@stage-labs/metro 0.1.0-beta.21 → 0.1.0-beta.210

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -0,0 +1,193 @@
+import type { IncomingMessage } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { readJsonBody } from '@metro-labs/http/api-http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { beginLogin, finishLogin, readCodexCliAuth, type CodexTokens } from './codex-auth.js';
+import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
+import { codexModels, currentTokens, sharedCodexState } from './codex.js';
+import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, userEmail, type GeminiTokens } from './gemini-auth.js';
+import { onboard, parseGeminiProject } from './gemini-setup.js';
+import { currentGeminiTokens, listGeminiModels, sharedGeminiState, type GeminiDeps } from './gemini.js';
+import { openrouterCredits } from './openrouter.js';
+import { lastServed } from './served.js';
+import { geminiUsage, noteUsage, openrouterUsage, usageOf } from './usage.js';
+import {
+  addConnection,
+  connectionOf,
+  setCodexAuth,
+  setGeminiAuth,
+  type Connection,
+  type ModelConfig,
+  type Provider,
+} from './model-config.js';
+import { asApiError, askedConnection, BODY_MAX, connectionFor, CREDITS_TTL_MS, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
+
+
+function connectionToFill(store: Store, req: IncomingMessage, provider: Provider): { cfg: ModelConfig; id: string } {
+  const asked = askedConnection(req);
+  const current = store.read();
+  if (asked !== '') {
+    if (connectionOf(current, asked)?.provider !== provider) throw new ApiError('no such connection', 404);
+    return { cfg: current, id: asked };
+  }
+  const cfg = addConnection(current, { provider });
+  return { cfg, id: cfg.connections.at(-1)?.id ?? '' };
+}
+
+const saved = (store: Store, cfg: ModelConfig, note: string, fields: Record<string, unknown>): unknown => {
+  store.write(cfg);
+  log.info(fields, note);
+  return settingsBody(cfg);
+};
+
+function keepCodex(store: Store, req: IncomingMessage, tokens: CodexTokens | null, note: string): unknown {
+  const { cfg, id } = connectionToFill(store, req, 'codex');
+  const next = setCodexAuth(cfg, id, tokens);
+  return saved(store, next, note, { connection: id, plan: tokens?.plan ?? null });
+}
+
+async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
+  const result = await pollDeviceLogin(id, deps.fetchImpl).catch(asApiError);
+  if (result.status !== 'done') return result;
+  return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected by device code') };
+}
+
+const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { issuer?: string; fetchImpl?: typeof fetch; base?: string; save: (connId: string, t: CodexTokens) => void } => ({
+  issuer: deps.issuer,
+  fetchImpl: deps.fetchImpl,
+  base: deps.codexBase,
+  save: (connId, t) => {
+    store.write(setCodexAuth(store.read(), connId === '' ? id : connId, t));
+  },
+});
+
+export const CODEX_ROUTES: Record<string, Route> = {
+  device: {
+    method: 'POST',
+    run: async (_req, deps) => {
+      const login = await beginDeviceLogin(deps.issuer, deps.fetchImpl).catch(asApiError);
+      return { id: login.id, user_code: login.userCode, verify_url: login.verifyUrl, interval: login.interval };
+    },
+  },
+  login: { method: 'POST', run: (_req, deps) => Promise.resolve({ url: beginLogin(deps.issuer).url }) },
+  callback: {
+    method: 'POST',
+    run: async (req, deps, store) => {
+      const body = await readJsonBody(req, BODY_MAX);
+      const raw = isRecord(body) && typeof body.url === 'string' ? body.url : '';
+      const tokens = await finishLogin(raw, deps.issuer, deps.fetchImpl).catch(asApiError);
+      return keepCodex(store, req, tokens, 'model-api: Codex connected');
+    },
+  },
+  import: {
+    method: 'POST',
+    run: (_req, deps, store) => {
+      let tokens;
+      try {
+        tokens = readCodexCliAuth(deps.codexHome);
+      } catch (err) {
+        asApiError(err);
+      }
+      return Promise.resolve(keepCodex(store, _req, tokens, 'model-api: Codex CLI login imported'));
+    },
+  },
+  models: {
+    method: 'GET',
+    run: async (req, deps, store) => {
+      const conn = connectionFor(store.read(), req, 'codex');
+      if (conn.codex === null) throw new ApiError('this connection is not signed in yet', 400);
+      const codexDeps = codexDepsFor(deps, store, conn.id);
+      const auth = await currentTokens(conn, codexDeps, sharedCodexState).catch(asApiError);
+      return { models: await codexModels(auth, codexDeps).catch(asApiError) };
+    },
+  },
+};
+
+const geminiDeps = (deps: ModelApiDeps, store: Store): GeminiDeps => ({
+  base: deps.geminiBase,
+  tokenBase: deps.geminiTokenBase,
+  fetchImpl: deps.fetchImpl,
+  save: (id, t) => {
+    store.write(setGeminiAuth(store.read(), id, t));
+  },
+});
+
+async function geminiModelsOf(conn: Connection, deps: ModelApiDeps, store: Store): Promise<Awaited<ReturnType<typeof listGeminiModels>>> {
+  if (conn.gemini === null) throw new ApiError('this connection is not signed in yet', 400);
+  const tokens = await currentGeminiTokens(conn, geminiDeps(deps, store), sharedGeminiState);
+  return listGeminiModels(tokens, geminiDeps(deps, store));
+}
+
+function projectOf(body: unknown): string | null {
+  try {
+    return parseGeminiProject(isRecord(body) ? body.project : null);
+  } catch (err) {
+    return asApiError(err);
+  }
+}
+
+async function connectGemini(req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
+  const body = await readJsonBody(req, BODY_MAX);
+  const code = isRecord(body) && typeof body.code === 'string' ? body.code : '';
+  const state = isRecord(body) && typeof body.state === 'string' ? body.state : '';
+  const project = projectOf(body);
+  const tokens = await exchangeGeminiCode(code, state, deps.geminiTokenBase, deps.fetchImpl).catch(asApiError);
+  const email = await userEmail(tokens, deps.geminiUserBase, deps.fetchImpl);
+  const onboarded = await onboard(tokens, project, deps.geminiBase, deps.fetchImpl).catch(asApiError);
+  const { cfg, id } = connectionToFill(store, req, 'gemini');
+  const full: GeminiTokens = { ...tokens, email, project: onboarded.project, tier: onboarded.tier };
+  return saved(store, setGeminiAuth(cfg, id, full), 'model-api: Gemini connected', { connection: id, tier: onboarded.tier });
+}
+
+export const GEMINI_ROUTES: Record<string, Route> = {
+  login: { method: 'POST', run: (_req, deps) => Promise.resolve(beginGeminiLogin(deps.geminiAuthBase)) },
+  code: { method: 'POST', run: connectGemini },
+  models: {
+    method: 'GET',
+    run: async (req, deps, store) => ({ models: (await geminiModelsOf(connectionFor(store.read(), req, 'gemini'), deps, store).catch(asApiError)).map((m) => m.id) }),
+  },
+};
+
+export function codexDeviceRoute(id: string, method: string | undefined): Route | number {
+  return method === 'GET' ? { method: 'GET', run: (req, deps, store) => pollDevice(id, req, deps, store) } : 405;
+}
+
+async function refreshOne(conn: Connection, deps: ModelApiDeps, now: number): Promise<void> {
+  if (conn.apiKey === '') return;
+  const seen = usageOf(conn.id);
+  if (seen !== undefined && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
+  try {
+    const credits = await openrouterCredits(conn.apiKey, deps.openrouterBase, deps.fetchImpl);
+    noteUsage(conn.id, openrouterUsage(credits.total, credits.spent, new Date(now)));
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'model-api: could not read the OpenRouter credits');
+  }
+}
+
+const modelsInUse = (conn: Connection): Set<string> => {
+  const served = lastServed();
+  return new Set([conn.model, served?.connection === conn.id ? served.model : ''].filter((m) => m !== ''));
+};
+
+async function refreshQuota(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.gemini === null) return;
+  const inUse = modelsInUse(conn);
+  const seen = usageOf(conn.id);
+  const covers = seen !== undefined && [...inUse].every((id) => seen.windows.some((w) => w.label === id));
+  if (seen !== undefined && covers && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
+  try {
+    const rows = (await geminiModelsOf(conn, deps, store)).filter((m) => inUse.has(m.id));
+    const usage = geminiUsage(rows, new Date(now));
+    if (usage !== null) noteUsage(conn.id, usage);
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'model-api: could not read the Gemini quota');
+  }
+}
+
+export async function refreshUsage(deps: ModelApiDeps, store: Store, now = Date.now()): Promise<void> {
+  for (const conn of store.read().connections) {
+    if (conn.provider === 'openrouter') await refreshOne(conn, deps, now);
+    if (conn.provider === 'gemini') await refreshQuota(conn, deps, store, now);
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -0,0 +1,70 @@
+import type { IncomingMessage } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { CodexAuthError } from './codex-auth.js';
+import { GeminiAuthError } from './gemini-auth.js';
+import { GatewayError } from './forward.js';
+import { lastServed } from './served.js';
+import { usageSeen } from './usage.js';
+import { ModelConfigError, connectionOf, publicModelConfig, routedConnection, type Connection, type ModelConfig, type Provider } from './model-config.js';
+import type { SetupDeps } from '../claude/setup.js';
+
+export interface ModelApiDeps {
+  read?: () => ModelConfig;
+  write?: (cfg: ModelConfig) => void;
+  issuer?: string;
+  fetchImpl?: typeof fetch;
+  codexHome?: string;
+  codexBase?: string;
+  geminiAuthBase?: string;
+  geminiTokenBase?: string;
+  geminiUserBase?: string;
+  geminiBase?: string;
+  openrouterBase?: string;
+  anthropicBase?: string;
+  bedrockControlBase?: string;
+  setup?: SetupDeps;
+  restartSession?: () => boolean;
+}
+
+export interface Store {
+  read: () => ModelConfig;
+  write: (cfg: ModelConfig) => void;
+}
+
+type Handler = (req: IncomingMessage, deps: ModelApiDeps, store: Store) => Promise<unknown>;
+
+export interface Route {
+  method: 'GET' | 'POST';
+  run: Handler;
+}
+
+export const BODY_MAX = 16 * 1024;
+export const CREDITS_TTL_MS = 5 * 60_000;
+
+export const settingsBody = (cfg: ModelConfig): Record<string, unknown> => ({
+  ...publicModelConfig(cfg),
+  lastServed: lastServed(),
+  usage: usageSeen(),
+});
+
+export function asApiError(err: unknown): never {
+  if (err instanceof ModelConfigError || err instanceof CodexAuthError || err instanceof GeminiAuthError) throw new ApiError(err.message, 400);
+  if (err instanceof GatewayError) throw new ApiError(err.message, err.status >= 400 && err.status < 500 ? 400 : 502);
+  throw err;
+}
+
+export const askedConnection = (req: IncomingMessage): string => new URL(req.url ?? '', 'http://metro').searchParams.get('connection') ?? '';
+
+export function connectionFor(cfg: ModelConfig, req: IncomingMessage, provider: Provider): Connection {
+  const asked = askedConnection(req);
+  if (asked !== '') {
+    const found = connectionOf(cfg, asked);
+    if (found?.provider !== provider) throw new ApiError('no such connection', 404);
+    return found;
+  }
+  const routed = routedConnection(cfg);
+  if (routed?.provider === provider) return routed;
+  const first = cfg.connections.find((c) => c.provider === provider);
+  if (first === undefined) throw new ApiError(`no ${provider} connection yet`, 400);
+  return first;
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter.ts

@@ -0,0 +1,90 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { GatewayError } from './forward.js';
+import { stringOf } from '@metro-labs/http/api-http';
+
+export const OPENROUTER_BASE = 'https://openrouter.ai/api';
+const MODELS_MAX = 2000;
+
+export interface OpenRouterModel {
+  id: string;
+  name: string;
+  prompt: number | null;
+  completion: number | null;
+  created: number | null;
+}
+
+
+function price(raw: unknown): number | null {
+  const value = typeof raw === 'string' ? Number(raw) : typeof raw === 'number' ? raw : Number.NaN;
+  return Number.isFinite(value) && value >= 0 ? value : null;
+}
+
+function released(raw: unknown): number | null {
+  return typeof raw === 'number' && Number.isFinite(raw) && raw > 0 ? raw : null;
+}
+
+function modelOf(entry: unknown): OpenRouterModel | null {
+  if (!isRecord(entry)) return null;
+  const id = stringOf(entry.id);
+  if (id === '') return null;
+  const pricing = isRecord(entry.pricing) ? entry.pricing : {};
+  return {
+    id,
+    name: stringOf(entry.name) || id,
+    prompt: price(pricing.prompt),
+    completion: price(pricing.completion),
+    created: released(entry.created),
+  };
+}
+
+function newestFirst(a: OpenRouterModel, b: OpenRouterModel): number {
+  const when = (b.created ?? 0) - (a.created ?? 0);
+  return when !== 0 ? when : a.id.localeCompare(b.id);
+}
+
+export async function openrouterModels(base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<OpenRouterModel[]> {
+  const res = await fetchImpl(`${base}/v1/models`, { headers: { accept: 'application/json' }, redirect: 'manual' });
+  if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not list its models (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const data = typeof body === 'object' && body !== null ? (body as { data?: unknown }).data : undefined;
+  if (!Array.isArray(data)) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no model list');
+  return data
+    .map(modelOf)
+    .filter((model): model is OpenRouterModel => model !== null)
+    .sort(newestFirst)
+    .slice(0, MODELS_MAX);
+}
+
+export interface OpenRouterCredits {
+  total: number;
+  spent: number;
+}
+
+export async function openrouterCredits(
+  apiKey: string,
+  base = OPENROUTER_BASE,
+  fetchImpl: typeof fetch = fetch,
+): Promise<OpenRouterCredits> {
+  const res = await fetchImpl(`${base}/v1/credits`, {
+    headers: { accept: 'application/json', authorization: `Bearer ${apiKey}` },
+    redirect: 'manual',
+  });
+  if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not report the credits (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const data = isRecord(body) && isRecord(body.data) ? body.data : {};
+  const total = Number(data.total_credits);
+  const spent = Number(data.total_usage);
+  if (!Number.isFinite(total) || !Number.isFinite(spent)) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no credit figures');
+  return { total, spent };
+}
+
+export async function openrouterZdrModels(base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<string[]> {
+  const res = await fetchImpl(`${base}/v1/endpoints/zdr`, { headers: { accept: 'application/json' }, redirect: 'manual' });
+  if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not list its zero data retention endpoints (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const data = typeof body === 'object' && body !== null ? (body as { data?: unknown }).data : undefined;
+  if (!Array.isArray(data)) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no endpoint list');
+  const ids = new Set<string>();
+  for (const entry of data) if (isRecord(entry) && stringOf(entry.model_id) !== '') ids.add(stringOf(entry.model_id));
+  return [...ids].sort();
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/pkce.ts

@@ -0,0 +1,36 @@
+import { createHash, randomBytes } from 'node:crypto';
+
+const PENDING_TTL_MS = 10 * 60_000;
+
+const b64url = (buf: Buffer): string => buf.toString('base64url');
+
+export function newPkce(): { verifier: string; challenge: string } {
+  const verifier = b64url(randomBytes(32));
+  return { verifier, challenge: b64url(createHash('sha256').update(verifier).digest()) };
+}
+
+export class PendingLogins {
+  private readonly pending = new Map<string, { verifier: string; at: number }>();
+
+  constructor(private readonly stateBytes: number) {}
+
+  private sweep(now: number): void {
+    for (const [state, entry] of this.pending) if (now - entry.at > PENDING_TTL_MS) this.pending.delete(state);
+  }
+
+  begin(now: number): { state: string; challenge: string } {
+    this.sweep(now);
+    const { verifier, challenge } = newPkce();
+    const state = b64url(randomBytes(this.stateBytes));
+    this.pending.set(state, { verifier, at: now });
+    return { state, challenge };
+  }
+
+  take(state: string, now: number): string | null {
+    this.sweep(now);
+    const entry = this.pending.get(state);
+    if (entry === undefined) return null;
+    this.pending.delete(state);
+    return entry.verifier;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/provider-models.ts

@@ -0,0 +1,66 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { GatewayError } from './forward.js';
+import type { Connection } from './model-config.js';
+import { stringOf } from '@metro-labs/http/api-http';
+
+const ANTHROPIC_API = 'https://api.anthropic.com';
+const ANTHROPIC_VERSION = '2023-06-01';
+const LIST_MAX = 1000;
+
+export interface ProviderModel {
+  id: string;
+  name: string;
+}
+
+const KNOWN_CLAUDE: ProviderModel[] = [
+  { id: 'claude-fable-5-1', name: 'Claude Fable 5.1' },
+  { id: 'claude-opus-5-5', name: 'Claude Opus 5.5' },
+  { id: 'claude-opus-5', name: 'Claude Opus 5' },
+  { id: 'claude-sonnet-5', name: 'Claude Sonnet 5' },
+  { id: 'claude-haiku-4-5', name: 'Claude Haiku 4.5' },
+];
+
+
+export async function anthropicModels(settings: Connection, base = ANTHROPIC_API, fetchImpl: typeof fetch = fetch): Promise<ProviderModel[]> {
+  if (settings.apiKey === '') return KNOWN_CLAUDE;
+  const res = await fetchImpl(`${base}/v1/models?limit=${String(LIST_MAX)}`, {
+    headers: { 'x-api-key': settings.apiKey, 'anthropic-version': ANTHROPIC_VERSION, accept: 'application/json' },
+    redirect: 'manual',
+  });
+  if (!res.ok) throw new GatewayError(res.status, 'api_error', `Anthropic would not list its models with the stored key (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const data = isRecord(body) && Array.isArray(body.data) ? body.data : null;
+  if (data === null) throw new GatewayError(502, 'api_error', 'Anthropic answered with no model list');
+  return data
+    .flatMap((entry) => (isRecord(entry) && stringOf(entry.id) !== '' ? [{ id: stringOf(entry.id), name: stringOf(entry.display_name) || stringOf(entry.id) }] : []))
+    .sort((a, b) => a.id.localeCompare(b.id));
+}
+
+export const bedrockControlBase = (region: string): string => `https://bedrock.${region}.amazonaws.com`;
+
+export async function bedrockModels(settings: Connection, base?: string, fetchImpl: typeof fetch = fetch): Promise<ProviderModel[]> {
+  if (settings.region === '') throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs a region before its models can be listed');
+  if (settings.apiKey === '') throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs an API key before its models can be listed');
+  const res = await fetchImpl(`${base ?? bedrockControlBase(settings.region)}/inference-profiles?maxResults=${String(LIST_MAX)}`, {
+    headers: { authorization: `Bearer ${settings.apiKey}`, accept: 'application/json' },
+    redirect: 'manual',
+  });
+  if (!res.ok)
+    throw new GatewayError(
+      res.status,
+      'api_error',
+      `Bedrock would not list its inference profiles (${String(res.status)}); the stored key may cover the runtime only, so type the model id instead`,
+    );
+  const body: unknown = await res.json();
+  const list = isRecord(body) && Array.isArray(body.inferenceProfileSummaries) ? body.inferenceProfileSummaries : null;
+  if (list === null) throw new GatewayError(502, 'api_error', 'Bedrock answered with no inference profile list');
+  return list
+    .flatMap((entry) => {
+      if (!isRecord(entry)) return [];
+      const id = stringOf(entry.inferenceProfileId);
+      const status = stringOf(entry.status);
+      if (id === '' || !id.includes('anthropic') || (status !== '' && status !== 'ACTIVE')) return [];
+      return [{ id, name: stringOf(entry.inferenceProfileName) || id }];
+    })
+    .sort((a, b) => a.id.localeCompare(b.id));
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/served.ts

@@ -0,0 +1,18 @@
+export interface Served {
+  connection: string;
+  provider: string;
+  model: string;
+  at: string;
+}
+
+let last: Served | null = null;
+
+export const noteServed = (served: Served): void => {
+  last = served;
+};
+
+export const lastServed = (): Served | null => last;
+
+export const forgetServed = (): void => {
+  last = null;
+};

package/runtime/node_modules/@metro-labs/daemon/src/gateway/subscription.ts

@@ -0,0 +1,120 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg } from '@metro-labs/core/log';
+import { assembleMessage, SseParser, type SseEvent } from './frames.js';
+import { GatewayError, relayFrames, type Watch } from './forward.js';
+import { UsageScanner } from './usage.js';
+
+const STATUS_OF: Record<string, number> = { rate_limit_error: 429, invalid_request_error: 400, permission_error: 403, overloaded_error: 529 };
+
+interface Slot<T> {
+  refreshing: Promise<T> | null;
+  latest: T | null;
+}
+
+export type TokenState<T> = Map<string, Slot<T>>;
+
+export interface TokenSource<T extends { savedAt: string }> {
+  label: string;
+  stale: (tokens: T) => boolean;
+  refresh: (tokens: T) => Promise<T>;
+  save: (id: string, tokens: T) => void;
+}
+
+function slotFor<T>(state: TokenState<T>, id: string): Slot<T> {
+  const found = state.get(id);
+  if (found !== undefined) return found;
+  const made: Slot<T> = { refreshing: null, latest: null };
+  state.set(id, made);
+  return made;
+}
+
+const newerThan = (a: { savedAt: string }, b: { savedAt: string }): boolean => Date.parse(a.savedAt) > Date.parse(b.savedAt);
+
+export function refreshed<T extends { savedAt: string }>(state: TokenState<T>, id: string, tokens: T, source: TokenSource<T>): Promise<T> {
+  const slot = slotFor(state, id);
+  const latest = slot.latest;
+  if (latest !== null && newerThan(latest, tokens) && !source.stale(latest)) return Promise.resolve(latest);
+  if (slot.refreshing !== null) return slot.refreshing;
+  const run = source
+    .refresh(tokens)
+    .then((fresh) => {
+      source.save(id, fresh);
+      slot.latest = fresh;
+      return fresh;
+    })
+    .catch((err: unknown) => {
+      throw new GatewayError(403, 'permission_error', `${source.label} sign-in expired (${errMsg(err)}): connect again on the Model page`);
+    })
+    .finally(() => {
+      slot.refreshing = null;
+    });
+  slot.refreshing = run;
+  return run;
+}
+
+export function currentOf<T extends { savedAt: string }>(state: TokenState<T>, id: string, tokens: T | null, source: TokenSource<T>, missing: string): Promise<T> {
+  if (tokens === null) throw new GatewayError(400, 'invalid_request_error', missing);
+  return source.stale(tokens) ? refreshed(state, id, tokens, source) : Promise.resolve(tokens);
+}
+
+export async function reach<T>(current: () => Promise<T>, again: (tokens: T) => Promise<T>, send: (tokens: T) => Promise<Response>): Promise<Response> {
+  const tokens = await current();
+  const upstream = await send(tokens);
+  if (upstream.status !== 401) return upstream;
+  await upstream.body?.cancel();
+  return send(await again(tokens));
+}
+
+export function errorKind(status: number, invalid: readonly number[] = [400, 404]): string {
+  if (status === 401 || status === 403) return 'permission_error';
+  if (status === 429) return 'rate_limit_error';
+  if (invalid.includes(status)) return 'invalid_request_error';
+  return 'api_error';
+}
+
+export function sessionHeader(req: IncomingMessage): string {
+  const raw = req.headers['x-claude-code-session-id'];
+  return (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
+}
+
+interface Translator {
+  readonly finished: boolean;
+  close: (message?: string) => string;
+}
+
+export function relayTranslated(
+  upstream: Response,
+  res: ServerResponse,
+  watch: Watch,
+  key: string,
+  translator: Translator,
+  onEvent: (raw: SseEvent) => string,
+): Promise<void> {
+  const parser = new SseParser();
+  const decoder = new TextDecoder();
+  return relayFrames(upstream, res, watch, key, {
+    push: (chunk, emit) => {
+      for (const raw of parser.push(decoder.decode(chunk, { stream: true }))) emit(onEvent(raw));
+    },
+    close: () => translator.close(),
+    idle: (message) => (translator.finished ? '' : translator.close(message)),
+  });
+}
+
+export function answerWhole(res: ServerResponse, frames: string, key: string): void {
+  const scanner = new UsageScanner(key);
+  scanner.feed(frames);
+  scanner.done();
+  const message = assembleMessage(frames);
+  const kind = isRecord(message.error) ? String(message.error.type) : '';
+  res.writeHead(message.type === 'error' ? (STATUS_OF[kind] ?? 502) : 200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(message));
+}
+
+export const estimateTokens = (body: Record<string, unknown>): number => Math.ceil(JSON.stringify(body).length / 4);
+
+export function countTokens(res: ServerResponse, body: Record<string, unknown>): void {
+  res.writeHead(200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify({ input_tokens: estimateTokens(body) }));
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/text.ts

@@ -0,0 +1,14 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { stringOf } from '@metro-labs/http/api-http';
+
+const IMAGE_NOTE = '[an image was attached here; this model cannot see it]';
+
+export const nonEmpty = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+const partText = (part: Record<string, unknown>): string => (part.type === 'text' ? stringOf(part.text) : part.type === 'image' ? IMAGE_NOTE : '');
+
+export function resultText(block: Record<string, unknown>): string {
+  const content = block.content;
+  const text = typeof content === 'string' ? content : Array.isArray(content) ? content.filter(isRecord).map(partText).filter((t) => t !== '').join('\n') : '';
+  return block.is_error === true ? `[tool error] ${text}` : text;
+}