@stage-labs/metro 0.1.0-beta.308 → 0.1.0-beta.309

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini.ts

@@ -1,208 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { isRecord } from '@metro-labs/core/is-record';
-import { errMsg, log } from '@metro-labs/core/log';
-import { refreshTokens, tokensStale, type GeminiTokens } from './gemini-auth.js';
-import { API, clientHeaders, generateBases, machineSessionId, type Bases } from './gemini-client.js';
-import { GeminiStreamTranslator } from './gemini-stream.js';
-import { toGeminiRequest } from './gemini-translate.js';
-import { ToolNames } from './codex-translate.js';
-import { GatewayError, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
-import type { Connection } from './model-config.js';
-import { answerWhole, currentOf, errorKind, reach, refreshed, relayTranslated, sessionHeader, type TokenSource, type TokenState } from './subscription.js';
-import { effortToApply, withoutEffort } from './effort.js';
-
-export interface GeminiDeps {
-  base?: Bases;
-  tokenBase?: string;
-  fetchImpl?: typeof fetch;
-  save: (id: string, tokens: GeminiTokens) => void;
-}
-
-export type GeminiState = TokenState<GeminiTokens>;
-
-export const sharedGeminiState: GeminiState = new Map();
-
-const sourceOf = (deps: GeminiDeps): TokenSource<GeminiTokens> => ({
-  label: 'Google',
-  stale: (tokens) => tokensStale(tokens),
-  refresh: (tokens) => refreshTokens(tokens, deps.tokenBase, deps.fetchImpl),
-  save: deps.save,
-});
-
-export const currentGeminiTokens = (conn: Connection, deps: GeminiDeps, state: GeminiState): Promise<GeminiTokens> =>
-  currentOf(state, conn.id, conn.gemini, sourceOf(deps), 'Gemini is not connected: sign in with Google on the Model page.');
-
-interface Call {
-  body: Record<string, unknown>;
-  model: string;
-  promptId: string;
-  watch: Watch;
-  deps: GeminiDeps;
-  names: ToolNames;
-  conn: Connection;
-}
-
-const headersFor = (token: string, stream: boolean): Record<string, string> => ({
-  authorization: `Bearer ${token}`,
-  'content-type': 'application/json',
-  ...clientHeaders(),
-  'x-machine-session-id': machineSessionId(),
-  ...(stream ? { accept: 'text/event-stream' } : {}),
-});
-
-async function sendTo(base: string, call: Call, tokens: GeminiTokens, stream: boolean): Promise<Response> {
-  const request = toGeminiRequest(call.body, call.model, tokens.project, call.promptId, call.names);
-  const method = stream ? 'streamGenerateContent?alt=sse' : 'generateContent';
-  return (call.deps.fetchImpl ?? fetch)(`${base}/${API}:${method}`, {
-    method: 'POST',
-    headers: headersFor(tokens.accessToken, stream),
-    body: JSON.stringify(request),
-    signal: call.watch.signal,
-    redirect: 'manual',
-  });
-}
-
-async function send(call: Call, tokens: GeminiTokens, stream: boolean): Promise<Response> {
-  const bases = generateBases(call.deps.base);
-  let last: Response | null = null;
-  for (const base of bases) {
-    if (last !== null) await last.body?.cancel();
-    try {
-      last = await sendTo(base, call, tokens, stream);
-    } catch (err) {
-      if (base === bases.at(-1) || call.watch.signal.aborted) throw err;
-      continue;
-    }
-    if (last.status < 500 && last.status !== 429) return last;
-  }
-  if (last === null) throw new GatewayError(502, 'api_error', 'no Code Assist endpoint to call');
-  return last;
-}
-
-const REFUSAL_LOG_MAX = 2000;
-
-const detailText = (detail: Record<string, unknown>): string[] => {
-  const out: string[] = [];
-  if (typeof detail.reason === 'string') out.push(detail.reason);
-  if (isRecord(detail.metadata)) out.push(...Object.entries(detail.metadata).map(([k, v]) => `${k}=${String(v)}`));
-  if (typeof detail.retryDelay === 'string') out.push(`retry after ${detail.retryDelay}`);
-  if (Array.isArray(detail.violations))
-    out.push(...detail.violations.filter(isRecord).map((v) => [v.subject, v.description].filter((x) => typeof x === 'string').join(': ')));
-  return out.filter((x) => x !== '');
-};
-
-function refusalMessage(text: string, status: number): string {
-  const message = upstreamMessage(text, `Gemini answered ${String(status)}`);
-  let details: unknown = null;
-  try {
-    const parsed: unknown = JSON.parse(text);
-    details = isRecord(parsed) && isRecord(parsed.error) ? parsed.error.details : null;
-  } catch {
-    return message;
-  }
-  const notes = Array.isArray(details) ? details.filter(isRecord).flatMap(detailText) : [];
-  return notes.length === 0 ? message : `${message} (${notes.join('; ')})`;
-}
-
-const reachWith = (call: Call, state: GeminiState, stream: boolean): Promise<Response> =>
-  reach(
-    () => currentGeminiTokens(call.conn, call.deps, state),
-    (tokens) => refreshed(state, call.conn.id, tokens, sourceOf(call.deps)),
-    (tokens) => send(call, tokens, stream),
-  );
-
-export interface GeminiModel {
-  id: string;
-  name: string;
-  remaining: number | null;
-  resetAt: string | null;
-}
-
-const modelOf = (id: string, raw: unknown): GeminiModel => {
-  const entry = isRecord(raw) ? raw : {};
-  const quota = isRecord(entry.quotaInfo) ? entry.quotaInfo : null;
-  const fraction = quota !== null && typeof quota.remainingFraction === 'number' ? quota.remainingFraction : null;
-  const resetAt = quota !== null && typeof quota.resetTime === 'string' ? quota.resetTime : null;
-  return { id, name: typeof entry.displayName === 'string' ? entry.displayName : id, remaining: fraction ?? (resetAt === null ? null : 0), resetAt };
-};
-
-export async function listGeminiModels(tokens: GeminiTokens, deps: GeminiDeps): Promise<GeminiModel[]> {
-  let last = 'no Code Assist endpoint to call';
-  for (const base of generateBases(deps.base)) {
-    try {
-      const res = await (deps.fetchImpl ?? fetch)(`${base}/${API}:fetchAvailableModels`, {
-        method: 'POST',
-        headers: headersFor(tokens.accessToken, false),
-        body: JSON.stringify({ project: tokens.project }),
-        signal: AbortSignal.timeout(30_000),
-      });
-      const body: unknown = await res.json().catch(() => null);
-      if (!res.ok) {
-        last = upstreamMessage(JSON.stringify(body), `Google answered ${String(res.status)}`);
-        continue;
-      }
-      const models = isRecord(body) && isRecord(body.models) ? body.models : {};
-      return Object.entries(models)
-        .filter(([id]) => id.startsWith('gemini'))
-        .map(([id, raw]) => modelOf(id, raw));
-    } catch (err) {
-      last = errMsg(err);
-    }
-  }
-  throw new GatewayError(502, 'api_error', `could not list the Gemini models: ${last}`);
-}
-
-const parseData = (raw: string): Record<string, unknown> | null => {
-  try {
-    const parsed: unknown = JSON.parse(raw);
-    return isRecord(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-};
-
-const NAMES_THINKING = /thinking|thought/i;
-
-function refuse(res: ServerResponse, model: string, status: number, text: string): void {
-  log.warn({ provider: 'gemini', model, status, body: text.slice(0, REFUSAL_LOG_MAX) }, 'gateway: the provider refused the request');
-  sendError(res, providerStatus(status), errorKind(status), refusalMessage(text, status));
-}
-
-export async function geminiMessages(
-  req: IncomingMessage,
-  res: ServerResponse,
-  body: Record<string, unknown>,
-  model: string,
-  conn: Connection,
-  deps: GeminiDeps,
-  state: GeminiState,
-  watch: Watch,
-): Promise<void> {
-  const stream = body.stream === true;
-  let call: Call = { body, model, promptId: sessionHeader(req) || 'metro', watch, deps, names: new ToolNames(), conn };
-  let upstream = await reachWith(call, state, stream);
-  if (upstream.status === 400 && effortToApply(body) !== null) {
-    const text = await upstream.text();
-    if (!NAMES_THINKING.test(text)) {
-      refuse(res, model, 400, text);
-      return;
-    }
-    log.warn({ provider: 'gemini', model }, 'gateway: Gemini refused the thinking level, so metro asked again without it');
-    call = { ...call, body: withoutEffort(body) };
-    upstream = await reachWith(call, state, stream);
-  }
-  if (!upstream.ok) {
-    refuse(res, model, upstream.status, await upstream.text());
-    return;
-  }
-  const translator = new GeminiStreamTranslator(model, (name) => call.names.restore(name));
-  if (stream) {
-    await relayTranslated(upstream, res, watch, conn.id, translator, (raw) => {
-      const data = parseData(raw.data);
-      return data === null ? '' : translator.push(data);
-    });
-    return;
-  }
-  const data = parseData(await upstream.text());
-  answerWhole(res, (data === null ? '' : translator.push(data)) + translator.close(), conn.id);
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -1,157 +0,0 @@
-import type { IncomingMessage } from 'node:http';
-import { ApiError } from '@metro-labs/http/api-error';
-import { readJsonBody } from '@metro-labs/http/api-http';
-import { isRecord } from '@metro-labs/core/is-record';
-import { log } from '@metro-labs/core/log';
-import { beginLogin, chatgptHostId, finishLogin, type ChatgptTokens, type CodexTokens } from './codex-auth.js';
-import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
-import { codexModels, currentTokens, sharedCodexState, type CodexDeps } from './codex.js';
-import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, userEmail, type GeminiTokens } from './gemini-auth.js';
-import { onboard, parseGeminiProject } from './gemini-setup.js';
-import { currentGeminiTokens, listGeminiModels, sharedGeminiState, type GeminiDeps } from './gemini.js';
-import { listCache } from './model-lists.js';
-import { forgetReported } from './usage.js';
-import {
-  addConnection,
-  connectionOf,
-  setCodexAuth,
-  setGeminiAuth,
-  type Connection,
-  type ModelConfig,
-  type Provider,
-} from './model-config.js';
-import { asApiError, askedConnection, BODY_MAX, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
-
-function connectionToFill(store: Store, req: IncomingMessage, provider: Provider): { cfg: ModelConfig; id: string } {
-  const asked = askedConnection(req);
-  const current = store.read();
-  if (asked !== '') {
-    if (connectionOf(current, asked)?.provider !== provider) throw new ApiError('no such connection', 404);
-    return { cfg: current, id: asked };
-  }
-  const cfg = addConnection(current, { provider });
-  return { cfg, id: cfg.connections.at(-1)?.id ?? '' };
-}
-
-const saved = (store: Store, cfg: ModelConfig, note: string, fields: { connection: string } & Record<string, unknown>): unknown => {
-  store.write(cfg);
-  forgetReported(fields.connection);
-  log.info(fields, note);
-  return settingsBody(cfg);
-};
-
-const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): CodexDeps => ({
-  issuer: deps.issuer,
-  fetchImpl: deps.fetchImpl,
-  base: deps.codexBase,
-  save: (connId, t) => {
-    store.write(setCodexAuth(store.read(), connId === '' ? id : connId, t));
-  },
-});
-
-function renewing(store: Store, req: IncomingMessage): ChatgptTokens | null {
-  if (askedConnection(req) === '') return null;
-  const tokens = connectionFor(store.read(), req, 'codex').codex;
-  return tokens?.method === 'chatgpt' ? tokens : null;
-}
-
-function keepCodex(store: Store, req: IncomingMessage, tokens: CodexTokens, note: string): unknown {
-  const { cfg, id } = connectionToFill(store, req, 'codex');
-  return saved(store, setCodexAuth(cfg, id, tokens), note, { connection: id, method: tokens.method });
-}
-
-async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
-  const result = await pollDeviceLogin(id, deps.fetchImpl).catch(asApiError);
-  if (result.status !== 'done') return result;
-  return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected with a code') };
-}
-
-export const CODEX_ROUTES: Record<string, Route> = {
-  login: {
-    method: 'POST',
-    run: (req, deps, store) => Promise.resolve({ url: beginLogin(renewing(store, req), chatgptHostId(deps.setup?.agents), deps.issuer) }),
-  },
-  callback: {
-    method: 'POST',
-    run: async (req, deps, store) => {
-      const body = await readJsonBody(req, BODY_MAX);
-      const raw = isRecord(body) && typeof body.url === 'string' ? body.url : '';
-      const tokens = await finishLogin(raw, deps.issuer, deps.fetchImpl).catch(asApiError);
-      return keepCodex(store, req, tokens, 'model-api: Codex connected with Sign in with ChatGPT');
-    },
-  },
-  device: {
-    method: 'POST',
-    run: async (_req, deps) => {
-      const login = await beginDeviceLogin(deps.issuer, deps.fetchImpl).catch(asApiError);
-      return { id: login.id, user_code: login.userCode, verify_url: login.verifyUrl, interval: login.interval };
-    },
-  },
-  models: {
-    method: 'GET',
-    run: async (req, deps, store) => {
-      const conn = connectionFor(store.read(), req, 'codex');
-      if (conn.codex === null) throw new ApiError('this connection is not signed in yet', 400);
-      const codexDeps = codexDepsFor(deps, store, conn.id);
-      const auth = await currentTokens(conn, codexDeps, sharedCodexState).catch(asApiError);
-      return { models: await codexModels(auth, codexDeps).catch(asApiError) };
-    },
-  },
-};
-
-const geminiDeps = (deps: ModelApiDeps, store: Store): GeminiDeps => ({
-  base: deps.geminiBase,
-  tokenBase: deps.geminiTokenBase,
-  fetchImpl: deps.fetchImpl,
-  save: (id, t) => {
-    store.write(setGeminiAuth(store.read(), id, t));
-  },
-});
-
-export async function geminiModelsOf(conn: Connection, deps: ModelApiDeps, store: Store): Promise<Awaited<ReturnType<typeof listGeminiModels>>> {
-  if (conn.gemini === null) throw new ApiError('this connection is not signed in yet', 400);
-  const tokens = await currentGeminiTokens(conn, geminiDeps(deps, store), sharedGeminiState);
-  return listGeminiModels(tokens, geminiDeps(deps, store));
-}
-
-function projectOf(body: unknown): string | null {
-  try {
-    return parseGeminiProject(isRecord(body) ? body.project : null);
-  } catch (err) {
-    return asApiError(err);
-  }
-}
-
-async function connectGemini(req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
-  const body = await readJsonBody(req, BODY_MAX);
-  const code = isRecord(body) && typeof body.code === 'string' ? body.code : '';
-  const state = isRecord(body) && typeof body.state === 'string' ? body.state : '';
-  const project = projectOf(body);
-  const tokens = await exchangeGeminiCode(code, state, deps.geminiTokenBase, deps.fetchImpl).catch(asApiError);
-  const email = await userEmail(tokens, deps.geminiUserBase, deps.fetchImpl);
-  const onboarded = await onboard(tokens, project, deps.geminiBase, deps.fetchImpl).catch(asApiError);
-  const { cfg, id } = connectionToFill(store, req, 'gemini');
-  const full: GeminiTokens = { ...tokens, email, project: onboarded.project, tier: onboarded.tier };
-  return saved(store, setGeminiAuth(cfg, id, full), 'model-api: Gemini connected', { connection: id, tier: onboarded.tier });
-}
-
-const geminiLists = listCache<string>('gemini');
-
-async function geminiIds(req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<string[]> {
-  const conn = connectionFor(store.read(), req, 'gemini');
-  const key = `${deps.geminiBase ?? ''}:${conn.id}:${conn.gemini?.email ?? ''}:${conn.gemini?.project ?? ''}`;
-  return geminiLists.get(key, async () => (await geminiModelsOf(conn, deps, store)).map((m) => m.id));
-}
-
-export const GEMINI_ROUTES: Record<string, Route> = {
-  login: { method: 'POST', run: (_req, deps) => Promise.resolve(beginGeminiLogin(deps.geminiAuthBase)) },
-  code: { method: 'POST', run: connectGemini },
-  models: {
-    method: 'GET',
-    run: async (req, deps, store) => ({ models: await geminiIds(req, deps, store).catch(asApiError) }),
-  },
-};
-
-export function codexDeviceRoute(id: string, method: string | undefined): Route | number {
-  return method === 'GET' ? { method: 'GET', run: (req, deps, store) => pollDevice(id, req, deps, store) } : 405;
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -1,82 +0,0 @@
-import type { IncomingMessage } from 'node:http';
-import { ApiError } from '@metro-labs/http/api-error';
-import { CodexAuthError } from './codex-auth.js';
-import { GeminiAuthError } from './gemini-auth.js';
-import { GatewayError } from './forward.js';
-import { lastServed } from './served.js';
-import { usageSeen } from './usage.js';
-import { chainStatus } from './fallback.js';
-import { ModelConfigError, connectionOf, publicModelConfig, routedConnection, type Connection, type ModelConfig, type Provider } from './model-config.js';
-import type { SetupDeps } from '../claude/setup.js';
-import type { ClaudeLoginDeps } from './claude-logins.js';
-
-export interface ModelApiDeps {
-  read?: () => ModelConfig;
-  write?: (cfg: ModelConfig) => void;
-  issuer?: string;
-  fetchImpl?: typeof fetch;
-  codexBase?: string;
-  geminiAuthBase?: string;
-  geminiTokenBase?: string;
-  geminiUserBase?: string;
-  geminiBase?: string;
-  openrouterBase?: string;
-  owner?: () => string | null;
-  openrouterPublicBase?: () => string | null;
-  openrouterNow?: () => number;
-  anthropicBase?: string;
-  bedrockControlBase?: string;
-  setup?: SetupDeps;
-  runnerAlive?: () => boolean;
-  switchModel?: (model: string | null) => boolean;
-  claudeUsage?: (env?: Record<string, string>) => Promise<unknown>;
-  claudeLoginsRoot?: string;
-  usageWaitMs?: number;
-}
-
-export const claudeLoginDeps = (deps: ModelApiDeps): ClaudeLoginDeps => ({ root: deps.claudeLoginsRoot, probe: deps.claudeUsage });
-
-export interface Store {
-  read: () => ModelConfig;
-  write: (cfg: ModelConfig) => void;
-}
-
-type Handler = (req: IncomingMessage, deps: ModelApiDeps, store: Store) => Promise<unknown>;
-
-export interface Route {
-  method: 'GET' | 'POST';
-  run: Handler;
-}
-
-export const BODY_MAX = 16 * 1024;
-export const CREDITS_TTL_MS = 5 * 60_000;
-
-export const settingsBody = (cfg: ModelConfig): Record<string, unknown> => ({
-  ...publicModelConfig(cfg),
-  fallbacks: cfg.fallbacks ?? [],
-  chain: chainStatus(cfg),
-  lastServed: lastServed(),
-  usage: usageSeen(),
-});
-
-export function asApiError(err: unknown): never {
-  if (err instanceof ModelConfigError || err instanceof CodexAuthError || err instanceof GeminiAuthError) throw new ApiError(err.message, 400);
-  if (err instanceof GatewayError) throw new ApiError(err.message, err.status >= 400 && err.status < 500 ? 400 : 502);
-  throw err;
-}
-
-export const askedConnection = (req: IncomingMessage): string => new URL(req.url ?? '', 'http://metro').searchParams.get('connection') ?? '';
-
-export function connectionFor(cfg: ModelConfig, req: IncomingMessage, provider: Provider): Connection {
-  const asked = askedConnection(req);
-  if (asked !== '') {
-    const found = connectionOf(cfg, asked);
-    if (found?.provider !== provider) throw new ApiError('no such connection', 404);
-    return found;
-  }
-  const routed = routedConnection(cfg);
-  if (routed?.provider === provider) return routed;
-  const first = cfg.connections.find((c) => c.provider === provider);
-  if (first === undefined) throw new ApiError(`no ${provider} connection yet`, 400);
-  return first;
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter-login.ts

@@ -1,192 +0,0 @@
-import { createHash } from 'node:crypto';
-import { pkcePair, newState } from '@metro-labs/core/stations/oauth';
-import { ticketStore } from '@metro-labs/core/tickets';
-import { isRecord } from '@metro-labs/core/is-record';
-import { log } from '@metro-labs/core/log';
-import { ApiError } from '@metro-labs/http/api-error';
-import { addConnection, connectionOf, updateConnection } from './model-config.js';
-import { asApiError, type Store } from './model-store.js';
-import { forgetReported } from './usage.js';
-
-export const OPENROUTER_CALLBACK = '/api/model/openrouter/callback';
-const TTL = 10 * 60_000;
-const MAX_ATTEMPTS = 100;
-const STALE = 'This OpenRouter sign-in expired or was cancelled. Start again.';
-const FAILED = 'OpenRouter sign-in did not finish. Try again or use an API key. Manage any unused key in OpenRouter.';
-
-type Result = { status: 'pending' } | { status: 'done'; connection: string } | { status: 'failed'; error: string };
-
-interface Attempt {
-  owner: string;
-  connection: string;
-  keyHash: string;
-  expiresAt: number;
-  state: string;
-  verifier: string;
-  result: Result;
-  abort: AbortController;
-}
-
-interface LoginDeps {
-  store: Store;
-  owner: () => string | null;
-  publicBase: () => string | null;
-  fetchImpl?: typeof fetch;
-  now?: () => number;
-}
-
-const hash = (value: string): string => createHash('sha256').update(value).digest('hex');
-
-function callbackUrl(base: string | null): string {
-  let url: URL;
-  try {
-    url = new URL(base ?? '');
-  } catch {
-    throw new ApiError('This box needs a public HTTPS address for OpenRouter sign-in. Use an API key instead.', 409);
-  }
-  if (url.protocol !== 'https:' || url.username !== '' || url.password !== '' || url.pathname !== '/' || url.search !== '' || url.hash !== '')
-    throw new ApiError('This box needs a public HTTPS origin for OpenRouter sign-in. Use an API key instead.', 409);
-  return `${url.origin}${OPENROUTER_CALLBACK}`;
-}
-
-async function exchange(code: string, verifier: string, signal: AbortSignal, fetchImpl: typeof fetch): Promise<string> {
-  const res = await fetchImpl('https://openrouter.ai/api/v1/auth/keys', {
-    method: 'POST',
-    headers: { 'content-type': 'application/json', accept: 'application/json' },
-    body: JSON.stringify({ code, code_verifier: verifier, code_challenge_method: 'S256' }),
-    redirect: 'manual',
-    signal: AbortSignal.any([signal, AbortSignal.timeout(15_000)]),
-  });
-  if (!res.ok) {
-    await res.body?.cancel();
-    throw new ApiError(FAILED, 502);
-  }
-  const body: unknown = await res.json();
-  if (!isRecord(body) || typeof body.key !== 'string' || body.key.trim() === '' || body.key.length > 512)
-    throw new ApiError(FAILED, 502);
-  return body.key.trim();
-}
-
-function authorizationCode(params: URLSearchParams): string {
-  const code = params.get('code') ?? '';
-  if (params.has('error') || code === '' || code.length > 4096 || params.getAll('code').length !== 1 || params.getAll('state').length !== 1)
-    throw new ApiError('OpenRouter did not approve this sign-in. Try again or use an API key.', 400);
-  return code;
-}
-
-export class OpenRouterLogins {
-  private readonly states = ticketStore<Attempt>(TTL, MAX_ATTEMPTS);
-  private readonly attempts = new Map<string, Attempt>();
-
-  constructor(private readonly deps: LoginDeps) {}
-
-  private now(): number {
-    return (this.deps.now ?? Date.now)();
-  }
-
-  private discard(attempt: Attempt): void {
-    this.states.take(attempt.state, this.now());
-    attempt.verifier = '';
-    attempt.abort.abort();
-  }
-
-  private prune(): void {
-    for (const [id, attempt] of this.attempts) {
-      if (attempt.expiresAt > this.now()) continue;
-      this.discard(attempt);
-      this.attempts.delete(id);
-    }
-  }
-
-  private checkOwner(owner: string): void {
-    if (this.deps.owner() !== owner) throw new ApiError('This sign-in belongs to another organization.', 403);
-  }
-
-  private target(connection: string): string {
-    const cfg = this.deps.store.read();
-    if (connection === '') {
-      try {
-        addConnection(cfg, { provider: 'openrouter' });
-      } catch (err) {
-        asApiError(err);
-      }
-      return '';
-    }
-    const found = connectionOf(cfg, connection);
-    if (found?.provider !== 'openrouter') throw new ApiError('This OpenRouter connection no longer exists.', 404);
-    return hash(found.apiKey);
-  }
-
-  begin(owner: string, connection: string): { id: string; url: string; expiresAt: number } {
-    this.checkOwner(owner);
-    const callback = callbackUrl(this.deps.publicBase());
-    const keyHash = this.target(connection);
-    this.prune();
-    if (this.attempts.size >= MAX_ATTEMPTS) throw new ApiError('Too many OpenRouter sign-ins. Try again later.', 429);
-    const { verifier, challenge } = pkcePair();
-    const attempt: Attempt = { owner, connection, keyHash, verifier, state: '', expiresAt: this.now() + TTL, result: { status: 'pending' }, abort: new AbortController() };
-    attempt.state = this.states.mint(attempt, this.now()).ticket;
-    const id = newState();
-    this.attempts.set(id, attempt);
-    const url = new URL('https://openrouter.ai/auth');
-    url.search = new URLSearchParams({ callback_url: callback, code_challenge: challenge, code_challenge_method: 'S256', state: attempt.state, key_label: 'Metro' }).toString();
-    return { id, url: url.href, expiresAt: attempt.expiresAt };
-  }
-
-  private find(owner: string, id: string): Attempt {
-    this.checkOwner(owner);
-    this.prune();
-    const attempt = this.attempts.get(id);
-    if (attempt?.owner !== owner) throw new ApiError(STALE, 410);
-    return attempt;
-  }
-
-  status(owner: string, id: string): Result {
-    return this.find(owner, id).result;
-  }
-
-  cancel(owner: string, id: string): Result {
-    const attempt = this.find(owner, id);
-    if (attempt.result.status === 'pending') {
-      attempt.result = { status: 'failed', error: 'OpenRouter sign-in cancelled.' };
-      this.discard(attempt);
-    }
-    return attempt.result;
-  }
-
-  private checkPending(attempt: Attempt): void {
-    if (attempt.expiresAt <= this.now() || attempt.result.status !== 'pending') throw new ApiError(STALE, 410);
-    this.checkOwner(attempt.owner);
-    if (this.target(attempt.connection) !== attempt.keyHash)
-      throw new ApiError('This connection changed during sign-in. Start again.', 409);
-  }
-
-  private save(attempt: Attempt, key: string): void {
-    this.checkPending(attempt);
-    const current = this.deps.store.read();
-    const next = attempt.connection === '' ? addConnection(current, { provider: 'openrouter', apiKey: key }) : updateConnection(current, attempt.connection, { apiKey: key });
-    const id = attempt.connection === '' ? (next.connections.at(-1)?.id ?? '') : attempt.connection;
-    this.deps.store.write(next);
-    forgetReported(id);
-    attempt.result = { status: 'done', connection: id };
-    log.info({ connection: id }, 'model-api: OpenRouter connected');
-  }
-
-  async complete(params: URLSearchParams): Promise<void> {
-    const state = params.get('state') ?? '';
-    const attempt = this.states.take(state, this.now());
-    if (attempt === undefined) throw new ApiError(STALE, 410);
-    const verifier = attempt.verifier;
-    attempt.verifier = '';
-    try {
-      this.checkPending(attempt);
-      const key = await exchange(authorizationCode(params), verifier, attempt.abort.signal, this.deps.fetchImpl ?? fetch);
-      this.save(attempt, key);
-    } catch (err) {
-      if (attempt.result.status === 'pending') attempt.result = { status: 'failed', error: err instanceof ApiError ? err.message : FAILED };
-      throw new ApiError(attempt.result.status === 'failed' ? attempt.result.error : FAILED, 400);
-    } finally {
-      this.discard(attempt);
-    }
-  }
-}