@velum-labs/routekit-daemon 0.11.0 → 0.13.0

package/dist/call-attribution-store.js

@@ -31,6 +31,9 @@ export function callInspection(modelCall) {
     }
     const account = record(attribution?.account);
     const accountSeat = string(account?.seat);
+    const principal = record(attribution?.principal);
+    const principalTokenId = string(principal?.token_id);
+    const principalLabel = string(principal?.label);
     const nativeModel = string(attribution?.native_model);
     const estimateUsd = number(metadata?.cost_estimate_usd);
     const attempts = number(attribution?.attempts) ?? 1;
@@ -44,6 +47,14 @@ export function callInspection(modelCall) {
         provider,
         billingMode,
         ...(accountSeat !== undefined ? { account: { seat: accountSeat } } : {}),
+        ...(principalTokenId !== undefined
+            ? {
+                principal: {
+                    tokenId: principalTokenId,
+                    ...(principalLabel !== undefined ? { label: principalLabel } : {})
+                }
+            }
+            : {}),
         retries: {
             attempts,
             total: retries,

package/dist/index.d.ts

@@ -23,4 +23,15 @@ export type RunningRouteKitDaemon = {
     close(): Promise<void>;
     reload(): Promise<void>;
 };
+export type DaemonPublicRecord = {
+    product: string;
+    kind: string;
+    url: string;
+    port: number;
+    generation: number;
+    protocolVersion: string;
+    dataUrl?: string;
+    dataPort?: number;
+    startedAt: string;
+};
 export declare function startRouteKitDaemon(options: RouteKitDaemonOptions): Promise<RunningRouteKitDaemon>;

package/dist/index.js

@@ -14,7 +14,7 @@ import { createRouteKitControlHandler, ROUTEKIT_CONTROL_CAPABILITY } from "@velu
 import { startSwitchingGatewayProxy } from "@velum-labs/routekit-gateway";
 import { PROVIDERS, accountKindForCliproxyAuthType, resolveAccountConnector } from "@velum-labs/routekit-registry";
 import { startRouter } from "@velum-labs/routekit-router";
-import { acquireLifecycleLock, CONTROL_PROTOCOL_VERSION, ControlClient, ControlError, createPortlessSession, createServiceRecordStore, extendCleanupGrace, generateControlToken, nextServiceGeneration, processIdentity, registerCleanup, startControlServer, supervisorFromEnv, writeFileAtomic } from "@velum-labs/routekit-runtime";
+import { acquireLifecycleLock, CONTROL_PROTOCOL_VERSION, ControlClient, ControlError, createPortlessSession, createServiceRecordStore, createTokenStore, encodeJoinCredential, extendCleanupGrace, generateControlToken, nextServiceGeneration, processIdentity, registerCleanup, SERVICE_HOME_MODE, startControlServer, supervisorFromEnv, writeFileAtomic } from "@velum-labs/routekit-runtime";
 import { createConsentManager } from "@velum-labs/routekit-telemetry-core";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { createCliproxySidecar } from "./cliproxy-sidecar.js";
@@ -42,16 +42,59 @@ function redactedProcessArgs(args) {
     }
     return result;
 }
-function resolveDataToken(home, input) {
+function resolveDataToken(home, input, tokens) {
     const path = input.authTokenFile ?? dataTokenPath(home);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const token = input.authToken ??
-        (existsSync(path) ? readFileSync(path, "utf8").trim() : generateControlToken());
-    if (token.length === 0)
+    const ensured = tokens.ensureOwnerDataToken({
+        ...(input.authToken !== undefined ? { plaintext: input.authToken } : {}),
+        legacyPath: path
+    });
+    if (ensured.token.length === 0)
         throw new Error("RouteKit data-plane token is empty");
-    writeFileAtomic(path, `${token}\n`, { mode: 0o600 });
-    chmodSync(path, 0o600);
-    return { token, path };
+    return { token: ensured.token, path };
+}
+function daemonPublicRecordPath(home) {
+    return join(home, "services", "daemon.public.json");
+}
+/** Publish a secret-free discovery file peers can read across OS accounts. */
+function writeDaemonPublicRecord(home, record) {
+    const servicesDir = join(home, "services");
+    mkdirSync(home, { recursive: true, mode: SERVICE_HOME_MODE });
+    chmodSync(home, SERVICE_HOME_MODE);
+    mkdirSync(servicesDir, { recursive: true, mode: SERVICE_HOME_MODE });
+    chmodSync(servicesDir, SERVICE_HOME_MODE);
+    const path = daemonPublicRecordPath(home);
+    writeFileAtomic(path, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o644 });
+    chmodSync(path, 0o644);
+}
+function removeDaemonPublicRecord(home) {
+    rmSync(daemonPublicRecordPath(home), { force: true });
+}
+/**
+ * Resolve (or mint) a data-plane token for the calling control principal so
+ * tool launchers attribute usage to that admin rather than the owner token.
+ * Plaintext is cached in-memory for the daemon lifetime.
+ */
+function dataTokenForPrincipal(tokens, cache, ownerToken, principal) {
+    if (principal === undefined || principal.role === "ephemeral" || principal.role === "owner") {
+        return ownerToken;
+    }
+    const label = `${principal.label}-data`;
+    const cached = cache.get(label);
+    if (cached !== undefined)
+        return cached;
+    const existing = tokens.findByLabel(label, "data");
+    if (existing !== undefined) {
+        // Registry has a hash but plaintext is gone after restart; rotate.
+        tokens.revoke(existing.id);
+    }
+    const issued = tokens.issue({
+        label,
+        plane: "data",
+        role: "admin",
+        createdBy: principal.label
+    });
+    cache.set(label, issued.token);
+    return issued.token;
 }
 function revisionPath(home) {
     return join(home, "daemon-revisions.json");
@@ -200,7 +243,10 @@ export async function startRouteKitDaemon(options) {
     const home = options.stateHome ?? routekitHome(env);
     const configPath = options.configPath ?? globalRouterConfigPath();
     const drainGraceMs = options.drainGraceMs ?? 30_000;
-    const dataAuth = resolveDataToken(home, options);
+    const tokens = createTokenStore(home);
+    const dataTokenCache = new Map();
+    const dataAuth = resolveDataToken(home, options, tokens);
+    dataTokenCache.set("default", dataAuth.token);
     const store = createServiceRecordStore({ home, product: ROUTEKIT_PRODUCT });
     // Held for the daemon's whole lifetime. Lifecycle clients use daemon.lock
     // while this authority lock prevents any second daemon from becoming live.
@@ -302,7 +348,17 @@ export async function startRouteKitDaemon(options) {
             target: activeRouter.url,
             host: options.host ?? "127.0.0.1",
             port: options.port ?? 8080,
-            authToken: dataAuth.token
+            authToken: dataAuth.token,
+            resolveDataPrincipal: (presented) => {
+                const principal = tokens.resolve(presented, "data");
+                if (principal === undefined)
+                    return undefined;
+                return {
+                    id: principal.id,
+                    label: principal.label,
+                    role: principal.role
+                };
+            }
         });
         portless = await createPortlessSession(options.portless ?? env.ROUTEKIT_PORTLESS !== "0", { project: "routekit", ownerLabel: "routekit-daemon", bareNames: [] });
         const dataUrl = portless.enabled
@@ -1165,7 +1221,7 @@ export async function startRouteKitDaemon(options) {
                     ]
                 };
             },
-            "launcher.prepare": async (params) => {
+            "launcher.prepare": async (params, context) => {
                 const listed = await handlers["models.list"]({}, {
                     signal: new AbortController().signal,
                     requestId: "internal"
@@ -1181,9 +1237,63 @@ export async function startRouteKitDaemon(options) {
                     tool: params.tool,
                     model,
                     gatewayUrl: dataUrl,
-                    authToken: dataAuth.token,
+                    authToken: dataTokenForPrincipal(tokens, dataTokenCache, dataAuth.token, context.principal),
                     env: {}
                 };
+            },
+            "tokens.issue": async (params, context) => {
+                try {
+                    const issued = tokens.issue({
+                        label: params.label,
+                        plane: params.plane,
+                        role: "admin",
+                        createdBy: params.createdBy ??
+                            context.principal?.label ??
+                            "control"
+                    });
+                    if (issued.plane === "data") {
+                        dataTokenCache.set(issued.label, issued.token);
+                    }
+                    return {
+                        id: issued.id,
+                        label: issued.label,
+                        plane: issued.plane,
+                        role: issued.role,
+                        token: issued.token,
+                        ...(issued.plane === "control"
+                            ? {
+                                joinToken: encodeJoinCredential({
+                                    publicRecordPath: daemonPublicRecordPath(home),
+                                    token: issued.token
+                                })
+                            }
+                            : {})
+                    };
+                }
+                catch (error) {
+                    throw new ControlError({
+                        code: "bad_request",
+                        message: error instanceof Error ? error.message : String(error)
+                    });
+                }
+            },
+            "tokens.list": async (params) => ({
+                tokens: tokens.list(params.plane)
+            }),
+            "tokens.revoke": async (params) => {
+                try {
+                    const revoked = tokens.revoke(params.id);
+                    if (revoked.plane === "data")
+                        dataTokenCache.delete(revoked.label);
+                    return revoked;
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    throw new ControlError({
+                        code: message.startsWith("unknown token") ? "not_found" : "bad_request",
+                        message
+                    });
+                }
             }
         };
         control = await startControlServer({
@@ -1192,6 +1302,16 @@ export async function startRouteKitDaemon(options) {
             product: ROUTEKIT_PRODUCT,
             packageVersion: options.packageVersion,
             capabilities: [ROUTEKIT_CONTROL_CAPABILITY],
+            authorize: (presented) => {
+                const principal = tokens.resolve(presented, "control");
+                if (principal === undefined)
+                    return undefined;
+                return {
+                    id: principal.id,
+                    label: principal.label,
+                    role: principal.role
+                };
+            },
             onError: (error, context) => {
                 const operation = context.method ?? "control transport";
                 console.error(`RouteKit ${operation} failed (request ${context.requestId}):`, error);
@@ -1221,6 +1341,17 @@ export async function startRouteKitDaemon(options) {
             args: redactedProcessArgs(process.argv.slice(2)),
             cwd: process.cwd()
         });
+        writeDaemonPublicRecord(home, {
+            product: ROUTEKIT_PRODUCT,
+            kind: ROUTEKIT_DAEMON_KIND,
+            url: control.url,
+            port: control.port,
+            generation,
+            protocolVersion: CONTROL_PROTOCOL_VERSION,
+            dataUrl,
+            dataPort: proxy.port(),
+            startedAt
+        });
         extendCleanupGrace(drainGraceMs + 10_000);
         let closeRun;
         const close = () => {
@@ -1238,6 +1369,7 @@ export async function startRouteKitDaemon(options) {
                 if (portless?.enabled)
                     portless.unregister("gateway");
                 store.remove(ROUTEKIT_DAEMON_KIND, { ifPid: process.pid });
+                removeDaemonPublicRecord(home);
                 authority.release();
                 lifecycle = "closed";
             })();
@@ -1274,6 +1406,7 @@ export async function startRouteKitDaemon(options) {
             portless.unregister("gateway");
         if (record !== undefined)
             store.remove(ROUTEKIT_DAEMON_KIND, { ifPid: process.pid });
+        removeDaemonPublicRecord(home);
         authority.release();
         throw error;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@velum-labs/routekit-daemon",
   "private": false,
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Singleton RouteKit control daemon and stable model gateway.",
   "repository": {
     "type": "git",
@@ -34,14 +34,14 @@
   ],
   "dependencies": {
     "yaml": "2.9.0",
-    "@velum-labs/routekit-config": "0.11.0",
-    "@velum-labs/routekit-gateway": "0.11.0",
-    "@velum-labs/routekit-control": "0.11.0",
-    "@velum-labs/routekit-accounts": "0.11.0",
-    "@velum-labs/routekit-router": "0.11.0",
-    "@velum-labs/routekit-registry": "0.11.0",
-    "@velum-labs/routekit-runtime": "0.11.0",
-    "@velum-labs/routekit-telemetry-core": "0.11.0"
+    "@velum-labs/routekit-control": "0.13.0",
+    "@velum-labs/routekit-gateway": "0.13.0",
+    "@velum-labs/routekit-registry": "0.13.0",
+    "@velum-labs/routekit-router": "0.13.0",
+    "@velum-labs/routekit-config": "0.13.0",
+    "@velum-labs/routekit-accounts": "0.13.0",
+    "@velum-labs/routekit-telemetry-core": "0.13.0",
+    "@velum-labs/routekit-runtime": "0.13.0"
   },
   "scripts": {
     "build": "tsc -b",