@constructive-io/graphql-server 4.31.5 → 4.32.0

package/esm/middleware/graphile.js

@@ -245,14 +245,21 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
                         if (req.token.access_level === 'read_only') {
                             pgSettings['default_transaction_read_only'] = 'on';
                         }
+                        if (req.requestId) {
+                            pgSettings['request.id'] = req.requestId;
+                        }
                         return { pgSettings };
                     }
                 }
+                const anonSettings = {
+                    role: anonRole,
+                    ...context,
+                };
+                if (req?.requestId) {
+                    anonSettings['request.id'] = req.requestId;
+                }
                 return {
-                    pgSettings: {
-                        role: anonRole,
-                        ...context,
-                    },
+                    pgSettings: anonSettings,
                 };
             },
         },

package/esm/middleware/llm-api.js

@@ -0,0 +1,562 @@
+/**
+ * LLM API Router
+ *
+ * Express router providing REST streaming endpoints for AI agent conversations.
+ * Uses the agent tables (agent_thread, agent_message) discovered from the
+ * agent_chat_module config table at runtime.
+ *
+ * Hybrid architecture:
+ *   - GraphQL handles CRUD (threads, messages, tasks) via PostGraphile
+ *   - REST handles SSE streaming for chat completions (what GraphQL can't do)
+ *
+ * Routes (entity-scoped):
+ *   POST /v1/orgs/:entity_id/threads                    → create thread
+ *   POST /v1/orgs/:entity_id/threads/:thread_id/messages → send message + stream response
+ *
+ * Routes (global — bills to actor_id from JWT):
+ *   POST /v1/threads                    → create thread (entity_id = user_id)
+ *   POST /v1/threads/:thread_id/messages → send message + stream response
+ *
+ * Auth: JWT from the auth middleware (req.token) → pg SET LOCAL context for RLS
+ * Metering: check_billing_quota → LLM call → record_usage with real token counts
+ */
+import express, { Router } from 'express';
+import { Logger } from '@pgpmjs/logger';
+import { getPgPool } from 'pg-cache';
+import OllamaClient from '@agentic-kit/ollama';
+import { ModuleConfigCache } from 'graphile-cache';
+import { getLlmEnvOptions, getAgentDiscovery, getLlmBillingConfig, } from 'graphile-llm';
+const log = new Logger('llm-api');
+/**
+ * Placeholder: replace with actual provider token counts once generateWithUsage() is approved.
+ * Estimates ~4 chars per token for English text.
+ */
+function placeholderAmountTokens(text) {
+    return Math.ceil(text.length / 4);
+}
+/**
+ * Call generate() and estimate token counts from text length.
+ * When a provider-native token counting API is approved, swap the
+ * estimation logic here without changing call sites.
+ */
+async function callWithUsage(client, input, onChunk) {
+    const promptText = input.messages.map((m) => m.content).join(' ');
+    let content;
+    if (onChunk || input.stream) {
+        await client.generate(input, onChunk);
+        content = '';
+    }
+    else {
+        content = await client.generate(input);
+    }
+    const inputTokens = placeholderAmountTokens(promptText);
+    const outputTokens = placeholderAmountTokens(content);
+    return {
+        content,
+        usage: { input: inputTokens, output: outputTokens, totalTokens: inputTokens + outputTokens },
+    };
+}
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function getPgSettings(req) {
+    const settings = {};
+    if (req.token?.user_id) {
+        settings['jwt.claims.user_id'] = req.token.user_id;
+        settings['role'] = 'authenticated';
+    }
+    if (req.databaseId) {
+        settings['jwt.claims.database_id'] = req.databaseId;
+    }
+    if (req.requestId) {
+        settings['request.id'] = req.requestId;
+    }
+    return settings;
+}
+async function withRlsClient(pool, pgSettings, fn) {
+    const client = await pool.connect();
+    try {
+        await client.query('BEGIN');
+        for (const [key, value] of Object.entries(pgSettings)) {
+            await client.query('SELECT set_config($1, $2, true)', [key, value]);
+        }
+        const result = await fn(client);
+        await client.query('COMMIT');
+        return result;
+    }
+    catch (err) {
+        await client.query('ROLLBACK').catch(() => { });
+        throw err;
+    }
+    finally {
+        client.release();
+    }
+}
+function resolveOllamaClient() {
+    const { chat } = getLlmEnvOptions();
+    if (chat.provider === 'ollama') {
+        return {
+            client: new OllamaClient(chat.baseUrl),
+            model: chat.model,
+        };
+    }
+    return null;
+}
+// ─── Billing Helpers ────────────────────────────────────────────────────────
+async function checkQuota(pool, pgSettings, billing, entityId, meterSlug) {
+    try {
+        return await withRlsClient(pool, pgSettings, async (client) => {
+            const sql = `SELECT "${billing.privateSchema}"."${billing.checkBillingQuotaFunction}"($1, $2::uuid, $3) AS allowed`;
+            const result = await client.query(sql, [meterSlug, entityId, 1]);
+            return result.rows[0]?.allowed !== false;
+        });
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        log.warn(`[llm-api] check_billing_quota failed (allowing): ${message}`);
+        return true;
+    }
+}
+async function recordUsage(pool, pgSettings, billing, entityId, meterSlug, amount, metadata) {
+    try {
+        await withRlsClient(pool, pgSettings, async (client) => {
+            const sql = `SELECT "${billing.privateSchema}"."${billing.recordUsageFunction}"($1, $2::uuid, $3, $4::jsonb)`;
+            await client.query(sql, [meterSlug, entityId, amount, JSON.stringify(metadata)]);
+        });
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        log.warn(`[llm-api] record_usage failed (non-fatal): ${message}`);
+    }
+}
+async function resolveBilling(pool, pgSettings, databaseId) {
+    try {
+        let billing = null;
+        await withRlsClient(pool, pgSettings, async (client) => {
+            const entry = await getLlmBillingConfig(client, databaseId);
+            billing = entry.billing;
+        });
+        return billing;
+    }
+    catch {
+        return null;
+    }
+}
+const INFERENCE_LOG_DISCOVERY_SQL = `
+  SELECT s.schema_name, ilm.inference_log_table_name
+  FROM metaschema_modules_public.inference_log_module ilm
+  JOIN metaschema_public.schema s ON s.id = ilm.schema_id
+  LIMIT 1
+`;
+const inferenceLogCache = new ModuleConfigCache({
+    name: 'inference-log',
+    ttlMs: 60_000,
+});
+async function getInferenceLogInfo(pool, dbname) {
+    const cached = inferenceLogCache.get(dbname);
+    if (cached !== undefined)
+        return cached;
+    let info = null;
+    try {
+        const { rows } = await pool.query(INFERENCE_LOG_DISCOVERY_SQL);
+        if (rows.length > 0) {
+            info = {
+                schemaName: rows[0].schema_name,
+                tableName: rows[0].inference_log_table_name,
+            };
+        }
+    }
+    catch {
+        // Module not provisioned
+    }
+    inferenceLogCache.set(dbname, info);
+    return info;
+}
+async function logInference(pool, pgSettings, logInfo, data) {
+    try {
+        await withRlsClient(pool, pgSettings, async (client) => {
+            await client.query(`INSERT INTO "${logInfo.schemaName}"."${logInfo.tableName}"
+         (entity_id, actor_id, model, provider, service, operation, input_tokens, output_tokens, total_tokens, latency_ms, status)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`, [
+                data.entityId,
+                data.actorId,
+                data.model,
+                data.provider,
+                data.service,
+                data.operation,
+                data.inputTokens,
+                data.outputTokens,
+                data.totalTokens,
+                data.latencyMs,
+                data.status,
+            ]);
+        });
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        log.warn(`[llm-api] inference log INSERT failed (non-fatal): ${message}`);
+    }
+}
+// ─── Route Handlers ─────────────────────────────────────────────────────────
+async function handleCreateThread(req, res, entityId) {
+    if (!req.token?.user_id) {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+    }
+    const dbname = req.api?.dbname;
+    if (!dbname) {
+        res.status(400).json({ error: 'Database not resolved' });
+        return;
+    }
+    const pool = getPgPool({ database: dbname });
+    const discovery = await getAgentDiscovery(pool, dbname);
+    if (!discovery?.thread) {
+        res.status(404).json({ error: 'Agent module not provisioned for this database' });
+        return;
+    }
+    const body = req.body || {};
+    const { thread } = discovery;
+    const pgSettings = getPgSettings(req);
+    const result = await withRlsClient(pool, pgSettings, async (client) => {
+        const { rows } = await client.query(`INSERT INTO "${thread.schemaName}"."${thread.tableName}"
+       (entity_id, owner_id, mode, model, system_prompt, title)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       RETURNING id, mode, model, system_prompt, status, created_at`, [
+            entityId,
+            req.token.user_id,
+            body.mode ?? 'ask',
+            body.model ?? null,
+            body.system_prompt ?? null,
+            body.title ?? null,
+        ]);
+        return rows[0];
+    });
+    res.status(201).json({
+        id: result.id,
+        mode: result.mode,
+        model: result.model,
+        system_prompt: result.system_prompt,
+        status: result.status,
+        created_at: result.created_at,
+    });
+}
+async function handleSendMessage(req, res, entityId) {
+    if (!req.token?.user_id) {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+    }
+    const dbname = req.api?.dbname;
+    if (!dbname) {
+        res.status(400).json({ error: 'Database not resolved' });
+        return;
+    }
+    const pool = getPgPool({ database: dbname });
+    const discovery = await getAgentDiscovery(pool, dbname);
+    if (!discovery?.thread || !discovery?.message) {
+        res.status(404).json({ error: 'Agent module not provisioned for this database' });
+        return;
+    }
+    const body = req.body || {};
+    if (!body.messages?.length) {
+        res.status(400).json({ error: 'messages[] is required and must not be empty' });
+        return;
+    }
+    const { thread, message: msgTable } = discovery;
+    const pgSettings = getPgSettings(req);
+    const threadId = req.params.thread_id;
+    const userId = req.token.user_id;
+    const databaseId = req.databaseId;
+    // 1. Verify thread exists and user owns it (RLS enforced)
+    const threadRow = await withRlsClient(pool, pgSettings, async (client) => {
+        const { rows } = await client.query(`SELECT id, mode, model, system_prompt, status
+       FROM "${thread.schemaName}"."${thread.tableName}"
+       WHERE id = $1`, [threadId]);
+        return rows[0];
+    });
+    if (!threadRow) {
+        res.status(404).json({ error: 'Thread not found' });
+        return;
+    }
+    // 2. Resolve billing config + inference log discovery
+    const billing = databaseId
+        ? await resolveBilling(pool, pgSettings, databaseId)
+        : null;
+    const inferenceLog = await getInferenceLogInfo(pool, dbname);
+    const ollama = resolveOllamaClient();
+    if (!ollama) {
+        res.status(503).json({ error: 'No LLM provider configured' });
+        return;
+    }
+    const model = body.model ?? threadRow.model ?? ollama.model;
+    const meterSlug = model;
+    if (billing) {
+        const allowed = await checkQuota(pool, pgSettings, billing, entityId, meterSlug);
+        if (!allowed) {
+            res.status(429).json({
+                error: 'Token quota exceeded',
+                meter: meterSlug,
+                entity_id: entityId,
+            });
+            return;
+        }
+    }
+    // 3. Persist user message(s)
+    await withRlsClient(pool, pgSettings, async (client) => {
+        for (const msg of body.messages) {
+            if (msg.role === 'user') {
+                await client.query(`INSERT INTO "${msgTable.schemaName}"."${msgTable.tableName}"
+           (thread_id, owner_id, entity_id, author_role, parts)
+           VALUES ($1, $2, (SELECT entity_id FROM "${thread.schemaName}"."${thread.tableName}" WHERE id = $1), $3, $4)`, [
+                    threadId,
+                    userId,
+                    'user',
+                    JSON.stringify([{ type: 'text', text: msg.content }]),
+                ]);
+            }
+        }
+    });
+    // 4. Load full thread history for context
+    const history = await withRlsClient(pool, pgSettings, async (client) => {
+        const { rows } = await client.query(`SELECT author_role, parts, created_at
+       FROM "${msgTable.schemaName}"."${msgTable.tableName}"
+       WHERE thread_id = $1
+       ORDER BY created_at ASC`, [threadId]);
+        return rows;
+    });
+    const llmMessages = [];
+    const systemPrompt = threadRow.system_prompt;
+    if (systemPrompt) {
+        llmMessages.push({ role: 'system', content: systemPrompt });
+    }
+    for (const row of history) {
+        const parts = Array.isArray(row.parts) ? row.parts : [];
+        const textContent = parts
+            .filter((p) => p.type === 'text')
+            .map((p) => p.text)
+            .join('');
+        if (textContent) {
+            llmMessages.push({
+                role: row.author_role === 'user' ? 'user' : 'assistant',
+                content: textContent,
+            });
+        }
+    }
+    // 5. Call LLM with token usage tracking
+    const shouldStream = body.stream !== false;
+    const startTime = Date.now();
+    if (shouldStream) {
+        // ── SSE Streaming ──────────────────────────────────────────────────
+        res.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache',
+            'Connection': 'keep-alive',
+            'X-Accel-Buffering': 'no',
+        });
+        const messageId = `msg_${Date.now()}`;
+        try {
+            let streamedContent = '';
+            const result = await callWithUsage(ollama.client, {
+                model,
+                messages: llmMessages,
+                stream: true,
+                temperature: body.temperature,
+            }, (chunk) => {
+                streamedContent += chunk;
+                const event = {
+                    id: messageId,
+                    choices: [{
+                            index: 0,
+                            delta: { content: chunk, role: 'assistant' },
+                            finish_reason: null,
+                        }],
+                    model,
+                };
+                res.write(`data: ${JSON.stringify(event)}\n\n`);
+            });
+            // Streaming generate() returns void; use accumulated chunks
+            const content = streamedContent;
+            const promptText = llmMessages.map(m => m.content).join(' ');
+            const latencyMs = Date.now() - startTime;
+            const inputTokens = placeholderAmountTokens(promptText);
+            const outputTokens = placeholderAmountTokens(content);
+            const totalTokens = inputTokens + outputTokens;
+            // Send [DONE] marker
+            res.write('data: [DONE]\n\n');
+            res.end();
+            // 6. Persist assistant message with model (fire-and-forget)
+            if (content) {
+                withRlsClient(pool, pgSettings, async (client) => {
+                    await client.query(`INSERT INTO "${msgTable.schemaName}"."${msgTable.tableName}"
+             (thread_id, owner_id, entity_id, author_role, parts, model)
+             VALUES ($1, $2, (SELECT entity_id FROM "${thread.schemaName}"."${thread.tableName}" WHERE id = $1), $3, $4, $5)`, [
+                        threadId,
+                        userId,
+                        'assistant',
+                        JSON.stringify([{ type: 'text', text: content }]),
+                        model,
+                    ]);
+                }).catch((err) => {
+                    log.error('[llm-api] Failed to persist assistant message:', err);
+                });
+            }
+            // 7. Record billing usage (fire-and-forget)
+            if (billing && totalTokens > 0) {
+                recordUsage(pool, pgSettings, billing, entityId, meterSlug, totalTokens, {
+                    input_tokens: inputTokens,
+                    output_tokens: outputTokens,
+                    model,
+                    latency_ms: latencyMs,
+                    stream: true,
+                }).catch(() => { });
+            }
+            // 8. Inference log (fire-and-forget)
+            if (inferenceLog) {
+                logInference(pool, pgSettings, inferenceLog, {
+                    entityId,
+                    actorId: userId,
+                    model,
+                    provider: 'ollama',
+                    service: 'llm',
+                    operation: 'chat',
+                    inputTokens,
+                    outputTokens,
+                    totalTokens,
+                    latencyMs,
+                    status: 'ok',
+                }).catch(() => { });
+            }
+        }
+        catch (streamErr) {
+            log.error('[llm-api] Streaming error:', streamErr);
+            const errorEvent = { error: { message: streamErr.message, type: 'stream_error' } };
+            res.write(`data: ${JSON.stringify(errorEvent)}\n\n`);
+            res.write('data: [DONE]\n\n');
+            res.end();
+        }
+    }
+    else {
+        // ── Non-streaming (batch) ──────────────────────────────────────────
+        const result = await callWithUsage(ollama.client, {
+            model,
+            messages: llmMessages,
+            stream: false,
+            temperature: body.temperature,
+        });
+        const latencyMs = Date.now() - startTime;
+        const inputTokens = result.usage.input;
+        const outputTokens = result.usage.output;
+        const totalTokens = result.usage.totalTokens;
+        // Persist assistant message with model
+        await withRlsClient(pool, pgSettings, async (client) => {
+            await client.query(`INSERT INTO "${msgTable.schemaName}"."${msgTable.tableName}"
+         (thread_id, owner_id, entity_id, author_role, parts, model)
+         VALUES ($1, $2, (SELECT entity_id FROM "${thread.schemaName}"."${thread.tableName}" WHERE id = $1), $3, $4, $5)`, [
+                threadId,
+                userId,
+                'assistant',
+                JSON.stringify([{ type: 'text', text: result.content }]),
+                model,
+            ]);
+        });
+        // Record billing usage
+        if (billing && totalTokens > 0) {
+            recordUsage(pool, pgSettings, billing, entityId, meterSlug, totalTokens, {
+                input_tokens: inputTokens,
+                output_tokens: outputTokens,
+                model,
+                latency_ms: latencyMs,
+                stream: false,
+            }).catch(() => { });
+        }
+        // Inference log
+        if (inferenceLog) {
+            logInference(pool, pgSettings, inferenceLog, {
+                entityId,
+                actorId: userId,
+                model,
+                provider: 'ollama',
+                service: 'llm',
+                operation: 'chat',
+                inputTokens,
+                outputTokens,
+                totalTokens,
+                latencyMs,
+                status: 'ok',
+            }).catch(() => { });
+        }
+        res.json({
+            id: `msg_${Date.now()}`,
+            choices: [{
+                    index: 0,
+                    message: { role: 'assistant', content: result.content },
+                    finish_reason: 'stop',
+                }],
+            model,
+            usage: {
+                prompt_tokens: inputTokens,
+                completion_tokens: outputTokens,
+                total_tokens: totalTokens,
+            },
+        });
+    }
+}
+// ─── Router Factory ─────────────────────────────────────────────────────────
+export function createLlmApiRouter() {
+    const router = Router();
+    router.use(express.json());
+    // ── Entity-scoped routes ─────────────────────────────────────────────────
+    router.post('/v1/orgs/:entity_id/threads', async (req, res) => {
+        try {
+            await handleCreateThread(req, res, req.params.entity_id);
+        }
+        catch (err) {
+            log.error('[llm-api] Error creating thread:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        }
+    });
+    router.post('/v1/orgs/:entity_id/threads/:thread_id/messages', async (req, res) => {
+        try {
+            await handleSendMessage(req, res, req.params.entity_id);
+        }
+        catch (err) {
+            log.error('[llm-api] Error in messages endpoint:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        }
+    });
+    // ── Global routes (no entity_id — bills to actor_id from JWT) ────────────
+    router.post('/v1/threads', async (req, res) => {
+        try {
+            const userId = req.token?.user_id;
+            if (!userId) {
+                res.status(401).json({ error: 'Authentication required' });
+                return;
+            }
+            await handleCreateThread(req, res, userId);
+        }
+        catch (err) {
+            log.error('[llm-api] Error creating thread:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        }
+    });
+    router.post('/v1/threads/:thread_id/messages', async (req, res) => {
+        try {
+            const userId = req.token?.user_id;
+            if (!userId) {
+                res.status(401).json({ error: 'Authentication required' });
+                return;
+            }
+            await handleSendMessage(req, res, userId);
+        }
+        catch (err) {
+            log.error('[llm-api] Error in messages endpoint:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        }
+    });
+    return router;
+}

package/esm/server.js

@@ -27,6 +27,7 @@ import { createRequestLogger } from './middleware/observability/request-logger';
 import { createCaptchaMiddleware } from './middleware/captcha';
 import { parseCookieValue, SESSION_COOKIE_NAME } from './middleware/cookie';
 import { createUploadAuthenticateMiddleware, uploadRoute } from './middleware/upload';
+import { createLlmApiRouter } from './middleware/llm-api';
 import { startDebugSampler } from './diagnostics/debug-sampler';
 const log = new Logger('server');
 /**
@@ -167,6 +168,9 @@ class Server {
         };
         app.use(csrfSetToken); // Set CSRF token cookie on all requests
         app.use('/graphql', csrfProtect); // Enforce CSRF on GraphQL mutations
+        // LLM Agent REST API — mounted before graphile so SSE streaming
+        // routes are handled without going through PostGraphile
+        app.use(createLlmApiRouter());
         app.use(graphile(effectiveOpts));
         app.use(flush);
         // Error handling - MUST be LAST

package/middleware/graphile.js

@@ -254,14 +254,21 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
                         if (req.token.access_level === 'read_only') {
                             pgSettings['default_transaction_read_only'] = 'on';
                         }
+                        if (req.requestId) {
+                            pgSettings['request.id'] = req.requestId;
+                        }
                         return { pgSettings };
                     }
                 }
+                const anonSettings = {
+                    role: anonRole,
+                    ...context,
+                };
+                if (req?.requestId) {
+                    anonSettings['request.id'] = req.requestId;
+                }
                 return {
-                    pgSettings: {
-                        role: anonRole,
-                        ...context,
-                    },
+                    pgSettings: anonSettings,
                 };
             },
         },

package/middleware/llm-api.d.ts

@@ -0,0 +1,24 @@
+/**
+ * LLM API Router
+ *
+ * Express router providing REST streaming endpoints for AI agent conversations.
+ * Uses the agent tables (agent_thread, agent_message) discovered from the
+ * agent_chat_module config table at runtime.
+ *
+ * Hybrid architecture:
+ *   - GraphQL handles CRUD (threads, messages, tasks) via PostGraphile
+ *   - REST handles SSE streaming for chat completions (what GraphQL can't do)
+ *
+ * Routes (entity-scoped):
+ *   POST /v1/orgs/:entity_id/threads                    → create thread
+ *   POST /v1/orgs/:entity_id/threads/:thread_id/messages → send message + stream response
+ *
+ * Routes (global — bills to actor_id from JWT):
+ *   POST /v1/threads                    → create thread (entity_id = user_id)
+ *   POST /v1/threads/:thread_id/messages → send message + stream response
+ *
+ * Auth: JWT from the auth middleware (req.token) → pg SET LOCAL context for RLS
+ * Metering: check_billing_quota → LLM call → record_usage with real token counts
+ */
+import { Router } from 'express';
+export declare function createLlmApiRouter(): Router;

package/middleware/llm-api.js

@@ -0,0 +1,601 @@
+"use strict";
+/**
+ * LLM API Router
+ *
+ * Express router providing REST streaming endpoints for AI agent conversations.
+ * Uses the agent tables (agent_thread, agent_message) discovered from the
+ * agent_chat_module config table at runtime.
+ *
+ * Hybrid architecture:
+ *   - GraphQL handles CRUD (threads, messages, tasks) via PostGraphile
+ *   - REST handles SSE streaming for chat completions (what GraphQL can't do)
+ *
+ * Routes (entity-scoped):
+ *   POST /v1/orgs/:entity_id/threads                    → create thread
+ *   POST /v1/orgs/:entity_id/threads/:thread_id/messages → send message + stream response
+ *
+ * Routes (global — bills to actor_id from JWT):
+ *   POST /v1/threads                    → create thread (entity_id = user_id)
+ *   POST /v1/threads/:thread_id/messages → send message + stream response
+ *
+ * Auth: JWT from the auth middleware (req.token) → pg SET LOCAL context for RLS
+ * Metering: check_billing_quota → LLM call → record_usage with real token counts
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLlmApiRouter = createLlmApiRouter;
+const express_1 = __importStar(require("express"));
+const logger_1 = require("@pgpmjs/logger");
+const pg_cache_1 = require("pg-cache");
+const ollama_1 = __importDefault(require("@agentic-kit/ollama"));
+const graphile_cache_1 = require("graphile-cache");
+const graphile_llm_1 = require("graphile-llm");
+const log = new logger_1.Logger('llm-api');
+/**
+ * Placeholder: replace with actual provider token counts once generateWithUsage() is approved.
+ * Estimates ~4 chars per token for English text.
+ */
+function placeholderAmountTokens(text) {
+    return Math.ceil(text.length / 4);
+}
+/**
+ * Call generate() and estimate token counts from text length.
+ * When a provider-native token counting API is approved, swap the
+ * estimation logic here without changing call sites.
+ */
+async function callWithUsage(client, input, onChunk) {
+    const promptText = input.messages.map((m) => m.content).join(' ');
+    let content;
+    if (onChunk || input.stream) {
+        await client.generate(input, onChunk);
+        content = '';
+    }
+    else {
+        content = await client.generate(input);
+    }
+    const inputTokens = placeholderAmountTokens(promptText);
+    const outputTokens = placeholderAmountTokens(content);
+    return {
+        content,
+        usage: { input: inputTokens, output: outputTokens, totalTokens: inputTokens + outputTokens },
+    };
+}
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function getPgSettings(req) {
+    const settings = {};
+    if (req.token?.user_id) {
+        settings['jwt.claims.user_id'] = req.token.user_id;
+        settings['role'] = 'authenticated';
+    }
+    if (req.databaseId) {
+        settings['jwt.claims.database_id'] = req.databaseId;
+    }
+    if (req.requestId) {
+        settings['request.id'] = req.requestId;
+    }
+    return settings;
+}
+async function withRlsClient(pool, pgSettings, fn) {
+    const client = await pool.connect();
+    try {
+        await client.query('BEGIN');
+        for (const [key, value] of Object.entries(pgSettings)) {
+            await client.query('SELECT set_config($1, $2, true)', [key, value]);
+        }
+        const result = await fn(client);
+        await client.query('COMMIT');
+        return result;
+    }
+    catch (err) {
+        await client.query('ROLLBACK').catch(() => { });
+        throw err;
+    }
+    finally {
+        client.release();
+    }
+}
+function resolveOllamaClient() {
+    const { chat } = (0, graphile_llm_1.getLlmEnvOptions)();
+    if (chat.provider === 'ollama') {
+        return {
+            client: new ollama_1.default(chat.baseUrl),
+            model: chat.model,
+        };
+    }
+    return null;
+}
+// ─── Billing Helpers ────────────────────────────────────────────────────────
+async function checkQuota(pool, pgSettings, billing, entityId, meterSlug) {
+    try {
+        return await withRlsClient(pool, pgSettings, async (client) => {
+            const sql = `SELECT "${billing.privateSchema}"."${billing.checkBillingQuotaFunction}"($1, $2::uuid, $3) AS allowed`;
+            const result = await client.query(sql, [meterSlug, entityId, 1]);
+            return result.rows[0]?.allowed !== false;
+        });
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        log.warn(`[llm-api] check_billing_quota failed (allowing): ${message}`);
+        return true;
+    }
+}
+async function recordUsage(pool, pgSettings, billing, entityId, meterSlug, amount, metadata) {
+    try {
+        await withRlsClient(pool, pgSettings, async (client) => {
+            const sql = `SELECT "${billing.privateSchema}"."${billing.recordUsageFunction}"($1, $2::uuid, $3, $4::jsonb)`;
+            await client.query(sql, [meterSlug, entityId, amount, JSON.stringify(metadata)]);
+        });
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        log.warn(`[llm-api] record_usage failed (non-fatal): ${message}`);
+    }
+}
+async function resolveBilling(pool, pgSettings, databaseId) {
+    try {
+        let billing = null;
+        await withRlsClient(pool, pgSettings, async (client) => {
+            const entry = await (0, graphile_llm_1.getLlmBillingConfig)(client, databaseId);
+            billing = entry.billing;
+        });
+        return billing;
+    }
+    catch {
+        return null;
+    }
+}
+const INFERENCE_LOG_DISCOVERY_SQL = `
+  SELECT s.schema_name, ilm.inference_log_table_name
+  FROM metaschema_modules_public.inference_log_module ilm
+  JOIN metaschema_public.schema s ON s.id = ilm.schema_id
+  LIMIT 1
+`;
+const inferenceLogCache = new graphile_cache_1.ModuleConfigCache({
+    name: 'inference-log',
+    ttlMs: 60_000,
+});
+async function getInferenceLogInfo(pool, dbname) {
+    const cached = inferenceLogCache.get(dbname);
+    if (cached !== undefined)
+        return cached;
+    let info = null;
+    try {
+        const { rows } = await pool.query(INFERENCE_LOG_DISCOVERY_SQL);
+        if (rows.length > 0) {
+            info = {
+                schemaName: rows[0].schema_name,
+                tableName: rows[0].inference_log_table_name,
+            };
+        }
+    }
+    catch {
+        // Module not provisioned
+    }
+    inferenceLogCache.set(dbname, info);
+    return info;
+}
+async function logInference(pool, pgSettings, logInfo, data) {
+    try {
+        await withRlsClient(pool, pgSettings, async (client) => {
+            await client.query(`INSERT INTO "${logInfo.schemaName}"."${logInfo.tableName}"
+         (entity_id, actor_id, model, provider, service, operation, input_tokens, output_tokens, total_tokens, latency_ms, status)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`, [
+                data.entityId,
+                data.actorId,
+                data.model,
+                data.provider,
+                data.service,
+                data.operation,
+                data.inputTokens,
+                data.outputTokens,
+                data.totalTokens,
+                data.latencyMs,
+                data.status,
+            ]);
+        });
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        log.warn(`[llm-api] inference log INSERT failed (non-fatal): ${message}`);
+    }
+}
+// ─── Route Handlers ─────────────────────────────────────────────────────────
+async function handleCreateThread(req, res, entityId) {
+    if (!req.token?.user_id) {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+    }
+    const dbname = req.api?.dbname;
+    if (!dbname) {
+        res.status(400).json({ error: 'Database not resolved' });
+        return;
+    }
+    const pool = (0, pg_cache_1.getPgPool)({ database: dbname });
+    const discovery = await (0, graphile_llm_1.getAgentDiscovery)(pool, dbname);
+    if (!discovery?.thread) {
+        res.status(404).json({ error: 'Agent module not provisioned for this database' });
+        return;
+    }
+    const body = req.body || {};
+    const { thread } = discovery;
+    const pgSettings = getPgSettings(req);
+    const result = await withRlsClient(pool, pgSettings, async (client) => {
+        const { rows } = await client.query(`INSERT INTO "${thread.schemaName}"."${thread.tableName}"
+       (entity_id, owner_id, mode, model, system_prompt, title)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       RETURNING id, mode, model, system_prompt, status, created_at`, [
+            entityId,
+            req.token.user_id,
+            body.mode ?? 'ask',
+            body.model ?? null,
+            body.system_prompt ?? null,
+            body.title ?? null,
+        ]);
+        return rows[0];
+    });
+    res.status(201).json({
+        id: result.id,
+        mode: result.mode,
+        model: result.model,
+        system_prompt: result.system_prompt,
+        status: result.status,
+        created_at: result.created_at,
+    });
+}
+async function handleSendMessage(req, res, entityId) {
+    if (!req.token?.user_id) {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+    }
+    const dbname = req.api?.dbname;
+    if (!dbname) {
+        res.status(400).json({ error: 'Database not resolved' });
+        return;
+    }
+    const pool = (0, pg_cache_1.getPgPool)({ database: dbname });
+    const discovery = await (0, graphile_llm_1.getAgentDiscovery)(pool, dbname);
+    if (!discovery?.thread || !discovery?.message) {
+        res.status(404).json({ error: 'Agent module not provisioned for this database' });
+        return;
+    }
+    const body = req.body || {};
+    if (!body.messages?.length) {
+        res.status(400).json({ error: 'messages[] is required and must not be empty' });
+        return;
+    }
+    const { thread, message: msgTable } = discovery;
+    const pgSettings = getPgSettings(req);
+    const threadId = req.params.thread_id;
+    const userId = req.token.user_id;
+    const databaseId = req.databaseId;
+    // 1. Verify thread exists and user owns it (RLS enforced)
+    const threadRow = await withRlsClient(pool, pgSettings, async (client) => {
+        const { rows } = await client.query(`SELECT id, mode, model, system_prompt, status
+       FROM "${thread.schemaName}"."${thread.tableName}"
+       WHERE id = $1`, [threadId]);
+        return rows[0];
+    });
+    if (!threadRow) {
+        res.status(404).json({ error: 'Thread not found' });
+        return;
+    }
+    // 2. Resolve billing config + inference log discovery
+    const billing = databaseId
+        ? await resolveBilling(pool, pgSettings, databaseId)
+        : null;
+    const inferenceLog = await getInferenceLogInfo(pool, dbname);
+    const ollama = resolveOllamaClient();
+    if (!ollama) {
+        res.status(503).json({ error: 'No LLM provider configured' });
+        return;
+    }
+    const model = body.model ?? threadRow.model ?? ollama.model;
+    const meterSlug = model;
+    if (billing) {
+        const allowed = await checkQuota(pool, pgSettings, billing, entityId, meterSlug);
+        if (!allowed) {
+            res.status(429).json({
+                error: 'Token quota exceeded',
+                meter: meterSlug,
+                entity_id: entityId,
+            });
+            return;
+        }
+    }
+    // 3. Persist user message(s)
+    await withRlsClient(pool, pgSettings, async (client) => {
+        for (const msg of body.messages) {
+            if (msg.role === 'user') {
+                await client.query(`INSERT INTO "${msgTable.schemaName}"."${msgTable.tableName}"
+           (thread_id, owner_id, entity_id, author_role, parts)
+           VALUES ($1, $2, (SELECT entity_id FROM "${thread.schemaName}"."${thread.tableName}" WHERE id = $1), $3, $4)`, [
+                    threadId,
+                    userId,
+                    'user',
+                    JSON.stringify([{ type: 'text', text: msg.content }]),
+                ]);
+            }
+        }
+    });
+    // 4. Load full thread history for context
+    const history = await withRlsClient(pool, pgSettings, async (client) => {
+        const { rows } = await client.query(`SELECT author_role, parts, created_at
+       FROM "${msgTable.schemaName}"."${msgTable.tableName}"
+       WHERE thread_id = $1
+       ORDER BY created_at ASC`, [threadId]);
+        return rows;
+    });
+    const llmMessages = [];
+    const systemPrompt = threadRow.system_prompt;
+    if (systemPrompt) {
+        llmMessages.push({ role: 'system', content: systemPrompt });
+    }
+    for (const row of history) {
+        const parts = Array.isArray(row.parts) ? row.parts : [];
+        const textContent = parts
+            .filter((p) => p.type === 'text')
+            .map((p) => p.text)
+            .join('');
+        if (textContent) {
+            llmMessages.push({
+                role: row.author_role === 'user' ? 'user' : 'assistant',
+                content: textContent,
+            });
+        }
+    }
+    // 5. Call LLM with token usage tracking
+    const shouldStream = body.stream !== false;
+    const startTime = Date.now();
+    if (shouldStream) {
+        // ── SSE Streaming ──────────────────────────────────────────────────
+        res.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache',
+            'Connection': 'keep-alive',
+            'X-Accel-Buffering': 'no',
+        });
+        const messageId = `msg_${Date.now()}`;
+        try {
+            let streamedContent = '';
+            const result = await callWithUsage(ollama.client, {
+                model,
+                messages: llmMessages,
+                stream: true,
+                temperature: body.temperature,
+            }, (chunk) => {
+                streamedContent += chunk;
+                const event = {
+                    id: messageId,
+                    choices: [{
+                            index: 0,
+                            delta: { content: chunk, role: 'assistant' },
+                            finish_reason: null,
+                        }],
+                    model,
+                };
+                res.write(`data: ${JSON.stringify(event)}\n\n`);
+            });
+            // Streaming generate() returns void; use accumulated chunks
+            const content = streamedContent;
+            const promptText = llmMessages.map(m => m.content).join(' ');
+            const latencyMs = Date.now() - startTime;
+            const inputTokens = placeholderAmountTokens(promptText);
+            const outputTokens = placeholderAmountTokens(content);
+            const totalTokens = inputTokens + outputTokens;
+            // Send [DONE] marker
+            res.write('data: [DONE]\n\n');
+            res.end();
+            // 6. Persist assistant message with model (fire-and-forget)
+            if (content) {
+                withRlsClient(pool, pgSettings, async (client) => {
+                    await client.query(`INSERT INTO "${msgTable.schemaName}"."${msgTable.tableName}"
+             (thread_id, owner_id, entity_id, author_role, parts, model)
+             VALUES ($1, $2, (SELECT entity_id FROM "${thread.schemaName}"."${thread.tableName}" WHERE id = $1), $3, $4, $5)`, [
+                        threadId,
+                        userId,
+                        'assistant',
+                        JSON.stringify([{ type: 'text', text: content }]),
+                        model,
+                    ]);
+                }).catch((err) => {
+                    log.error('[llm-api] Failed to persist assistant message:', err);
+                });
+            }
+            // 7. Record billing usage (fire-and-forget)
+            if (billing && totalTokens > 0) {
+                recordUsage(pool, pgSettings, billing, entityId, meterSlug, totalTokens, {
+                    input_tokens: inputTokens,
+                    output_tokens: outputTokens,
+                    model,
+                    latency_ms: latencyMs,
+                    stream: true,
+                }).catch(() => { });
+            }
+            // 8. Inference log (fire-and-forget)
+            if (inferenceLog) {
+                logInference(pool, pgSettings, inferenceLog, {
+                    entityId,
+                    actorId: userId,
+                    model,
+                    provider: 'ollama',
+                    service: 'llm',
+                    operation: 'chat',
+                    inputTokens,
+                    outputTokens,
+                    totalTokens,
+                    latencyMs,
+                    status: 'ok',
+                }).catch(() => { });
+            }
+        }
+        catch (streamErr) {
+            log.error('[llm-api] Streaming error:', streamErr);
+            const errorEvent = { error: { message: streamErr.message, type: 'stream_error' } };
+            res.write(`data: ${JSON.stringify(errorEvent)}\n\n`);
+            res.write('data: [DONE]\n\n');
+            res.end();
+        }
+    }
+    else {
+        // ── Non-streaming (batch) ──────────────────────────────────────────
+        const result = await callWithUsage(ollama.client, {
+            model,
+            messages: llmMessages,
+            stream: false,
+            temperature: body.temperature,
+        });
+        const latencyMs = Date.now() - startTime;
+        const inputTokens = result.usage.input;
+        const outputTokens = result.usage.output;
+        const totalTokens = result.usage.totalTokens;
+        // Persist assistant message with model
+        await withRlsClient(pool, pgSettings, async (client) => {
+            await client.query(`INSERT INTO "${msgTable.schemaName}"."${msgTable.tableName}"
+         (thread_id, owner_id, entity_id, author_role, parts, model)
+         VALUES ($1, $2, (SELECT entity_id FROM "${thread.schemaName}"."${thread.tableName}" WHERE id = $1), $3, $4, $5)`, [
+                threadId,
+                userId,
+                'assistant',
+                JSON.stringify([{ type: 'text', text: result.content }]),
+                model,
+            ]);
+        });
+        // Record billing usage
+        if (billing && totalTokens > 0) {
+            recordUsage(pool, pgSettings, billing, entityId, meterSlug, totalTokens, {
+                input_tokens: inputTokens,
+                output_tokens: outputTokens,
+                model,
+                latency_ms: latencyMs,
+                stream: false,
+            }).catch(() => { });
+        }
+        // Inference log
+        if (inferenceLog) {
+            logInference(pool, pgSettings, inferenceLog, {
+                entityId,
+                actorId: userId,
+                model,
+                provider: 'ollama',
+                service: 'llm',
+                operation: 'chat',
+                inputTokens,
+                outputTokens,
+                totalTokens,
+                latencyMs,
+                status: 'ok',
+            }).catch(() => { });
+        }
+        res.json({
+            id: `msg_${Date.now()}`,
+            choices: [{
+                    index: 0,
+                    message: { role: 'assistant', content: result.content },
+                    finish_reason: 'stop',
+                }],
+            model,
+            usage: {
+                prompt_tokens: inputTokens,
+                completion_tokens: outputTokens,
+                total_tokens: totalTokens,
+            },
+        });
+    }
+}
+// ─── Router Factory ─────────────────────────────────────────────────────────
+function createLlmApiRouter() {
+    const router = (0, express_1.Router)();
+    router.use(express_1.default.json());
+    // ── Entity-scoped routes ─────────────────────────────────────────────────
+    router.post('/v1/orgs/:entity_id/threads', async (req, res) => {
+        try {
+            await handleCreateThread(req, res, req.params.entity_id);
+        }
+        catch (err) {
+            log.error('[llm-api] Error creating thread:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        }
+    });
+    router.post('/v1/orgs/:entity_id/threads/:thread_id/messages', async (req, res) => {
+        try {
+            await handleSendMessage(req, res, req.params.entity_id);
+        }
+        catch (err) {
+            log.error('[llm-api] Error in messages endpoint:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        }
+    });
+    // ── Global routes (no entity_id — bills to actor_id from JWT) ────────────
+    router.post('/v1/threads', async (req, res) => {
+        try {
+            const userId = req.token?.user_id;
+            if (!userId) {
+                res.status(401).json({ error: 'Authentication required' });
+                return;
+            }
+            await handleCreateThread(req, res, userId);
+        }
+        catch (err) {
+            log.error('[llm-api] Error creating thread:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        }
+    });
+    router.post('/v1/threads/:thread_id/messages', async (req, res) => {
+        try {
+            const userId = req.token?.user_id;
+            if (!userId) {
+                res.status(401).json({ error: 'Authentication required' });
+                return;
+            }
+            await handleSendMessage(req, res, userId);
+        }
+        catch (err) {
+            log.error('[llm-api] Error in messages endpoint:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        }
+    });
+    return router;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "4.31.5",
+  "version": "4.32.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -41,10 +41,11 @@
     "backend"
   ],
   "dependencies": {
+    "@agentic-kit/ollama": "^1.2.1",
     "@constructive-io/csrf": "^0.14.0",
-    "@constructive-io/graphql-env": "^3.11.0",
-    "@constructive-io/graphql-types": "^3.10.0",
-    "@constructive-io/s3-utils": "^2.17.0",
+    "@constructive-io/graphql-env": "^3.11.1",
+    "@constructive-io/graphql-types": "^3.10.1",
+    "@constructive-io/s3-utils": "^2.17.1",
     "@constructive-io/upload-names": "^2.16.0",
     "@constructive-io/url-domains": "^2.16.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
@@ -57,40 +58,41 @@
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
     "gql-ast": "^3.10.0",
-    "grafast": "1.0.0",
+    "grafast": "1.0.2",
     "grafserv": "1.0.0",
-    "graphile-build": "5.0.0",
-    "graphile-build-pg": "5.0.0",
-    "graphile-cache": "^3.11.1",
-    "graphile-config": "1.0.0",
-    "graphile-settings": "^5.2.3",
-    "graphile-utils": "5.0.0",
+    "graphile-build": "5.0.2",
+    "graphile-build-pg": "5.0.2",
+    "graphile-cache": "^3.11.2",
+    "graphile-config": "1.0.1",
+    "graphile-llm": "^0.8.0",
+    "graphile-settings": "^5.2.4",
+    "graphile-utils": "5.0.1",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "multer": "^2.1.1",
-    "pg": "^8.20.0",
-    "pg-cache": "^3.10.0",
+    "pg": "^8.21.0",
+    "pg-cache": "^3.10.1",
     "pg-env": "^1.14.0",
-    "pg-query-context": "^2.15.0",
-    "pg-sql2": "5.0.0",
-    "postgraphile": "5.0.0",
+    "pg-query-context": "^2.15.1",
+    "pg-sql2": "5.0.1",
+    "postgraphile": "5.0.3",
     "request-ip": "^3.3.0"
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "^3.1009.0",
+    "@aws-sdk/client-s3": "^3.1052.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.6",
     "@types/graphql-upload": "^8.0.12",
     "@types/multer": "^2.1.0",
-    "@types/pg": "^8.18.0",
+    "@types/pg": "^8.20.0",
     "@types/request-ip": "^0.0.41",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "4.15.2",
+    "graphile-test": "4.15.3",
     "makage": "^0.3.0",
     "nodemon": "^3.1.14",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "7b7c25cb21fd0e97c2ab3c94b994b0ca89bd3247"
+  "gitHead": "030e1144acbd4e288ee74eff2ac0021ca0382ef7"
 }

package/server.js

@@ -33,6 +33,7 @@ const request_logger_1 = require("./middleware/observability/request-logger");
 const captcha_1 = require("./middleware/captcha");
 const cookie_1 = require("./middleware/cookie");
 const upload_1 = require("./middleware/upload");
+const llm_api_1 = require("./middleware/llm-api");
 const debug_sampler_1 = require("./diagnostics/debug-sampler");
 const log = new logger_1.Logger('server');
 /**
@@ -174,6 +175,9 @@ class Server {
         };
         app.use(csrfSetToken); // Set CSRF token cookie on all requests
         app.use('/graphql', csrfProtect); // Enforce CSRF on GraphQL mutations
+        // LLM Agent REST API — mounted before graphile so SSE streaming
+        // routes are handled without going through PostGraphile
+        app.use((0, llm_api_1.createLlmApiRouter)());
         app.use((0, graphile_1.graphile)(effectiveOpts));
         app.use(flush_1.flush);
         // Error handling - MUST be LAST