@flowdular/sdk 0.1.0

package/modules/automations/translations/en.json

@@ -0,0 +1,126 @@
+{
+	"module.name": "Automations Core",
+	"nav.schedules.label": "Schedules",
+	"nav.schedules.description": "Run agents or workflows on fixed intervals",
+	"nav.triggers.label": "Webhook triggers",
+	"nav.triggers.description": "Run agents or workflows from signed external requests",
+	"common.agent": "Agent",
+	"common.actions": "Automation actions",
+	"common.cancel": "Cancel",
+	"common.close": "Close",
+	"common.disabled": "disabled",
+	"common.edit": "Edit",
+	"common.enabled": "enabled",
+	"common.enabledLabel": "Enabled",
+	"common.enabledOnly": "Enabled only",
+	"common.eyebrow": "Automation",
+	"common.filters": "Filters",
+	"common.label": "Label",
+	"common.notYet": "Not yet",
+	"common.paused": "Paused",
+	"common.refresh": "Refresh",
+	"common.refreshing": "Refreshing…",
+	"common.requestFailed": "The automations operation failed.",
+	"common.saving": "Saving…",
+	"common.state": "State",
+	"common.target": "Target",
+	"common.targetUnavailable": "Unavailable {kind}",
+	"common.view": "View",
+	"targetKind.agent": "Agent",
+	"targetKind.workflow": "Workflow",
+	"cadence.day": "Every day",
+	"cadence.days": "Every {count} days",
+	"cadence.hour": "Every hour",
+	"cadence.hours": "Every {count} hours",
+	"cadence.hoursMinutes": "Every {hours} h {minutes} min",
+	"cadence.minutes": "Every {count} min",
+	"schedules.column.cadence": "Cadence",
+	"schedules.column.lastRun": "Last run",
+	"schedules.column.nextRun": "Next run",
+	"schedules.column.schedule": "Schedule",
+	"schedules.description": "Run an agent or published workflow on a fixed interval, with one durable run per time slot.",
+	"schedules.drawer.subtitle": "Interval trigger",
+	"schedules.empty.filteredHint": "No schedule in this workspace matches the current filters.",
+	"schedules.empty.filteredTitle": "No matching schedules",
+	"schedules.empty.hint": "Create a schedule to run an available target at a fixed interval.",
+	"schedules.empty.title": "No schedules yet",
+	"schedules.error.delete": "Could not delete the schedule.",
+	"schedules.error.load": "Could not load schedules.",
+	"schedules.error.run": "Could not queue the run.",
+	"schedules.error.save": "Could not save the schedule.",
+	"schedules.form.delete": "Delete schedule",
+	"schedules.form.deleteHint": "The schedule stops firing. Runs it already queued are kept.",
+	"schedules.form.deleteTitle": "Delete schedule",
+	"schedules.form.input": "Input",
+	"schedules.form.inputHelp": "Resolved once and sent to the agent at every scheduled slot.",
+	"schedules.form.workflowInputHelp": "Resolved once and parsed as JSON before the published workflow is queued.",
+	"schedules.form.inputPlaceholder": "Summarize yesterday's open orders.",
+	"schedules.form.interval": "Every (minutes)",
+	"schedules.form.intervalHelp": "A fixed interval from 1 minute to 7 days. A missed slot is skipped, never replayed.",
+	"schedules.form.labelPlaceholder": "Nightly order summary",
+	"schedules.form.noAgents": "No agent is active in this workspace. Activate one before a schedule can queue its runs.",
+	"schedules.form.noTargets": "No agent or published workflow is available with your current permissions.",
+	"schedules.form.save": "Save schedule",
+	"schedules.loading": "Loading schedules…",
+	"schedules.new": "New schedule",
+	"schedules.note": "Automatic runs use the permissions saved when the target was configured. An unavailable target stops the schedule and records the reason.",
+	"schedules.notice.queued": "Queued run {id} for {label}.",
+	"schedules.runNow": "Run now",
+	"schedules.search.label": "Filter schedules",
+	"schedules.search.placeholder": "Filter by label or target",
+	"schedules.table.caption": "Automation schedules",
+	"schedules.table.count": "{enabled} enabled · {total} defined",
+	"schedules.table.title": "Workspace schedules",
+	"schedules.title": "Schedules",
+	"template.available": "Available variables",
+	"template.empty": "No matching variables.",
+	"template.insert": "Insert variable",
+	"template.sample.agent": "Operations assistant",
+	"template.sample.schedule": "Nightly order summary",
+	"variables.agent.name.label": "Agent name",
+	"variables.automation.schedule.id.label": "Schedule ID",
+	"variables.automation.schedule.label.label": "Schedule label",
+	"variables.context.now.label": "Run time (UTC)",
+	"variables.context.today.label": "Run date (UTC)",
+	"triggers.column.accepted": "Accepted",
+	"triggers.column.lastFired": "Last fired",
+	"triggers.column.rejected": "Rejected",
+	"triggers.column.trigger": "Trigger",
+	"triggers.description": "Invoke an agent or published workflow from a signed external request with replay protection.",
+	"triggers.drawer.subtitle": "Signed webhook",
+	"triggers.empty.filteredHint": "No trigger in this workspace matches the current filters.",
+	"triggers.empty.filteredTitle": "No matching triggers",
+	"triggers.empty.hint": "Create a signed endpoint that invokes an available automation target.",
+	"triggers.empty.title": "No triggers yet",
+	"triggers.error.delete": "Could not delete the trigger.",
+	"triggers.error.load": "Could not load triggers.",
+	"triggers.error.rotate": "Could not rotate the secret.",
+	"triggers.error.save": "Could not save the trigger.",
+	"triggers.form.agentFixed": "Fixed after creation.",
+	"triggers.form.create": "Create trigger",
+	"triggers.form.dangerHint": "Rotating invalidates the current secret immediately. Deleting closes the endpoint for good.",
+	"triggers.form.dangerTitle": "Secret and removal",
+	"triggers.form.delete": "Delete trigger",
+	"triggers.form.endpoint": "Endpoint",
+	"triggers.form.endpointHelp": "Unauthenticated. The signature and its timestamp are the only credentials it accepts, within a five minute window.",
+	"triggers.form.labelPlaceholder": "Order webhook",
+	"triggers.form.noAgents": "No agent is active in this workspace. Activate one before a webhook can queue its runs.",
+	"triggers.form.noTargets": "No agent or published workflow is available with your current permissions.",
+	"triggers.form.rotate": "Rotate secret",
+	"triggers.form.save": "Save trigger",
+	"triggers.form.secret": "Signing secret",
+	"triggers.form.secretHelp": "HMAC-SHA256 key. Sign v1.<timestamp>.<raw body> and send x-flowdular-signature: v1=<hex> with x-flowdular-timestamp in Unix milliseconds.",
+	"triggers.form.secretWarning": "Copy the signing secret now. It is stored encrypted and is never shown again.",
+	"triggers.loading": "Loading webhook triggers…",
+	"triggers.new": "New trigger",
+	"triggers.note": "Every rejected request returns the same response. Requests are limited per trigger and signatures older than five minutes are refused.",
+	"triggers.search.label": "Filter webhook triggers",
+	"triggers.search.placeholder": "Filter by label or target",
+	"triggers.secretRevision": "secret r{revision}",
+	"triggers.table.caption": "Webhook triggers",
+	"triggers.table.count": "{enabled} enabled · {total} defined",
+	"triggers.table.title": "Workspace triggers",
+	"triggers.title": "Webhook triggers",
+	"settings.schedulerPollMs.label": "Scheduler poll interval (ms)",
+	"settings.schedulerPollMs.description": "How often this process checks for due schedules. Applied when the automations runtime starts."
+}

package/modules/automations/translations/pl.json

@@ -0,0 +1,126 @@
+{
+	"module.name": "Automatyzacje",
+	"nav.schedules.label": "Harmonogramy",
+	"nav.schedules.description": "Uruchamiaj agentów lub workflow w stałych odstępach czasu",
+	"nav.triggers.label": "Wyzwalacze webhook",
+	"nav.triggers.description": "Uruchamiaj agentów lub workflow przez podpisane żądania zewnętrzne",
+	"common.agent": "Agent",
+	"common.actions": "Akcje automatyzacji",
+	"common.cancel": "Anuluj",
+	"common.close": "Zamknij",
+	"common.disabled": "wyłączony",
+	"common.edit": "Edytuj",
+	"common.enabled": "włączony",
+	"common.enabledLabel": "Włączony",
+	"common.enabledOnly": "Tylko włączone",
+	"common.eyebrow": "Automatyzacje",
+	"common.filters": "Filtry",
+	"common.label": "Nazwa",
+	"common.notYet": "Jeszcze nie uruchomiono",
+	"common.paused": "Wstrzymany",
+	"common.refresh": "Odśwież",
+	"common.refreshing": "Odświeżanie…",
+	"common.requestFailed": "Operacja automatyzacji nie powiodła się.",
+	"common.saving": "Zapisywanie…",
+	"common.state": "Stan",
+	"common.target": "Cel",
+	"common.targetUnavailable": "Niedostępny cel: {kind}",
+	"common.view": "Zobacz",
+	"targetKind.agent": "Agent",
+	"targetKind.workflow": "Workflow",
+	"cadence.day": "Codziennie",
+	"cadence.days": "Co {count} dni",
+	"cadence.hour": "Co godzinę",
+	"cadence.hours": "Co {count} godz.",
+	"cadence.hoursMinutes": "Co {hours} godz. {minutes} min",
+	"cadence.minutes": "Co {count} min",
+	"schedules.column.cadence": "Częstotliwość",
+	"schedules.column.lastRun": "Ostatnie uruchomienie",
+	"schedules.column.nextRun": "Następne uruchomienie",
+	"schedules.column.schedule": "Harmonogram",
+	"schedules.description": "Uruchamiaj agenta lub opublikowany workflow w stałych odstępach, z jednym trwałym przebiegiem na każdy przedział czasu.",
+	"schedules.drawer.subtitle": "Wyzwalacz czasowy",
+	"schedules.empty.filteredHint": "Żaden harmonogram w tym obszarze roboczym nie pasuje do wybranych filtrów.",
+	"schedules.empty.filteredTitle": "Brak pasujących harmonogramów",
+	"schedules.empty.hint": "Utwórz harmonogram, aby uruchamiać dostępny cel w stałych odstępach.",
+	"schedules.empty.title": "Brak harmonogramów",
+	"schedules.error.delete": "Nie udało się usunąć harmonogramu.",
+	"schedules.error.load": "Nie udało się wczytać harmonogramów.",
+	"schedules.error.run": "Nie udało się dodać przebiegu do kolejki.",
+	"schedules.error.save": "Nie udało się zapisać harmonogramu.",
+	"schedules.form.delete": "Usuń harmonogram",
+	"schedules.form.deleteHint": "Harmonogram przestanie się uruchamiać. Przebiegi już dodane do kolejki pozostaną.",
+	"schedules.form.deleteTitle": "Usuń harmonogram",
+	"schedules.form.input": "Dane wejściowe",
+	"schedules.form.inputHelp": "Treść jest rozwiązywana raz i przekazywana agentowi w każdym zaplanowanym terminie.",
+	"schedules.form.workflowInputHelp": "Treść jest rozwiązywana raz i parsowana jako JSON przed dodaniem opublikowanego workflow do kolejki.",
+	"schedules.form.inputPlaceholder": "Podsumuj otwarte zamówienia z wczoraj.",
+	"schedules.form.interval": "Co ile minut",
+	"schedules.form.intervalHelp": "Stały odstęp od 1 minuty do 7 dni. Pominięty termin nie jest uruchamiany ponownie.",
+	"schedules.form.labelPlaceholder": "Nocne podsumowanie zamówień",
+	"schedules.form.noAgents": "W tej przestrzeni nie ma aktywnego agenta. Aktywuj agenta, zanim harmonogram zacznie dodawać przebiegi do kolejki.",
+	"schedules.form.noTargets": "Przy obecnych uprawnieniach nie jest dostępny żaden agent ani opublikowany workflow.",
+	"schedules.form.save": "Zapisz harmonogram",
+	"schedules.loading": "Wczytywanie harmonogramów…",
+	"schedules.new": "Nowy harmonogram",
+	"schedules.note": "Automatyczne przebiegi używają uprawnień zapisanych podczas konfiguracji celu. Niedostępny cel zatrzymuje harmonogram i zapisuje przyczynę.",
+	"schedules.notice.queued": "Dodano przebieg {id} dla harmonogramu {label}.",
+	"schedules.runNow": "Uruchom teraz",
+	"schedules.search.label": "Filtruj harmonogramy",
+	"schedules.search.placeholder": "Szukaj po nazwie lub celu",
+	"schedules.table.caption": "Harmonogramy automatyzacji",
+	"schedules.table.count": "włączone: {enabled} · wszystkie: {total}",
+	"schedules.table.title": "Harmonogramy obszaru roboczego",
+	"schedules.title": "Harmonogramy",
+	"template.available": "Dostępne zmienne",
+	"template.empty": "Brak pasujących zmiennych.",
+	"template.insert": "Wstaw zmienną",
+	"template.sample.agent": "Asystent operacyjny",
+	"template.sample.schedule": "Nocne podsumowanie zamówień",
+	"variables.agent.name.label": "Nazwa agenta",
+	"variables.automation.schedule.id.label": "Identyfikator harmonogramu",
+	"variables.automation.schedule.label.label": "Nazwa harmonogramu",
+	"variables.context.now.label": "Czas uruchomienia (UTC)",
+	"variables.context.today.label": "Data uruchomienia (UTC)",
+	"triggers.column.accepted": "Przyjęte",
+	"triggers.column.lastFired": "Ostatnie wywołanie",
+	"triggers.column.rejected": "Odrzucone",
+	"triggers.column.trigger": "Wyzwalacz",
+	"triggers.description": "Uruchamiaj agenta lub opublikowany workflow przez podpisane żądania z ochroną przed ponownym użyciem.",
+	"triggers.drawer.subtitle": "Podpisany webhook",
+	"triggers.empty.filteredHint": "Żaden wyzwalacz w tym obszarze roboczym nie pasuje do wybranych filtrów.",
+	"triggers.empty.filteredTitle": "Brak pasujących wyzwalaczy",
+	"triggers.empty.hint": "Utwórz podpisany endpoint, który uruchamia dostępny cel automatyzacji.",
+	"triggers.empty.title": "Brak wyzwalaczy",
+	"triggers.error.delete": "Nie udało się usunąć wyzwalacza.",
+	"triggers.error.load": "Nie udało się wczytać wyzwalaczy.",
+	"triggers.error.rotate": "Nie udało się zmienić sekretu.",
+	"triggers.error.save": "Nie udało się zapisać wyzwalacza.",
+	"triggers.form.agentFixed": "Nie można zmienić po utworzeniu.",
+	"triggers.form.create": "Utwórz wyzwalacz",
+	"triggers.form.dangerHint": "Zmiana sekretu natychmiast unieważnia poprzedni. Usunięcie trwale zamyka endpoint.",
+	"triggers.form.dangerTitle": "Sekret i usunięcie",
+	"triggers.form.delete": "Usuń wyzwalacz",
+	"triggers.form.endpoint": "Endpoint",
+	"triggers.form.endpointHelp": "Endpoint nie wymaga sesji. Przyjmuje wyłącznie podpis i jego znacznik czasu z ostatnich pięciu minut.",
+	"triggers.form.labelPlaceholder": "Webhook zamówień",
+	"triggers.form.noAgents": "W tej przestrzeni nie ma aktywnego agenta. Aktywuj agenta, zanim webhook zacznie dodawać przebiegi do kolejki.",
+	"triggers.form.noTargets": "Przy obecnych uprawnieniach nie jest dostępny żaden agent ani opublikowany workflow.",
+	"triggers.form.rotate": "Zmień sekret",
+	"triggers.form.save": "Zapisz wyzwalacz",
+	"triggers.form.secret": "Sekret podpisu",
+	"triggers.form.secretHelp": "Klucz HMAC-SHA256. Podpisz v1.<timestamp>.<raw body> i wyślij x-flowdular-signature: v1=<hex> wraz z x-flowdular-timestamp w milisekundach czasu Unix.",
+	"triggers.form.secretWarning": "Skopiuj sekret podpisu teraz. Jest przechowywany w postaci zaszyfrowanej i nie będzie ponownie wyświetlony.",
+	"triggers.loading": "Wczytywanie wyzwalaczy webhook…",
+	"triggers.new": "Nowy wyzwalacz",
+	"triggers.note": "Każde odrzucone żądanie dostaje tę samą odpowiedź. Obowiązuje limit na wyzwalacz, a podpisy starsze niż pięć minut są odrzucane.",
+	"triggers.search.label": "Filtruj wyzwalacze webhook",
+	"triggers.search.placeholder": "Szukaj po nazwie lub celu",
+	"triggers.secretRevision": "sekret r{revision}",
+	"triggers.table.caption": "Wyzwalacze webhook",
+	"triggers.table.count": "włączone: {enabled} · wszystkie: {total}",
+	"triggers.table.title": "Wyzwalacze obszaru roboczego",
+	"triggers.title": "Wyzwalacze webhook",
+	"settings.schedulerPollMs.label": "Częstotliwość sprawdzania harmonogramów (ms)",
+	"settings.schedulerPollMs.description": "Określa, jak często proces sprawdza harmonogramy oczekujące na uruchomienie. Wartość jest stosowana podczas uruchamiania automatyzacji."
+}

package/modules/automations-workflows-integration/module.json

@@ -0,0 +1,27 @@
+{
+	"$schema": "../../packages/contracts/schemas/module.schema.json",
+	"schemaVersion": 1,
+	"id": "automations-workflows.integration",
+	"package": "@flowdular/module-automations-workflows-integration",
+	"version": "0.1.0",
+	"profile": "integration",
+	"capabilities": ["integration"],
+	"platform": {
+		"server": true,
+		"client": false
+	},
+	"dependencies": [
+		{
+			"id": "automations.core",
+			"range": "0.4.0"
+		},
+		{
+			"id": "workflows.core",
+			"range": "0.3.0"
+		}
+	],
+	"tenancy": "required",
+	"locales": ["en", "pl"],
+	"stability": "experimental",
+	"platformApi": "0.1.0"
+}

package/modules/automations-workflows-integration/package.json

@@ -0,0 +1,48 @@
+{
+	"name": "@flowdular/module-automations-workflows-integration",
+	"version": "0.1.0",
+	"type": "module",
+	"exports": {
+		".": "./src/index.ts",
+		"./server": "./src/server/index.ts",
+		"./platform": "./src/platform.ts",
+		"./module.json": "./module.json"
+	},
+	"scripts": {
+		"typecheck": "tsc --noEmit -p tsconfig.json",
+		"test": "vitest run"
+	},
+	"dependencies": {
+		"@flowdular/contracts": "workspace:*",
+		"@flowdular/harness": "workspace:*",
+		"@flowdular/kernel": "workspace:*",
+		"@flowdular/module-auth": "workspace:*",
+		"@flowdular/module-automations": "workspace:*",
+		"@flowdular/module-workflows": "workspace:*"
+	},
+	"devDependencies": {
+		"@types/node": "24.13.3",
+		"typescript": "5.9.3",
+		"vitest": "4.1.10"
+	},
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/Flowdular/flowdular.git",
+		"directory": "modules/automations-workflows-integration"
+	},
+	"files": [
+		"src",
+		"schemas",
+		"dist",
+		"bin",
+		"public",
+		"module.json",
+		"migrations",
+		"translations",
+		"spec",
+		"README.md",
+		"LICENSE"
+	],
+	"private": true
+}

package/modules/automations-workflows-integration/spec/module.yaml

@@ -0,0 +1,93 @@
+schemaVersion: 1
+id: automations-workflows.integration
+specVersion: 0.1.0
+status: approved
+name: Automations Workflow Integration
+description: Connects schedules and signed webhooks owned by automations.core to published workflows through the public workflows.execution.v1 capability.
+profile: integration
+capabilities:
+  - integration
+dependencies:
+  - id: automations.core
+    range: 0.4.0
+  - id: workflows.core
+    range: 0.3.0
+tenancy: required
+locales:
+  - en
+  - pl
+invariants:
+  - The integration registers one versioned workflow target adapter through the public automations target extension contract and invokes workflows only through workflows.execution.v1.
+  - The integration owns no scheduler, polling interval, webhook route, signature verification, secret, workflow worker, execution history, database, HTTP endpoint, client view, or permission.
+  - automations.core remains the sole owner of schedule and webhook firing, target configuration, encrypted trigger secrets, configuredBy provenance, permission snapshots, and ingress audit evidence.
+  - workflows.core remains the sole owner of workflow selection by published key, exact revision snapshotting, durable enqueue, execution, cancellation, payload evidence, cost, run history, and workflow audit evidence.
+  - A schedule or webhook can select a workflow only when the configuring user can read published workflows, execute workflow runs, and satisfy every permission required by the selected published workflow.
+  - Automatic schedule and webhook invocations use a service actor for automations.core whose configuredBy field is the real user actor captured when the target was last configured, while schedule or webhook identity remains a separate execution origin.
+  - A user selecting Run now on a workflow schedule remains the real workflow actor; automations.core records the schedule correlation and invokes the workflow with module origin automations.core and operation schedules.run-now instead of disguising the user as an automatic service invocation.
+  - The workflow permission snapshot is captured by automations.core from trusted authorization context when the target is created or updated and cannot be supplied or widened by a schedule template, webhook body, or integration adapter.
+  - A schedule invocation uses the stable tenant-scoped key automations-workflows:schedule:<schedule-id>:<slot>, where slot is the exact persisted due timestamp owned by automations.core.
+  - A webhook invocation uses the stable tenant-scoped key automations-workflows:webhook:<trigger-id>:<accepted-signature-digest>, where the digest comes from the already verified signed request and exposes neither the trigger secret nor the request body.
+  - Repeating the same schedule slot or accepted signed webhook request resolves to the original workflow run, and a key reused for different workflow input is refused as an idempotency conflict.
+  - Schedule input resolves once through automations.core variable rules and must parse as bounded JSON before enqueue; an accepted webhook body must parse as bounded JSON before it is passed unchanged as workflow input.
+  - The adapter never accepts tenant, actor, configuredBy, permission, origin, workflow revision, mode, or idempotency fields from user-controlled input.
+  - If either required capability is absent, the workflow target is unavailable without weakening agent automations; existing workflow target configuration is retained, automatic firing is skipped with safe audit evidence, and signed webhook callers receive the normal indistinguishable refusal.
+  - A missing, archived, unpublished, or newly unauthorized workflow never falls back to another workflow or agent and never substitutes a latest revision selected outside workflows.core.
+  - Uninstalling the integration leaves automations.core agent schedules and triggers, workflows.core definitions and runs, and both modules' owned data fully usable and unchanged.
+dataOwnership:
+  - automations-workflows.integration owns no persistent records.
+  - automations.core owns the target kind, published workflow key reference, schedule input template, webhook ingress, service configuredBy user snapshot, trusted permission snapshot, stable source slot or accepted signature digest, and automation audit correlation.
+  - workflows.core owns the workflow run identifier, selected published revision, execution payload, node and edge evidence, usage, cost, status, cancellation, history, and workflow audit correlation.
+  - The integration passes stable correlation identifiers between the two owners and never copies private workflow evidence, webhook secrets, credentials, unrestricted bodies, or another module's database records.
+acceptanceScenarios:
+  - id: AUTO-WORKFLOW-REGISTER
+    given: automations.core, workflows.core, and the integration are composed.
+    when: Platform composition completes before module start hooks run.
+    then: Exactly one workflow target adapter is available to automations.core, duplicate registration stops boot, and no second scheduler, webhook ingress, or workflow worker starts.
+  - id: AUTO-WORKFLOW-OPTIONAL
+    given: The integration is not installed or workflows.core is unavailable.
+    when: A user opens automations or an automatic trigger becomes due.
+    then: Agent targets continue to work, workflow targets are hidden or marked unavailable, existing workflow target configuration is retained, no workflow run is created, and automations records a safe unavailable outcome without reading workflow storage.
+  - id: AUTO-WORKFLOW-CONFIGURE
+    given: A user can manage the schedule or trigger, read workflow definitions, execute workflow runs, and holds every permission required by a published workflow.
+    when: The user selects that workflow as the automation target.
+    then: automations.core stores the workflow key, service configuredBy user, trusted permission snapshot, and target input configuration without copying a workflow revision, graph, secret, or execution record.
+  - id: AUTO-WORKFLOW-CONFIGURE-DENY
+    given: A user lacks automation management, workflow read, workflow execution, or one permission required by the selected workflow.
+    when: The user attempts to create or update a workflow schedule or trigger.
+    then: automations.core refuses before persisting the target or invoking the adapter, and the integration grants no permission of its own.
+  - id: AUTO-WORKFLOW-SCHEDULE
+    given: An enabled workflow schedule is due for a persisted slot and its once-resolved input template produces schema-valid bounded JSON.
+    when: The automations worker fires that slot more than once because of polling or recovery.
+    then: The adapter enqueues one workflow by published key with a schedule origin, automations.core service actor, configuring user, trusted permission snapshot, and the same slot-derived idempotency key, and automations stores the returned run correlation.
+  - id: AUTO-WORKFLOW-RUN-NOW
+    given: An authorized user selects Run now on a workflow schedule and still holds every permission required by its published workflow.
+    when: automations.core asks the adapter to invoke the target with a bounded request identifier.
+    then: The adapter uses the real requesting user actor, module origin automations.core with operation schedules.run-now, the caller's current trusted permission snapshot, and a request-derived idempotency key while automations stores the schedule and run correlation.
+  - id: AUTO-WORKFLOW-WEBHOOK
+    given: An enabled workflow trigger receives a fresh valid signature and a bounded JSON body.
+    when: The same signed request is delivered more than once.
+    then: automations.core verifies ingress once per delivery, the adapter passes the parsed JSON unchanged with a webhook origin and stable signature-digest key, workflows.core returns the same run, and neither module exposes the secret or raw signature.
+  - id: AUTO-WORKFLOW-WEBHOOK-REFUSE
+    given: A workflow webhook has an invalid signature, stale timestamp, unknown identifier, disabled target, invalid JSON body, unavailable workflow capability, or workflow refusal.
+    when: The public fire route handles the request.
+    then: Every case returns the same external refusal, no alternate target runs, and the real bounded reason is stored only in tenant-scoped automation audit evidence.
+  - id: AUTO-WORKFLOW-ACTOR
+    given: A schedule or signed webhook was configured by a real user and later fires automatically.
+    when: Automation audit and workflow run history are inspected.
+    then: The automation event and workflow run share stable correlation identifiers, the workflow actor is the automations.core service with that user in configuredBy, and the schedule or trigger identifier appears only in the separate origin.
+  - id: AUTO-WORKFLOW-TENANT
+    given: Two tenants use the same workflow key and equivalent schedule or trigger identifiers and payloads.
+    when: Their automations fire.
+    then: Each adapter call uses only its trusted tenant context, idempotency is isolated per tenant, each run resolves that tenant's published workflow, and neither tenant can observe or affect the other's target or run.
+  - id: AUTO-WORKFLOW-UNAVAILABLE-TARGET
+    given: A configured workflow is archived, unpublished, missing, or no longer authorized by the stored permission snapshot.
+    when: Its schedule or webhook attempts to fire.
+    then: workflows.core refuses with its stable code, no fallback target or revision is selected, automations records a safe correlated failure, and the schedule or trigger is made visibly unavailable until an authorized user updates it.
+  - id: AUTO-WORKFLOW-IDEMPOTENCY-CONFLICT
+    given: An automation source reuses a persisted slot or accepted signature digest with a different workflow key or parsed input hash.
+    when: The adapter calls workflows.execution.v1 with the existing idempotency key.
+    then: workflows.core returns WORKFLOW_IDEMPOTENCY_CONFLICT, no second run is created, and automations records the refusal without retrying under a new key.
+  - id: AUTO-WORKFLOW-BOUNDARY
+    given: A workflow automation succeeds, fails, is refused, or is cancelled after durable enqueue.
+    when: The automation source reads its last outcome.
+    then: automations stores only target and run correlation plus a safe status summary, workflows retains the complete execution history, and the integration writes no duplicate run, audit, payload, usage, cost, or secret record.

package/modules/automations-workflows-integration/src/index.ts

@@ -0,0 +1,14 @@
+import type { ModuleManifest, RegisteredModule } from '@flowdular/sdk/contracts';
+import manifest from '../module.json' with { type: 'json' };
+
+export const moduleDefinition = {
+	manifest: manifest as ModuleManifest,
+	navigation: [],
+	permissions: [],
+} satisfies RegisteredModule;
+
+export {
+	createWorkflowAutomationTargetAdapter,
+	registerAutomationsWorkflowsIntegration,
+	WorkflowAutomationTargetError,
+} from './server/adapter.ts';

package/modules/automations-workflows-integration/src/platform.ts

@@ -0,0 +1,24 @@
+import type {
+	PlatformServerComposition,
+	PlatformServerContext,
+} from '@flowdular/sdk/modules/auth/server';
+import {
+	AUTOMATION_EXECUTION_CAPABILITY,
+	type AutomationExecutionCapability,
+} from '@flowdular/sdk/modules/automations/server';
+import { registerAutomationsWorkflowsIntegration } from './server/adapter.ts';
+import { createAutomationWorkflowActionTools } from './server/tools.ts';
+
+export function createServerComposition(
+	context: PlatformServerContext,
+): PlatformServerComposition {
+	registerAutomationsWorkflowsIntegration(context.capabilities);
+	context.agentTools.register(
+		createAutomationWorkflowActionTools(() =>
+			context.capabilities.get<AutomationExecutionCapability>(
+				AUTOMATION_EXECUTION_CAPABILITY,
+			),
+		),
+	);
+	return { routes: [] };
+}