@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/data-provider/package.json

@@ -3,7 +3,7 @@
   "version": "0.9.6",
   "main": "index.js",
   "dependencies": {
-    "@skrr-ai/auth-core": "^0.4.18"
+    "@skrr-ai/auth-core": "^0.4.30"
   },
   "_vendoredBy": "cli/scripts/vendor-monorepo-deps.js"
 }

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/contract.js

@@ -1,150 +1,102 @@
 "use strict";
-/**
- * model-proxy/contract.ts — single source of truth for the "subscription model
- * proxy" feature (BYO-subscription inside a remote sandbox).
- *
- * ## Why this exists
- *
- * When an OverSky agent runs inside a cloud sandbox (E2B / Fargate) the model
- * inference is driven by the bundled Claude Code Agent SDK. By default that SDK
- * authenticates with a PLATFORM credential. To let a user spend their OWN Claude
- * subscription WITHOUT placing a high-value personal OAuth token on multi-tenant
- * cloud infra, we do NOT ship the credential into the sandbox. Instead:
- *
- *   1. The in-sandbox SDK is pointed at a LOOPBACK proxy via `ANTHROPIC_BASE_URL`
- *      and given a per-session, revocable RELAY token via `ANTHROPIC_AUTH_TOKEN`.
- *   2. The in-sandbox daemon's loopback server tunnels each model HTTP call up
- *      the existing daemon↔backend Socket.IO channel as a `daemon:model-proxy:*`
- *      stream.
- *   3. The OverSky backend relays that stream to the USER'S OWN home daemon
- *      (matched by userId; authorized by the relay token).
- *   4. The home daemon — which physically holds `~/.claude` — injects the real
- *      subscription bearer and re-issues the request to api.anthropic.com,
- *      streaming the response back down the same path.
- *
- * The subscription credential therefore never leaves the user's machine; a
- * sandbox compromise yields only a revocable relay token. See
- * `docs/architecture/sandbox-subscription-model-proxy-2026-06-29.md`.
- *
- * This module holds the wire contract, the env-var names, and the upstream/OAuth
- * configuration so the sandbox side, the backend relay, and the home daemon all
- * agree on one shape. It has ZERO runtime dependencies on purpose.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ModelProxyError = exports.MODEL_PROXY_ERROR = exports.MODEL_PROXY_MAX_BODY_BYTES = exports.PROVIDER_PROXY_ENV = exports.MODEL_PROXY_PROVIDERS = exports.MODEL_PROXY_EVENTS = exports.CLAUDE_SETUP_TOKEN_ENV = exports.CLAUDE_CREDENTIALS_RELATIVE_PATH = exports.DEFAULT_REFRESH_SKEW_MS = exports.ANTHROPIC_OAUTH_BETA = exports.CLAUDE_OAUTH_DEFAULTS = exports.ANTHROPIC_UPSTREAM_BASE = exports.MODEL_PROXY_ENV = void 0;
-// ---------------------------------------------------------------------------
-// Environment contract (what the in-sandbox SDK reads)
-// ---------------------------------------------------------------------------
-/**
- * Env vars injected into the in-sandbox Agent SDK session (`buildSdkEnv`) when a
- * session runs in BYO-subscription mode. We use `ANTHROPIC_AUTH_TOKEN` (Bearer)
- * rather than `ANTHROPIC_API_KEY` so the SDK speaks OAuth-bearer to our loopback
- * — the value is a per-session RELAY token, never the real subscription token.
- */
-exports.MODEL_PROXY_ENV = {
-    /** Points the SDK at the in-sandbox loopback proxy, e.g. `http://127.0.0.1:8788`. */
-    baseUrl: 'ANTHROPIC_BASE_URL',
-    /** Per-session relay bearer the SDK sends; validated by the loopback server. */
-    authToken: 'ANTHROPIC_AUTH_TOKEN',
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-// ---------------------------------------------------------------------------
-// Upstream + OAuth configuration (home-daemon side)
-// ---------------------------------------------------------------------------
-/**
- * Default Anthropic upstream. The home daemon re-issues `<base><path>`. Kept as
- * an allowlist of one so a compromised relay cannot make the home daemon hit an
- * arbitrary host (SSRF hardening — see `egress.ts`).
- */
-exports.ANTHROPIC_UPSTREAM_BASE = 'https://api.anthropic.com';
-/**
- * Claude Code OAuth client used to refresh a `claude login` subscription token.
- *
- * These are the well-known public Claude Code OAuth client values. They are
- * configuration, not secrets, and are overridable per deployment.
- *
- * IMPORTANT (production gate): verify `tokenUrl` + `clientId` against the
- * Claude Code version bundled in the home daemon before enabling refresh in
- * production. A wrong value fails CLOSED (refresh throws), so the worst case is
- * "subscription proxy unavailable", never a silent wrong-account charge.
- */
-exports.CLAUDE_OAUTH_DEFAULTS = {
-    tokenUrl: 'https://console.anthropic.com/v1/oauth/token',
-    clientId: '9d1c250a-e61b-44d9-88ed-5944d1962f5e',
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
 };
-/**
- * `anthropic-beta` value that flags an OAuth-subscription (vs API-key) request.
- * Must be present on every outbound request the home daemon authorizes.
- */
-exports.ANTHROPIC_OAUTH_BETA = 'oauth-2025-04-20';
-/** Default refresh skew: refresh an access token this long before it expires. */
-exports.DEFAULT_REFRESH_SKEW_MS = 5 * 60 * 1000;
-/** Location of the `claude login` credential file, relative to the user's home. */
-exports.CLAUDE_CREDENTIALS_RELATIVE_PATH = ['.claude', '.credentials.json'];
-/** Long-lived headless token env var (`claude setup-token`, sk-ant-oat01-…). */
-exports.CLAUDE_SETUP_TOKEN_ENV = 'CLAUDE_CODE_OAUTH_TOKEN';
-// ---------------------------------------------------------------------------
-// Wire contract — the `daemon:model-proxy:*` stream
-// ---------------------------------------------------------------------------
-/**
- * Socket.IO event names for the bidirectional model-proxy stream. Modeled on the
- * existing `daemon:terminal:*` streaming pattern (connection.ts) so it rides the
- * same transport + Redis bridge without a parallel mechanism.
- *
- * The request body is carried INLINE on REQUEST_BEGIN (the Agent SDK sends a
- * complete request body; only the *response* is SSE-streamed), which keeps
- * backend routing stateless — one event per upstream call carries everything
- * needed to route it. CANCEL aborts an in-flight exchange whose response is
- * still streaming.
- *
- * Direction is relative to the HOME daemon:
- *   request (sandbox → backend → home):  REQUEST_BEGIN, CANCEL
- *   response (home → backend → sandbox): RESPONSE_BEGIN, RESPONSE_CHUNK, RESPONSE_END
- */
-exports.MODEL_PROXY_EVENTS = {
-    REQUEST_BEGIN: 'daemon:model-proxy:request',
-    CANCEL: 'daemon:model-proxy:cancel',
-    RESPONSE_BEGIN: 'daemon:model-proxy:response',
-    RESPONSE_CHUNK: 'daemon:model-proxy:response:chunk',
-    RESPONSE_END: 'daemon:model-proxy:response:end',
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var contract_exports = {};
+__export(contract_exports, {
+  ANTHROPIC_OAUTH_BETA: () => ANTHROPIC_OAUTH_BETA,
+  ANTHROPIC_UPSTREAM_BASE: () => ANTHROPIC_UPSTREAM_BASE,
+  CLAUDE_CREDENTIALS_RELATIVE_PATH: () => CLAUDE_CREDENTIALS_RELATIVE_PATH,
+  CLAUDE_OAUTH_DEFAULTS: () => CLAUDE_OAUTH_DEFAULTS,
+  CLAUDE_SETUP_TOKEN_ENV: () => CLAUDE_SETUP_TOKEN_ENV,
+  DEFAULT_REFRESH_SKEW_MS: () => DEFAULT_REFRESH_SKEW_MS,
+  MODEL_PROXY_ENV: () => MODEL_PROXY_ENV,
+  MODEL_PROXY_ERROR: () => MODEL_PROXY_ERROR,
+  MODEL_PROXY_EVENTS: () => MODEL_PROXY_EVENTS,
+  MODEL_PROXY_MAX_BODY_BYTES: () => MODEL_PROXY_MAX_BODY_BYTES,
+  MODEL_PROXY_PROVIDERS: () => MODEL_PROXY_PROVIDERS,
+  ModelProxyError: () => ModelProxyError,
+  PROVIDER_PROXY_ENV: () => PROVIDER_PROXY_ENV
+});
+module.exports = __toCommonJS(contract_exports);
+const MODEL_PROXY_ENV = {
+  /** Points the SDK at the in-sandbox loopback proxy, e.g. `http://127.0.0.1:8788`. */
+  baseUrl: "ANTHROPIC_BASE_URL",
+  /** Per-session relay bearer the SDK sends; validated by the loopback server. */
+  authToken: "ANTHROPIC_AUTH_TOKEN"
 };
-/** Subscription providers the model proxy can serve. */
-exports.MODEL_PROXY_PROVIDERS = {
-    CLAUDE: 'claude',
-    CODEX: 'codex',
+const ANTHROPIC_UPSTREAM_BASE = "https://api.anthropic.com";
+const CLAUDE_OAUTH_DEFAULTS = {
+  tokenUrl: "https://console.anthropic.com/v1/oauth/token",
+  clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
 };
-/**
- * Per-provider env contract injected into the in-sandbox session so the inner
- * CLI/SDK talks to the loopback with a relay token (never the real credential):
- *   - Claude Code: `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` (OAuth bearer).
- *   - Codex: `OPENAI_BASE_URL` + `OPENAI_API_KEY` (the loopback validates the
- *     relay token; the home daemon swaps in the real ChatGPT/Codex auth).
- */
-exports.PROVIDER_PROXY_ENV = {
-    claude: { baseUrl: 'ANTHROPIC_BASE_URL', authToken: 'ANTHROPIC_AUTH_TOKEN' },
-    codex: { baseUrl: 'OPENAI_BASE_URL', authToken: 'OPENAI_API_KEY' },
+const ANTHROPIC_OAUTH_BETA = "oauth-2025-04-20";
+const DEFAULT_REFRESH_SKEW_MS = 5 * 60 * 1e3;
+const CLAUDE_CREDENTIALS_RELATIVE_PATH = [".claude", ".credentials.json"];
+const CLAUDE_SETUP_TOKEN_ENV = "CLAUDE_CODE_OAUTH_TOKEN";
+const MODEL_PROXY_EVENTS = {
+  REQUEST_BEGIN: "daemon:model-proxy:request",
+  CANCEL: "daemon:model-proxy:cancel",
+  RESPONSE_BEGIN: "daemon:model-proxy:response",
+  RESPONSE_CHUNK: "daemon:model-proxy:response:chunk",
+  RESPONSE_END: "daemon:model-proxy:response:end"
 };
-/** Max inline request-body size (base64-decoded) accepted over the tunnel. */
-exports.MODEL_PROXY_MAX_BODY_BYTES = 8 * 1024 * 1024;
-/** Stable error codes surfaced across the proxy. */
-exports.MODEL_PROXY_ERROR = {
-    SUBSCRIPTION_NOT_FOUND: 'subscription_not_found',
-    SUBSCRIPTION_EXPIRED: 'subscription_expired',
-    REFRESH_FAILED: 'refresh_failed',
-    UPSTREAM_BLOCKED: 'upstream_blocked',
-    UPSTREAM_FAILED: 'upstream_failed',
-    UNAUTHORIZED: 'unauthorized',
-    CANCELLED: 'cancelled',
-    REQUEST_TOO_LARGE: 'request_too_large',
-    /** Deterministic local request/policy denial; callers must not retry it. */
-    REQUEST_REJECTED: 'request_rejected',
+const MODEL_PROXY_PROVIDERS = {
+  CLAUDE: "claude",
+  CODEX: "codex"
+};
+const PROVIDER_PROXY_ENV = {
+  claude: { baseUrl: "ANTHROPIC_BASE_URL", authToken: "ANTHROPIC_AUTH_TOKEN" },
+  codex: { baseUrl: "OPENAI_BASE_URL", authToken: "OPENAI_API_KEY" }
+};
+const MODEL_PROXY_MAX_BODY_BYTES = 8 * 1024 * 1024;
+const MODEL_PROXY_ERROR = {
+  SUBSCRIPTION_NOT_FOUND: "subscription_not_found",
+  SUBSCRIPTION_EXPIRED: "subscription_expired",
+  REFRESH_FAILED: "refresh_failed",
+  UPSTREAM_BLOCKED: "upstream_blocked",
+  UPSTREAM_FAILED: "upstream_failed",
+  UNAUTHORIZED: "unauthorized",
+  CANCELLED: "cancelled",
+  REQUEST_TOO_LARGE: "request_too_large",
+  /** Deterministic local request/policy denial; callers must not retry it. */
+  REQUEST_REJECTED: "request_rejected"
 };
-/** Typed error carrying a stable {@link ModelProxyErrorCode}. */
 class ModelProxyError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.name = 'ModelProxyError';
-        this.code = code;
-    }
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ModelProxyError";
+    this.code = code;
+  }
 }
-exports.ModelProxyError = ModelProxyError;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ANTHROPIC_OAUTH_BETA,
+  ANTHROPIC_UPSTREAM_BASE,
+  CLAUDE_CREDENTIALS_RELATIVE_PATH,
+  CLAUDE_OAUTH_DEFAULTS,
+  CLAUDE_SETUP_TOKEN_ENV,
+  DEFAULT_REFRESH_SKEW_MS,
+  MODEL_PROXY_ENV,
+  MODEL_PROXY_ERROR,
+  MODEL_PROXY_EVENTS,
+  MODEL_PROXY_MAX_BODY_BYTES,
+  MODEL_PROXY_PROVIDERS,
+  ModelProxyError,
+  PROVIDER_PROXY_ENV
+});

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/index.js

@@ -1,91 +1,59 @@
 "use strict";
-/**
- * OSK-3891 (ADR-102) — the loopback credential broker, as a shared package.
- *
- * ── The invariant this package exists to serve ─────────────────────────────
- *
- * **No cloud-reusable credential enters the harness process.** Not its
- * environment, not its address space, not a file it can read. The harness gets a
- * random secret bound to a Unix socket that dies with the session; the credential
- * stays with the parent.
- *
- * ── Why it is a package and not a daemon module ────────────────────────────
- *
- * The 2026-08-08 token-plane document phrased that invariant as *"the Daemon is
- * the sole local injection authority"*, which welded a correct requirement to one
- * implementation. In a cloud-dispatched session the daemon IS the harness's
- * parent; in a session a human starts with `skrr code` the CLI is, and the daemon
- * is a sibling background service. Requiring the daemon there makes a long-lived
- * service a prerequisite for an interactive command.
- *
- * The requirement is about the harness PROCESS. So the broker lives here, where
- * either parent can host it, and the server-side authorization is identical in
- * both cases.
- *
- * ── Why NOT reimplement it in the CLI instead ──────────────────────────────
- *
- * The loopback server enforces the request envelope — model, route, dialect, byte
- * ceiling, concurrency, rate — before anything leaves the machine. That
- * enforcement IS the security value of the design. A second implementation would
- * fork it, and the fork would drift silently because both halves would keep
- * working.
- *
- * ── What the broker does and does not buy ──────────────────────────────────
- *
- * It reduces the blast radius of ACCIDENTAL disclosure: a crash dump, a verbose
- * log, a repository plugin that prints `process.env`. That is the live risk,
- * because a coding harness runs code authored by whoever wrote the repository it
- * was pointed at.
- *
- * It is NOT a boundary against a MALICIOUS harness. Same UID means the child can
- * read the parent's memory or simply ask for another session. Process confinement
- * is a separate, unshipped control, and this package must not be described as
- * providing it.
- *
- * (Its earlier stated rationale — that the daemon would otherwise hold a LiteLLM
- * virtual key — is obsolete: current servers deliver an `agst_` session token and
- * resolve the virtual key server-side. Recorded because an expired rationale does
- * not fail loudly; it just invites someone to delete a still-needed control.)
- *
- * ── Dual build, deliberately ───────────────────────────────────────────────
- *
- * ESM and CJS are both emitted because the daemon is ESM and the CLI is CJS, and
- * this package exists precisely so both can host the broker.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ModelProxyLoopbackServer = exports.startRenewalLoop = exports.scheduleRenewalDelay = exports.minimumCapabilityWindowMs = exports.isManagedInferenceModelScope = exports.startManagedInferenceBroker = exports.buildManagedInferenceRelayCredential = exports.inferenceBrokerNoProxyEnv = exports.INFERENCE_BROKER_HOST = exports.MANAGED_STATUS_PATH = exports.MANAGED_PROMPT_CACHING_ENV = exports.MANAGED_SESSION_ENV = exports.INFERENCE_BROKER_SOCKET_ENV = exports.INFERENCE_BROKER_ORIGIN = void 0;
-var managed_inference_broker_js_1 = require("./managed-inference-broker.js");
-Object.defineProperty(exports, "INFERENCE_BROKER_ORIGIN", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_ORIGIN; } });
-Object.defineProperty(exports, "INFERENCE_BROKER_SOCKET_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_SOCKET_ENV; } });
-Object.defineProperty(exports, "MANAGED_SESSION_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_SESSION_ENV; } });
-Object.defineProperty(exports, "MANAGED_PROMPT_CACHING_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_PROMPT_CACHING_ENV; } });
-Object.defineProperty(exports, "MANAGED_STATUS_PATH", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_STATUS_PATH; } });
-Object.defineProperty(exports, "INFERENCE_BROKER_HOST", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_HOST; } });
-Object.defineProperty(exports, "inferenceBrokerNoProxyEnv", { enumerable: true, get: function () { return managed_inference_broker_js_1.inferenceBrokerNoProxyEnv; } });
-Object.defineProperty(exports, "buildManagedInferenceRelayCredential", { enumerable: true, get: function () { return managed_inference_broker_js_1.buildManagedInferenceRelayCredential; } });
-Object.defineProperty(exports, "startManagedInferenceBroker", { enumerable: true, get: function () { return managed_inference_broker_js_1.startManagedInferenceBroker; } });
-Object.defineProperty(exports, "isManagedInferenceModelScope", { enumerable: true, get: function () { return managed_inference_broker_js_1.isManagedInferenceModelScope; } });
-var managed_inference_renewal_js_1 = require("./managed-inference-renewal.js");
-Object.defineProperty(exports, "minimumCapabilityWindowMs", { enumerable: true, get: function () { return managed_inference_renewal_js_1.minimumCapabilityWindowMs; } });
-Object.defineProperty(exports, "scheduleRenewalDelay", { enumerable: true, get: function () { return managed_inference_renewal_js_1.scheduleRenewalDelay; } });
-Object.defineProperty(exports, "startRenewalLoop", { enumerable: true, get: function () { return managed_inference_renewal_js_1.startRenewalLoop; } });
-var loopback_server_js_1 = require("./loopback-server.js");
-Object.defineProperty(exports, "ModelProxyLoopbackServer", { enumerable: true, get: function () { return loopback_server_js_1.ModelProxyLoopbackServer; } });
-// Re-exported in full because `daemon/src/model-proxy/contract.ts` becomes a
-// pure re-export of this module: 23 daemon files import that path today, and
-// keeping it a re-export means none of them change.
-__exportStar(require("./contract.js"), exports);
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var index_exports = {};
+__export(index_exports, {
+  INFERENCE_BROKER_HOST: () => import_managed_inference_broker.INFERENCE_BROKER_HOST,
+  INFERENCE_BROKER_ORIGIN: () => import_managed_inference_broker.INFERENCE_BROKER_ORIGIN,
+  INFERENCE_BROKER_SOCKET_ENV: () => import_managed_inference_broker.INFERENCE_BROKER_SOCKET_ENV,
+  MANAGED_PROMPT_CACHING_ENV: () => import_managed_inference_broker.MANAGED_PROMPT_CACHING_ENV,
+  MANAGED_SESSION_ENV: () => import_managed_inference_broker.MANAGED_SESSION_ENV,
+  MANAGED_STATUS_PATH: () => import_managed_inference_broker.MANAGED_STATUS_PATH,
+  ModelProxyLoopbackServer: () => import_loopback_server.ModelProxyLoopbackServer,
+  buildManagedInferenceRelayCredential: () => import_managed_inference_broker.buildManagedInferenceRelayCredential,
+  inferenceBrokerNoProxyEnv: () => import_managed_inference_broker.inferenceBrokerNoProxyEnv,
+  isManagedInferenceModelScope: () => import_managed_inference_broker.isManagedInferenceModelScope,
+  minimumCapabilityWindowMs: () => import_managed_inference_renewal.minimumCapabilityWindowMs,
+  scheduleRenewalDelay: () => import_managed_inference_renewal.scheduleRenewalDelay,
+  startManagedInferenceBroker: () => import_managed_inference_broker.startManagedInferenceBroker,
+  startRenewalLoop: () => import_managed_inference_renewal.startRenewalLoop
+});
+module.exports = __toCommonJS(index_exports);
+var import_managed_inference_broker = require("./managed-inference-broker.js");
+var import_managed_inference_renewal = require("./managed-inference-renewal.js");
+var import_loopback_server = require("./loopback-server.js");
+__reExport(index_exports, require("./contract.js"), module.exports);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  INFERENCE_BROKER_HOST,
+  INFERENCE_BROKER_ORIGIN,
+  INFERENCE_BROKER_SOCKET_ENV,
+  MANAGED_PROMPT_CACHING_ENV,
+  MANAGED_SESSION_ENV,
+  MANAGED_STATUS_PATH,
+  ModelProxyLoopbackServer,
+  buildManagedInferenceRelayCredential,
+  inferenceBrokerNoProxyEnv,
+  isManagedInferenceModelScope,
+  minimumCapabilityWindowMs,
+  scheduleRenewalDelay,
+  startManagedInferenceBroker,
+  startRenewalLoop,
+  ...require("./contract.js")
+});