@graphorin/server 0.5.0

package/dist/app.js

@@ -0,0 +1,684 @@
+import { bridgeCommentaryToAudit, createLateBoundCommentarySink } from "./commentary/audit-bridge.js";
+import "./commentary/index.js";
+import { LifecycleDoubleStartError, LifecycleNotStartedError, ShutdownTimeoutError } from "./errors/index.js";
+import { parseServerConfig } from "./config.js";
+import { createConsolidatorDaemon } from "./consolidator/daemon.js";
+import { createExtendedHealthRoutes, createMetricsRoutes, createSecretsHealthRoutes } from "./health/routes.js";
+import "./health/index.js";
+import { runPreBind } from "./lifecycle/pre-bind.js";
+import "./lifecycle/index.js";
+import { SERVER_METRIC_NAMES, createServerMetricRegistry } from "./metrics/catalog.js";
+import { createAuditMiddleware } from "./middleware/audit.js";
+import { createAnonymousAuthMiddleware, createAuthMiddleware } from "./middleware/auth.js";
+import { createCorsMiddleware } from "./middleware/cors.js";
+import { createCsrfMiddleware } from "./middleware/csrf.js";
+import { createIdempotencyMiddleware } from "./middleware/idempotency.js";
+import { createRateLimitMiddleware } from "./middleware/rate-limit.js";
+import { createRequestStateMiddleware } from "./middleware/request-state.js";
+import "./middleware/index.js";
+import { AgentRegistry, WorkflowRegistry } from "./registry/index.js";
+import { createReplayRoutes } from "./replay/routes.js";
+import "./replay/index.js";
+import { createAgentRoutes, createRunRoutes } from "./routes/agents.js";
+import { createAuditRoutes } from "./routes/audit.js";
+import { createAuthRoutes } from "./routes/auth.js";
+import { createMcpRoutes } from "./routes/mcp.js";
+import { createMemoryRoutes } from "./routes/memory.js";
+import { createSessionRoutes } from "./routes/sessions.js";
+import { createSkillsRoutes } from "./routes/skills.js";
+import { createTokensRoutes } from "./routes/tokens.js";
+import { createWorkflowRoutes } from "./routes/workflows.js";
+import "./routes/index.js";
+import { RunStateTracker, scheduleRunPruning } from "./runtime/run-state.js";
+import { createSseRoutes } from "./sse/events.js";
+import "./sse/index.js";
+import { createTriggersDaemon } from "./triggers/daemon.js";
+import { createTriggersRoutes } from "./triggers/routes.js";
+import { createWsDispatcher } from "./ws/dispatcher.js";
+import { createWsTicketStore } from "./ws/ticket.js";
+import { createWsUpgradeEvents } from "./ws/upgrade.js";
+import "./ws/index.js";
+import { SUBPROTOCOL_NAME, negotiateSubprotocol } from "@graphorin/protocol";
+import { TokenVerifier, applyProcessHardening, generatePepper } from "@graphorin/security";
+import { openAuditDb, registerAuditDbBinding } from "@graphorin/security/audit";
+import { createSqliteStore, loadCipherDriver, readWalSize } from "@graphorin/store-sqlite";
+import { serve } from "@hono/node-server";
+import { createNodeWebSocket } from "@hono/node-ws";
+import { Hono } from "hono";
+
+//#region src/app.ts
+/**
+* Pre-built audit-db binding shipped from `@graphorin/store-sqlite`.
+* Registered exactly once per process so {@link openAuditDb} can find
+* a default binding without forcing operators to wire it manually.
+*
+* Exported as {@link ensureStoreAuditBinding} so the CLI (Phase 15
+* `graphorin audit verify | prune | export`) can reach into the same
+* binding without booting the HTTP listener.
+*
+* @stable
+*/
+let storeAuditBindingRegistered = false;
+function ensureStoreAuditBinding() {
+	if (storeAuditBindingRegistered) return;
+	registerAuditDbBinding({
+		id: "better-sqlite3-multiple-ciphers",
+		description: "Default audit-db binding shipped by @graphorin/store-sqlite.",
+		open: async (opts) => {
+			const driver = await loadCipherDriver();
+			const passphrase = await opts.passphrase.use((value) => value);
+			const db = new driver(opts.path);
+			db.pragma(`key = '${passphrase.replace(/'/g, "''")}'`);
+			db.pragma("journal_mode = WAL");
+			db.pragma("synchronous = NORMAL");
+			db.pragma("busy_timeout = 5000");
+			db.pragma("foreign_keys = ON");
+			db.exec(`CREATE TABLE IF NOT EXISTS audit_log (
+            seq INTEGER PRIMARY KEY,
+            ts INTEGER NOT NULL,
+            actor_json TEXT NOT NULL,
+            action TEXT NOT NULL,
+            target TEXT NOT NULL,
+            decision TEXT NOT NULL,
+            context_json TEXT,
+            metadata_json TEXT,
+            prev_hash TEXT NOT NULL,
+            hash TEXT NOT NULL UNIQUE
+          ) WITHOUT ROWID;`);
+			return {
+				binding: "better-sqlite3-multiple-ciphers",
+				path: opts.path,
+				async insert(entry) {
+					db.prepare(`INSERT INTO audit_log (
+                 seq, ts, actor_json, action, target, decision,
+                 context_json, metadata_json, prev_hash, hash
+               ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(entry.seq, entry.ts, JSON.stringify(entry.actor), entry.action, entry.target, entry.decision, entry.context !== void 0 ? JSON.stringify(entry.context) : null, entry.metadata !== void 0 ? JSON.stringify(entry.metadata) : null, entry.prevHash, entry.hash);
+					return entry;
+				},
+				async latest() {
+					const row = db.prepare("SELECT * FROM audit_log ORDER BY seq DESC LIMIT 1").get();
+					if (row === void 0) return void 0;
+					return rowToEntry(row);
+				},
+				async *iterate(bounds) {
+					const lo = bounds?.fromSeq ?? 1;
+					const hi = bounds?.toSeq ?? Number.MAX_SAFE_INTEGER;
+					const iter = db.prepare("SELECT * FROM audit_log WHERE seq BETWEEN ? AND ? ORDER BY seq ASC").iterate(lo, hi);
+					for (const row of iter) yield rowToEntry(row);
+				},
+				async count() {
+					return db.prepare("SELECT COUNT(*) AS n FROM audit_log").get().n;
+				},
+				async deleteUpTo(threshold) {
+					const before = db.prepare("SELECT COUNT(*) AS n FROM audit_log WHERE seq <= ?").get(threshold);
+					db.prepare("DELETE FROM audit_log WHERE seq <= ?").run(threshold);
+					return before.n;
+				},
+				async replaceEntry(entry) {
+					db.prepare(`UPDATE audit_log SET prev_hash = ?, hash = ? WHERE seq = ?`).run(entry.prevHash, entry.hash, entry.seq);
+				},
+				async close() {
+					if (db.open) db.close();
+				}
+			};
+		}
+	}, { setAsDefault: true });
+	storeAuditBindingRegistered = true;
+}
+function rowToEntry(row) {
+	return {
+		seq: row.seq,
+		ts: row.ts,
+		actor: JSON.parse(row.actor_json),
+		action: row.action,
+		target: row.target,
+		decision: row.decision,
+		...row.context_json !== null ? { context: JSON.parse(row.context_json) } : {},
+		...row.metadata_json !== null ? { metadata: JSON.parse(row.metadata_json) } : {},
+		prevHash: row.prev_hash,
+		hash: row.hash
+	};
+}
+/**
+* @stable
+*/
+const VERSION = "0.5.0";
+/**
+* Build a fully-wired Graphorin server. The returned handle is
+* inert until `start()` is awaited.
+*
+* @stable
+*/
+async function createServer(options = {}) {
+	const config = options.validatedConfig ?? parseServerConfig(options.config ?? {});
+	const now = options.now ?? Date.now;
+	const startedAt = now();
+	const version = options.version ?? VERSION;
+	let storeEncryption;
+	if (options.store === void 0 && config.storage.encryption.enabled) {
+		if (config.storage.encryption.passphraseRef === void 0) throw new Error("[graphorin/server] storage.encryption.enabled is true but no passphraseRef is configured.");
+		const { resolveSecret } = await import("@graphorin/security/secrets");
+		const passphrase = await resolveSecret(config.storage.encryption.passphraseRef);
+		storeEncryption = {
+			enabled: true,
+			passphraseResolver: async () => passphrase.use((v) => v)
+		};
+	}
+	const store = options.store ?? await createSqliteStore({
+		path: config.storage.path,
+		mode: config.storage.mode,
+		...storeEncryption !== void 0 ? { encryption: {
+			enabled: true,
+			...config.storage.encryption.cipher !== void 0 ? { cipher: config.storage.encryption.cipher } : {},
+			passphraseResolver: storeEncryption.passphraseResolver
+		} } : {}
+	});
+	const metricRegistry = options.metricRegistry ?? createServerMetricRegistry();
+	metricRegistry.set(SERVER_METRIC_NAMES.buildInfo, 1, { version });
+	const runs = options.runs ?? new RunStateTracker({
+		now,
+		onTerminal: (info) => {
+			metricRegistry.inc(SERVER_METRIC_NAMES.agentRunsTotal, { status: info.status });
+			if (info.durationMs !== void 0) metricRegistry.observe(SERVER_METRIC_NAMES.agentRunDuration, info.durationMs / 1e3);
+		}
+	});
+	const agents = options.agents ?? new AgentRegistry();
+	const workflows = options.workflows ?? new WorkflowRegistry();
+	const app = new Hono();
+	app.use("*", createRequestStateMiddleware({
+		now,
+		...config.server.trustProxy ? { trustProxy: true } : {}
+	}));
+	app.use("*", createCorsMiddleware(config.server.cors));
+	app.use("*", createCsrfMiddleware(config.server.csrf));
+	app.use("*", createRateLimitMiddleware(config.server.rateLimit, { now }));
+	let serverInstance;
+	let listening;
+	let started = false;
+	let stopped = false;
+	let stopRunPruning;
+	let auditDb;
+	let preBind;
+	let verifier;
+	let pepperHandle;
+	let triggersDaemon;
+	if (options.triggers !== void 0) if ("daemon" in options.triggers) triggersDaemon = options.triggers.daemon;
+	else triggersDaemon = createTriggersDaemon({ scheduler: options.triggers.scheduler });
+	let consolidatorDaemon;
+	if (options.consolidator !== void 0) consolidatorDaemon = createConsolidatorDaemon({ consolidator: options.consolidator });
+	let dispatcher;
+	let tickets;
+	let wsAdapter;
+	let commentaryAuditSink;
+	if (config.server.ws.enabled) {
+		commentaryAuditSink = createLateBoundCommentarySink();
+		dispatcher = createWsDispatcher({
+			commentary: {
+				policy: config.server.ws.commentarySanitization.policy,
+				applyToEvents: config.server.ws.commentarySanitization.applyToEvents,
+				sink: commentaryAuditSink
+			},
+			replayBuffer: {
+				maxEvents: config.server.stream.replayBuffer.maxEvents,
+				ttlMs: config.server.stream.replayBuffer.ttlSeconds * 1e3
+			},
+			perConnectionQueueLimit: config.server.stream.perConnectionQueueLimit,
+			now
+		});
+		tickets = createWsTicketStore({
+			ttlMs: config.server.ws.ticketTtlMs,
+			now
+		});
+		wsAdapter = createNodeWebSocket({ app });
+		const wssOptions = wsAdapter.wss.options;
+		wssOptions.handleProtocols = (protocols) => {
+			const negotiated = negotiateSubprotocol(Array.from(protocols));
+			if (negotiated !== null) return negotiated;
+			for (const candidate of protocols) if (candidate === SUBPROTOCOL_NAME) return SUBPROTOCOL_NAME;
+			return false;
+		};
+	}
+	return {
+		version,
+		config,
+		app,
+		agents,
+		workflows,
+		runs,
+		metrics: metricRegistry,
+		get wsDispatcher() {
+			return dispatcher;
+		},
+		get wsTickets() {
+			return tickets;
+		},
+		get triggers() {
+			return triggersDaemon;
+		},
+		get consolidator() {
+			return consolidatorDaemon;
+		},
+		get listeningOn() {
+			return listening;
+		},
+		async start() {
+			if (started) throw new LifecycleDoubleStartError();
+			started = true;
+			try {
+				if (options.hooks?.beforeStart !== void 0) await options.hooks.beforeStart({ config });
+				if (options.skipHardening !== true && config.hardening.applyOnStart) applyProcessHardening({
+					refuseRoot: config.hardening.refuseRoot,
+					umask: config.hardening.umask
+				});
+				preBind = await runPreBind({
+					config,
+					store,
+					...options.probeCipherPeer !== void 0 ? { probeCipherPeer: options.probeCipherPeer } : {}
+				});
+				if (config.audit.enabled && preBind.auditPassphrase !== void 0 && preBind.auditPath !== void 0) {
+					ensureStoreAuditBinding();
+					auditDb = await openAuditDb({
+						path: preBind.auditPath,
+						passphrase: preBind.auditPassphrase,
+						...config.audit.cipher !== void 0 ? { cipher: config.audit.cipher } : {}
+					});
+					commentaryAuditSink?.bind(bridgeCommentaryToAudit(auditDb));
+				}
+				if (config.auth.kind === "token") {
+					const pepper = preBind.pepper ?? await fallbackPepper(options.skipHardening === true);
+					pepperHandle = pepper;
+					verifier = new TokenVerifier({
+						tokenStore: store.authTokens,
+						pepper,
+						acceptPrefix: config.auth.tokenPrefix,
+						acceptEnvironments: config.auth.tokenEnvironments,
+						...config.auth.perIpFailureThreshold !== void 0 ? { perIpFailureThreshold: config.auth.perIpFailureThreshold } : {},
+						...config.auth.perIpLockoutMs !== void 0 ? { perIpLockoutMs: config.auth.perIpLockoutMs } : {},
+						now
+					});
+				}
+				mountRoutes(app, config, {
+					version,
+					startedAt,
+					now,
+					agents,
+					workflows,
+					runs,
+					store,
+					metricRegistry,
+					...options.sessions !== void 0 ? { sessions: options.sessions } : {},
+					...options.memory !== void 0 ? { memory: options.memory } : {},
+					...options.skills !== void 0 ? { skills: options.skills } : {},
+					...options.mcp !== void 0 ? { mcp: options.mcp } : {},
+					...options.audit !== void 0 ? { audit: options.audit } : {},
+					...options.replay !== void 0 ? { replay: options.replay } : {},
+					...options.healthProbes !== void 0 ? { healthProbes: options.healthProbes } : {},
+					...verifier !== void 0 ? { verifier } : {},
+					...auditDb !== void 0 ? { auditDb } : {},
+					...pepperHandle !== void 0 ? { pepper: pepperHandle } : {},
+					...dispatcher !== void 0 ? { wsDispatcher: dispatcher } : {},
+					...tickets !== void 0 ? { wsTickets: tickets } : {},
+					...wsAdapter !== void 0 ? { wsAdapter } : {},
+					...triggersDaemon !== void 0 ? { triggersDaemon } : {},
+					...consolidatorDaemon !== void 0 ? { consolidatorDaemon } : {}
+				});
+				if (consolidatorDaemon !== void 0) {
+					await consolidatorDaemon.start();
+					if (triggersDaemon !== void 0 && consolidatorDaemon.consolidator.registerWithScheduler !== void 0) await consolidatorDaemon.consolidator.registerWithScheduler(triggersDaemon.scheduler);
+				}
+				if (triggersDaemon !== void 0) await triggersDaemon.start();
+				try {
+					const wal = readWalSize(store.connection);
+					metricRegistry.set(SERVER_METRIC_NAMES.storageWalSize, wal);
+				} catch {}
+				metricRegistry.set(SERVER_METRIC_NAMES.serverUptime, Math.max(0, Math.floor((now() - startedAt) / 1e3)));
+				metricRegistry.set(SERVER_METRIC_NAMES.inflightRuns, runs.runningCount());
+				metricRegistry.set(SERVER_METRIC_NAMES.replayBufferEvents, 0);
+				stopRunPruning = scheduleRunPruning(runs, now);
+				if (options.skipListen !== true) {
+					serverInstance = serve({
+						fetch: app.fetch.bind(app),
+						hostname: config.server.host,
+						port: config.server.port
+					});
+					if (wsAdapter !== void 0 && serverInstance !== void 0) wsAdapter.injectWebSocket(serverInstance);
+					await new Promise((resolve) => {
+						const server = serverInstance;
+						if ("once" in server && typeof server.once === "function") server.once("listening", () => resolve());
+						else setImmediate(() => resolve());
+					});
+					const address = serverInstance.address();
+					if (address !== null && typeof address === "object") listening = {
+						host: address.address,
+						port: address.port
+					};
+					else listening = {
+						host: config.server.host,
+						port: config.server.port
+					};
+				} else listening = {
+					host: config.server.host,
+					port: config.server.port
+				};
+				if (options.hooks?.onReady !== void 0) await options.hooks.onReady({
+					config,
+					listeningOn: listening
+				});
+				return listening;
+			} catch (err) {
+				started = false;
+				await emitError(options.hooks, {
+					error: err,
+					phase: "beforeStart"
+				});
+				throw err;
+			}
+		},
+		async stop({ force } = {}) {
+			if (!started) throw new LifecycleNotStartedError();
+			if (stopped) return;
+			stopped = true;
+			stopRunPruning?.();
+			stopRunPruning = void 0;
+			const drainTimeoutMs = force === true ? 0 : config.server.shutdown.drainTimeoutMs;
+			try {
+				if (options.hooks?.beforeShutdown !== void 0) await options.hooks.beforeShutdown({
+					config,
+					inflight: runs.inflightCount(),
+					drainTimeoutMs
+				});
+			} catch (err) {
+				await emitError(options.hooks, {
+					error: err,
+					phase: "beforeShutdown"
+				});
+			}
+			if (triggersDaemon !== void 0) try {
+				await triggersDaemon.stop();
+			} catch (err) {
+				await emitError(options.hooks, {
+					error: err,
+					phase: "beforeShutdown"
+				});
+			}
+			if (consolidatorDaemon !== void 0) try {
+				await consolidatorDaemon.stop();
+			} catch (err) {
+				await emitError(options.hooks, {
+					error: err,
+					phase: "beforeShutdown"
+				});
+			}
+			runs.abortPending("server-shutdown");
+			if (!await drainInFlight(runs, drainTimeoutMs, now) && drainTimeoutMs > 0) runs.abortAll(new ShutdownTimeoutError(drainTimeoutMs, runs.runningCount()));
+			if (dispatcher !== void 0) try {
+				dispatcher.shutdown();
+			} catch {}
+			if (serverInstance !== void 0) {
+				await new Promise((resolve) => {
+					serverInstance.close(() => resolve());
+				});
+				serverInstance = void 0;
+			}
+			if (auditDb !== void 0) {
+				await auditDb.close();
+				auditDb = void 0;
+			}
+			await store.close();
+			listening = void 0;
+			verifier = void 0;
+			started = false;
+			preBind = void 0;
+			dispatcher = void 0;
+			tickets = void 0;
+			wsAdapter = void 0;
+		}
+	};
+}
+/** IP-23: is `host` a loopback interface (so an open /metrics is not exposed)? */
+function isLoopbackHost(host) {
+	const h = host.trim().toLowerCase();
+	return h === "127.0.0.1" || h === "::1" || h === "[::1]" || h === "localhost";
+}
+function mountRoutes(app, config, ctx) {
+	const base = config.server.basePath;
+	const probes = ctx.healthProbes ?? (() => buildDefaultHealthProbes(ctx.store, ctx.triggersDaemon, ctx.consolidatorDaemon, ctx.wsDispatcher, config));
+	const health = createExtendedHealthRoutes({
+		version: ctx.version,
+		startedAt: ctx.startedAt,
+		now: ctx.now,
+		probes
+	});
+	app.route(`${base}/health`, health);
+	if (config.auth.kind === "none" && !isLoopbackHost(config.server.host)) console.warn(`[graphorin/server] WARN: auth.kind='none' disables authentication on every endpoint, but the server binds the non-loopback host '${config.server.host}'. Anyone who can reach it has full admin access — use auth.kind='token' for non-loopback deployments or bind a loopback host.`);
+	if (config.metrics.enabled) {
+		if (!config.metrics.requireAuth && !isLoopbackHost(config.server.host)) console.warn(`[graphorin/server] WARN: /metrics is unauthenticated (metrics.requireAuth=false) and the server binds the non-loopback host '${config.server.host}'. The exposition leaks operational detail to anyone who can reach it — set metrics.requireAuth=true or bind a loopback host.`);
+		const metricsRoute = createMetricsRoutes({
+			registry: ctx.metricRegistry,
+			requireAuth: config.metrics.requireAuth,
+			refresh: () => refreshLiveMetrics({
+				registry: ctx.metricRegistry,
+				store: ctx.store,
+				runs: ctx.runs,
+				startedAt: ctx.startedAt,
+				now: ctx.now,
+				...ctx.triggersDaemon !== void 0 ? { triggersDaemon: ctx.triggersDaemon } : {},
+				...ctx.consolidatorDaemon !== void 0 ? { consolidatorDaemon: ctx.consolidatorDaemon } : {},
+				...ctx.wsDispatcher !== void 0 ? { wsDispatcher: ctx.wsDispatcher } : {}
+			})
+		});
+		app.route(`${base}${config.metrics.path}`, metricsRoute);
+	}
+	const wsUpgradePath = config.server.ws.enabled ? `${base}${config.server.ws.path}` : void 0;
+	const metricsPath = config.metrics.enabled && !config.metrics.requireAuth ? `${base}${config.metrics.path}` : void 0;
+	function shouldSkipAuth(path) {
+		if (path === `${base}/health` || path === `${base}/health/`) return true;
+		if (wsUpgradePath !== void 0) {
+			if (path === wsUpgradePath || path === `${wsUpgradePath}/`) return true;
+		}
+		if (metricsPath !== void 0) {
+			if (path === metricsPath || path === `${metricsPath}/`) return true;
+		}
+		return false;
+	}
+	const anonymousAuth = ctx.verifier === void 0 && config.auth.kind === "none";
+	if (ctx.verifier !== void 0 || anonymousAuth) {
+		const authMw = ctx.verifier !== void 0 ? createAuthMiddleware({ verifier: ctx.verifier }) : createAnonymousAuthMiddleware();
+		app.use(`${base}/*`, async (c, next) => {
+			if (shouldSkipAuth(c.req.path)) {
+				await next();
+				return;
+			}
+			return authMw(c, next);
+		});
+		if (ctx.auditDb !== void 0) {
+			const auditMw = createAuditMiddleware({
+				auditDb: ctx.auditDb,
+				now: ctx.now
+			});
+			app.use(`${base}/*`, async (c, next) => {
+				if (shouldSkipAuth(c.req.path)) {
+					await next();
+					return;
+				}
+				return auditMw(c, next);
+			});
+		}
+	}
+	if (config.server.idempotency.enabled) {
+		const idempotencyMw = createIdempotencyMiddleware({
+			store: ctx.store.idempotency,
+			config: config.server.idempotency,
+			now: ctx.now,
+			excludeResponseCachePaths: [`${base}/tokens`],
+			metricRegistry: ctx.metricRegistry
+		});
+		app.use(`${base}/*`, async (c, next) => {
+			if (shouldSkipAuth(c.req.path)) {
+				await next();
+				return;
+			}
+			return idempotencyMw(c, next);
+		});
+	}
+	app.route(`${base}/health/secrets`, createSecretsHealthRoutes());
+	app.route(`${base}/agents`, createAgentRoutes({
+		agents: ctx.agents,
+		runs: ctx.runs,
+		...ctx.wsDispatcher !== void 0 ? { dispatcher: ctx.wsDispatcher } : {}
+	}));
+	app.route(`${base}/runs`, createRunRoutes({
+		agents: ctx.agents,
+		runs: ctx.runs
+	}));
+	app.route(`${base}/workflows`, createWorkflowRoutes({
+		workflows: ctx.workflows,
+		runs: ctx.runs,
+		...ctx.wsDispatcher !== void 0 ? { dispatcher: ctx.wsDispatcher } : {}
+	}));
+	if (ctx.sessions !== void 0) app.route(`${base}/sessions`, createSessionRoutes({ sessions: ctx.sessions }));
+	if (ctx.memory !== void 0) app.route(`${base}/memory`, createMemoryRoutes({ memory: ctx.memory }));
+	if (ctx.skills !== void 0) app.route(`${base}/skills`, createSkillsRoutes({ skills: ctx.skills }));
+	if (ctx.mcp !== void 0) app.route(`${base}/mcp`, createMcpRoutes({ mcp: ctx.mcp }));
+	if (ctx.audit !== void 0) app.route(`${base}/audit`, createAuditRoutes({ audit: ctx.audit }));
+	if (ctx.triggersDaemon !== void 0) app.route(`${base}/triggers`, createTriggersRoutes({ daemon: ctx.triggersDaemon }));
+	if (ctx.replay !== void 0) app.route(`${base}`, createReplayRoutes({
+		replay: ctx.replay,
+		...ctx.auditDb !== void 0 ? { auditDb: ctx.auditDb } : {},
+		now: ctx.now
+	}));
+	if (config.auth.kind === "token" && ctx.pepper !== void 0) app.route(`${base}/tokens`, createTokensRoutes({
+		tokenStore: ctx.store.authTokens,
+		pepper: ctx.pepper,
+		defaultEnv: "live",
+		allowedEnvs: config.auth.tokenEnvironments
+	}));
+	if (ctx.wsTickets !== void 0) app.route(`${base}`, createAuthRoutes({ tickets: ctx.wsTickets }));
+	if (ctx.wsDispatcher !== void 0 && ctx.wsTickets !== void 0 && ctx.wsAdapter !== void 0 && (ctx.verifier !== void 0 || anonymousAuth) && config.server.ws.enabled) {
+		const dispatcher = ctx.wsDispatcher;
+		const tickets = ctx.wsTickets;
+		const verifier = ctx.verifier;
+		const runs = ctx.runs;
+		app.get(`${base}${config.server.ws.path}`, ctx.wsAdapter.upgradeWebSocket((c) => createWsUpgradeEvents(c, {
+			dispatcher,
+			tickets,
+			...verifier !== void 0 ? { verifier } : {},
+			anonymous: anonymousAuth,
+			runs,
+			now: ctx.now
+		})));
+	}
+	if (ctx.wsDispatcher !== void 0 && config.server.sse.enabled) app.route(`${base}${config.server.sse.path}`, createSseRoutes({
+		dispatcher: ctx.wsDispatcher,
+		keepAliveMs: config.server.sse.keepAliveMs,
+		perConnectionQueueLimit: config.server.stream.perConnectionQueueLimit,
+		now: ctx.now
+	}));
+}
+async function drainInFlight(runs, drainTimeoutMs, now) {
+	if (runs.runningCount() === 0) return true;
+	if (drainTimeoutMs <= 0) return runs.runningCount() === 0;
+	const deadline = now() + drainTimeoutMs;
+	while (now() < deadline) {
+		if (runs.runningCount() === 0) return true;
+		await new Promise((resolve) => setTimeout(resolve, Math.min(50, deadline - now())));
+	}
+	return runs.runningCount() === 0;
+}
+async function emitError(hooks, ctx) {
+	if (hooks?.onError === void 0) return;
+	try {
+		await hooks.onError(ctx);
+	} catch {}
+}
+async function refreshLiveMetrics(options) {
+	const { registry, store, runs, startedAt, now } = options;
+	try {
+		const wal = readWalSize(store.connection);
+		registry.set(SERVER_METRIC_NAMES.storageWalSize, wal);
+	} catch {}
+	registry.set(SERVER_METRIC_NAMES.serverUptime, Math.max(0, Math.floor((now() - startedAt) / 1e3)));
+	registry.set(SERVER_METRIC_NAMES.inflightRuns, runs.runningCount());
+	if (options.wsDispatcher !== void 0) {
+		const sizes = options.wsDispatcher.size();
+		registry.set(SERVER_METRIC_NAMES.replayBufferEvents, sizes.subscriptions);
+	}
+	if (options.triggersDaemon !== void 0) {
+		const metrics = options.triggersDaemon.metrics();
+		for (const [triggerId, counts] of metrics.fires) {
+			const sanitized = sanitizeMetricLabelValue(triggerId);
+			const successCurrent = readCounter(registry, SERVER_METRIC_NAMES.triggersFiresTotal, {
+				trigger_id: sanitized,
+				status: "success"
+			});
+			const errorCurrent = readCounter(registry, SERVER_METRIC_NAMES.triggersFiresTotal, {
+				trigger_id: sanitized,
+				status: "error"
+			});
+			const successDelta = counts.success - successCurrent;
+			const errorDelta = counts.error - errorCurrent;
+			if (successDelta > 0) registry.inc(SERVER_METRIC_NAMES.triggersFiresTotal, {
+				trigger_id: sanitized,
+				status: "success"
+			}, successDelta);
+			if (errorDelta > 0) registry.inc(SERVER_METRIC_NAMES.triggersFiresTotal, {
+				trigger_id: sanitized,
+				status: "error"
+			}, errorDelta);
+		}
+	}
+	if (options.consolidatorDaemon !== void 0) try {
+		const status = await options.consolidatorDaemon.status();
+		registry.set(SERVER_METRIC_NAMES.consolidatorQueueDepth, status.queueDepth, { phase: "aggregate" });
+		registry.set(SERVER_METRIC_NAMES.consolidatorDlqSize, status.dlqSize);
+		registry.set(SERVER_METRIC_NAMES.consolidatorBudgetRemainingUsd, status.budget.costRemaining);
+		registry.set(SERVER_METRIC_NAMES.consolidatorBudgetRemainingTokens, status.budget.tokensRemaining);
+	} catch {}
+}
+/**
+* Convert an arbitrary user-supplied identifier (trigger id) into a
+* Prometheus-safe label value. Replaces every character outside the
+* `[A-Za-z0-9_:]` range with `_`. This guarantees the cardinality
+* never explodes on UTF-8 sequences while keeping the value
+* recognizable.
+*/
+function sanitizeMetricLabelValue(value) {
+	return value.replace(/[^A-Za-z0-9_:.-]/g, "_").slice(0, 200);
+}
+function readCounter(registry, name, labels) {
+	const snap = registry.snapshot().counters[name] ?? [];
+	for (const entry of snap) if (matchesLabels(entry.labels, labels)) return entry.value;
+	return 0;
+}
+function matchesLabels(a, b) {
+	for (const k of Object.keys(b)) if (String(a[k]) !== b[k]) return false;
+	for (const k of Object.keys(a)) if (!(k in b)) return false;
+	return true;
+}
+function buildDefaultHealthProbes(store, triggersDaemon, consolidatorDaemon, dispatcher, config) {
+	const out = {
+		store,
+		walWarnThresholdBytes: config.health.walWarnThresholdBytes,
+		encryptionEnabled: config.storage.encryption.enabled,
+		...config.storage.encryption.enabled ? { cipherPeerInstalled: true } : {}
+	};
+	if (triggersDaemon !== void 0) out.triggers = triggersDaemon;
+	if (consolidatorDaemon !== void 0) out.consolidator = consolidatorDaemon;
+	if (dispatcher !== void 0) {
+		const sizes = dispatcher.size();
+		out.replayBuffer = {
+			eventsBuffered: sizes.subscriptions,
+			subscribers: sizes.subscribers,
+			subscriptions: sizes.subscriptions
+		};
+	}
+	return Object.freeze(out);
+}
+async function fallbackPepper(skipHardening) {
+	if (!skipHardening) throw new Error("[graphorin/server] missing resolved pepper after pre-bind; auth.pepperRef is required when auth.kind = token.");
+	return generatePepper();
+}
+
+//#endregion
+export { createServer, ensureStoreAuditBinding };
+//# sourceMappingURL=app.js.map