@amalgm/automations 0.1.1 → 0.1.2

package/AXIOMS.md

@@ -35,3 +35,6 @@
     firing instant that was claimed.
 14. Legacy local automation storage is not a compatibility authority. Engine
     cutover migrates callers to this SDK and then deletes the old store.
+15. Event ingress returns success only after every admitted run is durable in
+    Supabase. Its recent-event list is a bounded, secret-free operational view,
+    never a second event or run authority.

package/PURPOSE.md

@@ -25,6 +25,11 @@ The product has two composable halves over that one state:
   and started by the existing host runtime. Execution itself stays on the
   machine.
 
+The event HTTP adapter is one thin door over that delivery rail. It bounds and
+parses the webhook body, resolves the authenticated target supplied by the
+host, and returns only after matching runs have been stored in Supabase. Its
+recent-event response is an ephemeral, secret-free operational projection.
+
 Amalgm supplies a resolved authenticated principal from its user session or
 HMAC-refresh flow; future API keys resolve to the same principal capability.
 Core provides authenticated user identity, opaque machine identity,

package/README.md

@@ -98,6 +98,20 @@ await automations.updateRun({ userId, targetId }, runId, {
 const history = await sdk.runs.list(automationId);
 ```
 
+The brick also owns the `/events` HTTP contract; a host supplies only target
+identity and forwards the Fetch request:
+
+```ts
+import { createAutomationEventsApi } from '@amalgm/automations';
+
+const events = createAutomationEventsApi({
+  delivery: automations,
+  target: async (request) => resolveAutomationTarget(request),
+});
+
+const response = await events(request);
+```
+
 Configuration is written only through the auth-bound SDK shown above. The
 delivery rail exposes `receiveEvent`, `fireDueCrons`, `targetOnline`, and
 `updateRun`; it has no parallel save, delete, or history API. The surrounding

package/dist/src/events-http.d.ts

@@ -0,0 +1,19 @@
+import { Automations } from './automations.js';
+import type { AutomationTarget } from './types.js';
+export interface AutomationEventReceipt {
+    receivedAt: string;
+    targetId: string;
+    source: string;
+    event: string;
+    runIds: string[];
+    status: 'pending' | 'unmatched';
+}
+export interface AutomationEventsApiConfig {
+    delivery: Pick<Automations, 'receiveEvent'>;
+    target(request: Request): Promise<AutomationTarget>;
+    now?: () => Date;
+    maxBodyBytes?: number;
+    recentLimit?: number;
+}
+export type AutomationEventsApi = (request: Request) => Promise<Response>;
+export declare function createAutomationEventsApi(config: AutomationEventsApiConfig): AutomationEventsApi;

package/dist/src/events-http.js

@@ -0,0 +1,107 @@
+import { Automations, EventRejectedError } from './automations.js';
+import { eventReference } from './webhook.js';
+// Engine reference: amalgm-engine/runtime/scripts/amalgm-mcp/events/ingress.js.
+// The 2 MiB transport bound and safe recent-events door are preserved. The
+// authority changes deliberately: success now means matching runs are durable
+// in Supabase, never that an envelope was written to a local SQLite inbox.
+const DEFAULT_MAX_BODY_BYTES = 2 * 1024 * 1024;
+const DEFAULT_RECENT_LIMIT = 200;
+export function createAutomationEventsApi(config) {
+    const recent = [];
+    const now = config.now ?? (() => new Date());
+    const maxBodyBytes = positiveInteger(config.maxBodyBytes, DEFAULT_MAX_BODY_BYTES);
+    const recentLimit = positiveInteger(config.recentLimit, DEFAULT_RECENT_LIMIT);
+    return async (request) => {
+        const pathname = new URL(request.url).pathname;
+        if (pathname !== '/events')
+            return json(404, { error: 'not found' });
+        if (request.method === 'GET')
+            return json(200, { events: recent.slice(-50) });
+        if (request.method !== 'POST')
+            return json(405, { error: 'method not allowed' });
+        try {
+            const body = await readLimitedBody(request, maxBodyBytes);
+            const payload = parsePayload(body);
+            const headers = Object.fromEntries(request.headers.entries());
+            const target = await config.target(request);
+            const receivedAt = now();
+            const runs = await config.delivery.receiveEvent({
+                target,
+                headers,
+                body,
+                payload,
+                now: receivedAt,
+            });
+            const firstInput = runs[0]?.input;
+            const reference = firstInput?.kind === 'event'
+                ? { source: firstInput.source, event: firstInput.event }
+                : eventReference(headers, payload);
+            const receipt = {
+                receivedAt: receivedAt.toISOString(),
+                targetId: target.targetId,
+                source: reference.source,
+                event: reference.event,
+                runIds: runs.map(({ id }) => id),
+                status: runs.length ? 'pending' : 'unmatched',
+            };
+            recent.push(receipt);
+            if (recent.length > recentLimit)
+                recent.splice(0, recent.length - recentLimit);
+            return json(202, { ok: true, accepted: true, ...receipt });
+        }
+        catch (error) {
+            if (error instanceof EventRejectedError)
+                return json(401, { error: error.message });
+            if (error instanceof EventHttpError)
+                return json(error.status, { error: error.message });
+            return json(500, { error: error instanceof Error ? error.message : String(error) });
+        }
+    };
+}
+class EventHttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'EventHttpError';
+    }
+}
+async function readLimitedBody(request, limit) {
+    if (!request.body)
+        return Buffer.alloc(0);
+    const reader = request.body.getReader();
+    const chunks = [];
+    let size = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        const chunk = Buffer.from(value);
+        size += chunk.length;
+        if (size > limit) {
+            await reader.cancel();
+            throw new EventHttpError(413, `Event body exceeds ${limit} bytes`);
+        }
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+function parsePayload(body) {
+    if (body.length === 0)
+        return {};
+    try {
+        return JSON.parse(body.toString('utf8'));
+    }
+    catch {
+        throw new EventHttpError(400, 'Event body must be valid JSON');
+    }
+}
+function positiveInteger(value, fallback) {
+    return Number.isInteger(value) && value > 0 ? value : fallback;
+}
+function json(status, body) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}

package/dist/src/index.d.ts

@@ -7,6 +7,7 @@ export { createAutomationMcpServer } from './mcp.js';
 export { SupabaseAutomationCrudRepository, type SupabaseRpcClient } from './supabase-crud.js';
 export type { Automation, AutomationCrud, AutomationCrudService as AutomationCrudServiceContract, AutomationPrincipal, AutomationRun, AutomationScope, CreateAutomation, CreateScheduleTrigger, CreateWebhookTrigger, CreateWorkflow, Json, ListAutomations, ListRuns, Page, PageQuery, RunStatus, ScheduleTrigger, Trigger, UpdateAutomation, UpdateScheduleTrigger, UpdateWebhookTrigger, UpdateWorkflow, WebhookTrigger, Workflow, } from './contract.js';
 export { Automations, EventRejectedError } from './automations.js';
+export { createAutomationEventsApi, type AutomationEventReceipt, type AutomationEventsApi, type AutomationEventsApiConfig, } from './events-http.js';
 export { nextCronAt, validateCron } from './schedule.js';
 export { eventReference, eventReferences, matchesEvent, normalizeHeaders, verifyEventSecret, } from './webhook.js';
 export { SupabaseStore } from './supabase-store.js';

package/dist/src/index.js

@@ -13,6 +13,7 @@ export { runAutomationCli } from './cli.js';
 export { createAutomationMcpServer } from './mcp.js';
 export { SupabaseAutomationCrudRepository } from './supabase-crud.js';
 export { Automations, EventRejectedError } from './automations.js';
+export { createAutomationEventsApi, } from './events-http.js';
 export { nextCronAt, validateCron } from './schedule.js';
 export { eventReference, eventReferences, matchesEvent, normalizeHeaders, verifyEventSecret, } from './webhook.js';
 export { SupabaseStore } from './supabase-store.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Amalgm's cloud automation SDK: Supabase-backed configuration, trigger admission, and run delivery.",
   "license": "UNLICENSED",
   "repository": {
@@ -29,8 +29,8 @@
     }
   },
   "bin": {
-    "amalgm-automations": "./dist/src/cli-main.js",
-    "amalgm-automations-mcp": "./dist/src/mcp-main.js"
+    "amalgm-automations": "dist/src/cli-main.js",
+    "amalgm-automations-mcp": "dist/src/mcp-main.js"
   },
   "files": [
     "dist",