@amalgm/automations 0.1.0 → 0.1.1

package/AXIOMS.md

@@ -27,6 +27,11 @@
     automation's owner.
 11. Storage records, Supabase RPCs, HTTP details, and MCP protocol details are
     implementation concerns, not SDK concepts.
-12. During cutover, legacy and replacement implementations never write the
-    same authority concurrently. Completed cutover deletes the legacy
-    implementation.
+12. The control-plane SDK is the only configuration write path. The delivery
+    rail reads that configuration and writes only schedule clocks and run
+    state; it never owns a second automation-definition API.
+13. Admitting a run atomically verifies the current enabled configuration,
+    stores a secret-free snapshot, and, for a schedule, advances exactly the
+    firing instant that was claimed.
+14. Legacy local automation storage is not a compatibility authority. Engine
+    cutover migrates callers to this SDK and then deletes the old store.

package/PURPOSE.md

@@ -17,10 +17,13 @@ The product has two composable halves over that one state:
   skill are adapters over that contract; they do not access Supabase directly
   or implement lifecycle rules.
 - **The delivery rail** — trigger admission, scheduling, and run state: the
-  receipt-before-auth, lease, retry, and idempotency laws that decide when a
-  run happens. When a machine is offline, new runs remain pending; when it
-  reconnects, every pending run is sent through Amalgm's existing transport and
-  started by the existing host runtime. Execution itself stays on the machine.
+  authentication, atomic admission, schedule-claim, reconnect, and
+  idempotency laws that decide when a run happens. It consumes the control
+  plane's persisted configuration; it does not expose another definition
+  write path. When a machine is offline, new runs remain pending; when it
+  reconnects, every pending run is sent through Amalgm's existing transport
+  and started by the existing host runtime. Execution itself stays on the
+  machine.
 
 Amalgm supplies a resolved authenticated principal from its user session or
 HMAC-refresh flow; future API keys resolve to the same principal capability.
@@ -31,5 +34,5 @@ the other's storage or reimplements the other's decisions.
 
 This extraction is complete only when every Automations surface in Engine calls
 this product service, product state has one writer, migrated behavior has parity
-tests, and the legacy `amalgm-mcp` automation implementation and storage are
-deleted.
+tests, and the local `amalgm-mcp` automation implementation and storage are
+deleted rather than retained as a compatibility layer.

package/README.md

@@ -81,8 +81,6 @@ const automations = new Automations(new SupabaseStore(getSupabase()), {
   send: (run) => existingTunnel.send(run.targetId, run),
 });
 
-await automations.save(authenticatedUser.id, definition);
-
 await automations.receiveEvent({
   target: await core.resolveEventTarget(eventRef),
   headers,
@@ -97,24 +95,24 @@ await automations.updateRun({ userId, targetId }, runId, {
   output,
 });
 
-const history = await automations.listRuns(userId, automationId);
+const history = await sdk.runs.list(automationId);
 ```
 
-`save`, `receiveEvent`, `fireDueCrons`, `targetOnline`, `updateRun`, and
-`listRuns` own the decisions.
-The surrounding Engine route, MCP tool, scheduler callback, and tunnel callback
-only translate and call them.
+Configuration is written only through the auth-bound SDK shown above. The
+delivery rail exposes `receiveEvent`, `fireDueCrons`, `targetOnline`, and
+`updateRun`; it has no parallel save, delete, or history API. The surrounding
+Engine route, scheduler callback, and tunnel callback only translate and call
+these SDK operations.
 
 Every firing stores an immutable run snapshot in Supabase. Delivery and machine
 execution update that record instead of deleting it. When a machine is offline,
 new runs remain pending; on reconnect every pending run drains through the
 existing transport.
 
-The current implementation covers Supabase definitions, cron and event
-admission, secret verification, permanent run history, and reconnect drain. The
-remaining extraction is the proven workflow definition, validation,
-orchestration, and public surface behavior still owned by `amalgm-mcp`; it must
-move behind this same service boundary before legacy code is removed.
+The implementation covers Supabase definitions, cron and event admission,
+secret verification, permanent run history, and reconnect drain. Engine
+cutover must call these published contracts and delete its local automation
+store; this package intentionally provides no compatibility storage path.
 
 The purpose is in [PURPOSE.md](./PURPOSE.md), and the non-negotiable ownership
 rules are in [AXIOMS.md](./AXIOMS.md).

package/dist/src/automations.d.ts

@@ -1,4 +1,4 @@
-import type { AutomationDefinition, AutomationLog, AutomationRun, AutomationStore, AutomationTarget, AutomationTransport, Json, RunUpdate } from './types.js';
+import type { AutomationLog, AutomationRun, AutomationStore, AutomationTarget, AutomationTransport, Json, RunUpdate } from './types.js';
 export declare class EventRejectedError extends Error {
     constructor();
 }
@@ -8,9 +8,6 @@ export declare class Automations {
     readonly transport: AutomationTransport;
     readonly log: AutomationLog;
     constructor(store: AutomationStore, transport: AutomationTransport, log?: AutomationLog);
-    save(userId: string, definition: AutomationDefinition, now?: Date): Promise<void>;
-    delete(userId: string, automationId: string): Promise<boolean>;
-    listRuns(userId: string, automationId?: string): Promise<AutomationRun[]>;
     receiveEvent(input: {
         target: AutomationTarget;
         headers: Record<string, string>;

package/dist/src/automations.js

@@ -1,6 +1,5 @@
-import { nextCronAt, validateCron } from './schedule.js';
+import { nextCronAt } from './schedule.js';
 import { eventReferences, matchesEvent, verifyEventSecret } from './webhook.js';
-const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
 const noop = () => { };
 export class EventRejectedError extends Error {
     constructor() {
@@ -18,16 +17,6 @@ export class Automations {
         this.transport = transport;
         this.log = log;
     }
-    async save(userId, definition, now = new Date()) {
-        const automation = prepareAutomation(userId, definition, now);
-        await this.store.saveAutomation(automation);
-    }
-    delete(userId, automationId) {
-        return this.store.deleteAutomation(userId, automationId);
-    }
-    listRuns(userId, automationId) {
-        return this.store.listRuns(userId, automationId);
-    }
     async receiveEvent(input) {
         assertJson(input.payload, 'Event payload');
         const candidates = await this.store.eventTriggers(input.target);
@@ -135,53 +124,6 @@ export class Automations {
         return sent;
     }
 }
-function prepareAutomation(userId, definition, now) {
-    if (!ID.test(definition.id))
-        throw new Error('Automation id is invalid');
-    if (!userId)
-        throw new Error('Automation userId is required');
-    if (!definition.targetId)
-        throw new Error('Automation targetId is required');
-    if (!ID.test(definition.trigger.id))
-        throw new Error('Trigger id is invalid');
-    if (!ID.test(definition.workflow.id))
-        throw new Error('Workflow id is invalid');
-    if (!definition.workflow.script.trim())
-        throw new Error('Workflow script is required');
-    if (definition.workflow.compiled !== undefined) {
-        assertJson(definition.workflow.compiled, 'Compiled workflow');
-    }
-    if (definition.workflow.allowlist !== undefined) {
-        assertJson(definition.workflow.allowlist, 'Workflow allowlist');
-    }
-    if (definition.workflow.limits !== undefined) {
-        assertJson(definition.workflow.limits, 'Workflow limits');
-    }
-    const trigger = definition.trigger.kind === 'event'
-        ? prepareEventTrigger(definition.trigger)
-        : prepareCronTrigger(definition.trigger, now);
-    return { ...definition, userId, enabled: definition.enabled !== false, trigger };
-}
-function prepareEventTrigger(trigger) {
-    if (trigger.secret.length < 16)
-        throw new Error(`Event trigger ${trigger.id} secret is too short`);
-    return {
-        ...trigger,
-        enabled: trigger.enabled !== false,
-        source: trigger.source || '*',
-        event: trigger.event || '*',
-    };
-}
-function prepareCronTrigger(trigger, now) {
-    const timezone = trigger.timezone || 'UTC';
-    validateCron(trigger.cron, timezone);
-    return {
-        ...trigger,
-        enabled: trigger.enabled !== false,
-        timezone,
-        nextRunAt: nextCronAt(trigger.cron, timezone, now),
-    };
-}
 function assertJson(value, label) {
     if (value === null || typeof value === 'string' || typeof value === 'boolean')
         return;

package/dist/src/crud.d.ts

@@ -1,14 +1,20 @@
 import type { Automation, AutomationCrud, AutomationCrudService as AutomationCrudServiceContract, AutomationPrincipal, AutomationRun, CreateAutomation, CreateScheduleTrigger, CreateWebhookTrigger, CreateWorkflow, ListAutomations, ListRuns, Page, PageQuery, ScheduleTrigger, Trigger, UpdateAutomation, UpdateScheduleTrigger, UpdateWebhookTrigger, UpdateWorkflow, WebhookTrigger, Workflow } from './contract.js';
+export type StoredScheduleCreate = Required<CreateScheduleTrigger> & {
+    nextRunAt: string;
+};
+export type StoredScheduleUpdate = UpdateScheduleTrigger & {
+    nextRunAt?: string;
+};
 export interface AutomationCrudRepository {
     createAutomation(userId: string, input: Required<CreateAutomation>): Promise<Automation>;
     listAutomations(userId: string, query: NormalizedListAutomations): Promise<Page<Automation>>;
     getAutomation(userId: string, automationId: string): Promise<Automation | null>;
     updateAutomation(userId: string, automationId: string, patch: UpdateAutomation): Promise<Automation | null>;
     deleteAutomation(userId: string, automationId: string): Promise<boolean>;
-    createScheduleTrigger(userId: string, automationId: string, input: Required<CreateScheduleTrigger>): Promise<ScheduleTrigger>;
+    createScheduleTrigger(userId: string, automationId: string, input: StoredScheduleCreate): Promise<ScheduleTrigger>;
     listScheduleTriggers(userId: string, automationId: string, query: Required<PageQuery>): Promise<Page<ScheduleTrigger>>;
     getScheduleTrigger(userId: string, automationId: string, triggerId: string): Promise<ScheduleTrigger | null>;
-    updateScheduleTrigger(userId: string, automationId: string, triggerId: string, patch: UpdateScheduleTrigger): Promise<ScheduleTrigger | null>;
+    updateScheduleTrigger(userId: string, automationId: string, triggerId: string, patch: StoredScheduleUpdate): Promise<ScheduleTrigger | null>;
     deleteScheduleTrigger(userId: string, automationId: string, triggerId: string): Promise<boolean>;
     createWebhookTrigger(userId: string, automationId: string, input: Required<CreateWebhookTrigger>): Promise<WebhookTrigger>;
     listWebhookTriggers(userId: string, automationId: string, query: Required<PageQuery>): Promise<Page<WebhookTrigger>>;
@@ -27,6 +33,7 @@ export type NormalizedListAutomations = Required<PageQuery> & Omit<ListAutomatio
 export type NormalizedListRuns = Required<PageQuery> & Omit<ListRuns, keyof PageQuery>;
 export declare class AutomationCrudService implements AutomationCrudServiceContract {
     private readonly repository;
-    constructor(repository: AutomationCrudRepository);
+    private readonly clock;
+    constructor(repository: AutomationCrudRepository, clock?: () => Date);
     for(principal: AutomationPrincipal): AutomationCrud;
 }

package/dist/src/crud.js

@@ -1,10 +1,13 @@
 import { ConflictError, ForbiddenError, NotFoundError } from './errors.js';
 import { parseCreateAutomation, parseCreateScheduleTrigger, parseCreateWebhookTrigger, parseCreateWorkflow, parseListAutomations, parseListRuns, parsePageQuery, parseUpdateAutomation, parseUpdateScheduleTrigger, parseUpdateWebhookTrigger, parseUpdateWorkflow, } from './schema.js';
 import { id, newId, page, requiredText, schedule, } from './validation.js';
+import { nextCronAt } from './schedule.js';
 export class AutomationCrudService {
     repository;
-    constructor(repository) {
+    clock;
+    constructor(repository, clock = () => new Date()) {
         this.repository = repository;
+        this.clock = clock;
     }
     for(principal) {
         assertPrincipal(principal);
@@ -88,6 +91,7 @@ export class AutomationCrudService {
                             cron: parsed.cron,
                             timezone,
                             enabled: parsed.enabled !== false,
+                            nextRunAt: nextCronAt(parsed.cron, timezone, this.clock()),
                         });
                     },
                     list: async (automationId, query = {}) => {
@@ -104,13 +108,17 @@ export class AutomationCrudService {
                         write();
                         await exists(automationId);
                         const parsed = parseUpdateScheduleTrigger(patch);
+                        let storedPatch = parsed;
                         if (parsed.cron !== undefined || parsed.timezone !== undefined) {
                             const existing = await this.repository.getScheduleTrigger(principal.userId, automationId, triggerId);
                             if (!existing)
                                 throw new NotFoundError('Schedule trigger');
-                            schedule(parsed.cron ?? existing.cron, parsed.timezone ?? existing.timezone);
+                            const cron = parsed.cron ?? existing.cron;
+                            const timezone = parsed.timezone ?? existing.timezone;
+                            schedule(cron, timezone);
+                            storedPatch = { ...parsed, nextRunAt: nextCronAt(cron, timezone, this.clock()) };
                         }
-                        const updated = await this.repository.updateScheduleTrigger(principal.userId, automationId, id(triggerId, 'Schedule trigger id'), parsed);
+                        const updated = await this.repository.updateScheduleTrigger(principal.userId, automationId, id(triggerId, 'Schedule trigger id'), storedPatch);
                         if (!updated)
                             throw new NotFoundError('Schedule trigger');
                         return updated;

package/dist/src/index.d.ts

@@ -11,4 +11,4 @@ export { nextCronAt, validateCron } from './schedule.js';
 export { eventReference, eventReferences, matchesEvent, normalizeHeaders, verifyEventSecret, } from './webhook.js';
 export { SupabaseStore } from './supabase-store.js';
 export type { SupabaseRpcClient as SupabaseStoreRpcClient } from './supabase-store.js';
-export type { AutomationDefinition, AutomationLog, AutomationRun as AutomationRunRecord, AutomationStore, AutomationTarget, AutomationTransport, CronTrigger, DueCronTrigger, EventTrigger, PreparedAutomation, PreparedTrigger, RunInput, RunUpdate, StoredEventTrigger, Trigger as StoreTrigger, WorkflowDefinition, } from './types.js';
+export type { AutomationLog, AutomationRun as AutomationRunRecord, AutomationStore, AutomationTarget, AutomationTransport, DueCronTrigger, RunInput, RunUpdate, StoredEventTrigger, } from './types.js';

package/dist/src/index.js

@@ -1,8 +1,8 @@
 // The automation product has two composable halves:
 //  - the configuration service (contract/crud/http/mcp/cli) — Supabase owns
 //    everything except execution;
-//  - the delivery rail (automations/webhook/schedule/store) — the receipt,
-//    lease, and retry laws that decide when a run happens.
+//  - the delivery rail (automations/webhook/schedule/store) — authenticated
+//    admission, schedule claims, reconnect drain, and run-state transitions.
 // Colliding names keep the contract's spelling; the rail's store-level
 // records are exported under Store-scoped aliases.
 export { createAutomationClient } from './client.js';

package/dist/src/supabase-crud.d.ts

@@ -1,5 +1,5 @@
-import type { Automation, AutomationRun, CreateAutomation, CreateScheduleTrigger, CreateWebhookTrigger, CreateWorkflow, Page, ScheduleTrigger, Trigger, UpdateAutomation, UpdateScheduleTrigger, UpdateWebhookTrigger, UpdateWorkflow, WebhookTrigger, Workflow } from './contract.js';
-import type { AutomationCrudRepository, NormalizedListAutomations, NormalizedListRuns } from './crud.js';
+import type { Automation, AutomationRun, CreateAutomation, CreateWebhookTrigger, CreateWorkflow, Page, ScheduleTrigger, Trigger, UpdateAutomation, UpdateWebhookTrigger, UpdateWorkflow, WebhookTrigger, Workflow } from './contract.js';
+import type { AutomationCrudRepository, NormalizedListAutomations, NormalizedListRuns, StoredScheduleCreate, StoredScheduleUpdate } from './crud.js';
 export interface SupabaseRpcClient {
     rpc(functionName: string, arguments_: Record<string, unknown>): PromiseLike<{
         data: unknown;
@@ -18,13 +18,13 @@ export declare class SupabaseAutomationCrudRepository implements AutomationCrudR
     getAutomation(userId: string, automationId: string): Promise<Automation | null>;
     updateAutomation(userId: string, automationId: string, patch: UpdateAutomation): Promise<Automation | null>;
     deleteAutomation(userId: string, automationId: string): Promise<boolean>;
-    createScheduleTrigger(userId: string, automationId: string, input: Required<CreateScheduleTrigger>): Promise<ScheduleTrigger>;
+    createScheduleTrigger(userId: string, automationId: string, input: StoredScheduleCreate): Promise<ScheduleTrigger>;
     listScheduleTriggers(userId: string, automationId: string, query: Required<{
         limit?: number;
         offset?: number;
     }>): Promise<Page<ScheduleTrigger>>;
     getScheduleTrigger(userId: string, automationId: string, triggerId: string): Promise<ScheduleTrigger | null>;
-    updateScheduleTrigger(userId: string, automationId: string, triggerId: string, patch: UpdateScheduleTrigger): Promise<ScheduleTrigger | null>;
+    updateScheduleTrigger(userId: string, automationId: string, triggerId: string, patch: StoredScheduleUpdate): Promise<ScheduleTrigger | null>;
     deleteScheduleTrigger(userId: string, automationId: string, triggerId: string): Promise<boolean>;
     createWebhookTrigger(userId: string, automationId: string, input: Required<CreateWebhookTrigger>): Promise<WebhookTrigger>;
     listWebhookTriggers(userId: string, automationId: string, query: Required<{

package/dist/src/supabase-store.d.ts

@@ -1,4 +1,4 @@
-import type { AutomationStore, AutomationTarget, AutomationRun, DueCronTrigger, PreparedAutomation, RunInput, RunUpdate, StoredEventTrigger } from './types.js';
+import type { AutomationStore, AutomationTarget, AutomationRun, DueCronTrigger, RunInput, RunUpdate, StoredEventTrigger } from './types.js';
 export interface SupabaseRpcClient {
     rpc(functionName: string, arguments_: Record<string, unknown>): PromiseLike<{
         data: unknown;
@@ -11,8 +11,6 @@ export declare class SupabaseStore implements AutomationStore {
     #private;
     readonly client: SupabaseRpcClient;
     constructor(client: SupabaseRpcClient);
-    saveAutomation(automation: PreparedAutomation): Promise<void>;
-    deleteAutomation(userId: string, automationId: string): Promise<boolean>;
     eventTriggers(target: AutomationTarget): Promise<StoredEventTrigger[]>;
     dueCronTriggers(now: Date): Promise<DueCronTrigger[]>;
     enqueueEvent(trigger: StoredEventTrigger, input: Extract<RunInput, {
@@ -20,7 +18,6 @@ export declare class SupabaseStore implements AutomationStore {
     }>, now: Date): Promise<AutomationRun | null>;
     enqueueCron(trigger: DueCronTrigger, nextRunAt: string, now: Date): Promise<AutomationRun | null>;
     pendingRuns(target: AutomationTarget): Promise<AutomationRun[]>;
-    listRuns(userId: string, automationId?: string): Promise<AutomationRun[]>;
     markSent(runId: string, target: AutomationTarget, now: Date): Promise<boolean>;
     updateRun(target: AutomationTarget, runId: string, update: RunUpdate): Promise<AutomationRun | null>;
 }

package/dist/src/supabase-store.js

@@ -22,15 +22,6 @@ export class SupabaseStore {
     constructor(client) {
         this.client = client;
     }
-    async saveAutomation(automation) {
-        await this.#call('save_amalgm_automation', { p_automation: automation });
-    }
-    deleteAutomation(userId, automationId) {
-        return this.#call('delete_amalgm_automation', {
-            p_user_id: userId,
-            p_automation_id: automationId,
-        });
-    }
     async eventTriggers(target) {
         const rows = await this.#call('list_amalgm_event_triggers', {
             p_user_id: target.userId,
@@ -76,13 +67,6 @@ export class SupabaseStore {
         });
         return rows.map(automationRun);
     }
-    async listRuns(userId, automationId) {
-        const rows = await this.#call('list_amalgm_runs', {
-            p_user_id: userId,
-            p_automation_id: automationId || null,
-        });
-        return rows.map(automationRun);
-    }
     markSent(runId, target, now) {
         return this.#call('mark_amalgm_run_sent', {
             p_run_id: runId,

package/dist/src/types.d.ts

@@ -1,58 +1,10 @@
-export type Json = null | boolean | number | string | Json[] | {
-    [key: string]: Json;
-};
-interface TriggerBase {
-    id: string;
-    enabled?: boolean;
-}
-export interface CronTrigger extends TriggerBase {
-    kind: 'cron';
-    cron: string;
-    timezone?: string;
-}
-export interface EventTrigger extends TriggerBase {
-    kind: 'event';
-    source?: string;
-    event?: string;
-    secret: string;
-}
-export type Trigger = CronTrigger | EventTrigger;
-export interface WorkflowDefinition {
-    id: string;
-    name?: string;
-    script: string;
-    compiled?: Json;
-    allowlist?: Json;
-    limits?: Json;
-}
-export interface AutomationDefinition {
-    id: string;
-    targetId: string;
-    name?: string;
-    description?: string;
-    enabled?: boolean;
-    trigger: Trigger;
-    workflow: WorkflowDefinition;
-}
+import type { Json } from './contract.js';
+export type { Json } from './contract.js';
 /** The only authenticated identity Automations accepts from Core. */
 export interface AutomationTarget {
     userId: string;
     targetId: string;
 }
-export type PreparedTrigger = (CronTrigger & {
-    enabled: boolean;
-    timezone: string;
-    nextRunAt: string;
-}) | (EventTrigger & {
-    enabled: boolean;
-    source: string;
-    event: string;
-});
-export interface PreparedAutomation extends Omit<AutomationDefinition, 'enabled' | 'trigger'> {
-    userId: string;
-    enabled: boolean;
-    trigger: PreparedTrigger;
-}
 interface StoredTriggerBase {
     userId: string;
     automationId: string;
@@ -106,8 +58,6 @@ export interface RunUpdate {
     error?: string;
 }
 export interface AutomationStore {
-    saveAutomation(automation: PreparedAutomation): Promise<void>;
-    deleteAutomation(userId: string, automationId: string): Promise<boolean>;
     eventTriggers(target: AutomationTarget): Promise<StoredEventTrigger[]>;
     dueCronTriggers(now: Date): Promise<DueCronTrigger[]>;
     enqueueEvent(trigger: StoredEventTrigger, input: Extract<RunInput, {
@@ -115,7 +65,6 @@ export interface AutomationStore {
     }>, now: Date): Promise<AutomationRun | null>;
     enqueueCron(trigger: DueCronTrigger, nextRunAt: string, now: Date): Promise<AutomationRun | null>;
     pendingRuns(target: AutomationTarget): Promise<AutomationRun[]>;
-    listRuns(userId: string, automationId?: string): Promise<AutomationRun[]>;
     markSent(runId: string, target: AutomationTarget, now: Date): Promise<boolean>;
     updateRun(target: AutomationTarget, runId: string, update: RunUpdate): Promise<AutomationRun | null>;
 }
@@ -125,4 +74,3 @@ export interface AutomationTransport {
     send(run: AutomationRun): Promise<boolean>;
 }
 export type AutomationLog = (event: 'event.rejected' | 'run.pending' | 'drain.started' | 'run.sent' | 'run.failed', details: Readonly<Record<string, string>>) => void;
-export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.1.0",
-  "description": "Amalgm's automation product: Supabase-backed configuration plus the delivery rail (receipts, leases, retries).",
+  "version": "0.1.1",
+  "description": "Amalgm's cloud automation SDK: Supabase-backed configuration, trigger admission, and run delivery.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",

package/supabase/migrations/20260802000000_create_automations.sql

@@ -1,6 +1,5 @@
--- Isolated integration-test schema for this service. The canonical deployment
--- copy is amalgm-ui/supabase/migrations/20260806210000_create_automations.sql.
--- Keep their SQL bodies equivalent.
+-- Automations owns this schema contract. Deployments consume this migration;
+-- no UI or local-runtime store is an authority for these records.
 
 CREATE EXTENSION IF NOT EXISTS pgcrypto;
 
@@ -40,6 +39,7 @@ CREATE TABLE amalgm_automation_triggers (
   enabled boolean NOT NULL DEFAULT true,
   cron text,
   timezone text,
+  next_run_at timestamptz,
   source text,
   event text,
   secret text,
@@ -50,16 +50,22 @@ CREATE TABLE amalgm_automation_triggers (
     REFERENCES amalgm_automations(user_id, id) ON DELETE CASCADE,
   CHECK (
     (kind = 'schedule' AND cron IS NOT NULL AND timezone IS NOT NULL
-      AND source IS NULL AND event IS NULL AND secret IS NULL)
+      AND next_run_at IS NOT NULL AND source IS NULL AND event IS NULL
+      AND secret IS NULL)
     OR
-    (kind = 'webhook' AND cron IS NULL AND timezone IS NULL AND source IS NOT NULL
-      AND event IS NOT NULL AND length(secret) >= 16)
+    (kind = 'webhook' AND cron IS NULL AND timezone IS NULL
+      AND next_run_at IS NULL AND source IS NOT NULL AND event IS NOT NULL
+      AND length(secret) >= 16)
   )
 );
 
 CREATE INDEX amalgm_automation_triggers_by_automation
   ON amalgm_automation_triggers(user_id, automation_id, kind, created_at, id);
 
+CREATE INDEX amalgm_automation_schedules_due
+  ON amalgm_automation_triggers(next_run_at, user_id, automation_id, id)
+  WHERE kind = 'schedule' AND enabled;
+
 CREATE TABLE amalgm_automation_runs (
   id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
   user_id uuid NOT NULL,
@@ -82,6 +88,10 @@ CREATE TABLE amalgm_automation_runs (
 CREATE INDEX amalgm_automation_runs_history
   ON amalgm_automation_runs(user_id, automation_id, created_at DESC, id DESC);
 
+CREATE INDEX amalgm_automation_runs_pending
+  ON amalgm_automation_runs(user_id, target_id, created_at, id)
+  WHERE status = 'pending';
+
 ALTER TABLE amalgm_automations ENABLE ROW LEVEL SECURITY;
 ALTER TABLE amalgm_automation_workflows ENABLE ROW LEVEL SECURITY;
 ALTER TABLE amalgm_automation_triggers ENABLE ROW LEVEL SECURITY;
@@ -100,6 +110,7 @@ AS $$
     'enabled', p_trigger.enabled,
     'cron', p_trigger.cron,
     'timezone', p_trigger.timezone,
+    'next_run_at', p_trigger.next_run_at,
     'source', p_trigger.source,
     'event', p_trigger.event,
     'secret_configured', p_trigger.secret IS NOT NULL,
@@ -221,10 +232,11 @@ DECLARE
   v_row amalgm_automation_triggers;
 BEGIN
   INSERT INTO amalgm_automation_triggers (
-    user_id, automation_id, id, kind, enabled, cron, timezone
+    user_id, automation_id, id, kind, enabled, cron, timezone, next_run_at
   )
   SELECT p_user_id, p_automation_id, p_trigger->>'id', 'schedule',
-    (p_trigger->>'enabled')::boolean, p_trigger->>'cron', p_trigger->>'timezone'
+    (p_trigger->>'enabled')::boolean, p_trigger->>'cron', p_trigger->>'timezone',
+    (p_trigger->>'nextRunAt')::timestamptz
   WHERE EXISTS (
     SELECT 1 FROM amalgm_automations
     WHERE user_id = p_user_id AND id = p_automation_id
@@ -291,6 +303,10 @@ BEGIN
   UPDATE amalgm_automation_triggers SET
     cron = CASE WHEN p_patch ? 'cron' THEN p_patch->>'cron' ELSE cron END,
     timezone = CASE WHEN p_patch ? 'timezone' THEN p_patch->>'timezone' ELSE timezone END,
+    next_run_at = CASE
+      WHEN p_patch ? 'nextRunAt' THEN (p_patch->>'nextRunAt')::timestamptz
+      ELSE next_run_at
+    END,
     enabled = CASE WHEN p_patch ? 'enabled' THEN (p_patch->>'enabled')::boolean ELSE enabled END,
     updated_at = now()
   WHERE user_id = p_user_id AND automation_id = p_automation_id
@@ -561,6 +577,208 @@ AS $$
   WHERE r.user_id = p_user_id AND r.automation_id = p_automation_id AND r.id::text = p_run_id;
 $$;
 
+CREATE FUNCTION list_amalgm_event_triggers(p_user_id uuid, p_target_id text)
+RETURNS TABLE (
+  user_id uuid,
+  automation_id text,
+  trigger_id text,
+  target_id text,
+  source text,
+  event text,
+  secret text
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT t.user_id, t.automation_id, t.id, a.target_id, t.source, t.event, t.secret
+  FROM amalgm_automation_triggers t
+  JOIN amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  WHERE t.kind = 'webhook' AND t.user_id = p_user_id
+    AND a.target_id = p_target_id AND t.enabled AND a.enabled;
+$$;
+
+CREATE FUNCTION list_due_amalgm_crons(p_now timestamptz)
+RETURNS TABLE (
+  user_id uuid,
+  automation_id text,
+  trigger_id text,
+  target_id text,
+  cron text,
+  timezone text,
+  next_run_at timestamptz
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT t.user_id, t.automation_id, t.id, a.target_id,
+    t.cron, t.timezone, t.next_run_at
+  FROM amalgm_automation_triggers t
+  JOIN amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  WHERE t.kind = 'schedule' AND t.next_run_at <= p_now
+    AND t.enabled AND a.enabled
+  ORDER BY t.next_run_at, t.user_id, t.automation_id, t.id;
+$$;
+
+CREATE FUNCTION enqueue_amalgm_run(
+  p_kind text,
+  p_user_id uuid,
+  p_automation_id text,
+  p_trigger_id text,
+  p_target_id text,
+  p_expected_next_run_at timestamptz,
+  p_next_run_at timestamptz,
+  p_input jsonb,
+  p_now timestamptz
+)
+RETURNS SETOF amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  IF p_kind = 'cron' THEN
+    PERFORM 1
+    FROM amalgm_automation_triggers t
+    JOIN amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'schedule' AND t.next_run_at = p_expected_next_run_at
+      AND t.enabled AND a.enabled
+    FOR UPDATE OF t;
+  ELSIF p_kind = 'event' THEN
+    PERFORM 1
+    FROM amalgm_automation_triggers t
+    JOIN amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'webhook' AND t.enabled AND a.enabled;
+  ELSE
+    RAISE EXCEPTION 'Invalid automation trigger kind';
+  END IF;
+  IF NOT FOUND THEN RETURN; END IF;
+
+  RETURN QUERY
+  INSERT INTO amalgm_automation_runs (
+    user_id, target_id, automation_id, trigger_id, workflow_id,
+    automation_payload, input, status, created_at
+  )
+  SELECT
+    a.user_id,
+    a.target_id,
+    a.id,
+    t.id,
+    w.id,
+    jsonb_strip_nulls(jsonb_build_object(
+      'id', a.id,
+      'targetId', a.target_id,
+      'name', a.name,
+      'description', a.description,
+      'enabled', a.enabled,
+      'trigger', jsonb_strip_nulls(jsonb_build_object(
+        'id', t.id,
+        'kind', CASE WHEN t.kind = 'schedule' THEN 'cron' ELSE 'event' END,
+        'enabled', t.enabled,
+        'cron', t.cron,
+        'timezone', t.timezone,
+        'source', t.source,
+        'event', t.event
+      )),
+      'workflow', jsonb_strip_nulls(jsonb_build_object(
+        'id', w.id,
+        'name', w.name,
+        'script', w.script,
+        'compiled', w.compiled,
+        'allowlist', w.allowlist,
+        'limits', w.limits
+      ))
+    )),
+    p_input,
+    'pending',
+    p_now
+  FROM amalgm_automations a
+  JOIN amalgm_automation_triggers t
+    ON t.user_id = a.user_id AND t.automation_id = a.id
+  JOIN amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE a.user_id = p_user_id AND a.id = p_automation_id
+    AND t.id = p_trigger_id
+  RETURNING *;
+
+  IF p_kind = 'cron' THEN
+    UPDATE amalgm_automation_triggers
+    SET next_run_at = p_next_run_at, updated_at = p_now
+    WHERE user_id = p_user_id AND automation_id = p_automation_id
+      AND id = p_trigger_id AND kind = 'schedule'
+      AND next_run_at = p_expected_next_run_at;
+  END IF;
+END;
+$$;
+
+CREATE FUNCTION list_amalgm_pending_runs(p_user_id uuid, p_target_id text)
+RETURNS SETOF amalgm_automation_runs
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT * FROM amalgm_automation_runs
+  WHERE user_id = p_user_id AND target_id = p_target_id AND status = 'pending'
+  ORDER BY created_at, id;
+$$;
+
+CREATE FUNCTION mark_amalgm_run_sent(
+  p_run_id uuid,
+  p_user_id uuid,
+  p_target_id text,
+  p_now timestamptz
+)
+RETURNS boolean
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  UPDATE amalgm_automation_runs SET status = 'sent', sent_at = p_now
+  WHERE id = p_run_id AND user_id = p_user_id AND target_id = p_target_id
+    AND status = 'pending';
+  RETURN FOUND;
+END;
+$$;
+
+CREATE FUNCTION update_amalgm_run(
+  p_run_id uuid,
+  p_user_id uuid,
+  p_target_id text,
+  p_update jsonb
+)
+RETURNS SETOF amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  IF p_update->>'status' NOT IN ('running', 'completed', 'failed') THEN
+    RAISE EXCEPTION 'Invalid run status';
+  END IF;
+
+  RETURN QUERY
+  UPDATE amalgm_automation_runs SET
+    status = p_update->>'status',
+    started_at = coalesce((p_update->>'startedAt')::timestamptz, started_at),
+    finished_at = coalesce((p_update->>'finishedAt')::timestamptz, finished_at),
+    output = CASE WHEN p_update ? 'output' THEN p_update->'output' ELSE output END,
+    error = CASE WHEN p_update ? 'error' THEN p_update->>'error' ELSE error END
+  WHERE id = p_run_id AND user_id = p_user_id AND target_id = p_target_id
+    AND status IN ('sent', 'running')
+  RETURNING *;
+END;
+$$;
+
 REVOKE ALL ON FUNCTION amalgm_trigger_json(amalgm_automation_triggers) FROM PUBLIC;
 REVOKE ALL ON FUNCTION create_amalgm_automation(uuid, jsonb) FROM PUBLIC;
 REVOKE ALL ON FUNCTION list_amalgm_automations(uuid, text, boolean, integer, integer) FROM PUBLIC;
@@ -584,6 +802,12 @@ REVOKE ALL ON FUNCTION update_amalgm_workflow(uuid, text, jsonb) FROM PUBLIC;
 REVOKE ALL ON FUNCTION delete_amalgm_workflow(uuid, text) FROM PUBLIC;
 REVOKE ALL ON FUNCTION list_amalgm_runs(uuid, text, text, integer, integer) FROM PUBLIC;
 REVOKE ALL ON FUNCTION get_amalgm_run(uuid, text, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION list_amalgm_event_triggers(uuid, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION list_due_amalgm_crons(timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION enqueue_amalgm_run(text, uuid, text, text, text, timestamptz, timestamptz, jsonb, timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION list_amalgm_pending_runs(uuid, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION mark_amalgm_run_sent(uuid, uuid, text, timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION update_amalgm_run(uuid, uuid, text, jsonb) FROM PUBLIC;
 
 GRANT EXECUTE ON FUNCTION create_amalgm_automation(uuid, jsonb) TO service_role;
 GRANT EXECUTE ON FUNCTION list_amalgm_automations(uuid, text, boolean, integer, integer) TO service_role;
@@ -607,3 +831,9 @@ GRANT EXECUTE ON FUNCTION update_amalgm_workflow(uuid, text, jsonb) TO service_r
 GRANT EXECUTE ON FUNCTION delete_amalgm_workflow(uuid, text) TO service_role;
 GRANT EXECUTE ON FUNCTION list_amalgm_runs(uuid, text, text, integer, integer) TO service_role;
 GRANT EXECUTE ON FUNCTION get_amalgm_run(uuid, text, text) TO service_role;
+GRANT EXECUTE ON FUNCTION list_amalgm_event_triggers(uuid, text) TO service_role;
+GRANT EXECUTE ON FUNCTION list_due_amalgm_crons(timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION enqueue_amalgm_run(text, uuid, text, text, text, timestamptz, timestamptz, jsonb, timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION list_amalgm_pending_runs(uuid, text) TO service_role;
+GRANT EXECUTE ON FUNCTION mark_amalgm_run_sent(uuid, uuid, text, timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION update_amalgm_run(uuid, uuid, text, jsonb) TO service_role;