@amalgm/automations 0.2.0 → 0.2.1

package/AXIOMS.md

@@ -10,42 +10,47 @@
    key authentication all resolve to the same principal shape.
 4. An automation belongs to exactly one user and exactly one target. It may
    have zero or more triggers and zero or one workflow.
-5. Scheduled triggers and webhook triggers are distinct first-class resources
+5. A principal bound to exactly one target supplies that target implicitly on
+   create. Unbound or multi-target principals must choose explicitly; adapters
+   and models never guess opaque target ids.
+6. Scheduled triggers and webhook triggers are distinct first-class resources
    with their own CRUD operations and validation rules.
-6. A workflow is the one script resource owned by its automation. It may be
+7. A workflow is the one script resource owned by its automation. It may be
    created, read, updated, or deleted independently of the automation and its
    triggers.
-7. An incomplete automation is valid configuration. Future execution behavior
+8. An incomplete automation is valid configuration. Future execution behavior
    must be derived from its persisted configuration rather than repaired by the
    CRUD layer.
-8. Supabase is authoritative for automations, triggers, workflow source, and
+9. Supabase is authoritative for automations, triggers, workflow source, and
    permanent run history. A definition edit or deletion never rewrites prior
    runs.
-9. Webhook secrets are persisted but write-only: normal reads reveal only that
+10. Webhook secrets are persisted but write-only: normal reads reveal only that
    a secret is configured.
-10. Run history is read-only in the control plane and always scoped to its
+11. Run history is read-only in the control plane and always scoped to its
     automation's owner.
-11. Storage records, Supabase RPCs, HTTP details, and MCP protocol details are
+12. Storage records, Supabase RPCs, HTTP details, and MCP protocol details are
     implementation concerns, not SDK concepts.
-12. The control-plane SDK is the only configuration write path. The delivery
+13. The control-plane SDK is the only configuration write path. The delivery
     rail reads that configuration and writes only schedule clocks and run
     state; it never owns a second automation-definition API.
-13. Admitting a run atomically verifies the current enabled configuration,
+14. Admitting a run atomically verifies the current enabled configuration,
     stores a secret-free snapshot, and, for a schedule, advances exactly the
     firing instant that was claimed.
-14. Legacy local automation storage is not a compatibility authority. Engine
+15. Legacy local automation storage is not a compatibility authority. Engine
     cutover migrates callers to this SDK and then deletes the old store.
-15. Event ingress returns success only after every admitted run is durable in
+16. Event ingress returns success only after every admitted run is durable in
     Supabase. Its recent-event list is a bounded, secret-free operational view,
     never a second event or run authority.
-16. A finite schedule decrements its durable remaining occurrence count in the
+17. A finite schedule decrements its durable remaining occurrence count in the
     same transaction that admits a run; zero disables the trigger.
-17. A machine receives work only by exclusively leasing runs whose persisted
+18. A machine receives work only by exclusively leasing runs whose persisted
     target equals the `computer_id` in its DPoP-bound access token.
-18. Machine execution consumes the immutable workflow snapshot stored on the
+19. The configured public origin, never forwarding headers, reconstructs the
+    DPoP request URL behind the Fly proxy.
+20. Machine execution consumes the immutable workflow snapshot stored on the
     run. It never rediscovers or silently updates the automation definition.
-19. A compiled workflow is a small declarative sequence of tool actions. The
+21. A compiled workflow is a small declarative sequence of tool actions. The
     executor receives tool calling as a host capability and never embeds a
     Channels, Shell, CLI, or provider special case.
-20. Automations is a standalone hosted service. Gateway owns none of its API,
+22. Automations is a standalone hosted service. Gateway owns none of its API,
     scheduling, claim, execution, or persistence path.

package/PURPOSE.md

@@ -39,6 +39,9 @@ recent-event response is an ephemeral, secret-free operational projection.
 
 Amalgm supplies a resolved authenticated principal from its user session or
 HMAC-refresh flow; future API keys resolve to the same principal capability.
+When that principal is bound to exactly one machine, automation creation uses
+that target without asking a human or model to copy an opaque machine id. An
+explicit target remains mandatory for unbound or multi-target principals.
 Core provides authenticated user identity, opaque machine identity,
 connectivity, and narrow host capabilities. The product receives identity and
 scopes — never raw credentials or Core storage — and neither side reaches into

package/dist/host/config.d.ts

@@ -1,5 +1,6 @@
 export interface AutomationsHostConfig {
     readonly port: number;
+    readonly publicOrigin: string;
     readonly supabaseUrl: string;
     readonly supabaseServiceRoleKey: string;
     readonly authorizationIssuer: string;

package/dist/host/config.js

@@ -1,6 +1,7 @@
 export function automationsHostConfig(env = process.env) {
     return Object.freeze({
         port: integer(env.PORT, 8080, 1, 65_535),
+        publicOrigin: url(env.AMALGAM_PUBLIC_ORIGIN, 'AMALGAM_PUBLIC_ORIGIN'),
         supabaseUrl: url(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'),
         supabaseServiceRoleKey: required(env.SUPABASE_SERVICE_ROLE_KEY, 'SUPABASE_SERVICE_ROLE_KEY'),
         authorizationIssuer: url(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'),

package/dist/host/main.js

@@ -32,6 +32,7 @@ const machineApi = createMachineRunsApi({
     runsFor: (principal) => createMachineRuns(machineRepository, principal),
 });
 const host = createAutomationsHost({
+    publicOrigin: config.publicOrigin,
     controlApi,
     machineApi,
     fireSchedules: () => delivery.fireDueCrons(),

package/dist/host/server.d.ts

@@ -1,5 +1,6 @@
 import { type IncomingMessage, type ServerResponse } from 'node:http';
 export declare function createAutomationsHost(options: {
+    readonly publicOrigin: string;
     readonly controlApi: (request: Request) => Promise<Response>;
     readonly machineApi: (request: Request) => Promise<Response>;
     readonly fireSchedules: () => Promise<unknown>;

package/dist/host/server.js

@@ -1,4 +1,5 @@
 import { createServer } from 'node:http';
+import { publicResourceRequestUrl } from '@amalgm/core/authorization';
 export function createAutomationsHost(options) {
     const log = options.log ?? (() => { });
     let scheduling = null;
@@ -16,7 +17,7 @@ export function createAutomationsHost(options) {
         try {
             if (incoming.url === '/healthz')
                 return send(outgoing, Response.json({ ok: true }));
-            const request = await webRequest(incoming);
+            const request = await webRequest(incoming, options.publicOrigin);
             const api = new URL(request.url).pathname.startsWith('/v1/machine/')
                 ? options.machineApi : options.controlApi;
             await send(outgoing, await api(request));
@@ -35,12 +36,12 @@ export function createAutomationsHost(options) {
         },
     };
 }
-async function webRequest(request) {
+async function webRequest(request, publicOrigin) {
     const chunks = [];
     for await (const chunk of request)
         chunks.push(Buffer.from(chunk));
     const body = Buffer.concat(chunks);
-    return new Request(new URL(request.url ?? '/', `http://${request.headers.host ?? '127.0.0.1'}`), {
+    return new Request(publicResourceRequestUrl(publicOrigin, request.url ?? '/'), {
         method: request.method ?? 'GET',
         headers: request.headers,
         ...(body.length ? { body } : {}),

package/dist/src/contract.d.ts

@@ -31,7 +31,8 @@ export interface Automation {
 }
 export interface CreateAutomation {
     id?: string;
-    targetId: string;
+    /** Omit when the authenticated principal resolves exactly one target. */
+    targetId?: string;
     name?: string;
     description?: string;
     enabled?: boolean;

package/dist/src/crud/automations.js

@@ -1,20 +1,20 @@
 import { ConflictError, NotFoundError } from '../errors.js';
 import { parseCreateAutomation, parseListAutomations, parseUpdateAutomation } from '../schema.js';
 import { id, newId, page } from '../validation.js';
-import { assertTarget } from './context.js';
+import { assertTarget, resolveTarget } from './context.js';
 export function automationOperations(context) {
     const { principal, repository } = context;
     return {
         create: async (input) => {
             context.write();
             const parsed = parseCreateAutomation(input);
-            assertTarget(principal, parsed.targetId);
+            const targetId = resolveTarget(principal, parsed.targetId);
             if (parsed.id && await repository.getAutomation(principal.userId, id(parsed.id, 'Automation id'))) {
                 throw new ConflictError('Automation');
             }
             return repository.createAutomation(principal.userId, {
                 id: parsed.id ? id(parsed.id, 'Automation id') : newId('automation'),
-                targetId: parsed.targetId,
+                targetId,
                 name: parsed.name || '',
                 description: parsed.description || '',
                 enabled: parsed.enabled !== false,

package/dist/src/crud/context.d.ts

@@ -11,3 +11,4 @@ export interface CrudContext {
 }
 export declare function createContext(repository: AutomationCrudRepository, principal: AutomationPrincipal, clock: () => Date): CrudContext;
 export declare function assertTarget(principal: AutomationPrincipal, targetId: string): void;
+export declare function resolveTarget(principal: AutomationPrincipal, targetId?: string): string;

package/dist/src/crud/context.js

@@ -1,4 +1,4 @@
-import { ForbiddenError, NotFoundError } from '../errors.js';
+import { ForbiddenError, NotFoundError, ValidationError } from '../errors.js';
 import { id, requiredText } from '../validation.js';
 export function createContext(repository, principal, clock) {
     assertPrincipal(principal);
@@ -21,6 +21,15 @@ export function assertTarget(principal, targetId) {
         throw new ForbiddenError('This credential cannot access that target');
     }
 }
+export function resolveTarget(principal, targetId) {
+    if (targetId) {
+        assertTarget(principal, targetId);
+        return id(targetId, 'targetId');
+    }
+    if (principal.targetIds?.length === 1)
+        return principal.targetIds[0];
+    throw new ValidationError('targetId is required unless the credential resolves exactly one target');
+}
 function assertPrincipal(principal) {
     requiredText(principal.userId, 'Authenticated user id');
     if (!Array.isArray(principal.scopes))

package/dist/src/mcp.js

@@ -7,7 +7,7 @@ const triggerIdInput = { ...automationIdInput, trigger_id: identifierSchema };
 const runIdInput = { ...automationIdInput, run_id: identifierSchema };
 export function createAutomationMcpServer(sdk) {
     const server = new McpServer({ name: 'amalgm-automations-mcp-server', version: '0.1.0' });
-    register(server, 'amalgm_automations_create', 'Create automation', 'Create an automation configuration without triggers or workflow.', { input: createAutomationSchema }, write(false), ({ input }) => sdk.automations.create(input));
+    register(server, 'amalgm_automations_create', 'Create automation', 'Create an automation configuration without triggers or workflow. In an authenticated machine session, omit input.targetId so the service uses that machine; never guess a target id.', { input: createAutomationSchema }, write(false), ({ input }) => sdk.automations.create(input));
     register(server, 'amalgm_automations_list', 'List automations', 'List the caller\'s automations with optional target and enabled filters.', { query: listAutomationsSchema.optional() }, read(), ({ query }) => sdk.automations.list(query));
     register(server, 'amalgm_automations_get', 'Get automation', 'Get one automation by id.', automationIdInput, read(), ({ automation_id }) => sdk.automations.get(automation_id));
     register(server, 'amalgm_automations_update', 'Update automation', 'Update automation metadata, target, or enabled state.', { automation_id: identifierSchema, patch: updateAutomationSchema }, write(true), ({ automation_id, patch }) => sdk.automations.update(automation_id, patch));

package/dist/src/schema.d.ts

@@ -13,22 +13,22 @@ export declare const pageQuerySchema: z.ZodObject<{
 }>;
 export declare const createAutomationSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
-    targetId: z.ZodString;
+    targetId: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     description: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     enabled: z.ZodOptional<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
-    id?: string | undefined;
-    targetId: string;
+    targetId?: string | undefined;
+    enabled?: boolean | undefined;
     name?: string | undefined;
+    id?: string | undefined;
     description?: string | undefined;
-    enabled?: boolean | undefined;
 }, {
-    id?: string | undefined;
-    targetId: string;
+    targetId?: string | undefined;
+    enabled?: boolean | undefined;
     name?: string | undefined;
+    id?: string | undefined;
     description?: string | undefined;
-    enabled?: boolean | undefined;
 }>;
 export declare const updateAutomationSchema: z.ZodEffects<z.ZodObject<{
     targetId: z.ZodOptional<z.ZodString>;
@@ -37,24 +37,24 @@ export declare const updateAutomationSchema: z.ZodEffects<z.ZodObject<{
     enabled: z.ZodOptional<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
     targetId?: string | undefined;
+    enabled?: boolean | undefined;
     name?: string | null | undefined;
     description?: string | null | undefined;
-    enabled?: boolean | undefined;
 }, {
     targetId?: string | undefined;
+    enabled?: boolean | undefined;
     name?: string | null | undefined;
     description?: string | null | undefined;
-    enabled?: boolean | undefined;
 }>, {
     targetId?: string | undefined;
+    enabled?: boolean | undefined;
     name?: string | null | undefined;
     description?: string | null | undefined;
-    enabled?: boolean | undefined;
 }, {
     targetId?: string | undefined;
+    enabled?: boolean | undefined;
     name?: string | null | undefined;
     description?: string | null | undefined;
-    enabled?: boolean | undefined;
 }>;
 export declare const listAutomationsSchema: z.ZodObject<{
     limit: z.ZodOptional<z.ZodNumber>;
@@ -63,15 +63,15 @@ export declare const listAutomationsSchema: z.ZodObject<{
     targetId: z.ZodOptional<z.ZodString>;
     enabled: z.ZodOptional<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
-    limit?: number | undefined;
-    offset?: number | undefined;
     targetId?: string | undefined;
     enabled?: boolean | undefined;
-}, {
     limit?: number | undefined;
     offset?: number | undefined;
+}, {
     targetId?: string | undefined;
     enabled?: boolean | undefined;
+    limit?: number | undefined;
+    offset?: number | undefined;
 }>;
 export declare const createScheduleTriggerSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -80,16 +80,16 @@ export declare const createScheduleTriggerSchema: z.ZodObject<{
     enabled: z.ZodOptional<z.ZodBoolean>;
     maxOccurrences: z.ZodOptional<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
-    id?: string | undefined;
     cron: string;
-    timezone?: string | undefined;
     enabled?: boolean | undefined;
+    id?: string | undefined;
+    timezone?: string | undefined;
     maxOccurrences?: number | undefined;
 }, {
-    id?: string | undefined;
     cron: string;
-    timezone?: string | undefined;
     enabled?: boolean | undefined;
+    id?: string | undefined;
+    timezone?: string | undefined;
     maxOccurrences?: number | undefined;
 }>;
 export declare const updateScheduleTriggerSchema: z.ZodEffects<z.ZodObject<{
@@ -98,24 +98,24 @@ export declare const updateScheduleTriggerSchema: z.ZodEffects<z.ZodObject<{
     enabled: z.ZodOptional<z.ZodBoolean>;
     maxOccurrences: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
 }, "strict", z.ZodTypeAny, {
+    enabled?: boolean | undefined;
     cron?: string | undefined;
     timezone?: string | undefined;
-    enabled?: boolean | undefined;
     maxOccurrences?: number | null | undefined;
 }, {
+    enabled?: boolean | undefined;
     cron?: string | undefined;
     timezone?: string | undefined;
-    enabled?: boolean | undefined;
     maxOccurrences?: number | null | undefined;
 }>, {
+    enabled?: boolean | undefined;
     cron?: string | undefined;
     timezone?: string | undefined;
-    enabled?: boolean | undefined;
     maxOccurrences?: number | null | undefined;
 }, {
+    enabled?: boolean | undefined;
     cron?: string | undefined;
     timezone?: string | undefined;
-    enabled?: boolean | undefined;
     maxOccurrences?: number | null | undefined;
 }>;
 export declare const createWebhookTriggerSchema: z.ZodObject<{
@@ -125,17 +125,17 @@ export declare const createWebhookTriggerSchema: z.ZodObject<{
     secret: z.ZodString;
     enabled: z.ZodOptional<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
-    id?: string | undefined;
-    source?: string | undefined;
-    event?: string | undefined;
     secret: string;
     enabled?: boolean | undefined;
-}, {
-    id?: string | undefined;
-    source?: string | undefined;
     event?: string | undefined;
+    source?: string | undefined;
+    id?: string | undefined;
+}, {
     secret: string;
     enabled?: boolean | undefined;
+    event?: string | undefined;
+    source?: string | undefined;
+    id?: string | undefined;
 }>;
 export declare const updateWebhookTriggerSchema: z.ZodEffects<z.ZodObject<{
     source: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
@@ -143,25 +143,25 @@ export declare const updateWebhookTriggerSchema: z.ZodEffects<z.ZodObject<{
     secret: z.ZodOptional<z.ZodString>;
     enabled: z.ZodOptional<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
-    source?: string | undefined;
+    enabled?: boolean | undefined;
     event?: string | undefined;
     secret?: string | undefined;
-    enabled?: boolean | undefined;
-}, {
     source?: string | undefined;
+}, {
+    enabled?: boolean | undefined;
     event?: string | undefined;
     secret?: string | undefined;
-    enabled?: boolean | undefined;
-}>, {
     source?: string | undefined;
+}>, {
+    enabled?: boolean | undefined;
     event?: string | undefined;
     secret?: string | undefined;
-    enabled?: boolean | undefined;
-}, {
     source?: string | undefined;
+}, {
+    enabled?: boolean | undefined;
     event?: string | undefined;
     secret?: string | undefined;
-    enabled?: boolean | undefined;
+    source?: string | undefined;
 }>;
 export declare const createWorkflowSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -171,16 +171,16 @@ export declare const createWorkflowSchema: z.ZodObject<{
     allowlist: z.ZodOptional<z.ZodType<Json, z.ZodTypeDef, Json>>;
     limits: z.ZodOptional<z.ZodType<Json, z.ZodTypeDef, Json>>;
 }, "strict", z.ZodTypeAny, {
-    id?: string | undefined;
-    name?: string | undefined;
     script: string;
+    name?: string | undefined;
+    id?: string | undefined;
     compiled?: Json | undefined;
     allowlist?: Json | undefined;
     limits?: Json | undefined;
 }, {
-    id?: string | undefined;
-    name?: string | undefined;
     script: string;
+    name?: string | undefined;
+    id?: string | undefined;
     compiled?: Json | undefined;
     allowlist?: Json | undefined;
     limits?: Json | undefined;
@@ -222,13 +222,13 @@ export declare const listRunsSchema: z.ZodObject<{
 } & {
     status: z.ZodOptional<z.ZodEnum<["pending", "sent", "running", "completed", "failed"]>>;
 }, "strict", z.ZodTypeAny, {
+    status?: "pending" | "sent" | "running" | "completed" | "failed" | undefined;
     limit?: number | undefined;
     offset?: number | undefined;
-    status?: "completed" | "failed" | "pending" | "running" | "sent" | undefined;
 }, {
+    status?: "pending" | "sent" | "running" | "completed" | "failed" | undefined;
     limit?: number | undefined;
     offset?: number | undefined;
-    status?: "completed" | "failed" | "pending" | "running" | "sent" | undefined;
 }>;
 export declare function parseCreateAutomation(value: unknown): CreateAutomation;
 export declare function parseUpdateAutomation(value: unknown): UpdateAutomation;

package/dist/src/schema.js

@@ -21,7 +21,7 @@ const jsonSchema = z.lazy(() => z.union([
 ]));
 export const createAutomationSchema = z.object({
     id: identifierSchema.optional(),
-    targetId: identifierSchema,
+    targetId: identifierSchema.optional(),
     name: text(500, 'Automation name').optional(),
     description: text(10_000, 'Automation description').optional(),
     enabled: z.boolean().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Amalgm's cloud automation SDK: Supabase-backed configuration, trigger admission, and run delivery.",
   "license": "UNLICENSED",
   "repository": {
@@ -58,7 +58,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.2",
+    "@amalgm/core": "0.4.4",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@supabase/supabase-js": "2.57.4",
     "cron-parser": "^5.4.0",
@@ -70,6 +70,6 @@
     "@types/pg": "^8.20.1",
     "pg": "^8.16.3",
     "tsx": "^4.23.1",
-    "typescript": "^7.0.2"
+    "typescript": "5.9.3"
   }
 }