diff --git a/packages/ai/src/index.ts b/packages/ai/src/index.ts
index 0fdde330e..28e8239af 100644
--- a/packages/ai/src/index.ts
+++ b/packages/ai/src/index.ts
@@ -1,8 +1,8 @@
 export { type Type, type } from "arktype";
 export { type ZodType, z } from "zod/v4";
 export * from "./api-registry";
-export * from "./auth-broker";
-export { type AuthGatewayBootOptions, type ModelResolver, startAuthGateway } from "./auth-gateway/server";
+export type * from "./auth-broker";
+export type { AuthGatewayBootOptions, ModelResolver } from "./auth-gateway/server";
 export * from "./auth-gateway/types";
 export * from "./auth-retry";
 export * from "./auth-storage";
diff --git a/packages/ai/test/auth-broker-oauth-extra-fields.test.ts b/packages/ai/test/auth-broker-oauth-extra-fields.test.ts
index 4f06b2432..df74c01da 100644
--- a/packages/ai/test/auth-broker-oauth-extra-fields.test.ts
+++ b/packages/ai/test/auth-broker-oauth-extra-fields.test.ts
@@ -2,16 +2,13 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { AuthStorage, type OAuthCredential, REMOTE_REFRESH_SENTINEL, SqliteAuthCredentialStore } from "@oh-my-pi/pi-ai";
 import {
 	AuthBrokerClient,
 	type AuthBrokerServerHandle,
-	AuthStorage,
-	type OAuthCredential,
-	REMOTE_REFRESH_SENTINEL,
 	RemoteAuthCredentialStore,
-	SqliteAuthCredentialStore,
 	startAuthBroker,
-} from "@oh-my-pi/pi-ai";
+} from "@oh-my-pi/pi-ai/auth-broker";
 
 // MCP OAuth credentials extend the base OAuthCredential with refresh material
 // (tokenUrl/clientId/clientSecret/resource) embedded so token refresh works for
diff --git a/packages/ai/test/auth-broker-refresher.test.ts b/packages/ai/test/auth-broker-refresher.test.ts
index 82787da9b..732b62b4b 100644
--- a/packages/ai/test/auth-broker-refresher.test.ts
+++ b/packages/ai/test/auth-broker-refresher.test.ts
@@ -2,7 +2,8 @@ import { afterEach, beforeEach, describe, expect, test, vi } from "bun:test";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { AuthBrokerRefresher, AuthStorage, SqliteAuthCredentialStore } from "@oh-my-pi/pi-ai";
+import { AuthStorage, SqliteAuthCredentialStore } from "@oh-my-pi/pi-ai";
+import { AuthBrokerRefresher } from "@oh-my-pi/pi-ai/auth-broker";
 import * as oauthUtils from "@oh-my-pi/pi-ai/registry/oauth";
 
 const ANTHROPIC_ENV = ["ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN"] as const;
diff --git a/packages/ai/test/auth-broker-remote-store.test.ts b/packages/ai/test/auth-broker-remote-store.test.ts
index cf553eed4..03ef26558 100644
--- a/packages/ai/test/auth-broker-remote-store.test.ts
+++ b/packages/ai/test/auth-broker-remote-store.test.ts
@@ -2,16 +2,14 @@ import { afterEach, beforeEach, describe, expect, test, vi } from "bun:test";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { AuthStorage, REMOTE_REFRESH_SENTINEL, SqliteAuthCredentialStore } from "@oh-my-pi/pi-ai";
 import {
 	AuthBrokerClient,
 	type AuthBrokerServerHandle,
-	AuthStorage,
-	REMOTE_REFRESH_SENTINEL,
 	RemoteAuthCredentialStore,
 	type SnapshotResponse,
-	SqliteAuthCredentialStore,
 	startAuthBroker,
-} from "@oh-my-pi/pi-ai";
+} from "@oh-my-pi/pi-ai/auth-broker";
 
 const ANTHROPIC_ENV = ["ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN"] as const;
 const savedEnv: Partial<Record<(typeof ANTHROPIC_ENV)[number], string | undefined>> = {};
diff --git a/packages/ai/test/auth-broker-snapshot-cache.test.ts b/packages/ai/test/auth-broker-snapshot-cache.test.ts
index 51532b4d8..98cc010f6 100644
--- a/packages/ai/test/auth-broker-snapshot-cache.test.ts
+++ b/packages/ai/test/auth-broker-snapshot-cache.test.ts
@@ -2,7 +2,11 @@ import { describe, expect, test } from "bun:test";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { readAuthBrokerSnapshotCache, type SnapshotResponse, writeAuthBrokerSnapshotCache } from "@oh-my-pi/pi-ai";
+import {
+	readAuthBrokerSnapshotCache,
+	type SnapshotResponse,
+	writeAuthBrokerSnapshotCache,
+} from "@oh-my-pi/pi-ai/auth-broker";
 
 const TOKEN = "broker-cache-token";
 const URL = "http://127.0.0.1:8765";
diff --git a/packages/ai/test/auth-broker-wire.test.ts b/packages/ai/test/auth-broker-wire.test.ts
index 60fb2f349..7524e9226 100644
--- a/packages/ai/test/auth-broker-wire.test.ts
+++ b/packages/ai/test/auth-broker-wire.test.ts
@@ -2,16 +2,14 @@ import { afterEach, beforeEach, describe, expect, test, vi } from "bun:test";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { AuthStorage, REMOTE_REFRESH_SENTINEL, SqliteAuthCredentialStore } from "@oh-my-pi/pi-ai";
 import {
 	AuthBrokerClient,
 	type AuthBrokerServerHandle,
 	AuthBrokerStreamUnsupportedError,
-	AuthStorage,
-	REMOTE_REFRESH_SENTINEL,
 	type SnapshotStreamEvent,
-	SqliteAuthCredentialStore,
 	startAuthBroker,
-} from "@oh-my-pi/pi-ai";
+} from "@oh-my-pi/pi-ai/auth-broker";
 import * as oauthUtils from "@oh-my-pi/pi-ai/registry/oauth";
 
 const ANTHROPIC_ENV = ["ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN"] as const;
diff --git a/packages/ai/test/remote-auth-store.test.ts b/packages/ai/test/remote-auth-store.test.ts
index e1a6e2be6..3147f2ce5 100644
--- a/packages/ai/test/remote-auth-store.test.ts
+++ b/packages/ai/test/remote-auth-store.test.ts
@@ -2,15 +2,13 @@ import { afterEach, beforeEach, describe, expect, test, vi } from "bun:test";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { AuthStorage, REMOTE_REFRESH_SENTINEL, SqliteAuthCredentialStore } from "@oh-my-pi/pi-ai";
 import {
 	AuthBrokerClient,
 	type AuthBrokerServerHandle,
-	AuthStorage,
-	REMOTE_REFRESH_SENTINEL,
 	RemoteAuthCredentialStore,
-	SqliteAuthCredentialStore,
 	startAuthBroker,
-} from "@oh-my-pi/pi-ai";
+} from "@oh-my-pi/pi-ai/auth-broker";
 import * as oauthUtils from "@oh-my-pi/pi-ai/registry/oauth";
 
 const ANTHROPIC_ENV = ["ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN"] as const;
diff --git a/packages/coding-agent/src/cli/auth-broker-cli.ts b/packages/coding-agent/src/cli/auth-broker-cli.ts
index 5a58bcb5c..ff9c1a0d3 100644
--- a/packages/coding-agent/src/cli/auth-broker-cli.ts
+++ b/packages/coding-agent/src/cli/auth-broker-cli.ts
@@ -19,11 +19,9 @@ import * as os from "node:os";
 import * as path from "node:path";
 import * as readline from "node:readline";
 import {
-	AuthBrokerClient,
 	type AuthCredential,
 	AuthStorage,
 	type CredentialDisabledEvent,
-	DEFAULT_AUTH_BROKER_BIND,
 	getEnvApiKey,
 	getOAuthProviders,
 	listProvidersWithEnvKey,
@@ -32,8 +30,8 @@ import {
 	type OAuthProviderInfo,
 	PROVIDER_REGISTRY,
 	SqliteAuthCredentialStore,
-	startAuthBroker,
 } from "@oh-my-pi/pi-ai";
+import { AuthBrokerClient, DEFAULT_AUTH_BROKER_BIND, startAuthBroker } from "@oh-my-pi/pi-ai/auth-broker";
 import { $which, APP_NAME, getAgentDbPath, getConfigRootDir, isEnoent, logger, VERSION } from "@oh-my-pi/pi-utils";
 import { setTransports as setLoggerTransports } from "@oh-my-pi/pi-utils/logger";
 import { $ } from "bun";
diff --git a/packages/coding-agent/src/cli/auth-gateway-cli.ts b/packages/coding-agent/src/cli/auth-gateway-cli.ts
index 956ad8fce..d21a85409 100644
--- a/packages/coding-agent/src/cli/auth-gateway-cli.ts
+++ b/packages/coding-agent/src/cli/auth-gateway-cli.ts
@@ -17,18 +17,15 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import {
 	type Api,
-	AuthBrokerClient,
 	AuthStorage,
 	type CompletionProbe,
 	type CompletionProbeInput,
 	type CredentialCompletionResult,
 	completeSimple,
-	DEFAULT_AUTH_GATEWAY_BIND,
 	type Model,
-	RemoteAuthCredentialStore,
-	type SnapshotResponse,
-	startAuthGateway,
 } from "@oh-my-pi/pi-ai";
+import { AuthBrokerClient, RemoteAuthCredentialStore, type SnapshotResponse } from "@oh-my-pi/pi-ai/auth-broker";
+import { DEFAULT_AUTH_GATEWAY_BIND, startAuthGateway } from "@oh-my-pi/pi-ai/auth-gateway";
 import { type GeneratedProvider, getBundledModels, getBundledProviders } from "@oh-my-pi/pi-catalog/models";
 import { getConfigRootDir, isEnoent, VERSION } from "@oh-my-pi/pi-utils";
 import chalk from "chalk";
diff --git a/packages/coding-agent/src/config/models-config-schema.ts b/packages/coding-agent/src/config/models-config-schema.ts
index 916c925d9..76cd08b6e 100644
--- a/packages/coding-agent/src/config/models-config-schema.ts
+++ b/packages/coding-agent/src/config/models-config-schema.ts
@@ -1,4 +1,11 @@
-import { type } from "arktype";
+import { scope } from "arktype";
+
+// Config schemas validate at most a handful of times per process (on config
+// load), so the eager JIT codegen ArkType runs at definition time is pure
+// startup tax. A local jitless scope skips that codegen and falls back to
+// interpreted traversal — ~65% cheaper to construct, validation correctness
+// unchanged. (No `name`: duplicate module instances would collide.)
+const { type } = scope({}, { jitless: true });
 
 const OpenRouterRoutingSchema = type({
 	"only?": "string[]",
diff --git a/packages/coding-agent/src/sdk.ts b/packages/coding-agent/src/sdk.ts
index 9fb83aca6..eb5bf0ff1 100644
--- a/packages/coding-agent/src/sdk.ts
+++ b/packages/coding-agent/src/sdk.ts
@@ -56,6 +56,10 @@ import { loadPromptTemplates as loadPromptTemplatesInternal, type PromptTemplate
 import { Settings, type SkillsSettings } from "./config/settings";
 import { CursorExecHandlers } from "./cursor";
 import "./discovery";
+import { AuthBrokerClient } from "@oh-my-pi/pi-ai/auth-broker/client";
+import { RemoteAuthCredentialStore } from "@oh-my-pi/pi-ai/auth-broker/remote-store";
+import { readAuthBrokerSnapshotCache, writeAuthBrokerSnapshotCache } from "@oh-my-pi/pi-ai/auth-broker/snapshot-cache";
+import { DEFAULT_SNAPSHOT_CACHE_TTL_MS, type SnapshotResponse } from "@oh-my-pi/pi-ai/auth-broker/types";
 import { resolveConfigValue } from "./config/resolve-config-value";
 import { initializeWithSettings } from "./discovery";
 import { disposeAllKernelSessions, disposeKernelSessionsByOwner } from "./eval/py/executor";
@@ -116,15 +120,7 @@ import {
 } from "./secrets";
 import { AgentSession } from "./session/agent-session";
 import { resolveAuthBrokerConfig } from "./session/auth-broker-config";
-import {
-	AuthBrokerClient,
-	AuthStorage,
-	DEFAULT_SNAPSHOT_CACHE_TTL_MS,
-	RemoteAuthCredentialStore,
-	readAuthBrokerSnapshotCache,
-	type SnapshotResponse,
-	writeAuthBrokerSnapshotCache,
-} from "./session/auth-storage";
+import { AuthStorage } from "./session/auth-storage";
 import {
 	type CustomMessage,
 	convertToLlm,
diff --git a/packages/coding-agent/src/session/auth-storage.ts b/packages/coding-agent/src/session/auth-storage.ts
index 405f4d5ce..458e29d14 100644
--- a/packages/coding-agent/src/session/auth-storage.ts
+++ b/packages/coding-agent/src/session/auth-storage.ts
@@ -18,16 +18,7 @@ export type {
 	ResetCreditRedeemOutcome,
 	ResetCreditTarget,
 	SerializedAuthStorage,
-	SnapshotResponse,
 	StoredAuthCredential,
 } from "@oh-my-pi/pi-ai";
-export {
-	AuthBrokerClient,
-	AuthStorage,
-	DEFAULT_SNAPSHOT_CACHE_TTL_MS,
-	REMOTE_REFRESH_SENTINEL,
-	RemoteAuthCredentialStore,
-	readAuthBrokerSnapshotCache,
-	SqliteAuthCredentialStore,
-	writeAuthBrokerSnapshotCache,
-} from "@oh-my-pi/pi-ai";
+export { AuthStorage, REMOTE_REFRESH_SENTINEL, SqliteAuthCredentialStore } from "@oh-my-pi/pi-ai";
+export type { SnapshotResponse } from "@oh-my-pi/pi-ai/auth-broker/types";
diff --git a/packages/coding-agent/test/auth-broker-import.test.ts b/packages/coding-agent/test/auth-broker-import.test.ts
index 8f21357bc..d5b2dd660 100644
--- a/packages/coding-agent/test/auth-broker-import.test.ts
+++ b/packages/coding-agent/test/auth-broker-import.test.ts
@@ -2,7 +2,8 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { type AuthBrokerServerHandle, AuthStorage, SqliteAuthCredentialStore, startAuthBroker } from "@oh-my-pi/pi-ai";
+import { AuthStorage, SqliteAuthCredentialStore } from "@oh-my-pi/pi-ai";
+import { type AuthBrokerServerHandle, startAuthBroker } from "@oh-my-pi/pi-ai/auth-broker";
 import { runAuthBrokerCommand } from "@oh-my-pi/pi-coding-agent/cli/auth-broker-cli";
 import { getAgentDbPath, setAgentDir } from "@oh-my-pi/pi-utils";
 
diff --git a/packages/coding-agent/test/auth-broker-snapshot-cache.test.ts b/packages/coding-agent/test/auth-broker-snapshot-cache.test.ts
index 510f1b94c..9e43f52bc 100644
--- a/packages/coding-agent/test/auth-broker-snapshot-cache.test.ts
+++ b/packages/coding-agent/test/auth-broker-snapshot-cache.test.ts
@@ -2,13 +2,15 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { type AuthBrokerServerHandle, AuthStorage, SqliteAuthCredentialStore, startAuthBroker } from "@oh-my-pi/pi-ai";
-import { discoverAuthStorage } from "@oh-my-pi/pi-coding-agent/sdk";
+import { AuthStorage, SqliteAuthCredentialStore } from "@oh-my-pi/pi-ai";
 import {
+	type AuthBrokerServerHandle,
 	readAuthBrokerSnapshotCache,
 	type SnapshotResponse,
+	startAuthBroker,
 	writeAuthBrokerSnapshotCache,
-} from "@oh-my-pi/pi-coding-agent/session/auth-storage";
+} from "@oh-my-pi/pi-ai/auth-broker";
+import { discoverAuthStorage } from "@oh-my-pi/pi-coding-agent/sdk";
 
 const ENV_KEYS = [
 	"OMP_AUTH_BROKER_URL",