@aryee337/aery-ai 0.1.148 → 0.2.10

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -0,0 +1,412 @@
+/**
+ * Zod schemas for the auth-broker wire protocol.
+ *
+ * Shared between the server (validates inbound request bodies) and the client
+ * (validates responses from the broker). Schemas mirror the TypeScript types
+ * in `./types.ts` 1:1; the types remain the source of truth for static typing,
+ * and `z.infer<typeof Schema>` is asserted-compatible with them where possible.
+ *
+ * Schemas use `.strict()` on objects with a closed set of fields so unknown
+ * keys are rejected — the previous implementation used a hand-rolled
+ * `hasOnlyFields` allowlist for the same effect.
+ */
+import * as z from "zod/v4";
+/** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */
+export declare const oauthCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    refresh: z.ZodString;
+    access: z.ZodString;
+    expires: z.ZodNumber;
+    enterpriseUrl: z.ZodOptional<z.ZodString>;
+    projectId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** OAuth credential as it appears in broker snapshots — refresh replaced with sentinel. */
+export declare const remoteOauthCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    access: z.ZodString;
+    expires: z.ZodNumber;
+    enterpriseUrl: z.ZodOptional<z.ZodString>;
+    projectId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    refresh: z.ZodLiteral<"__remote__">;
+}, z.core.$strict>;
+export declare const apiKeyCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"api_key">;
+    key: z.ZodString;
+}, z.core.$strict>;
+/** Discriminated union accepted on POST /v1/credential (writes). */
+export declare const writableAuthCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    refresh: z.ZodString;
+    access: z.ZodString;
+    expires: z.ZodNumber;
+    enterpriseUrl: z.ZodOptional<z.ZodString>;
+    projectId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"api_key">;
+    key: z.ZodString;
+}, z.core.$strict>], "type">;
+/** Discriminated union returned in snapshots (refresh is sentinel for OAuth). */
+export declare const snapshotCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    access: z.ZodString;
+    expires: z.ZodNumber;
+    enterpriseUrl: z.ZodOptional<z.ZodString>;
+    projectId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    refresh: z.ZodLiteral<"__remote__">;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"api_key">;
+    key: z.ZodString;
+}, z.core.$strict>], "type">;
+export declare const credentialSnapshotEntrySchema: z.ZodObject<{
+    id: z.ZodNumber;
+    provider: z.ZodString;
+    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"oauth">;
+        access: z.ZodString;
+        expires: z.ZodNumber;
+        enterpriseUrl: z.ZodOptional<z.ZodString>;
+        projectId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        accountId: z.ZodOptional<z.ZodString>;
+        refresh: z.ZodLiteral<"__remote__">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        key: z.ZodString;
+    }, z.core.$strict>], "type">;
+    identityKey: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const snapshotEntrySchema: z.ZodObject<{
+    id: z.ZodNumber;
+    provider: z.ZodString;
+    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"oauth">;
+        access: z.ZodString;
+        expires: z.ZodNumber;
+        enterpriseUrl: z.ZodOptional<z.ZodString>;
+        projectId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        accountId: z.ZodOptional<z.ZodString>;
+        refresh: z.ZodLiteral<"__remote__">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        key: z.ZodString;
+    }, z.core.$strict>], "type">;
+    identityKey: z.ZodNullable<z.ZodString>;
+    rotatesInMs: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const refresherScheduleSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    intervalMs: z.ZodNumber;
+    skewMs: z.ZodNumber;
+    nextSweepInMs: z.ZodNumber;
+}, z.core.$strict>;
+export declare const snapshotResponseSchema: z.ZodObject<{
+    generation: z.ZodNumber;
+    generatedAt: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** First frame on connect — full snapshot embedded inline with a `kind` tag. */
+export declare const snapshotStreamSnapshotEventSchema: z.ZodObject<{
+    generation: z.ZodNumber;
+    generatedAt: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+    kind: z.ZodLiteral<"snapshot">;
+}, z.core.$strict>;
+/** Per-credential upsert/refresh delta. */
+export declare const snapshotStreamEntryEventSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"entry">;
+    generation: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    entry: z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** Per-credential delete delta. */
+export declare const snapshotStreamRemovedEventSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"removed">;
+    generation: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    id: z.ZodNumber;
+}, z.core.$strict>;
+/** Discriminated union over every event frame the snapshot stream emits. */
+export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    generation: z.ZodNumber;
+    generatedAt: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+    kind: z.ZodLiteral<"snapshot">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"entry">;
+    generation: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    entry: z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"removed">;
+    generation: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    id: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export declare const healthzResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    version: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * Broker `/v1/usage` response. Reports are full {@link UsageReport}s minus the
+ * heavy provider-specific `raw` field (the server strips it before send) — we
+ * keep `raw` optional in the underlying schema so a misconfigured broker that
+ * forgot to strip still validates.
+ */
+export declare const usageResponseSchema: z.ZodObject<{
+    generatedAt: z.ZodNumber;
+    reports: z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        fetchedAt: z.ZodNumber;
+        limits: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            scope: z.ZodObject<{
+                provider: z.ZodString;
+                accountId: z.ZodOptional<z.ZodString>;
+                projectId: z.ZodOptional<z.ZodString>;
+                orgId: z.ZodOptional<z.ZodString>;
+                modelId: z.ZodOptional<z.ZodString>;
+                tier: z.ZodOptional<z.ZodString>;
+                windowId: z.ZodOptional<z.ZodString>;
+                shared: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>;
+            window: z.ZodOptional<z.ZodObject<{
+                id: z.ZodString;
+                label: z.ZodString;
+                durationMs: z.ZodOptional<z.ZodNumber>;
+                resetsAt: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+            amount: z.ZodObject<{
+                used: z.ZodOptional<z.ZodNumber>;
+                limit: z.ZodOptional<z.ZodNumber>;
+                remaining: z.ZodOptional<z.ZodNumber>;
+                usedFraction: z.ZodOptional<z.ZodNumber>;
+                remainingFraction: z.ZodOptional<z.ZodNumber>;
+                unit: z.ZodEnum<{
+                    bytes: "bytes";
+                    minutes: "minutes";
+                    percent: "percent";
+                    requests: "requests";
+                    tokens: "tokens";
+                    unknown: "unknown";
+                    usd: "usd";
+                }>;
+            }, z.core.$strip>;
+            status: z.ZodOptional<z.ZodEnum<{
+                exhausted: "exhausted";
+                ok: "ok";
+                unknown: "unknown";
+                warning: "warning";
+            }>>;
+            notes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        raw: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export declare const credentialRefreshResponseSchema: z.ZodObject<{
+    entry: z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const credentialDisableRequestSchema: z.ZodObject<{
+    cause: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const credentialDisableResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const credentialUploadRequestSchema: z.ZodObject<{
+    provider: z.ZodString;
+    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"oauth">;
+        refresh: z.ZodString;
+        access: z.ZodString;
+        expires: z.ZodNumber;
+        enterpriseUrl: z.ZodOptional<z.ZodString>;
+        projectId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        accountId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        key: z.ZodString;
+    }, z.core.$strict>], "type">;
+}, z.core.$strict>;
+export declare const credentialUploadResponseSchema: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;

package/dist/types/auth-gateway/http.d.ts

@@ -0,0 +1,39 @@
+export declare function json(status: number, body: unknown): Response;
+export declare function resolvePeer(req: Request): string;
+/**
+ * Constant-time byte comparison. Falls back to a manual XOR accumulator if
+ * `node:crypto.timingSafeEqual` isn't available. Always processes every byte
+ * of the longer input so length itself doesn't leak via timing.
+ */
+export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+export declare function isAuthorized(req: Request, tokens: ReadonlySet<string>): boolean;
+/**
+ * Extract allow-listed passthrough headers from an inbound request. Keys are
+ * lowercased; empty values are dropped. Called once per request in
+ * `handleFormatEndpoint`; parsers then read `options.headers`.
+ */
+export declare function captureRequestHeaders(headers: Headers): Record<string, string>;
+/**
+ * Resolve a prompt-cache identity from inbound request body + headers.
+ * Order of precedence (first wins):
+ *   1. Body `prompt_cache_key`
+ *   2. Body `metadata.{prompt_cache_key,session_id,conversation_id}`
+ *   3. Header `x-prompt-cache-key`
+ *   4. Header `session_id` / `conversation_id` (Codex / ChatGPT-OAuth surface)
+ *   5. Header `x-session-id` / `x-conversation-id` (common informal)
+ * Returns undefined when none present; the gateway then derives a stable
+ * UUID from the request's stable parts.
+ */
+export declare function resolvePromptCacheKey(body: unknown, headers?: Headers): string | undefined;
+/**
+ * CORS headers for the auth-gateway. Currently echoes a wildcard origin; the
+ * request is accepted so future tightening can mirror `Origin` without
+ * threading the request through every caller.
+ */
+export declare function corsHeaders(_req: Request): Record<string, string>;
+/**
+ * Re-emit `response` with CORS headers merged. The original response body is
+ * passed through unchanged. Used by the gateway wrapper so every outbound
+ * format-endpoint response carries the same CORS surface as the preflight.
+ */
+export declare function withCors(response: Response, req: Request): Response;

package/dist/types/auth-gateway/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./http";
+export * from "./server";
+export * from "./types";

package/dist/types/auth-gateway/server.d.ts

@@ -0,0 +1,36 @@
+import type { AuthStorage } from "../auth-storage";
+import type { Api, Model } from "../types";
+import type { AuthGatewayServerHandle, AuthGatewayServerOptions } from "./types";
+export type ModelResolver = (modelId: string) => Model<Api> | undefined;
+export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
+    /** Source of credentials. Caller wires this to a broker-backed AuthStorage. */
+    storage: AuthStorage;
+    /**
+     * Resolve a client-requested model id to an aery-ai Model. Caller supplies
+     * this from a ModelRegistry (lives in `coding-agent` to avoid an inverse
+     * dependency in `aery-ai`).
+     */
+    resolveModel: ModelResolver;
+    /** Optional supplier for `/v1/models` listing. Returns the full model array. */
+    listModels?: () => Iterable<Model<Api>>;
+}
+/**
+ * Classify an upstream / gateway-internal error into a status code and a
+ * format-neutral type. The order is intentional:
+ *
+ *  1. Honour an explicit numeric `status` property on the thrown error.
+ *  2. Parse a status code embedded in the message string. Provider errors
+ *     virtually always carry one (`Google API error (400): …`, `HTTP 429`,
+ *     `status=503`) and the embedded value is authoritative.
+ *  3. Fall through to **word-boundaried** substring heuristics. The old
+ *     `lower.includes("rate")` test famously matched
+ *     `GenerateContentRequest`, surfacing every Google 400 as a 429
+ *     `rate_limit_error`. The patterns here all require boundaries so they
+ *     don't collide with provider field names.
+ */
+export declare function classifyGatewayError(err: unknown): {
+    status: number;
+    type: string;
+    message: string;
+};
+export declare function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServerHandle;

package/dist/types/auth-gateway/types.d.ts

@@ -0,0 +1,117 @@
+import type { Effort } from "../model-thinking";
+import type { AssistantMessage, AssistantMessageEventStream, CacheRetention, Context, ServiceTier, TokenTaskBudget } from "../types";
+/**
+ * Wire types for the aery auth-gateway.
+ *
+ * The gateway sits between unauthenticated clients (containerized aery,
+ * llm-git, …) and the broker. It accepts provider-format HTTP requests
+ * (OpenAI chat-completions / Anthropic messages / OpenAI Responses),
+ * dispatches them through aery-ai's `streamSimple()`, and translates the
+ * canonical event stream back to the matching wire format. The gateway
+ * injects `Authorization` server-side so clients never see access tokens.
+ */
+/** Default bind. Loopback-only — front with reverse proxy for remote access. */
+export declare const DEFAULT_AUTH_GATEWAY_BIND = "127.0.0.1:4000";
+export type AuthGatewayToolChoice = "auto" | "none" | "required" | {
+    name: string;
+};
+export interface AuthGatewayParsedRequestOptions {
+    maxOutputTokens?: number;
+    temperature?: number;
+    topP?: number;
+    topK?: number;
+    /** OpenAI nucleus-min sampling (`min_p`). */
+    minP?: number;
+    /** Anthropic `stop_sequences` / OpenAI `stop`. */
+    stopSequences?: string[];
+    /** OpenAI `presence_penalty`. */
+    presencePenalty?: number;
+    /** OpenAI `frequency_penalty`. */
+    frequencyPenalty?: number;
+    /** OpenRouter / vLLM `repetition_penalty`. */
+    repetitionPenalty?: number;
+    /** OpenAI deterministic-sampling `seed`. */
+    seed?: number;
+    /** OpenAI `logit_bias` map (token id → bias). */
+    logitBias?: Record<string, number>;
+    /** OpenAI `response_format` (text | json_object | json_schema). Opaque passthrough. */
+    responseFormat?: unknown;
+    toolChoice?: AuthGatewayToolChoice;
+    /** OpenAI `parallel_tool_calls`. */
+    parallelToolCalls?: boolean;
+    /** Effort-level reasoning request (OpenAI Responses / Chat `reasoning_effort`). */
+    reasoning?: Effort;
+    /** Force-disable reasoning (Anthropic `thinking: { type: "disabled" }`). */
+    disableReasoning?: boolean;
+    /**
+     * Explicit Anthropic `thinking.budget_tokens`. Mirrors Rust's
+     * `resolve_thinking_budget`: pins onto whichever effort the client
+     * requested (defaulting to High when unspecified). Preferred over the
+     * removed legacy single-number `thinkingBudget` for new code.
+     */
+    explicitThinkingBudgetTokens?: number;
+    /** Per-effort thinking budget map. */
+    thinkingBudgets?: Partial<Record<Effort, number>>;
+    /** Suppress the provider's reasoning summary stream. */
+    hideThinkingSummary?: boolean;
+    /** Anthropic `output_config.task_budget` advisory loop budget. */
+    taskBudget?: TokenTaskBudget;
+    /** OpenAI service tier (auto|default|flex|scale|priority). */
+    serviceTier?: ServiceTier;
+    /** Cache retention hint derived from inbound `cache_control` markers. */
+    cacheRetention?: CacheRetention;
+    /** OpenAI Responses `prompt_cache_key`; also seeds provider routing when no separate session id exists. */
+    promptCacheKey?: string;
+    /** OpenAI Responses `previous_response_id` for response chaining. */
+    previousResponseId?: string;
+    /** OpenAI / abuse-tracking `user` field. */
+    user?: string;
+    /**
+     * Provider-specific metadata. Anthropic uses `metadata.user_id`; OpenRouter
+     * carries routing hints; xAI uses `search_parameters`; OpenAI accepts a
+     * free-form bag. The gateway forwards as-is.
+     */
+    metadata?: Record<string, unknown>;
+    /**
+     * Captured allow-listed passthrough headers (anthropic-beta,
+     * anthropic-version, openai-organization, openai-project, openai-beta,
+     * x-stainless-*). Keys are lowercased.
+     */
+    headers?: Record<string, string>;
+    /**
+     * Escape hatch for provider-specific request controls that don't yet have a
+     * first-class field. Prefer adding a typed field over widening this.
+     */
+    extra?: Record<string, unknown>;
+}
+export interface AuthGatewayParsedRequest {
+    modelId: string;
+    context: Context;
+    stream: boolean;
+    options: AuthGatewayParsedRequestOptions;
+}
+export interface AuthGatewayFormatModule {
+    parseRequest(body: unknown, headers?: Headers): AuthGatewayParsedRequest;
+    encodeResponse(message: AssistantMessage, requestedModelId: string): Record<string, unknown>;
+    encodeStream(events: AssistantMessageEventStream, requestedModelId: string, options?: AuthGatewayParsedRequestOptions): ReadableStream<Uint8Array>;
+    /**
+     * Emit a protocol-specific error envelope. OpenAI returns
+     * `{ error: { message, type } }`; Anthropic returns
+     * `{ type: "error", error: { type, message } }`.
+     */
+    formatError(status: number, type: string, message: string): Response;
+}
+export interface AuthGatewayServerOptions {
+    /** Listen address. Default `127.0.0.1:4000`. */
+    bind?: string;
+    /** Accept any of these bearer tokens. Empty allows unauthenticated calls. */
+    bearerTokens: string[];
+    /** Version surfaced on `/healthz`. */
+    version?: string;
+}
+export interface AuthGatewayServerHandle {
+    url: string;
+    port: number;
+    hostname: string;
+    close(): Promise<void>;
+}