@graphorin/server 0.6.1 → 0.7.0

package/dist/app.js

@@ -1,148 +1,20 @@
 import { version } from "./package.js";
-import { bridgeCommentaryToAudit, createLateBoundCommentarySink } from "./commentary/audit-bridge.js";
-import "./commentary/index.js";
-import { LifecycleDoubleStartError, LifecycleNotStartedError, ShutdownTimeoutError } from "./errors/index.js";
-import { parseServerConfig } from "./config.js";
-import { createConsolidatorDaemon } from "./consolidator/daemon.js";
-import { createExtendedHealthRoutes, createMetricsRoutes, createSecretsHealthRoutes } from "./health/routes.js";
-import "./health/index.js";
-import { runPreBind } from "./lifecycle/pre-bind.js";
-import "./lifecycle/index.js";
+import { buildDaemons } from "./app-daemons.js";
+import { ensureStoreAuditBinding } from "./app-audit-binding.js";
 import { SERVER_METRIC_NAMES, createServerMetricRegistry } from "./metrics/catalog.js";
-import { createAuditMiddleware } from "./middleware/audit.js";
-import { createAnonymousAuthMiddleware, createAuthMiddleware } from "./middleware/auth.js";
-import { createCorsMiddleware } from "./middleware/cors.js";
-import { createCsrfMiddleware } from "./middleware/csrf.js";
-import { createIdempotencyMiddleware } from "./middleware/idempotency.js";
-import { createRateLimitMiddleware } from "./middleware/rate-limit.js";
-import { createRequestStateMiddleware } from "./middleware/request-state.js";
-import "./middleware/index.js";
+import { attachGlobalMiddleware } from "./app-middleware.js";
+import { RunStateTracker } from "./runtime/run-state.js";
+import { createLifecycle } from "./app-lifecycle.js";
+import { buildWsLayer } from "./app-ws.js";
+import { parseServerConfig } from "./config.js";
 import { AgentRegistry, WorkflowRegistry } from "./registry/index.js";
-import { createReplayRoutes } from "./replay/routes.js";
-import "./replay/index.js";
-import { createAgentRoutes, createRunRoutes } from "./routes/agents.js";
-import { createAuditRoutes } from "./routes/audit.js";
-import { createAuthRoutes } from "./routes/auth.js";
-import { createMcpRoutes } from "./routes/mcp.js";
-import { createMemoryRoutes } from "./routes/memory.js";
-import { createSessionRoutes } from "./routes/sessions.js";
-import { createSkillsRoutes } from "./routes/skills.js";
-import { createTokensRoutes } from "./routes/tokens.js";
-import { createWorkflowRoutes } from "./routes/workflows.js";
-import "./routes/index.js";
-import { RunStateTracker, scheduleRunPruning } from "./runtime/run-state.js";
-import { createSseRoutes } from "./sse/events.js";
-import "./sse/index.js";
-import { createTriggersDaemon } from "./triggers/daemon.js";
-import { createTriggersRoutes } from "./triggers/routes.js";
-import { createWsDispatcher } from "./ws/dispatcher.js";
-import { createWsTicketStore } from "./ws/ticket.js";
-import { createWsUpgradeEvents } from "./ws/upgrade.js";
-import "./ws/index.js";
-import { SUBPROTOCOL_NAME, negotiateSubprotocol } from "@graphorin/protocol";
-import { TokenVerifier, applyProcessHardening, generatePepper } from "@graphorin/security";
-import { openAuditDb, registerAuditDbBinding } from "@graphorin/security/audit";
-import { createSqliteStore, loadCipherDriver, readWalSize } from "@graphorin/store-sqlite";
-import { serve } from "@hono/node-server";
-import { createNodeWebSocket } from "@hono/node-ws";
+import { createSqliteStore } from "@graphorin/store-sqlite";
 import { Hono } from "hono";
 
 //#region src/app.ts
 /**
 * @stable
 */
-/**
-* Pre-built audit-db binding shipped from `@graphorin/store-sqlite`.
-* Registered exactly once per process so {@link openAuditDb} can find
-* a default binding without forcing operators to wire it manually.
-*
-* Exported as {@link ensureStoreAuditBinding} so the CLI (Phase 15
-* `graphorin audit verify | prune | export`) can reach into the same
-* binding without booting the HTTP listener.
-*
-* @stable
-*/
-let storeAuditBindingRegistered = false;
-function ensureStoreAuditBinding() {
-	if (storeAuditBindingRegistered) return;
-	registerAuditDbBinding({
-		id: "better-sqlite3-multiple-ciphers",
-		description: "Default audit-db binding shipped by @graphorin/store-sqlite.",
-		open: async (opts) => {
-			const driver = await loadCipherDriver();
-			const passphrase = await opts.passphrase.use((value) => value);
-			const db = new driver(opts.path);
-			db.pragma(`key = '${passphrase.replace(/'/g, "''")}'`);
-			db.pragma("journal_mode = WAL");
-			db.pragma("synchronous = NORMAL");
-			db.pragma("busy_timeout = 5000");
-			db.pragma("foreign_keys = ON");
-			db.exec(`CREATE TABLE IF NOT EXISTS audit_log (
-            seq INTEGER PRIMARY KEY,
-            ts INTEGER NOT NULL,
-            actor_json TEXT NOT NULL,
-            action TEXT NOT NULL,
-            target TEXT NOT NULL,
-            decision TEXT NOT NULL,
-            context_json TEXT,
-            metadata_json TEXT,
-            prev_hash TEXT NOT NULL,
-            hash TEXT NOT NULL UNIQUE
-          ) WITHOUT ROWID;`);
-			return {
-				binding: "better-sqlite3-multiple-ciphers",
-				path: opts.path,
-				async insert(entry) {
-					db.prepare(`INSERT INTO audit_log (
-                 seq, ts, actor_json, action, target, decision,
-                 context_json, metadata_json, prev_hash, hash
-               ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(entry.seq, entry.ts, JSON.stringify(entry.actor), entry.action, entry.target, entry.decision, entry.context !== void 0 ? JSON.stringify(entry.context) : null, entry.metadata !== void 0 ? JSON.stringify(entry.metadata) : null, entry.prevHash, entry.hash);
-					return entry;
-				},
-				async latest() {
-					const row = db.prepare("SELECT * FROM audit_log ORDER BY seq DESC LIMIT 1").get();
-					if (row === void 0) return void 0;
-					return rowToEntry(row);
-				},
-				async *iterate(bounds) {
-					const lo = bounds?.fromSeq ?? 1;
-					const hi = bounds?.toSeq ?? Number.MAX_SAFE_INTEGER;
-					const iter = db.prepare("SELECT * FROM audit_log WHERE seq BETWEEN ? AND ? ORDER BY seq ASC").iterate(lo, hi);
-					for (const row of iter) yield rowToEntry(row);
-				},
-				async count() {
-					return db.prepare("SELECT COUNT(*) AS n FROM audit_log").get().n;
-				},
-				async deleteUpTo(threshold) {
-					const before = db.prepare("SELECT COUNT(*) AS n FROM audit_log WHERE seq <= ?").get(threshold);
-					db.prepare("DELETE FROM audit_log WHERE seq <= ?").run(threshold);
-					return before.n;
-				},
-				async replaceEntry(entry) {
-					db.prepare(`UPDATE audit_log SET prev_hash = ?, hash = ? WHERE seq = ?`).run(entry.prevHash, entry.hash, entry.seq);
-				},
-				async close() {
-					if (db.open) db.close();
-				}
-			};
-		}
-	}, { setAsDefault: true });
-	storeAuditBindingRegistered = true;
-}
-function rowToEntry(row) {
-	return {
-		seq: row.seq,
-		ts: row.ts,
-		actor: JSON.parse(row.actor_json),
-		action: row.action,
-		target: row.target,
-		decision: row.decision,
-		...row.context_json !== null ? { context: JSON.parse(row.context_json) } : {},
-		...row.metadata_json !== null ? { metadata: JSON.parse(row.metadata_json) } : {},
-		prevHash: row.prev_hash,
-		hash: row.hash
-	};
-}
 const VERSION = version;
 /**
 * Build a fully-wired Graphorin server. The returned handle is
@@ -186,59 +58,25 @@ async function createServer(options = {}) {
 	const agents = options.agents ?? new AgentRegistry();
 	const workflows = options.workflows ?? new WorkflowRegistry();
 	const app = new Hono();
-	app.use("*", createRequestStateMiddleware({
+	attachGlobalMiddleware(app, config, now);
+	const { triggersDaemon, consolidatorDaemon, workflowTimerDaemon } = buildDaemons(options);
+	const lifecycle = createLifecycle({
+		options,
+		config,
+		store,
+		app,
+		metricRegistry,
+		runs,
+		agents,
+		workflows,
+		version: version$1,
+		startedAt,
 		now,
-		...config.server.trustProxy ? { trustProxy: true } : {}
-	}));
-	app.use("*", createCorsMiddleware(config.server.cors));
-	app.use("*", createCsrfMiddleware(config.server.csrf));
-	app.use("*", createRateLimitMiddleware(config.server.rateLimit, { now }));
-	let serverInstance;
-	let listening;
-	let started = false;
-	let stopped = false;
-	let stopRunPruning;
-	let auditDb;
-	let preBind;
-	let verifier;
-	let pepperHandle;
-	let triggersDaemon;
-	if (options.triggers !== void 0) if ("daemon" in options.triggers) triggersDaemon = options.triggers.daemon;
-	else triggersDaemon = createTriggersDaemon({ scheduler: options.triggers.scheduler });
-	let consolidatorDaemon;
-	if (options.consolidator !== void 0) consolidatorDaemon = createConsolidatorDaemon({ consolidator: options.consolidator });
-	let dispatcher;
-	let tickets;
-	let wsAdapter;
-	let commentaryAuditSink;
-	if (config.server.ws.enabled) {
-		commentaryAuditSink = createLateBoundCommentarySink();
-		dispatcher = createWsDispatcher({
-			commentary: {
-				policy: config.server.ws.commentarySanitization.policy,
-				applyToEvents: config.server.ws.commentarySanitization.applyToEvents,
-				sink: commentaryAuditSink
-			},
-			replayBuffer: {
-				maxEvents: config.server.stream.replayBuffer.maxEvents,
-				ttlMs: config.server.stream.replayBuffer.ttlSeconds * 1e3
-			},
-			perConnectionQueueLimit: config.server.stream.perConnectionQueueLimit,
-			now
-		});
-		tickets = createWsTicketStore({
-			ttlMs: config.server.ws.ticketTtlMs,
-			now
-		});
-		wsAdapter = createNodeWebSocket({ app });
-		const wssOptions = wsAdapter.wss.options;
-		wssOptions.handleProtocols = (protocols) => {
-			const negotiated = negotiateSubprotocol(Array.from(protocols));
-			if (negotiated !== null) return negotiated;
-			for (const candidate of protocols) if (candidate === SUBPROTOCOL_NAME) return SUBPROTOCOL_NAME;
-			return false;
-		};
-	}
+		ws: buildWsLayer(app, config, now),
+		triggersDaemon,
+		consolidatorDaemon,
+		workflowTimerDaemon
+	});
 	return {
 		version: version$1,
 		config,
@@ -248,10 +86,10 @@ async function createServer(options = {}) {
 		runs,
 		metrics: metricRegistry,
 		get wsDispatcher() {
-			return dispatcher;
+			return lifecycle.wsDispatcher;
 		},
 		get wsTickets() {
-			return tickets;
+			return lifecycle.wsTickets;
 		},
 		get triggers() {
 			return triggersDaemon;
@@ -259,427 +97,17 @@ async function createServer(options = {}) {
 		get consolidator() {
 			return consolidatorDaemon;
 		},
-		get listeningOn() {
-			return listening;
+		get workflowTimers() {
+			return workflowTimerDaemon;
 		},
-		async start() {
-			if (started) throw new LifecycleDoubleStartError();
-			started = true;
-			try {
-				if (options.hooks?.beforeStart !== void 0) await options.hooks.beforeStart({ config });
-				if (options.skipHardening !== true && config.hardening.applyOnStart) applyProcessHardening({
-					refuseRoot: config.hardening.refuseRoot,
-					umask: config.hardening.umask
-				});
-				preBind = await runPreBind({
-					config,
-					store,
-					...options.probeCipherPeer !== void 0 ? { probeCipherPeer: options.probeCipherPeer } : {}
-				});
-				if (config.audit.enabled && preBind.auditPassphrase !== void 0 && preBind.auditPath !== void 0) {
-					ensureStoreAuditBinding();
-					auditDb = await openAuditDb({
-						path: preBind.auditPath,
-						passphrase: preBind.auditPassphrase,
-						...config.audit.cipher !== void 0 ? { cipher: config.audit.cipher } : {}
-					});
-					commentaryAuditSink?.bind(bridgeCommentaryToAudit(auditDb));
-				}
-				if (config.auth.kind === "token") {
-					const pepper = preBind.pepper ?? await fallbackPepper(options.skipHardening === true);
-					pepperHandle = pepper;
-					verifier = new TokenVerifier({
-						tokenStore: store.authTokens,
-						pepper,
-						acceptPrefix: config.auth.tokenPrefix,
-						acceptEnvironments: config.auth.tokenEnvironments,
-						...config.auth.perIpFailureThreshold !== void 0 ? { perIpFailureThreshold: config.auth.perIpFailureThreshold } : {},
-						...config.auth.perIpLockoutMs !== void 0 ? { perIpLockoutMs: config.auth.perIpLockoutMs } : {},
-						now
-					});
-				}
-				mountRoutes(app, config, {
-					version: version$1,
-					startedAt,
-					now,
-					agents,
-					workflows,
-					runs,
-					store,
-					metricRegistry,
-					...options.sessions !== void 0 ? { sessions: options.sessions } : {},
-					...options.memory !== void 0 ? { memory: options.memory } : {},
-					...options.skills !== void 0 ? { skills: options.skills } : {},
-					...options.mcp !== void 0 ? { mcp: options.mcp } : {},
-					...options.audit !== void 0 ? { audit: options.audit } : {},
-					...options.replay !== void 0 ? { replay: options.replay } : {},
-					...options.healthProbes !== void 0 ? { healthProbes: options.healthProbes } : {},
-					...verifier !== void 0 ? { verifier } : {},
-					...auditDb !== void 0 ? { auditDb } : {},
-					...pepperHandle !== void 0 ? { pepper: pepperHandle } : {},
-					...dispatcher !== void 0 ? { wsDispatcher: dispatcher } : {},
-					...tickets !== void 0 ? { wsTickets: tickets } : {},
-					...wsAdapter !== void 0 ? { wsAdapter } : {},
-					...triggersDaemon !== void 0 ? { triggersDaemon } : {},
-					...consolidatorDaemon !== void 0 ? { consolidatorDaemon } : {}
-				});
-				if (consolidatorDaemon !== void 0) {
-					await consolidatorDaemon.start();
-					if (triggersDaemon !== void 0 && consolidatorDaemon.consolidator.registerWithScheduler !== void 0) await consolidatorDaemon.consolidator.registerWithScheduler(triggersDaemon.scheduler);
-				}
-				if (triggersDaemon !== void 0) await triggersDaemon.start();
-				try {
-					const wal = readWalSize(store.connection);
-					metricRegistry.set(SERVER_METRIC_NAMES.storageWalSize, wal);
-				} catch {}
-				metricRegistry.set(SERVER_METRIC_NAMES.serverUptime, Math.max(0, Math.floor((now() - startedAt) / 1e3)));
-				metricRegistry.set(SERVER_METRIC_NAMES.inflightRuns, runs.runningCount());
-				metricRegistry.set(SERVER_METRIC_NAMES.replayBufferEvents, 0);
-				stopRunPruning = scheduleRunPruning(runs, now);
-				if (options.skipListen !== true) {
-					serverInstance = serve({
-						fetch: app.fetch.bind(app),
-						hostname: config.server.host,
-						port: config.server.port
-					});
-					if (wsAdapter !== void 0 && serverInstance !== void 0) wsAdapter.injectWebSocket(serverInstance);
-					await new Promise((resolve) => {
-						const server = serverInstance;
-						if ("once" in server && typeof server.once === "function") server.once("listening", () => resolve());
-						else setImmediate(() => resolve());
-					});
-					const address = serverInstance.address();
-					if (address !== null && typeof address === "object") listening = {
-						host: address.address,
-						port: address.port
-					};
-					else listening = {
-						host: config.server.host,
-						port: config.server.port
-					};
-				} else listening = {
-					host: config.server.host,
-					port: config.server.port
-				};
-				if (options.hooks?.onReady !== void 0) await options.hooks.onReady({
-					config,
-					listeningOn: listening
-				});
-				return listening;
-			} catch (err) {
-				started = false;
-				await emitError(options.hooks, {
-					error: err,
-					phase: "beforeStart"
-				});
-				throw err;
-			}
+		get listeningOn() {
+			return lifecycle.listeningOn;
 		},
-		async stop({ force } = {}) {
-			if (!started) throw new LifecycleNotStartedError();
-			if (stopped) return;
-			stopped = true;
-			stopRunPruning?.();
-			stopRunPruning = void 0;
-			const drainTimeoutMs = force === true ? 0 : config.server.shutdown.drainTimeoutMs;
-			try {
-				if (options.hooks?.beforeShutdown !== void 0) await options.hooks.beforeShutdown({
-					config,
-					inflight: runs.inflightCount(),
-					drainTimeoutMs
-				});
-			} catch (err) {
-				await emitError(options.hooks, {
-					error: err,
-					phase: "beforeShutdown"
-				});
-			}
-			if (triggersDaemon !== void 0) try {
-				await triggersDaemon.stop();
-			} catch (err) {
-				await emitError(options.hooks, {
-					error: err,
-					phase: "beforeShutdown"
-				});
-			}
-			if (consolidatorDaemon !== void 0) try {
-				await consolidatorDaemon.stop();
-			} catch (err) {
-				await emitError(options.hooks, {
-					error: err,
-					phase: "beforeShutdown"
-				});
-			}
-			runs.abortPending("server-shutdown");
-			if (!await drainInFlight(runs, drainTimeoutMs, now) && drainTimeoutMs > 0) runs.abortAll(new ShutdownTimeoutError(drainTimeoutMs, runs.runningCount()));
-			if (dispatcher !== void 0) try {
-				dispatcher.shutdown();
-			} catch {}
-			if (serverInstance !== void 0) {
-				await new Promise((resolve) => {
-					serverInstance.close(() => resolve());
-				});
-				serverInstance = void 0;
-			}
-			if (auditDb !== void 0) {
-				await auditDb.close();
-				auditDb = void 0;
-			}
-			await store.close();
-			listening = void 0;
-			verifier = void 0;
-			started = false;
-			preBind = void 0;
-			dispatcher = void 0;
-			tickets = void 0;
-			wsAdapter = void 0;
-		}
-	};
-}
-/** IP-23: is `host` a loopback interface (so an open /metrics is not exposed)? */
-function isLoopbackHost(host) {
-	const h = host.trim().toLowerCase();
-	return h === "127.0.0.1" || h === "::1" || h === "[::1]" || h === "localhost";
-}
-function mountRoutes(app, config, ctx) {
-	const base = config.server.basePath;
-	const probes = ctx.healthProbes ?? (() => buildDefaultHealthProbes(ctx.store, ctx.triggersDaemon, ctx.consolidatorDaemon, ctx.wsDispatcher, config));
-	const health = createExtendedHealthRoutes({
-		version: ctx.version,
-		startedAt: ctx.startedAt,
-		now: ctx.now,
-		probes
-	});
-	app.route(`${base}/health`, health);
-	if (config.auth.kind === "none" && !isLoopbackHost(config.server.host)) console.warn(`[graphorin/server] WARN: auth.kind='none' disables authentication on every endpoint, but the server binds the non-loopback host '${config.server.host}'. Anyone who can reach it has full admin access - use auth.kind='token' for non-loopback deployments or bind a loopback host.`);
-	if (config.metrics.enabled) {
-		if (!config.metrics.requireAuth && !isLoopbackHost(config.server.host)) console.warn(`[graphorin/server] WARN: /metrics is unauthenticated (metrics.requireAuth=false) and the server binds the non-loopback host '${config.server.host}'. The exposition leaks operational detail to anyone who can reach it - set metrics.requireAuth=true or bind a loopback host.`);
-		const metricsRoute = createMetricsRoutes({
-			registry: ctx.metricRegistry,
-			requireAuth: config.metrics.requireAuth,
-			refresh: () => refreshLiveMetrics({
-				registry: ctx.metricRegistry,
-				store: ctx.store,
-				runs: ctx.runs,
-				startedAt: ctx.startedAt,
-				now: ctx.now,
-				...ctx.triggersDaemon !== void 0 ? { triggersDaemon: ctx.triggersDaemon } : {},
-				...ctx.consolidatorDaemon !== void 0 ? { consolidatorDaemon: ctx.consolidatorDaemon } : {},
-				...ctx.wsDispatcher !== void 0 ? { wsDispatcher: ctx.wsDispatcher } : {}
-			})
-		});
-		app.route(`${base}${config.metrics.path}`, metricsRoute);
-	}
-	const wsUpgradePath = config.server.ws.enabled ? `${base}${config.server.ws.path}` : void 0;
-	const metricsPath = config.metrics.enabled && !config.metrics.requireAuth ? `${base}${config.metrics.path}` : void 0;
-	function shouldSkipAuth(path) {
-		if (path === `${base}/health` || path === `${base}/health/`) return true;
-		if (wsUpgradePath !== void 0) {
-			if (path === wsUpgradePath || path === `${wsUpgradePath}/`) return true;
-		}
-		if (metricsPath !== void 0) {
-			if (path === metricsPath || path === `${metricsPath}/`) return true;
-		}
-		return false;
-	}
-	const anonymousAuth = ctx.verifier === void 0 && config.auth.kind === "none";
-	if (ctx.verifier !== void 0 || anonymousAuth) {
-		const authMw = ctx.verifier !== void 0 ? createAuthMiddleware({ verifier: ctx.verifier }) : createAnonymousAuthMiddleware();
-		app.use(`${base}/*`, async (c, next) => {
-			if (shouldSkipAuth(c.req.path)) {
-				await next();
-				return;
-			}
-			return authMw(c, next);
-		});
-		if (ctx.auditDb !== void 0) {
-			const auditMw = createAuditMiddleware({
-				auditDb: ctx.auditDb,
-				now: ctx.now
-			});
-			app.use(`${base}/*`, async (c, next) => {
-				if (shouldSkipAuth(c.req.path)) {
-					await next();
-					return;
-				}
-				return auditMw(c, next);
-			});
-		}
-	}
-	if (config.server.idempotency.enabled) {
-		const idempotencyMw = createIdempotencyMiddleware({
-			store: ctx.store.idempotency,
-			config: config.server.idempotency,
-			now: ctx.now,
-			excludeResponseCachePaths: [`${base}/tokens`],
-			metricRegistry: ctx.metricRegistry
-		});
-		app.use(`${base}/*`, async (c, next) => {
-			if (shouldSkipAuth(c.req.path)) {
-				await next();
-				return;
-			}
-			return idempotencyMw(c, next);
-		});
-	}
-	app.route(`${base}/health/secrets`, createSecretsHealthRoutes());
-	app.route(`${base}/agents`, createAgentRoutes({
-		agents: ctx.agents,
-		runs: ctx.runs,
-		...ctx.wsDispatcher !== void 0 ? { dispatcher: ctx.wsDispatcher } : {}
-	}));
-	app.route(`${base}/runs`, createRunRoutes({
-		agents: ctx.agents,
-		runs: ctx.runs
-	}));
-	app.route(`${base}/workflows`, createWorkflowRoutes({
-		workflows: ctx.workflows,
-		runs: ctx.runs,
-		...ctx.wsDispatcher !== void 0 ? { dispatcher: ctx.wsDispatcher } : {}
-	}));
-	if (ctx.sessions !== void 0) app.route(`${base}/sessions`, createSessionRoutes({ sessions: ctx.sessions }));
-	if (ctx.memory !== void 0) app.route(`${base}/memory`, createMemoryRoutes({ memory: ctx.memory }));
-	if (ctx.skills !== void 0) app.route(`${base}/skills`, createSkillsRoutes({ skills: ctx.skills }));
-	if (ctx.mcp !== void 0) app.route(`${base}/mcp`, createMcpRoutes({ mcp: ctx.mcp }));
-	if (ctx.audit !== void 0) app.route(`${base}/audit`, createAuditRoutes({ audit: ctx.audit }));
-	if (ctx.triggersDaemon !== void 0) app.route(`${base}/triggers`, createTriggersRoutes({ daemon: ctx.triggersDaemon }));
-	if (ctx.replay !== void 0) app.route(`${base}`, createReplayRoutes({
-		replay: ctx.replay,
-		...ctx.auditDb !== void 0 ? { auditDb: ctx.auditDb } : {},
-		now: ctx.now
-	}));
-	if (config.auth.kind === "token" && ctx.pepper !== void 0) app.route(`${base}/tokens`, createTokensRoutes({
-		tokenStore: ctx.store.authTokens,
-		pepper: ctx.pepper,
-		defaultEnv: "live",
-		allowedEnvs: config.auth.tokenEnvironments
-	}));
-	if (ctx.wsTickets !== void 0) app.route(`${base}`, createAuthRoutes({ tickets: ctx.wsTickets }));
-	if (ctx.wsDispatcher !== void 0 && ctx.wsTickets !== void 0 && ctx.wsAdapter !== void 0 && (ctx.verifier !== void 0 || anonymousAuth) && config.server.ws.enabled) {
-		const dispatcher = ctx.wsDispatcher;
-		const tickets = ctx.wsTickets;
-		const verifier = ctx.verifier;
-		const runs = ctx.runs;
-		app.get(`${base}${config.server.ws.path}`, ctx.wsAdapter.upgradeWebSocket((c) => createWsUpgradeEvents(c, {
-			dispatcher,
-			tickets,
-			...verifier !== void 0 ? { verifier } : {},
-			anonymous: anonymousAuth,
-			runs,
-			now: ctx.now
-		})));
-	}
-	if (ctx.wsDispatcher !== void 0 && config.server.sse.enabled) app.route(`${base}${config.server.sse.path}`, createSseRoutes({
-		dispatcher: ctx.wsDispatcher,
-		keepAliveMs: config.server.sse.keepAliveMs,
-		perConnectionQueueLimit: config.server.stream.perConnectionQueueLimit,
-		now: ctx.now
-	}));
-}
-async function drainInFlight(runs, drainTimeoutMs, now) {
-	if (runs.runningCount() === 0) return true;
-	if (drainTimeoutMs <= 0) return runs.runningCount() === 0;
-	const deadline = now() + drainTimeoutMs;
-	while (now() < deadline) {
-		if (runs.runningCount() === 0) return true;
-		await new Promise((resolve) => setTimeout(resolve, Math.min(50, deadline - now())));
-	}
-	return runs.runningCount() === 0;
-}
-async function emitError(hooks, ctx) {
-	if (hooks?.onError === void 0) return;
-	try {
-		await hooks.onError(ctx);
-	} catch {}
-}
-async function refreshLiveMetrics(options) {
-	const { registry, store, runs, startedAt, now } = options;
-	try {
-		const wal = readWalSize(store.connection);
-		registry.set(SERVER_METRIC_NAMES.storageWalSize, wal);
-	} catch {}
-	registry.set(SERVER_METRIC_NAMES.serverUptime, Math.max(0, Math.floor((now() - startedAt) / 1e3)));
-	registry.set(SERVER_METRIC_NAMES.inflightRuns, runs.runningCount());
-	if (options.wsDispatcher !== void 0) {
-		const sizes = options.wsDispatcher.size();
-		registry.set(SERVER_METRIC_NAMES.replayBufferEvents, sizes.subscriptions);
-	}
-	if (options.triggersDaemon !== void 0) {
-		const metrics = options.triggersDaemon.metrics();
-		for (const [triggerId, counts] of metrics.fires) {
-			const sanitized = sanitizeMetricLabelValue(triggerId);
-			const successCurrent = readCounter(registry, SERVER_METRIC_NAMES.triggersFiresTotal, {
-				trigger_id: sanitized,
-				status: "success"
-			});
-			const errorCurrent = readCounter(registry, SERVER_METRIC_NAMES.triggersFiresTotal, {
-				trigger_id: sanitized,
-				status: "error"
-			});
-			const successDelta = counts.success - successCurrent;
-			const errorDelta = counts.error - errorCurrent;
-			if (successDelta > 0) registry.inc(SERVER_METRIC_NAMES.triggersFiresTotal, {
-				trigger_id: sanitized,
-				status: "success"
-			}, successDelta);
-			if (errorDelta > 0) registry.inc(SERVER_METRIC_NAMES.triggersFiresTotal, {
-				trigger_id: sanitized,
-				status: "error"
-			}, errorDelta);
-		}
-	}
-	if (options.consolidatorDaemon !== void 0) try {
-		const status = await options.consolidatorDaemon.status();
-		registry.set(SERVER_METRIC_NAMES.consolidatorQueueDepth, status.queueDepth, { phase: "aggregate" });
-		registry.set(SERVER_METRIC_NAMES.consolidatorDlqSize, status.dlqSize);
-		registry.set(SERVER_METRIC_NAMES.consolidatorBudgetRemainingUsd, status.budget.costRemaining);
-		registry.set(SERVER_METRIC_NAMES.consolidatorBudgetRemainingTokens, status.budget.tokensRemaining);
-	} catch {}
-}
-/**
-* Convert an arbitrary user-supplied identifier (trigger id) into a
-* Prometheus-safe label value. Replaces every character outside the
-* `[A-Za-z0-9_:]` range with `_`. This guarantees the cardinality
-* never explodes on UTF-8 sequences while keeping the value
-* recognizable.
-*/
-function sanitizeMetricLabelValue(value) {
-	return value.replace(/[^A-Za-z0-9_:.-]/g, "_").slice(0, 200);
-}
-function readCounter(registry, name, labels) {
-	const snap = registry.snapshot().counters[name] ?? [];
-	for (const entry of snap) if (matchesLabels(entry.labels, labels)) return entry.value;
-	return 0;
-}
-function matchesLabels(a, b) {
-	for (const k of Object.keys(b)) if (String(a[k]) !== b[k]) return false;
-	for (const k of Object.keys(a)) if (!(k in b)) return false;
-	return true;
-}
-function buildDefaultHealthProbes(store, triggersDaemon, consolidatorDaemon, dispatcher, config) {
-	const out = {
-		store,
-		walWarnThresholdBytes: config.health.walWarnThresholdBytes,
-		encryptionEnabled: config.storage.encryption.enabled,
-		...config.storage.encryption.enabled ? { cipherPeerInstalled: true } : {}
+		start: lifecycle.start,
+		stop: lifecycle.stop
 	};
-	if (triggersDaemon !== void 0) out.triggers = triggersDaemon;
-	if (consolidatorDaemon !== void 0) out.consolidator = consolidatorDaemon;
-	if (dispatcher !== void 0) {
-		const sizes = dispatcher.size();
-		out.replayBuffer = {
-			eventsBuffered: sizes.subscriptions,
-			subscribers: sizes.subscribers,
-			subscriptions: sizes.subscriptions
-		};
-	}
-	return Object.freeze(out);
-}
-async function fallbackPepper(skipHardening) {
-	if (!skipHardening) throw new Error("[graphorin/server] missing resolved pepper after pre-bind; auth.pepperRef is required when auth.kind = token.");
-	return generatePepper();
 }
 
 //#endregion
-export { createServer, ensureStoreAuditBinding };
+export { createServer };
 //# sourceMappingURL=app.js.map