@velum-labs/routekit-daemon 1.3.2 → 1.5.0

package/dist/account-enroll-service.d.ts

@@ -1,7 +1,5 @@
 import type { EffectRouteKitControlHandlers } from "@velum-labs/routekit-control/effect";
 type AccountEnrollHandlers = Pick<EffectRouteKitControlHandlers, "accounts.enroll" | "accounts.enrollActivate">;
 /** Owns account enrollment and activation transactions. */
-export declare class AccountEnrollService {
-    handlers(): AccountEnrollHandlers;
-}
+export declare const accountEnrollHandlers: AccountEnrollHandlers;
 export {};

package/dist/account-enroll-service.js

@@ -1,6 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
-import { cliproxyAuthDirectory, defaultSubscriptionAccountDirectory, sanitizeSubscriptionLabel, subscriptionAccountIdentity, subscriptionCredentialFingerprint } from "@velum-labs/routekit-accounts";
+import { cliproxyAuthDirectory, defaultSubscriptionAccountDirectory, sanitizeSubscriptionLabel } from "@velum-labs/routekit-accounts";
+import { AccountAuth } from "@velum-labs/routekit-accounts/effect";
 import { resolveAccountConnector } from "@velum-labs/routekit-registry";
 import { ControlError } from "@velum-labs/routekit-runtime/control";
 import { writeFileAtomic } from "@velum-labs/routekit-runtime/filesystem";
@@ -9,282 +10,281 @@ import { Effect } from "effect";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { cleanupAccountTransaction, markAccountTransactionCommitted, prepareAccountTransaction, rollbackAccountTransaction } from "./account-transaction.js";
 import { DaemonHost } from "./daemon-host-context.js";
-import { daemonAccountServices } from "./account-services.js";
+import { DaemonEnv } from "./daemon-env-context.js";
 import { parseConfigDocument, safeCliproxyCredentialBlob, safeCliproxyLabel, safeCredentialBlob } from "./daemon-maintenance.js";
+import { DaemonState } from "./daemon-state-context.js";
+import { Generations } from "./services/generations/service.js";
+import { Sidecar } from "./sidecar-context.js";
 /** Owns account enrollment and activation transactions. */
-export class AccountEnrollService {
-    handlers() {
-        return {
-            "accounts.enroll": (params) => Effect.gen(function* () {
-                const { env: daemonEnv, state: runtimeState, generations } = yield* daemonAccountServices;
-                const host = yield* DaemonHost;
-                const env = daemonEnv.env;
-                return yield* runtimeState.serializeEffect(Effect.gen(function* () {
-                    const path = yield* Effect.try({
-                        try: () => {
-                            const label = sanitizeSubscriptionLabel(params.label);
-                            if (label !== params.label || label.startsWith(".")) {
-                                throw new ControlError({
-                                    code: "bad_request",
-                                    message: "account label must already be normalized"
-                                });
-                            }
-                            const directory = defaultSubscriptionAccountDirectory(params.kind, env);
-                            mkdirSync(directory, { recursive: true, mode: 0o700 });
-                            const credentialPath = join(directory, `${label}.json`);
-                            if (existsSync(credentialPath)) {
+export const accountEnrollHandlers = {
+    "accounts.enroll": (params) => Effect.gen(function* () {
+        const daemonEnv = yield* DaemonEnv;
+        const runtimeState = yield* DaemonState;
+        const generations = yield* Generations;
+        return yield* runtimeState.serializeEffect(Effect.gen(function* () {
+            const path = yield* Effect.try({
+                try: () => {
+                    const label = sanitizeSubscriptionLabel(params.label);
+                    if (label !== params.label || label.startsWith(".")) {
+                        throw new ControlError({
+                            code: "bad_request",
+                            message: "account label must already be normalized"
+                        });
+                    }
+                    const directory = defaultSubscriptionAccountDirectory(params.kind, daemonEnv.env);
+                    mkdirSync(directory, { recursive: true, mode: 0o700 });
+                    const credentialPath = join(directory, `${label}.json`);
+                    if (existsSync(credentialPath)) {
+                        throw new ControlError({
+                            code: "conflict",
+                            message: `${params.kind}/${label} is already enrolled; remove it before enrolling again`
+                        });
+                    }
+                    writeFileAtomic(credentialPath, `${JSON.stringify(safeCredentialBlob(params.kind, params.credential), null, 2)}\n`, { mode: 0o600 });
+                    chmodSync(credentialPath, 0o600);
+                    return credentialPath;
+                },
+                catch: toRouteKitFailure
+            });
+            yield* generations
+                .replace(runtimeState.config, runtimeState.document, {
+                write: false,
+                accountRevision: true
+            })
+                .pipe(Effect.catch((error) => {
+                rmSync(path, { force: true });
+                return Effect.fail(routeKitError(error));
+            }));
+            return { enrolled: true, revision: runtimeState.revisions.accounts };
+        }));
+    }),
+    "accounts.enrollActivate": (params) => Effect.gen(function* () {
+        const daemonEnv = yield* DaemonEnv;
+        const runtimeState = yield* DaemonState;
+        const generations = yield* Generations;
+        const authHealth = yield* AccountAuth;
+        const sidecar = yield* Sidecar;
+        const host = yield* DaemonHost;
+        const env = daemonEnv.env;
+        const home = daemonEnv.home;
+        const configPath = daemonEnv.configPath;
+        const replaceRouter = generations.replace;
+        const resolved = resolveAccountConnector(params.kind);
+        if (resolved === undefined) {
+            return yield* Effect.fail(new ControlError({
+                code: "bad_request",
+                message: `unknown subscription kind: ${params.kind}`
+            }));
+        }
+        const kind = resolved.kind;
+        const connector = resolved.info.connector;
+        const provider = connector === "cliproxy" ? "cliproxy" : kind;
+        const prepared = yield* Effect.try({
+            try: () => {
+                const seenLabels = new Set();
+                return params.accounts.map((account) => {
+                    const label = connector === "native"
+                        ? sanitizeSubscriptionLabel(account.label)
+                        : safeCliproxyLabel(account.label);
+                    if (label !== account.label || (connector === "native" && label.startsWith("."))) {
+                        throw new ControlError({
+                            code: "bad_request",
+                            message: "account label must already be normalized"
+                        });
+                    }
+                    if (seenLabels.has(label)) {
+                        throw new ControlError({
+                            code: "bad_request",
+                            message: `duplicate account label: ${label}`
+                        });
+                    }
+                    seenLabels.add(label);
+                    const directory = connector === "native"
+                        ? defaultSubscriptionAccountDirectory(kind, env)
+                        : cliproxyAuthDirectory(env);
+                    const path = join(directory, `${label}.json`);
+                    let credential = account.credential;
+                    if (credential === undefined) {
+                        if (!existsSync(path)) {
+                            throw new ControlError({
+                                code: "not_found",
+                                message: `${kind}/${label} is not enrolled`
+                            });
+                        }
+                        try {
+                            credential = JSON.parse(readFileSync(path, "utf8"));
+                        }
+                        catch {
+                            throw new ControlError({
+                                code: "bad_request",
+                                message: `${kind}/${label} has an invalid stored credential`
+                            });
+                        }
+                    }
+                    const blob = connector === "native"
+                        ? safeCredentialBlob(kind, credential)
+                        : safeCliproxyCredentialBlob(kind, credential);
+                    const content = `${JSON.stringify(blob, null, 2)}\n`;
+                    if (connector === "native" &&
+                        account.credential !== undefined &&
+                        existsSync(path) &&
+                        readFileSync(path, "utf8") !== content) {
+                        throw new ControlError({
+                            code: "conflict",
+                            message: `${kind}/${label} is already enrolled with different credentials`
+                        });
+                    }
+                    return {
+                        label,
+                        directory,
+                        path,
+                        content,
+                        credentialProvided: account.credential !== undefined
+                    };
+                });
+            },
+            catch: toRouteKitFailure
+        });
+        yield* runtimeState.serializeEffect(Effect.gen(function* () {
+            yield* Effect.try({
+                try: () => {
+                    for (const entry of prepared) {
+                        if (!entry.credentialProvided) {
+                            if (!existsSync(entry.path)) {
                                 throw new ControlError({
-                                    code: "conflict",
-                                    message: `${params.kind}/${label} is already enrolled; remove it before enrolling again`
+                                    code: "not_found",
+                                    message: `${kind}/${entry.label} is not enrolled`
                                 });
                             }
-                            writeFileAtomic(credentialPath, `${JSON.stringify(safeCredentialBlob(params.kind, params.credential), null, 2)}\n`, { mode: 0o600 });
-                            chmodSync(credentialPath, 0o600);
-                            return credentialPath;
-                        },
-                        catch: toRouteKitFailure
-                    });
-                    yield* generations
-                        .replace(runtimeState.config, runtimeState.document, {
-                        write: false,
-                        accountRevision: true
-                    })
-                        .pipe(Effect.catch((error) => {
-                        rmSync(path, { force: true });
-                        return Effect.fail(routeKitError(error));
-                    }));
-                    return { enrolled: true, revision: runtimeState.revisions.accounts };
-                }));
-            }),
-            "accounts.enrollActivate": (params) => Effect.gen(function* () {
-                const { env: daemonEnv, state: runtimeState, generations, auth: authHealth, sidecar } = yield* daemonAccountServices;
-                const host = yield* DaemonHost;
-                const env = daemonEnv.env;
-                const home = daemonEnv.home;
-                const configPath = daemonEnv.configPath;
-                const replaceRouter = generations.replace;
-                const resolved = resolveAccountConnector(params.kind);
-                if (resolved === undefined) {
-                    return yield* Effect.fail(new ControlError({
-                        code: "bad_request",
-                        message: `unknown subscription kind: ${params.kind}`
-                    }));
-                }
-                const kind = resolved.kind;
-                const connector = resolved.info.connector;
-                const provider = connector === "cliproxy" ? "cliproxy" : kind;
-                const prepared = yield* Effect.try({
-                    try: () => {
-                        const seenLabels = new Set();
-                        return params.accounts.map((account) => {
-                            const label = connector === "native"
-                                ? sanitizeSubscriptionLabel(account.label)
-                                : safeCliproxyLabel(account.label);
-                            if (label !== account.label || (connector === "native" && label.startsWith("."))) {
-                                throw new ControlError({
-                                    code: "bad_request",
-                                    message: "account label must already be normalized"
-                                });
+                            let stored;
+                            try {
+                                stored = JSON.parse(readFileSync(entry.path, "utf8"));
                             }
-                            if (seenLabels.has(label)) {
+                            catch {
                                 throw new ControlError({
                                     code: "bad_request",
-                                    message: `duplicate account label: ${label}`
+                                    message: `${kind}/${entry.label} has an invalid stored credential`
                                 });
                             }
-                            seenLabels.add(label);
-                            const directory = connector === "native"
-                                ? defaultSubscriptionAccountDirectory(kind, env)
-                                : cliproxyAuthDirectory(env);
-                            const path = join(directory, `${label}.json`);
-                            let credential = account.credential;
-                            if (credential === undefined) {
-                                if (!existsSync(path)) {
-                                    throw new ControlError({
-                                        code: "not_found",
-                                        message: `${kind}/${label} is not enrolled`
-                                    });
-                                }
-                                try {
-                                    credential = JSON.parse(readFileSync(path, "utf8"));
-                                }
-                                catch {
-                                    throw new ControlError({
-                                        code: "bad_request",
-                                        message: `${kind}/${label} has an invalid stored credential`
-                                    });
-                                }
-                            }
                             const blob = connector === "native"
-                                ? safeCredentialBlob(kind, credential)
-                                : safeCliproxyCredentialBlob(kind, credential);
-                            const content = `${JSON.stringify(blob, null, 2)}\n`;
-                            if (connector === "native" &&
-                                account.credential !== undefined &&
-                                existsSync(path) &&
-                                readFileSync(path, "utf8") !== content) {
-                                throw new ControlError({
-                                    code: "conflict",
-                                    message: `${kind}/${label} is already enrolled with different credentials`
-                                });
-                            }
-                            return {
-                                label,
-                                directory,
-                                path,
-                                content,
-                                credentialProvided: account.credential !== undefined
-                            };
-                        });
+                                ? safeCredentialBlob(kind, stored)
+                                : safeCliproxyCredentialBlob(kind, stored);
+                            entry.content = `${JSON.stringify(blob, null, 2)}\n`;
+                        }
+                        else if (connector === "native" &&
+                            existsSync(entry.path) &&
+                            readFileSync(entry.path, "utf8") !== entry.content) {
+                            throw new ControlError({
+                                code: "conflict",
+                                message: `${kind}/${entry.label} is already enrolled with different credentials`
+                            });
+                        }
+                    }
+                },
+                catch: toRouteKitFailure
+            });
+            const unchanged = prepared.every((entry) => existsSync(entry.path) && readFileSync(entry.path, "utf8") === entry.content);
+            if (unchanged && runtimeState.config.sources[provider] !== undefined) {
+                return;
+            }
+            const raw = parseYaml(runtimeState.document);
+            const sources = typeof raw.sources === "object" && raw.sources !== null && !Array.isArray(raw.sources)
+                ? { ...raw.sources }
+                : Object.fromEntries(Object.entries(runtimeState.config.sources).map(([sourceId, source]) => [
+                    sourceId,
+                    source
+                ]));
+            sources[provider] ??= { use: provider };
+            raw.sources = sources;
+            delete raw.providers;
+            const document = stringifyYaml(raw);
+            const nextConfig = parseConfigDocument(document);
+            const transaction = prepareAccountTransaction({
+                home,
+                configPath,
+                accountPaths: [
+                    ...prepared.map((entry) => entry.path),
+                    ...(connector === "native"
+                        ? [join(home, "subscriptions", "account-auth.v1.json")]
+                        : [])
+                ],
+                accountRoots: [
+                    ...new Set(prepared.map((entry) => entry.directory)),
+                    ...(connector === "native" ? [join(home, "subscriptions")] : [])
+                ],
+                kind,
+                provider,
+                labels: prepared.map((entry) => entry.label)
+            });
+            host.onAccountTransactionPhase?.("prepared");
+            let routerReplaced = false;
+            const previousConfig = runtimeState.config;
+            const previousDocument = runtimeState.document;
+            yield* Effect.gen(function* () {
+                yield* Effect.try({
+                    try: () => {
+                        for (const entry of prepared) {
+                            mkdirSync(entry.directory, { recursive: true, mode: 0o700 });
+                            writeFileAtomic(entry.path, entry.content, { mode: 0o600 });
+                            chmodSync(entry.path, 0o600);
+                        }
+                        host.onAccountTransactionPhase?.("credentials-written");
                     },
                     catch: toRouteKitFailure
                 });
-                yield* runtimeState.serializeEffect(Effect.gen(function* () {
-                    yield* Effect.try({
-                        try: () => {
-                            for (const entry of prepared) {
-                                if (!entry.credentialProvided) {
-                                    if (!existsSync(entry.path)) {
-                                        throw new ControlError({
-                                            code: "not_found",
-                                            message: `${kind}/${entry.label} is not enrolled`
-                                        });
-                                    }
-                                    let stored;
-                                    try {
-                                        stored = JSON.parse(readFileSync(entry.path, "utf8"));
-                                    }
-                                    catch {
-                                        throw new ControlError({
-                                            code: "bad_request",
-                                            message: `${kind}/${entry.label} has an invalid stored credential`
-                                        });
-                                    }
-                                    const blob = connector === "native"
-                                        ? safeCredentialBlob(kind, stored)
-                                        : safeCliproxyCredentialBlob(kind, stored);
-                                    entry.content = `${JSON.stringify(blob, null, 2)}\n`;
-                                }
-                                else if (connector === "native" &&
-                                    existsSync(entry.path) &&
-                                    readFileSync(entry.path, "utf8") !== entry.content) {
-                                    throw new ControlError({
-                                        code: "conflict",
-                                        message: `${kind}/${entry.label} is already enrolled with different credentials`
-                                    });
-                                }
-                            }
-                        },
-                        catch: toRouteKitFailure
-                    });
-                    const unchanged = prepared.every((entry) => existsSync(entry.path) && readFileSync(entry.path, "utf8") === entry.content);
-                    if (unchanged &&
-                        runtimeState.config.providers[provider] !== undefined) {
-                        return;
-                    }
-                    const raw = parseYaml(runtimeState.document);
-                    const providers = typeof raw.providers === "object" &&
-                        raw.providers !== null &&
-                        !Array.isArray(raw.providers)
-                        ? { ...raw.providers }
-                        : {};
-                    providers[provider] ??= {};
-                    raw.providers = providers;
-                    const document = stringifyYaml(raw);
-                    const nextConfig = parseConfigDocument(document);
-                    const transaction = prepareAccountTransaction({
-                        home,
-                        configPath,
-                        accountPaths: [
-                            ...prepared.map((entry) => entry.path),
-                            ...(connector === "native"
-                                ? [join(home, "subscriptions", "account-auth.v1.json")]
-                                : [])
-                        ],
-                        accountRoots: [
-                            ...new Set(prepared.map((entry) => entry.directory)),
-                            ...(connector === "native" ? [join(home, "subscriptions")] : [])
-                        ],
-                        kind,
-                        provider,
-                        labels: prepared.map((entry) => entry.label)
-                    });
-                    host.onAccountTransactionPhase?.("prepared");
-                    let routerReplaced = false;
-                    const previousConfig = runtimeState.config;
-                    const previousDocument = runtimeState.document;
-                    yield* Effect.gen(function* () {
-                        yield* Effect.try({
-                            try: () => {
-                                for (const entry of prepared) {
-                                    mkdirSync(entry.directory, { recursive: true, mode: 0o700 });
-                                    writeFileAtomic(entry.path, entry.content, { mode: 0o600 });
-                                    chmodSync(entry.path, 0o600);
-                                }
-                                host.onAccountTransactionPhase?.("credentials-written");
-                            },
-                            catch: toRouteKitFailure
-                        });
-                        yield* replaceRouter(nextConfig, document, {
-                            write: true,
-                            configRevision: true,
-                            accountRevision: true,
-                            persist: () => Effect.gen(function* () {
-                                if (connector === "native") {
-                                    for (const entry of prepared) {
-                                        yield* authHealth.activateFingerprint(subscriptionAccountIdentity(kind, entry.label), subscriptionCredentialFingerprint(entry.path));
-                                    }
-                                }
-                                markAccountTransactionCommitted(transaction);
-                                if (connector === "cliproxy") {
-                                    yield* sidecar.refresh;
-                                }
-                                host.onAccountTransactionPhase?.("committed");
-                            })
-                        });
-                        routerReplaced = true;
-                        host.onAccountTransactionPhase?.("router-swapped");
-                        yield* Effect.try({
-                            try: () => cleanupAccountTransaction(transaction),
-                            catch: toRouteKitFailure
-                        }).pipe(Effect.ignore);
-                    }).pipe(Effect.catch((error) => Effect.gen(function* () {
-                        const rollbackFailures = [];
-                        yield* Effect.try({
-                            try: () => {
-                                rollbackAccountTransaction(transaction, home);
-                            },
-                            catch: toRouteKitFailure
-                        }).pipe(Effect.flatMap(() => authHealth.reload), Effect.catch((rollbackError) => {
-                            rollbackFailures.push(rollbackError);
-                            return Effect.void;
-                        }));
+                yield* replaceRouter(nextConfig, document, {
+                    write: true,
+                    configRevision: true,
+                    accountRevision: true,
+                    persist: () => Effect.gen(function* () {
+                        markAccountTransactionCommitted(transaction);
                         if (connector === "cliproxy") {
-                            yield* sidecar.refresh.pipe(Effect.catch((rollbackError) => {
-                                rollbackFailures.push(rollbackError);
-                                return Effect.void;
-                            }));
-                        }
-                        if (routerReplaced) {
-                            yield* replaceRouter(previousConfig, previousDocument, { write: false }).pipe(Effect.catch((rollbackError) => {
-                                rollbackFailures.push(rollbackError);
-                                return Effect.void;
-                            }));
+                            yield* sidecar.refresh;
                         }
-                        if (rollbackFailures.length > 0) {
-                            return yield* Effect.fail(new AggregateError([error, ...rollbackFailures], `could not activate ${kind}; rollback failed`));
-                        }
-                        return yield* Effect.fail(routeKitError(error));
-                    })));
+                        host.onAccountTransactionPhase?.("committed");
+                    })
+                });
+                routerReplaced = true;
+                host.onAccountTransactionPhase?.("router-swapped");
+                yield* Effect.try({
+                    try: () => cleanupAccountTransaction(transaction),
+                    catch: toRouteKitFailure
+                }).pipe(Effect.ignore);
+            }).pipe(Effect.catch((error) => Effect.gen(function* () {
+                const rollbackFailures = [];
+                yield* Effect.try({
+                    try: () => {
+                        rollbackAccountTransaction(transaction, home);
+                    },
+                    catch: toRouteKitFailure
+                }).pipe(Effect.flatMap(() => authHealth.reload), Effect.catch((rollbackError) => {
+                    rollbackFailures.push(rollbackError);
+                    return Effect.void;
                 }));
-                return {
-                    enrolled: prepared.map((entry) => ({ subscriptionKind: kind, label: entry.label })),
-                    activated: true,
-                    configPath,
-                    configRevision: runtimeState.revisions.config,
-                    accountRevision: runtimeState.revisions.accounts
-                };
-            })
+                if (connector === "cliproxy") {
+                    yield* sidecar.refresh.pipe(Effect.catch((rollbackError) => {
+                        rollbackFailures.push(rollbackError);
+                        return Effect.void;
+                    }));
+                }
+                if (routerReplaced) {
+                    yield* replaceRouter(previousConfig, previousDocument, { write: false }).pipe(Effect.catch((rollbackError) => {
+                        rollbackFailures.push(rollbackError);
+                        return Effect.void;
+                    }));
+                }
+                if (rollbackFailures.length > 0) {
+                    return yield* Effect.fail(new AggregateError([error, ...rollbackFailures], `could not activate ${kind}; rollback failed`));
+                }
+                return yield* Effect.fail(routeKitError(error));
+            })));
+        }));
+        return {
+            enrolled: prepared.map((entry) => ({ subscriptionKind: kind, label: entry.label })),
+            activated: true,
+            configPath,
+            configRevision: runtimeState.revisions.config,
+            accountRevision: runtimeState.revisions.accounts
         };
-    }
-}
+    })
+};

package/dist/account-mutation-service.d.ts

@@ -1,7 +1,5 @@
 import type { EffectRouteKitControlHandlers } from "@velum-labs/routekit-control/effect";
 type AccountMutationHandlers = Pick<EffectRouteKitControlHandlers, "accounts.remove" | "accounts.rename" | "accounts.sync" | "accounts.resetCredits" | "accounts.redeemReset">;
 /** Owns account removal, rename, sync, and credit redemption. */
-export declare class AccountMutationService {
-    handlers(): AccountMutationHandlers;
-}
+export declare const accountMutationHandlers: AccountMutationHandlers;
 export {};