@graphorin/server 0.6.1 → 0.7.0

package/dist/app-routes.js

@@ -0,0 +1,131 @@
+import { refreshLiveMetrics } from "./app-metrics.js";
+import { attachProtectedMiddleware } from "./app-middleware.js";
+import { createExtendedHealthRoutes, createMetricsRoutes, createSecretsHealthRoutes } from "./health/routes.js";
+import { createReplayRoutes } from "./replay/routes.js";
+import { createAgentRoutes, createRunRoutes } from "./routes/agents.js";
+import { createAuditRoutes } from "./routes/audit.js";
+import { createAuthRoutes } from "./routes/auth.js";
+import { createMcpRoutes } from "./routes/mcp.js";
+import { createMemoryRoutes } from "./routes/memory.js";
+import { createSessionRoutes } from "./routes/sessions.js";
+import { createSkillsRoutes } from "./routes/skills.js";
+import { createTokensRoutes } from "./routes/tokens.js";
+import { createWorkflowRoutes } from "./routes/workflows.js";
+import { createSseRoutes } from "./sse/events.js";
+import { createTriggersRoutes } from "./triggers/routes.js";
+import { createWsUpgradeEvents } from "./ws/upgrade.js";
+
+//#region src/app-routes.ts
+/** IP-23: is `host` a loopback interface (so an open /metrics is not exposed)? */
+function isLoopbackHost(host) {
+	const h = host.trim().toLowerCase();
+	return h === "127.0.0.1" || h === "::1" || h === "[::1]" || h === "localhost";
+}
+function mountRoutes(app, config, ctx) {
+	const base = config.server.basePath;
+	const probes = ctx.healthProbes ?? (() => buildDefaultHealthProbes(ctx.store, ctx.triggersDaemon, ctx.consolidatorDaemon, ctx.wsDispatcher, config, ctx.workflowTimerDaemon));
+	const health = createExtendedHealthRoutes({
+		version: ctx.version,
+		startedAt: ctx.startedAt,
+		now: ctx.now,
+		probes
+	});
+	app.route(`${base}/health`, health);
+	if (config.auth.kind === "none" && !isLoopbackHost(config.server.host)) console.warn(`[graphorin/server] WARN: auth.kind='none' disables authentication on every endpoint, but the server binds the non-loopback host '${config.server.host}'. Anyone who can reach it has full admin access - use auth.kind='token' for non-loopback deployments or bind a loopback host.`);
+	if (config.metrics.enabled) {
+		if (!config.metrics.requireAuth && !isLoopbackHost(config.server.host)) console.warn(`[graphorin/server] WARN: /metrics is unauthenticated (metrics.requireAuth=false) and the server binds the non-loopback host '${config.server.host}'. The exposition leaks operational detail to anyone who can reach it - set metrics.requireAuth=true or bind a loopback host.`);
+		const metricsRoute = createMetricsRoutes({
+			registry: ctx.metricRegistry,
+			requireAuth: config.metrics.requireAuth,
+			refresh: () => refreshLiveMetrics({
+				registry: ctx.metricRegistry,
+				store: ctx.store,
+				runs: ctx.runs,
+				startedAt: ctx.startedAt,
+				now: ctx.now,
+				...ctx.triggersDaemon !== void 0 ? { triggersDaemon: ctx.triggersDaemon } : {},
+				...ctx.consolidatorDaemon !== void 0 ? { consolidatorDaemon: ctx.consolidatorDaemon } : {},
+				...ctx.wsDispatcher !== void 0 ? { wsDispatcher: ctx.wsDispatcher } : {}
+			})
+		});
+		app.route(`${base}${config.metrics.path}`, metricsRoute);
+	}
+	const { anonymousAuth } = attachProtectedMiddleware(app, config, ctx);
+	app.route(`${base}/health/secrets`, createSecretsHealthRoutes());
+	app.route(`${base}/agents`, createAgentRoutes({
+		agents: ctx.agents,
+		runs: ctx.runs,
+		...ctx.wsDispatcher !== void 0 ? { dispatcher: ctx.wsDispatcher } : {}
+	}));
+	app.route(`${base}/runs`, createRunRoutes({
+		agents: ctx.agents,
+		runs: ctx.runs
+	}));
+	app.route(`${base}/workflows`, createWorkflowRoutes({
+		workflows: ctx.workflows,
+		runs: ctx.runs,
+		...ctx.wsDispatcher !== void 0 ? { dispatcher: ctx.wsDispatcher } : {}
+	}));
+	if (ctx.sessions !== void 0) app.route(`${base}/sessions`, createSessionRoutes({ sessions: ctx.sessions }));
+	if (ctx.memory !== void 0) app.route(`${base}/memory`, createMemoryRoutes({ memory: ctx.memory }));
+	if (ctx.skills !== void 0) app.route(`${base}/skills`, createSkillsRoutes({ skills: ctx.skills }));
+	if (ctx.mcp !== void 0) app.route(`${base}/mcp`, createMcpRoutes({ mcp: ctx.mcp }));
+	if (ctx.audit !== void 0) app.route(`${base}/audit`, createAuditRoutes({ audit: ctx.audit }));
+	if (ctx.triggersDaemon !== void 0) app.route(`${base}/triggers`, createTriggersRoutes({ daemon: ctx.triggersDaemon }));
+	if (ctx.replay !== void 0) app.route(`${base}`, createReplayRoutes({
+		replay: ctx.replay,
+		...ctx.auditDb !== void 0 ? { auditDb: ctx.auditDb } : {},
+		now: ctx.now
+	}));
+	if (config.auth.kind === "token" && ctx.pepper !== void 0) app.route(`${base}/tokens`, createTokensRoutes({
+		tokenStore: ctx.store.authTokens,
+		pepper: ctx.pepper,
+		defaultEnv: "live",
+		allowedEnvs: config.auth.tokenEnvironments
+	}));
+	if (ctx.wsTickets !== void 0) app.route(`${base}`, createAuthRoutes({ tickets: ctx.wsTickets }));
+	if (ctx.wsDispatcher !== void 0 && ctx.wsTickets !== void 0 && ctx.wsAdapter !== void 0 && (ctx.verifier !== void 0 || anonymousAuth) && config.server.ws.enabled) {
+		const dispatcher = ctx.wsDispatcher;
+		const tickets = ctx.wsTickets;
+		const verifier = ctx.verifier;
+		const runs = ctx.runs;
+		app.get(`${base}${config.server.ws.path}`, ctx.wsAdapter.upgradeWebSocket((c) => createWsUpgradeEvents(c, {
+			dispatcher,
+			tickets,
+			...verifier !== void 0 ? { verifier } : {},
+			anonymous: anonymousAuth,
+			runs,
+			now: ctx.now
+		})));
+	}
+	if (ctx.wsDispatcher !== void 0 && config.server.sse.enabled) app.route(`${base}${config.server.sse.path}`, createSseRoutes({
+		dispatcher: ctx.wsDispatcher,
+		keepAliveMs: config.server.sse.keepAliveMs,
+		perConnectionQueueLimit: config.server.stream.perConnectionQueueLimit,
+		now: ctx.now
+	}));
+}
+function buildDefaultHealthProbes(store, triggersDaemon, consolidatorDaemon, dispatcher, config, workflowTimerDaemon) {
+	const out = {
+		store,
+		walWarnThresholdBytes: config.health.walWarnThresholdBytes,
+		encryptionEnabled: config.storage.encryption.enabled,
+		...config.storage.encryption.enabled ? { cipherPeerInstalled: true } : {}
+	};
+	if (triggersDaemon !== void 0) out.triggers = triggersDaemon;
+	if (consolidatorDaemon !== void 0) out.consolidator = consolidatorDaemon;
+	if (workflowTimerDaemon !== void 0) out.workflowTimers = workflowTimerDaemon;
+	if (dispatcher !== void 0) {
+		const sizes = dispatcher.size();
+		out.replayBuffer = {
+			eventsBuffered: sizes.subscriptions,
+			subscribers: sizes.subscribers,
+			subscriptions: sizes.subscriptions
+		};
+	}
+	return Object.freeze(out);
+}
+
+//#endregion
+export { mountRoutes };
+//# sourceMappingURL=app-routes.js.map

package/dist/app-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-routes.js","names":["out: {\n    -readonly [K in keyof HealthCheckOptions]?: HealthCheckOptions[K];\n  }"],"sources":["../src/app-routes.ts"],"sourcesContent":["/**\n * HTTP route mounting for `createServer({...})` - health, metrics,\n * the authenticated middleware boundary, every REST domain surface,\n * the WebSocket upgrade, and SSE. Mount order is part of the\n * documented contract (unauthenticated health/metrics first, then the\n * auth boundary, then the domain routes) - do not reorder.\n *\n * @packageDocumentation\n */\n\nimport type { TokenVerifier } from '@graphorin/security';\nimport type { AuditDb } from '@graphorin/security/audit';\nimport type { GraphorinSqliteStore } from '@graphorin/store-sqlite';\nimport type { createNodeWebSocket } from '@hono/node-ws';\nimport type { Hono } from 'hono';\nimport { refreshLiveMetrics } from './app-metrics.js';\nimport { attachProtectedMiddleware } from './app-middleware.js';\nimport type { ServerConfigSpec } from './config.js';\nimport type { ConsolidatorDaemon } from './consolidator/daemon.js';\nimport {\n  createExtendedHealthRoutes,\n  createMetricsRoutes,\n  createSecretsHealthRoutes,\n  type HealthCheckOptions,\n} from './health/index.js';\nimport type { ServerVariables } from './internal/context.js';\nimport type { MetricRegistry } from './metrics/registry.js';\nimport type { AgentRegistry, WorkflowRegistry } from './registry/index.js';\nimport { createReplayRoutes, type ReplayApi } from './replay/index.js';\nimport {\n  type AuditApi,\n  createAgentRoutes,\n  createAuditRoutes,\n  createAuthRoutes,\n  createMcpRoutes,\n  createMemoryRoutes,\n  createRunRoutes,\n  createSessionRoutes,\n  createSkillsRoutes,\n  createTokensRoutes,\n  createWorkflowRoutes,\n  type McpApi,\n  type MemoryApi,\n  type SessionApi,\n  type SkillsApi,\n} from './routes/index.js';\nimport type { RunStateTracker } from './runtime/run-state.js';\nimport { createSseRoutes } from './sse/index.js';\nimport type { TriggersDaemon } from './triggers/daemon.js';\nimport { createTriggersRoutes } from './triggers/routes.js';\nimport type { WorkflowTimerDaemon } from './workflows/timer-daemon.js';\nimport type { WsDispatcher, WsTicketStore } from './ws/index.js';\nimport { createWsUpgradeEvents } from './ws/upgrade.js';\n\nexport interface MountRoutesContext {\n  readonly version: string;\n  readonly startedAt: number;\n  readonly now: () => number;\n  readonly agents: AgentRegistry;\n  readonly workflows: WorkflowRegistry;\n  readonly runs: RunStateTracker;\n  readonly store: GraphorinSqliteStore;\n  readonly metricRegistry: MetricRegistry;\n  readonly sessions?: SessionApi;\n  readonly memory?: MemoryApi;\n  readonly skills?: SkillsApi;\n  readonly mcp?: McpApi;\n  readonly audit?: AuditApi;\n  readonly replay?: ReplayApi;\n  readonly healthProbes?: () => HealthCheckOptions | Promise<HealthCheckOptions>;\n  readonly verifier?: TokenVerifier;\n  readonly auditDb?: AuditDb;\n  readonly pepper?: import('@graphorin/security').SecretValue;\n  readonly wsDispatcher?: WsDispatcher;\n  readonly wsTickets?: WsTicketStore;\n  readonly wsAdapter?: ReturnType<typeof createNodeWebSocket>;\n  readonly triggersDaemon?: TriggersDaemon;\n  readonly consolidatorDaemon?: ConsolidatorDaemon;\n  readonly workflowTimerDaemon?: WorkflowTimerDaemon;\n}\n\n/** IP-23: is `host` a loopback interface (so an open /metrics is not exposed)? */\nfunction isLoopbackHost(host: string): boolean {\n  const h = host.trim().toLowerCase();\n  return h === '127.0.0.1' || h === '::1' || h === '[::1]' || h === 'localhost';\n}\n\nexport function mountRoutes(\n  app: Hono<{ Variables: ServerVariables }>,\n  config: ServerConfigSpec,\n  ctx: MountRoutesContext,\n): void {\n  const base = config.server.basePath;\n  const probes =\n    ctx.healthProbes ??\n    (() =>\n      buildDefaultHealthProbes(\n        ctx.store,\n        ctx.triggersDaemon,\n        ctx.consolidatorDaemon,\n        ctx.wsDispatcher,\n        config,\n        ctx.workflowTimerDaemon,\n      ));\n  const health = createExtendedHealthRoutes({\n    version: ctx.version,\n    startedAt: ctx.startedAt,\n    now: ctx.now,\n    probes,\n  });\n  app.route(`${base}/health`, health);\n\n  // IP-13: `auth.kind='none'` disables authentication on every route. It is the\n  // documented trusted-loopback / single-operator mode, but binding a\n  // non-loopback host with auth off exposes full admin access (including the WS\n  // stream) to anyone who can reach it - warn loudly rather than silently.\n  if (config.auth.kind === 'none' && !isLoopbackHost(config.server.host)) {\n    console.warn(\n      `[graphorin/server] WARN: auth.kind='none' disables authentication on every endpoint, ` +\n        `but the server binds the non-loopback host '${config.server.host}'. Anyone who can reach ` +\n        `it has full admin access - use auth.kind='token' for non-loopback deployments or bind a ` +\n        `loopback host.`,\n    );\n  }\n\n  if (config.metrics.enabled) {\n    // IP-23: an unauthenticated /metrics endpoint leaks operational intel\n    // (trigger ids in labels, consolidator budgets). It is fine on a loopback\n    // host, but binding a non-loopback host with auth off silently exposes it.\n    if (!config.metrics.requireAuth && !isLoopbackHost(config.server.host)) {\n      console.warn(\n        `[graphorin/server] WARN: /metrics is unauthenticated (metrics.requireAuth=false) and ` +\n          `the server binds the non-loopback host '${config.server.host}'. The exposition leaks ` +\n          `operational detail to anyone who can reach it - set metrics.requireAuth=true or bind a ` +\n          `loopback host.`,\n      );\n    }\n    const metricsRoute = createMetricsRoutes({\n      registry: ctx.metricRegistry,\n      requireAuth: config.metrics.requireAuth,\n      refresh: () =>\n        refreshLiveMetrics({\n          registry: ctx.metricRegistry,\n          store: ctx.store,\n          runs: ctx.runs,\n          startedAt: ctx.startedAt,\n          now: ctx.now,\n          ...(ctx.triggersDaemon !== undefined ? { triggersDaemon: ctx.triggersDaemon } : {}),\n          ...(ctx.consolidatorDaemon !== undefined\n            ? { consolidatorDaemon: ctx.consolidatorDaemon }\n            : {}),\n          ...(ctx.wsDispatcher !== undefined ? { wsDispatcher: ctx.wsDispatcher } : {}),\n        }),\n    });\n    app.route(`${base}${config.metrics.path}`, metricsRoute);\n  }\n\n  // Auth + audit + idempotency for everything below this line - see\n  // `app-middleware.ts` for the boundary semantics and skip list.\n  const { anonymousAuth } = attachProtectedMiddleware(app, config, ctx);\n\n  // Mounted AFTER the auth middleware so the scope check has a\n  // verified token to inspect; the unauthenticated `/v1/health` GET\n  // continues to serve the rollup.\n  app.route(`${base}/health/secrets`, createSecretsHealthRoutes());\n\n  app.route(\n    `${base}/agents`,\n    createAgentRoutes({\n      agents: ctx.agents,\n      runs: ctx.runs,\n      // IP-2: the streaming dispatcher reaches the route layer.\n      ...(ctx.wsDispatcher !== undefined ? { dispatcher: ctx.wsDispatcher } : {}),\n    }),\n  );\n  app.route(`${base}/runs`, createRunRoutes({ agents: ctx.agents, runs: ctx.runs }));\n  app.route(\n    `${base}/workflows`,\n    createWorkflowRoutes({\n      workflows: ctx.workflows,\n      runs: ctx.runs,\n      ...(ctx.wsDispatcher !== undefined ? { dispatcher: ctx.wsDispatcher } : {}),\n    }),\n  );\n  if (ctx.sessions !== undefined) {\n    app.route(`${base}/sessions`, createSessionRoutes({ sessions: ctx.sessions }));\n  }\n  if (ctx.memory !== undefined) {\n    app.route(`${base}/memory`, createMemoryRoutes({ memory: ctx.memory }));\n  }\n  if (ctx.skills !== undefined) {\n    app.route(`${base}/skills`, createSkillsRoutes({ skills: ctx.skills }));\n  }\n  if (ctx.mcp !== undefined) {\n    app.route(`${base}/mcp`, createMcpRoutes({ mcp: ctx.mcp }));\n  }\n  if (ctx.audit !== undefined) {\n    app.route(`${base}/audit`, createAuditRoutes({ audit: ctx.audit }));\n  }\n  if (ctx.triggersDaemon !== undefined) {\n    app.route(`${base}/triggers`, createTriggersRoutes({ daemon: ctx.triggersDaemon }));\n  }\n  if (ctx.replay !== undefined) {\n    app.route(\n      `${base}`,\n      createReplayRoutes({\n        replay: ctx.replay,\n        ...(ctx.auditDb !== undefined ? { auditDb: ctx.auditDb } : {}),\n        now: ctx.now,\n      }),\n    );\n  }\n  if (config.auth.kind === 'token' && ctx.pepper !== undefined) {\n    app.route(\n      `${base}/tokens`,\n      createTokensRoutes({\n        tokenStore: ctx.store.authTokens,\n        pepper: ctx.pepper,\n        defaultEnv: 'live',\n        allowedEnvs: config.auth.tokenEnvironments,\n      }),\n    );\n  }\n  if (ctx.wsTickets !== undefined) {\n    app.route(`${base}`, createAuthRoutes({ tickets: ctx.wsTickets }));\n  }\n  // IP-13: mount the WS upgrade when a verifier is wired OR auth is disabled\n  // (`auth.kind='none'`). The old condition required a verifier, so\n  // `ws.enabled: true` under no-auth was silently ignored - the route never\n  // mounted and clients got a bare 404 with no explanation.\n  if (\n    ctx.wsDispatcher !== undefined &&\n    ctx.wsTickets !== undefined &&\n    ctx.wsAdapter !== undefined &&\n    (ctx.verifier !== undefined || anonymousAuth) &&\n    config.server.ws.enabled\n  ) {\n    const dispatcher = ctx.wsDispatcher;\n    const tickets = ctx.wsTickets;\n    const verifier = ctx.verifier;\n    const runs = ctx.runs;\n    app.get(\n      `${base}${config.server.ws.path}`,\n      ctx.wsAdapter.upgradeWebSocket((c) =>\n        createWsUpgradeEvents(c, {\n          dispatcher,\n          tickets,\n          ...(verifier !== undefined ? { verifier } : {}),\n          anonymous: anonymousAuth,\n          runs,\n          now: ctx.now,\n        }),\n      ),\n    );\n  }\n  if (ctx.wsDispatcher !== undefined && config.server.sse.enabled) {\n    app.route(\n      `${base}${config.server.sse.path}`,\n      createSseRoutes({\n        dispatcher: ctx.wsDispatcher,\n        keepAliveMs: config.server.sse.keepAliveMs,\n        // IP-9: bound the per-connection delivery queue.\n        perConnectionQueueLimit: config.server.stream.perConnectionQueueLimit,\n        now: ctx.now,\n      }),\n    );\n  }\n}\n\nfunction buildDefaultHealthProbes(\n  store: GraphorinSqliteStore,\n  triggersDaemon: TriggersDaemon | undefined,\n  consolidatorDaemon: ConsolidatorDaemon | undefined,\n  dispatcher: WsDispatcher | undefined,\n  config: ServerConfigSpec,\n  workflowTimerDaemon?: WorkflowTimerDaemon,\n): HealthCheckOptions {\n  const out: {\n    -readonly [K in keyof HealthCheckOptions]?: HealthCheckOptions[K];\n  } = {\n    store,\n    walWarnThresholdBytes: config.health.walWarnThresholdBytes,\n    encryptionEnabled: config.storage.encryption.enabled,\n    // IP-1: when this process built the encrypted store itself, the\n    // keyed open at boot proved the cipher peer - report the fact.\n    ...(config.storage.encryption.enabled ? { cipherPeerInstalled: true } : {}),\n  };\n  if (triggersDaemon !== undefined) out.triggers = triggersDaemon;\n  if (consolidatorDaemon !== undefined) out.consolidator = consolidatorDaemon;\n  if (workflowTimerDaemon !== undefined) out.workflowTimers = workflowTimerDaemon;\n  if (dispatcher !== undefined) {\n    const sizes = dispatcher.size();\n    // The dispatcher only exposes (subscribers, subscriptions); the\n    // per-subject replay-buffer occupancy is owned by each\n    // subscription, not the dispatcher itself. Surface the active\n    // subscription count as a usable proxy + the raw subscriber count\n    // so operators can correlate.\n    out.replayBuffer = {\n      eventsBuffered: sizes.subscriptions,\n      subscribers: sizes.subscribers,\n      subscriptions: sizes.subscriptions,\n    };\n  }\n  return Object.freeze(out as HealthCheckOptions);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkFA,SAAS,eAAe,MAAuB;CAC7C,MAAM,IAAI,KAAK,MAAM,CAAC,aAAa;AACnC,QAAO,MAAM,eAAe,MAAM,SAAS,MAAM,WAAW,MAAM;;AAGpE,SAAgB,YACd,KACA,QACA,KACM;CACN,MAAM,OAAO,OAAO,OAAO;CAC3B,MAAM,SACJ,IAAI,uBAEF,yBACE,IAAI,OACJ,IAAI,gBACJ,IAAI,oBACJ,IAAI,cACJ,QACA,IAAI,oBACL;CACL,MAAM,SAAS,2BAA2B;EACxC,SAAS,IAAI;EACb,WAAW,IAAI;EACf,KAAK,IAAI;EACT;EACD,CAAC;AACF,KAAI,MAAM,GAAG,KAAK,UAAU,OAAO;AAMnC,KAAI,OAAO,KAAK,SAAS,UAAU,CAAC,eAAe,OAAO,OAAO,KAAK,CACpE,SAAQ,KACN,oIACiD,OAAO,OAAO,KAAK,gIAGrE;AAGH,KAAI,OAAO,QAAQ,SAAS;AAI1B,MAAI,CAAC,OAAO,QAAQ,eAAe,CAAC,eAAe,OAAO,OAAO,KAAK,CACpE,SAAQ,KACN,gIAC6C,OAAO,OAAO,KAAK,+HAGjE;EAEH,MAAM,eAAe,oBAAoB;GACvC,UAAU,IAAI;GACd,aAAa,OAAO,QAAQ;GAC5B,eACE,mBAAmB;IACjB,UAAU,IAAI;IACd,OAAO,IAAI;IACX,MAAM,IAAI;IACV,WAAW,IAAI;IACf,KAAK,IAAI;IACT,GAAI,IAAI,mBAAmB,SAAY,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,EAAE;IAClF,GAAI,IAAI,uBAAuB,SAC3B,EAAE,oBAAoB,IAAI,oBAAoB,GAC9C,EAAE;IACN,GAAI,IAAI,iBAAiB,SAAY,EAAE,cAAc,IAAI,cAAc,GAAG,EAAE;IAC7E,CAAC;GACL,CAAC;AACF,MAAI,MAAM,GAAG,OAAO,OAAO,QAAQ,QAAQ,aAAa;;CAK1D,MAAM,EAAE,kBAAkB,0BAA0B,KAAK,QAAQ,IAAI;AAKrE,KAAI,MAAM,GAAG,KAAK,kBAAkB,2BAA2B,CAAC;AAEhE,KAAI,MACF,GAAG,KAAK,UACR,kBAAkB;EAChB,QAAQ,IAAI;EACZ,MAAM,IAAI;EAEV,GAAI,IAAI,iBAAiB,SAAY,EAAE,YAAY,IAAI,cAAc,GAAG,EAAE;EAC3E,CAAC,CACH;AACD,KAAI,MAAM,GAAG,KAAK,QAAQ,gBAAgB;EAAE,QAAQ,IAAI;EAAQ,MAAM,IAAI;EAAM,CAAC,CAAC;AAClF,KAAI,MACF,GAAG,KAAK,aACR,qBAAqB;EACnB,WAAW,IAAI;EACf,MAAM,IAAI;EACV,GAAI,IAAI,iBAAiB,SAAY,EAAE,YAAY,IAAI,cAAc,GAAG,EAAE;EAC3E,CAAC,CACH;AACD,KAAI,IAAI,aAAa,OACnB,KAAI,MAAM,GAAG,KAAK,YAAY,oBAAoB,EAAE,UAAU,IAAI,UAAU,CAAC,CAAC;AAEhF,KAAI,IAAI,WAAW,OACjB,KAAI,MAAM,GAAG,KAAK,UAAU,mBAAmB,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAC;AAEzE,KAAI,IAAI,WAAW,OACjB,KAAI,MAAM,GAAG,KAAK,UAAU,mBAAmB,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAC;AAEzE,KAAI,IAAI,QAAQ,OACd,KAAI,MAAM,GAAG,KAAK,OAAO,gBAAgB,EAAE,KAAK,IAAI,KAAK,CAAC,CAAC;AAE7D,KAAI,IAAI,UAAU,OAChB,KAAI,MAAM,GAAG,KAAK,SAAS,kBAAkB,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC;AAErE,KAAI,IAAI,mBAAmB,OACzB,KAAI,MAAM,GAAG,KAAK,YAAY,qBAAqB,EAAE,QAAQ,IAAI,gBAAgB,CAAC,CAAC;AAErF,KAAI,IAAI,WAAW,OACjB,KAAI,MACF,GAAG,QACH,mBAAmB;EACjB,QAAQ,IAAI;EACZ,GAAI,IAAI,YAAY,SAAY,EAAE,SAAS,IAAI,SAAS,GAAG,EAAE;EAC7D,KAAK,IAAI;EACV,CAAC,CACH;AAEH,KAAI,OAAO,KAAK,SAAS,WAAW,IAAI,WAAW,OACjD,KAAI,MACF,GAAG,KAAK,UACR,mBAAmB;EACjB,YAAY,IAAI,MAAM;EACtB,QAAQ,IAAI;EACZ,YAAY;EACZ,aAAa,OAAO,KAAK;EAC1B,CAAC,CACH;AAEH,KAAI,IAAI,cAAc,OACpB,KAAI,MAAM,GAAG,QAAQ,iBAAiB,EAAE,SAAS,IAAI,WAAW,CAAC,CAAC;AAMpE,KACE,IAAI,iBAAiB,UACrB,IAAI,cAAc,UAClB,IAAI,cAAc,WACjB,IAAI,aAAa,UAAa,kBAC/B,OAAO,OAAO,GAAG,SACjB;EACA,MAAM,aAAa,IAAI;EACvB,MAAM,UAAU,IAAI;EACpB,MAAM,WAAW,IAAI;EACrB,MAAM,OAAO,IAAI;AACjB,MAAI,IACF,GAAG,OAAO,OAAO,OAAO,GAAG,QAC3B,IAAI,UAAU,kBAAkB,MAC9B,sBAAsB,GAAG;GACvB;GACA;GACA,GAAI,aAAa,SAAY,EAAE,UAAU,GAAG,EAAE;GAC9C,WAAW;GACX;GACA,KAAK,IAAI;GACV,CAAC,CACH,CACF;;AAEH,KAAI,IAAI,iBAAiB,UAAa,OAAO,OAAO,IAAI,QACtD,KAAI,MACF,GAAG,OAAO,OAAO,OAAO,IAAI,QAC5B,gBAAgB;EACd,YAAY,IAAI;EAChB,aAAa,OAAO,OAAO,IAAI;EAE/B,yBAAyB,OAAO,OAAO,OAAO;EAC9C,KAAK,IAAI;EACV,CAAC,CACH;;AAIL,SAAS,yBACP,OACA,gBACA,oBACA,YACA,QACA,qBACoB;CACpB,MAAMA,MAEF;EACF;EACA,uBAAuB,OAAO,OAAO;EACrC,mBAAmB,OAAO,QAAQ,WAAW;EAG7C,GAAI,OAAO,QAAQ,WAAW,UAAU,EAAE,qBAAqB,MAAM,GAAG,EAAE;EAC3E;AACD,KAAI,mBAAmB,OAAW,KAAI,WAAW;AACjD,KAAI,uBAAuB,OAAW,KAAI,eAAe;AACzD,KAAI,wBAAwB,OAAW,KAAI,iBAAiB;AAC5D,KAAI,eAAe,QAAW;EAC5B,MAAM,QAAQ,WAAW,MAAM;AAM/B,MAAI,eAAe;GACjB,gBAAgB,MAAM;GACtB,aAAa,MAAM;GACnB,eAAe,MAAM;GACtB;;AAEH,QAAO,OAAO,OAAO,IAA0B"}

package/dist/app-ws.js

@@ -0,0 +1,65 @@
+import { createLateBoundCommentarySink } from "./commentary/audit-bridge.js";
+import { createWsDispatcher } from "./ws/dispatcher.js";
+import { createWsTicketStore } from "./ws/ticket.js";
+import { SUBPROTOCOL_NAME, negotiateSubprotocol } from "@graphorin/protocol";
+import { createNodeWebSocket } from "@hono/node-ws";
+
+//#region src/app-ws.ts
+/**
+* WebSocket layer construction for `createServer({...})` - dispatcher,
+* single-use ticket store, the `@hono/node-ws` adapter, and the
+* Graphorin-aware subprotocol negotiation policy. Built before the
+* listener starts; the upgrade route itself is mounted in
+* `app-routes.ts` and the adapter is injected into the Node server in
+* `app-lifecycle.ts`.
+*
+* @packageDocumentation
+*/
+/**
+* Build the WS dispatcher + ticket store + node-ws adapter when
+* `server.ws.enabled` is true.
+*/
+function buildWsLayer(app, config, now) {
+	let dispatcher;
+	let tickets;
+	let wsAdapter;
+	let commentaryAuditSink;
+	if (config.server.ws.enabled) {
+		commentaryAuditSink = createLateBoundCommentarySink();
+		dispatcher = createWsDispatcher({
+			commentary: {
+				policy: config.server.ws.commentarySanitization.policy,
+				applyToEvents: config.server.ws.commentarySanitization.applyToEvents,
+				sink: commentaryAuditSink
+			},
+			replayBuffer: {
+				maxEvents: config.server.stream.replayBuffer.maxEvents,
+				ttlMs: config.server.stream.replayBuffer.ttlSeconds * 1e3
+			},
+			perConnectionQueueLimit: config.server.stream.perConnectionQueueLimit,
+			now
+		});
+		tickets = createWsTicketStore({
+			ttlMs: config.server.ws.ticketTtlMs,
+			now
+		});
+		wsAdapter = createNodeWebSocket({ app });
+		const wssOptions = wsAdapter.wss.options;
+		wssOptions.handleProtocols = (protocols) => {
+			const negotiated = negotiateSubprotocol(Array.from(protocols));
+			if (negotiated !== null) return negotiated;
+			for (const candidate of protocols) if (candidate === SUBPROTOCOL_NAME) return SUBPROTOCOL_NAME;
+			return false;
+		};
+	}
+	return {
+		dispatcher,
+		tickets,
+		wsAdapter,
+		commentaryAuditSink
+	};
+}
+
+//#endregion
+export { buildWsLayer };
+//# sourceMappingURL=app-ws.js.map

package/dist/app-ws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-ws.js","names":["dispatcher: WsDispatcher | undefined","tickets: WsTicketStore | undefined","wsAdapter: ReturnType<typeof createNodeWebSocket> | undefined","commentaryAuditSink: LateBoundCommentarySink | undefined"],"sources":["../src/app-ws.ts"],"sourcesContent":["/**\n * WebSocket layer construction for `createServer({...})` - dispatcher,\n * single-use ticket store, the `@hono/node-ws` adapter, and the\n * Graphorin-aware subprotocol negotiation policy. Built before the\n * listener starts; the upgrade route itself is mounted in\n * `app-routes.ts` and the adapter is injected into the Node server in\n * `app-lifecycle.ts`.\n *\n * @packageDocumentation\n */\n\nimport { negotiateSubprotocol, SUBPROTOCOL_NAME } from '@graphorin/protocol';\nimport { createNodeWebSocket } from '@hono/node-ws';\nimport type { Hono } from 'hono';\nimport { createLateBoundCommentarySink, type LateBoundCommentarySink } from './commentary/index.js';\nimport type { ServerConfigSpec } from './config.js';\nimport type { ServerVariables } from './internal/context.js';\nimport {\n  createWsDispatcher,\n  createWsTicketStore,\n  type WsDispatcher,\n  type WsTicketStore,\n} from './ws/index.js';\n\n/**\n * Everything the WebSocket layer contributes to the composed server.\n * Every member is `undefined` when `server.ws.enabled` is false.\n */\nexport interface WsLayer {\n  readonly dispatcher: WsDispatcher | undefined;\n  readonly tickets: WsTicketStore | undefined;\n  readonly wsAdapter: ReturnType<typeof createNodeWebSocket> | undefined;\n  readonly commentaryAuditSink: LateBoundCommentarySink | undefined;\n}\n\n/**\n * Build the WS dispatcher + ticket store + node-ws adapter when\n * `server.ws.enabled` is true.\n */\nexport function buildWsLayer(\n  app: Hono<{ Variables: ServerVariables }>,\n  config: ServerConfigSpec,\n  now: () => number,\n): WsLayer {\n  let dispatcher: WsDispatcher | undefined;\n  let tickets: WsTicketStore | undefined;\n  let wsAdapter: ReturnType<typeof createNodeWebSocket> | undefined;\n  // IP-21: the dispatcher is built here, before the audit DB opens in start().\n  // Hand it a late-bound commentary sink now and install the audit-writing\n  // target once the DB exists - otherwise the sanitizer's documented decisions\n  // (wrapped/stripped frames with before/after digests) are dropped.\n  let commentaryAuditSink: LateBoundCommentarySink | undefined;\n  if (config.server.ws.enabled) {\n    commentaryAuditSink = createLateBoundCommentarySink();\n    dispatcher = createWsDispatcher({\n      commentary: {\n        policy: config.server.ws.commentarySanitization.policy,\n        applyToEvents: config.server.ws.commentarySanitization.applyToEvents,\n        sink: commentaryAuditSink,\n      },\n      replayBuffer: {\n        maxEvents: config.server.stream.replayBuffer.maxEvents,\n        ttlMs: config.server.stream.replayBuffer.ttlSeconds * 1000,\n      },\n      perConnectionQueueLimit: config.server.stream.perConnectionQueueLimit,\n      now,\n    });\n    tickets = createWsTicketStore({\n      ttlMs: config.server.ws.ticketTtlMs,\n      now,\n    });\n    wsAdapter = createNodeWebSocket({ app });\n    // The WS server inside @hono/node-ws is created without any\n    // subprotocol-negotiation policy; without one, the `ws` library\n    // never echoes back `Sec-WebSocket-Protocol` and clients that\n    // advertised a subprotocol close the connection immediately.\n    // Mutate the options to install a Graphorin-aware policy that\n    // selects `graphorin.protocol.v1` when the client offered it.\n    const wssOptions = (\n      wsAdapter.wss as unknown as {\n        options: {\n          handleProtocols?: (\n            protocols: Set<string>,\n            request: import('node:http').IncomingMessage,\n          ) => string | false;\n        };\n      }\n    ).options;\n    wssOptions.handleProtocols = (protocols) => {\n      const negotiated = negotiateSubprotocol(Array.from(protocols));\n      if (negotiated !== null) return negotiated;\n      // Browser ticket flow: the `WebSocket` constructor cannot set an\n      // `Authorization` header, so the browser client offers two\n      // subprotocol tokens - the canonical `graphorin.protocol.v1`\n      // name plus a `ticket.<value>` token (see the wire contract in\n      // `@graphorin/protocol`'s `subprotocol.ts`:\n      // `SUBPROTOCOL_NAME` / `TICKET_SUBPROTOCOL_PREFIX` /\n      // `parseTicketSubprotocol`). The server MUST echo back exactly\n      // the canonical name (never the `ticket.*` token) so the\n      // handshake's `Sec-WebSocket-Protocol` response stays valid; the\n      // ticket value is consumed separately by `createWsUpgradeEvents`\n      // via `parseTicketSubprotocol` and exchanged through the\n      // single-use `WsTicketStore`.\n      for (const candidate of protocols) {\n        if (candidate === SUBPROTOCOL_NAME) return SUBPROTOCOL_NAME;\n      }\n      return false;\n    };\n  }\n  return { dispatcher, tickets, wsAdapter, commentaryAuditSink };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuCA,SAAgB,aACd,KACA,QACA,KACS;CACT,IAAIA;CACJ,IAAIC;CACJ,IAAIC;CAKJ,IAAIC;AACJ,KAAI,OAAO,OAAO,GAAG,SAAS;AAC5B,wBAAsB,+BAA+B;AACrD,eAAa,mBAAmB;GAC9B,YAAY;IACV,QAAQ,OAAO,OAAO,GAAG,uBAAuB;IAChD,eAAe,OAAO,OAAO,GAAG,uBAAuB;IACvD,MAAM;IACP;GACD,cAAc;IACZ,WAAW,OAAO,OAAO,OAAO,aAAa;IAC7C,OAAO,OAAO,OAAO,OAAO,aAAa,aAAa;IACvD;GACD,yBAAyB,OAAO,OAAO,OAAO;GAC9C;GACD,CAAC;AACF,YAAU,oBAAoB;GAC5B,OAAO,OAAO,OAAO,GAAG;GACxB;GACD,CAAC;AACF,cAAY,oBAAoB,EAAE,KAAK,CAAC;EAOxC,MAAM,aACJ,UAAU,IAQV;AACF,aAAW,mBAAmB,cAAc;GAC1C,MAAM,aAAa,qBAAqB,MAAM,KAAK,UAAU,CAAC;AAC9D,OAAI,eAAe,KAAM,QAAO;AAahC,QAAK,MAAM,aAAa,UACtB,KAAI,cAAc,iBAAkB,QAAO;AAE7C,UAAO;;;AAGX,QAAO;EAAE;EAAY;EAAS;EAAW;EAAqB"}

package/dist/app.d.ts

@@ -1,10 +1,12 @@
 import { ServerConfigInput, ServerConfigSpec } from "./config.js";
 import { ConsolidatorDaemon, ConsolidatorLike } from "./consolidator/daemon.js";
 import { TriggersDaemon } from "./triggers/daemon.js";
+import { WorkflowTimerDaemon } from "./workflows/timer-daemon.js";
 import { HealthCheckOptions } from "./health/checks.js";
 import { ServerVariables } from "./internal/context.js";
 import { MetricRegistry } from "./metrics/registry.js";
 import "./health/index.js";
+import { TriggersDaemonInput, WorkflowTimersInput } from "./app-daemons.js";
 import { LifecycleHooks } from "./lifecycle/hooks.js";
 import "./lifecycle/index.js";
 import { AgentRegistry, WorkflowRegistry } from "./registry/index.js";
@@ -20,13 +22,12 @@ import { SessionApi } from "./routes/sessions.js";
 import { SkillsApi } from "./routes/skills.js";
 import "./routes/index.js";
 import "./ws/index.js";
+import { ensureStoreAuditBinding } from "./app-audit-binding.js";
 import { GraphorinSqliteStore } from "@graphorin/store-sqlite";
 import { Hono } from "hono";
-import * as _graphorin_triggers0 from "@graphorin/triggers";
 
 //#region src/app.d.ts
 
-declare function ensureStoreAuditBinding(): void;
 /**
  * Public surface returned by {@link createServer}.
  *
@@ -70,6 +71,11 @@ interface GraphorinServer {
    * consolidator })`. Phase 14c integration.
    */
   readonly consolidator: ConsolidatorDaemon | undefined;
+  /**
+   * W-032: optional workflow durable-timer daemon - populated when the
+   * operator wired a `createTimerDriver(...)` at construction time.
+   */
+  readonly workflowTimers: WorkflowTimerDaemon | undefined;
   /**
    * Phase 14c Prometheus registry. Always present; sample updates
    * are observable via `metrics.snapshot()`.
@@ -83,19 +89,6 @@ interface GraphorinServer {
     readonly force?: boolean;
   }): Promise<void>;
 }
-/**
- * Discriminated union accepted by `CreateServerOptions.triggers`. A
- * caller may either supply a fully-built daemon (e.g. constructed
- * around a custom `Scheduler`) or just the underlying scheduler - the
- * server wraps it with {@link createTriggersDaemon} automatically.
- *
- * @stable
- */
-type TriggersDaemonInput = {
-  readonly daemon: TriggersDaemon;
-} | {
-  readonly scheduler: _graphorin_triggers0.Scheduler;
-};
 /**
  * @stable
  */
@@ -133,6 +126,13 @@ interface CreateServerOptions {
    * should wrap with the daemon adapter.
    */
   readonly triggers?: TriggersDaemonInput;
+  /**
+   * W-032: optional workflow durable-timer surface - pass a
+   * `createTimerDriver(...)` built over your workflows + checkpoint
+   * stores (`{ driver }`), or a pre-built daemon. The server starts
+   * and stops it with the lifecycle and reports it on `/v1/health`.
+   */
+  readonly workflowTimers?: WorkflowTimersInput;
   /**
    * Optional replay API consumed by the scope-enforced replay
    * endpoints. Phase 14c.
@@ -170,5 +170,5 @@ interface CreateServerOptions {
  */
 declare function createServer(options?: CreateServerOptions): Promise<GraphorinServer>;
 //#endregion
-export { CreateServerOptions, GraphorinServer, TriggersDaemonInput, createServer, ensureStoreAuditBinding };
+export { CreateServerOptions, GraphorinServer, createServer };
 //# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","names":[],"sources":["../src/app.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmQiB,iBAxJD,uBAAA,CAAA,CAwJgB,EAAA,IAAA;;;;;;AAMf,UANA,eAAA,CAMA;EAQQ,SAAA,OAAA,EAAA,MAAA;EAMH,SAAA,MAAA,EAlBH,gBAkBG;EAMD,SAAA,GAAA,EAvBL,IAuBK,CAAA;IAMI,SAAA,EA7BS,eA6BT;EAKL,CAAA,CAAA;EACT,SAAA,MAAA,EAlCQ,aAkCR;EACqC,SAAA,SAAA,EAlC1B,gBAkC0B;EAAO,SAAA,IAAA,EAjCtC,eAiCsC;EAW3C,SAAA,WAAA,EAAmB;IAOd,SAAA,IAAA,EAAA,MAAmB;IAEhB,SAAA,IAAA,EAAA,MAAA;EAMS,CAAA,GAAA,SAAA;EAEV;;;;;;EASC,SAAA,YAAA,EA9DK,YA8DL,GAAA,SAAA;EACH;;;;;EAuBe,SAAA,SAAA,EAhFV,aAgFU,GAAA,SAAA;EAA6B;;;;;EAYnB,SAAA,QAAA,EAtFrB,cAsFqB,GAAA,SAAA;EAsBpB;;;;;yBAtGG;;;;;oBAKL;WACT;;;;;;MACqC;;;;;;;;;;KAWpC,mBAAA;mBACW;;sBAAc,oBAAA,CACmB;;;;;UAKvC,mBAAA;;oBAEG;;;;;;6BAMS;;mBAEV;;kBAED;;oBAEE;uBACG;;sBAED;oBACF;oBACA;iBACH;mBACE;;;;;;0BAMO;;;;;;sBAMJ;;;;;oBAKF;;;;;gCAKY,qBAAqB,QAAQ;;;;;;4BAMjC;;mBAET;;;;mCAIgB;;;;;;;;;;;;;;iBAsBb,YAAA,WAAsB,sBAA2B,QAAQ"}
+{"version":3,"file":"app.d.ts","names":[],"sources":["../src/app.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0GiB,UAlDA,eAAA,CAkDmB;EAEhB,SAAA,OAAA,EAAA,MAAA;EAMS,SAAA,MAAA,EAxDV,gBAwDU;EAEV,SAAA,GAAA,EAzDH,IAyDG,CAAA;IAED,SAAA,EA3DgB,eA2DhB;EAEE,CAAA,CAAA;EACG,SAAA,MAAA,EA7DJ,aA6DI;EAED,SAAA,SAAA,EA9DA,gBA8DA;EACF,SAAA,IAAA,EA9DH,eA8DG;EACA,SAAA,WAAA,EAAA;IACH,SAAA,IAAA,EAAA,MAAA;IACE,SAAA,IAAA,EAAA,MAAA;EAMO,CAAA,GAAA,SAAA;EAMJ;;;;;;EAuBM,SAAA,YAAA,EA5FH,YA4FG,GAAA,SAAA;EAET;;;AA0BnB;;EAA+E,SAAA,SAAA,EAlHzD,aAkHyD,GAAA,SAAA;EAAR;;;;;qBA5GlD;;;;;;yBAMI;;;;;2BAKE;;;;;oBAKP;WACT;;;;;;MACqC;;;;;UAM/B,mBAAA;;oBAEG;;;;;;6BAMS;;mBAEV;;kBAED;;oBAEE;uBACG;;sBAED;oBACF;oBACA;iBACH;mBACE;;;;;;0BAMO;;;;;;sBAMJ;;;;;;;4BAOM;;;;;oBAKR;;;;;gCAKY,qBAAqB,QAAQ;;;;;;4BAMjC;;mBAET;;;;mCAIgB;;;;;;;;;;;;;;iBAsBb,YAAA,WAAsB,sBAA2B,QAAQ"}