inference-relay 1.4.0

package/dist/index.d.cts

@@ -0,0 +1,716 @@
+import { C as CreateParams, R as RelayResult, I as InferenceRelayConfig, P as ProbeResult, a as CostEstimate, b as ProviderHealth, c as RateLimitEvent, E as EngineEvent, S as SecurityState$1, A as AuditEvent, d as RoutingConfig } from './index-B20BqToz.cjs';
+export { e as ConcurrencyConfig, f as ContentBlock, M as Message, g as ProviderConfig, h as RelayCapExceededError, i as SecureEnclaveConfig, j as SecureEnclaveCredentials, k as SegmentUsage } from './index-B20BqToz.cjs';
+import { RelayStream } from './stream/index.cjs';
+export { createRelayStream } from './stream/index.cjs';
+import { EventEmitter } from 'node:events';
+
+interface LicenseValidation {
+    valid: boolean;
+    tier?: string;
+    features?: string[];
+    expiresAt?: number | null;
+    /**
+     * Effective cap: base cap plus any in-cycle top-up grants. Kept as the
+     * `usageCap` field for backward compat — the library has always compared
+     * against this.
+     */
+    usageCap?: number | null;
+    /** Raw base cap (before top-ups). Optional for back-compat. */
+    baseCap?: number | null;
+    /** Sum of active top-up grants for the current cycle. */
+    topUpGrants?: number;
+    /**
+     * Bumped by the backend on every top-up purchase. Library uses this to
+     * short-circuit the normal validation cache: if the cached entry has an
+     * older `lastCapChange` than the server, force a re-validate immediately.
+     * Enables sub-30s recovery after a top-up.
+     */
+    lastCapChange?: number;
+    usageThisMonth?: number;
+    capExceeded?: boolean;
+    error?: string;
+}
+/**
+ * Validate a license key against the inference-relay backend.
+ *
+ * SECURITY: This is the SOLE authoritative implementation of license verification
+ * in the entire monorepo. The Pro package re-exports this function rather than
+ * reimplementing it. Do NOT copy this logic into other packages — single source
+ * of truth for the asymmetric (RS256) trust chain.
+ *
+ * - Verifies JWS signatures from the Protocol Authority
+ * - Rejects unsigned valid:true responses (MITM protection — fail-closed)
+ * - Caches positive results for 24h, negative for 60s
+ * - Falls back to cached result on network failure within 7-day staleness window
+ */
+declare function validateLicense(key: string, endpoint?: string): Promise<LicenseValidation>;
+declare class InferenceRelay {
+    private providers;
+    private config;
+    private fallbackEngine;
+    private telemetryReporter;
+    private routingFn;
+    private license;
+    private licensePromise;
+    private licenseValidatedAt;
+    private callsSinceValidation;
+    private manifestDecryptor;
+    private capProbeTimer;
+    private capProbeTicksRemaining;
+    messages: {
+        create(params: CreateParams & {
+            stream?: false;
+        }, options?: {
+            signal?: AbortSignal;
+        }): Promise<RelayResult>;
+        create(params: CreateParams & {
+            stream: true;
+        }, options?: {
+            signal?: AbortSignal;
+        }): Promise<RelayStream>;
+        create(params: CreateParams, options?: {
+            signal?: AbortSignal;
+        }): Promise<RelayResult | RelayStream>;
+    };
+    constructor(config: InferenceRelayConfig);
+    /**
+     * Start the High-Frequency Probe: background poll of /v1/validate every
+     * 15 seconds for up to 5 minutes. Exits early when `lastCapChange` differs
+     * from the cached value — meaning a top-up purchase has landed — at which
+     * point the normal validation cache takes over and the next inference call
+     * succeeds.
+     *
+     * Idempotent: a second call while a probe is already running is a no-op.
+     * Properly cleaned up in dispose() so there are no timer leaks.
+     */
+    private startCapProbe;
+    /**
+     * Single validation call used by the cap probe loop. Extracted as a
+     * method so tests can override it without going through the RS256 JWS
+     * verification path. Production behavior delegates to the module-level
+     * validateLicense() function, which is the sole authoritative source of
+     * truth for the asymmetric trust chain.
+     */
+    private probeValidate;
+    private stopCapProbe;
+    static autoDetect(config?: Partial<InferenceRelayConfig>): Promise<InferenceRelay>;
+    dispose(): void;
+    private resolveProviders;
+    private executeMessage;
+    private streamMessage;
+    private createProvider;
+}
+
+declare abstract class BaseProvider {
+    abstract readonly type: string;
+    abstract readonly supportsStreaming: boolean;
+    abstract readonly supportsMultimodal: boolean;
+    abstract readonly platformRequirement: 'desktop' | 'web' | 'any';
+    priority: number;
+    abstract probe(): Promise<ProbeResult>;
+    abstract execute(params: CreateParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<RelayResult>;
+    /**
+     * Lower-level streaming entrypoint. Returns the raw provider event iterator
+     * with NO RelayStream wrapping. The FallbackEngine consumes streamRaw()
+     * directly so it can run mid-stream failover, accumulate state, and wrap
+     * the final output in createRelayStream exactly once.
+     *
+     * Returns a Promise so eager setup (auth, spawn, fetch) happens BEFORE the
+     * iterator is returned. This matches the previous stream() semantics — by
+     * the time streamRaw() resolves, any side effects (subprocess spawn, HTTP
+     * connection) have already started.
+     *
+     * Providers MUST override either streamRaw() OR stream() (preferably
+     * streamRaw — stream() will be removed once all callers migrate).
+     */
+    streamRaw(_params: CreateParams, _options?: {
+        signal?: AbortSignal;
+    }): Promise<AsyncIterable<any>>;
+    /**
+     * Default RelayStream wrapper. Most providers should NOT override this —
+     * implement streamRaw() instead. Kept as an instance method (not abstract)
+     * for backward compatibility with callers that hit providers directly.
+     */
+    stream(params: CreateParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<RelayStream>;
+    abstract estimateCost(params: CreateParams): CostEstimate;
+    abstract getHealth(): ProviderHealth;
+    abstract reportRateLimit(event: RateLimitEvent): void;
+}
+
+interface AnthropicAPIOptions {
+    apiKey: string;
+    baseUrl?: string;
+    /** Set true when running in a browser context */
+    dangerousDirectBrowserAccess?: boolean;
+}
+declare class AnthropicAPIProvider extends BaseProvider {
+    readonly type = "anthropic-api";
+    readonly supportsStreaming = true;
+    readonly supportsMultimodal = true;
+    readonly platformRequirement: "any";
+    private apiKey;
+    private baseUrl;
+    private dangerousDirectBrowserAccess;
+    private health;
+    constructor(options: AnthropicAPIOptions);
+    probe(): Promise<ProbeResult>;
+    execute(params: CreateParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<RelayResult>;
+    streamRaw(params: CreateParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<AsyncIterable<any>>;
+    estimateCost(params: CreateParams): CostEstimate;
+    getHealth(): ProviderHealth;
+    reportRateLimit(event: RateLimitEvent): void;
+    private buildHeaders;
+    private buildRequestBody;
+    private handleErrorResponse;
+    private recordSuccess;
+}
+
+interface OpenAIAPIOptions {
+    apiKey: string;
+    baseUrl?: string;
+}
+declare class OpenAIAPIProvider extends BaseProvider {
+    readonly type = "openai-api";
+    readonly supportsStreaming = true;
+    readonly supportsMultimodal = true;
+    readonly platformRequirement: "any";
+    private apiKey;
+    private baseUrl;
+    private health;
+    constructor(options: OpenAIAPIOptions);
+    probe(): Promise<ProbeResult>;
+    execute(params: CreateParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<RelayResult>;
+    streamRaw(params: CreateParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<AsyncIterable<any>>;
+    estimateCost(params: CreateParams): CostEstimate;
+    getHealth(): ProviderHealth;
+    reportRateLimit(event: RateLimitEvent): void;
+    private buildHeaders;
+    private buildRequestBody;
+    private handleErrorResponse;
+    private recordSuccess;
+}
+
+interface OllamaOptions {
+    baseUrl?: string;
+}
+declare class OllamaProvider extends BaseProvider {
+    readonly type = "ollama";
+    readonly supportsStreaming = true;
+    readonly supportsMultimodal = false;
+    readonly platformRequirement: "desktop";
+    private baseUrl;
+    private health;
+    constructor(options?: OllamaOptions);
+    probe(): Promise<ProbeResult>;
+    execute(params: CreateParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<RelayResult>;
+    streamRaw(params: CreateParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<AsyncIterable<any>>;
+    estimateCost(params: CreateParams): CostEstimate;
+    getHealth(): ProviderHealth;
+    reportRateLimit(event: RateLimitEvent): void;
+    private buildRequestBody;
+    private handleErrorResponse;
+    private recordSuccess;
+}
+
+/**
+ * Typed façade over Node's synchronous EventEmitter. Used by FallbackEngine
+ * to emit lifecycle events that the TelemetryReporter buffers per-call and
+ * flushes into a coherent AuditEvent at terminal stream_complete.
+ *
+ * MUST be synchronous (Node EventEmitter is). Do NOT replace with a custom
+ * Promise/microtask-queued impl — audit-event ordering depends on synchronous
+ * listener invocation so that lineage is fully buffered before flushLineageForCall
+ * runs.
+ */
+declare class EngineEventEmitter extends EventEmitter {
+    constructor();
+    emitTyped(event: EngineEvent): boolean;
+    onTyped<K extends EngineEvent['kind']>(kind: K, listener: (event: Extract<EngineEvent, {
+        kind: K;
+    }>) => void): this;
+    offTyped<K extends EngineEvent['kind']>(kind: K, listener: (event: Extract<EngineEvent, {
+        kind: K;
+    }>) => void): this;
+}
+
+interface FallbackOptions {
+    signal?: AbortSignal;
+    maxAttempts?: number;
+    /** Maximum mid-stream failovers per call. Default: 2. */
+    maxMidStreamFailovers?: number;
+    /** Security state of the licence chain. SEC_DEGRADED enables jitter. */
+    licenseState?: SecurityState$1;
+}
+interface HealthRecord {
+    status: ProviderHealth['status'];
+    lastError?: string;
+    updatedAt: number;
+}
+declare class RelayError extends Error {
+    readonly code = "ALL_PROVIDERS_FAILED";
+    readonly fallbackChain: string[];
+    constructor(chain: string[]);
+}
+declare class FallbackEngine {
+    /** Tracks provider health across calls. Keyed by provider type string. */
+    private healthMap;
+    /**
+     * Public lifecycle event emitter. The TelemetryReporter subscribes to this
+     * to buffer per-call lineage and flush a coherent AuditEvent at terminal
+     * stream_complete. Synchronous semantics — see telemetry/engine-events.ts.
+     */
+    readonly engineEvents: EngineEventEmitter;
+    /** Unhealthy providers recover after 5 minutes (allows retry after transient failures). */
+    private static readonly UNHEALTHY_TTL_MS;
+    getHealthStatus(providerType: string): HealthRecord['status'];
+    markUnhealthy(providerType: string, reason: string): void;
+    markDegraded(providerType: string, reason: string): void;
+    markHealthy(providerType: string): void;
+    resetHealth(): void;
+    execute(params: CreateParams, providers: BaseProvider[], options?: FallbackOptions): Promise<RelayResult>;
+    stream(params: CreateParams, providers: BaseProvider[], options?: FallbackOptions): Promise<RelayStream>;
+    /**
+     * Find the next provider in priority order after `current` that supports
+     * streaming AND has not already been tried-and-failed in this call.
+     *
+     * IMPORTANT: this method intentionally does NOT consult `getHealthStatus`.
+     * Type-health is keyed by provider type string, but the documented "two
+     * API keys for redundancy" pattern uses two instances of the SAME type
+     * (e.g. primary + backup AnthropicAPIProvider with different keys). If we
+     * skipped by type-health, the first instance failing would poison the
+     * second instance because they share the type string. Per-call exclusion
+     * by INSTANCE preserves global health-tracking semantics for the next
+     * call's connect-time loop while letting same-type siblings serve as
+     * legitimate failover targets.
+     */
+    private nextHealthyProvider;
+    /**
+     * Internal emit shim — keeps the public emit API tight.
+     */
+    private emitEngineEvent;
+    /**
+     * Emit a stream_complete event on the terminal exhaustion path so the
+     * reporter flushes its lineage buffer for this callId and we don't leak
+     * Map entries forever (bug C3).
+     */
+    private emitTerminalExhaustion;
+}
+
+/**
+ * Model Registry — Single Source of Truth
+ *
+ * v1.4.0: expanded from alias-only to a full registry with capabilities,
+ * pricing, and provider ownership. The `equivalents` field (cross-provider
+ * model mapping) is intentionally absent here — it lives in the gateway
+ * bundle as trade-secret IP.
+ *
+ * Public consumers use the helpers at the bottom (findModel, providerForModel,
+ * modelsForProvider) to enumerate and route. The backwards-compat
+ * MODEL_ALIASES + normalizeModel() exports are preserved.
+ */
+type ProviderType = 'anthropic-api' | 'openai-api' | 'ollama' | 'claude-cli';
+interface ModelEntry {
+    /** Canonical short name customers use */
+    canonical: string;
+    /** Provider-specific dated/full ID (passed to the API) */
+    apiId: string;
+    /** Which provider class handles this model */
+    provider: ProviderType;
+    /** Capabilities the model supports */
+    capabilities: {
+        streaming: boolean;
+        tools: boolean;
+        multimodal: boolean;
+        /** Max context window in tokens */
+        contextWindow: number;
+    };
+    /** Pricing per million tokens [input, output] — undefined for local models */
+    pricing?: [number, number];
+}
+declare const MODEL_REGISTRY: ModelEntry[];
+declare const MODEL_ALIASES: Record<string, string>;
+declare function normalizeModel(model: string): string;
+declare function findModel(canonical: string): ModelEntry | undefined;
+declare function providerForModel(canonical: string): ProviderType | undefined;
+declare function modelsForProvider(provider: ProviderType): ModelEntry[];
+
+/**
+ * Detect Claude CLI installation status.
+ *
+ * This is the public, lightweight binary-presence check. It runs entirely
+ * within the public package and only checks (a) is the binary installed
+ * (b) what version (c) version-drift warning. It does NOT check credential
+ * status — that requires reading OS keychain stores, which is gateway-only.
+ *
+ * The `authenticated` field returned here is `null` to signal "not yet
+ * checked." The LazyClaudeCLIProvider's probe() method calls this AND
+ * the gateway-loaded credential resolver to fill in the full picture.
+ *
+ * Customers who want the full probe (including authenticated status)
+ * should use `relay.providers[0].probe()` once the relay is constructed.
+ */
+declare function detectCLI(): Promise<ProbeResult>;
+
+/**
+ * Validates an Anthropic API key by making a minimal request.
+ * 200 -> valid, 401 -> invalid, 429/529 -> valid but rate limited/overloaded.
+ */
+declare function validateAnthropicKey(apiKey: string): Promise<{
+    valid: boolean;
+    error?: string;
+}>;
+
+interface CLIManifest {
+    version: string;
+    cliVersion: string;
+    eventTypes: {
+        system: string;
+        streamEvent: string;
+        assistant: string;
+        result: string;
+    };
+    fieldMappings: {
+        sessionId: string;
+        model: string;
+        cliVersion: string;
+        content: string;
+        usage: string;
+        inputTokens: string;
+        outputTokens: string;
+        stopReason: string;
+        isError: string;
+        totalCostUsd: string;
+        durationMs: string;
+        error: string;
+        event: string;
+    };
+    syntheticModel: string;
+}
+type SecurityState = 'SEC_NOMINAL' | 'SEC_CACHE' | 'SEC_RECOVERY' | 'SEC_DEGRADED';
+declare class ManifestDecryptor {
+    private verificationFailures;
+    private cachedManifest;
+    private currentSecurityState;
+    /**
+     * Verify a JWS-signed manifest from the backend.
+     * The server signs with RS256 private key; we verify with the embedded public key.
+     */
+    verifyManifest(jwsString: string): Promise<{
+        manifest: CLIManifest;
+        securityState: SecurityState;
+    }>;
+    getSecurityState(): SecurityState;
+    clearCache(): void;
+}
+declare function getLastKnownGoodManifest(): CLIManifest;
+/**
+ * Path-based value accessor for manifest field mappings.
+ * Zero-dependency alternative to lodash.get().
+ * Prototype pollution guarded.
+ */
+declare function getValue(obj: any, path: string): any;
+
+declare class TelemetryReporter {
+    private endpoint;
+    private enabled;
+    private keyId;
+    /**
+     * Lineage buffer: per-call accumulation of EngineEvents from FallbackEngine.
+     * Flushed into the AuditEvent.lineage field at terminal stream_complete.
+     * Keyed by callId so concurrent calls don't cross-contaminate.
+     */
+    private lineageBuffer;
+    /** Stored unsubscribe handlers so dispose() can detach cleanly. */
+    private unsubscribers;
+    constructor(options: {
+        endpoint?: string;
+        enabled?: boolean;
+        keyId?: string;
+    });
+    /**
+     * Subscribe to the FallbackEngine's lifecycle event stream. The reporter
+     * buffers per-call lineage and flushes a coherent AuditEvent at terminal
+     * stream_complete. Synchronous emit semantics from EngineEventEmitter
+     * guarantee that all lineage events for a callId are buffered before
+     * the stream_complete handler runs.
+     */
+    subscribeToEngine(engine: FallbackEngine): void;
+    /** Detach all engine subscriptions. Called by InferenceRelay.dispose(). */
+    unsubscribe(): void;
+    private bufferLineageEvent;
+    /**
+     * Construct the final AuditEvent from the stream_complete payload + buffered
+     * lineage and call report(). Privacy invariant: lineage carries IDs only,
+     * never content.
+     */
+    private flushLineageForCall;
+    report(event: AuditEvent): void;
+}
+
+type RoutingDecision = 'prefer-user' | 'prefer-app' | string;
+type RoutingFunction = (params: CreateParams, estimate: {
+    estimatedCost: number;
+}) => RoutingDecision;
+/**
+ * Apply routing decision to reorder providers.
+ * 'prefer-user' puts subscription-backed providers first (claude-cli, then user API keys).
+ * 'prefer-app' puts app-owned providers first (app API key).
+ * A specific provider name puts that provider first.
+ */
+declare function applyRouting(providers: BaseProvider[], decision: RoutingDecision): BaseProvider[];
+/**
+ * Create a routing function from a RoutingConfig.
+ */
+declare function createRoutingFunction(config: RoutingConfig): RoutingFunction;
+
+/**
+ * Estimate the cost of a request before sending it.
+ * Used by routing to decide which provider handles the call.
+ */
+declare function estimateCost(params: CreateParams): CostEstimate;
+
+/**
+ * Get pricing for a model. Falls back to Sonnet pricing for unknown models.
+ */
+declare function getModelPricing(model: string): [number, number];
+
+/**
+ * CredentialStore — secure local storage for user API keys.
+ * Keys never leave the client. Never sent to inference-relay servers.
+ */
+interface CredentialStore {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    has(key: string): Promise<boolean>;
+}
+
+/**
+ * Electron safeStorage credential store.
+ *
+ * Uses Electron's safeStorage.encryptString() / decryptString() to protect
+ * API keys at rest. Encrypted blobs are persisted as a JSON file in the
+ * user's data directory (~/.inference-relay/credentials.enc by default).
+ *
+ * Falls back to an in-memory Map if safeStorage is unavailable (e.g. when
+ * running outside Electron or before the app is ready).
+ */
+declare class ElectronCredentialStore implements CredentialStore {
+    private filePath;
+    private safeStorage;
+    private memoryFallback;
+    constructor(options?: {
+        storagePath?: string;
+    });
+    private readDisk;
+    private writeDisk;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    has(key: string): Promise<boolean>;
+}
+
+/**
+ * IndexedDB credential store with AES-GCM encryption via Web Crypto API.
+ *
+ * Encryption key is derived from a user-provided passphrase (PBKDF2) or,
+ * if no passphrase is given, a random key is generated and held in
+ * sessionStorage for the lifetime of the browser tab. This means
+ * credentials survive page refreshes within the same session but are
+ * wiped when the tab closes — a deliberate safety tradeoff.
+ */
+declare class IndexedDBCredentialStore implements CredentialStore {
+    private dbName;
+    private storeName;
+    private cryptoKey;
+    private passphrase?;
+    private initPromise;
+    constructor(options?: {
+        passphrase?: string;
+        dbName?: string;
+    });
+    private ensureReady;
+    private init;
+    private openDB;
+    private idbGet;
+    private idbPut;
+    private idbDelete;
+    private idbHas;
+    private getOrCreateSessionSalt;
+    private deriveKey;
+    private encrypt;
+    private decrypt;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    has(key: string): Promise<boolean>;
+}
+
+/**
+ * In-memory credential store. Volatile — cleared on process exit.
+ * Suitable for testing, CLI apps, or as a fallback when no persistent
+ * storage backend is available.
+ */
+declare class MemoryCredentialStore implements CredentialStore {
+    private store;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    has(key: string): Promise<boolean>;
+}
+
+/**
+ * GatewayLoader — fetches the signed Native Subscription Gateway bundle
+ * from the Protocol Authority on first use, verifies it against the
+ * embedded RSA public key, caches it locally, and loads it into the
+ * relay process via vm.Script.
+ *
+ * The bundle contains the implementation of the gateway providers
+ * (subscription-bridged providers, stream parsers, credential resolvers).
+ * It is NOT distributed via npm — it lives in Convex blob storage on the
+ * Protocol Authority and is downloaded on demand by license holders.
+ *
+ * This file is bundled INTO the public npm package (no IP here). It is
+ * the ONLY thing the public package needs to know about the gateway —
+ * after `await GatewayLoader.load(licenseKey)`, the loader returns the
+ * gateway module's exports as a plain object. Callers (specifically
+ * gateway/lazy-provider.ts) treat that object as opaque.
+ *
+ * Threat model:
+ * - Non-customer cannot fetch the bundle: the Protocol Authority's
+ *   /v1/gateway/fetch endpoint requires a valid license key. Bundles are
+ *   served via short-TTL pre-signed URLs.
+ * - MITM attacker cannot substitute a malicious bundle: the bundle ships
+ *   with an RS256 signature over `{ version, sha256, purpose: 'gateway-bundle' }`,
+ *   verified against the embedded RSA public key. Cross-payload confusion
+ *   is prevented by the `purpose` field — a manifest signature cannot be
+ *   replayed as a gateway-bundle signature and vice versa.
+ * - Customer who leaks bundle: contractual problem (covered by EULA).
+ *   Each bundle has a build identifier embedded; leaked copies are
+ *   identifiable.
+ * - Local cache tampering: bundle SHA-256 is verified against the
+ *   server-asserted SHA-256 before loading. A tampered cache file fails
+ *   verification and triggers a fresh fetch.
+ * - Gateway endpoint outage: fail closed. The relay cannot serve
+ *   claude-cli requests until the gateway is reachable. The user can
+ *   still configure direct API providers as a fallback.
+ */
+/**
+ * The shape of the gateway module's exports after loading. The lazy
+ * proxies use these to instantiate concrete implementations without the
+ * public package needing to know any internal details.
+ */
+interface GatewayModule {
+    ClaudeCLIProvider: new () => any;
+    ProcessPool: new (options?: {
+        maxSize?: number;
+        idleTimeoutMs?: number;
+    }) => any;
+    _lsp?: (model: string, baseUrl: string) => Promise<boolean>;
+    _lspClear?: () => void;
+    _lt?: (tools: any[]) => any[];
+    _lpc?: (toolCalls: any[]) => any[];
+    _lpsc?: (chunk: any, state: any) => any[];
+    _lcss?: () => any;
+    _rfp?: (model: string, targetProvider: string) => string | undefined;
+    _cfc?: (model: string) => string[];
+    _ge?: (model: string) => Record<string, string> | undefined;
+    _saf?: (input: any) => any | null;
+}
+/**
+ * Errors thrown by the loader. Designed to be matched against by error
+ * classification code in fallback/engine.ts and verify.ts so customer-
+ * facing diagnostics stay structured.
+ */
+declare class GatewayLoaderError extends Error {
+    readonly code: 'GATEWAY_FETCH_FAILED' | 'LICENSE_REJECTED' | 'NETWORK_TIMEOUT' | 'GATEWAY_VERIFICATION_FAILED' | 'GATEWAY_CACHE_WRITE_FAILED' | 'GATEWAY_LOAD_FAILED';
+    readonly cause?: unknown | undefined;
+    constructor(message: string, code: 'GATEWAY_FETCH_FAILED' | 'LICENSE_REJECTED' | 'NETWORK_TIMEOUT' | 'GATEWAY_VERIFICATION_FAILED' | 'GATEWAY_CACHE_WRITE_FAILED' | 'GATEWAY_LOAD_FAILED', cause?: unknown | undefined);
+}
+declare class GatewayLoader {
+    /**
+     * Load (or resolve from cache) the gateway module for a given license
+     * key. On first call, fetches from the Protocol Authority, verifies the
+     * signature, writes to local cache, and instantiates the module.
+     *
+     * @param licenseKey - The customer's license key (`ir_live_…`)
+     * @param libraryVersion - The library version, used as the cache namespace
+     * @param baseUrl - Override the gateway endpoint (test fixture only)
+     */
+    static load(licenseKey: string, libraryVersion: string, baseUrl?: string): Promise<GatewayModule>;
+    /**
+     * Test helper: bypass the network and load from a local file path.
+     * Used by tests and by the airgapped pre-fetch flow.
+     */
+    static loadFromDisk(bundlePath: string): Promise<GatewayModule>;
+    private static tryLoadFromDisk;
+    private static fetchFromAuthority;
+    /**
+     * Verify the RS256 signature over
+     * { libraryVersion, bundleVersion, sha256, purpose: 'gateway-bundle' }.
+     *
+     * The `purpose` field is mandatory — a payload signed for `manifest`
+     * cannot be replayed here. The `libraryVersion` field is the
+     * version-rollback guard: a 1.3.0 bundle's signature cannot be replayed
+     * to satisfy a 1.4.0 client (the SHA-256 also pins the bytes, but
+     * comparing libraryVersion catches the case where an attacker somehow
+     * generates a SHA collision OR substitutes a different bundle whose
+     * libraryVersion field doesn't match what the client requested).
+     * The signature itself is a JWS compact form.
+     */
+    private static verifySignature;
+    /**
+     * Execute the gateway bundle as a CommonJS module.
+     *
+     * The bundle is a CJS module — it expects `module.exports = { ClaudeCLIProvider, ... }`
+     * after evaluation. We use Node's `vm.compileFunction` API, which is
+     * the same primitive Node's own CJS loader uses internally to evaluate
+     * every .js file in a Node process. The gateway bundle gets called as
+     * if it were a normal CJS module: with explicit `exports`, `require`,
+     * `module`, `__filename`, and `__dirname` parameters.
+     *
+     * Why not vm.Script + createContext: that approach captures `require`
+     * from the parent (loader.ts) module's scope, which under tsup ESM
+     * compilation becomes a dynamic-require shim that throws inside the
+     * sandbox. compileFunction passes `require` as an explicit named
+     * argument, so the gateway bundle's bare `require()` calls resolve to
+     * the function parameter, never to a captured outer-scope wrapper.
+     *
+     * The require we pass is built via createRequire() bound to a path
+     * inside the local cache directory. Node built-in modules resolve
+     * via this require regardless of the bound path; the path only
+     * matters for relative file resolves, which the gateway bundle does
+     * not perform (it's self-contained).
+     *
+     * Trust model: by accepting the EULA, the customer agrees that the
+     * gateway bundle runs with the privileges of their Node process.
+     * Removing the vm.Script sandbox does not change this — the prior
+     * sandbox provided full `require` access anyway, so it was security
+     * theater. compileFunction is more honest: the gateway runs with the
+     * same Node API surface as any other CJS file in the host process.
+     */
+    private static loadIntoVm;
+    /**
+     * Test helper: clear the in-process module cache. Tests use this between
+     * cases to force a fresh load.
+     */
+    static clearCache(): void;
+}
+
+export { AnthropicAPIProvider, AuditEvent, BaseProvider, type CLIManifest, CostEstimate, CreateParams, type CredentialStore, ElectronCredentialStore, EngineEvent, EngineEventEmitter, FallbackEngine, GatewayLoader, GatewayLoaderError, type GatewayModule, IndexedDBCredentialStore, InferenceRelay, InferenceRelayConfig, type LicenseValidation, MODEL_ALIASES, MODEL_REGISTRY, ManifestDecryptor, MemoryCredentialStore, type ModelEntry, OllamaProvider, OpenAIAPIProvider, ProbeResult, ProviderHealth, type ProviderType, RateLimitEvent, RelayError, RelayResult, RelayStream, RoutingConfig, type RoutingDecision, type RoutingFunction, SecurityState$1 as SecurityState, TelemetryReporter, applyRouting, createRoutingFunction, detectCLI, estimateCost, findModel, getLastKnownGoodManifest, getModelPricing, getValue, modelsForProvider, normalizeModel, providerForModel, validateAnthropicKey, validateLicense };