@stage-labs/metro 0.1.0-beta.2 → 0.1.0-beta.200

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -0,0 +1,274 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from '@metro-labs/core/log';
+import { agentIdForKey } from '../agents/keys.js';
+import {
+  assertBedrockReady,
+  bedrockBase,
+  bedrockCount,
+  bedrockMessages,
+  freshAdaptations,
+  type Adaptations,
+} from './bedrock.js';
+import { addBeta, anthropicHeaders, forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, watchUpstream } from './forward.js';
+import { BINDING_BETA, cappedEffort, effortToApply, plannedEffort, withBlockBinding, withEffort, withThinkingFor } from './effort.js';
+import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type Connection, type ModelConfig, type Route } from './model-config.js';
+import { codexMessages, sharedCodexState } from './codex.js';
+import { geminiMessages, sharedGeminiState } from './gemini.js';
+import { countTokens } from './subscription.js';
+import type { GeminiDeps } from './gemini.js';
+import type { CodexDeps } from './codex.js';
+import type { GeminiTokens } from './gemini-auth.js';
+import { OPENROUTER_BASE } from './openrouter.js';
+import { isRecord } from '@metro-labs/core/is-record';
+import { forgetServed, noteServed } from './served.js';
+import { forgetUsage, noteUsageHeaders, UsageScanner } from './usage.js';
+import type { CodexTokens } from './codex-auth.js';
+
+export const GATEWAY_PREFIX = '/gateway';
+export const ANTHROPIC_BASE = 'https://api.anthropic.com';
+const MESSAGES = '/v1/messages';
+const COUNT = '/v1/messages/count_tokens';
+const MODELS = '/v1/models';
+const HELLO = '/api/hello';
+
+export interface GatewayDeps {
+  config: () => ModelConfig;
+  identify?: (key: string) => boolean;
+  anthropicBase?: string;
+  bedrockBase?: string;
+  openrouterBase?: string;
+  codex?: Partial<CodexDeps>;
+  gemini?: Partial<GeminiDeps>;
+}
+
+const learned: Adaptations = freshAdaptations();
+
+export function resetGatewayState(): void {
+  forgetServed();
+  forgetUsage();
+  learned.fields.clear();
+  learned.dropBetas = false;
+  sharedCodexState.clear();
+  sharedGeminiState.clear();
+}
+
+const saveCodexTokens = (id: string, tokens: CodexTokens): void => {
+  writeModelConfig(setCodexAuth(readModelConfig(), id, tokens));
+};
+
+const saveGeminiTokens = (id: string, tokens: GeminiTokens): void => {
+  writeModelConfig(setGeminiAuth(readModelConfig(), id, tokens));
+};
+
+const keyOf = (req: IncomingMessage): string => {
+  const raw = req.headers['x-metro-key'];
+  return (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
+};
+
+const defaultIdentify = (key: string): boolean => key !== '' && agentIdForKey(key) !== undefined;
+
+function modelsBody(cfg: ModelConfig): Record<string, unknown> {
+  const data = cfg.connections
+    .filter((c) => c.provider !== 'anthropic' && c.model !== '')
+    .map((c) => ({ id: `${c.provider}:${c.model}`, display_name: `${c.label} · ${c.model}`, description: 'Through metro' }));
+  return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
+}
+
+const PASSTHROUGH: Connection = { id: 'passthrough', provider: 'anthropic', label: 'Claude Code login', model: '', apiKey: '', region: '', zdr: false, codex: null, gemini: null };
+
+const passthrough = (body: Record<string, unknown>): Route => ({ connection: PASSTHROUGH, model: requestedModel(body) });
+
+function requestedModel(body: Record<string, unknown>): string {
+  const model = body.model;
+  if (typeof model !== 'string' || model === '') throw new GatewayError(400, 'invalid_request_error', 'model is required');
+  return model;
+}
+
+const standsInFor = (req: IncomingMessage): boolean => {
+  const metroKey = req.headers['x-metro-key'];
+  return typeof metroKey === 'string' && metroKey !== '' && req.headers.authorization === `Bearer ${metroKey}`;
+};
+
+interface Payloads {
+  metro: Buffer;
+  asSent: Buffer | null;
+  bound: boolean;
+}
+
+function anthropicPayloads(raw: Buffer, sent: Record<string, unknown>, shaped: Record<string, unknown>, model: string): Payloads {
+  const rewrite = typeof sent.model === 'string' && sent.model !== model;
+  const asSent = rewrite ? Buffer.from(JSON.stringify({ ...sent, model })) : raw;
+  const bound = withBlockBinding(withThinkingFor(shaped, model));
+  if (bound === sent) return { metro: asSent, asSent: null, bound: false };
+  return { metro: Buffer.from(JSON.stringify(rewrite ? { ...bound, model } : bound)), asSent, bound: bound !== shaped };
+}
+
+type Send = (payload: Buffer, headers: Record<string, string>) => Promise<Response>;
+
+async function asAnthropicWants(send: Send, base: Record<string, string>, payloads: Payloads, connection: string, model: string): Promise<Response> {
+  const { metro, asSent, bound } = payloads;
+  const upstream = await send(metro, bound ? addBeta(base, BINDING_BETA) : base);
+  if (upstream.status !== 400 || asSent === null) return upstream;
+  await upstream.body?.cancel();
+  log.warn({ connection, model }, 'gateway: Anthropic refused the request metro shaped, so it was sent again as Claude Code wrote it');
+  return send(asSent, base);
+}
+
+async function toAnthropic(
+  req: IncomingMessage,
+  res: ServerResponse,
+  raw: Buffer,
+  sent: Record<string, unknown>,
+  shaped: Record<string, unknown>,
+  route: Route,
+  deps: GatewayDeps,
+): Promise<void> {
+  const conn = route.connection;
+  const url = `${deps.anthropicBase ?? ANTHROPIC_BASE}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
+  const key = conn.apiKey;
+  if (key === '' && standsInFor(req))
+    throw new GatewayError(
+      403,
+      'permission_error',
+      'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter, Codex or Gemini on the Model page, or sign in on the Claude tab',
+    );
+  const watch = watchUpstream(res);
+  const base = key === '' ? forwardedHeaders(req) : anthropicHeaders(req, key);
+  const send = (payload: Buffer, headers: Record<string, string>): Promise<Response> =>
+    fetch(url, { method: 'POST', headers, body: new Uint8Array(payload), signal: watch.signal, redirect: 'manual' });
+  const upstream = await asAnthropicWants(send, base, anthropicPayloads(raw, sent, shaped, route.model), conn.label, route.model);
+  noteRefusal(conn.label, route.model, upstream);
+  noteUsageHeaders('anthropic', conn.id, upstream.headers);
+  const scanner = new UsageScanner(conn.id);
+  await pipeResponse(upstream, res, watch, key === '' ? { scanner } : { ownCredential: true, scanner });
+}
+
+async function toOpenRouter(
+  req: IncomingMessage,
+  res: ServerResponse,
+  body: Record<string, unknown>,
+  route: Route,
+  cfg: ModelConfig,
+  deps: GatewayDeps,
+): Promise<void> {
+  const conn = route.connection;
+  const reason = notReady(cfg, conn);
+  if (reason !== null) throw new GatewayError(400, 'invalid_request_error', reason);
+  const headers: Record<string, string> = {
+    'content-type': 'application/json',
+    accept: req.headers.accept ?? 'application/json',
+    authorization: `Bearer ${conn.apiKey}`,
+    'anthropic-version': typeof req.headers['anthropic-version'] === 'string' ? req.headers['anthropic-version'] : '2023-06-01',
+    'http-referer': 'https://metro.box',
+    'x-title': 'metro',
+  };
+  const beta = req.headers['anthropic-beta'];
+  if (typeof beta === 'string' && beta !== '') headers['anthropic-beta'] = beta;
+  const watch = watchUpstream(res);
+  const upstream = await fetch(`${deps.openrouterBase ?? OPENROUTER_BASE}${MESSAGES}`, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify(openrouterBody(body, route.model, conn.zdr)),
+    signal: watch.signal,
+    redirect: 'manual',
+  });
+  noteRefusal(conn.label, route.model, upstream);
+  await pipeResponse(upstream, res, watch, { keepalive: true, ownCredential: true, scanner: new UsageScanner(conn.id) });
+}
+
+const thinkingOff = (body: Record<string, unknown>): boolean => isRecord(body.thinking) && body.thinking.type === 'disabled';
+
+export function openrouterBody(body: Record<string, unknown>, model: string, zdr: boolean): Record<string, unknown> {
+  const sent: Record<string, unknown> = { ...body, model };
+  if (thinkingOff(body)) delete sent.thinking;
+  const effort = effortToApply(body);
+  if (effort !== null) sent.reasoning = { ...(isRecord(body.reasoning) ? body.reasoning : {}), effort: cappedEffort(effort) };
+  if (!zdr) return sent;
+  const provider = isRecord(body.provider) ? body.provider : {};
+  return { ...sent, provider: { ...provider, zdr: true } };
+}
+
+function noteRefusal(connection: string, model: string, upstream: Response): void {
+  if (!upstream.ok) log.warn({ connection, model, status: upstream.status }, 'gateway: the provider refused the request');
+}
+
+async function toSubscription(req: IncomingMessage, res: ServerResponse, path: string, body: Record<string, unknown>, route: Route, deps: GatewayDeps): Promise<void> {
+  const conn = route.connection;
+  if (path === COUNT) countTokens(res, body);
+  else if (conn.provider === 'gemini') await geminiMessages(req, res, body, route.model, conn, { save: saveGeminiTokens, ...deps.gemini }, sharedGeminiState, watchUpstream(res));
+  else await codexMessages(req, res, body, route.model, conn, { save: saveCodexTokens, ...deps.codex }, sharedCodexState, watchUpstream(res));
+}
+
+function shapedFor(req: IncomingMessage, sent: Record<string, unknown>): Record<string, unknown> {
+  const effort = plannedEffort(req, sent);
+  return effort === null ? sent : withEffort(sent, effort);
+}
+
+async function dispatch(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): Promise<void> {
+  const cfg = deps.config();
+  const raw = await readBody(req);
+  const sent = parseJson(raw);
+  const body = shapedFor(req, sent);
+  const route = resolveRoute(requestedModel(body), cfg) ?? passthrough(body);
+  const conn = route.connection;
+  log.info({ route: routeLabel(route), connection: conn.label, path }, 'gateway: routing');
+  if (path === MESSAGES) noteServed({ connection: conn.id, provider: conn.provider, model: route.model, at: new Date().toISOString() });
+  if (conn.provider === 'bedrock') {
+    assertBedrockReady(conn);
+    const up = { settings: conn, base: deps.bedrockBase ?? bedrockBase(conn.region), learned, watch: watchUpstream(res) };
+    if (path === COUNT) await bedrockCount(req, res, body, route.model, up);
+    else await bedrockMessages(req, res, body, route.model, up);
+    return;
+  }
+  if (conn.provider === 'openrouter') {
+    if (path === COUNT) throw new GatewayError(404, 'not_found_error', 'OpenRouter does not count tokens');
+    await toOpenRouter(req, res, body, route, cfg, deps);
+    return;
+  }
+  if (conn.provider === 'codex' || conn.provider === 'gemini') {
+    await toSubscription(req, res, path, body, route, deps);
+    return;
+  }
+  await toAnthropic(req, res, raw, sent, body, route, deps);
+}
+
+function failed(res: ServerResponse, err: unknown): void {
+  if (res.headersSent) {
+    res.end();
+    return;
+  }
+  if (err instanceof GatewayError) {
+    sendError(res, err.status, err.kind, err.message);
+    return;
+  }
+  log.warn({ err: errMsg(err) }, 'gateway: request failed');
+  sendError(res, 502, 'api_error', `metro gateway: ${errMsg(err)}`);
+}
+
+function answer(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): void {
+  if (req.method === 'GET' && path === MODELS) {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify(modelsBody(deps.config())));
+    return;
+  }
+  if (req.method === 'POST' && (path === MESSAGES || path === COUNT)) {
+    dispatch(req, res, path, deps).catch((err: unknown) => {
+      failed(res, err);
+    });
+    return;
+  }
+  sendError(res, 404, 'not_found_error', 'not found');
+}
+
+export function handleGatewayRequest(req: IncomingMessage, res: ServerResponse, deps: GatewayDeps): boolean {
+  const full = req.url ?? '';
+  if (full !== GATEWAY_PREFIX && !full.startsWith(`${GATEWAY_PREFIX}/`)) return false;
+  const path = (full.split('?')[0] ?? '').slice(GATEWAY_PREFIX.length);
+  if (req.method === 'HEAD' && path === HELLO) {
+    res.writeHead(200).end();
+    return true;
+  }
+  if ((deps.identify ?? defaultIdentify)(keyOf(req))) answer(req, res, path, deps);
+  else sendError(res, 401, 'authentication_error', 'metro gateway: no agent key (x-metro-key); start Claude Code with metro claude');
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-auth.ts

@@ -0,0 +1,160 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { PendingLogins } from './pkce.js';
+import { nonEmpty } from './text.js';
+
+export const GEMINI_CLIENT_ID = '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com';
+export const GEMINI_CLIENT_SECRET = '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';
+export const GEMINI_AUTH_BASE = 'https://accounts.google.com';
+export const GEMINI_TOKEN_BASE = 'https://oauth2.googleapis.com';
+export const GEMINI_REDIRECT = 'http://localhost:51121/oauth-callback';
+const SCOPE = [
+  'https://www.googleapis.com/auth/cloud-platform',
+  'https://www.googleapis.com/auth/userinfo.email',
+  'https://www.googleapis.com/auth/userinfo.profile',
+  'https://www.googleapis.com/auth/cclog',
+  'https://www.googleapis.com/auth/experimentsandconfigs',
+].join(' ');
+const EXPIRY_MARGIN_MS = 5 * 60_000;
+const DEFAULT_TTL_MS = 55 * 60_000;
+
+export interface GeminiTokens {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: number;
+  email: string | null;
+  project: string;
+  tier: string | null;
+  savedAt: string;
+}
+
+export class GeminiAuthError extends Error {}
+
+const pending = new PendingLogins(16);
+
+export function authorizeUrl(state: string, challenge: string, base = GEMINI_AUTH_BASE): string {
+  const params = new URLSearchParams({
+    client_id: GEMINI_CLIENT_ID,
+    redirect_uri: GEMINI_REDIRECT,
+    response_type: 'code',
+    scope: SCOPE,
+    access_type: 'offline',
+    prompt: 'consent',
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    state,
+  });
+  return `${base}/o/oauth2/v2/auth?${params.toString()}`;
+}
+
+export function beginLogin(base = GEMINI_AUTH_BASE, now = Date.now()): { url: string; state: string } {
+  const { state, challenge } = pending.begin(now);
+  return { url: authorizeUrl(state, challenge, base), state };
+}
+
+
+const refusalIn = (body: Record<string, unknown>): string => nonEmpty(body.error_description) ?? nonEmpty(body.error) ?? 'Google answered without an access token';
+
+function grantedTokens(body: unknown, previous: GeminiTokens | null): { accessToken: string; refreshToken: string; ttl: number } {
+  if (!isRecord(body)) throw new GeminiAuthError('Google answered without tokens');
+  const accessToken = nonEmpty(body.access_token);
+  if (accessToken === null) throw new GeminiAuthError(refusalIn(body));
+  const refreshToken = nonEmpty(body.refresh_token) ?? previous?.refreshToken ?? '';
+  if (refreshToken === '') throw new GeminiAuthError('Google issued no refresh token; sign in again');
+  return { accessToken, refreshToken, ttl: typeof body.expires_in === 'number' ? body.expires_in * 1000 : DEFAULT_TTL_MS };
+}
+
+function tokensOf(body: unknown, previous: GeminiTokens | null, now: number): GeminiTokens {
+  const granted = grantedTokens(body, previous);
+  return {
+    accessToken: granted.accessToken,
+    refreshToken: granted.refreshToken,
+    expiresAt: now + granted.ttl,
+    email: previous?.email ?? null,
+    project: previous?.project ?? '',
+    tier: previous?.tier ?? null,
+    savedAt: new Date(now).toISOString(),
+  };
+}
+
+async function tokenCall(form: Record<string, string>, base: string, fetchImpl: typeof fetch): Promise<unknown> {
+  let res: Response;
+  try {
+    res = await fetchImpl(`${base}/token`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(30_000),
+    });
+  } catch (err) {
+    throw new GeminiAuthError(`could not reach Google: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok) throw new GeminiAuthError(isRecord(body) ? (nonEmpty(body.error_description) ?? nonEmpty(body.error) ?? `Google answered ${String(res.status)}`) : `Google answered ${String(res.status)}`);
+  return body;
+}
+
+export function codeIn(pasted: string, state: string): string {
+  const trimmed = pasted.trim();
+  if (trimmed === '') throw new GeminiAuthError('paste the address the browser landed on, or the code in it');
+  if (!/^https?:\/\//i.test(trimmed)) return trimmed;
+  let url: URL;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    throw new GeminiAuthError('that is not a full address');
+  }
+  const code = url.searchParams.get('code') ?? '';
+  const carried = url.searchParams.get('state');
+  if (code === '') throw new GeminiAuthError(`that address carries no code${url.searchParams.get('error') === null ? '' : ` (Google said ${url.searchParams.get('error') ?? ''})`}`);
+  if (carried !== null && carried !== state) throw new GeminiAuthError('that address belongs to another sign-in; start again and paste the new one');
+  return code;
+}
+
+export async function exchangeCode(pasted: string, state: string, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
+  const verifier = pending.take(state, now);
+  if (verifier === null) throw new GeminiAuthError('that sign-in has expired; start it again');
+  const code = codeIn(pasted, state);
+  const body = await tokenCall(
+    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'authorization_code', code, code_verifier: verifier, redirect_uri: GEMINI_REDIRECT },
+    base,
+    fetchImpl,
+  );
+  return tokensOf(body, null, now);
+}
+
+export async function refreshTokens(previous: GeminiTokens, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
+  const body = await tokenCall(
+    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'refresh_token', refresh_token: previous.refreshToken },
+    base,
+    fetchImpl,
+  );
+  return tokensOf(body, previous, now);
+}
+
+export const tokensStale = (tokens: GeminiTokens, now = Date.now()): boolean => tokens.expiresAt - EXPIRY_MARGIN_MS <= now;
+
+export async function userEmail(tokens: GeminiTokens, base = 'https://www.googleapis.com', fetchImpl: typeof fetch = fetch): Promise<string | null> {
+  try {
+    const res = await fetchImpl(`${base}/oauth2/v2/userinfo`, { headers: { authorization: `Bearer ${tokens.accessToken}` }, signal: AbortSignal.timeout(15_000) });
+    const body: unknown = await res.json().catch(() => null);
+    return res.ok && isRecord(body) ? nonEmpty(body.email) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function tokensFromDisk(raw: unknown): GeminiTokens | null {
+  if (!isRecord(raw)) return null;
+  const accessToken = nonEmpty(raw.accessToken);
+  const refreshToken = nonEmpty(raw.refreshToken);
+  if (accessToken === null || refreshToken === null) return null;
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: typeof raw.expiresAt === 'number' ? raw.expiresAt : 0,
+    email: nonEmpty(raw.email),
+    project: nonEmpty(raw.project) ?? '',
+    tier: nonEmpty(raw.tier),
+    savedAt: nonEmpty(raw.savedAt) ?? '',
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-client.ts

@@ -0,0 +1,46 @@
+import { randomUUID } from 'node:crypto';
+
+export const CODE_ASSIST_BASE = 'https://cloudcode-pa.googleapis.com';
+export const CODE_ASSIST_DAILY = 'https://daily-cloudcode-pa.googleapis.com';
+export const API = 'v1internal';
+export const APP_VERSION = '2.0.3';
+export const CLIENT_VERSION = '1.110.0';
+export const CLIENT_NAME = 'antigravity';
+export const IDE_TYPE = 9;
+export const PLUGIN_TYPE = 2;
+export const SYSTEM_PREFIX =
+  'You are Antigravity, a powerful agentic AI coding assistant designed by the Google Deepmind team working on Advanced Agentic Coding.You are pair programming with a USER to solve their coding task. The task may require creating a new codebase, modifying or debugging an existing codebase, or simply answering a question.**Absolute paths only****Proactiveness**';
+
+const PLATFORMS: Record<string, number> = { 'darwin-x64': 1, 'darwin-arm64': 2, 'linux-x64': 3, 'linux-arm64': 4, 'win32-x64': 5 };
+
+const osName = (): string => (process.platform === 'darwin' ? 'darwin' : process.platform === 'win32' ? 'win32' : 'linux');
+
+export const platformCode = (): number => PLATFORMS[`${process.platform}-${process.arch}`] ?? 0;
+
+export const clientMetadata = (project: string | null): Record<string, unknown> => ({
+  ideType: IDE_TYPE,
+  platform: platformCode(),
+  pluginType: PLUGIN_TYPE,
+  ...(project === null ? {} : { duetProject: project }),
+});
+
+export const clientHeaders = (): Record<string, string> => ({
+  'user-agent': `${CLIENT_NAME}/${APP_VERSION} ${osName()}/${process.arch}`,
+  'x-client-name': CLIENT_NAME,
+  'x-client-version': CLIENT_VERSION,
+  'x-goog-api-client': 'gl-node/18.18.2 fire/0.8.6 grpc/1.10.x',
+});
+
+export type Bases = string | string[];
+
+const listed = (override: Bases): string[] => (typeof override === 'string' ? [override] : override);
+
+export const generateBases = (override?: Bases): string[] => (override === undefined ? [CODE_ASSIST_DAILY, CODE_ASSIST_BASE] : listed(override));
+
+export const setupBases = (override?: Bases): string[] => (override === undefined ? [CODE_ASSIST_BASE, CODE_ASSIST_DAILY] : listed(override));
+
+export const requestId = (): string => `agent-${randomUUID()}`;
+
+const sessionId = randomUUID();
+
+export const machineSessionId = (): string => sessionId;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-setup.ts

@@ -0,0 +1,150 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+import { GeminiAuthError, type GeminiTokens } from './gemini-auth.js';
+import { API, clientHeaders, clientMetadata, setupBases, type Bases } from './gemini-client.js';
+import { nonEmpty } from './text.js';
+
+const FREE_TIER = 'free-tier';
+const PROJECT_RE = /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/;
+const POLL_MS = 5000;
+const POLL_MAX = 24;
+
+export interface Onboarded {
+  project: string;
+  tier: string | null;
+}
+
+
+export function parseGeminiProject(value: unknown): string | null {
+  const project = typeof value === 'string' ? value.trim() : '';
+  if (project === '') return null;
+  if (!PROJECT_RE.test(project)) throw new GeminiAuthError('that is not a Google Cloud project id: 6 to 30 lowercase letters, digits and dashes, starting with a letter');
+  return project;
+}
+
+class Retryable extends Error {}
+
+async function callOne(base: string, method: string, token: string, body: unknown, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  let res: Response;
+  try {
+    res = await fetchImpl(`${base}/${API}:${method}`, {
+      method: 'POST',
+      headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json', ...clientHeaders() },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(30_000),
+    });
+  } catch (err) {
+    throw new Retryable(`could not reach Google Code Assist: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const answer: unknown = await res.json().catch(() => null);
+  if (!res.ok) {
+    const detail = (isRecord(answer) && isRecord(answer.error) ? nonEmpty(answer.error.message) : null) ?? `Google Code Assist answered ${String(res.status)} on ${method}`;
+    throw res.status >= 500 ? new Retryable(detail) : new GeminiAuthError(detail);
+  }
+  return isRecord(answer) ? answer : {};
+}
+
+async function call(bases: string[], method: string, token: string, body: unknown, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  let last = 'no Code Assist endpoint to call';
+  for (const base of bases) {
+    try {
+      return await callOne(base, method, token, body, fetchImpl);
+    } catch (err) {
+      if (!(err instanceof Retryable)) throw err;
+      last = err.message;
+    }
+  }
+  throw new GeminiAuthError(last);
+}
+
+const tierOf = (load: Record<string, unknown>): { id: string | null; name: string | null } => {
+  const tier = isRecord(load.paidTier) ? load.paidTier : isRecord(load.currentTier) ? load.currentTier : null;
+  return { id: tier === null ? null : nonEmpty(tier.id), name: tier === null ? null : nonEmpty(tier.name) };
+};
+
+async function waitOperation(base: string, token: string, first: Record<string, unknown>, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  let op = first;
+  for (let i = 0; op.done !== true && i < POLL_MAX; i += 1) {
+    const name = nonEmpty(op.name);
+    if (name === null) break;
+    await new Promise((r) => setTimeout(r, POLL_MS));
+    const res = await fetchImpl(`${base}/${API}/${name}`, { headers: { authorization: `Bearer ${token}`, ...clientHeaders() }, signal: AbortSignal.timeout(30_000) });
+    const answer: unknown = await res.json().catch(() => null);
+    op = isRecord(answer) ? answer : {};
+  }
+  return op;
+}
+
+const REASONS: Record<string, string> = {
+  DASHER_USER: 'this is a Google Workspace account; the individual tier needs a personal Google account',
+  NON_USER_ACCOUNT: 'this is not a user account',
+  RESTRICTED_AGE: 'the account does not meet the age requirement',
+  UNSUPPORTED_LOCATION: 'Gemini Code Assist for individuals is not offered where this account is located',
+  UNKNOWN_LOCATION: 'Google could not tell where this account is located',
+  RESTRICTED_NETWORK: 'the network this box is on is restricted',
+  INELIGIBLE_ACCOUNT: 'Google marks this account as not eligible',
+  UNSUPPORTED_CLIENT: 'Google no longer serves the client metro presents; nothing on this box can fix that',
+};
+
+function refuseIneligible(load: Record<string, unknown>): void {
+  if (isRecord(load.currentTier) || !Array.isArray(load.ineligibleTiers)) return;
+  const tiers = load.ineligibleTiers.filter(isRecord);
+  if (tiers.length === 0) return;
+  const validation = tiers.find((t) => t.reasonCode === 'VALIDATION_REQUIRED' && nonEmpty(t.validationUrl) !== null);
+  if (validation !== undefined) throw new GeminiAuthError(`Google asks you to validate the account first: open ${nonEmpty(validation.validationUrl) ?? ''} and then connect again`);
+  const said = tiers.map((t) => `${nonEmpty(t.reasonMessage) ?? 'not eligible'} [${nonEmpty(t.reasonCode) ?? 'UNKNOWN'}: ${REASONS[nonEmpty(t.reasonCode) ?? ''] ?? 'no known reason'}]`);
+  throw new GeminiAuthError(said.join('; '));
+}
+
+const NO_PROJECT = 'this account holds a Code Assist licence but Google named no project for it: enter the id of the Google Cloud project that carries the licence and connect again';
+
+function tierToOnboard(load: Record<string, unknown>): { id: string; name: string | null } {
+  const allowed = Array.isArray(load.allowedTiers) ? load.allowedTiers.filter(isRecord) : [];
+  const chosen = allowed.find((t) => t.isDefault === true);
+  return { id: nonEmpty(chosen?.id) ?? FREE_TIER, name: nonEmpty(chosen?.name) };
+}
+
+const summary = (load: Record<string, unknown>): Record<string, unknown> => ({
+  current: isRecord(load.currentTier) ? nonEmpty(load.currentTier.id) : null,
+  paid: isRecord(load.paidTier) ? nonEmpty(load.paidTier.id) : null,
+  allowed: Array.isArray(load.allowedTiers) ? load.allowedTiers.filter(isRecord).map((t) => `${nonEmpty(t.id) ?? '?'}${t.isDefault === true ? '*' : ''}`) : [],
+  ineligible: Array.isArray(load.ineligibleTiers) ? load.ineligibleTiers.filter(isRecord).map((t) => `${nonEmpty(t.tierId) ?? '?'}:${nonEmpty(t.reasonCode) ?? '?'}`) : [],
+  project: nonEmpty(load.cloudaicompanionProject),
+});
+
+function onboardBody(load: Record<string, unknown>, project: string | null): { body: Record<string, unknown>; name: string | null } {
+  const wanted = tierToOnboard(load);
+  const paid = wanted.id !== FREE_TIER && project !== null;
+  return { body: { tierId: wanted.id, metadata: clientMetadata(paid ? project : null) }, name: wanted.name ?? wanted.id };
+}
+
+const NO_ASSIGNMENT = 'Google did not assign a Code Assist project to this account; enter the id of the Google Cloud project that carries your licence and connect again';
+
+const withProject = (project: string | null): Record<string, unknown> => (project === null ? {} : { cloudaicompanionProject: project });
+
+const assignedProject = (op: Record<string, unknown>): string | null => {
+  const response = isRecord(op.response) ? op.response : {};
+  return isRecord(response.cloudaicompanionProject) ? nonEmpty(response.cloudaicompanionProject.id) : null;
+};
+
+async function onboardNew(load: Record<string, unknown>, tokens: GeminiTokens, project: string | null, bases: string[], fetchImpl: typeof fetch): Promise<Onboarded> {
+  const { body, name } = onboardBody(load, project);
+  const first = await call(bases, 'onboardUser', tokens.accessToken, body, fetchImpl);
+  const op = await waitOperation(bases[0] ?? '', tokens.accessToken, first, fetchImpl);
+  const assigned = assignedProject(op) ?? project;
+  if (assigned === null) throw new GeminiAuthError(NO_ASSIGNMENT);
+  return { project: assigned, tier: name };
+}
+
+export async function onboard(tokens: GeminiTokens, project: string | null = null, base?: Bases, fetchImpl: typeof fetch = fetch): Promise<Onboarded> {
+  const bases = setupBases(base);
+  const asked = { metadata: clientMetadata(project), mode: 1, ...withProject(project) };
+  const load = await call(bases, 'loadCodeAssist', tokens.accessToken, asked, fetchImpl);
+  log.info(summary(load), 'gemini: Code Assist answered loadCodeAssist');
+  refuseIneligible(load);
+  if (!isRecord(load.currentTier)) return onboardNew(load, tokens, project, [...bases].reverse(), fetchImpl);
+  const known = nonEmpty(load.cloudaicompanionProject) ?? project;
+  if (known === null) throw new GeminiAuthError(NO_PROJECT);
+  const tier = tierOf(load);
+  return { project: known, tier: tier.name ?? tier.id };
+}