@amalgm/automations 0.2.0 → 0.2.2

package/dist/src/tool-surface.js

@@ -0,0 +1,125 @@
+import { NotFoundError, ValidationError } from './errors.js';
+export function createAutomationToolSurface(sdk) {
+    const view = async (automationId, runs = false) => {
+        const automation = await sdk.automations.get(automationId);
+        if (!automation)
+            throw new NotFoundError('Automation');
+        const [triggers, workflow, history] = await Promise.all([
+            sdk.triggers.list(automationId),
+            sdk.workflow.get(automationId),
+            runs === false ? undefined : sdk.runs.list(automationId, runs),
+        ]);
+        return { automation, triggers, workflow, ...(history ? { runs: history } : {}) };
+    };
+    const surface = {
+        async create(input) {
+            const { schedules = [], webhooks = [], workflow, ...automationInput } = input;
+            validateCreateIds(schedules, webhooks);
+            const staged = schedules.length > 0 || webhooks.length > 0 || workflow !== undefined;
+            const requestedEnabled = automationInput.enabled !== false;
+            const automation = await sdk.automations.create({
+                ...automationInput,
+                ...(staged ? { enabled: false } : {}),
+            });
+            try {
+                if (workflow)
+                    await sdk.workflow.create(automation.id, workflow);
+                for (const schedule of schedules)
+                    await sdk.triggers.schedule.create(automation.id, schedule);
+                for (const webhook of webhooks)
+                    await sdk.triggers.webhook.create(automation.id, webhook);
+                if (staged && requestedEnabled)
+                    await sdk.automations.update(automation.id, { enabled: true });
+            }
+            catch (error) {
+                throw disabledDraftError(automation.id, error);
+            }
+            return view(automation.id);
+        },
+        list: (query = {}) => sdk.automations.list(query),
+        get: view,
+        async update(automationId, input) {
+            requireChanges(input);
+            validateChanges(input.schedules, 'schedule');
+            validateChanges(input.webhooks, 'webhook');
+            const current = await sdk.automations.get(automationId);
+            if (!current)
+                throw new NotFoundError('Automation');
+            const changesResources = hasChanges(input.schedules) || hasChanges(input.webhooks) || Boolean(input.workflow);
+            const finalEnabled = input.patch?.enabled ?? current.enabled;
+            const { enabled: _enabled, ...metadata } = input.patch ?? {};
+            if (!changesResources) {
+                await sdk.automations.update(automationId, input.patch);
+                return view(automationId);
+            }
+            if (current.enabled)
+                await sdk.automations.update(automationId, { enabled: false });
+            try {
+                await applyTriggerChanges(automationId, input.schedules, sdk.triggers.schedule);
+                await applyTriggerChanges(automationId, input.webhooks, sdk.triggers.webhook);
+                await applyWorkflowChange(automationId, input.workflow, sdk.workflow);
+                await sdk.automations.update(automationId, { ...metadata, enabled: finalEnabled });
+            }
+            catch (error) {
+                throw disabledDraftError(automationId, error);
+            }
+            return view(automationId);
+        },
+        async delete(automationId) {
+            await sdk.automations.delete(automationId);
+            return { deleted: automationId };
+        },
+    };
+    return Object.freeze(surface);
+}
+async function applyTriggerChanges(automationId, changes, operations) {
+    if (!changes)
+        return;
+    for (const triggerId of changes.delete ?? [])
+        await operations.delete(automationId, triggerId);
+    for (const item of changes.update ?? [])
+        await operations.update(automationId, item.id, item.patch);
+    for (const input of changes.create ?? [])
+        await operations.create(automationId, input);
+}
+async function applyWorkflowChange(automationId, change, workflow) {
+    if (!change)
+        return;
+    if ('create' in change)
+        await workflow.create(automationId, change.create);
+    else if ('update' in change)
+        await workflow.update(automationId, change.update);
+    else
+        await workflow.delete(automationId);
+}
+function requireChanges(input) {
+    if (!input.patch && !hasChanges(input.schedules) && !hasChanges(input.webhooks) && !input.workflow) {
+        throw new ValidationError('Automation update must include a change');
+    }
+}
+function hasChanges(changes) {
+    return Boolean(changes && [changes.create, changes.update, changes.delete]
+        .some((items) => items && items.length > 0));
+}
+function validateChanges(changes, label) {
+    if (!changes)
+        return;
+    const ids = [
+        ...changes.create?.flatMap(({ id }) => id ? [id] : []) ?? [],
+        ...changes.update?.map(({ id }) => id) ?? [],
+        ...changes.delete ?? [],
+    ];
+    if (new Set(ids).size !== ids.length) {
+        throw new ValidationError(`The same ${label} trigger cannot be changed twice`);
+    }
+}
+function validateCreateIds(schedules, webhooks) {
+    const ids = [...schedules, ...webhooks].flatMap(({ id }) => id ? [id] : []);
+    if (new Set(ids).size !== ids.length) {
+        throw new ValidationError('Trigger ids must be unique within an automation');
+    }
+}
+function disabledDraftError(automationId, error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return new Error(`Automation ${automationId} remains disabled because configuration failed: ${reason}`);
+}

package/dist/src/types.d.ts

@@ -51,13 +51,6 @@ export interface AutomationRun {
     output?: Json;
     error?: string;
 }
-export interface RunUpdate {
-    status: 'running' | 'completed' | 'failed';
-    startedAt?: string;
-    finishedAt?: string;
-    output?: Json;
-    error?: string;
-}
 export interface AutomationStore {
     eventTriggers(target: AutomationTarget): Promise<StoredEventTrigger[]>;
     dueCronTriggers(now: Date): Promise<DueCronTrigger[]>;
@@ -65,13 +58,5 @@ export interface AutomationStore {
         kind: 'event';
     }>, now: Date): Promise<AutomationRun | null>;
     enqueueCron(trigger: DueCronTrigger, nextRunAt: string, now: Date): Promise<AutomationRun | null>;
-    pendingRuns(target: AutomationTarget): Promise<AutomationRun[]>;
-    markSent(runId: string, target: AutomationTarget, now: Date): Promise<boolean>;
-    updateRun(target: AutomationTarget, runId: string, update: RunUpdate): Promise<AutomationRun | null>;
-}
-/** The complete transport capability Automations needs from Core. */
-export interface AutomationTransport {
-    isOnline(target: AutomationTarget): boolean;
-    send(run: AutomationRun): Promise<boolean>;
 }
-export type AutomationLog = (event: 'event.rejected' | 'run.pending' | 'drain.started' | 'run.sent' | 'run.failed', details: Readonly<Record<string, string>>) => void;
+export type AutomationLog = (event: 'event.rejected' | 'run.pending', details: Readonly<Record<string, string>>) => void;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.2.0",
-  "description": "Amalgm's cloud automation SDK: Supabase-backed configuration, trigger admission, and run delivery.",
+  "version": "0.2.2",
+  "description": "Amalgm's automation SDK: durable trigger admission and target-machine execution.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -39,7 +39,7 @@
   "files": [
     "dist",
     "skills",
-    "supabase",
+    "supabase/migrations",
     "AXIOMS.md",
     "PURPOSE.md",
     "README.md"
@@ -58,7 +58,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.2",
+    "@amalgm/core": "0.4.4",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@supabase/supabase-js": "2.57.4",
     "cron-parser": "^5.4.0",
@@ -70,6 +70,6 @@
     "@types/pg": "^8.20.1",
     "pg": "^8.16.3",
     "tsx": "^4.23.1",
-    "typescript": "^7.0.2"
+    "typescript": "5.9.3"
   }
 }

package/skills/automations/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: automations
-description: Create, inspect, change, or delete Amalgm automations, schedules, workflows, and run history through the Automations MCP tools.
+description: Create, inspect, change, or delete complete Amalgm automation definitions and inspect their run history through the Automations MCP tools.
 ---
 
 # Amalgm Automations
@@ -11,11 +11,8 @@ the agent adapter over the same hosted SDK used by the UI.
 ## Create a scheduled notification
 
 For a request such as “remind me to call my mom every minute for the next ten
-minutes,” create three resources for the current machine:
-
-1. `amalgm_automations_create` with a clear name and the current machine target.
-2. `amalgm_workflow_create` with a readable script summary and this compiled
-   plan:
+minutes,” make one `amalgm_automations_create` call containing the complete
+definition. Include a readable workflow summary and this compiled plan:
 
 ```json
 {
@@ -30,19 +27,27 @@ minutes,” create three resources for the current machine:
 }
 ```
 
-3. `amalgm_schedule_triggers_create` with cron `* * * * *`, the user's
-   timezone, and `maxOccurrences: 10`.
+Include one schedule with cron `* * * * *`, the user's timezone, and
+`maxOccurrences: 10`. Omit `targetId` in a machine-bound session; never guess
+an opaque target id.
 
-Create the automation disabled, attach its workflow and trigger, then enable it
-only after both exist. If setup fails, leave it disabled and explain which
-resource failed. Never replace a bounded occurrence count with an unbounded
-schedule plus a promise to clean it up later.
+The tool stages multi-resource configuration disabled and enables it only after
+setup succeeds. If setup fails, report the returned disabled draft id. Never
+replace a bounded occurrence count with an unbounded schedule plus a promise to
+clean it up later.
 
 ## Read and change
 
-Use list/get before changing an existing automation. Schedule and webhook
-triggers are separate resources. A workflow is zero-or-one per automation. Run
-history is read-only and remains after configuration deletion.
+Use `amalgm_automations_list` or `amalgm_automations_get` before changing an
+existing automation. Use `amalgm_automations_update` for grouped metadata,
+schedule, webhook, or workflow changes, and `amalgm_automations_delete` only
+after identifying the exact automation. Schedule and webhook triggers remain
+distinct resources inside the definition. A workflow is zero-or-one per
+automation. Run history is read-only, requested through `get`, and remains
+after configuration deletion.
+
+Action discovery belongs to the Tools product, not Automations. Manual
+execution is not advertised until the delivery SDK supports it.
 
 `pending` means a run is durable and waiting for its selected machine. `sent`
 or `running` means that machine holds a lease. `completed` and `failed` are

package/supabase/migrations/20260830010000_durable_step_retries.sql

@@ -0,0 +1,332 @@
+-- One Supabase run row is the queue, lease, durable step journal, and history.
+-- The target machine is the only executor.
+
+ALTER TABLE public.amalgm_automation_runs
+  ADD COLUMN IF NOT EXISTS retry_at timestamptz;
+
+DROP FUNCTION IF EXISTS list_amalgm_pending_runs(uuid, text);
+DROP FUNCTION IF EXISTS mark_amalgm_run_sent(uuid, uuid, text, timestamptz);
+DROP FUNCTION IF EXISTS update_amalgm_run(uuid, uuid, text, jsonb);
+
+ALTER TABLE public.amalgm_automation_runs
+  DROP CONSTRAINT IF EXISTS amalgm_automation_run_retry_state;
+ALTER TABLE public.amalgm_automation_runs
+  ADD CONSTRAINT amalgm_automation_run_retry_state CHECK (
+    status = 'pending' OR retry_at IS NULL
+  );
+
+DROP INDEX IF EXISTS public.amalgm_automation_runs_claimable;
+CREATE INDEX amalgm_automation_runs_claimable
+  ON public.amalgm_automation_runs(user_id, target_id, status, retry_at, lease_expires_at, created_at, id)
+  WHERE status IN ('pending', 'sent', 'running');
+
+CREATE OR REPLACE FUNCTION list_amalgm_event_triggers(p_user_id uuid, p_target_id text)
+RETURNS TABLE (
+  user_id uuid,
+  automation_id text,
+  trigger_id text,
+  target_id text,
+  source text,
+  event text,
+  secret text
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT t.user_id, t.automation_id, t.id, a.target_id, t.source, t.event, t.secret
+  FROM public.amalgm_automation_triggers t
+  JOIN public.amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE t.kind = 'webhook' AND t.user_id = p_user_id
+    AND a.target_id = p_target_id AND t.enabled AND a.enabled
+    AND jsonb_typeof(w.compiled) = 'object'
+    AND w.compiled->>'version' = '1'
+    AND jsonb_typeof(w.compiled->'steps') = 'array'
+    AND jsonb_array_length(
+      CASE WHEN jsonb_typeof(w.compiled->'steps') = 'array'
+        THEN w.compiled->'steps' ELSE '[]'::jsonb END
+    ) BETWEEN 1 AND 100;
+$$;
+
+DROP FUNCTION IF EXISTS list_due_amalgm_crons(timestamptz);
+CREATE FUNCTION list_due_amalgm_crons(p_now timestamptz)
+RETURNS TABLE (
+  user_id uuid,
+  automation_id text,
+  trigger_id text,
+  target_id text,
+  cron text,
+  timezone text,
+  next_run_at timestamptz,
+  remaining_occurrences integer
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT t.user_id, t.automation_id, t.id, a.target_id,
+    t.cron, t.timezone, t.next_run_at, t.remaining_occurrences
+  FROM public.amalgm_automation_triggers t
+  JOIN public.amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE t.kind = 'schedule' AND t.next_run_at <= p_now
+    AND (t.remaining_occurrences IS NULL OR t.remaining_occurrences > 0)
+    AND t.enabled AND a.enabled
+    AND jsonb_typeof(w.compiled) = 'object'
+    AND w.compiled->>'version' = '1'
+    AND jsonb_typeof(w.compiled->'steps') = 'array'
+    AND jsonb_array_length(
+      CASE WHEN jsonb_typeof(w.compiled->'steps') = 'array'
+        THEN w.compiled->'steps' ELSE '[]'::jsonb END
+    ) BETWEEN 1 AND 100
+  ORDER BY t.next_run_at, t.user_id, t.automation_id, t.id;
+$$;
+
+-- Re-check the executable plan inside the same transaction that admits work.
+-- Discovery is advisory; this function is the authority at the race boundary.
+CREATE OR REPLACE FUNCTION enqueue_amalgm_run(
+  p_kind text,
+  p_user_id uuid,
+  p_automation_id text,
+  p_trigger_id text,
+  p_target_id text,
+  p_expected_next_run_at timestamptz,
+  p_next_run_at timestamptz,
+  p_input jsonb,
+  p_now timestamptz
+) RETURNS SETOF public.amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_inserted integer := 0;
+BEGIN
+  IF p_kind = 'cron' THEN
+    PERFORM 1
+    FROM public.amalgm_automation_triggers t
+    JOIN public.amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'schedule' AND t.next_run_at = p_expected_next_run_at
+      AND (t.remaining_occurrences IS NULL OR t.remaining_occurrences > 0)
+      AND t.enabled AND a.enabled
+    FOR UPDATE OF t;
+  ELSIF p_kind = 'event' THEN
+    PERFORM 1
+    FROM public.amalgm_automation_triggers t
+    JOIN public.amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'webhook' AND t.enabled AND a.enabled;
+  ELSE
+    RAISE EXCEPTION 'Invalid automation trigger kind';
+  END IF;
+  IF NOT FOUND THEN RETURN; END IF;
+
+  RETURN QUERY
+  INSERT INTO public.amalgm_automation_runs (
+    user_id, target_id, automation_id, trigger_id, workflow_id,
+    automation_payload, input, status, created_at
+  )
+  SELECT a.user_id, a.target_id, a.id, t.id, w.id,
+    jsonb_strip_nulls(jsonb_build_object(
+      'id', a.id, 'targetId', a.target_id, 'name', a.name,
+      'description', a.description, 'enabled', a.enabled,
+      'trigger', jsonb_strip_nulls(jsonb_build_object(
+        'id', t.id,
+        'kind', CASE WHEN t.kind = 'schedule' THEN 'cron' ELSE 'event' END,
+        'enabled', t.enabled, 'cron', t.cron, 'timezone', t.timezone,
+        'source', t.source, 'event', t.event
+      )),
+      'workflow', jsonb_strip_nulls(jsonb_build_object(
+        'id', w.id, 'name', w.name, 'script', w.script,
+        'compiled', w.compiled, 'allowlist', w.allowlist, 'limits', w.limits
+      ))
+    )),
+    p_input, 'pending', p_now
+  FROM public.amalgm_automations a
+  JOIN public.amalgm_automation_triggers t
+    ON t.user_id = a.user_id AND t.automation_id = a.id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE a.user_id = p_user_id AND a.id = p_automation_id AND t.id = p_trigger_id
+    AND a.target_id = p_target_id AND t.enabled AND a.enabled
+    AND jsonb_typeof(w.compiled) = 'object'
+    AND w.compiled->>'version' = '1'
+    AND jsonb_typeof(w.compiled->'steps') = 'array'
+    AND jsonb_array_length(
+      CASE WHEN jsonb_typeof(w.compiled->'steps') = 'array'
+        THEN w.compiled->'steps' ELSE '[]'::jsonb END
+    ) BETWEEN 1 AND 100
+  RETURNING *;
+  GET DIAGNOSTICS v_inserted = ROW_COUNT;
+
+  IF p_kind = 'cron' AND v_inserted = 1 THEN
+    UPDATE public.amalgm_automation_triggers SET
+      next_run_at = p_next_run_at,
+      remaining_occurrences = CASE WHEN remaining_occurrences IS NULL
+        THEN NULL ELSE remaining_occurrences - 1 END,
+      enabled = CASE WHEN remaining_occurrences = 1 THEN false ELSE enabled END,
+      updated_at = p_now
+    WHERE user_id = p_user_id AND automation_id = p_automation_id
+      AND id = p_trigger_id AND kind = 'schedule'
+      AND next_run_at = p_expected_next_run_at;
+  END IF;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION claim_amalgm_machine_runs(
+  p_user_id uuid,
+  p_target_id text,
+  p_limit integer,
+  p_lease_seconds integer
+) RETURNS SETOF public.amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  UPDATE public.amalgm_automation_runs SET
+    status = 'failed', error = COALESCE(error, 'Machine execution attempts exhausted'),
+    finished_at = now(), lease_token = NULL, lease_expires_at = NULL, retry_at = NULL
+  WHERE user_id = p_user_id AND target_id = p_target_id AND attempts >= 5
+    AND (
+      (status = 'pending' AND COALESCE(retry_at, '-infinity'::timestamptz) <= now())
+      OR (status IN ('sent', 'running') AND COALESCE(lease_expires_at, '-infinity'::timestamptz) <= now())
+    );
+
+  RETURN QUERY
+  WITH candidates AS (
+    SELECT id
+    FROM public.amalgm_automation_runs
+    WHERE user_id = p_user_id AND target_id = p_target_id AND attempts < 5
+      AND (
+        (status = 'pending' AND COALESCE(retry_at, '-infinity'::timestamptz) <= now())
+        OR (status IN ('sent', 'running') AND COALESCE(lease_expires_at, '-infinity'::timestamptz) <= now())
+      )
+    ORDER BY created_at, id
+    FOR UPDATE SKIP LOCKED
+    LIMIT LEAST(GREATEST(p_limit, 1), 20)
+  )
+  UPDATE public.amalgm_automation_runs r SET
+    status = 'sent', sent_at = COALESCE(sent_at, now()),
+    lease_token = gen_random_uuid(),
+    lease_expires_at = now() + make_interval(secs => LEAST(GREATEST(p_lease_seconds, 30), 900)),
+    retry_at = NULL,
+    attempts = attempts + 1
+  FROM candidates
+  WHERE r.id = candidates.id
+  RETURNING r.*;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION update_amalgm_claimed_run(
+  p_user_id uuid,
+  p_target_id text,
+  p_run_id uuid,
+  p_lease_token uuid,
+  p_update jsonb,
+  p_now timestamptz
+) RETURNS SETOF public.amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_status text := p_update->>'status';
+BEGIN
+  IF v_status NOT IN ('pending', 'running', 'completed', 'failed') THEN
+    RAISE EXCEPTION 'Invalid run status';
+  END IF;
+  IF p_update ? 'retryAt' AND v_status <> 'pending' THEN
+    RAISE EXCEPTION 'Only a pending run may have retryAt';
+  END IF;
+
+  RETURN QUERY
+  UPDATE public.amalgm_automation_runs SET
+    status = CASE WHEN v_status = 'pending' AND attempts >= 5 THEN 'failed' ELSE v_status END,
+    started_at = CASE WHEN v_status = 'running' THEN COALESCE(started_at, p_now) ELSE started_at END,
+    finished_at = CASE
+      WHEN v_status IN ('completed', 'failed') OR (v_status = 'pending' AND attempts >= 5) THEN p_now
+      WHEN v_status = 'pending' THEN NULL
+      ELSE finished_at
+    END,
+    output = CASE WHEN p_update ? 'output' THEN p_update->'output' ELSE output END,
+    error = CASE
+      WHEN p_update ? 'error' THEN left(p_update->>'error', 1000)
+      WHEN v_status = 'running' THEN NULL
+      ELSE error
+    END,
+    retry_at = CASE
+      WHEN v_status = 'pending' AND attempts < 5 AND p_update ? 'retryAt'
+        THEN (p_update->>'retryAt')::timestamptz
+      ELSE NULL
+    END,
+    lease_token = CASE WHEN v_status = 'running' THEN lease_token ELSE NULL END,
+    lease_expires_at = CASE WHEN v_status = 'running' THEN p_now + interval '60 seconds' ELSE NULL END
+  WHERE id = p_run_id AND user_id = p_user_id AND target_id = p_target_id
+    AND status IN ('sent', 'running') AND lease_token = p_lease_token
+    AND lease_expires_at > p_now
+  RETURNING *;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION list_amalgm_runs(
+  p_user_id uuid,
+  p_automation_id text,
+  p_status text,
+  p_limit integer,
+  p_offset integer
+)
+RETURNS jsonb
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  WITH filtered AS (
+    SELECT id, automation_id, trigger_id, workflow_id, target_id, status, attempts,
+      retry_at, input, created_at, sent_at, started_at, finished_at, output, error
+    FROM public.amalgm_automation_runs
+    WHERE user_id = p_user_id AND automation_id = p_automation_id
+      AND (p_status IS NULL OR status = p_status)
+  ), page_rows AS (
+    SELECT * FROM filtered ORDER BY created_at DESC, id DESC LIMIT p_limit OFFSET p_offset
+  )
+  SELECT jsonb_build_object(
+    'items', COALESCE((SELECT jsonb_agg(to_jsonb(page_rows)) FROM page_rows), '[]'::jsonb),
+    'total', (SELECT count(*) FROM filtered)
+  );
+$$;
+
+CREATE OR REPLACE FUNCTION get_amalgm_run(p_user_id uuid, p_automation_id text, p_run_id text)
+RETURNS jsonb
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT to_jsonb(r) - 'user_id' - 'automation_payload' - 'lease_token' - 'lease_expires_at'
+  FROM public.amalgm_automation_runs r
+  WHERE r.user_id = p_user_id AND r.automation_id = p_automation_id AND r.id::text = p_run_id;
+$$;
+
+REVOKE ALL ON FUNCTION claim_amalgm_machine_runs(uuid, text, integer, integer) FROM PUBLIC;
+REVOKE ALL ON FUNCTION update_amalgm_claimed_run(uuid, text, uuid, uuid, jsonb, timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION list_due_amalgm_crons(timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION list_amalgm_event_triggers(uuid, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION list_amalgm_runs(uuid, text, text, integer, integer) FROM PUBLIC;
+REVOKE ALL ON FUNCTION get_amalgm_run(uuid, text, text) FROM PUBLIC;
+
+GRANT EXECUTE ON FUNCTION claim_amalgm_machine_runs(uuid, text, integer, integer) TO service_role;
+GRANT EXECUTE ON FUNCTION update_amalgm_claimed_run(uuid, text, uuid, uuid, jsonb, timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION list_due_amalgm_crons(timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION list_amalgm_event_triggers(uuid, text) TO service_role;
+GRANT EXECUTE ON FUNCTION list_amalgm_runs(uuid, text, text, integer, integer) TO service_role;
+GRANT EXECUTE ON FUNCTION get_amalgm_run(uuid, text, text) TO service_role;