@stage-labs/metro 0.1.0-beta.13 → 0.1.0-beta.131

package/runtime/node_modules/@metro-labs/daemon/src/gateway/bedrock.ts

@@ -0,0 +1,259 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { log } from '@metro-labs/core/log';
+import { EventStreamDecoder, type EventStreamMessage } from './eventstream.js';
+import { errorFrame, GatewayError, idleMessage, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
+import type { BedrockSettings } from './model-config.js';
+import { UsageScanner } from './usage.js';
+
+const ANTHROPIC_VERSION = 'bedrock-2023-05-31';
+const EXTRA_INPUT_RE = /^([A-Za-z0-9_]+)(?:\.[^:]*)?: Extra inputs are not permitted/;
+const MAX_REPAIRS = 4;
+const PING_MS = 25_000;
+
+export interface Adaptations {
+  fields: Set<string>;
+  dropBetas: boolean;
+}
+
+export const freshAdaptations = (): Adaptations => ({ fields: new Set(), dropBetas: false });
+
+export interface BedrockUpstream {
+  settings: BedrockSettings;
+  base: string;
+  learned: Adaptations;
+  watch: Watch;
+}
+
+interface Rewritten {
+  modelId: string;
+  stream: boolean;
+  body: Record<string, unknown>;
+  betas: string[];
+}
+
+interface Attempt {
+  body: Record<string, unknown>;
+  betas: string[];
+}
+
+const PREFIXES: [RegExp, string][] = [
+  [/^us-gov-/, 'us-gov'],
+  [/^us-/, 'us'],
+  [/^eu-/, 'eu'],
+  [/^ap-/, 'apac'],
+];
+
+export function regionPrefix(region: string): string {
+  for (const [pattern, prefix] of PREFIXES) if (pattern.test(region)) return prefix;
+  return 'global';
+}
+
+export function bedrockModelId(requested: string, region: string): string {
+  if (requested.includes('anthropic.')) return requested;
+  return `${regionPrefix(region)}.anthropic.${requested}`;
+}
+
+export const bedrockBase = (region: string): string => `https://bedrock-runtime.${region}.amazonaws.com`;
+
+function splitBetas(header: string | string[] | undefined): string[] {
+  const raw = Array.isArray(header) ? header.join(',') : (header ?? '');
+  return raw
+    .split(',')
+    .map((b) => b.trim())
+    .filter((b) => b !== '');
+}
+
+export function rewriteForBedrock(
+  body: Record<string, unknown>,
+  model: string,
+  betaHeader: string | string[] | undefined,
+  region: string,
+): Rewritten {
+  const betas = splitBetas(betaHeader);
+  const out: Record<string, unknown> = {
+    ...Object.fromEntries(Object.entries(body).filter(([key]) => key !== 'model' && key !== 'stream')),
+    anthropic_version: ANTHROPIC_VERSION,
+  };
+  if (betas.length > 0) out.anthropic_beta = betas;
+  return { modelId: bedrockModelId(model, region), stream: body.stream === true, body: out, betas };
+}
+
+export function errorKind(status: number, errorType: string | null): string {
+  if (status === 429 || errorType === 'ThrottlingException') return 'rate_limit_error';
+  if (status === 400) return 'invalid_request_error';
+  if (status === 401 || status === 403) return 'permission_error';
+  if (status === 404) return 'not_found_error';
+  if (status === 503) return 'overloaded_error';
+  return 'api_error';
+}
+
+const invokeUrl = (up: BedrockUpstream, modelId: string, action: string): string =>
+  `${up.base}/model/${encodeURIComponent(modelId)}/${action}`;
+
+function callBedrock(up: BedrockUpstream, url: string, body: unknown, accept: string): Promise<Response> {
+  return fetch(url, {
+    method: 'POST',
+    headers: {
+      authorization: `Bearer ${up.settings.apiKey}`,
+      'content-type': 'application/json',
+      accept,
+    },
+    body: JSON.stringify(body),
+    signal: up.watch.signal,
+  });
+}
+
+const without = (body: Record<string, unknown>, keys: Set<string>): Record<string, unknown> =>
+  Object.fromEntries(Object.entries(body).filter(([key]) => !keys.has(key)));
+
+function applyLearned(req: Rewritten, learned: Adaptations): Attempt {
+  const dropped = new Set(learned.fields);
+  if (learned.dropBetas) dropped.add('anthropic_beta');
+  return { body: without(req.body, dropped), betas: learned.dropBetas ? [] : req.betas };
+}
+
+function repair(attempt: Attempt, learned: Adaptations, message: string): Attempt | null {
+  const named = EXTRA_INPUT_RE.exec(message)?.[1];
+  if (named !== undefined && named in attempt.body) {
+    learned.fields.add(named);
+    log.warn({ field: named }, 'gateway: Bedrock refused an extra input; dropping it from every request');
+    return { body: without(attempt.body, new Set([named])), betas: attempt.betas };
+  }
+  if (attempt.betas.length > 0) {
+    learned.dropBetas = true;
+    log.warn({ betas: attempt.betas }, 'gateway: retrying without anthropic_beta');
+    return { body: without(attempt.body, new Set(['anthropic_beta'])), betas: [] };
+  }
+  return null;
+}
+
+async function withRepairs(up: BedrockUpstream, req: Rewritten, send: (attempt: Attempt) => Promise<Response>): Promise<Response> {
+  let attempt = applyLearned(req, up.learned);
+  for (let repairs = 0; ; repairs += 1) {
+    const res = await send(attempt);
+    if (res.status !== 400 || repairs >= MAX_REPAIRS) return res;
+    const text = await res.text();
+    const next = repair(attempt, up.learned, upstreamMessage(text, 'Bedrock returned no body'));
+    if (next === null) return new Response(text, { status: 400, headers: res.headers });
+    attempt = next;
+  }
+}
+
+function invoke(up: BedrockUpstream, req: Rewritten): Promise<Response> {
+  const action = req.stream ? 'invoke-with-response-stream' : 'invoke';
+  const accept = req.stream ? 'application/vnd.amazon.eventstream' : 'application/json';
+  const url = invokeUrl(up, req.modelId, action);
+  return withRepairs(up, req, (attempt) => callBedrock(up, url, attempt.body, accept));
+}
+
+function eventTypeOf(event: string): string {
+  try {
+    const parsed = JSON.parse(event) as { type?: unknown };
+    return typeof parsed.type === 'string' ? parsed.type : 'message';
+  } catch {
+    return 'message';
+  }
+}
+
+function writeEvent(res: ServerResponse, message: EventStreamMessage, scanner: UsageScanner): void {
+  if (message.headers[':message-type'] === 'event') {
+    const parsed = JSON.parse(message.payload.toString('utf8')) as { bytes?: unknown };
+    if (typeof parsed.bytes !== 'string') return;
+    const event = Buffer.from(parsed.bytes, 'base64').toString('utf8');
+    scanner.feed(`${event}\n`);
+    res.write(`event: ${eventTypeOf(event)}\ndata: ${event}\n\n`);
+    return;
+  }
+  const errorType = message.headers[':exception-type'] ?? message.headers[':error-code'] ?? null;
+  const body = {
+    type: 'error',
+    error: { type: errorKind(500, errorType), message: upstreamMessage(message.payload.toString('utf8'), 'Bedrock stream error') },
+  };
+  res.write(`event: error\ndata: ${JSON.stringify(body)}\n\n`);
+}
+
+async function relayStream(upstream: Response, res: ServerResponse, watch: Watch): Promise<void> {
+  res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-store', connection: 'keep-alive' });
+  const body = upstream.body;
+  if (body === null) {
+    res.end();
+    return;
+  }
+  const ping = setInterval(() => res.write('event: ping\ndata: {"type":"ping"}\n\n'), PING_MS);
+  const scanner = new UsageScanner('bedrock');
+  try {
+    const decoder = new EventStreamDecoder();
+    const reader = body.getReader();
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      watch.touch();
+      for (const message of decoder.push(Buffer.from(value))) writeEvent(res, message, scanner);
+    }
+  } catch (err) {
+    if (!watch.idle()) throw err;
+    res.write(errorFrame('api_error', idleMessage(watch.ms)));
+  } finally {
+    clearInterval(ping);
+    watch.stop();
+    res.end();
+    scanner.done();
+  }
+}
+
+async function relayFailure(upstream: Response, res: ServerResponse): Promise<void> {
+  const text = await upstream.text();
+  sendError(res, providerStatus(upstream.status), errorKind(upstream.status, upstream.headers.get('x-amzn-errortype')), upstreamMessage(text, 'Bedrock returned no body'));
+}
+
+export async function bedrockMessages(
+  req: IncomingMessage,
+  res: ServerResponse,
+  body: Record<string, unknown>,
+  model: string,
+  up: BedrockUpstream,
+): Promise<void> {
+  const rewritten = rewriteForBedrock(body, model, req.headers['anthropic-beta'], up.settings.region);
+  const upstream = await invoke(up, rewritten);
+  if (!upstream.ok) {
+    await relayFailure(upstream, res);
+    return;
+  }
+  if (rewritten.stream) {
+    await relayStream(upstream, res, up.watch);
+    return;
+  }
+  const text = await upstream.text();
+  const scanner = new UsageScanner('bedrock');
+  scanner.feed(text);
+  scanner.done();
+  res.writeHead(200, { 'content-type': 'application/json' });
+  res.end(text);
+}
+
+const estimateTokens = (body: Record<string, unknown>): number => Math.ceil(JSON.stringify(body).length / 4);
+
+export async function bedrockCount(
+  req: IncomingMessage,
+  res: ServerResponse,
+  body: Record<string, unknown>,
+  model: string,
+  up: BedrockUpstream,
+): Promise<void> {
+  const rewritten = rewriteForBedrock(body, model, req.headers['anthropic-beta'], up.settings.region);
+  const url = invokeUrl(up, rewritten.modelId, 'count-tokens');
+  const upstream = await withRepairs(up, rewritten, (attempt) => callBedrock(up, url, { input: { invokeModel: { body: JSON.stringify(attempt.body) } } }, 'application/json'));
+  const text = await upstream.text();
+  let counted: number | null = null;
+  if (upstream.ok) {
+    const parsed = JSON.parse(text) as { inputTokens?: unknown };
+    if (typeof parsed.inputTokens === 'number') counted = parsed.inputTokens;
+  }
+  res.writeHead(200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify({ input_tokens: counted ?? estimateTokens(rewritten.body) }));
+}
+
+export function assertBedrockReady(settings: BedrockSettings): void {
+  if (settings.apiKey === '' || settings.region === '')
+    throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs an API key and a region: add them on the Model page.');
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-auth.ts

@@ -0,0 +1,231 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { isRecord } from '@metro-labs/core/is-record';
+
+export const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+export const CODEX_ISSUER = 'https://auth.openai.com';
+export const CODEX_REDIRECT = 'http://localhost:1455/auth/callback';
+const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';
+const AUTH_CLAIM = 'https://api.openai.com/auth';
+const PENDING_TTL_MS = 10 * 60_000;
+export const ACCESS_TOKEN_TTL_MS = 55 * 60_000;
+
+export interface CodexTokens {
+  accessToken: string;
+  refreshToken: string;
+  idToken: string;
+  accountId: string;
+  email: string | null;
+  plan: string | null;
+  savedAt: string;
+}
+
+export class CodexAuthError extends Error {}
+
+interface Pending {
+  verifier: string;
+  at: number;
+}
+
+const pending = new Map<string, Pending>();
+
+const b64url = (buf: Buffer): string => buf.toString('base64url');
+
+export function newPkce(): { verifier: string; challenge: string } {
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash('sha256').update(verifier).digest());
+  return { verifier, challenge };
+}
+
+export function authorizeUrl(state: string, challenge: string, issuer = CODEX_ISSUER): string {
+  const query = new URLSearchParams({
+    response_type: 'code',
+    client_id: CODEX_CLIENT_ID,
+    redirect_uri: CODEX_REDIRECT,
+    scope: SCOPE,
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    id_token_add_organizations: 'true',
+    codex_cli_simplified_flow: 'true',
+    state,
+    originator: 'codex_cli_rs',
+  });
+  return `${issuer}/oauth/authorize?${query.toString()}`;
+}
+
+function sweep(now: number): void {
+  for (const [state, entry] of pending) if (now - entry.at > PENDING_TTL_MS) pending.delete(state);
+}
+
+export function beginLogin(issuer = CODEX_ISSUER, now = Date.now()): { url: string; state: string } {
+  sweep(now);
+  const { verifier, challenge } = newPkce();
+  const state = b64url(randomBytes(24));
+  pending.set(state, { verifier, at: now });
+  return { url: authorizeUrl(state, challenge, issuer), state };
+}
+
+export function parseCallback(raw: string): { code: string; state: string } {
+  const text = raw.trim();
+  let query: URLSearchParams;
+  try {
+    query = new URL(text).searchParams;
+  } catch {
+    query = new URLSearchParams(text.replace(/^\?/, ''));
+  }
+  const code = query.get('code')?.trim() ?? '';
+  const state = query.get('state')?.trim() ?? '';
+  if (code === '' || state === '')
+    throw new CodexAuthError('paste the whole address the browser landed on; it carries code= and state=');
+  return { code, state };
+}
+
+function decodeJwtPayload(jwt: string): Record<string, unknown> {
+  const part = jwt.split('.')[1] ?? '';
+  try {
+    const parsed: unknown = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    return isRecord(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+const text = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+export function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
+  const payload = decodeJwtPayload(idToken);
+  const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
+  return { accountId: text(auth.chatgpt_account_id), email: text(payload.email), plan: text(auth.chatgpt_plan_type) };
+}
+
+interface TokenResponse {
+  id_token?: unknown;
+  access_token?: unknown;
+  refresh_token?: unknown;
+}
+
+const EMPTY_TOKENS: CodexTokens = { accessToken: '', refreshToken: '', idToken: '', accountId: '', email: null, plan: null, savedAt: '' };
+
+function assertUsable(next: CodexTokens): CodexTokens {
+  if (next.accessToken === '' || next.refreshToken === '') throw new CodexAuthError('the token endpoint returned no usable tokens');
+  if (next.accountId === '') throw new CodexAuthError('the id token carries no ChatGPT account id; sign in with a ChatGPT account that has Codex');
+  return next;
+}
+
+const pick = (fresh: string | null, kept: string | null): string | null => fresh ?? kept;
+
+export function tokensFrom(body: unknown, previous: CodexTokens | null, now = new Date()): CodexTokens {
+  const res = (isRecord(body) ? body : {}) as TokenResponse;
+  const kept = previous ?? EMPTY_TOKENS;
+  const idToken = pick(text(res.id_token), kept.idToken) ?? '';
+  const claims = claimsOf(idToken);
+  return assertUsable({
+    accessToken: text(res.access_token) ?? '',
+    refreshToken: pick(text(res.refresh_token), kept.refreshToken) ?? '',
+    idToken,
+    accountId: pick(claims.accountId, kept.accountId) ?? '',
+    email: pick(claims.email, kept.email),
+    plan: pick(claims.plan, kept.plan),
+    savedAt: now.toISOString(),
+  });
+}
+
+async function tokenCall(issuer: string, init: RequestInit, fetchImpl: typeof fetch): Promise<unknown> {
+  const res = await fetchImpl(`${issuer}/oauth/token`, init);
+  const raw = await res.text();
+  if (!res.ok) {
+    let detail = raw.slice(0, 300);
+    try {
+      const parsed: unknown = JSON.parse(raw);
+      if (isRecord(parsed)) detail = text(parsed.error_description) ?? text(parsed.error) ?? detail;
+    } catch {
+      detail = raw.slice(0, 300);
+    }
+    throw new CodexAuthError(`OpenAI refused the token request (${String(res.status)}): ${detail}`);
+  }
+  return JSON.parse(raw) as unknown;
+}
+
+export async function finishLogin(
+  callback: string,
+  issuer = CODEX_ISSUER,
+  fetchImpl: typeof fetch = fetch,
+  now = Date.now(),
+): Promise<CodexTokens> {
+  sweep(now);
+  const { code, state } = parseCallback(callback);
+  const entry = pending.get(state);
+  if (entry === undefined) throw new CodexAuthError('this sign-in link has expired or was started elsewhere; press Connect again');
+  pending.delete(state);
+  return exchangeCode(issuer, code, entry.verifier, CODEX_REDIRECT, fetchImpl, now);
+}
+
+export async function exchangeCode(
+  issuer: string,
+  code: string,
+  verifier: string,
+  redirectUri: string,
+  fetchImpl: typeof fetch,
+  now = Date.now(),
+): Promise<CodexTokens> {
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: redirectUri,
+    client_id: CODEX_CLIENT_ID,
+    code_verifier: verifier,
+  });
+  const res = await tokenCall(
+    issuer,
+    { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString() },
+    fetchImpl,
+  );
+  return tokensFrom(res, null, new Date(now));
+}
+
+export async function refreshTokens(previous: CodexTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch): Promise<CodexTokens> {
+  const res = await tokenCall(
+    issuer,
+    {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ client_id: CODEX_CLIENT_ID, grant_type: 'refresh_token', refresh_token: previous.refreshToken }),
+    },
+    fetchImpl,
+  );
+  return tokensFrom(res, previous);
+}
+
+export const tokensStale = (tokens: CodexTokens, now = Date.now()): boolean =>
+  now - Date.parse(tokens.savedAt) > ACCESS_TOKEN_TTL_MS;
+
+function readAuthFile(home: string): Record<string, unknown> {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(join(home, '.codex', 'auth.json'), 'utf8'));
+  } catch {
+    throw new CodexAuthError('no Codex CLI login on this machine (~/.codex/auth.json); run codex login there first, or connect here');
+  }
+  return isRecord(raw) ? raw : {};
+}
+
+export function readCodexCliAuth(home = homedir()): CodexTokens {
+  const raw = readAuthFile(home);
+  if (!isRecord(raw.tokens)) throw new CodexAuthError('~/.codex/auth.json holds no ChatGPT tokens (an API-key login cannot be reused here)');
+  const stored = raw.tokens;
+  const idToken = text(stored.id_token) ?? '';
+  const claims = claimsOf(idToken);
+  const found: CodexTokens = {
+    accessToken: text(stored.access_token) ?? '',
+    refreshToken: text(stored.refresh_token) ?? '',
+    idToken,
+    accountId: text(stored.account_id) ?? claims.accountId ?? '',
+    email: claims.email,
+    plan: claims.plan,
+    savedAt: text(raw.last_refresh) ?? new Date(0).toISOString(),
+  };
+  if ([found.accessToken, found.refreshToken, found.accountId].includes('')) throw new CodexAuthError('~/.codex/auth.json is missing a token or the account id');
+  return found;
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-device.ts

@@ -0,0 +1,91 @@
+import { randomBytes } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg } from '@metro-labs/core/log';
+import { CODEX_CLIENT_ID, CODEX_ISSUER, CodexAuthError, exchangeCode, type CodexTokens } from './codex-auth.js';
+
+const VERIFY_PATH = '/codex/device';
+const DEVICE_TTL_MS = 15 * 60_000;
+const DEFAULT_INTERVAL_S = 5;
+const ID_BYTES = 18;
+
+export interface DeviceLogin {
+  id: string;
+  userCode: string;
+  verifyUrl: string;
+  interval: number;
+}
+
+export type DeviceStatus = { status: 'pending' } | { status: 'done'; tokens: CodexTokens } | { status: 'failed'; error: string };
+
+interface Entry {
+  deviceAuthId: string;
+  userCode: string;
+  interval: number;
+  issuer: string;
+  startedAt: number;
+  polledAt: number | null;
+}
+
+const logins = new Map<string, Entry>();
+
+const str = (value: unknown): string => (typeof value === 'string' ? value : '');
+
+function intervalOf(value: unknown): number {
+  const n = typeof value === 'number' ? value : typeof value === 'string' ? Number(value) : NaN;
+  return Number.isFinite(n) && n >= 1 ? Math.round(n) : DEFAULT_INTERVAL_S;
+}
+
+function sweep(now: number): void {
+  for (const [id, entry] of logins) if (now - entry.startedAt > DEVICE_TTL_MS) logins.delete(id);
+}
+
+const post = (url: string, body: unknown, fetchImpl: typeof fetch): Promise<Response> =>
+  fetchImpl(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+
+export async function beginDeviceLogin(issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceLogin> {
+  sweep(now);
+  const res = await post(`${issuer}/api/accounts/deviceauth/usercode`, { client_id: CODEX_CLIENT_ID }, fetchImpl);
+  if (res.status === 404) throw new CodexAuthError('OpenAI is not offering the device-code sign-in right now; use the browser sign-in instead');
+  if (!res.ok) throw new CodexAuthError(`OpenAI refused to start the device-code sign-in (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const parsed = isRecord(body) ? body : {};
+  const deviceAuthId = str(parsed.device_auth_id);
+  const userCode = str(parsed.user_code) || str(parsed.usercode);
+  if (deviceAuthId === '' || userCode === '') throw new CodexAuthError('OpenAI answered without a device code');
+  const id = randomBytes(ID_BYTES).toString('base64url');
+  const interval = intervalOf(parsed.interval);
+  logins.set(id, { deviceAuthId, userCode, interval, issuer, startedAt: now, polledAt: null });
+  return { id, userCode, verifyUrl: `${issuer}${VERIFY_PATH}`, interval };
+}
+
+async function claim(entry: Entry, fetchImpl: typeof fetch, now: number): Promise<DeviceStatus> {
+  const res = await post(`${entry.issuer}/api/accounts/deviceauth/token`, { device_auth_id: entry.deviceAuthId, user_code: entry.userCode }, fetchImpl);
+  if (res.status === 403 || res.status === 404) {
+    await res.body?.cancel();
+    return { status: 'pending' };
+  }
+  if (!res.ok) return { status: 'failed', error: `OpenAI ended the device-code sign-in (${String(res.status)})` };
+  const body: unknown = await res.json();
+  const parsed = isRecord(body) ? body : {};
+  const code = str(parsed.authorization_code);
+  const verifier = str(parsed.code_verifier);
+  if (code === '' || verifier === '') return { status: 'failed', error: 'OpenAI approved the sign-in but sent no code back' };
+  const tokens = await exchangeCode(entry.issuer, code, verifier, `${entry.issuer}/deviceauth/callback`, fetchImpl, now);
+  return { status: 'done', tokens };
+}
+
+export async function pollDeviceLogin(id: string, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceStatus> {
+  sweep(now);
+  const entry = logins.get(id);
+  if (entry === undefined) throw new CodexAuthError('this sign-in has expired or already finished; press Connect again');
+  if (entry.polledAt !== null && now - entry.polledAt < entry.interval * 1000) return { status: 'pending' };
+  entry.polledAt = now;
+  let result: DeviceStatus;
+  try {
+    result = await claim(entry, fetchImpl, now);
+  } catch (err) {
+    result = { status: 'failed', error: errMsg(err) };
+  }
+  if (result.status !== 'pending') logins.delete(id);
+  return result;
+}