@stage-labs/metro 0.1.0-beta.27 → 0.1.0-beta.271

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -0,0 +1,362 @@
+import { join } from 'node:path';
+import { ID_RE, newId } from '@metro-labs/core/ids';
+import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { agentsDir } from '../agents/files.js';
+import { isRecord } from '@metro-labs/core/is-record';
+import { CODEX_SIGN_IN, NEW_CLIENT, type CodexCredential, type CodexMethod, type CodexTokens } from './codex-auth.js';
+import { tokensFromDisk as geminiTokensFromDisk, type GeminiTokens } from './gemini-auth.js';
+
+export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex', 'gemini'] as const;
+export type Provider = (typeof PROVIDERS)[number];
+
+export interface ClaudeLogin {
+  id: string;
+  email: string | null;
+  plan: string | null;
+  savedAt: string;
+}
+
+export interface Connection {
+  id: string;
+  provider: Provider;
+  label: string;
+  model: string;
+  apiKey: string;
+  region: string;
+  zdr: boolean;
+  codex: CodexTokens | null;
+  gemini: GeminiTokens | null;
+  claude: ClaudeLogin | null;
+}
+
+export interface Fallback {
+  connection: string;
+  model: string;
+}
+
+export interface ModelConfig {
+  version: 2;
+  route: string;
+  connections: Connection[];
+  fallbacks?: Fallback[];
+}
+
+export interface Route {
+  connection: Connection;
+  model: string;
+}
+
+export class ModelConfigError extends Error {}
+
+const MODEL_FILE = 'model.json';
+const MAX_FIELD = 512;
+const MAX_LABEL = 60;
+const MAX_CONNECTIONS = 20;
+const MAX_FALLBACKS = 8;
+const PREFIX_RE = /^(anthropic|bedrock|openrouter|codex|gemini):(.+)$/;
+const SMALL_RE = /haiku/i;
+
+const LABELS: Record<Provider, string> = {
+  anthropic: 'Anthropic',
+  bedrock: 'Amazon Bedrock',
+  openrouter: 'OpenRouter',
+  codex: 'Codex (ChatGPT)',
+  gemini: 'Gemini (Google)',
+};
+
+const isProvider = (value: unknown): value is Provider => typeof value === 'string' && (PROVIDERS as readonly string[]).includes(value);
+
+const text = (value: unknown): string => (typeof value === 'string' ? value.trim() : '');
+const maybe = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+export const empty = (): ModelConfig => ({ version: 2, route: '', connections: [] });
+
+const newConnection = (provider: Provider, label: string): Connection => ({
+  id: newId(),
+  provider,
+  label,
+  model: '',
+  apiKey: '',
+  region: '',
+  zdr: false,
+  codex: null,
+  gemini: null,
+  claude: null,
+});
+
+function claudeFromDisk(raw: unknown): ClaudeLogin | null {
+  if (!isRecord(raw) || !ID_RE.test(text(raw.id))) return null;
+  return { id: text(raw.id), email: maybe(raw.email), plan: maybe(raw.plan), savedAt: text(raw.savedAt) };
+}
+
+function credentialFromDisk(raw: Record<string, unknown>): CodexCredential | null {
+  const accessToken = text(raw.accessToken);
+  const refreshToken = text(raw.refreshToken);
+  if (accessToken === '' || refreshToken === '') return null;
+  return {
+    email: maybe(raw.email),
+    accessToken,
+    refreshToken,
+    expiresAt: typeof raw.expiresAt === 'number' && Number.isFinite(raw.expiresAt) ? raw.expiresAt : 0,
+    savedAt: text(raw.savedAt) === '' ? new Date(0).toISOString() : text(raw.savedAt),
+  };
+}
+
+function codexFromDisk(raw: unknown): CodexTokens | null {
+  if (!isRecord(raw)) return null;
+  const held = credentialFromDisk(raw);
+  if (held === null) return null;
+  const accountId = text(raw.accountId);
+  if (accountId !== '') return { method: 'code', accountId, plan: maybe(raw.plan), ...held };
+  const clientId = text(raw.clientId);
+  return clientId === '' || clientId === NEW_CLIENT ? null : { method: 'chatgpt', clientId, subject: text(raw.subject), ...held };
+}
+
+function connectionFromDisk(raw: unknown): Connection | null {
+  if (!isRecord(raw) || !isProvider(raw.provider)) return null;
+  const id = text(raw.id);
+  const provider = raw.provider;
+  return {
+    id: id === '' ? newId() : id,
+    provider,
+    label: text(raw.label) === '' ? LABELS[provider] : text(raw.label).slice(0, MAX_LABEL),
+    model: text(raw.model),
+    apiKey: text(raw.apiKey),
+    region: text(raw.region),
+    zdr: raw.zdr === true,
+    codex: codexFromDisk(raw.codex),
+    gemini: geminiTokensFromDisk(raw.gemini),
+    claude: provider === 'anthropic' ? claudeFromDisk(raw.claude) : null,
+  };
+}
+
+function fallbacksOf(raw: unknown, connections: Connection[]): Fallback[] {
+  if (!Array.isArray(raw)) return [];
+  const known = raw.flatMap((f: unknown) => {
+    if (!isRecord(f)) return [];
+    const entry = { connection: text(f.connection), model: text(f.model).slice(0, MAX_FIELD) };
+    return entry.model !== '' && connections.some((c) => c.id === entry.connection) ? [entry] : [];
+  });
+  return known.filter((f, at) => known.findIndex((o) => o.connection === f.connection && o.model === f.model) === at).slice(0, MAX_FALLBACKS);
+}
+
+const withFallbacks = (cfg: ModelConfig, fallbacks: Fallback[]): ModelConfig => ({
+  version: 2,
+  route: cfg.route,
+  connections: cfg.connections,
+  ...(fallbacks.length === 0 ? {} : { fallbacks }),
+});
+
+export function parseModelConfig(raw: unknown): ModelConfig {
+  if (!isRecord(raw) || !Array.isArray(raw.connections)) return empty();
+  const connections = raw.connections.flatMap((c: unknown) => connectionFromDisk(c) ?? []).slice(0, MAX_CONNECTIONS);
+  const route = text(raw.route);
+  const cfg: ModelConfig = { version: 2, route: connections.some((c) => c.id === route) ? route : (connections[0]?.id ?? ''), connections };
+  return withFallbacks(cfg, fallbacksOf(raw.fallbacks, connections));
+}
+
+const needsIds = (raw: unknown): boolean =>
+  isRecord(raw) && Array.isArray(raw.connections) && raw.connections.some((c: unknown) => isRecord(c) && text(c.id) === '');
+
+const readStoredModel = (dir: string): unknown =>
+  readJson<unknown>(join(dir, MODEL_FILE), null, { warn: 'model-config: model.json is unreadable, so every request goes to Anthropic until it is fixed' });
+
+export function readModelConfig(dir = agentsDir()): ModelConfig {
+  const raw = readStoredModel(dir);
+  const cfg = parseModelConfig(raw);
+  if (needsIds(raw)) writeModelConfig(cfg, dir);
+  return cfg;
+}
+
+export function readModelSnapshot(dir = agentsDir()): ModelConfig {
+  const raw = readStoredModel(dir);
+  if (needsIds(raw)) throw new ModelConfigError('model snapshot is unavailable until every connection has a saved id');
+  return parseModelConfig(raw);
+}
+
+export function writeModelConfig(cfg: ModelConfig, dir = agentsDir()): void {
+  writeSecure(join(dir, MODEL_FILE), JSON.stringify(cfg, null, 2));
+}
+
+export const connectionOf = (cfg: ModelConfig, id: string): Connection | null => cfg.connections.find((c) => c.id === id) ?? null;
+
+export const routedConnection = (cfg: ModelConfig): Connection | null => connectionOf(cfg, cfg.route);
+
+function requireConnection(cfg: ModelConfig, id: string): Connection {
+  const found = connectionOf(cfg, id);
+  if (found === null) throw new ModelConfigError('no such connection');
+  return found;
+}
+
+const PASSTHROUGH = 'Nothing is connected: the request carries the Claude Code login of the session that sent it.';
+
+const CHECKS: Record<Provider, [(c: Connection) => boolean, string][]> = {
+  anthropic: [],
+  bedrock: [
+    [(c) => c.apiKey === '', 'Bedrock needs an API key: add it on the Model page.'],
+    [(c) => c.region === '', 'Bedrock needs a region: add it on the Model page.'],
+  ],
+  openrouter: [
+    [(c) => c.apiKey === '', 'OpenRouter needs an API key: add it on the Model page.'],
+    [(c) => c.model === '', 'OpenRouter needs a model id: choose one on the Model page.'],
+  ],
+  codex: [
+    [(c) => c.codex === null, CODEX_SIGN_IN],
+    [(c) => c.model === '', 'Codex needs a model id: choose one on the Model page.'],
+  ],
+  gemini: [
+    [(c) => c.gemini === null, 'Gemini is not connected: sign in with Google on the Model page.'],
+    [(c) => c.model === '', 'Gemini needs a model id: choose one on the Model page.'],
+  ],
+};
+
+export function notReady(cfg: ModelConfig, conn = routedConnection(cfg)): string | null {
+  if (conn === null) return cfg.connections.length === 0 ? null : PASSTHROUGH;
+  return CHECKS[conn.provider].find(([missing]) => missing(conn))?.[1] ?? null;
+}
+
+export const isSmallModel = (requested: string): boolean => SMALL_RE.test(requested);
+
+const DEFAULTS: Record<Provider, (requested: string, c: Connection) => string> = {
+  openrouter: (requested, c) => (requested.includes('/') ? requested : c.model),
+  bedrock: (requested, c) => (c.model === '' ? requested : c.model),
+  codex: (requested, c) => (requested.startsWith('gpt-') ? requested : c.model),
+  gemini: (requested, c) => (requested.startsWith('gemini-') ? requested : c.model),
+  anthropic: (requested, c) => (c.model === '' || isSmallModel(requested) ? requested : c.model),
+};
+
+function forProvider(cfg: ModelConfig, provider: Provider): Connection | null {
+  const routed = routedConnection(cfg);
+  if (routed?.provider === provider) return routed;
+  return cfg.connections.find((c) => c.provider === provider) ?? null;
+}
+
+export const bareModel = (requested: string): string => PREFIX_RE.exec(requested)?.[2]?.trim() ?? requested;
+
+export function resolveRoute(requested: string, cfg: ModelConfig): Route | null {
+  const explicit = PREFIX_RE.exec(requested);
+  if (explicit !== null && isProvider(explicit[1])) {
+    const conn = forProvider(cfg, explicit[1]);
+    return conn === null ? null : { connection: conn, model: (explicit[2] ?? '').trim() };
+  }
+  const routed = routedConnection(cfg);
+  return routed === null ? null : { connection: routed, model: DEFAULTS[routed.provider](requested, routed) };
+}
+
+export const routeLabel = (route: Route): string =>
+  route.connection.provider === 'anthropic' ? route.model : `${route.connection.provider}:${route.model}`;
+
+export const PASSTHROUGH_ID = 'passthrough';
+
+function signedInAs(c: Connection): { account: string | null; plan: string | null; method?: CodexMethod } {
+  if (c.claude !== null) return { account: c.claude.email, plan: c.claude.plan };
+  if (c.codex !== null) return { account: c.codex.email, plan: c.codex.method === 'code' ? c.codex.plan : null, method: c.codex.method };
+  return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
+}
+
+function publicConnection(c: Connection): Record<string, unknown> {
+  return {
+    id: c.id,
+    provider: c.provider,
+    label: c.label,
+    model: c.model,
+    hasKey: c.apiKey !== '',
+    region: c.region,
+    zdr: c.zdr,
+    signedIn: c.codex !== null || c.gemini !== null || c.claude !== null,
+    ...signedInAs(c),
+  };
+}
+
+export function publicModelConfig(cfg: ModelConfig): Record<string, unknown> {
+  const reason = notReady(cfg);
+  return { route: cfg.route, ready: reason === null, reason, connections: cfg.connections.map(publicConnection) };
+}
+
+const withConnection = (cfg: ModelConfig, id: string, change: (c: Connection) => Connection): ModelConfig => ({
+  ...cfg,
+  connections: cfg.connections.map((c) => (c.id === id ? change(c) : c)),
+});
+
+export const setCodexAuth = (cfg: ModelConfig, id: string, auth: CodexTokens | null): ModelConfig =>
+  withConnection(cfg, id, (c) => ({ ...c, codex: auth }));
+
+export const setGeminiAuth = (cfg: ModelConfig, id: string, auth: GeminiTokens | null): ModelConfig =>
+  withConnection(cfg, id, (c) => ({ ...c, gemini: auth }));
+
+export const setClaudeLogin = (cfg: ModelConfig, id: string, login: ClaudeLogin | null): ModelConfig =>
+  withConnection(cfg, id, (c) => ({ ...c, claude: login }));
+
+function field(patch: Record<string, unknown>, key: string, current: string, what: string, max = MAX_FIELD): string {
+  if (!(key in patch)) return current;
+  const value = patch[key];
+  if (typeof value !== 'string') throw new ModelConfigError(`${what} must be a string`);
+  if (value.length > max) throw new ModelConfigError(`${what} is too long`);
+  return value.trim();
+}
+
+function flag(patch: Record<string, unknown>, key: string, current: boolean, what: string): boolean {
+  if (!(key in patch)) return current;
+  const value = patch[key];
+  if (typeof value !== 'boolean') throw new ModelConfigError(`${what} must be true or false`);
+  return value;
+}
+
+function labelFor(cfg: ModelConfig, provider: Provider, given: string): string {
+  if (given !== '') return given.slice(0, MAX_LABEL);
+  const taken = cfg.connections.filter((c) => c.provider === provider).length;
+  return taken === 0 ? LABELS[provider] : `${LABELS[provider]} ${String(taken + 1)}`;
+}
+
+export function addConnection(cfg: ModelConfig, patch: unknown): ModelConfig {
+  if (!isRecord(patch) || !isProvider(patch.provider)) throw new ModelConfigError(`provider must be one of ${PROVIDERS.join(', ')}`);
+  if (cfg.connections.length >= MAX_CONNECTIONS) throw new ModelConfigError(`a box keeps at most ${String(MAX_CONNECTIONS)} connections`);
+  const made = newConnection(patch.provider, labelFor(cfg, patch.provider, field(patch, 'label', '', 'label', MAX_LABEL)));
+  const filled = applyToConnection(made, patch);
+  return { ...cfg, route: cfg.route === '' ? filled.id : cfg.route, connections: [...cfg.connections, filled] };
+}
+
+function applyToConnection(c: Connection, patch: Record<string, unknown>): Connection {
+  return {
+    ...c,
+    label: field(patch, 'label', c.label, 'label', MAX_LABEL),
+    model: field(patch, 'model', c.model, 'model'),
+    apiKey: field(patch, 'apiKey', c.apiKey, 'API key'),
+    region: field(patch, 'region', c.region, 'region'),
+    zdr: flag(patch, 'zdr', c.zdr, 'zero data retention'),
+  };
+}
+
+export function updateConnection(cfg: ModelConfig, id: string, patch: unknown): ModelConfig {
+  if (!isRecord(patch)) throw new ModelConfigError('body must be a JSON object');
+  requireConnection(cfg, id);
+  return withConnection(cfg, id, (c) => applyToConnection(c, patch));
+}
+
+export function removeConnection(cfg: ModelConfig, id: string): ModelConfig {
+  requireConnection(cfg, id);
+  const connections = cfg.connections.filter((c) => c.id !== id);
+  const next = { ...cfg, route: cfg.route === id ? (connections[0]?.id ?? '') : cfg.route, connections };
+  return withFallbacks(next, (cfg.fallbacks ?? []).filter((f) => f.connection !== id));
+}
+
+function fallbackEntry(cfg: ModelConfig, raw: unknown): Fallback {
+  if (!isRecord(raw)) throw new ModelConfigError('each fallback must be an object with a connection and a model');
+  const connection = field(raw, 'connection', '', 'connection');
+  const model = field(raw, 'model', '', 'model');
+  requireConnection(cfg, connection);
+  if (model === '') throw new ModelConfigError('each fallback needs a model');
+  return { connection, model };
+}
+
+export function setFallbacks(cfg: ModelConfig, raw: unknown): ModelConfig {
+  if (!Array.isArray(raw)) throw new ModelConfigError('fallbacks must be a list');
+  if (raw.length > MAX_FALLBACKS) throw new ModelConfigError(`a box keeps at most ${String(MAX_FALLBACKS)} fallbacks`);
+  const entries = raw.map((f: unknown) => fallbackEntry(cfg, f));
+  return withFallbacks(cfg, fallbacksOf(entries, cfg.connections));
+}
+
+export function setRoute(cfg: ModelConfig, id: string): ModelConfig {
+  requireConnection(cfg, id);
+  return { ...cfg, route: id };
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-lists.ts

@@ -0,0 +1,57 @@
+import { createHash } from 'node:crypto';
+import { errMsg, log } from '@metro-labs/core/log';
+
+export const LIST_TTL_MS = 60 * 60_000;
+export const RETRY_MS = 5 * 60_000;
+
+export interface ListCache<T> {
+  get: (key: string, load: () => Promise<T[]>) => Promise<T[]>;
+  peek: (key: string) => T[] | null;
+  refresh: (key: string, load: () => Promise<T[]>) => Promise<void>;
+}
+
+const clears = new Set<() => void>();
+
+export function listCache<T>(name: string, now: () => number = Date.now): ListCache<T> {
+  const kept = new Map<string, { at: number; list: T[] }>();
+  const tried = new Map<string, number>();
+  clears.add(() => {
+    kept.clear();
+    tried.clear();
+  });
+  const fresh = (key: string): boolean => {
+    const hit = kept.get(key);
+    return hit !== undefined && now() - hit.at < LIST_TTL_MS;
+  };
+  return {
+    async get(key, load) {
+      const hit = kept.get(key);
+      if (hit !== undefined && fresh(key)) return hit.list;
+      try {
+        const list = await load();
+        kept.set(key, { at: now(), list });
+        return list;
+      } catch (err) {
+        if (hit === undefined) throw err;
+        log.warn({ list: name, err: errMsg(err) }, 'model-lists: the provider would not list its models, so the last list it gave stands');
+        return hit.list;
+      }
+    },
+    peek: (key) => kept.get(key)?.list ?? null,
+    async refresh(key, load) {
+      if (fresh(key) || now() - (tried.get(key) ?? Number.NEGATIVE_INFINITY) < RETRY_MS) return;
+      tried.set(key, now());
+      try {
+        kept.set(key, { at: now(), list: await load() });
+      } catch (err) {
+        log.warn({ list: name, err: errMsg(err) }, 'model-lists: the provider would not list its models, so the last list it gave stands');
+      }
+    },
+  };
+}
+
+export function forgetModelLists(): void {
+  for (const clear of clears) clear();
+}
+
+export const fingerprint = (...parts: string[]): string => createHash('sha256').update(parts.join('\n')).digest('hex').slice(0, 16);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -0,0 +1,157 @@
+import type { IncomingMessage } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { readJsonBody } from '@metro-labs/http/api-http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+import { beginLogin, chatgptHostId, finishLogin, type ChatgptTokens, type CodexTokens } from './codex-auth.js';
+import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
+import { codexModels, currentTokens, sharedCodexState, type CodexDeps } from './codex.js';
+import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, userEmail, type GeminiTokens } from './gemini-auth.js';
+import { onboard, parseGeminiProject } from './gemini-setup.js';
+import { currentGeminiTokens, listGeminiModels, sharedGeminiState, type GeminiDeps } from './gemini.js';
+import { listCache } from './model-lists.js';
+import { forgetReported } from './usage.js';
+import {
+  addConnection,
+  connectionOf,
+  setCodexAuth,
+  setGeminiAuth,
+  type Connection,
+  type ModelConfig,
+  type Provider,
+} from './model-config.js';
+import { asApiError, askedConnection, BODY_MAX, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
+
+function connectionToFill(store: Store, req: IncomingMessage, provider: Provider): { cfg: ModelConfig; id: string } {
+  const asked = askedConnection(req);
+  const current = store.read();
+  if (asked !== '') {
+    if (connectionOf(current, asked)?.provider !== provider) throw new ApiError('no such connection', 404);
+    return { cfg: current, id: asked };
+  }
+  const cfg = addConnection(current, { provider });
+  return { cfg, id: cfg.connections.at(-1)?.id ?? '' };
+}
+
+const saved = (store: Store, cfg: ModelConfig, note: string, fields: { connection: string } & Record<string, unknown>): unknown => {
+  store.write(cfg);
+  forgetReported(fields.connection);
+  log.info(fields, note);
+  return settingsBody(cfg);
+};
+
+const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): CodexDeps => ({
+  issuer: deps.issuer,
+  fetchImpl: deps.fetchImpl,
+  base: deps.codexBase,
+  save: (connId, t) => {
+    store.write(setCodexAuth(store.read(), connId === '' ? id : connId, t));
+  },
+});
+
+function renewing(store: Store, req: IncomingMessage): ChatgptTokens | null {
+  if (askedConnection(req) === '') return null;
+  const tokens = connectionFor(store.read(), req, 'codex').codex;
+  return tokens?.method === 'chatgpt' ? tokens : null;
+}
+
+function keepCodex(store: Store, req: IncomingMessage, tokens: CodexTokens, note: string): unknown {
+  const { cfg, id } = connectionToFill(store, req, 'codex');
+  return saved(store, setCodexAuth(cfg, id, tokens), note, { connection: id, method: tokens.method });
+}
+
+async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
+  const result = await pollDeviceLogin(id, deps.fetchImpl).catch(asApiError);
+  if (result.status !== 'done') return result;
+  return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected with a code') };
+}
+
+export const CODEX_ROUTES: Record<string, Route> = {
+  login: {
+    method: 'POST',
+    run: (req, deps, store) => Promise.resolve({ url: beginLogin(renewing(store, req), chatgptHostId(deps.setup?.agents), deps.issuer) }),
+  },
+  callback: {
+    method: 'POST',
+    run: async (req, deps, store) => {
+      const body = await readJsonBody(req, BODY_MAX);
+      const raw = isRecord(body) && typeof body.url === 'string' ? body.url : '';
+      const tokens = await finishLogin(raw, deps.issuer, deps.fetchImpl).catch(asApiError);
+      return keepCodex(store, req, tokens, 'model-api: Codex connected with Sign in with ChatGPT');
+    },
+  },
+  device: {
+    method: 'POST',
+    run: async (_req, deps) => {
+      const login = await beginDeviceLogin(deps.issuer, deps.fetchImpl).catch(asApiError);
+      return { id: login.id, user_code: login.userCode, verify_url: login.verifyUrl, interval: login.interval };
+    },
+  },
+  models: {
+    method: 'GET',
+    run: async (req, deps, store) => {
+      const conn = connectionFor(store.read(), req, 'codex');
+      if (conn.codex === null) throw new ApiError('this connection is not signed in yet', 400);
+      const codexDeps = codexDepsFor(deps, store, conn.id);
+      const auth = await currentTokens(conn, codexDeps, sharedCodexState).catch(asApiError);
+      return { models: await codexModels(auth, codexDeps).catch(asApiError) };
+    },
+  },
+};
+
+const geminiDeps = (deps: ModelApiDeps, store: Store): GeminiDeps => ({
+  base: deps.geminiBase,
+  tokenBase: deps.geminiTokenBase,
+  fetchImpl: deps.fetchImpl,
+  save: (id, t) => {
+    store.write(setGeminiAuth(store.read(), id, t));
+  },
+});
+
+export async function geminiModelsOf(conn: Connection, deps: ModelApiDeps, store: Store): Promise<Awaited<ReturnType<typeof listGeminiModels>>> {
+  if (conn.gemini === null) throw new ApiError('this connection is not signed in yet', 400);
+  const tokens = await currentGeminiTokens(conn, geminiDeps(deps, store), sharedGeminiState);
+  return listGeminiModels(tokens, geminiDeps(deps, store));
+}
+
+function projectOf(body: unknown): string | null {
+  try {
+    return parseGeminiProject(isRecord(body) ? body.project : null);
+  } catch (err) {
+    return asApiError(err);
+  }
+}
+
+async function connectGemini(req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
+  const body = await readJsonBody(req, BODY_MAX);
+  const code = isRecord(body) && typeof body.code === 'string' ? body.code : '';
+  const state = isRecord(body) && typeof body.state === 'string' ? body.state : '';
+  const project = projectOf(body);
+  const tokens = await exchangeGeminiCode(code, state, deps.geminiTokenBase, deps.fetchImpl).catch(asApiError);
+  const email = await userEmail(tokens, deps.geminiUserBase, deps.fetchImpl);
+  const onboarded = await onboard(tokens, project, deps.geminiBase, deps.fetchImpl).catch(asApiError);
+  const { cfg, id } = connectionToFill(store, req, 'gemini');
+  const full: GeminiTokens = { ...tokens, email, project: onboarded.project, tier: onboarded.tier };
+  return saved(store, setGeminiAuth(cfg, id, full), 'model-api: Gemini connected', { connection: id, tier: onboarded.tier });
+}
+
+const geminiLists = listCache<string>('gemini');
+
+async function geminiIds(req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<string[]> {
+  const conn = connectionFor(store.read(), req, 'gemini');
+  const key = `${deps.geminiBase ?? ''}:${conn.id}:${conn.gemini?.email ?? ''}:${conn.gemini?.project ?? ''}`;
+  return geminiLists.get(key, async () => (await geminiModelsOf(conn, deps, store)).map((m) => m.id));
+}
+
+export const GEMINI_ROUTES: Record<string, Route> = {
+  login: { method: 'POST', run: (_req, deps) => Promise.resolve(beginGeminiLogin(deps.geminiAuthBase)) },
+  code: { method: 'POST', run: connectGemini },
+  models: {
+    method: 'GET',
+    run: async (req, deps, store) => ({ models: await geminiIds(req, deps, store).catch(asApiError) }),
+  },
+};
+
+export function codexDeviceRoute(id: string, method: string | undefined): Route | number {
+  return method === 'GET' ? { method: 'GET', run: (req, deps, store) => pollDevice(id, req, deps, store) } : 405;
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -0,0 +1,83 @@
+import type { IncomingMessage } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { CodexAuthError } from './codex-auth.js';
+import { GeminiAuthError } from './gemini-auth.js';
+import { GatewayError } from './forward.js';
+import { lastServed } from './served.js';
+import { usageSeen } from './usage.js';
+import { chainStatus } from './fallback.js';
+import { ModelConfigError, connectionOf, publicModelConfig, routedConnection, type Connection, type ModelConfig, type Provider } from './model-config.js';
+import type { SetupDeps } from '../claude/setup.js';
+import type { ClaudeLoginDeps } from './claude-logins.js';
+
+export interface ModelApiDeps {
+  read?: () => ModelConfig;
+  write?: (cfg: ModelConfig) => void;
+  issuer?: string;
+  fetchImpl?: typeof fetch;
+  codexBase?: string;
+  geminiAuthBase?: string;
+  geminiTokenBase?: string;
+  geminiUserBase?: string;
+  geminiBase?: string;
+  openrouterBase?: string;
+  owner?: () => string | null;
+  openrouterPublicBase?: () => string | null;
+  openrouterNow?: () => number;
+  anthropicBase?: string;
+  bedrockControlBase?: string;
+  setup?: SetupDeps;
+  restartSession?: () => boolean;
+  sessionRunning?: () => boolean;
+  switchModel?: (model: string | null) => boolean;
+  claudeUsage?: (env?: Record<string, string>) => Promise<unknown>;
+  claudeLoginsRoot?: string;
+  usageWaitMs?: number;
+}
+
+export const claudeLoginDeps = (deps: ModelApiDeps): ClaudeLoginDeps => ({ root: deps.claudeLoginsRoot, probe: deps.claudeUsage });
+
+export interface Store {
+  read: () => ModelConfig;
+  write: (cfg: ModelConfig) => void;
+}
+
+type Handler = (req: IncomingMessage, deps: ModelApiDeps, store: Store) => Promise<unknown>;
+
+export interface Route {
+  method: 'GET' | 'POST';
+  run: Handler;
+}
+
+export const BODY_MAX = 16 * 1024;
+export const CREDITS_TTL_MS = 5 * 60_000;
+
+export const settingsBody = (cfg: ModelConfig): Record<string, unknown> => ({
+  ...publicModelConfig(cfg),
+  fallbacks: cfg.fallbacks ?? [],
+  chain: chainStatus(cfg),
+  lastServed: lastServed(),
+  usage: usageSeen(),
+});
+
+export function asApiError(err: unknown): never {
+  if (err instanceof ModelConfigError || err instanceof CodexAuthError || err instanceof GeminiAuthError) throw new ApiError(err.message, 400);
+  if (err instanceof GatewayError) throw new ApiError(err.message, err.status >= 400 && err.status < 500 ? 400 : 502);
+  throw err;
+}
+
+export const askedConnection = (req: IncomingMessage): string => new URL(req.url ?? '', 'http://metro').searchParams.get('connection') ?? '';
+
+export function connectionFor(cfg: ModelConfig, req: IncomingMessage, provider: Provider): Connection {
+  const asked = askedConnection(req);
+  if (asked !== '') {
+    const found = connectionOf(cfg, asked);
+    if (found?.provider !== provider) throw new ApiError('no such connection', 404);
+    return found;
+  }
+  const routed = routedConnection(cfg);
+  if (routed?.provider === provider) return routed;
+  const first = cfg.connections.find((c) => c.provider === provider);
+  if (first === undefined) throw new ApiError(`no ${provider} connection yet`, 400);
+  return first;
+}