@amalgm/automations 0.1.1 → 0.2.0

package/AXIOMS.md

@@ -35,3 +35,17 @@
     firing instant that was claimed.
 14. Legacy local automation storage is not a compatibility authority. Engine
     cutover migrates callers to this SDK and then deletes the old store.
+15. Event ingress returns success only after every admitted run is durable in
+    Supabase. Its recent-event list is a bounded, secret-free operational view,
+    never a second event or run authority.
+16. A finite schedule decrements its durable remaining occurrence count in the
+    same transaction that admits a run; zero disables the trigger.
+17. A machine receives work only by exclusively leasing runs whose persisted
+    target equals the `computer_id` in its DPoP-bound access token.
+18. Machine execution consumes the immutable workflow snapshot stored on the
+    run. It never rediscovers or silently updates the automation definition.
+19. A compiled workflow is a small declarative sequence of tool actions. The
+    executor receives tool calling as a host capability and never embeds a
+    Channels, Shell, CLI, or provider special case.
+20. Automations is a standalone hosted service. Gateway owns none of its API,
+    scheduling, claim, execution, or persistence path.

package/PURPOSE.md

@@ -21,9 +21,21 @@ The product has two composable halves over that one state:
   idempotency laws that decide when a run happens. It consumes the control
   plane's persisted configuration; it does not expose another definition
   write path. When a machine is offline, new runs remain pending; when it
-  reconnects, every pending run is sent through Amalgm's existing transport
-  and started by the existing host runtime. Execution itself stays on the
-  machine.
+  reconnects, Shell claims pending runs directly from the Automations service
+  with its machine-bound DPoP identity and executes the persisted tool-action
+  plan. Execution itself stays on the selected machine.
+
+Automations is its own hosted service and Fly machine. Its API and scheduler
+share the same SDK and Supabase authority; neither is composed into, proxied by,
+or dependent on Amalgm Gateway. A finite schedule carries its remaining
+occurrence count in durable state, so “every minute for ten minutes” means ten
+admitted runs and then an automatically disabled trigger — not a timer that a
+machine must remember.
+
+The event HTTP adapter is one thin door over that delivery rail. It bounds and
+parses the webhook body, resolves the authenticated target supplied by the
+host, and returns only after matching runs have been stored in Supabase. Its
+recent-event response is an ephemeral, secret-free operational projection.
 
 Amalgm supplies a resolved authenticated principal from its user session or
 HMAC-refresh flow; future API keys resolve to the same principal capability.

package/README.md

@@ -1,128 +1,89 @@
 # @amalgm/automations
 
-The Automations product extracted from `amalgm-mcp`: a Supabase-backed
-configuration control plane plus the delivery rail that decides when runs
-happen. Supabase owns everything except execution.
-
-## SDK contract (configuration control plane)
-
-The public control plane is an auth-bound SDK. API, CLI, MCP, and the
-automation skill adapt this contract; only the service implementation accesses
-Supabase.
+The SDK and standalone hosted service for automation definitions, triggers,
+durable runs, and execution delivery to an Amalgm machine.
 
 ```ts
 const sdk = service.for(principal);
-
-await sdk.automations.create({ targetId: 'machine-1', name: 'Daily summary' });
-await sdk.triggers.schedule.create('automation-id', { cron: '0 9 * * 1-5' });
-await sdk.triggers.webhook.create('automation-id', {
-  source: 'github', event: 'push', secret: 'a-secret-at-least-16-characters',
+const automation = await sdk.automations.create({
+  targetId: computerId,
+  name: 'Call Mom',
 });
-await sdk.workflow.create('automation-id', {
-  script: 'export default workflow({ cells: [] });',
+await sdk.workflow.create(automation.id, {
+  script: 'Notify me to call Mom.',
+  compiled: {
+    version: 1,
+    steps: [{
+      id: 'notify',
+      actionId: 'channels.notify_user',
+      input: { message: 'Call Mom' },
+    }],
+  },
 });
-const history = await sdk.runs.list('automation-id');
-```
-
-An automation may have any number of scheduled and webhook triggers, and zero
-or one workflow. Every component can be created, read, changed, and deleted
-independently. Webhook secrets are write-only; reads return `secretConfigured`.
-Deleting configuration never deletes run history.
-
-### Composition
-
-```ts
-import {
-  AutomationCrudService,
-  SupabaseAutomationCrudRepository,
-  createAutomationApi,
-} from '@amalgm/automations';
-
-const service = new AutomationCrudService(
-  new SupabaseAutomationCrudRepository(supabaseRpcClient),
-);
-
-const api = createAutomationApi({
-  service,
-  authenticate: resolveAmalgmPrincipal,
+await sdk.triggers.schedule.create(automation.id, {
+  cron: '* * * * *',
+  timezone: 'America/Los_Angeles',
+  maxOccurrences: 10,
 });
 ```
 
-`authenticate` resolves the existing Amalgm session or HMAC-refresh credential
-to an `AutomationPrincipal`. Future API keys resolve to that same type. The
-SDK receives a principal with scopes and never raw credentials or a caller-
-supplied user ID.
+That schedule admits exactly ten durable runs, then disables itself. If the
+machine is offline, the runs remain pending. Shell later claims only work whose
+target matches its DPoP `computer_id`, executes the immutable tool-action plan,
+and commits the result.
 
-Use `createAutomationClient` to call the Fetch API from another process. The
-CLI and MCP server use this same client with
-`AMALGM_AUTOMATIONS_API_URL` and `AMALGM_AUTOMATIONS_AUTHORIZATION`.
+## Surfaces
 
-```sh
-amalgm-automations automations list
-amalgm-automations triggers schedule create automation-id schedule.json
-amalgm-automations triggers webhook create automation-id webhook.json
-amalgm-automations workflow update automation-id workflow.json
-```
+- `@amalgm/automations`: SDK, API/client, scheduler, machine claim client, and
+  generic tool-action executor.
+- `@amalgm/automations/mcp`: agent tools over the same SDK.
+- `@amalgm/automations/host`: standalone Fly service composition.
+- `amalgm-automations`: CLI adapter.
 
-The MCP server command is `amalgm-automations-mcp`; it exposes one typed,
-atomic MCP tool for every SDK operation.
+The hosted service accepts verified Supabase user sessions for browser control
+and Core-issued `amalgm-automations` DPoP grants for Shell. It does not run in
+or depend on Amalgm Gateway.
 
-## Delivery rail
+## Durable model
 
-The Core boundary is deliberately small. Core translates its authenticated
-machine record into an opaque `AutomationTarget`; the product never queries a
-Core table. Core also supplies the existing machine transport:
+An automation belongs to one user and target. It owns any number of schedule
+or webhook triggers and zero or one workflow. Supabase owns definitions,
+schedule clocks, immutable run snapshots, machine leases, and permanent run
+history. Webhook secrets are write-only.
+
+Compiled workflows use one small format:
 
 ```ts
-import { Automations, SupabaseStore } from '@amalgm/automations';
+type AutomationPlan = {
+  version: 1;
+  steps: Array<{ id: string; actionId: string; input: Json }>;
+};
+```
 
-const automations = new Automations(new SupabaseStore(getSupabase()), {
-  isOnline: ({ targetId }) => existingTunnel.hasConnection(targetId),
-  send: (run) => existingTunnel.send(run.targetId, run),
-});
+The executor does not know about Channels or any other product. Shell injects
+one action-calling capability, and each step receives the stable idempotency key
+`<run-id>:<step-id>`.
 
-await automations.receiveEvent({
-  target: await core.resolveEventTarget(eventRef),
-  headers,
-  body,
-  payload,
-});
+## HTTP
 
-await automations.targetOnline({ userId, targetId });
+The control API lives under `/v1/automations`. The machine execution API is:
 
-await automations.updateRun({ userId, targetId }, runId, {
-  status: 'completed',
-  output,
-});
-
-const history = await sdk.runs.list(automationId);
+```text
+POST  /v1/machine/runs/claim
+PATCH /v1/machine/runs/:runId
 ```
 
-Configuration is written only through the auth-bound SDK shown above. The
-delivery rail exposes `receiveEvent`, `fireDueCrons`, `targetOnline`, and
-`updateRun`; it has no parallel save, delete, or history API. The surrounding
-Engine route, scheduler callback, and tunnel callback only translate and call
-these SDK operations.
-
-Every firing stores an immutable run snapshot in Supabase. Delivery and machine
-execution update that record instead of deleting it. When a machine is offline,
-new runs remain pending; on reconnect every pending run drains through the
-existing transport.
-
-The implementation covers Supabase definitions, cron and event admission,
-secret verification, permanent run history, and reconnect drain. Engine
-cutover must call these published contracts and delete its local automation
-store; this package intentionally provides no compatibility storage path.
-
-The purpose is in [PURPOSE.md](./PURPOSE.md), and the non-negotiable ownership
-rules are in [AXIOMS.md](./AXIOMS.md).
+The target is never accepted in a machine request. It comes from the verified
+access token. Run leases expire and are safely reclaimable; terminal updates
+must present the active lease token.
 
 ## Verification
 
-```sh
-npm install
-npm run release:check
+```bash
+npm run verify
+TEST_DATABASE_URL=postgres://... npm run test:supabase
+npm pack --dry-run
 ```
 
-`release:check` includes deterministic unit tests and a real Postgres contract.
-Set `TEST_DATABASE_URL` to an empty Postgres 16 database for the latter.
+See [PURPOSE.md](./PURPOSE.md) and [AXIOMS.md](./AXIOMS.md) for the governing
+ownership and behavior laws.

package/dist/host/auth.d.ts

@@ -0,0 +1,11 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type { AutomationPrincipal } from '../src/contract.js';
+import type { AutomationMachinePrincipal } from '../src/machine.js';
+export declare function createAutomationsAuthenticators(options: {
+    readonly issuer: string;
+    readonly supabase: SupabaseClient;
+    readonly now?: () => number;
+}): Readonly<{
+    control: (request: Request) => Promise<AutomationPrincipal>;
+    machine: (request: Request) => Promise<AutomationMachinePrincipal>;
+}>;

package/dist/host/auth.js

@@ -0,0 +1,89 @@
+import { createHash } from 'node:crypto';
+import { authorizeMachineResource, } from '@amalgm/core/authorization';
+import { calculateJwkThumbprint, createRemoteJWKSet, decodeProtectedHeader, importJWK, jwtVerify, } from 'jose';
+import { ForbiddenError } from '../src/errors.js';
+export function createAutomationsAuthenticators(options) {
+    const jwks = createRemoteJWKSet(new URL(`${options.issuer}/.well-known/jwks.json`));
+    const ports = verifierPorts(options, jwks);
+    return Object.freeze({
+        control: async (request) => {
+            const authorization = request.headers.get('authorization');
+            if (authorization?.startsWith('Bearer ')) {
+                const result = await options.supabase.auth.getUser(authorization.slice(7).trim());
+                if (result.error || !result.data.user)
+                    throw new ForbiddenError('User authorization denied');
+                return {
+                    userId: result.data.user.id,
+                    scopes: ['automations:read', 'automations:write', 'runs:read'],
+                };
+            }
+            const scope = controlScope(request);
+            const principal = await authorize(request, options.issuer, scope, ports);
+            return {
+                userId: principal.userId,
+                computerId: principal.computerId,
+                scopes: automationScopes(principal.scopes),
+                targetIds: [principal.computerId],
+            };
+        },
+        machine: async (request) => {
+            const principal = await authorize(request, options.issuer, 'runs:execute', ports);
+            return {
+                userId: principal.userId,
+                computerId: principal.computerId,
+                scopes: automationScopes(principal.scopes),
+            };
+        },
+    });
+}
+async function authorize(request, issuer, scope, ports) {
+    return authorizeMachineResource({
+        authorization: request.headers.get('authorization'),
+        dpop: request.headers.get('dpop'),
+        method: request.method,
+        url: request.url,
+        issuer,
+        audience: 'amalgm-automations',
+        requiredScopes: [scope],
+    }, ports);
+}
+function verifierPorts(options, jwks) {
+    return {
+        nowSeconds: options.now ?? (() => Math.floor(Date.now() / 1000)),
+        async verifyAccessToken(token) {
+            const value = await jwtVerify(token, jwks, {
+                issuer: options.issuer, audience: 'amalgm-automations', algorithms: ['ES256'],
+            });
+            return { header: value.protectedHeader, claims: value.payload };
+        },
+        async verifyDpopProof(proof) {
+            const header = decodeProtectedHeader(proof);
+            const jwk = header.jwk;
+            if (!jwk)
+                throw new Error('DPoP proof has no public key');
+            const value = await jwtVerify(proof, await importJWK(jwk, 'ES256'), {
+                algorithms: ['ES256'], typ: 'dpop+jwt',
+            });
+            return { header: value.protectedHeader, claims: value.payload };
+        },
+        jwkThumbprint: (jwk) => calculateJwkThumbprint(jwk, 'sha256'),
+        accessTokenHash: async (token) => createHash('sha256').update(token).digest('base64url'),
+        async consumeProof(keyThumbprint, jti) {
+            const result = await options.supabase.rpc('consume_authorization_dpop_proof', {
+                p_key_thumbprint: keyThumbprint, p_jti: jti,
+            });
+            if (result.error)
+                throw result.error;
+            return result.data === true;
+        },
+    };
+}
+function controlScope(request) {
+    if (request.method.toUpperCase() !== 'GET')
+        return 'automations:write';
+    return new URL(request.url).pathname.includes('/runs') ? 'runs:read' : 'automations:read';
+}
+function automationScopes(scopes) {
+    return scopes.filter((scope) => (scope === 'automations:read' || scope === 'automations:write'
+        || scope === 'runs:read' || scope === 'runs:execute'));
+}

package/dist/host/config.d.ts

@@ -0,0 +1,8 @@
+export interface AutomationsHostConfig {
+    readonly port: number;
+    readonly supabaseUrl: string;
+    readonly supabaseServiceRoleKey: string;
+    readonly authorizationIssuer: string;
+    readonly schedulerIntervalMs: number;
+}
+export declare function automationsHostConfig(env?: Readonly<Record<string, string | undefined>>): AutomationsHostConfig;

package/dist/host/config.js

@@ -0,0 +1,29 @@
+export function automationsHostConfig(env = process.env) {
+    return Object.freeze({
+        port: integer(env.PORT, 8080, 1, 65_535),
+        supabaseUrl: url(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'),
+        supabaseServiceRoleKey: required(env.SUPABASE_SERVICE_ROLE_KEY, 'SUPABASE_SERVICE_ROLE_KEY'),
+        authorizationIssuer: url(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'),
+        schedulerIntervalMs: integer(env.AUTOMATIONS_SCHEDULER_INTERVAL_MS, 1_000, 250, 60_000),
+    });
+}
+function required(value, name) {
+    if (!value?.trim())
+        throw new Error(`${name} is required`);
+    return value.trim();
+}
+function url(value, name) {
+    const parsed = new URL(required(value, name));
+    const local = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
+    if (parsed.protocol !== 'https:' && !(local && parsed.protocol === 'http:')) {
+        throw new Error(`${name} must use HTTPS`);
+    }
+    return parsed.toString().replace(/\/$/, '');
+}
+function integer(value, fallback, minimum, maximum) {
+    const parsed = value === undefined ? fallback : Number(value);
+    if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {
+        throw new Error(`Expected an integer from ${minimum} to ${maximum}`);
+    }
+    return parsed;
+}

package/dist/host/index.d.ts

@@ -0,0 +1,3 @@
+export * from './auth.js';
+export * from './config.js';
+export * from './server.js';

package/dist/host/index.js

@@ -0,0 +1,3 @@
+export * from './auth.js';
+export * from './config.js';
+export * from './server.js';

package/dist/host/main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/host/main.js

@@ -0,0 +1,47 @@
+import { createClient } from '@supabase/supabase-js';
+import { Automations } from '../src/automations.js';
+import { AutomationCrudService } from '../src/crud.js';
+import { createAutomationApi } from '../src/http.js';
+import { createMachineRuns } from '../src/machine.js';
+import { createMachineRunsApi } from '../src/machine-http.js';
+import { SupabaseAutomationCrudRepository } from '../src/supabase-crud.js';
+import { SupabaseMachineRunRepository } from '../src/supabase-machine.js';
+import { SupabaseStore } from '../src/supabase-store.js';
+import { createAutomationsAuthenticators } from './auth.js';
+import { automationsHostConfig } from './config.js';
+import { createAutomationsHost } from './server.js';
+const config = automationsHostConfig();
+const supabase = createClient(config.supabaseUrl, config.supabaseServiceRoleKey, {
+    auth: { persistSession: false, autoRefreshToken: false },
+});
+const authentication = createAutomationsAuthenticators({
+    issuer: config.authorizationIssuer,
+    supabase,
+});
+const delivery = new Automations(new SupabaseStore(supabase), {
+    isOnline: () => false,
+    send: async () => false,
+}, (event, details) => log(event, details));
+const controlApi = createAutomationApi({
+    service: new AutomationCrudService(new SupabaseAutomationCrudRepository(supabase)),
+    authenticate: authentication.control,
+});
+const machineRepository = new SupabaseMachineRunRepository(supabase);
+const machineApi = createMachineRunsApi({
+    authenticate: authentication.machine,
+    runsFor: (principal) => createMachineRuns(machineRepository, principal),
+});
+const host = createAutomationsHost({
+    controlApi,
+    machineApi,
+    fireSchedules: () => delivery.fireDueCrons(),
+    schedulerIntervalMs: config.schedulerIntervalMs,
+    log,
+});
+host.server.listen(config.port, '0.0.0.0', () => log('host.ready', { port: config.port }));
+for (const signal of ['SIGINT', 'SIGTERM']) {
+    process.once(signal, () => void host.close().finally(() => process.exit(0)));
+}
+function log(event, details = {}) {
+    console.log(JSON.stringify({ service: 'amalgm-automations', event, ...details }));
+}

package/dist/host/server.d.ts

@@ -0,0 +1,11 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+export declare function createAutomationsHost(options: {
+    readonly controlApi: (request: Request) => Promise<Response>;
+    readonly machineApi: (request: Request) => Promise<Response>;
+    readonly fireSchedules: () => Promise<unknown>;
+    readonly schedulerIntervalMs: number;
+    readonly log?: (event: string, details?: Readonly<Record<string, unknown>>) => void;
+}): {
+    server: import("node:http").Server<typeof IncomingMessage, typeof ServerResponse>;
+    close(): Promise<void>;
+};

package/dist/host/server.js

@@ -0,0 +1,53 @@
+import { createServer } from 'node:http';
+export function createAutomationsHost(options) {
+    const log = options.log ?? (() => { });
+    let scheduling = null;
+    const tick = () => {
+        if (scheduling)
+            return;
+        scheduling = options.fireSchedules()
+            .catch((error) => log('scheduler.failed', { error: safe(error) }))
+            .finally(() => { scheduling = null; });
+    };
+    const timer = setInterval(tick, options.schedulerIntervalMs);
+    timer.unref();
+    tick();
+    const server = createServer(async (incoming, outgoing) => {
+        try {
+            if (incoming.url === '/healthz')
+                return send(outgoing, Response.json({ ok: true }));
+            const request = await webRequest(incoming);
+            const api = new URL(request.url).pathname.startsWith('/v1/machine/')
+                ? options.machineApi : options.controlApi;
+            await send(outgoing, await api(request));
+        }
+        catch (error) {
+            log('request.failed', { error: safe(error) });
+            await send(outgoing, Response.json({ error: 'Automations service failed' }, { status: 500 }));
+        }
+    });
+    return {
+        server,
+        async close() {
+            clearInterval(timer);
+            await scheduling;
+            await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+        },
+    };
+}
+async function webRequest(request) {
+    const chunks = [];
+    for await (const chunk of request)
+        chunks.push(Buffer.from(chunk));
+    const body = Buffer.concat(chunks);
+    return new Request(new URL(request.url ?? '/', `http://${request.headers.host ?? '127.0.0.1'}`), {
+        method: request.method ?? 'GET',
+        headers: request.headers,
+        ...(body.length ? { body } : {}),
+    });
+}
+async function send(response, source) {
+    response.writeHead(source.status, Object.fromEntries(source.headers));
+    response.end(Buffer.from(await source.arrayBuffer()));
+}
+const safe = (error) => (error instanceof Error ? error.message : String(error)).slice(0, 500);

package/dist/src/automations.js

@@ -46,13 +46,16 @@ export class Automations {
         const created = [];
         for (const trigger of await this.store.dueCronTriggers(now)) {
             let scheduledFor = trigger.nextRunAt;
-            while (new Date(scheduledFor) <= now) {
+            let remaining = trigger.remainingOccurrences;
+            while (new Date(scheduledFor) <= now && (remaining === undefined || remaining > 0)) {
                 const nextRunAt = nextCronAt(trigger.cron, trigger.timezone, scheduledFor);
                 const run = await this.store.enqueueCron({ ...trigger, nextRunAt: scheduledFor }, nextRunAt, now);
                 if (!run)
                     break;
                 created.push(run);
                 scheduledFor = nextRunAt;
+                if (remaining !== undefined)
+                    remaining -= 1;
             }
         }
         await this.#drainCreated(created);

package/dist/src/client.d.ts

@@ -1,7 +1,9 @@
 import type { AutomationCrud } from './contract.js';
 export type AutomationAuthorization = () => string | undefined | Promise<string | undefined>;
+export type AutomationHeaders = (method: string, url: string) => Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
 export declare function createAutomationClient(options: {
     baseUrl: string;
-    authorization: AutomationAuthorization;
+    authorization?: AutomationAuthorization;
+    headers?: AutomationHeaders;
     fetch?: typeof globalThis.fetch;
 }): AutomationCrud;

package/dist/src/client.js

@@ -1,7 +1,7 @@
 import { AutomationError } from './errors.js';
 export function createAutomationClient(options) {
     const baseUrl = options.baseUrl.replace(/\/$/, '');
-    const request = createRequester(baseUrl, options.authorization, options.fetch || globalThis.fetch);
+    const request = createRequester(baseUrl, options.authorization, options.headers, options.fetch || globalThis.fetch);
     return {
         automations: {
             create: (input) => request('/v1/automations', 'POST', input),
@@ -39,15 +39,17 @@ export function createAutomationClient(options) {
         },
     };
 }
-function createRequester(baseUrl, authorization, fetch) {
+function createRequester(baseUrl, authorization, additionalHeaders, fetch) {
     return async (path, method, body, nullable = false) => {
-        const token = await authorization();
-        const response = await fetch(`${baseUrl}${path}`, {
+        const url = `${baseUrl}${path}`;
+        const token = await authorization?.();
+        const response = await fetch(url, {
             method,
             headers: {
                 accept: 'application/json',
                 ...(body === undefined ? {} : { 'content-type': 'application/json' }),
                 ...(token ? { authorization: token } : {}),
+                ...await additionalHeaders?.(method, url),
             },
             ...(body === undefined ? {} : { body: JSON.stringify(body) }),
         });

package/dist/src/contract.d.ts

@@ -1,7 +1,7 @@
 export type Json = null | boolean | number | string | Json[] | {
     [key: string]: Json;
 };
-export type AutomationScope = 'automations:read' | 'automations:write' | 'runs:read' | '*';
+export type AutomationScope = 'automations:read' | 'automations:write' | 'runs:read' | 'runs:execute' | '*';
 /** Identity resolved by Amalgm before the SDK is bound to a caller. */
 export interface AutomationPrincipal {
     userId: string;
@@ -57,6 +57,9 @@ export interface ScheduleTrigger extends TriggerBase {
     kind: 'schedule';
     cron: string;
     timezone: string;
+    nextRunAt: string;
+    maxOccurrences?: number;
+    remainingOccurrences?: number;
 }
 export interface WebhookTrigger extends TriggerBase {
     kind: 'webhook';
@@ -70,11 +73,24 @@ export interface CreateScheduleTrigger {
     cron: string;
     timezone?: string;
     enabled?: boolean;
+    /** Omit for an unbounded schedule. */
+    maxOccurrences?: number;
 }
 export interface UpdateScheduleTrigger {
     cron?: string;
     timezone?: string;
     enabled?: boolean;
+    /** Set a new finite budget, or null to make the schedule unbounded. */
+    maxOccurrences?: number | null;
+}
+export interface ToolActionStep {
+    id: string;
+    actionId: string;
+    input: Json;
+}
+export interface AutomationPlan {
+    version: 1;
+    steps: ToolActionStep[];
 }
 export interface CreateWebhookTrigger {
     id?: string;

package/dist/src/crud/automations.d.ts

@@ -0,0 +1,3 @@
+import type { AutomationCrud } from '../contract.js';
+import { type CrudContext } from './context.js';
+export declare function automationOperations(context: CrudContext): AutomationCrud['automations'];