Server

@arcsig-labs/server runs flows for real: an HTTP API, webhook and cron triggers, timers that survive restarts, run history, encrypted credentials and live events. It is a Hono app, so it runs on Node, Bun, Deno or an edge runtime, and storage is pluggable.

One command

ARCFLOW_SECRET="a long random string" npx -y -p @arcsig-labs/server -p @arcsig-labs/editor arcflow dev --db ./arcflow.db

dev also serves the editor on the same address, with your steps, credentials and run history — no build step and no API key in the browser. serve is the same without the editor.

In your own app

import { createRegistry } from '@arcsig-labs/core';
import { standardSteps } from '@arcsig-labs/nodes';
import { createServer } from '@arcsig-labs/server';
import { SqliteStorage, serveNode } from '@arcsig-labs/server/node';

const server = await createServer({
	registry: createRegistry([standardSteps, myPack]),
	storage: new SqliteStorage('./arcflow.db'),
	secret: process.env.ARCFLOW_SECRET,
	services: { payments }    // your own services, handed to your steps
});

await serveNode(server, { port: 8787 });

Triggers

• Webhooks — an active flow with a trigger.webhook step answers at /hooks/<path>, immediately, when the run finishes, or with whatever a "respond" step sends.
• Schedules — cron steps fire on their expression; runs missed while the server was down are not replayed.
• Timers — a run paused by logic.wait is stored with a wake-up time and resumed later, also after a restart.

curl -X POST http://127.0.0.1:8787/hooks/new-signup -d '{"email":"a@b.com"}'

Credentials

A f.credential('http-auth') field stores only an id in the flow. The value is encrypted with AES-256-GCM and resolved at run time into ctx.secrets — it never enters flow JSON, run state, or an API response.

API