@velum-labs/routekit-daemon 1.3.2 → 1.5.0

package/dist/services/eval-session/service.js

@@ -1,22 +1,76 @@
 import { createHash, randomBytes } from "node:crypto";
+import { evalSessionEvidenceRequiredSchema, httpSubmissionBindingSchema, httpSubmissionOutcomeSchema, httpSubmissionRequestSchema } from "@velum-labs/routekit-control/protocol";
 import { ControlError } from "@velum-labs/routekit-runtime/control";
-import { Context, Effect, Layer } from "effect";
-import { ActiveGateway } from "../active-gateway/service.js";
+import { HttpSubmissionError } from "@velum-labs/routekit-runtime/effect";
+import { Cause, Context, Effect, Layer, Semaphore } from "effect";
 import { DaemonEnv } from "../../daemon-env-context.js";
+import { normalizeExecutionEvidence } from "../../eval-session-execution-store.js";
+import { ActiveGateway } from "../active-gateway/service.js";
 function digest(value) {
     return createHash("sha256").update(value, "utf8").digest("hex");
 }
-/** Daemon-owned, memory-only registry for short-lived eval credentials. */
+function submissionError(code, message) {
+    return new HttpSubmissionError({ code, message });
+}
+function grantOf(evidence) {
+    return {
+        grantId: evidence.grantId,
+        executionDigest: evidence.executionDigest,
+        issuerIdentity: evidence.issuerIdentity,
+        maximumProviderAttempts: evidence.maximumProviderAttempts,
+        policy: evidence.policy
+    };
+}
+function assertGrant(evidence, identity) {
+    if (evidence.sessionId !== identity.sessionId ||
+        evidence.grantId !== identity.grantId ||
+        evidence.executionDigest !== identity.executionDigest ||
+        evidence.issuerIdentity !== identity.issuerIdentity) {
+        throw submissionError("execution-identity", "provider submission grant identity does not match");
+    }
+}
+function assertOpen(evidence) {
+    if (evidence.state !== "open" ||
+        evidence.poisoned ||
+        evidence.receipts.some((receipt) => receipt.state === "unknown")) {
+        throw submissionError("execution-closed", "provider submission grant is revoked or poisoned");
+    }
+}
+function assertIngress(evidence, binding) {
+    assertGrant(evidence, binding);
+    const ingress = evidence.ingresses.find((entry) => entry.ingressId === binding.ingressId);
+    if (ingress === undefined ||
+        ingress.requestDigest !== binding.requestDigest ||
+        ingress.model !== binding.model) {
+        throw submissionError("ingress-identity", "provider submission ingress identity does not match");
+    }
+    return ingress;
+}
+/** Ephemeral bearer credentials with a separate durable, payload-free execution authority. */
 export class EvalSessionManager {
     #sessions = new Map();
     #sessionByTokenDigest = new Map();
     #now;
     #random;
+    #store;
+    #gate = Semaphore.makeUnsafe(1);
+    #executionsBySession = new Map();
+    #poisoned = new Set();
+    #initialized = false;
     constructor(options = {}) {
         this.#now = options.now ?? Date.now;
         this.#random = options.random ?? randomBytes;
+        this.#store = options.store;
     }
     open(input) {
+        if (input.evidenceRequired !== undefined) {
+            throw submissionError("execution-await-required", "strict eval sessions require awaited openEffect");
+        }
+        const prepared = this.#prepare(input);
+        this.#register(prepared.session);
+        return prepared.result;
+    }
+    #prepare(input) {
         const now = this.#now();
         const expiresAtMs = now + Math.min(input.expiresInSeconds * 1_000, input.limits.wallTimeMs);
         const sessionId = `eval_${this.#random(16).toString("base64url")}`;
@@ -34,17 +88,72 @@ export class EvalSessionManager {
             reservedOutputTokens: 0,
             closed: false
         };
-        this.#sessions.set(sessionId, session);
-        this.#sessionByTokenDigest.set(tokenDigest, sessionId);
         return {
-            sessionId,
-            gatewayUrl: input.gatewayUrl,
-            bearerCredential: credential,
-            targetIdentity: input.targetIdentity,
-            expiresAt: new Date(expiresAtMs).toISOString()
+            session,
+            result: {
+                sessionId,
+                gatewayUrl: input.gatewayUrl,
+                bearerCredential: credential,
+                targetIdentity: input.targetIdentity,
+                expiresAt: new Date(expiresAtMs).toISOString()
+            }
         };
     }
-    close(sessionId) {
+    #register(session) {
+        this.#sessions.set(session.id, session);
+        this.#sessionByTokenDigest.set(session.tokenDigest, session.id);
+        if (session.executionGrant !== undefined) {
+            this.#executionsBySession.set(session.id, session.executionGrant);
+        }
+    }
+    initialize() {
+        const self = this;
+        return this.#gate.withPermit(Effect.gen(function* () {
+            if (self.#initialized)
+                return;
+            const records = self.#store === undefined
+                ? []
+                : yield* self.#store.recover(new Date(self.#now()).toISOString());
+            for (const record of records) {
+                self.#executionsBySession.set(record.sessionId, grantOf(record));
+            }
+            self.#initialized = true;
+        }).pipe(Effect.uninterruptible));
+    }
+    openEffect(input) {
+        if (input.evidenceRequired === undefined)
+            return Effect.sync(() => this.open(input));
+        const self = this;
+        const requested = evalSessionEvidenceRequiredSchema.safeParse(input.evidenceRequired);
+        if (!requested.success) {
+            return Effect.fail(submissionError("execution-policy", "strict eval execution policy is invalid"));
+        }
+        const evidenceRequired = requested.data;
+        return Effect.gen(function* () {
+            yield* self.initialize();
+            return yield* self.#withExecution(evidenceRequired.executionDigest, (store) => Effect.gen(function* () {
+                const prepared = self.#prepare(input);
+                const executionGrant = {
+                    ...evidenceRequired,
+                    grantId: `grant_${self.#random(16).toString("base64url")}`,
+                    issuerIdentity: input.targetIdentity
+                };
+                yield* store.create({
+                    ...executionGrant,
+                    version: 1,
+                    sessionId: prepared.session.id,
+                    state: "open",
+                    exposure: "closed",
+                    poisoned: false,
+                    ingresses: [],
+                    receipts: []
+                });
+                self.#register({ ...prepared.session, executionGrant });
+                return { ...prepared.result, executionGrant };
+            }));
+        });
+    }
+    #revoke(sessionId) {
         const session = this.#sessions.get(sessionId);
         if (session === undefined || session.closed)
             return false;
@@ -52,6 +161,262 @@ export class EvalSessionManager {
         this.#sessionByTokenDigest.delete(session.tokenDigest);
         return true;
     }
+    close(sessionId) {
+        const session = this.#sessions.get(sessionId);
+        if (session?.executionGrant !== undefined) {
+            throw submissionError("execution-await-required", "strict eval sessions require awaited closeEffect");
+        }
+        return this.#revoke(sessionId);
+    }
+    closeEffect(sessionId) {
+        const self = this;
+        const grant = this.#executionsBySession.get(sessionId);
+        if (grant === undefined)
+            return Effect.sync(() => this.close(sessionId));
+        return this.#withExecution(grant.executionDigest, (store) => Effect.gen(function* () {
+            // Revoke in memory immediately, but never acknowledge durable closure
+            // before its write. Existing provider owners retain only settlement.
+            self.#revoke(sessionId);
+            const previous = yield* store.read(grant.executionDigest, sessionId);
+            if (previous === undefined) {
+                return yield* Effect.fail(submissionError("execution-store", "eval grant evidence is missing"));
+            }
+            assertGrant(previous, { sessionId, ...grant });
+            if (previous.state !== "open")
+                return false;
+            yield* store.update(grant.executionDigest, (current) => {
+                assertGrant(current, { sessionId, ...grant });
+                return normalizeExecutionEvidence({ ...current, state: "draining" });
+            }, { allowReadinessReopen: true });
+            return true;
+        }));
+    }
+    bindIngress(sessionId, input) {
+        const self = this;
+        return Effect.suspend(() => {
+            const session = self.#sessions.get(sessionId);
+            const grant = session?.executionGrant;
+            if (grant === undefined) {
+                return Effect.fail(submissionError("execution-unavailable", "strict eval execution grant is unavailable"));
+            }
+            const candidate = {
+                sessionId,
+                grantId: grant.grantId,
+                executionDigest: grant.executionDigest,
+                issuerIdentity: grant.issuerIdentity,
+                ingressId: `ingress_${self.#random(16).toString("base64url")}`,
+                requestDigest: input.requestDigest,
+                model: input.model
+            };
+            const validated = httpSubmissionBindingSchema.safeParse(candidate);
+            if (!validated.success) {
+                return Effect.fail(submissionError("ingress-identity", "strict eval ingress identity is invalid"));
+            }
+            return self.#withExecution(grant.executionDigest, (store) => Effect.gen(function* () {
+                self.#assertLiveSession(sessionId, input.model);
+                yield* store.update(grant.executionDigest, (current) => {
+                    assertGrant(current, validated.data);
+                    assertOpen(current);
+                    if (current.ingresses.length >= 8192) {
+                        throw submissionError("ingress-limit", "strict eval ingress bound has been reached");
+                    }
+                    return {
+                        ...current,
+                        ingresses: [
+                            ...current.ingresses,
+                            {
+                                ingressId: validated.data.ingressId,
+                                requestDigest: input.requestDigest,
+                                model: input.model,
+                                delivery: "pending",
+                                status: "no-attempt"
+                            }
+                        ]
+                    };
+                });
+                return validated.data;
+            }));
+        });
+    }
+    resolveSubmission(binding) {
+        const self = this;
+        const parsed = httpSubmissionBindingSchema.safeParse(binding);
+        if (!parsed.success) {
+            return Effect.fail(submissionError("ingress-identity", "strict eval ingress identity is invalid"));
+        }
+        return this.#withExecution(binding.executionDigest, (store) => Effect.gen(function* () {
+            self.#assertLiveSession(binding.sessionId, binding.model);
+            yield* store.update(binding.executionDigest, (current) => {
+                const ingress = assertIngress(current, binding);
+                assertOpen(current);
+                if (ingress.delivery !== "pending") {
+                    throw submissionError("ingress-consumed", "strict eval ingress has already been delivered");
+                }
+                return {
+                    ...current,
+                    ingresses: current.ingresses.map((entry) => entry.ingressId === binding.ingressId ? { ...entry, delivery: "claimed" } : entry)
+                };
+            });
+            return {
+                begin: (request) => self.#begin(binding, request),
+                settle: (attemptId, outcome) => self.#settle(binding, attemptId, outcome)
+            };
+        }));
+    }
+    #begin(binding, request) {
+        const self = this;
+        const parsed = httpSubmissionRequestSchema.safeParse(request);
+        if (!parsed.success) {
+            return Effect.fail(submissionError("submission-identity", "provider submission identity is invalid"));
+        }
+        return this.#withExecution(binding.executionDigest, (store) => Effect.gen(function* () {
+            self.#assertLiveSession(binding.sessionId, binding.model);
+            const attemptId = `attempt_${self.#random(16).toString("base64url")}`;
+            yield* store.update(binding.executionDigest, (current) => {
+                const ingress = assertIngress(current, binding);
+                assertOpen(current);
+                if (ingress.delivery !== "claimed") {
+                    throw submissionError("ingress-unclaimed", "strict eval ingress is not claimed");
+                }
+                if (current.receipts.length >= current.maximumProviderAttempts) {
+                    throw submissionError("provider-attempt-limit", "strict eval provider attempt allowance is exhausted");
+                }
+                return normalizeExecutionEvidence({
+                    ...current,
+                    ingresses: current.ingresses.map((entry) => entry.ingressId === binding.ingressId ? { ...entry, status: "attempted" } : entry),
+                    receipts: [
+                        ...current.receipts,
+                        {
+                            attemptId,
+                            ingressId: binding.ingressId,
+                            request: parsed.data,
+                            intentAt: new Date(self.#now()).toISOString(),
+                            state: "intent"
+                        }
+                    ]
+                });
+            });
+            // This is the permit: it cannot escape before the durable intent.
+            return { attemptId };
+        }));
+    }
+    #settle(binding, attemptId, outcome) {
+        const self = this;
+        const parsed = httpSubmissionOutcomeSchema.safeParse(outcome);
+        if (!parsed.success) {
+            return Effect.fail(submissionError("submission-outcome", "provider submission outcome is invalid"));
+        }
+        return this.#withExecution(binding.executionDigest, (store) => Effect.gen(function* () {
+            const settled = yield* store.update(binding.executionDigest, (current) => {
+                assertIngress(current, binding);
+                const receipt = current.receipts.find((entry) => entry.attemptId === attemptId);
+                if (receipt === undefined || receipt.ingressId !== binding.ingressId) {
+                    throw submissionError("attempt-identity", "provider submission attempt does not belong to this ingress");
+                }
+                // Recovery or an earlier unknown result is sticky, including when a
+                // retiring process later reports a successful response.
+                if (receipt.state === "unknown")
+                    return current;
+                if (receipt.state === "completed") {
+                    if (JSON.stringify(receipt.outcome) === JSON.stringify(parsed.data))
+                        return current;
+                    throw submissionError("attempt-settled", "provider submission attempt is already settled differently");
+                }
+                return normalizeExecutionEvidence({
+                    ...current,
+                    receipts: current.receipts.map((entry) => entry.attemptId === attemptId
+                        ? {
+                            ...entry,
+                            state: parsed.data.state,
+                            settledAt: new Date(self.#now()).toISOString(),
+                            outcome: parsed.data
+                        }
+                        : entry)
+                });
+            });
+            if (settled.state !== "open")
+                self.#revoke(binding.sessionId);
+        }));
+    }
+    executionEvidence(identity) {
+        const self = this;
+        return Effect.gen(function* () {
+            yield* self.initialize();
+            const session = self.#sessions.get(identity.sessionId);
+            if (session !== undefined && self.#now() >= session.expiresAtMs) {
+                yield* self.closeEffect(session.id);
+            }
+            return yield* self.#withExecution(identity.executionDigest, (store) => Effect.gen(function* () {
+                if (self.#poisoned.has(identity.executionDigest)) {
+                    yield* store.update(identity.executionDigest, (current) => normalizeExecutionEvidence({ ...current, poisoned: true, state: "draining" }));
+                }
+                const evidence = yield* store.read(identity.executionDigest, identity.sessionId);
+                if (evidence === undefined) {
+                    return yield* Effect.fail(submissionError("execution-not-found", "provider submission grant was not found"));
+                }
+                assertGrant(evidence, identity);
+                return evidence;
+            }));
+        });
+    }
+    #assertLiveSession(sessionId, model) {
+        const session = this.#sessions.get(sessionId);
+        if (session === undefined ||
+            session.closed ||
+            this.#now() >= session.expiresAtMs ||
+            session.executionGrant === undefined ||
+            this.#poisoned.has(session.executionGrant.executionDigest) ||
+            !session.allowedModels.includes(model)) {
+            throw submissionError("execution-closed", "strict eval session is unavailable, expired, or revoked");
+        }
+    }
+    #withExecution(executionDigest, operation) {
+        const self = this;
+        return this.#gate.withPermit(Effect.suspend(() => {
+            const store = self.#store;
+            if (store === undefined) {
+                return Effect.fail(submissionError("execution-unavailable", "durable provider submission authority is unavailable"));
+            }
+            return Effect.suspend(() => operation(store)).pipe(Effect.catchCause((cause) => {
+                const error = Cause.squash(cause);
+                return Effect.fail(error instanceof HttpSubmissionError
+                    ? error
+                    : new HttpSubmissionError({
+                        code: "execution-store",
+                        message: "provider submission authority failed to verify its durable state",
+                        cause: error
+                    }));
+            }), Effect.catch((error) => {
+                if (error.code !== "execution-store")
+                    return Effect.fail(error);
+                self.#poisoned.add(executionDigest);
+                for (const [sessionId, grant] of self.#executionsBySession) {
+                    if (grant.executionDigest === executionDigest)
+                        self.#revoke(sessionId);
+                }
+                // Best effort is only for preserving the poison marker. The
+                // mandatory original I/O error always propagates; no receipt or
+                // permission is fabricated if this second write also fails.
+                return store
+                    .update(executionDigest, (current) => normalizeExecutionEvidence({ ...current, poisoned: true, state: "draining" }))
+                    .pipe(Effect.ignore, Effect.andThen(Effect.fail(error)));
+            }));
+        }).pipe(Effect.uninterruptible));
+    }
+    shutdown() {
+        const self = this;
+        return Effect.gen(function* () {
+            self.closeAll();
+            let firstFailure;
+            for (const sessionId of self.#executionsBySession.keys()) {
+                yield* self.closeEffect(sessionId).pipe(Effect.catch((error) => Effect.sync(() => {
+                    firstFailure ??= error;
+                })));
+            }
+            if (firstFailure !== undefined)
+                return yield* Effect.fail(firstFailure);
+        }).pipe(Effect.ensuring(Effect.sync(() => self.closeAll())));
+    }
     closeAll() {
         for (const session of this.#sessions.values())
             session.closed = true;
@@ -79,6 +444,7 @@ export class EvalSessionManager {
                 allowedModels: session.allowedModels,
                 expiresAt: new Date(session.expiresAtMs).toISOString(),
                 perCallOutputTokens: session.limits.perCallOutputTokens,
+                ...(session.executionGrant === undefined ? {} : { executionGrant: session.executionGrant }),
                 admit: (model, inputTokenUpperBound, requestedOutputTokens) => this.#admit(session, model, inputTokenUpperBound, requestedOutputTokens)
             }
         };
@@ -114,37 +480,41 @@ export class EvalSessionManager {
 }
 export class EvalSessions extends Context.Service()("@velum-labs/routekit-daemon/EvalSessions") {
     static layer(options = {}) {
-        return Layer.effect(EvalSessions, Effect.acquireRelease(Effect.sync(() => new EvalSessionManager(options)), (sessions) => Effect.sync(() => sessions.closeAll())));
+        return Layer.effect(EvalSessions, Effect.acquireRelease(Effect.gen(function* () {
+            const sessions = new EvalSessionManager(options);
+            yield* sessions.initialize();
+            return sessions;
+        }), (sessions) => sessions.shutdown().pipe(Effect.orDie)));
     }
 }
 /** Owns short-lived, model-restricted eval data-plane sessions. */
-export class EvalSessionApplicationService {
-    handlers() {
+export const evalSessionHandlers = {
+    "evalSession.open": (params) => Effect.gen(function* () {
+        const env = yield* DaemonEnv;
+        const gateway = yield* ActiveGateway;
+        const sessions = yield* EvalSessions;
+        const gatewayUrl = gateway.dataUrl();
+        if (gatewayUrl === undefined) {
+            return yield* Effect.fail(new ControlError({
+                code: "unavailable",
+                message: "eval session cannot open before the data gateway is ready"
+            }));
+        }
+        return yield* sessions.openEffect({
+            ...params,
+            gatewayUrl,
+            targetIdentity: `routekit-generation:${env.generation}`
+        });
+    }),
+    "evalSession.close": (params) => Effect.gen(function* () {
+        const sessions = yield* EvalSessions;
         return {
-            "evalSession.open": (params) => Effect.gen(function* () {
-                const env = yield* DaemonEnv;
-                const gateway = yield* ActiveGateway;
-                const sessions = yield* EvalSessions;
-                const gatewayUrl = gateway.dataUrl();
-                if (gatewayUrl === undefined) {
-                    return yield* Effect.fail(new ControlError({
-                        code: "unavailable",
-                        message: "eval session cannot open before the data gateway is ready"
-                    }));
-                }
-                return sessions.open({
-                    ...params,
-                    gatewayUrl,
-                    targetIdentity: `routekit-generation:${env.generation}`
-                });
-            }),
-            "evalSession.close": (params) => Effect.gen(function* () {
-                const sessions = yield* EvalSessions;
-                return {
-                    sessionId: params.sessionId,
-                    closed: sessions.close(params.sessionId)
-                };
-            })
+            sessionId: params.sessionId,
+            closed: yield* sessions.closeEffect(params.sessionId)
         };
-    }
-}
+    }),
+    "evalSession.executionEvidence": (params) => Effect.gen(function* () {
+        const sessions = yield* EvalSessions;
+        return yield* sessions.executionEvidence(params);
+    })
+};

package/dist/services/gateway-generation/service.d.ts

@@ -1,8 +1,9 @@
 import type { RedeemResetCreditResult, ResetCreditSnapshot, SubscriptionAccountSetSnapshot, SubscriptionUsageResponse } from "@velum-labs/routekit-accounts";
 import type { AccountActivityService, AccountAuthService } from "@velum-labs/routekit-accounts/effect";
-import { type ProviderId, type RouterConfig } from "@velum-labs/routekit-config";
-import type { CatalogModelInfo, CompositionalRoutingObservation, CompositionalRoutingPolicyReader, Gateway, ProvenanceSink, ProviderSource } from "@velum-labs/routekit-gateway";
+import { type RouterConfig, type SourceId } from "@velum-labs/routekit-config";
+import type { CatalogModelInfo, CompositionalRoutingObservation, CompositionalRoutingPolicyReader, Gateway, GatewayOptions, ProvenanceSink } from "@velum-labs/routekit-gateway";
 import { RequestDecomposer, RoutingBackend } from "@velum-labs/routekit-gateway";
+import type { ProviderSource } from "@velum-labs/routekit-provider-core";
 import { type RouteKitPlatform } from "@velum-labs/routekit-runtime/effect";
 import { Effect, Layer } from "effect";
 export type GatewayGenerationOptions = {
@@ -11,8 +12,9 @@ export type GatewayGenerationOptions = {
     port?: number;
     authToken?: string;
     env?: NodeJS.ProcessEnv;
-    sources?: Partial<Record<ProviderId, ProviderSource>>;
+    sources?: Partial<Record<SourceId, ProviderSource>>;
     provenance?: ProvenanceSink;
+    resolveHttpSubmission?: GatewayOptions["resolveHttpSubmission"];
     /** Published model-by-dimension evidence used by automatic routing. */
     compositionalPolicyReader?: CompositionalRoutingPolicyReader;
     /** Override the default semantic classifier Layer. */
@@ -51,8 +53,10 @@ export type RunningGatewayGeneration = {
     modelCatalog(): readonly CatalogModelInfo[];
     modelInfo(model: string): ReturnType<RoutingBackend["modelInfo"]>;
     accountSnapshots(): SubscriptionAccountSetSnapshot[];
+    activeCredentialFingerprints(): ReadonlyMap<string, string>;
     usage(signal?: AbortSignal): Effect.Effect<SubscriptionUsageResponse, Error, RouteKitPlatform>;
     listResetCredits(kind: "codex", label: string, signal?: AbortSignal): Effect.Effect<ResetCreditSnapshot, Error, RouteKitPlatform>;
     redeemReset(input: GatewayGenerationRedeemResetOptions, signal?: AbortSignal): Effect.Effect<GatewayGenerationRedeemResetResponse, Error, RouteKitPlatform>;
 };
+export declare function routeKitUpstreamSources(config: RouterConfig, env: NodeJS.ProcessEnv): Partial<Record<SourceId, ProviderSource>>;
 export declare function startGatewayGenerationEffect(options: GatewayGenerationOptions): Effect.Effect<RunningGatewayGeneration, Error, RouteKitPlatform>;