agl 40.5.0 → 40.6.0

package/dist_ts/classes.inferencegateway.d.ts

@@ -3,6 +3,11 @@ import { InferenceRouter, type IInferenceRoutingPolicy, type TInferencePaymentCa
 import { type IInferenceAffinityStore } from './classes.inferenceaffinity.js';
 import type { IInferencePlacementJournal, TInferencePlacementReason } from './classes.inferenceplacement.js';
 import { type IInferenceUsageLedger } from './classes.inferenceusage.js';
+/**
+ * Where a credential is accepted: the loopback listener, which every process on the host can reach, or the confined
+ * listener, a Unix socket only the containers it is mounted into have. Each credential is accepted on its own route alone.
+ */
+export type TInferenceGatewayRoute = 'loopback' | 'confined';
 /**
  * Requests in flight: per session, so one runaway conversation cannot starve the others; per client credential,
  * which every session of one harness shares; and in all.
@@ -43,6 +48,13 @@ export interface IInferenceGatewayOptions {
      * and translated Messages answers alike. It holds no prompt, answer or credential.
      */
     usageLedger: IInferenceUsageLedger;
+    /**
+     * The confined listener's Unix socket, bound beside the loopback port and made this user's alone (0600, in a private
+     * directory that holds nothing else). It accepts confined credentials alone and serves them the Claude pool's three
+     * endpoints Claude Code uses (`confinedEndpoints`), exactly as the loopback listener serves them; unset, the gateway has
+     * no confined listener and admits no confined credential.
+     */
+    confinedSocketPath?: string;
 }
 /** A placement the journal could not record, as the proxy reports it: no session id, prompt or account id. */
 export interface IInferenceGatewayPlacementFailure {
@@ -93,6 +105,11 @@ export interface IInferenceGatewayClientOptions {
      * sessions are its name's. Sessions are kept per pool (see `inferenceSessionKey`).
      */
     sessionScope?: string;
+    /**
+     * Where the credential is accepted; `loopback` when unset. A confined credential is a lease of the Claude pool, accepted
+     * on the confined listener alone.
+     */
+    route?: TInferenceGatewayRoute;
 }
 /** A credential the gateway admits, known to it by its digest alone. */
 export interface IInferenceGatewayGrant {
@@ -112,6 +129,8 @@ export interface IInferenceGatewayRestoredLease {
     digest: string;
     /** The lease's `sessionScope`; see `IInferenceGatewayClientOptions`. */
     sessionScope?: string;
+    /** The lease's `route`; see `IInferenceGatewayClientOptions`. */
+    route?: TInferenceGatewayRoute;
 }
 /** Codex's Responses, Messages answered by a ChatGPT pool, or Claude Code's own Messages sent to a Claude pool. */
 type TProtocol = 'responses' | 'messages' | 'claude';
@@ -140,7 +159,10 @@ export declare const inferencePaymentCause: (providerArg: TInferenceProvider, cr
  * Claude Code and Flex, OpenAI's serve Responses requests.
  */
 export declare const assertInferenceRoutingPolicy: (policyArg: IInferenceRoutingPolicy) => void;
-/** Authenticated, loopback-only Responses and Messages endpoints with bounded, cancelable streaming. */
+/**
+ * Authenticated Responses and Messages endpoints with bounded, cancelable streaming, on a loopback listener and, for
+ * confined credentials, a Unix socket that serves the Claude pool alone.
+ */
 export declare class InferenceGateway {
     private readonly options;
     private readonly clients;
@@ -155,6 +177,7 @@ export declare class InferenceGateway {
     private inFlight;
     private readonly limits;
     private server?;
+    private confinedServer?;
     private host;
     private startTask?;
     private stopTask?;
@@ -177,7 +200,18 @@ export declare class InferenceGateway {
     restore(policyArg: IInferenceRoutingPolicy, leaseArg: IInferenceGatewayRestoredLease): Promise<IInferenceGatewayGrant>;
     private admit;
     stop(): Promise<void>;
+    /**
+     * Binds the loopback listener, then the confined one when the gateway has its socket. A stop that comes meanwhile
+     * closes whatever was bound.
+     */
     private start;
+    /** One listener: the loopback port or the confined socket, each with the same bounds and handling. */
+    private createServer;
+    /**
+     * The client a request's credential names, among those accepted on the listener it came in on. A loopback request must
+     * name the listener's exact host; on the confined socket the host is irrelevant, nothing but a mounted container
+     * reaches it. Neither takes a browser's request. A credential of the other listener is refused like an unknown one.
+     */
     private authenticate;
     private handle;
     /**