@skein-js/server-kit 0.15.0 → 0.16.0

package/dist/channels-runtime-OADE6ORT.js

@@ -0,0 +1,137 @@
+// src/channels-runtime.ts
+import {
+  createAuthScopedStore,
+  createContext,
+  createProtocolServiceFromContext
+} from "@skein-js/agent-protocol";
+import { SkeinConfigError } from "@skein-js/config";
+import { SkeinHttpError } from "@skein-js/core";
+async function resolveChannels(input) {
+  const names = Object.keys(input.channels);
+  if (names.length === 0) return void 0;
+  const channels = await importChannelsPackage(names);
+  const registry = channels.buildChannelRegistry({
+    channels: Object.fromEntries(
+      Object.entries(input.channels).map(([name, loaded]) => [
+        name,
+        {
+          module: loaded.module,
+          config: {
+            assistant: loaded.assistant,
+            ...loaded.allowedAssistants ? { allowedAssistants: loaded.allowedAssistants } : {},
+            ...loaded.publicUrl ? { publicUrl: loaded.publicUrl } : {}
+          }
+        }
+      ])
+    ),
+    graphIds: input.graphIds
+  });
+  const pipelineDeps = buildPipelineDeps(input.deps, input.service);
+  return {
+    routes: channels.channelRouteBindings(registry.names),
+    wrapDispatcher: (inner) => channels.wrapChannelDispatcher({
+      registry,
+      inner,
+      logger: input.deps.logger ?? console
+    }),
+    handlers: {
+      handleInboundEvent: async (req) => {
+        const name = req.url.split("?")[0].split("/channels/")[1] ?? "";
+        const registered = registry.get(name);
+        if (!registered) throw SkeinHttpError.notFound(`No channel named "${name}".`);
+        return channels.handleInboundEvent(
+          registered,
+          {
+            method: req.method,
+            url: req.url,
+            headers: req.headers,
+            ...typeof req.body === "string" ? { text: req.body } : {}
+          },
+          pipelineDeps
+        );
+      }
+    }
+  };
+}
+function buildPipelineDeps(deps, service) {
+  let requestFilters;
+  const scopedService = (authContext) => {
+    if (!authContext && !requestFilters) return service();
+    const base = createContext(deps);
+    return createProtocolServiceFromContext({
+      ...base,
+      ...authContext?.user ? { authUser: authContext.user } : {},
+      ...authContext?.scopes ? { authScopes: authContext.scopes } : {},
+      deps: requestFilters && deps.auth ? {
+        ...base.deps,
+        store: createAuthScopedStore(base.deps.store, deps.auth, requestFilters, "threads")
+      } : base.deps
+    });
+  };
+  return {
+    ...deps.store.idempotency ? { idempotency: deps.store.idempotency } : {},
+    clock: () => deps.clock ? deps.clock() : /* @__PURE__ */ new Date(),
+    logger: deps.logger ?? console,
+    // Straight off the run event bus — the same stream `runs.joinStream` serves, without the HTTP
+    // connection per conversation that reaching it from outside would cost.
+    runFrames: { subscribe: (runId) => deps.bus.subscribe(runId) },
+    authorize: async (principal, authz) => {
+      if (!deps.auth) return void 0;
+      const context = {
+        user: {
+          identity: principal.identity,
+          display_name: principal.identity,
+          is_authenticated: true,
+          permissions: principal.permissions ?? [],
+          ...principal.metadata ?? {}
+        },
+        scopes: principal.permissions ?? []
+      };
+      const decision = await deps.auth.authorize({
+        resource: authz.resource,
+        action: authz.action,
+        value: {},
+        context
+      });
+      requestFilters = decision.filters;
+      return context;
+    },
+    ensureThread: async (threadId, metadata, authContext) => {
+      await scopedService(authContext).threads.create({
+        thread_id: threadId,
+        metadata,
+        ifExists: "do_nothing"
+      });
+    },
+    threadStatus: async (threadId) => {
+      const thread = await service().threads.get(threadId).catch(() => null);
+      return thread?.status ?? null;
+    },
+    createRun: async (input) => {
+      const run = await scopedService(input.authContext).runs.createBackground(input.threadId, {
+        assistant_id: input.assistantId,
+        ...input.input !== void 0 ? { input: input.input } : {},
+        ...input.command ? { command: input.command } : {},
+        ...input.ifThreadStatus ? { if_thread_status: [...input.ifThreadStatus] } : {},
+        ...input.multitaskStrategy ? { multitask_strategy: input.multitaskStrategy } : {},
+        ...input.metadata ? { metadata: input.metadata } : {},
+        ...input.webhook ? { webhook: input.webhook } : {},
+        stream_mode: [...input.streamMode]
+      });
+      return { runId: run.run_id };
+    }
+  };
+}
+async function importChannelsPackage(names) {
+  try {
+    return await import("@skein-js/channels");
+  } catch (cause) {
+    throw new SkeinConfigError(
+      `skein.channels configures ${names.join(", ")}, but @skein-js/channels is not installed. Add it as a dependency.`,
+      { cause }
+    );
+  }
+}
+export {
+  resolveChannels
+};

package/dist/{chunk-TCYGP4ZJ.js → chunk-OZ477M7A.js}

@@ -7,6 +7,7 @@ import {
 import { MemorySaver as MemorySaver2 } from "@langchain/langgraph";
 import {
   loadAuthEngine,
+  loadChannels,
   loadConfig
 } from "@skein-js/config";
 import { langGraphResolver as langGraphResolver2 } from "@skein-js/langgraph";
@@ -148,6 +149,43 @@ function resolveMemoryBusLimits(explicit = {}, env = process.env) {
   };
 }
 
+// src/webhooks-config.ts
+var WEBHOOK_SECRET_ENV = "SKEIN_WEBHOOK_SECRET";
+function resolveSecrets(raw, env) {
+  const fromEnv = (env[WEBHOOK_SECRET_ENV] ?? "").split(",").map((secret) => secret.trim()).filter((secret) => secret.length > 0);
+  if (fromEnv.length > 0) return fromEnv;
+  const configured = typeof raw.secret === "string" ? [raw.secret] : raw.secret ?? [];
+  return configured.map((secret) => secret.trim()).filter((secret) => secret.length > 0);
+}
+function resolveWebhooks(raw, options = {}) {
+  const env = options.env ?? process.env;
+  const secrets = resolveSecrets(raw ?? {}, env);
+  if (!raw && secrets.length === 0) return void 0;
+  const config = {};
+  if (secrets.length > 0) {
+    config.secrets = secrets;
+    if (!env[WEBHOOK_SECRET_ENV] && raw?.secret !== void 0) {
+      options.warn?.(
+        `skein: a webhook signing key is set in langgraph.json, which puts it in version control. Set ${WEBHOOK_SECRET_ENV} instead \u2014 it takes precedence over this value.`
+      );
+    }
+  }
+  if (!raw) return config;
+  const retries = {};
+  if (typeof raw.retries?.max_attempts === "number") retries.maxAttempts = raw.retries.max_attempts;
+  if (typeof raw.retries?.initial_delay_ms === "number") {
+    retries.initialDelayMs = raw.retries.initial_delay_ms;
+  }
+  if (Object.keys(retries).length > 0) config.retries = retries;
+  if (typeof raw.max_payload_bytes === "number") config.maxPayloadBytes = raw.max_payload_bytes;
+  if (typeof raw.retain_hours === "number") config.retainHours = raw.retain_hours;
+  if (Array.isArray(raw.allowed_hosts) && raw.allowed_hosts.length > 0) {
+    config.allowedHosts = [...raw.allowed_hosts];
+  }
+  if (typeof raw.require_https === "boolean") config.requireHttps = raw.require_https;
+  return Object.keys(config).length > 0 ? config : void 0;
+}
+
 // src/in-memory-deps.ts
 function isGraphResolver(graphs) {
   const candidate = graphs;
@@ -174,6 +212,7 @@ function graphMapToResolver(graphs) {
   };
 }
 function embedInMemoryGraphs(graphs, overrides = {}) {
+  const webhooks = resolveWebhooks(void 0);
   return {
     // `maxPageSize` resolved for the same reason as the bus limits below: an embedded host's
     // `SKEIN_MAX_PAGE_SIZE` has to reach the driver that applies it.
@@ -191,6 +230,13 @@ function embedInMemoryGraphs(graphs, overrides = {}) {
     ephemeralCheckpointer: () => new MemorySaver(),
     // Clones a checkpoint before it is re-put under another thread id — see `ProtocolDeps.cloneCheckpoint`.
     cloneCheckpoint: cloneLangGraphCheckpoint,
+    // Resolved for the same reason as `maxPageSize` and the bus limits: an embedded host's env has to
+    // reach the code that applies it. Without this, a host that sets `SKEIN_WEBHOOK_SECRET` and
+    // follows the docs gets callbacks that are silently **unsigned** — a fail-open indistinguishable
+    // from a working setup, since an unsigned callback is delivered exactly like a signed one and only
+    // the receiver ever finds out. There is no `langgraph.json` on this path, so the env var is the
+    // only input; `overrides` still spreads last and wins.
+    ...webhooks ? { webhooks } : {},
     ...overrides
   };
 }
@@ -235,6 +281,10 @@ async function loadInMemoryRuntime(configPath, importModule, staticSchemas) {
   deps.auth = await loadAuthEngine(config.auth, { configDir, importModule });
   return {
     deps,
+    channels: await loadChannels(config.skein?.channels, {
+      configDir,
+      ...importModule ? { importModule } : {}
+    }),
     cors: corsFromHttpConfig(config.http),
     routes: routesFromHttpConfig(config.http)
   };
@@ -250,6 +300,9 @@ async function loadReloadableInMemoryRuntime(configPath, importModule, staticSch
   const threadTtl = resolveThreadTtl(first.config.checkpointer?.ttl);
   const storeTtl = resolveStoreTtl(first.config.store?.ttl);
   const idempotency = resolveIdempotency(first.config.skein?.idempotency);
+  const webhooks = resolveWebhooks(first.config.skein?.webhooks, {
+    warn: (message) => console.warn(message)
+  });
   const store = new MemorySkeinStore2({
     maxPageSize: resolveMaxPageSize(),
     ...threadTtl ? { threadTtl } : {},
@@ -269,10 +322,18 @@ async function loadReloadableInMemoryRuntime(configPath, importModule, staticSch
     ...threadTtl ? { threadTtl } : {},
     // Unlike `threadTtl`, absence here means *defaults*, not *off*: the header is honoured either way.
     ...idempotency ? { idempotency } : {},
+    ...webhooks ? { webhooks } : {},
     ...extraDeps
   };
   return {
     deps,
+    // Loaded here so the modules are imported once, with the same importer the graphs used — under
+    // `skein dev` that is the vite-backed one, which is what lets a channel be a TypeScript file in
+    // the user's own repo rather than something they have to build first.
+    channels: await loadChannels(first.config.skein?.channels, {
+      configDir: first.configDir,
+      ...importModule ? { importModule } : {}
+    }),
     cors: corsFromHttpConfig(first.config.http),
     routes: routesFromHttpConfig(first.config.http),
     config: first.config,
@@ -303,6 +364,7 @@ export {
   resolveIdempotency,
   resolveMaxPageSize,
   resolveMemoryBusLimits,
+  resolveWebhooks,
   normalizeEmbeddableGraphs,
   graphMapToResolver,
   embedInMemoryGraphs,

package/dist/{in-memory-runtime-AOVHAXHJ.js → in-memory-runtime-HE3LTSLD.js}

@@ -1,7 +1,7 @@
 import {
   loadInMemoryRuntime,
   loadReloadableInMemoryRuntime
-} from "./chunk-TCYGP4ZJ.js";
+} from "./chunk-OZ477M7A.js";
 import "./chunk-JUBBCC7R.js";
 export {
   loadInMemoryRuntime,

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { ProtocolRuntime, RouteBinding, Logger, ProtocolDeps, RunWorkerOptions, CronSchedulerOptions, RunFailureReport, IdempotencyConfig, GraphResolver, RouteMatcher, DisabledRouteGroups, ProtocolResponse } from '@skein-js/agent-protocol';
+import { ProtocolRuntime, RouteBinding, Logger, ProtocolDeps, RunWorkerOptions, CronSchedulerOptions, RunFailureReport, IdempotencyConfig, WebhookDeliveryConfig, GraphResolver, RouteMatcher, DisabledRouteGroups, ProtocolResponse } from '@skein-js/agent-protocol';
 export { CompiledGraphFactory, DEFAULT_RUN_CONCURRENCY, DEFAULT_SHUTDOWN_GRACE_MS, GraphResolver, Logger, ProtocolDeps, ResolvedGraph, RunWorkerOptions } from '@skein-js/agent-protocol';
-import { ModuleImporter, LanggraphJson, GraphSchemas } from '@skein-js/config';
+import { LoadedChannel, ModuleImporter, LanggraphJson, GraphSchemas } from '@skein-js/config';
 import { CorsOptions } from 'cors';
 export { CorsOptions } from 'cors';
 import { MemoryRunEventBusOptions } from '@skein-js/storage-memory';
@@ -114,6 +114,8 @@ interface ResolvedRuntimeDeps {
     routes: readonly RouteBinding[];
     /** The resolved logger — see {@link ResolvedProtocolRuntime.logger}. */
     logger?: Logger;
+    /** Channel modules named by `skein.channels`, already imported. Absent on the injected-deps path. */
+    channels?: Record<string, LoadedChannel>;
 }
 /**
  * Resolve the `{ config } | { deps }` seam down to a `ProtocolDeps` — injected as-is, or fresh
@@ -416,6 +418,13 @@ interface InMemoryRuntimeConfig {
     cors?: CorsOptions;
     /** The route table to mount, with any `http.disable_*` groups already removed. */
     routes: readonly RouteBinding[];
+    /**
+     * Channel modules named by `skein.channels`, already imported, keyed by name.
+     *
+     * Empty when none is configured, which is what keeps the channel routes out of the table entirely
+     * rather than merely disabled.
+     */
+    channels?: Record<string, LoadedChannel>;
 }
 /** Load `langgraph.json`, wiring fresh in-memory drivers and reading its `http.cors` for the adapter. */
 declare function loadInMemoryRuntime(configPath: string, importModule?: ModuleImporter, staticSchemas?: Record<string, GraphSchemas>): Promise<InMemoryRuntimeConfig>;
@@ -497,14 +506,55 @@ interface RawIdempotency {
  */
 declare function resolveIdempotency(raw: RawIdempotency | undefined): IdempotencyConfig | undefined;
 
+/** The raw `skein.webhooks` block as `langgraph.json` spells it. */
+interface RawWebhooks {
+    retries?: {
+        max_attempts?: number;
+        initial_delay_ms?: number;
+    };
+    secret?: string | string[];
+    max_payload_bytes?: number;
+    retain_hours?: number;
+    allowed_hosts?: string[];
+    require_https?: boolean;
+}
+/**
+ * Map the raw block to {@link WebhookDeliveryConfig}, or `undefined` when nothing is set.
+ *
+ * `undefined` means **defaults, not disabled**, the same distinction `resolveIdempotency` draws: a run
+ * that carries a `webhook` owes a callback whether or not a policy was configured. There is no
+ * setting that stops skein trying — only `retries.max_attempts: 1`, which asks it to try once.
+ */
+declare function resolveWebhooks(raw: RawWebhooks | undefined, options?: {
+    env?: Record<string, string | undefined>;
+    warn?: (message: string) => void;
+}): WebhookDeliveryConfig | undefined;
+
 type AnyCompiledGraph = CompiledGraph<any>;
 /**
- * A graph you can embed in code: any compiled LangGraph.js graph, or a factory that builds one per run
- * (called with the run's `configurable`). Keys of a graph map become graph ids.
+ * The surface the engine actually drives, stated structurally.
+ *
+ * `CompiledGraph` is not the right bound here even though every graph is one. LangChain's own
+ * `createAgent` returns a `ReactAgent`, which is graph-*like* — it streams and it has state — but is
+ * not structurally a `CompiledGraph`, so requiring that type rejected the blessed way to build an
+ * agent. The engine never needed it: `langGraphResolver` casts whatever it is to an `AgentGraph`, and
+ * `AgentGraph` requires exactly these two methods.
+ *
+ * Kept narrow enough to still catch a mistake — an object with neither method is not a graph — while
+ * accepting anything the runtime can genuinely drive.
+ */
+interface EmbeddableAgentSurface {
+    stream(input: any, options?: any): any;
+    getState(config: any): any;
+}
+/**
+ * A graph you can embed in code: any compiled LangGraph.js graph, anything `createAgent` returns, or a
+ * factory that builds one per run (called with the run's `configurable`). Keys of a graph map become
+ * graph ids.
  */
-type EmbeddableGraph = AnyCompiledGraph | ((config: {
+type EmbeddableGraph = AnyCompiledGraph | EmbeddableAgentSurface | ((config: {
     configurable?: Record<string, unknown>;
-}) => AnyCompiledGraph | Promise<AnyCompiledGraph>);
+}) => AnyCompiledGraph | EmbeddableAgentSurface | Promise<AnyCompiledGraph | EmbeddableAgentSurface>);
 /**
  * Accept either a ready {@link GraphResolver} or a plain graph map and return a `GraphResolver` either
  * way — the normalization every in-code embedding helper shares (`embedInMemoryGraphs` here,
@@ -703,4 +753,4 @@ type RuntimeGlobal = typeof globalThis & {
 /** Detect Node, Bun, or Deno without importing a runtime-specific module. */
 declare function detectRuntimeCapabilities(scope?: RuntimeGlobal): RuntimeCapabilities;
 
-export { type ConsoleLogLevel, type ConsoleLoggerOptions, type CorsSetting, DEFAULT_HEAP_SAMPLE_MS, DEFAULT_HEAP_WARN_PERCENT, DevStateSnapshot, type EmbeddableGraph, type FileReader, HEAP_REARM_MARGIN_PERCENT, HEAP_REARM_PERCENT, type HeapHeadroom, type HeapPressureContext, type HeapPressureMonitor, type HeapPressureMonitorOptions, type InMemoryRuntimeConfig, type IntervalHandle, type LanggraphCorsConfig, type RawIdempotency, type RawStoreTtl, type RawThreadTtl, type ReloadableInMemoryRuntime, type ResolvedMemoryBusLimits, type ResolvedProtocolRuntime, type ResolvedRuntimeDeps, type RuntimeCapabilities, type RuntimeMemorySnapshot, type RuntimeSignalSubscription, type SkeinRuntimeCommonOptions, type SkeinRuntimeOptions, allowedOrigin, applyNodeCors, checkHeapHeadroom, consoleMountFromHttpConfig, corsFromHttpConfig, corsPreflightHeaders, corsResponseHeaders, createConsoleLogger, createInMemoryDeps, describeError, describeHeapHeadroom, describePoolPressure, detectRuntimeCapabilities, disabledRoutesFromHttpConfig, embedInMemoryGraphs, formatLogMeta, graphMapToResolver, joinList, loadInMemoryRuntime, loadReloadableInMemoryRuntime, normalizeEmbeddableGraphs, readContainerMemoryLimit, resolveCronTickMs, resolveHeapPressureOptions, resolveIdempotency, resolveMaxPageSize, resolveMemoryBusLimits, resolveProtocolRuntime, resolveRunConcurrency, resolveRunTimeoutMs, resolveRuntimeDeps, resolveShutdownGraceMs, resolveStoreTtl, resolveThreadTtl, routeMatcherFor, routesFromHttpConfig, runFailureIdentity, sendNodeError, sendNodePreflight, sendNodeResponse, startHeapPressureMonitor, stripBasePath, toCorsOptions };
+export { type ConsoleLogLevel, type ConsoleLoggerOptions, type CorsSetting, DEFAULT_HEAP_SAMPLE_MS, DEFAULT_HEAP_WARN_PERCENT, DevStateSnapshot, type EmbeddableGraph, type FileReader, HEAP_REARM_MARGIN_PERCENT, HEAP_REARM_PERCENT, type HeapHeadroom, type HeapPressureContext, type HeapPressureMonitor, type HeapPressureMonitorOptions, type InMemoryRuntimeConfig, type IntervalHandle, type LanggraphCorsConfig, type RawIdempotency, type RawStoreTtl, type RawThreadTtl, type RawWebhooks, type ReloadableInMemoryRuntime, type ResolvedMemoryBusLimits, type ResolvedProtocolRuntime, type ResolvedRuntimeDeps, type RuntimeCapabilities, type RuntimeMemorySnapshot, type RuntimeSignalSubscription, type SkeinRuntimeCommonOptions, type SkeinRuntimeOptions, allowedOrigin, applyNodeCors, checkHeapHeadroom, consoleMountFromHttpConfig, corsFromHttpConfig, corsPreflightHeaders, corsResponseHeaders, createConsoleLogger, createInMemoryDeps, describeError, describeHeapHeadroom, describePoolPressure, detectRuntimeCapabilities, disabledRoutesFromHttpConfig, embedInMemoryGraphs, formatLogMeta, graphMapToResolver, joinList, loadInMemoryRuntime, loadReloadableInMemoryRuntime, normalizeEmbeddableGraphs, readContainerMemoryLimit, resolveCronTickMs, resolveHeapPressureOptions, resolveIdempotency, resolveMaxPageSize, resolveMemoryBusLimits, resolveProtocolRuntime, resolveRunConcurrency, resolveRunTimeoutMs, resolveRuntimeDeps, resolveShutdownGraceMs, resolveStoreTtl, resolveThreadTtl, resolveWebhooks, routeMatcherFor, routesFromHttpConfig, runFailureIdentity, sendNodeError, sendNodePreflight, sendNodeResponse, startHeapPressureMonitor, stripBasePath, toCorsOptions };

package/dist/index.js

@@ -15,14 +15,16 @@ import {
   resolveMemoryBusLimits,
   resolveStoreTtl,
   resolveThreadTtl,
+  resolveWebhooks,
   routesFromHttpConfig,
   toCorsOptions
-} from "./chunk-TCYGP4ZJ.js";
+} from "./chunk-OZ477M7A.js";
 import "./chunk-JUBBCC7R.js";
 
 // src/resolve-runtime.ts
 import {
   createProtocolRuntime,
+  fetchWebhookDispatcher,
   skeinRoutes
 } from "@skein-js/agent-protocol";
 
@@ -166,22 +168,45 @@ function resolveLogger(option, injected, frameworkLogger) {
   return option ?? frameworkLogger;
 }
 async function resolveRuntimeDeps(options, frameworkLogger) {
-  const loaded = options.deps ? { deps: options.deps, cors: void 0, routes: skeinRoutes } : await (await import("./in-memory-runtime-AOVHAXHJ.js")).loadInMemoryRuntime(options.config, options.importModule);
+  const loaded = options.deps ? { deps: options.deps, cors: void 0, routes: skeinRoutes, channels: void 0 } : await (await import("./in-memory-runtime-HE3LTSLD.js")).loadInMemoryRuntime(options.config, options.importModule);
   const logger = resolveLogger(options.logger, loaded.deps.logger, frameworkLogger);
   if (logger && !loaded.deps.logger) loaded.deps.logger = logger;
-  return { deps: loaded.deps, cors: loaded.cors, routes: loaded.routes, logger };
+  return {
+    deps: loaded.deps,
+    cors: loaded.cors,
+    routes: loaded.routes,
+    ...loaded.channels ? { channels: loaded.channels } : {},
+    logger
+  };
 }
 async function resolveProtocolRuntime(options, frameworkLogger) {
   const {
     deps,
     cors: corsFromConfig,
     routes,
+    channels,
     logger
   } = await resolveRuntimeDeps(options, frameworkLogger);
   const heapPressureOptions = resolveHeapPressureOptions();
   const runTimeoutMs = resolveRunTimeoutMs(deps.runTimeoutMs);
   if (runTimeoutMs !== void 0) deps.runTimeoutMs = runTimeoutMs;
+  const runtimeRef = {};
+  const channelSurface = channels ? await (await import("./channels-runtime-OADE6ORT.js")).resolveChannels({
+    channels,
+    graphIds: deps.graphs.ids,
+    deps,
+    service: () => {
+      const current = runtimeRef.current;
+      if (!current) throw new Error("channel pipeline used before the runtime was assembled");
+      return current.service;
+    }
+  }) : void 0;
+  if (channelSurface) {
+    const inner = deps.webhookDispatcher ?? fetchWebhookDispatcher;
+    deps.webhookDispatcher = channelSurface.wrapDispatcher(inner);
+  }
   const runtime = createProtocolRuntime(deps, {
+    ...channelSurface ? { handlers: channelSurface.handlers } : {},
     worker: {
       ...options.worker,
       maxConcurrency: resolveRunConcurrency(options.worker?.maxConcurrency),
@@ -195,6 +220,7 @@ async function resolveProtocolRuntime(options, frameworkLogger) {
       enabled: options.scheduler?.enabled ?? routes.some((route) => route.group === "crons")
     }
   });
+  runtimeRef.current = runtime;
   await runtime.service.assistants.registerGraphAssistants();
   if (options.warm) {
     await Promise.all(
@@ -230,7 +256,15 @@ async function resolveProtocolRuntime(options, frameworkLogger) {
       await runtime.worker.stop();
     }
   };
-  return { runtime: { ...runtime, worker }, cors: corsFromConfig, routes, logger };
+  return {
+    runtime: { ...runtime, worker },
+    cors: corsFromConfig,
+    // Channel routes are *appended*, never declared in `skeinRoutes`: they exist only when a channel
+    // is configured, which is what makes the feature undetectable to a deployment that never wanted
+    // it — strictly stronger than an `http.disable_*` flag, and it needs no `RouteGroup` to express.
+    routes: channelSurface ? [...routes, ...channelSurface.routes] : routes,
+    logger
+  };
 }
 
 // src/log-meta.ts
@@ -529,6 +563,7 @@ function sendNodeError(error, res, logger, adapterName = "skein") {
     return;
   }
   if (isSkeinHttpError(error)) {
+    if (error.status >= 500) logger?.error(`Request failed: ${error.message}`, error);
     res.writeHead(error.status, { "content-type": "application/json" });
     res.end(
       JSON.stringify({
@@ -688,6 +723,7 @@ export {
   resolveShutdownGraceMs,
   resolveStoreTtl,
   resolveThreadTtl,
+  resolveWebhooks,
   routeMatcherFor,
   routesFromHttpConfig,
   runFailureIdentity,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skein-js/server-kit",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Shared, framework-agnostic building blocks for skein-js HTTP adapters — in-memory dev runtime, LangGraph dev-state import, and langgraph.json CORS mapping.",
   "license": "Apache-2.0",
   "author": "Maina Wycliffe <wmmaina7@gmail.com>",
@@ -49,21 +49,29 @@
     "cors": "^2.8.5",
     "superjson": "^2.2.6",
     "zod": "^3.25.76",
-    "@skein-js/agent-protocol": "0.15.0",
-    "@skein-js/config": "0.15.0",
-    "@skein-js/core": "0.15.0",
-    "@skein-js/langgraph": "0.15.0",
-    "@skein-js/storage-memory": "0.15.0"
+    "@skein-js/agent-protocol": "0.16.0",
+    "@skein-js/config": "0.16.0",
+    "@skein-js/core": "0.16.0",
+    "@skein-js/langgraph": "0.16.0",
+    "@skein-js/storage-memory": "0.16.0"
   },
   "peerDependencies": {
-    "@langchain/langgraph": "^1.4.0"
+    "@langchain/langgraph": "^1.4.0",
+    "@skein-js/channels": "0.16.0"
   },
   "devDependencies": {
-    "@langchain/core": "^1.2.0",
+    "@langchain/core": "^1.2.9",
     "@langchain/langgraph": "^1.4.0",
-    "@types/cors": "^2.8.17"
+    "@langchain/langgraph-sdk": "^1.9.0",
+    "@types/cors": "^2.8.17",
+    "@skein-js/channels": "0.16.0"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "peerDependenciesMeta": {
+    "@skein-js/channels": {
+      "optional": true
+    }
   }
 }