[RaviTharuma]

Summary

Native gemini-embedding-2 is registered in OmniRoute, but a host without a Google AI Studio key on the gemini provider returns a dead-end 400. OpenRouter already serves the same model. This PR only improves that 400 (and the unknown-google 400) so operators are told the working ids.

This does not add a Gemini API key. Native gemini-embedding-2 still needs a gemini connection (secrets-only / dashboard). See the secrets note at the bottom.

Live evidence (re-verified 2026-08-17, OmniRoute 3.8.49)

Endpoint: https://<omniroute-host>/v1/embeddings
Clients that break: Hindsight 0.9.1 and Memorix 1.6.0 if they are pointed at bare gemini-embedding-2 / gemini/gemini-embedding-2.

Actual — native id

Request:

{ "model": "gemini-embedding-2", "input": ["alpha", "beta"] }

HTTP 400

{
  "error": {
    "message": "No credentials for embedding provider: gemini",
    "type": "invalid_request_error",
    "code": "bad_request"
  }
}

gemini/gemini-embedding-2 is the same 400.

google/gemini-embedding-2 is HTTP 400:

{
  "error": {
    "message": "Unknown embedding provider: google. No matching hardcoded or local provider found.",
    "type": "invalid_request_error",
    "code": "bad_request"
  }
}

Actual — working OpenRouter ids (same host, OpenRouter configured)

openrouter/google/gemini-embedding-2 → HTTP 200, 2 vectors, 3072-d, batch 2→2.
openrouter/google/gemini-embedding-2-preview → HTTP 200, 2 vectors, 3072-d.

Expected after this PR

Same HTTP 400, but the message names:

• openrouter/google/gemini-embedding-2
• openrouter/google/gemini-embedding-2-preview
• and that a Google AI Studio key on the gemini provider is required for gemini/gemini-embedding-2

Unrelated providers keep the short message (existing route-edge-coverage regex still matches).

Repro (redact the bearer)

curl -sS https://omniroute.example/v1/embeddings \
  -H "Authorization: Bearer $OMNIROUTE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gemini-embedding-2","input":["alpha","beta"]}'

curl -sS https://omniroute.example/v1/embeddings \
  -H "Authorization: Bearer $OMNIROUTE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"openrouter/google/gemini-embedding-2","input":["alpha","beta"]}'

Secrets-only (cannot ship in this PR)

Making native gemini-embedding-2 return 200 requires a Google AI Studio key stored as a gemini provider connection (dashboard or imported GEMINI_API_KEY). That secret is not in git. Homelab omniroute-secrets currently injects JINA_AI_API_KEY, not a Gemini embed key.

Related Issues

• Related to feat(api): support secure multimodal input items in /v1/embeddings #7956 / fix(embeddings): support secure multimodal inputs #7978 (multimodal embeddings already landed; this is the credential 400)
• Sibling PRs: catalog registration of the OpenRouter ids; embeddings client runbook

Validation

• node --import tsx/esm --test tests/unit/embeddings-gemini-creds-hint.test.ts (4 pass)
• node --import tsx/esm --test tests/unit/route-edge-coverage.test.ts (16 pass)

Tests Added Or Updated

• tests/unit/embeddings-gemini-creds-hint.test.ts

Coverage Notes

• New helper src/lib/embeddings/errors.ts is fully covered by the new unit file.
• src/lib/embeddings/service.ts now calls those helpers on the existing 400 paths; route-edge-coverage still exercises missing-credentials / unknown-provider.

Reviewer Notes

• No credential fallback / silent OpenRouter rewrite. Operators must change the model id or add a Gemini key.
• google is not aliased to gemini globally — a custom provider_node with prefix google already exists in tests (auth-clear-provider-routes).

Made with Cursor

[diegosouzapw]

Clean, focused fix -- the error-hint tests cover both the Gemini-specific case and confirm unrelated providers keep their short message. Verified no conflict with the other PRs in this batch. Merging as-is; the base-branch CI reds (Docs Gates, Fast Quality Gates, Unit Tests fast-path) are pre-existing release-tip drift unrelated to this diff.