Flue Zero to Expert, Part 6: Production Routing and Deployment

Series map

Part 1: Your First Flue Agent · Part 2: Typed Workflows · Part 3: Safe Tools · Part 4: Autonomous Agents · Part 5: Persistence and Durable Execution · Part 6: Production Routing and Deployment · Part 7: Operate Like an Expert

Tested with @flue/runtime 1.0.0-beta.9 and Hono 4.12.29 on Node.js.

Own the HTTP boundary

Add src/app.ts when you need authentication, health checks, prefixes, or custom routes. It is a normal Hono application. Middleware registered before the flue() mount protects matching Flue routes.

Agents and workflows must export their HTTP route handlers to be exposed. Workflow run resources also require a runs middleware export.

A minimal authenticated Hono application

Install Hono because this application imports it directly:

npm install hono

// src/app.ts
import { flue } from '@flue/runtime/routing';
import { Hono, type MiddlewareHandler } from 'hono';

const apiToken = process.env.API_TOKEN;
if (!apiToken) throw new Error('API_TOKEN is required');

const requireApiToken: MiddlewareHandler = async (c, next) => {
  if (c.req.header('authorization') !== `Bearer ${apiToken}`) {
    return c.json({ error: 'Unauthorized' }, 401);
  }
  await next();
};

const app = new Hono();
app.get('/health', (c) => c.json({ ok: true }));
app.use('/agents/*', requireApiToken);
app.use('/workflows/*', requireApiToken);
app.use('/runs/*', requireApiToken);
app.use('/channels/*', requireApiToken);
app.route('/', flue());

export default app;

The Part 2 workflow is private until its module exports a route. Add this to src/workflows/review.ts so the curl examples below exist; the application middleware still supplies authentication:

import type { WorkflowRouteHandler } from '@flue/runtime';

export const route: WorkflowRouteHandler = async (_c, next) => next();

The health route is public. Agent, workflow, run, and channel routes require the bearer token. This is a minimal single-credential example, not a complete identity or authorization system. Multi-user services must authorize access to the selected agent instance or run.

Exposure is not authorization. An agent or workflow route must be exported before it exists; trusted middleware decides who may use it. A workflow's separate runs export exposes and can authorize its run resources. Without it, existing and unknown runs both return a generic 404.

Environment, build, and run

Keep secrets outside source control. flue build can load a project-root .env while evaluating the build, but it does not package those credentials into the generated server. Production should inject environment variables through its host or secret manager.

Do not set FLUE_MODE, FLUE_CLI_*, or FLUE_INTERNAL_CLI_IPC; Flue reserves them. Production must not run with FLUE_MODE=local.

npx flue build --target node
node dist/server.mjs

The default output is dist/. Dependencies remain external, so the deployment still needs the project's node_modules. The server listens on port 3000 by default; set PORT when your platform requires another port.

curl http://localhost:3000/health

curl http://localhost:3000/workflows/review \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"text":"Deploy every change directly to production."}'

Without ?wait=result, successful workflow admission returns 202 with a runId; it does not return the completed result. Append ?wait=result when the caller should remain attached until completion:

curl 'http://localhost:3000/workflows/review?wait=result' \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"text":"Deploy every change directly to production."}'

Keep liveness checks fast. Put dependency checks in a separate readiness endpoint.

Sandbox boundaries

The default virtual sandbox starts with an empty filesystem, but it is not a network-isolation boundary. A local sandbox can access host files and commands, so run it only inside a trusted container, CI runner, or virtual machine and pass only the environment variables its shell needs.

Use a remote sandbox when work must not run on the application host. Its command, network, isolation, persistence, and lifecycle behavior depends on the adapter. HTTP authentication and sandbox isolation solve different problems.

Sources

• Routing
• Deploy on Node.js
• Sandboxes

Next, continue to Part 7: Operate Like an Expert.