Purpose of this page: walk the middleware chain in order and state the
one job a handler is allowed to do.
Layer 4
http/server/ (koa)
Transport, nothing else. A koa server with a fixed middleware chain and about fifty handlers that parse, invoke, and format.
Components
Middleware chain
envelope → origin → host → preflight → auth (Bearer, timingSafeEqual)
→ route → authorize → bodyParser → idempotency (in-memory store) → dispatch
~50 operation handlers
Each handler parses a request, invokes exactly one command or query, and formats the response. A handler that branches on a domain rule is a defect.
listen(bind:port)
Binds the configured address and shuts down cleanly on SIGTERM or SIGINT.
Inbound edges
| From | Meaning |
|---|---|
| worker | claim · heartbeat · report |
| DaemonClient | HTTP + Bearer token |
Outbound edges
| From | To | Meaning |
|---|---|---|
| listen | middleware chain | every request enters here |
| middleware | operation registry | route match via |
| middleware | handlers | dispatch after auth and parse |
| handlers | commands/ | write paths |
| handlers | queries/ | read paths |
Rules
- A stubbed route answers 501 and writes nothing. An integration test compares database state before and after.
- Route lifecycle is registry data. The handler signature admits only parse, invoke and format.
- This layer may import domain, commands, queries, contract, and itself — nothing below Layer 5.