@premai/api-sdk 1.0.46 → 1.0.48

package/dist/index.mjs

@@ -166,7 +166,12 @@ async function attest(apiKey, options = { enabled: true }) {
 // src/utils/crypto.ts
 import { aeskwp } from "@noble/ciphers/aes.js";
 import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
-import { bytesToHex, hexToBytes, managedNonce, randomBytes } from "@noble/ciphers/utils.js";
+import {
+  bytesToHex,
+  hexToBytes,
+  managedNonce,
+  randomBytes
+} from "@noble/ciphers/utils.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { sha3_256 } from "@noble/hashes/sha3.js";
 import { XWing } from "@noble/post-quantum/hybrid.js";
@@ -420,7 +425,10 @@ function createAudioClient(apiKey, encryptionKeys, requestTimeoutMs = DEFAULT_RE
     const controller = new AbortController;
     const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
     try {
-      const sessionId = await attest(apiKey, { model: body.model, enabled: attest2 });
+      const sessionId = await attest(apiKey, {
+        model: body.model,
+        enabled: attest2
+      });
       const encryptedRequest = await preprocessAudioRequest(body, encryptionKeys);
       const response = await fetch(`${endpoints.proxy}/rvenc/audio/transcriptions`, {
         method: "POST",
@@ -452,7 +460,10 @@ function createAudioClient(apiKey, encryptionKeys, requestTimeoutMs = DEFAULT_RE
     const controller = new AbortController;
     const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
     try {
-      const sessionId = await attest(apiKey, { model: body.model, enabled: attest2 });
+      const sessionId = await attest(apiKey, {
+        model: body.model,
+        enabled: attest2
+      });
       const encryptedRequest = await preprocessAudioTranslationRequest(body, encryptionKeys);
       const response = await fetch(`${endpoints.proxy}/rvenc/audio/translations`, {
         method: "POST",
@@ -1143,7 +1154,10 @@ function createRvencChatClient(apiKey, encryptionKeys, requestTimeoutMs = DEFAUL
     const controller = new AbortController;
     const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
     try {
-      const sessionId = await attest(apiKey, { model: body.model, enabled: attest2 });
+      const sessionId = await attest(apiKey, {
+        model: body.model,
+        enabled: attest2
+      });
       const encryptedRequest = preprocessRequest(body, encryptionKeys);
       const response = await fetch(`${endpoints.proxy}/rvenc/chat/completions`, {
         method: "POST",
@@ -1265,7 +1279,11 @@ async function* createDecryptedStreamGenerator(reader, sharedSecret, nonce, maxB
 
 // src/tools/index.ts
 import { bytesToHex as bytesToHex6, hexToBytes as hexToBytes6, randomBytes as randomBytes4 } from "@noble/ciphers/utils.js";
-var FILE_OUTPUT_TOOLS = ["generateImage", "audioGenerateFromText", "createFileForUser"];
+var FILE_OUTPUT_TOOLS = [
+  "generateImage",
+  "audioGenerateFromText",
+  "createFileForUser"
+];
 var FILE_INPUT_TOOLS = [
   "imageDescribeAndCaption",
   "imageDescribeAndCaptionFallback",
@@ -1324,7 +1342,9 @@ async function downloadEncryptedFile(fileId, apiKey, timeoutMs) {
     if (!downloadUrl) {
       throw new Error("No download URL in response");
     }
-    const fileResponse = await fetch(downloadUrl, { signal: controller.signal });
+    const fileResponse = await fetch(downloadUrl, {
+      signal: controller.signal
+    });
     if (!fileResponse.ok) {
       throw new Error(`Failed to download file: ${fileResponse.status}`);
     }
@@ -1932,6 +1952,10 @@ function anthropicMessagesCreateToOpenAI(body) {
     messages.push(...systemToOpenAiMessages(body.system));
   }
   for (const m of body.messages) {
+    if (m.role === "system") {
+      messages.push(...systemToOpenAiMessages(m.content));
+      continue;
+    }
     if (m.role !== "user" && m.role !== "assistant") {
       throw new AnthropicRequestValidationError(`Invalid message role "${m.role}".`);
     }
@@ -2356,7 +2380,8 @@ function toAnthropicModel(model) {
     type: "model",
     id: model.model,
     display_name: model.name || model.model,
-    created_at: model.created_at
+    created_at: model.created_at,
+    description: model.description
   };
 }
 function filterEnabled(models) {
@@ -2451,8 +2476,8 @@ function registerAnthropicModelsRoute(router, deps) {
 
 // src/server/runtime.ts
 import multer from "multer";
-var DEFAULT_HOST = process.env.HOST ?? "127.0.0.1";
-var DEFAULT_PORT = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : 8000;
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_PORT = 8787;
 var CLIENT_CACHE_MAX = (() => {
   let cacheTTL = 256;
   const raw = process.env.CLIENT_CACHE_MAX;
@@ -2482,9 +2507,7 @@ function applyServerOptions(options) {
   if (enclaveUrl) {
     serverEnclaveUrl = enclaveUrl;
   }
-  if (kek) {
-    serverKek = kek;
-  }
+  serverKek = kek || generateNewClientKEK();
 }
 async function getOrCreateRvencClient(apiKey) {
   const existing = clientCache.get(apiKey);
@@ -2703,6 +2726,40 @@ function registerOpenAICompatRoutes(router, deps) {
   });
 }
 
+// src/utils/debug.ts
+import { existsSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import envPaths from "env-paths";
+import winston from "winston";
+var defaultLogFile = `${envPaths("confidential-proxy").data}/confidential-proxy.log`;
+var dir = dirname(defaultLogFile);
+try {
+  if (!existsSync(dir))
+    mkdirSync(dir, { recursive: true });
+} catch {}
+var level = process.env.CONFIDENTIAL_PROXY_LOG_LEVEL ?? "info";
+var fileTransport = new winston.transports.File({
+  filename: defaultLogFile,
+  level,
+  maxsize: 10 * 1024 * 1024,
+  maxFiles: 3,
+  format: winston.format.combine(winston.format.timestamp({ format: "YYYY-MM-DDTHH:mm:ss.SSSZ" }), winston.format.json())
+});
+var consoleTransport = new winston.transports.Console({
+  level,
+  format: winston.format.combine(winston.format.timestamp({ format: "YYYY-MM-DDTHH:mm:ss.SSSZ" }), winston.format.printf(({ timestamp, level: level2, message, ...rest }) => {
+    const meta = Object.keys(rest).length ? ` ${JSON.stringify(rest)}` : "";
+    return `[${timestamp}] [${level2}] ${message}${meta}`;
+  }))
+});
+var logger = winston.createLogger({
+  level,
+  transports: [fileTransport, consoleTransport]
+});
+
+// src/server/discovery.ts
+import { readFileSync } from "node:fs";
+
 // src/server/route-prefix.ts
 function normalizeRoutePrefix(raw) {
   if (raw == null) {
@@ -2737,6 +2794,9 @@ function prefixedRoute(prefix, path) {
 }
 
 // src/server/discovery.ts
+var pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+var SERVER_MESSAGE = "Rvenc API Server";
+var SERVER_VERSION = pkg.version;
 function registerApiDiscoveryRoute(app, mount) {
   const {
     openai: mountOpenAI,
@@ -2766,8 +2826,8 @@ function registerApiDiscoveryRoute(app, mount) {
       labels.push("Anthropic Messages-compatible");
     }
     res.json({
-      message: `Rvenc API Server (${labels.join(" + ")})`,
-      version: "1.0.0",
+      message: `${SERVER_MESSAGE} (${labels.join(" + ")})`,
+      version: SERVER_VERSION,
       compat: resolveCompatLabel(mount),
       route_prefixes: buildRoutePrefixesPayload(mountOpenAI, mountAnthropic, openaiPrefix, anthropicPrefix),
       endpoints: endpoints2
@@ -2797,7 +2857,66 @@ function resolveCompatLabel(mount) {
   return "openai";
 }
 
+// src/server/request-debug.ts
+function requestDebugMiddleware(req, res, next) {
+  const start = Date.now();
+  const method = req.method;
+  const path = req.path;
+  logger.debug("request", { method, path });
+  res.on("finish", () => {
+    const elapsed = Date.now() - start;
+    const status = res.statusCode;
+    const contentLength = res.getHeader("content-length") ?? res.get("content-length");
+    logger.debug("response", {
+      method,
+      path,
+      status,
+      elapsedMs: elapsed,
+      contentLength
+    });
+  });
+  next();
+}
+
+// src/server/shutdown-route.ts
+import { timingSafeEqual } from "node:crypto";
+var LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+function isLoopback(addr) {
+  return !!addr && LOOPBACK.has(addr);
+}
+function hexBuf(s) {
+  if (!s || s.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(s))
+    return null;
+  return Buffer.from(s, "hex");
+}
+function registerShutdownRoute(app, hooks) {
+  const expected = Buffer.from(hooks.token, "hex");
+  app.post("/__shutdown", (req, res) => {
+    if (!isLoopback(req.socket.remoteAddress)) {
+      logger.debug("shutdown rejected: non-loopback", {
+        remote: req.socket.remoteAddress
+      });
+      res.status(403).end();
+      return;
+    }
+    const provided = hexBuf(req.header("x-shutdown-token") ?? "");
+    if (!provided || provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+      res.status(401).end();
+      return;
+    }
+    logger.debug("shutdown accepted");
+    res.status(202).end();
+    setImmediate(() => {
+      hooks.onShutdown().catch((err) => logger.debug("shutdown error", { error: String(err) })).finally(() => process.exit(0));
+    });
+  });
+}
+
 // src/server/create-app.ts
+var draining = false;
+function setDraining(value) {
+  draining = value;
+}
 var rvencDeps = {
   getOrCreateClient: getOrCreateRvencClient
 };
@@ -2819,7 +2938,8 @@ function resolveCreateServerInput(compatOrOptions) {
       compat: compat2,
       openaiPrefix: openaiPrefix2,
       anthropicPrefix: anthropicPrefix2,
-      jsonBodyLimit: resolveJsonBodyLimit()
+      jsonBodyLimit: resolveJsonBodyLimit(),
+      shutdown: undefined
     };
   }
   const compat = compatOrOptions.compat ?? "openai";
@@ -2828,7 +2948,8 @@ function resolveCreateServerInput(compatOrOptions) {
     compat,
     openaiPrefix,
     anthropicPrefix,
-    jsonBodyLimit: resolveJsonBodyLimit(compatOrOptions.jsonBodyLimit)
+    jsonBodyLimit: resolveJsonBodyLimit(compatOrOptions.jsonBodyLimit),
+    shutdown: compatOrOptions.shutdown
   };
 }
 function httpErrorStatus(err) {
@@ -2845,11 +2966,51 @@ function mountRouter(app, prefix, router) {
   app.use(prefix || "/", router);
 }
 function createServerApp(compatOrOptions = "openai") {
-  const { compat, openaiPrefix, anthropicPrefix, jsonBodyLimit } = resolveCreateServerInput(compatOrOptions);
+  const { compat, openaiPrefix, anthropicPrefix, jsonBodyLimit, shutdown } = resolveCreateServerInput(compatOrOptions);
   const mountOpenAI = compat === "openai" || compat === "both";
   const mountAnthropic = compat === "anthropic" || compat === "both";
+  const isAnthropicRequest = (req) => {
+    if (!mountAnthropic) {
+      return false;
+    }
+    if (!mountOpenAI) {
+      return true;
+    }
+    return req.path === anthropicPrefix || req.path.startsWith(`${anthropicPrefix}/`);
+  };
   const app = express();
+  app.use((req, res, next) => {
+    if (draining) {
+      logger.debug("drain-reject", { method: req.method, path: req.path });
+      if (!res.headersSent) {
+        res.setHeader("Connection", "close");
+        res.setHeader("Retry-After", "5");
+        if (isAnthropicRequest(req)) {
+          const requestId = newAnthropicRequestId();
+          res.setHeader("request-id", requestId);
+          res.status(503).json({
+            type: "error",
+            error: {
+              type: httpStatusToAnthropicErrorType(503),
+              message: "Server is shutting down"
+            },
+            request_id: requestId
+          });
+        } else {
+          res.status(503).json({
+            error: {
+              message: "Server is shutting down",
+              type: "server_error"
+            }
+          });
+        }
+      }
+      return;
+    }
+    next();
+  });
   app.use(express.json({ limit: jsonBodyLimit }));
+  app.use(requestDebugMiddleware);
   registerApiDiscoveryRoute(app, {
     openai: mountOpenAI,
     anthropic: mountAnthropic,
@@ -2868,18 +3029,18 @@ function createServerApp(compatOrOptions = "openai") {
     registerAnthropicModelsRoute(router, rvencDeps);
     mountRouter(app, anthropicPrefix, router);
   }
-  const isAnthropicRequest = (req) => {
-    if (!mountAnthropic) {
-      return false;
-    }
-    if (!mountOpenAI) {
-      return true;
-    }
-    return req.path === anthropicPrefix || req.path.startsWith(`${anthropicPrefix}/`);
-  };
+  if (shutdown) {
+    registerShutdownRoute(app, shutdown);
+  }
   app.use((err, req, res, _next) => {
     const status = httpErrorStatus(err);
     const message = err instanceof Error ? err.message : "Internal server error";
+    logger.debug("request-error", {
+      method: req.method,
+      path: req.path,
+      status,
+      message
+    });
     if (isAnthropicRequest(req)) {
       const requestId = newAnthropicRequestId();
       res.setHeader("request-id", requestId);
@@ -2902,6 +3063,7 @@ function createServerApp(compatOrOptions = "openai") {
   });
   app.use((req, res) => {
     const message = `Route ${req.method} ${req.path} not found`;
+    logger.debug("route-not-found", { method: req.method, path: req.path });
     if (isAnthropicRequest(req)) {
       const requestId = newAnthropicRequestId();
       res.setHeader("request-id", requestId);
@@ -2921,7 +3083,149 @@ function createServerApp(compatOrOptions = "openai") {
   });
   return app;
 }
+// src/server/create-drain-wrapper.ts
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 30000;
+function createDrainingServer(app, port, host, opts = {}) {
+  const timeoutMs = opts.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
+  const activeSockets = new Set;
+  return new Promise((resolve, reject) => {
+    const server = app.listen(port, host, () => {
+      server.on("connection", (socket) => {
+        activeSockets.add(socket);
+        socket.once("close", () => activeSockets.delete(socket));
+      });
+      const { port: boundPort } = server.address();
+      resolve({
+        port: boundPort,
+        close: () => {
+          setDraining(true);
+          server.close();
+        },
+        shutdown: async (customTimeout) => {
+          const deadline = customTimeout ?? timeoutMs;
+          setDraining(true);
+          server.close();
+          const deadlineTime = Date.now() + deadline;
+          while (activeSockets.size > 0 && Date.now() < deadlineTime) {
+            await new Promise((r) => setTimeout(r, 100));
+          }
+          for (const socket of activeSockets) {
+            socket.destroy();
+          }
+        }
+      });
+    });
+    server.on("error", (err) => {
+      if (err.code === "EADDRINUSE") {
+        const e = new Error(`Port ${port} is already in use`);
+        e.code = "EADDRINUSE";
+        reject(e);
+      } else {
+        reject(err);
+      }
+    });
+  });
+}
+// src/utils/poll-ready.ts
+async function isProxyRoot(baseUrl) {
+  try {
+    const res = await fetch(`${baseUrl}/`, {
+      signal: AbortSignal.timeout(2000)
+    });
+    if (!res.ok)
+      return false;
+    const body = await res.json();
+    return typeof body === "object" && body !== null && typeof body.message === "string" && body.message.startsWith(SERVER_MESSAGE);
+  } catch {
+    return false;
+  }
+}
+async function pollForReadiness(baseUrl, timeoutMs = 30000) {
+  const deadline = Date.now() + timeoutMs;
+  let backoff = 200;
+  while (Date.now() < deadline) {
+    if (await isProxyRoot(baseUrl))
+      return;
+    await new Promise((r) => setTimeout(r, backoff));
+    backoff = Math.min(backoff * 1.5, 2000);
+  }
+  throw new Error(`Proxy did not become reachable within ${timeoutMs}ms`);
+}
+
+// src/utils/state-file.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { dirname as dirname2 } from "node:path";
+import { bytesToHex as bytesToHex8, randomBytes as randomBytes6 } from "@noble/ciphers/utils.js";
+import envPaths2 from "env-paths";
+var appData = envPaths2("confidential-proxy");
+function defaultStateFile() {
+  return `${appData.data}/proxy.state.json`;
+}
+function writeStateFile(path, state) {
+  const dir2 = dirname2(path);
+  if (!existsSync2(dir2))
+    mkdirSync2(dir2, { recursive: true });
+  writeFileSync(path, JSON.stringify(state), { mode: 384 });
+}
+function removeStateFile(path) {
+  try {
+    if (existsSync2(path))
+      unlinkSync(path);
+  } catch {}
+}
+function generateShutdownToken() {
+  return bytesToHex8(randomBytes6(32));
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function acquireDaemonLock(stateFile) {
+  const lockFile = `${stateFile}.lock`;
+  mkdirSync2(dirname2(lockFile), { recursive: true });
+  try {
+    writeFileSync(lockFile, String(process.pid), { flag: "wx" });
+  } catch (err) {
+    if (err.code !== "EEXIST")
+      throw err;
+    const lockPid = parseInt(readFileSync2(lockFile, "utf-8").trim(), 10);
+    if (Number.isFinite(lockPid) && lockPid > 0 && isProcessAlive(lockPid)) {
+      throw new Error(`Daemon lock is held by PID ${lockPid}. Another instance may already be running.`);
+    }
+    unlinkSync(lockFile);
+    writeFileSync(lockFile, String(process.pid), { flag: "wx" });
+  }
+  return () => {
+    try {
+      unlinkSync(lockFile);
+    } catch {}
+  };
+}
+
 // src/server/start.ts
+var SHUTDOWN_TOKEN_ENV = "CONFIDENTIAL_PROXY_SHUTDOWN_TOKEN";
+var DAEMON_CHILD_ENV = "CONFIDENTIAL_PROXY_DAEMON_CHILD";
+async function bindServer(app, host, port, allowFallback, shutdownTimeoutMs) {
+  try {
+    return await createDrainingServer(app, port, host, { shutdownTimeoutMs });
+  } catch (err) {
+    if (!allowFallback || err.code !== "EADDRINUSE") {
+      throw err;
+    }
+    logger.debug("port in use, falling back to OS-assigned port", { port });
+    return await createDrainingServer(app, 0, host, { shutdownTimeoutMs });
+  }
+}
 async function startServer(options = {}) {
   const {
     host,
@@ -2929,31 +3233,161 @@ async function startServer(options = {}) {
     compat: compatOpt,
     openaiRoutePrefix,
     anthropicRoutePrefix,
-    jsonBodyLimit
+    jsonBodyLimit,
+    daemon,
+    stateFile,
+    logFile,
+    shutdownTimeoutMs
   } = options;
   const serverHost = host || DEFAULT_HOST;
   const serverPort = port || DEFAULT_PORT;
   const compat = compatOpt ?? "openai";
   applyServerOptions(options);
   resolvePrefixesForCompat(compat, openaiRoutePrefix, anthropicRoutePrefix);
+  const isDaemonChild = !!process.env[DAEMON_CHILD_ENV];
+  logger.debug("startServer", {
+    daemon,
+    daemonChild: isDaemonChild,
+    serverHost,
+    serverPort,
+    compat
+  });
+  if (daemon && !isDaemonChild) {
+    return runDaemonParent({
+      serverHost,
+      serverPort,
+      stateFile,
+      logFile
+    });
+  }
+  const allowFallback = !(daemon || isDaemonChild);
+  const stateFilePath = stateFile || (isDaemonChild ? defaultStateFile() : undefined);
+  let token;
+  if (isDaemonChild) {
+    token = process.env[SHUTDOWN_TOKEN_ENV];
+    process.env[SHUTDOWN_TOKEN_ENV] = undefined;
+    if (!token) {
+      throw new Error(`Daemon child is missing ${SHUTDOWN_TOKEN_ENV}. Refusing to start.`);
+    }
+  } else if (stateFilePath) {
+    token = generateShutdownToken();
+  }
+  const handleRef = { current: null };
+  const shutdownConfig = token ? {
+    token,
+    onShutdown: async () => {
+      if (handleRef.current) {
+        await handleRef.current.shutdown();
+      }
+      if (stateFilePath)
+        removeStateFile(stateFilePath);
+    }
+  } : undefined;
   const app = createServerApp({
     compat,
     openaiRoutePrefix,
     anthropicRoutePrefix,
-    jsonBodyLimit
+    jsonBodyLimit,
+    shutdown: shutdownConfig
   });
-  return new Promise((resolve, reject) => {
-    const server = app.listen(serverPort, serverHost, () => {
-      resolve({ close: () => server.close() });
+  logger.debug("starting server", {
+    serverHost,
+    serverPort,
+    allowFallback,
+    isDaemonChild,
+    hasStateFile: !!stateFilePath
+  });
+  const handle = await bindServer(app, serverHost, serverPort, allowFallback, shutdownTimeoutMs);
+  handleRef.current = handle;
+  if (stateFilePath && token) {
+    writeStateFile(stateFilePath, {
+      pid: process.pid,
+      host: serverHost,
+      port: handle.port,
+      token
     });
-    server.on("error", (error) => {
-      if (error && typeof error === "object" && "code" in error && error.code === "EADDRINUSE") {
-        reject(new Error(`Port ${serverPort} is already in use`));
-      } else {
-        reject(error);
-      }
+  }
+  if (allowFallback) {
+    console.log(`Proxy listening on http://${serverHost}:${handle.port}`);
+  }
+  logger.debug("server listening", { serverHost, port: handle.port });
+  const onShutdown = async (signal) => {
+    logger.debug("shutdown signal", { signal });
+    console.log(`
+Received ${signal}. Shutting down gracefully...`);
+    try {
+      await handle.shutdown();
+    } finally {
+      if (stateFilePath)
+        removeStateFile(stateFilePath);
+      process.exit(signal === "SIGINT" ? 130 : 143);
+    }
+  };
+  process.once("SIGINT", () => {
+    onShutdown("SIGINT");
+  });
+  process.once("SIGTERM", () => {
+    onShutdown("SIGTERM");
+  });
+  if (process.platform !== "win32") {
+    process.once("SIGHUP", () => {
+      onShutdown("SIGHUP");
     });
+  }
+  process.on("uncaughtException", (err) => {
+    logger.debug("uncaughtException", { error: String(err) });
+    console.error("Uncaught exception:", err);
+    handle.shutdown().finally(() => process.exit(1));
+  });
+  return handle;
+}
+async function runDaemonParent(opts) {
+  const { serverHost, serverPort, stateFile, logFile } = opts;
+  const stateFilePath = stateFile || defaultStateFile();
+  let releaseLock;
+  try {
+    releaseLock = acquireDaemonLock(stateFilePath);
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  const token = generateShutdownToken();
+  const scriptPath = process.argv[1];
+  const args = [scriptPath, ...process.argv.slice(2)];
+  logger.debug("daemon re-exec", { execPath: process.execPath, args });
+  const child = Bun.spawn([process.execPath, ...args], {
+    stdin: "ignore",
+    stdout: logFile ? Bun.file(logFile) : "ignore",
+    stderr: logFile ? Bun.file(logFile) : "ignore",
+    env: {
+      ...process.env,
+      [DAEMON_CHILD_ENV]: "1",
+      [SHUTDOWN_TOKEN_ENV]: token
+    }
   });
+  logger.debug("daemon child spawned", { pid: child.pid, stateFilePath });
+  const baseUrl = `http://${serverHost}:${serverPort}`;
+  const startupCrash = child.exited.then((code) => {
+    throw new Error(`Proxy exited during startup with code ${code}. Run with CONFIDENTIAL_PROXY_LOG_LEVEL=debug to capture logs.`);
+  });
+  let started = false;
+  try {
+    await Promise.race([pollForReadiness(baseUrl), startupCrash]);
+    started = true;
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+  } finally {
+    child.unref();
+    startupCrash.catch(() => {});
+    if (!started) {
+      releaseLock?.();
+      removeStateFile(stateFilePath);
+      process.exit(1);
+    }
+    releaseLock?.();
+  }
+  console.log(`Proxy started. PID: ${child.pid}. State file: ${stateFilePath}`);
+  process.exit(0);
 }
 // src/server.ts
 var server_default = createServerApp("both");

package/dist/launcher/proxy-subprocess.d.ts

@@ -4,10 +4,12 @@ export type ProxyConfig = {
     proxyUrl: string;
     enclaveUrl: string;
     kek: string;
+    attest?: boolean;
 };
 export type ProxyHandle = {
-    stop: () => void;
+    stop: () => Promise<void>;
     ready: Promise<void>;
     whenCrashed: Promise<never>;
+    pid: number;
 };
-export declare function startProxySubprocess(config: ProxyConfig): ProxyHandle;
+export declare function ensureProxyRunning(config: ProxyConfig): Promise<ProxyHandle>;

package/dist/server/create-app.d.ts

@@ -1,6 +1,7 @@
 import express from "express";
 import type { RvencClient } from "../core";
 import type { CreateServerAppOptions, ServerCompatMode } from "../types";
+export declare function setDraining(value: boolean): void;
 export type RvencServerDeps = {
     getOrCreateClient: (apiKey: string) => Promise<RvencClient>;
 };

package/dist/server/create-drain-wrapper.d.ts

@@ -0,0 +1,5 @@
+import type { Application } from "express";
+import type { ProxyServerHandle } from "../types";
+export declare function createDrainingServer(app: Application, port: number, host: string, opts?: {
+    shutdownTimeoutMs?: number;
+}): Promise<ProxyServerHandle>;