> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# connectionEngine

> **get** `protected` **connectionEngine**(): [`AgentSocketServer`](/docs/agent-sdk/internals/the-socket-server)\<`State`>

The connection engine behind the folded surface — the agent's single
protocol server: one authorization policy, one watcher set, one broadcast
path.

The default [`webSocket`](/docs/agent-sdk/interface/webSocket) runs every socket
through this engine, and implicit publication ([`setState`](/docs/agent-sdk/interface/setState), `this.messages` appends, `this.events` emits) fans out from
it. Reading it here hands the SAME instance to another front door, so an
agent can serve more transports without a second server, a second policy,
or a second set of watchers to keep in sync. The canonical use is the
HTTP front door — Server-Sent Events over GET and RPC over POST:

```ts theme={null}
import { AgentHttpServer } from "@telnyx/edge-runtime/agent-http";

export class Desk extends Agent<Env, DeskState> {
  // Same claims policy the sockets get.
  override authorize(token: string | undefined): readonly Claim[] {
    return token === undefined ? ["read"] : ["read", "rpc"];
  }

  private door = new AgentHttpServer(this.connectionEngine);

  override fetch(req: Request): Promise<Response> {
    return this.door.fetch(req);
  }
}
```

The engine is created on first read and cached, so every read returns the
same instance — reading it from a field initializer (as above, at
construction time) is the intended usage and is always safe: it opens no
socket, reads no storage, and starts nothing.

Reading it is NOT an opt-in to the socket surface. `webSocket()` stays
gated on its own seams ([`authorize`](/docs/agent-sdk/interface/authorize) /
[`onAttach`](/docs/agent-sdk/interface/onAttach) / a `webSocket` override), because the
runtime hands an agent sockets unbidden — whereas a front door built over
this engine only ever receives what the subclass routes into it. An agent
that wires HTTP and overrides no seam therefore serves HTTP and still
refuses sockets with [AgentSocketsNotEnabledError](/docs/agent-sdk/interface/webSocket#agentsocketsnotenablederror).

Whatever policy the seams express applies identically on every front door
built over the engine: an unoverridden [`authorize`](/docs/agent-sdk/interface/authorize)
admits HTTP callers as read-only watchers too, and never grants `"rpc"`.

Added with SDK 0.12 — a new inherited member, so a subclass that already
declares `connectionEngine` must rename it (or align it to override this
accessor).

**Returns**

[`AgentSocketServer`](/docs/agent-sdk/internals/the-socket-server)\<`State`>

The agent's connection engine — the same instance on every read.