@amalgm/automations 0.2.5 → 0.2.6

package/AXIOMS.md

@@ -25,10 +25,11 @@
    permanent run history. A definition edit or deletion never rewrites prior
    runs.
 10. A webhook URL is a rotatable bearer capability for exactly one trigger.
-    Possession plus any configured provider proof admits that trigger; source
-    and event labels never form a second routing gate. Its random locator is not
-    sufficient without the hosted service's HMAC, and caller input never
-    supplies an owner or target.
+    It resolves the owner and target; the trigger's declared source and event
+    decide whether an authenticated delivery is one of its occurrences and
+    never route to a different trigger. Its random locator is not sufficient
+    without the hosted service's HMAC, and caller input never supplies an owner
+    or target.
 11. Optional provider signing secrets are persisted but write-only: normal
     reads reveal only that a secret is configured.
 12. Run history is read-only in the control plane and always scoped to its

package/PURPOSE.md

@@ -49,10 +49,11 @@ trigger owns one opaque URL under `automations.amalgm.ai`; the URL resolves the
 trigger, owner, and target, so a caller never supplies routing identity. The
 adapter bounds and parses the body, optionally verifies the provider's signing
 secret, deduplicates explicit provider delivery ids, and returns only after the
-run has been stored in Supabase. Provider source and event labels describe the
-occurrence; they are not a second routing gate after the URL has selected the
-trigger. The signed URL can be rotated without changing the automation, and its
-usable bearer token cannot be reconstructed from the database alone.
+run has been stored in Supabase. The URL selects one trigger; that trigger's
+declared source and event then decide whether the authenticated delivery is an
+occurrence. They never select an owner, target, or different trigger. The signed
+URL can be rotated without changing the automation, and its usable bearer token
+cannot be reconstructed from the database alone.
 
 Amalgm supplies a resolved authenticated principal from its user session or
 HMAC-refresh flow; future API keys resolve to the same principal capability.

package/README.md

@@ -99,8 +99,9 @@ Public webhook admission uses the URL returned on each webhook trigger:
 POST https://automations.amalgm.ai/e/<opaque-capability>
 ```
 
-That URL selects the exact trigger. Provider source and event labels are
-recorded as occurrence metadata, not used as another routing condition.
+That URL selects the exact trigger and its owner/target. The trigger's declared
+provider source and event decide whether the authenticated delivery is one of
+its occurrences; a GitHub `ping` therefore cannot fire a `push` trigger.
 `Idempotency-Key` and common provider delivery-id headers deduplicate retries
 against the same trigger. The caller never supplies a user or target id.
 

package/dist/src/automations.js

@@ -34,6 +34,9 @@ export class Automations {
             ? { primary: { source: input.source, event: input.event } }
             : eventReferences(input.headers, input.payload);
         const reference = references.primary;
+        if (!matches(reference.source, trigger.source) || !matches(reference.event, trigger.event)) {
+            return { run: null, ...reference };
+        }
         const now = input.now || new Date();
         const runInput = { kind: 'event', ...reference, payload: input.payload };
         const run = await this.store.enqueueEvent(trigger, runInput, now, input.deliveryKey);
@@ -77,6 +80,9 @@ export class Automations {
         }
     }
 }
+function matches(actual, configured) {
+    return configured === '*' || configured === actual;
+}
 function assertJson(value, label) {
     if (value === null || typeof value === 'string' || typeof value === 'boolean')
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Amalgm's automation SDK: durable trigger admission and target-machine execution.",
   "license": "UNLICENSED",
   "repository": {