@amalgm/automations 0.4.2 → 0.4.4-main.34176529830

package/AXIOMS.md

@@ -6,8 +6,9 @@
    skill adapters translate inputs and call it; none accesses Supabase or owns
    validation, authorization, or persistence rules.
 3. Every call is scoped by a resolved Amalgm principal. Public inputs never
-   contain a user id or raw credential; session, HMAC-refresh, and future API
-   key authentication all resolve to the same principal shape.
+    contain a user id or raw credential; session, HMAC-refresh, and future API
+    key authentication all resolve to the same principal shape. Database
+    functions that accept an owner id are private to the hosted service role.
 4. An automation belongs to exactly one user and exactly one target. It may
    have zero or more triggers and zero or one workflow.
 5. A principal bound to exactly one target supplies that target implicitly on
@@ -147,3 +148,13 @@
 49. A complete definition validates all supplied configuration before its
     first write; a later service failure preserves an identifiable disabled
     draft and the original failure code.
+50. Launch quotas belong to the authenticated account in Supabase, shared by
+    every client, target, trigger, and Fly replica, and use the database clock.
+51. Configuration API writes and new run admissions each allow ten operations
+    per rolling minute; retries of an admitted delivery consume no new-run slot.
+52. An account retains at most one hundred unfinished runs; rejecting new work
+    neither removes accepted runs nor advances a schedule's occurrence count.
+53. Only five-field cron may fire; existing finer schedules remain inspectable
+    but disabled until the owner replaces their expression.
+54. Reads, ingress attempts, claims, stream openings, and execution updates
+    have independent bounded transport budgets, separate from new-work quotas.

package/PURPOSE.md

@@ -2,6 +2,11 @@
 
 ## Purpose
 
+Consumer assembly derives exact same-branch dependency pins from the declared
+package manifests and registry candidate records. One pending composition per
+branch preserves human edits; complete consumer checks for the exact merge tree govern its
+merge, and publication never implies installed adoption.
+
 Managed releases bind to one exact published Core version and build from the
 locked dependency graph on the supported Node toolchain.
 
@@ -18,6 +23,15 @@ webhook authority. Main and preview initially share the database by owner
 direction; their public API and issuer identities remain distinct. Durable
 claims remain the single authority for work even when hosts share data.
 
+The initial launch is free, with no payment prerequisite or automatic paid
+cutover. Shared account limits protect the hosted service: ten configuration
+API writes and ten newly admitted runs per rolling minute, and at most one
+hundred unfinished runs. Accepted work remains durable; quota rejection never
+deletes it or advances a schedule. Schedules use standard five-field cron, with
+one minute as the finest interval. Reads, webhook attempts, machine claims,
+stream openings, and execution updates have separate transport allowances so
+accepted work can finish after new-work capacity is exhausted.
+
 The product has two composable halves over that one state:
 
 - **The configuration control plane** — one ergonomic, auth-bound SDK contract
@@ -70,6 +84,10 @@ the user reach aayush@amalgm.ai with bounded, redacted diagnostic evidence when
 the failing boundary cannot be repaired. The packaged skill is the source for
 installed copies and public setup/support guidance.
 
+Amalgm's public skills collection distributes reviewed copies of this skill
+from a recorded source commit. It is the short installation entry point; this
+repository remains the authority for Automations instructions.
+
 The standalone service publishes a public skill discovery index and an
 integrity-checked archive built from that same packaged skill. Installation
 needs no private repository access, and the archive includes its referenced
@@ -144,3 +162,27 @@ authority. Shell calls the published machine-claim and execution contracts
 directly; the UI calls the hosted control plane through the published client.
 Any remaining Engine automation code is deprecated migration/parity evidence,
 not a cutover dependency or compatibility authority.
+
+## Managed package delivery
+
+Managed package delivery starts from a clean, exact main or preview source
+commit. The workflow occurrence supplies only its generated version and source
+record; tests run against those candidate inputs before packing. Every native
+gate and publication use that same tarball and integrity. A candidate tag makes
+bytes available to release assembly; it never promotes an installed runtime.
+Release tooling remains available inside each owner repository so a developer
+or CI job never needs access to another private product repository.
+Registry credentials are available only to the final protected publication job,
+after every native examination proves the exact candidate bytes.
+Native consumers install the archive as a dependency, so SDK development
+dependencies never become an end-user installation requirement.
+The repository token creates only its own dependency proposals and explicitly
+dispatches checks and delivery; every admitted gate proves the actual checkout,
+including the exact two-parent merge commit that becomes managed source.
+
+Hosted delivery examines the final immutable image under both declared managed
+bindings before deploying that exact digest to its source branch's Fly app.
+The host's own pipeline owns replacement, health and provider verification;
+no hosted process updates its package tree in place. A local image examination
+proves image behavior, while Fly networking and durable product journeys retain
+their separate provider proof.

package/README.md

@@ -3,6 +3,52 @@
 The SDK and standalone hosted service for automation definitions, triggers,
 durable runs, and execution delivery to an Amalgm machine.
 
+## Free launch limits
+
+Amalgm is free during launch, with no payment prerequisite or automatic paid
+cutover. Each account shares these rolling one-minute allowances across all
+clients, computers, and Fly replicas:
+
+| Operation | Allowance per minute |
+| --- | ---: |
+| Configuration API writes | 10 |
+| New runs, across cron, webhook, and Run Now | 10 |
+| Reads | 120 |
+| Webhook and Run Now attempts, including retries/unmatched events | 120 |
+| Machine claim requests | 120 |
+| Notification stream openings | 20 |
+| Execution journal and lease updates | 3,000 |
+
+A complete CLI create with one schedule and workflow uses four configuration
+writes. Multi-resource changes may leave an inspectable disabled draft if the
+allowance is exhausted during staging; wait and repair that same draft.
+Reads and execution updates remain available when a new-work allowance is full.
+The existing 2 MiB request and 1.5 MiB run-journal bounds still apply.
+
+At most 100 runs per account may be unfinished (`pending`, `sent`, or `running`).
+Excess admissions return HTTP 429 with an error code and `Retry-After`.
+Duplicate delivery keys return their already-admitted run without spending a
+new-run slot. A full queue preserves every accepted run. Cron waits for capacity
+without advancing its firing instant or finite occurrence count; webhook
+senders must retry a rejected delivery. Minute limits bound rates, not a total
+monthly bill or protection against someone creating many accounts.
+
+Schedules require standard five-field cron; seconds and cron macros are
+rejected. Existing expressions outside that format are disabled by migration
+and remain inspectable. Replace the expression before enabling them again.
+
+The hosted service authenticates configuration and machine requests before
+checking account quotas. A signed webhook URL is a bearer capability for one
+trigger; provider signatures are checked when configured. Supabase functions
+and tables cannot be accessed directly by anonymous or signed-in client roles.
+Health checks and skill downloads intentionally remain public.
+
+The Fly configuration uses two `performance-1x` machines with 2 GiB each in
+San Jose. The database owns shared quotas; no machine-local counter can grant
+additional capacity.
+
+## Example
+
 ```ts
 const sdk = service.for(principal);
 const automation = await sdk.automations.create({
@@ -107,20 +153,23 @@ compatibility, the standalone entry point still accepts the prior paired
 `AMALGM_AUTOMATIONS_API_URL` and `AMALGM_AUTOMATIONS_AUTHORIZATION`
 environment variables.
 
-For public local MCP clients, Shell 0.1.176+ provides
-`amalgm automations mcp --user person@example.com`. It exposes the same six
-tools over stdio and discovers the current runtime connection per call.
-`amalgm status --all` lists local account registrations. No pasted token or
-private repository access is part of either flow; the standalone
-`amalgm-automations-mcp` entry point remains for custom authenticated hosts.
+CLI and skill are the first public launch surfaces. The local stdio MCP
+adapter and `amalgm status --all` account discovery are prepared for a later
+Shell release. Do not advertise an unreleased Shell version as available.
+The standalone `amalgm-automations-mcp` entry point remains for custom
+authenticated hosts.
 
 Install the complete portable skill with Node.js 22.20+:
 
 ```bash
-npx skills add https://automations.amalgm.ai --skill amalgm-automations
+npx skills add amalgm-inc/skills
 ```
 
-The host serves standard discovery at `/.well-known/agent-skills/index.json`
+The public [Amalgm collection](https://github.com/amalgm-inc/skills) distributes
+this repository's canonical skill, including its references and agent metadata.
+Users can refresh installed instructions with `npx skills update`.
+
+The host also serves standard discovery at `/.well-known/agent-skills/index.json`
 and a checksum-addressed archive built from `skills/amalgm-automations`.
 The archive includes its references and agent metadata and requires no login.
 
@@ -251,6 +300,8 @@ Run inserts and eligibility changes publish small owner/target wakeups from
 the database transaction. Fly re-reads the earliest retry/lease deadline only
 when a target connects, changes, or reaches that deadline. Losing the database
 subscription closes the machine streams so they reconnect and catch up.
+Progress updates, lease extensions, and completion do not publish another
+wakeup: an existing earlier timer re-reads the current ledger at its deadline.
 Cron scheduling remains hosted; no schedule timer runs on the user's machine.
 
 Rollout order: apply the product migrations, deploy the Fly host, publish the
@@ -270,6 +321,9 @@ npm pack --dry-run
 
 `test:supabase` requires an empty disposable Postgres database; its fixture
 records the Supabase Broadcast boundary inside the same transaction.
+It also examines concurrent shared quotas, all trigger admission paths,
+idempotent retries at capacity, queue preservation, and direct Supabase-role
+denial even when schema defaults initially grant those roles access.
 `test:notifications` requires Node.js 22+, Docker, and Supabase CLI 2.26.9
 (also pinned in CI). It starts and removes its own local Supabase project,
 using real database Broadcast and two HTTP hosts to verify delivery, idle
@@ -277,3 +331,37 @@ behavior, offline catch-up, retry deadlines, and abandoned claims.
 
 See [PURPOSE.md](./PURPOSE.md) and [AXIOMS.md](./AXIOMS.md) for the governing
 ownership and behavior laws.
+
+## Managed package delivery
+
+Managed npm delivery uses `.github/workflows/publish-package.yml` after the
+exact main/preview owner checks pass. The occurrence generates a unique
+prerelease version and records its source SHA; it reruns the owner suite, packs
+once, and installs that tarball on Linux, macOS and Windows before publication.
+The `candidate-main`/`candidate-preview` tags are release-assembly inputs and
+never select installed runtimes. `package.json` declares this owner's gates,
+CLI probes, peer-only exports and lifecycle permissions. The standalone runner
+under `scripts/release/` is intentionally copied across owners to preserve
+private repository access boundaries. The final publish step uses the `NPM_TOKEN`
+secret in the `npm-release` environment. Where npm trusted publishing is
+configured for this repository's `publish-package.yml` and that environment,
+the token can be omitted. Authentication does not replace native certification,
+exact source records or artifact integrity; private source repositories do not
+receive npm's public-source provenance.
+
+Hosted delivery is separately wired in `release-hosted.yml`: it builds the exact
+source image, tests both declared bindings without network access, deploys the
+same digest to the selected Fly app, then verifies machine identity and public
+readiness. `package.json` owns the host declaration. The Python effect runner is
+an intentional standalone copy from UI; no other private repository is required.
+Live provider and durable product-flow proof remain separate release obligations.
+
+Managed dependency reconciliation reads this owner’s declared manifests and
+updates exact same-branch registry candidates in one pending composition PR per
+branch. The repository token explicitly dispatches the owner checks. Every declared gate must
+pass for the exact merge tree; an atomic expected-base update prevents merging
+with untested concurrent source. Human additions or amendments are preserved.
+The half-hour CI reconciliation recovers missed dispatch hints. Assembly runs
+no dependency code or lifecycle hooks, and repeated owner checks do not publish
+another candidate for unchanged source. Repository policy must allow GitHub Actions to create pull requests; no
+cross-repository credential or paid auto-merge feature is required.

package/dist/host/limits.d.ts

@@ -0,0 +1,5 @@
+import type { SupabaseRpcClient } from '../src/supabase-store.js';
+/** The database owns the budget. This cache only repeats a known rejection. */
+export declare function createRequestLimits(client: SupabaseRpcClient): Readonly<{
+    check(userId: string, request: Request, door: "control" | "machine"): Promise<void>;
+}>;

package/dist/host/limits.js

@@ -0,0 +1,44 @@
+import { AutomationError } from '../src/errors.js';
+import { AutomationRateLimitError } from '../src/rate-limits.js';
+/** The database owns the budget. This cache only repeats a known rejection. */
+export function createRequestLimits(client) {
+    const deniedUntil = new Map();
+    return Object.freeze({
+        async check(userId, request, door) {
+            const bucket = requestBucket(request, door);
+            const key = JSON.stringify([userId, bucket]);
+            const until = deniedUntil.get(key) ?? 0;
+            let retryAfter = Math.ceil((until - Date.now()) / 1000);
+            if (retryAfter <= 0) {
+                deniedUntil.delete(key);
+                const { data, error } = await client.rpc('consume_amalgm_automation_budget', {
+                    p_user_id: userId, p_bucket: bucket,
+                });
+                if (error || typeof data !== 'number' || !Number.isInteger(data) || data < 0) {
+                    throw new AutomationError('unavailable', 'Request allowance could not be checked', 503);
+                }
+                retryAfter = data;
+                if (retryAfter > 0) {
+                    if (deniedUntil.size >= 10_000)
+                        deniedUntil.clear();
+                    deniedUntil.set(key, Date.now() + retryAfter * 1000);
+                }
+            }
+            if (retryAfter > 0) {
+                throw new AutomationRateLimitError('rate_limited', `Account ${bucket} allowance exhausted. Retry after ${retryAfter} seconds.`, retryAfter);
+            }
+        },
+    });
+}
+function requestBucket(request, door) {
+    const parts = new URL(request.url).pathname.split('/').filter(Boolean).map(decodeURIComponent);
+    if (door === 'machine') {
+        if (parts[3] === 'notifications' && request.method === 'GET')
+            return 'streams';
+        return request.method === 'PATCH' ? 'execution' : 'claims';
+    }
+    if (request.method === 'GET')
+        return 'reads';
+    return parts.length === 4 && parts[3] === 'runs' && request.method === 'POST'
+        ? 'ingress' : 'configuration';
+}

package/dist/host/main.js

@@ -15,6 +15,7 @@ import { createAutomationsHost } from './server.js';
 import { createMachineRunNotifications } from '../src/machine-notifications.js';
 import { subscribeToRunChanges } from './notifications.js';
 import { createPublicSkillApi } from './skill.js';
+import { createRequestLimits } from './limits.js';
 const config = automationsHostConfig();
 const supabase = createClient(config.supabaseUrl, config.supabaseServiceRoleKey, {
     auth: { persistSession: false, autoRefreshToken: false },
@@ -23,11 +24,16 @@ const authentication = createAutomationsAuthenticators({
     issuer: config.authorizationIssuer,
     supabase,
 });
+const limits = createRequestLimits(supabase);
 const webhooks = new WebhookEndpoints(config.webhookOrigin, config.webhookTokenKey);
 const delivery = new Automations(new SupabaseStore(supabase), (event, details) => log(event, details));
 const controlApi = createAutomationApi({
     service: new AutomationCrudService(new SupabaseAutomationCrudRepository(supabase), () => new Date(), webhooks),
-    authenticate: authentication.control,
+    authenticate: async (request) => {
+        const principal = await authentication.control(request);
+        await limits.check(principal.userId, request, 'control');
+        return principal;
+    },
 });
 const machineRepository = new SupabaseMachineRunRepository(supabase);
 const notifications = createMachineRunNotifications({
@@ -36,7 +42,11 @@ const notifications = createMachineRunNotifications({
 });
 const closeNotifications = subscribeToRunChanges(supabase, notifications);
 const machineApi = createMachineRunsApi({
-    authenticate: authentication.machine,
+    authenticate: async (request) => {
+        const principal = await authentication.machine(request);
+        await limits.check(principal.userId, request, 'machine');
+        return principal;
+    },
     runsFor: (principal) => createMachineRuns(machineRepository, principal),
     notifications,
 });

package/dist/skills/index.json

@@ -1 +1 @@
-{"$schema":"https://schemas.agentskills.io/discovery/0.2.0/schema.json","skills":[{"name":"amalgm-automations","description":"Set up, operate, and troubleshoot Amalgm Automations through MCP or the amalgm automations CLI. Use for installation, Google sign-in, scheduled or webhook workflows, Run Now, run history, and Automations support.","type":"archive","url":"./amalgm-automations.f64db3414c22f330c2c83a5d1dc76949d7a95f3c9ba06a94c5fbd9c4024d4acd.tgz","digest":"sha256:f64db3414c22f330c2c83a5d1dc76949d7a95f3c9ba06a94c5fbd9c4024d4acd"}]}
+{"$schema":"https://schemas.agentskills.io/discovery/0.2.0/schema.json","skills":[{"name":"amalgm-automations","description":"Set up and use Amalgm to schedule workflows, run native agents and scripts, receive webhooks, and inspect automation results through the amalgm CLI or an existing MCP connection.","type":"archive","url":"./amalgm-automations.a46100bf875bc64b8668dc705003d6e31bddd32cb61cda74852786370842c94e.tgz","digest":"sha256:a46100bf875bc64b8668dc705003d6e31bddd32cb61cda74852786370842c94e"}]}

package/dist/src/automations.js

@@ -1,4 +1,5 @@
 import { nextCronAt } from './schedule.js';
+import { AutomationRateLimitError } from './rate-limits.js';
 import { eventReferences, verifyEventSecret } from './webhook.js';
 const noop = () => { };
 export class EventRejectedError extends Error {
@@ -49,14 +50,26 @@ export class Automations {
         if (!Number.isInteger(maximumRuns) || maximumRuns < 1)
             throw new Error('maximumRuns must be a positive integer');
         const created = [];
+        const limitedAccounts = new Set();
         for (const trigger of await this.store.dueCronTriggers(now)) {
+            if (limitedAccounts.has(trigger.userId))
+                continue;
             let scheduledFor = trigger.nextRunAt;
             let remaining = trigger.remainingOccurrences;
             while (created.length < maximumRuns
                 && new Date(scheduledFor) <= now
                 && (remaining === undefined || remaining > 0)) {
                 const nextRunAt = nextCronAt(trigger.cron, trigger.timezone, scheduledFor);
-                const run = await this.store.enqueueCron({ ...trigger, nextRunAt: scheduledFor }, nextRunAt, now);
+                let run;
+                try {
+                    run = await this.store.enqueueCron({ ...trigger, nextRunAt: scheduledFor }, nextRunAt, now);
+                }
+                catch (error) {
+                    if (!(error instanceof AutomationRateLimitError))
+                        throw error;
+                    limitedAccounts.add(trigger.userId);
+                    break;
+                }
                 if (!run)
                     break;
                 created.push(run);

package/dist/src/events-http.js

@@ -1,5 +1,7 @@
 import { Automations, EventEndpointNotFoundError, EventRejectedError } from './automations.js';
 import { webhookDeliveryKey } from './webhook.js';
+import { AutomationError } from './errors.js';
+import { rateLimitHeaders } from './rate-limits.js';
 // Engine reference: amalgm-engine/runtime/scripts/amalgm-mcp/events/ingress.js.
 // The 2 MiB transport bound is preserved. Success means the matching run is
 // durable in Supabase, never that an envelope was written to a local inbox.
@@ -40,6 +42,9 @@ export function createAutomationEventsApi(config) {
             return json(202, { ok: true, accepted: true, ...receipt });
         }
         catch (error) {
+            if (error instanceof AutomationError && error.status) {
+                return json(error.status, { error: error.message, code: error.code }, rateLimitHeaders(error));
+            }
             if (error instanceof EventEndpointNotFoundError)
                 return json(404, { error: error.message });
             if (error instanceof EventRejectedError)
@@ -95,9 +100,9 @@ function parsePayload(body) {
 function positiveInteger(value, fallback) {
     return Number.isInteger(value) && value > 0 ? value : fallback;
 }
-function json(status, body) {
+function json(status, body, headers = {}) {
     return new Response(JSON.stringify(body), {
         status,
-        headers: { 'content-type': 'application/json' },
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store', ...headers },
     });
 }

package/dist/src/http.js

@@ -1,4 +1,5 @@
 import { AutomationError } from './errors.js';
+import { rateLimitHeaders } from './rate-limits.js';
 import { parseCreateAutomation, parseCreateScheduleTrigger, parseCreateWebhookTrigger, parseCreateWorkflow, parseListAutomations, parseListRuns, parseRunAutomationNow, parsePageQuery, parseUpdateAutomation, parseUpdateScheduleTrigger, parseUpdateWebhookTrigger, parseUpdateWorkflow, } from './schema.js';
 export function createAutomationApi(options) {
     return async (request) => {
@@ -101,7 +102,7 @@ export function createAutomationApi(options) {
         }
         catch (error) {
             if (error instanceof AutomationError)
-                return response(status(error), { error: error.message, code: error.code });
+                return response(status(error), { error: error.message, code: error.code }, rateLimitHeaders(error));
             const code = error && typeof error === 'object' && 'code' in error ? String(error.code) : '';
             if (code.startsWith('dpop_') || code.includes('access_token') || code.includes('authorization')) {
                 return response(401, { error: 'Authorization denied', code });
@@ -142,13 +143,15 @@ function booleanQuery(url, name) {
 function nullable(value) {
     return value === null ? response(404, { error: 'Not found', code: 'not_found' }) : response(200, value);
 }
-function response(status, body) {
+function response(status, body, headers = {}) {
     return new Response(JSON.stringify(body), {
         status,
-        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
+        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', ...headers },
     });
 }
 function status(error) {
+    if (error.status !== undefined)
+        return error.status;
     if (error.code === 'validation')
         return 400;
     if (error.code === 'forbidden')

package/dist/src/machine-http.js

@@ -1,4 +1,5 @@
 import { AutomationError, ValidationError } from './errors.js';
+import { rateLimitHeaders } from './rate-limits.js';
 export function createMachineRunsApi(options) {
     return async (request) => {
         try {
@@ -26,7 +27,7 @@ export function createMachineRunsApi(options) {
             if (error instanceof AutomationError)
                 return json(error.status ?? (error.code === 'validation' ? 400 : 403), {
                     error: error.message, code: error.code,
-                });
+                }, rateLimitHeaders(error));
             const code = error instanceof Error && 'code' in error ? String(error.code) : 'internal';
             return json(code.startsWith('dpop_') || code.includes('access') ? 401 : 500, {
                 error: code === 'internal' ? 'Automations service failed' : 'Authorization denied', code,
@@ -41,6 +42,6 @@ async function body(request) {
     }
     return value;
 }
-function json(status, value) {
-    return Response.json(value, { status, headers: { 'cache-control': 'no-store' } });
+function json(status, value, headers = {}) {
+    return Response.json(value, { status, headers: { 'cache-control': 'no-store', ...headers } });
 }

package/dist/src/rate-limits.d.ts

@@ -0,0 +1,11 @@
+import { AutomationError } from './errors.js';
+export declare class AutomationRateLimitError extends AutomationError {
+    readonly retryAfterSeconds: number;
+    constructor(code: string, message: string, retryAfterSeconds?: number);
+}
+/** Translate the admission authority's stable errors at every transport door. */
+export declare function admissionLimitError(error: {
+    code?: string;
+    message?: string;
+}): AutomationRateLimitError | null;
+export declare function rateLimitHeaders(error: unknown): Record<string, string>;

package/dist/src/rate-limits.js

@@ -0,0 +1,25 @@
+import { AutomationError } from './errors.js';
+export class AutomationRateLimitError extends AutomationError {
+    retryAfterSeconds;
+    constructor(code, message, retryAfterSeconds = 60) {
+        super(code, message, 429);
+        this.retryAfterSeconds = retryAfterSeconds;
+        this.name = 'AutomationRateLimitError';
+    }
+}
+/** Translate the admission authority's stable errors at every transport door. */
+export function admissionLimitError(error) {
+    if (error.code !== 'PT429')
+        return null;
+    if (error.message === 'queue_full') {
+        return new AutomationRateLimitError('queue_full', 'This account already has 100 unfinished runs. Complete existing work before admitting more.');
+    }
+    if (error.message === 'run_rate_limited') {
+        return new AutomationRateLimitError('run_rate_limited', 'This account can admit 10 new runs per minute. Retry after 60 seconds.');
+    }
+    return new AutomationRateLimitError('rate_limited', 'Request allowance exhausted. Retry after 60 seconds.');
+}
+export function rateLimitHeaders(error) {
+    return error instanceof AutomationRateLimitError
+        ? { 'retry-after': String(error.retryAfterSeconds) } : {};
+}

package/dist/src/schedule.js

@@ -1,5 +1,9 @@
 import { CronExpressionParser } from 'cron-parser';
+import { ValidationError } from './errors.js';
 export function nextCronAt(cron, timezone, after) {
+    if (cron.trim().split(/\s+/).length !== 5) {
+        throw new ValidationError('Schedules require five-field cron; the minimum interval is one minute');
+    }
     return CronExpressionParser.parse(cron, {
         currentDate: after,
         tz: timezone,

package/dist/src/schema.d.ts

@@ -128,14 +128,14 @@ export declare const createWebhookTriggerSchema: z.ZodObject<{
     enabled?: boolean | undefined;
     event?: string | undefined;
     secret?: string | undefined;
-    id?: string | undefined;
     source?: string | undefined;
+    id?: string | undefined;
 }, {
     enabled?: boolean | undefined;
     event?: string | undefined;
     secret?: string | undefined;
-    id?: string | undefined;
     source?: string | undefined;
+    id?: string | undefined;
 }>;
 export declare const updateWebhookTriggerSchema: z.ZodEffects<z.ZodObject<{
     source: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;

package/dist/src/supabase-crud/rpc.js

@@ -1,8 +1,12 @@
 import { ConflictError } from '../errors.js';
+import { admissionLimitError } from '../rate-limits.js';
 export async function call(client, functionName, arguments_) {
     const { data, error } = await client.rpc(functionName, arguments_);
     if (!error)
         return data;
+    const limitError = admissionLimitError(error);
+    if (limitError)
+        throw limitError;
     if (error.code === '23505' || /duplicate key|unique constraint/i.test(error.message || '')) {
         throw new ConflictError(resource(functionName));
     }

package/dist/src/supabase-store.d.ts

@@ -3,6 +3,7 @@ export interface SupabaseRpcClient {
     rpc(functionName: string, arguments_: Record<string, unknown>): PromiseLike<{
         data: unknown;
         error: {
+            code?: string;
             message?: string;
         } | null;
     }>;

package/dist/src/supabase-store.js

@@ -1,3 +1,4 @@
+import { admissionLimitError } from './rate-limits.js';
 function automationRun(row) {
     return {
         id: row.id,
@@ -81,7 +82,7 @@ export class SupabaseStore {
     async #call(functionName, arguments_) {
         const { data, error } = await this.client.rpc(functionName, arguments_);
         if (error)
-            throw new Error(error.message || `Supabase function ${functionName} failed`);
+            throw admissionLimitError(error) ?? new Error(error.message || `Supabase function ${functionName} failed`);
         return data;
     }
 }

package/dist/src/validation.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { CronExpressionParser } from 'cron-parser';
+import { validateCron } from './schedule.js';
 import { ValidationError } from './errors.js';
 export const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
 const MAX_PAGE_SIZE = 100;
@@ -32,9 +32,11 @@ export function schedule(cron, timezone) {
     requiredText(cron, 'Schedule cron');
     requiredText(timezone, 'Schedule timezone');
     try {
-        CronExpressionParser.parse(cron, { currentDate: new Date(0), tz: timezone });
+        validateCron(cron, timezone);
     }
-    catch {
+    catch (error) {
+        if (error instanceof ValidationError)
+            throw error;
         throw new ValidationError('Schedule cron or timezone is invalid');
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.4.2",
+  "version": "0.4.4-main.34176529830",
   "description": "Amalgm's automation SDK: durable trigger admission and target-machine execution.",
   "license": "UNLICENSED",
   "repository": {
@@ -53,13 +53,19 @@
     "verify": "npm run check && npm test && npm run build && tsx scripts/check-cli-artifact.ts",
     "release:check": "npm run verify && npm run test:supabase",
     "prepack": "npm run build",
-    "start": "node dist/host/main.js"
+    "start": "node dist/host/main.js",
+    "release:admit": "node scripts/release/package.mjs admit",
+    "release:prepare": "node scripts/release/package.mjs prepare",
+    "release:examine": "node scripts/release/package.mjs examine",
+    "release:publish": "node scripts/release/package.mjs publish",
+    "release:compose": "node scripts/release/compose.mjs",
+    "test:release": "node --test scripts/release/*.test.mjs"
   },
   "engines": {
     "node": ">=24"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.7",
+    "@amalgm/core": "0.4.8-main.34168902443",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@supabase/supabase-js": "2.57.4",
     "cron-parser": "^5.4.0",
@@ -72,5 +78,45 @@
     "pg": "^8.16.3",
     "tsx": "^4.23.1",
     "typescript": "5.9.3"
+  },
+  "amalgmRelease": {
+    "schema": 1,
+    "workflow": "verify.yml",
+    "jobs": [
+      "product",
+      "notifications"
+    ],
+    "verify": "verify",
+    "cli": [
+      "amalgm-automations"
+    ]
+  },
+  "allowScripts": {
+    "esbuild@0.28.1": true,
+    "fsevents@2.3.3": false
+  },
+  "amalgmHosts": {
+    "automations": {
+      "directory": ".",
+      "context": ".",
+      "dockerfile": "Dockerfile"
+    }
+  },
+  "amalgmComposition": {
+    "schema": 1,
+    "manifests": [
+      "package.json"
+    ],
+    "afterMergeWorkflows": [
+      "publish-package.yml",
+      "release-hosted.yml"
+    ]
+  },
+  "gitHead": "09ce702dd22145ddc2684e0dc1bfde1639d66e33",
+  "amalgmSource": {
+    "repository": "amalgm-inc/amalgm-automations",
+    "branch": "main",
+    "commit": "09ce702dd22145ddc2684e0dc1bfde1639d66e33",
+    "occurrence": "34176529830"
   }
 }

package/skills/amalgm-automations/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: amalgm-automations
-description: Set up, operate, and troubleshoot Amalgm Automations through MCP or the amalgm automations CLI. Use for installation, Google sign-in, scheduled or webhook workflows, Run Now, run history, and Automations support.
+description: Set up and use Amalgm to schedule workflows, run native agents and scripts, receive webhooks, and inspect automation results through the amalgm CLI or an existing MCP connection.
 ---
 
 # Amalgm Automations
@@ -10,14 +10,14 @@ workflow into one durable Amalgm automation and verify what actually ran.
 Automations owns configuration and permanent run history; the selected Amalgm
 machine executes the workflow.
 
-Amalgm Automations is free. Guide the person through Google sign-in and computer
+Amalgm Automations is free during launch. Guide the person through Google sign-in and computer
 approval when needed; do not introduce a payment step. A native agent or other
 external service still uses its own account and may have its own usage costs.
 
 ## Choose the available adapter
 
-Prefer the six `amalgm_automations_*` MCP tools when they are callable. In a
-native local agent without that MCP server, use the matching global CLI:
+Use the global `amalgm automations` CLI in a native local agent. If an existing
+MCP connection already exposes the six `amalgm_automations_*` tools, reuse it.
 
 ```text
 MCP                                 CLI
@@ -85,6 +85,13 @@ id, get and repair that draft with `update`; do not create a replacement.
 
 Use a finite `maxOccurrences` when the user's request is bounded. Do not turn
 "ten times" into an unbounded schedule plus a future cleanup promise.
+Use standard five-field cron; the finest interval is one minute. Seconds and
+cron macros are rejected. Account limits are 10 configuration API writes and
+10 new runs per minute, shared by every client and trigger, with at most 100
+unfinished runs. One complete create with a schedule and workflow uses four
+writes. On HTTP 429, wait for `Retry-After` (or 60 seconds if unavailable), then
+repair an identified draft or retry the same delivery key; never create a new
+definition or key to evade the limit. Accepted runs remain durable.
 
 Choose workflow lanes explicitly:
 

package/skills/amalgm-automations/references/setup-and-support.md

@@ -12,11 +12,12 @@ GitHub account or access to Amalgm's source repositories. With Node.js 22.20+
 (or Amalgm's supplied Node runtime), run:
 
 ```bash
-npx skills add https://automations.amalgm.ai --skill amalgm-automations
+npx skills add amalgm-inc/skills
 ```
 
-Choose the intended agent in the installer's prompt. Installing the skill
-supplies guidance; use the connection steps below to access Automations.
+Choose the intended agent in the installer's prompt. Use `npx skills update`
+to refresh installed instructions. Installing the skill supplies guidance;
+use the connection steps below to access Automations.
 
 ## Start with the connection you have
 
@@ -47,27 +48,9 @@ A successful Automations response is a JSON `result` envelope; an empty list
 is valid. The six Automations commands use that envelope. Shell's `status`
 returns a different JSON shape; `login` and `run` report progress as text.
 
-For a local stdio MCP client, configure this server using the actual selected
-account email (Shell 0.1.176 or newer):
-
-```json
-{
-  "mcpServers": {
-    "amalgm-automations": {
-      "command": "amalgm",
-      "args": ["automations", "mcp", "--user", "person@example.com"]
-    }
-  }
-}
-```
-
-This is the server entry for clients using `mcpServers` JSON; clients with a
-different configuration format use the same command and arguments. Use the
-exact installed launcher path if the client cannot find `amalgm` on PATH.
-Shell supplies the current local connection on every tool call, including
-after a runtime restart. Do not add credentials or environment variables.
-Listing tools works before login; calling them requires a running signed-in
-runtime. After configuring the client, verify its Automations `list` tool.
+CLI and skill are the first public launch surfaces; local stdio MCP setup is
+a follow-up. Use the CLI for new local setup. Reuse an already working MCP
+connection without configuring a second connection or copying credentials.
 
 ## Install only when needed
 
@@ -140,11 +123,11 @@ do not reopen approval until they choose to continue.
 
 ## Reuse or resume a registered computer
 
-Discover registered accounts with `amalgm status --all` (Shell 0.1.176+).
-It returns email and registration state only. A sole ready account is selected
-implicitly; multiple ready accounts require `--user`. Once the account email
-is known, inspect it explicitly. Replace the example email below with the
-user's actual selected account:
+Use the account email selected during setup. If it is unknown, ask the user
+which account they connected; do not read credential files to discover it.
+If the installed `amalgm --help` advertises `status --all`, that command can
+list public registration metadata. Multiple accounts require an explicit
+choice. Replace the example email below with the user's selected account:
 
 ```bash
 amalgm status --user person@example.com
@@ -186,7 +169,7 @@ reinstallation, or repeated writes.
 
 | Failure | What to do |
 | --- | --- |
-| `user_not_registered` or `user_selection_required` | Use `amalgm status --all` to discover local accounts, then select the intended email or complete login for it. |
+| `user_not_registered` or `user_selection_required` | Select the intended account email, inspect its status, and complete login if needed. Use `status --all` only when the installed CLI advertises it. |
 | `runtime_unavailable`, connection refused, or Shell says it is not running | Inspect the selected account's status and use the resume/setup decision above. A standalone adapter asking for environment credentials should be replaced by the global `amalgm automations` path. |
 | `runtime_unauthorized` | Retry the read once through the public Shell command, which obtains the current local connection. If it still fails, keep the error for support; never extract or replace tokens manually. |
 | `runtime_transport` or `runtime_protocol` | Check local readiness, connectivity, and the installed version. A timeout or service outage is not evidence that the user needs a new account. |

package/supabase/migrations/20260907000000_service_only_permissions.sql

@@ -0,0 +1,56 @@
+-- The hosted principal is the only authority allowed to choose a user_id.
+-- Supabase schema defaults grant anon/authenticated EXECUTE directly: removing
+-- PUBLIC alone does not remove those grants. Keep this list at the product
+-- boundary; never alter another product's functions or schema-wide defaults.
+DO $$
+DECLARE v_function regprocedure;
+BEGIN
+  FOR v_function IN
+    SELECT p.oid::regprocedure FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname = 'public' AND p.proname IN (
+      'amalgm_machine_wake_delay',
+      'amalgm_trigger_json',
+      'amalgm_workflow_is_executable',
+      'claim_amalgm_machine_runs',
+      'create_amalgm_automation',
+      'create_amalgm_schedule_trigger',
+      'create_amalgm_webhook_trigger',
+      'create_amalgm_workflow',
+      'delete_amalgm_automation',
+      'delete_amalgm_schedule_trigger',
+      'delete_amalgm_webhook_trigger',
+      'delete_amalgm_workflow',
+      'enqueue_amalgm_manual_run',
+      'enqueue_amalgm_run',
+      'get_amalgm_automation',
+      'get_amalgm_run',
+      'get_amalgm_schedule_trigger',
+      'get_amalgm_webhook_trigger',
+      'get_amalgm_workflow',
+      'list_amalgm_automations',
+      'list_amalgm_event_triggers',
+      'list_amalgm_pending_runs',
+      'list_amalgm_runs',
+      'list_amalgm_schedule_triggers',
+      'list_amalgm_triggers',
+      'list_amalgm_webhook_triggers',
+      'list_due_amalgm_crons',
+      'mark_amalgm_run_sent',
+      'notify_amalgm_machine_run',
+      'resolve_amalgm_webhook',
+      'update_amalgm_automation',
+      'update_amalgm_claimed_run',
+      'update_amalgm_run',
+      'update_amalgm_schedule_trigger',
+      'update_amalgm_webhook_trigger',
+      'update_amalgm_workflow'
+    )
+  LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC, anon, authenticated', v_function);
+  END LOOP;
+END;
+$$;
+REVOKE ALL ON public.amalgm_automations, public.amalgm_automation_triggers,
+  public.amalgm_automation_workflows, public.amalgm_automation_runs
+  FROM PUBLIC, anon, authenticated;

package/supabase/migrations/20260907010000_free_launch_limits.sql

@@ -0,0 +1,340 @@
+-- Free launch policy. All budgets use the database clock and one account key.
+CREATE TABLE public.amalgm_automation_rate_limits (
+  user_id uuid NOT NULL,
+  bucket text NOT NULL,
+  admitted_at timestamptz[] NOT NULL DEFAULT '{}',
+  PRIMARY KEY (user_id, bucket)
+);
+ALTER TABLE public.amalgm_automation_rate_limits ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON public.amalgm_automation_rate_limits FROM PUBLIC, anon, authenticated;
+
+-- Returns zero on admission, otherwise the number of seconds until capacity.
+-- A bounded sliding window avoids double bursts at wall-clock minute boundaries.
+CREATE FUNCTION public.consume_amalgm_automation_budget(p_user_id uuid, p_bucket text)
+RETURNS integer
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  v_limit integer;
+  v_now timestamptz;
+  v_times timestamptz[];
+BEGIN
+  v_limit := CASE p_bucket
+    WHEN 'configuration' THEN 10 WHEN 'runs' THEN 10
+    WHEN 'reads' THEN 120 WHEN 'ingress' THEN 120
+    WHEN 'claims' THEN 120 WHEN 'streams' THEN 20
+    WHEN 'execution' THEN 3000 ELSE NULL END;
+  IF p_user_id IS NULL OR v_limit IS NULL THEN
+    RAISE EXCEPTION 'Invalid Automations budget';
+  END IF;
+  INSERT INTO public.amalgm_automation_rate_limits (user_id, bucket)
+    VALUES (p_user_id, p_bucket) ON CONFLICT DO NOTHING;
+  SELECT admitted_at INTO v_times FROM public.amalgm_automation_rate_limits
+    WHERE user_id = p_user_id AND bucket = p_bucket FOR UPDATE;
+  v_now := clock_timestamp();
+  SELECT coalesce(array_agg(t ORDER BY t), '{}'::timestamptz[]) INTO v_times
+    FROM unnest(v_times) t WHERE t > v_now - interval '1 minute';
+  IF cardinality(v_times) >= v_limit THEN
+    RETURN greatest(1, ceil(extract(epoch FROM (v_times[1] + interval '1 minute' - v_now)))::integer);
+  END IF;
+  UPDATE public.amalgm_automation_rate_limits SET admitted_at = array_append(v_times, v_now)
+    WHERE user_id = p_user_id AND bucket = p_bucket;
+  RETURN 0;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.consume_amalgm_automation_budget(uuid, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.consume_amalgm_automation_budget(uuid, text) TO service_role;
+
+CREATE INDEX amalgm_automation_runs_unfinished_account
+  ON public.amalgm_automation_runs(user_id)
+  WHERE status IN ('pending', 'sent', 'running');
+
+-- Admission functions take this account lock before reading duplicate keys or
+-- trigger rows. The insert guard also covers future service-owned admissions.
+CREATE FUNCTION public.guard_amalgm_run_admission()
+RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended('amalgm-admission:' || NEW.user_id::text, 0));
+  IF (SELECT count(*) FROM public.amalgm_automation_runs
+      WHERE user_id = NEW.user_id AND status IN ('pending', 'sent', 'running')) >= 100 THEN
+    RAISE SQLSTATE 'PT429' USING MESSAGE = 'queue_full',
+      DETAIL = 'This account already has 100 unfinished runs. Complete existing work before admitting more.';
+  END IF;
+  IF public.consume_amalgm_automation_budget(NEW.user_id, 'runs') > 0 THEN
+    RAISE SQLSTATE 'PT429' USING MESSAGE = 'run_rate_limited',
+      DETAIL = 'This account can admit 10 new runs per minute. Retry after 60 seconds.';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.guard_amalgm_run_admission() FROM PUBLIC, anon, authenticated;
+CREATE TRIGGER amalgm_run_admission_guard
+BEFORE INSERT ON public.amalgm_automation_runs
+FOR EACH ROW EXECUTE FUNCTION public.guard_amalgm_run_admission();
+
+CREATE FUNCTION public.amalgm_cron_has_minute_granularity(p_cron text)
+RETURNS boolean LANGUAGE sql IMMUTABLE SET search_path = ''
+AS $$ SELECT p_cron IS NOT NULL AND cardinality(regexp_split_to_array(btrim(p_cron), '\s+')) = 5; $$;
+REVOKE ALL ON FUNCTION public.amalgm_cron_has_minute_granularity(text) FROM PUBLIC, anon, authenticated;
+
+-- Preserve the definition and run history; an old seconds expression cannot
+-- continue firing or be enabled again without changing its expression.
+UPDATE public.amalgm_automation_triggers SET enabled = false, updated_at = now()
+WHERE kind = 'schedule' AND NOT public.amalgm_cron_has_minute_granularity(cron);
+ALTER TABLE public.amalgm_automation_triggers ADD CONSTRAINT amalgm_schedule_minute_granularity
+  CHECK (kind <> 'schedule' OR NOT enabled OR public.amalgm_cron_has_minute_granularity(cron));
+
+CREATE OR REPLACE FUNCTION public.enqueue_amalgm_run(
+  p_kind text,
+  p_user_id uuid,
+  p_automation_id text,
+  p_trigger_id text,
+  p_target_id text,
+  p_endpoint_id text,
+  p_delivery_key text,
+  p_expected_next_run_at timestamptz,
+  p_next_run_at timestamptz,
+  p_input jsonb,
+  p_now timestamptz
+) RETURNS SETOF public.amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_inserted integer := 0;
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended('amalgm-admission:' || p_user_id::text, 0));
+  IF p_kind = 'cron' THEN
+    IF p_next_run_at IS NULL OR p_next_run_at < p_expected_next_run_at + interval '1 minute' THEN
+      RAISE EXCEPTION 'Schedule intervals must be at least one minute';
+    END IF;
+    IF p_endpoint_id IS NOT NULL OR p_delivery_key IS NOT NULL THEN
+      RAISE EXCEPTION 'Schedule admission cannot carry webhook identity';
+    END IF;
+    PERFORM 1
+    FROM public.amalgm_automation_triggers t
+    JOIN public.amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'schedule' AND public.amalgm_cron_has_minute_granularity(t.cron)
+      AND t.next_run_at = p_expected_next_run_at
+      AND (t.remaining_occurrences IS NULL OR t.remaining_occurrences > 0)
+      AND t.enabled AND a.enabled
+    FOR UPDATE OF t;
+  ELSIF p_kind = 'event' THEN
+    IF p_endpoint_id IS NULL THEN RAISE EXCEPTION 'Webhook endpoint is required'; END IF;
+    PERFORM 1
+    FROM public.amalgm_automation_triggers t
+    JOIN public.amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id
+      AND t.enabled AND a.enabled;
+  ELSE
+    RAISE EXCEPTION 'Invalid automation trigger kind';
+  END IF;
+  IF NOT FOUND THEN RETURN; END IF;
+  IF p_delivery_key IS NOT NULL THEN
+    RETURN QUERY SELECT r.* FROM public.amalgm_automation_runs r
+    WHERE r.user_id = p_user_id AND r.automation_id = p_automation_id
+      AND r.trigger_id = p_trigger_id AND r.delivery_key = p_delivery_key;
+    IF FOUND THEN RETURN; END IF;
+  END IF;
+
+  RETURN QUERY
+  INSERT INTO public.amalgm_automation_runs (
+    user_id, target_id, automation_id, trigger_id, workflow_id,
+    automation_payload, input, status, delivery_key, created_at
+  )
+  SELECT a.user_id, a.target_id, a.id, t.id, w.id,
+    jsonb_strip_nulls(jsonb_build_object(
+      'id', a.id, 'targetId', a.target_id, 'name', a.name,
+      'description', a.description, 'enabled', a.enabled,
+      'trigger', jsonb_strip_nulls(jsonb_build_object(
+        'id', t.id,
+        'kind', CASE WHEN t.kind = 'schedule' THEN 'cron' ELSE 'event' END,
+        'enabled', t.enabled, 'cron', t.cron, 'timezone', t.timezone,
+        'source', t.source, 'event', t.event
+      )),
+      'workflow', jsonb_strip_nulls(jsonb_build_object(
+        'id', w.id, 'name', w.name, 'script', w.script,
+        'compiled', w.compiled, 'allowlist', w.allowlist, 'limits', w.limits
+      ))
+    )),
+    p_input, 'pending', p_delivery_key, p_now
+  FROM public.amalgm_automations a
+  JOIN public.amalgm_automation_triggers t
+    ON t.user_id = a.user_id AND t.automation_id = a.id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE a.user_id = p_user_id AND a.id = p_automation_id AND t.id = p_trigger_id
+    AND a.target_id = p_target_id AND t.enabled AND a.enabled
+    AND (p_kind = 'cron' OR (t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id))
+    AND public.amalgm_workflow_is_executable(w.compiled)
+  ON CONFLICT (user_id, automation_id, trigger_id, delivery_key)
+    WHERE delivery_key IS NOT NULL
+  DO UPDATE SET delivery_key = EXCLUDED.delivery_key
+  RETURNING *;
+  GET DIAGNOSTICS v_inserted = ROW_COUNT;
+
+  IF p_kind = 'cron' AND v_inserted = 1 THEN
+    UPDATE public.amalgm_automation_triggers SET
+      next_run_at = p_next_run_at,
+      remaining_occurrences = CASE WHEN remaining_occurrences IS NULL
+        THEN NULL ELSE remaining_occurrences - 1 END,
+      enabled = CASE WHEN remaining_occurrences = 1 THEN false ELSE enabled END,
+      updated_at = p_now
+    WHERE user_id = p_user_id AND automation_id = p_automation_id
+      AND id = p_trigger_id AND kind = 'schedule'
+      AND next_run_at = p_expected_next_run_at;
+  END IF;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.enqueue_amalgm_manual_run(
+  p_user_id uuid,
+  p_automation_id text,
+  p_input jsonb,
+  p_idempotency_key text,
+  p_now timestamptz
+) RETURNS SETOF public.amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended('amalgm-admission:' || p_user_id::text, 0));
+  IF p_idempotency_key IS NOT NULL THEN
+    RETURN QUERY
+    SELECT r.*
+    FROM public.amalgm_automation_runs r
+    WHERE r.user_id = p_user_id
+      AND r.automation_id = p_automation_id
+      AND r.trigger_id = '@manual'
+      AND r.delivery_key = p_idempotency_key;
+    IF FOUND THEN RETURN; END IF;
+  END IF;
+
+  RETURN QUERY
+  INSERT INTO public.amalgm_automation_runs (
+    user_id, target_id, automation_id, trigger_id, workflow_id,
+    automation_payload, input, status, delivery_key, created_at
+  )
+  SELECT a.user_id, a.target_id, a.id, '@manual', w.id,
+    jsonb_strip_nulls(jsonb_build_object(
+      'id', a.id, 'targetId', a.target_id, 'name', a.name,
+      'description', a.description, 'enabled', a.enabled,
+      'trigger', jsonb_build_object(
+        'id', '@manual', 'kind', 'manual', 'enabled', true
+      ),
+      'workflow', jsonb_strip_nulls(jsonb_build_object(
+        'id', w.id, 'name', w.name, 'script', w.script,
+        'compiled', w.compiled, 'allowlist', w.allowlist, 'limits', w.limits
+      ))
+    )),
+    p_input, 'pending', p_idempotency_key, p_now
+  FROM public.amalgm_automations a
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE a.user_id = p_user_id AND a.id = p_automation_id AND a.enabled
+    AND public.amalgm_workflow_is_executable(w.compiled)
+  ON CONFLICT (user_id, automation_id, trigger_id, delivery_key)
+    WHERE delivery_key IS NOT NULL
+  DO UPDATE SET delivery_key = EXCLUDED.delivery_key
+  RETURNING *;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.list_due_amalgm_crons(p_now timestamptz)
+RETURNS TABLE (
+  user_id uuid,
+  automation_id text,
+  trigger_id text,
+  target_id text,
+  cron text,
+  timezone text,
+  next_run_at timestamptz,
+  remaining_occurrences integer
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT t.user_id, t.automation_id, t.id, a.target_id,
+    t.cron, t.timezone, t.next_run_at, t.remaining_occurrences
+  FROM public.amalgm_automation_triggers t
+  JOIN public.amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE t.kind = 'schedule' AND t.next_run_at <= p_now
+    AND (t.remaining_occurrences IS NULL OR t.remaining_occurrences > 0)
+    AND t.enabled AND a.enabled
+    AND public.amalgm_cron_has_minute_granularity(t.cron)
+    AND public.amalgm_workflow_is_executable(w.compiled)
+    AND NOT EXISTS (SELECT 1 FROM public.amalgm_automation_rate_limits q
+      WHERE q.user_id = t.user_id AND q.bucket = 'runs'
+        AND cardinality(q.admitted_at) >= 10
+        AND q.admitted_at[1] > clock_timestamp() - interval '1 minute')
+    AND (SELECT count(*) FROM public.amalgm_automation_runs r
+      WHERE r.user_id = t.user_id AND r.status IN ('pending', 'sent', 'running')) < 100
+  ORDER BY t.next_run_at, t.user_id, t.automation_id, t.id;
+$$;
+
+CREATE OR REPLACE FUNCTION public.resolve_amalgm_webhook(p_endpoint_id text)
+RETURNS TABLE (
+  user_id uuid, automation_id text, trigger_id text, target_id text,
+  endpoint_id text, source text, event text, secret text
+)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE v_owner uuid;
+BEGIN
+  SELECT t.user_id INTO v_owner FROM public.amalgm_automation_triggers t
+    WHERE t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id;
+  IF v_owner IS NULL THEN RETURN; END IF;
+  IF public.consume_amalgm_automation_budget(v_owner, 'ingress') > 0 THEN
+    RAISE SQLSTATE 'PT429' USING MESSAGE = 'rate_limited';
+  END IF;
+  RETURN QUERY
+  SELECT t.user_id, t.automation_id, t.id, a.target_id,
+    t.endpoint_id, t.source, t.event, t.secret
+  FROM public.amalgm_automation_triggers t
+  JOIN public.amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id
+    AND t.enabled AND a.enabled
+    AND public.amalgm_workflow_is_executable(w.compiled);
+END;
+$$;
+
+-- A later eligibility deadline cannot require an earlier wakeup. Existing
+-- timers re-read the ledger at their deadline; journal writes and heartbeat
+-- renewals need no Broadcast. Earlier eligibility still wakes every host.
+CREATE OR REPLACE FUNCTION public.notify_amalgm_machine_run()
+RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+BEGIN
+  IF TG_OP = 'UPDATE' THEN
+    IF (OLD.status, OLD.retry_at, OLD.lease_expires_at) IS NOT DISTINCT FROM
+       (NEW.status, NEW.retry_at, NEW.lease_expires_at) THEN RETURN NEW; END IF;
+    IF NEW.status IN ('completed', 'failed') THEN RETURN NEW; END IF;
+    IF OLD.status IN ('sent', 'running') AND NEW.status IN ('sent', 'running')
+      AND NEW.lease_expires_at >= OLD.lease_expires_at THEN RETURN NEW; END IF;
+  END IF;
+  PERFORM realtime.send(
+    jsonb_build_object('userId', NEW.user_id, 'targetId', NEW.target_id),
+    'changed', 'amalgm:automations:runs', true
+  );
+  RETURN NEW;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.notify_amalgm_machine_run() FROM PUBLIC, anon, authenticated;