openwork-server 0.18.60 → 0.18.61

package/README.md

@@ -9,7 +9,7 @@ npm install -g openwork-server
 openwork-server --workspace /path/to/workspace --approval auto
 ```
 
-The npm package runs on Node.js 22.13 or newer on macOS, Linux, and Windows (arm64 or x64); Bun is not required at runtime.
+The npm package requires stable Node.js 24.x, version 24.22.1 or newer within that major, on macOS, Linux, and Windows (arm64 or x64); Bun is not required at runtime. Older Node releases and other majors (including 25+) are rejected by the runtime gate. This security baseline also replaces the previous Node.js 22.13 minimum.
 
 ### Self-hosted web UI
 
@@ -34,8 +34,14 @@ persisted in `~/.openwork/openwork-server/web-tokens.json` so they survive
 restarts; `--token`/`--host-token` or `OPENWORK_TOKEN`/`OPENWORK_HOST_TOKEN`
 override them.
 
+In `web` mode the UI's pages never carry CORS headers, and the server only
+answers requests addressed to `localhost`, an IP address or the `--host` name.
+Add other names with `--allowed-hosts` (or `OPENWORK_ALLOWED_HOSTS`,
+comma-separated; `*` allows any).
+
 To reach it from other machines, keep the server on `127.0.0.1` and put a TLS
-proxy in front (e.g. `tailscale serve --bg --https=8787 http://127.0.0.1:8787`).
+proxy in front (e.g. `tailscale serve --bg --https=8787 http://127.0.0.1:8787`),
+then allow the proxy's name (e.g. `--allowed-hosts my-machine.tailnet.ts.net`).
 Browsers require a secure context for the UI on any non-localhost origin.
 Set `OPENWORK_OPENCODE_BIN` to use your own OpenCode install instead of the
 managed download; `/health` reports both the pinned `opencodeVersion` and the
@@ -175,6 +181,7 @@ Defaults to `~/.config/openwork/server.json` (override with `OPENWORK_SERVER_CON
 - `OPENWORK_APPROVAL_TIMEOUT_MS`
 - `OPENWORK_WORKSPACES` (JSON array or comma-separated list of paths)
 - `OPENWORK_CORS_ORIGINS` (comma-separated list or `*`)
+- `OPENWORK_ALLOWED_HOSTS` (comma-separated host names or `*`; `web` mode always checks the Host)
 - `OPENWORK_OPENCODE_BASE_URL`
 - `OPENWORK_OPENCODE_DIRECTORY`
 - `OPENWORK_OPENCODE_USERNAME`

package/bin/openwork-server.mjs

@@ -29,7 +29,7 @@ const nodeBundle = fromPackage("./dist/openwork-server.mjs");
 if (existsSync(nodeBundle)) {
   if (!nodeVersionSupported(process.versions.node)) {
     console.error(
-      `openwork-server needs Node.js ${MIN_NODE_VERSION} or newer (found ${process.versions.node}). Install a current Node.js LTS and try again.`,
+      `openwork-server needs Node.js 24.x, version ${MIN_NODE_VERSION} or newer within that major (found ${process.versions.node}). Install a supported Node.js 24 release and try again.`,
     );
     process.exit(1);
   }

package/bin/platform.mjs

@@ -16,13 +16,13 @@ export function serverBinaryName(platform, arch) {
   return `openwork-server-${target.target}${platform === "win32" ? ".exe" : ""}`;
 }
 
-// node:sqlite (the server's runtime database) is available without a flag
-// from Node 22.13 and 23.4.
-export const MIN_NODE_VERSION = "22.13.0";
+// Security baseline: only patched releases on the supported Node 24 line.
+// New majors must be reviewed explicitly, not accepted by a lower-bound check.
+export const MIN_NODE_VERSION = "24.22.1";
 
 export function nodeVersionSupported(version) {
-  const [major, minor] = version.replace(/^v/, "").split(".").map(Number);
-  if (major === 22) return minor >= 13;
-  if (major === 23) return minor >= 4;
-  return major > 23;
+  const match = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(version);
+  if (!match) return false;
+  const [, major, minor, patch] = match.map(Number);
+  return major === 24 && (minor > 22 || (minor === 22 && patch >= 1));
 }

package/dist/opencode-plugins/openwork-cloud-skills-v2.js

@@ -19,6 +19,9 @@ const MAX_SKILLS = 150;
 const NATIVE_BUDGET_CHARS = 64_000;
 const NATIVE_DESCRIPTION_CHARS = 1_024;
 const MAX_MENTIONED_SKILLS = 3;
+// Bodies kept for the skills messages used most recently, so using one again
+// needs no read before the model runs. Every other skill loads on use.
+const MAX_WARM_SKILLS = 8;
 const skillId = (skill) => `${CLOUD_SKILL_ID_PREFIX}${skill.name}`;
 // Not SKILL.md: the native skill tool must not scan a fake directory. The engine
 // requires path and disables this whole plugin, OpenWork's context tools
@@ -60,10 +63,10 @@ function budgeted(skills, budget, descriptionChars, content) {
     return result;
 }
 /**
- * Each organization skill is a native skill
- * with its full description and its authorized SKILL.md, verified against the
- * digest Den published. A skill whose body could not be read or verified keeps
- * the discovery note, so it still works through get_skill.
+ * Each organization skill is a native skill with its full description. A
+ * skill whose authorized SKILL.md has been read for a message, verified against
+ * the digest Den published, carries it; every other skill keeps the discovery
+ * note, so it still works through get_skill.
  */
 export function nativeSkills(catalog, contents) {
     return budgeted(catalog.skills, NATIVE_BUDGET_CHARS, NATIVE_DESCRIPTION_CHARS, skill => {
@@ -113,15 +116,19 @@ export function mentionedSkillIds(text, skills) {
 }
 /** Setup starts background discovery without making Cloud a dependency of
  * chatting or local skill discovery. Only authorized catalog entries and
- * digest-verified bodies are added to the native registry. */
+ * digest-verified bodies are added to the native registry. Discovery reads
+ * metadata only; a body is read when a message names or attaches its skill. */
 export async function registerCloudSkillDiscovery(context) {
     let skills = [];
+    let catalog = { skills: [] };
     let fingerprint = "[]";
     let closed = false;
     let refreshing = false;
-    // Verified SKILL.md bodies by digest, in memory only. A body is re-read only
-    // when Den publishes a new digest, and dropped as soon as Den stops listing it.
+    // Verified SKILL.md bodies by digest, in memory only, for the warm skills.
+    // A body is re-read only when Den publishes a new digest for one of them.
     const contents = new Map();
+    // Skill IDs messages used, most recent last.
+    const warm = [];
     const controller = new AbortController();
     let registration;
     let promptHook;
@@ -134,44 +141,34 @@ export async function registerCloudSkillDiscovery(context) {
         });
         return response.ok ? await response.json() : null;
     };
-    const loadContents = async (catalog) => {
-        const wanted = new Set(catalog.skills.flatMap(skill => skill.digest && !skill.setup ? [skill.digest] : []));
-        for (const digest of contents.keys())
-            if (!wanted.has(digest))
-                contents.delete(digest);
-        for (const skill of catalog.skills) {
-            if (closed || !skill.digest || !skill.url || skill.setup || contents.has(skill.digest))
-                continue;
-            const result = z.object({ content: z.string() }).safeParse(await call("openwork_skill_read", { url: skill.url }).catch(() => null));
+    /** Read listed skills' bodies in one request and keep those matching Den's digest. */
+    const readBodies = async (entries, use) => {
+        const loadable = entries.filter(skill => skill.url && skill.digest && !skill.setup);
+        if (loadable.length === 0)
+            return;
+        const result = z.object({ contents: z.record(z.string(), z.string()) })
+            .safeParse(await call("openwork_skill_read", { urls: loadable.map(skill => skill.url), ...(use ? { use } : {}) }).catch(() => null));
+        if (!result.success)
+            return;
+        for (const skill of loadable) {
+            const body = result.data.contents[skill.url];
             // Only a body that matches Den's published digest is used.
-            if (result.success && sha256Digest(result.data.content) === skill.digest)
-                contents.set(skill.digest, result.data.content);
+            if (body !== undefined && sha256Digest(body) === skill.digest)
+                contents.set(skill.digest, body);
         }
     };
-    const ensurePromptHook = async () => {
-        if (promptHook || !context.session)
-            return;
-        promptHook = await context.session.hook("prompt", event => {
-            if (skills.length === 0)
-                return;
-            const attached = new Set((event.prompt.skills ?? []).map(skill => skill.id));
-            const mentioned = mentionedSkillIds(event.prompt.text, skills).filter(id => !attached.has(id));
-            if (mentioned.length === 0)
-                return;
-            event.prompt.skills = [...(event.prompt.skills ?? []), ...mentioned.map(id => ({ id }))];
-        });
+    const warmEntries = () => {
+        const listed = new Set(nativeSkills(catalog, contents).map(skill => skill.id));
+        return catalog.skills.filter(skill => warm.includes(skillId(skill)) && listed.has(skillId(skill)));
     };
-    const refresh = async () => {
-        if (closed || refreshing)
-            return;
-        refreshing = true;
-        try {
-            const value = await call("openwork_skills", {});
-            if (value === null)
-                return;
-            const catalog = catalogSchema.parse(value);
-            await loadContents(catalog);
-            await ensurePromptHook();
+    // Registry updates run one at a time, from refreshes and prompts alike.
+    let publishing = Promise.resolve();
+    const publish = () => {
+        publishing = publishing.catch(() => { }).then(async () => {
+            const wanted = new Set(warmEntries().flatMap(skill => skill.digest && !skill.setup ? [skill.digest] : []));
+            for (const digest of contents.keys())
+                if (!wanted.has(digest))
+                    contents.delete(digest);
             const next = nativeSkills(catalog, contents);
             const key = JSON.stringify(next);
             if (closed || key === fingerprint)
@@ -198,6 +195,54 @@ export async function registerCloudSkillDiscovery(context) {
                 await context.skill.reload();
             }
             fingerprint = key;
+        });
+        return publishing;
+    };
+    const ensurePromptHook = async () => {
+        if (promptHook || !context.session)
+            return;
+        promptHook = await context.session.hook("prompt", async (event) => {
+            if (skills.length === 0)
+                return;
+            const attached = new Set((event.prompt.skills ?? []).map(skill => skill.id));
+            const mentioned = mentionedSkillIds(event.prompt.text, skills).filter(id => !attached.has(id));
+            if (mentioned.length)
+                event.prompt.skills = [...(event.prompt.skills ?? []), ...mentioned.map(id => ({ id }))];
+            // Only registered skills: an unlisted ID never costs a read.
+            const registered = new Set(skills.map(skill => skill.id));
+            const used = new Set([...attached, ...mentioned].filter(id => registered.has(id)));
+            const entries = catalog.skills.filter(skill => used.has(skillId(skill)));
+            if (entries.length === 0)
+                return;
+            try {
+                // Freshly authorized for this message, and counted by Den as a use.
+                // A body that cannot be read leaves the discovery note: get_skill still works.
+                await readBodies(entries, true);
+                for (const skill of entries) {
+                    const id = skillId(skill);
+                    warm.splice(0, warm.length, ...warm.filter(entry => entry !== id), id);
+                }
+                warm.splice(0, Math.max(0, warm.length - MAX_WARM_SKILLS));
+                await publish();
+            }
+            catch {
+                // A message is never held back by Cloud skill loading.
+            }
+        });
+    };
+    const refresh = async () => {
+        if (closed || refreshing)
+            return;
+        refreshing = true;
+        try {
+            const value = await call("openwork_skills", {});
+            if (value === null)
+                return;
+            catalog = catalogSchema.parse(value);
+            // Only warm skills whose digest changed are read again.
+            await readBodies(warmEntries().filter(skill => skill.digest && !contents.has(skill.digest)), false);
+            await ensurePromptHook();
+            await publish();
         }
         catch {
             // Cloud readiness is never a prerequisite to chatting. Discovery entries
@@ -216,6 +261,7 @@ export async function registerCloudSkillDiscovery(context) {
         controller.abort();
         skills = [];
         contents.clear();
+        await publishing.catch(() => { });
         await promptHook?.dispose();
         await registration?.dispose();
     };

package/dist/opencode-plugins/openwork-context-v2.js

@@ -13813,6 +13813,7 @@ var MAX_SKILLS = 150;
 var NATIVE_BUDGET_CHARS = 64000;
 var NATIVE_DESCRIPTION_CHARS = 1024;
 var MAX_MENTIONED_SKILLS = 3;
+var MAX_WARM_SKILLS = 8;
 var skillId = (skill) => `${CLOUD_SKILL_ID_PREFIX}${skill.name}`;
 var skillPath = (skill) => `/openwork/remote-skills/${skill.name}.md`;
 function discoveryContent(skill) {
@@ -13890,10 +13891,12 @@ function mentionedSkillIds(text2, skills) {
 }
 async function registerCloudSkillDiscovery(context) {
   let skills = [];
+  let catalog = { skills: [] };
   let fingerprint = "[]";
   let closed = false;
   let refreshing = false;
   const contents = new Map;
+  const warm = [];
   const controller = new AbortController;
   let registration;
   let promptHook;
@@ -13907,43 +13910,30 @@ async function registerCloudSkillDiscovery(context) {
     });
     return response.ok ? await response.json() : null;
   };
-  const loadContents = async (catalog) => {
-    const wanted = new Set(catalog.skills.flatMap((skill) => skill.digest && !skill.setup ? [skill.digest] : []));
-    for (const digest of contents.keys())
-      if (!wanted.has(digest))
-        contents.delete(digest);
-    for (const skill of catalog.skills) {
-      if (closed || !skill.digest || !skill.url || skill.setup || contents.has(skill.digest))
-        continue;
-      const result = exports_external.object({ content: exports_external.string() }).safeParse(await call("openwork_skill_read", { url: skill.url }).catch(() => null));
-      if (result.success && sha256Digest(result.data.content) === skill.digest)
-        contents.set(skill.digest, result.data.content);
-    }
-  };
-  const ensurePromptHook = async () => {
-    if (promptHook || !context.session)
+  const readBodies = async (entries, use) => {
+    const loadable = entries.filter((skill) => skill.url && skill.digest && !skill.setup);
+    if (loadable.length === 0)
       return;
-    promptHook = await context.session.hook("prompt", (event) => {
-      if (skills.length === 0)
-        return;
-      const attached = new Set((event.prompt.skills ?? []).map((skill) => skill.id));
-      const mentioned = mentionedSkillIds(event.prompt.text, skills).filter((id) => !attached.has(id));
-      if (mentioned.length === 0)
-        return;
-      event.prompt.skills = [...event.prompt.skills ?? [], ...mentioned.map((id) => ({ id }))];
-    });
-  };
-  const refresh = async () => {
-    if (closed || refreshing)
+    const result = exports_external.object({ contents: exports_external.record(exports_external.string(), exports_external.string()) }).safeParse(await call("openwork_skill_read", { urls: loadable.map((skill) => skill.url), ...use ? { use } : {} }).catch(() => null));
+    if (!result.success)
       return;
-    refreshing = true;
-    try {
-      const value = await call("openwork_skills", {});
-      if (value === null)
-        return;
-      const catalog = catalogSchema.parse(value);
-      await loadContents(catalog);
-      await ensurePromptHook();
+    for (const skill of loadable) {
+      const body = result.data.contents[skill.url];
+      if (body !== undefined && sha256Digest(body) === skill.digest)
+        contents.set(skill.digest, body);
+    }
+  };
+  const warmEntries = () => {
+    const listed = new Set(nativeSkills(catalog, contents).map((skill) => skill.id));
+    return catalog.skills.filter((skill) => warm.includes(skillId(skill)) && listed.has(skillId(skill)));
+  };
+  let publishing = Promise.resolve();
+  const publish = () => {
+    publishing = publishing.catch(() => {}).then(async () => {
+      const wanted = new Set(warmEntries().flatMap((skill) => skill.digest && !skill.setup ? [skill.digest] : []));
+      for (const digest of contents.keys())
+        if (!wanted.has(digest))
+          contents.delete(digest);
       const next = nativeSkills(catalog, contents);
       const key = JSON.stringify(next);
       if (closed || key === fingerprint)
@@ -13968,6 +13958,47 @@ async function registerCloudSkillDiscovery(context) {
         await context.skill.reload();
       }
       fingerprint = key;
+    });
+    return publishing;
+  };
+  const ensurePromptHook = async () => {
+    if (promptHook || !context.session)
+      return;
+    promptHook = await context.session.hook("prompt", async (event) => {
+      if (skills.length === 0)
+        return;
+      const attached = new Set((event.prompt.skills ?? []).map((skill) => skill.id));
+      const mentioned = mentionedSkillIds(event.prompt.text, skills).filter((id) => !attached.has(id));
+      if (mentioned.length)
+        event.prompt.skills = [...event.prompt.skills ?? [], ...mentioned.map((id) => ({ id }))];
+      const registered = new Set(skills.map((skill) => skill.id));
+      const used = new Set([...attached, ...mentioned].filter((id) => registered.has(id)));
+      const entries = catalog.skills.filter((skill) => used.has(skillId(skill)));
+      if (entries.length === 0)
+        return;
+      try {
+        await readBodies(entries, true);
+        for (const skill of entries) {
+          const id = skillId(skill);
+          warm.splice(0, warm.length, ...warm.filter((entry) => entry !== id), id);
+        }
+        warm.splice(0, Math.max(0, warm.length - MAX_WARM_SKILLS));
+        await publish();
+      } catch {}
+    });
+  };
+  const refresh = async () => {
+    if (closed || refreshing)
+      return;
+    refreshing = true;
+    try {
+      const value = await call("openwork_skills", {});
+      if (value === null)
+        return;
+      catalog = catalogSchema.parse(value);
+      await readBodies(warmEntries().filter((skill) => skill.digest && !contents.has(skill.digest)), false);
+      await ensurePromptHook();
+      await publish();
     } catch {} finally {
       refreshing = false;
     }
@@ -13981,6 +14012,7 @@ async function registerCloudSkillDiscovery(context) {
     controller.abort();
     skills = [];
     contents.clear();
+    await publishing.catch(() => {});
     await promptHook?.dispose();
     await registration?.dispose();
   };

package/dist/opencode-plugins/openwork-gateway-quota-v2.js

@@ -13739,6 +13739,138 @@ function hasGatewayUsageLimitHttpMarker(response) {
   return response.status === 429 && response.headers.get("X-OpenWork-Error-Code") === GATEWAY_USAGE_LIMIT_ERROR_CODE && response.headers.get("X-OpenWork-Usage-State") === "blocked";
 }
 
+// ../../packages/types/src/den/inference.ts
+var INFERENCE_WINDOW_DURATIONS_MS = {
+  five_hour: 5 * 60 * 60 * 1000,
+  weekly: 7 * 24 * 60 * 60 * 1000,
+  monthly: 30 * 24 * 60 * 60 * 1000
+};
+var OPENWORK_MODELS_ALLOWANCE_ERROR_CODE = "openwork_models_allowance_reached";
+var OPENWORK_MODELS_ALLOWANCE_SOURCE = "openwork_models";
+var OPENWORK_MODELS_ALLOWANCE_MESSAGE = "Your workspace used its OpenWork Models allowance.";
+function openWorkModelsAllowanceErrorBody() {
+  return {
+    error: {
+      message: OPENWORK_MODELS_ALLOWANCE_MESSAGE,
+      type: "usage_limit_error",
+      param: null,
+      code: OPENWORK_MODELS_ALLOWANCE_ERROR_CODE,
+      source: OPENWORK_MODELS_ALLOWANCE_SOURCE
+    }
+  };
+}
+function hasOpenWorkModelsAllowanceHttpMarker(response) {
+  return response.status === 429 && response.headers.get("X-OpenWork-Error-Code") === OPENWORK_MODELS_ALLOWANCE_ERROR_CODE && response.headers.get("X-OpenWork-Usage-State") === "blocked";
+}
+var INFERENCE_ACCESS_REASONS = [
+  "admin_disabled",
+  "not_eligible",
+  "free_disabled",
+  "accounting_unavailable",
+  "free_allowance_exhausted",
+  "upstream_unavailable"
+];
+var freeInferenceProviderSummarySchema = exports_external.object({
+  state: exports_external.enum(["available", "disabled", "unavailable"]),
+  reason: exports_external.union([exports_external.enum(INFERENCE_ACCESS_REASONS), exports_external.null()]),
+  defaultPinned: exports_external.boolean(),
+  modelGroup: exports_external.object({ id: exports_external.literal("free"), name: exports_external.literal("Free") }),
+  catalog: exports_external.array(exports_external.object({ modelID: exports_external.string(), displayName: exports_external.string(), providerName: exports_external.string(), summary: exports_external.string(), recommended: exports_external.boolean(), rank: exports_external.number(), capabilities: exports_external.array(exports_external.string()) })),
+  allowance: exports_external.object({
+    usageScope: exports_external.literal("organization"),
+    allowanceScope: exports_external.literal("person"),
+    windowStartAt: exports_external.string().datetime(),
+    resetsAt: exports_external.string().datetime(),
+    weeklyLimitUsd: exports_external.number().finite().nonnegative(),
+    joinedMembers: exports_external.number().int().nonnegative(),
+    eligibleMembers: exports_external.number().int().nonnegative(),
+    exhaustedMembers: exports_external.number().int().nonnegative().nullable().describe("Current eligible members whose recorded weekly usage has reached their person-wide limit; not a probe of Gateway request headroom. Null when accounting cannot be verified."),
+    usedUsd: exports_external.number().finite().nonnegative().nullable(),
+    requestCount: exports_external.number().int().nonnegative().nullable()
+  })
+});
+var inferenceApiKeyMapSecretSchema = exports_external.record(exports_external.string(), exports_external.string()).refine((value) => Object.keys(value).length > 0, {
+  message: "api_key_map must contain at least one entry"
+});
+var inferenceAwsKeysSecretSchema = exports_external.object({
+  accessKeyId: exports_external.string().min(1),
+  secretAccessKey: exports_external.string().min(1),
+  sessionToken: exports_external.string().min(1).optional(),
+  region: exports_external.string().min(1).optional()
+});
+var inferenceGcpServiceAccountSecretSchema = exports_external.looseObject({
+  client_email: exports_external.string().min(1),
+  private_key: exports_external.string().min(1),
+  token_uri: exports_external.string().min(1)
+});
+var authorizationRevisionSchema = exports_external.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var microsoftTenantIdSchema = exports_external.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+var inferenceOauthTokenSecretSchema = exports_external.object({
+  accessToken: exports_external.string().min(1),
+  refreshToken: exports_external.string().min(1).optional(),
+  tokenType: exports_external.string().min(1).optional(),
+  googleIdentity: exports_external.object({
+    subject: exports_external.string().min(1).max(255),
+    email: exports_external.email(),
+    emailVerified: exports_external.literal(true),
+    clientId: exports_external.string().min(1),
+    authorizationRevision: authorizationRevisionSchema.optional()
+  }).optional(),
+  microsoftIdentity: exports_external.object({
+    tenantId: microsoftTenantIdSchema,
+    objectId: exports_external.string().min(1).max(255),
+    userName: exports_external.string().min(1).max(320).nullable(),
+    clientId: exports_external.string().min(1),
+    authorizationRevision: authorizationRevisionSchema
+  }).optional()
+});
+var awsAccountIdSchema = exports_external.string().regex(/^\d{12}$/);
+var awsPermissionSetNameSchema = exports_external.string().regex(/^[\w+=,.@-]{1,32}$/);
+var awsSsoStartUrlSchema = exports_external.string().max(2048).refine((value) => {
+  try {
+    const url2 = new URL(value);
+    return url2.protocol === "https:" && !url2.username && !url2.password && !url2.search && !url2.hash && !url2.port && /^[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:awsapps\.com|app\.aws)$/i.test(url2.hostname);
+  } catch {
+    return false;
+  }
+}, { message: "Use the AWS access portal URL, for example https://d-xxxxxxxxxx.awsapps.com/start." });
+var awsRegionSchema = exports_external.string().max(32).regex(/^[a-z]{2}(?:-[a-z]+)+-\d{1,2}$/);
+var gatewayAwsSsoSettingsSchema = exports_external.object({
+  startUrl: awsSsoStartUrlSchema,
+  region: awsRegionSchema,
+  accountId: awsAccountIdSchema,
+  roleName: awsPermissionSetNameSchema
+}).strict();
+var inferenceAwsSsoSecretSchema = exports_external.object({
+  accessToken: exports_external.string().min(1).max(16384),
+  refreshToken: exports_external.string().min(1).max(16384),
+  clientId: exports_external.string().min(1).max(4096),
+  clientSecret: exports_external.string().min(1).max(16384),
+  clientSecretExpiresAt: exports_external.number().int().positive(),
+  sso: gatewayAwsSsoSettingsSchema,
+  identity: exports_external.object({
+    arn: exports_external.string().min(1).max(2048),
+    userName: exports_external.string().min(1).max(320).nullable(),
+    authorizationRevision: authorizationRevisionSchema
+  })
+});
+var GATEWAY_MEMBER_SIGN_IN_METHODS = ["google", "aws_sso", "microsoft"];
+var gatewayMemberConnectionsResponseSchema = exports_external.object({
+  connections: exports_external.array(exports_external.object({
+    providerId: exports_external.string(),
+    signInMethod: exports_external.enum(GATEWAY_MEMBER_SIGN_IN_METHODS).default("google"),
+    credentialSetId: exports_external.string(),
+    providerName: exports_external.string(),
+    name: exports_external.string(),
+    ready: exports_external.boolean(),
+    hasAccess: exports_external.boolean(),
+    hasCredential: exports_external.boolean(),
+    configurationRequired: exports_external.boolean().default(false),
+    authorizationRevision: exports_external.string().nullable(),
+    accountEmail: exports_external.string().nullable()
+  }))
+});
+
 // src/gateway-quota.ts
 var GATEWAY_QUOTA_MESSAGE = "You have reached your AI Gateway usage limit.";
 var MAX_ERROR_BYTES = 16384;
@@ -13761,6 +13893,61 @@ function gatewayBase(id, baseURL) {
     return;
   }
 }
+function openWorkModelsBase(id, baseURL) {
+  if (id !== "openwork" || typeof baseURL !== "string")
+    return;
+  try {
+    const url2 = new URL(baseURL);
+    if (!["https:", "http:"].includes(url2.protocol) || url2.username || url2.password || url2.search || url2.hash)
+      return;
+    url2.pathname = url2.pathname.replace(/\/+$/, "");
+    if (!url2.pathname.endsWith("/api/v1"))
+      return;
+    return url2;
+  } catch {
+    return;
+  }
+}
+async function isOpenWorkModelsAllowanceResponse(base, url2, response) {
+  if (url2.origin !== base.origin || !url2.pathname.startsWith(`${base.pathname}/`) || response.url && new URL(response.url).origin !== base.origin || !hasOpenWorkModelsAllowanceHttpMarker(response))
+    return false;
+  const body = await readBoundedJson(response);
+  return record2(body) && record2(body.error) && body.error.code === OPENWORK_MODELS_ALLOWANCE_ERROR_CODE && body.error.source === OPENWORK_MODELS_ALLOWANCE_SOURCE;
+}
+async function readBoundedJson(response) {
+  const reader = response.clone().body?.getReader();
+  if (!reader)
+    return null;
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(null), BODY_TIMEOUT_MS);
+  });
+  const read = async () => {
+    let size = 0;
+    let text = "";
+    const decoder = new TextDecoder;
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > MAX_ERROR_BYTES)
+        return null;
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    return JSON.parse(text + decoder.decode());
+  };
+  try {
+    return await Promise.race([read(), expired]);
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+    reader.cancel().catch(() => {
+      return;
+    });
+  }
+}
 async function isGatewayQuotaResponse(base, url2, response) {
   if (url2.origin !== base.origin || !url2.pathname.startsWith(`${base.pathname}/`) || response.url && new URL(response.url).origin !== base.origin || !hasGatewayUsageLimitHttpMarker(response))
     return false;