@graphorin/server 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,76 @@
 # @graphorin/server
 
+## 0.7.0
+
+### Minor Changes
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-110: both audit.db open paths now apply the CS-7 cipher-selection pragmas before `PRAGMA key`, so `config.audit.cipher` actually selects the cipher (it was silently ignored - every audit.db came out as the sqlite3mc default, and tools opening it with the declared `sqlcipher` failed with SQLITE_NOTADB). The audit default is pinned to `chacha20` (NOT the main store's `sqlcipher`): pre-fix audit files were created without cipher pragmas, i.e. in chacha20 format, so the pin stays byte-compatible with every existing file. Unknown cipher values fail fast. UPGRADE NOTE: a deployment whose config has long carried `audit.cipher: 'sqlcipher'` (previously ignored) will now fail to open its existing chacha20 file - remove the setting or re-encrypt the audit database. `cipherSelectionPragmas` is now exported from `@graphorin/store-sqlite`.
+
+- [#153](https://github.com/o-stepper/graphorin/pull/153) [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534) Thanks [@o-stepper](https://github.com/o-stepper)! - Reachable per-thread checkpoint erasure (W-005) - `CheckpointStore.deleteThread` finally has supported callers:
+
+  - `@graphorin/workflow`: the workflow handle gains `deleteThread(threadId)` next to `listCheckpoints` (idempotent; deletes every checkpoint + pending write of the thread).
+  - `@graphorin/server`: new route `DELETE /v1/workflows/:id/threads/:threadId` under scope `workflows:delete:<id>` (204 on success, 404 for an unknown workflow, 400 when the registered entry does not expose `deleteThread`); `ServerWorkflowLike` gains the optional `deleteThread?` member.
+  - `@graphorin/agent`: opt-in `AgentConfig.checkpointPolicy: 'keep' | 'delete-on-terminal'` (default `'keep'` - byte-identical to today). With `'delete-on-terminal'` the run's checkpoint thread is best-effort deleted after `completed`/`failed` runs, mirroring the TL-10 spill lifecycle; `awaiting_approval` and `aborted` runs always keep theirs (the thread is the resume state).
+
+  Full erasure cascades stay the job of the session purge path; these are the operator levers for hygiene and targeted per-thread GDPR requests.
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-072: every export map's `import` condition becomes `default`, and the Node floor rises to `>=22.12.0`.
+
+  CJS consumers previously hit a bewildering `ERR_PACKAGE_PATH_NOT_EXPORTED` instead of a clear ESM-only signal. With the `default` condition, plain `require('@graphorin/core')` works via Node's stable `require(esm)` - which shipped in 22.12, hence the engines bump across every workspace manifest (packages, examples, benchmarks, docs; enforced by the widened mvp-readiness sweep). No dual-instance hazard: there is no CJS build, `require()` returns the same ESM module instance. ESM consumers are unaffected (`default` serves both paths; `types` stays first). The pack gate now runs attw under the full `node16` profile (was `esm-only`) and adds a runtime `require(esm)` smoke against the packed tarballs. Installs on Node 22.0-22.11 with `engine-strict` will refuse - upgrade Node (see the migration guide).
+
+- [#158](https://github.com/o-stepper/graphorin/pull/158) [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab) Thanks [@o-stepper](https://github.com/o-stepper)! - Unified retention scheduler (W-010 / W-008). The server now runs a periodic sweep (`config.retention`, default every 6 hours, first sweep immediately at startup) over every SQLite growth surface. Default-on for derived/recoverable data with conservative windows: spans older than 30 days, consolidator run counters older than 90 days, exhausted DLQ batches older than 30 days, and expired idempotency records (subsuming the W-061 hourly sweep). Primary user content is strictly opt-in via explicit windows: `sessionsDays` (+ `sessionsClosedOnly`, default true), `auditDays`, `memoryHistoryDays`, and `workflowThreadsDays` (always terminal-only threads). `retention.enabled: false` disables the mechanism entirely. Each surface prunes in its own try/catch: a failure logs WARN and never blocks the others; a sweep that deleted rows logs INFO with per-surface counts through the new `createConsoleRetentionLog` (the first consumer of `observability.logger`). New exports: `scheduleRetentionSweeps`, `RetentionConfig`, `RetentionStoreLike`, `RetentionLog`, `createConsoleRetentionLog`. BEHAVIOUR CHANGE on upgrade: old span telemetry and expired idempotency bodies start being deleted by default - set `retention: { enabled: false }` or widen the windows to keep them. The deployment guide gains a growth-surface table (including the file-based replay-JSONL directory, which stays cron-territory) and lib-mode scheduling guidance.
+
+- [#158](https://github.com/o-stepper/graphorin/pull/158) [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab) Thanks [@o-stepper](https://github.com/o-stepper)! - Durable timers now fire without user polling code (W-032). The engine stamps `CheckpointMetadata.wakeAt` (earliest due frontier timer) on suspended checkpoints; `CheckpointStore` gains the optional `listSuspended(namespace, { dueBefore, limit })` enumeration (implemented by the SQLite adapter - migration 032 adds `workflow_checkpoints.wake_at` with a partial index - and by `InMemoryCheckpointStore`); the new `createTimerDriver({ workflows: [{ workflow, checkpointStore }] })` polls due threads and calls `workflow.tick`, re-arming at `min(pollIntervalMs, earliest nextWakeAt)`, with per-thread error isolation and benign handling of cross-process `checkpoint-version-conflict` races. On the server, `createServer({ workflowTimers: { driver } })` binds a lifecycle daemon and reports `checks.workflowTimers` on `/v1/health`. A custom store without `listSuspended` fails fast with `TimerDriverStoreUnsupportedError`. Threads suspended before migration 032 carry no `wake_at` and stay invisible to the driver until one manual `tick` or resume re-persists them.
+
+- [#160](https://github.com/o-stepper/graphorin/pull/160) [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156) Thanks [@o-stepper](https://github.com/o-stepper)! - W-051: tools/MCP telemetry finally reaches the server's operator surfaces - shadow-mode dataflow findings are observable without hand-wiring.
+
+  - `@graphorin/tools`: `CounterSnapshot` gains a `kinds` record (`'counter'` vs `'gauge'` per key, tracked at write time) so exporters can bridge monotonic counters with delta-inc and gauges with absolute set.
+  - `/v1/metrics`: every scrape folds the live `tool.*` / `mcp.*` counters into the Prometheus registry as lazily-registered `graphorin_tool_*` / `graphorin_mcp_*` series (delta-synced counters - re-scrapes never double-count; absolute gauges; label values sanitized). Histograms are deliberately not bridged yet (documented; raw observations stay available via `snapshotCounters()`).
+  - Audit chain: a new bridge subscribes `onToolAudit` to the tamper-evident audit log, governed by `audit.toolEvents`: `'security'` (default - dataflow flagged/blocked/declassified, sanitization, approvals, collisions, cap-disabled), `'all'` (adds per-call `tool:execute:*`), `'off'`. Unsubscribed and drained on shutdown before the audit DB closes. Exported for embedders as `bridgeToolAuditToAudit` / `syncToolCounters`.
+  - `@graphorin/server` now depends on `@graphorin/tools` directly (it previously reached tools types only transitively).
+
+- [#158](https://github.com/o-stepper/graphorin/pull/158) [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab) Thanks [@o-stepper](https://github.com/o-stepper)! - `POST /v1/tokens` enforces attenuation-only minting (W-106): a token principal can only mint scopes its own grant covers (`scopeMatches` semantics - `admin:*` covers all, two-segment grants cover three-segment requests, never the reverse), answering `403 scope-escalation-denied` with the uncovered list otherwise; delegation chains narrow monotonically since the child's `tokens:create` must itself be covered. Syntactically invalid requested scopes now answer `400` instead of minting a token that grants nothing. Integrations that minted wider tokens through a bare `tokens:create` service token must grant the minter the full target set (or `admin:*`). The anonymous trusted-loopback operator (auth disabled) is exempt; the CLI path is unaffected.
+
+- [#158](https://github.com/o-stepper/graphorin/pull/158) [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab) Thanks [@o-stepper](https://github.com/o-stepper)! - Scope granularity is symmetric across every surface (W-107). Session REST reads (`GET /:id`, `/messages`, `/handoffs`, `/export`, `DELETE`) and the SSE fallback (`GET /v1/sessions/:id/events`) now require per-resource `sessions:<verb>:<sessionId>` - a token scoped to one session gets the same access on REST/SSE it already had on WS, while bare two-segment grants keep covering everything (the global list stays a two-segment administrative read). `POST /v1/session/ws-ticket` requires only authentication (the ticket adds no rights; every subscribe is per-subject gated) - read-only tokens get their browser WS path. Run control binds to the run's OWNING resource on BOTH surfaces: REST `/runs/:runId/{state,abort,resume}` and WS `run.cancel` / `notifications/cancelled` resolve the run first (unknown id answers 404/RUN_NOT_FOUND before scope; runIds are unguessable and ephemeral) and then require `agents:{read,invoke}:<agentId>` or `workflows:{read,execute}:<workflowId>`; a three-segment grant for another agent's run is now denied. Dynamic scope requirements parse with the non-throwing parser, so junk URL segments answer 403 instead of 500. New helpers `checkScope` and `createAuthenticatedMiddleware` are exported from the middleware module.
+
+- [#158](https://github.com/o-stepper/graphorin/pull/158) [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab) Thanks [@o-stepper](https://github.com/o-stepper)! - The server workflow surface exposes every D1 primitive over HTTP (W-119). `POST /:id/resume` accepts an optional `name` that routes through `resolveAwakeable` (targeting one of several parallel awakeables/approvals); new `POST /:id/retry` (background replay of a failed/aborted thread) and `POST /:id/tick` (synchronous due-timer firing with `{fired, nextWakeAt}`) under `workflows:resume:<id>`; `POST /:id/fork` performs a REAL fork (the periphery-01 honest 501 retires) returning `201 { newThreadId }`, defaulting to the thread's latest checkpoint. `ServerWorkflowLike` gains the optional `retry/tick/resolveAwakeable/fork` methods and an `opts.signal` third parameter on `resume`; background resume/retry now receive the run tracker's AbortSignal so `runs.abort(runId)` actually cancels them.
+
+- [#158](https://github.com/o-stepper/graphorin/pull/158) [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab) Thanks [@o-stepper](https://github.com/o-stepper)! - `POST /agents/:id/stream` rejects a malformed body with the same `400 config-invalid` envelope as its sibling `/run` route (W-151), validated through one shared helper BEFORE any run is registered - previously a failed parse silently launched the agent on an empty prompt behind a successful-looking 202, burning provider tokens. Empty and absent bodies stay valid via the schema default, so minimal legitimate calls are unaffected; clients that relied on the silent 202 for invalid bodies now get the honest 400.
+
+### Patch Changes
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-011: cross-process fencing for the audit hash chain. `AuditDb` gains an optional `transact` member (BEGIN-IMMEDIATE semantics, additive - custom bindings keep compiling); the default binding in `@graphorin/server` implements it with rollback strictly in `finally`. `appendAudit` wraps its `latest()`+`insert()` read-modify-write in the fence, so two processes sharing one audit.db can no longer hash against the same tip; on bindings WITHOUT the fence a seq primary-key collision is now retried (bounded, re-reading the tip) instead of silently dropping the losing security entry. `pruneAudit` runs its delete + suffix re-hash inside ONE transaction - a concurrent append waits for the lock and chains to the post-prune tip instead of leaving a permanent verify break - and FAILS CLOSED on bindings without `transact` (an unsafe prune is worse than a refused one). Verified with worker-thread contention tests against a real encrypted audit.db.
+
+- [#153](https://github.com/o-stepper/graphorin/pull/153) [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534) Thanks [@o-stepper](https://github.com/o-stepper)! - Disk-hygiene fix (W-061): expired `idempotency_records` (each row stores the full `response_json` of a keyed POST) are now swept from the database on a periodic timer (`scheduleIdempotencyPruning`, hourly, unref-ed, stopped on `server.stop()`). Previously `SqliteIdempotencyStore.prune` existed but had zero callers - expiry was only checked on the read path, so response bodies accumulated on disk indefinitely. The sweep deletes exactly the records the read path already refuses to replay; IETF-draft replay semantics are unchanged.
+
+- [#162](https://github.com/o-stepper/graphorin/pull/162) [`73b19ca`](https://github.com/o-stepper/graphorin/commit/73b19caeda388bda628a48138cb7d70b1db839a3) Thanks [@o-stepper](https://github.com/o-stepper)! - Remove phantom workspace dependencies that no source file imports: agent no longer depends on provider and observability, mcp/workflow/server no longer depend on observability, sessions no longer depends on security (and its memory edge moves to devDependencies where the single test import lives), skills no longer depends on tools. Dead tsdown `external` entries for the removed edges are gone too, so a future import can no longer build as external without a declared dependency. Consumer install graphs shrink accordingly; a new repo-wide `check-phantom-deps` CI gate keeps the manifest graph honest from here on.
+
+- [#164](https://github.com/o-stepper/graphorin/pull/164) [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00) Thanks [@o-stepper](https://github.com/o-stepper)! - TSDoc `{@link}` hygiene sweep (W-130): all 55 broken links found by TypeDoc's now-enabled `validation.invalidLink` are fixed - two resolved to their real targets (`GraphorinMCPError` was misnamed `MCPError`), the rest (cross-package, `import()`-form, unexported-constant, and DOM-type references that have never rendered as hrefs) converted to plain inline code. The docs build now fails on any new broken `{@link}` via a scoped gate.
+
+- [#164](https://github.com/o-stepper/graphorin/pull/164) [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00) Thanks [@o-stepper](https://github.com/o-stepper)! - The server's sibling peer floors (`@graphorin/agent`/`memory`/`sessions`/`workflow`) now track the current minor (W-135): the static `workspace:>=0.5.0 <1.0.0` range let npm silently assemble a mixed install (agent@0.5.0 under server@0.6.x). The floor is rewritten to the just-computed minor by `bump-version --sync` AFTER `changeset version` (a statically narrow range would re-trigger the changesets fixed-group escalation to a phantom 1.0.0), and `check-version-consistency` fails any release pass that skips the rewrite.
+
+- [#164](https://github.com/o-stepper/graphorin/pull/164) [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00) Thanks [@o-stepper](https://github.com/o-stepper)! - Tarballs now ship `src/` so the published `dist/**/*.d.ts.map` files actually work (W-136): the maps referenced `../src/*.ts` that the `files` whitelist excluded, so go-to-definition fell back into `.d.ts` and the shipped maps were dead weight. The pack gate gains a `map-integrity` leg: every source referenced by a shipped map must resolve inside the tarball (or be embedded via `sourcesContent`), with an anti-vacuous guard - a package whose tsdown config emits declaration maps must contain a non-zero number of `.d.ts.map` files, so a cache-restored dist that silently dropped maps fails the gate instead of passing vacuously. `mvp-readiness` now requires `src` in every publishable `files` array.
+
+- [#164](https://github.com/o-stepper/graphorin/pull/164) [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00) Thanks [@o-stepper](https://github.com/o-stepper)! - Every published package now declares its tree-shaking contract via `sideEffects` (W-137): 18 packages audited to a pure module scope get `false`, the CLI declares its bin entry (`["./dist/bin/*"]`), and `@graphorin/security` gets an explicit `true` - its secrets subsystem registers built-in resolvers and the SecretValue caller-context provider at import time, so marking it pure would let bundlers drop those registrations. `mvp-readiness` now fails any publishable manifest without a declared `sideEffects`, closing the drift for future packages.
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-046: JSON-safe `WireAgentEvent` projection for all binary-bearing event variants, applied on the server WS path.
+
+  `@graphorin/core` gains `WireFileGeneratedEvent`, `WireToolExecutePartialEvent`, `WireAgentEndEvent` (whose `result.state` is the `WireRunState` projection) plus the `WireAgentEvent` union and pure `toWireAgentEvent`/`fromWireAgentEvent` codecs. The `AgentEvent` TSDoc now documents the real two-layer wire contract (envelope `{eventId, subject, type, payload}` with `payload = WireAgentEvent`) instead of the false claim that `@graphorin/protocol` re-exports the union; protocol stays zod-only with a doc pointer. The server's `backgroundStreamAgent` projects every streamed event before emitting, so `file.generated`, binary `tool.execute.partial` chunks and a multimodal `agent.end` state arrive at WS clients decodable instead of as numeric-key mush. An exhaustive `Record<AgentEvent['type'], ...>` fixture gate in core forces a wire decision for every future event variant.
+
+- [#153](https://github.com/o-stepper/graphorin/pull/153) [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534) Thanks [@o-stepper](https://github.com/o-stepper)! - Machine-readable workflow failure codes on the wire (W-052): the `workflow.error` WS frame payload and the run-status `error` object now carry `code` (and `hint` when the source error has one) next to the unchanged `message`. Normalization happens at the server boundary via the new internal `toWireError` helper - `err.code` (agent/workflow error family) wins, `err.kind` (tools/memory/provider/server family) is the fallback, `'unknown'` otherwise - so clients can retry `checkpoint-version-conflict` and abandon `node-execution-failed` without parsing English text. No package-internal discriminators were renamed; the field is additive.
+
+- [#153](https://github.com/o-stepper/graphorin/pull/153) [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534) Thanks [@o-stepper](https://github.com/o-stepper)! - WS replay-buffer memory-leak fix (W-028): a periodic prune sweep (`scheduleReplayBufferPruning`, default every 60 s, `stream.replayBuffer.pruneIntervalSeconds` config) now applies the already-documented TTL to every subject, so finished-run subjects (a fresh runId per run, never touched again by push/replay) no longer retain up to 1000 full payloads forever on a long-living server. Emptied subjects release their `dropped`-map entry too; a resume whose cursor misses the buffer still reports `droppedCount >= 1` (the miss itself proves the gap), so the replay-marker keeps firing. The `@stable` `ReplayBuffer` interface gains an OPTIONAL `stats?(): { subjects, events }` (external implementations keep compiling; `createReplayBuffer` always provides it), and the `graphorin_replay_buffer_events` gauge now reports buffered EVENTS as its name says - previously it was filled with the subscription count (dashboards reading it will see the corrected semantics). Replay semantics inside the TTL window are unchanged; servers without WS are unaffected.
+
+- [#153](https://github.com/o-stepper/graphorin/pull/153) [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534) Thanks [@o-stepper](https://github.com/o-stepper)! - Security fix (W-027): the WebSocket replay path now sanitizes every buffered frame with the same delivery-commentary sanitizer as the live path and the SSE replay. Previously a fresh WS subscription (or a reconnect-resume) received up to 1000 raw buffered frames, bypassing the `wrap`/`strip` commentary policy and its audit decisions exactly on the reconnect scenario the buffer exists for. Delivery now goes through a single `dispatchSanitized` choke point shared by the live and replay paths, so future delivery paths cannot silently bypass the sanitizer; replayed bytes are identical to live bytes for the same frame (single sanitize per delivery, no double-wrap), and the `lastEventId` ordering invariant is unchanged.
+
+- Updated dependencies [[`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`73b19ca`](https://github.com/o-stepper/graphorin/commit/73b19caeda388bda628a48138cb7d70b1db839a3), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04)]:
+  - @graphorin/core@0.7.0
+  - @graphorin/security@0.7.0
+  - @graphorin/store-sqlite@0.7.0
+  - @graphorin/tools@0.7.0
+  - @graphorin/protocol@0.7.0
+  - @graphorin/triggers@0.7.0
+
 ## 0.6.1
 
 ### Patch Changes

package/README.md

@@ -5,7 +5,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Node.js: 22+](https://img.shields.io/badge/Node.js-22%2B-43853d.svg)](https://nodejs.org)
 
-- **Version:** v0.6.1
+- **Version:** v0.7.0
 - **License:** [MIT](./LICENSE) (© 2026 Oleksiy Stepurenko)
 - **Repository:** <https://github.com/o-stepper/graphorin/tree/main/packages/server>
 - **Issues:** <https://github.com/o-stepper/graphorin/issues>
@@ -109,8 +109,8 @@ The most-frequently-touched options:
 
 ## Status
 
-`@graphorin/server` is part of the Graphorin framework's `v0.6.1` pre-release. Once published, the package follows the lockstep release cadence shared by every `@graphorin/*` package on the `0.x` line.
+`@graphorin/server` is part of the Graphorin framework's `v0.7.0` pre-release. Once published, the package follows the lockstep release cadence shared by every `@graphorin/*` package on the `0.x` line.
 
 ---
 
-**Project Graphorin** · v0.6.1 · MIT License · © 2026 Oleksiy Stepurenko · <https://github.com/o-stepper/graphorin>
+**Project Graphorin** · v0.7.0 · MIT License · © 2026 Oleksiy Stepurenko · <https://github.com/o-stepper/graphorin>

package/dist/app-audit-binding.d.ts

@@ -0,0 +1,15 @@
+//#region src/app-audit-binding.d.ts
+/**
+ * Default audit-db binding registration for `createServer({...})`.
+ *
+ * Extracted from `app.ts` so the binding (and its SQLite row mapping)
+ * lives next to nothing but itself; the server lifecycle and the CLI
+ * both call {@link ensureStoreAuditBinding} before opening the audit
+ * chain.
+ *
+ * @packageDocumentation
+ */
+declare function ensureStoreAuditBinding(): void;
+//#endregion
+export { ensureStoreAuditBinding };
+//# sourceMappingURL=app-audit-binding.d.ts.map

package/dist/app-audit-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-audit-binding.d.ts","names":[],"sources":["../src/app-audit-binding.ts"],"sourcesContent":[],"mappings":";;AAuCA;;;;;;;;;iBAAgB,uBAAA,CAAA"}

package/dist/app-audit-binding.js

@@ -0,0 +1,136 @@
+import { cipherSelectionPragmas, loadCipherDriver } from "@graphorin/store-sqlite";
+import { registerAuditDbBinding } from "@graphorin/security/audit";
+
+//#region src/app-audit-binding.ts
+/**
+* Default audit-db binding registration for `createServer({...})`.
+*
+* Extracted from `app.ts` so the binding (and its SQLite row mapping)
+* lives next to nothing but itself; the server lifecycle and the CLI
+* both call {@link ensureStoreAuditBinding} before opening the audit
+* chain.
+*
+* @packageDocumentation
+*/
+/** The ciphers sqlite3mc supports - mirrors `EncryptionCipher`. */
+const KNOWN_CIPHERS = new Set([
+	"sqlcipher",
+	"chacha20",
+	"aes256cbc",
+	"aes128cbc",
+	"rc4"
+]);
+/**
+* Pre-built audit-db binding shipped from `@graphorin/store-sqlite`.
+* Registered exactly once per process so {@link openAuditDb} can find
+* a default binding without forcing operators to wire it manually.
+*
+* Exported as {@link ensureStoreAuditBinding} so the CLI (Phase 15
+* `graphorin audit verify | prune | export`) can reach into the same
+* binding without booting the HTTP listener.
+*
+* @stable
+*/
+let storeAuditBindingRegistered = false;
+function ensureStoreAuditBinding() {
+	if (storeAuditBindingRegistered) return;
+	registerAuditDbBinding({
+		id: "better-sqlite3-multiple-ciphers",
+		description: "Default audit-db binding shipped by @graphorin/store-sqlite.",
+		open: async (opts) => {
+			const driver = await loadCipherDriver();
+			const passphrase = await opts.passphrase.use((value) => value);
+			const Db = driver;
+			const cipher = opts.cipher ?? "chacha20";
+			if (!KNOWN_CIPHERS.has(cipher)) throw new Error(`[graphorin/server] unknown audit.cipher '${cipher}'. Supported: ${[...KNOWN_CIPHERS].join(", ")}.`);
+			const db = new Db(opts.path);
+			for (const pragma of cipherSelectionPragmas(cipher)) db.pragma(pragma);
+			db.pragma(`key = '${passphrase.replace(/'/g, "''")}'`);
+			db.pragma("journal_mode = WAL");
+			db.pragma("synchronous = NORMAL");
+			db.pragma("busy_timeout = 5000");
+			db.pragma("foreign_keys = ON");
+			db.exec(`CREATE TABLE IF NOT EXISTS audit_log (
+            seq INTEGER PRIMARY KEY,
+            ts INTEGER NOT NULL,
+            actor_json TEXT NOT NULL,
+            action TEXT NOT NULL,
+            target TEXT NOT NULL,
+            decision TEXT NOT NULL,
+            context_json TEXT,
+            metadata_json TEXT,
+            prev_hash TEXT NOT NULL,
+            hash TEXT NOT NULL UNIQUE
+          ) WITHOUT ROWID;`);
+			return {
+				binding: "better-sqlite3-multiple-ciphers",
+				path: opts.path,
+				async insert(entry) {
+					db.prepare(`INSERT INTO audit_log (
+                 seq, ts, actor_json, action, target, decision,
+                 context_json, metadata_json, prev_hash, hash
+               ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(entry.seq, entry.ts, JSON.stringify(entry.actor), entry.action, entry.target, entry.decision, entry.context !== void 0 ? JSON.stringify(entry.context) : null, entry.metadata !== void 0 ? JSON.stringify(entry.metadata) : null, entry.prevHash, entry.hash);
+					return entry;
+				},
+				async latest() {
+					const row = db.prepare("SELECT * FROM audit_log ORDER BY seq DESC LIMIT 1").get();
+					if (row === void 0) return void 0;
+					return rowToEntry(row);
+				},
+				async *iterate(bounds) {
+					const lo = bounds?.fromSeq ?? 1;
+					const hi = bounds?.toSeq ?? Number.MAX_SAFE_INTEGER;
+					const iter = db.prepare("SELECT * FROM audit_log WHERE seq BETWEEN ? AND ? ORDER BY seq ASC").iterate(lo, hi);
+					for (const row of iter) yield rowToEntry(row);
+				},
+				async count() {
+					return db.prepare("SELECT COUNT(*) AS n FROM audit_log").get().n;
+				},
+				async deleteUpTo(threshold) {
+					const before = db.prepare("SELECT COUNT(*) AS n FROM audit_log WHERE seq <= ?").get(threshold);
+					db.prepare("DELETE FROM audit_log WHERE seq <= ?").run(threshold);
+					return before.n;
+				},
+				async replaceEntry(entry) {
+					db.prepare(`UPDATE audit_log SET prev_hash = ?, hash = ? WHERE seq = ?`).run(entry.prevHash, entry.hash, entry.seq);
+				},
+				async transact(fn) {
+					db.exec("BEGIN IMMEDIATE");
+					let committed = false;
+					try {
+						const result = await fn();
+						db.exec("COMMIT");
+						committed = true;
+						return result;
+					} finally {
+						if (!committed) try {
+							db.exec("ROLLBACK");
+						} catch {}
+					}
+				},
+				async close() {
+					if (db.open) db.close();
+				}
+			};
+		}
+	}, { setAsDefault: true });
+	storeAuditBindingRegistered = true;
+}
+function rowToEntry(row) {
+	return {
+		seq: row.seq,
+		ts: row.ts,
+		actor: JSON.parse(row.actor_json),
+		action: row.action,
+		target: row.target,
+		decision: row.decision,
+		...row.context_json !== null ? { context: JSON.parse(row.context_json) } : {},
+		...row.metadata_json !== null ? { metadata: JSON.parse(row.metadata_json) } : {},
+		prevHash: row.prev_hash,
+		hash: row.hash
+	};
+}
+
+//#endregion
+export { ensureStoreAuditBinding };
+//# sourceMappingURL=app-audit-binding.js.map

package/dist/app-audit-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-audit-binding.js","names":["KNOWN_CIPHERS: ReadonlySet<string>"],"sources":["../src/app-audit-binding.ts"],"sourcesContent":["/**\n * Default audit-db binding registration for `createServer({...})`.\n *\n * Extracted from `app.ts` so the binding (and its SQLite row mapping)\n * lives next to nothing but itself; the server lifecycle and the CLI\n * both call {@link ensureStoreAuditBinding} before opening the audit\n * chain.\n *\n * @packageDocumentation\n */\n\nimport { registerAuditDbBinding } from '@graphorin/security/audit';\nimport {\n  cipherSelectionPragmas,\n  type EncryptionCipher,\n  loadCipherDriver,\n} from '@graphorin/store-sqlite';\n\n/** The ciphers sqlite3mc supports - mirrors `EncryptionCipher`. */\nconst KNOWN_CIPHERS: ReadonlySet<string> = new Set([\n  'sqlcipher',\n  'chacha20',\n  'aes256cbc',\n  'aes128cbc',\n  'rc4',\n]);\n\n/**\n * Pre-built audit-db binding shipped from `@graphorin/store-sqlite`.\n * Registered exactly once per process so {@link openAuditDb} can find\n * a default binding without forcing operators to wire it manually.\n *\n * Exported as {@link ensureStoreAuditBinding} so the CLI (Phase 15\n * `graphorin audit verify | prune | export`) can reach into the same\n * binding without booting the HTTP listener.\n *\n * @stable\n */\nlet storeAuditBindingRegistered = false;\nexport function ensureStoreAuditBinding(): void {\n  if (storeAuditBindingRegistered) return;\n  registerAuditDbBinding(\n    {\n      id: 'better-sqlite3-multiple-ciphers',\n      description: 'Default audit-db binding shipped by @graphorin/store-sqlite.',\n      open: async (opts) => {\n        const driver = await loadCipherDriver();\n        const passphrase = await opts.passphrase.use((value) => value);\n        const Db = driver as unknown as new (\n          path: string,\n        ) => {\n          pragma(s: string): unknown;\n          prepare(sql: string): {\n            run(...args: unknown[]): unknown;\n            get(...args: unknown[]): unknown;\n            all(...args: unknown[]): unknown;\n            iterate(...args: unknown[]): IterableIterator<unknown>;\n          };\n          exec(sql: string): unknown;\n          close(): void;\n          open: boolean;\n        };\n        // W-110 / CS-7: pin the cipher BEFORE PRAGMA key - `opts.cipher`\n        // (config.audit.cipher) was previously ignored, so every audit.db\n        // silently came out as sqlite3mc's default. Default 'chacha20':\n        // pre-fix files were created without cipher pragmas (= chacha20\n        // format), so this pin is byte-compatible with every existing\n        // audit.db, while 'sqlcipher' (the MAIN store's ADR-030 default)\n        // would brick them. Unknown values fail fast.\n        const cipher = opts.cipher ?? 'chacha20';\n        if (!KNOWN_CIPHERS.has(cipher)) {\n          throw new Error(\n            `[graphorin/server] unknown audit.cipher '${cipher}'. Supported: ${[...KNOWN_CIPHERS].join(', ')}.`,\n          );\n        }\n        const db = new Db(opts.path);\n        for (const pragma of cipherSelectionPragmas(cipher as EncryptionCipher)) {\n          db.pragma(pragma);\n        }\n        db.pragma(`key = '${passphrase.replace(/'/g, \"''\")}'`);\n        db.pragma('journal_mode = WAL');\n        db.pragma('synchronous = NORMAL');\n        db.pragma('busy_timeout = 5000');\n        db.pragma('foreign_keys = ON');\n        db.exec(\n          `CREATE TABLE IF NOT EXISTS audit_log (\n            seq INTEGER PRIMARY KEY,\n            ts INTEGER NOT NULL,\n            actor_json TEXT NOT NULL,\n            action TEXT NOT NULL,\n            target TEXT NOT NULL,\n            decision TEXT NOT NULL,\n            context_json TEXT,\n            metadata_json TEXT,\n            prev_hash TEXT NOT NULL,\n            hash TEXT NOT NULL UNIQUE\n          ) WITHOUT ROWID;`,\n        );\n        return {\n          binding: 'better-sqlite3-multiple-ciphers',\n          path: opts.path,\n          async insert(entry) {\n            db.prepare(\n              `INSERT INTO audit_log (\n                 seq, ts, actor_json, action, target, decision,\n                 context_json, metadata_json, prev_hash, hash\n               ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n            ).run(\n              entry.seq,\n              entry.ts,\n              JSON.stringify(entry.actor),\n              entry.action,\n              entry.target,\n              entry.decision,\n              entry.context !== undefined ? JSON.stringify(entry.context) : null,\n              entry.metadata !== undefined ? JSON.stringify(entry.metadata) : null,\n              entry.prevHash,\n              entry.hash,\n            );\n            return entry;\n          },\n          async latest() {\n            const row = db.prepare('SELECT * FROM audit_log ORDER BY seq DESC LIMIT 1').get() as\n              | undefined\n              | {\n                  seq: number;\n                  ts: number;\n                  actor_json: string;\n                  action: string;\n                  target: string;\n                  decision: string;\n                  context_json: string | null;\n                  metadata_json: string | null;\n                  prev_hash: string;\n                  hash: string;\n                };\n            if (row === undefined) return undefined;\n            return rowToEntry(row);\n          },\n          async *iterate(bounds) {\n            const lo = bounds?.fromSeq ?? 1;\n            const hi = bounds?.toSeq ?? Number.MAX_SAFE_INTEGER;\n            const iter = db\n              .prepare('SELECT * FROM audit_log WHERE seq BETWEEN ? AND ? ORDER BY seq ASC')\n              .iterate(lo, hi);\n            for (const row of iter) yield rowToEntry(row as Parameters<typeof rowToEntry>[0]);\n          },\n          async count() {\n            const row = db.prepare('SELECT COUNT(*) AS n FROM audit_log').get() as { n: number };\n            return row.n;\n          },\n          async deleteUpTo(threshold) {\n            const before = db\n              .prepare('SELECT COUNT(*) AS n FROM audit_log WHERE seq <= ?')\n              .get(threshold) as { n: number };\n            db.prepare('DELETE FROM audit_log WHERE seq <= ?').run(threshold);\n            return before.n;\n          },\n          async replaceEntry(entry) {\n            db.prepare(`UPDATE audit_log SET prev_hash = ?, hash = ? WHERE seq = ?`).run(\n              entry.prevHash,\n              entry.hash,\n              entry.seq,\n            );\n          },\n          // W-011: cross-process fence. Raw BEGIN IMMEDIATE (not\n          // better-sqlite3's .transaction() - that helper rejects async\n          // functions, while this binding's methods are async-shaped\n          // with synchronous bodies; the in-process WRITE_CHAINS\n          // serialisation guarantees no foreign statement interleaves\n          // inside the transaction). ROLLBACK strictly in finally so an\n          // exception can never leave the handle wedged inside an open\n          // transaction.\n          async transact(fn) {\n            db.exec('BEGIN IMMEDIATE');\n            let committed = false;\n            try {\n              const result = await fn();\n              db.exec('COMMIT');\n              committed = true;\n              return result;\n            } finally {\n              if (!committed) {\n                try {\n                  db.exec('ROLLBACK');\n                } catch {\n                  // Already rolled back / connection unusable - nothing to release.\n                }\n              }\n            }\n          },\n          async close() {\n            if (db.open) db.close();\n          },\n        };\n      },\n    },\n    { setAsDefault: true },\n  );\n  storeAuditBindingRegistered = true;\n}\n\nfunction rowToEntry(row: {\n  seq: number;\n  ts: number;\n  actor_json: string;\n  action: string;\n  target: string;\n  decision: string;\n  context_json: string | null;\n  metadata_json: string | null;\n  prev_hash: string;\n  hash: string;\n}) {\n  return {\n    seq: row.seq,\n    ts: row.ts,\n    actor: JSON.parse(row.actor_json),\n    action: row.action,\n    target: row.target,\n    decision: row.decision as 'success' | 'denied' | 'error' | 'not-found',\n    ...(row.context_json !== null ? { context: JSON.parse(row.context_json) } : {}),\n    ...(row.metadata_json !== null ? { metadata: JSON.parse(row.metadata_json) } : {}),\n    prevHash: row.prev_hash,\n    hash: row.hash,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,MAAMA,gBAAqC,IAAI,IAAI;CACjD;CACA;CACA;CACA;CACA;CACD,CAAC;;;;;;;;;;;;AAaF,IAAI,8BAA8B;AAClC,SAAgB,0BAAgC;AAC9C,KAAI,4BAA6B;AACjC,wBACE;EACE,IAAI;EACJ,aAAa;EACb,MAAM,OAAO,SAAS;GACpB,MAAM,SAAS,MAAM,kBAAkB;GACvC,MAAM,aAAa,MAAM,KAAK,WAAW,KAAK,UAAU,MAAM;GAC9D,MAAM,KAAK;GAqBX,MAAM,SAAS,KAAK,UAAU;AAC9B,OAAI,CAAC,cAAc,IAAI,OAAO,CAC5B,OAAM,IAAI,MACR,4CAA4C,OAAO,gBAAgB,CAAC,GAAG,cAAc,CAAC,KAAK,KAAK,CAAC,GAClG;GAEH,MAAM,KAAK,IAAI,GAAG,KAAK,KAAK;AAC5B,QAAK,MAAM,UAAU,uBAAuB,OAA2B,CACrE,IAAG,OAAO,OAAO;AAEnB,MAAG,OAAO,UAAU,WAAW,QAAQ,MAAM,KAAK,CAAC,GAAG;AACtD,MAAG,OAAO,qBAAqB;AAC/B,MAAG,OAAO,uBAAuB;AACjC,MAAG,OAAO,sBAAsB;AAChC,MAAG,OAAO,oBAAoB;AAC9B,MAAG,KACD;;;;;;;;;;;4BAYD;AACD,UAAO;IACL,SAAS;IACT,MAAM,KAAK;IACX,MAAM,OAAO,OAAO;AAClB,QAAG,QACD;;;wDAID,CAAC,IACA,MAAM,KACN,MAAM,IACN,KAAK,UAAU,MAAM,MAAM,EAC3B,MAAM,QACN,MAAM,QACN,MAAM,UACN,MAAM,YAAY,SAAY,KAAK,UAAU,MAAM,QAAQ,GAAG,MAC9D,MAAM,aAAa,SAAY,KAAK,UAAU,MAAM,SAAS,GAAG,MAChE,MAAM,UACN,MAAM,KACP;AACD,YAAO;;IAET,MAAM,SAAS;KACb,MAAM,MAAM,GAAG,QAAQ,oDAAoD,CAAC,KAAK;AAcjF,SAAI,QAAQ,OAAW,QAAO;AAC9B,YAAO,WAAW,IAAI;;IAExB,OAAO,QAAQ,QAAQ;KACrB,MAAM,KAAK,QAAQ,WAAW;KAC9B,MAAM,KAAK,QAAQ,SAAS,OAAO;KACnC,MAAM,OAAO,GACV,QAAQ,qEAAqE,CAC7E,QAAQ,IAAI,GAAG;AAClB,UAAK,MAAM,OAAO,KAAM,OAAM,WAAW,IAAwC;;IAEnF,MAAM,QAAQ;AAEZ,YADY,GAAG,QAAQ,sCAAsC,CAAC,KAAK,CACxD;;IAEb,MAAM,WAAW,WAAW;KAC1B,MAAM,SAAS,GACZ,QAAQ,qDAAqD,CAC7D,IAAI,UAAU;AACjB,QAAG,QAAQ,uCAAuC,CAAC,IAAI,UAAU;AACjE,YAAO,OAAO;;IAEhB,MAAM,aAAa,OAAO;AACxB,QAAG,QAAQ,6DAA6D,CAAC,IACvE,MAAM,UACN,MAAM,MACN,MAAM,IACP;;IAUH,MAAM,SAAS,IAAI;AACjB,QAAG,KAAK,kBAAkB;KAC1B,IAAI,YAAY;AAChB,SAAI;MACF,MAAM,SAAS,MAAM,IAAI;AACzB,SAAG,KAAK,SAAS;AACjB,kBAAY;AACZ,aAAO;eACC;AACR,UAAI,CAAC,UACH,KAAI;AACF,UAAG,KAAK,WAAW;cACb;;;IAMd,MAAM,QAAQ;AACZ,SAAI,GAAG,KAAM,IAAG,OAAO;;IAE1B;;EAEJ,EACD,EAAE,cAAc,MAAM,CACvB;AACD,+BAA8B;;AAGhC,SAAS,WAAW,KAWjB;AACD,QAAO;EACL,KAAK,IAAI;EACT,IAAI,IAAI;EACR,OAAO,KAAK,MAAM,IAAI,WAAW;EACjC,QAAQ,IAAI;EACZ,QAAQ,IAAI;EACZ,UAAU,IAAI;EACd,GAAI,IAAI,iBAAiB,OAAO,EAAE,SAAS,KAAK,MAAM,IAAI,aAAa,EAAE,GAAG,EAAE;EAC9E,GAAI,IAAI,kBAAkB,OAAO,EAAE,UAAU,KAAK,MAAM,IAAI,cAAc,EAAE,GAAG,EAAE;EACjF,UAAU,IAAI;EACd,MAAM,IAAI;EACX"}

package/dist/app-daemons.d.ts

@@ -0,0 +1,29 @@
+import "./consolidator/daemon.js";
+import { TriggersDaemon } from "./triggers/daemon.js";
+import { WorkflowTimerDaemon, WorkflowTimerDriverLike } from "./workflows/timer-daemon.js";
+import * as _graphorin_triggers0 from "@graphorin/triggers";
+
+//#region src/app-daemons.d.ts
+
+/**
+ * Discriminated union accepted by `CreateServerOptions.triggers`. A
+ * caller may either supply a fully-built daemon (e.g. constructed
+ * around a custom `Scheduler`) or just the underlying scheduler - the
+ * server wraps it with {@link createTriggersDaemon} automatically.
+ *
+ * @stable
+ */
+type TriggersDaemonInput = {
+  readonly daemon: TriggersDaemon;
+} | {
+  readonly scheduler: _graphorin_triggers0.Scheduler;
+};
+/** W-032: accepted forms for `createServer({ workflowTimers })`. */
+type WorkflowTimersInput = {
+  readonly daemon: WorkflowTimerDaemon;
+} | {
+  readonly driver: WorkflowTimerDriverLike;
+};
+//#endregion
+export { TriggersDaemonInput, WorkflowTimersInput };
+//# sourceMappingURL=app-daemons.d.ts.map

package/dist/app-daemons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-daemons.d.ts","names":[],"sources":["../src/app-daemons.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;KAwBY,mBAAA;mBACW;;sBAAc,oBAAA,CACmB;;;KAG5C,mBAAA;mBACW;;mBACA"}

package/dist/app-daemons.js

@@ -0,0 +1,27 @@
+import { createConsolidatorDaemon } from "./consolidator/daemon.js";
+import { createTriggersDaemon } from "./triggers/daemon.js";
+import { createWorkflowTimerDaemon } from "./workflows/timer-daemon.js";
+
+//#region src/app-daemons.ts
+/**
+* Wrap the operator-supplied triggers / consolidator surfaces in their
+* daemon adapters. Pure construction - nothing is started here.
+*/
+function buildDaemons(options) {
+	let triggersDaemon;
+	if (options.triggers !== void 0) if ("daemon" in options.triggers) triggersDaemon = options.triggers.daemon;
+	else triggersDaemon = createTriggersDaemon({ scheduler: options.triggers.scheduler });
+	let consolidatorDaemon;
+	if (options.consolidator !== void 0) consolidatorDaemon = createConsolidatorDaemon({ consolidator: options.consolidator });
+	let workflowTimerDaemon;
+	if (options.workflowTimers !== void 0) workflowTimerDaemon = "daemon" in options.workflowTimers ? options.workflowTimers.daemon : createWorkflowTimerDaemon({ driver: options.workflowTimers.driver });
+	return {
+		triggersDaemon,
+		consolidatorDaemon,
+		workflowTimerDaemon
+	};
+}
+
+//#endregion
+export { buildDaemons };
+//# sourceMappingURL=app-daemons.js.map

package/dist/app-daemons.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-daemons.js","names":["triggersDaemon: TriggersDaemon | undefined","consolidatorDaemon: ConsolidatorDaemon | undefined","workflowTimerDaemon: WorkflowTimerDaemon | undefined"],"sources":["../src/app-daemons.ts"],"sourcesContent":["/**\n * Daemon construction for `createServer({...})` - wraps the caller's\n * triggers scheduler / consolidator surfaces in their daemon adapters.\n * Start/stop sequencing stays in `app-lifecycle.ts` because the order\n * relative to the listener is part of the lifecycle contract.\n *\n * @packageDocumentation\n */\n\nimport type { ConsolidatorDaemon, ConsolidatorLike } from './consolidator/daemon.js';\nimport { createConsolidatorDaemon } from './consolidator/daemon.js';\nimport type { TriggersDaemon } from './triggers/daemon.js';\nimport { createTriggersDaemon } from './triggers/daemon.js';\nimport type { WorkflowTimerDaemon, WorkflowTimerDriverLike } from './workflows/timer-daemon.js';\nimport { createWorkflowTimerDaemon } from './workflows/timer-daemon.js';\n\n/**\n * Discriminated union accepted by `CreateServerOptions.triggers`. A\n * caller may either supply a fully-built daemon (e.g. constructed\n * around a custom `Scheduler`) or just the underlying scheduler - the\n * server wraps it with {@link createTriggersDaemon} automatically.\n *\n * @stable\n */\nexport type TriggersDaemonInput =\n  | { readonly daemon: TriggersDaemon }\n  | { readonly scheduler: import('@graphorin/triggers').Scheduler };\n\n/** W-032: accepted forms for `createServer({ workflowTimers })`. */\nexport type WorkflowTimersInput =\n  | { readonly daemon: WorkflowTimerDaemon }\n  | { readonly driver: WorkflowTimerDriverLike };\n\n/** Subset of `CreateServerOptions` consumed by {@link buildDaemons}. */\nexport interface BuildDaemonsOptions {\n  readonly triggers?: TriggersDaemonInput | undefined;\n  readonly consolidator?: ConsolidatorLike | undefined;\n  readonly workflowTimers?: WorkflowTimersInput | undefined;\n}\n\n/** Daemon handles constructed (or adopted) by {@link buildDaemons}. */\nexport interface BuiltDaemons {\n  readonly triggersDaemon: TriggersDaemon | undefined;\n  readonly consolidatorDaemon: ConsolidatorDaemon | undefined;\n  readonly workflowTimerDaemon: WorkflowTimerDaemon | undefined;\n}\n\n/**\n * Wrap the operator-supplied triggers / consolidator surfaces in their\n * daemon adapters. Pure construction - nothing is started here.\n */\nexport function buildDaemons(options: BuildDaemonsOptions): BuiltDaemons {\n  let triggersDaemon: TriggersDaemon | undefined;\n  if (options.triggers !== undefined) {\n    if ('daemon' in options.triggers) {\n      triggersDaemon = options.triggers.daemon;\n    } else {\n      triggersDaemon = createTriggersDaemon({ scheduler: options.triggers.scheduler });\n    }\n  }\n  let consolidatorDaemon: ConsolidatorDaemon | undefined;\n  if (options.consolidator !== undefined) {\n    consolidatorDaemon = createConsolidatorDaemon({ consolidator: options.consolidator });\n  }\n  let workflowTimerDaemon: WorkflowTimerDaemon | undefined;\n  if (options.workflowTimers !== undefined) {\n    workflowTimerDaemon =\n      'daemon' in options.workflowTimers\n        ? options.workflowTimers.daemon\n        : createWorkflowTimerDaemon({ driver: options.workflowTimers.driver });\n  }\n  return { triggersDaemon, consolidatorDaemon, workflowTimerDaemon };\n}\n"],"mappings":";;;;;;;;;AAmDA,SAAgB,aAAa,SAA4C;CACvE,IAAIA;AACJ,KAAI,QAAQ,aAAa,OACvB,KAAI,YAAY,QAAQ,SACtB,kBAAiB,QAAQ,SAAS;KAElC,kBAAiB,qBAAqB,EAAE,WAAW,QAAQ,SAAS,WAAW,CAAC;CAGpF,IAAIC;AACJ,KAAI,QAAQ,iBAAiB,OAC3B,sBAAqB,yBAAyB,EAAE,cAAc,QAAQ,cAAc,CAAC;CAEvF,IAAIC;AACJ,KAAI,QAAQ,mBAAmB,OAC7B,uBACE,YAAY,QAAQ,iBAChB,QAAQ,eAAe,SACvB,0BAA0B,EAAE,QAAQ,QAAQ,eAAe,QAAQ,CAAC;AAE5E,QAAO;EAAE;EAAgB;EAAoB;EAAqB"}