jeopi-ai 16.2.13 → 16.2.14

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [16.2.14] - 2026-07-02
+
 ### Added
 
 - Added opt-in support for Anthropic's server-side fallback beta (`server-side-fallback-2026-06-01`) on the `anthropic-messages` provider, including support for `AnthropicOptions.fallbacks`, mid-stream fallback content blocks, fallback billing/usage iterations, and automatic filtering of fallback blocks during cross-provider message transformations.
@@ -13,6 +15,7 @@
 
 ### Fixed
 
+- Fixed `Cloud Code Assist API error (400): Invalid value at 'request.tools[N].function_declarations[i].parameters.properties[j].value.items'` on the Gemini CLI / Antigravity `parameters` wire path. `normalizeSchemaForCCA` now coerces 2020-12 boolean subschemas (`items: true`, `properties: {x: false}` — valid JSON Schema, so AJV validation passed them through) to `{}` in schema positions while preserving booleans in `enum`/`default` values, and strips JSON Schema keywords the CCA `Schema` proto has no field for (`$id`, `$anchor`, `$comment`, `uniqueItems`, `not`, `if`/`then`/`else`, `contains`/`minContains`/`maxContains`, `dependentRequired`/`dependentSchemas`, `contentEncoding`/`contentMediaType`/`contentSchema`, `deprecated`, `readOnly`, `writeOnly`), spilling human-meaningful ones into the description. These shapes commonly arrive from MCP-server tool schemas; one bad tool no longer 400s the whole request.
 - Fixed an issue where broker usage fetch failures were not cached, causing redundant network requests during sequential ranking passes when the broker is offline.
 - Fixed Xiaomi MiMo API key validation to use the supported `mimo-v2.5` model.
 - Fixed certificate verification errors for custom gateways behind private CA bundles by ensuring `NODE_EXTRA_CA_CERTS` is respected across all provider fetches (including OpenAI-compatible, Codex, Ollama, Azure, and Google).

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "jeopi-ai",
-	"version": "16.2.13",
+	"version": "16.2.14",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/akillness/jeopi",
 	"author": "Can Boluk",
@@ -37,16 +37,16 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@bufbuild/protobuf": "^2.12.0",
-		"jeopi-catalog": "16.2.13",
-		"jeopi-utils": "16.2.13",
-		"jeopi-wire": "16.2.13",
-		"arktype": "^2.2.0",
-		"zod": "^4"
+		"@bufbuild/protobuf": "catalog:",
+		"jeopi-catalog": "catalog:",
+		"jeopi-utils": "catalog:",
+		"jeopi-wire": "catalog:",
+		"arktype": "catalog:",
+		"zod": "catalog:"
 	},
 	"devDependencies": {
-		"@bufbuild/protoc-gen-es": "^2.12.0",
-		"@types/bun": "^1.3.14"
+		"@bufbuild/protoc-gen-es": "catalog:",
+		"@types/bun": "catalog:"
 	},
 	"engines": {
 		"bun": ">=1.3.14"

package/src/auth-storage.ts

@@ -459,7 +459,7 @@ export type AuthStorageOptions = {
 	 * so the TUI can show where a token came from (broker URL or local SQLite path).
 	 *
 	 * Examples:
-	 * - `"local ~/.omp/agent/agent.db"`
+	 * - `"local ~/.jeopi/agent/agent.db"`
 	 * - `"broker http://omp.internal:8765"`
 	 */
 	sourceLabel?: string;

package/src/utils/schema/CONSTRAINTS.md

@@ -93,10 +93,11 @@ For Cloud Code Assist Claude tool declarations, schema MUST satisfy stricter con
 
 ### 3.2 Sanitization contract
 
-1. Start with Google unsupported-key stripping behavior.
+1. Start with Google unsupported-key stripping behavior, **plus** the CCA-proto-unknown keyword set (`CCA_PROTO_UNKNOWN_SCHEMA_FIELDS`): `$id`, `$anchor`, `$comment`, `uniqueItems`, `not`, `if`, `then`, `else`, `contains`, `minContains`, `maxContains`, `dependentRequired`, `dependentSchemas`, `contentEncoding`, `contentMediaType`, `contentSchema`, `deprecated`, `readOnly`, `writeOnly`. These keywords have no field in the CCA `Schema` proto; a leaked one 400s the whole request with "Unknown name".
 2. **`nullable` keyword MUST be stripped** in CCA Claude path.
 3. `type: ["T", "null"]` becomes `type: "T"` with no `nullable` marker.
 4. Human-meaningful stripped keys are appended to `description` with the same spill format used by the Google dispatcher.
+5. **Boolean subschemas MUST be coerced to `{}`** in schema positions (`items` values and `properties` map entries). `items: true` / `properties: {x: false}` are valid 2020-12 JSON Schema — AJV validation passes them — but the CCA proto requires a Schema message and rejects the request with `Invalid value at '...parameters.properties[N].value.items'`. Booleans in value positions (`enum` entries, `default`) MUST be preserved.
 
 ### 3.3 Combiner/union normalization contract
 

package/src/utils/schema/fields.ts

@@ -205,3 +205,34 @@ export const CCA_UNSUPPORTED_SCHEMA_FIELDS: Record<string, true> = {
 	$dynamicAnchor: true,
 	propertyNames: true,
 };
+
+/**
+ * JSON Schema keywords with no counterpart field in the Cloud Code Assist
+ * `Schema` proto (the legacy `parameters` wire shape used for Claude models
+ * and every Antigravity model). Any of these reaching the wire produces a
+ * 400 INVALID_ARGUMENT ("Unknown name ..."). Stripped only on the CCA
+ * `parameters` path — the Google `parametersJsonSchema` path accepts full
+ * JSON Schema and keeps them.
+ */
+export const CCA_PROTO_UNKNOWN_SCHEMA_FIELDS: Record<string, true> = {
+	$id: true,
+	$anchor: true,
+	$comment: true,
+	uniqueItems: true,
+	not: true,
+	if: true,
+	// biome-ignore lint/suspicious/noThenProperty: JSON Schema keyword
+	then: true,
+	else: true,
+	contains: true,
+	minContains: true,
+	maxContains: true,
+	dependentRequired: true,
+	dependentSchemas: true,
+	contentEncoding: true,
+	contentMediaType: true,
+	contentSchema: true,
+	deprecated: true,
+	readOnly: true,
+	writeOnly: true,
+};

package/src/utils/schema/normalize.ts

@@ -13,6 +13,7 @@ import { upgradeJsonSchemaTo202012 } from "./draft";
 import { areJsonValuesEqual, mergeCompatibleEnumSchemas, mergePropertySchemas } from "./equality";
 import {
 	ALL_CCA_TYPE_SPECIFIC_KEYS,
+	CCA_PROTO_UNKNOWN_SCHEMA_FIELDS,
 	CLOUD_CODE_ASSIST_SHARED_SCHEMA_KEYS,
 	CLOUD_CODE_ASSIST_TYPE_SPECIFIC_KEYS,
 	COMBINATOR_KEYS,
@@ -51,6 +52,14 @@ export interface NormalizeSchemaOptions {
 	foldOneOfIntoAnyOf: boolean;
 	dropNonScalarEnum: boolean;
 	rejectResidualIncompatibilities?: ReadonlyArray<ResidualSchemaIncompatibility>;
+	/**
+	 * Coerce 2020-12 boolean subschemas (`items: true`, `properties: {x: false}`)
+	 * to `{}` in schema positions. Boolean schemas are valid JSON Schema (so AJV
+	 * validation passes them) but the Cloud Code Assist `Schema` proto requires
+	 * a message, and a leaked boolean fails the whole request with
+	 * `Invalid value at '...parameters.properties[N].value.items'` (400).
+	 */
+	coerceBooleanSubschemas?: boolean;
 	validateAndFallback?: { fallback: unknown };
 }
 
@@ -84,6 +93,23 @@ function isGoogleUnsupportedSchemaField(key: string): boolean {
 	return Object.hasOwn(UNSUPPORTED_SCHEMA_FIELDS, key);
 }
 
+function isCcaUnsupportedSchemaField(key: string): boolean {
+	return Object.hasOwn(UNSUPPORTED_SCHEMA_FIELDS, key) || Object.hasOwn(CCA_PROTO_UNKNOWN_SCHEMA_FIELDS, key);
+}
+
+/**
+ * Replace a boolean subschema with `{}` when it sits in a schema position:
+ * a value inside a `properties` map, or the value of `items`. Only these
+ * positions are proto-mapped schema fields on the CCA wire; booleans in
+ * value positions (`enum` entries, `default`) are never touched because they
+ * arrive as array/scalar entries, not via this per-key assignment.
+ */
+function coerceBooleanSubschema(value: unknown, key: string, options: NormalizeSchemaWalkOptions): unknown {
+	if (options.coerceBooleanSubschemas !== true || typeof value !== "boolean") return value;
+	if (options.insideProperties || key === "items") return {};
+	return value;
+}
+
 function isMcpUnsupportedSchemaField(key: string): boolean {
 	return key === "$schema";
 }
@@ -303,10 +329,14 @@ function normalizeSchemaObjectNode(value: JsonObject, options: NormalizeSchemaWa
 				continue;
 			}
 			if (options.stripNullableKeyword && key === "nullable") continue;
-			result[key] = normalizeSchemaNode(entry, {
-				...options,
-				insideProperties: !options.insideProperties && key === "properties",
-			});
+			result[key] = coerceBooleanSubschema(
+				normalizeSchemaNode(entry, {
+					...options,
+					insideProperties: !options.insideProperties && key === "properties",
+				}),
+				key,
+				options,
+			);
 		}
 		applyDescriptionSpill(result, spill, options);
 		return applyNodePostProcessing(result, options);
@@ -325,10 +355,14 @@ function normalizeSchemaObjectNode(value: JsonObject, options: NormalizeSchemaWa
 			constValue = entry;
 			continue;
 		}
-		result[key] = normalizeSchemaNode(entry, {
-			...options,
-			insideProperties: !options.insideProperties && key === "properties",
-		});
+		result[key] = coerceBooleanSubschema(
+			normalizeSchemaNode(entry, {
+				...options,
+				insideProperties: !options.insideProperties && key === "properties",
+			}),
+			key,
+			options,
+		);
 	}
 
 	if (options.normalizeTypeArrayToNullable && Array.isArray(result.type)) {
@@ -924,7 +958,7 @@ export function normalizeSchemaForGoogle(value: unknown): unknown {
 
 export function normalizeSchemaForCCA(value: unknown): unknown {
 	return normalizeSchema(value, {
-		unsupportedFields: isGoogleUnsupportedSchemaField,
+		unsupportedFields: isCcaUnsupportedSchemaField,
 		normalizeFieldNames: true,
 		collapseNullFields: false,
 		normalizeTypeArrayToNullable: true,
@@ -940,6 +974,7 @@ export function normalizeSchemaForCCA(value: unknown): unknown {
 		inferTypeForBareEnum: true,
 		dropNonScalarEnum: false,
 		foldOneOfIntoAnyOf: false,
+		coerceBooleanSubschemas: true,
 		rejectResidualIncompatibilities: ["type-array", "type-null", "nullable", "combiners"],
 		validateAndFallback: { fallback: CLOUD_CODE_ASSIST_CLAUDE_FALLBACK_SCHEMA },
 	});

package/dist/types/api-registry.d.ts

@@ -1,30 +0,0 @@
-/**
- * Custom API provider registry.
- *
- * Allows extensions to register streaming functions for custom API types
- * (e.g., "vertex-claude-api") that are not built into stream.ts.
- */
-import type { Api, AssistantMessageEventStream, Context, Model, SimpleStreamOptions, StreamOptions } from "./types";
-export type CustomStreamFn = (model: Model<Api>, context: Context, options?: StreamOptions) => AssistantMessageEventStream;
-export type CustomStreamSimpleFn = (model: Model<Api>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream;
-export interface RegisteredCustomApi {
-    stream: CustomStreamFn;
-    streamSimple: CustomStreamSimpleFn;
-    sourceId?: string;
-}
-/**
- * Register a custom API streaming function.
- */
-export declare function registerCustomApi(api: string, streamSimple: CustomStreamSimpleFn, sourceId?: string, stream?: CustomStreamFn): void;
-/**
- * Get a custom API provider by API identifier.
- */
-export declare function getCustomApi(api: string): RegisteredCustomApi | undefined;
-/**
- * Remove all custom APIs registered by a specific source (e.g., extension path).
- */
-export declare function unregisterCustomApis(sourceId: string): void;
-/**
- * Clear all custom API registrations.
- */
-export declare function clearCustomApis(): void;

package/dist/types/auth-broker/client.d.ts

@@ -1,73 +0,0 @@
-/**
- * HTTP client for the omp auth-broker server.
- *
- * Used by {@link RemoteAuthCredentialStore} (snapshot pulls) and by
- * `omp auth-broker status` (liveness checks). All endpoints except
- * `/v1/healthz` require a bearer token.
- */
-import type { AuthCredential } from "../auth-storage";
-import type { CredentialDisableResponse, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse } from "./types";
-export interface AuthBrokerClientOptions {
-    /** Base URL (e.g. `https://broker.tailnet:8765`). Trailing slashes are trimmed. */
-    url: string;
-    /** Bearer token used for everything except `healthz`. */
-    token: string;
-    /** Per-request timeout in milliseconds. Default 10s. */
-    timeoutMs?: number;
-    /** Retry connection errors this many times. Default 1. */
-    maxRetries?: number;
-    /** Override fetch (used in tests). Default global `fetch`. */
-    fetchImpl?: typeof fetch;
-}
-export declare class AuthBrokerError extends Error {
-    readonly status: number | undefined;
-    readonly body: string | undefined;
-    constructor(message: string, opts?: {
-        status?: number;
-        body?: string;
-        cause?: unknown;
-    });
-}
-/**
- * Thrown when a broker responds 404 to `GET /v1/snapshot/stream` — old
- * brokers that predate the SSE endpoint. Callers (`RemoteAuthCredentialStore`)
- * detect this sentinel to fall back to long-polling permanently.
- */
-export declare class AuthBrokerStreamUnsupportedError extends AuthBrokerError {
-    constructor(message?: string);
-}
-export interface FetchSnapshotOptions {
-    ifGenerationGt?: number;
-    waitMs?: number;
-    signal?: AbortSignal;
-}
-export type FetchSnapshotResult = {
-    status: 200;
-    snapshot: SnapshotResponse;
-    generation: number;
-} | {
-    status: 304;
-    generation: number;
-};
-export declare class AuthBrokerClient {
-    #private;
-    constructor(opts: AuthBrokerClientOptions);
-    healthz(signal?: AbortSignal): Promise<HealthzResponse>;
-    fetchSnapshot(opts?: FetchSnapshotOptions): Promise<FetchSnapshotResult>;
-    /**
-     * Subscribe to the broker's SSE snapshot stream. The first frame is always
-     * a full `snapshot`; subsequent frames are `entry` upserts / refreshes or
-     * `removed` deletes. Caller controls lifecycle via `opts.signal`.
-     *
-     * Throws {@link AuthBrokerStreamUnsupportedError} when the broker responds
-     * 404 — older brokers predate this endpoint and the caller should fall back
-     * to long-polling for the remainder of its lifetime.
-     */
-    openSnapshotStream(opts?: {
-        signal?: AbortSignal;
-    }): AsyncGenerator<SnapshotStreamEvent>;
-    fetchUsage(signal?: AbortSignal): Promise<UsageResponse>;
-    refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
-    disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse>;
-    uploadCredential(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialUploadResponse>;
-}

package/dist/types/auth-broker/discover.d.ts

@@ -1,35 +0,0 @@
-import { AuthStorage } from "../auth-storage";
-export interface AuthBrokerClientConfig {
-    url: string;
-    token: string;
-}
-export interface ResolveAuthBrokerConfigOptions {
-    agentDir?: string;
-    configValueResolver?: (config: string) => Promise<string | undefined>;
-}
-export interface DiscoverAuthStorageOptions {
-    agentDir?: string;
-    configValueResolver?: (config: string) => Promise<string | undefined>;
-    cachePath?: string;
-    sourceLabel?: string;
-}
-/** Path to the local bearer token file. Created by `omp auth-broker token`. */
-export declare function getAuthBrokerTokenFilePath(): string;
-/**
- * Resolve broker connection configuration using the same precedence as the TUI:
- *
- * 1. `OMP_AUTH_BROKER_URL` / `OMP_AUTH_BROKER_TOKEN` env vars.
- * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml`.
- * 3. `<config-root>/auth-broker.token` file (paired with a URL from env/config).
- *
- * Returns `null` when no broker URL is configured — callers should fall back to
- * the local SQLite store. Throws when a URL is configured but no token is
- * available, matching the TUI behavior.
- */
-export declare function resolveAuthBrokerConfig(options?: ResolveAuthBrokerConfigOptions): Promise<AuthBrokerClientConfig | null>;
-/**
- * Create an AuthStorage instance, using the broker when configured and falling
- * back to the local SQLite store otherwise. This is the single source of truth
- * for the TUI and the catalog generator.
- */
-export declare function discoverAuthStorage(options?: DiscoverAuthStorageOptions): Promise<AuthStorage>;

package/dist/types/auth-broker/index.d.ts

@@ -1,7 +0,0 @@
-export * from "./client";
-export * from "./discover";
-export * from "./refresher";
-export * from "./remote-store";
-export * from "./server";
-export * from "./snapshot-cache";
-export * from "./types";

package/dist/types/auth-broker/refresher.d.ts

@@ -1,25 +0,0 @@
-import { type AuthStorage } from "../auth-storage";
-export interface AuthBrokerRefresherOptions {
-    storage: AuthStorage;
-    /** Refresh credentials expiring within this window. Default 5 min. */
-    refreshSkewMs?: number;
-    /** Loop cadence. Default 60s. */
-    refreshIntervalMs?: number;
-    /** Override clock (tests). */
-    now?: () => number;
-}
-export interface AuthBrokerRefresherSchedule {
-    enabled: boolean;
-    intervalMs: number;
-    skewMs: number;
-    nextSweepAt: number;
-}
-export declare class AuthBrokerRefresher {
-    #private;
-    constructor(opts: AuthBrokerRefresherOptions);
-    start(): void;
-    stop(): void;
-    getSchedule(): AuthBrokerRefresherSchedule;
-    /** Run one sweep. Exposed for tests. */
-    tick(): Promise<void>;
-}

package/dist/types/auth-broker/remote-store.d.ts

@@ -1,102 +0,0 @@
-import { type AuthCredential, type AuthCredentialStore, type OAuthCredential, type StoredAuthCredential } from "../auth-storage";
-import type { OAuthCredentials } from "../registry/oauth/types";
-import type { Provider } from "../types";
-import type { UsageReport } from "../usage";
-import { type AuthBrokerClient } from "./client";
-import type { SnapshotResponse } from "./types";
-export interface RemoteAuthCredentialStoreOptions {
-    client: AuthBrokerClient;
-    /**
-     * Initial snapshot. When omitted, callers must call
-     * {@link RemoteAuthCredentialStore.refreshSnapshot} before the first read.
-     */
-    initialSnapshot?: SnapshotResponse;
-    /**
-     * Subscribe to the broker's SSE snapshot stream when available. Falls back
-     * to long-poll permanently when the broker returns 404. Default `true`.
-     */
-    streamSnapshots?: boolean;
-    /**
-     * Called after broker-sourced full snapshots are applied. The constructor's
-     * initial snapshot intentionally does not trigger this hook.
-     */
-    onSnapshot?: (snapshot: SnapshotResponse, generation: number) => void;
-}
-export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
-    #private;
-    constructor(opts: RemoteAuthCredentialStoreOptions);
-    get client(): AuthBrokerClient;
-    get snapshot(): SnapshotResponse;
-    /** Re-hydrate the in-memory snapshot from the broker. */
-    refreshSnapshot(): Promise<SnapshotResponse>;
-    listAuthCredentials(provider?: string): StoredAuthCredential[];
-    /**
-     * In-memory update from a successful refresh through the broker. AuthStorage
-     * calls this after `#replaceCredentialAt`; the broker already persisted the
-     * authoritative row, so we just mirror it.
-     */
-    updateAuthCredential(id: number, credential: AuthCredential): void;
-    deleteAuthCredential(id: number, disabledCause: string): void;
-    deleteAuthCredentialRemote(id: number, disabledCause: string): Promise<boolean>;
-    tryDisableAuthCredentialIfMatches(id: number, _expectedData: string, disabledCause: string): boolean;
-    waitForFreshSnapshot(maxWaitMs: number, opts?: {
-        signal?: AbortSignal;
-    }): Promise<boolean>;
-    prepareForRequest(credentialId: number, opts?: {
-        signal?: AbortSignal;
-    }): Promise<boolean>;
-    markCredentialSuspect(credentialId: number, opts?: {
-        signal?: AbortSignal;
-    }): Promise<void>;
-    replaceAuthCredentialsForProvider(_provider: string, _credentials: AuthCredential[]): StoredAuthCredential[];
-    upsertAuthCredentialForProvider(_provider: string, _credential: AuthCredential): StoredAuthCredential[];
-    deleteAuthCredentialsForProvider(_provider: string, _disabledCause: string): void;
-    /**
-     * Upsert a single credential through the broker. The broker server is the
-     * canonical writer — see `POST /v1/credential`. The redacted snapshot
-     * entries returned by the server replace the provider's rows in our local
-     * snapshot, and the global snapshot is then refreshed in the background so
-     * any concurrent peer (refresh, generation bump) stays in sync.
-     */
-    upsertAuthCredentialRemote(provider: string, credential: AuthCredential): Promise<StoredAuthCredential[]>;
-    /**
-     * Replace-all semantics: disable every active credential for the provider,
-     * then upload each of the new credentials. Used by API-key login so a new
-     * key clobbers any previously stored key for the same provider.
-     */
-    replaceAuthCredentialsRemote(provider: string, credentials: AuthCredential[]): Promise<StoredAuthCredential[]>;
-    /**
-     * Logout: disable every active credential for the provider on the broker,
-     * then drop them from the local snapshot. Refresh fetches the authoritative
-     * post-state in the background.
-     */
-    deleteAuthCredentialsRemote(provider: string, disabledCause: string): Promise<void>;
-    getCache(key: string): string | null;
-    setCache(key: string, value: string, expiresAtSec: number): void;
-    cleanExpiredCache(): void;
-    /**
-     * Store-level hook consumed by `AuthStorage` — routes refresh through the
-     * broker so the actual refresh token never leaves the broker host. Returns
-     * the broker-redacted credential with {@link REMOTE_REFRESH_SENTINEL} in
-     * the `refresh` slot.
-     */
-    refreshOAuthCredential(_provider: Provider, credentialId: number, _credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredentials>;
-    /**
-     * Store-level hook consumed by `AuthStorage.fetchUsageReports()` — proxies
-     * to the broker's `/v1/usage` endpoint. The broker's egress IP isn't
-     * rate-limited by Anthropic's per-IP `/usage` cap the way a heavy
-     * residential laptop is, so all credentials surface every cycle.
-     */
-    fetchUsageReports(signal?: AbortSignal): Promise<UsageReport[] | null>;
-    /**
-     * Per-credential usage hook consumed by `AuthStorage.#getUsageReport`. Pulls
-     * the aggregate broker `/v1/usage` once and serves all callers from the
-     * same response (coalesced + cached), then matches the credential to a
-     * report by provider + identity (accountId / email / projectId).
-     *
-     * The broker already aggregates with its own 30s TTL on the server side; our
-     * 15s client TTL is below that so we usually re-use the broker's cache too.
-     */
-    getUsageReport(provider: Provider, credential: OAuthCredential, signal?: AbortSignal): Promise<UsageReport | null>;
-    close(): void;
-}

package/dist/types/auth-broker/server.d.ts

@@ -1,43 +0,0 @@
-/**
- * Auth broker HTTP server.
- *
- * Wraps an {@link AuthStorage} (backed by a SQLite store on the broker host)
- * and exposes a minimal REST API for snapshot pulls and explicit refresh /
- * disable operations. Background refresh of expiring credentials lives in
- * {@link AuthBrokerRefresher}.
- *
- * Transport security is delegated to the operator (Tailscale / Wireguard);
- * the server only checks a bearer token against an allow-list per request.
- */
-import type { AuthStorage } from "../auth-storage";
-export interface AuthBrokerServerOptions {
-    /** Underlying credential storage (wraps the local SQLite store on the broker). */
-    storage: AuthStorage;
-    /** Listen address; accepts `host:port` or just `port`. */
-    bind?: string;
-    /** Accept any of these bearer tokens. Empty disables auth (loopback only). */
-    bearerTokens: string[];
-    /** Broker version string surfaced on `/v1/healthz`. */
-    version?: string;
-    /** Refresh credentials expiring within this window. Default 5 min. */
-    refreshSkewMs?: number;
-    /** Background refresh cadence. Default 60s. */
-    refreshIntervalMs?: number;
-    /** Disable the background refresher (e.g. for tests). */
-    disableRefresher?: boolean;
-    /**
-     * Override SSE keepalive cadence in milliseconds for `/v1/snapshot/stream`.
-     * Internal-only — tests use a short interval so they can assert heartbeats
-     * without long sleeps. Default {@link DEFAULT_STREAM_KEEPALIVE_MS}.
-     */
-    streamKeepaliveMs?: number;
-}
-export interface AuthBrokerServerHandle {
-    /** Bound URL (`http://host:port`). */
-    url: string;
-    port: number;
-    hostname: string;
-    close(): Promise<void>;
-}
-/** Boot the broker. Caller owns lifecycle; `handle.close()` to stop. */
-export declare function startAuthBroker(opts: AuthBrokerServerOptions): AuthBrokerServerHandle;

package/dist/types/auth-broker/snapshot-cache.d.ts

@@ -1,17 +0,0 @@
-import type { SnapshotResponse } from "./types";
-export interface ReadAuthBrokerSnapshotCacheOptions {
-    path: string;
-    token: string;
-    url: string;
-    ttlMs: number;
-    /** Override clock for deterministic tests. */
-    now?: () => number;
-}
-export interface WriteAuthBrokerSnapshotCacheOptions {
-    path: string;
-    token: string;
-    url: string;
-    snapshot: SnapshotResponse;
-}
-export declare function readAuthBrokerSnapshotCache(opts: ReadAuthBrokerSnapshotCacheOptions): Promise<SnapshotResponse | null>;
-export declare function writeAuthBrokerSnapshotCache(opts: WriteAuthBrokerSnapshotCacheOptions): Promise<void>;

package/dist/types/auth-broker/types.d.ts

@@ -1,107 +0,0 @@
-/**
- * Wire types shared between the auth-broker server and clients.
- *
- * The broker holds OAuth refresh tokens and exposes a redacted snapshot;
- * clients use `access` tokens directly and call back to the broker when a
- * credential expires or a 401 surfaces on a supposedly-fresh credential.
- */
-import type { AuthCredential, AuthCredentialSnapshot, AuthCredentialSnapshotEntry } from "../auth-storage";
-import type { UsageReport } from "../usage";
-/** GET /v1/healthz response body. */
-export interface HealthzResponse {
-    ok: boolean;
-    version?: string;
-}
-export interface RefresherSchedule {
-    enabled: boolean;
-    intervalMs: number;
-    skewMs: number;
-    nextSweepInMs: number;
-}
-export type SnapshotEntry = AuthCredentialSnapshotEntry & {
-    rotatesInMs: number | null;
-};
-/** GET /v1/snapshot response body. */
-export interface SnapshotResponse extends Omit<AuthCredentialSnapshot, "credentials"> {
-    serverNowMs: number;
-    refresher: RefresherSchedule;
-    credentials: SnapshotEntry[];
-}
-/** GET /v1/usage response body — matches the local `AuthStorage.fetchUsageReports` shape. */
-export interface UsageResponse {
-    generatedAt: number;
-    reports: UsageReport[];
-}
-/** POST /v1/credential/:id/refresh response body. */
-export interface CredentialRefreshResponse {
-    entry: AuthCredentialSnapshotEntry;
-}
-/** POST /v1/credential/:id/disable request body. */
-export interface CredentialDisableRequest {
-    cause: string;
-}
-/** POST /v1/credential/:id/disable response body. */
-export interface CredentialDisableResponse {
-    ok: boolean;
-}
-/**
- * POST /v1/credential request body. The OAuth `refresh` must be the *real*
- * refresh token (not the sentinel) — the broker is the canonical writer.
- */
-export interface CredentialUploadRequest {
-    provider: string;
-    credential: AuthCredential;
-}
-/** POST /v1/credential response body — redacted snapshot of the provider's rows after upsert. */
-export interface CredentialUploadResponse {
-    entries: AuthCredentialSnapshotEntry[];
-}
-/**
- * SSE event kinds emitted on `GET /v1/snapshot/stream`. The same value is set
- * as the SSE `event:` name (load-bearing for clients) **and** embedded as a
- * `kind` field inside the JSON body so a Zod discriminated union can validate
- * the payload without consulting the line metadata.
- */
-export type SnapshotStreamEventKind = "snapshot" | "entry" | "removed";
-/** Initial frame emitted on connect — the full {@link SnapshotResponse}. */
-export interface SnapshotStreamSnapshotEvent extends SnapshotResponse {
-    kind: "snapshot";
-}
-/** Single credential added/changed (upsert or refresh). */
-export interface SnapshotStreamEntryEvent {
-    kind: "entry";
-    generation: number;
-    serverNowMs: number;
-    refresher: RefresherSchedule;
-    entry: SnapshotEntry;
-}
-/** Single credential disabled/deleted. */
-export interface SnapshotStreamRemovedEvent {
-    kind: "removed";
-    generation: number;
-    serverNowMs: number;
-    refresher: RefresherSchedule;
-    id: number;
-}
-/** Discriminated union of every event the snapshot stream emits. */
-export type SnapshotStreamEvent = SnapshotStreamSnapshotEvent | SnapshotStreamEntryEvent | SnapshotStreamRemovedEvent;
-/**
- * Default bearer-protected route prefix. The broker exposes `/v1/healthz`
- * unauthenticated for liveness probes; everything else requires a bearer.
- */
-export declare const AUTH_BROKER_API_PREFIX = "/v1";
-/** Default port when none is configured. Loopback-only, no external exposure. */
-export declare const DEFAULT_AUTH_BROKER_BIND = "127.0.0.1:8765";
-/** Default broker→provider refresh skew. Refresh credentials this close to expiry. */
-export declare const DEFAULT_REFRESH_SKEW_MS: number;
-/** Default broker refresh-loop cadence. */
-export declare const DEFAULT_REFRESH_INTERVAL_MS = 60000;
-/** Default freshness window for the encrypted local broker snapshot cache. */
-export declare const DEFAULT_SNAPSHOT_CACHE_TTL_MS: number;
-/** Keepalive cadence for `GET /v1/snapshot/stream` SSE comments. */
-export declare const DEFAULT_STREAM_KEEPALIVE_MS = 20000;
-/**
- * Bun.serve `idleTimeout` (seconds) used by the broker. Default Bun idle
- * timeout (10s) would close long-lived SSE connections between keepalives.
- */
-export declare const DEFAULT_SERVER_IDLE_TIMEOUT_S = 255;