Struct LocalBroker 

pub struct LocalBroker { /* private fields */ }

In-process credential broker. This module is the ONLY place runtime-serving code may read auth.json, provider.<key> config values, or credential environment variables.

Implementations

impl LocalBroker

pub fn new(http: Client) -> Self

pub fn with_cloud_backend(self, backend: Arc<dyn CloudBackend>) -> Self

pub fn with_account_policy(self, policy: AccountPolicy) -> Self

Pin the account policy instead of reading env + config per call.

pub fn with_auto_policy(self, policy: AutoSelectionPolicy) -> Self

Pin the automatic ranking policy (tests/embedding).

pub async fn access_token_auto( &self, provider: OAuthProviderId, model: Option<&str>, ) -> Result<PinnedToken, BrokerError>

Capacity-based selection for provider regardless of the configured selector (used by the broker daemon when a remote client’s own policy is auto). Fails closed like access_token_pinned_for.

pub fn with_max_snapshot_age(self, age: Duration) -> Self

Bound on usage-snapshot age for automatic selection.

pub fn auth_state( &self, query: &AuthStateQuery, ) -> Result<AuthStateReport, BrokerError>

What this broker remembers about the accounts query selects: no network request, no refresh; the account list comes from the store. With query.clear, their in-memory state is dropped first.

pub async fn plan( &self, provider: OAuthProviderId, model: Option<&str>, ) -> Result<SelectionPlan, BrokerError>

Preview the exact ranking without vending inference credentials or changing stickiness/cooldowns. Usage reads may refresh expired OAuth tokens through the ordinary rotation-safe credential path.

pub fn with_local_base_url(http: Client, base_url: impl Into<String>) -> Self

Test/embedding seam: pin the local provider endpoint explicitly.

Trait Implementations

impl CredentialBroker for LocalBroker

fn recover_rejected_token<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, cred: &'life1 CredentialRef, rejected: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<AccessToken, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Re-vend the exact credential whose access token was rejected. Local brokers force refresh only if storage still holds that rejected token. Remote/custom brokers keep their ordinary explicit-slot semantics.

fn access_token<'life0, 'async_trait>( &'life0 self, provider: OAuthProviderId, ) -> Pin<Box<dyn Future<Output = Result<AccessToken, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Vend a fresh OAuth access token (token + expiry ONLY) for the policy-selected account of provider.

fn account_selector(&self, provider: OAuthProviderId) -> AccountSelector

Effective account selector for provider (env > config > injected policy). No I/O beyond reading configuration; no secrets.

fn access_token_for<'life0, 'life1, 'async_trait>( &'life0 self, cred: &'life1 CredentialRef, ) -> Pin<Box<dyn Future<Output = Result<AccessToken, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Vend a token for an explicitly addressed credential. The default implementation serves only the default slot (via access_token); a named slot is an error — NEVER a fallback to another account.

fn access_token_pinned<'life0, 'async_trait>( &'life0 self, provider: OAuthProviderId, ) -> Pin<Box<dyn Future<Output = Result<PinnedToken, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Policy-resolved pair: the credential the broker selected for provider and its token. Default implementation: the default slot.

fn access_token_pinned_for<'life0, 'life1, 'async_trait>( &'life0 self, provider: OAuthProviderId, model: Option<&'life1 str>, ) -> Pin<Box<dyn Future<Output = Result<PinnedToken, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Model-aware variant of access_token_pinned: under an auto selector only accounts with proven capacity for model are eligible. Default implementation ignores the model.

fn accounts<'life0, 'async_trait>( &'life0 self, provider: OAuthProviderId, ) -> Pin<Box<dyn Future<Output = Result<Vec<AccountSummary>, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Non-secret account listing for provider. Default: unsupported.

fn usage<'life0, 'life1, 'async_trait>( &'life0 self, cred: &'life1 CredentialRef, ) -> Pin<Box<dyn Future<Output = Result<UsageSnapshot, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Typed, read-only usage snapshot for one credential. The token is resolved and used behind the boundary; callers receive normalized, secret-free data only. Default: unsupported.

fn report_cooldown<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, cred: &'life1 CredentialRef, until_ms: Option<u64>, reason: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<(), BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Report that cred hit a provider limit so automatic selection stops advertising it until until_ms (epoch ms; None = a short default). Best effort; default implementation is a no-op.

fn proxy<'life0, 'async_trait>( &'life0 self, request: ProxyRequest, ) -> Pin<Box<dyn Future<Output = Result<ProxyResponse, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Execute a non-streaming provider request with the broker-owned key.

fn proxy_stream<'life0, 'async_trait>( &'life0 self, request: ProxyRequest, ) -> Pin<Box<dyn Future<Output = Result<ProxyByteStream, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Execute a streaming (SSE) provider request with the broker-owned key. Returns the byte stream only when the upstream response is successful; error statuses are read (bounded) and surfaced as BrokerError.

fn anthropic_usage<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<Value, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Typed operation: fetch the Anthropic account-usage summary.

fn cloud_catalog<'life0, 'life1, 'async_trait>( &'life0 self, provider: CloudProviderId, context_ref: &'life1 str, allow_stale: bool, ) -> Pin<Box<dyn Future<Output = Result<Vec<CloudCatalogEntry>, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Typed cloud catalog. Credentials and provider authority remain broker-owned.

fn cloud_invoke<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, provider: CloudProviderId, context_ref: &'life1 str, model_id: &'life2 str, request: InvokeRequest, ) -> Pin<Box<dyn Future<Output = Result<CloudEventStream, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Typed cloud invocation. The canonical model and normalized request are the only caller-controlled inputs; hosts, auth and signing remain broker-owned.

fn capabilities<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<Vec<ProviderStatus>, BrokerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Non-secret provider capability/status list.