existing_docs__get = existing.docs[0].get('values')) != null ? _existing_docs__get : {}
-                });
-                if (Object.keys(write.errors).length) {
-                    return failed(`record failed validation for dataset "${updateLabel}": ${describeDatasetRecordErrors(write.errors)}`);
-                }
-                const merged = write.values;
-                await existing.docs[0].ref.set(_extends({
-                    values: merged
-                }, datasetIntegrityUpdate(updateModel, merged, FieldValue.delete()), {
-                    updatedAt: FieldValue.serverTimestamp()
-                }), // `mergeFields`, not `merge: true`: a merge would fold the new
-                // `filterValues` map into the stored one key by key, and a value
-                // cleared here would go on answering its old equality. Each named
-                // field is replaced whole; `merged` already holds every value.
-                {
-                    mergeFields: [
-                        'values',
-                        'referencedIds',
-                        'filterKeys',
-                        'filterValues',
-                        'updatedAt'
-                    ]
-                });
-            } else {
-                // The APPEND leg of update-or-append, and the only one of the two
-                // that adds a row — the merge above rewrites a record that already
-                // counts against the band. A new row is held to the whole model,
-                // required fields included, like any other append.
-                if (Object.keys(incoming.errors).length) {
-                    return failed(`record failed validation for dataset "${updateLabel}": ${describeDatasetRecordErrors(incoming.errors)}`);
-                }
-                const refusal = await datasetAppendRefusal(env, datasetDoc.ref);
-                if (refusal) return failed(refusal);
-                await datasetDoc.ref.collection('records').add(_extends({
-                    values: incoming.values
-                }, datasetIntegrityFields(updateModel, incoming.values), {
-                    createdAt: FieldValue.serverTimestamp()
-                }));
-            }
-            // Both legs changed a row, so both make the same pages stale — an edited
-            // record reads no differently from a new one on a page that lists them.
-            await announceDatasetStepWrite(env, datasetDoc.id);
         } else if (step.type === 'notifyAdmins') {
             var _step_title;
             await notifyHostManagers(hostId, _extends({
@@ -520,7 +335,7 @@ async function datasetAppendRefusal(env, datasetRef) {
                 link: `/${hostId}`
             }));
         } else if (step.type === 'sendEmail') {
-            var _payload_, _ref4, _hostPublicOrigin, _step_topicId, _step_subject, _step_body, _ref5, _run_orgId, _env_org, _env_org1, _screened_releasedReviewId;
+            var _payload_, _ref4, _hostPublicOrigin, _step_topicId, _step_subject, _step_body, _ref5, _run_orgId, _env_org, _env_org1, _payload_contactId, _payload_email, _screened_releasedReviewId;
             var _step_toField, _this;
             const to = String((_payload_ = payload[((_step_toField = step.toField) == null ? void 0 : _step_toField.trim()) || 'email']) != null ? _payload_ : '').trim();
             if (!isEmailConfigured()) return failed('email is not configured');
@@ -634,19 +449,26 @@ async function datasetAppendRefusal(env, datasetRef) {
             }
             const consentGroup = consentGroupForHost((_env_org1 = env.org) != null ? _env_org1 : null, hostId);
             /*
-       * THE TIMELINE ENTRY (AGL-2615). A message addressed to the contact
-       * the event is about is logged on that contact's timeline as an
-       * email activity — the same row the console's own send logs — so an
-       * automated welcome shows beside the calls a rep made, with its
-       * delivery state. Prepared first because the row's id has to be on
-       * the message for the webhook to find it; written only after the
-       * provider accepted. Behind the suite gate like every other CRM
-       * write an action makes.
-       */ const emailActivity = env.crmAllowed ? await prepareCrmEmailActivity({
+       * THE TIMELINE ENTRY (AGL-2615). A message addressed to the person the
+       * event is about is filed on that person's timeline — the same entry a
+       * member's own send files — so an automated welcome shows beside the
+       * calls a rep made, with its delivery state. Whether the message earns
+       * an entry, and where, is the record system's to say: it is offered
+       * the message first, because the entry's tags have to ride the message
+       * for the delivery webhook to find it, and files it only after the
+       * provider accepted. No record system, or a message that earns no
+       * entry, sends untagged.
+       */ const recordEmail = env.orgId ? await preparePluginRecordEmail({
+                orgId: env.orgId,
                 hostId,
-                org: env.org,
-                orgId: env.orgId
-            }, to, payload) : null;
+                to,
+                link: _extends({}, String((_payload_contactId = payload['contactId']) != null ? _payload_contactId : '').trim() ? {
+                    contactId: String(payload['contactId']).trim()
+                } : {}, String((_payload_email = payload['email']) != null ? _payload_email : '').trim() ? {
+                    email: String(payload['email']).trim()
+                } : {}),
+                org: env.org
+            }) : null;
             // In the site's header and footer (AGL-3370): a workflow's email is the
             // site writing to its contact, in words the site owner typed.
             const framed = await renderSiteTextEmail(firebaseAdmin.app().firestore(), hostId, 'workflow-email', {
@@ -661,8 +483,10 @@ async function datasetAppendRefusal(env, datasetRef) {
                 html: framed.html
             } : {}, {
                 sendingIdentity: await hostSendingIdentity(hostId)
-            }, emailActivity ? {
-                tags: emailActivity.tags
+            }, recordEmail ? {
+                tags: [
+                    ...recordEmail.tags
+                ]
             } : {}, {
                 audience: 'tenant',
                 context: enrollmentRef ? 'flow step' : 'event action',
@@ -711,17 +535,12 @@ async function datasetAppendRefusal(env, datasetRef) {
             // cost.
             if (result.sent) {
                 await meterHostEmail(hostId);
-                if (emailActivity) {
-                    await logCrmEmailActivity({
-                        hostId,
-                        org: env.org,
-                        orgId: env.orgId
-                    }, emailActivity, {
-                        subject: emailSubject,
-                        body: emailText,
-                        to
-                    }, run.id);
-                }
+                await (recordEmail == null ? void 0 : recordEmail.file({
+                    subject: emailSubject,
+                    body: emailText,
+                    to,
+                    sourceRef: run.id
+                }));
             }
             if (sendError) return failed(sendError);
         } else if (step.type === 'enrollList') {
@@ -755,12 +574,14 @@ async function datasetAppendRefusal(env, datasetRef) {
                 return failed('no contact email to assign');
             }
             // Scoped to this host (AGL-1039): a site must not reach a contact
-            // it cannot see, even to tag it onto a campaign. Through the org's
-            // address index (AGL-2633), so an address a merge folded into
-            // another record still names the person who now holds it.
-            const { ref: contactsRef } = await orgDataQueryForHost(hostId, 'contacts');
-            const contact = await findContactByEmail(contactsRef, email, {
-                hostId
+            // it cannot see, even to tag it onto a campaign. Asked of the plugin
+            // that keeps people (AGL-3080), whose lookup answers an address a
+            // merge folded into another record (AGL-2633) with the person who now
+            // holds it.
+            const contact = await findPluginPerson({
+                hostId,
+                email,
+                onlyVisibleToSite: true
             });
             if (!contact) return failed(`no contact for ${email}`);
             /*
@@ -808,53 +629,50 @@ async function datasetAppendRefusal(env, datasetRef) {
                 return failed(`campaign "${campaignLabel}" is not placed on this site`);
             }
             /*
-       * INSIDE THIS SITE'S FACET, not at the top of the document.
-       *
-       * A contact is one row shared by every site in the org, and which
-       * campaigns a merchant has filed somebody under is that merchant's
-       * business record on the same footing as their notes and their tags.
-       * Written at the top it would be readable by every other site in an
-       * agency's account.
-       *
-       * `update` with a dotted path, never `set({merge:true})`: a `set`
-       * treats the string as a literal field NAME and would mint a
-       * top-level key with dots in it. The document was just read, so the
-       * update cannot fail for absence.
-       */ const group = await consentGroupForSite(hostId);
-            await contact.ref.update({
-                [contactContainerFieldPath(group.groupId, 'campaign')]: FieldValue.arrayUnion(campaign.id),
-                updatedAt: FieldValue.serverTimestamp()
-            });
-        } else if (isCrmActionStep(step)) {
-            // The plan gate, the way `webhookPost` takes the `webhooks` one:
-            // refused into the run history with the tier that carries it, so
-            // a Free workspace whose flow names a CRM step reads why the step
-            // did nothing rather than a log that says it ran.
-            if (!env.crmAllowed) {
-                return failed(`CRM steps require the ${planLabelGrantingFeature('crm')} plan`);
-            }
-            // The five CRM steps (AGL-2605) share a resolver and a scope, so
-            // they share a module; see `crm-action-steps.ts`.
-            const outcome = await runCrmActionStep({
+       * Filed by the plugin that keeps people, as THIS SITE holds them
+       * (AGL-3080): which campaigns a merchant has filed somebody under is
+       * that merchant's business record, on the same footing as their notes
+       * and their tags, and where it lives on the person is the owner's to
+       * know. A person the owner no longer finds for the site is not filed.
+       */ const filed = await filePluginPersonUnder({
                 hostId,
-                org: env.org,
-                orgId: env.orgId
-            }, run.id, step, payload);
-            if (outcome.error) return failed(outcome.error);
-            detail = outcome.detail;
+                orgId: campaignOrgId,
+                record: {
+                    kind: contact.kind,
+                    id: contact.id
+                },
+                containerKind: 'campaign',
+                ids: [
+                    campaign.id
+                ]
+            });
+            if (!(filed == null ? void 0 : filed.filed)) return failed(`no contact for ${email}`);
+        } else {
             /*
-       * A stage set by an automation IS a stage change, and whatever
-       * listens for one must hear it — fanned out here, under the same
-       * depth guard a `customEvent` chain runs under, rather than through
-       * `emitHostEvent`, which starts every chain at depth zero and would
-       * let an automation that sets the stage it listens for run forever.
-       * Workflows take the guard too, now that a workflow can set a stage.
-       */ if (outcome.emit) {
-                const [fromWorkflows, fromActions] = await Promise.all([
-                    runEventWorkflows(hostId, outcome.emit.event, outcome.emit.payload, depth + 1),
-                    runEventActions(hostId, outcome.emit.event, outcome.emit.payload, depth + 1)
-                ]);
-                alerts.push(...fromActions, ...fromWorkflows);
+       * A STEP ANOTHER PLUGIN RUNS: one that writes that plugin's records,
+       * handed to the executor it registered (`plugin-server-steps`). The
+       * guard, the order, the history and the nesting cap stay here; the
+       * write is the owner's. A declared step whose executor is missing
+       * throws, and is this step's failure. A type nobody runs answers
+       * `null` and reads as done, as an unknown type always has.
+       */ const executor = await pluginServerStepExecutor(step.type);
+            if (executor) {
+                const answer = await executor.run({
+                    hostId,
+                    org: env.org,
+                    orgId: env.orgId,
+                    run: {
+                        kind: run.kind,
+                        id: run.id,
+                        name: run.name
+                    },
+                    event,
+                    payload: payload,
+                    step: step
+                });
+                if (answer.error) return failed(answer.error);
+                detail = answer.detail;
+                if (answer.emit) await raiseEarnedEvent(env, answer.emit);
             }
         }
     } catch (error) {
@@ -1239,12 +1057,9 @@ async function datasetAppendRefusal(env, datasetRef) {
      * this site's own actions exactly as before.
      */ const placed = await findOrgAutomationsForEvent(hostId, event);
         if (!actions.length && !placed) return alerts;
-        const monthKey = new Date().toISOString().slice(0, 7);
-        const runCounterRef = hostRef.collection('counters').doc('actionRuns');
         // Webhook steps take the higher `webhooks` gate (AGL-149); plan gates
         // ride the owning org's doc (AGL-238).
         let webhooksAllowed = true;
-        let crmAllowed = true;
         /*
      * Whether each half fits under the month's allowance — all or nothing per
      * half, as the site's own actions always were.
@@ -1253,25 +1068,32 @@ async function datasetAppendRefusal(env, datasetRef) {
      * were always asked, so an organization placing automations on a site can
      * never be what stops that site's own actions running. The org half is
      * asked second, against what is left after the site's half, and both
-     * count on this site's one meter: an org automation's run is this site's
+     * count on this site's meter: an org automation's run is this site's
      * run, and the usage card, the usage alerts and the COGS rollup read it
      * there.
      */ let runSite = false;
         let runOrg = false;
         // Plan-less orgs resolve as free (AGL-247) — gates always run. Held for
-        // the rest of the run so the dataset caps below cost no second read.
+        // the rest of the run so a step's own plan check costs no second read.
         const owner = await getOrgForHost(hostId);
+        // The band is the WORKSPACE's (AGL-3472): every site's runs count
+        // against it, read off the org's counter — see `run-meter.ts`.
+        const meter = {
+            firestore,
+            hostRef,
+            orgId: owner == null ? void 0 : owner.orgId,
+            counter: 'actionRuns',
+            month: runMonthKey()
+        };
         // A suspended site runs nothing (AGL-3356): see `eventRunSuspension`.
         if (await eventRunSuspension(hostRef, owner == null ? void 0 : owner.org)) return alerts;
         {
-            var _counterSnapshot_get, _ref2;
+            var _ref2;
             const org = owner == null ? void 0 : owner.org;
             if (!checkEntitlement(org, 'actions')) return alerts;
             webhooksAllowed = checkEntitlement(org, 'webhooks');
-            crmAllowed = checkEntitlement(org, 'crm');
             const limit = resolveOrgEntitlements(org).actionRunsPerMonth;
-            const counterSnapshot = await runCounterRef.get();
-            const used = Number((_counterSnapshot_get = counterSnapshot.get(monthKey)) != null ? _counterSnapshot_get : 0);
+            const used = await runsUsedThisMonth(meter);
             // Asked as "would it go over", the question this gate has always
             // asked — so a counter that reads as no number refuses nothing, as
             // before, rather than refusing everything.
@@ -1290,7 +1112,6 @@ async function datasetAppendRefusal(env, datasetRef) {
             // Admitted by the `actions` gate above.
             actionsAllowed: true,
             webhooksAllowed,
-            crmAllowed,
             depth,
             org: (_ref = owner == null ? void 0 : owner.org) != null ? _ref : null,
             orgId: (_ref1 = owner == null ? void 0 : owner.orgId) != null ? _ref1 : null,
@@ -1357,13 +1178,9 @@ async function datasetAppendRefusal(env, datasetRef) {
                 }
             });
         }
-        if (executed > 0) {
-            await runCounterRef.set({
-                [monthKey]: FieldValue.increment(executed)
-            }, {
-                merge: true
-            }).catch(()=>undefined);
-        }
+        await recordRuns(_extends({}, meter, {
+            count: executed
+        }));
     } catch (error) {
         console.error('runEventActions failed', hostId, event, error);
     }
@@ -1416,21 +1233,23 @@ async function datasetAppendRefusal(env, datasetRef) {
         }, payload))) {
             return skipped('conditions');
         }
-        const monthKey = new Date().toISOString().slice(0, 7);
-        const runCounterRef = hostRef.collection('counters').doc('actionRuns');
         let webhooksAllowed = true;
-        let crmAllowed = true;
         // Held for the rest of the run, as in `runEventActions` above.
         const owner = await getOrgForHost(hostId);
+        // The workspace's band, as in `runEventActions` above (AGL-3472).
+        const meter = {
+            firestore,
+            hostRef,
+            orgId: owner == null ? void 0 : owner.orgId,
+            counter: 'actionRuns',
+            month: runMonthKey()
+        };
         {
-            var _counterSnapshot_get;
             const org = owner == null ? void 0 : owner.org;
             if (!checkEntitlement(org, 'actions')) return skipped('plan');
             webhooksAllowed = checkEntitlement(org, 'webhooks');
-            crmAllowed = checkEntitlement(org, 'crm');
             const limit = resolveOrgEntitlements(org).actionRunsPerMonth;
-            const counterSnapshot = await runCounterRef.get();
-            const used = Number((_counterSnapshot_get = counterSnapshot.get(monthKey)) != null ? _counterSnapshot_get : 0);
+            const used = await runsUsedThisMonth(meter);
             if (used + 1 > limit) return skipped('allowance', limit);
         }
         const env = {
@@ -1440,18 +1259,15 @@ async function datasetAppendRefusal(env, datasetRef) {
             // Admitted by the `actions` gate above.
             actionsAllowed: true,
             webhooksAllowed,
-            crmAllowed,
             depth: 0,
             org: (_ref1 = owner == null ? void 0 : owner.org) != null ? _ref1 : null,
             orgId: (_ref2 = owner == null ? void 0 : owner.orgId) != null ? _ref2 : null,
             loadWorkflowContext: makeWorkflowContextLoader(hostRef)
         };
         await executeAction(env, doc.id, action, event, payload);
-        await runCounterRef.set({
-            [monthKey]: FieldValue.increment(1)
-        }, {
-            merge: true
-        }).catch(()=>undefined);
+        await recordRuns(_extends({}, meter, {
+            count: 1
+        }));
         return {
             ran: true,
             skipped: null,
@@ -1550,7 +1366,6 @@ async function datasetAppendRefusal(env, datasetRef) {
         // Admitted by the `actions` gate above.
         actionsAllowed: true,
         webhooksAllowed: checkEntitlement(owner == null ? void 0 : owner.org, 'webhooks'),
-        crmAllowed: checkEntitlement(owner == null ? void 0 : owner.org, 'crm'),
         depth: 0,
         org: (_ref1 = owner == null ? void 0 : owner.org) != null ? _ref1 : null,
         orgId: (_ref2 = owner == null ? void 0 : owner.orgId) != null ? _ref2 : null,
@@ -1585,12 +1400,14 @@ async function datasetAppendRefusal(env, datasetRef) {
    * would abandon somebody half-way through a sequence, which is a capacity
    * limit enforced against a person rather than against the decision that
    * added them. The gate belongs at enrollment, and that is where it is.
-   */ const monthKey = new Date(nowMs).toISOString().slice(0, 7);
-    await hostRef.collection('counters').doc('actionRuns').set({
-        [monthKey]: FieldValue.increment(1)
-    }, {
-        merge: true
-    }).catch(()=>undefined);
+   */ await recordRuns({
+        firestore,
+        hostRef,
+        orgId: owner == null ? void 0 : owner.orgId,
+        counter: 'actionRuns',
+        month: runMonthKey(nowMs),
+        count: 1
+    });
     return ending;
 }
 /** How long a deferred enrollment waits before the next attempt. */ export const FLOW_CLAIM_RETRY_MS = 15 * 60000;