@stage-labs/metro 0.1.0-beta.26 → 0.1.0-beta.261

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter-login.ts

@@ -0,0 +1,192 @@
+import { createHash } from 'node:crypto';
+import { pkcePair, newState } from '@metro-labs/core/stations/oauth';
+import { ticketStore } from '@metro-labs/core/tickets';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { addConnection, connectionOf, updateConnection } from './model-config.js';
+import { asApiError, type Store } from './model-store.js';
+import { forgetReported } from './usage.js';
+
+export const OPENROUTER_CALLBACK = '/api/model/openrouter/callback';
+const TTL = 10 * 60_000;
+const MAX_ATTEMPTS = 100;
+const STALE = 'This OpenRouter sign-in expired or was cancelled. Start again.';
+const FAILED = 'OpenRouter sign-in did not finish. Try again or use an API key. Manage any unused key in OpenRouter.';
+
+type Result = { status: 'pending' } | { status: 'done'; connection: string } | { status: 'failed'; error: string };
+
+interface Attempt {
+  owner: string;
+  connection: string;
+  keyHash: string;
+  expiresAt: number;
+  state: string;
+  verifier: string;
+  result: Result;
+  abort: AbortController;
+}
+
+interface LoginDeps {
+  store: Store;
+  owner: () => string | null;
+  publicBase: () => string | null;
+  fetchImpl?: typeof fetch;
+  now?: () => number;
+}
+
+const hash = (value: string): string => createHash('sha256').update(value).digest('hex');
+
+function callbackUrl(base: string | null): string {
+  let url: URL;
+  try {
+    url = new URL(base ?? '');
+  } catch {
+    throw new ApiError('This box needs a public HTTPS address for OpenRouter sign-in. Use an API key instead.', 409);
+  }
+  if (url.protocol !== 'https:' || url.username !== '' || url.password !== '' || url.pathname !== '/' || url.search !== '' || url.hash !== '')
+    throw new ApiError('This box needs a public HTTPS origin for OpenRouter sign-in. Use an API key instead.', 409);
+  return `${url.origin}${OPENROUTER_CALLBACK}`;
+}
+
+async function exchange(code: string, verifier: string, signal: AbortSignal, fetchImpl: typeof fetch): Promise<string> {
+  const res = await fetchImpl('https://openrouter.ai/api/v1/auth/keys', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', accept: 'application/json' },
+    body: JSON.stringify({ code, code_verifier: verifier, code_challenge_method: 'S256' }),
+    redirect: 'manual',
+    signal: AbortSignal.any([signal, AbortSignal.timeout(15_000)]),
+  });
+  if (!res.ok) {
+    await res.body?.cancel();
+    throw new ApiError(FAILED, 502);
+  }
+  const body: unknown = await res.json();
+  if (!isRecord(body) || typeof body.key !== 'string' || body.key.trim() === '' || body.key.length > 512)
+    throw new ApiError(FAILED, 502);
+  return body.key.trim();
+}
+
+function authorizationCode(params: URLSearchParams): string {
+  const code = params.get('code') ?? '';
+  if (params.has('error') || code === '' || code.length > 4096 || params.getAll('code').length !== 1 || params.getAll('state').length !== 1)
+    throw new ApiError('OpenRouter did not approve this sign-in. Try again or use an API key.', 400);
+  return code;
+}
+
+export class OpenRouterLogins {
+  private readonly states = ticketStore<Attempt>(TTL, MAX_ATTEMPTS);
+  private readonly attempts = new Map<string, Attempt>();
+
+  constructor(private readonly deps: LoginDeps) {}
+
+  private now(): number {
+    return (this.deps.now ?? Date.now)();
+  }
+
+  private discard(attempt: Attempt): void {
+    this.states.take(attempt.state, this.now());
+    attempt.verifier = '';
+    attempt.abort.abort();
+  }
+
+  private prune(): void {
+    for (const [id, attempt] of this.attempts) {
+      if (attempt.expiresAt > this.now()) continue;
+      this.discard(attempt);
+      this.attempts.delete(id);
+    }
+  }
+
+  private checkOwner(owner: string): void {
+    if (this.deps.owner() !== owner) throw new ApiError('This sign-in belongs to another organization.', 403);
+  }
+
+  private target(connection: string): string {
+    const cfg = this.deps.store.read();
+    if (connection === '') {
+      try {
+        addConnection(cfg, { provider: 'openrouter' });
+      } catch (err) {
+        asApiError(err);
+      }
+      return '';
+    }
+    const found = connectionOf(cfg, connection);
+    if (found?.provider !== 'openrouter') throw new ApiError('This OpenRouter connection no longer exists.', 404);
+    return hash(found.apiKey);
+  }
+
+  begin(owner: string, connection: string): { id: string; url: string; expiresAt: number } {
+    this.checkOwner(owner);
+    const callback = callbackUrl(this.deps.publicBase());
+    const keyHash = this.target(connection);
+    this.prune();
+    if (this.attempts.size >= MAX_ATTEMPTS) throw new ApiError('Too many OpenRouter sign-ins. Try again later.', 429);
+    const { verifier, challenge } = pkcePair();
+    const attempt: Attempt = { owner, connection, keyHash, verifier, state: '', expiresAt: this.now() + TTL, result: { status: 'pending' }, abort: new AbortController() };
+    attempt.state = this.states.mint(attempt, this.now()).ticket;
+    const id = newState();
+    this.attempts.set(id, attempt);
+    const url = new URL('https://openrouter.ai/auth');
+    url.search = new URLSearchParams({ callback_url: callback, code_challenge: challenge, code_challenge_method: 'S256', state: attempt.state, key_label: 'Metro' }).toString();
+    return { id, url: url.href, expiresAt: attempt.expiresAt };
+  }
+
+  private find(owner: string, id: string): Attempt {
+    this.checkOwner(owner);
+    this.prune();
+    const attempt = this.attempts.get(id);
+    if (attempt?.owner !== owner) throw new ApiError(STALE, 410);
+    return attempt;
+  }
+
+  status(owner: string, id: string): Result {
+    return this.find(owner, id).result;
+  }
+
+  cancel(owner: string, id: string): Result {
+    const attempt = this.find(owner, id);
+    if (attempt.result.status === 'pending') {
+      attempt.result = { status: 'failed', error: 'OpenRouter sign-in cancelled.' };
+      this.discard(attempt);
+    }
+    return attempt.result;
+  }
+
+  private checkPending(attempt: Attempt): void {
+    if (attempt.expiresAt <= this.now() || attempt.result.status !== 'pending') throw new ApiError(STALE, 410);
+    this.checkOwner(attempt.owner);
+    if (this.target(attempt.connection) !== attempt.keyHash)
+      throw new ApiError('This connection changed during sign-in. Start again.', 409);
+  }
+
+  private save(attempt: Attempt, key: string): void {
+    this.checkPending(attempt);
+    const current = this.deps.store.read();
+    const next = attempt.connection === '' ? addConnection(current, { provider: 'openrouter', apiKey: key }) : updateConnection(current, attempt.connection, { apiKey: key });
+    const id = attempt.connection === '' ? (next.connections.at(-1)?.id ?? '') : attempt.connection;
+    this.deps.store.write(next);
+    forgetReported(id);
+    attempt.result = { status: 'done', connection: id };
+    log.info({ connection: id }, 'model-api: OpenRouter connected');
+  }
+
+  async complete(params: URLSearchParams): Promise<void> {
+    const state = params.get('state') ?? '';
+    const attempt = this.states.take(state, this.now());
+    if (attempt === undefined) throw new ApiError(STALE, 410);
+    const verifier = attempt.verifier;
+    attempt.verifier = '';
+    try {
+      this.checkPending(attempt);
+      const key = await exchange(authorizationCode(params), verifier, attempt.abort.signal, this.deps.fetchImpl ?? fetch);
+      this.save(attempt, key);
+    } catch (err) {
+      if (attempt.result.status === 'pending') attempt.result = { status: 'failed', error: err instanceof ApiError ? err.message : FAILED };
+      throw new ApiError(attempt.result.status === 'failed' ? attempt.result.error : FAILED, 400);
+    } finally {
+      this.discard(attempt);
+    }
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter-signin.ts

@@ -0,0 +1,64 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { sendJson, sessionRoute } from '@metro-labs/http/api-http';
+import { log } from '@metro-labs/core/log';
+import { publicBaseUrl } from '../files/attach-serve.js';
+import { askedConnection, type ModelApiDeps, type Store } from './model-store.js';
+import { OPENROUTER_CALLBACK, OpenRouterLogins } from './openrouter-login.js';
+
+const LOGIN = '/api/model/openrouter/login';
+const ID_RE = /^[A-Za-z0-9_-]{32}$/;
+const logins = new WeakMap<ModelApiDeps, OpenRouterLogins>();
+const CALLBACK_HEADERS = {
+  'cache-control': 'no-store',
+  'referrer-policy': 'no-referrer',
+  'content-security-policy': "default-src 'none'; frame-ancestors 'none'; base-uri 'none'",
+  'x-content-type-options': 'nosniff',
+};
+
+function loginFor(deps: ModelApiDeps, store: Store): OpenRouterLogins {
+  let login = logins.get(deps);
+  if (login === undefined) {
+    login = new OpenRouterLogins({
+      store,
+      owner: () => deps.owner?.() ?? null,
+      publicBase: deps.openrouterPublicBase ?? publicBaseUrl,
+      fetchImpl: deps.fetchImpl,
+      now: deps.openrouterNow,
+    });
+    logins.set(deps, login);
+  }
+  return login;
+}
+
+function callback(req: IncomingMessage, res: ServerResponse, login: OpenRouterLogins): void {
+  if (req.method !== 'GET') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return;
+  }
+  const url = new URL(req.url ?? '', 'https://metro');
+  if (url.search === '') {
+    res.writeHead(200, { ...CALLBACK_HEADERS, 'content-type': 'text/html; charset=utf-8' });
+    res.end('<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>OpenRouter sign-in</title><h1>Return to Metro</h1><p>Check your connection in Metro. You can close this tab.</p><p>If you declined access, cancel the sign-in in Metro or use an API key.</p></html>');
+    return;
+  }
+  const finish = (): void => { res.writeHead(303, { ...CALLBACK_HEADERS, location: OPENROUTER_CALLBACK }).end(); };
+  login.complete(url.searchParams).then(finish, finish).catch(() => {
+    log.warn('openrouter-signin: callback response closed');
+    if (!res.writableEnded) res.end();
+  });
+}
+
+export function handleOpenRouterSignIn(req: IncomingMessage, res: ServerResponse, deps: ModelApiDeps, store: Store): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path === OPENROUTER_CALLBACK) {
+    callback(req, res, loginFor(deps, store));
+    return true;
+  }
+  const id = path.startsWith(`${LOGIN}/`) ? path.slice(LOGIN.length + 1) : '';
+  if (path !== LOGIN && !ID_RE.test(id)) return false;
+  return sessionRoute(req, res, { methods: { [path]: path === LOGIN ? ['POST'] : ['GET', 'DELETE'] }, admin: false, label: 'openrouter-signin' }, (session) => {
+    const login = loginFor(deps, store);
+    if (path === LOGIN) return Promise.resolve(login.begin(session.subject, askedConnection(req)));
+    return Promise.resolve(req.method === 'DELETE' ? login.cancel(session.subject, id) : login.status(session.subject, id));
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter.ts

@@ -0,0 +1,104 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { GatewayError } from './forward.js';
+import { listCache } from './model-lists.js';
+import { stringOf } from '@metro-labs/http/api-http';
+import type { KeySpend } from './usage.js';
+
+export const OPENROUTER_BASE = 'https://openrouter.ai/api';
+const MODELS_MAX = 2000;
+const KEY_TIMEOUT_MS = 10_000;
+
+export interface OpenRouterModel {
+  id: string;
+  name: string;
+  prompt: number | null;
+  completion: number | null;
+  created: number | null;
+}
+
+const modelLists = listCache<OpenRouterModel>('openrouter');
+const zdrLists = listCache<string>('openrouter-zdr');
+
+function price(raw: unknown): number | null {
+  const value = typeof raw === 'string' ? Number(raw) : typeof raw === 'number' ? raw : Number.NaN;
+  return Number.isFinite(value) && value >= 0 ? value : null;
+}
+
+function released(raw: unknown): number | null {
+  return typeof raw === 'number' && Number.isFinite(raw) && raw > 0 ? raw : null;
+}
+
+const strings = (value: unknown): string[] | null => (Array.isArray(value) ? value.filter((v): v is string => typeof v === 'string') : null);
+
+function chatCapable(entry: Record<string, unknown>): boolean {
+  const output = strings(isRecord(entry.architecture) ? entry.architecture.output_modalities : undefined);
+  const params = strings(entry.supported_parameters);
+  return (output === null || output.includes('text')) && (params === null || params.includes('tools'));
+}
+
+function modelOf(entry: unknown): OpenRouterModel | null {
+  if (!isRecord(entry) || !chatCapable(entry)) return null;
+  const id = stringOf(entry.id);
+  if (id === '') return null;
+  const pricing = isRecord(entry.pricing) ? entry.pricing : {};
+  return {
+    id,
+    name: stringOf(entry.name) || id,
+    prompt: price(pricing.prompt),
+    completion: price(pricing.completion),
+    created: released(entry.created),
+  };
+}
+
+function newestFirst(a: OpenRouterModel, b: OpenRouterModel): number {
+  const when = (b.created ?? 0) - (a.created ?? 0);
+  return when !== 0 ? when : a.id.localeCompare(b.id);
+}
+
+async function listModels(base: string, fetchImpl: typeof fetch): Promise<OpenRouterModel[]> {
+  const res = await fetchImpl(`${base}/v1/models`, { headers: { accept: 'application/json' }, redirect: 'manual' });
+  if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not list its models (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const data = typeof body === 'object' && body !== null ? (body as { data?: unknown }).data : undefined;
+  if (!Array.isArray(data)) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no model list');
+  return data
+    .map(modelOf)
+    .filter((model): model is OpenRouterModel => model !== null)
+    .sort(newestFirst)
+    .slice(0, MODELS_MAX);
+}
+
+export const openrouterModels = (base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<OpenRouterModel[]> =>
+  modelLists.get(base, () => listModels(base, fetchImpl));
+
+const nullableAmount = (raw: unknown): number | null => (typeof raw === 'number' && Number.isFinite(raw) ? raw : null);
+
+export async function openrouterKey(apiKey: string, base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<KeySpend> {
+  const res = await fetchImpl(`${base}/v1/key`, {
+    headers: { accept: 'application/json', authorization: `Bearer ${apiKey}` },
+    redirect: 'manual',
+    signal: AbortSignal.timeout(KEY_TIMEOUT_MS),
+  });
+  if (!res.ok) {
+    await res.body?.cancel();
+    throw new GatewayError(res.status, 'api_error', `OpenRouter would not describe the stored key (${String(res.status)})`);
+  }
+  const body: unknown = await res.json();
+  const data = isRecord(body) && isRecord(body.data) ? body.data : {};
+  const spent = nullableAmount(data.usage);
+  if (spent === null) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no spend for the key');
+  return { limit: nullableAmount(data.limit), remaining: nullableAmount(data.limit_remaining), spent };
+}
+
+async function listZdr(base: string, fetchImpl: typeof fetch): Promise<string[]> {
+  const res = await fetchImpl(`${base}/v1/endpoints/zdr`, { headers: { accept: 'application/json' }, redirect: 'manual' });
+  if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not list its zero data retention endpoints (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const data = typeof body === 'object' && body !== null ? (body as { data?: unknown }).data : undefined;
+  if (!Array.isArray(data)) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no endpoint list');
+  const ids = new Set<string>();
+  for (const entry of data) if (isRecord(entry) && stringOf(entry.model_id) !== '') ids.add(stringOf(entry.model_id));
+  return [...ids].sort();
+}
+
+export const openrouterZdrModels = (base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<string[]> => zdrLists.get(base, () => listZdr(base, fetchImpl));

package/runtime/node_modules/@metro-labs/daemon/src/gateway/pkce.ts

@@ -0,0 +1,36 @@
+import { createHash, randomBytes } from 'node:crypto';
+
+const PENDING_TTL_MS = 10 * 60_000;
+
+const b64url = (buf: Buffer): string => buf.toString('base64url');
+
+export function newPkce(): { verifier: string; challenge: string } {
+  const verifier = b64url(randomBytes(32));
+  return { verifier, challenge: b64url(createHash('sha256').update(verifier).digest()) };
+}
+
+export class PendingLogins {
+  private readonly pending = new Map<string, { verifier: string; at: number }>();
+
+  constructor(private readonly stateBytes: number) {}
+
+  private sweep(now: number): void {
+    for (const [state, entry] of this.pending) if (now - entry.at > PENDING_TTL_MS) this.pending.delete(state);
+  }
+
+  begin(now: number): { state: string; challenge: string } {
+    this.sweep(now);
+    const { verifier, challenge } = newPkce();
+    const state = b64url(randomBytes(this.stateBytes));
+    this.pending.set(state, { verifier, at: now });
+    return { state, challenge };
+  }
+
+  take(state: string, now: number): string | null {
+    this.sweep(now);
+    const entry = this.pending.get(state);
+    if (entry === undefined) return null;
+    this.pending.delete(state);
+    return entry.verifier;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/provider-models.ts

@@ -0,0 +1,117 @@
+import type { IncomingHttpHeaders } from 'node:http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { GatewayError, OAUTH_BETA } from './forward.js';
+import type { Connection } from './model-config.js';
+import { fingerprint, listCache } from './model-lists.js';
+import { stringOf } from '@metro-labs/http/api-http';
+
+export const ANTHROPIC_API = 'https://api.anthropic.com';
+const ANTHROPIC_VERSION = '2023-06-01';
+const LIST_MAX = 1000;
+const LIST_TIMEOUT_MS = 10_000;
+const BEARER = 'Bearer ';
+
+export interface ProviderModel {
+  id: string;
+  name: string;
+}
+
+interface Dated extends ProviderModel {
+  created: string;
+}
+
+const KNOWN_CLAUDE: ProviderModel[] = [
+  { id: 'claude-sonnet-5-5', name: 'Claude Sonnet 5.5' },
+  { id: 'claude-opus-5-5', name: 'Claude Opus 5.5' },
+  { id: 'claude-fable-5-1', name: 'Claude Fable 5.1' },
+  { id: 'claude-opus-5', name: 'Claude Opus 5' },
+  { id: 'claude-sonnet-5', name: 'Claude Sonnet 5' },
+  { id: 'claude-haiku-4-5', name: 'Claude Haiku 4.5' },
+];
+
+const claudeLists = listCache<ProviderModel>('anthropic');
+const bedrockLists = listCache<ProviderModel>('bedrock');
+
+const newestFirst = (list: Dated[]): ProviderModel[] =>
+  list.sort((a, b) => b.created.localeCompare(a.created) || a.id.localeCompare(b.id)).map(({ id, name }) => ({ id, name }));
+
+function claudeEntry(entry: unknown): Dated[] {
+  if (!isRecord(entry) || stringOf(entry.id) === '') return [];
+  const type = stringOf(entry.type);
+  if (type !== '' && type !== 'model') return [];
+  const id = stringOf(entry.id);
+  return [{ id, name: stringOf(entry.display_name) || id, created: stringOf(entry.created_at) }];
+}
+
+async function listClaude(auth: Record<string, string>, what: string, base: string, fetchImpl: typeof fetch): Promise<ProviderModel[]> {
+  const res = await fetchImpl(`${base}/v1/models?limit=${String(LIST_MAX)}`, {
+    headers: { ...auth, 'anthropic-version': ANTHROPIC_VERSION, accept: 'application/json' },
+    redirect: 'manual',
+    signal: AbortSignal.timeout(LIST_TIMEOUT_MS),
+  });
+  if (!res.ok) throw new GatewayError(res.status, 'api_error', `Anthropic would not list its models with ${what} (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const data = isRecord(body) && Array.isArray(body.data) ? body.data : null;
+  if (data === null) throw new GatewayError(502, 'api_error', 'Anthropic answered with no model list');
+  return newestFirst(data.flatMap(claudeEntry));
+}
+
+const loginKey = (base: string): string => `login:${base}`;
+
+const first = (value: string | string[] | undefined): string => (Array.isArray(value) ? value[0] : value)?.trim() ?? '';
+
+function loginAuth(headers: IncomingHttpHeaders): Record<string, string> | null {
+  const bearer = first(headers.authorization);
+  if (bearer.startsWith(BEARER) && bearer.length > BEARER.length) return { authorization: bearer, 'anthropic-beta': OAUTH_BETA };
+  const key = first(headers['x-api-key']);
+  return key === '' ? null : { 'x-api-key': key };
+}
+
+export function refreshLoginModels(headers: IncomingHttpHeaders, base = ANTHROPIC_API, fetchImpl: typeof fetch = fetch): Promise<void> {
+  const auth = loginAuth(headers);
+  if (auth === null) return Promise.resolve();
+  return claudeLists.refresh(loginKey(base), () => listClaude(auth, 'the Claude Code login', base, fetchImpl));
+}
+
+export async function anthropicModels(settings: Connection, base = ANTHROPIC_API, fetchImpl: typeof fetch = fetch): Promise<ProviderModel[]> {
+  if (settings.apiKey === '') {
+    const live = claudeLists.peek(loginKey(base)) ?? [];
+    return live.length > 0 ? live : KNOWN_CLAUDE;
+  }
+  return claudeLists.get(`key:${base}:${fingerprint(settings.apiKey)}`, () => listClaude({ 'x-api-key': settings.apiKey }, 'the stored key', base, fetchImpl));
+}
+
+export const bedrockControlBase = (region: string): string => `https://bedrock.${region}.amazonaws.com`;
+
+function bedrockEntry(entry: unknown): Dated[] {
+  if (!isRecord(entry)) return [];
+  const id = stringOf(entry.inferenceProfileId);
+  const status = stringOf(entry.status);
+  if (id === '' || !id.includes('anthropic') || (status !== '' && status !== 'ACTIVE')) return [];
+  return [{ id, name: stringOf(entry.inferenceProfileName) || id, created: stringOf(entry.createdAt) }];
+}
+
+async function listBedrock(settings: Connection, base: string, fetchImpl: typeof fetch): Promise<ProviderModel[]> {
+  const res = await fetchImpl(`${base}/inference-profiles?maxResults=${String(LIST_MAX)}`, {
+    headers: { authorization: `Bearer ${settings.apiKey}`, accept: 'application/json' },
+    redirect: 'manual',
+    signal: AbortSignal.timeout(LIST_TIMEOUT_MS),
+  });
+  if (!res.ok)
+    throw new GatewayError(
+      res.status,
+      'api_error',
+      `Bedrock would not list its inference profiles (${String(res.status)}); the stored key may cover the runtime only, so type the model id instead`,
+    );
+  const body: unknown = await res.json();
+  const list = isRecord(body) && Array.isArray(body.inferenceProfileSummaries) ? body.inferenceProfileSummaries : null;
+  if (list === null) throw new GatewayError(502, 'api_error', 'Bedrock answered with no inference profile list');
+  return newestFirst(list.flatMap(bedrockEntry));
+}
+
+export async function bedrockModels(settings: Connection, base?: string, fetchImpl: typeof fetch = fetch): Promise<ProviderModel[]> {
+  if (settings.region === '') throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs a region before its models can be listed');
+  if (settings.apiKey === '') throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs an API key before its models can be listed');
+  const from = base ?? bedrockControlBase(settings.region);
+  return bedrockLists.get(`${from}:${fingerprint(settings.apiKey)}`, () => listBedrock(settings, from, fetchImpl));
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/served.ts

@@ -0,0 +1,18 @@
+export interface Served {
+  connection: string;
+  provider: string;
+  model: string;
+  at: string;
+}
+
+let last: Served | null = null;
+
+export const noteServed = (served: Served): void => {
+  last = served;
+};
+
+export const lastServed = (): Served | null => last;
+
+export const forgetServed = (): void => {
+  last = null;
+};

package/runtime/node_modules/@metro-labs/daemon/src/gateway/subscription.ts

@@ -0,0 +1,120 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg } from '@metro-labs/core/log';
+import { assembleMessage, SseParser, type SseEvent } from './frames.js';
+import { GatewayError, relayFrames, type Watch } from './forward.js';
+import { UsageScanner } from './usage.js';
+
+const STATUS_OF: Record<string, number> = { rate_limit_error: 429, invalid_request_error: 400, permission_error: 403, overloaded_error: 529 };
+
+interface Slot<T> {
+  refreshing: Promise<T> | null;
+  latest: T | null;
+}
+
+export type TokenState<T> = Map<string, Slot<T>>;
+
+export interface TokenSource<T extends { savedAt: string }> {
+  label: string;
+  stale: (tokens: T) => boolean;
+  refresh: (tokens: T) => Promise<T>;
+  save: (id: string, tokens: T) => void;
+}
+
+function slotFor<T>(state: TokenState<T>, id: string): Slot<T> {
+  const found = state.get(id);
+  if (found !== undefined) return found;
+  const made: Slot<T> = { refreshing: null, latest: null };
+  state.set(id, made);
+  return made;
+}
+
+const newerThan = (a: { savedAt: string }, b: { savedAt: string }): boolean => Date.parse(a.savedAt) > Date.parse(b.savedAt);
+
+export function refreshed<T extends { savedAt: string }>(state: TokenState<T>, id: string, tokens: T, source: TokenSource<T>): Promise<T> {
+  const slot = slotFor(state, id);
+  const latest = slot.latest;
+  if (latest !== null && newerThan(latest, tokens) && !source.stale(latest)) return Promise.resolve(latest);
+  if (slot.refreshing !== null) return slot.refreshing;
+  const run = source
+    .refresh(tokens)
+    .then((fresh) => {
+      source.save(id, fresh);
+      slot.latest = fresh;
+      return fresh;
+    })
+    .catch((err: unknown) => {
+      throw new GatewayError(403, 'permission_error', `${source.label} sign-in expired (${errMsg(err)}): connect again on the Model page`);
+    })
+    .finally(() => {
+      slot.refreshing = null;
+    });
+  slot.refreshing = run;
+  return run;
+}
+
+export function currentOf<T extends { savedAt: string }>(state: TokenState<T>, id: string, tokens: T | null, source: TokenSource<T>, missing: string): Promise<T> {
+  if (tokens === null) throw new GatewayError(400, 'invalid_request_error', missing);
+  return source.stale(tokens) ? refreshed(state, id, tokens, source) : Promise.resolve(tokens);
+}
+
+export async function reach<T>(current: () => Promise<T>, again: (tokens: T) => Promise<T>, send: (tokens: T) => Promise<Response>): Promise<Response> {
+  const tokens = await current();
+  const upstream = await send(tokens);
+  if (upstream.status !== 401) return upstream;
+  await upstream.body?.cancel();
+  return send(await again(tokens));
+}
+
+export function errorKind(status: number, invalid: readonly number[] = [400, 404]): string {
+  if (status === 401 || status === 403) return 'permission_error';
+  if (status === 429) return 'rate_limit_error';
+  if (invalid.includes(status)) return 'invalid_request_error';
+  return 'api_error';
+}
+
+export function sessionHeader(req: IncomingMessage): string {
+  const raw = req.headers['x-claude-code-session-id'];
+  return (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
+}
+
+interface Translator {
+  readonly finished: boolean;
+  close: (message?: string) => string;
+}
+
+export function relayTranslated(
+  upstream: Response,
+  res: ServerResponse,
+  watch: Watch,
+  key: string,
+  translator: Translator,
+  onEvent: (raw: SseEvent) => string,
+): Promise<void> {
+  const parser = new SseParser();
+  const decoder = new TextDecoder();
+  return relayFrames(upstream, res, watch, key, {
+    push: (chunk, emit) => {
+      for (const raw of parser.push(decoder.decode(chunk, { stream: true }))) emit(onEvent(raw));
+    },
+    close: () => translator.close(),
+    idle: (message) => (translator.finished ? '' : translator.close(message)),
+  });
+}
+
+export function answerWhole(res: ServerResponse, frames: string, key: string): void {
+  const scanner = new UsageScanner(key);
+  scanner.feed(frames);
+  scanner.done();
+  const message = assembleMessage(frames);
+  const kind = isRecord(message.error) ? String(message.error.type) : '';
+  res.writeHead(message.type === 'error' ? (STATUS_OF[kind] ?? 502) : 200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(message));
+}
+
+export const estimateTokens = (body: Record<string, unknown>): number => Math.ceil(JSON.stringify(body).length / 4);
+
+export function countTokens(res: ServerResponse, body: Record<string, unknown>): void {
+  res.writeHead(200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify({ input_tokens: estimateTokens(body) }));
+}