@graphorin/server 0.6.0 → 0.7.0

package/dist/health/checks.d.ts

@@ -1,5 +1,6 @@
 import { ConsolidatorDaemon } from "../consolidator/daemon.js";
 import { TriggersDaemon } from "../triggers/daemon.js";
+import { WorkflowTimerDaemon } from "../workflows/timer-daemon.js";
 import { GraphorinSqliteStore } from "@graphorin/store-sqlite";
 
 //#region src/health/checks.d.ts
@@ -73,7 +74,18 @@ interface ReplayBufferCheck extends BaseHealthCheck {
   readonly subscriptions?: number;
 }
 /** @stable */
-type HealthCheck = StorageCheck | EmbedderCheck | SecretsCheck | EncryptionCheck | ConsolidatorCheck | TriggersCheck | ReplayBufferCheck;
+type HealthCheck = StorageCheck | EmbedderCheck | SecretsCheck | EncryptionCheck | ConsolidatorCheck | TriggersCheck | WorkflowTimersCheck | ReplayBufferCheck;
+/** W-032: durable-timer driver health. @stable */
+interface WorkflowTimersCheck {
+  readonly status: HealthStatus;
+  readonly running: boolean;
+  readonly sweeps: number;
+  readonly fired: number;
+  readonly errors: number;
+  readonly lastSweepAt?: string;
+  readonly nextWakeAt?: string;
+  readonly message?: string;
+}
 /** @stable */
 interface HealthChecks {
   readonly storage?: StorageCheck;
@@ -82,6 +94,7 @@ interface HealthChecks {
   readonly encryption?: EncryptionCheck;
   readonly consolidator?: ConsolidatorCheck;
   readonly triggers?: TriggersCheck;
+  readonly workflowTimers?: WorkflowTimersCheck;
   readonly replayBuffer?: ReplayBufferCheck;
 }
 /** @stable */
@@ -93,6 +106,7 @@ interface HealthSummary {
 interface HealthCheckOptions {
   readonly store?: GraphorinSqliteStore;
   readonly triggers?: TriggersDaemon;
+  readonly workflowTimers?: WorkflowTimerDaemon;
   readonly consolidator?: ConsolidatorDaemon;
   readonly replayBuffer?: ReplayBufferProbe;
   readonly secretsActive?: string;

package/dist/health/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","names":[],"sources":["../../src/health/checks.ts"],"sourcesContent":[],"mappings":";;;;;;AA2FA;AAOY,UA/EK,iBAAA,CA+EM;EACnB;EACA,SAAA,cAAA,EAAA,MAAA;EACA,SAAA,WAAA,CAAA,EAAA,MAAA;EACA,SAAA,aAAA,CAAA,EAAA,MAAA;;;AAGA,KA9EQ,YAAA,GA8ER,IAAA,GAAA,MAAA,GAAA,MAAA;;AAGa,KA9EL,YAAA,GA8EiB,IAAA,GAAA,UAAA,GAAA,SAAA;;;;;;;;AAOc,UA5E1B,eAAA,CA4E0B;EAI1B,SAAA,MAAA,EA/EE,YAgFA;EAKF,SAAA,OAAA,CAAA,EAAA,MAAkB;;;AAGT,UAnFT,YAAA,SAAqB,eAmFZ,CAAA;EACA,SAAA,YAAA,EAAA,MAAA;EAAiB,SAAA,kBAAA,EAAA,MAAA;EAiBrB,SAAA,gBAAa,CAAA,EAAA,MAAA;;;AAA+B,UA9FjD,aAAA,SAAsB,eA8F2B,CAAA;EAAO,SAAA,WAAA,EAAA,OAAA;EAuHzD,SAAM,KAAA,CAAA,EAAA,MAAS;;;UA/Md,YAAA,SAAqB;;;;UAKrB,eAAA,SAAwB;;;;;UAMxB,iBAAA,SAA0B;;;;;;;;;;;;UAa1B,aAAA,SAAsB;;;;;;;;UAStB,iBAAA,SAA0B;;;;;;KAO/B,WAAA,GACR,eACA,gBACA,eACA,kBACA,oBACA,gBACA;;UAGa,YAAA;qBACI;sBACC;qBACD;wBACG;0BACE;sBACJ;0BACI;;;UAIT,aAAA;mBACE;mBACA;;;UAIF,kBAAA;mBACE;sBACG;0BACI;0BACA;;;;;;;;;;;;;;iBAiBJ,aAAA,UAAuB,qBAAqB,QAAQ;;;;;;iBAuH1D,MAAA,SAAe,eAAe"}
+{"version":3,"file":"checks.d.ts","names":[],"sources":["../../src/health/checks.ts"],"sourcesContent":[],"mappings":";;;;;;;AA4FA;AAOY,UA/EK,iBAAA,CA+EM;EACnB;EACA,SAAA,cAAA,EAAA,MAAA;EACA,SAAA,WAAA,CAAA,EAAA,MAAA;EACA,SAAA,aAAA,CAAA,EAAA,MAAA;;;AAGA,KA9EQ,YAAA,GA8ER,IAAA,GAAA,MAAA,GAAA,MAAA;;AACiB,KA5ET,YAAA,GA4ES,IAAA,GAAA,UAAA,GAAA,SAAA;AAGrB;AAYA;;;;;;AAMsB,UAxFL,eAAA,CAwFK;EACM,SAAA,MAAA,EAxFT,YAwFS;EACF,SAAA,OAAA,CAAA,EAAA,MAAA;;AAI1B;AAMiB,UA9FA,YAAA,SAAqB,eA8FH,CAAA;EAChB,SAAA,YAAA,EAAA,MAAA;EACG,SAAA,kBAAA,EAAA,MAAA;EACM,SAAA,gBAAA,CAAA,EAAA,MAAA;;;AAEe,UA5F1B,aAAA,SAAsB,eA4FI,CAAA;EAiBrB,SAAA,WAAa,EAAA,OAAA;EAAU,SAAA,KAAA,CAAA,EAAA,MAAA;;;AAA4B,UAvGxD,YAAA,SAAqB,eAuGmC,CAAA;EA+IzD,SAAM,WAAA,EAAS,MAAA;;;UAjPd,eAAA,SAAwB;;;;;UAMxB,iBAAA,SAA0B;;;;;;;;;;;;UAa1B,aAAA,SAAsB;;;;;;;;UAStB,iBAAA,SAA0B;;;;;;KAO/B,WAAA,GACR,eACA,gBACA,eACA,kBACA,oBACA,gBACA,sBACA;;UAGa,mBAAA;mBACE;;;;;;;;;;UAWF,YAAA;qBACI;sBACC;qBACD;wBACG;0BACE;sBACJ;4BACM;0BACF;;;UAIT,aAAA;mBACE;mBACA;;;UAIF,kBAAA;mBACE;sBACG;4BACM;0BACF;0BACA;;;;;;;;;;;;;;iBAiBJ,aAAA,UAAuB,qBAAqB,QAAQ;;;;;;iBA+I1D,MAAA,SAAe,eAAe"}

package/dist/health/checks.js

@@ -85,6 +85,27 @@ async function collectHealth(options) {
 			message: err instanceof Error ? err.message : String(err)
 		};
 	}
+	if (options.workflowTimers !== void 0) try {
+		const status$1 = await options.workflowTimers.status();
+		checks.workflowTimers = {
+			status: status$1.errors > 0 ? "warn" : "ok",
+			running: status$1.running,
+			sweeps: status$1.sweeps,
+			fired: status$1.fired,
+			errors: status$1.errors,
+			...status$1.lastSweepAt !== void 0 ? { lastSweepAt: status$1.lastSweepAt } : {},
+			...status$1.nextWakeAt !== void 0 ? { nextWakeAt: status$1.nextWakeAt } : {}
+		};
+	} catch (err) {
+		checks.workflowTimers = {
+			status: "fail",
+			running: false,
+			sweeps: 0,
+			fired: 0,
+			errors: 0,
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
 	if (options.replayBuffer !== void 0) {
 		const probe = options.replayBuffer;
 		checks.replayBuffer = {

package/dist/health/checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"checks.js","names":["checks: {\n    -readonly [K in keyof HealthChecks]?: HealthChecks[K];\n  }","status","overall: HealthStatus","worst: HealthRollup"],"sources":["../../src/health/checks.ts"],"sourcesContent":["/**\n * Per-subsystem health checks aggregated by `/v1/health`. Every check\n * resolves to `'ok' | 'warn' | 'fail'`; the aggregator promotes the\n * worst status to the top-level rollup.\n *\n * The serialized shape is **flat**: each check carries its detail\n * fields directly on the same object as the `status` discriminator\n * - no nested `detail` wrapper - matching the documented response\n * contract exactly.\n *\n * @packageDocumentation\n */\n\nimport type { GraphorinSqliteStore } from '@graphorin/store-sqlite';\nimport { readWalSize } from '@graphorin/store-sqlite';\nimport type { ConsolidatorDaemon } from '../consolidator/daemon.js';\nimport type { TriggersDaemon } from '../triggers/daemon.js';\n\n/** @stable */\nexport interface ReplayBufferProbe {\n  /** Total events buffered across all subjects. Aggregated by the caller. */\n  readonly eventsBuffered: number;\n  readonly subscribers?: number;\n  readonly subscriptions?: number;\n}\n\n/** @stable */\nexport type HealthStatus = 'ok' | 'warn' | 'fail';\n\n/** @stable */\nexport type HealthRollup = 'ok' | 'degraded' | 'failing';\n\n/**\n * Common discriminator carried on every per-subsystem check entry.\n * Concrete shapes extend this with subsystem-specific fields per the\n * documented contract.\n *\n * @stable\n */\nexport interface BaseHealthCheck {\n  readonly status: HealthStatus;\n  readonly message?: string;\n}\n\n/** @stable */\nexport interface StorageCheck extends BaseHealthCheck {\n  readonly walSizeBytes: number;\n  readonly warnThresholdBytes: number;\n  readonly lastCheckpointAt?: string;\n}\n\n/** @stable */\nexport interface EmbedderCheck extends BaseHealthCheck {\n  readonly modelLoaded: boolean;\n  readonly model?: string;\n}\n\n/** @stable */\nexport interface SecretsCheck extends BaseHealthCheck {\n  readonly activeStore: string;\n}\n\n/** @stable */\nexport interface EncryptionCheck extends BaseHealthCheck {\n  readonly enabled: boolean;\n  readonly peerDepInstalled: boolean;\n}\n\n/** @stable */\nexport interface ConsolidatorCheck extends BaseHealthCheck {\n  readonly tier: string;\n  readonly running: boolean;\n  readonly paused: boolean;\n  readonly queueDepth: number;\n  readonly dlqSize: number;\n  readonly budgetRemaining: {\n    readonly tokens: number;\n    readonly costUsd: number;\n  };\n}\n\n/** @stable */\nexport interface TriggersCheck extends BaseHealthCheck {\n  readonly running: boolean;\n  readonly active: number;\n  readonly disabled: number;\n  readonly deferred: number;\n  readonly lastFireAt?: string;\n}\n\n/** @stable */\nexport interface ReplayBufferCheck extends BaseHealthCheck {\n  readonly eventsBuffered: number;\n  readonly subscribers?: number;\n  readonly subscriptions?: number;\n}\n\n/** @stable */\nexport type HealthCheck =\n  | StorageCheck\n  | EmbedderCheck\n  | SecretsCheck\n  | EncryptionCheck\n  | ConsolidatorCheck\n  | TriggersCheck\n  | ReplayBufferCheck;\n\n/** @stable */\nexport interface HealthChecks {\n  readonly storage?: StorageCheck;\n  readonly embedder?: EmbedderCheck;\n  readonly secrets?: SecretsCheck;\n  readonly encryption?: EncryptionCheck;\n  readonly consolidator?: ConsolidatorCheck;\n  readonly triggers?: TriggersCheck;\n  readonly replayBuffer?: ReplayBufferCheck;\n}\n\n/** @stable */\nexport interface HealthSummary {\n  readonly status: HealthRollup;\n  readonly checks: HealthChecks;\n}\n\n/** @stable */\nexport interface HealthCheckOptions {\n  readonly store?: GraphorinSqliteStore;\n  readonly triggers?: TriggersDaemon;\n  readonly consolidator?: ConsolidatorDaemon;\n  readonly replayBuffer?: ReplayBufferProbe;\n  readonly secretsActive?: string;\n  readonly encryptionEnabled?: boolean;\n  readonly cipherPeerInstalled?: boolean;\n  readonly embedderModel?: string;\n  readonly embedderLoaded?: boolean;\n  /** Highest acceptable WAL size in bytes before warning. Default 50 MB. */\n  readonly walWarnThresholdBytes?: number;\n}\n\nconst DEFAULT_WAL_WARN_THRESHOLD_BYTES = 50 * 1024 * 1024;\n\n/**\n * Build the aggregate health summary from runtime probes.\n *\n * @stable\n */\nexport async function collectHealth(options: HealthCheckOptions): Promise<HealthSummary> {\n  const checks: {\n    -readonly [K in keyof HealthChecks]?: HealthChecks[K];\n  } = {};\n\n  if (options.store !== undefined) {\n    const walSize = readWalSizeSafely(options.store);\n    const threshold = options.walWarnThresholdBytes ?? DEFAULT_WAL_WARN_THRESHOLD_BYTES;\n    const status: HealthStatus = walSize > threshold ? 'warn' : 'ok';\n    checks.storage = {\n      status,\n      walSizeBytes: walSize,\n      warnThresholdBytes: threshold,\n    };\n  }\n\n  if (options.embedderLoaded !== undefined) {\n    checks.embedder = {\n      status: options.embedderLoaded ? 'ok' : 'warn',\n      modelLoaded: options.embedderLoaded,\n      ...(options.embedderModel !== undefined ? { model: options.embedderModel } : {}),\n    };\n  }\n\n  if (options.secretsActive !== undefined) {\n    checks.secrets = {\n      status: 'ok',\n      activeStore: options.secretsActive,\n    };\n  }\n\n  if (options.encryptionEnabled !== undefined) {\n    // IP-1: a server that is serving this health endpoint with\n    // encryption enabled has already opened the store WITH its key at\n    // boot (createServer threads the resolved passphrase into\n    // createSqliteStore and fails fast otherwise) - that successful\n    // keyed open is the factual basis of this check. 'fail' is\n    // reserved for an explicit negative cipher-peer probe; the old\n    // default blamed a missing peer dep on every encrypted boot.\n    const peerDepInstalled = options.cipherPeerInstalled ?? true;\n    checks.encryption = {\n      status: options.encryptionEnabled && peerDepInstalled === false ? 'fail' : 'ok',\n      enabled: options.encryptionEnabled,\n      peerDepInstalled,\n    };\n  }\n\n  if (options.consolidator !== undefined) {\n    try {\n      const status = await options.consolidator.status();\n      const overall: HealthStatus = status.dlqSize > 0 ? 'warn' : 'ok';\n      checks.consolidator = {\n        status: status.paused ? 'warn' : overall,\n        tier: status.tier,\n        running: status.running,\n        paused: status.paused,\n        queueDepth: status.queueDepth,\n        dlqSize: status.dlqSize,\n        budgetRemaining: {\n          tokens: status.budget.tokensRemaining,\n          costUsd: status.budget.costRemaining,\n        },\n      };\n    } catch (err) {\n      checks.consolidator = {\n        status: 'fail',\n        tier: 'unknown',\n        running: false,\n        paused: false,\n        queueDepth: 0,\n        dlqSize: 0,\n        budgetRemaining: { tokens: 0, costUsd: 0 },\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  if (options.triggers !== undefined) {\n    try {\n      const status = await options.triggers.status();\n      checks.triggers = {\n        status: 'ok',\n        running: status.running,\n        active: status.active,\n        disabled: status.disabled,\n        deferred: status.deferred,\n        ...(status.lastFireAt !== undefined ? { lastFireAt: status.lastFireAt } : {}),\n      };\n    } catch (err) {\n      checks.triggers = {\n        status: 'fail',\n        running: false,\n        active: 0,\n        disabled: 0,\n        deferred: 0,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  if (options.replayBuffer !== undefined) {\n    const probe = options.replayBuffer;\n    checks.replayBuffer = {\n      status: 'ok',\n      eventsBuffered: probe.eventsBuffered,\n      ...(probe.subscribers !== undefined ? { subscribers: probe.subscribers } : {}),\n      ...(probe.subscriptions !== undefined ? { subscriptions: probe.subscriptions } : {}),\n    };\n  }\n\n  const status = rollup(checks);\n  return Object.freeze({ status, checks: Object.freeze(checks) as HealthChecks });\n}\n\n/**\n * Promote the worst per-check status to the rollup label.\n *\n * @stable\n */\nexport function rollup(checks: HealthChecks): HealthRollup {\n  let worst: HealthRollup = 'ok';\n  for (const value of Object.values(checks)) {\n    if (value === undefined) continue;\n    if (value.status === 'fail') return 'failing';\n    if (value.status === 'warn') worst = 'degraded';\n  }\n  return worst;\n}\n\nfunction readWalSizeSafely(store: GraphorinSqliteStore): number {\n  try {\n    return readWalSize(store.connection);\n  } catch {\n    return 0;\n  }\n}\n"],"mappings":";;;AA2IA,MAAM,mCAAmC,KAAK,OAAO;;;;;;AAOrD,eAAsB,cAAc,SAAqD;CACvF,MAAMA,SAEF,EAAE;AAEN,KAAI,QAAQ,UAAU,QAAW;EAC/B,MAAM,UAAU,kBAAkB,QAAQ,MAAM;EAChD,MAAM,YAAY,QAAQ,yBAAyB;AAEnD,SAAO,UAAU;GACf,QAF2B,UAAU,YAAY,SAAS;GAG1D,cAAc;GACd,oBAAoB;GACrB;;AAGH,KAAI,QAAQ,mBAAmB,OAC7B,QAAO,WAAW;EAChB,QAAQ,QAAQ,iBAAiB,OAAO;EACxC,aAAa,QAAQ;EACrB,GAAI,QAAQ,kBAAkB,SAAY,EAAE,OAAO,QAAQ,eAAe,GAAG,EAAE;EAChF;AAGH,KAAI,QAAQ,kBAAkB,OAC5B,QAAO,UAAU;EACf,QAAQ;EACR,aAAa,QAAQ;EACtB;AAGH,KAAI,QAAQ,sBAAsB,QAAW;EAQ3C,MAAM,mBAAmB,QAAQ,uBAAuB;AACxD,SAAO,aAAa;GAClB,QAAQ,QAAQ,qBAAqB,qBAAqB,QAAQ,SAAS;GAC3E,SAAS,QAAQ;GACjB;GACD;;AAGH,KAAI,QAAQ,iBAAiB,OAC3B,KAAI;EACF,MAAMC,WAAS,MAAM,QAAQ,aAAa,QAAQ;EAClD,MAAMC,UAAwBD,SAAO,UAAU,IAAI,SAAS;AAC5D,SAAO,eAAe;GACpB,QAAQA,SAAO,SAAS,SAAS;GACjC,MAAMA,SAAO;GACb,SAASA,SAAO;GAChB,QAAQA,SAAO;GACf,YAAYA,SAAO;GACnB,SAASA,SAAO;GAChB,iBAAiB;IACf,QAAQA,SAAO,OAAO;IACtB,SAASA,SAAO,OAAO;IACxB;GACF;UACM,KAAK;AACZ,SAAO,eAAe;GACpB,QAAQ;GACR,MAAM;GACN,SAAS;GACT,QAAQ;GACR,YAAY;GACZ,SAAS;GACT,iBAAiB;IAAE,QAAQ;IAAG,SAAS;IAAG;GAC1C,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC1D;;AAIL,KAAI,QAAQ,aAAa,OACvB,KAAI;EACF,MAAMA,WAAS,MAAM,QAAQ,SAAS,QAAQ;AAC9C,SAAO,WAAW;GAChB,QAAQ;GACR,SAASA,SAAO;GAChB,QAAQA,SAAO;GACf,UAAUA,SAAO;GACjB,UAAUA,SAAO;GACjB,GAAIA,SAAO,eAAe,SAAY,EAAE,YAAYA,SAAO,YAAY,GAAG,EAAE;GAC7E;UACM,KAAK;AACZ,SAAO,WAAW;GAChB,QAAQ;GACR,SAAS;GACT,QAAQ;GACR,UAAU;GACV,UAAU;GACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC1D;;AAIL,KAAI,QAAQ,iBAAiB,QAAW;EACtC,MAAM,QAAQ,QAAQ;AACtB,SAAO,eAAe;GACpB,QAAQ;GACR,gBAAgB,MAAM;GACtB,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,aAAa,GAAG,EAAE;GAC7E,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,MAAM,eAAe,GAAG,EAAE;GACpF;;CAGH,MAAM,SAAS,OAAO,OAAO;AAC7B,QAAO,OAAO,OAAO;EAAE;EAAQ,QAAQ,OAAO,OAAO,OAAO;EAAkB,CAAC;;;;;;;AAQjF,SAAgB,OAAO,QAAoC;CACzD,IAAIE,QAAsB;AAC1B,MAAK,MAAM,SAAS,OAAO,OAAO,OAAO,EAAE;AACzC,MAAI,UAAU,OAAW;AACzB,MAAI,MAAM,WAAW,OAAQ,QAAO;AACpC,MAAI,MAAM,WAAW,OAAQ,SAAQ;;AAEvC,QAAO;;AAGT,SAAS,kBAAkB,OAAqC;AAC9D,KAAI;AACF,SAAO,YAAY,MAAM,WAAW;SAC9B;AACN,SAAO"}
+{"version":3,"file":"checks.js","names":["checks: {\n    -readonly [K in keyof HealthChecks]?: HealthChecks[K];\n  }","status","overall: HealthStatus","worst: HealthRollup"],"sources":["../../src/health/checks.ts"],"sourcesContent":["/**\n * Per-subsystem health checks aggregated by `/v1/health`. Every check\n * resolves to `'ok' | 'warn' | 'fail'`; the aggregator promotes the\n * worst status to the top-level rollup.\n *\n * The serialized shape is **flat**: each check carries its detail\n * fields directly on the same object as the `status` discriminator\n * - no nested `detail` wrapper - matching the documented response\n * contract exactly.\n *\n * @packageDocumentation\n */\n\nimport type { GraphorinSqliteStore } from '@graphorin/store-sqlite';\nimport { readWalSize } from '@graphorin/store-sqlite';\nimport type { ConsolidatorDaemon } from '../consolidator/daemon.js';\nimport type { TriggersDaemon } from '../triggers/daemon.js';\nimport type { WorkflowTimerDaemon } from '../workflows/timer-daemon.js';\n\n/** @stable */\nexport interface ReplayBufferProbe {\n  /** Total events buffered across all subjects. Aggregated by the caller. */\n  readonly eventsBuffered: number;\n  readonly subscribers?: number;\n  readonly subscriptions?: number;\n}\n\n/** @stable */\nexport type HealthStatus = 'ok' | 'warn' | 'fail';\n\n/** @stable */\nexport type HealthRollup = 'ok' | 'degraded' | 'failing';\n\n/**\n * Common discriminator carried on every per-subsystem check entry.\n * Concrete shapes extend this with subsystem-specific fields per the\n * documented contract.\n *\n * @stable\n */\nexport interface BaseHealthCheck {\n  readonly status: HealthStatus;\n  readonly message?: string;\n}\n\n/** @stable */\nexport interface StorageCheck extends BaseHealthCheck {\n  readonly walSizeBytes: number;\n  readonly warnThresholdBytes: number;\n  readonly lastCheckpointAt?: string;\n}\n\n/** @stable */\nexport interface EmbedderCheck extends BaseHealthCheck {\n  readonly modelLoaded: boolean;\n  readonly model?: string;\n}\n\n/** @stable */\nexport interface SecretsCheck extends BaseHealthCheck {\n  readonly activeStore: string;\n}\n\n/** @stable */\nexport interface EncryptionCheck extends BaseHealthCheck {\n  readonly enabled: boolean;\n  readonly peerDepInstalled: boolean;\n}\n\n/** @stable */\nexport interface ConsolidatorCheck extends BaseHealthCheck {\n  readonly tier: string;\n  readonly running: boolean;\n  readonly paused: boolean;\n  readonly queueDepth: number;\n  readonly dlqSize: number;\n  readonly budgetRemaining: {\n    readonly tokens: number;\n    readonly costUsd: number;\n  };\n}\n\n/** @stable */\nexport interface TriggersCheck extends BaseHealthCheck {\n  readonly running: boolean;\n  readonly active: number;\n  readonly disabled: number;\n  readonly deferred: number;\n  readonly lastFireAt?: string;\n}\n\n/** @stable */\nexport interface ReplayBufferCheck extends BaseHealthCheck {\n  readonly eventsBuffered: number;\n  readonly subscribers?: number;\n  readonly subscriptions?: number;\n}\n\n/** @stable */\nexport type HealthCheck =\n  | StorageCheck\n  | EmbedderCheck\n  | SecretsCheck\n  | EncryptionCheck\n  | ConsolidatorCheck\n  | TriggersCheck\n  | WorkflowTimersCheck\n  | ReplayBufferCheck;\n\n/** W-032: durable-timer driver health. @stable */\nexport interface WorkflowTimersCheck {\n  readonly status: HealthStatus;\n  readonly running: boolean;\n  readonly sweeps: number;\n  readonly fired: number;\n  readonly errors: number;\n  readonly lastSweepAt?: string;\n  readonly nextWakeAt?: string;\n  readonly message?: string;\n}\n\n/** @stable */\nexport interface HealthChecks {\n  readonly storage?: StorageCheck;\n  readonly embedder?: EmbedderCheck;\n  readonly secrets?: SecretsCheck;\n  readonly encryption?: EncryptionCheck;\n  readonly consolidator?: ConsolidatorCheck;\n  readonly triggers?: TriggersCheck;\n  readonly workflowTimers?: WorkflowTimersCheck;\n  readonly replayBuffer?: ReplayBufferCheck;\n}\n\n/** @stable */\nexport interface HealthSummary {\n  readonly status: HealthRollup;\n  readonly checks: HealthChecks;\n}\n\n/** @stable */\nexport interface HealthCheckOptions {\n  readonly store?: GraphorinSqliteStore;\n  readonly triggers?: TriggersDaemon;\n  readonly workflowTimers?: WorkflowTimerDaemon;\n  readonly consolidator?: ConsolidatorDaemon;\n  readonly replayBuffer?: ReplayBufferProbe;\n  readonly secretsActive?: string;\n  readonly encryptionEnabled?: boolean;\n  readonly cipherPeerInstalled?: boolean;\n  readonly embedderModel?: string;\n  readonly embedderLoaded?: boolean;\n  /** Highest acceptable WAL size in bytes before warning. Default 50 MB. */\n  readonly walWarnThresholdBytes?: number;\n}\n\nconst DEFAULT_WAL_WARN_THRESHOLD_BYTES = 50 * 1024 * 1024;\n\n/**\n * Build the aggregate health summary from runtime probes.\n *\n * @stable\n */\nexport async function collectHealth(options: HealthCheckOptions): Promise<HealthSummary> {\n  const checks: {\n    -readonly [K in keyof HealthChecks]?: HealthChecks[K];\n  } = {};\n\n  if (options.store !== undefined) {\n    const walSize = readWalSizeSafely(options.store);\n    const threshold = options.walWarnThresholdBytes ?? DEFAULT_WAL_WARN_THRESHOLD_BYTES;\n    const status: HealthStatus = walSize > threshold ? 'warn' : 'ok';\n    checks.storage = {\n      status,\n      walSizeBytes: walSize,\n      warnThresholdBytes: threshold,\n    };\n  }\n\n  if (options.embedderLoaded !== undefined) {\n    checks.embedder = {\n      status: options.embedderLoaded ? 'ok' : 'warn',\n      modelLoaded: options.embedderLoaded,\n      ...(options.embedderModel !== undefined ? { model: options.embedderModel } : {}),\n    };\n  }\n\n  if (options.secretsActive !== undefined) {\n    checks.secrets = {\n      status: 'ok',\n      activeStore: options.secretsActive,\n    };\n  }\n\n  if (options.encryptionEnabled !== undefined) {\n    // IP-1: a server that is serving this health endpoint with\n    // encryption enabled has already opened the store WITH its key at\n    // boot (createServer threads the resolved passphrase into\n    // createSqliteStore and fails fast otherwise) - that successful\n    // keyed open is the factual basis of this check. 'fail' is\n    // reserved for an explicit negative cipher-peer probe; the old\n    // default blamed a missing peer dep on every encrypted boot.\n    const peerDepInstalled = options.cipherPeerInstalled ?? true;\n    checks.encryption = {\n      status: options.encryptionEnabled && peerDepInstalled === false ? 'fail' : 'ok',\n      enabled: options.encryptionEnabled,\n      peerDepInstalled,\n    };\n  }\n\n  if (options.consolidator !== undefined) {\n    try {\n      const status = await options.consolidator.status();\n      const overall: HealthStatus = status.dlqSize > 0 ? 'warn' : 'ok';\n      checks.consolidator = {\n        status: status.paused ? 'warn' : overall,\n        tier: status.tier,\n        running: status.running,\n        paused: status.paused,\n        queueDepth: status.queueDepth,\n        dlqSize: status.dlqSize,\n        budgetRemaining: {\n          tokens: status.budget.tokensRemaining,\n          costUsd: status.budget.costRemaining,\n        },\n      };\n    } catch (err) {\n      checks.consolidator = {\n        status: 'fail',\n        tier: 'unknown',\n        running: false,\n        paused: false,\n        queueDepth: 0,\n        dlqSize: 0,\n        budgetRemaining: { tokens: 0, costUsd: 0 },\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  if (options.triggers !== undefined) {\n    try {\n      const status = await options.triggers.status();\n      checks.triggers = {\n        status: 'ok',\n        running: status.running,\n        active: status.active,\n        disabled: status.disabled,\n        deferred: status.deferred,\n        ...(status.lastFireAt !== undefined ? { lastFireAt: status.lastFireAt } : {}),\n      };\n    } catch (err) {\n      checks.triggers = {\n        status: 'fail',\n        running: false,\n        active: 0,\n        disabled: 0,\n        deferred: 0,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  if (options.workflowTimers !== undefined) {\n    try {\n      const status = await options.workflowTimers.status();\n      checks.workflowTimers = {\n        status: status.errors > 0 ? 'warn' : 'ok',\n        running: status.running,\n        sweeps: status.sweeps,\n        fired: status.fired,\n        errors: status.errors,\n        ...(status.lastSweepAt !== undefined ? { lastSweepAt: status.lastSweepAt } : {}),\n        ...(status.nextWakeAt !== undefined ? { nextWakeAt: status.nextWakeAt } : {}),\n      };\n    } catch (err) {\n      checks.workflowTimers = {\n        status: 'fail',\n        running: false,\n        sweeps: 0,\n        fired: 0,\n        errors: 0,\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  if (options.replayBuffer !== undefined) {\n    const probe = options.replayBuffer;\n    checks.replayBuffer = {\n      status: 'ok',\n      eventsBuffered: probe.eventsBuffered,\n      ...(probe.subscribers !== undefined ? { subscribers: probe.subscribers } : {}),\n      ...(probe.subscriptions !== undefined ? { subscriptions: probe.subscriptions } : {}),\n    };\n  }\n\n  const status = rollup(checks);\n  return Object.freeze({ status, checks: Object.freeze(checks) as HealthChecks });\n}\n\n/**\n * Promote the worst per-check status to the rollup label.\n *\n * @stable\n */\nexport function rollup(checks: HealthChecks): HealthRollup {\n  let worst: HealthRollup = 'ok';\n  for (const value of Object.values(checks)) {\n    if (value === undefined) continue;\n    if (value.status === 'fail') return 'failing';\n    if (value.status === 'warn') worst = 'degraded';\n  }\n  return worst;\n}\n\nfunction readWalSizeSafely(store: GraphorinSqliteStore): number {\n  try {\n    return readWalSize(store.connection);\n  } catch {\n    return 0;\n  }\n}\n"],"mappings":";;;AA2JA,MAAM,mCAAmC,KAAK,OAAO;;;;;;AAOrD,eAAsB,cAAc,SAAqD;CACvF,MAAMA,SAEF,EAAE;AAEN,KAAI,QAAQ,UAAU,QAAW;EAC/B,MAAM,UAAU,kBAAkB,QAAQ,MAAM;EAChD,MAAM,YAAY,QAAQ,yBAAyB;AAEnD,SAAO,UAAU;GACf,QAF2B,UAAU,YAAY,SAAS;GAG1D,cAAc;GACd,oBAAoB;GACrB;;AAGH,KAAI,QAAQ,mBAAmB,OAC7B,QAAO,WAAW;EAChB,QAAQ,QAAQ,iBAAiB,OAAO;EACxC,aAAa,QAAQ;EACrB,GAAI,QAAQ,kBAAkB,SAAY,EAAE,OAAO,QAAQ,eAAe,GAAG,EAAE;EAChF;AAGH,KAAI,QAAQ,kBAAkB,OAC5B,QAAO,UAAU;EACf,QAAQ;EACR,aAAa,QAAQ;EACtB;AAGH,KAAI,QAAQ,sBAAsB,QAAW;EAQ3C,MAAM,mBAAmB,QAAQ,uBAAuB;AACxD,SAAO,aAAa;GAClB,QAAQ,QAAQ,qBAAqB,qBAAqB,QAAQ,SAAS;GAC3E,SAAS,QAAQ;GACjB;GACD;;AAGH,KAAI,QAAQ,iBAAiB,OAC3B,KAAI;EACF,MAAMC,WAAS,MAAM,QAAQ,aAAa,QAAQ;EAClD,MAAMC,UAAwBD,SAAO,UAAU,IAAI,SAAS;AAC5D,SAAO,eAAe;GACpB,QAAQA,SAAO,SAAS,SAAS;GACjC,MAAMA,SAAO;GACb,SAASA,SAAO;GAChB,QAAQA,SAAO;GACf,YAAYA,SAAO;GACnB,SAASA,SAAO;GAChB,iBAAiB;IACf,QAAQA,SAAO,OAAO;IACtB,SAASA,SAAO,OAAO;IACxB;GACF;UACM,KAAK;AACZ,SAAO,eAAe;GACpB,QAAQ;GACR,MAAM;GACN,SAAS;GACT,QAAQ;GACR,YAAY;GACZ,SAAS;GACT,iBAAiB;IAAE,QAAQ;IAAG,SAAS;IAAG;GAC1C,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC1D;;AAIL,KAAI,QAAQ,aAAa,OACvB,KAAI;EACF,MAAMA,WAAS,MAAM,QAAQ,SAAS,QAAQ;AAC9C,SAAO,WAAW;GAChB,QAAQ;GACR,SAASA,SAAO;GAChB,QAAQA,SAAO;GACf,UAAUA,SAAO;GACjB,UAAUA,SAAO;GACjB,GAAIA,SAAO,eAAe,SAAY,EAAE,YAAYA,SAAO,YAAY,GAAG,EAAE;GAC7E;UACM,KAAK;AACZ,SAAO,WAAW;GAChB,QAAQ;GACR,SAAS;GACT,QAAQ;GACR,UAAU;GACV,UAAU;GACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC1D;;AAIL,KAAI,QAAQ,mBAAmB,OAC7B,KAAI;EACF,MAAMA,WAAS,MAAM,QAAQ,eAAe,QAAQ;AACpD,SAAO,iBAAiB;GACtB,QAAQA,SAAO,SAAS,IAAI,SAAS;GACrC,SAASA,SAAO;GAChB,QAAQA,SAAO;GACf,OAAOA,SAAO;GACd,QAAQA,SAAO;GACf,GAAIA,SAAO,gBAAgB,SAAY,EAAE,aAAaA,SAAO,aAAa,GAAG,EAAE;GAC/E,GAAIA,SAAO,eAAe,SAAY,EAAE,YAAYA,SAAO,YAAY,GAAG,EAAE;GAC7E;UACM,KAAK;AACZ,SAAO,iBAAiB;GACtB,QAAQ;GACR,SAAS;GACT,QAAQ;GACR,OAAO;GACP,QAAQ;GACR,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC1D;;AAIL,KAAI,QAAQ,iBAAiB,QAAW;EACtC,MAAM,QAAQ,QAAQ;AACtB,SAAO,eAAe;GACpB,QAAQ;GACR,gBAAgB,MAAM;GACtB,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,aAAa,GAAG,EAAE;GAC7E,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,MAAM,eAAe,GAAG,EAAE;GACpF;;CAGH,MAAM,SAAS,OAAO,OAAO;AAC7B,QAAO,OAAO,OAAO;EAAE;EAAQ,QAAQ,OAAO,OAAO,OAAO;EAAkB,CAAC;;;;;;;AAQjF,SAAgB,OAAO,QAAoC;CACzD,IAAIE,QAAsB;AAC1B,MAAK,MAAM,SAAS,OAAO,OAAO,OAAO,EAAE;AACzC,MAAI,UAAU,OAAW;AACzB,MAAI,MAAM,WAAW,OAAQ,QAAO;AACpC,MAAI,MAAM,WAAW,OAAQ,SAAQ;;AAEvC,QAAO;;AAGT,SAAS,kBAAkB,OAAqC;AAC9D,KAAI;AACF,SAAO,YAAY,MAAM,WAAW;SAC9B;AACN,SAAO"}

package/dist/health/routes.js

@@ -1,5 +1,5 @@
-import { collectHealth } from "./checks.js";
 import { createScopeMiddleware } from "../middleware/scope.js";
+import { collectHealth } from "./checks.js";
 import { Hono } from "hono";
 import { getSecretsStoreStatus } from "@graphorin/security/secrets";
 

package/dist/index.d.ts

@@ -7,11 +7,13 @@ import { ConsolidatorDaemon, ConsolidatorLike, ConsolidatorStatusLike, CreateCon
 import "./consolidator/index.js";
 import { AgentNotFoundError, ConfigInvalidError, GraphorinServerError, GraphorinServerErrorCode, IdempotencyConflictError, IdempotencyKeyRequiredError, LifecycleDoubleStartError, LifecycleNotStartedError, MigrationFailedError, PrebindEncryptionPeerMissingError, PrebindEncryptionRequiredError, PrebindPepperMissingError, PrebindSecretUnresolvableError, RouteHandlerMissingError, ShutdownTimeoutError, WorkflowNotFoundError } from "./errors/index.js";
 import { CreateTriggersDaemonOptions, TriggersDaemon, TriggersDaemonMetrics, TriggersDaemonStatus, createTriggersDaemon, defaultCatchupPolicy } from "./triggers/daemon.js";
+import { CreateWorkflowTimerDaemonOptions, WorkflowTimerDaemon, WorkflowTimerDaemonStatus, WorkflowTimerDriverLike, createWorkflowTimerDaemon } from "./workflows/timer-daemon.js";
 import { BaseHealthCheck, ConsolidatorCheck, EmbedderCheck, EncryptionCheck, HealthCheck, HealthCheckOptions, HealthChecks, HealthRollup, HealthStatus, HealthSummary, ReplayBufferCheck, ReplayBufferProbe, SecretsCheck, StorageCheck, TriggersCheck, collectHealth, rollup } from "./health/checks.js";
 import { RequestToken, ServerRequestState, ServerVariables } from "./internal/context.js";
 import { LabelSet, MetricKind, MetricRegistry } from "./metrics/registry.js";
 import { HealthRouteOptions, MetricsRoutesOptions, createExtendedHealthRoutes, createMetricsRoutes, createSecretsHealthRoutes } from "./health/routes.js";
 import "./health/index.js";
+import { TriggersDaemonInput, WorkflowTimersInput } from "./app-daemons.js";
 import { BeforeShutdownContext, BeforeStartContext, LifecycleHooks, OnErrorContext, OnReadyContext } from "./lifecycle/hooks.js";
 import { PreBindResult, RunPreBindOptions, runPreBind } from "./lifecycle/pre-bind.js";
 import "./lifecycle/index.js";
@@ -36,8 +38,10 @@ import { WorkflowRoutesDeps, createWorkflowRoutes } from "./routes/workflows.js"
 import "./routes/index.js";
 import { WsUpgradeOptions, createWsUpgradeEvents } from "./ws/upgrade.js";
 import "./ws/index.js";
-import { CreateServerOptions, GraphorinServer, TriggersDaemonInput, createServer, ensureStoreAuditBinding } from "./app.js";
+import { ensureStoreAuditBinding } from "./app-audit-binding.js";
+import { CreateServerOptions, GraphorinServer, createServer } from "./app.js";
 import { SERVER_METRIC_NAMES, createServerMetricRegistry } from "./metrics/catalog.js";
+import { syncToolCounters } from "./metrics/tools-bridge.js";
 import { AuditErrorSink, AuditMiddlewareOptions, HTTP_REQUEST_AUDIT_ACTION, createAuditMiddleware } from "./middleware/audit.js";
 import { AuthMiddlewareOptions, createAuthMiddleware } from "./middleware/auth.js";
 import { createCorsMiddleware } from "./middleware/cors.js";
@@ -47,8 +51,10 @@ import { createRateLimitMiddleware } from "./middleware/rate-limit.js";
 import { RequestStateMiddlewareOptions, createRequestStateMiddleware } from "./middleware/request-state.js";
 import { ScopeRequirement, createScopeMiddleware } from "./middleware/scope.js";
 import "./middleware/index.js";
+import { RetentionConfig, RetentionLog, RetentionLogLevel, RetentionStoreLike, ScheduleRetentionOptions, createConsoleRetentionLog, scheduleRetentionSweeps } from "./runtime/retention.js";
 import { SseRoutesDeps, createSseRoutes } from "./sse/events.js";
 import "./sse/index.js";
+import { ToolAuditBridge, ToolEventsAuditPolicy, bridgeToolAuditToAudit, toolAuditEventToAuditInput } from "./tools-audit-bridge.js";
 import { TriggersRoutesDeps, createTriggersRoutes } from "./triggers/routes.js";
 import "./triggers/index.js";
 
@@ -81,8 +87,7 @@ import "./triggers/index.js";
  *
  * @packageDocumentation
  */
-/** Canonical version constant. Mirrors the `package.json` version. */
-declare const VERSION = "0.6.0";
+declare const VERSION: string;
 //#endregion
-export { AgentNotFoundError, type AgentRegistration, AgentRegistry, type AgentRoutesDeps, type AgentSummary, type AuditApi, type AuditErrorSink, type AuditMiddlewareOptions, type AuditRoutesDeps, type AuthMiddlewareOptions, type AuthRoutesDeps, type BareEventFrame, type BaseHealthCheck, type BeforeShutdownContext, type BeforeStartContext, ConfigInvalidError, type ConsolidatorCheck, type ConsolidatorDaemon, type ConsolidatorLike, type ConsolidatorStatusLike, type CreateConsolidatorDaemonOptions, type CreateServerOptions, type CreateTriggersDaemonOptions, DEFAULT_APPLY_TO_EVENTS, DEFAULT_DELIVERY_COMMENTARY_PATTERNS, type DeliveryCommentaryConfig, type DeliveryCommentaryDecision, type DeliveryCommentaryPattern, type DeliveryCommentaryPolicy, type DeliveryCommentaryPolicyConfig, type DeliveryCommentaryReason, type DeliveryCommentarySanitizer, type DeliveryCommentarySink, type DeliveryCommentaryTransport, type EmbedderCheck, type EncryptionCheck, type GraphorinServer, GraphorinServerError, GraphorinServerErrorCode, HTTP_REQUEST_AUDIT_ACTION, type HealthCheck, type HealthCheckOptions, type HealthChecks, type HealthRollup, type HealthRouteOptions, type HealthRoutesDeps, type HealthStatus, type HealthSummary, IdempotencyConflictError, IdempotencyKeyRequiredError, type IdempotencyMiddlewareOptions, type IdempotencyRequireKeyMode, type LabelSet, LifecycleDoubleStartError, type LifecycleHooks, LifecycleNotStartedError, type McpApi, type McpRoutesDeps, type MemoryApi, type MemoryRoutesDeps, type MetricKind, MetricRegistry, type MetricsRoutesOptions, MigrationFailedError, type OnErrorContext, type OnReadyContext, type ParsedSubject, type PreBindResult, PrebindEncryptionPeerMissingError, PrebindEncryptionRequiredError, PrebindPepperMissingError, PrebindSecretUnresolvableError, type ReplayApi, type ReplayBuffer, type ReplayBufferCheck, type ReplayBufferOptions, type ReplayBufferProbe, type ReplayBufferSlice, type ReplayMode, type ReplayResponse, type ReplayRoutesDeps, type RequestStateMiddlewareOptions, type RequestToken, RouteHandlerMissingError, type RunDescriptor, type RunHandle, type RunPreBindOptions, type RunStateSnapshot, RunStateTracker, type RunStatus, SERVER_METRIC_NAMES, type ScopeRequirement, type SecretRefString, type SecretsCheck, type SecretsSource, type ServerAgentLike, type ServerConfigInput, ServerConfigSchema, type ServerConfigSpec, type ServerRequestState, type ServerVariables, type ServerWorkflowLike, type SessionApi, type SessionRoutesDeps, ShutdownTimeoutError, type SkillsApi, type SkillsRoutesDeps, type SseRoutesDeps, type StorageCheck, type SubscribeResult, type TokensRoutesDeps, type TriggersCheck, type TriggersDaemon, type TriggersDaemonInput, type TriggersDaemonMetrics, type TriggersDaemonStatus, type TriggersRoutesDeps, VERSION, WorkflowNotFoundError, type WorkflowRegistration, WorkflowRegistry, type WorkflowRoutesDeps, type WorkflowSummary, type WsDispatcher, type WsDispatcherOptions, type WsDispatcherWarning, type WsSubscriberHandle, type WsSubscriptionSnapshot, type WsTicket, type WsTicketConsumeResult, type WsTicketStore, type WsTicketStoreOptions, type WsUpgradeOptions, collectHealth, createAgentRoutes, createAuditMiddleware, createAuditRoutes, createAuthMiddleware, createAuthRoutes, createConsolidatorDaemon, createCorsMiddleware, createCsrfMiddleware, createDeliveryCommentarySanitizer, createExtendedHealthRoutes, createHealthRoutes, createIdempotencyMiddleware, createMcpRoutes, createMemoryRoutes, createMetricsRoutes, createRateLimitMiddleware, createReplayBuffer, createReplayRoutes, createRequestStateMiddleware, createRunRoutes, createScopeMiddleware, createSecretsHealthRoutes, createServer, createServerMetricRegistry, createSessionRoutes, createSkillsRoutes, createSseRoutes, createTokensRoutes, createTriggersDaemon, createTriggersRoutes, createWorkflowRoutes, createWsDispatcher, createWsTicketStore, createWsUpgradeEvents, defaultCatchupPolicy, defineConfig, ensureStoreAuditBinding, parseServerConfig, requiredScopeFor, rollup, runPreBind, tryParseSubject };
+export { AgentNotFoundError, type AgentRegistration, AgentRegistry, type AgentRoutesDeps, type AgentSummary, type AuditApi, type AuditErrorSink, type AuditMiddlewareOptions, type AuditRoutesDeps, type AuthMiddlewareOptions, type AuthRoutesDeps, type BareEventFrame, type BaseHealthCheck, type BeforeShutdownContext, type BeforeStartContext, ConfigInvalidError, type ConsolidatorCheck, type ConsolidatorDaemon, type ConsolidatorLike, type ConsolidatorStatusLike, type CreateConsolidatorDaemonOptions, type CreateServerOptions, type CreateTriggersDaemonOptions, type CreateWorkflowTimerDaemonOptions, DEFAULT_APPLY_TO_EVENTS, DEFAULT_DELIVERY_COMMENTARY_PATTERNS, type DeliveryCommentaryConfig, type DeliveryCommentaryDecision, type DeliveryCommentaryPattern, type DeliveryCommentaryPolicy, type DeliveryCommentaryPolicyConfig, type DeliveryCommentaryReason, type DeliveryCommentarySanitizer, type DeliveryCommentarySink, type DeliveryCommentaryTransport, type EmbedderCheck, type EncryptionCheck, type GraphorinServer, GraphorinServerError, GraphorinServerErrorCode, HTTP_REQUEST_AUDIT_ACTION, type HealthCheck, type HealthCheckOptions, type HealthChecks, type HealthRollup, type HealthRouteOptions, type HealthRoutesDeps, type HealthStatus, type HealthSummary, IdempotencyConflictError, IdempotencyKeyRequiredError, type IdempotencyMiddlewareOptions, type IdempotencyRequireKeyMode, type LabelSet, LifecycleDoubleStartError, type LifecycleHooks, LifecycleNotStartedError, type McpApi, type McpRoutesDeps, type MemoryApi, type MemoryRoutesDeps, type MetricKind, MetricRegistry, type MetricsRoutesOptions, MigrationFailedError, type OnErrorContext, type OnReadyContext, type ParsedSubject, type PreBindResult, PrebindEncryptionPeerMissingError, PrebindEncryptionRequiredError, PrebindPepperMissingError, PrebindSecretUnresolvableError, type ReplayApi, type ReplayBuffer, type ReplayBufferCheck, type ReplayBufferOptions, type ReplayBufferProbe, type ReplayBufferSlice, type ReplayMode, type ReplayResponse, type ReplayRoutesDeps, type RequestStateMiddlewareOptions, type RequestToken, type RetentionConfig, type RetentionLog, type RetentionLogLevel, type RetentionStoreLike, RouteHandlerMissingError, type RunDescriptor, type RunHandle, type RunPreBindOptions, type RunStateSnapshot, RunStateTracker, type RunStatus, SERVER_METRIC_NAMES, type ScheduleRetentionOptions, type ScopeRequirement, type SecretRefString, type SecretsCheck, type SecretsSource, type ServerAgentLike, type ServerConfigInput, ServerConfigSchema, type ServerConfigSpec, type ServerRequestState, type ServerVariables, type ServerWorkflowLike, type SessionApi, type SessionRoutesDeps, ShutdownTimeoutError, type SkillsApi, type SkillsRoutesDeps, type SseRoutesDeps, type StorageCheck, type SubscribeResult, type TokensRoutesDeps, type ToolAuditBridge, type ToolEventsAuditPolicy, type TriggersCheck, type TriggersDaemon, type TriggersDaemonInput, type TriggersDaemonMetrics, type TriggersDaemonStatus, type TriggersRoutesDeps, VERSION, WorkflowNotFoundError, type WorkflowRegistration, WorkflowRegistry, type WorkflowRoutesDeps, type WorkflowSummary, type WorkflowTimerDaemon, type WorkflowTimerDaemonStatus, type WorkflowTimerDriverLike, type WorkflowTimersInput, type WsDispatcher, type WsDispatcherOptions, type WsDispatcherWarning, type WsSubscriberHandle, type WsSubscriptionSnapshot, type WsTicket, type WsTicketConsumeResult, type WsTicketStore, type WsTicketStoreOptions, type WsUpgradeOptions, bridgeToolAuditToAudit, collectHealth, createAgentRoutes, createAuditMiddleware, createAuditRoutes, createAuthMiddleware, createAuthRoutes, createConsoleRetentionLog, createConsolidatorDaemon, createCorsMiddleware, createCsrfMiddleware, createDeliveryCommentarySanitizer, createExtendedHealthRoutes, createHealthRoutes, createIdempotencyMiddleware, createMcpRoutes, createMemoryRoutes, createMetricsRoutes, createRateLimitMiddleware, createReplayBuffer, createReplayRoutes, createRequestStateMiddleware, createRunRoutes, createScopeMiddleware, createSecretsHealthRoutes, createServer, createServerMetricRegistry, createSessionRoutes, createSkillsRoutes, createSseRoutes, createTokensRoutes, createTriggersDaemon, createTriggersRoutes, createWorkflowRoutes, createWorkflowTimerDaemon, createWsDispatcher, createWsTicketStore, createWsUpgradeEvents, defaultCatchupPolicy, defineConfig, ensureStoreAuditBinding, parseServerConfig, requiredScopeFor, rollup, runPreBind, scheduleRetentionSweeps, syncToolCounters, toolAuditEventToAuditInput, tryParseSubject };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8Ba,OAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAgCa"}

package/dist/index.js

@@ -1,17 +1,11 @@
-import { DEFAULT_APPLY_TO_EVENTS, DEFAULT_DELIVERY_COMMENTARY_PATTERNS } from "./commentary/built-in-patterns.js";
-import { createDeliveryCommentarySanitizer } from "./commentary/sanitizer.js";
-import "./commentary/index.js";
-import { AgentNotFoundError, ConfigInvalidError, GraphorinServerError, IdempotencyConflictError, IdempotencyKeyRequiredError, LifecycleDoubleStartError, LifecycleNotStartedError, MigrationFailedError, PrebindEncryptionPeerMissingError, PrebindEncryptionRequiredError, PrebindPepperMissingError, PrebindSecretUnresolvableError, RouteHandlerMissingError, ShutdownTimeoutError, WorkflowNotFoundError } from "./errors/index.js";
-import { ServerConfigSchema, defineConfig, parseServerConfig } from "./config.js";
+import { version } from "./package.js";
 import { createConsolidatorDaemon } from "./consolidator/daemon.js";
-import { collectHealth, rollup } from "./health/checks.js";
-import { createScopeMiddleware } from "./middleware/scope.js";
-import { createExtendedHealthRoutes, createMetricsRoutes, createSecretsHealthRoutes } from "./health/routes.js";
-import "./health/index.js";
-import { runPreBind } from "./lifecycle/pre-bind.js";
-import "./lifecycle/index.js";
+import { createTriggersDaemon, defaultCatchupPolicy } from "./triggers/daemon.js";
+import { createWorkflowTimerDaemon } from "./workflows/timer-daemon.js";
+import { ensureStoreAuditBinding } from "./app-audit-binding.js";
 import { MetricRegistry } from "./metrics/registry.js";
 import { SERVER_METRIC_NAMES, createServerMetricRegistry } from "./metrics/catalog.js";
+import { syncToolCounters } from "./metrics/tools-bridge.js";
 import { HTTP_REQUEST_AUDIT_ACTION, createAuditMiddleware } from "./middleware/audit.js";
 import { createAuthMiddleware } from "./middleware/auth.js";
 import { createCorsMiddleware } from "./middleware/cors.js";
@@ -19,10 +13,12 @@ import { createCsrfMiddleware } from "./middleware/csrf.js";
 import { createIdempotencyMiddleware } from "./middleware/idempotency.js";
 import { createRateLimitMiddleware } from "./middleware/rate-limit.js";
 import { createRequestStateMiddleware } from "./middleware/request-state.js";
-import "./middleware/index.js";
-import { AgentRegistry, WorkflowRegistry } from "./registry/index.js";
+import { createScopeMiddleware } from "./middleware/scope.js";
+import { collectHealth, rollup } from "./health/checks.js";
+import { createExtendedHealthRoutes, createMetricsRoutes, createSecretsHealthRoutes } from "./health/routes.js";
 import { createReplayRoutes } from "./replay/routes.js";
-import "./replay/index.js";
+import { AgentNotFoundError, ConfigInvalidError, GraphorinServerError, IdempotencyConflictError, IdempotencyKeyRequiredError, LifecycleDoubleStartError, LifecycleNotStartedError, MigrationFailedError, PrebindEncryptionPeerMissingError, PrebindEncryptionRequiredError, PrebindPepperMissingError, PrebindSecretUnresolvableError, RouteHandlerMissingError, ShutdownTimeoutError, WorkflowNotFoundError } from "./errors/index.js";
+import { RunStateTracker } from "./runtime/run-state.js";
 import { createAgentRoutes, createRunRoutes } from "./routes/agents.js";
 import { createAuditRoutes } from "./routes/audit.js";
 import { createAuthRoutes } from "./routes/auth.js";
@@ -33,21 +29,21 @@ import { createSessionRoutes } from "./routes/sessions.js";
 import { createSkillsRoutes } from "./routes/skills.js";
 import { createTokensRoutes } from "./routes/tokens.js";
 import { createWorkflowRoutes } from "./routes/workflows.js";
-import "./routes/index.js";
-import { RunStateTracker } from "./runtime/run-state.js";
+import { DEFAULT_APPLY_TO_EVENTS, DEFAULT_DELIVERY_COMMENTARY_PATTERNS } from "./commentary/built-in-patterns.js";
+import { createDeliveryCommentarySanitizer } from "./commentary/sanitizer.js";
 import { createSseRoutes } from "./sse/events.js";
-import "./sse/index.js";
-import { createTriggersDaemon, defaultCatchupPolicy } from "./triggers/daemon.js";
 import { createTriggersRoutes } from "./triggers/routes.js";
+import { createWsUpgradeEvents } from "./ws/upgrade.js";
+import { runPreBind } from "./lifecycle/pre-bind.js";
+import { createConsoleRetentionLog, scheduleRetentionSweeps } from "./runtime/retention.js";
+import { bridgeToolAuditToAudit, toolAuditEventToAuditInput } from "./tools-audit-bridge.js";
 import { createReplayBuffer } from "./ws/replay-buffer.js";
 import { requiredScopeFor, tryParseSubject } from "./ws/subjects.js";
 import { createWsDispatcher } from "./ws/dispatcher.js";
 import { createWsTicketStore } from "./ws/ticket.js";
-import { createWsUpgradeEvents } from "./ws/upgrade.js";
-import "./ws/index.js";
-import { createServer, ensureStoreAuditBinding } from "./app.js";
-import "./metrics/index.js";
-import "./triggers/index.js";
+import { ServerConfigSchema, defineConfig, parseServerConfig } from "./config.js";
+import { AgentRegistry, WorkflowRegistry } from "./registry/index.js";
+import { createServer } from "./app.js";
 
 //#region src/index.ts
 /**
@@ -78,9 +74,9 @@ import "./triggers/index.js";
 *
 * @packageDocumentation
 */
-/** Canonical version constant. Mirrors the `package.json` version. */
-const VERSION = "0.6.0";
+/** Canonical version constant, derived from `package.json` at build time. */
+const VERSION = version;
 
 //#endregion
-export { AgentNotFoundError, AgentRegistry, ConfigInvalidError, DEFAULT_APPLY_TO_EVENTS, DEFAULT_DELIVERY_COMMENTARY_PATTERNS, GraphorinServerError, HTTP_REQUEST_AUDIT_ACTION, IdempotencyConflictError, IdempotencyKeyRequiredError, LifecycleDoubleStartError, LifecycleNotStartedError, MetricRegistry, MigrationFailedError, PrebindEncryptionPeerMissingError, PrebindEncryptionRequiredError, PrebindPepperMissingError, PrebindSecretUnresolvableError, RouteHandlerMissingError, RunStateTracker, SERVER_METRIC_NAMES, ServerConfigSchema, ShutdownTimeoutError, VERSION, WorkflowNotFoundError, WorkflowRegistry, collectHealth, createAgentRoutes, createAuditMiddleware, createAuditRoutes, createAuthMiddleware, createAuthRoutes, createConsolidatorDaemon, createCorsMiddleware, createCsrfMiddleware, createDeliveryCommentarySanitizer, createExtendedHealthRoutes, createHealthRoutes, createIdempotencyMiddleware, createMcpRoutes, createMemoryRoutes, createMetricsRoutes, createRateLimitMiddleware, createReplayBuffer, createReplayRoutes, createRequestStateMiddleware, createRunRoutes, createScopeMiddleware, createSecretsHealthRoutes, createServer, createServerMetricRegistry, createSessionRoutes, createSkillsRoutes, createSseRoutes, createTokensRoutes, createTriggersDaemon, createTriggersRoutes, createWorkflowRoutes, createWsDispatcher, createWsTicketStore, createWsUpgradeEvents, defaultCatchupPolicy, defineConfig, ensureStoreAuditBinding, parseServerConfig, requiredScopeFor, rollup, runPreBind, tryParseSubject };
+export { AgentNotFoundError, AgentRegistry, ConfigInvalidError, DEFAULT_APPLY_TO_EVENTS, DEFAULT_DELIVERY_COMMENTARY_PATTERNS, GraphorinServerError, HTTP_REQUEST_AUDIT_ACTION, IdempotencyConflictError, IdempotencyKeyRequiredError, LifecycleDoubleStartError, LifecycleNotStartedError, MetricRegistry, MigrationFailedError, PrebindEncryptionPeerMissingError, PrebindEncryptionRequiredError, PrebindPepperMissingError, PrebindSecretUnresolvableError, RouteHandlerMissingError, RunStateTracker, SERVER_METRIC_NAMES, ServerConfigSchema, ShutdownTimeoutError, VERSION, WorkflowNotFoundError, WorkflowRegistry, bridgeToolAuditToAudit, collectHealth, createAgentRoutes, createAuditMiddleware, createAuditRoutes, createAuthMiddleware, createAuthRoutes, createConsoleRetentionLog, createConsolidatorDaemon, createCorsMiddleware, createCsrfMiddleware, createDeliveryCommentarySanitizer, createExtendedHealthRoutes, createHealthRoutes, createIdempotencyMiddleware, createMcpRoutes, createMemoryRoutes, createMetricsRoutes, createRateLimitMiddleware, createReplayBuffer, createReplayRoutes, createRequestStateMiddleware, createRunRoutes, createScopeMiddleware, createSecretsHealthRoutes, createServer, createServerMetricRegistry, createSessionRoutes, createSkillsRoutes, createSseRoutes, createTokensRoutes, createTriggersDaemon, createTriggersRoutes, createWorkflowRoutes, createWorkflowTimerDaemon, createWsDispatcher, createWsTicketStore, createWsUpgradeEvents, defaultCatchupPolicy, defineConfig, ensureStoreAuditBinding, parseServerConfig, requiredScopeFor, rollup, runPreBind, scheduleRetentionSweeps, syncToolCounters, toolAuditEventToAuditInput, tryParseSubject };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@graphorin/server` - standalone server runtime for the Graphorin\n * framework.\n *\n * Phase 14a entry point. Ships:\n *\n * - {@link createServer} - the single programmatic entry that wires\n *   the Hono app, the auth + scope + idempotency + audit middleware\n *   stack, REST endpoints (agents / workflows / sessions / memory /\n *   skills / mcp / tokens / audit / health), the lifecycle hooks\n *   (`beforeStart` / `onReady` / `beforeShutdown` / `onError`), the\n *   pre-bind secrets-resolution + storage-migration runner, and the\n *   graceful SIGTERM drain.\n * - {@link defineConfig} + {@link parseServerConfig} - typed\n *   configuration loader with a Zod-validated schema; missing fields\n *   fall back to documented production-ready defaults.\n * - {@link AgentRegistry} + {@link WorkflowRegistry} - read/write\n *   registries the route handlers consult to look up user-defined\n *   agents / workflows.\n * - {@link RunStateTracker} - in-memory bookkeeping for in-flight\n *   runs (run id, status, AbortController). Phase 14b/c promote the\n *   tracker to a SQLite-backed durable variant.\n * - The full middleware factory suite - re-exported from\n *   `@graphorin/server/middleware` so operators can compose a custom\n *   Hono app on top of the same primitives.\n *\n * @packageDocumentation\n */\n\n/** Canonical version constant. Mirrors the `package.json` version. */\nexport const VERSION = '0.6.0';\n\nexport {\n  type CreateServerOptions,\n  createServer,\n  ensureStoreAuditBinding,\n  type GraphorinServer,\n  type TriggersDaemonInput,\n} from './app.js';\nexport {\n  createDeliveryCommentarySanitizer,\n  DEFAULT_APPLY_TO_EVENTS,\n  DEFAULT_DELIVERY_COMMENTARY_PATTERNS,\n  type DeliveryCommentaryConfig,\n  type DeliveryCommentaryDecision,\n  type DeliveryCommentaryPattern,\n  type DeliveryCommentaryPolicy,\n  type DeliveryCommentaryReason,\n  type DeliveryCommentarySanitizer,\n  type DeliveryCommentarySink,\n  type DeliveryCommentaryTransport,\n} from './commentary/index.js';\nexport {\n  type DeliveryCommentaryPolicyConfig,\n  defineConfig,\n  type IdempotencyRequireKeyMode,\n  parseServerConfig,\n  type SecretRefString,\n  type SecretsSource,\n  type ServerConfigInput,\n  ServerConfigSchema,\n  type ServerConfigSpec,\n} from './config.js';\nexport {\n  type ConsolidatorDaemon,\n  type ConsolidatorLike,\n  type ConsolidatorStatusLike,\n  type CreateConsolidatorDaemonOptions,\n  createConsolidatorDaemon,\n} from './consolidator/index.js';\nexport * from './errors/index.js';\nexport {\n  type BaseHealthCheck,\n  type ConsolidatorCheck,\n  collectHealth,\n  createExtendedHealthRoutes,\n  createMetricsRoutes,\n  createSecretsHealthRoutes,\n  type EmbedderCheck,\n  type EncryptionCheck,\n  type HealthCheck,\n  type HealthCheckOptions,\n  type HealthChecks,\n  type HealthRollup,\n  type HealthRouteOptions,\n  type HealthStatus,\n  type HealthSummary,\n  type MetricsRoutesOptions,\n  type ReplayBufferCheck,\n  type ReplayBufferProbe,\n  rollup,\n  type SecretsCheck,\n  type StorageCheck,\n  type TriggersCheck,\n} from './health/index.js';\nexport type { RequestToken, ServerRequestState, ServerVariables } from './internal/context.js';\nexport {\n  type BeforeShutdownContext,\n  type BeforeStartContext,\n  type LifecycleHooks,\n  type OnErrorContext,\n  type OnReadyContext,\n  type PreBindResult,\n  type RunPreBindOptions,\n  runPreBind,\n} from './lifecycle/index.js';\nexport {\n  createServerMetricRegistry,\n  type LabelSet,\n  type MetricKind,\n  MetricRegistry,\n  SERVER_METRIC_NAMES,\n} from './metrics/index.js';\nexport {\n  type AuditErrorSink,\n  type AuditMiddlewareOptions,\n  type AuthMiddlewareOptions,\n  createAuditMiddleware,\n  createAuthMiddleware,\n  createCorsMiddleware,\n  createCsrfMiddleware,\n  createIdempotencyMiddleware,\n  createRateLimitMiddleware,\n  createRequestStateMiddleware,\n  createScopeMiddleware,\n  HTTP_REQUEST_AUDIT_ACTION,\n  type IdempotencyMiddlewareOptions,\n  type RequestStateMiddlewareOptions,\n  type ScopeRequirement,\n} from './middleware/index.js';\nexport {\n  type AgentRegistration,\n  AgentRegistry,\n  type AgentSummary,\n  type ServerAgentLike,\n  type ServerWorkflowLike,\n  type WorkflowRegistration,\n  WorkflowRegistry,\n  type WorkflowSummary,\n} from './registry/index.js';\nexport {\n  createReplayRoutes,\n  type ReplayApi,\n  type ReplayMode,\n  type ReplayResponse,\n  type ReplayRoutesDeps,\n} from './replay/index.js';\nexport {\n  type AgentRoutesDeps,\n  type AuditApi,\n  type AuditRoutesDeps,\n  type AuthRoutesDeps,\n  createAgentRoutes,\n  createAuditRoutes,\n  createAuthRoutes,\n  createHealthRoutes,\n  createMcpRoutes,\n  createMemoryRoutes,\n  createRunRoutes,\n  createSessionRoutes,\n  createSkillsRoutes,\n  createTokensRoutes,\n  createWorkflowRoutes,\n  type HealthRoutesDeps,\n  type McpApi,\n  type McpRoutesDeps,\n  type MemoryApi,\n  type MemoryRoutesDeps,\n  type SessionApi,\n  type SessionRoutesDeps,\n  type SkillsApi,\n  type SkillsRoutesDeps,\n  type TokensRoutesDeps,\n  type WorkflowRoutesDeps,\n} from './routes/index.js';\nexport {\n  type RunDescriptor,\n  type RunHandle,\n  type RunStateSnapshot,\n  RunStateTracker,\n  type RunStatus,\n} from './runtime/run-state.js';\nexport { createSseRoutes, type SseRoutesDeps } from './sse/index.js';\nexport {\n  type CreateTriggersDaemonOptions,\n  createTriggersDaemon,\n  createTriggersRoutes,\n  defaultCatchupPolicy,\n  type TriggersDaemon,\n  type TriggersDaemonMetrics,\n  type TriggersDaemonStatus,\n  type TriggersRoutesDeps,\n} from './triggers/index.js';\nexport {\n  type BareEventFrame,\n  createReplayBuffer,\n  createWsDispatcher,\n  createWsTicketStore,\n  createWsUpgradeEvents,\n  type ParsedSubject,\n  type ReplayBuffer,\n  type ReplayBufferOptions,\n  type ReplayBufferSlice,\n  requiredScopeFor,\n  type SubscribeResult,\n  tryParseSubject,\n  type WsDispatcher,\n  type WsDispatcherOptions,\n  type WsDispatcherWarning,\n  type WsSubscriberHandle,\n  type WsSubscriptionSnapshot,\n  type WsTicket,\n  type WsTicketConsumeResult,\n  type WsTicketStore,\n  type WsTicketStoreOptions,\n  type WsUpgradeOptions,\n} from './ws/index.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAa,UAAU"}
+{"version":3,"file":"index.js","names":["VERSION: string","pkg.version"],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@graphorin/server` - standalone server runtime for the Graphorin\n * framework.\n *\n * Phase 14a entry point. Ships:\n *\n * - {@link createServer} - the single programmatic entry that wires\n *   the Hono app, the auth + scope + idempotency + audit middleware\n *   stack, REST endpoints (agents / workflows / sessions / memory /\n *   skills / mcp / tokens / audit / health), the lifecycle hooks\n *   (`beforeStart` / `onReady` / `beforeShutdown` / `onError`), the\n *   pre-bind secrets-resolution + storage-migration runner, and the\n *   graceful SIGTERM drain.\n * - {@link defineConfig} + {@link parseServerConfig} - typed\n *   configuration loader with a Zod-validated schema; missing fields\n *   fall back to documented production-ready defaults.\n * - {@link AgentRegistry} + {@link WorkflowRegistry} - read/write\n *   registries the route handlers consult to look up user-defined\n *   agents / workflows.\n * - {@link RunStateTracker} - in-memory bookkeeping for in-flight\n *   runs (run id, status, AbortController). Phase 14b/c promote the\n *   tracker to a SQLite-backed durable variant.\n * - The full middleware factory suite - re-exported from\n *   `@graphorin/server/middleware` so operators can compose a custom\n *   Hono app on top of the same primitives.\n *\n * @packageDocumentation\n */\n\n/** Canonical version constant, derived from `package.json` at build time. */\nimport pkg from '../package.json' with { type: 'json' };\n\nexport const VERSION: string = pkg.version;\n\nexport {\n  type CreateServerOptions,\n  createServer,\n  ensureStoreAuditBinding,\n  type GraphorinServer,\n  type TriggersDaemonInput,\n  type WorkflowTimersInput,\n} from './app.js';\nexport {\n  createDeliveryCommentarySanitizer,\n  DEFAULT_APPLY_TO_EVENTS,\n  DEFAULT_DELIVERY_COMMENTARY_PATTERNS,\n  type DeliveryCommentaryConfig,\n  type DeliveryCommentaryDecision,\n  type DeliveryCommentaryPattern,\n  type DeliveryCommentaryPolicy,\n  type DeliveryCommentaryReason,\n  type DeliveryCommentarySanitizer,\n  type DeliveryCommentarySink,\n  type DeliveryCommentaryTransport,\n} from './commentary/index.js';\nexport {\n  type DeliveryCommentaryPolicyConfig,\n  defineConfig,\n  type IdempotencyRequireKeyMode,\n  parseServerConfig,\n  type SecretRefString,\n  type SecretsSource,\n  type ServerConfigInput,\n  ServerConfigSchema,\n  type ServerConfigSpec,\n} from './config.js';\nexport {\n  type ConsolidatorDaemon,\n  type ConsolidatorLike,\n  type ConsolidatorStatusLike,\n  type CreateConsolidatorDaemonOptions,\n  createConsolidatorDaemon,\n} from './consolidator/index.js';\nexport * from './errors/index.js';\nexport {\n  type BaseHealthCheck,\n  type ConsolidatorCheck,\n  collectHealth,\n  createExtendedHealthRoutes,\n  createMetricsRoutes,\n  createSecretsHealthRoutes,\n  type EmbedderCheck,\n  type EncryptionCheck,\n  type HealthCheck,\n  type HealthCheckOptions,\n  type HealthChecks,\n  type HealthRollup,\n  type HealthRouteOptions,\n  type HealthStatus,\n  type HealthSummary,\n  type MetricsRoutesOptions,\n  type ReplayBufferCheck,\n  type ReplayBufferProbe,\n  rollup,\n  type SecretsCheck,\n  type StorageCheck,\n  type TriggersCheck,\n} from './health/index.js';\nexport type { RequestToken, ServerRequestState, ServerVariables } from './internal/context.js';\nexport {\n  type BeforeShutdownContext,\n  type BeforeStartContext,\n  type LifecycleHooks,\n  type OnErrorContext,\n  type OnReadyContext,\n  type PreBindResult,\n  type RunPreBindOptions,\n  runPreBind,\n} from './lifecycle/index.js';\nexport {\n  createServerMetricRegistry,\n  type LabelSet,\n  type MetricKind,\n  MetricRegistry,\n  SERVER_METRIC_NAMES,\n} from './metrics/index.js';\nexport { syncToolCounters } from './metrics/tools-bridge.js';\nexport {\n  type AuditErrorSink,\n  type AuditMiddlewareOptions,\n  type AuthMiddlewareOptions,\n  createAuditMiddleware,\n  createAuthMiddleware,\n  createCorsMiddleware,\n  createCsrfMiddleware,\n  createIdempotencyMiddleware,\n  createRateLimitMiddleware,\n  createRequestStateMiddleware,\n  createScopeMiddleware,\n  HTTP_REQUEST_AUDIT_ACTION,\n  type IdempotencyMiddlewareOptions,\n  type RequestStateMiddlewareOptions,\n  type ScopeRequirement,\n} from './middleware/index.js';\nexport {\n  type AgentRegistration,\n  AgentRegistry,\n  type AgentSummary,\n  type ServerAgentLike,\n  type ServerWorkflowLike,\n  type WorkflowRegistration,\n  WorkflowRegistry,\n  type WorkflowSummary,\n} from './registry/index.js';\nexport {\n  createReplayRoutes,\n  type ReplayApi,\n  type ReplayMode,\n  type ReplayResponse,\n  type ReplayRoutesDeps,\n} from './replay/index.js';\nexport {\n  type AgentRoutesDeps,\n  type AuditApi,\n  type AuditRoutesDeps,\n  type AuthRoutesDeps,\n  createAgentRoutes,\n  createAuditRoutes,\n  createAuthRoutes,\n  createHealthRoutes,\n  createMcpRoutes,\n  createMemoryRoutes,\n  createRunRoutes,\n  createSessionRoutes,\n  createSkillsRoutes,\n  createTokensRoutes,\n  createWorkflowRoutes,\n  type HealthRoutesDeps,\n  type McpApi,\n  type McpRoutesDeps,\n  type MemoryApi,\n  type MemoryRoutesDeps,\n  type SessionApi,\n  type SessionRoutesDeps,\n  type SkillsApi,\n  type SkillsRoutesDeps,\n  type TokensRoutesDeps,\n  type WorkflowRoutesDeps,\n} from './routes/index.js';\nexport {\n  createConsoleRetentionLog,\n  type RetentionConfig,\n  type RetentionLog,\n  type RetentionLogLevel,\n  type RetentionStoreLike,\n  type ScheduleRetentionOptions,\n  scheduleRetentionSweeps,\n} from './runtime/retention.js';\nexport {\n  type RunDescriptor,\n  type RunHandle,\n  type RunStateSnapshot,\n  RunStateTracker,\n  type RunStatus,\n} from './runtime/run-state.js';\nexport { createSseRoutes, type SseRoutesDeps } from './sse/index.js';\nexport {\n  bridgeToolAuditToAudit,\n  type ToolAuditBridge,\n  type ToolEventsAuditPolicy,\n  toolAuditEventToAuditInput,\n} from './tools-audit-bridge.js';\nexport {\n  type CreateTriggersDaemonOptions,\n  createTriggersDaemon,\n  createTriggersRoutes,\n  defaultCatchupPolicy,\n  type TriggersDaemon,\n  type TriggersDaemonMetrics,\n  type TriggersDaemonStatus,\n  type TriggersRoutesDeps,\n} from './triggers/index.js';\nexport {\n  type CreateWorkflowTimerDaemonOptions,\n  createWorkflowTimerDaemon,\n  type WorkflowTimerDaemon,\n  type WorkflowTimerDaemonStatus,\n  type WorkflowTimerDriverLike,\n} from './workflows/timer-daemon.js';\nexport {\n  type BareEventFrame,\n  createReplayBuffer,\n  createWsDispatcher,\n  createWsTicketStore,\n  createWsUpgradeEvents,\n  type ParsedSubject,\n  type ReplayBuffer,\n  type ReplayBufferOptions,\n  type ReplayBufferSlice,\n  requiredScopeFor,\n  type SubscribeResult,\n  tryParseSubject,\n  type WsDispatcher,\n  type WsDispatcherOptions,\n  type WsDispatcherWarning,\n  type WsSubscriberHandle,\n  type WsSubscriptionSnapshot,\n  type WsTicket,\n  type WsTicketConsumeResult,\n  type WsTicketStore,\n  type WsTicketStoreOptions,\n  type WsUpgradeOptions,\n} from './ws/index.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAaA,UAAkBC"}

package/dist/internal/context.d.ts

@@ -20,7 +20,7 @@ type AuthState = {
 /**
  * Request-scoped variables surfaced through `c.var` in Hono. The
  * server's middleware populates these fields incrementally; route
- * handlers consume them through {@link getRequestState}.
+ * handlers consume them through `getRequestState`.
  *
  * @stable
  */
@@ -39,7 +39,7 @@ interface ServerRequestState {
  * Authentication / authorization middleware: "populates `c.var.token:
  * { id, label, scopes, env }`").
  *
- * Read this through {@link getRequestToken} so consumers do not have
+ * Read this through `getRequestToken` so consumers do not have
  * to remember the variable key.
  *
  * @stable

package/dist/internal/wire-error.js

@@ -0,0 +1,20 @@
+//#region src/internal/wire-error.ts
+/** Normalize any thrown value into the wire envelope (W-052). */
+function toWireError(err) {
+	if (err !== null && typeof err === "object") {
+		const rec = err;
+		return {
+			code: typeof rec.code === "string" && rec.code.length > 0 ? rec.code : typeof rec.kind === "string" && rec.kind.length > 0 ? rec.kind : "unknown",
+			message: typeof rec.message === "string" ? rec.message : String(err),
+			...typeof rec.hint === "string" && rec.hint.length > 0 ? { hint: rec.hint } : {}
+		};
+	}
+	return {
+		code: "unknown",
+		message: String(err)
+	};
+}
+
+//#endregion
+export { toWireError };
+//# sourceMappingURL=wire-error.js.map

package/dist/internal/wire-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-error.js","names":[],"sources":["../../src/internal/wire-error.ts"],"sourcesContent":["/**\n * W-052: machine-readable error envelope for the server boundary.\n *\n * The packages disagree on the error discriminator by history:\n * `@graphorin/agent` / `@graphorin/workflow` use `code`,\n * `@graphorin/tools` / `@graphorin/memory` / `@graphorin/provider` /\n * the server's own errors use `kind`. Renaming either family is a\n * breaking change to no benefit - NORMALIZATION IS THE SERVER\n * BOUNDARY'S JOB. Every wire payload that reports a failure funnels\n * through {@link toWireError}, so clients branch on one stable `code`\n * field (e.g. retry `checkpoint-version-conflict`, abandon\n * `node-execution-failed`) instead of parsing English prose.\n *\n * @packageDocumentation\n */\n\n/** Normalized error envelope for wire payloads. */\nexport interface WireError {\n  /** `err.code` if a string, else `err.kind` if a string, else `'unknown'`. */\n  readonly code: string;\n  readonly message: string;\n  /** Operator hint when the source error carries one (`WorkflowError.hint`). */\n  readonly hint?: string;\n}\n\n/** Normalize any thrown value into the wire envelope (W-052). */\nexport function toWireError(err: unknown): WireError {\n  if (err !== null && typeof err === 'object') {\n    const rec = err as { code?: unknown; kind?: unknown; message?: unknown; hint?: unknown };\n    const code =\n      typeof rec.code === 'string' && rec.code.length > 0\n        ? rec.code\n        : typeof rec.kind === 'string' && rec.kind.length > 0\n          ? rec.kind\n          : 'unknown';\n    const message = typeof rec.message === 'string' ? rec.message : String(err);\n    return {\n      code,\n      message,\n      ...(typeof rec.hint === 'string' && rec.hint.length > 0 ? { hint: rec.hint } : {}),\n    };\n  }\n  return { code: 'unknown', message: String(err) };\n}\n"],"mappings":";;AA0BA,SAAgB,YAAY,KAAyB;AACnD,KAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;EAC3C,MAAM,MAAM;AAQZ,SAAO;GACL,MAPA,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,SAAS,IAC9C,IAAI,OACJ,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,SAAS,IAChD,IAAI,OACJ;GAIN,SAHc,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU,OAAO,IAAI;GAIzE,GAAI,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,SAAS,IAAI,EAAE,MAAM,IAAI,MAAM,GAAG,EAAE;GAClF;;AAEH,QAAO;EAAE,MAAM;EAAW,SAAS,OAAO,IAAI;EAAE"}

package/dist/lifecycle/pre-bind.d.ts

@@ -1,6 +1,6 @@
 import { ServerConfigSpec } from "../config.js";
-import { SecretValue } from "@graphorin/security";
 import { GraphorinSqliteStore } from "@graphorin/store-sqlite";
+import { SecretValue } from "@graphorin/security";
 
 //#region src/lifecycle/pre-bind.d.ts
 

package/dist/metrics/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","names":[],"sources":["../../src/metrics/catalog.ts"],"sourcesContent":[],"mappings":";;;;;;;cA0Ba,qBAAmB;;;;;;;;;;;;;;;;;;;;;;;iBAwBhB,0BAAA,CAAA,GAA8B"}
+{"version":3,"file":"catalog.d.ts","names":[],"sources":["../../src/metrics/catalog.ts"],"sourcesContent":[],"mappings":";;;;;;;cA+Ba,qBAAmB;;;;;;;;;;;;;;;;;;;;;;;iBAwBhB,0BAAA,CAAA,GAA8B"}

package/dist/metrics/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","names":[],"sources":["../../src/metrics/catalog.ts"],"sourcesContent":["/**\n * Canonical metric inventory for the standalone server. Every metric\n * the framework emits is registered here in one place so the\n * exposition output is deterministic across builds.\n *\n * Metric naming follows the documented `graphorin_*` prefix\n * discipline; label cardinality is bounded by construction (no PII\n * labels - see DEC-141 cross-cut).\n *\n * @packageDocumentation\n */\n\nimport { MetricRegistry } from './registry.js';\n\n/**\n * @stable\n */\n// IP-15: the catalog lists only metrics the server actually moves. Five\n// previously-registered series - `graphorin_tool_calls_total`,\n// `graphorin_provider_tokens_total`, `graphorin_provider_cost_usd_total`,\n// `graphorin_redaction_drops_total` and `graphorin_oauth_tokens_freshness_seconds`\n// - had no producer anywhere in the monorepo (per-tool and provider usage live\n// in the agent runtime, not the server; redaction drops in the observability\n// layer; OAuth freshness needs an MCP token store the server does not own). A\n// permanently-empty series is worse than an absent one for dashboards, so they\n// are dropped until a real producer exists rather than advertised inert.\nexport const SERVER_METRIC_NAMES = Object.freeze({\n  agentRunsTotal: 'graphorin_agent_runs_total',\n  agentRunDuration: 'graphorin_agent_run_duration_seconds',\n  storageWalSize: 'graphorin_storage_wal_size_bytes',\n  idempotencyCacheHitRatio: 'graphorin_idempotency_cache_hit_ratio',\n  triggersFiresTotal: 'graphorin_triggers_fires_total',\n  consolidatorQueueDepth: 'graphorin_consolidator_queue_depth',\n  consolidatorDlqSize: 'graphorin_consolidator_dlq_size',\n  consolidatorBudgetRemainingUsd: 'graphorin_consolidator_budget_remaining_usd',\n  consolidatorBudgetRemainingTokens: 'graphorin_consolidator_budget_remaining_tokens',\n  replayBufferEvents: 'graphorin_replay_buffer_events',\n  inflightRuns: 'graphorin_inflight_runs',\n  serverUptime: 'graphorin_server_uptime_seconds',\n  buildInfo: 'graphorin_build_info',\n} as const);\n\n/**\n * Build a fully-registered {@link MetricRegistry} ready for the\n * `/v1/metrics` exposition. The returned registry has every metric\n * declared but no samples; the server runtime updates samples\n * incrementally.\n *\n * @stable\n */\nexport function createServerMetricRegistry(): MetricRegistry {\n  const registry = new MetricRegistry();\n\n  registry.registerCounter(\n    SERVER_METRIC_NAMES.agentRunsTotal,\n    'Total agent runs by terminal status.',\n    ['status'],\n  );\n  registry.registerSummary(\n    SERVER_METRIC_NAMES.agentRunDuration,\n    'Agent run duration in seconds.',\n    [],\n  );\n  registry.registerGauge(SERVER_METRIC_NAMES.storageWalSize, 'Current SQLite WAL size in bytes.');\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.idempotencyCacheHitRatio,\n    'Idempotency LRU cache hit ratio in [0, 1].',\n  );\n  registry.registerCounter(\n    SERVER_METRIC_NAMES.triggersFiresTotal,\n    'Total trigger fires by trigger id and outcome.',\n    ['trigger_id', 'status'],\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.consolidatorQueueDepth,\n    'Pending consolidator items by phase.',\n    ['phase'],\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.consolidatorDlqSize,\n    'Number of consolidator runs sitting in the dead-letter queue.',\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.consolidatorBudgetRemainingUsd,\n    'Consolidator USD budget remaining for the current period.',\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.consolidatorBudgetRemainingTokens,\n    'Consolidator token budget remaining for the current period.',\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.replayBufferEvents,\n    'Number of events currently buffered for WebSocket replay.',\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.inflightRuns,\n    'Number of in-flight agent / workflow runs.',\n  );\n  registry.registerGauge(SERVER_METRIC_NAMES.serverUptime, 'Server process uptime in seconds.');\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.buildInfo,\n    'Static `1` gauge carrying graphorin build labels.',\n    ['version'],\n  );\n\n  return registry;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA0BA,MAAa,sBAAsB,OAAO,OAAO;CAC/C,gBAAgB;CAChB,kBAAkB;CAClB,gBAAgB;CAChB,0BAA0B;CAC1B,oBAAoB;CACpB,wBAAwB;CACxB,qBAAqB;CACrB,gCAAgC;CAChC,mCAAmC;CACnC,oBAAoB;CACpB,cAAc;CACd,cAAc;CACd,WAAW;CACZ,CAAU;;;;;;;;;AAUX,SAAgB,6BAA6C;CAC3D,MAAM,WAAW,IAAI,gBAAgB;AAErC,UAAS,gBACP,oBAAoB,gBACpB,wCACA,CAAC,SAAS,CACX;AACD,UAAS,gBACP,oBAAoB,kBACpB,kCACA,EAAE,CACH;AACD,UAAS,cAAc,oBAAoB,gBAAgB,oCAAoC;AAC/F,UAAS,cACP,oBAAoB,0BACpB,6CACD;AACD,UAAS,gBACP,oBAAoB,oBACpB,kDACA,CAAC,cAAc,SAAS,CACzB;AACD,UAAS,cACP,oBAAoB,wBACpB,wCACA,CAAC,QAAQ,CACV;AACD,UAAS,cACP,oBAAoB,qBACpB,gEACD;AACD,UAAS,cACP,oBAAoB,gCACpB,4DACD;AACD,UAAS,cACP,oBAAoB,mCACpB,8DACD;AACD,UAAS,cACP,oBAAoB,oBACpB,4DACD;AACD,UAAS,cACP,oBAAoB,cACpB,6CACD;AACD,UAAS,cAAc,oBAAoB,cAAc,oCAAoC;AAC7F,UAAS,cACP,oBAAoB,WACpB,qDACA,CAAC,UAAU,CACZ;AAED,QAAO"}
+{"version":3,"file":"catalog.js","names":[],"sources":["../../src/metrics/catalog.ts"],"sourcesContent":["/**\n * Canonical metric inventory for the standalone server. Every metric\n * the framework emits is registered here in one place so the\n * exposition output is deterministic across builds.\n *\n * Metric naming follows the documented `graphorin_*` prefix\n * discipline; label cardinality is bounded by construction (no PII\n * labels - see DEC-141 cross-cut).\n *\n * @packageDocumentation\n */\n\nimport { MetricRegistry } from './registry.js';\n\n/**\n * @stable\n */\n// IP-15: the catalog lists only metrics the server actually moves. Five\n// previously-registered series - `graphorin_tool_calls_total`,\n// `graphorin_provider_tokens_total`, `graphorin_provider_cost_usd_total`,\n// `graphorin_redaction_drops_total` and `graphorin_oauth_tokens_freshness_seconds`\n// - had no producer anywhere in the monorepo (per-tool and provider usage live\n// in the agent runtime, not the server; redaction drops in the observability\n// layer; OAuth freshness needs an MCP token store the server does not own). A\n// permanently-empty series is worse than an absent one for dashboards, so they\n// are dropped until a real producer exists rather than advertised inert.\n// W-051 update: tool/MCP telemetry NOW has a producer - the scrape-time\n// `metrics/tools-bridge.ts` sync lazily registers\n// `graphorin_tool_*` / `graphorin_mcp_*` series from the tools package's\n// live counter snapshot, so only series that actually moved ever appear\n// (consistent with IP-15: nothing advertised inert).\nexport const SERVER_METRIC_NAMES = Object.freeze({\n  agentRunsTotal: 'graphorin_agent_runs_total',\n  agentRunDuration: 'graphorin_agent_run_duration_seconds',\n  storageWalSize: 'graphorin_storage_wal_size_bytes',\n  idempotencyCacheHitRatio: 'graphorin_idempotency_cache_hit_ratio',\n  triggersFiresTotal: 'graphorin_triggers_fires_total',\n  consolidatorQueueDepth: 'graphorin_consolidator_queue_depth',\n  consolidatorDlqSize: 'graphorin_consolidator_dlq_size',\n  consolidatorBudgetRemainingUsd: 'graphorin_consolidator_budget_remaining_usd',\n  consolidatorBudgetRemainingTokens: 'graphorin_consolidator_budget_remaining_tokens',\n  replayBufferEvents: 'graphorin_replay_buffer_events',\n  inflightRuns: 'graphorin_inflight_runs',\n  serverUptime: 'graphorin_server_uptime_seconds',\n  buildInfo: 'graphorin_build_info',\n} as const);\n\n/**\n * Build a fully-registered {@link MetricRegistry} ready for the\n * `/v1/metrics` exposition. The returned registry has every metric\n * declared but no samples; the server runtime updates samples\n * incrementally.\n *\n * @stable\n */\nexport function createServerMetricRegistry(): MetricRegistry {\n  const registry = new MetricRegistry();\n\n  registry.registerCounter(\n    SERVER_METRIC_NAMES.agentRunsTotal,\n    'Total agent runs by terminal status.',\n    ['status'],\n  );\n  registry.registerSummary(\n    SERVER_METRIC_NAMES.agentRunDuration,\n    'Agent run duration in seconds.',\n    [],\n  );\n  registry.registerGauge(SERVER_METRIC_NAMES.storageWalSize, 'Current SQLite WAL size in bytes.');\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.idempotencyCacheHitRatio,\n    'Idempotency LRU cache hit ratio in [0, 1].',\n  );\n  registry.registerCounter(\n    SERVER_METRIC_NAMES.triggersFiresTotal,\n    'Total trigger fires by trigger id and outcome.',\n    ['trigger_id', 'status'],\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.consolidatorQueueDepth,\n    'Pending consolidator items by phase.',\n    ['phase'],\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.consolidatorDlqSize,\n    'Number of consolidator runs sitting in the dead-letter queue.',\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.consolidatorBudgetRemainingUsd,\n    'Consolidator USD budget remaining for the current period.',\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.consolidatorBudgetRemainingTokens,\n    'Consolidator token budget remaining for the current period.',\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.replayBufferEvents,\n    'Number of events currently buffered for WebSocket replay.',\n  );\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.inflightRuns,\n    'Number of in-flight agent / workflow runs.',\n  );\n  registry.registerGauge(SERVER_METRIC_NAMES.serverUptime, 'Server process uptime in seconds.');\n  registry.registerGauge(\n    SERVER_METRIC_NAMES.buildInfo,\n    'Static `1` gauge carrying graphorin build labels.',\n    ['version'],\n  );\n\n  return registry;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA+BA,MAAa,sBAAsB,OAAO,OAAO;CAC/C,gBAAgB;CAChB,kBAAkB;CAClB,gBAAgB;CAChB,0BAA0B;CAC1B,oBAAoB;CACpB,wBAAwB;CACxB,qBAAqB;CACrB,gCAAgC;CAChC,mCAAmC;CACnC,oBAAoB;CACpB,cAAc;CACd,cAAc;CACd,WAAW;CACZ,CAAU;;;;;;;;;AAUX,SAAgB,6BAA6C;CAC3D,MAAM,WAAW,IAAI,gBAAgB;AAErC,UAAS,gBACP,oBAAoB,gBACpB,wCACA,CAAC,SAAS,CACX;AACD,UAAS,gBACP,oBAAoB,kBACpB,kCACA,EAAE,CACH;AACD,UAAS,cAAc,oBAAoB,gBAAgB,oCAAoC;AAC/F,UAAS,cACP,oBAAoB,0BACpB,6CACD;AACD,UAAS,gBACP,oBAAoB,oBACpB,kDACA,CAAC,cAAc,SAAS,CACzB;AACD,UAAS,cACP,oBAAoB,wBACpB,wCACA,CAAC,QAAQ,CACV;AACD,UAAS,cACP,oBAAoB,qBACpB,gEACD;AACD,UAAS,cACP,oBAAoB,gCACpB,4DACD;AACD,UAAS,cACP,oBAAoB,mCACpB,8DACD;AACD,UAAS,cACP,oBAAoB,oBACpB,4DACD;AACD,UAAS,cACP,oBAAoB,cACpB,6CACD;AACD,UAAS,cAAc,oBAAoB,cAAc,oCAAoC;AAC7F,UAAS,cACP,oBAAoB,WACpB,qDACA,CAAC,UAAU,CACZ;AAED,QAAO"}

package/dist/metrics/tools-bridge.d.ts

@@ -0,0 +1,15 @@
+import { MetricRegistry } from "./registry.js";
+import { CounterSnapshot } from "@graphorin/tools/audit";
+
+//#region src/metrics/tools-bridge.d.ts
+
+/**
+ * Sync the tools-package counter snapshot into `registry`. Idempotent
+ * per value: scraping twice without new increments changes nothing.
+ *
+ * @stable
+ */
+declare function syncToolCounters(registry: MetricRegistry, snapshot?: CounterSnapshot): void;
+//#endregion
+export { syncToolCounters };
+//# sourceMappingURL=tools-bridge.d.ts.map

package/dist/metrics/tools-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-bridge.d.ts","names":[],"sources":["../../src/metrics/tools-bridge.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;iBAqCgB,gBAAA,WACJ,2BACA"}

package/dist/metrics/tools-bridge.js

@@ -0,0 +1,103 @@
+import { snapshotCounters } from "@graphorin/tools/audit";
+
+//#region src/metrics/tools-bridge.ts
+/**
+* W-051: bridge the `@graphorin/tools` module-level counter registry
+* (which `@graphorin/mcp` also writes) into the server's
+* {@link MetricRegistry}, so `tool.*` / `mcp.*` telemetry - including
+* the shadow-mode `tool.dataflow.*` counters - shows up on
+* `/v1/metrics` without hand-wiring.
+*
+* Called from `refreshLiveMetrics` on every scrape. Counters are
+* delta-synced (the tools registry is cumulative per process; the
+* Prometheus registry increments by the positive difference, so
+* repeated scrapes never double-count); gauges are set absolutely -
+* the `kinds` field on the snapshot (added for exactly this bridge)
+* tells the two apart. Histograms are deliberately NOT bridged yet:
+* summary bridging needs per-key consumed-observation offsets, and the
+* raw observation lists stay available through `snapshotCounters()`
+* for library users (documented in the observability guide).
+*
+* Naming: `tool.executor.retry.total{toolName=x}` becomes
+* `graphorin_tool_executor_retry_total{toolName="x"}` - `[.-]` map to
+* `_` (the Prometheus name grammar forbids dots), label values pass
+* through the same sanitizer as trigger ids.
+*
+* @packageDocumentation
+*/
+const BRIDGED_PREFIXES = ["tool.", "mcp."];
+const PROM_LABEL_NAME_RE = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+/**
+* Sync the tools-package counter snapshot into `registry`. Idempotent
+* per value: scraping twice without new increments changes nothing.
+*
+* @stable
+*/
+function syncToolCounters(registry, snapshot = snapshotCounters()) {
+	for (const [key, value] of Object.entries(snapshot.counters)) {
+		const parsed = parseCounterKey(key);
+		if (parsed === void 0) continue;
+		if (!BRIDGED_PREFIXES.some((prefix) => parsed.name.startsWith(prefix))) continue;
+		const kind = snapshot.kinds[key] ?? "counter";
+		const metricName = toPrometheusName(parsed.name);
+		try {
+			if (kind === "gauge") {
+				registry.registerGauge(metricName, `Bridged from tools counter '${parsed.name}'.`);
+				registry.set(metricName, value, parsed.labels);
+			} else {
+				registry.registerCounter(metricName, `Bridged from tools counter '${parsed.name}'.`);
+				const delta = value - readBridgedValue(registry, metricName, parsed.labels);
+				if (delta > 0) registry.inc(metricName, parsed.labels, delta);
+			}
+		} catch {}
+	}
+}
+function parseCounterKey(key) {
+	const brace = key.indexOf("{");
+	if (brace === -1) return {
+		name: key,
+		labels: {}
+	};
+	if (!key.endsWith("}")) return void 0;
+	const name = key.slice(0, brace);
+	const body = key.slice(brace + 1, -1);
+	const labels = {};
+	for (const pair of body.split(",")) {
+		const eq = pair.indexOf("=");
+		if (eq <= 0) return void 0;
+		const labelName = pair.slice(0, eq);
+		if (!PROM_LABEL_NAME_RE.test(labelName)) return void 0;
+		labels[labelName] = sanitizeLabelValue(pair.slice(eq + 1));
+	}
+	return {
+		name,
+		labels
+	};
+}
+function toPrometheusName(name) {
+	return `graphorin_${name.replace(/[.-]/g, "_")}`;
+}
+/**
+* Same policy as the trigger-id sanitizer in `app-metrics.ts`: bound
+* the character set and the length so server identities / tool names
+* cannot explode label cardinality with UTF-8 sequences.
+*/
+function sanitizeLabelValue(value) {
+	return value.replace(/[^A-Za-z0-9_:.\-/]/g, "_").slice(0, 200);
+}
+function readBridgedValue(registry, name, labels) {
+	const entries = registry.snapshot().counters[name] ?? [];
+	for (const entry of entries) if (labelsEqual(entry.labels, labels)) return entry.value;
+	return 0;
+}
+function labelsEqual(a, b) {
+	const aKeys = Object.keys(a);
+	const bKeys = Object.keys(b);
+	if (aKeys.length !== bKeys.length) return false;
+	for (const k of bKeys) if (String(a[k]) !== b[k]) return false;
+	return true;
+}
+
+//#endregion
+export { syncToolCounters };
+//# sourceMappingURL=tools-bridge.js.map

package/dist/metrics/tools-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-bridge.js","names":["labels: Record<string, string>"],"sources":["../../src/metrics/tools-bridge.ts"],"sourcesContent":["/**\n * W-051: bridge the `@graphorin/tools` module-level counter registry\n * (which `@graphorin/mcp` also writes) into the server's\n * {@link MetricRegistry}, so `tool.*` / `mcp.*` telemetry - including\n * the shadow-mode `tool.dataflow.*` counters - shows up on\n * `/v1/metrics` without hand-wiring.\n *\n * Called from `refreshLiveMetrics` on every scrape. Counters are\n * delta-synced (the tools registry is cumulative per process; the\n * Prometheus registry increments by the positive difference, so\n * repeated scrapes never double-count); gauges are set absolutely -\n * the `kinds` field on the snapshot (added for exactly this bridge)\n * tells the two apart. Histograms are deliberately NOT bridged yet:\n * summary bridging needs per-key consumed-observation offsets, and the\n * raw observation lists stay available through `snapshotCounters()`\n * for library users (documented in the observability guide).\n *\n * Naming: `tool.executor.retry.total{toolName=x}` becomes\n * `graphorin_tool_executor_retry_total{toolName=\"x\"}` - `[.-]` map to\n * `_` (the Prometheus name grammar forbids dots), label values pass\n * through the same sanitizer as trigger ids.\n *\n * @packageDocumentation\n */\n\nimport { type CounterSnapshot, snapshotCounters } from '@graphorin/tools/audit';\nimport type { MetricRegistry } from './registry.js';\n\nconst BRIDGED_PREFIXES = ['tool.', 'mcp.'] as const;\nconst PROM_LABEL_NAME_RE = /^[a-zA-Z_][a-zA-Z0-9_]*$/;\n\n/**\n * Sync the tools-package counter snapshot into `registry`. Idempotent\n * per value: scraping twice without new increments changes nothing.\n *\n * @stable\n */\nexport function syncToolCounters(\n  registry: MetricRegistry,\n  snapshot: CounterSnapshot = snapshotCounters(),\n): void {\n  for (const [key, value] of Object.entries(snapshot.counters)) {\n    const parsed = parseCounterKey(key);\n    if (parsed === undefined) continue;\n    if (!BRIDGED_PREFIXES.some((prefix) => parsed.name.startsWith(prefix))) continue;\n    const kind = snapshot.kinds[key] ?? 'counter';\n    const metricName = toPrometheusName(parsed.name);\n    try {\n      if (kind === 'gauge') {\n        registry.registerGauge(metricName, `Bridged from tools counter '${parsed.name}'.`);\n        registry.set(metricName, value, parsed.labels);\n      } else {\n        registry.registerCounter(metricName, `Bridged from tools counter '${parsed.name}'.`);\n        const current = readBridgedValue(registry, metricName, parsed.labels);\n        const delta = value - current;\n        if (delta > 0) registry.inc(metricName, parsed.labels, delta);\n      }\n    } catch {\n      // Best-effort: one malformed key (or a name registered by other\n      // code with a conflicting kind) must never fail the scrape.\n    }\n  }\n}\n\n/** Parsed `name{k=v,...}` key in the tools `buildKey` format. */\ninterface ParsedCounterKey {\n  readonly name: string;\n  readonly labels: Record<string, string>;\n}\n\nfunction parseCounterKey(key: string): ParsedCounterKey | undefined {\n  const brace = key.indexOf('{');\n  if (brace === -1) return { name: key, labels: {} };\n  if (!key.endsWith('}')) return undefined;\n  const name = key.slice(0, brace);\n  const body = key.slice(brace + 1, -1);\n  const labels: Record<string, string> = {};\n  for (const pair of body.split(',')) {\n    const eq = pair.indexOf('=');\n    if (eq <= 0) return undefined;\n    const labelName = pair.slice(0, eq);\n    if (!PROM_LABEL_NAME_RE.test(labelName)) return undefined;\n    labels[labelName] = sanitizeLabelValue(pair.slice(eq + 1));\n  }\n  return { name, labels };\n}\n\nfunction toPrometheusName(name: string): string {\n  return `graphorin_${name.replace(/[.-]/g, '_')}`;\n}\n\n/**\n * Same policy as the trigger-id sanitizer in `app-metrics.ts`: bound\n * the character set and the length so server identities / tool names\n * cannot explode label cardinality with UTF-8 sequences.\n */\nfunction sanitizeLabelValue(value: string): string {\n  return value.replace(/[^A-Za-z0-9_:.\\-/]/g, '_').slice(0, 200);\n}\n\nfunction readBridgedValue(\n  registry: MetricRegistry,\n  name: string,\n  labels: Record<string, string>,\n): number {\n  const entries = registry.snapshot().counters[name] ?? [];\n  for (const entry of entries) {\n    if (labelsEqual(entry.labels, labels)) return entry.value;\n  }\n  return 0;\n}\n\nfunction labelsEqual(\n  a: Record<string, string | number | boolean>,\n  b: Record<string, string>,\n): boolean {\n  const aKeys = Object.keys(a);\n  const bKeys = Object.keys(b);\n  if (aKeys.length !== bKeys.length) return false;\n  for (const k of bKeys) {\n    if (String(a[k]) !== b[k]) return false;\n  }\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,mBAAmB,CAAC,SAAS,OAAO;AAC1C,MAAM,qBAAqB;;;;;;;AAQ3B,SAAgB,iBACd,UACA,WAA4B,kBAAkB,EACxC;AACN,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,SAAS,EAAE;EAC5D,MAAM,SAAS,gBAAgB,IAAI;AACnC,MAAI,WAAW,OAAW;AAC1B,MAAI,CAAC,iBAAiB,MAAM,WAAW,OAAO,KAAK,WAAW,OAAO,CAAC,CAAE;EACxE,MAAM,OAAO,SAAS,MAAM,QAAQ;EACpC,MAAM,aAAa,iBAAiB,OAAO,KAAK;AAChD,MAAI;AACF,OAAI,SAAS,SAAS;AACpB,aAAS,cAAc,YAAY,+BAA+B,OAAO,KAAK,IAAI;AAClF,aAAS,IAAI,YAAY,OAAO,OAAO,OAAO;UACzC;AACL,aAAS,gBAAgB,YAAY,+BAA+B,OAAO,KAAK,IAAI;IAEpF,MAAM,QAAQ,QADE,iBAAiB,UAAU,YAAY,OAAO,OAAO;AAErE,QAAI,QAAQ,EAAG,UAAS,IAAI,YAAY,OAAO,QAAQ,MAAM;;UAEzD;;;AAaZ,SAAS,gBAAgB,KAA2C;CAClE,MAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,KAAI,UAAU,GAAI,QAAO;EAAE,MAAM;EAAK,QAAQ,EAAE;EAAE;AAClD,KAAI,CAAC,IAAI,SAAS,IAAI,CAAE,QAAO;CAC/B,MAAM,OAAO,IAAI,MAAM,GAAG,MAAM;CAChC,MAAM,OAAO,IAAI,MAAM,QAAQ,GAAG,GAAG;CACrC,MAAMA,SAAiC,EAAE;AACzC,MAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,EAAE;EAClC,MAAM,KAAK,KAAK,QAAQ,IAAI;AAC5B,MAAI,MAAM,EAAG,QAAO;EACpB,MAAM,YAAY,KAAK,MAAM,GAAG,GAAG;AACnC,MAAI,CAAC,mBAAmB,KAAK,UAAU,CAAE,QAAO;AAChD,SAAO,aAAa,mBAAmB,KAAK,MAAM,KAAK,EAAE,CAAC;;AAE5D,QAAO;EAAE;EAAM;EAAQ;;AAGzB,SAAS,iBAAiB,MAAsB;AAC9C,QAAO,aAAa,KAAK,QAAQ,SAAS,IAAI;;;;;;;AAQhD,SAAS,mBAAmB,OAAuB;AACjD,QAAO,MAAM,QAAQ,uBAAuB,IAAI,CAAC,MAAM,GAAG,IAAI;;AAGhE,SAAS,iBACP,UACA,MACA,QACQ;CACR,MAAM,UAAU,SAAS,UAAU,CAAC,SAAS,SAAS,EAAE;AACxD,MAAK,MAAM,SAAS,QAClB,KAAI,YAAY,MAAM,QAAQ,OAAO,CAAE,QAAO,MAAM;AAEtD,QAAO;;AAGT,SAAS,YACP,GACA,GACS;CACT,MAAM,QAAQ,OAAO,KAAK,EAAE;CAC5B,MAAM,QAAQ,OAAO,KAAK,EAAE;AAC5B,KAAI,MAAM,WAAW,MAAM,OAAQ,QAAO;AAC1C,MAAK,MAAM,KAAK,MACd,KAAI,OAAO,EAAE,GAAG,KAAK,EAAE,GAAI,QAAO;AAEpC,QAAO"}

package/dist/middleware/audit.d.ts

@@ -1,6 +1,6 @@
 import { ServerVariables } from "../internal/context.js";
-import { AuditDb, AuditEntryInput } from "@graphorin/security/audit";
 import { MiddlewareHandler } from "hono";
+import { AuditDb, AuditEntryInput } from "@graphorin/security/audit";
 
 //#region src/middleware/audit.d.ts
 

package/dist/middleware/auth.js

@@ -1,4 +1,4 @@
-import { parseScope } from "@graphorin/security/auth";
+import { parseScope, tryParseScope } from "@graphorin/security/auth";
 
 //#region src/middleware/auth.ts
 /**

package/dist/middleware/csrf.js

@@ -1,5 +1,5 @@
-import { randomBytes, timingSafeEqual } from "node:crypto";
 import { Buffer } from "node:buffer";
+import { randomBytes, timingSafeEqual } from "node:crypto";
 
 //#region src/middleware/csrf.ts
 /**