@gajae-code/ai 0.15.4 → 0.15.6

package/CHANGELOG.md

@@ -2,13 +2,39 @@
 
 ## [Unreleased]
 
+## [0.15.6] - 2026-08-30
+
+### Added
+
+- `AuthGatewayServerOptions` now requires `providerScope`; `AuthGatewayBootOptions` requires the provider-filtered `listModels` callback and an exact-catalog-object `resolveModel`. Direct `@gajae-code/ai` callers must construct one gateway instance per provider and pass a provider-filtered source catalog. This matches the mandatory `--provider=<id>` CLI migration and prevents cross-provider model and credential ambiguity.
+- `AuthGatewayBootOptions` now requires live authority callbacks (`hasProviderCredential`, `reloadProviderCredentials`, and `validateProviderCredential`). Gateway dispatch holds the authority lease through `streamSimple()` admission and rejects credentials revoked during asynchronous selection instead of sending a stale key.
+- `auth-broker serve` now requires an `AuthCredentialStore` with atomic `allocateMonotonicSequence` support for durable broker incarnation epochs; unsupported custom stores fail closed before binding and must migrate to the durable cache-backed contract.
+
+### Fixed
+
+- Cursor HTTP/2 streams now drain admitted exec responses before normal teardown and centralize terminal failures, preventing delayed handlers and retained shell callbacks from writing after the request has ended.
+- Auth-gateway boot and dispatch are now provider-scoped: model catalogs reject cross-provider id ambiguity, Codex rows retain `openai-codex-responses`, and requests cannot borrow credentials from another provider.
+- Broker-backed gateway dispatch leases now remain held until the provider's transport-admission boundary, preventing lazy stream construction from releasing authority before outbound dispatch.
+- Kiro (Amazon Q Developer / CodeWhisperer) OAuth is now fully wired end-to-end: `AuthStorage.login("kiro", ...)` previously had no dispatch case despite `kiro` being advertised in `getOAuthProviders()`, so every advertised login path (`gjc auth-broker login kiro`, the interactive `/login` provider picker, direct `@gajae-code/ai` CLI `login kiro`) failed with `Unknown OAuth provider: kiro`. `mapOptionsForApi()` also had no case for `kiro-codewhisperer-stream`, so any chat call on a Kiro model threw `Unhandled API in mapOptionsForApi` regardless of auth method. The bundled model catalog had no `kiro` entries at all, leaving OAuth-only users with an empty model list; the provider descriptor's default model id also did not match any catalog entry. The OAuth CodeWhisperer request now also carries `modelId` in every wire message, matching the sibling API-key transport's request shape (issue #5064).
+
+## [0.15.5] - 2026-08-29
+
+### Added
+
+- The built-in `kiro` provider now accepts long-lived `KIRO_API_KEY` values (`ksk_…` from [app.kiro.dev](https://app.kiro.dev/settings/api-keys)) in addition to AWS Builder ID OAuth. API-key auth talks to the Kiro service root with `tokentype: API_KEY` and discovers the live model catalog via `ListAvailableModels`. Builder ID login (`gjc auth-broker login kiro` / `AWS_BEARER_TOKEN_KIRO`) is unchanged.
+
+### Fixed
+
+- The generic OpenAI Responses transport now preserves the typed `server_is_overloaded` code from an HTTP 200 terminal envelope as transport facts (`openaiErrorCode` / `providerCode`), and that statusless code classifies as a `server` fallback trigger. Both terminal shapes that carry the structured failure are covered: `response.failed`, and `response.completed` whose response `status` is `failed` (including the nested `status_details.error` form). Previously the envelope became a plain `Error`, so the only structured evidence of a capacity rejection was lost and consumers had to read provider prose. The code is matched case-sensitively and exactly, so near misses (`server_is_overloaded_now`), case variants (`SERVER_IS_OVERLOADED`), padded variants, and a `cancelled` response carrying the same code all stay untyped and unclassified; the displayed error message is unchanged in every case. The shared Azure Responses path inherits the same parsing. (#5018)
+- Kiro credential selection now rejects control-character injection and keeps non-`ksk_` values on the Builder ID bearer path. API-key failures redact the credential before reaching assistant error output, and the transport accepts provider header overrides without changing the documented endpoint contract.
+- API-key model discovery also retains the contributor-supplied static catalog for offline print-mode resolution, while live `ListAvailableModels` results remain authoritative when available.
 ## [0.15.4] - 2026-08-29
 
 ## [0.15.3] - 2026-08-27
 
 ### Fixed
 
-- Valid JSON `\uXXXX` tool arguments now execute as their canonical decoded strings instead of entering the escaped-non-ASCII resample loop. Provider adapters retain guard metadata only for malformed JSON, duplicate/deep evidence, and unpaired UTF-16 surrogates, so those cases remain fail-closed while standard escaped Hangul, emoji surrogate pairs, and printable ASCII no longer consume retries or terminate managed runs.
+- Valid JSON `\uXXXX` tool arguments now execute as their canonical decoded strings instead of entering the escaped-non-ASCII resample loop. This intentionally treats every syntactically valid decoded scalar as canonical; runtime validation cannot infer whether a valid hex digit differed from the model's intent. Provider adapters retain guard metadata for malformed escape-bearing JSON, duplicate/deep suspicious escape evidence, and unpaired UTF-16 surrogates, while standard escaped Hangul, emoji surrogate pairs, and printable ASCII no longer consume retries or terminate managed runs.
 - Explicit positive `maxTokens` values declared for custom `models.yml` models
   and model overrides now reach the provider request across the shared stream
   mapping (`max_tokens`, `max_completion_tokens`, and `max_output_tokens`).

package/dist/types/auth-broker/client.d.ts

@@ -1,5 +1,7 @@
 import type { AuthCredential } from "../auth-storage";
+import type { Provider } from "../types";
 import type { CredentialDisableResponse, CredentialIfAbsentUploadResponse, CredentialMetadataResponse, CredentialRefreshRequest, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse } from "./types";
+export declare const AUTH_BROKER_EPOCH_HEADER = "X-GJC-Auth-Broker-Epoch";
 export interface AuthBrokerClientOptions {
     /** Base URL (e.g. `https://broker.tailnet:8765`). Trailing slashes are trimmed. */
     url: string;
@@ -35,6 +37,7 @@ export declare class AuthBrokerCredentialMetadataUnsupportedError extends AuthBr
 }
 export interface FetchSnapshotOptions {
     ifGenerationGt?: number;
+    ifEpoch?: string;
     waitMs?: number;
     signal?: AbortSignal;
 }
@@ -45,6 +48,7 @@ export type FetchSnapshotResult = {
 } | {
     status: 304;
     generation: number;
+    epoch?: string;
 };
 export declare class AuthBrokerClient {
     #private;
@@ -67,10 +71,10 @@ export declare class AuthBrokerClient {
     openSnapshotStream(opts?: {
         signal?: AbortSignal;
     }): AsyncGenerator<SnapshotStreamEvent>;
-    fetchUsage(signal?: AbortSignal): Promise<UsageResponse>;
+    fetchUsage(signal?: AbortSignal, provider?: Provider): Promise<UsageResponse>;
     refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
     refreshMCPCredential(id: number, body: CredentialRefreshRequest, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
-    disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse>;
+    disableCredential(id: number, cause: string, signal?: AbortSignal, expectedRevision?: number): Promise<CredentialDisableResponse>;
     uploadCredential(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialUploadResponse>;
     uploadCredentialIfAbsent(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialIfAbsentUploadResponse>;
 }

package/dist/types/auth-broker/remote-store.d.ts

@@ -7,7 +7,7 @@
  * usage reports cache TTL is 5 minutes per credential, so durability across
  * runs isn't required.
  */
-import { type AuthCredential, type AuthCredentialIfAbsentResult, type AuthCredentialStore, type CachedCredentialHealth, type CachedUsagePresentation, type CredentialInventoryRecord, type MCPOAuthRefreshClient, type OAuthCredential, type SafeUsageReport, type StoredAuthCredential } from "../auth-storage";
+import { type AuthCredential, type AuthCredentialIfAbsentResult, type AuthCredentialStore, type CachedCredentialHealth, type CachedUsagePresentation, type CredentialDispatchTicket, type CredentialInventoryRecord, type MCPOAuthRefreshClient, type OAuthCredential, type SafeUsageReport, type StoredAuthCredential } from "../auth-storage";
 import type { Provider } from "../types";
 import type { UsageReport } from "../usage";
 import type { OAuthCredentials } from "../utils/oauth/types";
@@ -50,6 +50,14 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     flushPresentationPersistence(): Promise<void>;
     get snapshot(): SnapshotResponse;
     getInventoryMetadataState(): Readonly<CredentialInventoryMetadataState>;
+    onSnapshotChanged(listener: () => void): () => void;
+    /**
+     * Queue a provider-admission ticket behind all currently pending snapshot
+     * authority work. Snapshot applications that arrive after this ticket wait
+     * for its release, so a revocation is ordered either before admission or
+     * after it — never in the middle of the dispatch boundary.
+     */
+    acquireCredentialDispatchTicket(_provider: Provider, signal?: AbortSignal): Promise<CredentialDispatchTicket>;
     syncInventoryMetadata(): Promise<Readonly<CredentialInventoryMetadataState>>;
     /**
      * Payload-free inventory view. This method never performs network I/O; metadata
@@ -58,7 +66,7 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
      */
     listCredentialInventory(provider?: string): CredentialInventoryRecord[];
     /** Re-hydrate the in-memory snapshot from the broker. */
-    refreshSnapshot(): Promise<SnapshotResponse>;
+    refreshSnapshot(signal?: AbortSignal): Promise<SnapshotResponse>;
     listAuthCredentials(provider?: string): StoredAuthCredential[];
     /**
      * In-memory update from a successful refresh through the broker. AuthStorage
@@ -67,7 +75,10 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
      */
     updateAuthCredential(id: number, credential: AuthCredential): void;
     deleteAuthCredential(_id: number, _disabledCause: string): void;
+    allocateMonotonicSequence(_key: string, _expiresAtSec: number): number;
     tryDisableAuthCredentialIfMatches(_id: number, _expectedData: string, _disabledCause: string): boolean;
+    /** Disable one credential through the authenticated broker mutation endpoint. */
+    disableAuthCredentialRemote(credentialId: number, disabledCause: string, signal?: AbortSignal, expectedRevision?: number): Promise<boolean>;
     waitForFreshSnapshot(maxWaitMs: number, opts?: {
         signal?: AbortSignal;
     }): Promise<boolean>;
@@ -117,6 +128,7 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
      * residential laptop is, so all credentials surface every cycle.
      */
     fetchUsageReports(signal?: AbortSignal): Promise<UsageReport[] | null>;
+    fetchUsageReportsForProvider(provider: Provider, signal?: AbortSignal): Promise<UsageReport[] | null>;
     /** Synchronous, zero-network usage presentation read. */
     peekCachedUsagePresentation(provider: Provider, credentialId: number): CachedUsagePresentation | undefined;
     /** Synchronous, zero-network health presentation read backed by the redacted sidecar. */

package/dist/types/auth-broker/types.d.ts

@@ -17,6 +17,7 @@ export interface CredentialMetadataRecord {
 }
 /** GET /v1/credentials/metadata response body. */
 export interface CredentialMetadataResponse {
+    epoch?: string;
     generation: number;
     generatedAt: number;
     credentials: CredentialMetadataRecord[];
@@ -37,6 +38,8 @@ export type SnapshotEntry = AuthCredentialSnapshotEntry & {
 };
 /** GET /v1/snapshot response body. */
 export interface SnapshotResponse extends Omit<AuthCredentialSnapshot, "credentials"> {
+    /** Stable for one broker process; changes when the broker restarts. */
+    epoch?: string;
     serverNowMs: number;
     refresher: RefresherSchedule;
     credentials: SnapshotEntry[];
@@ -55,6 +58,7 @@ export type CredentialRefreshRequest = MCPOAuthRefreshClient;
 /** POST /v1/credential/:id/disable request body. */
 export interface CredentialDisableRequest {
     cause: string;
+    expectedRevision?: number;
 }
 /** POST /v1/credential/:id/disable response body. */
 export interface CredentialDisableResponse {
@@ -91,6 +95,7 @@ export interface SnapshotStreamSnapshotEvent extends SnapshotResponse {
 /** Single credential added/changed (upsert or refresh). */
 export interface SnapshotStreamEntryEvent {
     kind: "entry";
+    epoch?: string;
     generation: number;
     serverNowMs: number;
     refresher: RefresherSchedule;
@@ -99,6 +104,7 @@ export interface SnapshotStreamEntryEvent {
 /** Single credential disabled/deleted. */
 export interface SnapshotStreamRemovedEvent {
     kind: "removed";
+    epoch?: string;
     generation: number;
     serverNowMs: number;
     refresher: RefresherSchedule;

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -106,6 +106,7 @@ export declare const credentialSnapshotEntrySchema: z.ZodObject<{
         key: z.ZodString;
     }, z.core.$strict>], "type">;
     identityKey: z.ZodNullable<z.ZodString>;
+    revision: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export declare const snapshotEntrySchema: z.ZodObject<{
     id: z.ZodNumber;
@@ -128,6 +129,7 @@ export declare const snapshotEntrySchema: z.ZodObject<{
         key: z.ZodString;
     }, z.core.$strict>], "type">;
     identityKey: z.ZodNullable<z.ZodString>;
+    revision: z.ZodOptional<z.ZodNumber>;
     rotatesInMs: z.ZodNullable<z.ZodNumber>;
 }, z.core.$strict>;
 export declare const refresherScheduleSchema: z.ZodObject<{
@@ -137,6 +139,7 @@ export declare const refresherScheduleSchema: z.ZodObject<{
     nextSweepInMs: z.ZodNumber;
 }, z.core.$strict>;
 export declare const snapshotResponseSchema: z.ZodObject<{
+    epoch: z.ZodOptional<z.ZodString>;
     generation: z.ZodNumber;
     generatedAt: z.ZodNumber;
     serverNowMs: z.ZodNumber;
@@ -167,6 +170,7 @@ export declare const snapshotResponseSchema: z.ZodObject<{
             key: z.ZodString;
         }, z.core.$strict>], "type">;
         identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
         rotatesInMs: z.ZodNullable<z.ZodNumber>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
@@ -182,6 +186,7 @@ export declare const credentialMetadataRecordSchema: z.ZodObject<{
     disabledCause: z.ZodNullable<z.ZodString>;
 }, z.core.$strict>;
 export declare const credentialMetadataResponseSchema: z.ZodObject<{
+    epoch: z.ZodOptional<z.ZodString>;
     generation: z.ZodNumber;
     generatedAt: z.ZodNumber;
     credentials: z.ZodArray<z.ZodObject<{
@@ -197,6 +202,7 @@ export declare const credentialMetadataResponseSchema: z.ZodObject<{
 }, z.core.$strict>;
 /** First frame on connect — full snapshot embedded inline with a `kind` tag. */
 export declare const snapshotStreamSnapshotEventSchema: z.ZodObject<{
+    epoch: z.ZodOptional<z.ZodString>;
     generation: z.ZodNumber;
     generatedAt: z.ZodNumber;
     serverNowMs: z.ZodNumber;
@@ -227,6 +233,7 @@ export declare const snapshotStreamSnapshotEventSchema: z.ZodObject<{
             key: z.ZodString;
         }, z.core.$strict>], "type">;
         identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
         rotatesInMs: z.ZodNullable<z.ZodNumber>;
     }, z.core.$strict>>;
     kind: z.ZodLiteral<"snapshot">;
@@ -234,6 +241,7 @@ export declare const snapshotStreamSnapshotEventSchema: z.ZodObject<{
 /** Per-credential upsert/refresh delta. */
 export declare const snapshotStreamEntryEventSchema: z.ZodObject<{
     kind: z.ZodLiteral<"entry">;
+    epoch: z.ZodOptional<z.ZodString>;
     generation: z.ZodNumber;
     serverNowMs: z.ZodNumber;
     refresher: z.ZodObject<{
@@ -263,12 +271,14 @@ export declare const snapshotStreamEntryEventSchema: z.ZodObject<{
             key: z.ZodString;
         }, z.core.$strict>], "type">;
         identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
         rotatesInMs: z.ZodNullable<z.ZodNumber>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 /** Per-credential delete delta. */
 export declare const snapshotStreamRemovedEventSchema: z.ZodObject<{
     kind: z.ZodLiteral<"removed">;
+    epoch: z.ZodOptional<z.ZodString>;
     generation: z.ZodNumber;
     serverNowMs: z.ZodNumber;
     refresher: z.ZodObject<{
@@ -281,6 +291,7 @@ export declare const snapshotStreamRemovedEventSchema: z.ZodObject<{
 }, z.core.$strict>;
 /** Discriminated union over every event frame the snapshot stream emits. */
 export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    epoch: z.ZodOptional<z.ZodString>;
     generation: z.ZodNumber;
     generatedAt: z.ZodNumber;
     serverNowMs: z.ZodNumber;
@@ -311,11 +322,13 @@ export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodOb
             key: z.ZodString;
         }, z.core.$strict>], "type">;
         identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
         rotatesInMs: z.ZodNullable<z.ZodNumber>;
     }, z.core.$strict>>;
     kind: z.ZodLiteral<"snapshot">;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"entry">;
+    epoch: z.ZodOptional<z.ZodString>;
     generation: z.ZodNumber;
     serverNowMs: z.ZodNumber;
     refresher: z.ZodObject<{
@@ -345,10 +358,12 @@ export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodOb
             key: z.ZodString;
         }, z.core.$strict>], "type">;
         identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
         rotatesInMs: z.ZodNullable<z.ZodNumber>;
     }, z.core.$strict>;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"removed">;
+    epoch: z.ZodOptional<z.ZodString>;
     generation: z.ZodNumber;
     serverNowMs: z.ZodNumber;
     refresher: z.ZodObject<{
@@ -447,10 +462,12 @@ export declare const credentialRefreshResponseSchema: z.ZodObject<{
             key: z.ZodString;
         }, z.core.$strict>], "type">;
         identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 export declare const credentialDisableRequestSchema: z.ZodObject<{
     cause: z.ZodOptional<z.ZodString>;
+    expectedRevision: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export declare const credentialDisableResponseSchema: z.ZodObject<{
     ok: z.ZodBoolean;
@@ -497,6 +514,7 @@ export declare const credentialUploadResponseSchema: z.ZodObject<{
             key: z.ZodString;
         }, z.core.$strict>], "type">;
         identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const credentialIfAbsentUploadResponseSchema: z.ZodObject<{
@@ -532,5 +550,6 @@ export declare const credentialIfAbsentUploadResponseSchema: z.ZodObject<{
             key: z.ZodString;
         }, z.core.$strict>], "type">;
         identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/dist/types/auth-gateway/server.d.ts

@@ -1,7 +1,7 @@
 /**
  * gjc auth-gateway HTTP server.
  *
- * Accepts any provider-format request (OpenAI chat-completions, Anthropic
+ * Accepts a provider-scoped provider-format request (OpenAI chat-completions, Anthropic
  * messages, OpenAI Responses) and dispatches through pi-ai's `streamSimple()`
  * — which handles credential injection, anthropic-beta headers, OpenAI code backend
  * websocket transport, and all the per-provider intricacies. The gateway is
@@ -12,25 +12,59 @@
  *   GET  /healthz                          → unauth; ok + version
  *   GET  /v1/usage                         → aggregated provider usage (5-min per-credential cache via AuthStorage)
  *   GET  /v1/credentials/check             → per-credential auth probe (diagnose 401s in a multi-account pool)
- *   GET  /v1/models                        → list known models from the registry
+ *   GET  /v1/models                        → list models from the selected provider scope
  *   POST /v1/chat/completions              → OpenAI chat-completions in/out
  *   POST /v1/messages                      → Anthropic messages in/out
  *   POST /v1/responses                     → OpenAI Responses in/out
  */
 import type { AuthStorage } from "../auth-storage";
-import type { Api, Model } from "../types";
+import type { Api, AssistantMessageEventStream, Model, Provider } from "../types";
 import type { AuthGatewayServerHandle, AuthGatewayServerOptions } from "./types";
 export type ModelResolver = (modelId: string) => Model<Api> | undefined;
 export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
     /** Source of credentials. Caller wires this to a broker-backed AuthStorage. */
     storage: AuthStorage;
+    /**
+     * Current broker-backed scope authority. When supplied, this is checked on
+     * every request so a live broker snapshot removal immediately fails closed.
+     */
+    hasProviderCredential: () => boolean;
+    /** Refresh the dispatch cache from the current broker snapshot before use. */
+    reloadProviderCredentials: (signal?: AbortSignal) => Promise<void>;
+    /** Confirm that the selected key is still present in the current authority snapshot. */
+    validateProviderCredential: (provider: string, apiKey: string) => boolean;
     /**
      * Resolve a client-requested model id to a pi-ai Model. Caller supplies
      * this from a ModelRegistry (lives in `coding-agent` to avoid an inverse
      * dependency in `pi-ai`).
      */
     resolveModel: ModelResolver;
-    /** Optional supplier for `/v1/models` listing. Returns the full model array. */
-    listModels?: () => Iterable<Model<Api>>;
+    /** Supplier for the source-backed model catalog used by `/v1/models`. */
+    listModels: () => Iterable<Model<Api>>;
+}
+export interface AuthGatewayModelCatalog {
+    readonly models: readonly Model<Api>[];
+    resolve(modelId: string): Model<Api> | undefined;
 }
+/**
+ * Whether a model can be served through the broker-backed auth gateway.
+ *
+ * Bedrock's credential chain is process-local AWS authority, not a broker
+ * credential. Advertising a native Bedrock model from this gateway would let
+ * direct callers bypass the broker boundary (and make readiness lie about a
+ * model the gateway cannot authenticate). Keep this predicate shared with the
+ * CLI readiness checks so every entry point applies the same fence.
+ */
+export declare function isAuthGatewayModelBrokerConsumable(model: Pick<Model<Api>, "api" | "transport">): boolean;
+/**
+ * Build an unambiguous, provider-scoped catalog.
+ *
+ * Models from other providers are intentionally ignored rather than allowed
+ * to compete for the same id. Duplicate ids within the selected provider are
+ * rejected because choosing either one would make request dispatch
+ * order-dependent.
+ */
+export declare function createAuthGatewayModelCatalog(provider: Provider, models: Iterable<Model<Api>>): AuthGatewayModelCatalog;
+export declare function releaseGatewayCredentialLeaseOnAdmission(events: Pick<AssistantMessageEventStream, "result">, release: () => void, signal?: AbortSignal): void;
 export declare function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServerHandle;
+export declare function isSafeProviderScope(provider: unknown): provider is string;

package/dist/types/auth-gateway/types.d.ts

@@ -1,17 +1,29 @@
 import type { Effort } from "../model-thinking";
-import type { AssistantMessage, AssistantMessageEventStream, CacheRetention, Context, ServiceTier } from "../types";
+import type { Api, AssistantMessage, AssistantMessageEventStream, CacheRetention, Context, Provider, ServiceTier } from "../types";
 /**
  * Wire types for the gjc auth-gateway.
  *
  * The gateway sits between unauthenticated clients (containerized gjc,
  * llm-git, …) and the broker. It accepts provider-format HTTP requests
- * (OpenAI chat-completions / Anthropic messages / OpenAI Responses),
+ * (OpenAI chat-completions / Anthropic messages / OpenAI Responses) within
+ * one explicit provider scope,
  * dispatches them through pi-ai's `streamSimple()`, and translates the
  * canonical event stream back to the matching wire format. The gateway
  * injects `Authorization` server-side so clients never see access tokens.
  */
 /** Default bind. Loopback-only — front with reverse proxy for remote access. */
 export declare const DEFAULT_AUTH_GATEWAY_BIND = "127.0.0.1:4000";
+/**
+ * Provider APIs whose gateway identity is part of the provider contract.
+ *
+ * OpenAI Codex is backed by the Codex OAuth authority and must never be
+ * projected as a generic OpenAI Responses model. Other providers may expose
+ * more than one API and therefore remain catalog-defined.
+ */
+export declare const AUTH_GATEWAY_PROVIDER_APIS: Readonly<Record<string, Api>>;
+export interface AuthGatewayProviderScope {
+    provider: Provider;
+}
 export type AuthGatewayToolChoice = "auto" | "none" | "required" | {
     name: string;
 };
@@ -102,6 +114,8 @@ export interface AuthGatewayFormatModule {
 export interface AuthGatewayServerOptions {
     /** Listen address. Default `127.0.0.1:4000`. */
     bind?: string;
+    /** Required provider scope. An unscoped gateway is not supported. */
+    providerScope: AuthGatewayProviderScope;
     /** Accept any of these bearer tokens. Empty allows unauthenticated calls. */
     bearerTokens: string[];
     /** Version surfaced on `/healthz`. */