jeopi-ai 16.2.13

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -0,0 +1,411 @@
+/** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */
+export declare const oauthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    apiEndpoint?: string | undefined;
+    type: "oauth";
+    refresh: string;
+    access: string;
+    expires: number;
+    enterpriseUrl?: string | undefined;
+    projectId?: string | undefined;
+    email?: string | undefined;
+    accountId?: string | undefined;
+}, {}>;
+/** OAuth credential as it appears in broker snapshots — refresh replaced with sentinel. */
+export declare const remoteOauthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    apiEndpoint?: string | undefined;
+    type: "oauth";
+    refresh: "__remote__";
+    access: string;
+    expires: number;
+    enterpriseUrl?: string | undefined;
+    projectId?: string | undefined;
+    email?: string | undefined;
+    accountId?: string | undefined;
+}, {}>;
+export declare const apiKeyCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    type: "api_key";
+    key: string;
+}, {}>;
+/** Discriminated union accepted on POST /v1/credential (writes). */
+export declare const writableAuthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    apiEndpoint?: string | undefined;
+    type: "oauth";
+    refresh: string;
+    access: string;
+    expires: number;
+    enterpriseUrl?: string | undefined;
+    projectId?: string | undefined;
+    email?: string | undefined;
+    accountId?: string | undefined;
+} | {
+    type: "api_key";
+    key: string;
+}, {}>;
+/** Discriminated union returned in snapshots (refresh is sentinel for OAuth). */
+export declare const snapshotCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    apiEndpoint?: string | undefined;
+    type: "oauth";
+    refresh: "__remote__";
+    access: string;
+    expires: number;
+    enterpriseUrl?: string | undefined;
+    projectId?: string | undefined;
+    email?: string | undefined;
+    accountId?: string | undefined;
+} | {
+    type: "api_key";
+    key: string;
+}, {}>;
+export declare const credentialSnapshotEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    id: number;
+    provider: string;
+    credential: {
+        apiEndpoint?: string | undefined;
+        type: "oauth";
+        refresh: "__remote__";
+        access: string;
+        expires: number;
+        enterpriseUrl?: string | undefined;
+        projectId?: string | undefined;
+        email?: string | undefined;
+        accountId?: string | undefined;
+    } | {
+        type: "api_key";
+        key: string;
+    };
+    identityKey: string | null;
+}, {}>;
+export declare const snapshotEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    id: number;
+    provider: string;
+    credential: {
+        apiEndpoint?: string | undefined;
+        type: "oauth";
+        refresh: "__remote__";
+        access: string;
+        expires: number;
+        enterpriseUrl?: string | undefined;
+        projectId?: string | undefined;
+        email?: string | undefined;
+        accountId?: string | undefined;
+    } | {
+        type: "api_key";
+        key: string;
+    };
+    identityKey: string | null;
+    rotatesInMs: number | null;
+}, {}>;
+export declare const refresherScheduleSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    enabled: boolean;
+    intervalMs: number;
+    skewMs: number;
+    nextSweepInMs: number;
+}, {}>;
+export declare const snapshotResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    generation: number;
+    generatedAt: number;
+    serverNowMs: number;
+    refresher: {
+        enabled: boolean;
+        intervalMs: number;
+        skewMs: number;
+        nextSweepInMs: number;
+    };
+    credentials: {
+        id: number;
+        provider: string;
+        credential: {
+            apiEndpoint?: string | undefined;
+            type: "oauth";
+            refresh: "__remote__";
+            access: string;
+            expires: number;
+            enterpriseUrl?: string | undefined;
+            projectId?: string | undefined;
+            email?: string | undefined;
+            accountId?: string | undefined;
+        } | {
+            type: "api_key";
+            key: string;
+        };
+        identityKey: string | null;
+        rotatesInMs: number | null;
+    }[];
+}, {}>;
+/** First frame on connect — full snapshot embedded inline with a `kind` tag. */
+export declare const snapshotStreamSnapshotEventSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    generation: number;
+    generatedAt: number;
+    serverNowMs: number;
+    refresher: {
+        enabled: boolean;
+        intervalMs: number;
+        skewMs: number;
+        nextSweepInMs: number;
+    };
+    credentials: {
+        id: number;
+        provider: string;
+        credential: {
+            apiEndpoint?: string | undefined;
+            type: "oauth";
+            refresh: "__remote__";
+            access: string;
+            expires: number;
+            enterpriseUrl?: string | undefined;
+            projectId?: string | undefined;
+            email?: string | undefined;
+            accountId?: string | undefined;
+        } | {
+            type: "api_key";
+            key: string;
+        };
+        identityKey: string | null;
+        rotatesInMs: number | null;
+    }[];
+    kind: "snapshot";
+}, {}>;
+/** Per-credential upsert/refresh delta. */
+export declare const snapshotStreamEntryEventSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    kind: "entry";
+    generation: number;
+    serverNowMs: number;
+    refresher: {
+        enabled: boolean;
+        intervalMs: number;
+        skewMs: number;
+        nextSweepInMs: number;
+    };
+    entry: {
+        id: number;
+        provider: string;
+        credential: {
+            apiEndpoint?: string | undefined;
+            type: "oauth";
+            refresh: "__remote__";
+            access: string;
+            expires: number;
+            enterpriseUrl?: string | undefined;
+            projectId?: string | undefined;
+            email?: string | undefined;
+            accountId?: string | undefined;
+        } | {
+            type: "api_key";
+            key: string;
+        };
+        identityKey: string | null;
+        rotatesInMs: number | null;
+    };
+}, {}>;
+/** Per-credential delete delta. */
+export declare const snapshotStreamRemovedEventSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    kind: "removed";
+    generation: number;
+    serverNowMs: number;
+    refresher: {
+        enabled: boolean;
+        intervalMs: number;
+        skewMs: number;
+        nextSweepInMs: number;
+    };
+    id: number;
+}, {}>;
+/** Discriminated union over every event frame the snapshot stream emits. */
+export declare const snapshotStreamEventSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    generation: number;
+    generatedAt: number;
+    serverNowMs: number;
+    refresher: {
+        enabled: boolean;
+        intervalMs: number;
+        skewMs: number;
+        nextSweepInMs: number;
+    };
+    credentials: {
+        id: number;
+        provider: string;
+        credential: {
+            apiEndpoint?: string | undefined;
+            type: "oauth";
+            refresh: "__remote__";
+            access: string;
+            expires: number;
+            enterpriseUrl?: string | undefined;
+            projectId?: string | undefined;
+            email?: string | undefined;
+            accountId?: string | undefined;
+        } | {
+            type: "api_key";
+            key: string;
+        };
+        identityKey: string | null;
+        rotatesInMs: number | null;
+    }[];
+    kind: "snapshot";
+} | {
+    kind: "entry";
+    generation: number;
+    serverNowMs: number;
+    refresher: {
+        enabled: boolean;
+        intervalMs: number;
+        skewMs: number;
+        nextSweepInMs: number;
+    };
+    entry: {
+        id: number;
+        provider: string;
+        credential: {
+            apiEndpoint?: string | undefined;
+            type: "oauth";
+            refresh: "__remote__";
+            access: string;
+            expires: number;
+            enterpriseUrl?: string | undefined;
+            projectId?: string | undefined;
+            email?: string | undefined;
+            accountId?: string | undefined;
+        } | {
+            type: "api_key";
+            key: string;
+        };
+        identityKey: string | null;
+        rotatesInMs: number | null;
+    };
+} | {
+    kind: "removed";
+    generation: number;
+    serverNowMs: number;
+    refresher: {
+        enabled: boolean;
+        intervalMs: number;
+        skewMs: number;
+        nextSweepInMs: number;
+    };
+    id: number;
+}, {}>;
+export declare const healthzResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    ok: boolean;
+    version?: string | undefined;
+}, {}>;
+/**
+ * Broker `/v1/usage` response. Reports are full {@link UsageReport}s minus the
+ * heavy provider-specific `raw` field (the server strips it before send) — we
+ * keep `raw` optional in the underlying schema so a misconfigured broker that
+ * forgot to strip still validates.
+ */
+export declare const usageResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    generatedAt: number;
+    reports: {
+        provider: string;
+        fetchedAt: number;
+        limits: {
+            id: string;
+            label: string;
+            scope: {
+                provider: string;
+                accountId?: string | undefined;
+                projectId?: string | undefined;
+                orgId?: string | undefined;
+                modelId?: string | undefined;
+                tier?: string | undefined;
+                windowId?: string | undefined;
+                shared?: boolean | undefined;
+            };
+            window?: {
+                id: string;
+                label: string;
+                durationMs?: number | undefined;
+                resetsAt?: number | undefined;
+            } | undefined;
+            amount: {
+                used?: number | undefined;
+                limit?: number | undefined;
+                remaining?: number | undefined;
+                usedFraction?: number | undefined;
+                remainingFraction?: number | undefined;
+                unit: "bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
+            };
+            status?: "exhausted" | "ok" | "unknown" | "warning" | undefined;
+            notes?: string[] | undefined;
+        }[];
+        resetCredits?: {
+            availableCount: number;
+            credits?: {
+                grantedAt?: string | undefined;
+                expiresAt?: string | undefined;
+                status?: string | undefined;
+            }[] | undefined;
+        } | undefined;
+        notes?: string[] | undefined;
+        metadata?: {
+            [x: string]: unknown;
+        } | undefined;
+        raw?: unknown;
+    }[];
+}, {}>;
+export declare const credentialRefreshResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    entry: {
+        id: number;
+        provider: string;
+        credential: {
+            apiEndpoint?: string | undefined;
+            type: "oauth";
+            refresh: "__remote__";
+            access: string;
+            expires: number;
+            enterpriseUrl?: string | undefined;
+            projectId?: string | undefined;
+            email?: string | undefined;
+            accountId?: string | undefined;
+        } | {
+            type: "api_key";
+            key: string;
+        };
+        identityKey: string | null;
+    };
+}, {}>;
+export declare const credentialDisableRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    cause?: string | undefined;
+}, {}>;
+export declare const credentialDisableResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    ok: boolean;
+}, {}>;
+export declare const credentialUploadRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    provider: string;
+    credential: {
+        apiEndpoint?: string | undefined;
+        type: "oauth";
+        refresh: string;
+        access: string;
+        expires: number;
+        enterpriseUrl?: string | undefined;
+        projectId?: string | undefined;
+        email?: string | undefined;
+        accountId?: string | undefined;
+    } | {
+        type: "api_key";
+        key: string;
+    };
+}, {}>;
+export declare const credentialUploadResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    entries: {
+        id: number;
+        provider: string;
+        credential: {
+            apiEndpoint?: string | undefined;
+            type: "oauth";
+            refresh: "__remote__";
+            access: string;
+            expires: number;
+            enterpriseUrl?: string | undefined;
+            projectId?: string | undefined;
+            email?: string | undefined;
+            accountId?: string | undefined;
+        } | {
+            type: "api_key";
+            key: string;
+        };
+        identityKey: string | null;
+    }[];
+}, {}>;

package/dist/types/auth-gateway/http.d.ts

@@ -0,0 +1,39 @@
+export declare function json(status: number, body: unknown): Response;
+export declare function resolvePeer(req: Request): string;
+/**
+ * Constant-time byte comparison. Falls back to a manual XOR accumulator if
+ * `node:crypto.timingSafeEqual` isn't available. Always processes every byte
+ * of the longer input so length itself doesn't leak via timing.
+ */
+export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+export declare function isAuthorized(req: Request, tokens: ReadonlySet<string>): boolean;
+/**
+ * Extract allow-listed passthrough headers from an inbound request. Keys are
+ * lowercased; empty values are dropped. Called once per request in
+ * `handleFormatEndpoint`; parsers then read `options.headers`.
+ */
+export declare function captureRequestHeaders(headers: Headers): Record<string, string>;
+/**
+ * Resolve a prompt-cache identity from inbound request body + headers.
+ * Order of precedence (first wins):
+ *   1. Body `prompt_cache_key`
+ *   2. Body `metadata.{prompt_cache_key,session_id,conversation_id}`
+ *   3. Header `x-prompt-cache-key`
+ *   4. Header `session_id` / `conversation_id` (Codex / ChatGPT-OAuth surface)
+ *   5. Header `x-session-id` / `x-conversation-id` (common informal)
+ * Returns undefined when none present; the gateway then derives a stable
+ * UUID from the request's stable parts.
+ */
+export declare function resolvePromptCacheKey(body: unknown, headers?: Headers): string | undefined;
+/**
+ * CORS headers for the auth-gateway. Currently echoes a wildcard origin; the
+ * request is accepted so future tightening can mirror `Origin` without
+ * threading the request through every caller.
+ */
+export declare function corsHeaders(_req: Request): Record<string, string>;
+/**
+ * Re-emit `response` with CORS headers merged. The original response body is
+ * passed through unchanged. Used by the gateway wrapper so every outbound
+ * format-endpoint response carries the same CORS surface as the preflight.
+ */
+export declare function withCors(response: Response, req: Request): Response;

package/dist/types/auth-gateway/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./http";
+export * from "./server";
+export * from "./types";

package/dist/types/auth-gateway/server.d.ts

@@ -0,0 +1,36 @@
+/**
+ * omp auth-gateway HTTP server.
+ *
+ * Accepts any provider-format request (OpenAI chat-completions, Anthropic
+ * messages, OpenAI Responses) and dispatches through pi-ai's `streamSimple()`
+ * — which handles credential injection, anthropic-beta headers, codex
+ * websocket transport, and all the per-provider intricacies. The gateway is
+ * pure protocol translation: foreign wire → omp Context → pi-ai stream() →
+ * omp events → foreign wire.
+ *
+ * Endpoints:
+ *   GET  /healthz                          → unauth; ok + version
+ *   GET  /v1/usage                         → aggregated provider usage (5-min per-credential cache via AuthStorage)
+ *   GET  /v1/credentials/check             → per-credential auth probe (diagnose 401s in a multi-account pool)
+ *   GET  /v1/models                        → list known models from the registry
+ *   POST /v1/chat/completions              → OpenAI chat-completions in/out
+ *   POST /v1/messages                      → Anthropic messages in/out
+ *   POST /v1/responses                     → OpenAI Responses in/out
+ */
+import type { AuthStorage } from "../auth-storage";
+import type { Api, Model } from "../types";
+import type { AuthGatewayServerHandle, AuthGatewayServerOptions } from "./types";
+export type ModelResolver = (modelId: string) => Model<Api> | undefined;
+export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
+    /** Source of credentials. Caller wires this to a broker-backed AuthStorage. */
+    storage: AuthStorage;
+    /**
+     * Resolve a client-requested model id to a pi-ai Model. Caller supplies
+     * this from a ModelRegistry (lives in `coding-agent` to avoid an inverse
+     * dependency in `pi-ai`).
+     */
+    resolveModel: ModelResolver;
+    /** Optional supplier for `/v1/models` listing. Returns the full model array. */
+    listModels?: () => Iterable<Model<Api>>;
+}
+export declare function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServerHandle;

package/dist/types/auth-gateway/types.d.ts

@@ -0,0 +1,123 @@
+import type { Effort } from "jeopi-catalog/effort";
+import type { AssistantMessage, AssistantMessageEventStream, CacheRetention, Context, ServiceTier, TokenTaskBudget } from "../types";
+/**
+ * Wire types for the omp auth-gateway.
+ *
+ * The gateway sits between unauthenticated clients (containerized omp,
+ * llm-git, …) and the broker. It accepts provider-format HTTP requests
+ * (OpenAI chat-completions / Anthropic messages / OpenAI Responses),
+ * dispatches them through pi-ai's `streamSimple()`, and translates the
+ * canonical event stream back to the matching wire format. The gateway
+ * injects `Authorization` server-side so clients never see access tokens.
+ */
+/** Default bind. Loopback-only — front with reverse proxy for remote access. */
+export declare const DEFAULT_AUTH_GATEWAY_BIND = "127.0.0.1:4000";
+export type AuthGatewayToolChoice = "auto" | "none" | "required" | {
+    name: string;
+};
+export interface AuthGatewayParsedRequestOptions {
+    maxOutputTokens?: number;
+    temperature?: number;
+    topP?: number;
+    topK?: number;
+    /** OpenAI nucleus-min sampling (`min_p`). */
+    minP?: number;
+    /** Anthropic `stop_sequences` / OpenAI `stop`. */
+    stopSequences?: string[];
+    /** OpenAI `presence_penalty`. */
+    presencePenalty?: number;
+    /** OpenAI `frequency_penalty`. */
+    frequencyPenalty?: number;
+    /** OpenRouter / vLLM `repetition_penalty`. */
+    repetitionPenalty?: number;
+    /** OpenAI deterministic-sampling `seed`. */
+    seed?: number;
+    /** OpenAI `logit_bias` map (token id → bias). */
+    logitBias?: Record<string, number>;
+    /** OpenAI `response_format` (text | json_object | json_schema). Opaque passthrough. */
+    responseFormat?: unknown;
+    toolChoice?: AuthGatewayToolChoice;
+    /** OpenAI `parallel_tool_calls`. */
+    parallelToolCalls?: boolean;
+    /** Effort-level reasoning request (OpenAI Responses / Chat `reasoning_effort`). */
+    reasoning?: Effort;
+    /** Force-disable reasoning (Anthropic `thinking: { type: "disabled" }`). */
+    disableReasoning?: boolean;
+    /**
+     * Explicit Anthropic `thinking.budget_tokens`. Mirrors Rust's
+     * `resolve_thinking_budget`: pins onto whichever effort the client
+     * requested (defaulting to High when unspecified). Preferred over the
+     * removed legacy single-number `thinkingBudget` for new code.
+     */
+    explicitThinkingBudgetTokens?: number;
+    /** Per-effort thinking budget map. */
+    thinkingBudgets?: Partial<Record<Effort, number>>;
+    /** Suppress the provider's reasoning summary stream. */
+    hideThinkingSummary?: boolean;
+    /** Anthropic `output_config.task_budget` advisory loop budget. */
+    taskBudget?: TokenTaskBudget;
+    /** OpenAI service tier (auto|default|flex|scale|priority). */
+    serviceTier?: ServiceTier;
+    /** Cache retention hint derived from inbound `cache_control` markers. */
+    cacheRetention?: CacheRetention;
+    /** OpenAI Responses `prompt_cache_key`; also seeds provider routing when no separate session id exists. */
+    promptCacheKey?: string;
+    /** OpenAI Responses `previous_response_id` for response chaining. */
+    previousResponseId?: string;
+    /** OpenAI / abuse-tracking `user` field. */
+    user?: string;
+    /**
+     * Provider-specific metadata. Anthropic uses `metadata.user_id`; OpenRouter
+     * carries routing hints; xAI uses `search_parameters`; OpenAI accepts a
+     * free-form bag. The gateway forwards as-is.
+     */
+    metadata?: Record<string, unknown>;
+    /**
+     * Captured allow-listed passthrough headers (anthropic-beta,
+     * anthropic-version, openai-organization, openai-project, openai-beta,
+     * x-stainless-*). Keys are lowercased.
+     */
+    headers?: Record<string, string>;
+    /**
+     * Escape hatch for provider-specific request controls that don't yet have a
+     * first-class field. Prefer adding a typed field over widening this.
+     */
+    extra?: Record<string, unknown>;
+}
+export interface AuthGatewayParsedRequest {
+    modelId: string;
+    context: Context;
+    stream: boolean;
+    options: AuthGatewayParsedRequestOptions;
+}
+export interface AuthGatewayStreamControl {
+    /** Gateway request signal. Encoders stop producing frames when it aborts. */
+    signal?: AbortSignal;
+    /** Called when the HTTP response body is cancelled by the client. */
+    onCancel?: (reason?: unknown) => void;
+}
+export interface AuthGatewayFormatModule {
+    parseRequest(body: unknown, headers?: Headers): AuthGatewayParsedRequest;
+    encodeResponse(message: AssistantMessage, requestedModelId: string): Record<string, unknown>;
+    encodeStream(events: AssistantMessageEventStream, requestedModelId: string, options?: AuthGatewayParsedRequestOptions, control?: AuthGatewayStreamControl): ReadableStream<Uint8Array>;
+    /**
+     * Emit a protocol-specific error envelope. OpenAI returns
+     * `{ error: { message, type } }`; Anthropic returns
+     * `{ type: "error", error: { type, message } }`.
+     */
+    formatError(status: number, type: string, message: string): Response;
+}
+export interface AuthGatewayServerOptions {
+    /** Listen address. Default `127.0.0.1:4000`. */
+    bind?: string;
+    /** Accept any of these bearer tokens. Empty allows unauthenticated calls. */
+    bearerTokens: string[];
+    /** Version surfaced on `/healthz`. */
+    version?: string;
+}
+export interface AuthGatewayServerHandle {
+    url: string;
+    port: number;
+    hostname: string;
+    close(): Promise<void>;
+}