@amalgm/automations 0.4.1 → 0.4.2

package/AXIOMS.md

@@ -64,6 +64,9 @@
     aliases for one another.
 23. Automations is a standalone hosted service. Gateway owns none of its API,
     scheduling, claim, execution, or persistence path.
+    Its host validates Core's complete environment binding before opening its
+    database, issuer, public API or webhook authority; local has no managed
+    service fallback.
 24. The durable run ledger is the offline queue. The platform never keeps a
     second online-machine delivery buffer and never drops an unclaimed run.
 25. A run advances through its immutable plan in order. Every step transition

package/PURPOSE.md

@@ -2,6 +2,9 @@
 
 ## Purpose
 
+Managed releases bind to one exact published Core version and build from the
+locked dependency graph on the supported Node toolchain.
+
 Automations is the sole owner of Amalgm automation behavior and data. It lets an
 authenticated user create, inspect, change, delete, and manually run automation
 configuration — an automation belongs to one user and one target, may own any
@@ -10,6 +13,11 @@ have each trigger occurrence run on the selected existing Amalgm machine.
 Supabase holds everything except execution: the automation, its triggers, the
 complete workflow, and permanent run history.
 
+Each hosted environment reaches only its declared UI issuer, database and
+webhook authority. Main and preview initially share the database by owner
+direction; their public API and issuer identities remain distinct. Durable
+claims remain the single authority for work even when hosts share data.
+
 The product has two composable halves over that one state:
 
 - **The configuration control plane** — one ergonomic, auth-bound SDK contract

package/dist/host/config.js

@@ -1,12 +1,16 @@
+import { isLoopbackEndpoint, resolveRuntimeEndpoint, validateRuntimeEndpointEnvironment } from '@amalgm/core/binding';
 export function automationsHostConfig(env = process.env) {
+    const publicOrigin = required(env.AMALGAM_PUBLIC_ORIGIN, 'AMALGAM_PUBLIC_ORIGIN');
+    const isolatedOrigin = isLoopbackEndpoint(publicOrigin) ? publicOrigin : undefined;
+    const binding = validateRuntimeEndpointEnvironment(env, isolatedOrigin);
     return Object.freeze({
         port: integer(env.PORT, 8080, 1, 65_535),
-        publicOrigin: url(env.AMALGAM_PUBLIC_ORIGIN, 'AMALGAM_PUBLIC_ORIGIN'),
-        webhookOrigin: url(env.AUTOMATIONS_WEBHOOK_ORIGIN, 'AUTOMATIONS_WEBHOOK_ORIGIN'),
+        publicOrigin: resolveRuntimeEndpoint(binding, 'automations', publicOrigin, isolatedOrigin),
+        webhookOrigin: resolveRuntimeEndpoint(binding, 'automations', required(env.AUTOMATIONS_WEBHOOK_ORIGIN, 'AUTOMATIONS_WEBHOOK_ORIGIN'), isolatedOrigin),
         webhookTokenKey: secret(env.AUTOMATIONS_WEBHOOK_TOKEN_KEY, 'AUTOMATIONS_WEBHOOK_TOKEN_KEY'),
-        supabaseUrl: url(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'),
+        supabaseUrl: resolveRuntimeEndpoint(binding, 'supabase', required(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'), isolatedOrigin),
         supabaseServiceRoleKey: required(env.SUPABASE_SERVICE_ROLE_KEY, 'SUPABASE_SERVICE_ROLE_KEY'),
-        authorizationIssuer: url(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'),
+        authorizationIssuer: resolveRuntimeEndpoint(binding, 'app', required(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'), isolatedOrigin),
         schedulerIntervalMs: integer(env.AUTOMATIONS_SCHEDULER_INTERVAL_MS, 1_000, 250, 60_000),
     });
 }
@@ -21,14 +25,6 @@ function secret(value, name) {
         throw new Error(`${name} must contain at least 32 bytes`);
     return result;
 }
-function url(value, name) {
-    const parsed = new URL(required(value, name));
-    const local = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
-    if (parsed.protocol !== 'https:' && !(local && parsed.protocol === 'http:')) {
-        throw new Error(`${name} must use HTTPS`);
-    }
-    return parsed.toString().replace(/\/$/, '');
-}
 function integer(value, fallback, minimum, maximum) {
     const parsed = value === undefined ? fallback : Number(value);
     if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {

package/dist/skills/index.json

@@ -1 +1 @@
-{"$schema":"https://schemas.agentskills.io/discovery/0.2.0/schema.json","skills":[{"name":"amalgm-automations","description":"Set up, operate, and troubleshoot Amalgm Automations through MCP or the amalgm automations CLI. Use for installation, Google sign-in, scheduled or webhook workflows, Run Now, run history, and Automations support.","type":"archive","url":"./amalgm-automations.5e4e14f0ace632c8383cd014e1f0f34b24ec0d5c5600132a840abc4c313b31d4.tgz","digest":"sha256:5e4e14f0ace632c8383cd014e1f0f34b24ec0d5c5600132a840abc4c313b31d4"}]}
+{"$schema":"https://schemas.agentskills.io/discovery/0.2.0/schema.json","skills":[{"name":"amalgm-automations","description":"Set up, operate, and troubleshoot Amalgm Automations through MCP or the amalgm automations CLI. Use for installation, Google sign-in, scheduled or webhook workflows, Run Now, run history, and Automations support.","type":"archive","url":"./amalgm-automations.f64db3414c22f330c2c83a5d1dc76949d7a95f3c9ba06a94c5fbd9c4024d4acd.tgz","digest":"sha256:f64db3414c22f330c2c83a5d1dc76949d7a95f3c9ba06a94c5fbd9c4024d4acd"}]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Amalgm's automation SDK: durable trigger admission and target-machine execution.",
   "license": "UNLICENSED",
   "repository": {
@@ -45,7 +45,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json && tsx scripts/mark-executables.ts && tsx scripts/build-public-skill.ts",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && tsx scripts/mark-executables.ts && tsx scripts/build-public-skill.ts",
     "check": "tsx scripts/check-tree.ts && tsc -p tsconfig.json --noEmit",
     "test": "tsx --test test/*.test.ts",
     "test:supabase": "tsx --test test/integration/postgres.test.ts",
@@ -56,10 +56,10 @@
     "start": "node dist/host/main.js"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.4",
+    "@amalgm/core": "0.4.7",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@supabase/supabase-js": "2.57.4",
     "cron-parser": "^5.4.0",