@velum-labs/routekit-daemon 0.18.6 → 1.0.0

package/README.md

@@ -14,5 +14,6 @@ worker serving traffic.
 tests. Production `routekit daemon run` uses `startRouteKitDaemonHost` in the
 primary and `runRouteKitDaemonWorker` in cluster workers.
 
-Applications normally use it through `@velum-labs/routekit`; embedders should keep
-using `@velum-labs/routekit-router` instead of claiming the singleton service record.
+Applications normally use it through `@velum-labs/routekit`. Tests and specialized
+hosts can acquire a scoped gateway generation from `@velum-labs/routekit-daemon/effect`
+without claiming the singleton service record.

package/dist/account-enroll-service.d.ts

@@ -0,0 +1,7 @@
+import type { EffectRouteKitControlHandlers } from "@velum-labs/routekit-control/effect";
+type AccountEnrollHandlers = Pick<EffectRouteKitControlHandlers, "accounts.enroll" | "accounts.enrollActivate">;
+/** Owns account enrollment and activation transactions. */
+export declare class AccountEnrollService {
+    handlers(): AccountEnrollHandlers;
+}
+export {};

package/dist/account-enroll-service.js

@@ -0,0 +1,290 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { cliproxyAuthDirectory, defaultSubscriptionAccountDirectory, sanitizeSubscriptionLabel, subscriptionAccountIdentity, subscriptionCredentialFingerprint } from "@velum-labs/routekit-accounts";
+import { resolveAccountConnector } from "@velum-labs/routekit-registry";
+import { ControlError } from "@velum-labs/routekit-runtime/control";
+import { writeFileAtomic } from "@velum-labs/routekit-runtime/filesystem";
+import { routeKitError, toRouteKitFailure } from "@velum-labs/routekit-runtime/effect";
+import { Effect } from "effect";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { cleanupAccountTransaction, markAccountTransactionCommitted, prepareAccountTransaction, rollbackAccountTransaction } from "./account-transaction.js";
+import { DaemonHost } from "./daemon-host-context.js";
+import { daemonAccountServices } from "./account-services.js";
+import { parseConfigDocument, safeCliproxyCredentialBlob, safeCliproxyLabel, safeCredentialBlob } from "./daemon-maintenance.js";
+/** Owns account enrollment and activation transactions. */
+export class AccountEnrollService {
+    handlers() {
+        return {
+            "accounts.enroll": (params) => Effect.gen(function* () {
+                const { env: daemonEnv, state: runtimeState, generations } = yield* daemonAccountServices;
+                const host = yield* DaemonHost;
+                const env = daemonEnv.env;
+                return yield* runtimeState.serializeEffect(Effect.gen(function* () {
+                    const path = yield* Effect.try({
+                        try: () => {
+                            const label = sanitizeSubscriptionLabel(params.label);
+                            if (label !== params.label || label.startsWith(".")) {
+                                throw new ControlError({
+                                    code: "bad_request",
+                                    message: "account label must already be normalized"
+                                });
+                            }
+                            const directory = defaultSubscriptionAccountDirectory(params.kind, env);
+                            mkdirSync(directory, { recursive: true, mode: 0o700 });
+                            const credentialPath = join(directory, `${label}.json`);
+                            if (existsSync(credentialPath)) {
+                                throw new ControlError({
+                                    code: "conflict",
+                                    message: `${params.kind}/${label} is already enrolled; remove it before enrolling again`
+                                });
+                            }
+                            writeFileAtomic(credentialPath, `${JSON.stringify(safeCredentialBlob(params.kind, params.credential), null, 2)}\n`, { mode: 0o600 });
+                            chmodSync(credentialPath, 0o600);
+                            return credentialPath;
+                        },
+                        catch: toRouteKitFailure
+                    });
+                    yield* generations
+                        .replace(runtimeState.config, runtimeState.document, {
+                        write: false,
+                        accountRevision: true
+                    })
+                        .pipe(Effect.catch((error) => {
+                        rmSync(path, { force: true });
+                        return Effect.fail(routeKitError(error));
+                    }));
+                    return { enrolled: true, revision: runtimeState.revisions.accounts };
+                }));
+            }),
+            "accounts.enrollActivate": (params) => Effect.gen(function* () {
+                const { env: daemonEnv, state: runtimeState, generations, auth: authHealth, sidecar } = yield* daemonAccountServices;
+                const host = yield* DaemonHost;
+                const env = daemonEnv.env;
+                const home = daemonEnv.home;
+                const configPath = daemonEnv.configPath;
+                const replaceRouter = generations.replace;
+                const resolved = resolveAccountConnector(params.kind);
+                if (resolved === undefined) {
+                    return yield* Effect.fail(new ControlError({
+                        code: "bad_request",
+                        message: `unknown subscription kind: ${params.kind}`
+                    }));
+                }
+                const kind = resolved.kind;
+                const connector = resolved.info.connector;
+                const provider = connector === "cliproxy" ? "cliproxy" : kind;
+                const prepared = yield* Effect.try({
+                    try: () => {
+                        const seenLabels = new Set();
+                        return params.accounts.map((account) => {
+                            const label = connector === "native"
+                                ? sanitizeSubscriptionLabel(account.label)
+                                : safeCliproxyLabel(account.label);
+                            if (label !== account.label || (connector === "native" && label.startsWith("."))) {
+                                throw new ControlError({
+                                    code: "bad_request",
+                                    message: "account label must already be normalized"
+                                });
+                            }
+                            if (seenLabels.has(label)) {
+                                throw new ControlError({
+                                    code: "bad_request",
+                                    message: `duplicate account label: ${label}`
+                                });
+                            }
+                            seenLabels.add(label);
+                            const directory = connector === "native"
+                                ? defaultSubscriptionAccountDirectory(kind, env)
+                                : cliproxyAuthDirectory(env);
+                            const path = join(directory, `${label}.json`);
+                            let credential = account.credential;
+                            if (credential === undefined) {
+                                if (!existsSync(path)) {
+                                    throw new ControlError({
+                                        code: "not_found",
+                                        message: `${kind}/${label} is not enrolled`
+                                    });
+                                }
+                                try {
+                                    credential = JSON.parse(readFileSync(path, "utf8"));
+                                }
+                                catch {
+                                    throw new ControlError({
+                                        code: "bad_request",
+                                        message: `${kind}/${label} has an invalid stored credential`
+                                    });
+                                }
+                            }
+                            const blob = connector === "native"
+                                ? safeCredentialBlob(kind, credential)
+                                : safeCliproxyCredentialBlob(kind, credential);
+                            const content = `${JSON.stringify(blob, null, 2)}\n`;
+                            if (connector === "native" &&
+                                account.credential !== undefined &&
+                                existsSync(path) &&
+                                readFileSync(path, "utf8") !== content) {
+                                throw new ControlError({
+                                    code: "conflict",
+                                    message: `${kind}/${label} is already enrolled with different credentials`
+                                });
+                            }
+                            return {
+                                label,
+                                directory,
+                                path,
+                                content,
+                                credentialProvided: account.credential !== undefined
+                            };
+                        });
+                    },
+                    catch: toRouteKitFailure
+                });
+                yield* runtimeState.serializeEffect(Effect.gen(function* () {
+                    yield* Effect.try({
+                        try: () => {
+                            for (const entry of prepared) {
+                                if (!entry.credentialProvided) {
+                                    if (!existsSync(entry.path)) {
+                                        throw new ControlError({
+                                            code: "not_found",
+                                            message: `${kind}/${entry.label} is not enrolled`
+                                        });
+                                    }
+                                    let stored;
+                                    try {
+                                        stored = JSON.parse(readFileSync(entry.path, "utf8"));
+                                    }
+                                    catch {
+                                        throw new ControlError({
+                                            code: "bad_request",
+                                            message: `${kind}/${entry.label} has an invalid stored credential`
+                                        });
+                                    }
+                                    const blob = connector === "native"
+                                        ? safeCredentialBlob(kind, stored)
+                                        : safeCliproxyCredentialBlob(kind, stored);
+                                    entry.content = `${JSON.stringify(blob, null, 2)}\n`;
+                                }
+                                else if (connector === "native" &&
+                                    existsSync(entry.path) &&
+                                    readFileSync(entry.path, "utf8") !== entry.content) {
+                                    throw new ControlError({
+                                        code: "conflict",
+                                        message: `${kind}/${entry.label} is already enrolled with different credentials`
+                                    });
+                                }
+                            }
+                        },
+                        catch: toRouteKitFailure
+                    });
+                    const unchanged = prepared.every((entry) => existsSync(entry.path) && readFileSync(entry.path, "utf8") === entry.content);
+                    if (unchanged &&
+                        runtimeState.config.providers[provider] !== undefined) {
+                        return;
+                    }
+                    const raw = parseYaml(runtimeState.document);
+                    const providers = typeof raw.providers === "object" &&
+                        raw.providers !== null &&
+                        !Array.isArray(raw.providers)
+                        ? { ...raw.providers }
+                        : {};
+                    providers[provider] ??= {};
+                    raw.providers = providers;
+                    const document = stringifyYaml(raw);
+                    const nextConfig = parseConfigDocument(document);
+                    const transaction = prepareAccountTransaction({
+                        home,
+                        configPath,
+                        accountPaths: [
+                            ...prepared.map((entry) => entry.path),
+                            ...(connector === "native"
+                                ? [join(home, "subscriptions", "account-auth.v1.json")]
+                                : [])
+                        ],
+                        accountRoots: [
+                            ...new Set(prepared.map((entry) => entry.directory)),
+                            ...(connector === "native" ? [join(home, "subscriptions")] : [])
+                        ],
+                        kind,
+                        provider,
+                        labels: prepared.map((entry) => entry.label)
+                    });
+                    host.onAccountTransactionPhase?.("prepared");
+                    let routerReplaced = false;
+                    const previousConfig = runtimeState.config;
+                    const previousDocument = runtimeState.document;
+                    yield* Effect.gen(function* () {
+                        yield* Effect.try({
+                            try: () => {
+                                for (const entry of prepared) {
+                                    mkdirSync(entry.directory, { recursive: true, mode: 0o700 });
+                                    writeFileAtomic(entry.path, entry.content, { mode: 0o600 });
+                                    chmodSync(entry.path, 0o600);
+                                }
+                                host.onAccountTransactionPhase?.("credentials-written");
+                            },
+                            catch: toRouteKitFailure
+                        });
+                        yield* replaceRouter(nextConfig, document, {
+                            write: true,
+                            configRevision: true,
+                            accountRevision: true,
+                            persist: () => Effect.gen(function* () {
+                                if (connector === "native") {
+                                    for (const entry of prepared) {
+                                        yield* authHealth.activateFingerprint(subscriptionAccountIdentity(kind, entry.label), subscriptionCredentialFingerprint(entry.path));
+                                    }
+                                }
+                                markAccountTransactionCommitted(transaction);
+                                if (connector === "cliproxy") {
+                                    yield* sidecar.refresh;
+                                }
+                                host.onAccountTransactionPhase?.("committed");
+                            })
+                        });
+                        routerReplaced = true;
+                        host.onAccountTransactionPhase?.("router-swapped");
+                        yield* Effect.try({
+                            try: () => cleanupAccountTransaction(transaction),
+                            catch: toRouteKitFailure
+                        }).pipe(Effect.ignore);
+                    }).pipe(Effect.catch((error) => Effect.gen(function* () {
+                        const rollbackFailures = [];
+                        yield* Effect.try({
+                            try: () => {
+                                rollbackAccountTransaction(transaction, home);
+                            },
+                            catch: toRouteKitFailure
+                        }).pipe(Effect.flatMap(() => authHealth.reload), Effect.catch((rollbackError) => {
+                            rollbackFailures.push(rollbackError);
+                            return Effect.void;
+                        }));
+                        if (connector === "cliproxy") {
+                            yield* sidecar.refresh.pipe(Effect.catch((rollbackError) => {
+                                rollbackFailures.push(rollbackError);
+                                return Effect.void;
+                            }));
+                        }
+                        if (routerReplaced) {
+                            yield* replaceRouter(previousConfig, previousDocument, { write: false }).pipe(Effect.catch((rollbackError) => {
+                                rollbackFailures.push(rollbackError);
+                                return Effect.void;
+                            }));
+                        }
+                        if (rollbackFailures.length > 0) {
+                            return yield* Effect.fail(new AggregateError([error, ...rollbackFailures], `could not activate ${kind}; rollback failed`));
+                        }
+                        return yield* Effect.fail(routeKitError(error));
+                    })));
+                }));
+                return {
+                    enrolled: prepared.map((entry) => ({ subscriptionKind: kind, label: entry.label })),
+                    activated: true,
+                    configPath,
+                    configRevision: runtimeState.revisions.config,
+                    accountRevision: runtimeState.revisions.accounts
+                };
+            })
+        };
+    }
+}

package/dist/account-mutation-service.d.ts

@@ -0,0 +1,7 @@
+import type { EffectRouteKitControlHandlers } from "@velum-labs/routekit-control/effect";
+type AccountMutationHandlers = Pick<EffectRouteKitControlHandlers, "accounts.remove" | "accounts.rename" | "accounts.sync" | "accounts.resetCredits" | "accounts.redeemReset">;
+/** Owns account removal, rename, sync, and credit redemption. */
+export declare class AccountMutationService {
+    handlers(): AccountMutationHandlers;
+}
+export {};

package/dist/account-mutation-service.js

@@ -0,0 +1,322 @@
+import { chmodSync, existsSync, lstatSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { cliproxyAccountEntries, cliproxyAccountMatchesKind, defaultSubscriptionAccountDirectory, RateLimitTracker, removeCliproxyAccount, removeSubscriptionAccount, renameSubscriptionAccount, sanitizeSubscriptionLabel, subscriptionAccountIdentity } from "@velum-labs/routekit-accounts";
+import { resolveAccountConnector } from "@velum-labs/routekit-registry";
+import { ControlError } from "@velum-labs/routekit-runtime/control";
+import { writeFileAtomic } from "@velum-labs/routekit-runtime/filesystem";
+import { routeKitError, toRouteKitFailure } from "@velum-labs/routekit-runtime/effect";
+import { Effect } from "effect";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { cleanupAccountTransaction, markAccountTransactionCommitted, prepareAccountTransaction, rollbackAccountTransaction } from "./account-transaction.js";
+import { DaemonHost } from "./daemon-host-context.js";
+import { daemonAccountServices } from "./account-services.js";
+import { accountEntries, parseConfigDocument } from "./daemon-maintenance.js";
+function rollbackAccountCoordinators(transaction, home, activity, authHealth, error, message) {
+    return Effect.gen(function* () {
+        yield* Effect.try({
+            try: () => {
+                rollbackAccountTransaction(transaction, home);
+            },
+            catch: (rollbackError) => new AggregateError([error, rollbackError], message)
+        });
+        yield* activity.reload.pipe(Effect.mapError((rollbackError) => new AggregateError([error, rollbackError], message)));
+        yield* authHealth.reload.pipe(Effect.mapError((rollbackError) => new AggregateError([error, rollbackError], message)));
+        return yield* Effect.fail(routeKitError(error));
+    });
+}
+/** Owns account removal, rename, sync, and credit redemption. */
+export class AccountMutationService {
+    handlers() {
+        return {
+            "accounts.remove": (params) => Effect.gen(function* () {
+                const { env: daemonEnv, state: runtimeState, generations, activity, auth: authHealth, sidecar } = yield* daemonAccountServices;
+                const env = daemonEnv.env;
+                const home = daemonEnv.home;
+                const configPath = daemonEnv.configPath;
+                const replaceRouter = generations.replace;
+                const resolved = resolveAccountConnector(params.kind);
+                if (resolved === undefined) {
+                    return yield* Effect.fail(new ControlError({
+                        code: "bad_request",
+                        message: `unknown subscription kind: ${params.kind}`
+                    }));
+                }
+                const kind = resolved.kind;
+                let removed = false;
+                yield* runtimeState.serializeEffect(Effect.gen(function* () {
+                    const directory = resolved.info.connector === "native"
+                        ? defaultSubscriptionAccountDirectory(kind, env)
+                        : undefined;
+                    const nativePath = directory === undefined ? undefined : join(directory, `${params.label}.json`);
+                    if (nativePath !== undefined && existsSync(nativePath)) {
+                        const nativeKind = kind;
+                        const hasRemainingAccount = accountEntries(env).some((entry) => entry.connector === "native" &&
+                            entry.subscriptionKind === nativeKind &&
+                            entry.label !== params.label);
+                        const raw = parseYaml(runtimeState.document);
+                        const providers = typeof raw.providers === "object" &&
+                            raw.providers !== null &&
+                            !Array.isArray(raw.providers)
+                            ? { ...raw.providers }
+                            : {};
+                        const disableProvider = !hasRemainingAccount && runtimeState.config.providers[nativeKind] !== undefined;
+                        if (disableProvider) {
+                            delete providers[nativeKind];
+                            raw.providers = providers;
+                            if (typeof raw.defaultModel === "string" &&
+                                raw.defaultModel.startsWith(`${nativeKind}/`)) {
+                                delete raw.defaultModel;
+                            }
+                        }
+                        const document = disableProvider ? stringifyYaml(raw) : runtimeState.document;
+                        const config = disableProvider
+                            ? parseConfigDocument(document)
+                            : runtimeState.config;
+                        const transaction = prepareAccountTransaction({
+                            home,
+                            configPath,
+                            accountPaths: [
+                                nativePath,
+                                join(home, "usage", "account-activity.v1.json"),
+                                join(home, "subscriptions", "account-auth.v1.json")
+                            ],
+                            accountRoots: [dirname(nativePath), home, join(home, "subscriptions")],
+                            kind: nativeKind,
+                            provider: nativeKind,
+                            labels: [params.label]
+                        });
+                        const rollbackMessage = `could not remove ${kind}/${params.label}; rollback failed`;
+                        yield* Effect.gen(function* () {
+                            const outcome = yield* Effect.try({
+                                try: () => {
+                                    const result = removeSubscriptionAccount(nativeKind, params.label, {
+                                        accountsDirectory: dirname(nativePath)
+                                    });
+                                    if (!result.removed)
+                                        cleanupAccountTransaction(transaction);
+                                    return result;
+                                },
+                                catch: toRouteKitFailure
+                            });
+                            removed = outcome.removed;
+                            if (!removed)
+                                return;
+                            yield* replaceRouter(config, document, {
+                                write: disableProvider,
+                                configRevision: disableProvider,
+                                accountRevision: true,
+                                persist: () => Effect.gen(function* () {
+                                    yield* activity.remove(subscriptionAccountIdentity(nativeKind, params.label));
+                                    yield* authHealth.remove(subscriptionAccountIdentity(nativeKind, params.label));
+                                    markAccountTransactionCommitted(transaction);
+                                })
+                            });
+                            yield* Effect.try({
+                                try: () => cleanupAccountTransaction(transaction),
+                                catch: toRouteKitFailure
+                            }).pipe(Effect.ignore);
+                        }).pipe(Effect.catch((error) => rollbackAccountCoordinators(transaction, home, activity, authHealth, error, rollbackMessage)));
+                        return;
+                    }
+                    const entry = cliproxyAccountEntries(env).find((candidate) => candidate.label === params.label && cliproxyAccountMatchesKind(candidate, kind));
+                    if (entry === undefined)
+                        return;
+                    const previous = yield* Effect.try({
+                        try: () => readFileSync(entry.path),
+                        catch: toRouteKitFailure
+                    });
+                    const cliproxyResult = yield* Effect.try({
+                        try: () => removeCliproxyAccount(params.label, env),
+                        catch: toRouteKitFailure
+                    });
+                    removed = cliproxyResult.removed;
+                    if (!removed)
+                        return;
+                    yield* Effect.gen(function* () {
+                        yield* sidecar.refresh;
+                        yield* replaceRouter(runtimeState.config, runtimeState.document, {
+                            write: false,
+                            accountRevision: true
+                        });
+                    }).pipe(Effect.catch((error) => Effect.gen(function* () {
+                        yield* Effect.try({
+                            try: () => {
+                                writeFileAtomic(entry.path, previous.toString("utf8"), { mode: 0o600 });
+                                chmodSync(entry.path, 0o600);
+                            },
+                            catch: toRouteKitFailure
+                        });
+                        yield* sidecar.refresh.pipe(Effect.ignore);
+                        return yield* Effect.fail(routeKitError(error));
+                    })));
+                }));
+                return { removed, revision: runtimeState.revisions.accounts };
+            }),
+            "accounts.rename": (params) => Effect.gen(function* () {
+                const { env: daemonEnv, state: runtimeState, generations, activity, auth: authHealth } = yield* daemonAccountServices;
+                const host = yield* DaemonHost;
+                const env = daemonEnv.env;
+                const home = daemonEnv.home;
+                const configPath = daemonEnv.configPath;
+                const replaceRouter = generations.replace;
+                const resolved = resolveAccountConnector(params.kind);
+                if (resolved === undefined || resolved.info.connector !== "native") {
+                    return yield* Effect.fail(new ControlError({
+                        code: "bad_request",
+                        message: "account rename supports only claude-code and codex"
+                    }));
+                }
+                for (const [field, label] of [
+                    ["source", params.source],
+                    ["target", params.target]
+                ]) {
+                    if (sanitizeSubscriptionLabel(label) !== label || label.startsWith(".")) {
+                        return yield* Effect.fail(new ControlError({
+                            code: "bad_request",
+                            message: `${field} account label must already be normalized`
+                        }));
+                    }
+                }
+                const kind = resolved.kind;
+                yield* runtimeState.serializeEffect(Effect.gen(function* () {
+                    const directory = defaultSubscriptionAccountDirectory(kind, env);
+                    const sourcePath = join(directory, `${params.source}.json`);
+                    const targetPath = join(directory, `${params.target}.json`);
+                    yield* Effect.try({
+                        try: () => {
+                            if (!existsSync(sourcePath)) {
+                                throw new ControlError({
+                                    code: "not_found",
+                                    message: `${kind}/${params.source} is not enrolled`
+                                });
+                            }
+                            try {
+                                lstatSync(targetPath);
+                                throw new ControlError({
+                                    code: "conflict",
+                                    message: `${kind}/${params.target} is already enrolled`
+                                });
+                            }
+                            catch (error) {
+                                if (error instanceof ControlError ||
+                                    typeof error !== "object" ||
+                                    error === null ||
+                                    !("code" in error) ||
+                                    error.code !== "ENOENT") {
+                                    throw error;
+                                }
+                            }
+                        },
+                        catch: toRouteKitFailure
+                    });
+                    const transaction = prepareAccountTransaction({
+                        home,
+                        configPath,
+                        accountPaths: [
+                            sourcePath,
+                            targetPath,
+                            join(directory, ".state.json"),
+                            join(home, "usage", "account-activity.v1.json"),
+                            join(home, "subscriptions", "account-auth.v1.json")
+                        ],
+                        accountRoots: [directory, home, join(home, "subscriptions")],
+                        kind,
+                        provider: kind,
+                        labels: [params.source, params.target]
+                    });
+                    yield* Effect.gen(function* () {
+                        yield* Effect.try({
+                            try: () => {
+                                renameSubscriptionAccount(kind, params.source, params.target, {
+                                    accountsDirectory: directory
+                                });
+                            },
+                            catch: toRouteKitFailure
+                        });
+                        const tracker = yield* RateLimitTracker.open(join(directory, ".state.json"), kind);
+                        yield* tracker.renameMember(params.source, params.target);
+                        host.onAccountTransactionPhase?.("credentials-written");
+                        yield* replaceRouter(runtimeState.config, runtimeState.document, {
+                            write: false,
+                            accountRevision: true,
+                            persist: () => Effect.gen(function* () {
+                                yield* activity.rename(subscriptionAccountIdentity(kind, params.source), subscriptionAccountIdentity(kind, params.target));
+                                yield* authHealth.rename(subscriptionAccountIdentity(kind, params.source), subscriptionAccountIdentity(kind, params.target));
+                                markAccountTransactionCommitted(transaction);
+                            })
+                        });
+                        yield* Effect.try({
+                            try: () => cleanupAccountTransaction(transaction),
+                            catch: toRouteKitFailure
+                        }).pipe(Effect.ignore);
+                    }).pipe(Effect.catch((error) => rollbackAccountCoordinators(transaction, home, activity, authHealth, error, `could not rename ${kind}/${params.source}; rollback failed`)));
+                }));
+                return { renamed: true, revision: runtimeState.revisions.accounts };
+            }),
+            "accounts.sync": () => Effect.gen(function* () {
+                const { state: runtimeState, generations, sidecar } = yield* daemonAccountServices;
+                return yield* runtimeState.serializeEffect(Effect.gen(function* () {
+                    yield* sidecar.refresh;
+                    yield* generations.replace(runtimeState.config, runtimeState.document, {
+                        write: false,
+                        accountRevision: true
+                    });
+                    return { synced: true, revision: runtimeState.revisions.accounts };
+                }));
+            }),
+            "accounts.resetCredits": (params, context) => Effect.gen(function* () {
+                const { gateway } = yield* daemonAccountServices;
+                return yield* gateway
+                    .router()
+                    .listResetCredits(params.kind, params.label, context.signal)
+                    .pipe(Effect.map((resetCredits) => ({
+                    kind: params.kind,
+                    label: params.label,
+                    resetCredits
+                })), Effect.catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    if (message.includes("is not enrolled") ||
+                        message.includes("no codex account pool")) {
+                        return Effect.fail(new ControlError({ code: "not_found", message }));
+                    }
+                    return Effect.fail(routeKitError(error));
+                }));
+            }),
+            "accounts.redeemReset": (params, context) => Effect.gen(function* () {
+                const { gateway } = yield* daemonAccountServices;
+                return yield* gateway
+                    .router()
+                    .redeemReset({
+                    kind: params.kind,
+                    label: params.label,
+                    ...(params.creditId !== undefined ? { creditId: params.creditId } : {}),
+                    ...(params.redeemRequestId !== undefined
+                        ? { redeemRequestId: params.redeemRequestId }
+                        : {})
+                }, context.signal)
+                    .pipe(Effect.map((result) => ({
+                    ok: result.ok,
+                    code: result.code,
+                    kind: "codex",
+                    label: result.label,
+                    redeemRequestId: result.redeemRequestId,
+                    ...(result.creditId !== undefined ? { creditId: result.creditId } : {}),
+                    ...(result.windowsReset !== undefined ? { windowsReset: result.windowsReset } : {}),
+                    usage: result.usage
+                })), Effect.catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    if (message.includes("is not enrolled") || message.includes("no redeemable")) {
+                        return Effect.fail(new ControlError({ code: "not_found", message }));
+                    }
+                    if (message.includes("does not support") ||
+                        message.includes("no codex account pool") ||
+                        message.includes("creditId must not be empty") ||
+                        message.includes("account label is required")) {
+                        return Effect.fail(new ControlError({ code: "bad_request", message }));
+                    }
+                    return Effect.fail(new ControlError({ code: "internal", message }));
+                }));
+            })
+        };
+    }
+}

package/dist/account-query-service.d.ts

@@ -0,0 +1,7 @@
+import type { EffectRouteKitControlHandlers } from "@velum-labs/routekit-control/effect";
+type AccountQueryHandlers = Pick<EffectRouteKitControlHandlers, "accounts.list" | "accounts.status" | "accounts.usage">;
+/** Owns account inventory, live status, and usage queries. */
+export declare class AccountQueryService {
+    handlers(): AccountQueryHandlers;
+}
+export {};