.

Author: Wundercorp

LOCAL.md

@@ -231,7 +231,7 @@ curl http://127.0.0.1:8787/health
 curl http://127.0.0.1:8787/v1/gateways
 ```
 
-The protected endpoints continue to validate real RS256 access tokens from the configured issuer. For Cognito, set `AUTH_AUDIENCE` to the generated app client ID and obtain an access token whose `client_id` matches that value:
+The protected endpoints continue to validate real RS256 access tokens from the configured issuer. For Cognito, set `AUTH_AUDIENCE` to the same generated app client ID used by the web application and obtain an access token whose `client_id` matches that value. After changing the app client ID, sign out and sign in again so the browser does not reuse a token from the previous client:
 
 ```bash
 curl http://127.0.0.1:8787/v1/me \

README.md

@@ -52,21 +52,26 @@ om pull ollama://qwen2.5:3b
 om run qwen2.5:3b "Explain gateway interoperability."
 ```
 
-Start a local API:
+Start the local API. A default model is optional, so the dashboard can connect before anything is installed:
 
 ```bash
-om serve tinyllama --port 11435
+om serve --port 11435
 curl http://127.0.0.1:11435/v1/models
 ```
 
 The local server supports:
 
 - `GET /health`
 - `GET /v1/models`
+- `GET /v1/model-catalog`
+- `POST /v1/models/install`
+- `GET /v1/model-installs/:jobId`
 - `POST /v1/chat/completions`
 - `GET /api/tags`
 - `POST /api/generate`
 
+The authenticated web dashboard uses the catalog and install-job endpoints for a one-click starter-model download with local progress reporting. Installation requests are restricted to configured browser origins.
+
 ## Gateway interoperability
 
 Gateways normalize external model catalogs and artifact sources into a stable descriptor. Runtimes are separate from gateways, so one gateway can feed multiple local runtimes and one runtime can execute models from multiple gateways.

apps/aws-api/package.json

@@ -4,9 +4,10 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "build": "esbuild src/index.mjs --bundle --platform=node --target=node22 --format=esm --outfile=dist/index.mjs",
+    "build": "esbuild src/index.mjs --bundle --platform=node --target=node22 --format=esm --banner:js=\"import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);\" --outfile=dist/index.mjs",
     "check": "node --check src/index.mjs",
-    "test": "node --test"
+    "test": "node --test",
+    "test:bundle": "node scripts/bundle-smoke.mjs"
   },
   "dependencies": {
     "@aws-sdk/client-dynamodb": "3.1084.0",

apps/aws-api/scripts/bundle-smoke.mjs

@@ -0,0 +1,33 @@
+import assert from 'node:assert/strict';
+
+process.env.ALLOWED_ORIGINS = 'https://openmodel.sh';
+delete process.env.GATEWAY_REGISTRY_TABLE;
+
+const bundleUrl = new URL(`../dist/index.mjs?smoke=${Date.now()}`, import.meta.url);
+const { handler } = await import(bundleUrl.href);
+
+const healthResponse = await handler({
+  rawPath: '/health',
+  headers: { origin: 'https://openmodel.sh' },
+  requestContext: { http: { method: 'GET' } }
+});
+
+assert.equal(healthResponse.statusCode, 200);
+assert.deepEqual(JSON.parse(healthResponse.body), {
+  status: 'ok',
+  service: 'openmodel-aws-api'
+});
+
+const gatewayResponse = await handler({
+  rawPath: '/v1/gateways',
+  headers: { origin: 'https://openmodel.sh' },
+  requestContext: { http: { method: 'GET' } }
+});
+
+assert.equal(gatewayResponse.statusCode, 200);
+assert.deepEqual(
+  JSON.parse(gatewayResponse.body).data.map((gateway) => gateway.id),
+  ['huggingface', 'direct', 'ollama']
+);
+
+console.log('Bundled Lambda smoke test passed.');

apps/aws-api/src/index.mjs

@@ -84,20 +84,21 @@ async function authenticate(authorizationHeader) {
     throw new HttpError(401, 'Token issuer did not match.');
   }
 
-  const expectedAudiences = requireEnvironmentVariable('AUTH_AUDIENCE')
+  if (payload.token_use && payload.token_use !== 'access') {
+    throw new HttpError(401, 'An access token is required.');
+  }
+
+  const expectedClientIds = requireEnvironmentVariable('AUTH_AUDIENCE')
     .split(',')
     .map((value) => value.trim())
     .filter(Boolean);
-  const presentedAudiences = [
-    ...(Array.isArray(payload.aud) ? payload.aud : [payload.aud]),
-    payload.client_id,
-    payload.azp
-  ].filter((value) => typeof value === 'string');
-  if (!expectedAudiences.some((expectedAudience) => presentedAudiences.includes(expectedAudience))) {
-    throw new HttpError(401, 'Token client or audience did not match.');
-  }
-  if (payload.token_use && payload.token_use !== 'access') {
-    throw new HttpError(401, 'An access token is required.');
+  const presentedClientId = typeof payload.client_id === 'string'
+    ? payload.client_id
+    : typeof payload.azp === 'string'
+      ? payload.azp
+      : undefined;
+  if (!presentedClientId || !expectedClientIds.includes(presentedClientId)) {
+    throw new HttpError(401, 'Token was issued for a different Cognito app client. Sign out and sign in again.');
   }
 
   const currentUnixTime = Math.floor(Date.now() / 1000);

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wundercorp/openmodel",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Download, run, and serve local AI models through a gateway-first CLI with OpenAI- and Ollama-compatible APIs.",
   "type": "module",
   "bin": {

apps/cli/src/index.js

@@ -1,10 +1,9 @@
-import path from 'node:path';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { parseArgs, getFlag } from './lib/args.js';
 import { getPaths } from './lib/paths.js';
-import { downloadArtifact } from './lib/download.js';
 import { readConfig, writeConfig } from './lib/config.js';
-import { findManifest, listManifests, removeManifest, safeModelId, saveManifest, setAlias } from './lib/model-store.js';
+import { installModel } from './lib/install-model.js';
+import { findManifest, listManifests, removeManifest } from './lib/model-store.js';
 import { loadGateways, resolveReference } from './gateways/registry.js';
 import { selectRuntime, runtimes } from './runtimes/index.js';
 import { startLocalServer } from './server/http.js';
@@ -57,20 +56,10 @@ export async function main(argv) {
 async function pullCommand(positionals, flags) {
   const reference = positionals[0];
   if (!reference) throw new Error('Usage: om pull <reference> [--alias name]');
-  const { gateway, model } = await resolveReference(reference);
-  const paths = getPaths();
-  const modelDirectory = path.join(paths.models, safeModelId(model.id));
-  await mkdir(modelDirectory, { recursive: true });
-  const artifactPaths = [];
-  for (const artifact of model.artifacts) artifactPaths.push(await downloadArtifact(artifact, modelDirectory));
-  if (model.native?.runtime === 'ollama') {
-    const runtime = runtimes.find((candidate) => candidate.id === 'ollama');
-    if (!(await runtime.available())) throw new Error('Ollama is required for ollama:// references.');
-    await runtime.pull(model.native.model);
-  }
-  const manifest = await saveManifest(model, gateway.id, artifactPaths);
   const alias = getFlag(flags, 'alias');
-  if (alias) await setAlias(String(alias), manifest.storedId);
+  const manifest = await installModel(reference, {
+    alias: alias ? String(alias) : undefined
+  });
   process.stdout.write(`Installed ${manifest.storedId}${alias ? ` as ${alias}` : ''}.\n`);
 }
 

apps/cli/src/lib/download.js

@@ -5,47 +5,154 @@ import path from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import { Readable, Transform } from 'node:stream';
 
-export async function downloadArtifact(artifact, destinationDirectory, signal) {
+export async function downloadArtifact(artifact, destinationDirectory, options = {}) {
+  const normalizedOptions = normalizeDownloadOptions(options);
+  const signal = normalizedOptions.signal;
+  const onProgress = normalizedOptions.onProgress;
   await mkdir(destinationDirectory, { recursive: true });
   const destinationPath = path.join(destinationDirectory, artifact.fileName);
   const temporaryPath = `${destinationPath}.partial`;
   let offset = 0;
-  try { offset = (await stat(temporaryPath)).size; } catch {}
+  try {
+    offset = (await stat(temporaryPath)).size;
+  } catch {}
+
   const headers = { ...artifact.headers };
-  if (offset > 0) headers.Range = `bytes=${offset}-`;
+  if (offset > 0) {
+    headers.Range = `bytes=${offset}-`;
+  }
+
   const response = await fetch(artifact.url, { headers, signal, redirect: 'follow' });
-  if (!response.ok && response.status !== 206) throw new Error(`Download failed with HTTP ${response.status} for ${artifact.url}`);
-  if (!response.body) throw new Error(`Download returned no body for ${artifact.url}`);
+  if (!response.ok && response.status !== 206) {
+    throw new Error(`Download failed with HTTP ${response.status} for ${artifact.url}`);
+  }
+  if (!response.body) {
+    throw new Error(`Download returned no body for ${artifact.url}`);
+  }
+
   const append = response.status === 206 && offset > 0;
   if (!append) {
     offset = 0;
     await rm(temporaryPath, { force: true });
   }
-  let received = offset;
-  let lastPrinted = 0;
-  const progress = new Transform({
+
+  const totalBytes = readTotalBytes(response, offset);
+  let receivedBytes = offset;
+  let lastReportedAt = 0;
+  reportProgress(onProgress, {
+    type: 'download-start',
+    fileName: artifact.fileName,
+    receivedBytes,
+    totalBytes,
+    progress: calculateProgress(receivedBytes, totalBytes),
+    message: `Downloading ${artifact.fileName}.`
+  });
+
+  const progressTransform = new Transform({
     transform(chunk, encoding, callback) {
-      received += chunk.length;
-      if (Date.now() - lastPrinted > 500) {
-        process.stderr.write(`\rDownloading ${artifact.fileName}: ${(received / 1024 / 1024).toFixed(1)} MiB`);
-        lastPrinted = Date.now();
+      receivedBytes += chunk.length;
+      const currentTime = Date.now();
+      if (currentTime - lastReportedAt >= 150) {
+        reportProgress(onProgress, {
+          type: 'download-progress',
+          fileName: artifact.fileName,
+          receivedBytes,
+          totalBytes,
+          progress: calculateProgress(receivedBytes, totalBytes),
+          message: `Downloading ${artifact.fileName}.`
+        });
+        if (!onProgress) {
+          process.stderr.write(`\rDownloading ${artifact.fileName}: ${(receivedBytes / 1024 / 1024).toFixed(1)} MiB`);
+        }
+        lastReportedAt = currentTime;
       }
       callback(null, chunk);
     }
   });
-  await pipeline(Readable.fromWeb(response.body), progress, createWriteStream(temporaryPath, { flags: append ? 'a' : 'w' }));
-  process.stderr.write(`\rDownloading ${artifact.fileName}: ${(received / 1024 / 1024).toFixed(1)} MiB\n`);
+
+  await pipeline(
+    Readable.fromWeb(response.body),
+    progressTransform,
+    createWriteStream(temporaryPath, { flags: append ? 'a' : 'w' })
+  );
+
+  if (!onProgress) {
+    process.stderr.write(`\rDownloading ${artifact.fileName}: ${(receivedBytes / 1024 / 1024).toFixed(1)} MiB\n`);
+  }
+
+  reportProgress(onProgress, {
+    type: 'download-complete',
+    fileName: artifact.fileName,
+    receivedBytes,
+    totalBytes: totalBytes ?? receivedBytes,
+    progress: 100,
+    message: `Downloaded ${artifact.fileName}.`
+  });
+
   if (artifact.sha256) {
+    reportProgress(onProgress, {
+      type: 'verifying',
+      fileName: artifact.fileName,
+      receivedBytes,
+      totalBytes: totalBytes ?? receivedBytes,
+      progress: 100,
+      message: `Verifying ${artifact.fileName}.`
+    });
     const digest = await hashFile(temporaryPath);
     if (digest !== artifact.sha256) {
       await rm(temporaryPath, { force: true });
       throw new Error(`SHA-256 mismatch for ${artifact.fileName}.`);
     }
   }
+
   await rename(temporaryPath, destinationPath);
   return destinationPath;
 }
 
+function normalizeDownloadOptions(options) {
+  if (
+    options &&
+    typeof options === 'object' &&
+    typeof options.aborted === 'boolean' &&
+    typeof options.addEventListener === 'function'
+  ) {
+    return { signal: options, onProgress: undefined };
+  }
+
+  return {
+    signal: options?.signal,
+    onProgress: typeof options?.onProgress === 'function' ? options.onProgress : undefined
+  };
+}
+
+function readTotalBytes(response, offset) {
+  const contentRange = response.headers.get('content-range');
+  const contentRangeMatch = contentRange?.match(/\/([0-9]+)$/);
+  if (contentRangeMatch) {
+    return Number(contentRangeMatch[1]);
+  }
+
+  const contentLength = Number(response.headers.get('content-length'));
+  if (!Number.isFinite(contentLength) || contentLength <= 0) {
+    return undefined;
+  }
+
+  return offset + contentLength;
+}
+
+function calculateProgress(receivedBytes, totalBytes) {
+  if (!Number.isFinite(totalBytes) || totalBytes <= 0) {
+    return 0;
+  }
+  return Math.min(100, (receivedBytes / totalBytes) * 100);
+}
+
+function reportProgress(onProgress, event) {
+  if (onProgress) {
+    onProgress(event);
+  }
+}
+
 async function hashFile(filePath) {
   const hash = createHash('sha256');
   await pipeline(createReadStream(filePath), hash);