@aglyn/plugins-workflows 1.0.0-beta.222 → 1.0.0-beta.224

package/src/lib/engine/email-merge.d.ts

@@ -0,0 +1,69 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type CrmMergeContext, type CrmMergeResult } from '@aglyn/aglyn/app-utils/crm-email-templates';
+/**
+ * The person a step's email is about, as the payload names them when no
+ * record does: the `name` and `email` the event carried.
+ */
+export interface EmailMergePerson {
+    name?: string | null;
+    email?: string | null;
+}
+/**
+ * A `sendEmail` step's subject or body with its merge tags filled from the
+ * contact or the lead the run is about (AGL-3458), so a reply greets the
+ * person by name rather than as `{{firstName|there}}`.
+ *
+ * Both spellings a merchant has been shown resolve, because a workflow email
+ * is written by the same people who write the other two:
+ *
+ *  - the CRM's fields, `{{contact.firstName}}`, `{{lead.company}}`,
+ *    `{{site.name}}` — `resolveCrmMergeFields`, the one-to-one email's
+ *    resolver, run over the record the run resolved;
+ *  - the campaign's short tags, `{{firstName|there}}`, `{{name}}`,
+ *    `{{email}}` — `resolveMergeTags`, the campaign sender's own resolver, run
+ *    over the same person: the contact's name as this site knows it, else
+ *    the lead's, else the name the event carried.
+ *
+ * Both honor `|fallback`, and an unknown tag prints its fallback or nothing,
+ * never its braces — a typo must not reach a customer as `{{frstName}}`.
+ * Pure; the caller hands over what it read.
+ */
+export declare function resolveStepEmailMerge(text: string, context: CrmMergeContext, person?: EmailMergePerson | null): CrmMergeResult;
+/**
+ * The records a step's email is about, for its merge tags: the person the
+ * event names, as the plugin that keeps people holds them — a contact, else
+ * the lead a lead-routed form filed — and the site's name, in the shape the
+ * one-to-one email's resolver takes (`resolveStepEmailMerge`).
+ *
+ * Asked through the person-records seam (`findPluginPerson`), narrowed to
+ * what this site may see, so the engine opens no record system's storage. A
+ * workspace with no record system, or a person nobody holds yet, leaves both
+ * records out, and the tags fall back to the name and address the event
+ * carried.
+ *
+ * **Never throws.** A lookup that fails is an email with its fallbacks, never
+ * an email that did not leave.
+ */
+export declare function stepEmailMergeContext(input: {
+    hostId: string;
+    /** The address of the person the event is about. */
+    email: unknown;
+    /** The holder group whose facet names a contact: the sending site's. */
+    contactGroupId: string;
+    siteName: string;
+}): Promise<CrmMergeContext>;

package/src/lib/engine/email-merge.js

@@ -0,0 +1,98 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { normalizeContactEmail } from "@aglyn/aglyn/app-utils/contacts";
+import { resolveCrmMergeFields } from "@aglyn/aglyn/app-utils/crm-email-templates";
+import { findPluginPerson } from "@aglyn/aglyn/plugin-manager/plugin-person-records";
+import { resolveMergeTags } from "@aglyn/shared-util-email/email-merge";
+/** One CRM field's value, through the one-to-one email's own resolver. */ const field = (key, context)=>resolveCrmMergeFields(`{{${key}}}`, context).text.trim();
+/**
+ * A `sendEmail` step's subject or body with its merge tags filled from the
+ * contact or the lead the run is about (AGL-3458), so a reply greets the
+ * person by name rather than as `{{firstName|there}}`.
+ *
+ * Both spellings a merchant has been shown resolve, because a workflow email
+ * is written by the same people who write the other two:
+ *
+ *  - the CRM's fields, `{{contact.firstName}}`, `{{lead.company}}`,
+ *    `{{site.name}}` — `resolveCrmMergeFields`, the one-to-one email's
+ *    resolver, run over the record the run resolved;
+ *  - the campaign's short tags, `{{firstName|there}}`, `{{name}}`,
+ *    `{{email}}` — `resolveMergeTags`, the campaign sender's own resolver, run
+ *    over the same person: the contact's name as this site knows it, else
+ *    the lead's, else the name the event carried.
+ *
+ * Both honor `|fallback`, and an unknown tag prints its fallback or nothing,
+ * never its braces — a typo must not reach a customer as `{{frstName}}`.
+ * Pure; the caller hands over what it read.
+ */ export function resolveStepEmailMerge(text, context, person = null) {
+    var _normalizeContactEmail;
+    const crm = resolveCrmMergeFields(text, context);
+    const name = field('contact.name', context) || field('lead.name', context) || (typeof (person == null ? void 0 : person.name) === 'string' ? person.name.trim() : '');
+    const email = field('contact.email', context) || field('lead.email', context) || ((_normalizeContactEmail = normalizeContactEmail(person == null ? void 0 : person.email)) != null ? _normalizeContactEmail : '');
+    return {
+        text: resolveMergeTags(crm.text, _extends({
+            email
+        }, name ? {
+            name
+        } : {})),
+        unresolved: crm.unresolved
+    };
+}
+/**
+ * The records a step's email is about, for its merge tags: the person the
+ * event names, as the plugin that keeps people holds them — a contact, else
+ * the lead a lead-routed form filed — and the site's name, in the shape the
+ * one-to-one email's resolver takes (`resolveStepEmailMerge`).
+ *
+ * Asked through the person-records seam (`findPluginPerson`), narrowed to
+ * what this site may see, so the engine opens no record system's storage. A
+ * workspace with no record system, or a person nobody holds yet, leaves both
+ * records out, and the tags fall back to the name and address the event
+ * carried.
+ *
+ * **Never throws.** A lookup that fails is an email with its fallbacks, never
+ * an email that did not leave.
+ */ export async function stepEmailMergeContext(input) {
+    const context = {
+        site: {
+            name: input.siteName
+        }
+    };
+    try {
+        const person = await findPluginPerson({
+            hostId: input.hostId,
+            email: input.email,
+            onlyVisibleToSite: true,
+            anyKind: true
+        });
+        const data = person ? _extends({}, person.data) : null;
+        if ((person == null ? void 0 : person.kind) === 'contact') {
+            return _extends({}, context, {
+                contact: data,
+                contactGroupId: input.contactGroupId
+            });
+        }
+        if ((person == null ? void 0 : person.kind) === 'lead') return _extends({}, context, {
+            lead: data
+        });
+    } catch (error) {
+        console.error('[workflow] email merge context could not be read', input.hostId, error);
+    }
+    return context;
+}
+
+//# sourceMappingURL=email-merge.js.map

package/src/lib/engine/email-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/workflows/src/lib/engine/email-merge.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { normalizeContactEmail } from '@aglyn/aglyn/app-utils/contacts'\nimport {\n  type CrmMergeContext,\n  type CrmMergeResult,\n  resolveCrmMergeFields,\n} from '@aglyn/aglyn/app-utils/crm-email-templates'\nimport { findPluginPerson } from '@aglyn/aglyn/plugin-manager/plugin-person-records'\nimport { resolveMergeTags } from '@aglyn/shared-util-email/email-merge'\n\n/**\n * The person a step's email is about, as the payload names them when no\n * record does: the `name` and `email` the event carried.\n */\nexport interface EmailMergePerson {\n  name?: string | null\n  email?: string | null\n}\n\n/** One CRM field's value, through the one-to-one email's own resolver. */\nconst field = (key: string, context: CrmMergeContext): string =>\n  resolveCrmMergeFields(`{{${key}}}`, context).text.trim()\n\n/**\n * A `sendEmail` step's subject or body with its merge tags filled from the\n * contact or the lead the run is about (AGL-3458), so a reply greets the\n * person by name rather than as `{{firstName|there}}`.\n *\n * Both spellings a merchant has been shown resolve, because a workflow email\n * is written by the same people who write the other two:\n *\n *  - the CRM's fields, `{{contact.firstName}}`, `{{lead.company}}`,\n *    `{{site.name}}` — `resolveCrmMergeFields`, the one-to-one email's\n *    resolver, run over the record the run resolved;\n *  - the campaign's short tags, `{{firstName|there}}`, `{{name}}`,\n *    `{{email}}` — `resolveMergeTags`, the campaign sender's own resolver, run\n *    over the same person: the contact's name as this site knows it, else\n *    the lead's, else the name the event carried.\n *\n * Both honor `|fallback`, and an unknown tag prints its fallback or nothing,\n * never its braces — a typo must not reach a customer as `{{frstName}}`.\n * Pure; the caller hands over what it read.\n */\nexport function resolveStepEmailMerge(\n  text: string,\n  context: CrmMergeContext,\n  person: EmailMergePerson | null = null,\n): CrmMergeResult {\n  const crm = resolveCrmMergeFields(text, context)\n  const name =\n    field('contact.name', context) ||\n    field('lead.name', context) ||\n    (typeof person?.name === 'string' ? person.name.trim() : '')\n  const email =\n    field('contact.email', context) ||\n    field('lead.email', context) ||\n    (normalizeContactEmail(person?.email) ?? '')\n  return {\n    text: resolveMergeTags(crm.text, { email, ...(name ? { name } : {}) }),\n    unresolved: crm.unresolved,\n  }\n}\n\n/**\n * The records a step's email is about, for its merge tags: the person the\n * event names, as the plugin that keeps people holds them — a contact, else\n * the lead a lead-routed form filed — and the site's name, in the shape the\n * one-to-one email's resolver takes (`resolveStepEmailMerge`).\n *\n * Asked through the person-records seam (`findPluginPerson`), narrowed to\n * what this site may see, so the engine opens no record system's storage. A\n * workspace with no record system, or a person nobody holds yet, leaves both\n * records out, and the tags fall back to the name and address the event\n * carried.\n *\n * **Never throws.** A lookup that fails is an email with its fallbacks, never\n * an email that did not leave.\n */\nexport async function stepEmailMergeContext(input: {\n  hostId: string\n  /** The address of the person the event is about. */\n  email: unknown\n  /** The holder group whose facet names a contact: the sending site's. */\n  contactGroupId: string\n  siteName: string\n}): Promise<CrmMergeContext> {\n  const context: CrmMergeContext = { site: { name: input.siteName } }\n  try {\n    const person = await findPluginPerson({\n      hostId: input.hostId,\n      email: input.email,\n      onlyVisibleToSite: true,\n      anyKind: true,\n    })\n    const data = person ? { ...person.data } : null\n    if (person?.kind === 'contact') {\n      return { ...context, contact: data, contactGroupId: input.contactGroupId }\n    }\n    if (person?.kind === 'lead') return { ...context, lead: data }\n  } catch (error) {\n    console.error('[workflow] email merge context could not be read', input.hostId, error)\n  }\n  return context\n}\n"],"names":["normalizeContactEmail","resolveCrmMergeFields","findPluginPerson","resolveMergeTags","field","key","context","text","trim","resolveStepEmailMerge","person","crm","name","email","unresolved","stepEmailMergeContext","input","site","siteName","hostId","onlyVisibleToSite","anyKind","data","kind","contact","contactGroupId","lead","error","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,qBAAqB,QAAQ,kCAAiC;AACvE,SAGEC,qBAAqB,QAChB,6CAA4C;AACnD,SAASC,gBAAgB,QAAQ,oDAAmD;AACpF,SAASC,gBAAgB,QAAQ,uCAAsC;AAWvE,wEAAwE,GACxE,MAAMC,QAAQ,CAACC,KAAaC,UAC1BL,sBAAsB,CAAC,EAAE,EAAEI,IAAI,EAAE,CAAC,EAAEC,SAASC,IAAI,CAACC,IAAI;AAExD;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,SAASC,sBACdF,IAAY,EACZD,OAAwB,EACxBI,SAAkC,IAAI;QAUnCV;IARH,MAAMW,MAAMV,sBAAsBM,MAAMD;IACxC,MAAMM,OACJR,MAAM,gBAAgBE,YACtBF,MAAM,aAAaE,YAClB,CAAA,QAAOI,0BAAAA,OAAQE,IAAI,MAAK,WAAWF,OAAOE,IAAI,CAACJ,IAAI,KAAK,EAAC;IAC5D,MAAMK,QACJT,MAAM,iBAAiBE,YACvBF,MAAM,cAAcE,cACnBN,yBAAAA,sBAAsBU,0BAAAA,OAAQG,KAAK,aAAnCb,yBAAwC;IAC3C,OAAO;QACLO,MAAMJ,iBAAiBQ,IAAIJ,IAAI,EAAE;YAAEM;WAAWD,OAAO;YAAEA;QAAK,IAAI,CAAC;QACjEE,YAAYH,IAAIG,UAAU;IAC5B;AACF;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,eAAeC,sBAAsBC,KAO3C;IACC,MAAMV,UAA2B;QAAEW,MAAM;YAAEL,MAAMI,MAAME,QAAQ;QAAC;IAAE;IAClE,IAAI;QACF,MAAMR,SAAS,MAAMR,iBAAiB;YACpCiB,QAAQH,MAAMG,MAAM;YACpBN,OAAOG,MAAMH,KAAK;YAClBO,mBAAmB;YACnBC,SAAS;QACX;QACA,MAAMC,OAAOZ,SAAS,aAAKA,OAAOY,IAAI,IAAK;QAC3C,IAAIZ,CAAAA,0BAAAA,OAAQa,IAAI,MAAK,WAAW;YAC9B,OAAO,aAAKjB;gBAASkB,SAASF;gBAAMG,gBAAgBT,MAAMS,cAAc;;QAC1E;QACA,IAAIf,CAAAA,0BAAAA,OAAQa,IAAI,MAAK,QAAQ,OAAO,aAAKjB;YAASoB,MAAMJ;;IAC1D,EAAE,OAAOK,OAAO;QACdC,QAAQD,KAAK,CAAC,oDAAoDX,MAAMG,MAAM,EAAEQ;IAClF;IACA,OAAOrB;AACT"}

package/src/lib/engine/run-event-actions.d.ts

@@ -20,6 +20,8 @@ import { type FlowEnrollment, type FlowSweepCursor, type FlowSweepResult } from
 import type { HostEventPayload } from '@aglyn/tenant-runtime/host-event-listeners';
 import { type AutomationWorkflow, type WorkflowStep } from './workflow-steps';
 import { type HostAction, type HostActionAlert, type HostActionStep } from '../model/host-actions';
+/** The live, switched-on actions a site holds for `event`, in document-id order. */
+export declare function liveActionsForEvent(hostRef: FirebaseFirestore.DocumentReference, event: string): Promise<FirebaseFirestore.QueryDocumentSnapshot[]>;
 export interface ActionRunEnv {
     hostId: string;
     hostRef: FirebaseFirestore.DocumentReference;
@@ -221,6 +223,34 @@ interface ExecuteWorkflowOptions {
  * both, once.
  */
 export declare function executeWorkflow(env: ActionRunEnv, run: AutomationRun, workflow: AutomationWorkflow, event: string, payload: HostEventPayload, options?: ExecuteWorkflowOptions): Promise<WorkflowExecution>;
+/**
+ * Events too frequent to log a skip for.
+ *
+ * `runEventActions` fires on EVERY page view of every published site. A
+ * Firestore write per visitor per non-matching action is not a run
+ * history, it is an outage — and a page-view condition is one an author
+ * tunes by watching the site, not by reading a log. The events people
+ * actually debug are the server-emitted ones (a form submission, a
+ * booking, a sign-up), and those are low-volume by construction.
+ */
+export declare const SKIP_LOG_EXCLUDED_EVENTS: ReadonlySet<string>;
+/**
+ * Whether an action's unmet conditions only say it is ANOTHER FORM'S
+ * (AGL-3458) — the case that is noise rather than an answer.
+ *
+ * A site with one auto-reply per form keyed on `formId equals …` would write
+ * a `Skipped` row for every other form's reply on every submission: eight
+ * rows a fill on a nine-form site, burying the one row that explains a real
+ * miss. A form picked by id cannot be mistyped, so its mismatch against a
+ * submission that names a DIFFERENT form says only "not this form", and it
+ * is not recorded. Every other unmet condition still is: a hand-typed
+ * `formName`, a field condition, a submission that names no form at all.
+ *
+ * With `and`, one such clause is the whole answer; with `or`, only when every
+ * clause is about which form it was — `formId` or `formName` equals — since
+ * any other clause could have been the one that was meant to match.
+ */
+export declare function conditionsNameAnotherForm(trigger: HostAction['trigger'] | null | undefined, payload: HostEventPayload): boolean;
 /**
  * Event-triggered action runner (AGL-148): loads enabled actions whose
  * `trigger.event` matches (built-in, site event, or custom), evaluates

package/src/lib/engine/run-event-actions.js

@@ -14,11 +14,12 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { ACTION_MAX_STEPS, checkEntitlement, consentGroupForHost, planLabelGrantingFeature, evaluateExpression, evaluateStepGuard, evaluateTriggerConditions, flowSubscriptionTopicId, hostPublicOrigin, isClientActionStep, normalizeTriggerConditions, resolveOrgEntitlements } from "@aglyn/aglyn/server";
+ */ import { ACTION_MAX_STEPS, ACTIONS_MAX_PER_HOST, checkEntitlement, consentGroupForHost, planLabelGrantingFeature, evaluateExpression, evaluateStepGuard, evaluateTriggerConditions, flowSubscriptionTopicId, hostPublicOrigin, isClientActionStep, normalizeTriggerConditions, resolveOrgEntitlements } from "@aglyn/aglyn/server";
 import { isDeferrableSendResult, isEmailConfigured, sendEmail, sendFailureReason } from "@aglyn/shared-util-email";
-import { enrollListMember, firebaseAdmin, flowEmailRefusal, getOrgForHost, hostSendingIdentity, meterHostEmail, notifyHostManagers, consentGroupForSite, resolveOrgIdForHost } from "@aglyn/tenant-data-admin";
+import { enrollListMember, filterSendableForHost, firebaseAdmin, flowEmailRefusal, getOrgForHost, hostDisplayName, hostSendingIdentity, meterHostEmail, notifyHostManagers, consentGroupForSite, resolveOrgIdForHost } from "@aglyn/tenant-data-admin";
 import { activitySearchTokens } from "@aglyn/aglyn/app-utils/activity-search";
 import { visibleToHost } from "@aglyn/aglyn/app-utils/scope-tokens";
+import { triggerFilterProblem } from "@aglyn/aglyn/app-utils/site-interactions";
 // The person behind an address, and their filing under a campaign, through
 // the plugin that keeps people (AGL-3080): the engine opens none of its
 // collections.
@@ -35,6 +36,8 @@ import { ACTION_MAX_EVENT_DEPTH, runWorkflow, WORKFLOW_MAX_STEPS } from "../mode
 import { describeStepOutcome } from "../model/step-outcomes.js";
 import { WEBHOOK_URL_PATTERN } from "../model/webhooks.js";
 import { eventRunSuspension } from "./site-suspension.js";
+import { triggeredDocsForEvent } from "./triggered-docs.js";
+import { resolveStepEmailMerge, stepEmailMergeContext } from "./email-merge.js";
 import { recordRuns, runMonthKey, runsUsedThisMonth } from "./run-meter.js";
 import { advanceFlowEnrollment, claimFlowEnrollment, deferFlowEnrollment, endFlowEnrollment, enrollInFlow, findFlowEnrollmentsAwaiting, sweepDueFlowEnrollments } from "./flow-enrollments.js";
 import { resumeWorkflowEnrollment, runEventWorkflows } from "./run-event-workflows.js";
@@ -45,8 +48,19 @@ import { runTriggeredByFields } from "./run-trigger-actor.js";
 // By path, not the barrel: only a server run asks.
 import { pluginServerStepExecutor } from "@aglyn/aglyn/plugin-manager/plugin-server-steps";
 import { preparePluginRecordEmail } from "@aglyn/aglyn/plugin-manager/plugin-record-timeline";
-import { FLOW_TIMED_OUT_FIELD, isFlowSuspendingStep } from "../model/host-actions.js";
-/** Bounded fan-out per event, mirroring the workflow runner. */ const MAX_TRIGGERED_ACTIONS = 10;
+import { FLOW_TIMED_OUT_FIELD, isFlowSuspendingStep, sendEmailIsTransactionalReply } from "../model/host-actions.js";
+/**
+ * Every live, switched-on action a site holds for an event runs, in
+ * document-id order (AGL-3458) — up to the most live actions a site may hold
+ * at all, so no matching action is ever left out. See `triggered-docs.ts`.
+ */ const MAX_TRIGGERED_ACTIONS = ACTIONS_MAX_PER_HOST;
+/** The live, switched-on actions a site holds for `event`, in document-id order. */ export function liveActionsForEvent(hostRef, event) {
+    return triggeredDocsForEvent(hostRef.collection('actions'), event, {
+        keep: (doc)=>!doc.get('deletedAt') && doc.get('enabled') !== false,
+        max: MAX_TRIGGERED_ACTIONS,
+        maxReads: MAX_TRIGGERED_ACTIONS * 4
+    });
+}
 /**
  * The run environment for one automation run: the org's plan gates resolved
  * once, from the org document the caller already read.
@@ -335,7 +349,7 @@ export function makeWorkflowContextLoader(hostRef) {
                 link: `/${hostId}`
             }));
         } else if (step.type === 'sendEmail') {
-            var _payload_, _ref4, _hostPublicOrigin, _step_topicId, _step_subject, _step_body, _ref5, _run_orgId, _env_org, _env_org1, _payload_contactId, _payload_email, _screened_releasedReviewId;
+            var _payload_, _ref4, _hostPublicOrigin, _env_org, _step_subject, _step_body, _payload_email, _ref5, _payload_name, _ref6, _run_orgId, _env_org1, _payload_contactId, _payload_email1, _screened_releasedReviewId;
             var _step_toField, _this;
             const to = String((_payload_ = payload[((_step_toField = step.toField) == null ? void 0 : _step_toField.trim()) || 'email']) != null ? _payload_ : '').trim();
             if (!isEmailConfigured()) return failed('email is not configured');
@@ -349,13 +363,14 @@ export function makeWorkflowContextLoader(hostRef) {
             const hostData = (_ref4 = (_this = await hostRef.get().catch(()=>null)) == null ? void 0 : _this.data()) != null ? _ref4 : null;
             const siteBase = (_hostPublicOrigin = hostPublicOrigin(hostData)) != null ? _hostPublicOrigin : '';
             /*
-       * MARKETING. The subject and body are merchant-authored and the
-       * recipient comes out of the event payload — which, for the collect
-       * route, is a write triggered by an anonymous visitor. So this is a
-       * site mailing an address on the merchant's say-so, and it owes what
-       * every other such message owes: the unsubscribe header pair and a
-       * visible link, both suppression lists, and a share of the ceiling on
-       * how much one person receives from this site.
+       * MARKETING, unless it is a transactional reply (below). The subject
+       * and body are merchant-authored and the recipient comes out of the
+       * event payload — which, for the collect route, is a write triggered
+       * by an anonymous visitor. So a step that is not a reply is a site
+       * mailing an address on the merchant's say-so, and it owes what every
+       * other such message owes: the unsubscribe header pair and a visible
+       * link, both suppression lists, and a share of the ceiling on how much
+       * one person receives from this site.
        *
        * Priority stays transactional. An action run is not resumable — the
        * event has already happened and there is no beat that comes back for
@@ -393,27 +408,74 @@ export function makeWorkflowContextLoader(hostRef) {
        * enrollment moves on rather than retrying.
        */ const scope = enrollmentRef ? 'scheduled' : 'immediate';
             /*
+       * A TRANSACTIONAL REPLY (AGL-3458) — the answer to what the recipient
+       * just did: the run started on their own form submission, booking or
+       * sign-up, this step runs at once, names no topic, and goes to the
+       * address the event carries. Such a message is not a mailing, so it
+       * leaves with no unsubscribe header and no unsubscribe link, and asks
+       * no marketing-consent question — the reply the Inbox sends to a
+       * submission is the same kind of message, and CAN-SPAM exempts both.
+       * What it keeps is the suppression check below: a hard bounce, a spam
+       * complaint or a person who asked this site to stop is not mailed by
+       * anything. The author can switch a qualifying step back to a mailing
+       * (`transactional: false`); a step that does not qualify is a mailing
+       * whatever it says.
+       */ const transactional = sendEmailIsTransactionalReply(step, {
+                event,
+                afterWait: Boolean(enrollmentRef)
+            });
+            /*
        * The stream this message belongs to, resolved ONCE and read twice:
        * the gate below filters on it, and it rides the `marketing` context
        * so the opt-out link the seam mints names it. Without that the
        * preference page opens on a list of every stream the site has, and
        * the recipient has to find the one they were trying to leave.
        */ const topicId = flowSubscriptionTopicId(step.topicId, scope);
-            const gate = await flowEmailRefusal({
+            const consentGroup = consentGroupForHost((_env_org = env.org) != null ? _env_org : null, hostId);
+            if (transactional) {
+                // Both suppression lists — the platform's bounces and complaints, and
+                // this site's (and its consent group's) opt-outs — fail CLOSED.
+                const sendable = await filterSendableForHost(hostId, [
+                    to
+                ], undefined, consentGroup);
+                if (!sendable.length) return failed('the recipient is unsubscribed or suppressed');
+            } else {
+                var _step_topicId;
+                const gate = await flowEmailRefusal({
+                    hostId,
+                    email: to,
+                    topicId: (_step_topicId = step.topicId) != null ? _step_topicId : null,
+                    org: env.org,
+                    scope
+                });
+                if (gate) {
+                    return failed(gate !== 'consent-withheld' ? 'the recipient has left this email topic' : // only on a stated refusal, so reporting it as a missing
+                    // record would send a merchant looking for a consent field to
+                    // fill in that would change nothing.
+                    enrollmentRef ? 'the recipient has no marketing consent record on this site' : 'the recipient has declined marketing from this site');
+                }
+            }
+            /*
+       * THE WORDS AS AUTHORED, and as sent (AGL-3458). The merge tags — the
+       * campaign's `{{firstName|there}}` and the CRM's `{{contact.firstName}}`
+       * — are filled from the contact or the lead the run is about, else from
+       * the name and address the event carried. The phishing screen below
+       * reads the AUTHORED words: it judges what the business wrote, once per
+       * automation, not one copy per recipient.
+       */ const authoredSubject = String((_step_subject = step.subject) != null ? _step_subject : '').slice(0, 200);
+            const authoredText = String((_step_body = step.body) != null ? _step_body : '').slice(0, 5000);
+            const mergeContext = await stepEmailMergeContext({
                 hostId,
-                email: to,
-                topicId: (_step_topicId = step.topicId) != null ? _step_topicId : null,
-                org: env.org,
-                scope
+                email: String((_payload_email = payload['email']) != null ? _payload_email : '').trim() || to,
+                contactGroupId: consentGroup.groupId,
+                siteName: hostDisplayName(hostData != null ? hostData : undefined, hostId)
             });
-            if (gate) {
-                return failed(gate !== 'consent-withheld' ? 'the recipient has left this email topic' : // only on a stated refusal, so reporting it as a missing
-                // record would send a merchant looking for a consent field to
-                // fill in that would change nothing.
-                enrollmentRef ? 'the recipient has no marketing consent record on this site' : 'the recipient has declined marketing from this site');
-            }
-            const emailSubject = String((_step_subject = step.subject) != null ? _step_subject : '').slice(0, 200);
-            const emailText = String((_step_body = step.body) != null ? _step_body : '').slice(0, 5000);
+            const mergePerson = {
+                email: to,
+                name: String((_ref5 = (_payload_name = payload['name']) != null ? _payload_name : payload['fullName']) != null ? _ref5 : '').trim()
+            };
+            const emailSubject = resolveStepEmailMerge(authoredSubject, mergeContext, mergePerson).text.replace(/[\r\n]+/g, ' ').slice(0, 200);
+            const emailText = resolveStepEmailMerge(authoredText, mergeContext, mergePerson).text.slice(0, 5000);
             /*
        * THE PHISHING SCREEN, for a workspace in its first fortnight
        * (AGL-3356). The incident's second message was exactly this step: a
@@ -428,14 +490,14 @@ export function makeWorkflowContextLoader(hostRef) {
        * once released. See `outbound-send-review.ts`.
        */ const screened = await screenOutboundSend({
                 kind: run.kind,
-                path: run.kind === 'orgAutomation' ? `orgs/${(_ref5 = (_run_orgId = run.orgId) != null ? _run_orgId : env.orgId) != null ? _ref5 : ''}/automations/${run.id}` : `hosts/${hostId}/${run.kind === 'workflow' ? 'workflows' : 'actions'}/${run.id}`,
+                path: run.kind === 'orgAutomation' ? `orgs/${(_ref6 = (_run_orgId = run.orgId) != null ? _run_orgId : env.orgId) != null ? _ref6 : ''}/automations/${run.id}` : `hosts/${hostId}/${run.kind === 'workflow' ? 'workflows' : 'actions'}/${run.id}`,
                 hostId,
                 orgId: env.orgId,
-                org: (_env_org = env.org) != null ? _env_org : null,
+                org: (_env_org1 = env.org) != null ? _env_org1 : null,
                 host: hostData,
-                subject: emailSubject,
+                subject: authoredSubject,
                 bodies: [
-                    emailText
+                    authoredText
                 ]
             });
             if (screened.outcome === 'rejected') {
@@ -447,7 +509,6 @@ export function makeWorkflowContextLoader(hostRef) {
                 };
                 return failed('this email is held for staff review because it may impersonate ' + `another business (${screened.reference})`);
             }
-            const consentGroup = consentGroupForHost((_env_org1 = env.org) != null ? _env_org1 : null, hostId);
             /*
        * THE TIMELINE ENTRY (AGL-2615). A message addressed to the person the
        * event is about is filed on that person's timeline — the same entry a
@@ -464,7 +525,7 @@ export function makeWorkflowContextLoader(hostRef) {
                 to,
                 link: _extends({}, String((_payload_contactId = payload['contactId']) != null ? _payload_contactId : '').trim() ? {
                     contactId: String(payload['contactId']).trim()
-                } : {}, String((_payload_email = payload['email']) != null ? _payload_email : '').trim() ? {
+                } : {}, String((_payload_email1 = payload['email']) != null ? _payload_email1 : '').trim() ? {
                     email: String(payload['email']).trim()
                 } : {}),
                 org: env.org
@@ -495,13 +556,7 @@ export function makeWorkflowContextLoader(hostRef) {
                 releasedReviewId: screened.outcome === 'send' ? (_screened_releasedReviewId = screened.releasedReviewId) != null ? _screened_releasedReviewId : null : null
             }, enrollmentRef ? {
                 priority: 'bulk'
-            } : {}, {
-                // `topicId` is `''` for a step that belongs to no stream, which
-                // every reader of it treats as absent — see `flowSubscriptionTopicId`.
-                // The consent group comes off the org the run already holds, so the
-                // gate honors an unsubscribe from any site of a declared group —
-                // the sender this site mails as — and the org's confirmation switch,
-                // at no extra read.
+            } : {}, transactional ? {} : {
                 marketing: {
                     hostId,
                     siteBase,
@@ -544,15 +599,15 @@ export function makeWorkflowContextLoader(hostRef) {
             }
             if (sendError) return failed(sendError);
         } else if (step.type === 'enrollList') {
-            var _payload_email1, _ref6;
+            var _payload_email2, _ref7;
             var _step_listId, _step_listName;
             const orgId = await resolveOrgIdForHost(hostId);
-            const email = String((_payload_email1 = payload.email) != null ? _payload_email1 : '').trim().toLowerCase();
+            const email = String((_payload_email2 = payload.email) != null ? _payload_email2 : '').trim().toLowerCase();
             if (!orgId || !email || !email.includes('@')) {
                 return failed('no email to enroll');
             }
             const listsRef = firebaseAdmin.app().firestore().collection('orgs').doc(orgId).collection('lists');
-            const listDoc = ((_step_listId = step.listId) == null ? void 0 : _step_listId.trim()) ? await listsRef.doc(step.listId.trim()).get() : (await listsRef.where('name', '==', (_ref6 = (_step_listName = step.listName) == null ? void 0 : _step_listName.trim()) != null ? _ref6 : '').limit(1).get()).docs[0];
+            const listDoc = ((_step_listId = step.listId) == null ? void 0 : _step_listId.trim()) ? await listsRef.doc(step.listId.trim()).get() : (await listsRef.where('name', '==', (_ref7 = (_step_listName = step.listName) == null ? void 0 : _step_listName.trim()) != null ? _ref7 : '').limit(1).get()).docs[0];
             if (!(listDoc == null ? void 0 : listDoc.exists)) {
                 return failed(`unknown list "${step.listName || step.listId}"`);
             }
@@ -567,9 +622,9 @@ export function makeWorkflowContextLoader(hostRef) {
                 source: `${run.kind}:${run.id}`
             });
         } else if (step.type === 'assignCampaign') {
-            var _payload_email2, _env_orgId, _ref7, _ref8;
+            var _payload_email3, _env_orgId, _ref8, _ref9;
             var _step_campaignId, _step_campaignName;
-            const email = String((_payload_email2 = payload.email) != null ? _payload_email2 : '').trim().toLowerCase();
+            const email = String((_payload_email3 = payload.email) != null ? _payload_email3 : '').trim().toLowerCase();
             if (!email || !email.includes('@')) {
                 return failed('no contact email to assign');
             }
@@ -615,10 +670,10 @@ export function makeWorkflowContextLoader(hostRef) {
             // declaration says they are stored.
             const containerStore = firebaseAdmin.app().firestore();
             const usable = (container)=>Boolean((container == null ? void 0 : container.live) && visibleToHost(container.visibleTo, hostId));
-            const namedId = (_ref7 = (_step_campaignId = step.campaignId) == null ? void 0 : _step_campaignId.trim()) != null ? _ref7 : '';
+            const namedId = (_ref8 = (_step_campaignId = step.campaignId) == null ? void 0 : _step_campaignId.trim()) != null ? _ref8 : '';
             const campaign = namedId ? (await readOrgContainers(containerStore, 'campaign', campaignOrgId, [
                 namedId
-            ]))[0] : (await findOrgContainersByName(containerStore, 'campaign', campaignOrgId, (_ref8 = (_step_campaignName = step.campaignName) == null ? void 0 : _step_campaignName.trim()) != null ? _ref8 : '', 10)).find(usable);
+            ]))[0] : (await findOrgContainersByName(containerStore, 'campaign', campaignOrgId, (_ref9 = (_step_campaignName = step.campaignName) == null ? void 0 : _step_campaignName.trim()) != null ? _ref9 : '', 10)).find(usable);
             if (!(campaign == null ? void 0 : campaign.exists)) {
                 return failed(`unknown campaign "${campaignLabel}"`);
             }
@@ -979,9 +1034,45 @@ export function makeWorkflowContextLoader(hostRef) {
  * tunes by watching the site, not by reading a log. The events people
  * actually debug are the server-emitted ones (a form submission, a
  * booking, a sign-up), and those are low-volume by construction.
- */ const SKIP_LOG_EXCLUDED_EVENTS = new Set([
+ */ export const SKIP_LOG_EXCLUDED_EVENTS = new Set([
     'pageView'
 ]);
+/**
+ * Whether an action's unmet conditions only say it is ANOTHER FORM'S
+ * (AGL-3458) — the case that is noise rather than an answer.
+ *
+ * A site with one auto-reply per form keyed on `formId equals …` would write
+ * a `Skipped` row for every other form's reply on every submission: eight
+ * rows a fill on a nine-form site, burying the one row that explains a real
+ * miss. A form picked by id cannot be mistyped, so its mismatch against a
+ * submission that names a DIFFERENT form says only "not this form", and it
+ * is not recorded. Every other unmet condition still is: a hand-typed
+ * `formName`, a field condition, a submission that names no form at all.
+ *
+ * With `and`, one such clause is the whole answer; with `or`, only when every
+ * clause is about which form it was — `formId` or `formName` equals — since
+ * any other clause could have been the one that was meant to match.
+ */ export function conditionsNameAnotherForm(trigger, payload) {
+    var _payload_formId;
+    const submitted = String((_payload_formId = payload['formId']) != null ? _payload_formId : '').trim();
+    if (!submitted) return false;
+    const clauses = normalizeTriggerConditions(trigger);
+    const another = (clause)=>{
+        var _clause_field, _clause_value, _clause_value1;
+        return ((_clause_field = clause.field) == null ? void 0 : _clause_field.trim()) === 'formId' && clause.op === 'equals' && Boolean((_clause_value = clause.value) == null ? void 0 : _clause_value.trim()) && ((_clause_value1 = clause.value) == null ? void 0 : _clause_value1.trim()) !== submitted;
+    };
+    if ((trigger == null ? void 0 : trigger.combinator) === 'or') {
+        return clauses.some(another) && clauses.every((clause)=>{
+            var _ref;
+            var _clause_field;
+            return clause.op === 'equals' && [
+                'formId',
+                'formName'
+            ].includes((_ref = (_clause_field = clause.field) == null ? void 0 : _clause_field.trim()) != null ? _ref : '');
+        });
+    }
+    return clauses.some(another);
+}
 /**
  * Writes the `Skipped` row (AGL-2171): which condition stopped the run,
  * so the answer to "why didn't it fire?" is in the same place as every
@@ -989,7 +1080,7 @@ export function makeWorkflowContextLoader(hostRef) {
  *
  * Never counts against `actionRunsPerMonth` — nothing executed, and
  * charging for a condition that said no would be its own bug.
- */ async function recordSkippedRun(hostRef, actionId, action, event, kind = 'action') {
+ */ async function recordSkippedRun(hostRef, actionId, action, event, kind = 'action', /** What stopped it, when it was not an unmet condition. */ because) {
     var _action_name;
     if (SKIP_LOG_EXCLUDED_EVENTS.has(event)) return;
     // `normalizeTriggerConditions`, not `trigger.conditions` — a pre-AGL-565
@@ -999,7 +1090,7 @@ export function makeWorkflowContextLoader(hostRef) {
         var _ref;
         return String((_ref = condition == null ? void 0 : condition.field) != null ? _ref : '').trim();
     }).filter(Boolean);
-    const reason = named.length ? `Condition on ${named.slice(0, 3).join(', ')} not met` : 'Trigger condition not met';
+    const reason = because != null ? because : named.length ? `Condition on ${named.slice(0, 3).join(', ')} not met` : 'Trigger condition not met';
     await hostRef.collection('activity').add(_extends({
         actorId: null,
         actorEmail: null
@@ -1046,8 +1137,7 @@ export function makeWorkflowContextLoader(hostRef) {
         var _ref, _ref1;
         const firestore = firebaseAdmin.app().firestore();
         const hostRef = firestore.collection('hosts').doc(hostId);
-        const triggered = await hostRef.collection('actions').where('trigger.event', '==', event).limit(MAX_TRIGGERED_ACTIONS).get();
-        const actions = triggered.docs.filter((doc)=>!doc.get('deletedAt') && doc.get('enabled') !== false);
+        const actions = await liveActionsForEvent(hostRef, event);
         /*
      * THE ORGANIZATION'S AUTOMATIONS placed on this site and not paused here.
      *
@@ -1123,12 +1213,17 @@ export function makeWorkflowContextLoader(hostRef) {
             const action = doc.data();
             const filter = (_action_trigger = action.trigger) == null ? void 0 : (_action_trigger_filter = _action_trigger.filter) == null ? void 0 : _action_trigger_filter.trim();
             if (filter) {
+                const unrunnable = triggerFilterProblem(filter);
+                if (unrunnable) {
+                    await recordSkippedRun(hostRef, doc.id, action, event, 'action', unrunnable);
+                    continue;
+                }
                 try {
                     if (!evaluateExpression(filter, _extends({
                         event
                     }, payload))) continue;
                 } catch (unused) {
-                    continue; // A broken filter never fires.
+                    continue; // A field the filter names is not on this event.
                 }
             }
             // Structured payload conditions (AGL-557; AND/OR chaining AGL-565):
@@ -1142,7 +1237,9 @@ export function makeWorkflowContextLoader(hostRef) {
                 // common support question about automations — had no answer
                 // anywhere in the product, while `/product/workflows` advertises
                 // an amber `Skipped` row that answers it.
-                await recordSkippedRun(hostRef, doc.id, action, event);
+                if (!conditionsNameAnotherForm(action.trigger, payload)) {
+                    await recordSkippedRun(hostRef, doc.id, action, event);
+                }
                 continue;
             }
             executed += 1;
@@ -1157,18 +1254,25 @@ export function makeWorkflowContextLoader(hostRef) {
             const automation = doc.data();
             const filter = (_automation_trigger = automation.trigger) == null ? void 0 : (_automation_trigger_filter = _automation_trigger.filter) == null ? void 0 : _automation_trigger_filter.trim();
             if (filter) {
+                const unrunnable = triggerFilterProblem(filter);
+                if (unrunnable) {
+                    await recordSkippedRun(hostRef, doc.id, automation, event, 'orgAutomation', unrunnable);
+                    continue;
+                }
                 try {
                     if (!evaluateExpression(filter, _extends({
                         event
                     }, payload))) continue;
                 } catch (unused) {
-                    continue; // A broken filter never fires.
+                    continue; // A field the filter names is not on this event.
                 }
             }
             if (!evaluateTriggerConditions(automation.trigger, _extends({
                 event
             }, payload))) {
-                await recordSkippedRun(hostRef, doc.id, automation, event, 'orgAutomation');
+                if (!conditionsNameAnotherForm(automation.trigger, payload)) {
+                    await recordSkippedRun(hostRef, doc.id, automation, event, 'orgAutomation');
+                }
                 continue;
             }
             executed += 1;