@aglyn/plugins-workflows 1.0.0-beta.221 → 1.0.0-beta.223

package/src/lib/engine/run-event-actions.js

@@ -14,15 +14,16 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { ACTION_MAX_STEPS, checkEntitlement, consentGroupForHost, planLabelGrantingFeature, checkQuota, evaluateExpression, evaluateStepGuard, evaluateTriggerConditions, FLOW_TIMED_OUT_FIELD, flowSubscriptionTopicId, hostPublicOrigin, isClientActionStep, isFlowSuspendingStep, datasetDisplayName, describeDatasetRecordErrors, contactContainerFieldPath, datasetIntegrityFields, datasetIntegrityUpdate, effectiveDatasetModel, ensureDeclaredCustomFieldTypes, normalizeTriggerConditions, prepareDatasetRecordWrite, resolveOrgEntitlements } from "@aglyn/aglyn/server";
+ */ import { ACTION_MAX_STEPS, ACTIONS_MAX_PER_HOST, checkEntitlement, consentGroupForHost, planLabelGrantingFeature, evaluateExpression, evaluateStepGuard, evaluateTriggerConditions, flowSubscriptionTopicId, hostPublicOrigin, isClientActionStep, normalizeTriggerConditions, resolveOrgEntitlements } from "@aglyn/aglyn/server";
 import { isDeferrableSendResult, isEmailConfigured, sendEmail, sendFailureReason } from "@aglyn/shared-util-email";
-import { dataStorageRefusal, enrollListMember, firebaseAdmin, flowEmailRefusal, getOrgForHost, hostSendingIdentity, meterHostEmail, notifyHostManagers, consentGroupForSite, orgDataCollectionForHost, orgDataQueryForHost, resolveOrgIdForHost } from "@aglyn/tenant-data-admin";
-import { announceDatasetRecordChange } from "@aglyn/tenant-data-admin/server/dataset-live-pages";
+import { enrollListMember, filterSendableForHost, firebaseAdmin, flowEmailRefusal, getOrgForHost, hostDisplayName, hostSendingIdentity, meterHostEmail, notifyHostManagers, consentGroupForSite, resolveOrgIdForHost } from "@aglyn/tenant-data-admin";
 import { activitySearchTokens } from "@aglyn/aglyn/app-utils/activity-search";
 import { visibleToHost } from "@aglyn/aglyn/app-utils/scope-tokens";
-// The leaf, not the barrel: this library's specs substitute the barrel
-// wholesale, and the lookup must reach the real index logic under them.
-import { findContactByEmail } from "@aglyn/tenant-data-admin/server/contact-email-index";
+import { triggerFilterProblem } from "@aglyn/aglyn/app-utils/site-interactions";
+// The person behind an address, and their filing under a campaign, through
+// the plugin that keeps people (AGL-3080): the engine opens none of its
+// collections.
+import { filePluginPersonUnder, findPluginPerson } from "@aglyn/aglyn/plugin-manager/plugin-person-records";
 import { findOrgContainersByName, readOrgContainers } from "@aglyn/tenant-data-admin/server/org-containers";
 // The leaf again, for the phishing screen's hold (AGL-3356): the control
 // that stops a send must be the real one under a spec that mocks the barrel.
@@ -35,9 +36,10 @@ import { ACTION_MAX_EVENT_DEPTH, runWorkflow, WORKFLOW_MAX_STEPS } from "../mode
 import { describeStepOutcome } from "../model/step-outcomes.js";
 import { WEBHOOK_URL_PATTERN } from "../model/webhooks.js";
 import { eventRunSuspension } from "./site-suspension.js";
+import { triggeredDocsForEvent } from "./triggered-docs.js";
+import { resolveStepEmailMerge, stepEmailMergeContext } from "./email-merge.js";
+import { recordRuns, runMonthKey, runsUsedThisMonth } from "./run-meter.js";
 import { advanceFlowEnrollment, claimFlowEnrollment, deferFlowEnrollment, endFlowEnrollment, enrollInFlow, findFlowEnrollmentsAwaiting, sweepDueFlowEnrollments } from "./flow-enrollments.js";
-import { isCrmActionStep, logCrmEmailActivity, prepareCrmEmailActivity, runCrmActionStep } from "./crm-action-steps.js";
-import { resolveDatasetDoc } from "@aglyn/tenant-runtime/resolve-dataset";
 import { resumeWorkflowEnrollment, runEventWorkflows } from "./run-event-workflows.js";
 import { ORG_AUTOMATION_RUN_TARGET, orgAutomationStepRefusal } from "../model/org-automations.js";
 import { findOrgAutomationsForEvent, resumeOrgAutomationEnrollment } from "./run-org-automations.js";
@@ -45,7 +47,20 @@ import { isWorkflowActionStep, workflowActionStepRefusal, workflowHasActionSteps
 import { runTriggeredByFields } from "./run-trigger-actor.js";
 // By path, not the barrel: only a server run asks.
 import { pluginServerStepExecutor } from "@aglyn/aglyn/plugin-manager/plugin-server-steps";
-/** Bounded fan-out per event, mirroring the workflow runner. */ const MAX_TRIGGERED_ACTIONS = 10;
+import { preparePluginRecordEmail } from "@aglyn/aglyn/plugin-manager/plugin-record-timeline";
+import { FLOW_TIMED_OUT_FIELD, isFlowSuspendingStep, sendEmailIsTransactionalReply } from "../model/host-actions.js";
+/**
+ * Every live, switched-on action a site holds for an event runs, in
+ * document-id order (AGL-3458) — up to the most live actions a site may hold
+ * at all, so no matching action is ever left out. See `triggered-docs.ts`.
+ */ const MAX_TRIGGERED_ACTIONS = ACTIONS_MAX_PER_HOST;
+/** The live, switched-on actions a site holds for `event`, in document-id order. */ export function liveActionsForEvent(hostRef, event) {
+    return triggeredDocsForEvent(hostRef.collection('actions'), event, {
+        keep: (doc)=>!doc.get('deletedAt') && doc.get('enabled') !== false,
+        max: MAX_TRIGGERED_ACTIONS,
+        maxReads: MAX_TRIGGERED_ACTIONS * 4
+    });
+}
 /**
  * The run environment for one automation run: the org's plan gates resolved
  * once, from the org document the caller already read.
@@ -59,7 +74,6 @@ import { pluginServerStepExecutor } from "@aglyn/aglyn/plugin-manager/plugin-ser
         alerts: (_input_alerts = input.alerts) != null ? _input_alerts : [],
         actionsAllowed: checkEntitlement(org, 'actions'),
         webhooksAllowed: checkEntitlement(org, 'webhooks'),
-        crmAllowed: checkEntitlement(org, 'crm'),
         depth: input.depth,
         org,
         orgId: (_ref1 = (_input_owner1 = input.owner) == null ? void 0 : _input_owner1.orgId) != null ? _ref1 : null,
@@ -113,76 +127,6 @@ export function makeWorkflowContextLoader(hostRef) {
         workflows
     };
 }
-/**
- * Whether this dataset may take ANOTHER record, on the plan of the org that
- * owns the site — the row band and the byte band, in that order. Null when
- * the append may proceed; a reason string when it may not.
- *
- * ## Why an append needs a gate at all
- *
- * Every other door onto `datasets/{id}/records` already has one: the console
- * route re-checks `recordsPerDataset` inside the creating transaction, the
- * `/v1` record route checks it below its idempotency claim, and the public
- * form-submission leg checks the rows and the bytes. A workflow step wrote
- * with no check of either — and it is the door a visitor drives hardest,
- * because an action fires per event on a published site. A cap enforced at
- * three of four doors is not a cap; it is the shape of the one that is left.
- *
- * ## What it does NOT do
- *
- * It refuses the WRITE, never the dataset. A dataset already holding more
- * rows than the plan includes keeps every row it has and keeps being read —
- * nothing here deletes, truncates, or hides anything, and nothing may be
- * added that does. What is refused is the next row, which is the same
- * boundary the other three doors draw, and the reason a plan change cannot
- * cost a customer data they already have.
- *
- * The update leg of `updateDataset` is deliberately NOT gated: merging fields
- * into a record that already exists adds no row, so refusing it would refuse
- * the state of being over rather than the raise.
- *
- * ## What it costs
- *
- * Nothing on the plans that sell the data store. The row count is read only
- * when `recordsPerDataset` is FINITE, so an uncapped plan pays nothing; and
- * `dataStorageRefusal` answers null with no read at all whenever the plan
- * carries an `extraDataGbMonthlyUsd` rate, which every metered plan does. The
- * reads are paid on the shapes that can actually refuse.
- */ /**
- * Refresh the live pages showing the dataset this step just wrote to
- * (AGL-3113).
- *
- * An automation that appends a row is the same change to a visitor as a form
- * submission or a console edit: the pages repeating over the dataset go on
- * serving the rows they were built from. Announced from the step rather than
- * from the run, so a workflow whose steps write two different datasets
- * refreshes both — the announce coalesces repeats of the SAME dataset itself,
- * which is what a run hitting one dataset several times needs.
- *
- * Silent without an org: datasets are org-scoped, so a host with no resolvable
- * org has no dataset to have written to. Best effort, and never thrown: the
- * row is already stored.
- */ async function announceDatasetStepWrite(env, datasetId) {
-    if (!env.orgId) return;
-    await announceDatasetRecordChange({
-        firestore: firebaseAdmin.app().firestore(),
-        orgId: env.orgId,
-        datasetId
-    });
-}
-async function datasetAppendRefusal(env, datasetRef) {
-    const limit = resolveOrgEntitlements(env.org).recordsPerDataset;
-    if (Number.isFinite(limit)) {
-        const used = (await datasetRef.collection('records').count().get()).data().count;
-        if (!checkQuota(env.org, 'recordsPerDataset', used).allowed) {
-            return `dataset is full (${limit} records on this plan)`;
-        }
-    }
-    if (!env.orgId) return null;
-    const bytes = await dataStorageRefusal(env.org, firebaseAdmin.app().firestore().collection('orgs').doc(env.orgId));
-    if (!bytes) return null;
-    return `dataset storage is full (${bytes.includedMb} MB on this plan)`;
-}
 /**
  * Folds one step's verdict into its run's tally, in the run-history phrasing
  * every automation shares; true when the run stops at this step.
@@ -234,7 +178,7 @@ async function datasetAppendRefusal(env, datasetRef) {
  *
  * An action's step list runs through it one step at a time, and so does
  * every Actions step inside a workflow — so the two engines cannot disagree
- * about what `sendEmail` or `datasetAppend` does, what a step is gated on, or
+ * about what `sendEmail` or `webhookPost` does, what a step is gated on, or
  * how its outcome reads in the run history. There is no second copy of any
  * branch below.
  *
@@ -246,8 +190,8 @@ async function datasetAppendRefusal(env, datasetRef) {
     const { hostId, hostRef, alerts, depth } = env;
     const { event, payload, enrollmentRef } = context;
     /**
-   * The one fact worth carrying into the summary — the dataset's name,
-   * the webhook's status. Set by the branch that knows it.
+   * The one fact worth carrying into the summary — the webhook's status, or
+   * whatever a plugin's step answers. Set by the branch that knows it.
    */ let detail;
     const failed = (error)=>({
             kind: 'failed',
@@ -394,140 +338,6 @@ async function datasetAppendRefusal(env, datasetRef) {
             // until AGL-2171. A 200 and a 204 are both `ok`, and knowing which is
             // the whole reason anyone opens a run history after a webhook.
             detail = String(lastStatus != null ? lastStatus : '');
-        } else if (step.type === 'datasetAppend') {
-            // Id-first lookup (AGL-261/556); the name query is the legacy path.
-            const datasetsRef = await orgDataCollectionForHost(hostId, 'datasets');
-            const datasetDoc = await resolveDatasetDoc(datasetsRef, step, hostId);
-            if (!(datasetDoc == null ? void 0 : datasetDoc.exists) || datasetDoc.get('deletedAt')) {
-                return failed(`unknown dataset "${step.datasetName || step.datasetId}"`);
-            }
-            // Restrict to the model's field ids (AGL-556) — covers model-only
-            // datasets whose flat v1 `fields` mirror is absent.
-            const appendDataset = {
-                model: datasetDoc.get('model'),
-                fields: Array.isArray(datasetDoc.get('fields')) ? datasetDoc.get('fields') : []
-            };
-            const appendModel = effectiveDatasetModel(appendDataset);
-            // A plugin's field validator runs only once its plugin registered it.
-            await ensureDeclaredCustomFieldTypes(appendModel);
-            const write = prepareDatasetRecordWrite(appendDataset, payload);
-            const values = write.values;
-            // Same name precedence `findDatasetByName` resolves in.
-            const appendLabel = (datasetDisplayName({
-                displayName: datasetDoc.get('displayName'),
-                name: datasetDoc.get('name')
-            }) || step.datasetName || '').slice(0, 60);
-            // No event field matched a field of the dataset, so there is nothing
-            // to write. An error rather than a quiet success: a run history that
-            // says `saved to Leads` while nothing saves is how a mismatched field
-            // name goes unnoticed.
-            if (!write.matched.length) {
-                return failed(`no event field matches a field in dataset "${appendLabel || step.datasetId}"`);
-            }
-            // Held to the model like every other record write (AGL-2773): a value
-            // its field cannot hold refuses the whole record, and the run says
-            // which field and why instead of `saved to Leads`.
-            if (Object.keys(write.errors).length) {
-                return failed(`record failed validation for dataset "${appendLabel || step.datasetId}": ${describeDatasetRecordErrors(write.errors)}`);
-            }
-            if (!Object.keys(values).length) {
-                return failed(`every event field matching dataset "${appendLabel || step.datasetId}" is empty`);
-            }
-            const refusal = await datasetAppendRefusal(env, datasetDoc.ref);
-            if (refusal) return failed(refusal);
-            await datasetDoc.ref.collection('records').add(_extends({
-                values
-            }, datasetIntegrityFields(appendModel, values), {
-                createdAt: FieldValue.serverTimestamp()
-            }));
-            await announceDatasetStepWrite(env, datasetDoc.id);
-            // `saved to Leads` beats `saved to dataset` (AGL-2171).
-            detail = appendLabel;
-        } else if (step.type === 'updateDataset') {
-            var _payload_email;
-            // Update-or-append (AGL-257): matches the record whose `email`
-            // field equals the payload's email; appends when nothing matches.
-            const datasetsRef = await orgDataCollectionForHost(hostId, 'datasets');
-            const datasetDoc = await resolveDatasetDoc(datasetsRef, step, hostId);
-            if (!(datasetDoc == null ? void 0 : datasetDoc.exists) || datasetDoc.get('deletedAt')) {
-                return failed(`unknown dataset "${step.datasetName || step.datasetId}"`);
-            }
-            const updateDataset = {
-                model: datasetDoc.get('model'),
-                fields: Array.isArray(datasetDoc.get('fields')) ? datasetDoc.get('fields') : []
-            };
-            const updateModel = effectiveDatasetModel(updateDataset);
-            await ensureDeclaredCustomFieldTypes(updateModel);
-            const updateLabel = String(datasetDisplayName({
-                displayName: datasetDoc.get('displayName'),
-                name: datasetDoc.get('name')
-            }) || step.datasetName || step.datasetId || '').slice(0, 60);
-            // Checked before the lookup, as an append: the fields this write
-            // supplies are held to the model whichever leg runs below, and a
-            // refusal costs no read.
-            const incoming = prepareDatasetRecordWrite(updateDataset, payload);
-            // Nothing to merge or append — an error, for the reason the append
-            // branch above gives.
-            if (!incoming.matched.length) {
-                return failed(`no event field matches a field in dataset "${updateLabel}"`);
-            }
-            if (!Object.keys(incoming.values).length) {
-                return failed(`every event field matching dataset "${updateLabel}" is empty`);
-            }
-            const email = String((_payload_email = payload.email) != null ? _payload_email : '').trim();
-            // `records.values` is exempt from indexing, so this lookup is served
-            // only by the `values.email` field override in
-            // cloud/firebase-firestore.indexes.json. Without that override
-            // production refuses the query and neither leg below runs.
-            const existing = email ? await datasetDoc.ref.collection('records').where('values.email', '==', email).limit(1).get() : null;
-            if (existing && !existing.empty) {
-                var _existing_docs__get;
-                // A merge holds only the fields this write sent to the model: a row
-                // stored as text before AGL-2773 is not refused for a legacy value
-                // this run never touched.
-                const write = prepareDatasetRecordWrite(updateDataset, payload, {
-                    existing: (_existing_docs__get = existing.docs[0].get('values')) != null ? _existing_docs__get : {}
-                });
-                if (Object.keys(write.errors).length) {
-                    return failed(`record failed validation for dataset "${updateLabel}": ${describeDatasetRecordErrors(write.errors)}`);
-                }
-                const merged = write.values;
-                await existing.docs[0].ref.set(_extends({
-                    values: merged
-                }, datasetIntegrityUpdate(updateModel, merged, FieldValue.delete()), {
-                    updatedAt: FieldValue.serverTimestamp()
-                }), // `mergeFields`, not `merge: true`: a merge would fold the new
-                // `filterValues` map into the stored one key by key, and a value
-                // cleared here would go on answering its old equality. Each named
-                // field is replaced whole; `merged` already holds every value.
-                {
-                    mergeFields: [
-                        'values',
-                        'referencedIds',
-                        'filterKeys',
-                        'filterValues',
-                        'updatedAt'
-                    ]
-                });
-            } else {
-                // The APPEND leg of update-or-append, and the only one of the two
-                // that adds a row — the merge above rewrites a record that already
-                // counts against the band. A new row is held to the whole model,
-                // required fields included, like any other append.
-                if (Object.keys(incoming.errors).length) {
-                    return failed(`record failed validation for dataset "${updateLabel}": ${describeDatasetRecordErrors(incoming.errors)}`);
-                }
-                const refusal = await datasetAppendRefusal(env, datasetDoc.ref);
-                if (refusal) return failed(refusal);
-                await datasetDoc.ref.collection('records').add(_extends({
-                    values: incoming.values
-                }, datasetIntegrityFields(updateModel, incoming.values), {
-                    createdAt: FieldValue.serverTimestamp()
-                }));
-            }
-            // Both legs changed a row, so both make the same pages stale — an edited
-            // record reads no differently from a new one on a page that lists them.
-            await announceDatasetStepWrite(env, datasetDoc.id);
         } else if (step.type === 'notifyAdmins') {
             var _step_title;
             await notifyHostManagers(hostId, _extends({
@@ -539,7 +349,7 @@ async function datasetAppendRefusal(env, datasetRef) {
                 link: `/${hostId}`
             }));
         } else if (step.type === 'sendEmail') {
-            var _payload_, _ref4, _hostPublicOrigin, _step_topicId, _step_subject, _step_body, _ref5, _run_orgId, _env_org, _env_org1, _screened_releasedReviewId;
+            var _payload_, _ref4, _hostPublicOrigin, _env_org, _step_subject, _step_body, _payload_email, _ref5, _payload_name, _ref6, _run_orgId, _env_org1, _payload_contactId, _payload_email1, _screened_releasedReviewId;
             var _step_toField, _this;
             const to = String((_payload_ = payload[((_step_toField = step.toField) == null ? void 0 : _step_toField.trim()) || 'email']) != null ? _payload_ : '').trim();
             if (!isEmailConfigured()) return failed('email is not configured');
@@ -553,13 +363,14 @@ async function datasetAppendRefusal(env, datasetRef) {
             const hostData = (_ref4 = (_this = await hostRef.get().catch(()=>null)) == null ? void 0 : _this.data()) != null ? _ref4 : null;
             const siteBase = (_hostPublicOrigin = hostPublicOrigin(hostData)) != null ? _hostPublicOrigin : '';
             /*
-       * MARKETING. The subject and body are merchant-authored and the
-       * recipient comes out of the event payload — which, for the collect
-       * route, is a write triggered by an anonymous visitor. So this is a
-       * site mailing an address on the merchant's say-so, and it owes what
-       * every other such message owes: the unsubscribe header pair and a
-       * visible link, both suppression lists, and a share of the ceiling on
-       * how much one person receives from this site.
+       * MARKETING, unless it is a transactional reply (below). The subject
+       * and body are merchant-authored and the recipient comes out of the
+       * event payload — which, for the collect route, is a write triggered
+       * by an anonymous visitor. So a step that is not a reply is a site
+       * mailing an address on the merchant's say-so, and it owes what every
+       * other such message owes: the unsubscribe header pair and a visible
+       * link, both suppression lists, and a share of the ceiling on how much
+       * one person receives from this site.
        *
        * Priority stays transactional. An action run is not resumable — the
        * event has already happened and there is no beat that comes back for
@@ -597,27 +408,74 @@ async function datasetAppendRefusal(env, datasetRef) {
        * enrollment moves on rather than retrying.
        */ const scope = enrollmentRef ? 'scheduled' : 'immediate';
             /*
+       * A TRANSACTIONAL REPLY (AGL-3458) — the answer to what the recipient
+       * just did: the run started on their own form submission, booking or
+       * sign-up, this step runs at once, names no topic, and goes to the
+       * address the event carries. Such a message is not a mailing, so it
+       * leaves with no unsubscribe header and no unsubscribe link, and asks
+       * no marketing-consent question — the reply the Inbox sends to a
+       * submission is the same kind of message, and CAN-SPAM exempts both.
+       * What it keeps is the suppression check below: a hard bounce, a spam
+       * complaint or a person who asked this site to stop is not mailed by
+       * anything. The author can switch a qualifying step back to a mailing
+       * (`transactional: false`); a step that does not qualify is a mailing
+       * whatever it says.
+       */ const transactional = sendEmailIsTransactionalReply(step, {
+                event,
+                afterWait: Boolean(enrollmentRef)
+            });
+            /*
        * The stream this message belongs to, resolved ONCE and read twice:
        * the gate below filters on it, and it rides the `marketing` context
        * so the opt-out link the seam mints names it. Without that the
        * preference page opens on a list of every stream the site has, and
        * the recipient has to find the one they were trying to leave.
        */ const topicId = flowSubscriptionTopicId(step.topicId, scope);
-            const gate = await flowEmailRefusal({
+            const consentGroup = consentGroupForHost((_env_org = env.org) != null ? _env_org : null, hostId);
+            if (transactional) {
+                // Both suppression lists — the platform's bounces and complaints, and
+                // this site's (and its consent group's) opt-outs — fail CLOSED.
+                const sendable = await filterSendableForHost(hostId, [
+                    to
+                ], undefined, consentGroup);
+                if (!sendable.length) return failed('the recipient is unsubscribed or suppressed');
+            } else {
+                var _step_topicId;
+                const gate = await flowEmailRefusal({
+                    hostId,
+                    email: to,
+                    topicId: (_step_topicId = step.topicId) != null ? _step_topicId : null,
+                    org: env.org,
+                    scope
+                });
+                if (gate) {
+                    return failed(gate !== 'consent-withheld' ? 'the recipient has left this email topic' : // only on a stated refusal, so reporting it as a missing
+                    // record would send a merchant looking for a consent field to
+                    // fill in that would change nothing.
+                    enrollmentRef ? 'the recipient has no marketing consent record on this site' : 'the recipient has declined marketing from this site');
+                }
+            }
+            /*
+       * THE WORDS AS AUTHORED, and as sent (AGL-3458). The merge tags — the
+       * campaign's `{{firstName|there}}` and the CRM's `{{contact.firstName}}`
+       * — are filled from the contact or the lead the run is about, else from
+       * the name and address the event carried. The phishing screen below
+       * reads the AUTHORED words: it judges what the business wrote, once per
+       * automation, not one copy per recipient.
+       */ const authoredSubject = String((_step_subject = step.subject) != null ? _step_subject : '').slice(0, 200);
+            const authoredText = String((_step_body = step.body) != null ? _step_body : '').slice(0, 5000);
+            const mergeContext = await stepEmailMergeContext({
                 hostId,
-                email: to,
-                topicId: (_step_topicId = step.topicId) != null ? _step_topicId : null,
-                org: env.org,
-                scope
+                email: String((_payload_email = payload['email']) != null ? _payload_email : '').trim() || to,
+                contactGroupId: consentGroup.groupId,
+                siteName: hostDisplayName(hostData != null ? hostData : undefined, hostId)
             });
-            if (gate) {
-                return failed(gate !== 'consent-withheld' ? 'the recipient has left this email topic' : // only on a stated refusal, so reporting it as a missing
-                // record would send a merchant looking for a consent field to
-                // fill in that would change nothing.
-                enrollmentRef ? 'the recipient has no marketing consent record on this site' : 'the recipient has declined marketing from this site');
-            }
-            const emailSubject = String((_step_subject = step.subject) != null ? _step_subject : '').slice(0, 200);
-            const emailText = String((_step_body = step.body) != null ? _step_body : '').slice(0, 5000);
+            const mergePerson = {
+                email: to,
+                name: String((_ref5 = (_payload_name = payload['name']) != null ? _payload_name : payload['fullName']) != null ? _ref5 : '').trim()
+            };
+            const emailSubject = resolveStepEmailMerge(authoredSubject, mergeContext, mergePerson).text.replace(/[\r\n]+/g, ' ').slice(0, 200);
+            const emailText = resolveStepEmailMerge(authoredText, mergeContext, mergePerson).text.slice(0, 5000);
             /*
        * THE PHISHING SCREEN, for a workspace in its first fortnight
        * (AGL-3356). The incident's second message was exactly this step: a
@@ -632,14 +490,14 @@ async function datasetAppendRefusal(env, datasetRef) {
        * once released. See `outbound-send-review.ts`.
        */ const screened = await screenOutboundSend({
                 kind: run.kind,
-                path: run.kind === 'orgAutomation' ? `orgs/${(_ref5 = (_run_orgId = run.orgId) != null ? _run_orgId : env.orgId) != null ? _ref5 : ''}/automations/${run.id}` : `hosts/${hostId}/${run.kind === 'workflow' ? 'workflows' : 'actions'}/${run.id}`,
+                path: run.kind === 'orgAutomation' ? `orgs/${(_ref6 = (_run_orgId = run.orgId) != null ? _run_orgId : env.orgId) != null ? _ref6 : ''}/automations/${run.id}` : `hosts/${hostId}/${run.kind === 'workflow' ? 'workflows' : 'actions'}/${run.id}`,
                 hostId,
                 orgId: env.orgId,
-                org: (_env_org = env.org) != null ? _env_org : null,
+                org: (_env_org1 = env.org) != null ? _env_org1 : null,
                 host: hostData,
-                subject: emailSubject,
+                subject: authoredSubject,
                 bodies: [
-                    emailText
+                    authoredText
                 ]
             });
             if (screened.outcome === 'rejected') {
@@ -651,21 +509,27 @@ async function datasetAppendRefusal(env, datasetRef) {
                 };
                 return failed('this email is held for staff review because it may impersonate ' + `another business (${screened.reference})`);
             }
-            const consentGroup = consentGroupForHost((_env_org1 = env.org) != null ? _env_org1 : null, hostId);
             /*
-       * THE TIMELINE ENTRY (AGL-2615). A message addressed to the contact
-       * the event is about is logged on that contact's timeline as an
-       * email activity — the same row the console's own send logs — so an
-       * automated welcome shows beside the calls a rep made, with its
-       * delivery state. Prepared first because the row's id has to be on
-       * the message for the webhook to find it; written only after the
-       * provider accepted. Behind the suite gate like every other CRM
-       * write an action makes.
-       */ const emailActivity = env.crmAllowed ? await prepareCrmEmailActivity({
+       * THE TIMELINE ENTRY (AGL-2615). A message addressed to the person the
+       * event is about is filed on that person's timeline — the same entry a
+       * member's own send files — so an automated welcome shows beside the
+       * calls a rep made, with its delivery state. Whether the message earns
+       * an entry, and where, is the record system's to say: it is offered
+       * the message first, because the entry's tags have to ride the message
+       * for the delivery webhook to find it, and files it only after the
+       * provider accepted. No record system, or a message that earns no
+       * entry, sends untagged.
+       */ const recordEmail = env.orgId ? await preparePluginRecordEmail({
+                orgId: env.orgId,
                 hostId,
-                org: env.org,
-                orgId: env.orgId
-            }, to, payload) : null;
+                to,
+                link: _extends({}, String((_payload_contactId = payload['contactId']) != null ? _payload_contactId : '').trim() ? {
+                    contactId: String(payload['contactId']).trim()
+                } : {}, String((_payload_email1 = payload['email']) != null ? _payload_email1 : '').trim() ? {
+                    email: String(payload['email']).trim()
+                } : {}),
+                org: env.org
+            }) : null;
             // In the site's header and footer (AGL-3370): a workflow's email is the
             // site writing to its contact, in words the site owner typed.
             const framed = await renderSiteTextEmail(firebaseAdmin.app().firestore(), hostId, 'workflow-email', {
@@ -680,8 +544,10 @@ async function datasetAppendRefusal(env, datasetRef) {
                 html: framed.html
             } : {}, {
                 sendingIdentity: await hostSendingIdentity(hostId)
-            }, emailActivity ? {
-                tags: emailActivity.tags
+            }, recordEmail ? {
+                tags: [
+                    ...recordEmail.tags
+                ]
             } : {}, {
                 audience: 'tenant',
                 context: enrollmentRef ? 'flow step' : 'event action',
@@ -690,13 +556,7 @@ async function datasetAppendRefusal(env, datasetRef) {
                 releasedReviewId: screened.outcome === 'send' ? (_screened_releasedReviewId = screened.releasedReviewId) != null ? _screened_releasedReviewId : null : null
             }, enrollmentRef ? {
                 priority: 'bulk'
-            } : {}, {
-                // `topicId` is `''` for a step that belongs to no stream, which
-                // every reader of it treats as absent — see `flowSubscriptionTopicId`.
-                // The consent group comes off the org the run already holds, so the
-                // gate honors an unsubscribe from any site of a declared group —
-                // the sender this site mails as — and the org's confirmation switch,
-                // at no extra read.
+            } : {}, transactional ? {} : {
                 marketing: {
                     hostId,
                     siteBase,
@@ -730,29 +590,24 @@ async function datasetAppendRefusal(env, datasetRef) {
             // cost.
             if (result.sent) {
                 await meterHostEmail(hostId);
-                if (emailActivity) {
-                    await logCrmEmailActivity({
-                        hostId,
-                        org: env.org,
-                        orgId: env.orgId
-                    }, emailActivity, {
-                        subject: emailSubject,
-                        body: emailText,
-                        to
-                    }, run.id);
-                }
+                await (recordEmail == null ? void 0 : recordEmail.file({
+                    subject: emailSubject,
+                    body: emailText,
+                    to,
+                    sourceRef: run.id
+                }));
             }
             if (sendError) return failed(sendError);
         } else if (step.type === 'enrollList') {
-            var _payload_email1, _ref6;
+            var _payload_email2, _ref7;
             var _step_listId, _step_listName;
             const orgId = await resolveOrgIdForHost(hostId);
-            const email = String((_payload_email1 = payload.email) != null ? _payload_email1 : '').trim().toLowerCase();
+            const email = String((_payload_email2 = payload.email) != null ? _payload_email2 : '').trim().toLowerCase();
             if (!orgId || !email || !email.includes('@')) {
                 return failed('no email to enroll');
             }
             const listsRef = firebaseAdmin.app().firestore().collection('orgs').doc(orgId).collection('lists');
-            const listDoc = ((_step_listId = step.listId) == null ? void 0 : _step_listId.trim()) ? await listsRef.doc(step.listId.trim()).get() : (await listsRef.where('name', '==', (_ref6 = (_step_listName = step.listName) == null ? void 0 : _step_listName.trim()) != null ? _ref6 : '').limit(1).get()).docs[0];
+            const listDoc = ((_step_listId = step.listId) == null ? void 0 : _step_listId.trim()) ? await listsRef.doc(step.listId.trim()).get() : (await listsRef.where('name', '==', (_ref7 = (_step_listName = step.listName) == null ? void 0 : _step_listName.trim()) != null ? _ref7 : '').limit(1).get()).docs[0];
             if (!(listDoc == null ? void 0 : listDoc.exists)) {
                 return failed(`unknown list "${step.listName || step.listId}"`);
             }
@@ -767,19 +622,21 @@ async function datasetAppendRefusal(env, datasetRef) {
                 source: `${run.kind}:${run.id}`
             });
         } else if (step.type === 'assignCampaign') {
-            var _payload_email2, _env_orgId, _ref7, _ref8;
+            var _payload_email3, _env_orgId, _ref8, _ref9;
             var _step_campaignId, _step_campaignName;
-            const email = String((_payload_email2 = payload.email) != null ? _payload_email2 : '').trim().toLowerCase();
+            const email = String((_payload_email3 = payload.email) != null ? _payload_email3 : '').trim().toLowerCase();
             if (!email || !email.includes('@')) {
                 return failed('no contact email to assign');
             }
             // Scoped to this host (AGL-1039): a site must not reach a contact
-            // it cannot see, even to tag it onto a campaign. Through the org's
-            // address index (AGL-2633), so an address a merge folded into
-            // another record still names the person who now holds it.
-            const { ref: contactsRef } = await orgDataQueryForHost(hostId, 'contacts');
-            const contact = await findContactByEmail(contactsRef, email, {
-                hostId
+            // it cannot see, even to tag it onto a campaign. Asked of the plugin
+            // that keeps people (AGL-3080), whose lookup answers an address a
+            // merge folded into another record (AGL-2633) with the person who now
+            // holds it.
+            const contact = await findPluginPerson({
+                hostId,
+                email,
+                onlyVisibleToSite: true
             });
             if (!contact) return failed(`no contact for ${email}`);
             /*
@@ -813,10 +670,10 @@ async function datasetAppendRefusal(env, datasetRef) {
             // declaration says they are stored.
             const containerStore = firebaseAdmin.app().firestore();
             const usable = (container)=>Boolean((container == null ? void 0 : container.live) && visibleToHost(container.visibleTo, hostId));
-            const namedId = (_ref7 = (_step_campaignId = step.campaignId) == null ? void 0 : _step_campaignId.trim()) != null ? _ref7 : '';
+            const namedId = (_ref8 = (_step_campaignId = step.campaignId) == null ? void 0 : _step_campaignId.trim()) != null ? _ref8 : '';
             const campaign = namedId ? (await readOrgContainers(containerStore, 'campaign', campaignOrgId, [
                 namedId
-            ]))[0] : (await findOrgContainersByName(containerStore, 'campaign', campaignOrgId, (_ref8 = (_step_campaignName = step.campaignName) == null ? void 0 : _step_campaignName.trim()) != null ? _ref8 : '', 10)).find(usable);
+            ]))[0] : (await findOrgContainersByName(containerStore, 'campaign', campaignOrgId, (_ref9 = (_step_campaignName = step.campaignName) == null ? void 0 : _step_campaignName.trim()) != null ? _ref9 : '', 10)).find(usable);
             if (!(campaign == null ? void 0 : campaign.exists)) {
                 return failed(`unknown campaign "${campaignLabel}"`);
             }
@@ -827,42 +684,24 @@ async function datasetAppendRefusal(env, datasetRef) {
                 return failed(`campaign "${campaignLabel}" is not placed on this site`);
             }
             /*
-       * INSIDE THIS SITE'S FACET, not at the top of the document.
-       *
-       * A contact is one row shared by every site in the org, and which
-       * campaigns a merchant has filed somebody under is that merchant's
-       * business record on the same footing as their notes and their tags.
-       * Written at the top it would be readable by every other site in an
-       * agency's account.
-       *
-       * `update` with a dotted path, never `set({merge:true})`: a `set`
-       * treats the string as a literal field NAME and would mint a
-       * top-level key with dots in it. The document was just read, so the
-       * update cannot fail for absence.
-       */ const group = await consentGroupForSite(hostId);
-            await contact.ref.update({
-                [contactContainerFieldPath(group.groupId, 'campaign')]: FieldValue.arrayUnion(campaign.id),
-                updatedAt: FieldValue.serverTimestamp()
-            });
-        } else if (isCrmActionStep(step)) {
-            // The plan gate, the way `webhookPost` takes the `webhooks` one:
-            // refused into the run history with the tier that carries it, so
-            // a Free workspace whose flow names a CRM step reads why the step
-            // did nothing rather than a log that says it ran.
-            if (!env.crmAllowed) {
-                return failed(`CRM steps require the ${planLabelGrantingFeature('crm')} plan`);
-            }
-            // The five CRM steps (AGL-2605) share a resolver and a scope, so
-            // they share a module; see `crm-action-steps.ts`.
-            const outcome = await runCrmActionStep({
+       * Filed by the plugin that keeps people, as THIS SITE holds them
+       * (AGL-3080): which campaigns a merchant has filed somebody under is
+       * that merchant's business record, on the same footing as their notes
+       * and their tags, and where it lives on the person is the owner's to
+       * know. A person the owner no longer finds for the site is not filed.
+       */ const filed = await filePluginPersonUnder({
                 hostId,
-                org: env.org,
-                orgId: env.orgId
-            }, run.id, step, payload);
-            if (outcome.error) return failed(outcome.error);
-            detail = outcome.detail;
-            // A stage set by an automation IS a stage change; see `raiseEarnedEvent`.
-            if (outcome.emit) await raiseEarnedEvent(env, outcome.emit);
+                orgId: campaignOrgId,
+                record: {
+                    kind: contact.kind,
+                    id: contact.id
+                },
+                containerKind: 'campaign',
+                ids: [
+                    campaign.id
+                ]
+            });
+            if (!(filed == null ? void 0 : filed.filed)) return failed(`no contact for ${email}`);
         } else {
             /*
        * A STEP ANOTHER PLUGIN RUNS: one that writes that plugin's records,
@@ -1195,9 +1034,45 @@ async function datasetAppendRefusal(env, datasetRef) {
  * tunes by watching the site, not by reading a log. The events people
  * actually debug are the server-emitted ones (a form submission, a
  * booking, a sign-up), and those are low-volume by construction.
- */ const SKIP_LOG_EXCLUDED_EVENTS = new Set([
+ */ export const SKIP_LOG_EXCLUDED_EVENTS = new Set([
     'pageView'
 ]);
+/**
+ * Whether an action's unmet conditions only say it is ANOTHER FORM'S
+ * (AGL-3458) — the case that is noise rather than an answer.
+ *
+ * A site with one auto-reply per form keyed on `formId equals …` would write
+ * a `Skipped` row for every other form's reply on every submission: eight
+ * rows a fill on a nine-form site, burying the one row that explains a real
+ * miss. A form picked by id cannot be mistyped, so its mismatch against a
+ * submission that names a DIFFERENT form says only "not this form", and it
+ * is not recorded. Every other unmet condition still is: a hand-typed
+ * `formName`, a field condition, a submission that names no form at all.
+ *
+ * With `and`, one such clause is the whole answer; with `or`, only when every
+ * clause is about which form it was — `formId` or `formName` equals — since
+ * any other clause could have been the one that was meant to match.
+ */ export function conditionsNameAnotherForm(trigger, payload) {
+    var _payload_formId;
+    const submitted = String((_payload_formId = payload['formId']) != null ? _payload_formId : '').trim();
+    if (!submitted) return false;
+    const clauses = normalizeTriggerConditions(trigger);
+    const another = (clause)=>{
+        var _clause_field, _clause_value, _clause_value1;
+        return ((_clause_field = clause.field) == null ? void 0 : _clause_field.trim()) === 'formId' && clause.op === 'equals' && Boolean((_clause_value = clause.value) == null ? void 0 : _clause_value.trim()) && ((_clause_value1 = clause.value) == null ? void 0 : _clause_value1.trim()) !== submitted;
+    };
+    if ((trigger == null ? void 0 : trigger.combinator) === 'or') {
+        return clauses.some(another) && clauses.every((clause)=>{
+            var _ref;
+            var _clause_field;
+            return clause.op === 'equals' && [
+                'formId',
+                'formName'
+            ].includes((_ref = (_clause_field = clause.field) == null ? void 0 : _clause_field.trim()) != null ? _ref : '');
+        });
+    }
+    return clauses.some(another);
+}
 /**
  * Writes the `Skipped` row (AGL-2171): which condition stopped the run,
  * so the answer to "why didn't it fire?" is in the same place as every
@@ -1205,7 +1080,7 @@ async function datasetAppendRefusal(env, datasetRef) {
  *
  * Never counts against `actionRunsPerMonth` — nothing executed, and
  * charging for a condition that said no would be its own bug.
- */ async function recordSkippedRun(hostRef, actionId, action, event, kind = 'action') {
+ */ async function recordSkippedRun(hostRef, actionId, action, event, kind = 'action', /** What stopped it, when it was not an unmet condition. */ because) {
     var _action_name;
     if (SKIP_LOG_EXCLUDED_EVENTS.has(event)) return;
     // `normalizeTriggerConditions`, not `trigger.conditions` — a pre-AGL-565
@@ -1215,7 +1090,7 @@ async function datasetAppendRefusal(env, datasetRef) {
         var _ref;
         return String((_ref = condition == null ? void 0 : condition.field) != null ? _ref : '').trim();
     }).filter(Boolean);
-    const reason = named.length ? `Condition on ${named.slice(0, 3).join(', ')} not met` : 'Trigger condition not met';
+    const reason = because != null ? because : named.length ? `Condition on ${named.slice(0, 3).join(', ')} not met` : 'Trigger condition not met';
     await hostRef.collection('activity').add(_extends({
         actorId: null,
         actorEmail: null
@@ -1262,8 +1137,7 @@ async function datasetAppendRefusal(env, datasetRef) {
         var _ref, _ref1;
         const firestore = firebaseAdmin.app().firestore();
         const hostRef = firestore.collection('hosts').doc(hostId);
-        const triggered = await hostRef.collection('actions').where('trigger.event', '==', event).limit(MAX_TRIGGERED_ACTIONS).get();
-        const actions = triggered.docs.filter((doc)=>!doc.get('deletedAt') && doc.get('enabled') !== false);
+        const actions = await liveActionsForEvent(hostRef, event);
         /*
      * THE ORGANIZATION'S AUTOMATIONS placed on this site and not paused here.
      *
@@ -1273,12 +1147,9 @@ async function datasetAppendRefusal(env, datasetRef) {
      * this site's own actions exactly as before.
      */ const placed = await findOrgAutomationsForEvent(hostId, event);
         if (!actions.length && !placed) return alerts;
-        const monthKey = new Date().toISOString().slice(0, 7);
-        const runCounterRef = hostRef.collection('counters').doc('actionRuns');
         // Webhook steps take the higher `webhooks` gate (AGL-149); plan gates
         // ride the owning org's doc (AGL-238).
         let webhooksAllowed = true;
-        let crmAllowed = true;
         /*
      * Whether each half fits under the month's allowance — all or nothing per
      * half, as the site's own actions always were.
@@ -1287,25 +1158,32 @@ async function datasetAppendRefusal(env, datasetRef) {
      * were always asked, so an organization placing automations on a site can
      * never be what stops that site's own actions running. The org half is
      * asked second, against what is left after the site's half, and both
-     * count on this site's one meter: an org automation's run is this site's
+     * count on this site's meter: an org automation's run is this site's
      * run, and the usage card, the usage alerts and the COGS rollup read it
      * there.
      */ let runSite = false;
         let runOrg = false;
         // Plan-less orgs resolve as free (AGL-247) — gates always run. Held for
-        // the rest of the run so the dataset caps below cost no second read.
+        // the rest of the run so a step's own plan check costs no second read.
         const owner = await getOrgForHost(hostId);
+        // The band is the WORKSPACE's (AGL-3472): every site's runs count
+        // against it, read off the org's counter — see `run-meter.ts`.
+        const meter = {
+            firestore,
+            hostRef,
+            orgId: owner == null ? void 0 : owner.orgId,
+            counter: 'actionRuns',
+            month: runMonthKey()
+        };
         // A suspended site runs nothing (AGL-3356): see `eventRunSuspension`.
         if (await eventRunSuspension(hostRef, owner == null ? void 0 : owner.org)) return alerts;
         {
-            var _counterSnapshot_get, _ref2;
+            var _ref2;
             const org = owner == null ? void 0 : owner.org;
             if (!checkEntitlement(org, 'actions')) return alerts;
             webhooksAllowed = checkEntitlement(org, 'webhooks');
-            crmAllowed = checkEntitlement(org, 'crm');
             const limit = resolveOrgEntitlements(org).actionRunsPerMonth;
-            const counterSnapshot = await runCounterRef.get();
-            const used = Number((_counterSnapshot_get = counterSnapshot.get(monthKey)) != null ? _counterSnapshot_get : 0);
+            const used = await runsUsedThisMonth(meter);
             // Asked as "would it go over", the question this gate has always
             // asked — so a counter that reads as no number refuses nothing, as
             // before, rather than refusing everything.
@@ -1324,7 +1202,6 @@ async function datasetAppendRefusal(env, datasetRef) {
             // Admitted by the `actions` gate above.
             actionsAllowed: true,
             webhooksAllowed,
-            crmAllowed,
             depth,
             org: (_ref = owner == null ? void 0 : owner.org) != null ? _ref : null,
             orgId: (_ref1 = owner == null ? void 0 : owner.orgId) != null ? _ref1 : null,
@@ -1336,12 +1213,17 @@ async function datasetAppendRefusal(env, datasetRef) {
             const action = doc.data();
             const filter = (_action_trigger = action.trigger) == null ? void 0 : (_action_trigger_filter = _action_trigger.filter) == null ? void 0 : _action_trigger_filter.trim();
             if (filter) {
+                const unrunnable = triggerFilterProblem(filter);
+                if (unrunnable) {
+                    await recordSkippedRun(hostRef, doc.id, action, event, 'action', unrunnable);
+                    continue;
+                }
                 try {
                     if (!evaluateExpression(filter, _extends({
                         event
                     }, payload))) continue;
                 } catch (unused) {
-                    continue; // A broken filter never fires.
+                    continue; // A field the filter names is not on this event.
                 }
             }
             // Structured payload conditions (AGL-557; AND/OR chaining AGL-565):
@@ -1355,7 +1237,9 @@ async function datasetAppendRefusal(env, datasetRef) {
                 // common support question about automations — had no answer
                 // anywhere in the product, while `/product/workflows` advertises
                 // an amber `Skipped` row that answers it.
-                await recordSkippedRun(hostRef, doc.id, action, event);
+                if (!conditionsNameAnotherForm(action.trigger, payload)) {
+                    await recordSkippedRun(hostRef, doc.id, action, event);
+                }
                 continue;
             }
             executed += 1;
@@ -1370,18 +1254,25 @@ async function datasetAppendRefusal(env, datasetRef) {
             const automation = doc.data();
             const filter = (_automation_trigger = automation.trigger) == null ? void 0 : (_automation_trigger_filter = _automation_trigger.filter) == null ? void 0 : _automation_trigger_filter.trim();
             if (filter) {
+                const unrunnable = triggerFilterProblem(filter);
+                if (unrunnable) {
+                    await recordSkippedRun(hostRef, doc.id, automation, event, 'orgAutomation', unrunnable);
+                    continue;
+                }
                 try {
                     if (!evaluateExpression(filter, _extends({
                         event
                     }, payload))) continue;
                 } catch (unused) {
-                    continue; // A broken filter never fires.
+                    continue; // A field the filter names is not on this event.
                 }
             }
             if (!evaluateTriggerConditions(automation.trigger, _extends({
                 event
             }, payload))) {
-                await recordSkippedRun(hostRef, doc.id, automation, event, 'orgAutomation');
+                if (!conditionsNameAnotherForm(automation.trigger, payload)) {
+                    await recordSkippedRun(hostRef, doc.id, automation, event, 'orgAutomation');
+                }
                 continue;
             }
             executed += 1;
@@ -1391,13 +1282,9 @@ async function datasetAppendRefusal(env, datasetRef) {
                 }
             });
         }
-        if (executed > 0) {
-            await runCounterRef.set({
-                [monthKey]: FieldValue.increment(executed)
-            }, {
-                merge: true
-            }).catch(()=>undefined);
-        }
+        await recordRuns(_extends({}, meter, {
+            count: executed
+        }));
     } catch (error) {
         console.error('runEventActions failed', hostId, event, error);
     }
@@ -1450,21 +1337,23 @@ async function datasetAppendRefusal(env, datasetRef) {
         }, payload))) {
             return skipped('conditions');
         }
-        const monthKey = new Date().toISOString().slice(0, 7);
-        const runCounterRef = hostRef.collection('counters').doc('actionRuns');
         let webhooksAllowed = true;
-        let crmAllowed = true;
         // Held for the rest of the run, as in `runEventActions` above.
         const owner = await getOrgForHost(hostId);
+        // The workspace's band, as in `runEventActions` above (AGL-3472).
+        const meter = {
+            firestore,
+            hostRef,
+            orgId: owner == null ? void 0 : owner.orgId,
+            counter: 'actionRuns',
+            month: runMonthKey()
+        };
         {
-            var _counterSnapshot_get;
             const org = owner == null ? void 0 : owner.org;
             if (!checkEntitlement(org, 'actions')) return skipped('plan');
             webhooksAllowed = checkEntitlement(org, 'webhooks');
-            crmAllowed = checkEntitlement(org, 'crm');
             const limit = resolveOrgEntitlements(org).actionRunsPerMonth;
-            const counterSnapshot = await runCounterRef.get();
-            const used = Number((_counterSnapshot_get = counterSnapshot.get(monthKey)) != null ? _counterSnapshot_get : 0);
+            const used = await runsUsedThisMonth(meter);
             if (used + 1 > limit) return skipped('allowance', limit);
         }
         const env = {
@@ -1474,18 +1363,15 @@ async function datasetAppendRefusal(env, datasetRef) {
             // Admitted by the `actions` gate above.
             actionsAllowed: true,
             webhooksAllowed,
-            crmAllowed,
             depth: 0,
             org: (_ref1 = owner == null ? void 0 : owner.org) != null ? _ref1 : null,
             orgId: (_ref2 = owner == null ? void 0 : owner.orgId) != null ? _ref2 : null,
             loadWorkflowContext: makeWorkflowContextLoader(hostRef)
         };
         await executeAction(env, doc.id, action, event, payload);
-        await runCounterRef.set({
-            [monthKey]: FieldValue.increment(1)
-        }, {
-            merge: true
-        }).catch(()=>undefined);
+        await recordRuns(_extends({}, meter, {
+            count: 1
+        }));
         return {
             ran: true,
             skipped: null,
@@ -1584,7 +1470,6 @@ async function datasetAppendRefusal(env, datasetRef) {
         // Admitted by the `actions` gate above.
         actionsAllowed: true,
         webhooksAllowed: checkEntitlement(owner == null ? void 0 : owner.org, 'webhooks'),
-        crmAllowed: checkEntitlement(owner == null ? void 0 : owner.org, 'crm'),
         depth: 0,
         org: (_ref1 = owner == null ? void 0 : owner.org) != null ? _ref1 : null,
         orgId: (_ref2 = owner == null ? void 0 : owner.orgId) != null ? _ref2 : null,
@@ -1619,12 +1504,14 @@ async function datasetAppendRefusal(env, datasetRef) {
    * would abandon somebody half-way through a sequence, which is a capacity
    * limit enforced against a person rather than against the decision that
    * added them. The gate belongs at enrollment, and that is where it is.
-   */ const monthKey = new Date(nowMs).toISOString().slice(0, 7);
-    await hostRef.collection('counters').doc('actionRuns').set({
-        [monthKey]: FieldValue.increment(1)
-    }, {
-        merge: true
-    }).catch(()=>undefined);
+   */ await recordRuns({
+        firestore,
+        hostRef,
+        orgId: owner == null ? void 0 : owner.orgId,
+        counter: 'actionRuns',
+        month: runMonthKey(nowMs),
+        count: 1
+    });
     return ending;
 }
 /** How long a deferred enrollment waits before the next attempt. */ export const FLOW_CLAIM_RETRY_MS = 15 * 60000;