@sayknow-cli/ai 0.3.5 → 0.3.6

package/dist/types/auth-storage.d.ts

@@ -1,677 +0,0 @@
-/**
- * Credential storage for API keys and OAuth tokens.
- * Handles loading, saving, refreshing credentials, and usage tracking.
- *
- * This module defines:
- * - `AuthCredentialStore` interface: persistence abstraction (SQLite, remote vault, …)
- * - `AuthStorage` class: credential management with round-robin, usage limits, OAuth refresh
- * - `SqliteAuthCredentialStore`: concrete SQLite-backed implementation
- */
-import { Database } from "bun:sqlite";
-import type { Provider } from "./types";
-import type { CredentialRankingStrategy, UsageLogger, UsageProvider, UsageReport } from "./usage";
-import type { OAuthController, OAuthCredentials, OAuthProviderId } from "./utils/oauth/types";
-export type ApiKeyCredential = {
-    type: "api_key";
-    key: string;
-};
-export type OAuthCredential = {
-    type: "oauth";
-} & OAuthCredentials;
-export type AuthCredential = ApiKeyCredential | OAuthCredential;
-export type AuthCredentialEntry = AuthCredential | AuthCredential[];
-export type AuthStorageData = Record<string, AuthCredentialEntry>;
-/**
- * Serialized representation of AuthStorage for passing to subagent workers.
- * Contains only the essential credential data, not runtime state.
- */
-export interface SerializedAuthStorage {
-    credentials: Record<string, Array<{
-        id: number;
-        type: "api_key" | "oauth";
-        data: Record<string, unknown>;
-    }>>;
-    runtimeOverrides?: Record<string, string>;
-    dbPath?: string;
-}
-/**
- * Auth credential with database row ID for updates/deletes.
- * Wraps AuthCredential with storage metadata.
- */
-export interface StoredAuthCredential {
-    id: number;
-    provider: string;
-    credential: AuthCredential;
-    disabledCause: string | null;
-}
-/**
- * Per-credential health record returned by {@link AuthStorage.checkCredentials}.
- *
- * Use this to identify which credential in a multi-account pool is causing
- * auth errors. `ok` is tri-state:
- *
- * - `true` — credential authenticated against the provider's auth-verifying
- *   probe (today: the usage endpoint). For OAuth this also exercises refresh
- *   when the access token was expired.
- * - `false` — the probe rejected the credential (401/403/refresh failure/etc).
- *   `reason` carries the upstream error string.
- * - `null` — no probe is configured for this provider (or the configured
- *   probe doesn't support this credential type). The credential's auth
- *   status is unverifiable from here.
- */
-export interface CredentialHealthResult {
-    /** Database row id (matches {@link StoredAuthCredential.id}). */
-    id: number;
-    provider: string;
-    type: AuthCredential["type"];
-    /** OAuth email if known on the stored credential or surfaced by the probe. */
-    email?: string;
-    /** OAuth account id / org id if known. */
-    accountId?: string;
-    /** `true` when the refresh token lives on a remote broker (sentinel was present). */
-    remoteRefresh?: true;
-    ok: boolean | null;
-    /** Failure / unverifiable reason; absent when `ok === true`. */
-    reason?: string;
-    /** Probe usage report (raw payload stripped) when `ok === true`. */
-    report?: Omit<UsageReport, "raw">;
-}
-export interface CheckCredentialsOptions {
-    signal?: AbortSignal;
-    /** Per-credential probe timeout (ms). Defaults to the configured usage request timeout. */
-    timeoutMs?: number;
-    /** Provider → base URL override, same shape as {@link AuthStorage.fetchUsageReports}. */
-    baseUrlResolver?: (provider: Provider) => string | undefined;
-}
-/**
- * Sentinel value placed in OAuth `refresh` fields when a credential is shared
- * via {@link AuthStorage.exportSnapshot}. Refresh tokens never leave the broker;
- * clients must call back to refresh.
- */
-export declare const REMOTE_REFRESH_SENTINEL: "__remote__";
-export type RemoteRefreshSentinel = typeof REMOTE_REFRESH_SENTINEL;
-/** OAuth credential with refresh token replaced by the broker sentinel. */
-export type RemoteOAuthCredential = Omit<OAuthCredential, "refresh"> & {
-    refresh: RemoteRefreshSentinel;
-};
-/** Discriminated credential payload as published by the broker. */
-export type SnapshotCredential = ApiKeyCredential | RemoteOAuthCredential;
-export interface AuthCredentialSnapshotEntry {
-    id: number;
-    provider: string;
-    credential: SnapshotCredential;
-    identityKey: string | null;
-}
-export type AuthCredentialIfAbsentReason = "inserted" | "skipped-existing" | "skipped-existing-runtime" | "skipped-existing-config" | "skipped-existing-env" | "skipped-existing-fallback" | "skipped-invalid";
-export interface AuthCredentialIfAbsentResult {
-    inserted: boolean;
-    reason: AuthCredentialIfAbsentReason;
-    provider: string;
-    entries: StoredAuthCredential[];
-}
-export interface AuthCredentialIfAbsentSnapshotResult {
-    inserted: boolean;
-    reason: AuthCredentialIfAbsentReason;
-    provider: string;
-    entries: AuthCredentialSnapshotEntry[];
-}
-/**
- * Wire-shaped snapshot exported by {@link AuthStorage.exportSnapshot} and
- * served by the auth-broker server on `GET /v1/snapshot`.
- */
-export interface AuthCredentialSnapshot {
-    generation: number;
-    generatedAt: number;
-    credentials: AuthCredentialSnapshotEntry[];
-}
-/**
- * Persistence abstraction consumed by {@link AuthStorage}.
- *
- * Concrete implementations:
- * - {@link SqliteAuthCredentialStore} — local SQLite-backed store (default).
- * - `RemoteAuthCredentialStore` from `./auth-broker` — client-side snapshot of
- *   a remote broker; mutating methods (`replace*`, `upsert*`, `delete*ForProvider`)
- *   throw because login flows route through the broker, not the client.
- */
-export interface AuthCredentialStore {
-    close(): void;
-    listAuthCredentials(provider?: string): StoredAuthCredential[];
-    updateAuthCredential(id: number, credential: AuthCredential): void;
-    deleteAuthCredential(id: number, disabledCause: string): void;
-    tryDisableAuthCredentialIfMatches(id: number, expectedData: string, disabledCause: string): boolean;
-    replaceAuthCredentialsForProvider(provider: string, credentials: AuthCredential[]): StoredAuthCredential[];
-    upsertAuthCredentialForProvider(provider: string, credential: AuthCredential): StoredAuthCredential[];
-    upsertAuthCredentialForProviderIfAbsent(provider: string, credential: AuthCredential): AuthCredentialIfAbsentResult;
-    deleteAuthCredentialsForProvider(provider: string, disabledCause: string): void;
-    getCache(key: string, options?: {
-        includeExpired?: boolean;
-    }): string | null;
-    setCache(key: string, value: string, expiresAtSec: number): void;
-    cleanExpiredCache(): void;
-    /**
-     * Optional store-supplied OAuth refresh. When present, `AuthStorage` uses
-     * it before the per-provider local refresh path. `RemoteAuthCredentialStore`
-     * implements this against the broker; SQLite stores leave it undefined.
-     *
-     * Precedence: `AuthStorageOptions.refreshOAuthCredential` > this hook > local.
-     *
-     * `signal` propagates the agent's cancel (ESC, request abort, …) all the
-     * way to the broker fetch so a hung connection can't strand the caller
-     * for `timeoutMs * (maxRetries + 1)`.
-     */
-    refreshOAuthCredential?(provider: Provider, credentialId: number, credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredentials>;
-    /**
-     * Optional async pre-read hook invoked after AuthStorage selects a stored
-     * credential but before it returns that credential for an outbound request.
-     * Remote broker stores use this to wait out imminent rotations and refresh
-     * their local snapshot before the caller sees a stale access token.
-     */
-    prepareForRequest?(credentialId: number, opts?: {
-        signal?: AbortSignal;
-    }): Promise<boolean | undefined>;
-    /**
-     * Optional store-supplied aggregate usage fetch. When present, `AuthStorage`
-     * routes `fetchUsageReports()` here instead of fanning out per-credential.
-     * `RemoteAuthCredentialStore` proxies to the broker (whose datacenter IP
-     * isn't rate-limited like a heavy residential client).
-     *
-     * Precedence: `AuthStorageOptions.fetchUsageReports` > this hook > local fan-out.
-     *
-     * `signal` propagates the agent's cancel down to the broker fetch.
-     */
-    fetchUsageReports?(signal?: AbortSignal): Promise<UsageReport[] | null>;
-    /**
-     * Optional store-supplied per-credential usage report lookup. When present,
-     * `AuthStorage` consults this before its own per-credential upstream fetch
-     * (`#getUsageReport`). `RemoteAuthCredentialStore` implements this against
-     * the broker's aggregate `/v1/usage` (one coalesced round-trip shared across
-     * all callers) so multi-credential ranking on the client never hits the
-     * upstream provider's rate-limited usage endpoint from the laptop IP.
-     *
-     * Returning `null` is authoritative — `AuthStorage` does NOT fall back to
-     * the local fetch path. The store hook owns the decision, since falling
-     * back would re-introduce the per-IP rate-limit problem the broker exists
-     * to avoid.
-     *
-     * `signal` propagates the agent's cancel down to the broker fetch.
-     */
-    getUsageReport?(provider: Provider, credential: OAuthCredential, signal?: AbortSignal): Promise<UsageReport | null>;
-    /**
-     * Optional store hook to invalidate a specific credential after the upstream
-     * provider returned 401 on a supposedly-fresh key. Remote stores force the
-     * broker to re-issue the row; local stores can leave it undefined and let
-     * {@link AuthStorage.invalidateCredentialMatching} fall back to `reload()`.
-     */
-    markCredentialSuspect?(credentialId: number, opts?: {
-        signal?: AbortSignal;
-    }): Promise<void>;
-    /**
-     * Optional async write hook for upserting a single credential. When present,
-     * `AuthStorage.#upsertOAuthCredential` routes through this instead of the
-     * sync `upsertAuthCredentialForProvider`. `RemoteAuthCredentialStore` uses
-     * it to send the upsert to the broker via `POST /v1/credential`.
-     *
-     * Implementations MUST update the in-memory snapshot before returning so the
-     * post-write read path is consistent.
-     */
-    upsertAuthCredentialRemote?(provider: string, credential: AuthCredential): Promise<StoredAuthCredential[]>;
-    upsertAuthCredentialRemoteIfAbsent?(provider: string, credential: AuthCredential): Promise<AuthCredentialIfAbsentResult>;
-    /**
-     * Optional async write hook for replace-all semantics (e.g. API-key login
-     * overwriting any previous keys for the same provider). When present,
-     * `AuthStorage.set` routes through this instead of the sync
-     * `replaceAuthCredentialsForProvider`.
-     */
-    replaceAuthCredentialsRemote?(provider: string, credentials: AuthCredential[]): Promise<StoredAuthCredential[]>;
-    /**
-     * Optional async write hook for clearing every credential for a provider
-     * (logout). When present, `AuthStorage.remove` routes through this instead
-     * of the sync `deleteAuthCredentialsForProvider`.
-     */
-    deleteAuthCredentialsRemote?(provider: string, disabledCause: string): Promise<void>;
-}
-/**
- * Event payload describing a credential that was just soft-disabled.
- *
- * Today the only call site is OAuth refresh failures with a definitive cause
- * (`invalid_grant`, `401/403` not from a network blip, etc.) — the
- * disabled_cause string is the verbatim error captured for forensics.
- *
- * Subscribers can use this to surface a notification, banner, or auto-launch
- * a re-login flow instead of letting the credential silently disappear.
- */
-export interface CredentialDisabledEvent {
-    provider: string;
-    disabledCause: string;
-}
-/**
- * How {@link AuthStorage} orders multiple healthy OAuth credentials of the same
- * provider:type pool when selecting one for a (new) session.
- *
- * - `balanced` (default): prefer the least-used / lowest-drain-rate account.
- *   Spreads load across accounts and keeps burst headroom on every account.
- * - `earliest-reset`: prefer the non-blocked account whose usage window resets
- *   soonest (earliest-expiry-first). Tumbling-window quota is perishable —
- *   unused quota is lost at reset — so draining the soonest-to-reset account
- *   first minimizes wasted quota. Drain/used metrics remain tiebreakers.
- *
- * Only affects ranking, which the `shouldRank` guard already limits to session
- * start (or when the session's preferred credential is blocked), so this never
- * thrashes accounts mid-session / cold-starts the server-side prompt cache.
- */
-export type CredentialRankingMode = "balanced" | "earliest-reset";
-export type AuthStorageOptions = {
-    usageProviderResolver?: (provider: Provider) => UsageProvider | undefined;
-    rankingStrategyResolver?: (provider: Provider) => CredentialRankingStrategy | undefined;
-    credentialRankingMode?: CredentialRankingMode;
-    usageFetch?: typeof fetch;
-    usageRequestTimeoutMs?: number;
-    usageLogger?: UsageLogger;
-    /**
-     * Resolve a config value (API key, header value, etc.) to an actual value.
-     * - coding-agent injects its resolveConfigValue (supports "!command" syntax via pi-natives)
-     * - Default: checks environment variable first, then treats as literal
-     */
-    configValueResolver?: (config: string) => Promise<string | undefined>;
-    /**
-     * Optional callback fired when AuthStorage automatically disables a
-     * credential because something detected it as no longer usable — today
-     * that's the OAuth refresh-failure path in `getApiKey`. NOT fired for
-     * user-initiated `remove()` (the user already knows) or dedup of
-     * duplicate credentials (uninteresting hygiene).
-     */
-    onCredentialDisabled?: (event: CredentialDisabledEvent) => void | Promise<void>;
-    /**
-     * Override OAuth refresh. When set, `AuthStorage` calls this instead of the
-     * per-provider local refresh function. Receives the credential id so the
-     * implementation can address remote credentials.
-     *
-     * Must return updated {@link OAuthCredentials} with at least `access` and
-     * `expires`. `refresh` may be an opaque sentinel (e.g. `"__remote__"`) when
-     * the actual refresh token never leaves the broker.
-     */
-    refreshOAuthCredential?: (provider: Provider, credentialId: number, credential: OAuthCredential, signal?: AbortSignal) => Promise<OAuthCredentials>;
-    /**
-     * Human-readable description of the credential store backing this
-     * AuthStorage instance. Surfaced through {@link AuthStorage.describeCredentialSource}
-     * so the TUI can show where a token came from (broker URL or local SQLite path).
-     *
-     * Examples:
-     * - `"local ~/.skc/agent/agent.db"`
-     * - `"broker http://can.internal:8765"`
-     */
-    sourceLabel?: string;
-    /**
-     * Override `fetchUsageReports`. When set, `AuthStorage.fetchUsageReports`
-     * calls this instead of fanning out per-credential. The primary use case is
-     * routing through a broker that egresses from a less-throttled IP — e.g. a
-     * residential laptop trips Anthropic's per-IP rate limit on the usage
-     * endpoint and drops 2-of-5 credentials, while the VPS broker gets all 5.
-     *
-     * Implementations may return null when no usage data is available; the
-     * AuthStorage caller surfaces that to its own consumer unchanged.
-     */
-    fetchUsageReports?: (signal?: AbortSignal) => Promise<UsageReport[] | null>;
-};
-type AuthApiKeyOptions = {
-    baseUrl?: string;
-    modelId?: string;
-    /**
-     * Caller's cancel signal. Threaded into any broker-bound OAuth refresh so
-     * `ESC` / request abort actually kills a hung broker fetch instead of
-     * stranding the caller for `timeoutMs * (maxRetries + 1)`.
-     */
-    signal?: AbortSignal;
-};
-/**
- * Refreshed OAuth access plus identity metadata returned by
- * {@link AuthStorage.getOAuthAccess}. Callers that authenticate via a bearer
- * AND need the credential's identity (OpenAI code backend `chatgpt-account-id`, Google
- * `projectId`, GitHub `enterpriseUrl`) consume this shape directly; the
- * refresh slot is deliberately omitted because rotating refresh tokens never
- * leave {@link AuthStorage}.
- */
-export interface OAuthAccess {
-    accessToken: string;
-    accountId?: string;
-    email?: string;
-    projectId?: string;
-    enterpriseUrl?: string;
-}
-export interface InvalidateCredentialMatchingOptions {
-    signal?: AbortSignal;
-    sessionId?: string;
-}
-/**
- * Credential storage backed by an AuthCredentialStore.
- * Reads from storage on reload(), manages round-robin credential selection,
- * usage limit tracking, and OAuth token refresh.
- */
-export declare class AuthStorage {
-    #private;
-    constructor(store: AuthCredentialStore, options?: AuthStorageOptions);
-    /**
-     * Create an AuthStorage instance backed by a AuthCredentialStore.
-     * Convenience factory for standalone use (e.g., pi-ai CLI).
-     * @param dbPath - Path to SQLite database
-     */
-    static create(dbPath: string, options?: AuthStorageOptions): Promise<AuthStorage>;
-    /**
-     * Close the underlying credential store.
-     *
-     * After calling this, the instance must not be reused.
-     */
-    close(): void;
-    getGeneration(): number;
-    onGenerationChanged(listener: (generation: number) => void): () => void;
-    offGenerationChanged(listener: (generation: number) => void): void;
-    /**
-     * Subscribe to {@link CredentialDisabledEvent}s. Multiple subscribers are supported and
-     * each fires for every disable event; subscribers are invoked in registration order with
-     * exceptions and async rejections isolated per-listener so a misbehaving subscriber
-     * cannot break the disable path or starve the rest of the chain.
-     *
-     * If `credential_disabled` events were emitted while no listener was subscribed, they are
-     * replayed (in insertion order) to the listener that triggers the empty→non-empty
-     * transition. The drain is one-shot — listeners that subscribe after that no longer see
-     * past events.
-     *
-     * Returns an unsubscribe function. The function is idempotent: calling it more than once
-     * is a no-op. After every subscriber has unsubscribed, subsequent disable events buffer
-     * again until the next subscribe.
-     *
-     * @param listener Callback invoked with each disable event. May be sync or async.
-     * @returns A function that removes this listener from the subscriber set.
-     */
-    onCredentialDisabled(listener: (event: CredentialDisabledEvent) => void | Promise<void>): () => void;
-    /**
-     * Set a runtime API key override (not persisted to disk).
-     * Used for CLI --api-key flag.
-     */
-    setRuntimeApiKey(provider: string, apiKey: string): void;
-    /**
-     * Remove a runtime API key override.
-     */
-    removeRuntimeApiKey(provider: string): void;
-    /**
-     * Register a per-provider API key sourced from user configuration
-     * (e.g. `models.yml` `providers.<name>.apiKey`). Higher priority than
-     * stored credentials and OAuth tokens — when the user pins a key in
-     * config, that key is what authenticates outbound requests, regardless
-     * of whatever the broker happens to have loaded for that provider.
-     *
-     * Lower priority than {@link setRuntimeApiKey} so a CLI `--api-key`
-     * still wins for the duration of a single invocation.
-     */
-    setConfigApiKey(provider: string, apiKey: string): void;
-    /**
-     * Remove a single config-sourced API key override.
-     */
-    removeConfigApiKey(provider: string): void;
-    /**
-     * Drop every config-sourced API key. Called by `ModelRegistry` before
-     * re-parsing `models.yml` so removed entries actually disappear.
-     */
-    clearConfigApiKeys(): void;
-    /**
-     * Set a fallback resolver for API keys not found in storage or env vars.
-     * Used for custom provider keys from models.json.
-     */
-    setFallbackResolver(resolver: (provider: string) => string | undefined): void;
-    /**
-     * Reload credentials from storage.
-     */
-    reload(): Promise<void>;
-    /** Returns the credential type selected for a provider/session, if one has been recorded. */
-    getSessionCredentialType(provider: string, sessionId?: string): AuthCredential["type"] | undefined;
-    /**
-     * Get credential for a provider (first entry if multiple).
-     */
-    get(provider: string): AuthCredential | undefined;
-    /**
-     * Set credential for a provider.
-     */
-    set(provider: string, credential: AuthCredentialEntry): Promise<void>;
-    importCredentialIfAbsent(provider: string, credential: AuthCredential): Promise<AuthCredentialIfAbsentSnapshotResult>;
-    /**
-     * Remove credential for a provider.
-     */
-    remove(provider: string): Promise<void>;
-    /**
-     * List all providers with credentials.
-     */
-    list(): string[];
-    /**
-     * Check if credentials exist for a provider in storage.
-     */
-    has(provider: string): boolean;
-    /**
-     * Check if any form of auth is configured for a provider.
-     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
-     */
-    hasAuth(provider: string): boolean;
-    /**
-     * Check if OAuth credentials are configured for a provider.
-     */
-    hasOAuth(provider: string): boolean;
-    /**
-     * Get OAuth credentials for a provider.
-     */
-    getOAuthCredential(provider: string): OAuthCredential | undefined;
-    /**
-     * Get the OAuth `accountId` for a provider, preferring the credential that is
-     * session-sticky for `sessionId` when multiple OAuth credentials are configured.
-     * Falls back to the first OAuth credential when no session preference exists (e.g.
-     * first call before any `getApiKey` has been issued, or single-credential setups).
-     * Returns `undefined` when no OAuth credential carries an `accountId`.
-     */
-    getOAuthAccountId(provider: string, sessionId?: string): string | undefined;
-    /**
-     * Get all credentials.
-     */
-    getAll(): AuthStorageData;
-    /**
-     * Login to an OAuth provider.
-     */
-    login(provider: OAuthProviderId, ctrl: OAuthController & {
-        /** onAuth is required by auth-storage but optional in OAuthController */
-        onAuth: (info: {
-            url: string;
-            instructions?: string;
-        }) => void;
-        /** onPrompt is required for some providers (github-copilot, OpenAI code provider) */
-        onPrompt: (prompt: {
-            message: string;
-            placeholder?: string;
-        }) => Promise<string>;
-    }): Promise<void>;
-    /**
-     * Logout from a provider.
-     */
-    logout(provider: string): Promise<void>;
-    fetchUsageReports(options?: {
-        baseUrlResolver?: (provider: Provider) => string | undefined;
-        /** Caller's cancel signal; only rejects this caller, never the shared upstream fetch. */
-        signal?: AbortSignal;
-    }): Promise<UsageReport[] | null>;
-    /**
-     * Probe each stored credential against its provider's auth-verifying usage
-     * endpoint and report per-credential auth health.
-     *
-     * Surfaces the identity of failing credentials so callers running a
-     * multi-account pool (e.g. a broker-backed auth-gateway) can tell which
-     * row is producing 401s. The probe mirrors the per-credential fan-out
-     * inside {@link AuthStorage.fetchUsageReports} (OAuth refresh-on-expiry,
-     * then `UsageProvider.fetchUsage`) but does NOT swallow errors — every
-     * credential gets either `ok: true`, `ok: false` with `reason`, or
-     * `ok: null` when no probe is configured for the provider.
-     *
-     * Iterates sequentially to avoid synchronized N-account fan-out that
-     * upstream `/usage` rate limiters (per source IP) treat as a burst.
-     *
-     * Only inspects active rows from {@link AuthCredentialStore.listAuthCredentials};
-     * soft-disabled rows are already known-bad and don't need a network probe.
-     * Environment-variable API keys are not enumerated — the caller's intent
-     * here is "which of my stored credentials is broken".
-     */
-    checkCredentials(options?: CheckCredentialsOptions): Promise<CredentialHealthResult[]>;
-    /**
-     * Marks the current session's credential as temporarily blocked due to usage limits.
-     * Uses usage reports to determine accurate reset time when available.
-     * Returns true if a credential was blocked, enabling automatic fallback to the next credential.
-     */
-    markUsageLimitReached(provider: string, sessionId: string | undefined, options?: {
-        retryAfterMs?: number;
-        baseUrl?: string;
-        signal?: AbortSignal;
-    }): Promise<boolean>;
-    /**
-     * Peek at API key for a provider without refreshing OAuth tokens.
-     * Used for model discovery where we only need to know if credentials exist
-     * and get a best-effort token. For GitHub Copilot we preserve enterprise
-     * routing metadata so discovery can hit the correct host.
-     */
-    peekApiKey(provider: string): Promise<string | undefined>;
-    /**
-     * Get API key for a provider.
-     * Priority:
-     * 1. Runtime override (CLI --api-key)
-     * 2. Config override (models.yml `providers.<name>.apiKey`)
-     * 3. API key from storage
-     * 4. OAuth token from storage (auto-refreshed)
-     * 5. Environment variable
-     * 6. Fallback resolver (models.yml custom providers, last-resort)
-     */
-    getApiKey(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<string | undefined>;
-    /**
-     * Resolve the OAuth credential for `provider`, refreshing through the same
-     * pipeline as {@link AuthStorage.getApiKey} but returning the refreshed
-     * {@link OAuthAccess} (raw access token + identity metadata) instead of
-     * the API-key bytes.
-     *
-     * Use this when the caller needs to inject identity headers alongside the
-     * bearer (OpenAI code backend `chatgpt-account-id`, Google `project`, GitHub
-     * `enterpriseUrl`). For pure "give me the bytes for `Authorization`"
-     * scenarios, prefer {@link AuthStorage.getApiKey}.
-     *
-     * Returns `undefined` when no OAuth credential is available, the
-     * credential fails to refresh, or runtime/config overrides have replaced
-     * OAuth with an explicit API key.
-     */
-    getOAuthAccess(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<OAuthAccess | undefined>;
-    invalidateCredentialMatching(provider: string, apiKey: string, options?: InvalidateCredentialMatchingOptions): Promise<boolean>;
-    invalidateCredentialMatching(provider: string, apiKey: string, signal?: AbortSignal): Promise<boolean>;
-    /**
-     * Build a redacted snapshot of all loaded credentials for the auth-broker
-     * wire. OAuth refresh tokens are replaced with {@link REMOTE_REFRESH_SENTINEL}
-     * so clients never see the actual refresh token.
-     *
-     * Callers must {@link AuthStorage.reload} first when serving a stale snapshot
-     * (the broker server's HTTP handler does this).
-     */
-    exportSnapshot(): AuthCredentialSnapshot;
-    /**
-     * Refresh the OAuth credential with the given id through a per-credential
-     * single-flight. Concurrent callers for the same row await the same upstream
-     * refresh attempt, which is required for providers that rotate refresh tokens
-     * on every successful refresh.
-     */
-    refreshCredentialById(id: number, signal?: AbortSignal): Promise<AuthCredentialSnapshotEntry>;
-    /**
-     * Force-refresh the OAuth credential with the given id, bypassing the
-     * not-yet-expired guard. Used by the auth-broker server to honour
-     * `POST /v1/credential/:id/refresh`.
-     *
-     * Returns the redacted snapshot entry for the refreshed row.
-     * Throws when no OAuth credential with that id is loaded.
-     */
-    forceRefreshCredentialById(id: number, signal?: AbortSignal): Promise<AuthCredentialSnapshotEntry>;
-    /**
-     * Disable the credential with the given id and emit a
-     * {@link CredentialDisabledEvent}. Used by the auth-broker server to honour
-     * `POST /v1/credential/:id/disable`. Returns `false` when no such row exists.
-     */
-    disableCredentialById(id: number, disabledCause: string): boolean;
-    /**
-     * Upsert a credential into the underlying store, refresh the in-memory
-     * snapshot, and return the redacted snapshot entries for the provider.
-     *
-     * Used by the auth-broker server to honour `POST /v1/credential`. The
-     * persistence layer (`SqliteAuthCredentialStore.upsertAuthCredentialForProvider`)
-     * does identity-key matching, so re-uploading the same email/account replaces
-     * the existing row instead of inserting a duplicate.
-     */
-    upsertCredential(provider: string, credential: AuthCredential): AuthCredentialSnapshotEntry[];
-    /**
-     * Describe where the active credential for a provider came from.
-     *
-     * Surfaces four layers, highest precedence first:
-     *   1. Runtime override (`--api-key`).
-     *   2. Config override (`models.yml` `providers.<name>.apiKey`).
-     *   3. Stored credential (the one this session is currently sticky to, or the
-     *      one round-robin would pick next when no session id is supplied).
-     *   4. Env var / fallback resolver — when no stored credential exists.
-     *
-     * The string is purely informational; consumers must not parse it.
-     */
-    describeCredentialSource(provider: string, sessionId?: string): string | undefined;
-}
-/**
- * Default SQLite-backed implementation of {@link AuthCredentialStore}.
- *
- * Used by the pi-ai CLI and as the default store for `AuthStorage.create()`.
- * Also exposes convenience methods (`saveOAuth`, `getOAuth`, `saveApiKey`,
- * `getApiKey`, `listProviders`, `deleteProvider`) that callers can use directly
- * without going through `AuthStorage`.
- */
-export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
-    #private;
-    constructor(db: Database);
-    static open(dbPath?: string): Promise<SqliteAuthCredentialStore>;
-    listAuthCredentials(provider?: string): StoredAuthCredential[];
-    replaceAuthCredentialsForProvider(provider: string, credentials: AuthCredential[]): StoredAuthCredential[];
-    upsertAuthCredentialForProvider(provider: string, credential: AuthCredential): StoredAuthCredential[];
-    upsertAuthCredentialForProviderIfAbsent(provider: string, credential: AuthCredential): AuthCredentialIfAbsentResult;
-    updateAuthCredential(id: number, credential: AuthCredential): void;
-    deleteAuthCredential(id: number, disabledCause: string): void;
-    /**
-     * CAS-style disable: only soft-deletes the row when its `data` column still
-     * matches `expectedData` and the row has not already been disabled. Used by
-     * the OAuth refresh-failure path to avoid clobbering a peer that rotated the
-     * row between our pre-check and the disable.
-     */
-    tryDisableAuthCredentialIfMatches(id: number, expectedData: string, disabledCause: string): boolean;
-    deleteAuthCredentialsForProvider(provider: string, disabledCause: string): void;
-    getCache(key: string, options?: {
-        includeExpired?: boolean;
-    }): string | null;
-    setCache(key: string, value: string, expiresAtSec: number): void;
-    cleanExpiredCache(): void;
-    /**
-     * Save OAuth credentials for a provider.
-     * Preserves unrelated identities and replaces only the matching credential.
-     */
-    saveOAuth(provider: string, credentials: OAuthCredentials): void;
-    /**
-     * Get OAuth credentials for a provider.
-     */
-    getOAuth(provider: string): OAuthCredentials | null;
-    /**
-     * Save API key for a provider (replaces existing).
-     */
-    saveApiKey(provider: string, apiKey: string): void;
-    /**
-     * Get API key for a provider.
-     */
-    getApiKey(provider: string): string | null;
-    /**
-     * List all providers with credentials.
-     */
-    listProviders(): string[];
-    /**
-     * Delete all credentials for a provider.
-     */
-    deleteProvider(provider: string): void;
-    close(): void;
-}
-export {};

package/dist/types/cli.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env bun
-export {};