@linxiraos/pi-ai 1.0.0

package/dist/types/auth-storage.d.ts

@@ -0,0 +1,1258 @@
+import type { ApiKeyResolver } from "./auth-retry.js";
+import type { OAuthAuthInfo, OAuthController, OAuthCredentials, OAuthProviderId } from "./registry/oauth/types.js";
+import type { Provider } from "./types.js";
+import type { ClientUsageReport, ClientUsageSummary, CredentialRankingStrategy, ObservedUsageEntry, UsageCostHistoryEntry, UsageCostHistoryQuery, UsageHistoryEntry, UsageHistoryQuery, UsageLogger, UsageProvider, UsageReport } from "./usage.js";
+import { type CodexResetConsumeCode, type CodexResetCredit } from "./usage/openai-codex-reset.js";
+export { isSqliteBusyError, isSqliteCorruptionError, SqliteAuthCredentialStore, } from "./auth/sqlite-credential-store.js";
+export type ApiKeyCredential = {
+    type: "api_key";
+    key: string;
+    source?: "login";
+};
+export type OAuthCredential = {
+    type: "oauth";
+} & OAuthCredentials;
+export type AuthCredential = ApiKeyCredential | OAuthCredential;
+export type AuthCredentialEntry = AuthCredential | AuthCredential[];
+export type AuthStorageData = Record<string, AuthCredentialEntry>;
+/**
+ * Cascade leg that supplies a provider's active credential, highest precedence
+ * first — mirrors {@link AuthStorage.getApiKey}'s resolution order.
+ */
+export type CredentialOriginKind = "runtime" | "config" | "oauth" | "api_key" | "env" | "fallback";
+/**
+ * Structured provenance for a provider's auth, for UI that needs a machine
+ * tag (the `/login` provider list) rather than the prose of
+ * {@link AuthStorage.describeCredentialSource}.
+ */
+export interface CredentialOrigin {
+    kind: CredentialOriginKind;
+    /** Env var name when `kind === "env"` and a single named variable backs it. */
+    envVar?: string;
+}
+/**
+ * Serialized representation of AuthStorage for passing to subagent workers.
+ * Contains only the essential credential data, not runtime state.
+ */
+export interface SerializedAuthStorage {
+    credentials: Record<string, Array<{
+        id: number;
+        type: "api_key" | "oauth";
+        data: Record<string, unknown>;
+    }>>;
+    runtimeOverrides?: Record<string, string>;
+    dbPath?: string;
+}
+/**
+ * Auth credential with database row ID for updates/deletes.
+ * Wraps AuthCredential with storage metadata.
+ */
+export interface StoredAuthCredential {
+    id: number;
+    provider: string;
+    credential: AuthCredential;
+    disabledCause: string | null;
+}
+/** One persisted rate-limit block: credential row id + provider-type key + optional scope. */
+export interface StoredCredentialBlock {
+    /** SQLite row id of the credential (auth_credentials.id). */
+    credentialId: number;
+    /** `${provider}:${credentialType}` — same value as AuthStorage's in-memory providerKey. */
+    providerKey: string;
+    /** Block scope (e.g. "tier:fable"); empty string = unscoped. Never NUL-delimited. */
+    blockScope: string;
+    /** Epoch milliseconds. */
+    blockedUntilMs: number;
+    /** Last row update timestamp in epoch milliseconds, when provided by the backing store. */
+    updatedAtMs?: number;
+}
+/**
+ * Identity slice of a disabled (soft-deleted) credential tombstone — cause and
+ * account identity only, never token material. Surfaced so auto-disabled
+ * accounts (e.g. an expired Anthropic OAuth grant) stay visible in `omp usage`
+ * instead of silently vanishing until the user notices missing quota.
+ */
+export interface DisabledCredentialSummary {
+    /** Database row id (matches {@link StoredAuthCredential.id}). */
+    id: number;
+    provider: string;
+    type: AuthCredential["type"];
+    email?: string;
+    accountId?: string;
+    /** Organization/workspace the credential was scoped to (Anthropic/ChatGPT multi-subscription). */
+    orgId?: string;
+    orgName?: string;
+    /** Verbatim disable cause captured when the row was torn down. */
+    cause: string;
+    /** Epoch ms the row was disabled (SQLite `updated_at`), when known. */
+    disabledAtMs?: number;
+}
+/**
+ * Per-credential health record returned by {@link AuthStorage.checkCredentials}.
+ *
+ * Use this to identify which credential in a multi-account pool is causing
+ * auth errors. `ok` is tri-state:
+ *
+ * - `true` — credential authenticated against the provider's auth-verifying
+ *   probe (today: the usage endpoint). For OAuth this also exercises refresh
+ *   when the access token was expired.
+ * - `false` — the probe rejected the credential (401/403/refresh failure/etc).
+ *   `reason` carries the upstream error string.
+ * - `null` — no probe is configured for this provider (or the configured
+ *   probe doesn't support this credential type). The credential's auth
+ *   status is unverifiable from here.
+ */
+export interface CredentialHealthResult {
+    /** Database row id (matches {@link StoredAuthCredential.id}). */
+    id: number;
+    provider: string;
+    type: AuthCredential["type"];
+    /** OAuth email if known on the stored credential or surfaced by the probe. */
+    email?: string;
+    /** OAuth account id if known. */
+    accountId?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic/ChatGPT multi-subscription). */
+    orgId?: string;
+    orgName?: string;
+    /** `true` when the refresh token lives on a remote broker (sentinel was present). */
+    remoteRefresh?: true;
+    ok: boolean | null;
+    /** Failure / unverifiable reason; absent when `ok === true`. */
+    reason?: string;
+    /** Probe usage report (raw payload stripped) when `ok === true`. */
+    report?: Omit<UsageReport, "raw">;
+    /**
+     * Result of the optional end-to-end completion probe (see
+     * {@link CheckCredentialsOptions.completionProbe}). Absent when no probe was
+     * supplied. The completion probe exercises the provider's chat-completion
+     * endpoint with the credential's bearer bytes, which is a stricter signal
+     * than the usage endpoint (some providers happily 200 a `/usage` call while
+     * the chat endpoint 401s the same bearer).
+     */
+    completion?: CredentialCompletionResult;
+}
+/**
+ * Outcome of the end-to-end completion probe. `null` means the probe was
+ * skipped (no bearer bytes were available — e.g. OAuth refresh failed
+ * upstream of the probe).
+ */
+export interface CredentialCompletionResult {
+    ok: boolean | null;
+    /** Failure / unverifiable reason; absent when `ok === true`. */
+    reason?: string;
+    /** Probe model id used (carried back from the caller for display). */
+    modelId?: string;
+    /** Round-trip latency in milliseconds. */
+    latencyMs?: number;
+}
+/**
+ * Credential payload handed to {@link CompletionProbe}. For API-key
+ * credentials only the bytes are exposed; for OAuth, every identity field
+ * carried by the refreshed credential is included so the probe can compose
+ * provider-specific apiKey shapes (e.g. GitHub Copilot / Google Gemini CLI
+ * expect a JSON blob with `token` + `projectId`, not the raw access token).
+ *
+ * `refreshToken` may be {@link REMOTE_REFRESH_SENTINEL} when the credential
+ * lives behind a broker; the chat endpoint never reads it, so the probe can
+ * forward it verbatim into the structured shape without harm.
+ */
+export type CompletionProbeCredential = {
+    type: "api_key";
+    apiKey: string;
+} | {
+    type: "oauth";
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    accountId?: string;
+    projectId?: string;
+    email?: string;
+    enterpriseUrl?: string;
+    apiEndpoint?: string;
+};
+/**
+ * Caller-supplied bearer probe. Receives the post-refresh credential for a
+ * single row and reports whether a real chat-completion round-trip succeeds.
+ * The check-credentials pipeline calls this AFTER any OAuth refresh so the
+ * bytes match what a live request would send.
+ */
+export interface CompletionProbeInput {
+    provider: Provider;
+    credentialId: number;
+    credential: CompletionProbeCredential;
+    signal: AbortSignal;
+}
+export type CompletionProbe = (input: CompletionProbeInput) => Promise<CredentialCompletionResult>;
+export interface CheckCredentialsOptions {
+    signal?: AbortSignal;
+    /** Per-credential probe timeout (ms). Defaults to the configured usage request timeout. */
+    timeoutMs?: number;
+    /** Provider → base URL override, same shape as {@link AuthStorage.fetchUsageReports}. */
+    baseUrlResolver?: (provider: Provider) => string | undefined;
+    /**
+     * Optional end-to-end probe. When provided, `checkCredentials` invokes it
+     * for every credential where a usable bearer is available (API key, or
+     * OAuth access token after refresh-on-expiry succeeded). The result lands
+     * on {@link CredentialHealthResult.completion}.
+     *
+     * The probe runs INDEPENDENTLY of whether a {@link UsageProvider} is
+     * configured: providers without a usage endpoint still benefit from the
+     * extra signal. The probe is NOT invoked when OAuth refresh fails — the
+     * bytes would be stale anyway and the upstream failure is already captured
+     * on `reason`.
+     */
+    completionProbe?: CompletionProbe;
+    /** Per-credential completion probe timeout (ms). Defaults to `timeoutMs`. */
+    completionTimeoutMs?: number;
+}
+/**
+ * Sentinel value placed in OAuth `refresh` fields when a credential is shared
+ * via {@link AuthStorage.exportSnapshot}. Refresh tokens never leave the broker;
+ * clients must call back to refresh.
+ */
+export declare const REMOTE_REFRESH_SENTINEL: "__remote__";
+export type RemoteRefreshSentinel = typeof REMOTE_REFRESH_SENTINEL;
+/** OAuth credential with refresh token replaced by the broker sentinel. */
+export type RemoteOAuthCredential = Omit<OAuthCredential, "refresh"> & {
+    refresh: RemoteRefreshSentinel;
+};
+/** Discriminated credential payload as published by the broker. */
+export type SnapshotCredential = ApiKeyCredential | RemoteOAuthCredential;
+export interface AuthCredentialSnapshotEntry {
+    id: number;
+    provider: string;
+    credential: SnapshotCredential;
+    identityKey: string | null;
+}
+/**
+ * Wire-shaped snapshot exported by {@link AuthStorage.exportSnapshot} and
+ * served by the auth-broker server on `GET /v1/snapshot`.
+ */
+export interface AuthCredentialSnapshot {
+    generation: number;
+    generatedAt: number;
+    credentials: AuthCredentialSnapshotEntry[];
+}
+/**
+ * Persistence abstraction consumed by {@link AuthStorage}.
+ *
+ * Concrete implementations:
+ * - {@link SqliteAuthCredentialStore} — local SQLite-backed store (default).
+ * - `RemoteAuthCredentialStore` from `./auth-broker` — client-side snapshot of
+ *   a remote broker; mutating methods (`replace*`, `upsert*`, `delete*ForProvider`)
+ *   throw because login flows route through the broker, not the client.
+ */
+export interface CredentialRefreshLeaseFence {
+    owner: string;
+    nowMs: number;
+}
+export interface AuthCredentialStore {
+    close(): void;
+    /**
+     * Stateful probe for commits made by another process to the backing store.
+     * Returns true once per observed change.
+     */
+    pollExternalChanges?(): boolean;
+    /** Record the current auth revision after a local mutation already notified consumers. */
+    acknowledgeLocalChanges?(): void;
+    /** Optional hook to notify the underlying store that usage report cache is stale. */
+    invalidateUsageCache?(signal?: AbortSignal): Promise<void>;
+    listAuthCredentials(provider?: string): StoredAuthCredential[];
+    /**
+     * Optional store hook to re-hydrate the credential snapshot from its
+     * backing source. Remote broker stores re-fetch `GET /v1/snapshot` so a
+     * disk-cached snapshot (up to an hour stale) cannot be paired with live
+     * per-credential data; local SQLite stores omit it — their reads are
+     * always current.
+     */
+    refreshSnapshot?(): Promise<unknown>;
+    /**
+     * Disabled credential tombstones (see {@link DisabledCredentialSummary}).
+     * Optional: remote stores forward to the broker's
+     * `GET /v1/credentials/disabled` (empty list when the broker predates the
+     * endpoint); stores without tombstones omit it.
+     */
+    listDisabledCredentials?(provider?: string, signal?: AbortSignal): Promise<DisabledCredentialSummary[]>;
+    updateAuthCredential(id: number, credential: AuthCredential): void;
+    deleteAuthCredential(id: number, disabledCause: string): void;
+    tryDisableAuthCredentialIfMatches(id: number, expectedData: string, disabledCause: string, lease?: CredentialRefreshLeaseFence): boolean;
+    tryUpdateAuthCredentialIfMatches?(id: number, expectedData: string, credential: AuthCredential, lease?: CredentialRefreshLeaseFence): boolean;
+    replaceAuthCredentialsForProvider(provider: string, credentials: AuthCredential[]): StoredAuthCredential[];
+    upsertAuthCredentialForProvider(provider: string, credential: AuthCredential): StoredAuthCredential[];
+    deleteAuthCredentialsForProvider(provider: string, disabledCause: string): void;
+    getCache(key: string, options?: {
+        includeExpired?: boolean;
+    }): string | null;
+    setCache(key: string, value: string, expiresAtSec: number): void;
+    /** Drop all cache rows whose keys start with the supplied prefix. */
+    deleteCachePrefix?(prefix: string): void;
+    cleanExpiredCache(): void;
+    /** Non-expired block for one (credential, providerKey, scope) key, or undefined. */
+    getCredentialBlock?(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    /** Earliest time a shared-store block should be eligible for live-usage reconciliation. */
+    getCredentialBlockReconcileAfter?(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    /** Upsert with MAX semantics: keep the later blockedUntilMs on conflict. */
+    upsertCredentialBlock?(block: StoredCredentialBlock): void;
+    /** Drop one block row for a credential/provider/scope key. */
+    deleteCredentialBlock?(credentialId: number, providerKey: string, blockScope: string): void;
+    /** Drop every block row for a credential (all providerKeys/scopes). */
+    deleteCredentialBlocks?(credentialId: number): void;
+    /** Prune rows with blocked_until_ms <= nowMs. */
+    cleanExpiredCredentialBlocks?(nowMs: number): void;
+    /** List non-expired blocks for broker snapshots. */
+    listCredentialBlocks?(credentialIds: readonly number[]): StoredCredentialBlock[];
+    tryAcquireCredentialRefreshLease?(credentialId: number, owner: string, expiresAtMs: number): boolean;
+    getCredentialRefreshLeaseExpiresAt?(credentialId: number): number | undefined;
+    releaseCredentialRefreshLease?(credentialId: number, owner: string): void;
+    renewCredentialRefreshLease?(credentialId: number, owner: string, expiresAtMs: number): boolean;
+    /**
+     * Append usage-limit snapshots for trend history. Optional: stores without
+     * durable storage (e.g. the broker remote store) omit it and recording is
+     * skipped — the broker host records into its own database instead.
+     */
+    recordUsageSnapshots?(entries: UsageHistoryEntry[]): void;
+    /** Append observed request costs for providers without upstream usage APIs. */
+    recordUsageCosts?(entries: UsageCostHistoryEntry[]): void;
+    /** Read observed request costs, oldest first. */
+    listUsageCosts?(query?: UsageCostHistoryQuery): UsageCostHistoryEntry[];
+    /** Read recorded usage-limit snapshots, oldest first. */
+    listUsageHistory?(query?: UsageHistoryQuery): UsageHistoryEntry[];
+    /**
+     * Client hook: forward locally observed request usage. Remote broker stores
+     * batch these to the broker so it can attribute token burn per install;
+     * local stores omit it and observation is skipped.
+     */
+    recordObservedUsage?(entries: ObservedUsageEntry[]): void;
+    /** Broker host: persist one client's observed-usage report. */
+    recordClientUsage?(report: ClientUsageReport): void;
+    /** Broker host: aggregate recorded per-client usage since a timestamp. */
+    getClientUsageSummary?(sinceMs: number): ClientUsageSummary;
+    /**
+     * Optional store-supplied OAuth refresh. When present, `AuthStorage` uses
+     * it before the per-provider local refresh path. `RemoteAuthCredentialStore`
+     * implements this against the broker; SQLite stores leave it undefined.
+     *
+     * Precedence: `AuthStorageOptions.refreshOAuthCredential` > this hook > local.
+     *
+     * `signal` propagates the agent's cancel (ESC, request abort, …) all the
+     * way to the broker fetch so a hung connection can't strand the caller
+     * for `timeoutMs * (maxRetries + 1)`.
+     */
+    refreshOAuthCredential?(provider: Provider, credentialId: number, credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredentials>;
+    /**
+     * Optional async pre-read hook invoked after AuthStorage selects a stored
+     * credential but before it returns that credential for an outbound request.
+     * Remote broker stores use this to wait out imminent rotations and refresh
+     * their local snapshot before the caller sees a stale access token.
+     */
+    prepareForRequest?(credentialId: number, opts?: {
+        signal?: AbortSignal;
+    }): Promise<boolean | undefined>;
+    /**
+     * Optional store-supplied aggregate usage fetch. When present, `AuthStorage`
+     * routes `fetchUsageReports()` here instead of fanning out per-credential.
+     * `RemoteAuthCredentialStore` proxies to the broker (whose datacenter IP
+     * isn't rate-limited like a heavy residential client).
+     *
+     * Precedence: `AuthStorageOptions.fetchUsageReports` > this hook > local fan-out.
+     *
+     * `signal` propagates the agent's cancel down to the broker fetch.
+     */
+    fetchUsageReports?(signal?: AbortSignal): Promise<UsageReport[] | null>;
+    /**
+     * Optional store-supplied per-credential usage report lookup. When present,
+     * `AuthStorage` consults this before its own per-credential upstream fetch
+     * (`#getUsageReport`). `RemoteAuthCredentialStore` implements this against
+     * the broker's aggregate `/v1/usage` (one coalesced round-trip shared across
+     * all callers) so multi-credential ranking on the client never hits the
+     * upstream provider's rate-limited usage endpoint from the laptop IP.
+     *
+     * Returning `null` is authoritative — `AuthStorage` does NOT fall back to
+     * the local fetch path. The store hook owns the decision, since falling
+     * back would re-introduce the per-IP rate-limit problem the broker exists
+     * to avoid.
+     *
+     * `signal` propagates the agent's cancel down to the broker fetch.
+     */
+    getUsageReport?(provider: Provider, credential: OAuthCredential, signal?: AbortSignal): Promise<UsageReport | null>;
+    /**
+     * Optional store hook to ingest a parsed provider usage report for one OAuth
+     * credential. Remote broker stores use this to overlay header-derived limits
+     * onto their cached aggregate `/v1/usage` response without mutating broker
+     * state.
+     */
+    ingestUsageReport?(provider: Provider, credential: OAuthCredential, report: UsageReport): boolean;
+    /**
+     * Optional store hook to invalidate a specific credential after the upstream
+     * provider returned 401 on a supposedly-fresh key. Remote stores force the
+     * broker to re-issue the row; local stores can leave it undefined and let
+     * {@link AuthStorage.invalidateCredentialMatching} fall back to `reload()`.
+     */
+    markCredentialSuspect?(credentialId: number, opts?: {
+        signal?: AbortSignal;
+    }): Promise<void>;
+    /**
+     * Optional async write hook for upserting a single credential. When present,
+     * `AuthStorage.#upsertOAuthCredential` routes through this instead of the
+     * sync `upsertAuthCredentialForProvider`. `RemoteAuthCredentialStore` uses
+     * it to send the upsert to the broker via `POST /v1/credential`.
+     *
+     * Implementations MUST update the in-memory snapshot before returning so the
+     * post-write read path is consistent.
+     */
+    upsertAuthCredentialRemote?(provider: string, credential: AuthCredential): Promise<StoredAuthCredential[]>;
+    /**
+     * Optional async write hook for replace-all semantics (e.g. API-key login
+     * overwriting any previous keys for the same provider). When present,
+     * `AuthStorage.set` routes through this instead of the sync
+     * `replaceAuthCredentialsForProvider`.
+     */
+    replaceAuthCredentialsRemote?(provider: string, credentials: AuthCredential[]): Promise<StoredAuthCredential[]>;
+    /**
+     * Optional async write hook for disabling one stored credential. Remote stores
+     * use it to await broker persistence before AuthStorage updates its snapshot.
+     */
+    deleteAuthCredentialRemote?(id: number, disabledCause: string): Promise<boolean>;
+    /**
+     * Optional async write hook for clearing every credential for a provider
+     * (logout). When present, `AuthStorage.remove` routes through this instead
+     * of the sync `deleteAuthCredentialsForProvider`.
+     */
+    deleteAuthCredentialsRemote?(provider: string, disabledCause: string): Promise<void>;
+}
+/**
+ * Event payload describing a credential that was just soft-disabled.
+ *
+ * Today the only call site is OAuth refresh failures with a definitive cause
+ * (`invalid_grant`, `401/403` not from a network blip, etc.) — the
+ * disabled_cause string is the verbatim error captured for forensics.
+ *
+ * Subscribers can use this to surface a notification, banner, or auto-launch
+ * a re-login flow instead of letting the credential silently disappear.
+ */
+export interface CredentialDisabledEvent {
+    provider: string;
+    disabledCause: string;
+}
+export type AuthStorageOptions = {
+    usageProviderResolver?: (provider: Provider) => UsageProvider | undefined;
+    rankingStrategyResolver?: (provider: Provider) => CredentialRankingStrategy | undefined;
+    usageFetch?: typeof fetch;
+    usageRequestTimeoutMs?: number;
+    usageLogger?: UsageLogger;
+    /**
+     * Resolve a config value (API key, header value, etc.) to an actual value.
+     * - coding-agent injects its resolveConfigValue (supports "!command" syntax via pi-natives)
+     * - Default: checks environment variable first, then treats as literal
+     */
+    configValueResolver?: (config: string) => Promise<string | undefined>;
+    /**
+     * Optional callback fired when AuthStorage automatically disables a
+     * credential because something detected it as no longer usable — today
+     * that's the OAuth refresh-failure path in `getApiKey`. NOT fired for
+     * user-initiated `remove()` (the user already knows) or dedup of
+     * duplicate credentials (uninteresting hygiene).
+     */
+    onCredentialDisabled?: (event: CredentialDisabledEvent) => void | Promise<void>;
+    /**
+     * Override OAuth refresh. When set, `AuthStorage` calls this instead of the
+     * per-provider local refresh function. Receives the credential id so the
+     * implementation can address remote credentials.
+     *
+     * Must return updated {@link OAuthCredentials} with at least `access` and
+     * `expires`. `refresh` may be an opaque sentinel (e.g. `"__remote__"`) when
+     * the actual refresh token never leaves the broker.
+     */
+    refreshOAuthCredential?: (provider: Provider, credentialId: number, credential: OAuthCredential, signal?: AbortSignal) => Promise<OAuthCredentials>;
+    /**
+     * Human-readable description of the credential store backing this
+     * AuthStorage instance. Surfaced through {@link AuthStorage.describeCredentialSource}
+     * so the TUI can show where a token came from (broker URL or local SQLite path).
+     *
+     * Examples:
+     * - `"local ~/.omp/agent/agent.db"`
+     * - `"broker http://omp.internal:8765"`
+     */
+    sourceLabel?: string;
+    /**
+     * Override `fetchUsageReports`. When set, `AuthStorage.fetchUsageReports`
+     * calls this instead of fanning out per-credential. The primary use case is
+     * routing through a broker that egresses from a less-throttled IP — e.g. a
+     * residential laptop trips Anthropic's per-IP rate limit on the usage
+     * endpoint and drops 2-of-5 credentials, while the VPS broker gets all 5.
+     *
+     * Implementations may return null when no usage data is available; the
+     * AuthStorage caller surfaces that to its own consumer unchanged.
+     */
+    fetchUsageReports?: (signal?: AbortSignal) => Promise<UsageReport[] | null>;
+};
+export { isDefinitiveOAuthFailure } from "./error/auth-classify.js";
+/**
+ * Outcome of {@link AuthStorage.markUsageLimitReached}.
+ *
+ * `switched` is `true` when an unblocked same-type sibling credential is
+ * available right now, so the caller can retry immediately and the next
+ * `getApiKey` will hand it out. When `false`, `retryAtMs` (epoch ms) carries
+ * the earliest moment any same-type sibling's temporary block expires —
+ * callers should prefer waiting until then over the provider's (often
+ * multi-hour) retry-after when it is sooner. `retryAtMs` is `undefined` when
+ * no sibling credentials exist at all, or when the session has no tracked
+ * credential to rotate away from.
+ */
+export interface UsageLimitMarkResult {
+    switched: boolean;
+    retryAtMs?: number;
+}
+export type ModelUsageHealthState = "healthy" | "reserve" | "depleted" | "unknown";
+export interface ModelUsageAccountHealth {
+    credentialId: number;
+    credentialType: AuthCredential["type"];
+    /** True when this credential is currently sticky for options.sessionId. */
+    selected?: true;
+    state: ModelUsageHealthState;
+    remainingFraction?: number;
+    resetsAt?: number;
+}
+export interface ModelUsageHealth {
+    state: ModelUsageHealthState;
+    accounts: ModelUsageAccountHealth[];
+}
+export interface ModelUsageHealthOptions {
+    modelId?: string;
+    sessionId?: string;
+    baseUrl?: string;
+    reserveFraction: number;
+    signal?: AbortSignal;
+}
+type AuthApiKeyOptions = {
+    baseUrl?: string;
+    modelId?: string;
+    /**
+     * Caller's cancel signal. Threaded into any broker-bound OAuth refresh so
+     * `ESC` / request abort actually kills a hung broker fetch instead of
+     * stranding the caller for `timeoutMs * (maxRetries + 1)`.
+     */
+    signal?: AbortSignal;
+    /**
+     * Force a re-mint of the session-preferred OAuth credential's access token,
+     * bypassing the not-yet-expired short-circuit. Powers step (b) of the
+     * auth-retry policy ("refresh the SAME account") so a locally-cached token
+     * that a peer/broker rotated out from under us is replaced before retrying.
+     */
+    forceRefresh?: boolean;
+};
+/**
+ * Refreshed OAuth access plus identity metadata returned by
+ * {@link AuthStorage.getOAuthAccess}. Callers that authenticate via a bearer
+ * AND need the credential's identity (Codex `chatgpt-account-id`, Google
+ * `projectId`, GitHub `enterpriseUrl`) consume this shape directly; the
+ * refresh slot is deliberately omitted because rotating refresh tokens never
+ * leave {@link AuthStorage}.
+ */
+export interface OAuthAccess {
+    accessToken: string;
+    credentialId?: number;
+    accountId?: string;
+    email?: string;
+    projectId?: string;
+    enterpriseUrl?: string;
+    apiEndpoint?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic/ChatGPT multi-subscription). */
+    orgId?: string;
+    orgName?: string;
+}
+/**
+ * Identity slice of the credential a successful {@link AuthStorage.login}
+ * stored — lets callers confirm WHICH account (and for Anthropic, which
+ * organization/subscription) was added, without exposing tokens.
+ */
+export interface OAuthLoginIdentity {
+    type: "oauth" | "api_key";
+    email?: string;
+    accountId?: string;
+    orgId?: string;
+    orgName?: string;
+}
+export interface OAuthAccessFailure {
+    credentialId?: number;
+    accountId?: string;
+    email?: string;
+    projectId?: string;
+    enterpriseUrl?: string;
+    apiEndpoint?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic/ChatGPT multi-subscription). */
+    orgId?: string;
+    orgName?: string;
+    error: string;
+}
+/**
+ * Identity of the OAuth credential a session is currently routed to. Read-only
+ * display/metadata shape: `accountId` is the provider's account UUID, `email`
+ * the user-facing login, `projectId` the GCP-style project for providers that
+ * key usage on it (Gemini CLI / Antigravity).
+ */
+export interface OAuthAccountIdentity {
+    accountId?: string;
+    email?: string;
+    projectId?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic/ChatGPT multi-subscription). */
+    orgId?: string;
+    orgName?: string;
+}
+export type OAuthAccessResolution = ({
+    ok: true;
+} & OAuthAccess) | ({
+    ok: false;
+} & OAuthAccessFailure);
+/**
+ * Read-only identity of one stored OAuth account, in stable storage order.
+ * Returned by {@link AuthStorage.listOAuthAccounts}; `position` (0-based) is the
+ * selector accepted by {@link AuthStorage.getOAuthAccessAt}.
+ */
+export interface OAuthAccountSummary {
+    position: number;
+    credentialId: number;
+    accountId?: string;
+    email?: string;
+    projectId?: string;
+    enterpriseUrl?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic/ChatGPT multi-subscription). */
+    orgId?: string;
+    orgName?: string;
+    /** True when this account is the session-sticky OAuth credential requested by `listOAuthAccounts`. */
+    active: boolean;
+}
+export interface InvalidateCredentialMatchingOptions {
+    signal?: AbortSignal;
+    sessionId?: string;
+}
+/** Options for refreshing one stored OAuth row through durable ownership. */
+export interface StoredOAuthRefreshOptions<T extends OAuthCredential = OAuthCredential> {
+    /** Stable row id when a provider has multiple OAuth credentials. */
+    credentialId?: number;
+    observedCredential?: T;
+    credentialFromRow: (credential: OAuthCredential) => T | undefined;
+    forceRefresh?: boolean;
+    canRefresh?: (credential: T) => boolean;
+    refreshSkewMs?: number;
+    signal?: AbortSignal;
+    keepCredentialOnRefreshFailure?: boolean | ((error: unknown) => boolean);
+    onRefreshFailure?: (error: unknown) => void;
+    refreshTimeoutMs?: number;
+    refresh: (credential: T, signal?: AbortSignal) => Promise<OAuthCredentials>;
+    mergeRefreshedCredential?: (credential: T, refreshed: OAuthCredentials) => T;
+    isDefinitiveFailure?: (error: unknown) => boolean;
+    disabledCause?: (error: unknown) => string;
+}
+/** Result of a stored OAuth refresh attempt. */
+export interface StoredOAuthRefreshResult<T extends OAuthCredential = OAuthCredential> {
+    credential: T | undefined;
+    refreshed: boolean;
+    removed: boolean;
+}
+/**
+ * Identifies which stored account to redeem a saved rate-limit reset for.
+ * Any one field is enough; `credentialId` is the most precise.
+ */
+export interface ResetCreditTarget {
+    credentialId?: number;
+    accountId?: string;
+    email?: string;
+}
+/** Outcome of {@link AuthStorage.redeemResetCredit}. */
+export interface ResetCreditRedeemOutcome {
+    /** `true` only when a reset was actually applied (`code === "reset"`). */
+    ok: boolean;
+    /**
+     * Result code. Backend codes: `reset` (success), `already_redeemed`,
+     * `no_credit`, `nothing_to_reset`. Locally-synthesized: `no_account`
+     * (target not found), `account_unavailable` (token refresh failed),
+     * `credit_list_failed` (transport/auth failure while listing credits —
+     * retryable, unlike a genuine `no_credit`), `http_<status>` (unexpected
+     * HTTP).
+     */
+    code: CodexResetConsumeCode;
+    accountId?: string;
+    email?: string;
+    /** The credit that was spent (when one was). */
+    creditId?: string;
+}
+/** One stored account's live saved-reset status, from {@link AuthStorage.listResetCredits}. */
+export interface ResetCreditAccountStatus {
+    credentialId?: number;
+    accountId?: string;
+    email?: string;
+    /** Resets redeemable for this account right now (live, not cached). */
+    availableCount: number;
+    credits: CodexResetCredit[];
+    /** Whether this is the given session's active account. */
+    active: boolean;
+    /** Set when the account's token refresh or list call failed. */
+    error?: string;
+}
+/**
+ * Credential storage backed by an AuthCredentialStore.
+ * Reads from storage on reload(), manages round-robin credential selection,
+ * usage limit tracking, and OAuth token refresh.
+ */
+export declare class AuthStorage {
+    #private;
+    constructor(store: AuthCredentialStore, options?: AuthStorageOptions);
+    /**
+     * Create an AuthStorage instance backed by a AuthCredentialStore.
+     * Convenience factory for standalone use (e.g., pi-ai CLI).
+     * @param dbPath - Path to SQLite database
+     */
+    static create(dbPath: string, options?: AuthStorageOptions): Promise<AuthStorage>;
+    /**
+     * Close the underlying credential store.
+     *
+     * After calling this, the instance must not be reused.
+     */
+    close(): void;
+    getGeneration(): number;
+    /**
+     * Reload state after another process commits to the backing store, then
+     * notify snapshot consumers even when only credential blocks changed.
+     */
+    pollExternalChanges(): Promise<boolean>;
+    onGenerationChanged(listener: (generation: number) => void): () => void;
+    offGenerationChanged(listener: (generation: number) => void): void;
+    /**
+     * Subscribe to {@link CredentialDisabledEvent}s. Multiple subscribers are supported and
+     * each fires for every disable event; subscribers are invoked in registration order with
+     * exceptions and async rejections isolated per-listener so a misbehaving subscriber
+     * cannot break the disable path or starve the rest of the chain.
+     *
+     * If `credential_disabled` events were emitted while no listener was subscribed, they are
+     * replayed (in insertion order) to the listener that triggers the empty→non-empty
+     * transition. The drain is one-shot — listeners that subscribe after that no longer see
+     * past events.
+     *
+     * Returns an unsubscribe function. The function is idempotent: calling it more than once
+     * is a no-op. After every subscriber has unsubscribed, subsequent disable events buffer
+     * again until the next subscribe.
+     *
+     * @param listener Callback invoked with each disable event. May be sync or async.
+     * @returns A function that removes this listener from the subscriber set.
+     */
+    onCredentialDisabled(listener: (event: CredentialDisabledEvent) => void | Promise<void>): () => void;
+    /**
+     * Set a runtime API key override (not persisted to disk).
+     * Used for CLI --api-key flag.
+     */
+    setRuntimeApiKey(provider: string, apiKey: string): void;
+    /**
+     * Remove a runtime API key override.
+     */
+    removeRuntimeApiKey(provider: string): void;
+    /**
+     * Register a per-provider API key sourced from user configuration
+     * (e.g. `models.yml` `providers.<name>.apiKey`). Higher priority than
+     * stored credentials and OAuth tokens — when the user pins a key in
+     * config, that key is what authenticates outbound requests, regardless
+     * of whatever the broker happens to have loaded for that provider.
+     *
+     * Lower priority than {@link setRuntimeApiKey} so a CLI `--api-key`
+     * still wins for the duration of a single invocation.
+     */
+    setConfigApiKey(provider: string, apiKey: string): void;
+    /**
+     * Remove a single config-sourced API key override.
+     */
+    removeConfigApiKey(provider: string): void;
+    /**
+     * Drop every config-sourced API key. Called by `ModelRegistry` before
+     * re-parsing `models.yml` so removed entries actually disappear.
+     */
+    clearConfigApiKeys(): void;
+    /**
+     * Set a fallback resolver for API keys not found in storage or env vars.
+     * Used for custom provider keys from models.json.
+     */
+    setFallbackResolver(resolver: (provider: string) => string | undefined): void;
+    /**
+     * Reload credentials from storage.
+     */
+    reload(): Promise<void>;
+    /**
+     * Get credential for a provider (first entry if multiple).
+     */
+    get(provider: string): AuthCredential | undefined;
+    /**
+     * Set credential for a provider.
+     */
+    set(provider: string, credential: AuthCredentialEntry): Promise<void>;
+    /**
+     * List stored credential rows, optionally filtered by provider.
+     */
+    listStoredCredentials(provider?: string): StoredAuthCredential[];
+    /**
+     * Refresh one stored OAuth credential under durable row ownership.
+     */
+    refreshStoredOAuthCredential<T extends OAuthCredential = OAuthCredential>(provider: string, options: StoredOAuthRefreshOptions<T>): Promise<StoredOAuthRefreshResult<T>>;
+    /**
+     * Remove credential for a provider.
+     */
+    remove(provider: string): Promise<void>;
+    /**
+     * Remove one stored credential for a provider.
+     */
+    removeCredential(provider: string, credentialId: number): Promise<boolean>;
+    /**
+     * List all providers with credentials.
+     */
+    list(): string[];
+    /**
+     * Check if credentials exist for a provider in storage.
+     */
+    has(provider: string): boolean;
+    /**
+     * Check if any form of auth is configured for a provider.
+     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
+     */
+    hasAuth(provider: string): boolean;
+    /**
+     * True iff a dedicated, non-env credential source is configured for this
+     * provider — i.e. anything in the cascade EXCEPT `getEnvApiKey(provider)`.
+     *
+     * Mirrors `hasAuth` minus the env-fallback leg. Useful for callers that
+     * need to distinguish "the user explicitly configured this provider"
+     * from "an env var happens to alias this provider via the cross-provider
+     * fallback map" (see e.g. `xai-oauth → XAI_OAUTH_TOKEN || XAI_API_KEY` in
+     * `stream.ts`). Without that distinction, an `XAI_API_KEY`-only setup
+     * silently satisfies xai-oauth and routes around `providers.xai.baseUrl`.
+     */
+    hasNonEnvCredential(provider: string): boolean;
+    /**
+     * Classify where a provider's auth comes from, following the same precedence
+     * as {@link AuthStorage.getApiKey}: runtime override → config override →
+     * stored OAuth → login-stored api_key → env var → stored api_key →
+     * fallback resolver. Returns undefined when no auth is configured.
+     *
+     * Compact, structured counterpart to {@link describeCredentialSource}.
+     */
+    getCredentialOrigin(provider: string): CredentialOrigin | undefined;
+    /**
+     * Check if OAuth credentials are configured for a provider.
+     */
+    hasOAuth(provider: string): boolean;
+    /**
+     * Get OAuth credentials for a provider.
+     */
+    getOAuthCredential(provider: string): OAuthCredential | undefined;
+    /**
+     * Get the OAuth `accountId` for a provider, preferring the credential that is
+     * session-sticky for `sessionId` when multiple OAuth credentials are configured.
+     * Falls back to the first OAuth credential when no session preference exists (e.g.
+     * first call before any `getApiKey` has been issued, or single-credential setups).
+     * Returns `undefined` when no OAuth credential carries an `accountId`.
+     */
+    getOAuthAccountId(provider: string, sessionId?: string): string | undefined;
+    /**
+     * Get the OAuth account identity for a provider, preferring the credential that
+     * is session-sticky for `sessionId`. This is a read-only lookup for display and
+     * metadata paths; it does not refresh tokens, rank usage, or advance selection.
+     */
+    getOAuthAccountIdentity(provider: string, sessionId?: string): OAuthAccountIdentity | undefined;
+    /**
+     * Get all credentials.
+     */
+    getAll(): AuthStorageData;
+    /**
+     * Login to an OAuth provider. Resolves with the stored credential's
+     * identity slice (or `undefined` when nothing was stored) so callers can
+     * surface which account — and for Anthropic, which organization — the
+     * login registered.
+     */
+    login(provider: OAuthProviderId, ctrl: OAuthController & {
+        /** onAuth is required by auth-storage but optional in OAuthController */
+        onAuth: (info: OAuthAuthInfo) => void;
+        /** onPrompt is required for some providers (github-copilot, openai-codex) */
+        onPrompt: (prompt: {
+            message: string;
+            placeholder?: string;
+        }) => Promise<string>;
+    }): Promise<OAuthLoginIdentity | undefined>;
+    /**
+     * Logout from a provider.
+     */
+    logout(provider: string): Promise<void>;
+    /**
+     * Recorded usage-limit snapshots, oldest first. Empty when the underlying
+     * store has no durable history (e.g. a broker-backed remote store).
+     */
+    listUsageHistory(query?: UsageHistoryQuery): UsageHistoryEntry[];
+    /** Record one observed provider request cost for later local usage aggregation. */
+    recordUsageCost(provider: Provider, costUsd: number, options?: {
+        sessionId?: string;
+        recordedAt?: number;
+        baseUrl?: string;
+    }): boolean;
+    /**
+     * Forward one completed request's usage to the store's observer hook.
+     * Broker-backed stores batch these into per-install reports so the broker
+     * can track actual token burn per client; local stores have no hook and
+     * the call is a no-op.
+     */
+    recordObservedUsage(entry: {
+        provider: Provider;
+        model: string;
+        usage: {
+            input: number;
+            output: number;
+            cacheRead: number;
+            cacheWrite: number;
+        };
+        costUsd?: number;
+        at?: number;
+    }): void;
+    /** Broker host: persist one client's observed-usage report (per-install token burn). */
+    recordClientUsage(report: ClientUsageReport): boolean;
+    /** Broker host: aggregate recorded per-client usage since `sinceMs`. */
+    getClientUsageSummary(sinceMs: number): ClientUsageSummary;
+    ingestUsageHeaders(provider: Provider, headers: Record<string, string>, options?: {
+        sessionId?: string;
+        baseUrl?: string;
+    }): boolean;
+    /**
+     * The {@link UsageProvider} registered for `provider`, or undefined when the
+     * provider has no usage endpoint at all. Lets callers tell "a credential we
+     * could have fetched usage for but didn't" apart from "a provider with no
+     * usage concept" (web-search keys, local/keyless servers, inference
+     * providers without a usage API) — the latter never warrants a usage row.
+     */
+    usageProviderFor(provider: Provider): UsageProvider | undefined;
+    /**
+     * Return model ids whose live reports map to a quantitative usage scope.
+     * Provider strategies supply model/tier mapping when available; otherwise
+     * only explicitly matching model ids and account-wide shared limits count.
+     * Label-only or ambiguous tier limits are excluded rather than guessed.
+     */
+    getUsageReportingModelIds(provider: Provider, modelIds: readonly string[], reports: readonly UsageReport[]): string[];
+    /**
+     * Inspect the credential pool that {@link getApiKey} would use for one model
+     * without advancing round-robin state or changing session stickiness.
+     *
+     * Pool aggregation is deliberately conservative: one healthy sibling makes
+     * the model healthy, while any unknown sibling prevents a depleted/reserve
+     * conclusion. Static runtime/config/env credentials return unknown because
+     * they bypass the managed account pool.
+     */
+    getModelUsageHealth(provider: Provider, options: ModelUsageHealthOptions): Promise<ModelUsageHealth>;
+    /**
+     * Release a session's sticky credential so its next {@link getApiKey} call
+     * re-runs native pool ranking. This never blocks or penalizes the released
+     * account; usage-aware routing uses it when another sibling has more
+     * headroom, before considering a model/provider fallback.
+     */
+    releaseSessionCredentialForReselection(provider: string, sessionId: string): boolean;
+    fetchUsageReports(options?: {
+        baseUrlResolver?: (provider: Provider) => string | undefined;
+        /** Caller's cancel signal; only rejects this caller, never the shared upstream fetch. */
+        signal?: AbortSignal;
+    }): Promise<UsageReport[] | null>;
+    /**
+     * Probe each stored credential against its provider's auth-verifying usage
+     * endpoint and report per-credential auth health.
+     *
+     * Surfaces the identity of failing credentials so callers running a
+     * multi-account pool (e.g. a broker-backed auth-gateway) can tell which
+     * row is producing 401s. The probe mirrors the per-credential fan-out
+     * inside {@link AuthStorage.fetchUsageReports} (OAuth refresh-on-expiry,
+     * then `UsageProvider.fetchUsage`) but does NOT swallow errors — every
+     * credential gets either `ok: true`, `ok: false` with `reason`, or
+     * `ok: null` when no probe is configured for the provider.
+     *
+     * Iterates sequentially to avoid synchronized N-account fan-out that
+     * upstream `/usage` rate limiters (per source IP) treat as a burst.
+     *
+     * Only inspects active rows from {@link AuthCredentialStore.listAuthCredentials};
+     * soft-disabled rows are already known-bad and don't need a network probe.
+     * Environment-variable API keys are not enumerated — the caller's intent
+     * here is "which of my stored credentials is broken".
+     *
+     * Pass {@link CheckCredentialsOptions.completionProbe} to additionally
+     * exercise each credential against the provider's chat-completion endpoint
+     * (strict mode). The result lands on
+     * {@link CredentialHealthResult.completion}; the usage `ok` field is
+     * unchanged so callers can tell the two signals apart.
+     */
+    checkCredentials(options?: CheckCredentialsOptions): Promise<CredentialHealthResult[]>;
+    /**
+     * Marks the current session's credential as temporarily blocked due to usage limits.
+     * Uses usage reports to determine accurate reset time when available.
+     * Returns whether a sibling credential is available now; when none is, also
+     * reports the earliest time a blocked sibling becomes available again so
+     * callers can wait for the sibling instead of the provider's full window.
+     */
+    markUsageLimitReached(provider: string, sessionId: string | undefined, options?: {
+        retryAfterMs?: number;
+        baseUrl?: string;
+        modelId?: string;
+        apiKey?: string;
+        credentialId?: number;
+        signal?: AbortSignal;
+    }): Promise<UsageLimitMarkResult>;
+    /**
+     * Peek at API key for a provider without refreshing OAuth tokens.
+     * Used for model discovery where we only need to know if credentials exist
+     * and get a best-effort token. For GitHub Copilot we preserve enterprise
+     * routing metadata so discovery can hit the correct host.
+     */
+    peekApiKey(provider: string): Promise<string | undefined>;
+    /**
+     * Get API key for a provider.
+     * Priority (first match wins):
+     * 1. Runtime override (CLI --api-key)
+     * 2. Config override (models.yml `providers.<name>.apiKey`)
+     * 3. OAuth token from storage (auto-refreshed)
+     * 4. API key persisted by a successful `/login`
+     * 5. Environment variable
+     * 6. Stored API key (e.g. a broker-migrated copy) — last resort, so an explicit env var wins
+     * 7. Fallback resolver (models.yml custom providers, last-resort)
+     */
+    getApiKey(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<string | undefined>;
+    /**
+     * Resolve the OAuth credential for `provider`, refreshing through the same
+     * pipeline as {@link AuthStorage.getApiKey} but returning the refreshed
+     * {@link OAuthAccess} (raw access token + identity metadata) instead of
+     * the API-key bytes.
+     *
+     * Use this when the caller needs to inject identity headers alongside the
+     * bearer (Codex `chatgpt-account-id`, Google `project`, GitHub
+     * `enterpriseUrl`). For pure "give me the bytes for `Authorization`"
+     * scenarios, prefer {@link AuthStorage.getApiKey}.
+     *
+     * Returns `undefined` when no OAuth credential is available, the
+     * credential fails to refresh, or runtime/config overrides have replaced
+     * OAuth with an explicit API key.
+     */
+    getOAuthAccess(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<OAuthAccess | undefined>;
+    /**
+     * Read-only list of stored OAuth accounts for `provider` in stable storage
+     * order, WITHOUT refreshing any token. The array position (0-based) is the
+     * selector accepted by {@link AuthStorage.getOAuthAccessAt}; a "pick the Nth
+     * account" UI should render `position + 1`.
+     *
+     * When `sessionId` is supplied, the session-sticky OAuth credential is marked
+     * `active`. No account is active before that session has resolved or pinned a
+     * credential.
+     */
+    listOAuthAccounts(provider: string, sessionId?: string): OAuthAccountSummary[];
+    /**
+     * Pin one stored OAuth account as this session's preferred credential.
+     *
+     * The durable credential id keeps the pin stable across credential refreshes,
+     * storage reordering, and process restarts. Normal auth retry and usage-limit
+     * handling may still route around an unavailable account.
+     *
+     * `options.lastUsedAtMs` backdates the sticky's last-use timestamp so a pin
+     * restored from a persisted session keeps the provider's warm-window
+     * semantics: a resume inside the prompt-cache TTL reuses the account, a
+     * stale resume still re-ranks.
+     */
+    pinSessionOAuthAccount(provider: string, sessionId: string, credentialId: number, options?: {
+        lastUsedAtMs?: number;
+    }): boolean;
+    /**
+     * Resolve every stored OAuth credential for `provider` independently.
+     *
+     * Refreshes credentials through the same broker/local path as
+     * {@link AuthStorage.getOAuthAccess}, but does not rank, round-robin, or
+     * stop after the first usable account. Intended for diagnostics that must
+     * exercise each stored account exactly once.
+     */
+    getOAuthAccesses(provider: string, options?: AuthApiKeyOptions): Promise<OAuthAccessResolution[]>;
+    /**
+     * Resolve a single stored OAuth credential by its account position (0-based,
+     * matching {@link AuthStorage.listOAuthAccounts}). Refreshes ONLY that
+     * credential ({@link #resolveStoredOAuthAccess} runs with `allowFallback:
+     * false`), so — unlike {@link AuthStorage.getOAuthAccesses} — a definitive
+     * failure of the targeted account surfaces as a failed resolution rather than
+     * silently rotating or rate-tripping a sibling.
+     *
+     * Returns `undefined` when `position` is out of range or runtime/config
+     * overrides have replaced OAuth with an explicit API key.
+     */
+    getOAuthAccessAt(provider: string, position: number, options?: AuthApiKeyOptions): Promise<OAuthAccessResolution | undefined>;
+    /**
+     * Resolve one stored OAuth credential by its durable storage row id.
+     *
+     * Unlike the normal session resolver, this method never ranks, rotates, or
+     * falls back to sibling credentials. A forced refresh re-mints only the
+     * requested row, preserving exact-account affinity for operations whose
+     * provenance and policy boundary are tied to one workspace.
+     *
+     * Returns `undefined` when the row does not exist for `provider` or an
+     * explicit runtime/config API-key override suppresses OAuth.
+     */
+    getOAuthAccessByCredentialId(provider: string, credentialId: number, options?: AuthApiKeyOptions): Promise<OAuthAccessResolution | undefined>;
+    /**
+     * List saved rate-limit resets for every stored OAuth account of `provider`
+     * (Codex), fetched LIVE from the dedicated `rate-limit-reset-credits` route.
+     *
+     * This deliberately bypasses the usage-report cache: `/wham/usage` is
+     * IP-rate-limited and may serve stale (or pre-feature) snapshots when many
+     * accounts are polled, which would hide redeemable credits. One entry per
+     * account, with the session's active account flagged and unreachable
+     * accounts carrying an `error`.
+     */
+    listResetCredits(options?: {
+        provider?: string;
+        sessionId?: string;
+        baseUrlResolver?: (provider: string) => string | undefined;
+        signal?: AbortSignal;
+    }): Promise<ResetCreditAccountStatus[]>;
+    /**
+     * Redeem one saved rate-limit reset (OpenAI Codex "saved resets") for a
+     * specific stored account.
+     *
+     * Resolves a fresh access token for the target account, picks an available
+     * credit (the given `creditId`, else the first redeemable one), spends it,
+     * and invalidates the cached usage report so the next `/usage` reflects the
+     * reset. Never throws for business outcomes — inspect the returned `code`.
+     */
+    redeemResetCredit(options: {
+        target: ResetCreditTarget;
+        provider?: string;
+        creditId?: string;
+        baseUrlResolver?: (provider: string) => string | undefined;
+        signal?: AbortSignal;
+    }): Promise<ResetCreditRedeemOutcome>;
+    /**
+     * Force-invalidate cached usage reports so the next fetch retrieves fresh
+     * values from upstream providers. If `provider` is specified, only that
+     * provider's credentials are invalidated; otherwise, all credentials in the
+     * store are invalidated.
+     */
+    invalidateUsageCache(provider?: string, signal?: AbortSignal): Promise<void>;
+    invalidateCredentialMatching(provider: string, apiKey: string, options?: InvalidateCredentialMatchingOptions): Promise<boolean>;
+    invalidateCredentialMatching(provider: string, apiKey: string, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Rotate away from the credential that failed after a retryable auth error —
+     * step (c) of the auth-retry policy. Prefer the failed stored row id supplied
+     * in `options.credentialId`, then the failed bearer supplied in
+     * `options.apiKey`, so overlapping requests cannot redirect rotation through
+     * stale session stickiness. Fall back to the session-sticky credential only
+     * when neither explicit target is available. For hard-auth errors, an explicit
+     * target that no longer matches storage returns `false` without mutation.
+     * Delayed usage-limit errors may instead recover the durable OAuth row from
+     * the bearer fingerprint recorded when the request resolved.
+     *
+     * - usage-limit / account-rate-limit error → {@link AuthStorage.markUsageLimitReached}
+     *   (temporary block via its own backoff — default plus server usage-report
+     *   reset; sticky left intact so the next resolve re-ranks around the block).
+     * - otherwise (hard 401 / auth failure) → mark the credential suspect (or
+     *   reload when no broker hook is wired) and block it, then drop matching
+     *   sticky state.
+     *
+     * Returns whether another usable credential of the same type remains.
+     */
+    rotateSessionCredential(provider: string, sessionId: string | undefined, options?: {
+        error?: unknown;
+        modelId?: string;
+        apiKey?: string;
+        credentialId?: number;
+        signal?: AbortSignal;
+    }): Promise<boolean>;
+    /**
+     * Build an {@link ApiKeyResolver} backed by this storage, implementing the
+     * central a/b/c auth-retry policy:
+     *
+     * - initial (`error: undefined`) → resolve the session credential.
+     * - step (b) `!lastChance` → force-refresh the SAME session-sticky credential.
+     * - step (c) `lastChance` → rotate to a sibling and re-resolve, unless quota exhaustion has no sibling.
+     *
+     * Used by web-search providers and other consumers that hold an AuthStorage
+     * directly (no ModelRegistry in scope).
+     */
+    resolver(provider: string, options?: {
+        sessionId?: string;
+        baseUrl?: string;
+        modelId?: string;
+    }): ApiKeyResolver;
+    /**
+     * Build a redacted snapshot of all loaded credentials for the auth-broker
+     * wire. OAuth refresh tokens are replaced with {@link REMOTE_REFRESH_SENTINEL}
+     * so clients never see the actual refresh token.
+     *
+     * Callers must {@link AuthStorage.reload} first when serving a stale snapshot
+     * (the broker server's HTTP handler does this).
+     */
+    exportSnapshot(): AuthCredentialSnapshot;
+    /**
+     * Disabled credential tombstones for display surfaces (`omp usage`,
+     * broker `GET /v1/credentials/disabled`). Empty when the backing store
+     * keeps no tombstones or the remote broker predates the endpoint.
+     */
+    listDisabledCredentials(provider?: string, signal?: AbortSignal): Promise<DisabledCredentialSummary[]>;
+    /**
+     * Force the backing store to revalidate its credential snapshot, then
+     * reload. Remote broker stores re-fetch the snapshot; local stores are
+     * always current, so only the reload runs. Callers that pair live
+     * per-credential data with stored identities (`omp usage`) use this so a
+     * disk-cached snapshot cannot misattribute fresh reports.
+     */
+    revalidateCredentials(): Promise<void>;
+    /**
+     * Refresh the OAuth credential with the given id through a per-credential
+     * single-flight. Concurrent callers for the same row await the same upstream
+     * refresh attempt, which is required for providers that rotate refresh tokens
+     * on every successful refresh.
+     */
+    refreshCredentialById(id: number, signal?: AbortSignal): Promise<AuthCredentialSnapshotEntry>;
+    /**
+     * Force-refresh the OAuth credential with the given id, bypassing the
+     * not-yet-expired guard. Used by the auth-broker server to honour
+     * `POST /v1/credential/:id/refresh`.
+     *
+     * Returns the redacted snapshot entry for the refreshed row.
+     * Throws when no OAuth credential with that id is loaded.
+     */
+    forceRefreshCredentialById(id: number, signal?: AbortSignal): Promise<AuthCredentialSnapshotEntry>;
+    /**
+     * Disable the credential with the given id and emit a
+     * {@link CredentialDisabledEvent}. Used by the auth-broker server to honour
+     * `POST /v1/credential/:id/disable`. Returns `false` when no such row exists.
+     */
+    disableCredentialById(id: number, disabledCause: string): boolean;
+    /**
+     * Upsert a credential into the underlying store, refresh the in-memory
+     * snapshot, and return the redacted snapshot entries for the provider.
+     *
+     * Used by the auth-broker server to honour `POST /v1/credential`. The
+     * persistence layer (`SqliteAuthCredentialStore.upsertAuthCredentialForProvider`)
+     * does identity-key matching, so re-uploading the same email/account replaces
+     * the existing row instead of inserting a duplicate.
+     */
+    upsertCredential(provider: string, credential: AuthCredential): AuthCredentialSnapshotEntry[];
+    /**
+     * Broker-server seam: list non-expired persisted blocks for snapshot entries.
+     */
+    listCredentialBlocks(credentialIds: readonly number[]): StoredCredentialBlock[];
+    /**
+     * Broker-server seam: persist one credential block and notify snapshot waiters.
+     */
+    upsertCredentialBlock(block: StoredCredentialBlock): void;
+    /**
+     * Broker-server seam: clear all persisted blocks for one credential and notify snapshot waiters.
+     */
+    deleteCredentialBlock(credentialId: number, providerKey: string, blockScope: string): void;
+    deleteCredentialBlocks(credentialId: number): void;
+    /**
+     * Describe where the active credential for a provider came from.
+     *
+     * Mirrors {@link AuthStorage.getApiKey} precedence, highest first:
+     *   1. Runtime override (`--api-key`).
+     *   2. Config override (`models.yml` `providers.<name>.apiKey`).
+     *   3. Stored OAuth credential.
+     *   4. API key persisted by a successful `/login`.
+     *   5. Env var — overrides a stored static api_key (e.g. a stale broker copy).
+     *   6. Stored api_key credential.
+     *   7. Fallback resolver.
+     *
+     * The string is purely informational; consumers must not parse it.
+     */
+    describeCredentialSource(provider: string, sessionId?: string): string | undefined;
+}