@vib-rato/ai 0.16.0

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -0,0 +1,555 @@
+/**
+ * Zod schemas for the auth-broker wire protocol.
+ *
+ * Shared between the server (validates inbound request bodies) and the client
+ * (validates responses from the broker). Schemas mirror the TypeScript types
+ * in `./types.ts` 1:1; the types remain the source of truth for static typing,
+ * and `z.infer<typeof Schema>` is asserted-compatible with them where possible.
+ *
+ * Schemas use `.strict()` on objects with a closed set of fields so unknown
+ * keys are rejected — the previous implementation used a hand-rolled
+ * `hasOnlyFields` allowlist for the same effect.
+ */
+import * as z from "zod/v4";
+export declare const mcpOAuthBindingSchema: z.ZodObject<{
+    resourceOrigin: z.ZodString;
+    tokenEndpoint: z.ZodString;
+}, z.core.$strict>;
+/** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */
+export declare const oauthCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    refresh: z.ZodString;
+    access: z.ZodString;
+    expires: z.ZodNumber;
+    enterpriseUrl: z.ZodOptional<z.ZodString>;
+    projectId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** OAuth credential as it appears in broker snapshots — refresh replaced with sentinel. */
+export declare const remoteOauthCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    access: z.ZodString;
+    expires: z.ZodNumber;
+    enterpriseUrl: z.ZodOptional<z.ZodString>;
+    projectId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
+    refresh: z.ZodLiteral<"__remote__">;
+}, z.core.$strict>;
+export declare const apiKeyCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"api_key">;
+    key: z.ZodString;
+}, z.core.$strict>;
+/** Discriminated union accepted on POST /v1/credential (writes). */
+export declare const writableAuthCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    refresh: z.ZodString;
+    access: z.ZodString;
+    expires: z.ZodNumber;
+    enterpriseUrl: z.ZodOptional<z.ZodString>;
+    projectId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"api_key">;
+    key: z.ZodString;
+}, z.core.$strict>], "type">;
+/** Discriminated union returned in snapshots (refresh is sentinel for OAuth). */
+export declare const snapshotCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    access: z.ZodString;
+    expires: z.ZodNumber;
+    enterpriseUrl: z.ZodOptional<z.ZodString>;
+    projectId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
+    refresh: z.ZodLiteral<"__remote__">;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"api_key">;
+    key: z.ZodString;
+}, z.core.$strict>], "type">;
+export declare const credentialSnapshotEntrySchema: z.ZodObject<{
+    id: z.ZodNumber;
+    provider: z.ZodString;
+    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"oauth">;
+        access: z.ZodString;
+        expires: z.ZodNumber;
+        enterpriseUrl: z.ZodOptional<z.ZodString>;
+        projectId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        accountId: z.ZodOptional<z.ZodString>;
+        mcpBinding: z.ZodOptional<z.ZodObject<{
+            resourceOrigin: z.ZodString;
+            tokenEndpoint: z.ZodString;
+        }, z.core.$strict>>;
+        refresh: z.ZodLiteral<"__remote__">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        key: z.ZodString;
+    }, z.core.$strict>], "type">;
+    identityKey: z.ZodNullable<z.ZodString>;
+    revision: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const snapshotEntrySchema: z.ZodObject<{
+    id: z.ZodNumber;
+    provider: z.ZodString;
+    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"oauth">;
+        access: z.ZodString;
+        expires: z.ZodNumber;
+        enterpriseUrl: z.ZodOptional<z.ZodString>;
+        projectId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        accountId: z.ZodOptional<z.ZodString>;
+        mcpBinding: z.ZodOptional<z.ZodObject<{
+            resourceOrigin: z.ZodString;
+            tokenEndpoint: z.ZodString;
+        }, z.core.$strict>>;
+        refresh: z.ZodLiteral<"__remote__">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        key: z.ZodString;
+    }, z.core.$strict>], "type">;
+    identityKey: z.ZodNullable<z.ZodString>;
+    revision: z.ZodOptional<z.ZodNumber>;
+    rotatesInMs: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const refresherScheduleSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    intervalMs: z.ZodNumber;
+    skewMs: z.ZodNumber;
+    nextSweepInMs: z.ZodNumber;
+}, z.core.$strict>;
+export declare const snapshotResponseSchema: z.ZodObject<{
+    epoch: z.ZodOptional<z.ZodString>;
+    generation: z.ZodNumber;
+    generatedAt: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Closed redacted projection: no token, key, identity object, or extension fields. */
+export declare const credentialMetadataRecordSchema: z.ZodObject<{
+    id: z.ZodNumber;
+    provider: z.ZodString;
+    type: z.ZodEnum<{
+        api_key: "api_key";
+        oauth: "oauth";
+    }>;
+    identity: z.ZodNullable<z.ZodString>;
+    disabledCause: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const credentialMetadataResponseSchema: z.ZodObject<{
+    epoch: z.ZodOptional<z.ZodString>;
+    generation: z.ZodNumber;
+    generatedAt: z.ZodNumber;
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            oauth: "oauth";
+        }>;
+        identity: z.ZodNullable<z.ZodString>;
+        disabledCause: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** First frame on connect — full snapshot embedded inline with a `kind` tag. */
+export declare const snapshotStreamSnapshotEventSchema: z.ZodObject<{
+    epoch: z.ZodOptional<z.ZodString>;
+    generation: z.ZodNumber;
+    generatedAt: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+    kind: z.ZodLiteral<"snapshot">;
+}, z.core.$strict>;
+/** Per-credential upsert/refresh delta. */
+export declare const snapshotStreamEntryEventSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"entry">;
+    epoch: z.ZodOptional<z.ZodString>;
+    generation: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    entry: z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** Per-credential delete delta. */
+export declare const snapshotStreamRemovedEventSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"removed">;
+    epoch: z.ZodOptional<z.ZodString>;
+    generation: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    id: z.ZodNumber;
+}, z.core.$strict>;
+/** Discriminated union over every event frame the snapshot stream emits. */
+export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    epoch: z.ZodOptional<z.ZodString>;
+    generation: z.ZodNumber;
+    generatedAt: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+    kind: z.ZodLiteral<"snapshot">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"entry">;
+    epoch: z.ZodOptional<z.ZodString>;
+    generation: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    entry: z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        rotatesInMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"removed">;
+    epoch: z.ZodOptional<z.ZodString>;
+    generation: z.ZodNumber;
+    serverNowMs: z.ZodNumber;
+    refresher: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        intervalMs: z.ZodNumber;
+        skewMs: z.ZodNumber;
+        nextSweepInMs: z.ZodNumber;
+    }, z.core.$strict>;
+    id: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export declare const healthzResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    version: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * Broker `/v1/usage` response. Reports are full {@link UsageReport}s minus the
+ * heavy provider-specific `raw` field (the server strips it before send) — we
+ * keep `raw` optional in the underlying schema so a misconfigured broker that
+ * forgot to strip still validates.
+ */
+export declare const usageResponseSchema: z.ZodObject<{
+    generatedAt: z.ZodNumber;
+    reports: z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        fetchedAt: z.ZodNumber;
+        limits: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            scope: z.ZodObject<{
+                provider: z.ZodString;
+                accountId: z.ZodOptional<z.ZodString>;
+                projectId: z.ZodOptional<z.ZodString>;
+                orgId: z.ZodOptional<z.ZodString>;
+                modelId: z.ZodOptional<z.ZodString>;
+                tier: z.ZodOptional<z.ZodString>;
+                windowId: z.ZodOptional<z.ZodString>;
+                shared: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>;
+            window: z.ZodOptional<z.ZodObject<{
+                id: z.ZodString;
+                label: z.ZodString;
+                durationMs: z.ZodOptional<z.ZodNumber>;
+                resetsAt: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+            amount: z.ZodObject<{
+                used: z.ZodOptional<z.ZodNumber>;
+                limit: z.ZodOptional<z.ZodNumber>;
+                remaining: z.ZodOptional<z.ZodNumber>;
+                usedFraction: z.ZodOptional<z.ZodNumber>;
+                remainingFraction: z.ZodOptional<z.ZodNumber>;
+                unit: z.ZodEnum<{
+                    bytes: "bytes";
+                    minutes: "minutes";
+                    percent: "percent";
+                    requests: "requests";
+                    tokens: "tokens";
+                    unknown: "unknown";
+                    usd: "usd";
+                }>;
+            }, z.core.$strip>;
+            status: z.ZodOptional<z.ZodEnum<{
+                exhausted: "exhausted";
+                ok: "ok";
+                unknown: "unknown";
+                warning: "warning";
+            }>>;
+            notes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        raw: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export declare const credentialRefreshRequestSchema: z.ZodObject<{
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const credentialRefreshResponseSchema: z.ZodObject<{
+    entry: z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const credentialDisableRequestSchema: z.ZodObject<{
+    cause: z.ZodOptional<z.ZodString>;
+    expectedRevision: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const credentialDisableResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const credentialUploadRequestSchema: z.ZodObject<{
+    provider: z.ZodString;
+    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"oauth">;
+        refresh: z.ZodString;
+        access: z.ZodString;
+        expires: z.ZodNumber;
+        enterpriseUrl: z.ZodOptional<z.ZodString>;
+        projectId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        accountId: z.ZodOptional<z.ZodString>;
+        mcpBinding: z.ZodOptional<z.ZodObject<{
+            resourceOrigin: z.ZodString;
+            tokenEndpoint: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        key: z.ZodString;
+    }, z.core.$strict>], "type">;
+}, z.core.$strict>;
+export declare const credentialUploadResponseSchema: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const credentialIfAbsentUploadResponseSchema: z.ZodObject<{
+    inserted: z.ZodBoolean;
+    reason: z.ZodEnum<{
+        inserted: "inserted";
+        "skipped-existing": "skipped-existing";
+        "skipped-existing-config": "skipped-existing-config";
+        "skipped-existing-env": "skipped-existing-env";
+        "skipped-existing-fallback": "skipped-existing-fallback";
+        "skipped-existing-runtime": "skipped-existing-runtime";
+        "skipped-invalid": "skipped-invalid";
+        "updated-existing": "updated-existing";
+    }>;
+    entries: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        provider: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            access: z.ZodString;
+            expires: z.ZodNumber;
+            enterpriseUrl: z.ZodOptional<z.ZodString>;
+            projectId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
+            refresh: z.ZodLiteral<"__remote__">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+        }, z.core.$strict>], "type">;
+        identityKey: z.ZodNullable<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;

package/dist/types/auth-gateway/http.d.ts

@@ -0,0 +1,40 @@
+export declare function json(status: number, body: unknown): Response;
+export declare function resolvePeer(req: Request): string;
+/**
+ * Constant-time byte comparison. Falls back to a manual XOR accumulator if
+ * `node:crypto.timingSafeEqual` isn't available. Always processes every byte
+ * of the longer input so length itself doesn't leak via timing.
+ */
+export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+export declare function isAuthorized(req: Request, tokens: ReadonlySet<string>): boolean;
+export declare function isNoAuthBrowserOriginRequest(req: Request, tokens: ReadonlySet<string>): boolean;
+/**
+ * Extract allow-listed passthrough headers from an inbound request. Keys are
+ * lowercased; empty values are dropped. Called once per request in
+ * `handleFormatEndpoint`; parsers then read `options.headers`.
+ */
+export declare function captureRequestHeaders(headers: Headers): Record<string, string>;
+/**
+ * Resolve a prompt-cache identity from inbound request body + headers.
+ * Order of precedence (first wins):
+ *   1. Body `prompt_cache_key`
+ *   2. Body `metadata.{prompt_cache_key,session_id,conversation_id}`
+ *   3. Header `x-prompt-cache-key`
+ *   4. Header `session_id` / `conversation_id` (OpenAI code backend / ChatGPT-OAuth surface)
+ *   5. Header `x-session-id` / `x-conversation-id` (common informal)
+ * Returns undefined when none present; the gateway then derives a stable
+ * UUID from the request's stable parts.
+ */
+export declare function resolvePromptCacheKey(body: unknown, headers?: Headers): string | undefined;
+/**
+ * CORS headers for the auth-gateway. Currently echoes a wildcard origin; the
+ * request is accepted so future tightening can mirror `Origin` without
+ * threading the request through every caller.
+ */
+export declare function corsHeaders(_req: Request): Record<string, string>;
+/**
+ * Re-emit `response` with CORS headers merged. The original response body is
+ * passed through unchanged. Used by the gateway wrapper so every outbound
+ * format-endpoint response carries the same CORS surface as the preflight.
+ */
+export declare function withCors(response: Response, req: Request): Response;

package/dist/types/auth-gateway/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./http";
+export * from "./server";
+export * from "./types";

package/dist/types/auth-gateway/server.d.ts

@@ -0,0 +1,70 @@
+/**
+ * vib auth-gateway HTTP server.
+ *
+ * Accepts a provider-scoped provider-format request (OpenAI chat-completions, Anthropic
+ * messages, OpenAI Responses) and dispatches through pi-ai's `streamSimple()`
+ * — which handles credential injection, anthropic-beta headers, OpenAI code backend
+ * websocket transport, and all the per-provider intricacies. The gateway is
+ * pure protocol translation: foreign wire → vib Context → pi-ai stream() →
+ * vib events → foreign wire.
+ *
+ * Endpoints:
+ *   GET  /healthz                          → unauth; ok + version
+ *   GET  /v1/usage                         → aggregated provider usage (5-min per-credential cache via AuthStorage)
+ *   GET  /v1/credentials/check             → per-credential auth probe (diagnose 401s in a multi-account pool)
+ *   GET  /v1/models                        → list models from the selected provider scope
+ *   POST /v1/chat/completions              → OpenAI chat-completions in/out
+ *   POST /v1/messages                      → Anthropic messages in/out
+ *   POST /v1/responses                     → OpenAI Responses in/out
+ */
+import type { AuthStorage } from "../auth-storage";
+import type { Api, AssistantMessageEventStream, Model, Provider } from "../types";
+import type { AuthGatewayServerHandle, AuthGatewayServerOptions } from "./types";
+export type ModelResolver = (modelId: string) => Model<Api> | undefined;
+export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
+    /** Source of credentials. Caller wires this to a broker-backed AuthStorage. */
+    storage: AuthStorage;
+    /**
+     * Current broker-backed scope authority. When supplied, this is checked on
+     * every request so a live broker snapshot removal immediately fails closed.
+     */
+    hasProviderCredential: () => boolean;
+    /** Refresh the dispatch cache from the current broker snapshot before use. */
+    reloadProviderCredentials: (signal?: AbortSignal) => Promise<void>;
+    /** Confirm that the selected key is still present in the current authority snapshot. */
+    validateProviderCredential: (provider: string, apiKey: string) => boolean;
+    /**
+     * Resolve a client-requested model id to a pi-ai Model. Caller supplies
+     * this from a ModelRegistry (lives in `coding-agent` to avoid an inverse
+     * dependency in `pi-ai`).
+     */
+    resolveModel: ModelResolver;
+    /** Supplier for the source-backed model catalog used by `/v1/models`. */
+    listModels: () => Iterable<Model<Api>>;
+}
+export interface AuthGatewayModelCatalog {
+    readonly models: readonly Model<Api>[];
+    resolve(modelId: string): Model<Api> | undefined;
+}
+/**
+ * Whether a model can be served through the broker-backed auth gateway.
+ *
+ * Bedrock's credential chain is process-local AWS authority, not a broker
+ * credential. Advertising a native Bedrock model from this gateway would let
+ * direct callers bypass the broker boundary (and make readiness lie about a
+ * model the gateway cannot authenticate). Keep this predicate shared with the
+ * CLI readiness checks so every entry point applies the same fence.
+ */
+export declare function isAuthGatewayModelBrokerConsumable(model: Pick<Model<Api>, "api" | "transport">): boolean;
+/**
+ * Build an unambiguous, provider-scoped catalog.
+ *
+ * Models from other providers are intentionally ignored rather than allowed
+ * to compete for the same id. Duplicate ids within the selected provider are
+ * rejected because choosing either one would make request dispatch
+ * order-dependent.
+ */
+export declare function createAuthGatewayModelCatalog(provider: Provider, models: Iterable<Model<Api>>): AuthGatewayModelCatalog;
+export declare function releaseGatewayCredentialLeaseOnAdmission(events: Pick<AssistantMessageEventStream, "result">, release: () => void, signal?: AbortSignal): void;
+export declare function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServerHandle;
+export declare function isSafeProviderScope(provider: unknown): provider is string;