@boardwalk-labs/engine 0.1.1 → 0.1.2

package/bin/boardwalk-server.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+
 // Thin launcher for `boardwalk-server` (SPEC §5). All real logic lives in compiled,
 // type-checked, tested TypeScript (src/server_main.ts) — this shim only exists so npm `bin`
 // and the Docker CMD share one entrypoint that resolves dist/ relative to the package.

package/dist/agent/conversation.js

@@ -1,4 +1,2 @@
-// The provider-neutral conversation model for the agent() loop. The leaf builds these;
-// each protocol adapter maps them to its wire format. Keeping the loop neutral is what lets
-// two adapters (Anthropic + OpenAI-compatible) cover every supported endpoint.
+// SPDX-License-Identifier: Apache-2.0
 export {};

package/dist/agent/leaf.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The agent() leaf: a real agentic loop (SDK SPEC §2.1.1) — streamed model turns with tool
 // use (program-defined ToolDefs + memory file tools + MCP server tools), skills loaded into
 // context, schema output, secret redaction, and usage reporting. Runs IN THE PROGRAM PROCESS

package/dist/agent/providers.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // Provider adapters for the agent() leaf — two wire protocols cover everything (SPEC §2.3):
 // Anthropic's Messages API (streamed) and OpenAI-style chat completions (the lingua franca of
 // OpenAI, Google's compat surface, vLLM, Ollama, Together, Fireworks, Groq…). Each adapter

package/dist/agent/rates.js

@@ -1,10 +1,4 @@
-// The approximate token-price table behind budget.max_usd (SPEC §2.2: "USD via a bundled
-// approximate rate table, documented as approximate").
-//
-// This is a GUARDRAIL, not a bill: the engine never charges anyone — it terminates a run that
-// crosses the author's declared ceiling. Prices drift; entries here are deliberately coarse
-// pattern matches with a conservative default, so an unknown model still consumes budget
-// rather than running unmetered.
+// SPDX-License-Identifier: Apache-2.0
 // Order matters: first match wins, most-specific first.
 const RULES = [
     { pattern: /claude-opus/i, rate: { inUsdPerMtok: 15, outUsdPerMtok: 75 } },

package/dist/agent/redact.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // Secret redaction for the agent() leaf.
 //
 // The invariant: secret VALUES live only in deterministic program code; everything bound for a

package/dist/agent/resolve.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // Model + provider resolution for the agent() leaf (SPEC §2.3 "model resolution").
 //
 // `provider` and `model` are ORTHOGONAL (decided 2026-06-12):

package/dist/agent/sse.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // Server-Sent Events parsing, shared by the provider adapters (streamed model turns) and the
 // MCP streamable-HTTP transport (a server may answer any POST with an SSE stream). One parser
 // so the two consumers can't drift on framing edge cases (CRLF, split chunks, [DONE]).

package/dist/agent/tools.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // Capability assembly for an agent() call (SDK SPEC §2.1.1). Capabilities are PER-AGENT
 // (decided 2026-06-11): each call brings its own tools/skills/memory — there is nothing to
 // check against the manifest, but everything the call names must RESOLVE (fail loudly —

package/dist/clock.js

@@ -1,6 +1,4 @@
-// Injectable time source. The scheduler and lifecycle take a Clock instead of calling
-// Date.now()/setTimeout directly so tests can drive time deterministically (scheduler clock
-// tests, DST cases, catch-up policy) without real waits.
+// SPDX-License-Identifier: Apache-2.0
 /** The real wall clock. */
 export const systemClock = {
     now: () => Date.now(),

package/dist/cron/cron.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // Cron parsing + next-fire computation for the scheduler (SPEC §2.1).
 //
 // One-validator philosophy: the SDK manifest schema only checks a cron trigger shallowly

package/dist/engine.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The engine facade — the one object both consumers construct (SPEC §1):
 //   - SERVER mode: `start()` boots the recovery sweep + the cron scheduler loop and the
 //     process stays up (the HTTP surface sits on top of this object).

package/dist/errors.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // Engine errors carry a stable machine-readable code (surfaced in run_status `failed` events
 // and API responses) plus an actionable message. Messages NEVER contain secret values.
 export const ENGINE_ERROR_CODES = [

package/dist/ids.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // ULIDs — the engine's primary-key format: time-sortable, URL-safe,
 // no auto-increment integers. Implemented in-house: 26 chars of Crockford base32 over
 // 48 bits of timestamp + 80 bits of crypto randomness. Zero dependencies on purpose —

package/dist/index.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // @boardwalk-labs/engine — the open-source single-node runtime.
 //
 // Two consumers, one implementation (SPEC §1): the CLI embeds it for `boardwalk dev`

package/dist/json_value.js

@@ -1,6 +1,4 @@
-// Runtime narrowing for JsonValue. Values arriving over the run process's JSON-serialized IPC
-// channel are JSON by construction, but "by construction" is exactly what trust boundaries
-// don't get to assume — so narrow structurally instead of casting.
+// SPDX-License-Identifier: Apache-2.0
 import { EngineError } from "./errors.js";
 /** True when `value` is a plain JSON tree (no functions, symbols, bigints, class instances). */
 export function isJsonValue(value) {

package/dist/mcp/client.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The MCP connection: the protocol conversation (initialize handshake, tools/list pagination,
 // tools/call) over any transport. Lives in the RUN PROCESS — tool execution must happen where
 // the program runs — while OAuth token state stays parent-side (the transport's hook brokers

package/dist/mcp/jsonrpc.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // JSON-RPC 2.0 request/notification correlation for the hand-rolled MCP client (the
 // @modelcontextprotocol/sdk dependency tree was rejected for the flagship — zero new deps).
 // The transport moves frames; this layer owns ids, correlation, timeouts, and the trust

package/dist/mcp/oauth.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // PARENT-side OAuth 2.1 for MCP servers (MCP authorization spec, 2025-06-18): discovery
 // (RFC 9728 protected-resource metadata → RFC 8414 AS metadata), RFC 7591 dynamic client
 // registration, the authorization-code + PKCE (S256) grant with a loopback redirect, RFC 8707

package/dist/mcp/token_store.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // PARENT-side MCP OAuth token persistence. Tokens live with the engine — never in the run
 // process beyond the single brokered value a request needs — in one JSON file under the data
 // dir, mode 0600 (they are credentials, treated like secrets: values

package/dist/mcp/transport_http.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // MCP streamable-HTTP transport (spec rev 2025-06-18 §Transports): every client message is a
 // POST to the server URL; the response is either a single JSON body or an SSE stream of
 // JSON-RPC messages (one shared parser with the provider adapters — src/agent/sse.ts). The

package/dist/mcp/transport_stdio.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // MCP stdio transport: spawn the server command and speak newline-delimited JSON over its
 // stdin/stdout (the MCP stdio framing). Runs in the RUN PROCESS — the program is the trusted
 // layer, so its inline `command`/`env` are honored as-is; the server's stderr is inherited so

package/dist/run/child.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The run-process entry point. Spawned by the supervisor with an IPC channel; never run
 // directly. Protocol: wait for `init`, install the SDK host + run inputs, then IMPORT the
 // program bundle — the module body is the program, so importing the file IS running it

package/dist/run/child_host.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The WorkflowHost installed in the run process.
 //
 // Split of responsibilities (SPEC §2.3): anything that only needs the local process happens

package/dist/run/idempotency.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // Default idempotency keys for workflows.call / workflows.run.
 //
 // Contract (SDK CallOptions): "a deterministic key over (parent_run_id, target, input)" — a

package/dist/run/ipc.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The supervisor ⇄ run-process IPC protocol.
 //
 // One run = one spawned Node process (SPEC §2.2). The child executes the user's program and

package/dist/run/run_dir.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // Per-run on-disk layout + the SDK-sharing symlink.
 //
 //   <dataDir>/runs/<runId>/

package/dist/run/supervisor.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The run supervisor — owns run-lifecycle state transitions and process supervision
 // (SPEC §2.2). Layering: knows nothing about HTTP or the CLI; persistence
 // goes through the Store; what workflows *do* lives in the child process.

package/dist/server/http.js

@@ -1,8 +1,4 @@
-// Shared HTTP plumbing for the engine server: the error type every route throws, JSON
-// request/response helpers, and query/body parsing. Bare node:http is deliberate (no
-// third-party HTTP framework anywhere in the Boardwalk stack) — these helpers are the entire
-// "framework", so every trust boundary (bodies, query params, headers) is narrowed with Zod
-// or a type predicate before any engine call sees the data.
+// SPDX-License-Identifier: Apache-2.0
 import { z } from "zod";
 import { CHANNELS, DEFAULT_CHANNELS } from "@boardwalk-labs/workflow";
 import { EngineError } from "../errors.js";

package/dist/server/routes/api.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The JSON API (SPEC §2.4): list workflows/runs, trigger a manual run, read a run + its
 // events, cancel. Handlers translate HTTP into engine/store calls and nothing else — all SQL
 // lives in the store, all run semantics in the engine.

package/dist/server/routes/hooks.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // POST /hooks/:workflow/:triggerIndex — the webhook trigger endpoint, and this engine's v0
 // answer to the open webhook-auth question (documented in SPEC §2.4):
 // per-workflow credentials live in *server* environment variables —

package/dist/server/routes/router.js

@@ -1,7 +1,4 @@
-// URL → handler resolution for the engine server. One flat match over decoded path segments —
-// the route table is small enough that a real trie/middleware stack would be pure ceremony.
-// Method mismatches on a known path get 405 + Allow (not 404), so clients can tell "wrong
-// verb" from "no such thing".
+// SPDX-License-Identifier: Apache-2.0
 import { HttpError } from "../http.js";
 import { handleCancelRun, handleGetRun, handleListEvents, handleListRuns, handleListWorkflows, handleStartRun, } from "./api.js";
 import { handleWebhook } from "./hooks.js";

package/dist/server/routes/stream.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // GET /api/runs/:id/stream — the SSE live tail (SPEC §2.4): replay
 // persisted events after the resume cursor, then follow live ones. Every frame carries
 // `id: <cursor>`, so a dropped client reconnects with Last-Event-ID and misses nothing —

package/dist/server/routes/ui.js

@@ -1,7 +1,4 @@
-// GET / — the local run-log page (SPEC §2.4): one self-contained HTML document, no build
-// step, no external assets. It is a log viewer, not a console: list workflows, list recent
-// runs, click a run to tail it over the SSE endpoint. All rendering uses textContent — no
-// markup is ever built from API data, so nothing a workflow prints can inject into the page.
+// SPDX-License-Identifier: Apache-2.0
 export function handleUiPage(ctx) {
     ctx.res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     ctx.res.end(RUN_LOG_PAGE);

package/dist/server/server.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The engine's HTTP surface (SPEC §2.4): JSON API + SSE live tail + webhook triggers + the
 // local run-log page, on bare node:http. This file owns the socket lifecycle only — routing
 // lives in routes/router.ts, and every handler goes through engine/store methods, never SQL.

package/dist/server_main.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The composition root for the `boardwalk-server` binary (SPEC §2.4 + §5): parse config,
 // construct the Engine, mount the HTTP surface, wire graceful shutdown. Everything here is
 // glue — run semantics live in the engine, routing in the server, so this file stays thin

package/dist/store/migrations.js

@@ -1,14 +1,4 @@
-// Versioned, forward-only schema migrations for the engine database.
-//
-// The schema version lives in SQLite's `PRAGMA user_version` (an integer in the database
-// header): reading it costs nothing, needs no bookkeeping table, and — crucially — setting it
-// participates in the same transaction as the migration's DDL. A crash mid-migration therefore
-// leaves the database exactly at the previous version with none of the new schema applied
-// (multi-row writes are transactional; a half-migrated database is a state
-// the engine could not recover from).
-//
-// Forward-only: an older engine refuses a newer database instead of guessing what future
-// columns mean. Downgrades are restore-from-backup, not code.
+// SPDX-License-Identifier: Apache-2.0
 import { EngineError } from "../errors.js";
 // v1 — the full SPEC §4 schema. STRICT tables so SQLite enforces the declared column types
 // (a TEXT primary key can never silently hold an integer; INTEGER columns reject REALs).

package/dist/store/store.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 // The engine's one persistence module — every SQL statement in the engine lives here
 // (storage access goes through one persistence module). The backend is
 // node:sqlite, synchronous on purpose: a single-node engine gains nothing from an async

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boardwalk-labs/engine",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "The Boardwalk single-node engine: cron scheduling, run lifecycle, SQLite state, and the local run log. Powers `boardwalk dev` and the self-hosted server.",
   "license": "Apache-2.0",
   "repository": {
@@ -40,7 +40,7 @@
     "coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@boardwalk-labs/workflow": "^0.1.0",
+    "@boardwalk-labs/workflow": "^0.1.2",
     "zod": "^4.0.0"
   },
   "devDependencies": {