@amalgm/automations 0.4.2 → 0.4.3

package/AXIOMS.md

@@ -6,8 +6,9 @@
    skill adapters translate inputs and call it; none accesses Supabase or owns
    validation, authorization, or persistence rules.
 3. Every call is scoped by a resolved Amalgm principal. Public inputs never
-   contain a user id or raw credential; session, HMAC-refresh, and future API
-   key authentication all resolve to the same principal shape.
+    contain a user id or raw credential; session, HMAC-refresh, and future API
+    key authentication all resolve to the same principal shape. Database
+    functions that accept an owner id are private to the hosted service role.
 4. An automation belongs to exactly one user and exactly one target. It may
    have zero or more triggers and zero or one workflow.
 5. A principal bound to exactly one target supplies that target implicitly on
@@ -64,9 +65,6 @@
     aliases for one another.
 23. Automations is a standalone hosted service. Gateway owns none of its API,
     scheduling, claim, execution, or persistence path.
-    Its host validates Core's complete environment binding before opening its
-    database, issuer, public API or webhook authority; local has no managed
-    service fallback.
 24. The durable run ledger is the offline queue. The platform never keeps a
     second online-machine delivery buffer and never drops an unclaimed run.
 25. A run advances through its immutable plan in order. Every step transition
@@ -147,3 +145,13 @@
 49. A complete definition validates all supplied configuration before its
     first write; a later service failure preserves an identifiable disabled
     draft and the original failure code.
+50. Launch quotas belong to the authenticated account in Supabase, shared by
+    every client, target, trigger, and Fly replica, and use the database clock.
+51. Configuration API writes and new run admissions each allow ten operations
+    per rolling minute; retries of an admitted delivery consume no new-run slot.
+52. An account retains at most one hundred unfinished runs; rejecting new work
+    neither removes accepted runs nor advances a schedule's occurrence count.
+53. Only five-field cron may fire; existing finer schedules remain inspectable
+    but disabled until the owner replaces their expression.
+54. Reads, ingress attempts, claims, stream openings, and execution updates
+    have independent bounded transport budgets, separate from new-work quotas.

package/PURPOSE.md

@@ -2,9 +2,6 @@
 
 ## Purpose
 
-Managed releases bind to one exact published Core version and build from the
-locked dependency graph on the supported Node toolchain.
-
 Automations is the sole owner of Amalgm automation behavior and data. It lets an
 authenticated user create, inspect, change, delete, and manually run automation
 configuration — an automation belongs to one user and one target, may own any
@@ -13,10 +10,14 @@ have each trigger occurrence run on the selected existing Amalgm machine.
 Supabase holds everything except execution: the automation, its triggers, the
 complete workflow, and permanent run history.
 
-Each hosted environment reaches only its declared UI issuer, database and
-webhook authority. Main and preview initially share the database by owner
-direction; their public API and issuer identities remain distinct. Durable
-claims remain the single authority for work even when hosts share data.
+The initial launch is free, with no payment prerequisite or automatic paid
+cutover. Shared account limits protect the hosted service: ten configuration
+API writes and ten newly admitted runs per rolling minute, and at most one
+hundred unfinished runs. Accepted work remains durable; quota rejection never
+deletes it or advances a schedule. Schedules use standard five-field cron, with
+one minute as the finest interval. Reads, webhook attempts, machine claims,
+stream openings, and execution updates have separate transport allowances so
+accepted work can finish after new-work capacity is exhausted.
 
 The product has two composable halves over that one state:
 
@@ -70,6 +71,10 @@ the user reach aayush@amalgm.ai with bounded, redacted diagnostic evidence when
 the failing boundary cannot be repaired. The packaged skill is the source for
 installed copies and public setup/support guidance.
 
+Amalgm's public skills collection distributes reviewed copies of this skill
+from a recorded source commit. It is the short installation entry point; this
+repository remains the authority for Automations instructions.
+
 The standalone service publishes a public skill discovery index and an
 integrity-checked archive built from that same packaged skill. Installation
 needs no private repository access, and the archive includes its referenced

package/README.md

@@ -3,6 +3,52 @@
 The SDK and standalone hosted service for automation definitions, triggers,
 durable runs, and execution delivery to an Amalgm machine.
 
+## Free launch limits
+
+Amalgm is free during launch, with no payment prerequisite or automatic paid
+cutover. Each account shares these rolling one-minute allowances across all
+clients, computers, and Fly replicas:
+
+| Operation | Allowance per minute |
+| --- | ---: |
+| Configuration API writes | 10 |
+| New runs, across cron, webhook, and Run Now | 10 |
+| Reads | 120 |
+| Webhook and Run Now attempts, including retries/unmatched events | 120 |
+| Machine claim requests | 120 |
+| Notification stream openings | 20 |
+| Execution journal and lease updates | 3,000 |
+
+A complete CLI create with one schedule and workflow uses four configuration
+writes. Multi-resource changes may leave an inspectable disabled draft if the
+allowance is exhausted during staging; wait and repair that same draft.
+Reads and execution updates remain available when a new-work allowance is full.
+The existing 2 MiB request and 1.5 MiB run-journal bounds still apply.
+
+At most 100 runs per account may be unfinished (`pending`, `sent`, or `running`).
+Excess admissions return HTTP 429 with an error code and `Retry-After`.
+Duplicate delivery keys return their already-admitted run without spending a
+new-run slot. A full queue preserves every accepted run. Cron waits for capacity
+without advancing its firing instant or finite occurrence count; webhook
+senders must retry a rejected delivery. Minute limits bound rates, not a total
+monthly bill or protection against someone creating many accounts.
+
+Schedules require standard five-field cron; seconds and cron macros are
+rejected. Existing expressions outside that format are disabled by migration
+and remain inspectable. Replace the expression before enabling them again.
+
+The hosted service authenticates configuration and machine requests before
+checking account quotas. A signed webhook URL is a bearer capability for one
+trigger; provider signatures are checked when configured. Supabase functions
+and tables cannot be accessed directly by anonymous or signed-in client roles.
+Health checks and skill downloads intentionally remain public.
+
+The Fly configuration uses two `performance-1x` machines with 2 GiB each in
+San Jose. The database owns shared quotas; no machine-local counter can grant
+additional capacity.
+
+## Example
+
 ```ts
 const sdk = service.for(principal);
 const automation = await sdk.automations.create({
@@ -107,20 +153,23 @@ compatibility, the standalone entry point still accepts the prior paired
 `AMALGM_AUTOMATIONS_API_URL` and `AMALGM_AUTOMATIONS_AUTHORIZATION`
 environment variables.
 
-For public local MCP clients, Shell 0.1.176+ provides
-`amalgm automations mcp --user person@example.com`. It exposes the same six
-tools over stdio and discovers the current runtime connection per call.
-`amalgm status --all` lists local account registrations. No pasted token or
-private repository access is part of either flow; the standalone
-`amalgm-automations-mcp` entry point remains for custom authenticated hosts.
+CLI and skill are the first public launch surfaces. The local stdio MCP
+adapter and `amalgm status --all` account discovery are prepared for a later
+Shell release. Do not advertise an unreleased Shell version as available.
+The standalone `amalgm-automations-mcp` entry point remains for custom
+authenticated hosts.
 
 Install the complete portable skill with Node.js 22.20+:
 
 ```bash
-npx skills add https://automations.amalgm.ai --skill amalgm-automations
+npx skills add amalgm-inc/skills
 ```
 
-The host serves standard discovery at `/.well-known/agent-skills/index.json`
+The public [Amalgm collection](https://github.com/amalgm-inc/skills) distributes
+this repository's canonical skill, including its references and agent metadata.
+Users can refresh installed instructions with `npx skills update`.
+
+The host also serves standard discovery at `/.well-known/agent-skills/index.json`
 and a checksum-addressed archive built from `skills/amalgm-automations`.
 The archive includes its references and agent metadata and requires no login.
 
@@ -251,6 +300,8 @@ Run inserts and eligibility changes publish small owner/target wakeups from
 the database transaction. Fly re-reads the earliest retry/lease deadline only
 when a target connects, changes, or reaches that deadline. Losing the database
 subscription closes the machine streams so they reconnect and catch up.
+Progress updates, lease extensions, and completion do not publish another
+wakeup: an existing earlier timer re-reads the current ledger at its deadline.
 Cron scheduling remains hosted; no schedule timer runs on the user's machine.
 
 Rollout order: apply the product migrations, deploy the Fly host, publish the
@@ -270,6 +321,9 @@ npm pack --dry-run
 
 `test:supabase` requires an empty disposable Postgres database; its fixture
 records the Supabase Broadcast boundary inside the same transaction.
+It also examines concurrent shared quotas, all trigger admission paths,
+idempotent retries at capacity, queue preservation, and direct Supabase-role
+denial even when schema defaults initially grant those roles access.
 `test:notifications` requires Node.js 22+, Docker, and Supabase CLI 2.26.9
 (also pinned in CI). It starts and removes its own local Supabase project,
 using real database Broadcast and two HTTP hosts to verify delivery, idle

package/dist/host/config.js

@@ -1,16 +1,12 @@
-import { isLoopbackEndpoint, resolveRuntimeEndpoint, validateRuntimeEndpointEnvironment } from '@amalgm/core/binding';
 export function automationsHostConfig(env = process.env) {
-    const publicOrigin = required(env.AMALGAM_PUBLIC_ORIGIN, 'AMALGAM_PUBLIC_ORIGIN');
-    const isolatedOrigin = isLoopbackEndpoint(publicOrigin) ? publicOrigin : undefined;
-    const binding = validateRuntimeEndpointEnvironment(env, isolatedOrigin);
     return Object.freeze({
         port: integer(env.PORT, 8080, 1, 65_535),
-        publicOrigin: resolveRuntimeEndpoint(binding, 'automations', publicOrigin, isolatedOrigin),
-        webhookOrigin: resolveRuntimeEndpoint(binding, 'automations', required(env.AUTOMATIONS_WEBHOOK_ORIGIN, 'AUTOMATIONS_WEBHOOK_ORIGIN'), isolatedOrigin),
+        publicOrigin: url(env.AMALGAM_PUBLIC_ORIGIN, 'AMALGAM_PUBLIC_ORIGIN'),
+        webhookOrigin: url(env.AUTOMATIONS_WEBHOOK_ORIGIN, 'AUTOMATIONS_WEBHOOK_ORIGIN'),
         webhookTokenKey: secret(env.AUTOMATIONS_WEBHOOK_TOKEN_KEY, 'AUTOMATIONS_WEBHOOK_TOKEN_KEY'),
-        supabaseUrl: resolveRuntimeEndpoint(binding, 'supabase', required(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'), isolatedOrigin),
+        supabaseUrl: url(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'),
         supabaseServiceRoleKey: required(env.SUPABASE_SERVICE_ROLE_KEY, 'SUPABASE_SERVICE_ROLE_KEY'),
-        authorizationIssuer: resolveRuntimeEndpoint(binding, 'app', required(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'), isolatedOrigin),
+        authorizationIssuer: url(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'),
         schedulerIntervalMs: integer(env.AUTOMATIONS_SCHEDULER_INTERVAL_MS, 1_000, 250, 60_000),
     });
 }
@@ -25,6 +21,14 @@ function secret(value, name) {
         throw new Error(`${name} must contain at least 32 bytes`);
     return result;
 }
+function url(value, name) {
+    const parsed = new URL(required(value, name));
+    const local = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
+    if (parsed.protocol !== 'https:' && !(local && parsed.protocol === 'http:')) {
+        throw new Error(`${name} must use HTTPS`);
+    }
+    return parsed.toString().replace(/\/$/, '');
+}
 function integer(value, fallback, minimum, maximum) {
     const parsed = value === undefined ? fallback : Number(value);
     if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {

package/dist/host/limits.d.ts

@@ -0,0 +1,5 @@
+import type { SupabaseRpcClient } from '../src/supabase-store.js';
+/** The database owns the budget. This cache only repeats a known rejection. */
+export declare function createRequestLimits(client: SupabaseRpcClient): Readonly<{
+    check(userId: string, request: Request, door: "control" | "machine"): Promise<void>;
+}>;

package/dist/host/limits.js

@@ -0,0 +1,44 @@
+import { AutomationError } from '../src/errors.js';
+import { AutomationRateLimitError } from '../src/rate-limits.js';
+/** The database owns the budget. This cache only repeats a known rejection. */
+export function createRequestLimits(client) {
+    const deniedUntil = new Map();
+    return Object.freeze({
+        async check(userId, request, door) {
+            const bucket = requestBucket(request, door);
+            const key = JSON.stringify([userId, bucket]);
+            const until = deniedUntil.get(key) ?? 0;
+            let retryAfter = Math.ceil((until - Date.now()) / 1000);
+            if (retryAfter <= 0) {
+                deniedUntil.delete(key);
+                const { data, error } = await client.rpc('consume_amalgm_automation_budget', {
+                    p_user_id: userId, p_bucket: bucket,
+                });
+                if (error || typeof data !== 'number' || !Number.isInteger(data) || data < 0) {
+                    throw new AutomationError('unavailable', 'Request allowance could not be checked', 503);
+                }
+                retryAfter = data;
+                if (retryAfter > 0) {
+                    if (deniedUntil.size >= 10_000)
+                        deniedUntil.clear();
+                    deniedUntil.set(key, Date.now() + retryAfter * 1000);
+                }
+            }
+            if (retryAfter > 0) {
+                throw new AutomationRateLimitError('rate_limited', `Account ${bucket} allowance exhausted. Retry after ${retryAfter} seconds.`, retryAfter);
+            }
+        },
+    });
+}
+function requestBucket(request, door) {
+    const parts = new URL(request.url).pathname.split('/').filter(Boolean).map(decodeURIComponent);
+    if (door === 'machine') {
+        if (parts[3] === 'notifications' && request.method === 'GET')
+            return 'streams';
+        return request.method === 'PATCH' ? 'execution' : 'claims';
+    }
+    if (request.method === 'GET')
+        return 'reads';
+    return parts.length === 4 && parts[3] === 'runs' && request.method === 'POST'
+        ? 'ingress' : 'configuration';
+}

package/dist/host/main.js

@@ -15,6 +15,7 @@ import { createAutomationsHost } from './server.js';
 import { createMachineRunNotifications } from '../src/machine-notifications.js';
 import { subscribeToRunChanges } from './notifications.js';
 import { createPublicSkillApi } from './skill.js';
+import { createRequestLimits } from './limits.js';
 const config = automationsHostConfig();
 const supabase = createClient(config.supabaseUrl, config.supabaseServiceRoleKey, {
     auth: { persistSession: false, autoRefreshToken: false },
@@ -23,11 +24,16 @@ const authentication = createAutomationsAuthenticators({
     issuer: config.authorizationIssuer,
     supabase,
 });
+const limits = createRequestLimits(supabase);
 const webhooks = new WebhookEndpoints(config.webhookOrigin, config.webhookTokenKey);
 const delivery = new Automations(new SupabaseStore(supabase), (event, details) => log(event, details));
 const controlApi = createAutomationApi({
     service: new AutomationCrudService(new SupabaseAutomationCrudRepository(supabase), () => new Date(), webhooks),
-    authenticate: authentication.control,
+    authenticate: async (request) => {
+        const principal = await authentication.control(request);
+        await limits.check(principal.userId, request, 'control');
+        return principal;
+    },
 });
 const machineRepository = new SupabaseMachineRunRepository(supabase);
 const notifications = createMachineRunNotifications({
@@ -36,7 +42,11 @@ const notifications = createMachineRunNotifications({
 });
 const closeNotifications = subscribeToRunChanges(supabase, notifications);
 const machineApi = createMachineRunsApi({
-    authenticate: authentication.machine,
+    authenticate: async (request) => {
+        const principal = await authentication.machine(request);
+        await limits.check(principal.userId, request, 'machine');
+        return principal;
+    },
     runsFor: (principal) => createMachineRuns(machineRepository, principal),
     notifications,
 });

package/dist/skills/index.json

@@ -1 +1 @@
-{"$schema":"https://schemas.agentskills.io/discovery/0.2.0/schema.json","skills":[{"name":"amalgm-automations","description":"Set up, operate, and troubleshoot Amalgm Automations through MCP or the amalgm automations CLI. Use for installation, Google sign-in, scheduled or webhook workflows, Run Now, run history, and Automations support.","type":"archive","url":"./amalgm-automations.f64db3414c22f330c2c83a5d1dc76949d7a95f3c9ba06a94c5fbd9c4024d4acd.tgz","digest":"sha256:f64db3414c22f330c2c83a5d1dc76949d7a95f3c9ba06a94c5fbd9c4024d4acd"}]}
+{"$schema":"https://schemas.agentskills.io/discovery/0.2.0/schema.json","skills":[{"name":"amalgm-automations","description":"Set up and use Amalgm to schedule workflows, run native agents and scripts, receive webhooks, and inspect automation results through the amalgm CLI or an existing MCP connection.","type":"archive","url":"./amalgm-automations.97a9eb82d8185b0730c018c7e82479f2597efd19e2a828cfb256d64ac27082af.tgz","digest":"sha256:97a9eb82d8185b0730c018c7e82479f2597efd19e2a828cfb256d64ac27082af"}]}

package/dist/src/automations.js

@@ -1,4 +1,5 @@
 import { nextCronAt } from './schedule.js';
+import { AutomationRateLimitError } from './rate-limits.js';
 import { eventReferences, verifyEventSecret } from './webhook.js';
 const noop = () => { };
 export class EventRejectedError extends Error {
@@ -49,14 +50,26 @@ export class Automations {
         if (!Number.isInteger(maximumRuns) || maximumRuns < 1)
             throw new Error('maximumRuns must be a positive integer');
         const created = [];
+        const limitedAccounts = new Set();
         for (const trigger of await this.store.dueCronTriggers(now)) {
+            if (limitedAccounts.has(trigger.userId))
+                continue;
             let scheduledFor = trigger.nextRunAt;
             let remaining = trigger.remainingOccurrences;
             while (created.length < maximumRuns
                 && new Date(scheduledFor) <= now
                 && (remaining === undefined || remaining > 0)) {
                 const nextRunAt = nextCronAt(trigger.cron, trigger.timezone, scheduledFor);
-                const run = await this.store.enqueueCron({ ...trigger, nextRunAt: scheduledFor }, nextRunAt, now);
+                let run;
+                try {
+                    run = await this.store.enqueueCron({ ...trigger, nextRunAt: scheduledFor }, nextRunAt, now);
+                }
+                catch (error) {
+                    if (!(error instanceof AutomationRateLimitError))
+                        throw error;
+                    limitedAccounts.add(trigger.userId);
+                    break;
+                }
                 if (!run)
                     break;
                 created.push(run);

package/dist/src/events-http.js

@@ -1,5 +1,7 @@
 import { Automations, EventEndpointNotFoundError, EventRejectedError } from './automations.js';
 import { webhookDeliveryKey } from './webhook.js';
+import { AutomationError } from './errors.js';
+import { rateLimitHeaders } from './rate-limits.js';
 // Engine reference: amalgm-engine/runtime/scripts/amalgm-mcp/events/ingress.js.
 // The 2 MiB transport bound is preserved. Success means the matching run is
 // durable in Supabase, never that an envelope was written to a local inbox.
@@ -40,6 +42,9 @@ export function createAutomationEventsApi(config) {
             return json(202, { ok: true, accepted: true, ...receipt });
         }
         catch (error) {
+            if (error instanceof AutomationError && error.status) {
+                return json(error.status, { error: error.message, code: error.code }, rateLimitHeaders(error));
+            }
             if (error instanceof EventEndpointNotFoundError)
                 return json(404, { error: error.message });
             if (error instanceof EventRejectedError)
@@ -95,9 +100,9 @@ function parsePayload(body) {
 function positiveInteger(value, fallback) {
     return Number.isInteger(value) && value > 0 ? value : fallback;
 }
-function json(status, body) {
+function json(status, body, headers = {}) {
     return new Response(JSON.stringify(body), {
         status,
-        headers: { 'content-type': 'application/json' },
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store', ...headers },
     });
 }

package/dist/src/http.js

@@ -1,4 +1,5 @@
 import { AutomationError } from './errors.js';
+import { rateLimitHeaders } from './rate-limits.js';
 import { parseCreateAutomation, parseCreateScheduleTrigger, parseCreateWebhookTrigger, parseCreateWorkflow, parseListAutomations, parseListRuns, parseRunAutomationNow, parsePageQuery, parseUpdateAutomation, parseUpdateScheduleTrigger, parseUpdateWebhookTrigger, parseUpdateWorkflow, } from './schema.js';
 export function createAutomationApi(options) {
     return async (request) => {
@@ -101,7 +102,7 @@ export function createAutomationApi(options) {
         }
         catch (error) {
             if (error instanceof AutomationError)
-                return response(status(error), { error: error.message, code: error.code });
+                return response(status(error), { error: error.message, code: error.code }, rateLimitHeaders(error));
             const code = error && typeof error === 'object' && 'code' in error ? String(error.code) : '';
             if (code.startsWith('dpop_') || code.includes('access_token') || code.includes('authorization')) {
                 return response(401, { error: 'Authorization denied', code });
@@ -142,13 +143,15 @@ function booleanQuery(url, name) {
 function nullable(value) {
     return value === null ? response(404, { error: 'Not found', code: 'not_found' }) : response(200, value);
 }
-function response(status, body) {
+function response(status, body, headers = {}) {
     return new Response(JSON.stringify(body), {
         status,
-        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
+        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', ...headers },
     });
 }
 function status(error) {
+    if (error.status !== undefined)
+        return error.status;
     if (error.code === 'validation')
         return 400;
     if (error.code === 'forbidden')

package/dist/src/machine-http.js

@@ -1,4 +1,5 @@
 import { AutomationError, ValidationError } from './errors.js';
+import { rateLimitHeaders } from './rate-limits.js';
 export function createMachineRunsApi(options) {
     return async (request) => {
         try {
@@ -26,7 +27,7 @@ export function createMachineRunsApi(options) {
             if (error instanceof AutomationError)
                 return json(error.status ?? (error.code === 'validation' ? 400 : 403), {
                     error: error.message, code: error.code,
-                });
+                }, rateLimitHeaders(error));
             const code = error instanceof Error && 'code' in error ? String(error.code) : 'internal';
             return json(code.startsWith('dpop_') || code.includes('access') ? 401 : 500, {
                 error: code === 'internal' ? 'Automations service failed' : 'Authorization denied', code,
@@ -41,6 +42,6 @@ async function body(request) {
     }
     return value;
 }
-function json(status, value) {
-    return Response.json(value, { status, headers: { 'cache-control': 'no-store' } });
+function json(status, value, headers = {}) {
+    return Response.json(value, { status, headers: { 'cache-control': 'no-store', ...headers } });
 }

package/dist/src/rate-limits.d.ts

@@ -0,0 +1,11 @@
+import { AutomationError } from './errors.js';
+export declare class AutomationRateLimitError extends AutomationError {
+    readonly retryAfterSeconds: number;
+    constructor(code: string, message: string, retryAfterSeconds?: number);
+}
+/** Translate the admission authority's stable errors at every transport door. */
+export declare function admissionLimitError(error: {
+    code?: string;
+    message?: string;
+}): AutomationRateLimitError | null;
+export declare function rateLimitHeaders(error: unknown): Record<string, string>;

package/dist/src/rate-limits.js

@@ -0,0 +1,25 @@
+import { AutomationError } from './errors.js';
+export class AutomationRateLimitError extends AutomationError {
+    retryAfterSeconds;
+    constructor(code, message, retryAfterSeconds = 60) {
+        super(code, message, 429);
+        this.retryAfterSeconds = retryAfterSeconds;
+        this.name = 'AutomationRateLimitError';
+    }
+}
+/** Translate the admission authority's stable errors at every transport door. */
+export function admissionLimitError(error) {
+    if (error.code !== 'PT429')
+        return null;
+    if (error.message === 'queue_full') {
+        return new AutomationRateLimitError('queue_full', 'This account already has 100 unfinished runs. Complete existing work before admitting more.');
+    }
+    if (error.message === 'run_rate_limited') {
+        return new AutomationRateLimitError('run_rate_limited', 'This account can admit 10 new runs per minute. Retry after 60 seconds.');
+    }
+    return new AutomationRateLimitError('rate_limited', 'Request allowance exhausted. Retry after 60 seconds.');
+}
+export function rateLimitHeaders(error) {
+    return error instanceof AutomationRateLimitError
+        ? { 'retry-after': String(error.retryAfterSeconds) } : {};
+}

package/dist/src/schedule.js

@@ -1,5 +1,9 @@
 import { CronExpressionParser } from 'cron-parser';
+import { ValidationError } from './errors.js';
 export function nextCronAt(cron, timezone, after) {
+    if (cron.trim().split(/\s+/).length !== 5) {
+        throw new ValidationError('Schedules require five-field cron; the minimum interval is one minute');
+    }
     return CronExpressionParser.parse(cron, {
         currentDate: after,
         tz: timezone,

package/dist/src/schema.d.ts

@@ -128,14 +128,14 @@ export declare const createWebhookTriggerSchema: z.ZodObject<{
     enabled?: boolean | undefined;
     event?: string | undefined;
     secret?: string | undefined;
-    id?: string | undefined;
     source?: string | undefined;
+    id?: string | undefined;
 }, {
     enabled?: boolean | undefined;
     event?: string | undefined;
     secret?: string | undefined;
-    id?: string | undefined;
     source?: string | undefined;
+    id?: string | undefined;
 }>;
 export declare const updateWebhookTriggerSchema: z.ZodEffects<z.ZodObject<{
     source: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;

package/dist/src/supabase-crud/rpc.js

@@ -1,8 +1,12 @@
 import { ConflictError } from '../errors.js';
+import { admissionLimitError } from '../rate-limits.js';
 export async function call(client, functionName, arguments_) {
     const { data, error } = await client.rpc(functionName, arguments_);
     if (!error)
         return data;
+    const limitError = admissionLimitError(error);
+    if (limitError)
+        throw limitError;
     if (error.code === '23505' || /duplicate key|unique constraint/i.test(error.message || '')) {
         throw new ConflictError(resource(functionName));
     }

package/dist/src/supabase-store.d.ts

@@ -3,6 +3,7 @@ export interface SupabaseRpcClient {
     rpc(functionName: string, arguments_: Record<string, unknown>): PromiseLike<{
         data: unknown;
         error: {
+            code?: string;
             message?: string;
         } | null;
     }>;

package/dist/src/supabase-store.js

@@ -1,3 +1,4 @@
+import { admissionLimitError } from './rate-limits.js';
 function automationRun(row) {
     return {
         id: row.id,
@@ -81,7 +82,7 @@ export class SupabaseStore {
     async #call(functionName, arguments_) {
         const { data, error } = await this.client.rpc(functionName, arguments_);
         if (error)
-            throw new Error(error.message || `Supabase function ${functionName} failed`);
+            throw admissionLimitError(error) ?? new Error(error.message || `Supabase function ${functionName} failed`);
         return data;
     }
 }

package/dist/src/validation.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { CronExpressionParser } from 'cron-parser';
+import { validateCron } from './schedule.js';
 import { ValidationError } from './errors.js';
 export const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
 const MAX_PAGE_SIZE = 100;
@@ -32,9 +32,11 @@ export function schedule(cron, timezone) {
     requiredText(cron, 'Schedule cron');
     requiredText(timezone, 'Schedule timezone');
     try {
-        CronExpressionParser.parse(cron, { currentDate: new Date(0), tz: timezone });
+        validateCron(cron, timezone);
     }
-    catch {
+    catch (error) {
+        if (error instanceof ValidationError)
+            throw error;
         throw new ValidationError('Schedule cron or timezone is invalid');
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Amalgm's automation SDK: durable trigger admission and target-machine execution.",
   "license": "UNLICENSED",
   "repository": {
@@ -45,7 +45,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && tsx scripts/mark-executables.ts && tsx scripts/build-public-skill.ts",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && tsx scripts/mark-executables.ts && tsx scripts/build-public-skill.ts",
     "check": "tsx scripts/check-tree.ts && tsc -p tsconfig.json --noEmit",
     "test": "tsx --test test/*.test.ts",
     "test:supabase": "tsx --test test/integration/postgres.test.ts",
@@ -56,10 +56,10 @@
     "start": "node dist/host/main.js"
   },
   "engines": {
-    "node": ">=24"
+    "node": ">=20"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.7",
+    "@amalgm/core": "0.4.4",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@supabase/supabase-js": "2.57.4",
     "cron-parser": "^5.4.0",

package/skills/amalgm-automations/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: amalgm-automations
-description: Set up, operate, and troubleshoot Amalgm Automations through MCP or the amalgm automations CLI. Use for installation, Google sign-in, scheduled or webhook workflows, Run Now, run history, and Automations support.
+description: Set up and use Amalgm to schedule workflows, run native agents and scripts, receive webhooks, and inspect automation results through the amalgm CLI or an existing MCP connection.
 ---
 
 # Amalgm Automations
@@ -10,14 +10,14 @@ workflow into one durable Amalgm automation and verify what actually ran.
 Automations owns configuration and permanent run history; the selected Amalgm
 machine executes the workflow.
 
-Amalgm Automations is free. Guide the person through Google sign-in and computer
+Amalgm Automations is free during launch. Guide the person through Google sign-in and computer
 approval when needed; do not introduce a payment step. A native agent or other
 external service still uses its own account and may have its own usage costs.
 
 ## Choose the available adapter
 
-Prefer the six `amalgm_automations_*` MCP tools when they are callable. In a
-native local agent without that MCP server, use the matching global CLI:
+Use the global `amalgm automations` CLI in a native local agent. If an existing
+MCP connection already exposes the six `amalgm_automations_*` tools, reuse it.
 
 ```text
 MCP                                 CLI
@@ -85,6 +85,13 @@ id, get and repair that draft with `update`; do not create a replacement.
 
 Use a finite `maxOccurrences` when the user's request is bounded. Do not turn
 "ten times" into an unbounded schedule plus a future cleanup promise.
+Use standard five-field cron; the finest interval is one minute. Seconds and
+cron macros are rejected. Account limits are 10 configuration API writes and
+10 new runs per minute, shared by every client and trigger, with at most 100
+unfinished runs. One complete create with a schedule and workflow uses four
+writes. On HTTP 429, wait for `Retry-After` (or 60 seconds if unavailable), then
+repair an identified draft or retry the same delivery key; never create a new
+definition or key to evade the limit. Accepted runs remain durable.
 
 Choose workflow lanes explicitly:
 

package/skills/amalgm-automations/references/setup-and-support.md

@@ -12,11 +12,12 @@ GitHub account or access to Amalgm's source repositories. With Node.js 22.20+
 (or Amalgm's supplied Node runtime), run:
 
 ```bash
-npx skills add https://automations.amalgm.ai --skill amalgm-automations
+npx skills add amalgm-inc/skills
 ```
 
-Choose the intended agent in the installer's prompt. Installing the skill
-supplies guidance; use the connection steps below to access Automations.
+Choose the intended agent in the installer's prompt. Use `npx skills update`
+to refresh installed instructions. Installing the skill supplies guidance;
+use the connection steps below to access Automations.
 
 ## Start with the connection you have
 
@@ -47,27 +48,9 @@ A successful Automations response is a JSON `result` envelope; an empty list
 is valid. The six Automations commands use that envelope. Shell's `status`
 returns a different JSON shape; `login` and `run` report progress as text.
 
-For a local stdio MCP client, configure this server using the actual selected
-account email (Shell 0.1.176 or newer):
-
-```json
-{
-  "mcpServers": {
-    "amalgm-automations": {
-      "command": "amalgm",
-      "args": ["automations", "mcp", "--user", "person@example.com"]
-    }
-  }
-}
-```
-
-This is the server entry for clients using `mcpServers` JSON; clients with a
-different configuration format use the same command and arguments. Use the
-exact installed launcher path if the client cannot find `amalgm` on PATH.
-Shell supplies the current local connection on every tool call, including
-after a runtime restart. Do not add credentials or environment variables.
-Listing tools works before login; calling them requires a running signed-in
-runtime. After configuring the client, verify its Automations `list` tool.
+CLI and skill are the first public launch surfaces; local stdio MCP setup is
+a follow-up. Use the CLI for new local setup. Reuse an already working MCP
+connection without configuring a second connection or copying credentials.
 
 ## Install only when needed
 
@@ -140,11 +123,11 @@ do not reopen approval until they choose to continue.
 
 ## Reuse or resume a registered computer
 
-Discover registered accounts with `amalgm status --all` (Shell 0.1.176+).
-It returns email and registration state only. A sole ready account is selected
-implicitly; multiple ready accounts require `--user`. Once the account email
-is known, inspect it explicitly. Replace the example email below with the
-user's actual selected account:
+Use the account email selected during setup. If it is unknown, ask the user
+which account they connected; do not read credential files to discover it.
+If the installed `amalgm --help` advertises `status --all`, that command can
+list public registration metadata. Multiple accounts require an explicit
+choice. Replace the example email below with the user's selected account:
 
 ```bash
 amalgm status --user person@example.com
@@ -186,7 +169,7 @@ reinstallation, or repeated writes.
 
 | Failure | What to do |
 | --- | --- |
-| `user_not_registered` or `user_selection_required` | Use `amalgm status --all` to discover local accounts, then select the intended email or complete login for it. |
+| `user_not_registered` or `user_selection_required` | Select the intended account email, inspect its status, and complete login if needed. Use `status --all` only when the installed CLI advertises it. |
 | `runtime_unavailable`, connection refused, or Shell says it is not running | Inspect the selected account's status and use the resume/setup decision above. A standalone adapter asking for environment credentials should be replaced by the global `amalgm automations` path. |
 | `runtime_unauthorized` | Retry the read once through the public Shell command, which obtains the current local connection. If it still fails, keep the error for support; never extract or replace tokens manually. |
 | `runtime_transport` or `runtime_protocol` | Check local readiness, connectivity, and the installed version. A timeout or service outage is not evidence that the user needs a new account. |

package/supabase/migrations/20260907000000_service_only_permissions.sql

@@ -0,0 +1,56 @@
+-- The hosted principal is the only authority allowed to choose a user_id.
+-- Supabase schema defaults grant anon/authenticated EXECUTE directly: removing
+-- PUBLIC alone does not remove those grants. Keep this list at the product
+-- boundary; never alter another product's functions or schema-wide defaults.
+DO $$
+DECLARE v_function regprocedure;
+BEGIN
+  FOR v_function IN
+    SELECT p.oid::regprocedure FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname = 'public' AND p.proname IN (
+      'amalgm_machine_wake_delay',
+      'amalgm_trigger_json',
+      'amalgm_workflow_is_executable',
+      'claim_amalgm_machine_runs',
+      'create_amalgm_automation',
+      'create_amalgm_schedule_trigger',
+      'create_amalgm_webhook_trigger',
+      'create_amalgm_workflow',
+      'delete_amalgm_automation',
+      'delete_amalgm_schedule_trigger',
+      'delete_amalgm_webhook_trigger',
+      'delete_amalgm_workflow',
+      'enqueue_amalgm_manual_run',
+      'enqueue_amalgm_run',
+      'get_amalgm_automation',
+      'get_amalgm_run',
+      'get_amalgm_schedule_trigger',
+      'get_amalgm_webhook_trigger',
+      'get_amalgm_workflow',
+      'list_amalgm_automations',
+      'list_amalgm_event_triggers',
+      'list_amalgm_pending_runs',
+      'list_amalgm_runs',
+      'list_amalgm_schedule_triggers',
+      'list_amalgm_triggers',
+      'list_amalgm_webhook_triggers',
+      'list_due_amalgm_crons',
+      'mark_amalgm_run_sent',
+      'notify_amalgm_machine_run',
+      'resolve_amalgm_webhook',
+      'update_amalgm_automation',
+      'update_amalgm_claimed_run',
+      'update_amalgm_run',
+      'update_amalgm_schedule_trigger',
+      'update_amalgm_webhook_trigger',
+      'update_amalgm_workflow'
+    )
+  LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC, anon, authenticated', v_function);
+  END LOOP;
+END;
+$$;
+REVOKE ALL ON public.amalgm_automations, public.amalgm_automation_triggers,
+  public.amalgm_automation_workflows, public.amalgm_automation_runs
+  FROM PUBLIC, anon, authenticated;

package/supabase/migrations/20260907010000_free_launch_limits.sql

@@ -0,0 +1,340 @@
+-- Free launch policy. All budgets use the database clock and one account key.
+CREATE TABLE public.amalgm_automation_rate_limits (
+  user_id uuid NOT NULL,
+  bucket text NOT NULL,
+  admitted_at timestamptz[] NOT NULL DEFAULT '{}',
+  PRIMARY KEY (user_id, bucket)
+);
+ALTER TABLE public.amalgm_automation_rate_limits ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON public.amalgm_automation_rate_limits FROM PUBLIC, anon, authenticated;
+
+-- Returns zero on admission, otherwise the number of seconds until capacity.
+-- A bounded sliding window avoids double bursts at wall-clock minute boundaries.
+CREATE FUNCTION public.consume_amalgm_automation_budget(p_user_id uuid, p_bucket text)
+RETURNS integer
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  v_limit integer;
+  v_now timestamptz;
+  v_times timestamptz[];
+BEGIN
+  v_limit := CASE p_bucket
+    WHEN 'configuration' THEN 10 WHEN 'runs' THEN 10
+    WHEN 'reads' THEN 120 WHEN 'ingress' THEN 120
+    WHEN 'claims' THEN 120 WHEN 'streams' THEN 20
+    WHEN 'execution' THEN 3000 ELSE NULL END;
+  IF p_user_id IS NULL OR v_limit IS NULL THEN
+    RAISE EXCEPTION 'Invalid Automations budget';
+  END IF;
+  INSERT INTO public.amalgm_automation_rate_limits (user_id, bucket)
+    VALUES (p_user_id, p_bucket) ON CONFLICT DO NOTHING;
+  SELECT admitted_at INTO v_times FROM public.amalgm_automation_rate_limits
+    WHERE user_id = p_user_id AND bucket = p_bucket FOR UPDATE;
+  v_now := clock_timestamp();
+  SELECT coalesce(array_agg(t ORDER BY t), '{}'::timestamptz[]) INTO v_times
+    FROM unnest(v_times) t WHERE t > v_now - interval '1 minute';
+  IF cardinality(v_times) >= v_limit THEN
+    RETURN greatest(1, ceil(extract(epoch FROM (v_times[1] + interval '1 minute' - v_now)))::integer);
+  END IF;
+  UPDATE public.amalgm_automation_rate_limits SET admitted_at = array_append(v_times, v_now)
+    WHERE user_id = p_user_id AND bucket = p_bucket;
+  RETURN 0;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.consume_amalgm_automation_budget(uuid, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.consume_amalgm_automation_budget(uuid, text) TO service_role;
+
+CREATE INDEX amalgm_automation_runs_unfinished_account
+  ON public.amalgm_automation_runs(user_id)
+  WHERE status IN ('pending', 'sent', 'running');
+
+-- Admission functions take this account lock before reading duplicate keys or
+-- trigger rows. The insert guard also covers future service-owned admissions.
+CREATE FUNCTION public.guard_amalgm_run_admission()
+RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended('amalgm-admission:' || NEW.user_id::text, 0));
+  IF (SELECT count(*) FROM public.amalgm_automation_runs
+      WHERE user_id = NEW.user_id AND status IN ('pending', 'sent', 'running')) >= 100 THEN
+    RAISE SQLSTATE 'PT429' USING MESSAGE = 'queue_full',
+      DETAIL = 'This account already has 100 unfinished runs. Complete existing work before admitting more.';
+  END IF;
+  IF public.consume_amalgm_automation_budget(NEW.user_id, 'runs') > 0 THEN
+    RAISE SQLSTATE 'PT429' USING MESSAGE = 'run_rate_limited',
+      DETAIL = 'This account can admit 10 new runs per minute. Retry after 60 seconds.';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.guard_amalgm_run_admission() FROM PUBLIC, anon, authenticated;
+CREATE TRIGGER amalgm_run_admission_guard
+BEFORE INSERT ON public.amalgm_automation_runs
+FOR EACH ROW EXECUTE FUNCTION public.guard_amalgm_run_admission();
+
+CREATE FUNCTION public.amalgm_cron_has_minute_granularity(p_cron text)
+RETURNS boolean LANGUAGE sql IMMUTABLE SET search_path = ''
+AS $$ SELECT p_cron IS NOT NULL AND cardinality(regexp_split_to_array(btrim(p_cron), '\s+')) = 5; $$;
+REVOKE ALL ON FUNCTION public.amalgm_cron_has_minute_granularity(text) FROM PUBLIC, anon, authenticated;
+
+-- Preserve the definition and run history; an old seconds expression cannot
+-- continue firing or be enabled again without changing its expression.
+UPDATE public.amalgm_automation_triggers SET enabled = false, updated_at = now()
+WHERE kind = 'schedule' AND NOT public.amalgm_cron_has_minute_granularity(cron);
+ALTER TABLE public.amalgm_automation_triggers ADD CONSTRAINT amalgm_schedule_minute_granularity
+  CHECK (kind <> 'schedule' OR NOT enabled OR public.amalgm_cron_has_minute_granularity(cron));
+
+CREATE OR REPLACE FUNCTION public.enqueue_amalgm_run(
+  p_kind text,
+  p_user_id uuid,
+  p_automation_id text,
+  p_trigger_id text,
+  p_target_id text,
+  p_endpoint_id text,
+  p_delivery_key text,
+  p_expected_next_run_at timestamptz,
+  p_next_run_at timestamptz,
+  p_input jsonb,
+  p_now timestamptz
+) RETURNS SETOF public.amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_inserted integer := 0;
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended('amalgm-admission:' || p_user_id::text, 0));
+  IF p_kind = 'cron' THEN
+    IF p_next_run_at IS NULL OR p_next_run_at < p_expected_next_run_at + interval '1 minute' THEN
+      RAISE EXCEPTION 'Schedule intervals must be at least one minute';
+    END IF;
+    IF p_endpoint_id IS NOT NULL OR p_delivery_key IS NOT NULL THEN
+      RAISE EXCEPTION 'Schedule admission cannot carry webhook identity';
+    END IF;
+    PERFORM 1
+    FROM public.amalgm_automation_triggers t
+    JOIN public.amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'schedule' AND public.amalgm_cron_has_minute_granularity(t.cron)
+      AND t.next_run_at = p_expected_next_run_at
+      AND (t.remaining_occurrences IS NULL OR t.remaining_occurrences > 0)
+      AND t.enabled AND a.enabled
+    FOR UPDATE OF t;
+  ELSIF p_kind = 'event' THEN
+    IF p_endpoint_id IS NULL THEN RAISE EXCEPTION 'Webhook endpoint is required'; END IF;
+    PERFORM 1
+    FROM public.amalgm_automation_triggers t
+    JOIN public.amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id
+      AND t.enabled AND a.enabled;
+  ELSE
+    RAISE EXCEPTION 'Invalid automation trigger kind';
+  END IF;
+  IF NOT FOUND THEN RETURN; END IF;
+  IF p_delivery_key IS NOT NULL THEN
+    RETURN QUERY SELECT r.* FROM public.amalgm_automation_runs r
+    WHERE r.user_id = p_user_id AND r.automation_id = p_automation_id
+      AND r.trigger_id = p_trigger_id AND r.delivery_key = p_delivery_key;
+    IF FOUND THEN RETURN; END IF;
+  END IF;
+
+  RETURN QUERY
+  INSERT INTO public.amalgm_automation_runs (
+    user_id, target_id, automation_id, trigger_id, workflow_id,
+    automation_payload, input, status, delivery_key, created_at
+  )
+  SELECT a.user_id, a.target_id, a.id, t.id, w.id,
+    jsonb_strip_nulls(jsonb_build_object(
+      'id', a.id, 'targetId', a.target_id, 'name', a.name,
+      'description', a.description, 'enabled', a.enabled,
+      'trigger', jsonb_strip_nulls(jsonb_build_object(
+        'id', t.id,
+        'kind', CASE WHEN t.kind = 'schedule' THEN 'cron' ELSE 'event' END,
+        'enabled', t.enabled, 'cron', t.cron, 'timezone', t.timezone,
+        'source', t.source, 'event', t.event
+      )),
+      'workflow', jsonb_strip_nulls(jsonb_build_object(
+        'id', w.id, 'name', w.name, 'script', w.script,
+        'compiled', w.compiled, 'allowlist', w.allowlist, 'limits', w.limits
+      ))
+    )),
+    p_input, 'pending', p_delivery_key, p_now
+  FROM public.amalgm_automations a
+  JOIN public.amalgm_automation_triggers t
+    ON t.user_id = a.user_id AND t.automation_id = a.id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE a.user_id = p_user_id AND a.id = p_automation_id AND t.id = p_trigger_id
+    AND a.target_id = p_target_id AND t.enabled AND a.enabled
+    AND (p_kind = 'cron' OR (t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id))
+    AND public.amalgm_workflow_is_executable(w.compiled)
+  ON CONFLICT (user_id, automation_id, trigger_id, delivery_key)
+    WHERE delivery_key IS NOT NULL
+  DO UPDATE SET delivery_key = EXCLUDED.delivery_key
+  RETURNING *;
+  GET DIAGNOSTICS v_inserted = ROW_COUNT;
+
+  IF p_kind = 'cron' AND v_inserted = 1 THEN
+    UPDATE public.amalgm_automation_triggers SET
+      next_run_at = p_next_run_at,
+      remaining_occurrences = CASE WHEN remaining_occurrences IS NULL
+        THEN NULL ELSE remaining_occurrences - 1 END,
+      enabled = CASE WHEN remaining_occurrences = 1 THEN false ELSE enabled END,
+      updated_at = p_now
+    WHERE user_id = p_user_id AND automation_id = p_automation_id
+      AND id = p_trigger_id AND kind = 'schedule'
+      AND next_run_at = p_expected_next_run_at;
+  END IF;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.enqueue_amalgm_manual_run(
+  p_user_id uuid,
+  p_automation_id text,
+  p_input jsonb,
+  p_idempotency_key text,
+  p_now timestamptz
+) RETURNS SETOF public.amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended('amalgm-admission:' || p_user_id::text, 0));
+  IF p_idempotency_key IS NOT NULL THEN
+    RETURN QUERY
+    SELECT r.*
+    FROM public.amalgm_automation_runs r
+    WHERE r.user_id = p_user_id
+      AND r.automation_id = p_automation_id
+      AND r.trigger_id = '@manual'
+      AND r.delivery_key = p_idempotency_key;
+    IF FOUND THEN RETURN; END IF;
+  END IF;
+
+  RETURN QUERY
+  INSERT INTO public.amalgm_automation_runs (
+    user_id, target_id, automation_id, trigger_id, workflow_id,
+    automation_payload, input, status, delivery_key, created_at
+  )
+  SELECT a.user_id, a.target_id, a.id, '@manual', w.id,
+    jsonb_strip_nulls(jsonb_build_object(
+      'id', a.id, 'targetId', a.target_id, 'name', a.name,
+      'description', a.description, 'enabled', a.enabled,
+      'trigger', jsonb_build_object(
+        'id', '@manual', 'kind', 'manual', 'enabled', true
+      ),
+      'workflow', jsonb_strip_nulls(jsonb_build_object(
+        'id', w.id, 'name', w.name, 'script', w.script,
+        'compiled', w.compiled, 'allowlist', w.allowlist, 'limits', w.limits
+      ))
+    )),
+    p_input, 'pending', p_idempotency_key, p_now
+  FROM public.amalgm_automations a
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE a.user_id = p_user_id AND a.id = p_automation_id AND a.enabled
+    AND public.amalgm_workflow_is_executable(w.compiled)
+  ON CONFLICT (user_id, automation_id, trigger_id, delivery_key)
+    WHERE delivery_key IS NOT NULL
+  DO UPDATE SET delivery_key = EXCLUDED.delivery_key
+  RETURNING *;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.list_due_amalgm_crons(p_now timestamptz)
+RETURNS TABLE (
+  user_id uuid,
+  automation_id text,
+  trigger_id text,
+  target_id text,
+  cron text,
+  timezone text,
+  next_run_at timestamptz,
+  remaining_occurrences integer
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT t.user_id, t.automation_id, t.id, a.target_id,
+    t.cron, t.timezone, t.next_run_at, t.remaining_occurrences
+  FROM public.amalgm_automation_triggers t
+  JOIN public.amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE t.kind = 'schedule' AND t.next_run_at <= p_now
+    AND (t.remaining_occurrences IS NULL OR t.remaining_occurrences > 0)
+    AND t.enabled AND a.enabled
+    AND public.amalgm_cron_has_minute_granularity(t.cron)
+    AND public.amalgm_workflow_is_executable(w.compiled)
+    AND NOT EXISTS (SELECT 1 FROM public.amalgm_automation_rate_limits q
+      WHERE q.user_id = t.user_id AND q.bucket = 'runs'
+        AND cardinality(q.admitted_at) >= 10
+        AND q.admitted_at[1] > clock_timestamp() - interval '1 minute')
+    AND (SELECT count(*) FROM public.amalgm_automation_runs r
+      WHERE r.user_id = t.user_id AND r.status IN ('pending', 'sent', 'running')) < 100
+  ORDER BY t.next_run_at, t.user_id, t.automation_id, t.id;
+$$;
+
+CREATE OR REPLACE FUNCTION public.resolve_amalgm_webhook(p_endpoint_id text)
+RETURNS TABLE (
+  user_id uuid, automation_id text, trigger_id text, target_id text,
+  endpoint_id text, source text, event text, secret text
+)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE v_owner uuid;
+BEGIN
+  SELECT t.user_id INTO v_owner FROM public.amalgm_automation_triggers t
+    WHERE t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id;
+  IF v_owner IS NULL THEN RETURN; END IF;
+  IF public.consume_amalgm_automation_budget(v_owner, 'ingress') > 0 THEN
+    RAISE SQLSTATE 'PT429' USING MESSAGE = 'rate_limited';
+  END IF;
+  RETURN QUERY
+  SELECT t.user_id, t.automation_id, t.id, a.target_id,
+    t.endpoint_id, t.source, t.event, t.secret
+  FROM public.amalgm_automation_triggers t
+  JOIN public.amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id
+    AND t.enabled AND a.enabled
+    AND public.amalgm_workflow_is_executable(w.compiled);
+END;
+$$;
+
+-- A later eligibility deadline cannot require an earlier wakeup. Existing
+-- timers re-read the ledger at their deadline; journal writes and heartbeat
+-- renewals need no Broadcast. Earlier eligibility still wakes every host.
+CREATE OR REPLACE FUNCTION public.notify_amalgm_machine_run()
+RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+BEGIN
+  IF TG_OP = 'UPDATE' THEN
+    IF (OLD.status, OLD.retry_at, OLD.lease_expires_at) IS NOT DISTINCT FROM
+       (NEW.status, NEW.retry_at, NEW.lease_expires_at) THEN RETURN NEW; END IF;
+    IF NEW.status IN ('completed', 'failed') THEN RETURN NEW; END IF;
+    IF OLD.status IN ('sent', 'running') AND NEW.status IN ('sent', 'running')
+      AND NEW.lease_expires_at >= OLD.lease_expires_at THEN RETURN NEW; END IF;
+  END IF;
+  PERFORM realtime.send(
+    jsonb_build_object('userId', NEW.user_id, 'targetId', NEW.target_id),
+    'changed', 'amalgm:automations:runs', true
+  );
+  RETURN NEW;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.notify_amalgm_machine_run() FROM PUBLIC, anon, authenticated;