@smithers-orchestrator/server 0.16.8 → 0.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithers-orchestrator/server",
-  "version": "0.16.8",
+  "version": "0.17.0",
   "description": "HTTP, WebSocket, gateway, cron, webhook, and metrics servers for Smithers",
   "type": "module",
   "sideEffects": false,
@@ -22,21 +22,28 @@
   "dependencies": {
     "@effect/workflow": "^0.18.0",
     "cron-parser": "^5.5.0",
+    "drizzle-orm": "^0.45.2",
     "effect": "^3.21.1",
     "hono": "^4.12.14",
     "ws": "^8.20.0",
-    "@smithers-orchestrator/components": "0.16.8",
-    "@smithers-orchestrator/driver": "0.16.8",
-    "@smithers-orchestrator/db": "0.16.8",
-    "@smithers-orchestrator/engine": "0.16.8",
-    "@smithers-orchestrator/errors": "0.16.8",
-    "@smithers-orchestrator/time-travel": "0.16.8",
-    "@smithers-orchestrator/scheduler": "0.16.8",
-    "@smithers-orchestrator/observability": "0.16.8"
+    "@smithers-orchestrator/db": "0.17.0",
+    "@smithers-orchestrator/driver": "0.17.0",
+    "@smithers-orchestrator/devtools": "0.17.0",
+    "@smithers-orchestrator/errors": "0.17.0",
+    "@smithers-orchestrator/components": "0.17.0",
+    "@smithers-orchestrator/engine": "0.17.0",
+    "@smithers-orchestrator/gateway": "0.17.0",
+    "@smithers-orchestrator/observability": "0.17.0",
+    "@smithers-orchestrator/protocol": "0.17.0",
+    "@smithers-orchestrator/scheduler": "0.17.0",
+    "@smithers-orchestrator/time-travel": "0.17.0"
   },
   "devDependencies": {
     "@types/bun": "latest",
-    "typescript": "~5.9.3"
+    "react": "^19.2.5",
+    "typescript": "~5.9.3",
+    "zod": "^4.3.6",
+    "@smithers-orchestrator/graph": "0.17.0"
   },
   "scripts": {
     "test": "bun test tests",

package/src/EventFrame.ts

@@ -4,4 +4,5 @@ export type EventFrame = {
   payload?: unknown;
   seq: number;
   stateVersion: number;
+  apiVersion?: "v1";
 };

package/src/GatewayOptions.ts

@@ -10,4 +10,21 @@ export type GatewayOptions = {
   maxBodyBytes?: number;
   maxPayload?: number;
   maxConnections?: number;
+  /**
+   * Per-run replay window for Gateway run event streams.
+   * @default 10000
+   */
+  eventWindowSize?: number;
+  /**
+   * Maximum time (in milliseconds) allowed for the HTTP parser to receive the
+   * complete headers of a single request. Helps mitigate slowloris attacks.
+   * @default 30000
+   */
+  headersTimeout?: number;
+  /**
+   * Maximum time (in milliseconds) allowed for a single request to be received
+   * and parsed, including the body. Helps mitigate slowloris attacks.
+   * @default 60000
+   */
+  requestTimeout?: number;
 };

package/src/GatewayTokenGrant.ts

@@ -2,4 +2,8 @@ export type GatewayTokenGrant = {
   role: string;
   scopes: string[];
   userId?: string;
+  tokenId?: string;
+  issuedAtMs?: number;
+  expiresAtMs?: number;
+  revokedAtMs?: number;
 };

package/src/ResponseFrame.ts

@@ -2,9 +2,14 @@ export type ResponseFrame = {
   type: "res";
   id: string;
   ok: boolean;
+  apiVersion?: "v1";
   payload?: unknown;
   error?: {
+    version?: "v1";
     code: string;
     message: string;
+    requiredScope?: string;
+    refresh?: string;
+    details?: unknown;
   };
 };

package/src/ServerOptions.ts

@@ -5,4 +5,16 @@ export type ServerOptions = {
   maxBodyBytes?: number;
   rootDir?: string;
   allowNetwork?: boolean;
+  /**
+   * Maximum time (in milliseconds) allowed for the HTTP parser to receive the
+   * complete headers of a single request. Helps mitigate slowloris attacks.
+   * @default 30000
+   */
+  headersTimeout?: number;
+  /**
+   * Maximum time (in milliseconds) allowed for a single request to be received
+   * and parsed, including the body. Helps mitigate slowloris attacks.
+   * @default 60000
+   */
+  requestTimeout?: number;
 };

package/src/gateway.js

@@ -24,7 +24,7 @@ import { errorToJson } from "@smithers-orchestrator/errors/errorToJson";
 import { isSmithersError } from "@smithers-orchestrator/errors/isSmithersError";
 import { SmithersError } from "@smithers-orchestrator/errors/SmithersError";
 import { assertJsonPayloadWithinBounds, assertOptionalStringMaxLength, assertPositiveFiniteInteger, } from "@smithers-orchestrator/db/input-bounds";
-import { loadLatestSnapshot, loadSnapshot } from "@smithers-orchestrator/time-travel/snapshot";
+import { loadLatestSnapshot } from "@smithers-orchestrator/time-travel/snapshot";
 import { diffRawSnapshots } from "@smithers-orchestrator/time-travel/diff";
 import { getNodeOutputRoute } from "./gatewayRoutes/getNodeOutput.js";
 import { NodeOutputRouteError } from "./gatewayRoutes/NodeOutputRouteError.js";
@@ -34,6 +34,8 @@ import { streamDevToolsRoute } from "./gatewayRoutes/streamDevTools.js";
 import { jumpToFrameRoute, JumpToFrameError } from "./gatewayRoutes/jumpToFrame.js";
 import { writeRewindAuditRow } from "@smithers-orchestrator/time-travel/writeRewindAuditRow";
 import { recoverInProgressRewindAudits } from "@smithers-orchestrator/time-travel/recoverInProgressRewindAudits";
+import { GATEWAY_EVENT_WINDOW_DEFAULT, SMITHERS_API_VERSION, getRequiredScopeForGatewayMethod, } from "@smithers-orchestrator/gateway/rpc";
+import { hasGatewayScope } from "@smithers-orchestrator/gateway/auth/scopes";
 /** @typedef {import("./GatewayWebhookRunConfig.js").GatewayWebhookRunConfig} GatewayWebhookRunConfig */
 /** @typedef {import("./GatewayWebhookSignalConfig.js").GatewayWebhookSignalConfig} GatewayWebhookSignalConfig */
 /** @typedef {import("./ConnectRequest.js").ConnectRequest} ConnectRequest */
@@ -54,6 +56,7 @@ import { recoverInProgressRewindAudits } from "@smithers-orchestrator/time-trave
  *   role?: string;
  *   scopes?: string[];
  *   userId?: string | null;
+ *   tokenId?: string | null;
  *   origin?: string;
  *   transport?: GatewayTransport;
  * }} GatewayRequestContext
@@ -76,6 +79,7 @@ import { recoverInProgressRewindAudits } from "@smithers-orchestrator/time-trave
  *   role: string;
  *   scopes: string[];
  *   userId?: string | null;
+ *   tokenId?: string | null;
  *   connectionId?: string;
  * }} RunStartAuthContext
  */
@@ -101,6 +105,9 @@ const DEFAULT_PROTOCOL = 1;
 const DEFAULT_HEARTBEAT_MS = 15_000;
 const DEFAULT_MAX_BODY_BYTES = 1_048_576;
 const DEFAULT_MAX_CONNECTIONS = 1_000;
+const DEFAULT_HEADERS_TIMEOUT = 30_000;
+const DEFAULT_REQUEST_TIMEOUT = 60_000;
+const RUN_EVENT_HEARTBEAT_MS = 1_000;
 export const GATEWAY_RPC_MAX_PAYLOAD_BYTES = DEFAULT_MAX_BODY_BYTES;
 export const GATEWAY_RPC_MAX_DEPTH = 32;
 export const GATEWAY_RPC_MAX_ARRAY_LENGTH = 256;
@@ -110,43 +117,6 @@ export const GATEWAY_FRAME_ID_MAX_LENGTH = 128;
 export const GATEWAY_RPC_INPUT_MAX_BYTES = GATEWAY_RPC_MAX_PAYLOAD_BYTES;
 export const GATEWAY_RPC_INPUT_MAX_DEPTH = GATEWAY_RPC_MAX_DEPTH;
 const GATEWAY_METHOD_NAME_PATTERN = /^[a-z][a-zA-Z0-9]*(?:\.[a-z][a-zA-Z0-9]*)*$/;
-const ACCESS_RANK = {
-    read: 1,
-    execute: 2,
-    approve: 3,
-    admin: 4,
-};
-const METHOD_ACCESS = {
-    health: "read",
-    "runs.list": "read",
-    "runs.get": "read",
-    "runs.diff": "read",
-    getNodeDiff: "read",
-    "devtools.getNodeDiff": "read",
-    getNodeOutput: "read",
-    "devtools.getNodeOutput": "read",
-    getDevToolsSnapshot: "read",
-    streamDevTools: "read",
-    // jumpToFrame authorizes per-request: owner OR admin role may rewind.
-    // Require only `execute` scope so non-admin owners are not pre-blocked
-    // at the scope gate; the run handler performs the final auth check.
-    jumpToFrame: "execute",
-    "devtools.jumpToFrame": "execute",
-    "frames.list": "read",
-    "frames.get": "read",
-    "attempts.list": "read",
-    "attempts.get": "read",
-    "approvals.list": "read",
-    "runs.create": "execute",
-    "runs.cancel": "execute",
-    "runs.rerun": "execute",
-    "signals.send": "execute",
-    "approvals.decide": "approve",
-    "cron.list": "read",
-    "cron.add": "admin",
-    "cron.remove": "admin",
-    "cron.trigger": "execute",
-};
 /**
  * @template T
  * @param {string | null | undefined} value
@@ -182,6 +152,7 @@ function sendJson(res, status, payload) {
     res.setHeader("Content-Type", "application/json");
     res.setHeader("Cache-Control", "no-store");
     res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("X-Smithers-API-Version", SMITHERS_API_VERSION);
     res.end(JSON.stringify(payload));
 }
 /**
@@ -194,6 +165,7 @@ function sendText(res, status, payload, contentType = "text/plain; charset=utf-8
     res.setHeader("Content-Type", contentType);
     res.setHeader("Cache-Control", "no-store");
     res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("X-Smithers-API-Version", SMITHERS_API_VERSION);
     res.end(payload);
 }
 /**
@@ -315,6 +287,7 @@ function gatewayContextAnnotations(context) {
         transport: context.transport,
         ...(context.userId ? { userId: context.userId } : {}),
         ...(context.role ? { role: context.role } : {}),
+        ...(context.tokenId ? { tokenId: context.tokenId } : {}),
     };
 }
 /**
@@ -450,7 +423,7 @@ function bearerTokenFromHeaders(req) {
     if (!authHeader) {
         return null;
     }
-    return authHeader.startsWith("Bearer ") ? authHeader.slice(7) : authHeader;
+    return authHeader.slice(0, 7).toLowerCase() === "bearer " ? authHeader.slice(7) : authHeader;
 }
 /**
  * @param {unknown} value
@@ -465,16 +438,39 @@ function asStringRecord(value) {
  * @returns {ResponseFrame}
  */
 function responseOk(id, payload) {
-    return { type: "res", id, ok: true, payload };
+    return { type: "res", id, ok: true, apiVersion: SMITHERS_API_VERSION, payload };
 }
 /**
  * @param {string} id
  * @param {string} code
  * @param {string} message
+ * @param {Record<string, unknown>} [details]
  * @returns {ResponseFrame}
  */
-function responseError(id, code, message) {
-    return { type: "res", id, ok: false, error: { code, message } };
+function responseError(id, code, message, details = {}) {
+    return {
+        type: "res",
+        id,
+        ok: false,
+        apiVersion: SMITHERS_API_VERSION,
+        error: {
+            version: SMITHERS_API_VERSION,
+            code,
+            message,
+            ...details,
+        },
+    };
+}
+/**
+ * @param {string} id
+ * @param {string} method
+ * @returns {ResponseFrame}
+ */
+function responseForbidden(id, method) {
+    const requiredScope = requiredScopeForMethod(method);
+    return responseError(id, "FORBIDDEN", `Missing required scope ${requiredScope} for ${method}`, {
+        requiredScope,
+    });
 }
 /**
  * @param {unknown} raw
@@ -624,13 +620,16 @@ export function statusForRpcError(code) {
         case "Unauthorized":
             return 401;
         case "FORBIDDEN":
+        case "Forbidden":
             return 403;
         case "NOT_FOUND":
         case "METHOD_NOT_FOUND":
             return 404;
         case "INVALID_REQUEST":
+        case "InvalidRequest":
         case "INVALID_FRAME":
         case "INVALID_INPUT":
+        case "InvalidInput":
         case "PROTOCOL_UNSUPPORTED":
         case "InvalidRunId":
         case "InvalidNodeId":
@@ -649,9 +648,11 @@ export function statusForRpcError(code) {
             return 404;
         case "AttemptNotFinished":
         case "Busy":
+        case "AlreadyDecided":
             return 409;
         case "DiffTooLarge":
         case "PayloadTooLarge":
+        case "PAYLOAD_TOO_LARGE":
             return 413;
         case "RateLimited":
         case "BackpressureDisconnect":
@@ -683,10 +684,23 @@ function normalizeGrantedScope(scope) {
 }
 /**
  * @param {string} method
- * @returns {MethodAccess}
- */
-function accessForMethod(method) {
-    return METHOD_ACCESS[method] ?? (method.startsWith("config.") ? "admin" : "read");
+ * @returns {import("@smithers-orchestrator/gateway/auth/scopes").GatewayScope}
+ */
+function requiredScopeForMethod(method) {
+    if (method === "run:read" ||
+        method === "run:write" ||
+        method === "run:admin" ||
+        method === "approval:submit" ||
+        method === "signal:submit" ||
+        method === "cron:read" ||
+        method === "cron:write" ||
+        method === "observability:read") {
+        return method;
+    }
+    if (method.startsWith("config.")) {
+        return "run:admin";
+    }
+    return getRequiredScopeForGatewayMethod(method) ?? "run:read";
 }
 /**
  * @param {string[]} scopes
@@ -694,26 +708,7 @@ function accessForMethod(method) {
  * @returns {boolean}
  */
 function hasScope(scopes, method) {
-    if (scopes.includes("*")) {
-        return true;
-    }
-    const requiredAccess = accessForMethod(method);
-    const grantedLevels = scopes
-        .map((scope) => scope.trim())
-        .filter((scope) => scope === "read" || scope === "execute" || scope === "approve" || scope === "admin");
-    if (grantedLevels.some((level) => ACCESS_RANK[level] >= ACCESS_RANK[requiredAccess])) {
-        return true;
-    }
-    for (const scope of scopes.map(normalizeGrantedScope)) {
-        if (!scope)
-            continue;
-        if (scope === method)
-            return true;
-        if (scope.endsWith(".*") && method.startsWith(scope.slice(0, -1))) {
-            return true;
-        }
-    }
-    return false;
+    return hasGatewayScope(scopes.map(normalizeGrantedScope), requiredScopeForMethod(method), method);
 }
 /**
  * @param {unknown} value
@@ -962,13 +957,13 @@ async function readRawBody(req, maxBytes) {
     const lengthHeader = headerValue(req, "content-length");
     const declaredLength = lengthHeader ? Number(lengthHeader) : NaN;
     if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
-        throw new SmithersError("INVALID_INPUT", `Gateway request payload exceeds ${maxBytes} bytes.`, { maxBytes });
+        throw new SmithersError("PayloadTooLarge", `Gateway request payload exceeds ${maxBytes} bytes.`, { maxBytes });
     }
     for await (const chunk of req) {
         const buffer = Buffer.from(chunk);
         total += buffer.length;
         if (total > maxBytes) {
-            throw new SmithersError("INVALID_INPUT", `Gateway request payload exceeds ${maxBytes} bytes.`, { maxBytes });
+            throw new SmithersError("PayloadTooLarge", `Gateway request payload exceeds ${maxBytes} bytes.`, { maxBytes });
         }
         chunks.push(buffer);
     }
@@ -1055,6 +1050,9 @@ export class Gateway {
     maxBodyBytes;
     maxPayload;
     maxConnections;
+    eventWindowSize;
+    headersTimeout;
+    requestTimeout;
     auth;
     defaults;
     workflows = new Map();
@@ -1063,6 +1061,7 @@ export class Gateway {
     activeRuns = new Map();
     inflightRuns = new Map();
     devtoolsSubscribers = new Map();
+    runEventWindows = new Map();
     /** Absolute active subscriber count per runId (gauge source of truth). */
     devtoolsSubscriberCounts = new Map();
     /** Flagged subscriber IDs that should force a snapshot on their next emit. */
@@ -1088,6 +1087,15 @@ export class Gateway {
         this.maxConnections = options.maxConnections === undefined
             ? DEFAULT_MAX_CONNECTIONS
             : Math.floor(assertPositiveFiniteInteger("maxConnections", Number(options.maxConnections)));
+        this.eventWindowSize = options.eventWindowSize === undefined
+            ? GATEWAY_EVENT_WINDOW_DEFAULT
+            : Math.floor(assertPositiveFiniteInteger("eventWindowSize", Number(options.eventWindowSize)));
+        this.headersTimeout = options.headersTimeout === undefined
+            ? DEFAULT_HEADERS_TIMEOUT
+            : Math.floor(assertPositiveFiniteInteger("headersTimeout", Number(options.headersTimeout)));
+        this.requestTimeout = options.requestTimeout === undefined
+            ? DEFAULT_REQUEST_TIMEOUT
+            : Math.floor(assertPositiveFiniteInteger("requestTimeout", Number(options.requestTimeout)));
         this.auth = options.auth;
         this.defaults = options.defaults;
     }
@@ -1238,6 +1246,153 @@ export class Gateway {
         }
     }
     /**
+   * @param {string} runId
+   * @returns {{ nextSeq: number; window: Array<Record<string, unknown>> }}
+   */
+    getRunEventWindow(runId) {
+        let state = this.runEventWindows.get(runId);
+        if (!state) {
+            state = { nextSeq: 0, window: [] };
+            this.runEventWindows.set(runId, state);
+        }
+        return state;
+    }
+    /**
+   * @param {string} event
+   * @param {unknown} payload
+   * @param {number} stateVersion
+   * @returns {Record<string, unknown> | null}
+   */
+    appendRunEventWindow(event, payload, stateVersion) {
+        const runId = eventRunId(payload);
+        if (!runId) {
+            return null;
+        }
+        const state = this.getRunEventWindow(runId);
+        state.nextSeq += 1;
+        const frame = {
+            apiVersion: SMITHERS_API_VERSION,
+            type: "RunEvent",
+            runId,
+            event,
+            payload,
+            seq: state.nextSeq,
+            stateVersion,
+        };
+        state.window.push(frame);
+        while (state.window.length > this.eventWindowSize) {
+            state.window.shift();
+        }
+        return frame;
+    }
+    /**
+   * @param {string} runId
+   * @returns {number}
+   */
+    getRunEventCurrentSeq(runId) {
+        return this.runEventWindows.get(runId)?.nextSeq ?? 0;
+    }
+    /**
+   * @param {ConnectionState} connection
+   * @param {string} streamId
+   * @param {string} runId
+   * @returns {() => void}
+   */
+    registerRunEventSubscriber(connection, streamId, runId) {
+        if (!connection.runEventStreams) {
+            connection.runEventStreams = new Map();
+        }
+        const heartbeat = setInterval(() => {
+            this.sendEvent(connection, "run.heartbeat", {
+                apiVersion: SMITHERS_API_VERSION,
+                type: "Heartbeat",
+                streamId,
+                runId,
+                ts: nowMs(),
+            });
+        }, RUN_EVENT_HEARTBEAT_MS);
+        connection.runEventStreams.set(streamId, { runId, heartbeat });
+        return () => this.unregisterRunEventSubscriber(connection, streamId);
+    }
+    /**
+   * @param {ConnectionState} connection
+   * @param {string} streamId
+   */
+    unregisterRunEventSubscriber(connection, streamId) {
+        const stream = connection.runEventStreams?.get(streamId);
+        if (!stream) {
+            return;
+        }
+        clearInterval(stream.heartbeat);
+        connection.runEventStreams?.delete(streamId);
+    }
+    /**
+   * @param {ConnectionState} connection
+   */
+    cleanupRunEventSubscribers(connection) {
+        const streams = connection.runEventStreams;
+        if (!streams || streams.size === 0) {
+            return;
+        }
+        for (const streamId of streams.keys()) {
+            this.unregisterRunEventSubscriber(connection, streamId);
+        }
+    }
+    /**
+   * @param {ConnectionState} connection
+   * @param {string} streamId
+   * @param {Record<string, unknown>} frame
+   */
+    sendRunEventStreamFrame(connection, streamId, frame) {
+        this.sendEvent(connection, "run.event", {
+            streamId,
+            ...frame,
+        });
+    }
+    /**
+   * @param {ConnectionState} connection
+   * @param {string} streamId
+   * @param {string} runId
+   * @param {number} fromSeq
+   * @param {number} toSeq
+   * @param {unknown} snapshot
+   */
+    sendRunGapResync(connection, streamId, runId, fromSeq, toSeq, snapshot) {
+        this.sendEvent(connection, "run.gap_resync", {
+            apiVersion: SMITHERS_API_VERSION,
+            type: "GapResync",
+            streamId,
+            runId,
+            fromSeq,
+            toSeq,
+            snapshot,
+        });
+    }
+    /**
+   * @param {string} runId
+   */
+    async buildRunSnapshot(runId) {
+        const resolved = await this.resolveRun(runId);
+        if (!resolved) {
+            return null;
+        }
+        const run = await resolved.adapter.getRun(runId);
+        if (!run) {
+            return null;
+        }
+        const summary = await resolved.adapter.countNodesByState(runId);
+        const runState = await computeRunStateFromRow(resolved.adapter, run).catch(() => undefined);
+        return {
+            ...run,
+            workflowKey: resolved.workflowKey,
+            summary: summary.reduce((acc, row) => {
+                acc[row.state] = row.count;
+                return acc;
+            }, {}),
+            ...(runState ? { runState } : {}),
+        };
+    }
+    /**
    * @param {GatewayTransport} transport
    * @param {string} frameType
    * @param {GatewayMetricLabels} [labels]
@@ -1359,8 +1514,10 @@ export class Gateway {
     rpcSuccessEffect(context, frame, response) {
         const params = asObject(frame.params) ?? {};
         switch (frame.method) {
-            case "approvals.decide": {
-                const approved = asBoolean(params.approved) ?? false;
+            case "approvals.decide":
+            case "submitApproval": {
+                const decision = asObject(params.decision);
+                const approved = asBoolean(params.approved) ?? asBoolean(decision?.approved) ?? false;
                 const nodeId = asString(params.nodeId);
                 return Effect.all([
                     incrementMetric(gatewayApprovalDecisionsTotal, {
@@ -1374,9 +1531,10 @@ export class Gateway {
                     })),
                 ], { discard: true });
             }
-            case "signals.send": {
-                const signalName = asString(params.signalName);
-                const correlationId = asString(params.correlationId);
+            case "signals.send":
+            case "submitSignal": {
+                const signalName = asString(params.signalName) ?? asString(params.correlationKey);
+                const correlationId = asString(params.correlationId) ?? asString(params.correlationKey);
                 return Effect.all([
                     incrementMetric(gatewaySignalsTotal, { outcome: "sent" }),
                     Effect.logInfo("Gateway signal sent").pipe(Effect.annotateLogs({
@@ -1386,7 +1544,8 @@ export class Gateway {
                     })),
                 ], { discard: true });
             }
-            case "cron.trigger": {
+            case "cron.trigger":
+            case "cronRun": {
                 const cronId = asString(params.cronId);
                 const workflow = asString(params.workflow);
                 return Effect.all([
@@ -1646,9 +1805,13 @@ export class Gateway {
             noServer: true,
             maxPayload: this.maxPayload,
         });
+        wsServer.on("headers", (headers) => {
+            headers.push(`X-Smithers-API-Version: ${SMITHERS_API_VERSION}`);
+        });
         const server = createServer(async (req, res) => {
             const url = new URL(req.url ?? "/", "http://127.0.0.1");
             const webhookMatch = url.pathname.match(/^\/webhooks\/([^/]+)$/);
+            const rpcMatch = url.pathname.match(/^\/v1\/rpc\/([^/]+)$/);
             if ((req.method ?? "GET") === "GET" && (req.url ?? "/") === "/health") {
                 return sendJson(res, 200, {
                     ok: true,
@@ -1663,11 +1826,16 @@ export class Gateway {
             if ((req.method ?? "GET") === "POST" && webhookMatch) {
                 return this.handleWebhook(req, res, decodeURIComponent(webhookMatch[1]));
             }
+            if ((req.method ?? "GET") === "POST" && rpcMatch) {
+                return this.handleHttpRpc(req, res, decodeURIComponent(rpcMatch[1]));
+            }
             if ((req.method ?? "GET") === "POST" && (req.url ?? "/") === "/rpc") {
                 return this.handleHttpRpc(req, res);
             }
             return sendJson(res, 404, { error: { code: "NOT_FOUND", message: "Route not found" } });
         });
+        server.headersTimeout = this.headersTimeout;
+        server.requestTimeout = this.requestTimeout;
         server.on("upgrade", (req, socket, head) => {
             if (this.connections.size >= this.maxConnections) {
                 emitGatewayEffect(incrementMetric(gatewayErrorsTotal, {
@@ -1683,6 +1851,7 @@ export class Gateway {
                 socket.write("HTTP/1.1 503 Service Unavailable\r\n"
                     + "Connection: close\r\n"
                     + "Content-Type: text/plain; charset=utf-8\r\n"
+                    + `X-Smithers-API-Version: ${SMITHERS_API_VERSION}\r\n`
                     + `Content-Length: ${Buffer.byteLength(body, "utf8")}\r\n`
                     + "\r\n"
                     + body);
@@ -1873,6 +2042,7 @@ export class Gateway {
                 triggeredBy: auth.triggeredBy,
                 source: gatewayTriggerSource(auth.triggeredBy),
                 resume: options?.resume ?? false,
+                ...(auth.tokenId ? { tokenId: auth.tokenId } : {}),
                 ...(auth.subscribeConnection
                     ? gatewayContextAnnotations(auth.subscribeConnection)
                     : {}),
@@ -1899,6 +2069,7 @@ export class Gateway {
                 triggeredBy: auth.triggeredBy,
                 scopes: [...auth.scopes],
                 role: auth.role,
+                tokenId: auth.tokenId ?? null,
                 createdAt: new Date().toISOString(),
             },
         }))
@@ -1994,6 +2165,7 @@ export class Gateway {
             role: null,
             scopes: [],
             userId: null,
+            tokenId: null,
             subscribedRuns: null,
             devtoolsStreams: new Map(),
             heartbeatTimer: null,
@@ -2024,7 +2196,7 @@ export class Gateway {
                         return this.handleConnect(connection, req, frame.id, frame.params);
                     }
                     if (!hasScope(connection.scopes, frame.method)) {
-                        return responseError(frame.id, "FORBIDDEN", `Missing scope for ${frame.method}`);
+                        return responseForbidden(frame.id, frame.method);
                     }
                     return this.routeRequest(connection, frame);
                 });
@@ -2062,6 +2234,7 @@ export class Gateway {
             }
             this.connections.delete(connection);
             this.cleanupDevToolsSubscribers(connection);
+            this.cleanupRunEventSubscribers(connection);
             emitGatewayEffect(Effect.all([
                 updateMetric(gatewayConnectionsActive, -1, { transport: "ws" }),
                 incrementMetric(gatewayConnectionsClosedTotal, {
@@ -2146,13 +2319,14 @@ export class Gateway {
                 authCode: authResult.code,
                 authMessage: authResult.message,
             });
-            return responseError(id, authResult.code, authResult.message);
+            return responseError(id, authResult.code, authResult.message, authResult.details);
         }
         connection.authenticated = true;
         connection.sessionToken = randomUUID();
         connection.role = authResult.role;
         connection.scopes = [...authResult.scopes];
         connection.userId = authResult.userId ?? null;
+        connection.tokenId = authResult.tokenId ?? null;
         connection.subscribedRuns = Array.isArray(request.subscribe)
             ? new Set(request.subscribe.filter((value) => typeof value === "string"))
             : null;
@@ -2171,6 +2345,7 @@ export class Gateway {
                 role: authResult.role,
                 scopes: authResult.scopes,
                 userId: authResult.userId ?? null,
+                tokenId: authResult.tokenId ?? null,
             },
             snapshot: await this.buildSnapshot(),
         };
@@ -2214,11 +2389,32 @@ export class Gateway {
                     message: "Invalid token",
                 };
             }
+            if (typeof grant.revokedAtMs === "number" && grant.revokedAtMs <= Date.now()) {
+                return {
+                    ok: false,
+                    code: "UNAUTHORIZED",
+                    message: "Token has been revoked",
+                    details: {
+                        refresh: "smithers token issue",
+                    },
+                };
+            }
+            if (typeof grant.expiresAtMs === "number" && grant.expiresAtMs <= Date.now()) {
+                return {
+                    ok: false,
+                    code: "UNAUTHORIZED",
+                    message: "Token expired; issue a refreshed token.",
+                    details: {
+                        refresh: "smithers token issue",
+                    },
+                };
+            }
             return {
                 ok: true,
                 role: grant.role,
                 scopes: grant.scopes,
                 userId: grant.userId,
+                tokenId: grant.tokenId ?? createHash("sha256").update(token).digest("hex").slice(0, 16),
             };
         }
         if (this.auth.mode === "jwt") {
@@ -2235,6 +2431,9 @@ export class Gateway {
                     ok: false,
                     code: "UNAUTHORIZED",
                     message: verified.message,
+                    details: verified.message.includes("expired")
+                        ? { refresh: "smithers token issue" }
+                        : undefined,
                 };
             }
             const scopes = parseJwtScopes(verified.payload[this.auth.scopesClaim ?? "scope"]);
@@ -2247,6 +2446,7 @@ export class Gateway {
                 role,
                 scopes: scopes.length > 0 ? scopes : [...(this.auth.defaultScopes ?? [])],
                 userId: userId ?? undefined,
+                tokenId: createHash("sha256").update(token).digest("hex").slice(0, 16),
             };
         }
         if (this.auth.mode === "trusted-proxy") {
@@ -2271,6 +2471,7 @@ export class Gateway {
                 role,
                 scopes,
                 userId: userId ?? undefined,
+                tokenId: asString(req.headers["x-smithers-token-id"]) ?? undefined,
             };
         }
         return {
@@ -2282,8 +2483,9 @@ export class Gateway {
     /**
    * @param {IncomingMessage} req
    * @param {ServerResponse} res
+   * @param {string} [forcedMethod]
    */
-    async handleHttpRpc(req, res) {
+    async handleHttpRpc(req, res, forcedMethod) {
         const requestId = headerValue(req, "x-request-id") ?? randomUUID();
         const baseContext = {
             connectionId: `http:${requestId}`,
@@ -2291,6 +2493,7 @@ export class Gateway {
             role: null,
             scopes: [],
             userId: null,
+            tokenId: null,
             subscribedRuns: null,
             devtoolsStreams: null,
         };
@@ -2309,7 +2512,7 @@ export class Gateway {
                     authCode: authResult.code,
                     authMessage: authResult.message,
                 }, "warning");
-                const response = responseError(requestId, authResult.code, authResult.message);
+                const response = responseError(requestId, authResult.code, authResult.message, authResult.details);
                 return this.sendHttpRpcResponse(res, statusForRpcError(authResult.code), response);
             }
             context = {
@@ -2317,6 +2520,7 @@ export class Gateway {
                 role: authResult.role,
                 scopes: [...authResult.scopes],
                 userId: authResult.userId ?? null,
+                tokenId: authResult.tokenId ?? null,
             };
             this.recordAuthEvent("http", "success", context, {
                 requestId,
@@ -2342,18 +2546,18 @@ export class Gateway {
                 maxDepth: GATEWAY_RPC_MAX_DEPTH,
                 maxStringLength: GATEWAY_RPC_MAX_STRING_LENGTH,
             });
-            const method = validateGatewayMethodName(body.method);
+            const method = validateGatewayMethodName(forcedMethod ?? body.method);
             const bodyId = asString(body.id) ?? requestId;
             assertOptionalStringMaxLength("id", bodyId, GATEWAY_FRAME_ID_MAX_LENGTH);
             const frame = {
                 type: "req",
                 id: bodyId,
                 method,
-                params: body.params,
+                params: forcedMethod && body.method === undefined ? body : body.params,
             };
             const response = await this.executeRpc(context, frame, async () => {
                 if (!hasScope(context.scopes, method)) {
-                    return responseError(bodyId, "FORBIDDEN", `Missing scope for ${method}`);
+                    return responseForbidden(bodyId, method);
                 }
                 return this.routeRequest(context, frame);
             });
@@ -2407,6 +2611,7 @@ export class Gateway {
             payload,
             seq: connection.seq,
             stateVersion,
+            apiVersion: SMITHERS_API_VERSION,
         };
         connection.ws.send(JSON.stringify(frame));
         this.recordMessageSent("ws", "event", { event });
@@ -2418,6 +2623,7 @@ export class Gateway {
     broadcastEvent(event, payload) {
         const runId = eventRunId(payload);
         this.stateVersion += 1;
+        const runFrame = this.appendRunEventWindow(event, payload, this.stateVersion);
         let recipientCount = 0;
         for (const connection of this.connections) {
             if (!connection.authenticated || !shouldDeliverEvent(connection, runId)) {
@@ -2425,6 +2631,13 @@ export class Gateway {
             }
             recipientCount += 1;
             this.sendEvent(connection, event, payload, this.stateVersion);
+            if (runFrame && connection.runEventStreams) {
+                for (const [streamId, stream] of connection.runEventStreams.entries()) {
+                    if (stream.runId === runId) {
+                        this.sendRunEventStreamFrame(connection, streamId, runFrame);
+                    }
+                }
+            }
         }
         emitGatewayLog("debug", "Gateway event broadcast", {
             event,
@@ -2725,12 +2938,15 @@ export class Gateway {
                     stateVersion: this.stateVersion,
                     uptimeMs: nowMs() - this.startedAtMs,
                 });
-            case "runs.list": {
-                const limit = asOptionalPositiveInt(params.limit, "limit") ?? 50;
-                const status = asString(params.status);
+            case "runs.list":
+            case "listRuns": {
+                const filter = asObject(params.filter) ?? {};
+                const limit = asOptionalPositiveInt(params.limit ?? filter.limit, "limit") ?? 50;
+                const status = asString(params.status) ?? asString(filter.status);
                 return responseOk(frame.id, await this.listRunsAcrossWorkflows(limit, status));
             }
-            case "runs.create": {
+            case "runs.create":
+            case "launchRun": {
                 const workflowKey = asString(params.workflow);
                 if (!workflowKey) {
                     return responseError(frame.id, "INVALID_REQUEST", "workflow is required");
@@ -2748,14 +2964,42 @@ export class Gateway {
                     }
                     throw error;
                 }
+                const options = asObject(params.options) ?? {};
                 return responseOk(frame.id, await this.startRun(workflowKey, input, {
                     triggeredBy: connection.userId ?? "gateway",
                     scopes: [...connection.scopes],
                     role: connection.role ?? "operator",
+                    tokenId: connection.tokenId ?? null,
                     subscribeConnection: connection,
-                }, asString(params.runId) ?? crypto.randomUUID(), { resume: false }));
+                }, asString(params.runId) ?? asString(options.runId) ?? crypto.randomUUID(), { resume: false }));
+            }
+            case "resumeRun": {
+                const runId = asString(params.runId);
+                if (!runId) {
+                    return responseError(frame.id, "INVALID_REQUEST", "runId is required");
+                }
+                const resolved = await this.resolveRun(runId);
+                if (!resolved) {
+                    return responseError(frame.id, "NOT_FOUND", `Run not found: ${runId}`);
+                }
+                const run = await resolved.adapter.getRun(runId);
+                if (!run) {
+                    return responseError(frame.id, "NOT_FOUND", `Run not found: ${runId}`);
+                }
+                if (run.status === "finished" || run.status === "failed" || run.status === "cancelled") {
+                    return responseOk(frame.id, { runId, status: "already_terminal" });
+                }
+                await this.resumeRunIfNeeded(runId, resolved.workflowKey, resolved.adapter, {
+                    triggeredBy: connection.userId ?? "gateway",
+                    scopes: [...connection.scopes],
+                    role: connection.role ?? "operator",
+                    tokenId: connection.tokenId ?? null,
+                    subscribeConnection: connection.transport === "ws" ? connection : undefined,
+                });
+                return responseOk(frame.id, { runId, status: "resume_requested" });
             }
-            case "runs.get": {
+            case "runs.get":
+            case "getRun": {
                 const runId = asString(params.runId);
                 if (!runId) {
                     return responseError(frame.id, "INVALID_REQUEST", "runId is required");
@@ -2918,6 +3162,64 @@ export class Gateway {
                     throw error;
                 }
             }
+            case "streamRunEvents": {
+                if (connection.transport !== "ws" || !connection.ws) {
+                    return responseError(frame.id, "INVALID_REQUEST", "streamRunEvents is only supported over websocket connections");
+                }
+                const runId = asString(params.runId);
+                if (!runId) {
+                    return responseError(frame.id, "InvalidRunId", "runId is required");
+                }
+                const afterSeq = params.afterSeq;
+                if (afterSeq !== undefined &&
+                    (typeof afterSeq !== "number" || !Number.isInteger(afterSeq) || afterSeq < 0)) {
+                    return responseError(frame.id, "SeqOutOfRange", "afterSeq must be a non-negative integer");
+                }
+                const resolved = await this.resolveRun(runId);
+                if (!resolved) {
+                    return responseError(frame.id, "RunNotFound", `Run not found: ${runId}`);
+                }
+                const currentSeq = this.getRunEventCurrentSeq(runId);
+                if (typeof afterSeq === "number" && afterSeq > currentSeq) {
+                    return responseError(frame.id, "SeqOutOfRange", `afterSeq ${afterSeq} is newer than current seq ${currentSeq}`);
+                }
+                const streamId = randomUUID();
+                this.registerRunEventSubscriber(connection, streamId, runId);
+                queueMicrotask(() => {
+                    void (async () => {
+                        const state = this.getRunEventWindow(runId);
+                        const window = [...state.window];
+                        if (typeof afterSeq === "number") {
+                            const firstSeq = window.length > 0 ? Number(window[0].seq) : state.nextSeq + 1;
+                            if (window.length > 0 && afterSeq < firstSeq - 1) {
+                                const snapshot = await this.buildRunSnapshot(runId);
+                                this.sendRunGapResync(connection, streamId, runId, afterSeq + 1, firstSeq - 1, snapshot);
+                            }
+                            for (const eventFrame of window) {
+                                if (Number(eventFrame.seq) > afterSeq) {
+                                    this.sendRunEventStreamFrame(connection, streamId, eventFrame);
+                                }
+                            }
+                        }
+                    })().catch((error) => {
+                        this.sendEvent(connection, "run.error", {
+                            streamId,
+                            runId,
+                            error: {
+                                version: SMITHERS_API_VERSION,
+                                code: "Internal",
+                                message: error?.message ?? "streamRunEvents replay failed",
+                            },
+                        });
+                    });
+                });
+                return responseOk(frame.id, {
+                    streamId,
+                    runId,
+                    afterSeq: typeof afterSeq === "number" ? afterSeq : null,
+                    currentSeq,
+                });
+            }
             case "streamDevTools": {
                 if (connection.transport !== "ws" || !connection.ws) {
                     this.recordDevToolsSubscribeAttempt("error");
@@ -2928,7 +3230,13 @@ export class Gateway {
                     this.recordDevToolsSubscribeAttempt("error");
                     return responseError(frame.id, "InvalidRunId", "runId is required");
                 }
-                const fromSeq = params.fromSeq;
+                if (typeof params.fromSeq === "number" &&
+                    typeof params.afterSeq === "number" &&
+                    params.fromSeq !== params.afterSeq) {
+                    this.recordDevToolsSubscribeAttempt("error");
+                    return responseError(frame.id, "SeqOutOfRange", "fromSeq and afterSeq must match when both are provided");
+                }
+                const fromSeq = typeof params.fromSeq === "number" ? params.fromSeq : params.afterSeq;
                 const streamId = randomUUID();
                 try {
                     // Full route-level validation at the gateway boundary so
@@ -3094,6 +3402,7 @@ export class Gateway {
                         streamId,
                         runId,
                         fromSeq: typeof fromSeq === "number" ? fromSeq : null,
+                        afterSeq: typeof fromSeq === "number" ? fromSeq : null,
                     });
                 }
                 catch (error) {
@@ -3104,6 +3413,22 @@ export class Gateway {
                     throw error;
                 }
             }
+            case "hijackRun": {
+                const runId = asString(params.runId);
+                if (!runId) {
+                    return responseError(frame.id, "InvalidRunId", "runId is required");
+                }
+                const resolved = await this.resolveRun(runId);
+                if (!resolved) {
+                    return responseError(frame.id, "RunNotFound", `Run not found: ${runId}`);
+                }
+                return responseOk(frame.id, {
+                    runId,
+                    status: "hijack-ready",
+                    sessionId: randomUUID(),
+                });
+            }
+            case "rewindRun":
             case "jumpToFrame":
             case "devtools.jumpToFrame": {
                 const runId = asString(params.runId);
@@ -3179,6 +3504,7 @@ export class Gateway {
                                 triggeredBy: connection.userId ?? "gateway",
                                 scopes: [...connection.scopes],
                                 role: connection.role ?? "operator",
+                                tokenId: connection.tokenId ?? null,
                                 subscribeConnection: connection.transport === "ws" ? connection : undefined,
                             });
                         },
@@ -3223,10 +3549,12 @@ export class Gateway {
             }
             case "approvals.list":
                 return responseOk(frame.id, await this.listPendingApprovals());
-            case "approvals.decide": {
+            case "approvals.decide":
+            case "submitApproval": {
                 const runId = asString(params.runId);
                 const nodeId = asString(params.nodeId);
-                const approved = asBoolean(params.approved);
+                const stableDecision = asObject(params.decision);
+                const approved = asBoolean(params.approved) ?? asBoolean(stableDecision?.approved);
                 const iteration = asNumber(params.iteration) ?? 0;
                 if (!runId || !nodeId || approved === undefined) {
                     return responseError(frame.id, "INVALID_REQUEST", "runId, nodeId, and approved are required");
@@ -3236,6 +3564,14 @@ export class Gateway {
                     return responseError(frame.id, "NOT_FOUND", `Run not found: ${runId}`);
                 }
                 const approval = await resolved.adapter.getApproval(runId, nodeId, iteration);
+                if (approval && approval.status !== "requested") {
+                    return responseError(frame.id, "AlreadyDecided", `Approval for ${nodeId} has already been decided`, {
+                        runId,
+                        nodeId,
+                        iteration,
+                        status: approval.status,
+                    });
+                }
                 const request = parseApprovalRequest(parseJson(typeof approval?.requestJson === "string" ? approval.requestJson : null), nodeId);
                 if (request.allowedUsers.length > 0 &&
                     (!connection.userId || !request.allowedUsers.includes(connection.userId))) {
@@ -3245,7 +3581,8 @@ export class Gateway {
                     !request.allowedScopes.some((scope) => hasScope(connection.scopes, scope))) {
                     return responseError(frame.id, "FORBIDDEN", "Connection is missing required approval scope");
                 }
-                const decision = params.decision;
+                const decision = stableDecision && "value" in stableDecision ? stableDecision.value : params.decision;
+                const note = asString(params.note) ?? asString(stableDecision?.note);
                 if (approved) {
                     const validation = validateApprovalDecision(request, decision);
                     if (!validation.ok) {
@@ -3253,22 +3590,25 @@ export class Gateway {
                     }
                 }
                 if (approved) {
-                    await Effect.runPromise(approveNode(resolved.adapter, runId, nodeId, iteration, asString(params.note), connection.userId ?? undefined, decision));
+                    await Effect.runPromise(approveNode(resolved.adapter, runId, nodeId, iteration, note, connection.userId ?? undefined, decision));
                 }
                 else {
-                    await Effect.runPromise(denyNode(resolved.adapter, runId, nodeId, iteration, asString(params.note), connection.userId ?? undefined, decision));
+                    await Effect.runPromise(denyNode(resolved.adapter, runId, nodeId, iteration, note, connection.userId ?? undefined, decision));
                 }
                 await this.resumeRunIfNeeded(runId, resolved.workflowKey, resolved.adapter, {
                     triggeredBy: connection.userId ?? "gateway",
                     scopes: [...connection.scopes],
                     role: connection.role ?? "operator",
+                    tokenId: connection.tokenId ?? null,
                     subscribeConnection: connection,
                 });
                 return responseOk(frame.id, { runId, nodeId, iteration, approved });
             }
-            case "signals.send": {
+            case "signals.send":
+            case "submitSignal": {
                 const runId = asString(params.runId);
-                const signalName = asString(params.signalName);
+                const correlationKey = asString(params.correlationKey);
+                const signalName = asString(params.signalName) ?? correlationKey;
                 if (!runId || !signalName) {
                     return responseError(frame.id, "INVALID_REQUEST", "runId and signalName are required");
                 }
@@ -3276,19 +3616,21 @@ export class Gateway {
                 if (!resolved) {
                     return responseError(frame.id, "NOT_FOUND", `Run not found: ${runId}`);
                 }
-                const delivered = await Effect.runPromise(signalRun(resolved.adapter, runId, signalName, params.data ?? {}, {
-                    correlationId: asString(params.correlationId),
+                const delivered = await Effect.runPromise(signalRun(resolved.adapter, runId, signalName, params.data ?? params.payload ?? {}, {
+                    correlationId: asString(params.correlationId) ?? correlationKey,
                     receivedBy: connection.userId,
                 }));
                 await this.resumeRunIfNeeded(runId, resolved.workflowKey, resolved.adapter, {
                     triggeredBy: connection.userId ?? "gateway",
                     scopes: [...connection.scopes],
                     role: connection.role ?? "operator",
+                    tokenId: connection.tokenId ?? null,
                     subscribeConnection: connection,
                 });
                 return responseOk(frame.id, delivered);
             }
-            case "runs.cancel": {
+            case "runs.cancel":
+            case "cancelRun": {
                 const runId = asString(params.runId);
                 if (!runId) {
                     return responseError(frame.id, "INVALID_REQUEST", "runId is required");
@@ -3326,8 +3668,16 @@ export class Gateway {
                 });
             }
             case "cron.list":
-                return responseOk(frame.id, await this.listCrons());
-            case "cron.add": {
+            case "cronList": {
+                const filter = asObject(params.filter) ?? {};
+                const workflowFilter = asString(filter.workflow);
+                const rows = await this.listCrons();
+                return responseOk(frame.id, workflowFilter
+                    ? rows.filter((row) => row.workflow === workflowFilter)
+                    : rows);
+            }
+            case "cron.add":
+            case "cronCreate": {
                 const workflowKey = asString(params.workflow);
                 const pattern = asString(params.pattern);
                 if (!workflowKey || !pattern) {
@@ -3355,7 +3705,8 @@ export class Gateway {
                     workflow: workflowKey,
                 });
             }
-            case "cron.remove": {
+            case "cron.remove":
+            case "cronDelete": {
                 const cronId = asString(params.cronId);
                 if (!cronId) {
                     return responseError(frame.id, "INVALID_REQUEST", "cronId is required");
@@ -3367,7 +3718,8 @@ export class Gateway {
                 await resolvedCron.adapter.deleteCron(cronId);
                 return responseOk(frame.id, { cronId, removed: true });
             }
-            case "cron.trigger": {
+            case "cron.trigger":
+            case "cronRun": {
                 const cronId = asString(params.cronId);
                 const workflowKey = asString(params.workflow);
                 const resolvedCron = cronId ? await this.findCron(cronId) : null;
@@ -3392,6 +3744,7 @@ export class Gateway {
                     triggeredBy: connection.userId ?? "gateway",
                     scopes: [...connection.scopes],
                     role: connection.role ?? "operator",
+                    tokenId: connection.tokenId ?? null,
                     subscribeConnection: connection,
                 }, undefined, { resume: false }));
             }

package/src/gatewayRoutes/getNodeDiff.js

@@ -273,9 +273,9 @@ export async function getNodeDiffRoute({
     emitEffect = (effect) => runPromise(effect),
     computeDiffBundleImpl,
     computeDiffBundleBetweenRefsImpl,
-    getCurrentPointerImpl,
+    getCurrentPointerImpl: _getCurrentPointerImpl,
     resolveCommitPointerImpl = resolveCommitPointer,
-    restorePointerImpl,
+    restorePointerImpl: _restorePointerImpl,
     nowMs = () => Date.now(),
     // stat: true → return summary only ({ files, filesChanged, added,
     // removed }). Bypasses the cache and the full-bundle JSON size guard
@@ -292,7 +292,6 @@ export async function getNodeDiffRoute({
             ? async (baseRef, _targetRef, cwd, seq) => computeDiffBundleImpl(baseRef, cwd, seq)
             : computeDiffBundleBetweenRefs);
     let resultLabel = "error";
-    let cacheResultLabel = "miss";
     let sizeBytes = 0;
     let computeDurationMs = 0;
     const rootSpanAttrs = {
@@ -380,7 +379,6 @@ export async function getNodeDiffRoute({
         const recordCacheResult = async (cacheResult, bytes) => {
             sizeBytes = bytes;
             resultLabel = cacheResult;
-            cacheResultLabel = cacheResult;
             rootSpanAttrs.cacheResult = cacheResult;
             await swallow(() => emitEffect(Effect.all([
                 Metric.increment(taggedMetric(nodeDiffCacheTotal, { result: cacheResult })),

package/src/index.js

@@ -1,4 +1,4 @@
-import { createServer, IncomingMessage, ServerResponse } from "node:http";
+import { createServer } from "node:http";
 import { readFile, writeFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { pathToFileURL } from "node:url";
@@ -20,6 +20,7 @@ import { errorToJson } from "@smithers-orchestrator/errors/errorToJson";
 import { SmithersError } from "@smithers-orchestrator/errors/SmithersError";
 import { assertMaxBytes, assertMaxJsonDepth } from "@smithers-orchestrator/db/input-bounds";
 import { prometheusContentType, renderPrometheusMetrics, } from "@smithers-orchestrator/observability";
+/** @typedef {import("node:http").ServerResponse} ServerResponse */
 /** @typedef {import("./ServerOptions.js").ServerOptions} ServerOptions */
 
 // Re-export the full public surface so the tsup-bundled `src/index.d.ts`
@@ -44,6 +45,8 @@ const DEFAULT_MAX_BODY_BYTES = 1_048_576;
 const DEFAULT_MAX_BODY_JSON_DEPTH = 32;
 const DEFAULT_SSE_HEARTBEAT_MS = 10_000;
 const COMPLETED_RUN_RETENTION_MS = 60_000;
+const DEFAULT_HEADERS_TIMEOUT = 30_000;
+const DEFAULT_REQUEST_TIMEOUT = 60_000;
 class HttpError extends Error {
     status;
     code;
@@ -355,7 +358,7 @@ function assertAuth(req, authToken) {
         req.headers["Authorization"] ??
         req.headers["x-smithers-key"];
     const value = Array.isArray(header) ? header[0] : header;
-    const token = value?.startsWith("Bearer ") ? value.slice(7) : value;
+    const token = value?.slice(0, 7).toLowerCase() === "bearer " ? value.slice(7) : value;
     if (!token || token !== authToken) {
         throw new HttpError(401, "UNAUTHORIZED", "Missing or invalid authorization token");
     }
@@ -645,6 +648,8 @@ function startServerInternal(opts = {}) {
     const maxBodyBytes = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
     const rootDir = opts.rootDir ? resolve(opts.rootDir) : undefined;
     const allowNetwork = Boolean(opts.allowNetwork);
+    const headersTimeout = opts.headersTimeout ?? DEFAULT_HEADERS_TIMEOUT;
+    const requestTimeout = opts.requestTimeout ?? DEFAULT_REQUEST_TIMEOUT;
     if (serverDb) {
         ensureSmithersTables(serverDb);
     }
@@ -1206,6 +1211,8 @@ function startServerInternal(opts = {}) {
             await recordHttpRequestMetricsSafely(requestMethod, requestPathname, res.statusCode || 500, performance.now() - requestStart);
         }
     });
+    server.headersTimeout = headersTimeout;
+    server.requestTimeout = requestTimeout;
     server.on("close", () => {
         logInfo("stopping smithers server", {
             activeRuns: runs.size,

package/src/serve.js

@@ -1,7 +1,6 @@
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { Effect, Metric } from "effect";
-import { SmithersDb } from "@smithers-orchestrator/db/adapter";
 import { approveNode, denyNode } from "@smithers-orchestrator/engine/approvals";
 import { isRunHeartbeatFresh } from "@smithers-orchestrator/engine";
 import { nowMs } from "@smithers-orchestrator/scheduler/nowMs";
@@ -119,7 +118,7 @@ export function createServeApp(opts) {
                 return next();
             const authHeader = c.req.header("authorization");
             if (authHeader) {
-                const token = authHeader.startsWith("Bearer ")
+                const token = authHeader.slice(0, 7).toLowerCase() === "bearer "
                     ? authHeader.slice(7)
                     : authHeader;
                 if (token === authToken)