@danypops/jittor 0.9.0 → 0.11.0

package/src/constants.ts

@@ -91,6 +91,13 @@ export const MAX_USAGE_BUCKETS = 120;
 /** Defense-in-depth cap on the SQL-side usage aggregation result: (scopes x metrics x buckets) is already small by construction, but this bounds it explicitly rather than trusting that alone. */
 export const USAGE_AGGREGATE_MAX_ROWS = 25_000;
 export const MAX_DYNAMIC_ROUTES = 100;
+/** Bounds concurrent in-memory Pi router scopes; the least recently used non-global scope is evicted. */
+export const ROUTER_MAX_SESSION_SCOPES = 500;
+export const ROUTER_SESSION_ID_MAX_CHARACTERS = 128;
+/** Hard cap on registered session_identities rows; oldest-seen identity is evicted beyond this. */
+export const SESSION_IDENTITY_MAX_ROWS = 2_000;
+/** Bounds one metrics.record_batch call; a real per-turn event batch (usage, headers, local-run metrics) is a handful of rows, never thousands. */
+export const METRIC_BATCH_MAX_OBSERVATIONS = 100;
 export const CODEX_ERROR_MESSAGE_LIMIT = 160;
 export const CODEX_RETRY_AFTER_MAX_MS = 5 * MILLISECONDS_PER_MINUTE;
 export const CODEX_RECOVERY_BASE_DELAY_MS = 2 * MILLISECONDS_PER_SECOND;

package/src/daemon.ts

@@ -12,6 +12,8 @@ import { BenchmarkCatalog } from "./domain/benchmark.ts";
 import { EvidenceModelRanker } from "./domain/model-ranking-service.ts";
 import { createApp, JittorService } from "./service.ts";
 import { JittorRouter } from "./router.ts";
+import { SQLiteSessionIdentityStore } from "./adapters/sqlite-session-identity-store.ts";
+import { SessionIdentity } from "./session-identity-service.ts";
 import type { BenchmarkSource } from "./ports/benchmark-source.ts";
 import type { TelemetrySource } from "./ports/telemetry-source.ts";
 import { CodexTelemetrySource, GoogleVertexBudgetTelemetrySource, OpenRouterTelemetrySource } from "./providers/telemetry-sources.ts";
@@ -39,6 +41,12 @@ export function benchmarkSourcesFromEnvironment(env: Record<string, string | und
 	return sources;
 }
 
+function googleVertexMetricSource(value: string | undefined): GoogleVertexMetricSource {
+	if (value === undefined || value === "google-vertex") return "google-vertex";
+	if (value === "anthropic-vertex") return "anthropic-vertex";
+	throw new Error("JITTOR_GOOGLE_VERTEX_BUDGET_SOURCE must be google-vertex or anthropic-vertex");
+}
+
 export function telemetrySourcesFromEnvironment(env: Record<string, string | undefined> = process.env): TelemetrySource[] {
 	const sources: TelemetrySource[] = [];
 	const codexAuthFile = env["JITTOR_CODEX_AUTH_FILE"];
@@ -49,7 +57,7 @@ export function telemetrySourcesFromEnvironment(env: Record<string, string | und
 	// docs/PROVIDER_RESEARCH.md), so its absence must never attempt ADC discovery or a network call.
 	const vertexBudgetSubscription = env["JITTOR_GOOGLE_VERTEX_BUDGET_SUBSCRIPTION"];
 	if (vertexBudgetSubscription) {
-		const source = (env["JITTOR_GOOGLE_VERTEX_BUDGET_SOURCE"] ?? "google-vertex") as GoogleVertexMetricSource;
+		const source = googleVertexMetricSource(env["JITTOR_GOOGLE_VERTEX_BUDGET_SOURCE"]);
 		const tokenProvider = createGoogleAdcTokenProvider([GOOGLE_PUBSUB_READONLY_SCOPE]);
 		sources.push(new GoogleVertexBudgetTelemetrySource(vertexBudgetSubscription, tokenProvider, Date.now, fetch, source));
 	}
@@ -71,7 +79,9 @@ export function startDaemon(
 	env: Record<string, string | undefined> = process.env,
 ): RunningDaemon {
 	const token = ensureAuthToken(paths);
-	const metrics = new SQLiteMetricStore(openJittorDb(paths.database));
+	const db = openJittorDb(paths.database);
+	const metrics = new SQLiteMetricStore(db);
+	const sessionIdentity = new SessionIdentity(new SQLiteSessionIdentityStore(db));
 	const sources = telemetrySourcesFromEnvironment(env);
 	const benchmarkSources = benchmarkSourcesFromEnvironment(env);
 	const benchmarkStore = new MetricBenchmarkStore(metrics);
@@ -84,7 +94,7 @@ export function startDaemon(
 		routes: [],
 		currentRoute: UNCONFIGURED_ROUTE,
 	});
-	const service = new JittorService(metrics, router, benchmarks, modelRanker);
+	const service = new JittorService(metrics, router, benchmarks, modelRanker, sessionIdentity);
 
 	const daemon = startDaemonKit({
 		daemonLabel: "Jittor",

package/src/db.ts

@@ -19,6 +19,17 @@ CREATE INDEX metric_observations_time_idx
 	ON metric_observations(observed_at);
 `;
 
+const SESSION_IDENTITY_SCHEMA = `
+CREATE TABLE session_identities (
+	session_id    TEXT PRIMARY KEY,
+	secret_hash   TEXT NOT NULL,
+	registered_at TEXT NOT NULL,
+	last_seen_at  TEXT NOT NULL
+);
+CREATE INDEX session_identities_last_seen_idx
+	ON session_identities(last_seen_at);
+`;
+
 /**
  * Delegates bootstrap (pragmas, migration engine) to `@danypops/daemon-kit/storage`, which
  * generalizes the byte-identical pragma/PRAGMA-user_version skeleton jittor's own db.ts used to
@@ -28,6 +39,9 @@ export function openJittorDb(path: string): Database {
 	return openSqliteWithPragmas(path, {
 		databaseOptions: { create: true, strict: true },
 		busyTimeoutMs: SQLITE_BUSY_TIMEOUT_MS,
-		migrations: [{ version: 1, up: (db) => db.exec(INITIAL_SCHEMA) }],
+		migrations: [
+			{ version: 1, up: (db) => db.exec(INITIAL_SCHEMA) },
+			{ version: 2, up: (db) => db.exec(SESSION_IDENTITY_SCHEMA) },
+		],
 	});
 }

package/src/domain/task-cost.ts

@@ -1,5 +1,16 @@
 import type { StoredMetricObservation } from "./metric.ts";
 
+export interface TaskCostBreakdown {
+	provider: string;
+	model: string;
+	thinking: string;
+	costUsd: number;
+	inputTokens: number;
+	outputTokens: number;
+	cacheReadTokens: number;
+	cacheWriteTokens: number;
+}
+
 export interface TaskCostEntry {
 	taskId: string;
 	costUsd: number;
@@ -7,6 +18,7 @@ export interface TaskCostEntry {
 	outputTokens: number;
 	cacheReadTokens: number;
 	cacheWriteTokens: number;
+	byModel: TaskCostBreakdown[];
 }
 
 export interface TaskCostSummary {
@@ -25,20 +37,35 @@ export interface TaskCostSummaryOptions {
 
 const TOKEN_METRICS = new Set(["input-tokens", "output-tokens", "cache-read-tokens", "cache-write-tokens"]);
 
+function attributeText(attributes: Record<string, unknown>, key: string): string {
+	return typeof attributes[key] === "string" && attributes[key].length > 0 ? attributes[key] : "unknown";
+}
+
 function entryFor(byTask: Map<string, TaskCostEntry>, taskId: string): TaskCostEntry {
 	const existing = byTask.get(taskId);
 	if (existing) return existing;
-	const created: TaskCostEntry = { taskId, costUsd: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 };
+	const created: TaskCostEntry = { taskId, costUsd: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, byModel: [] };
 	byTask.set(taskId, created);
 	return created;
 }
 
+function breakdownFor(byModel: Map<string, TaskCostBreakdown>, provider: string, model: string, thinking: string): TaskCostBreakdown {
+	const key = `${provider}\u0000${model}\u0000${thinking}`;
+	const existing = byModel.get(key);
+	if (existing) return existing;
+	const created: TaskCostBreakdown = { provider, model, thinking, costUsd: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 };
+	byModel.set(key, created);
+	return created;
+}
+
 /**
  * Groups already-recorded "pi" source cost/token metrics by the Papyrus task focused when each was
- * recorded (see the papyrus.task-focus.v1 real-time tagging in the extension), rather than by
- * provider/model identity. Rows recorded with nothing focused have no attributes.taskId and are
- * reported separately as unattributedCostUsd -- they are real spend, just not attributable to any
- * task, and must never be silently dropped or folded into an invented "unknown" task bucket.
+ * recorded (see the papyrus.task-focus.v1 real-time tagging in the extension), with a secondary
+ * breakdown per provider/model/thinking within each task. Rows recorded with nothing focused have
+ * no attributes.taskId and are reported separately as unattributedCostUsd -- they are real spend,
+ * just not attributable to any task, and must never be silently dropped or folded into an invented
+ * "unknown" task bucket. A row missing provider/model/thinking (recorded before that attribution
+ * existed) falls into an "unknown" breakdown bucket instead, since the task-level total is real.
  *
  * This queries a single bounded time window without per-task fairness partitioning (unlike
  * buildUsageGraph/buildCostGraph's per-scope fetch): a task's own working period is typically a far
@@ -48,6 +75,7 @@ function entryFor(byTask: Map<string, TaskCostEntry>, taskId: string): TaskCostE
  */
 export function buildTaskCostSummary(rows: StoredMetricObservation[], options: TaskCostSummaryOptions): TaskCostSummary {
 	const byTask = new Map<string, TaskCostEntry>();
+	const byTaskModel = new Map<string, Map<string, TaskCostBreakdown>>();
 	let unattributedCostUsd = 0;
 	for (const row of rows) {
 		if (row.source !== "pi" || typeof row.value !== "number" || !Number.isFinite(row.value) || row.value < 0) continue;
@@ -56,14 +84,21 @@ export function buildTaskCostSummary(rows: StoredMetricObservation[], options: T
 		if (row.metric === "cost" && row.unit === "usd") {
 			if (taskId === undefined) { unattributedCostUsd += row.value; continue; }
 			entryFor(byTask, taskId).costUsd += row.value;
+			if (!byTaskModel.has(taskId)) byTaskModel.set(taskId, new Map());
+			breakdownFor(byTaskModel.get(taskId)!, attributeText(row.attributes, "provider"), attributeText(row.attributes, "model"), attributeText(row.attributes, "thinking")).costUsd += row.value;
 			continue;
 		}
 		if (taskId === undefined || row.unit !== "tokens" || !TOKEN_METRICS.has(row.metric)) continue;
 		const entry = entryFor(byTask, taskId);
-		if (row.metric === "input-tokens") entry.inputTokens += row.value;
-		else if (row.metric === "output-tokens") entry.outputTokens += row.value;
-		else if (row.metric === "cache-read-tokens") entry.cacheReadTokens += row.value;
-		else entry.cacheWriteTokens += row.value;
+		if (!byTaskModel.has(taskId)) byTaskModel.set(taskId, new Map());
+		const breakdown = breakdownFor(byTaskModel.get(taskId)!, attributeText(row.attributes, "provider"), attributeText(row.attributes, "model"), attributeText(row.attributes, "thinking"));
+		if (row.metric === "input-tokens") { entry.inputTokens += row.value; breakdown.inputTokens += row.value; }
+		else if (row.metric === "output-tokens") { entry.outputTokens += row.value; breakdown.outputTokens += row.value; }
+		else if (row.metric === "cache-read-tokens") { entry.cacheReadTokens += row.value; breakdown.cacheReadTokens += row.value; }
+		else { entry.cacheWriteTokens += row.value; breakdown.cacheWriteTokens += row.value; }
+	}
+	for (const [taskId, entry] of byTask) {
+		entry.byModel = [...(byTaskModel.get(taskId)?.values() ?? [])].sort((left, right) => right.costUsd - left.costUsd || left.model.localeCompare(right.model));
 	}
 	const entries = [...byTask.values()].sort((left, right) => right.costUsd - left.costUsd || left.taskId.localeCompare(right.taskId));
 	return { since: options.since, until: options.until, entries, unattributedCostUsd, truncated: options.truncated === true };

package/src/operations/benchmark-operations.ts

@@ -0,0 +1,12 @@
+import type { BenchmarkQuery } from "../domain/benchmark.ts";
+import type { BenchmarkController } from "../ports/benchmark-controller.ts";
+import type { OperationHandlerMap } from "./types.ts";
+
+/** benchmark.* -- every operation whose only collaborator is the benchmark-controller port. */
+export function benchmarkOperations(benchmarks: BenchmarkController): OperationHandlerMap {
+	return {
+		"benchmark.refresh": (input) => benchmarks.refresh(input["force"] === true),
+		"benchmark.status": () => benchmarks.status(),
+		"benchmark.query": (input) => benchmarks.query(input as unknown as BenchmarkQuery),
+	};
+}

package/src/operations/context-operations.ts

@@ -0,0 +1,30 @@
+import { COMPACTION_DURATION_ESTIMATE_MAX_SAMPLES, CONTEXT_ASSESSMENT_DEFAULT_WINDOW_MS, CONTEXT_ASSESSMENT_QUERY_LIMIT } from "../constants.ts";
+import { assessContextTelemetry, estimateCompactionDuration } from "../domain/context-telemetry.ts";
+import type { MetricStore } from "../ports/metric-store.ts";
+import type { OperationHandlerMap } from "./types.ts";
+
+/** context.assess and compaction.estimate -- both read-only projections of recorded metrics, no router/session involvement. */
+export function contextOperations(metrics: MetricStore): OperationHandlerMap {
+	return {
+		"context.assess": (input) => {
+			const until = input["until"] === undefined ? Date.now() : input["until"];
+			const since = input["since"] === undefined && typeof until === "number" ? Math.max(0, until - CONTEXT_ASSESSMENT_DEFAULT_WINDOW_MS) : input["since"];
+			if (!Number.isSafeInteger(since) || !Number.isSafeInteger(until) || (since as number) < 0 || (until as number) < (since as number)) throw new Error("context assessment requires non-negative ordered integer bounds");
+			const query = { since: since as number, until: until as number, order: "asc" as const, limit: CONTEXT_ASSESSMENT_QUERY_LIMIT };
+			const injections = metrics.query({ ...query, source: "papyrus-context", metric: "injected-characters" });
+			const compactions = metrics.query({ ...query, source: "pi-context" });
+			return assessContextTelemetry(injections, compactions, {
+				since: since as number,
+				until: until as number,
+				truncated: injections.length >= CONTEXT_ASSESSMENT_QUERY_LIMIT || compactions.length >= CONTEXT_ASSESSMENT_QUERY_LIMIT,
+			});
+		},
+		"compaction.estimate": () => {
+			const rows = metrics.query({
+				source: "pi-context", scope: "compaction", metric: "compaction-duration",
+				order: "desc", limit: COMPACTION_DURATION_ESTIMATE_MAX_SAMPLES,
+			});
+			return estimateCompactionDuration(rows);
+		},
+	};
+}

package/src/operations/metrics-operations.ts

@@ -0,0 +1,77 @@
+import { MAX_USAGE_BUCKETS, METRIC_BATCH_MAX_OBSERVATIONS, PRUNE_MIN_AGE_MS, TASK_COST_QUERY_LIMIT, USAGE_MAX_DISTINCT_SCOPES } from "../constants.ts";
+import { validateMetricObservation, type MetricQuery } from "../domain/metric.ts";
+import { buildTaskCostSummary } from "../domain/task-cost.ts";
+import type { MetricStore } from "../ports/metric-store.ts";
+import type { OperationHandlerMap } from "./types.ts";
+
+/** metrics.* and service.checkpoint -- every operation whose only collaborator is the metric-store port. */
+export function metricsOperations(metrics: MetricStore): OperationHandlerMap {
+	return {
+		"metrics.record": (input) => metrics.record(validateMetricObservation(input)),
+		"metrics.record_batch": (input) => {
+			const observations = input["observations"];
+			if (!Array.isArray(observations) || observations.length === 0) throw new Error("observations must be a non-empty array");
+			if (observations.length > METRIC_BATCH_MAX_OBSERVATIONS) throw new Error(`observations must contain at most ${METRIC_BATCH_MAX_OBSERVATIONS} entries`);
+			return metrics.recordBatch(observations.map((observation) => validateMetricObservation(observation)));
+		},
+		"metrics.query": (input) => metrics.query(input as MetricQuery),
+		"metrics.distinct_scopes": (input) => {
+			const source = input["source"];
+			const since = input["since"];
+			const until = input["until"];
+			if (typeof source !== "string" || source.length === 0) throw new Error("source is required");
+			if (!Number.isSafeInteger(since) || !Number.isSafeInteger(until) || (since as number) < 0 || (until as number) < (since as number)) {
+				throw new Error("distinct scopes requires non-negative ordered integer bounds");
+			}
+			const requestedLimit = input["limit"];
+			const limit = Number.isFinite(requestedLimit) ? Math.max(1, Math.min(USAGE_MAX_DISTINCT_SCOPES, Math.floor(requestedLimit as number))) : USAGE_MAX_DISTINCT_SCOPES;
+			return metrics.distinctScopes({ source, since: since as number, until: until as number, limit });
+		},
+		"metrics.usage_series": (input) => {
+			const source = input["source"];
+			const since = input["since"];
+			const until = input["until"];
+			const bucketSizeMs = input["bucketSizeMs"];
+			const bucketCount = input["bucketCount"];
+			if (typeof source !== "string" || source.length === 0) throw new Error("source is required");
+			if (!Number.isSafeInteger(since) || !Number.isSafeInteger(until) || (since as number) < 0 || (until as number) < (since as number)) {
+				throw new Error("usage series requires non-negative ordered integer bounds");
+			}
+			if (typeof bucketSizeMs !== "number" || !Number.isFinite(bucketSizeMs) || bucketSizeMs <= 0) throw new Error("bucketSizeMs must be a positive number");
+			if (!Number.isInteger(bucketCount) || (bucketCount as number) <= 0 || (bucketCount as number) > MAX_USAGE_BUCKETS) {
+				throw new Error(`bucketCount must be a positive integer up to ${MAX_USAGE_BUCKETS}`);
+			}
+			const requestedScopeLimit = input["scopeLimit"];
+			const scopeLimit = Number.isFinite(requestedScopeLimit) ? Math.max(1, Math.min(USAGE_MAX_DISTINCT_SCOPES, Math.floor(requestedScopeLimit as number))) : USAGE_MAX_DISTINCT_SCOPES;
+			const scopes = metrics.distinctScopes({ source, since: since as number, until: until as number, limit: scopeLimit });
+			// More distinct scopes may exist beyond this bounded list -- that is the only remaining
+			// truncation risk once aggregation replaces a per-scope raw-row fetch (see aggregateUsage's
+			// own doc comment for the incident this was built to stop repeating).
+			const truncated = scopes.length >= scopeLimit;
+			const rows = scopes.length === 0 ? [] : metrics.aggregateUsage({
+				source, scopes, since: since as number, until: until as number, bucketSizeMs, bucketCount: bucketCount as number,
+			});
+			return { rows, truncated };
+		},
+		"metrics.cost_by_task": (input) => {
+			const since = input["since"];
+			const until = input["until"];
+			if (!Number.isSafeInteger(since) || !Number.isSafeInteger(until) || (since as number) < 0 || (until as number) < (since as number)) {
+				throw new Error("cost by task requires non-negative ordered integer bounds");
+			}
+			const rows = metrics.query({ source: "pi", since: since as number, until: until as number, order: "desc", limit: TASK_COST_QUERY_LIMIT });
+			return buildTaskCostSummary(rows, { since: since as number, until: until as number, truncated: rows.length >= TASK_COST_QUERY_LIMIT });
+		},
+		"metrics.prune": (input) => {
+			const before = input["before"];
+			if (typeof before !== "number") throw new Error("before is required");
+			const force = input["force"] === true;
+			const minCutoff = Date.now() - PRUNE_MIN_AGE_MS;
+			if (!force && before > minCutoff) {
+				throw new Error(`refusing to prune metrics newer than ${new Date(minCutoff).toISOString()} without force: true (this looked like it could delete recent or live data)`);
+			}
+			return { deleted: metrics.pruneBefore(before) };
+		},
+		"service.checkpoint": () => { metrics.checkpoint(); return { ok: true }; },
+	};
+}

package/src/operations/model-ranking-operations.ts

@@ -0,0 +1,16 @@
+import type { ModelRanker, ModelRecommendationInput } from "../domain/model-ranking-service.ts";
+import type { RouterController } from "../ports/router-controller.ts";
+import type { OperationHandlerMap } from "./types.ts";
+
+/** models.rank -- scores candidates via the model ranker, then, only for an automatic selection, applies it as a router mutation (so it shares the same session-identity authorization as every other router mutation). */
+export function modelRankingOperations(modelRanker: ModelRanker, router: RouterController, authorize: (input: Record<string, unknown>) => string | undefined): OperationHandlerMap {
+	return {
+		"models.rank": (input) => {
+			const result = modelRanker.rank(input as unknown as ModelRecommendationInput);
+			if (result.automaticSelection && router.applyModelRanking) {
+				router.applyModelRanking(result.ranked.map((item) => item.candidate), authorize(input));
+			}
+			return result;
+		},
+	};
+}

package/src/operations/router-operations.ts

@@ -0,0 +1,19 @@
+import type { RouteOverride, RouterController } from "../ports/router-controller.ts";
+import type { Route } from "../policy.ts";
+import type { OperationHandlerMap } from "./types.ts";
+import { routerSessionId } from "./session-scope.ts";
+
+/** telemetry.poll and every router.* operation -- reads pass a bare session_id through; mutations run authorize first, matching the opt-in session-identity armor. */
+export function routerOperations(router: RouterController, authorize: (input: Record<string, unknown>) => string | undefined): OperationHandlerMap {
+	return {
+		"telemetry.poll": () => router.poll(),
+		"router.status": (input) => router.status(routerSessionId(input)),
+		"router.decide": (input) => router.decide(routerSessionId(input)),
+		"router.pause": (input) => router.pause(authorize(input)),
+		"router.resume": (input) => router.resume(authorize(input)),
+		"router.override": (input) => router.setOverride(input as unknown as RouteOverride, authorize(input)),
+		"router.clear_override": (input) => router.clearOverride(authorize(input)),
+		"router.current_route": (input) => router.setCurrentRoute(input as unknown as Route, authorize(input)),
+		"router.available_routes": (input) => router.setAvailableRoutes(Array.isArray(input["routes"]) ? input["routes"] as Route[] : [], authorize(input)),
+	};
+}

package/src/operations/session-identity-operations.ts

@@ -0,0 +1,15 @@
+import type { SessionIdentity } from "../session-identity-service.ts";
+import type { OperationHandlerMap } from "./types.ts";
+import { requiredString, routerSessionSecret } from "./session-scope.ts";
+
+/** session.register and session.release -- the only two operations that mutate SessionIdentity itself, distinct from the router mutations it later authorizes. */
+export function sessionIdentityOperations(sessionIdentity: SessionIdentity | undefined): OperationHandlerMap {
+	const require = (): SessionIdentity => {
+		if (!sessionIdentity) throw new Error("session identity is not configured");
+		return sessionIdentity;
+	};
+	return {
+		"session.register": (input) => require().register(requiredString(input, "session_id")),
+		"session.release": (input) => require().release(requiredString(input, "session_id"), routerSessionSecret(input)),
+	};
+}

package/src/operations/session-scope.ts

@@ -0,0 +1,31 @@
+import type { SessionIdentity } from "../session-identity-service.ts";
+
+/** Shared input parsing for every operation that accepts an optional session_id/session_secret pair. */
+export function routerSessionId(input: Record<string, unknown>): string | undefined {
+	const value = input["session_id"];
+	if (value === undefined) return undefined;
+	if (typeof value !== "string") throw new Error("session_id must be a string");
+	return value;
+}
+
+export function routerSessionSecret(input: Record<string, unknown>): string | undefined {
+	const value = input["session_secret"];
+	if (value === undefined) return undefined;
+	if (typeof value !== "string") throw new Error("session_secret must be a string");
+	return value;
+}
+
+export function requiredString(input: Record<string, unknown>, key: string): string {
+	const value = input[key];
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${key} is required`);
+	return value;
+}
+
+/** Opt-in armor: a session_id never registered via session.register mutates exactly as before. Bound once per JittorService instance and shared by every router-mutating operation module. */
+export function routerMutationAuthorizer(sessionIdentity: SessionIdentity | undefined): (input: Record<string, unknown>) => string | undefined {
+	return (input) => {
+		const sessionId = routerSessionId(input);
+		sessionIdentity?.assertAuthorized(sessionId, routerSessionSecret(input));
+		return sessionId;
+	};
+}

package/src/operations/types.ts

@@ -0,0 +1,3 @@
+/** One capability module's contribution to the operation dispatch table: a bounded set of operation names, each backed by a handler that only needs the collaborators its own factory was given. */
+export type OperationHandler = (input: Record<string, unknown>) => unknown | Promise<unknown>;
+export type OperationHandlerMap = Partial<Record<string, OperationHandler>>;

package/src/ports/metric-store.ts

@@ -20,6 +20,8 @@ export interface UsageAggregateFilter {
 
 export interface MetricStore {
 	record(observation: MetricObservation): StoredMetricObservation;
+	/** Validates and writes every observation in one atomic transaction: either all rows land, or none do -- a single-event RPC loop can otherwise leave a partially-persisted event when a later observation in the same event fails validation or the connection drops mid-loop. */
+	recordBatch(observations: MetricObservation[]): StoredMetricObservation[];
 	query(filter?: MetricQuery): StoredMetricObservation[];
 	/** Bounded distinct scope values for a source within a time window, so callers can fetch a fair share per scope instead of one flat query a single heavy scope could monopolize. */
 	distinctScopes(filter: DistinctScopesFilter): string[];

package/src/ports/router-controller.ts

@@ -31,13 +31,13 @@ export interface RouterStatus {
 
 export interface RouterController {
 	poll(): Promise<TelemetryPollResult>;
-	status(): RouterStatus;
-	decide(): PolicyDecision;
-	pause(): RouterStatus;
-	resume(): RouterStatus;
-	setOverride(override?: RouteOverride): RouterStatus;
-	clearOverride(): RouterStatus;
-	setCurrentRoute(route: Route): RouterStatus;
-	setAvailableRoutes(routes: Route[]): RouterStatus;
-	applyModelRanking?(candidates: Route[]): RouterStatus;
+	status(sessionId?: string): RouterStatus;
+	decide(sessionId?: string): PolicyDecision;
+	pause(sessionId?: string): RouterStatus;
+	resume(sessionId?: string): RouterStatus;
+	setOverride(override: RouteOverride | undefined, sessionId?: string): RouterStatus;
+	clearOverride(sessionId?: string): RouterStatus;
+	setCurrentRoute(route: Route, sessionId?: string): RouterStatus;
+	setAvailableRoutes(routes: Route[], sessionId?: string): RouterStatus;
+	applyModelRanking?(candidates: Route[], sessionId?: string): RouterStatus;
 }

package/src/ports/session-identity-store.ts

@@ -0,0 +1,5 @@
+import type { SessionIdentityRecord, SessionIdentityStore as DaemonKitSessionIdentityStore } from "@danypops/daemon-kit/session-identity";
+
+/** Jittor's persistence port for daemon-kit's storage-agnostic session-identity primitive. */
+export type SessionIdentityStore = DaemonKitSessionIdentityStore;
+export type { SessionIdentityRecord };

package/src/providers/telemetry-sources.ts

@@ -79,7 +79,7 @@ export class OpenRouterTelemetrySource implements TelemetrySource {
  */
 export class GoogleVertexBudgetTelemetrySource implements TelemetrySource {
 	readonly id: string;
-	readonly provider = "google-vertex";
+	readonly provider: GoogleVertexMetricSource;
 	readonly required = false;
 
 	private readonly adapter: GoogleVertexBudgetTelemetryAdapter;
@@ -92,6 +92,7 @@ export class GoogleVertexBudgetTelemetrySource implements TelemetrySource {
 		source: GoogleVertexMetricSource = "google-vertex",
 	) {
 		this.id = `google-vertex-budget:${source}`;
+		this.provider = source;
 		this.adapter = new GoogleVertexBudgetTelemetryAdapter(subscription, tokenProvider, transport, source);
 	}