@cortexkit/opencode-openai-auth 1.0.4 → 1.1.0

package/src/tui-compiled/runtime/shared/4d05c2d7a531aece-oauth.js

@@ -0,0 +1,500 @@
+import {
+  createServer
+} from "node:http";
+import { setTimeout as sleep } from "node:timers/promises";
+export const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann", ISSUER = "https://auth.openai.com", OAUTH_PORT = 1455, OAUTH_POLLING_SAFETY_MARGIN_MS = 3000, USER_AGENT_PRODUCT = "cortexkit-opencode-openai-auth";
+export function buildUserAgent(version) {
+  return `${USER_AGENT_PRODUCT}/${version}`;
+}
+export const RESERVED_ACCOUNT_ID = "main", RESERVED_ACCOUNT_ID_ERROR = `"${RESERVED_ACCOUNT_ID}" is a reserved account id; choose a different label.`;
+export function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(buffer), binary = String.fromCharCode(...bytes);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export async function generatePKCE() {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~", verifier = Array.from(crypto.getRandomValues(new Uint8Array(43))).map((b) => chars[b % chars.length]).join(""), challenge = base64UrlEncode(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
+  return { verifier, challenge };
+}
+export function parseJwtClaims(token) {
+  if (token.length > 16384)
+    return;
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    return;
+  const payload = parts[1];
+  if (!payload || payload.length > 8192)
+    return;
+  try {
+    return JSON.parse(Buffer.from(payload, "base64url").toString());
+  } catch {
+    return;
+  }
+}
+export function extractAccountIdFromClaims(claims) {
+  const direct = claims.chatgpt_account_id;
+  if (typeof direct === "string" && direct.length > 0)
+    return direct;
+  const nested = claims["https://api.openai.com/auth"];
+  if (nested && typeof nested === "object" && !Array.isArray(nested) && typeof nested.chatgpt_account_id === "string" && nested.chatgpt_account_id.length > 0)
+    return nested.chatgpt_account_id;
+  const orgs = claims.organizations;
+  if (Array.isArray(orgs)) {
+    const first = orgs[0];
+    if (first && typeof first === "object" && !Array.isArray(first) && typeof first.id === "string" && first.id.length > 0)
+      return first.id;
+  }
+  return;
+}
+export function extractAccountId(tokens) {
+  if (tokens.id_token) {
+    const claims = parseJwtClaims(tokens.id_token), accountId = claims && extractAccountIdFromClaims(claims);
+    if (accountId)
+      return accountId;
+  }
+  if (tokens.access_token) {
+    const claims = parseJwtClaims(tokens.access_token);
+    return claims ? extractAccountIdFromClaims(claims) : void 0;
+  }
+  return;
+}
+export function isReservedAccountId(value) {
+  return typeof value === "string" && value.toLowerCase() === RESERVED_ACCOUNT_ID;
+}
+export function assertFallbackAccountIdAllowed(value) {
+  if (isReservedAccountId(value))
+    throw Error(RESERVED_ACCOUNT_ID_ERROR);
+  return value;
+}
+export function buildAuthorizeUrl(redirectUri, pkce, state) {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: CLIENT_ID,
+    redirect_uri: redirectUri,
+    scope: "openid profile email offline_access",
+    code_challenge: pkce.challenge,
+    code_challenge_method: "S256",
+    id_token_add_organizations: "true",
+    codex_cli_simplified_flow: "true",
+    state,
+    originator: "opencode"
+  });
+  return `${ISSUER}/oauth/authorize?${params.toString()}`;
+}
+export async function exchangeCodeForTokens(code, redirectUri, pkce) {
+  const response = await fetch(`${ISSUER}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      client_id: CLIENT_ID,
+      code_verifier: pkce.verifier
+    }).toString()
+  });
+  if (!response.ok)
+    throw Error(`Token exchange failed: ${response.status}`);
+  return await response.json();
+}
+export function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+export const HTML_SUCCESS = `<!doctype html>
+<html>
+  <head>
+    <title>CortexKit OpenAI Auth - Authorization Successful</title>
+    <style>
+      body {
+        font-family:
+          system-ui,
+          -apple-system,
+          sans-serif;
+        display: flex;
+        justify-content: center;
+        align-items: center;
+        height: 100vh;
+        margin: 0;
+        background: #131010;
+        color: #f1ecec;
+      }
+      .container {
+        text-align: center;
+        padding: 2rem;
+      }
+      h1 {
+        color: #f1ecec;
+        margin-bottom: 1rem;
+      }
+      p {
+        color: #b7b1b1;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Authorization Successful</h1>
+      <p>You can close this window and return to OpenCode.</p>
+    </div>
+    <script>
+      setTimeout(() => window.close(), 2000)
+    </script>
+  </body>
+</html>`, HTML_ERROR = (error) => `<!doctype html>
+<html>
+  <head>
+    <title>CortexKit OpenAI Auth - Authorization Failed</title>
+    <style>
+      body {
+        font-family:
+          system-ui,
+          -apple-system,
+          sans-serif;
+        display: flex;
+        justify-content: center;
+        align-items: center;
+        height: 100vh;
+        margin: 0;
+        background: #131010;
+        color: #f1ecec;
+      }
+      .container {
+        text-align: center;
+        padding: 2rem;
+      }
+      h1 {
+        color: #fc533a;
+        margin-bottom: 1rem;
+      }
+      p {
+        color: #b7b1b1;
+      }
+      .error {
+        color: #ff917b;
+        font-family: monospace;
+        margin-top: 1rem;
+        padding: 1rem;
+        background: #3c140d;
+        border-radius: 0.5rem;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Authorization Failed</h1>
+      <p>An error occurred during authorization.</p>
+      <div class="error">${escapeHtml(error)}</div>
+    </div>
+  </body>
+</html>`;
+let oauthServers = [], serverStarting;
+const pendingFlows = new Map;
+function listenOAuthServer(server, host) {
+  return new Promise((resolve, reject) => {
+    const onError = (error) => {
+      server.off("listening", onListening);
+      reject(error);
+    }, onListening = () => {
+      server.off("error", onError);
+      resolve();
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(OAUTH_PORT, host);
+  });
+}
+function closeOAuthServer(server) {
+  server.close(() => {});
+  server.closeIdleConnections?.();
+  setTimeout(() => {
+    server.closeAllConnections?.();
+  }, 25).unref?.();
+}
+function flowCount() {
+  return pendingFlows.size;
+}
+export function flowCleanup(state) {
+  pendingFlows.delete(state);
+  if (flowCount() === 0)
+    stopOAuthServer();
+}
+export async function startOAuthServer() {
+  const redirectUri = `http://localhost:${OAUTH_PORT}/auth/callback`;
+  if (oauthServers.length > 0)
+    return { port: OAUTH_PORT, redirectUri };
+  if (serverStarting)
+    return serverStarting;
+  serverStarting = (async () => {
+    const handler = (req, res) => {
+      const url = new URL(req.url || "/", `http://127.0.0.1:${OAUTH_PORT}`);
+      if (url.pathname === "/auth/callback") {
+        const code = url.searchParams.get("code"), state = url.searchParams.get("state"), error = url.searchParams.get("error"), errorDescription = url.searchParams.get("error_description");
+        if (error) {
+          const errorMsg = errorDescription || error;
+          if (state) {
+            const entry = pendingFlows.get(state);
+            if (entry) {
+              entry.reject(Error(errorMsg));
+              flowCleanup(state);
+            } else if (flowCount() === 0)
+              stopOAuthServer();
+          } else if (flowCount() === 0)
+            stopOAuthServer();
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(HTML_ERROR(errorMsg));
+          return;
+        }
+        if (!state) {
+          if (flowCount() === 0)
+            stopOAuthServer();
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(HTML_ERROR("Missing state parameter"));
+          return;
+        }
+        if (!code) {
+          if (flowCount() === 0)
+            stopOAuthServer();
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(HTML_ERROR("Missing authorization code"));
+          return;
+        }
+        const entry = pendingFlows.get(state);
+        if (!entry) {
+          const errorMsg = "Unknown state \u2014 authorization may have expired";
+          if (flowCount() === 0)
+            stopOAuthServer();
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(HTML_ERROR(errorMsg));
+          return;
+        }
+        flowCleanup(state);
+        exchangeCodeForTokens(code, redirectUri, entry.pkce).then((tokens) => entry.resolve(tokens)).catch((err) => entry.reject(err));
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(HTML_SUCCESS);
+        return;
+      }
+      if (url.pathname === "/cancel") {
+        const state = url.searchParams.get("state"), states = state ? [state] : [...pendingFlows.keys()];
+        res.writeHead(200);
+        res.end("Login cancelled");
+        for (const flowState of states) {
+          const entry = pendingFlows.get(flowState);
+          if (!entry)
+            continue;
+          entry.reject(Error("Login cancelled"));
+          flowCleanup(flowState);
+        }
+        if (flowCount() === 0)
+          stopOAuthServer();
+        return;
+      }
+      res.writeHead(404);
+      res.end("Not found");
+    }, ipv4Server = createServer(handler);
+    await listenOAuthServer(ipv4Server, "127.0.0.1");
+    const listeners = [ipv4Server], ipv6Server = createServer(handler);
+    try {
+      await listenOAuthServer(ipv6Server, "::1");
+      listeners.push(ipv6Server);
+    } catch (error) {
+      const code = error.code;
+      if (code !== "EADDRNOTAVAIL" && code !== "EAFNOSUPPORT") {
+        closeOAuthServer(ipv4Server);
+        throw error;
+      }
+    }
+    oauthServers = listeners;
+    return { port: OAUTH_PORT, redirectUri };
+  })();
+  try {
+    return await serverStarting;
+  } finally {
+    serverStarting = void 0;
+  }
+}
+export function stopOAuthServer() {
+  const servers = oauthServers;
+  oauthServers = [];
+  for (const server of servers)
+    closeOAuthServer(server);
+}
+export function resetOAuthStateForTest() {
+  pendingFlows.clear();
+  stopOAuthServer();
+}
+export function waitForOAuthCallback(pkce, state, timeoutMs = 300000, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      flowCleanup(state);
+      reject(Error("Login cancelled"));
+      return;
+    }
+    const timeout = setTimeout(() => {
+      if (pendingFlows.get(state)) {
+        flowCleanup(state);
+        reject(Error("OAuth callback timeout \u2014 authorization took too long"));
+      }
+    }, timeoutMs), onAbort = () => {
+      clearTimeout(timeout);
+      if (pendingFlows.get(state)) {
+        flowCleanup(state);
+        reject(Error("Login cancelled"));
+      }
+    };
+    if (signal)
+      signal.addEventListener("abort", onAbort);
+    pendingFlows.set(state, {
+      pkce,
+      state,
+      resolve: (tokens) => {
+        clearTimeout(timeout);
+        if (signal)
+          signal.removeEventListener("abort", onAbort);
+        resolve(tokens);
+      },
+      reject: (error) => {
+        clearTimeout(timeout);
+        if (signal)
+          signal.removeEventListener("abort", onAbort);
+        reject(error);
+      }
+    });
+  });
+}
+export async function beginDeviceAuth(version) {
+  const deviceResponse = await fetch(`${ISSUER}/api/accounts/deviceauth/usercode`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "User-Agent": buildUserAgent(version)
+    },
+    body: JSON.stringify({ client_id: CLIENT_ID })
+  });
+  if (!deviceResponse.ok)
+    throw Error("Failed to initiate device authorization");
+  const deviceData = await deviceResponse.json();
+  return {
+    deviceData,
+    url: `${ISSUER}/codex/device`,
+    instructions: `Enter code: ${deviceData.user_code}`
+  };
+}
+export async function completeDeviceAuth(deviceData, version, signal) {
+  const interval = Math.max(parseInt(deviceData.interval, 10) || 5, 1) * 1000, expires_in = typeof deviceData.expires_in === "number" ? deviceData.expires_in : parseInt(deviceData.expires_in || "", 10), maxDurationMs = !Number.isNaN(expires_in) && expires_in > 0 ? expires_in * 1000 : 900000, startTime = Date.now();
+  while (!0) {
+    if (signal?.aborted)
+      throw Error("Device authorization cancelled");
+    if (Date.now() - startTime > maxDurationMs)
+      throw Error("Device authorization expired");
+    const response = await fetch(`${ISSUER}/api/accounts/deviceauth/token`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "User-Agent": buildUserAgent(version)
+      },
+      body: JSON.stringify({
+        device_auth_id: deviceData.device_auth_id,
+        user_code: deviceData.user_code
+      })
+    });
+    if (response.ok) {
+      const data = await response.json(), tokenResponse = await fetch(`${ISSUER}/oauth/token`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          code: data.authorization_code,
+          redirect_uri: `${ISSUER}/deviceauth/callback`,
+          client_id: CLIENT_ID,
+          code_verifier: data.code_verifier
+        }).toString()
+      });
+      if (!tokenResponse.ok)
+        throw Error(`Token exchange failed: ${tokenResponse.status}`);
+      return await tokenResponse.json();
+    }
+    if (response.status !== 403 && response.status !== 404)
+      throw Error(`Device authorization failed: ${response.status}`);
+    const remainingMs = maxDurationMs - (Date.now() - startTime);
+    if (remainingMs <= 0)
+      throw Error("Device authorization expired");
+    const sleepMs = Math.min(interval + OAUTH_POLLING_SAFETY_MARGIN_MS, remainingMs);
+    try {
+      await sleep(sleepMs, void 0, { signal });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError")
+        throw Error("Device authorization cancelled");
+      throw err;
+    }
+  }
+}
+export function upsertAccount(accounts, account) {
+  let index = -1;
+  if (account.accountId)
+    index = accounts.findIndex((candidate) => candidate.accountId && candidate.accountId === account.accountId);
+  if (index < 0)
+    index = accounts.findIndex((candidate) => candidate.id === account.id);
+  if (index < 0 && account.label && !account.accountId)
+    index = accounts.findIndex((candidate) => candidate.label === account.label);
+  if (index >= 0) {
+    accounts[index] = {
+      ...accounts[index],
+      ...account,
+      addedAt: accounts[index]?.addedAt ?? account.addedAt
+    };
+    return index;
+  }
+  accounts.push(account);
+  return accounts.length - 1;
+}
+export async function beginAccountLogin(opts) {
+  const { label, headless = !1, signal, version } = opts;
+  assertFallbackAccountIdAllowed(label);
+  if (headless) {
+    const { deviceData, url, instructions } = await beginDeviceAuth(version), completion = (async () => {
+      const tokens = await completeDeviceAuth(deviceData, version, signal), now = Date.now(), accountId = extractAccountId(tokens);
+      return {
+        id: assertFallbackAccountIdAllowed(label || accountId || crypto.randomUUID()),
+        label: label || void 0,
+        type: "oauth",
+        access: tokens.access_token,
+        refresh: tokens.refresh_token,
+        expires: now + (tokens.expires_in ?? 3600) * 1000,
+        enabled: !0,
+        addedAt: now,
+        lastUsed: now,
+        lastRefreshedAt: now,
+        accountId
+      };
+    })();
+    return { url, instructions, completion };
+  }
+  const { redirectUri } = await startOAuthServer(), pkce = await generatePKCE(), state = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)).buffer), authUrl = buildAuthorizeUrl(redirectUri, pkce, state), completion = (async () => {
+    try {
+      if (signal?.aborted)
+        throw Error("Login cancelled");
+      const tokens = await waitForOAuthCallback(pkce, state, void 0, signal), now = Date.now(), accountId = extractAccountId(tokens);
+      return {
+        id: assertFallbackAccountIdAllowed(label || accountId || crypto.randomUUID()),
+        label: label || void 0,
+        type: "oauth",
+        access: tokens.access_token,
+        refresh: tokens.refresh_token,
+        expires: now + (tokens.expires_in ?? 3600) * 1000,
+        enabled: !0,
+        addedAt: now,
+        lastUsed: now,
+        lastRefreshedAt: now,
+        accountId
+      };
+    } finally {
+      flowCleanup(state);
+    }
+  })();
+  return {
+    url: authUrl,
+    instructions: "Complete authorization in your browser. This window will close automatically.",
+    completion
+  };
+}

package/src/tui-compiled/runtime/shared/6371b24a0573d79e-any-signal.js

@@ -0,0 +1,42 @@
+/**
+ * Combine abort signals without relying on `AbortSignal.any`, which is missing
+ * from early Node 20 releases. Call `dispose` when the operation using the
+ * combined signal settles so long-lived source signals do not retain listeners.
+ */
+export function combineAbortSignals(signals) {
+    const controller = new AbortController();
+    const listeners = [];
+    let disposed = false;
+    const dispose = () => {
+        if (disposed)
+            return;
+        disposed = true;
+        for (const { source, listener } of listeners) {
+            source.removeEventListener('abort', listener);
+        }
+        listeners.length = 0;
+    };
+    const abort = (reason) => {
+        if (disposed || controller.signal.aborted)
+            return;
+        controller.abort(reason);
+        dispose();
+    };
+    const alreadyAborted = signals.find((signal) => signal.aborted);
+    if (alreadyAborted) {
+        controller.abort(alreadyAborted.reason);
+        return { signal: controller.signal, dispose };
+    }
+    for (const source of signals) {
+        if (controller.signal.aborted)
+            break;
+        const listener = () => abort(source.reason);
+        listeners.push({ source, listener });
+        source.addEventListener('abort', listener, { once: true });
+        // Cover a source that aborts after the initial check but before its listener
+        // is installed.
+        if (source.aborted)
+            abort(source.reason);
+    }
+    return { signal: controller.signal, dispose };
+}

package/src/tui-compiled/runtime/shared/7c140680fc81be92-interlock.js

@@ -0,0 +1,29 @@
+function matches(entry, credentialId, accountIdentity) {
+    if (entry.accountIdentity !== undefined && accountIdentity !== undefined)
+        return entry.accountIdentity === accountIdentity;
+    return entry.credentialId === credentialId;
+}
+export function isDeclined(entries, credentialId, accountIdentity) {
+    return entries.some((entry) => matches(entry, credentialId, accountIdentity));
+}
+export function declineAccount(entries, credentialId, accountIdentity) {
+    const entry = {
+        credentialId,
+        ...(accountIdentity !== undefined && { accountIdentity }),
+    };
+    return [
+        ...entries.filter((existing) => existing.credentialId !== credentialId ||
+            existing.accountIdentity !== accountIdentity),
+        entry,
+    ];
+}
+/**
+ * Lift every entry that declines a row: the row's credential ids (the
+ * representative and its aliases) under the row's account. An entry for a
+ * different known account is left alone even when it names one of these
+ * credential ids, so accepting a replacement never re-enables the account the
+ * user declined.
+ */
+export function acceptAccount(entries, credentialIds, accountIdentity) {
+    return entries.filter((entry) => !credentialIds.some((id) => matches(entry, id, accountIdentity)));
+}

package/src/tui-compiled/runtime/shared/85512cc5263ba259-provider.js

@@ -0,0 +1,87 @@
+import { parseRetryAfter } from "./134b008900698fe0-backoff.js";
+import { createLogger } from "./d669d72c40e9e116-logger.js";
+import { normalizeWham } from "./2577ec69f9973ae9-quota-normalize.js";
+import { assertNotTombstoneRefresh } from "./4593a4d71edf69fd-tombstone.js";
+import { errorMessage } from "./f37fcefc7aedbf25-error.js";
+const log = createLogger("quota");
+export const PRIMARY = "primary", SECONDARY = "secondary", CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann", CODEX_ISSUER = "https://auth.openai.com";
+export async function codexRefreshFn(input) {
+  assertNotTombstoneRefresh(input.refreshToken);
+  const response = await input.fetchImpl(`${CODEX_ISSUER}/oauth/token`, {
+    method: "POST",
+    signal: AbortSignal.timeout(15000),
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: input.refreshToken,
+      client_id: CODEX_CLIENT_ID
+    }).toString()
+  });
+  if (!response.ok) {
+    const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
+    throw Object.assign(Error(`Token refresh failed: ${response.status}`), {
+      status: response.status,
+      retryAfter,
+      isRefreshError: !0
+    });
+  }
+  const tokens = await response.json();
+  if (!tokens || typeof tokens.access_token !== "string" || !tokens.access_token || typeof tokens.expires_in !== "number")
+    throw Object.assign(Error("Token refresh failed: malformed response"), {
+      status: response.status,
+      isRefreshError: !0
+    });
+  if (tokens.refresh_token !== void 0 && typeof tokens.refresh_token !== "string")
+    throw Object.assign(Error("Token refresh failed: malformed response"), {
+      status: response.status,
+      isRefreshError: !0
+    });
+  const rotatedRefresh = typeof tokens.refresh_token === "string" && tokens.refresh_token ? tokens.refresh_token : input.refreshToken;
+  return {
+    access: tokens.access_token,
+    refresh: rotatedRefresh,
+    expires: input.now() + tokens.expires_in * 1000,
+    expiresIn: tokens.expires_in
+  };
+}
+const WHAM_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+export async function whamUsageFn(input) {
+  const logger = input.logger ?? log, accountId = input.accountKey ?? "unknown", startedAt = Date.now();
+  logger.debug("wham usage fetch started", { pid: process.pid, accountId });
+  try {
+    const res = await input.fetchImpl(WHAM_USAGE_URL, {
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        authorization: `Bearer ${input.accessToken}`,
+        "chatgpt-account-id": input.accountId ?? "",
+        "oai-client-platform": "web",
+        "oai-client-version": "0",
+        "x-openai-target-path": "/backend-api/wham/usage"
+      }
+    });
+    if (!res.ok) {
+      const retryAfter = parseRetryAfter(res.headers.get("retry-after"));
+      throw Object.assign(Error(`wham usage check failed: ${res.status}`), {
+        status: res.status,
+        retryAfter
+      });
+    }
+    const snapshot = normalizeWham(await res.json());
+    logger.debug("wham usage fetch succeeded", {
+      pid: process.pid,
+      accountId,
+      status: res.status,
+      elapsedMs: Date.now() - startedAt
+    });
+    return snapshot;
+  } catch (error) {
+    logger.warn("wham usage fetch failed", {
+      pid: process.pid,
+      accountId,
+      status: typeof error?.status === "number" ? error.status : "error",
+      elapsedMs: Date.now() - startedAt,
+      error: errorMessage(error)
+    });
+    throw error;
+  }
+}