@velum-labs/routekit-daemon 0.18.0 → 0.18.2

package/dist/index.js

@@ -6,11 +6,12 @@
  * ports behind that front door; config/account reload builds a complete new
  * generation before atomically switching new traffic and draining the old.
  */
+import { createHash } from "node:crypto";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { AccountActivityCoordinator, AccountAuthCoordinator, accountStoreEntries, CLIPROXY_API_KEY_ENV, CLIPROXY_BASE_URL_ENV, cliproxyAccountEntries, cliproxyAccountMatchesKind, cliproxyApiKey, cliproxyAuthDirectory, cliproxyBaseUrl, cliproxyCredentialValid, defaultSubscriptionAccountDirectory, RateLimitTracker, removeCliproxyAccount, removeSubscriptionAccount, renameSubscriptionAccount, sanitizeSubscriptionLabel, subscriptionAccountIdentity, subscriptionCredentialFingerprint } from "@velum-labs/routekit-accounts";
 import { configuredProviderIds, globalRouterConfigPath, parseRouterConfigDocument, routekitHome, writeRouterConfig } from "@velum-labs/routekit-config";
-import { createRouteKitControlHandler, ROUTEKIT_CONTROL_CAPABILITY } from "@velum-labs/routekit-control";
+import { createRouteKitControlHandler, MUTATING_ROUTEKIT_METHODS, ROUTEKIT_CONTROL_CAPABILITY, ROUTEKIT_DAEMON_ROLL_CAPABILITY } from "@velum-labs/routekit-control";
 import { resolveCodexStartupModel, resolveLeaderboardConfig, startSwitchingGatewayProxy } from "@velum-labs/routekit-gateway";
 import { accountKindForCliproxyAuthType, PROVIDERS, resolveAccountConnector } from "@velum-labs/routekit-registry";
 import { startRouter } from "@velum-labs/routekit-router";
@@ -20,6 +21,7 @@ import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { cleanupAccountTransaction, markAccountTransactionCommitted, prepareAccountTransaction, recoverAccountTransactions, rollbackAccountTransaction } from "./account-transaction.js";
 import { CallAttributionStore, callInspection } from "./call-attribution-store.js";
 import { createCliproxySidecar } from "./cliproxy-sidecar.js";
+import { DAEMON_HOST_PROTOCOL_VERSION } from "./host-protocol.js";
 import { aggregateInspections, buildLeaderboardResult, defaultLeaderboardWindow, LeaderboardRollupStore } from "./leaderboard.js";
 import { DaemonTelemetry, DEFAULT_TELEMETRY_HOST, GatewayTelemetryAggregator, resolveTelemetryProjectKey } from "./telemetry.js";
 export const ROUTEKIT_DAEMON_KIND = "daemon";
@@ -54,11 +56,11 @@ function resolveDataToken(home, input, tokens) {
         throw new Error("RouteKit data-plane token is empty");
     return { token: ensured.token, path };
 }
-function daemonPublicRecordPath(home) {
+export function daemonPublicRecordPath(home) {
     return join(home, "services", "daemon.public.json");
 }
 /** Publish a secret-free discovery file peers can read across OS accounts. */
-function writeDaemonPublicRecord(home, record) {
+export function writeDaemonPublicRecord(home, record) {
     const servicesDir = join(home, "services");
     mkdirSync(home, { recursive: true, mode: SERVICE_HOME_MODE });
     chmodSync(home, SERVICE_HOME_MODE);
@@ -68,7 +70,7 @@ function writeDaemonPublicRecord(home, record) {
     writeFileAtomic(path, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o644 });
     chmodSync(path, 0o644);
 }
-function removeDaemonPublicRecord(home) {
+export function removeDaemonPublicRecord(home) {
     rmSync(daemonPublicRecordPath(home), { force: true });
 }
 /**
@@ -101,7 +103,7 @@ function dataTokenForPrincipal(tokens, cache, ownerToken, principal) {
 function revisionPath(home) {
     return join(home, "daemon-revisions.json");
 }
-function readRevisions(home) {
+export function readDaemonRevisions(home) {
     try {
         const parsed = JSON.parse(readFileSync(revisionPath(home), "utf8"));
         return {
@@ -118,7 +120,7 @@ function readRevisions(home) {
         return { config: 0, accounts: 0, daemon: 0 };
     }
 }
-function writeRevisions(home, revisions) {
+export function writeDaemonRevisions(home, revisions) {
     mkdirSync(home, { recursive: true, mode: 0o700 });
     writeFileAtomic(revisionPath(home), `${JSON.stringify(revisions, null, 2)}\n`, {
         mode: 0o600
@@ -248,26 +250,29 @@ export async function startRouteKitDaemon(options) {
     const dataAuth = resolveDataToken(home, options, tokens);
     dataTokenCache.set("default", dataAuth.token);
     const store = createServiceRecordStore({ home, product: ROUTEKIT_PRODUCT });
+    const hosted = options.hosted;
     // Held for the daemon's whole lifetime. Lifecycle clients use daemon.lock
     // while this authority lock prevents any second daemon from becoming live.
-    const authority = await acquireLifecycleLock(join(store.directory, "daemon-authority.lock"), {
-        timeoutMs: 30_000,
-        onWait: async () => {
-            const existing = store.read(ROUTEKIT_DAEMON_KIND);
-            return existing !== undefined && (await healthyControl(existing))
-                ? new ControlError({
-                    code: "conflict",
-                    message: `RouteKit daemon is already running (pid ${existing.pid})`
-                })
-                : undefined;
-        }
-    });
+    const authority = hosted === undefined
+        ? await acquireLifecycleLock(join(store.directory, "daemon-authority.lock"), {
+            timeoutMs: 30_000,
+            onWait: async () => {
+                const existing = store.read(ROUTEKIT_DAEMON_KIND);
+                return existing !== undefined && (await healthyControl(existing))
+                    ? new ControlError({
+                        code: "conflict",
+                        message: `RouteKit daemon is already running (pid ${existing.pid})`
+                    })
+                    : undefined;
+            }
+        })
+        : undefined;
     let accountRecovery;
     try {
         accountRecovery = recoverAccountTransactions(home);
     }
     catch (error) {
-        authority.release();
+        authority?.release();
         throw error;
     }
     let control;
@@ -282,8 +287,8 @@ export async function startRouteKitDaemon(options) {
     let record;
     let closed = false;
     let draining = false;
-    let lifecycle = "running";
-    let revisions = readRevisions(home);
+    let lifecycle = hosted?.initiallyPaused === true ? "paused" : "running";
+    let revisions = readDaemonRevisions(home);
     let currentDocument = canonicalConfigDocument(configPath);
     let currentConfig = parseConfigDocument(currentDocument);
     let mutationTail = Promise.resolve();
@@ -300,26 +305,27 @@ export async function startRouteKitDaemon(options) {
     };
     const startedAt = new Date().toISOString();
     try {
-        const previous = store.read(ROUTEKIT_DAEMON_KIND);
-        if (previous !== undefined &&
-            previous.pid !== process.pid &&
-            (await healthyControl(previous))) {
+        const previous = hosted === undefined ? store.read(ROUTEKIT_DAEMON_KIND) : undefined;
+        if (hosted === undefined && previous !== undefined && previous.pid !== process.pid && (await healthyControl(previous))) {
             throw new ControlError({
                 code: "conflict",
                 message: `RouteKit daemon is already running (pid ${previous.pid})`
             });
         }
-        if (previous !== undefined && previous.pid !== process.pid) {
+        if (hosted === undefined && previous !== undefined && previous.pid !== process.pid) {
             // A live-but-unhealthy daemon is not safe to replace under its feet.
             throw new ControlError({
                 code: "unavailable",
                 message: `RouteKit daemon pid ${previous.pid} is alive but its control plane is unhealthy; stop it before recovery`
             });
         }
-        const generation = nextServiceGeneration(Math.max(previous?.generation ?? 0, revisions.daemon));
-        revisions.daemon = generation;
-        writeRevisions(home, revisions);
-        const sidecar = createCliproxySidecar({ env });
+        const generation = hosted?.generation ??
+            nextServiceGeneration(Math.max(previous?.generation ?? 0, revisions.daemon));
+        if (hosted === undefined) {
+            revisions.daemon = generation;
+            writeDaemonRevisions(home, revisions);
+        }
+        const sidecar = hosted?.sidecar ?? createCliproxySidecar({ env });
         sidecarRef = sidecar;
         let leaderboardConfig = resolveLeaderboardConfig(currentConfig);
         const callAttributions = new CallAttributionStore({
@@ -430,12 +436,16 @@ export async function startRouteKitDaemon(options) {
                 };
             }
         });
-        portless = await createPortlessSession(options.portless ?? env.ROUTEKIT_PORTLESS !== "0", {
-            project: "routekit",
-            ownerLabel: "routekit-daemon",
-            bareNames: []
-        });
-        const dataUrl = portless.enabled ? portless.register("gateway", proxy.port()) : proxy.url();
+        portless =
+            hosted === undefined
+                ? await createPortlessSession(options.portless ?? env.ROUTEKIT_PORTLESS !== "0", {
+                    project: "routekit",
+                    ownerLabel: "routekit-daemon",
+                    bareNames: []
+                })
+                : undefined;
+        const dataUrl = hosted?.dataUrl() ??
+            (portless?.enabled === true ? portless.register("gateway", proxy.port()) : proxy.url());
         const replaceRouter = async (nextConfig, nextDocument, input) => {
             // Sidecar reconcile runs before the generation commits; any failure
             // below must put the sidecar back to the still-live currentConfig.
@@ -463,7 +473,7 @@ export async function startRouteKitDaemon(options) {
             try {
                 if (input.write)
                     writeRouterConfig(configPath, nextConfig);
-                writeRevisions(home, nextRevisions);
+                writeDaemonRevisions(home, nextRevisions);
                 await input.beforeSwap?.();
             }
             catch (error) {
@@ -472,7 +482,7 @@ export async function startRouteKitDaemon(options) {
                     chmodSync(configPath, 0o600);
                 }
                 revisions = previousRevisions;
-                writeRevisions(home, previousRevisions);
+                writeDaemonRevisions(home, previousRevisions);
                 await candidate.close();
                 await sidecar.reconcile(wantsCliproxySidecar(currentConfig));
                 throw error;
@@ -515,17 +525,22 @@ export async function startRouteKitDaemon(options) {
         handlers = {
             "daemon.status": async () => ({
                 pid: process.pid,
+                workerPid: process.pid,
+                hostPid: hosted?.hostPid ?? process.pid,
+                hostStartedAt: hosted?.hostStartedAt ?? startedAt,
                 startedAt,
                 packageVersion: options.packageVersion,
                 protocolVersion: CONTROL_PROTOCOL_VERSION,
+                hostProtocolVersion: hosted === undefined ? 0 : DAEMON_HOST_PROTOCOL_VERSION,
                 generation,
                 configRevision: revisions.config,
                 accountRevision: revisions.accounts,
                 controlUrl: control?.url ?? "",
-                dataUrl,
+                dataUrl: hosted?.dataUrl() ?? dataUrl,
                 dataPort: proxy?.port() ?? 0,
                 supervisor: supervisorFromEnv(env),
-                draining
+                draining,
+                rolling: hosted?.rolling() ?? false
             }),
             "daemon.reload": async (params) => {
                 await serializeMutation(async () => {
@@ -545,9 +560,66 @@ export async function startRouteKitDaemon(options) {
                     accountRevision: revisions.accounts
                 };
             },
+            "daemon.roll": async (params, context) => {
+                if (context.principal?.role !== "ephemeral") {
+                    throw new ControlError({
+                        code: "unauthorized",
+                        message: "daemon roll requires the local service credential"
+                    });
+                }
+                if (options.onRollRequested === undefined) {
+                    throw new ControlError({
+                        code: "upgrade_required",
+                        message: "this daemon does not support rolling process replacement"
+                    });
+                }
+                const startedAt = Date.now();
+                const supervisor = ["systemd", "launchd", "detached"].includes(supervisorFromEnv(env))
+                    ? supervisorFromEnv(env)
+                    : "unknown";
+                const toVersion = params.candidate?.expectedVersion ?? options.packageVersion;
+                daemonTelemetry?.capture("routekit.daemon_lifecycle", {
+                    action: "roll_started",
+                    outcome: "success",
+                    supervisor,
+                    version: options.packageVersion,
+                    reason: params.reason,
+                    from_version: options.packageVersion,
+                    to_version: toVersion
+                });
+                try {
+                    const result = await options.onRollRequested(params);
+                    daemonTelemetry?.capture("routekit.daemon_lifecycle", {
+                        action: "roll_committed",
+                        outcome: "success",
+                        supervisor,
+                        version: result.packageVersion,
+                        reason: params.reason,
+                        from_version: options.packageVersion,
+                        to_version: result.packageVersion,
+                        duration_bucket: durationBucket(Date.now() - startedAt)
+                    });
+                    return result;
+                }
+                catch (error) {
+                    daemonTelemetry?.capture("routekit.daemon_lifecycle", {
+                        action: "roll_failed",
+                        outcome: "error",
+                        supervisor,
+                        version: options.packageVersion,
+                        reason: params.reason,
+                        from_version: options.packageVersion,
+                        to_version: toVersion,
+                        rollback_stage: "candidate",
+                        duration_bucket: durationBucket(Date.now() - startedAt)
+                    });
+                    throw error;
+                }
+            },
             "daemon.prepareShutdown": async (params) => {
-                if (lifecycle !== "running")
+                if (lifecycle === "quiescing" || lifecycle === "draining" || lifecycle === "closed") {
                     return { accepted: true };
+                }
                 lifecycle = "quiescing";
                 draining = true;
                 await mutationTail;
@@ -1653,16 +1725,29 @@ export async function startRouteKitDaemon(options) {
                 version: options.packageVersion
             });
         };
-        const dispatch = createRouteKitControlHandler(handlers, {
+        const routeKitDispatch = createRouteKitControlHandler(handlers, {
             onCommitted: (method, params, durationMs) => captureOperation(method, params, "success", durationMs),
             onControlError: (method, params, _code, durationMs) => captureOperation(method, params, "error", durationMs)
         });
+        const dispatch = async (method, params, context) => {
+            if (lifecycle === "paused" && MUTATING_ROUTEKIT_METHODS.has(method)) {
+                throw new ControlError({
+                    code: "unavailable",
+                    message: "RouteKit daemon is synchronizing a replacement worker"
+                });
+            }
+            return await routeKitDispatch(method, params, context);
+        };
         control = await startControlServer({
             handler: dispatch,
-            token: generateControlToken(),
+            token: hosted?.controlToken ?? generateControlToken(),
             product: ROUTEKIT_PRODUCT,
             packageVersion: options.packageVersion,
-            capabilities: [ROUTEKIT_CONTROL_CAPABILITY],
+            port: options.controlPort,
+            capabilities: [
+                ROUTEKIT_CONTROL_CAPABILITY,
+                ...(hosted === undefined ? [] : [ROUTEKIT_DAEMON_ROLL_CAPABILITY])
+            ],
             authorize: (presented) => {
                 const principal = tokens.resolve(presented, "control");
                 if (principal === undefined)
@@ -1678,7 +1763,7 @@ export async function startRouteKitDaemon(options) {
                 console.error(`RouteKit ${operation} failed (request ${context.requestId}):`, error);
             }
         });
-        record = store.write({
+        const workerRecordInput = {
             kind: ROUTEKIT_DAEMON_KIND,
             pid: process.pid,
             ...(processIdentity(process.pid) !== undefined
@@ -1693,7 +1778,7 @@ export async function startRouteKitDaemon(options) {
             dataUrl,
             dataPort: proxy.port(),
             host: options.host ?? "127.0.0.1",
-            portless: portless.enabled,
+            portless: portless?.enabled ?? false,
             drainGraceMs,
             authTokenFile: dataAuth.path,
             generation,
@@ -1701,18 +1786,24 @@ export async function startRouteKitDaemon(options) {
             ...(process.argv[1] !== undefined ? { binPath: process.argv[1] } : {}),
             args: redactedProcessArgs(process.argv.slice(2)),
             cwd: process.cwd()
-        });
-        writeDaemonPublicRecord(home, {
-            product: ROUTEKIT_PRODUCT,
-            kind: ROUTEKIT_DAEMON_KIND,
-            url: control.url,
-            port: control.port,
-            generation,
-            protocolVersion: CONTROL_PROTOCOL_VERSION,
-            dataUrl,
-            dataPort: proxy.port(),
-            startedAt
-        });
+        };
+        record =
+            hosted === undefined
+                ? store.write(workerRecordInput)
+                : { product: ROUTEKIT_PRODUCT, owner: ROUTEKIT_PRODUCT, ...workerRecordInput };
+        if (hosted === undefined) {
+            writeDaemonPublicRecord(home, {
+                product: ROUTEKIT_PRODUCT,
+                kind: ROUTEKIT_DAEMON_KIND,
+                url: control.url,
+                port: control.port,
+                generation,
+                protocolVersion: CONTROL_PROTOCOL_VERSION,
+                dataUrl,
+                dataPort: proxy.port(),
+                startedAt
+            });
+        }
         daemonTelemetry.capture("routekit.daemon_lifecycle", {
             action: "started",
             outcome: "success",
@@ -1745,13 +1836,16 @@ export async function startRouteKitDaemon(options) {
                 await activeRouter?.close();
                 accountActivity?.close();
                 accountAuth?.close();
-                await sidecar.close();
+                if (hosted === undefined)
+                    await sidecar.close();
                 await control?.close();
-                if (portless?.enabled)
-                    portless.unregister("gateway");
-                store.remove(ROUTEKIT_DAEMON_KIND, { ifPid: process.pid });
-                removeDaemonPublicRecord(home);
-                authority.release();
+                if (hosted === undefined) {
+                    if (portless?.enabled)
+                        portless.unregister("gateway");
+                    store.remove(ROUTEKIT_DAEMON_KIND, { ifPid: process.pid });
+                    removeDaemonPublicRecord(home);
+                    authority?.release();
+                }
                 lifecycle = "closed";
             })();
             return closeRun;
@@ -1770,6 +1864,42 @@ export async function startRouteKitDaemon(options) {
             dataUrl,
             controlUrl: control.url,
             close,
+            retire: async (graceMs = drainGraceMs) => {
+                if (lifecycle === "closed" || lifecycle === "draining")
+                    return;
+                lifecycle = "quiescing";
+                draining = true;
+                await mutationTail;
+                lifecycle = "draining";
+                await Promise.all([proxy?.retire(graceMs), control?.retire(Math.min(graceMs, 2_000))]);
+                await activeRouter?.close();
+                accountActivity?.close();
+                accountAuth?.close();
+                gatewayTelemetry?.close();
+                await daemonTelemetry?.shutdown();
+                lifecycle = "closed";
+            },
+            pauseMutations: async () => {
+                if (lifecycle !== "running") {
+                    throw new ControlError({ code: "unavailable", message: "RouteKit daemon is not mutable" });
+                }
+                lifecycle = "paused";
+                await mutationTail;
+                return {
+                    configRevision: revisions.config,
+                    accountRevision: revisions.accounts,
+                    configHash: createHash("sha256").update(currentDocument).digest("hex")
+                };
+            },
+            resumeMutations: () => {
+                if (lifecycle === "paused")
+                    lifecycle = "running";
+            },
+            snapshot: () => ({
+                configRevision: revisions.config,
+                accountRevision: revisions.accounts,
+                configHash: createHash("sha256").update(currentDocument).digest("hex")
+            }),
             reload: async () => {
                 await handlers["daemon.reload"]({}, {
                     signal: new AbortController().signal,
@@ -1785,14 +1915,26 @@ export async function startRouteKitDaemon(options) {
         await activeRouter?.close();
         accountActivity?.close();
         accountAuth?.close();
-        await sidecarRef?.close();
+        if (hosted === undefined)
+            await sidecarRef?.close();
         await control?.close();
-        if (portless?.enabled)
-            portless.unregister("gateway");
-        if (record !== undefined)
-            store.remove(ROUTEKIT_DAEMON_KIND, { ifPid: process.pid });
-        removeDaemonPublicRecord(home);
-        authority.release();
+        if (hosted === undefined) {
+            if (portless?.enabled)
+                portless.unregister("gateway");
+            if (record !== undefined)
+                store.remove(ROUTEKIT_DAEMON_KIND, { ifPid: process.pid });
+            removeDaemonPublicRecord(home);
+            authority?.release();
+        }
         throw error;
     }
 }
+export { ROUTEKIT_DAEMON_WORKER_ENV } from "./host-protocol.js";
+export async function startRouteKitDaemonHost(options) {
+    const daemonHost = await import("./host.js");
+    return await daemonHost.startRouteKitDaemonHost(options);
+}
+export async function runRouteKitDaemonWorker(options) {
+    const daemonWorker = await import("./worker.js");
+    return await daemonWorker.runRouteKitDaemonWorker(options);
+}

package/dist/worker.d.ts

@@ -0,0 +1,2 @@
+import type { RouteKitDaemonOptions } from "./index.js";
+export declare function runRouteKitDaemonWorker(options: RouteKitDaemonOptions): Promise<never>;

package/dist/worker.js

@@ -0,0 +1,168 @@
+import cluster from "node:cluster";
+import { DAEMON_HOST_PROTOCOL_VERSION, ROUTEKIT_DAEMON_CONTROL_PORT_ENV, ROUTEKIT_DAEMON_CONTROL_TOKEN_ENV, ROUTEKIT_DAEMON_DATA_PORT_ENV, ROUTEKIT_DAEMON_DATA_URL_ENV, ROUTEKIT_DAEMON_GENERATION_ENV, ROUTEKIT_DAEMON_HOST_PID_ENV, ROUTEKIT_DAEMON_HOST_STARTED_AT_ENV, ROUTEKIT_DAEMON_INITIAL_PAUSED_ENV } from "./host-protocol.js";
+import { startRouteKitDaemon } from "./index.js";
+function requiredEnv(env, name) {
+    const value = env[name];
+    if (value === undefined || value.length === 0)
+        throw new Error(`missing hosted worker environment ${name}`);
+    return value;
+}
+function positiveInteger(value, name) {
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0)
+        throw new Error(`invalid hosted worker ${name}`);
+    return parsed;
+}
+function send(message) {
+    if (typeof process.send !== "function")
+        throw new Error("hosted daemon worker has no IPC channel");
+    process.send(message);
+}
+export async function runRouteKitDaemonWorker(options) {
+    if (!cluster.isWorker)
+        throw new Error("daemon worker must run as a cluster worker");
+    const env = options.env ?? process.env;
+    const generation = positiveInteger(requiredEnv(env, ROUTEKIT_DAEMON_GENERATION_ENV), "generation");
+    const hostPid = positiveInteger(requiredEnv(env, ROUTEKIT_DAEMON_HOST_PID_ENV), "host pid");
+    const hostStartedAt = requiredEnv(env, ROUTEKIT_DAEMON_HOST_STARTED_AT_ENV);
+    const controlToken = requiredEnv(env, ROUTEKIT_DAEMON_CONTROL_TOKEN_ENV);
+    const dataPort = positiveInteger(requiredEnv(env, ROUTEKIT_DAEMON_DATA_PORT_ENV), "data port");
+    const controlPort = positiveInteger(requiredEnv(env, ROUTEKIT_DAEMON_CONTROL_PORT_ENV), "control port");
+    let dataUrl = requiredEnv(env, ROUTEKIT_DAEMON_DATA_URL_ENV);
+    let rolling = env[ROUTEKIT_DAEMON_INITIAL_PAUSED_ENV] === "1";
+    let sidecarState = { managed: true, running: false };
+    let nextRequestId = 0;
+    const pending = new Map();
+    let running;
+    const requestHost = async (request) => {
+        const requestId = `${process.pid}-${++nextRequestId}`;
+        const response = new Promise((resolve, reject) => {
+            pending.set(requestId, { resolve: (value) => resolve(value), reject });
+        });
+        send({ ...request, requestId });
+        return await response;
+    };
+    const sidecar = {
+        reconcile: async (wanted) => {
+            sidecarState = await requestHost({ type: "host.sidecar", operation: "reconcile", wanted });
+        },
+        refresh: async () => {
+            sidecarState = await requestHost({ type: "host.sidecar", operation: "refresh" });
+        },
+        running: () => sidecarState.running,
+        managed: () => sidecarState.managed,
+        reachable: async (timeoutMs) => {
+            const reachable = await requestHost({
+                type: "host.sidecar",
+                operation: "reachable",
+                timeoutMs
+            });
+            sidecarState = { ...sidecarState, running: reachable };
+            return reachable;
+        },
+        close: async () => { }
+    };
+    const onRollRequested = async (params) => await requestHost({ type: "host.roll", params });
+    process.on("message", (message) => {
+        if (message.type === "host.response") {
+            const waiter = pending.get(message.requestId);
+            if (waiter === undefined)
+                return;
+            pending.delete(message.requestId);
+            if (message.ok)
+                waiter.resolve(message.result);
+            else
+                waiter.reject(new Error(message.error));
+            return;
+        }
+        if (!message.type.startsWith("worker."))
+            return;
+        const request = message;
+        void (async () => {
+            try {
+                let result;
+                switch (request.type) {
+                    case "worker.pause":
+                        result = await running?.pauseMutations();
+                        break;
+                    case "worker.resume":
+                        running?.resumeMutations();
+                        rolling = false;
+                        break;
+                    case "worker.hostState":
+                        dataUrl = request.dataUrl;
+                        rolling = request.rolling;
+                        break;
+                    case "worker.retire":
+                        await running?.retire(request.graceMs);
+                        result = { retired: true };
+                        break;
+                    case "worker.shutdown":
+                        await running?.close();
+                        result = { closed: true };
+                        break;
+                }
+                send({ type: "worker.response", requestId: request.requestId, ok: true, result });
+                if (request.type === "worker.retire" || request.type === "worker.shutdown") {
+                    setImmediate(() => process.exit(0));
+                }
+            }
+            catch (error) {
+                send({
+                    type: "worker.response",
+                    requestId: request.requestId,
+                    ok: false,
+                    error: error instanceof Error ? error.message : String(error)
+                });
+            }
+        })();
+    });
+    process.once("disconnect", () => {
+        void running?.close().finally(() => process.exit(1));
+    });
+    try {
+        running = await startRouteKitDaemon({
+            ...options,
+            port: dataPort,
+            controlPort,
+            hosted: {
+                generation,
+                controlToken,
+                dataUrl: () => dataUrl,
+                hostPid,
+                hostStartedAt,
+                rolling: () => rolling,
+                sidecar,
+                initiallyPaused: env[ROUTEKIT_DAEMON_INITIAL_PAUSED_ENV] === "1"
+            },
+            onRollRequested,
+            onShutdownRequested: (reason) => send({ type: "host.shutdown", reason })
+        });
+    }
+    catch (error) {
+        if (process.connected)
+            process.disconnect();
+        throw error;
+    }
+    const snapshot = running.snapshot();
+    send({
+        type: "worker.ready",
+        protocolVersion: DAEMON_HOST_PROTOCOL_VERSION,
+        workerPid: process.pid,
+        ...(running.record.processIdentity !== undefined
+            ? { workerProcessIdentity: running.record.processIdentity }
+            : {}),
+        workerStartedAt: running.record.startedAt,
+        packageVersion: options.packageVersion,
+        generation,
+        configRevision: snapshot.configRevision,
+        accountRevision: snapshot.accountRevision,
+        configHash: snapshot.configHash,
+        controlUrl: running.controlUrl,
+        controlPort: running.record.port,
+        dataUrl: running.dataUrl,
+        dataPort: running.record.dataPort ?? 0,
+        ...(process.argv[1] !== undefined ? { binPath: process.argv[1] } : {})
+    });
+    return await new Promise(() => undefined);
+}