@skein-js/server-kit 0.15.0 → 0.17.0

package/README.md

@@ -81,7 +81,7 @@ Pass `overrides` to swap in production drivers or an auth engine while keeping t
   **`@deprecated`** alias. `graphMapToResolver` / `normalizeEmbeddableGraphs` are the lower-level
   graph→`GraphResolver` helpers.
 - **`resolveProtocolRuntime(options, frameworkLogger?): Promise<ResolvedProtocolRuntime>`** — turn a
-  `{ config } | { deps }` bag (`SkeinRuntimeOptions`) into a live runtime (assistants seeded, worker
+  `{ config } | { deps, channels? }` bag (`SkeinRuntimeOptions`) into a live runtime (assistants seeded, worker
   started) — the step every adapter runs before mounting routes. `options.worker`
   (`RunWorkerOptions`) tunes the background worker; `worker.maxConcurrency` is how many queued runs
   run at once. `frameworkLogger` is the adapter's own default, applied only when the caller supplied

package/dist/channels-runtime-JHTMXARF.js

@@ -0,0 +1,156 @@
+// src/channels-runtime.ts
+import {
+  createAuthScopedStore,
+  createContext,
+  createProtocolServiceFromContext
+} from "@skein-js/agent-protocol";
+import { SkeinConfigError } from "@skein-js/config";
+import { SkeinHttpError } from "@skein-js/core";
+async function resolveChannels(input) {
+  const names = Object.keys(input.channels);
+  if (names.length === 0) return void 0;
+  const channels = await importChannelsPackage(names);
+  const registry = channels.buildChannelRegistry({
+    channels: Object.fromEntries(
+      Object.entries(input.channels).map(([name, loaded]) => [
+        name,
+        {
+          module: loaded.module,
+          config: {
+            assistant: loaded.assistant,
+            ...loaded.allowedAssistants ? { allowedAssistants: loaded.allowedAssistants } : {},
+            ...loaded.publicUrl ? { publicUrl: loaded.publicUrl } : {}
+          }
+        }
+      ])
+    ),
+    graphIds: input.graphIds
+  });
+  const pipelineDeps = buildPipelineDeps(input.deps, input.service);
+  const channelInventory = registry.names.map((routeName) => {
+    const registered = registry.get(routeName);
+    if (!registered) throw new Error(`Channel registry lost configured route "${routeName}".`);
+    return {
+      route_name: routeName,
+      assistant: registered.config.assistant,
+      allowed_assistants: [...registered.config.allowedAssistants ?? []],
+      channel_name: registered.channel.name,
+      delivery_supported: typeof registered.channel.deliver === "function"
+    };
+  });
+  return {
+    routes: [
+      { method: "get", path: "/channels", handler: "listChannels" },
+      ...channels.channelRouteBindings(registry.names)
+    ],
+    wrapDispatcher: (inner) => channels.wrapChannelDispatcher({
+      registry,
+      inner,
+      logger: input.deps.logger ?? console
+    }),
+    handlers: {
+      listChannels: async () => ({
+        kind: "json",
+        status: 200,
+        body: { channels: channelInventory }
+      }),
+      handleInboundEvent: async (req) => {
+        const name = req.url.split("?")[0].split("/channels/")[1] ?? "";
+        const registered = registry.get(name);
+        if (!registered) throw SkeinHttpError.notFound(`No channel named "${name}".`);
+        return channels.handleInboundEvent(
+          registered,
+          {
+            method: req.method,
+            url: req.url,
+            headers: req.headers,
+            ...typeof req.body === "string" ? { text: req.body } : {}
+          },
+          pipelineDeps
+        );
+      }
+    }
+  };
+}
+function buildPipelineDeps(deps, service) {
+  let requestFilters;
+  const scopedService = (authContext) => {
+    if (!authContext && !requestFilters) return service();
+    const base = createContext(deps);
+    return createProtocolServiceFromContext({
+      ...base,
+      ...authContext?.user ? { authUser: authContext.user } : {},
+      ...authContext?.scopes ? { authScopes: authContext.scopes } : {},
+      deps: requestFilters && deps.auth ? {
+        ...base.deps,
+        store: createAuthScopedStore(base.deps.store, deps.auth, requestFilters, "threads")
+      } : base.deps
+    });
+  };
+  return {
+    ...deps.store.idempotency ? { idempotency: deps.store.idempotency } : {},
+    clock: () => deps.clock ? deps.clock() : /* @__PURE__ */ new Date(),
+    logger: deps.logger ?? console,
+    // Straight off the run event bus — the same stream `runs.joinStream` serves, without the HTTP
+    // connection per conversation that reaching it from outside would cost.
+    runFrames: { subscribe: (runId) => deps.bus.subscribe(runId) },
+    authorize: async (principal, authz) => {
+      if (!deps.auth) return void 0;
+      const context = {
+        user: {
+          identity: principal.identity,
+          display_name: principal.identity,
+          is_authenticated: true,
+          permissions: principal.permissions ?? [],
+          ...principal.metadata ?? {}
+        },
+        scopes: principal.permissions ?? []
+      };
+      const decision = await deps.auth.authorize({
+        resource: authz.resource,
+        action: authz.action,
+        value: {},
+        context
+      });
+      requestFilters = decision.filters;
+      return context;
+    },
+    ensureThread: async (threadId, metadata, authContext) => {
+      await scopedService(authContext).threads.create({
+        thread_id: threadId,
+        metadata,
+        ifExists: "do_nothing"
+      });
+    },
+    threadStatus: async (threadId) => {
+      const thread = await service().threads.get(threadId).catch(() => null);
+      return thread?.status ?? null;
+    },
+    createRun: async (input) => {
+      const run = await scopedService(input.authContext).runs.createBackground(input.threadId, {
+        assistant_id: input.assistantId,
+        ...input.input !== void 0 ? { input: input.input } : {},
+        ...input.command ? { command: input.command } : {},
+        ...input.ifThreadStatus ? { if_thread_status: [...input.ifThreadStatus] } : {},
+        ...input.multitaskStrategy ? { multitask_strategy: input.multitaskStrategy } : {},
+        ...input.metadata ? { metadata: input.metadata } : {},
+        ...input.webhook ? { webhook: input.webhook } : {},
+        stream_mode: [...input.streamMode]
+      });
+      return { runId: run.run_id };
+    }
+  };
+}
+async function importChannelsPackage(names) {
+  try {
+    return await import("@skein-js/channels");
+  } catch (cause) {
+    throw new SkeinConfigError(
+      `skein.channels configures ${names.join(", ")}, but @skein-js/channels is not installed. Add it as a dependency.`,
+      { cause }
+    );
+  }
+}
+export {
+  resolveChannels
+};

package/dist/{chunk-TCYGP4ZJ.js → chunk-5Q3G665D.js}

@@ -7,10 +7,10 @@ import {
 import { MemorySaver as MemorySaver2 } from "@langchain/langgraph";
 import {
   loadAuthEngine,
+  loadChannels,
   loadConfig
 } from "@skein-js/config";
-import { langGraphResolver as langGraphResolver2 } from "@skein-js/langgraph";
-import { MemoryRunEventBus as MemoryRunEventBus2, MemoryRunQueue as MemoryRunQueue2, MemorySkeinStore as MemorySkeinStore2 } from "@skein-js/storage-memory";
+import { MemorySkeinStore as MemorySkeinStore2 } from "@skein-js/storage-memory";
 
 // src/cors-config.ts
 import {
@@ -18,7 +18,7 @@ import {
   skeinRoutes
 } from "@skein-js/agent-protocol";
 var ALWAYS_EXPOSED_HEADERS = ["content-location", "x-pagination-total", "idempotent-replay"];
-var ALWAYS_ALLOWED_HEADERS = ["idempotency-key"];
+var ALWAYS_ALLOWED_HEADERS = ["idempotency-key", "x-api-key"];
 function toCorsOptions(config) {
   const options = {};
   const allowAll = config.allow_origins?.includes("*") ?? false;
@@ -148,6 +148,43 @@ function resolveMemoryBusLimits(explicit = {}, env = process.env) {
   };
 }
 
+// src/webhooks-config.ts
+var WEBHOOK_SECRET_ENV = "SKEIN_WEBHOOK_SECRET";
+function resolveSecrets(raw, env) {
+  const fromEnv = (env[WEBHOOK_SECRET_ENV] ?? "").split(",").map((secret) => secret.trim()).filter((secret) => secret.length > 0);
+  if (fromEnv.length > 0) return fromEnv;
+  const configured = typeof raw.secret === "string" ? [raw.secret] : raw.secret ?? [];
+  return configured.map((secret) => secret.trim()).filter((secret) => secret.length > 0);
+}
+function resolveWebhooks(raw, options = {}) {
+  const env = options.env ?? process.env;
+  const secrets = resolveSecrets(raw ?? {}, env);
+  if (!raw && secrets.length === 0) return void 0;
+  const config = {};
+  if (secrets.length > 0) {
+    config.secrets = secrets;
+    if (!env[WEBHOOK_SECRET_ENV] && raw?.secret !== void 0) {
+      options.warn?.(
+        `skein: a webhook signing key is set in langgraph.json, which puts it in version control. Set ${WEBHOOK_SECRET_ENV} instead \u2014 it takes precedence over this value.`
+      );
+    }
+  }
+  if (!raw) return config;
+  const retries = {};
+  if (typeof raw.retries?.max_attempts === "number") retries.maxAttempts = raw.retries.max_attempts;
+  if (typeof raw.retries?.initial_delay_ms === "number") {
+    retries.initialDelayMs = raw.retries.initial_delay_ms;
+  }
+  if (Object.keys(retries).length > 0) config.retries = retries;
+  if (typeof raw.max_payload_bytes === "number") config.maxPayloadBytes = raw.max_payload_bytes;
+  if (typeof raw.retain_hours === "number") config.retainHours = raw.retain_hours;
+  if (Array.isArray(raw.allowed_hosts) && raw.allowed_hosts.length > 0) {
+    config.allowedHosts = [...raw.allowed_hosts];
+  }
+  if (typeof raw.require_https === "boolean") config.requireHttps = raw.require_https;
+  return Object.keys(config).length > 0 ? config : void 0;
+}
+
 // src/in-memory-deps.ts
 function isGraphResolver(graphs) {
   const candidate = graphs;
@@ -174,6 +211,7 @@ function graphMapToResolver(graphs) {
   };
 }
 function embedInMemoryGraphs(graphs, overrides = {}) {
+  const webhooks = resolveWebhooks(void 0);
   return {
     // `maxPageSize` resolved for the same reason as the bus limits below: an embedded host's
     // `SKEIN_MAX_PAGE_SIZE` has to reach the driver that applies it.
@@ -191,6 +229,13 @@ function embedInMemoryGraphs(graphs, overrides = {}) {
     ephemeralCheckpointer: () => new MemorySaver(),
     // Clones a checkpoint before it is re-put under another thread id — see `ProtocolDeps.cloneCheckpoint`.
     cloneCheckpoint: cloneLangGraphCheckpoint,
+    // Resolved for the same reason as `maxPageSize` and the bus limits: an embedded host's env has to
+    // reach the code that applies it. Without this, a host that sets `SKEIN_WEBHOOK_SECRET` and
+    // follows the docs gets callbacks that are silently **unsigned** — a fail-open indistinguishable
+    // from a working setup, since an unsigned callback is delivered exactly like a signed one and only
+    // the receiver ever finds out. There is no `langgraph.json` on this path, so the env var is the
+    // only input; `overrides` still spreads last and wins.
+    ...webhooks ? { webhooks } : {},
     ...overrides
   };
 }
@@ -231,10 +276,14 @@ async function loadInMemoryRuntime(configPath, importModule, staticSchemas) {
     importModule,
     staticSchemas
   });
-  const deps = embedInMemoryGraphs(langGraphResolver2(toGraphResolver(graphs)));
+  const deps = embedInMemoryGraphs(toGraphResolver(graphs));
   deps.auth = await loadAuthEngine(config.auth, { configDir, importModule });
   return {
     deps,
+    channels: await loadChannels(config.skein?.channels, {
+      configDir,
+      ...importModule ? { importModule } : {}
+    }),
     cors: corsFromHttpConfig(config.http),
     routes: routesFromHttpConfig(config.http)
   };
@@ -242,37 +291,45 @@ async function loadInMemoryRuntime(configPath, importModule, staticSchemas) {
 async function loadReloadableInMemoryRuntime(configPath, importModule, staticSchemas, extraDeps) {
   const first = await loadConfig({ configPath, importModule, staticSchemas });
   let current = first.graphs;
-  const graphs = langGraphResolver2({
+  const graphs = {
     ids: first.graphs.ids,
     load: (graphId) => current.load(graphId),
     schemas: async (graphId) => await current.schemas(graphId)
-  });
+  };
   const threadTtl = resolveThreadTtl(first.config.checkpointer?.ttl);
   const storeTtl = resolveStoreTtl(first.config.store?.ttl);
   const idempotency = resolveIdempotency(first.config.skein?.idempotency);
+  const webhooks = resolveWebhooks(first.config.skein?.webhooks, {
+    warn: (message) => console.warn(message)
+  });
   const store = new MemorySkeinStore2({
     maxPageSize: resolveMaxPageSize(),
     ...threadTtl ? { threadTtl } : {},
     ...storeTtl ? { ttl: storeTtl } : {}
   });
   const checkpointer = new MemorySaver2();
-  const deps = {
+  const deps = embedInMemoryGraphs(graphs, {
     store,
-    graphs,
-    queue: new MemoryRunQueue2(),
-    // This is the path `skein start` and `skein up` take by default, so it is the longest-lived
-    // memory bus skein runs — the bounds have to be resolved here too, not just on the embed paths.
-    bus: new MemoryRunEventBus2(resolveMemoryBusLimits()),
     checkpointer,
     auth: await loadAuthEngine(first.config.auth, { configDir: first.configDir, importModule }),
     // Present only when configured — its presence is what starts the thread TTL sweeper.
     ...threadTtl ? { threadTtl } : {},
     // Unlike `threadTtl`, absence here means *defaults*, not *off*: the header is honoured either way.
     ...idempotency ? { idempotency } : {},
+    // Resolved from this runtime's config, which `resolveWebhooks` already merges with the environment
+    // — so this subsumes the env-only value `embedInMemoryGraphs` computes, and overrides spread last.
+    ...webhooks ? { webhooks } : {},
     ...extraDeps
-  };
+  });
   return {
     deps,
+    // Loaded here so the modules are imported once, with the same importer the graphs used — under
+    // `skein dev` that is the vite-backed one, which is what lets a channel be a TypeScript file in
+    // the user's own repo rather than something they have to build first.
+    channels: await loadChannels(first.config.skein?.channels, {
+      configDir: first.configDir,
+      ...importModule ? { importModule } : {}
+    }),
     cors: corsFromHttpConfig(first.config.http),
     routes: routesFromHttpConfig(first.config.http),
     config: first.config,
@@ -303,6 +360,7 @@ export {
   resolveIdempotency,
   resolveMaxPageSize,
   resolveMemoryBusLimits,
+  resolveWebhooks,
   normalizeEmbeddableGraphs,
   graphMapToResolver,
   embedInMemoryGraphs,

package/dist/{in-memory-runtime-AOVHAXHJ.js → in-memory-runtime-N3GPWIA5.js}

@@ -1,7 +1,7 @@
 import {
   loadInMemoryRuntime,
   loadReloadableInMemoryRuntime
-} from "./chunk-TCYGP4ZJ.js";
+} from "./chunk-5Q3G665D.js";
 import "./chunk-JUBBCC7R.js";
 export {
   loadInMemoryRuntime,

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { ProtocolRuntime, RouteBinding, Logger, ProtocolDeps, RunWorkerOptions, CronSchedulerOptions, RunFailureReport, IdempotencyConfig, GraphResolver, RouteMatcher, DisabledRouteGroups, ProtocolResponse } from '@skein-js/agent-protocol';
+import { ProtocolRuntime, RouteBinding, Logger, ProtocolDeps, RunWorkerOptions, CronSchedulerOptions, RunFailureReport, IdempotencyConfig, WebhookDeliveryConfig, GraphResolver, RouteMatcher, DisabledRouteGroups, ProtocolResponse } from '@skein-js/agent-protocol';
 export { CompiledGraphFactory, DEFAULT_RUN_CONCURRENCY, DEFAULT_SHUTDOWN_GRACE_MS, GraphResolver, Logger, ProtocolDeps, ResolvedGraph, RunWorkerOptions } from '@skein-js/agent-protocol';
-import { ModuleImporter, LanggraphJson, GraphSchemas } from '@skein-js/config';
+import { LoadedChannel, ModuleImporter, LanggraphJson, GraphSchemas } from '@skein-js/config';
 import { CorsOptions } from 'cors';
 export { CorsOptions } from 'cors';
 import { MemoryRunEventBusOptions } from '@skein-js/storage-memory';
@@ -85,6 +85,8 @@ type SkeinRuntimeOptions = SkeinRuntimeCommonOptions & ({
     deps: ProtocolDeps;
     config?: never;
     importModule?: never;
+    /** Preloaded channel modules when another assembler consumed langgraph.json before us. */
+    channels?: Record<string, LoadedChannel>;
 });
 interface ResolvedProtocolRuntime {
     /** The wired runtime — assistants seeded and the background worker already started. */
@@ -114,6 +116,8 @@ interface ResolvedRuntimeDeps {
     routes: readonly RouteBinding[];
     /** The resolved logger — see {@link ResolvedProtocolRuntime.logger}. */
     logger?: Logger;
+    /** Channel modules named by `skein.channels`, already imported. Absent on the injected-deps path. */
+    channels?: Record<string, LoadedChannel>;
 }
 /**
  * Resolve the `{ config } | { deps }` seam down to a `ProtocolDeps` — injected as-is, or fresh
@@ -416,6 +420,13 @@ interface InMemoryRuntimeConfig {
     cors?: CorsOptions;
     /** The route table to mount, with any `http.disable_*` groups already removed. */
     routes: readonly RouteBinding[];
+    /**
+     * Channel modules named by `skein.channels`, already imported, keyed by name.
+     *
+     * Empty when none is configured, which is what keeps the channel routes out of the table entirely
+     * rather than merely disabled.
+     */
+    channels?: Record<string, LoadedChannel>;
 }
 /** Load `langgraph.json`, wiring fresh in-memory drivers and reading its `http.cors` for the adapter. */
 declare function loadInMemoryRuntime(configPath: string, importModule?: ModuleImporter, staticSchemas?: Record<string, GraphSchemas>): Promise<InMemoryRuntimeConfig>;
@@ -497,14 +508,55 @@ interface RawIdempotency {
  */
 declare function resolveIdempotency(raw: RawIdempotency | undefined): IdempotencyConfig | undefined;
 
+/** The raw `skein.webhooks` block as `langgraph.json` spells it. */
+interface RawWebhooks {
+    retries?: {
+        max_attempts?: number;
+        initial_delay_ms?: number;
+    };
+    secret?: string | string[];
+    max_payload_bytes?: number;
+    retain_hours?: number;
+    allowed_hosts?: string[];
+    require_https?: boolean;
+}
+/**
+ * Map the raw block to {@link WebhookDeliveryConfig}, or `undefined` when nothing is set.
+ *
+ * `undefined` means **defaults, not disabled**, the same distinction `resolveIdempotency` draws: a run
+ * that carries a `webhook` owes a callback whether or not a policy was configured. There is no
+ * setting that stops skein trying — only `retries.max_attempts: 1`, which asks it to try once.
+ */
+declare function resolveWebhooks(raw: RawWebhooks | undefined, options?: {
+    env?: Record<string, string | undefined>;
+    warn?: (message: string) => void;
+}): WebhookDeliveryConfig | undefined;
+
 type AnyCompiledGraph = CompiledGraph<any>;
 /**
- * A graph you can embed in code: any compiled LangGraph.js graph, or a factory that builds one per run
- * (called with the run's `configurable`). Keys of a graph map become graph ids.
+ * The surface the engine actually drives, stated structurally.
+ *
+ * `CompiledGraph` is not the right bound here even though every graph is one. LangChain's own
+ * `createAgent` returns a `ReactAgent`, which is graph-*like* — it streams and it has state — but is
+ * not structurally a `CompiledGraph`, so requiring that type rejected the blessed way to build an
+ * agent. The engine never needed it: `langGraphResolver` casts whatever it is to an `AgentGraph`, and
+ * `AgentGraph` requires exactly these two methods.
+ *
+ * Kept narrow enough to still catch a mistake — an object with neither method is not a graph — while
+ * accepting anything the runtime can genuinely drive.
+ */
+interface EmbeddableAgentSurface {
+    stream(input: any, options?: any): any;
+    getState(config: any): any;
+}
+/**
+ * A graph you can embed in code: any compiled LangGraph.js graph, anything `createAgent` returns, or a
+ * factory that builds one per run (called with the run's `configurable`). Keys of a graph map become
+ * graph ids.
  */
-type EmbeddableGraph = AnyCompiledGraph | ((config: {
+type EmbeddableGraph = AnyCompiledGraph | EmbeddableAgentSurface | ((config: {
     configurable?: Record<string, unknown>;
-}) => AnyCompiledGraph | Promise<AnyCompiledGraph>);
+}) => AnyCompiledGraph | EmbeddableAgentSurface | Promise<AnyCompiledGraph | EmbeddableAgentSurface>);
 /**
  * Accept either a ready {@link GraphResolver} or a plain graph map and return a `GraphResolver` either
  * way — the normalization every in-code embedding helper shares (`embedInMemoryGraphs` here,
@@ -703,4 +755,4 @@ type RuntimeGlobal = typeof globalThis & {
 /** Detect Node, Bun, or Deno without importing a runtime-specific module. */
 declare function detectRuntimeCapabilities(scope?: RuntimeGlobal): RuntimeCapabilities;
 
-export { type ConsoleLogLevel, type ConsoleLoggerOptions, type CorsSetting, DEFAULT_HEAP_SAMPLE_MS, DEFAULT_HEAP_WARN_PERCENT, DevStateSnapshot, type EmbeddableGraph, type FileReader, HEAP_REARM_MARGIN_PERCENT, HEAP_REARM_PERCENT, type HeapHeadroom, type HeapPressureContext, type HeapPressureMonitor, type HeapPressureMonitorOptions, type InMemoryRuntimeConfig, type IntervalHandle, type LanggraphCorsConfig, type RawIdempotency, type RawStoreTtl, type RawThreadTtl, type ReloadableInMemoryRuntime, type ResolvedMemoryBusLimits, type ResolvedProtocolRuntime, type ResolvedRuntimeDeps, type RuntimeCapabilities, type RuntimeMemorySnapshot, type RuntimeSignalSubscription, type SkeinRuntimeCommonOptions, type SkeinRuntimeOptions, allowedOrigin, applyNodeCors, checkHeapHeadroom, consoleMountFromHttpConfig, corsFromHttpConfig, corsPreflightHeaders, corsResponseHeaders, createConsoleLogger, createInMemoryDeps, describeError, describeHeapHeadroom, describePoolPressure, detectRuntimeCapabilities, disabledRoutesFromHttpConfig, embedInMemoryGraphs, formatLogMeta, graphMapToResolver, joinList, loadInMemoryRuntime, loadReloadableInMemoryRuntime, normalizeEmbeddableGraphs, readContainerMemoryLimit, resolveCronTickMs, resolveHeapPressureOptions, resolveIdempotency, resolveMaxPageSize, resolveMemoryBusLimits, resolveProtocolRuntime, resolveRunConcurrency, resolveRunTimeoutMs, resolveRuntimeDeps, resolveShutdownGraceMs, resolveStoreTtl, resolveThreadTtl, routeMatcherFor, routesFromHttpConfig, runFailureIdentity, sendNodeError, sendNodePreflight, sendNodeResponse, startHeapPressureMonitor, stripBasePath, toCorsOptions };
+export { type ConsoleLogLevel, type ConsoleLoggerOptions, type CorsSetting, DEFAULT_HEAP_SAMPLE_MS, DEFAULT_HEAP_WARN_PERCENT, DevStateSnapshot, type EmbeddableGraph, type FileReader, HEAP_REARM_MARGIN_PERCENT, HEAP_REARM_PERCENT, type HeapHeadroom, type HeapPressureContext, type HeapPressureMonitor, type HeapPressureMonitorOptions, type InMemoryRuntimeConfig, type IntervalHandle, type LanggraphCorsConfig, type RawIdempotency, type RawStoreTtl, type RawThreadTtl, type RawWebhooks, type ReloadableInMemoryRuntime, type ResolvedMemoryBusLimits, type ResolvedProtocolRuntime, type ResolvedRuntimeDeps, type RuntimeCapabilities, type RuntimeMemorySnapshot, type RuntimeSignalSubscription, type SkeinRuntimeCommonOptions, type SkeinRuntimeOptions, allowedOrigin, applyNodeCors, checkHeapHeadroom, consoleMountFromHttpConfig, corsFromHttpConfig, corsPreflightHeaders, corsResponseHeaders, createConsoleLogger, createInMemoryDeps, describeError, describeHeapHeadroom, describePoolPressure, detectRuntimeCapabilities, disabledRoutesFromHttpConfig, embedInMemoryGraphs, formatLogMeta, graphMapToResolver, joinList, loadInMemoryRuntime, loadReloadableInMemoryRuntime, normalizeEmbeddableGraphs, readContainerMemoryLimit, resolveCronTickMs, resolveHeapPressureOptions, resolveIdempotency, resolveMaxPageSize, resolveMemoryBusLimits, resolveProtocolRuntime, resolveRunConcurrency, resolveRunTimeoutMs, resolveRuntimeDeps, resolveShutdownGraceMs, resolveStoreTtl, resolveThreadTtl, resolveWebhooks, routeMatcherFor, routesFromHttpConfig, runFailureIdentity, sendNodeError, sendNodePreflight, sendNodeResponse, startHeapPressureMonitor, stripBasePath, toCorsOptions };

package/dist/index.js

@@ -15,14 +15,16 @@ import {
   resolveMemoryBusLimits,
   resolveStoreTtl,
   resolveThreadTtl,
+  resolveWebhooks,
   routesFromHttpConfig,
   toCorsOptions
-} from "./chunk-TCYGP4ZJ.js";
+} from "./chunk-5Q3G665D.js";
 import "./chunk-JUBBCC7R.js";
 
 // src/resolve-runtime.ts
 import {
   createProtocolRuntime,
+  fetchWebhookDispatcher,
   skeinRoutes
 } from "@skein-js/agent-protocol";
 
@@ -166,22 +168,45 @@ function resolveLogger(option, injected, frameworkLogger) {
   return option ?? frameworkLogger;
 }
 async function resolveRuntimeDeps(options, frameworkLogger) {
-  const loaded = options.deps ? { deps: options.deps, cors: void 0, routes: skeinRoutes } : await (await import("./in-memory-runtime-AOVHAXHJ.js")).loadInMemoryRuntime(options.config, options.importModule);
+  const loaded = options.deps ? { deps: options.deps, cors: void 0, routes: skeinRoutes, channels: options.channels } : await (await import("./in-memory-runtime-N3GPWIA5.js")).loadInMemoryRuntime(options.config, options.importModule);
   const logger = resolveLogger(options.logger, loaded.deps.logger, frameworkLogger);
   if (logger && !loaded.deps.logger) loaded.deps.logger = logger;
-  return { deps: loaded.deps, cors: loaded.cors, routes: loaded.routes, logger };
+  return {
+    deps: loaded.deps,
+    cors: loaded.cors,
+    routes: loaded.routes,
+    ...loaded.channels ? { channels: loaded.channels } : {},
+    logger
+  };
 }
 async function resolveProtocolRuntime(options, frameworkLogger) {
   const {
     deps,
     cors: corsFromConfig,
     routes,
+    channels,
     logger
   } = await resolveRuntimeDeps(options, frameworkLogger);
   const heapPressureOptions = resolveHeapPressureOptions();
   const runTimeoutMs = resolveRunTimeoutMs(deps.runTimeoutMs);
   if (runTimeoutMs !== void 0) deps.runTimeoutMs = runTimeoutMs;
+  const runtimeRef = {};
+  const channelSurface = channels ? await (await import("./channels-runtime-JHTMXARF.js")).resolveChannels({
+    channels,
+    graphIds: deps.graphs.ids,
+    deps,
+    service: () => {
+      const current = runtimeRef.current;
+      if (!current) throw new Error("channel pipeline used before the runtime was assembled");
+      return current.service;
+    }
+  }) : void 0;
+  if (channelSurface) {
+    const inner = deps.webhookDispatcher ?? fetchWebhookDispatcher;
+    deps.webhookDispatcher = channelSurface.wrapDispatcher(inner);
+  }
   const runtime = createProtocolRuntime(deps, {
+    ...channelSurface ? { handlers: channelSurface.handlers } : {},
     worker: {
       ...options.worker,
       maxConcurrency: resolveRunConcurrency(options.worker?.maxConcurrency),
@@ -195,6 +220,7 @@ async function resolveProtocolRuntime(options, frameworkLogger) {
       enabled: options.scheduler?.enabled ?? routes.some((route) => route.group === "crons")
     }
   });
+  runtimeRef.current = runtime;
   await runtime.service.assistants.registerGraphAssistants();
   if (options.warm) {
     await Promise.all(
@@ -230,7 +256,15 @@ async function resolveProtocolRuntime(options, frameworkLogger) {
       await runtime.worker.stop();
     }
   };
-  return { runtime: { ...runtime, worker }, cors: corsFromConfig, routes, logger };
+  return {
+    runtime: { ...runtime, worker },
+    cors: corsFromConfig,
+    // Channel routes are *appended*, never declared in `skeinRoutes`: they exist only when a channel
+    // is configured, which is what makes the feature undetectable to a deployment that never wanted
+    // it — strictly stronger than an `http.disable_*` flag, and it needs no `RouteGroup` to express.
+    routes: channelSurface ? [...routes, ...channelSurface.routes] : routes,
+    logger
+  };
 }
 
 // src/log-meta.ts
@@ -529,6 +563,7 @@ function sendNodeError(error, res, logger, adapterName = "skein") {
     return;
   }
   if (isSkeinHttpError(error)) {
+    if (error.status >= 500) logger?.error(`Request failed: ${error.message}`, error);
     res.writeHead(error.status, { "content-type": "application/json" });
     res.end(
       JSON.stringify({
@@ -688,6 +723,7 @@ export {
   resolveShutdownGraceMs,
   resolveStoreTtl,
   resolveThreadTtl,
+  resolveWebhooks,
   routeMatcherFor,
   routesFromHttpConfig,
   runFailureIdentity,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skein-js/server-kit",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Shared, framework-agnostic building blocks for skein-js HTTP adapters — in-memory dev runtime, LangGraph dev-state import, and langgraph.json CORS mapping.",
   "license": "Apache-2.0",
   "author": "Maina Wycliffe <wmmaina7@gmail.com>",
@@ -49,21 +49,29 @@
     "cors": "^2.8.5",
     "superjson": "^2.2.6",
     "zod": "^3.25.76",
-    "@skein-js/agent-protocol": "0.15.0",
-    "@skein-js/config": "0.15.0",
-    "@skein-js/core": "0.15.0",
-    "@skein-js/langgraph": "0.15.0",
-    "@skein-js/storage-memory": "0.15.0"
+    "@skein-js/agent-protocol": "0.17.0",
+    "@skein-js/config": "0.17.0",
+    "@skein-js/core": "0.17.0",
+    "@skein-js/langgraph": "0.17.0",
+    "@skein-js/storage-memory": "0.17.0"
   },
   "peerDependencies": {
-    "@langchain/langgraph": "^1.4.0"
+    "@langchain/langgraph": "^1.4.0",
+    "@skein-js/channels": "0.17.0"
   },
   "devDependencies": {
-    "@langchain/core": "^1.2.0",
+    "@langchain/core": "^1.2.9",
     "@langchain/langgraph": "^1.4.0",
-    "@types/cors": "^2.8.17"
+    "@langchain/langgraph-sdk": "^1.9.0",
+    "@types/cors": "^2.8.17",
+    "@skein-js/channels": "0.17.0"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "peerDependenciesMeta": {
+    "@skein-js/channels": {
+      "optional": true
+    }
   }
 }