@oh-my-pi/pi-ai 17.1.4 → 17.1.5

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [17.1.5] - 2026-07-27
+
+### Fixed
+
+- Fixed OpenAI Responses replay treating a tool output as paired with a matching call that appeared later in the input, or a tool call as paired with an earlier output. Pair repair now respects wire order before preserving or synthesizing each side.
+- Fixed adaptive-thinking Anthropic models omitting the interleaved-thinking beta on signature-enforcing proxies, which caused persisted interleaved assistant turns to fail on replay ([#6717](https://github.com/can1357/oh-my-pi/issues/6717)).
+- Kimi Code now sends its session-stable prompt cache key on both supported transports: `prompt_cache_key` for OpenAI-compatible requests and `metadata.user_id` for Anthropic-compatible requests. Explicit keys survive side-channel session IDs, while `cacheRetention: "none"` still disables automatic affinity ([#6049](https://github.com/can1357/oh-my-pi/issues/6049)).
+- Fresh encrypted auth-broker snapshot caches are revalidated within a short startup budget, so one-shot clients see newly imported or revoked credentials immediately when the broker is reachable while retaining cache fallback for transport and server failures.
+- Fixed custom `anthropic-messages` endpoints dropping native web-search call/result blocks in the leaked-thinking wrapper, preserving signed continuation history in source order without carrying a preceding text signature onto later unsigned blocks ([#6703](https://github.com/can1357/oh-my-pi/issues/6703)).
+
 ## [17.1.4] - 2026-07-26
 
 ### Added

package/dist/types/auth-broker/wire-schema-resource.d.ts

@@ -0,0 +1,53 @@
+/**
+ * ArkType schemas for the auth-broker wire protocol.
+ *
+ * Shared between the server (validates inbound request bodies) and the client
+ * (validates responses from the broker). Schemas mirror the TypeScript types
+ * in `./types.ts` 1:1; the types remain the source of truth for static typing,
+ * and `Type` is asserted-compatible with them where possible.
+ *
+ * Envelope and fixed-shape schemas use `"+": "reject"` so unknown keys are
+ * rejected — the previous implementation used a hand-rolled `hasOnlyFields`
+ * allowlist for the same effect. The OAuth credential schema is the deliberate
+ * exception (standard type keeps extra keys): it preserves provider-specific extension fields so
+ * they round-trip through the broker instead of being dropped (see below).
+ */
+import { type Type } from "arktype";
+import { type ApiKeyCredential, type AuthCredential, type AuthCredentialSnapshotEntry, type DisabledCredentialSummary, type OAuthCredential, type RemoteOAuthCredential, type SnapshotCredential } from "../auth-storage.js";
+import type { ClientUsageReportRequest, ClientUsageReportResponse, ClientUsageSummaryResponse, CredentialBlockRequest, CredentialBlockResponse, CredentialBlockSnapshot, CredentialBlocksDeleteResponse, CredentialDisableResponse, CredentialRefreshResponse, CredentialUploadRequest, CredentialUploadResponse, DisabledCredentialsResponse, HealthzResponse, RefresherSchedule, SnapshotEntry, SnapshotResponse, SnapshotStreamEntryEvent, SnapshotStreamEvent, SnapshotStreamRemovedEvent, SnapshotStreamSnapshotEvent, UsageHistoryResponse, UsageResponse, UsageStaleResponse } from "./types.js";
+export interface AuthBrokerWireSchemas {
+    readonly oauthCredentialSchema: Type<OAuthCredential>;
+    readonly remoteOauthCredentialSchema: Type<RemoteOAuthCredential>;
+    readonly apiKeyCredentialSchema: Type<ApiKeyCredential>;
+    readonly writableAuthCredentialSchema: Type<AuthCredential>;
+    readonly snapshotCredentialSchema: Type<SnapshotCredential>;
+    readonly credentialSnapshotEntrySchema: Type<AuthCredentialSnapshotEntry>;
+    readonly credentialBlockSnapshotSchema: Type<CredentialBlockSnapshot>;
+    readonly snapshotEntrySchema: Type<SnapshotEntry>;
+    readonly refresherScheduleSchema: Type<RefresherSchedule>;
+    readonly snapshotResponseSchema: Type<SnapshotResponse>;
+    readonly snapshotStreamSnapshotEventSchema: Type<SnapshotStreamSnapshotEvent>;
+    readonly snapshotStreamEntryEventSchema: Type<SnapshotStreamEntryEvent>;
+    readonly snapshotStreamRemovedEventSchema: Type<SnapshotStreamRemovedEvent>;
+    readonly snapshotStreamEventSchema: Type<SnapshotStreamEvent>;
+    readonly healthzResponseSchema: Type<HealthzResponse>;
+    readonly usageResponseSchema: Type<UsageResponse>;
+    readonly usageHistoryResponseSchema: Type<UsageHistoryResponse>;
+    readonly clientUsageReportRequestSchema: Type<ClientUsageReportRequest>;
+    readonly clientUsageReportResponseSchema: Type<ClientUsageReportResponse>;
+    readonly clientUsageSummaryResponseSchema: Type<ClientUsageSummaryResponse>;
+    readonly credentialRefreshResponseSchema: Type<CredentialRefreshResponse>;
+    readonly credentialDisableRequestSchema: Type<{
+        cause?: string;
+    }>;
+    readonly credentialDisableResponseSchema: Type<CredentialDisableResponse>;
+    readonly disabledCredentialSummarySchema: Type<DisabledCredentialSummary>;
+    readonly disabledCredentialsResponseSchema: Type<DisabledCredentialsResponse>;
+    readonly credentialBlockRequestSchema: Type<CredentialBlockRequest>;
+    readonly credentialBlockResponseSchema: Type<CredentialBlockResponse>;
+    readonly credentialBlocksDeleteResponseSchema: Type<CredentialBlocksDeleteResponse>;
+    readonly usageStaleResponseSchema: Type<UsageStaleResponse>;
+    readonly credentialUploadRequestSchema: Type<CredentialUploadRequest>;
+    readonly credentialUploadResponseSchema: Type<CredentialUploadResponse>;
+}
+export declare function getAuthBrokerWireSchemas(): AuthBrokerWireSchemas;

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -1,605 +1,3 @@
-/** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */
-export declare const oauthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    apiEndpoint?: string | undefined;
-    type: "oauth";
-    refresh: string;
-    access: string;
-    expires: number;
-    enterpriseUrl?: string | undefined;
-    projectId?: string | undefined;
-    email?: string | undefined;
-    accountId?: string | undefined;
-    orgId?: string | undefined;
-    orgName?: string | undefined;
-    authorizedAt?: number | undefined;
-}, {}>;
-/** OAuth credential as it appears in broker snapshots — refresh replaced with sentinel. */
-export declare const remoteOauthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    apiEndpoint?: string | undefined;
-    type: "oauth";
-    refresh: "__remote__";
-    access: string;
-    expires: number;
-    enterpriseUrl?: string | undefined;
-    projectId?: string | undefined;
-    email?: string | undefined;
-    accountId?: string | undefined;
-    orgId?: string | undefined;
-    orgName?: string | undefined;
-    authorizedAt?: number | undefined;
-}, {}>;
-export declare const apiKeyCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    type: "api_key";
-    key: string;
-    source?: "login" | undefined;
-}, {}>;
-/** Discriminated union accepted on POST /v1/credential (writes). */
-export declare const writableAuthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    apiEndpoint?: string | undefined;
-    type: "oauth";
-    refresh: string;
-    access: string;
-    expires: number;
-    enterpriseUrl?: string | undefined;
-    projectId?: string | undefined;
-    email?: string | undefined;
-    accountId?: string | undefined;
-    orgId?: string | undefined;
-    orgName?: string | undefined;
-    authorizedAt?: number | undefined;
-} | {
-    type: "api_key";
-    key: string;
-    source?: "login" | undefined;
-}, {}>;
-/** Discriminated union returned in snapshots (refresh is sentinel for OAuth). */
-export declare const snapshotCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    apiEndpoint?: string | undefined;
-    type: "oauth";
-    refresh: "__remote__";
-    access: string;
-    expires: number;
-    enterpriseUrl?: string | undefined;
-    projectId?: string | undefined;
-    email?: string | undefined;
-    accountId?: string | undefined;
-    orgId?: string | undefined;
-    orgName?: string | undefined;
-    authorizedAt?: number | undefined;
-} | {
-    type: "api_key";
-    key: string;
-    source?: "login" | undefined;
-}, {}>;
-export declare const credentialSnapshotEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    id: number;
-    provider: string;
-    credential: {
-        apiEndpoint?: string | undefined;
-        type: "oauth";
-        refresh: "__remote__";
-        access: string;
-        expires: number;
-        enterpriseUrl?: string | undefined;
-        projectId?: string | undefined;
-        email?: string | undefined;
-        accountId?: string | undefined;
-        orgId?: string | undefined;
-        orgName?: string | undefined;
-        authorizedAt?: number | undefined;
-    } | {
-        type: "api_key";
-        key: string;
-        source?: "login" | undefined;
-    };
-    identityKey: string | null;
-}, {}>;
-export declare const credentialBlockSnapshotSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    providerKey: string;
-    blockScope: string;
-    blockedUntilMs: number;
-    updatedAtMs?: number | undefined;
-}, {}>;
-export declare const snapshotEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    id: number;
-    provider: string;
-    credential: {
-        apiEndpoint?: string | undefined;
-        type: "oauth";
-        refresh: "__remote__";
-        access: string;
-        expires: number;
-        enterpriseUrl?: string | undefined;
-        projectId?: string | undefined;
-        email?: string | undefined;
-        accountId?: string | undefined;
-        orgId?: string | undefined;
-        orgName?: string | undefined;
-        authorizedAt?: number | undefined;
-    } | {
-        type: "api_key";
-        key: string;
-        source?: "login" | undefined;
-    };
-    identityKey: string | null;
-    rotatesInMs: number | null;
-    blocks?: {
-        providerKey: string;
-        blockScope: string;
-        blockedUntilMs: number;
-        updatedAtMs?: number | undefined;
-    }[] | undefined;
-}, {}>;
-export declare const refresherScheduleSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    enabled: boolean;
-    intervalMs: number;
-    skewMs: number;
-    nextSweepInMs: number;
-}, {}>;
-export declare const snapshotResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    generation: number;
-    generatedAt: number;
-    serverNowMs: number;
-    refresher: {
-        enabled: boolean;
-        intervalMs: number;
-        skewMs: number;
-        nextSweepInMs: number;
-    };
-    credentials: {
-        id: number;
-        provider: string;
-        credential: {
-            apiEndpoint?: string | undefined;
-            type: "oauth";
-            refresh: "__remote__";
-            access: string;
-            expires: number;
-            enterpriseUrl?: string | undefined;
-            projectId?: string | undefined;
-            email?: string | undefined;
-            accountId?: string | undefined;
-            orgId?: string | undefined;
-            orgName?: string | undefined;
-            authorizedAt?: number | undefined;
-        } | {
-            type: "api_key";
-            key: string;
-            source?: "login" | undefined;
-        };
-        identityKey: string | null;
-        rotatesInMs: number | null;
-        blocks?: {
-            providerKey: string;
-            blockScope: string;
-            blockedUntilMs: number;
-            updatedAtMs?: number | undefined;
-        }[] | undefined;
-    }[];
-}, {}>;
-/** First frame on connect — full snapshot embedded inline with a `kind` tag. */
-export declare const snapshotStreamSnapshotEventSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    generation: number;
-    generatedAt: number;
-    serverNowMs: number;
-    refresher: {
-        enabled: boolean;
-        intervalMs: number;
-        skewMs: number;
-        nextSweepInMs: number;
-    };
-    credentials: {
-        id: number;
-        provider: string;
-        credential: {
-            apiEndpoint?: string | undefined;
-            type: "oauth";
-            refresh: "__remote__";
-            access: string;
-            expires: number;
-            enterpriseUrl?: string | undefined;
-            projectId?: string | undefined;
-            email?: string | undefined;
-            accountId?: string | undefined;
-            orgId?: string | undefined;
-            orgName?: string | undefined;
-            authorizedAt?: number | undefined;
-        } | {
-            type: "api_key";
-            key: string;
-            source?: "login" | undefined;
-        };
-        identityKey: string | null;
-        rotatesInMs: number | null;
-        blocks?: {
-            providerKey: string;
-            blockScope: string;
-            blockedUntilMs: number;
-            updatedAtMs?: number | undefined;
-        }[] | undefined;
-    }[];
-    kind: "snapshot";
-}, {}>;
-/** Per-credential upsert/refresh delta. */
-export declare const snapshotStreamEntryEventSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    kind: "entry";
-    generation: number;
-    serverNowMs: number;
-    refresher: {
-        enabled: boolean;
-        intervalMs: number;
-        skewMs: number;
-        nextSweepInMs: number;
-    };
-    entry: {
-        id: number;
-        provider: string;
-        credential: {
-            apiEndpoint?: string | undefined;
-            type: "oauth";
-            refresh: "__remote__";
-            access: string;
-            expires: number;
-            enterpriseUrl?: string | undefined;
-            projectId?: string | undefined;
-            email?: string | undefined;
-            accountId?: string | undefined;
-            orgId?: string | undefined;
-            orgName?: string | undefined;
-            authorizedAt?: number | undefined;
-        } | {
-            type: "api_key";
-            key: string;
-            source?: "login" | undefined;
-        };
-        identityKey: string | null;
-        rotatesInMs: number | null;
-        blocks?: {
-            providerKey: string;
-            blockScope: string;
-            blockedUntilMs: number;
-            updatedAtMs?: number | undefined;
-        }[] | undefined;
-    };
-}, {}>;
-/** Per-credential delete delta. */
-export declare const snapshotStreamRemovedEventSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    kind: "removed";
-    generation: number;
-    serverNowMs: number;
-    refresher: {
-        enabled: boolean;
-        intervalMs: number;
-        skewMs: number;
-        nextSweepInMs: number;
-    };
-    id: number;
-}, {}>;
-/** Discriminated union over every event frame the snapshot stream emits. */
-export declare const snapshotStreamEventSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    generation: number;
-    generatedAt: number;
-    serverNowMs: number;
-    refresher: {
-        enabled: boolean;
-        intervalMs: number;
-        skewMs: number;
-        nextSweepInMs: number;
-    };
-    credentials: {
-        id: number;
-        provider: string;
-        credential: {
-            apiEndpoint?: string | undefined;
-            type: "oauth";
-            refresh: "__remote__";
-            access: string;
-            expires: number;
-            enterpriseUrl?: string | undefined;
-            projectId?: string | undefined;
-            email?: string | undefined;
-            accountId?: string | undefined;
-            orgId?: string | undefined;
-            orgName?: string | undefined;
-            authorizedAt?: number | undefined;
-        } | {
-            type: "api_key";
-            key: string;
-            source?: "login" | undefined;
-        };
-        identityKey: string | null;
-        rotatesInMs: number | null;
-        blocks?: {
-            providerKey: string;
-            blockScope: string;
-            blockedUntilMs: number;
-            updatedAtMs?: number | undefined;
-        }[] | undefined;
-    }[];
-    kind: "snapshot";
-} | {
-    kind: "entry";
-    generation: number;
-    serverNowMs: number;
-    refresher: {
-        enabled: boolean;
-        intervalMs: number;
-        skewMs: number;
-        nextSweepInMs: number;
-    };
-    entry: {
-        id: number;
-        provider: string;
-        credential: {
-            apiEndpoint?: string | undefined;
-            type: "oauth";
-            refresh: "__remote__";
-            access: string;
-            expires: number;
-            enterpriseUrl?: string | undefined;
-            projectId?: string | undefined;
-            email?: string | undefined;
-            accountId?: string | undefined;
-            orgId?: string | undefined;
-            orgName?: string | undefined;
-            authorizedAt?: number | undefined;
-        } | {
-            type: "api_key";
-            key: string;
-            source?: "login" | undefined;
-        };
-        identityKey: string | null;
-        rotatesInMs: number | null;
-        blocks?: {
-            providerKey: string;
-            blockScope: string;
-            blockedUntilMs: number;
-            updatedAtMs?: number | undefined;
-        }[] | undefined;
-    };
-} | {
-    kind: "removed";
-    generation: number;
-    serverNowMs: number;
-    refresher: {
-        enabled: boolean;
-        intervalMs: number;
-        skewMs: number;
-        nextSweepInMs: number;
-    };
-    id: number;
-}, {}>;
-export declare const healthzResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    ok: boolean;
-    version?: string | undefined;
-}, {}>;
-/**
- * Broker `/v1/usage` response. Reports are full {@link UsageReport}s minus the
- * heavy provider-specific `raw` field (the server strips it before send) — we
- * keep `raw` optional in the underlying schema so a misconfigured broker that
- * forgot to strip still validates.
- */
-export declare const usageResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    generatedAt: number;
-    reports: {
-        provider: string;
-        fetchedAt: number;
-        limits: {
-            id: string;
-            label: string;
-            scope: {
-                provider: string;
-                accountId?: string | undefined;
-                projectId?: string | undefined;
-                orgId?: string | undefined;
-                modelId?: string | undefined;
-                tier?: string | undefined;
-                windowId?: string | undefined;
-                shared?: boolean | undefined;
-            };
-            window?: {
-                id: string;
-                label: string;
-                durationMs?: number | undefined;
-                resetsAt?: number | undefined;
-            } | undefined;
-            amount: {
-                used?: number | undefined;
-                limit?: number | undefined;
-                remaining?: number | undefined;
-                usedFraction?: number | undefined;
-                remainingFraction?: number | undefined;
-                unit: "bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
-            };
-            status?: "exhausted" | "ok" | "unknown" | "warning" | undefined;
-            notes?: string[] | undefined;
-        }[];
-        resetCredits?: {
-            availableCount: number;
-            credits?: {
-                grantedAt?: string | undefined;
-                expiresAt?: string | undefined;
-                status?: string | undefined;
-            }[] | undefined;
-        } | undefined;
-        notes?: string[] | undefined;
-        metadata?: {
-            [x: string]: unknown;
-        } | undefined;
-        raw?: unknown;
-    }[];
-}, {}>;
-/** Broker `/v1/usage/history` response — recorded usage-limit snapshots, oldest first. */
-export declare const usageHistoryResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    generatedAt: number;
-    entries: {
-        recordedAt: number;
-        provider: string;
-        accountKey: string;
-        email?: string | undefined;
-        accountId?: string | undefined;
-        limitId: string;
-        label: string;
-        windowLabel?: string | undefined;
-        usedFraction?: number | undefined;
-        status?: "exhausted" | "ok" | "unknown" | "warning" | undefined;
-        resetsAt?: number | undefined;
-    }[];
-}, {}>;
-/** Broker `POST /v1/usage/observed` request — one client's batched observed usage. */
-export declare const clientUsageReportRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    installId: string;
-    hostname?: string | undefined;
-    entries: {
-        at: number;
-        provider: string;
-        model: string;
-        requests: number;
-        inputTokens: number;
-        outputTokens: number;
-        cacheReadTokens: number;
-        cacheWriteTokens: number;
-        costUsd: number;
-    }[];
-}, {}>;
-export declare const clientUsageReportResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    ok: boolean;
-}, {}>;
-/** Broker `GET /v1/usage/clients` response — per-client token burn aggregates. */
-export declare const clientUsageSummaryResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    generatedAt: number;
-    clients: {
-        installId: string;
-        hostname?: string | undefined;
-        firstSeen: number;
-        lastSeen: number;
-        providers: {
-            provider: string;
-            requests: number;
-            inputTokens: number;
-            outputTokens: number;
-            cacheReadTokens: number;
-            cacheWriteTokens: number;
-            costUsd: number;
-        }[];
-    }[];
-}, {}>;
-export declare const credentialRefreshResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    entry: {
-        id: number;
-        provider: string;
-        credential: {
-            apiEndpoint?: string | undefined;
-            type: "oauth";
-            refresh: "__remote__";
-            access: string;
-            expires: number;
-            enterpriseUrl?: string | undefined;
-            projectId?: string | undefined;
-            email?: string | undefined;
-            accountId?: string | undefined;
-            orgId?: string | undefined;
-            orgName?: string | undefined;
-            authorizedAt?: number | undefined;
-        } | {
-            type: "api_key";
-            key: string;
-            source?: "login" | undefined;
-        };
-        identityKey: string | null;
-    };
-}, {}>;
-export declare const credentialDisableRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    cause?: string | undefined;
-}, {}>;
-export declare const credentialDisableResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    ok: boolean;
-}, {}>;
-/** One disabled-credential tombstone — identity + cause, never token material. */
-export declare const disabledCredentialSummarySchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    id: number;
-    provider: string;
-    type: "api_key" | "oauth";
-    email?: string | undefined;
-    accountId?: string | undefined;
-    orgId?: string | undefined;
-    orgName?: string | undefined;
-    cause: string;
-    disabledAtMs?: number | undefined;
-}, {}>;
-/** Broker `GET /v1/credentials/disabled` response. */
-export declare const disabledCredentialsResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    generatedAt: number;
-    disabled: {
-        id: number;
-        provider: string;
-        type: "api_key" | "oauth";
-        email?: string | undefined;
-        accountId?: string | undefined;
-        orgId?: string | undefined;
-        orgName?: string | undefined;
-        cause: string;
-        disabledAtMs?: number | undefined;
-    }[];
-}, {}>;
-export declare const credentialBlockRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    providerKey: string;
-    blockScope: string;
-    blockedUntilMs: number;
-    updatedAtMs?: number | undefined;
-}, {}>;
-export declare const credentialBlockResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    ok: boolean;
-}, {}>;
-export declare const credentialBlocksDeleteResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    ok: boolean;
-}, {}>;
-export declare const usageStaleResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    ok: boolean;
-}, {}>;
-export declare const credentialUploadRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    provider: string;
-    credential: {
-        apiEndpoint?: string | undefined;
-        type: "oauth";
-        refresh: string;
-        access: string;
-        expires: number;
-        enterpriseUrl?: string | undefined;
-        projectId?: string | undefined;
-        email?: string | undefined;
-        accountId?: string | undefined;
-        orgId?: string | undefined;
-        orgName?: string | undefined;
-        authorizedAt?: number | undefined;
-    } | {
-        type: "api_key";
-        key: string;
-        source?: "login" | undefined;
-    };
-}, {}>;
-export declare const credentialUploadResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
-    entries: {
-        id: number;
-        provider: string;
-        credential: {
-            apiEndpoint?: string | undefined;
-            type: "oauth";
-            refresh: "__remote__";
-            access: string;
-            expires: number;
-            enterpriseUrl?: string | undefined;
-            projectId?: string | undefined;
-            email?: string | undefined;
-            accountId?: string | undefined;
-            orgId?: string | undefined;
-            orgName?: string | undefined;
-            authorizedAt?: number | undefined;
-        } | {
-            type: "api_key";
-            key: string;
-            source?: "login" | undefined;
-        };
-        identityKey: string | null;
-    }[];
-}, {}>;
+export declare const oauthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<import("../index.js").OAuthCredential, {}>, remoteOauthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<import("../index.js").RemoteOAuthCredential, {}>, apiKeyCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<import("../index.js").ApiKeyCredential, {}>, writableAuthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<import("../index.js").AuthCredential, {}>, snapshotCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<import("../index.js").SnapshotCredential, {}>, credentialSnapshotEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<import("../index.js").AuthCredentialSnapshotEntry, {}>, credentialBlockSnapshotSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").CredentialBlockSnapshot, {}>, snapshotEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").SnapshotEntry, {}>, refresherScheduleSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").RefresherSchedule, {}>, snapshotResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").SnapshotResponse, {}>, snapshotStreamSnapshotEventSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").SnapshotStreamSnapshotEvent, {}>, snapshotStreamEntryEventSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").SnapshotStreamEntryEvent, {}>, snapshotStreamRemovedEventSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").SnapshotStreamRemovedEvent, {}>, snapshotStreamEventSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").SnapshotStreamEvent, {}>, healthzResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").HealthzResponse, {}>, usageResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").UsageResponse, {}>, usageHistoryResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").UsageHistoryResponse, {}>, clientUsageReportRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<import("../index.js").ClientUsageReport, {}>, clientUsageReportResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").ClientUsageReportResponse, {}>, clientUsageSummaryResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").ClientUsageSummaryResponse, {}>, credentialRefreshResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").CredentialRefreshResponse, {}>, credentialDisableRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    cause?: string;
+}, {}>, credentialDisableResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").CredentialDisableResponse, {}>, disabledCredentialSummarySchema: import("arktype/internal/variants/object.ts").ObjectType<import("../index.js").DisabledCredentialSummary, {}>, disabledCredentialsResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").DisabledCredentialsResponse, {}>, credentialBlockRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").CredentialBlockSnapshot, {}>, credentialBlockResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").CredentialBlockResponse, {}>, credentialBlocksDeleteResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").CredentialBlocksDeleteResponse, {}>, usageStaleResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").UsageStaleResponse, {}>, credentialUploadRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").CredentialUploadRequest, {}>, credentialUploadResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<import("./types.js").CredentialUploadResponse, {}>;