@amalgm/automations 0.4.3 → 0.4.4-main.34257034777

package/AXIOMS.md

@@ -65,6 +65,9 @@
     aliases for one another.
 23. Automations is a standalone hosted service. Gateway owns none of its API,
     scheduling, claim, execution, or persistence path.
+    Its host validates Core's complete environment binding before opening its
+    database, issuer, public API or webhook authority; local has no managed
+    service fallback.
 24. The durable run ledger is the offline queue. The platform never keeps a
     second online-machine delivery buffer and never drops an unclaimed run.
 25. A run advances through its immutable plan in order. Every step transition

package/PURPOSE.md

@@ -2,6 +2,14 @@
 
 ## Purpose
 
+Consumer assembly derives exact same-branch dependency pins from the declared
+package manifests and registry candidate records. One pending composition per
+branch preserves human edits; complete consumer checks for the exact merge tree govern its
+merge, and publication never implies installed adoption.
+
+Managed releases bind to one exact published Core version and build from the
+locked dependency graph on the supported Node toolchain.
+
 Automations is the sole owner of Amalgm automation behavior and data. It lets an
 authenticated user create, inspect, change, delete, and manually run automation
 configuration — an automation belongs to one user and one target, may own any
@@ -10,6 +18,11 @@ have each trigger occurrence run on the selected existing Amalgm machine.
 Supabase holds everything except execution: the automation, its triggers, the
 complete workflow, and permanent run history.
 
+Each hosted environment reaches only its declared UI issuer, database and
+webhook authority. Main and preview initially share the database by owner
+direction; their public API and issuer identities remain distinct. Durable
+claims remain the single authority for work even when hosts share data.
+
 The initial launch is free, with no payment prerequisite or automatic paid
 cutover. Shared account limits protect the hosted service: ten configuration
 API writes and ten newly admitted runs per rolling minute, and at most one
@@ -149,3 +162,31 @@ authority. Shell calls the published machine-claim and execution contracts
 directly; the UI calls the hosted control plane through the published client.
 Any remaining Engine automation code is deprecated migration/parity evidence,
 not a cutover dependency or compatibility authority.
+
+## Managed package delivery
+
+Managed package delivery starts from a clean, exact main or preview source
+commit. The workflow occurrence supplies only its generated version and source
+record; tests run against those candidate inputs before packing. Every native
+gate and publication use that same tarball and integrity. A candidate tag makes
+bytes available to release assembly; it never promotes an installed runtime.
+Release tooling remains available inside each owner repository so a developer
+or CI job never needs access to another private product repository.
+Registry credentials are available only to the final protected publication job,
+after every native examination proves the exact candidate bytes.
+Native consumers install the archive as a dependency, so SDK development
+dependencies never become an end-user installation requirement.
+The repository token creates only its own dependency proposals and explicitly
+dispatches checks and delivery; every admitted gate proves the actual checkout,
+including the exact two-parent merge commit that becomes managed source.
+
+Hosted delivery examines the final immutable image under both declared managed
+bindings before deploying that exact digest to its source branch's Fly app.
+The host's own pipeline owns replacement, health and provider verification;
+no hosted process updates its package tree in place. A local image examination
+proves image behavior, while Fly networking and durable product journeys retain
+their separate provider proof.
+Every retained Fly member has the examined digest and binding, whether started
+or stopped. Every started member is healthy; the primary region has at least
+the declared minimum of healthy started members with automatic stopping disabled,
+and public readiness passes. Stopped capacity never counts toward that minimum.

package/README.md

@@ -331,3 +331,37 @@ behavior, offline catch-up, retry deadlines, and abandoned claims.
 
 See [PURPOSE.md](./PURPOSE.md) and [AXIOMS.md](./AXIOMS.md) for the governing
 ownership and behavior laws.
+
+## Managed package delivery
+
+Managed npm delivery uses `.github/workflows/publish-package.yml` after the
+exact main/preview owner checks pass. The occurrence generates a unique
+prerelease version and records its source SHA; it reruns the owner suite, packs
+once, and installs that tarball on Linux, macOS and Windows before publication.
+The `candidate-main`/`candidate-preview` tags are release-assembly inputs and
+never select installed runtimes. `package.json` declares this owner's gates,
+CLI probes, peer-only exports and lifecycle permissions. The standalone runner
+under `scripts/release/` is intentionally copied across owners to preserve
+private repository access boundaries. The final publish step uses the `NPM_TOKEN`
+secret in the `npm-release` environment. Where npm trusted publishing is
+configured for this repository's `publish-package.yml` and that environment,
+the token can be omitted. Authentication does not replace native certification,
+exact source records or artifact integrity; private source repositories do not
+receive npm's public-source provenance.
+
+Hosted delivery is separately wired in `release-hosted.yml`: it builds the exact
+source image, tests both declared bindings without network access, deploys the
+same digest to the selected Fly app, then verifies machine identity and public
+readiness. `package.json` owns the host declaration. The Python effect runner is
+an intentional standalone copy from UI; no other private repository is required.
+Live provider and durable product-flow proof remain separate release obligations.
+
+Managed dependency reconciliation reads this owner’s declared manifests and
+updates exact same-branch registry candidates in one pending composition PR per
+branch. The repository token explicitly dispatches the owner checks. Every declared gate must
+pass for the exact merge tree; an atomic expected-base update prevents merging
+with untested concurrent source. Human additions or amendments are preserved.
+The half-hour CI reconciliation recovers missed dispatch hints. Assembly runs
+no dependency code or lifecycle hooks, and repeated owner checks do not publish
+another candidate for unchanged source. Repository policy must allow GitHub Actions to create pull requests; no
+cross-repository credential or paid auto-merge feature is required.

package/dist/host/config.js

@@ -1,12 +1,16 @@
+import { isLoopbackEndpoint, resolveRuntimeEndpoint, validateRuntimeEndpointEnvironment } from '@amalgm/core/binding';
 export function automationsHostConfig(env = process.env) {
+    const publicOrigin = required(env.AMALGAM_PUBLIC_ORIGIN, 'AMALGAM_PUBLIC_ORIGIN');
+    const isolatedOrigin = isLoopbackEndpoint(publicOrigin) ? publicOrigin : undefined;
+    const binding = validateRuntimeEndpointEnvironment(env, isolatedOrigin);
     return Object.freeze({
         port: integer(env.PORT, 8080, 1, 65_535),
-        publicOrigin: url(env.AMALGAM_PUBLIC_ORIGIN, 'AMALGAM_PUBLIC_ORIGIN'),
-        webhookOrigin: url(env.AUTOMATIONS_WEBHOOK_ORIGIN, 'AUTOMATIONS_WEBHOOK_ORIGIN'),
+        publicOrigin: resolveRuntimeEndpoint(binding, 'automations', publicOrigin, isolatedOrigin),
+        webhookOrigin: resolveRuntimeEndpoint(binding, 'automations', required(env.AUTOMATIONS_WEBHOOK_ORIGIN, 'AUTOMATIONS_WEBHOOK_ORIGIN'), isolatedOrigin),
         webhookTokenKey: secret(env.AUTOMATIONS_WEBHOOK_TOKEN_KEY, 'AUTOMATIONS_WEBHOOK_TOKEN_KEY'),
-        supabaseUrl: url(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'),
+        supabaseUrl: resolveRuntimeEndpoint(binding, 'supabase', required(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'), isolatedOrigin),
         supabaseServiceRoleKey: required(env.SUPABASE_SERVICE_ROLE_KEY, 'SUPABASE_SERVICE_ROLE_KEY'),
-        authorizationIssuer: url(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'),
+        authorizationIssuer: resolveRuntimeEndpoint(binding, 'app', required(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'), isolatedOrigin),
         schedulerIntervalMs: integer(env.AUTOMATIONS_SCHEDULER_INTERVAL_MS, 1_000, 250, 60_000),
     });
 }
@@ -21,14 +25,6 @@ function secret(value, name) {
         throw new Error(`${name} must contain at least 32 bytes`);
     return result;
 }
-function url(value, name) {
-    const parsed = new URL(required(value, name));
-    const local = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
-    if (parsed.protocol !== 'https:' && !(local && parsed.protocol === 'http:')) {
-        throw new Error(`${name} must use HTTPS`);
-    }
-    return parsed.toString().replace(/\/$/, '');
-}
 function integer(value, fallback, minimum, maximum) {
     const parsed = value === undefined ? fallback : Number(value);
     if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {

package/dist/skills/index.json

@@ -1 +1 @@
-{"$schema":"https://schemas.agentskills.io/discovery/0.2.0/schema.json","skills":[{"name":"amalgm-automations","description":"Set up and use Amalgm to schedule workflows, run native agents and scripts, receive webhooks, and inspect automation results through the amalgm CLI or an existing MCP connection.","type":"archive","url":"./amalgm-automations.97a9eb82d8185b0730c018c7e82479f2597efd19e2a828cfb256d64ac27082af.tgz","digest":"sha256:97a9eb82d8185b0730c018c7e82479f2597efd19e2a828cfb256d64ac27082af"}]}
+{"$schema":"https://schemas.agentskills.io/discovery/0.2.0/schema.json","skills":[{"name":"amalgm-automations","description":"Set up and use Amalgm to schedule workflows, run native agents and scripts, receive webhooks, and inspect automation results through the amalgm CLI or an existing MCP connection.","type":"archive","url":"./amalgm-automations.0eb8fa39c0270d1604168a27f545d14b2bddc14f1cf015d40f504d59a4472115.tgz","digest":"sha256:0eb8fa39c0270d1604168a27f545d14b2bddc14f1cf015d40f504d59a4472115"}]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/automations",
-  "version": "0.4.3",
+  "version": "0.4.4-main.34257034777",
   "description": "Amalgm's automation SDK: durable trigger admission and target-machine execution.",
   "license": "UNLICENSED",
   "repository": {
@@ -45,7 +45,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json && tsx scripts/mark-executables.ts && tsx scripts/build-public-skill.ts",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && tsx scripts/mark-executables.ts && tsx scripts/build-public-skill.ts",
     "check": "tsx scripts/check-tree.ts && tsc -p tsconfig.json --noEmit",
     "test": "tsx --test test/*.test.ts",
     "test:supabase": "tsx --test test/integration/postgres.test.ts",
@@ -53,13 +53,19 @@
     "verify": "npm run check && npm test && npm run build && tsx scripts/check-cli-artifact.ts",
     "release:check": "npm run verify && npm run test:supabase",
     "prepack": "npm run build",
-    "start": "node dist/host/main.js"
+    "start": "node dist/host/main.js",
+    "release:admit": "node scripts/release/package.mjs admit",
+    "release:prepare": "node scripts/release/package.mjs prepare",
+    "release:examine": "node scripts/release/package.mjs examine",
+    "release:publish": "node scripts/release/package.mjs publish",
+    "release:compose": "node scripts/release/compose.mjs",
+    "test:release": "node --test scripts/release/*.test.mjs"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.4",
+    "@amalgm/core": "0.4.8-main.34168902443",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@supabase/supabase-js": "2.57.4",
     "cron-parser": "^5.4.0",
@@ -72,5 +78,45 @@
     "pg": "^8.16.3",
     "tsx": "^4.23.1",
     "typescript": "5.9.3"
+  },
+  "amalgmRelease": {
+    "schema": 1,
+    "workflow": "verify.yml",
+    "jobs": [
+      "product",
+      "notifications"
+    ],
+    "verify": "verify",
+    "cli": [
+      "amalgm-automations"
+    ]
+  },
+  "allowScripts": {
+    "esbuild@0.28.1": true,
+    "fsevents@2.3.3": false
+  },
+  "amalgmHosts": {
+    "automations": {
+      "directory": ".",
+      "context": ".",
+      "dockerfile": "Dockerfile"
+    }
+  },
+  "amalgmComposition": {
+    "schema": 1,
+    "manifests": [
+      "package.json"
+    ],
+    "afterMergeWorkflows": [
+      "publish-package.yml",
+      "release-hosted.yml"
+    ]
+  },
+  "gitHead": "cc53b8eb2358f0bb7613a348150a2e0b1c067129",
+  "amalgmSource": {
+    "repository": "amalgm-inc/amalgm-automations",
+    "branch": "main",
+    "commit": "cc53b8eb2358f0bb7613a348150a2e0b1c067129",
+    "occurrence": "34257034777"
   }
 }