@amalgm/automations 0.2.3 → 0.2.4

package/AXIOMS.md

@@ -24,9 +24,11 @@
 9. Supabase is authoritative for automations, triggers, workflow source, and
    permanent run history. A definition edit or deletion never rewrites prior
    runs.
-10. A webhook URL is a rotatable bearer capability for exactly one trigger. Its
-    random locator is not sufficient without the hosted service's HMAC, and
-    caller input never supplies an owner or target.
+10. A webhook URL is a rotatable bearer capability for exactly one trigger.
+    Possession plus any configured provider proof admits that trigger; source
+    and event labels never form a second routing gate. Its random locator is not
+    sufficient without the hosted service's HMAC, and caller input never
+    supplies an owner or target.
 11. Optional provider signing secrets are persisted but write-only: normal
     reads reveal only that a secret is configured.
 12. Run history is read-only in the control plane and always scoped to its

package/PURPOSE.md

@@ -47,9 +47,10 @@ trigger owns one opaque URL under `automations.amalgm.ai`; the URL resolves the
 trigger, owner, and target, so a caller never supplies routing identity. The
 adapter bounds and parses the body, optionally verifies the provider's signing
 secret, deduplicates explicit provider delivery ids, and returns only after the
-run has been stored in Supabase. The signed URL can be rotated without changing
-the automation, and its usable bearer token cannot be reconstructed from the
-database alone.
+run has been stored in Supabase. Provider source and event labels describe the
+occurrence; they are not a second routing gate after the URL has selected the
+trigger. The signed URL can be rotated without changing the automation, and its
+usable bearer token cannot be reconstructed from the database alone.
 
 Amalgm supplies a resolved authenticated principal from its user session or
 HMAC-refresh flow; future API keys resolve to the same principal capability.

package/README.md

@@ -99,6 +99,8 @@ Public webhook admission uses the URL returned on each webhook trigger:
 POST https://automations.amalgm.ai/e/<opaque-capability>
 ```
 
+That URL selects the exact trigger. Provider source and event labels are
+recorded as occurrence metadata, not used as another routing condition.
 `Idempotency-Key` and common provider delivery-id headers deduplicate retries
 against the same trigger. The caller never supplies a user or target id.
 

package/dist/src/automations.js

@@ -1,5 +1,5 @@
 import { nextCronAt } from './schedule.js';
-import { eventReferences, matchesEvent, verifyEventSecret } from './webhook.js';
+import { eventReferences, verifyEventSecret } from './webhook.js';
 const noop = () => { };
 export class EventRejectedError extends Error {
     constructor() {
@@ -33,14 +33,7 @@ export class Automations {
         const references = input.source && input.event
             ? { primary: { source: input.source, event: input.event } }
             : eventReferences(input.headers, input.payload);
-        let reference = references.primary;
-        let matches = matchesEvent(trigger, reference.source, reference.event);
-        if (!matches && references.fallback) {
-            reference = references.fallback;
-            matches = matchesEvent(trigger, reference.source, reference.event);
-        }
-        if (!matches)
-            return { run: null, ...reference };
+        const reference = references.primary;
         const now = input.now || new Date();
         const runInput = { kind: 'event', ...reference, payload: input.payload };
         const run = await this.store.enqueueEvent(trigger, runInput, now, input.deliveryKey);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Amalgm's automation SDK: durable trigger admission and target-machine execution.",
   "license": "UNLICENSED",
   "repository": {