@antseed/cli 0.1.179 → 0.1.180

package/dist/gateway/console-api/types.d.ts

@@ -0,0 +1,779 @@
+/**
+ * Contract between the gateway's console API (`/console/api/*`, served by the
+ * gateway process) and the console web app (`apps/gateway-console`), which
+ * imports these types by relative path. Amounts are USDC as decimal strings
+ * ("12.345678") on the wire; timestamps are epoch milliseconds.
+ *
+ * Auth: a session cookie (`antseed_console`, HttpOnly, Secure unless served
+ * on loopback, SameSite=Strict) or `Authorization: Bearer antseed_admin_…`
+ * (a management token). Every mutating request from the browser must carry
+ * `x-antseed-console: 1`. Errors are `{ error: { code, message } }` with an
+ * HTTP status.
+ */
+import type { RoutingPolicy } from '../../routing-policy/policy.js';
+export type { RoutingPolicy, ModelRoute, RoutingSort } from '../../routing-policy/policy.js';
+export type { OperatorRelation, OperatorState, OperatorAuthorization, WorkspaceOperatorSummary } from './operator-types.js';
+export declare const CONSOLE_BASE_PATH = "/console";
+export declare const CONSOLE_API_PATH = "/console/api";
+export declare const CONSOLE_CSRF_HEADER = "x-antseed-console";
+export type Usdc = string;
+export type OrgRole = 'owner' | 'admin' | 'member';
+export type WorkspaceRole = 'admin' | 'member';
+export type LimitPeriod = 'daily' | 'weekly' | 'monthly' | 'total';
+export type SpendLimits = Record<LimitPeriod, Usdc | null>;
+export interface ApiError {
+    error: {
+        code: string;
+        message: string;
+    };
+}
+export interface AuthConfig {
+    /** True until the owner has claimed the console with the setup link. */
+    setupRequired: boolean;
+    passkey: boolean;
+    wallet: boolean;
+    /** Present when the operator configured an OpenID Connect provider. */
+    oidc: {
+        label: string;
+    } | null;
+    /** Present when the gateway trusts Cloudflare Access identity headers. */
+    cloudflareAccess: boolean;
+    /** Key holders may sign in with an API key to see that key only. */
+    apiKeyLogin: boolean;
+}
+export interface Me {
+    member: Member;
+    /** The workspaces this member can open, with their role in each. */
+    workspaces: Array<{
+        workspace: WorkspaceSummary;
+        role: WorkspaceRole;
+    }>;
+}
+/** A read-only session from an API key; sees only that key. */
+export interface KeySessionMe {
+    key: ApiKey;
+}
+export type MeResponse = {
+    kind: 'member';
+    me: Me;
+} | {
+    kind: 'key';
+    me: KeySessionMe;
+};
+export interface Enrollment {
+    enrollment: string;
+    /** Who is enrolling, for the welcome screen. */
+    label: string;
+    orgRole: OrgRole;
+}
+export interface Member {
+    id: string;
+    label: string;
+    email: string | null;
+    orgRole: OrgRole;
+    status: 'active' | 'invited' | 'disabled';
+    credentials: Array<{
+        id: string;
+        kind: 'passkey' | 'wallet' | 'oidc';
+        label: string;
+        createdAt: number;
+        lastUsedAt: number | null;
+    }>;
+    limits: SpendLimits;
+    routingPolicy: RoutingPolicy | null;
+    /** How many keys this member may create on their own; null means no limit. */
+    maxKeys: number | null;
+    createdAt: number;
+}
+/** What a plain workspace member sees of the others in their workspace. */
+export type MemberSummary = Pick<Member, 'id' | 'label' | 'orgRole' | 'status'>;
+export interface MemberInput {
+    label: string;
+    email: string | null;
+    orgRole: OrgRole;
+    limits: SpendLimits;
+    routingPolicy: RoutingPolicy | null;
+    maxKeys: number | null;
+}
+export interface InviteInput {
+    label: string;
+    email?: string | null;
+    orgRole: OrgRole;
+    workspaces: Array<{
+        workspaceId: string;
+        role: WorkspaceRole;
+    }>;
+    /** Hours until the link expires; default 72. */
+    expiresInHours?: number;
+}
+export interface Invite {
+    id: string;
+    label: string;
+    email: string | null;
+    orgRole: OrgRole;
+    /** Shown once, on creation. */
+    url?: string;
+    expiresAt: number;
+    createdAt: number;
+}
+export interface WorkspaceSummary {
+    id: string;
+    name: string;
+    isDefault: boolean;
+}
+export interface Workspace extends WorkspaceSummary {
+    /** Buyer identity (wallet) that pays for this workspace's keys. */
+    buyerIdentity: string;
+    walletAddress: string | null;
+    limits: SpendLimits;
+    /** Set by workspace admins. */
+    routingPolicy: RoutingPolicy | null;
+    /** Set by org admins; workspace admins can only narrow it with `routingPolicy`. */
+    orgRoutingPolicy: RoutingPolicy | null;
+    memberCount: number;
+    keyCount: number;
+    createdAt: number;
+}
+export interface WorkspaceInput {
+    name: string;
+    limits: SpendLimits;
+    routingPolicy: RoutingPolicy | null;
+    /** Org admins only. */
+    orgRoutingPolicy?: RoutingPolicy | null;
+    /** Use an existing buyer identity instead of creating a new wallet. */
+    buyerIdentity?: string;
+}
+export interface ApiKey {
+    id: string;
+    label: string;
+    hint: string;
+    workspaceId: string;
+    ownerMemberId: string | null;
+    buyerIdentity: string;
+    status: 'active' | 'revoked';
+    /** Admin layer: set by workspace admins; the key's owner cannot change it. */
+    limits: SpendLimits;
+    routingPolicy: RoutingPolicy | null;
+    /**
+     * Owner layer: set by the key's owner (or an admin) on top of the admin
+     * layer. Each layer only narrows, so the effective cap per period is the
+     * lower of `limits` and `ownerLimits`, and the owner's policy can never
+     * allow what the admin layer does not.
+     */
+    ownerLimits?: SpendLimits;
+    ownerRoutingPolicy?: RoutingPolicy | null;
+    topupEnabled: boolean;
+    expiresAt: number | null;
+    createdAt: number;
+    lastUsedAt: number | null;
+    usage: {
+        requests: number;
+        spent: Usdc;
+        spentThisMonth: Usdc;
+    };
+}
+export interface ApiKeyInput {
+    label: string;
+    workspaceId: string;
+    limits: SpendLimits;
+    routingPolicy: RoutingPolicy | null;
+    topupEnabled: boolean;
+    expiresAt: number | null;
+    /** Admins may create a key for another member. */
+    ownerMemberId?: string | null;
+    ownerLimits?: SpendLimits;
+    ownerRoutingPolicy?: RoutingPolicy | null;
+    /** Store a policy whose allow list leaves no seller. */
+    confirmEmpty?: boolean;
+    /** Store a policy or limits even though the levels above narrow them. */
+    acceptNarrowed?: boolean;
+}
+/** Body of a 409 `narrowed` answer. */
+export interface PolicyNarrowedError {
+    error: {
+        code: 'narrowed';
+        message: string;
+        /** Which fields lost something, e.g. "allowedPeerIds", "limits.daily". */
+        fields: string[];
+        /** The routing policy at that level after narrowing under every level above (peer lists expanded), when a policy was sent. */
+        effectiveRoutingPolicy?: RoutingPolicy;
+        /** The effective key caps (lower of admin and owner layer), when limits were sent. */
+        effectiveLimits?: SpendLimits;
+    };
+}
+export interface AdminToken {
+    id: string;
+    label: string;
+    hint: string;
+    /** 'admin' = everything an org admin can do; 'read' = GETs only. */
+    scope: 'admin' | 'read';
+    createdByMemberId: string | null;
+    /** Tokens stop working at this time; null never expires. */
+    expiresAt: number | null;
+    createdAt: number;
+    lastUsedAt: number | null;
+}
+/** `hour` and `day` group by UTC hour (`YYYY-MM-DDTHH`) and day (`YYYY-MM-DD`), oldest first. */
+export type UsageGroupBy = 'hour' | 'day' | 'model' | 'key' | 'member' | 'peer' | 'workspace' | 'user';
+export interface UsageReport {
+    from: number;
+    to: number;
+    totals: UsageTotals;
+    groups: Array<UsageSplit & {
+        splits?: UsageSplit[];
+    }>;
+}
+/**
+ * One part of a usage group when the report was split (`splitBy`). By end
+ * user, the users past the largest 100 come as one group with `others` set
+ * to how many it folds.
+ */
+export type UsageSplit = {
+    group: string;
+    label: string;
+    others?: number;
+} & UsageTotals;
+export interface UsageTotals {
+    requests: number;
+    failedRequests: number;
+    spent: Usdc;
+    inputTokens: number;
+    cachedInputTokens: number;
+    outputTokens: number;
+}
+export interface RequestLogEntry {
+    tag: string;
+    startedAt: number;
+    finishedAt: number | null;
+    keyId: string;
+    keyLabel: string;
+    workspaceId: string;
+    memberId: string | null;
+    /** End user from the request's `user` field, if the client sent one. */
+    endUser: string | null;
+    method: string;
+    path: string;
+    model: string | null;
+    status: number | null;
+    sellerPeerId: string | null;
+    latencyMs: number | null;
+    spent: Usdc | null;
+    inputTokens: number;
+    cachedInputTokens: number;
+    outputTokens: number;
+    /** Error code and message from a failed response (gateway, buyer or seller). */
+    errorCode: string | null;
+    errorMessage: string | null;
+    /** Served by a free seller (all its advertised prices zero): the cost is $0 and no spend is reported. */
+    servedFree?: boolean;
+    /**
+     * A model request that did not fail, was not served free and has no spend
+     * recorded yet: the buyer reports spend a moment after the response. If it
+     * stays pending for minutes the spend was not recorded (lost).
+     * Token counts meanwhile come from the response's own usage.
+     */
+    costPending?: boolean;
+}
+/** GET /requests/:tag → one entry, with bodies when content logging was on for it. */
+export interface RequestDetail extends RequestLogEntry {
+    requestBody: string | null;
+    responseBody: string | null;
+}
+export interface AuditEntry {
+    id: string;
+    at: number;
+    actor: {
+        kind: 'member' | 'token' | 'key' | 'system' | 'cli';
+        id: string | null;
+        label: string | null;
+    };
+    /** Dotted verb, e.g. "key.create", "workspace.policy.update", "wallet.operator_auth". */
+    action: string;
+    target: {
+        kind: string;
+        id: string | null;
+        label: string | null;
+    } | null;
+    details: Record<string, unknown>;
+    ip: string | null;
+}
+export interface Wallet {
+    buyerIdentity: string;
+    address: string;
+    /** Credits deposited in AntseedDeposits and available to spend. */
+    available: Usdc;
+    reserved: Usdc;
+    /** USDC sitting in the wallet itself, not yet swept into deposits. */
+    walletUsdc: Usdc;
+    creditLimit: Usdc | null;
+    /** Personal wallet authorized to withdraw and claim for this wallet. */
+    operator: string | null;
+    deposit: DepositWatch;
+    /** Last known values: the chain RPC is unreachable or rate limiting right now. */
+    stale?: boolean;
+}
+/**
+ * The workspace wallet's EIP-712 SetOperator authorization for
+ * AntseedDeposits; the operator submits `setOperator(buyer, operator, nonce,
+ * signature)` from its own wallet.
+ */
+export interface OperatorAuth {
+    buyer: string;
+    /** Operator nonce as a decimal string. */
+    nonce: string;
+    signature: string;
+}
+export interface DepositWatch {
+    mode: 'active' | 'background' | 'off';
+    status: string;
+    lastTxHash: string | null;
+    /**
+     * The watcher's latest event, for a live status line: received → sweeping →
+     * credited (or deferred / error). `seq` grows with every event, so a client
+     * can tell a new one from the last it showed. Null before the first event.
+     */
+    event: {
+        seq: number;
+        phase: 'received' | 'sweeping' | 'credited' | 'deferred' | 'error';
+        amount: Usdc | null;
+        txHash: string | null;
+        error: string | null;
+        at: number;
+    } | null;
+}
+export interface Channel {
+    channelId: string;
+    peerId: string;
+    sellerName: string | null;
+    status: string;
+    reserved: Usdc;
+    spent: Usdc;
+    openedAt: number | null;
+    canCooperativeClose: boolean;
+    /**
+     * When the authorized wallet requested an on-chain close (ms), or null. The
+     * unused reserve can be withdrawn `CHANNEL_CLOSE_GRACE_MS` later (status
+     * 'closing', then 'withdrawable').
+     */
+    closeRequestedAt: number | null;
+    /** Already settled to the seller on chain; null when the chain was not read. `spent - settled` is authorized but not yet charged. */
+    settled: Usdc | null;
+}
+/** AntseedChannels' grace period between an on-chain close request and the withdrawal. */
+export declare const CHANNEL_CLOSE_GRACE_MS: number;
+export interface Rewards {
+    address: string;
+    /** Everything claimable: the current program's epochs plus legacy emissions. */
+    pendingAnts: string;
+    /** Not readable per epoch (a claimed epoch reads as 0 pending); always '0'. */
+    claimedAnts: string;
+    /** The current (usage rewards) program, claimed per epoch with claimBuyerReward. */
+    epochs: Array<{
+        epoch: number;
+        pendingAnts: string;
+        claimed: boolean;
+    }>;
+    /**
+     * Buyer emissions from the legacy program, claimed in one
+     * claimBuyerEmissions(buyer, epochs) call on `contract` (epochs already
+     * claimed or empty are skipped on chain). Null when there is none.
+     */
+    legacy: {
+        pendingAnts: string;
+        contract: string;
+        epochs: number[];
+    } | null;
+    /** Claiming needs the operator wallet connected in the browser. */
+    operator: string | null;
+    /** Last known values: the chain RPC is unreachable or rate limiting right now. */
+    stale?: boolean;
+}
+export interface ChainInfo {
+    chainId: number;
+    name: string;
+    /** The chain's public default RPC; null for a chain without one (never the operator's configured URL). */
+    rpcUrl: string | null;
+    explorerUrl: string | null;
+    contracts: Record<string, string>;
+}
+export interface ChatThread {
+    id: string;
+    title: string;
+    model: string | null;
+    /** The peer the conversation was pinned to, or null. */
+    peerId: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface ChatThreadDetail extends ChatThread {
+    /** AI SDK UIMessages; assistant messages carry ChatMessageMetadata. */
+    messages: unknown[];
+}
+export interface ChatModelPeer {
+    peerId: string;
+    name: string | null;
+    toolUse: boolean;
+    reasoning: boolean;
+    /** Takes images as input. */
+    vision: boolean;
+    /** Advertises the TEE verifier (attested hardware). */
+    tee: boolean;
+    inputUsdPerMillion: number | null;
+    outputUsdPerMillion: number | null;
+    /** Null when the peer advertises no cached-input price (cached tokens then cost the input price). */
+    cachedInputUsdPerMillion: number | null;
+    reputation: number | null;
+}
+export interface ChatMessageMetadata {
+    model: string;
+    /** The peer the user pinned, or null for automatic routing. */
+    pinnedPeerId: string | null;
+    /** The peer(s) that served the answer, one per model call (tool rounds can reach different peers when not pinned). */
+    peers: Array<{
+        peerId: string;
+        name: string | null;
+    }>;
+    /** Tokens over every model call of the answer so far. */
+    usage?: {
+        inputTokens: number;
+        cachedInputTokens: number;
+        outputTokens: number;
+    };
+    /**
+     * Estimated cost in USD: each call's tokens at the serving peer's advertised
+     * prices. Null when a serving peer's price is unknown. The signed amount is
+     * in the request log once the buyer reports it.
+     */
+    costUsd?: number | null;
+}
+export interface ChatContext {
+    /** The caller's "Web chat" key in the workspace (or, for a key session, that key), with its limits and usage. */
+    key: ApiKey;
+    workspaceName: string;
+}
+export interface ChatModel {
+    id: string;
+    name: string;
+    /** At least one offer supports tool calls (the agent's web and file tools). */
+    toolUse: boolean;
+    reasoning: boolean;
+    /** At least one offer takes images as input. */
+    vision: boolean;
+    /** At least one offer is free (no input or output price). */
+    free: boolean;
+    /** At least one offer advertises the TEE verifier. */
+    tee: boolean;
+    offers: number;
+    /** Cheapest offer's prices, USD per million tokens; null when not advertised. */
+    inputUsdPerMillion: number | null;
+    outputUsdPerMillion: number | null;
+    /** The sellers offering it, best reputation first. */
+    peers: ChatModelPeer[];
+}
+/** A seller ownership claim the buyer verified, as a display-safe link. */
+export interface PeerVerificationLink {
+    kind: 'domain' | 'github';
+    /** `example.com`, `@user` or `@user/repo`. */
+    label: string;
+    /** `https://<domain>` or `https://github.com/<user>[/<repo>]`. */
+    href: string;
+}
+export interface Peer {
+    peerId: string;
+    displayName: string | null;
+    services: Array<{
+        provider: string;
+        service: string;
+        inputUsdPerMillion: number | null;
+        outputUsdPerMillion: number | null;
+        cachedInputUsdPerMillion: number | null;
+        categories: string[];
+        /** Wire APIs the seller serves this model on, e.g. "openai-chat-completions", "anthropic-messages". */
+        apiProtocols?: string[];
+    }>;
+    trustScore: number | null;
+    reputationScore: number | null;
+    verified: boolean;
+    /** Verified domain and GitHub claims; empty when none checked out. */
+    verificationLinks: PeerVerificationLink[];
+    tee: boolean;
+    stakeAnts: string | null;
+    usageShareBps: number | null;
+    washFlagged: boolean;
+    lastSeen: number | null;
+    health: {
+        failureStreak: number;
+        coolingDownUntil: number | null;
+    };
+    /** Measured by this gateway over its recent requests. */
+    latencyMsP50: number | null;
+    requests24h: number;
+}
+export type NetworkModelType = 'text' | 'image' | 'decision' | 'video';
+/** A feature at least one seller of the model advertises. */
+export type NetworkModelCapability = 'toolUse' | 'reasoning' | 'structuredOutput' | 'vision';
+/** One seller's offer of a network model. */
+export interface NetworkModelOffer {
+    peerId: string;
+    displayName: string | null;
+    /** The seller's own name for the model; pin it as `<peerId>@<serviceId>`. */
+    serviceId: string;
+    provider: string;
+    /** Wire APIs the seller serves the model on. */
+    protocols: string[];
+    inputUsdPerMillion: number | null;
+    outputUsdPerMillion: number | null;
+    cachedInputUsdPerMillion: number | null;
+    /** Image models: price per image, cheapest to dearest; null when not advertised. */
+    usdPerImage: {
+        min: number;
+        max: number;
+    } | null;
+    contextLength: number | null;
+    free: boolean;
+    /** The reputation routing ranks this offer by (0-100); null when unscored. */
+    reputationScore: number | null;
+    trustScore: number | null;
+    verified: boolean;
+    /** The seller's verified domain and GitHub claims. */
+    verificationLinks: PeerVerificationLink[];
+    tee: boolean;
+    /** Measured by this gateway over its recent requests. */
+    latencyMsP50: number | null;
+}
+/** A model on the network, merged across the sellers that offer it (aliases included). */
+export interface NetworkModel {
+    id: string;
+    name: string;
+    aliases: string[];
+    type: NetworkModelType;
+    /** Largest context window a seller advertises; null when none does. */
+    contextLength: number | null;
+    capabilities: NetworkModelCapability[];
+    sellers: number;
+    /** Cheapest to dearest across offers, USD per million tokens; null when no offer advertises one. */
+    inputUsdPerMillion: {
+        min: number;
+        max: number;
+    } | null;
+    outputUsdPerMillion: {
+        min: number;
+        max: number;
+    } | null;
+    /** At least one offer is free. */
+    free: boolean;
+    teeSellers: number;
+    verifiedSellers: number;
+    /** In the buyer's routing order. */
+    offers: NetworkModelOffer[];
+}
+/**
+ * The buyer's own config, the top level of every routing policy chain.
+ * Hard limits (`minPeerReputation`, `requireVerifier`, `maxPricing`) apply
+ * to every request, pinned ones included. `routingPreferences` (trust
+ * minimum, allow and block lists, free-first) apply to automatic routing:
+ * gateway levels narrow them like any other level and can never loosen
+ * them. `maxPricing` is null when the config cannot be read;
+ * `routingPreferences` is null when neither the buyer nor the config says.
+ */
+export interface BuyerLimits {
+    minPeerReputation: number;
+    requireVerifier: boolean;
+    maxPricing: {
+        inputUsdPerMillion: number;
+        outputUsdPerMillion: number;
+        cachedInputUsdPerMillion: number | null;
+    } | null;
+    routingPreferences: BuyerRoutingPreferences | null;
+}
+export interface BuyerRoutingPreferences {
+    minTrustScore: number;
+    allowedPeerIds: string[];
+    blockedPeerIds: string[];
+    preferFreePeers: boolean;
+}
+export interface RoutePreview {
+    model: string;
+    /** The policy that applies after combining every level. */
+    policy: RoutingPolicy;
+    /**
+     * Which levels contributed, top to bottom. The `buyer` entry holds the
+     * buyer's config (`BuyerLimits` as a policy); the buyer applies it on top
+     * of `policy`, which is the gateway levels only.
+     */
+    sources: Array<{
+        level: 'buyer' | 'gateway' | 'workspace-org' | 'workspace' | 'member' | 'key' | 'key-owner' | 'preset';
+        id: string | null;
+        policy: RoutingPolicy | null;
+    }>;
+    modelAllowed: boolean;
+    candidates: Array<{
+        peerId: string;
+        displayName: string | null;
+        rank: number | null;
+        eligible: boolean;
+        /** Why it was excluded or how it scored, e.g. "blocked by workspace", "over input price cap". */
+        reasons: string[];
+        inputUsdPerMillion: number | null;
+        outputUsdPerMillion: number | null;
+        trustScore: number | null;
+    }>;
+}
+export interface PeerList {
+    id: string;
+    name: string;
+    description: string | null;
+    peerIds: string[];
+    createdAt: number;
+}
+/** Called as `model: "@preset/<slug>"`. */
+export interface Preset {
+    id: string;
+    slug: string;
+    name: string;
+    workspaceId: string | null;
+    model: string;
+    routingPolicy: RoutingPolicy | null;
+    systemPrompt: string | null;
+    /** Request parameters merged under the client's own (temperature, max_tokens, …). */
+    params: Record<string, unknown>;
+    createdAt: number;
+}
+export interface GatewayStatus {
+    version: string;
+    publicUrl: string | null;
+    buyer: {
+        reachable: boolean;
+        peers: number;
+        dhtNodes: number;
+        uptimeMs: number | null;
+    };
+    spendFeed: string;
+    x402: boolean;
+    /**
+     * Who can reach this gateway. Org admins get every field; other callers
+     * get `mode`, `reachableFromInternet` and `personalComputer` only
+     * (`listenHost` null, `reasons` empty).
+     */
+    exposure?: GatewayExposure;
+}
+/**
+ * `local`: only this machine can reach the gateway (loopback, no public URL);
+ * `lan`: it listens beyond loopback without a public URL; `public`: it has
+ * a public URL (a domain or a tunnel). Judged from configuration only.
+ */
+export type GatewayExposureMode = 'local' | 'lan' | 'public';
+export interface GatewayExposure {
+    mode: GatewayExposureMode;
+    publicUrl: string | null;
+    listenHost: string | null;
+    /** null when configuration alone cannot tell (e.g. listening on 0.0.0.0). */
+    reachableFromInternet: boolean | null;
+    /** macOS/Windows, or Linux without systemd outside a container: likely a laptop or desktop. */
+    personalComputer: boolean;
+    /** Plain-language reasons behind `mode`, for the console. */
+    reasons: string[];
+}
+export interface Settings {
+    publicUrl: string | null;
+    buyer: BuyerSettings;
+    observability: ObservabilitySettings;
+    auth: AuthConfig;
+    /**
+     * Set by `PATCH /settings/buyer` when a change needs a buyer restart and
+     * the buyer could not restart itself (not supervised, or unreachable): the
+     * change is saved but applies only after the operator restarts it.
+     * `observability.otlpHeaders` values read "••••" for anyone but org-admin
+     * sessions; sending "••••" back keeps the stored value.
+     */
+    restartRequired?: boolean;
+}
+/**
+ * Every buyer setting in the config file the buyer behind the gateway
+ * runs with. `routingPreferences` apply at once (the buyer reloads them);
+ * everything else needs a buyer restart, which `PATCH /settings/buyer`
+ * requests. `proxyPort` is read only: the gateway forwards to it.
+ */
+export interface BuyerSettings {
+    proxyPort: number;
+    /** Hard price caps (defaults for every provider), USD per million tokens. */
+    maxPricing: {
+        inputUsdPerMillion: number;
+        outputUsdPerMillion: number;
+        cachedInputUsdPerMillion: number | null;
+    };
+    /** Minimum seller reputation, 0–100, for every request (pins included). */
+    minPeerReputation: number;
+    /** Automatic routing preferences; the top level of every routing policy. */
+    routingPreferences: {
+        minTrustScore: number;
+        /** Soft input-price limit: sellers above it rank lower, never excluded. */
+        maxInputUsdPerMillion: number;
+        allowedPeerIds: string[];
+        blockedPeerIds: string[];
+        preferFreePeers: boolean;
+    };
+    /** Seller verification by verifier SDKs (e.g. TEE attestation). */
+    verifier: {
+        enabled: boolean;
+        prefer: string[];
+        require: boolean;
+    };
+    /** Kept for older clients: `verifier.require`. */
+    requireVerifier: boolean;
+    payments: {
+        /** Sweep USDC arriving in the buyer wallets into deposits automatically. */
+        autoSweep: boolean;
+        /** Most USDC authorized for a single request. */
+        maxPerRequestUsdc: number;
+        /** Most USDC reserved for one payment channel. */
+        maxReserveUsdc: number;
+        /** Base RPC endpoint; null uses the chain default. Path and query (API keys) are masked unless revealed. */
+        rpcUrl: string | null;
+        fallbackRpcUrls: string[];
+    };
+    network: {
+        peerRefreshIntervalMs: number;
+        metadataFetchTimeoutMs: number;
+        requestTimeoutMs: number;
+        maxStreamDurationMs: number;
+        /** Leave per-service attribution out of signed request metadata. */
+        disableMetadataV2Services: boolean;
+    };
+    /** Response-auth evidence sampling. */
+    evidence: {
+        sampleRate: number | null;
+        maxSampleBytes: number | null;
+    };
+    /**
+     * Setting paths (e.g. "maxPricing.inputUsdPerMillion", "verifier") the
+     * running buyer takes from its environment or start flags instead: editing
+     * them here is saved but has no effect until that override is removed.
+     * Empty when the buyer is unreachable.
+     */
+    overrides: string[];
+}
+/** A partial `BuyerSettings`: only the fields sent change. Lists replace the saved list. */
+export interface BuyerSettingsInput {
+    maxPricing?: {
+        inputUsdPerMillion?: number;
+        outputUsdPerMillion?: number;
+        cachedInputUsdPerMillion?: number | null;
+    };
+    minPeerReputation?: number;
+    routingPreferences?: Partial<BuyerSettings['routingPreferences']>;
+    verifier?: Partial<BuyerSettings['verifier']>;
+    payments?: Partial<BuyerSettings['payments']>;
+    network?: Partial<BuyerSettings['network']>;
+    evidence?: Partial<BuyerSettings['evidence']>;
+}
+export interface ObservabilitySettings {
+    /** OpenTelemetry/HTTP endpoint the gateway sends one trace per request to. */
+    otlpEndpoint: string | null;
+    otlpHeaders: Record<string, string>;
+    /** Store request and response bodies in the request log. Off by default. */
+    logContent: boolean;
+    /** Days to keep the request log; null keeps it forever. */
+    retentionDays: number | null;
+}
+//# sourceMappingURL=types.d.ts.map