inference-relay 1.6.13 → 1.6.14

package/dist/index.d.cts

@@ -1,953 +0,0 @@
-import { C as CreateParams, R as RelayResult, I as InferenceRelayConfig, P as ProbeResult, a as CostEstimate, b as ProviderHealth, c as RateLimitEvent, E as EngineEvent, S as SecurityState$1, A as AuditEvent, d as RoutingConfig } from './index-yGhLy31i.cjs';
-export { e as ConcurrencyConfig, f as ContentBlock, M as Message, g as ProviderConfig, h as RelayCapExceededError, i as SecureEnclaveConfig, j as SecureEnclaveCredentials, k as SegmentUsage } from './index-yGhLy31i.cjs';
-import { RelayStream } from './stream/index.cjs';
-export { createRelayStream } from './stream/index.cjs';
-import { EventEmitter } from 'node:events';
-
-/**
- * The relay's version and what its roads keep, for its caller (1.6.10, 9 Nov 2026).
- *
- * A caller that streams (a desktop app, for one) has to know, BEFORE it chooses the streamed road, whether the relay it
- * runs keeps the whole request there. Published 1.6.8's streamed road sent the model only the system prompt and the last message, and
- * returned tool names prefixed mcp__r__; 1.6.10's streamed road runs the queue route's own round (claude-cli streamRaw over executeImpl),
- * so every message, every tool_use and tool_result block, and the bare tool names survive.
- *
- * Read it with no call and no network:
- *   import { RELAY_VERSION, RELAY_FEATURES, relayHello } from 'inference-relay';
- *   RELAY_FEATURES.streamKeepsHistory === true      // the one test a caller needs; undefined on 1.6.8 and earlier (no such export)
- *   relayHello()  // { name: 'inference-relay', version: '1.6.10', features: { streamKeepsHistory: true, ... } }
- * or on an instance: relay.version, relay.features, relay.hello() (and InferenceRelay.version).
- *
- * A caller that may run an OLDER relay (1.6.8 and earlier have none of these exports) must not import them by name: a static
- * `import { RELAY_FEATURES }` of a missing export is a hard error in ESM and in strict bundlers. Read them off the module instead, with
- * optional access, so an old relay reads as "does not keep history":
- *   const ir = await import('inference-relay');            // or: import * as ir from 'inference-relay'
- *   const keepsHistory = ir.RELAY_FEATURES?.streamKeepsHistory === true;
- *
- * The flags describe the claude-cli streamed road of the gateway bundle published with this library version: the library fetches the
- * bundle by its own version (gateway/lazy-provider.ts, LIBRARY_VERSION), so a 1.6.10 library always runs the 1.6.10 bundle.
- */
-declare const RELAY_VERSION: string;
-interface RelayFeatures {
-    /** The streamed road sends the model every message of the request (earlier turns, a tool round's call and result), as the queue road does. */
-    readonly streamKeepsHistory: boolean;
-    /** tool_use and tool_result content blocks in the request survive on the streamed road. */
-    readonly streamToolBlocks: boolean;
-    /** Tool names on the streamed road come back as the caller declared them (no mcp__r__ prefix, no CLI caller field). */
-    readonly streamBareToolNames: boolean;
-    /** 1.6.12, the claude-cli provider only (kimi-cli unchanged): a caller that goes (its signal aborts, or a stream's reader stops) stops the CLI run within seconds on both roads, a Stop given
-     *  before the call starts no run, and an aborted call fails as an AbortError, never a cut answer handed back as finished. The signal is read
-     *  from create(params, { signal }) and also from create({ ...params, signal }). Undefined on 1.6.11 and earlier. */
-    readonly stopsWhenCallerGoes: boolean;
-    /** 1.6.13, the claude-cli provider only (kimi-cli unchanged): a call with max_tokens ends at the FIRST output cap, with the text written so
-     *  far and stop_reason "max_tokens", on both roads. The CLI is stopped there, before its own "Resume directly" continuations (which ran
-     *  a capped call to about 4 x max_tokens, ending end_turn when the model finished inside one). Undefined on 1.6.12 and earlier. */
-    readonly stopsAtFirstCap: boolean;
-}
-declare const RELAY_FEATURES: RelayFeatures;
-interface RelayHello {
-    readonly name: 'inference-relay';
-    readonly version: string;
-    readonly features: RelayFeatures;
-}
-/** One object a caller can log, send to its server, or put on a response header (JSON). */
-declare function relayHello(): RelayHello;
-
-interface LicenseValidation {
-    valid: boolean;
-    tier?: string;
-    features?: string[];
-    expiresAt?: number | null;
-    /**
-     * Effective cap: base cap plus any in-cycle top-up grants. Kept as the
-     * `usageCap` field for backward compat — the library has always compared
-     * against this.
-     */
-    usageCap?: number | null;
-    /** Raw base cap (before top-ups). Optional for back-compat. */
-    baseCap?: number | null;
-    /** Sum of active top-up grants for the current cycle. */
-    topUpGrants?: number;
-    /**
-     * Bumped by the backend on every top-up purchase. Library uses this to
-     * short-circuit the normal validation cache: if the cached entry has an
-     * older `lastCapChange` than the server, force a re-validate immediately.
-     * Enables sub-30s recovery after a top-up.
-     */
-    lastCapChange?: number;
-    usageThisMonth?: number;
-    capExceeded?: boolean;
-    error?: string;
-}
-/**
- * Validate a license key against the inference-relay backend.
- *
- * SECURITY: This is the SOLE authoritative implementation of license verification
- * in the entire monorepo. The Pro package re-exports this function rather than
- * reimplementing it. Do NOT copy this logic into other packages — single source
- * of truth for the asymmetric (RS256) trust chain.
- *
- * - Verifies JWS signatures from the Protocol Authority
- * - Rejects unsigned valid:true responses (MITM protection — fail-closed)
- * - Caches positive results for 24h, negative for 60s
- * - Falls back to cached result on network failure within 7-day staleness window
- */
-declare function validateLicense(key: string, endpoint?: string): Promise<LicenseValidation>;
-declare class InferenceRelay {
-    /** This library's version (package.json at build time), e.g. '1.6.10'. Also exported as RELAY_VERSION. */
-    static readonly version: string;
-    /** This library's version, for a caller holding an instance. */
-    get version(): string;
-    /** What this relay's roads keep (src/version.ts). A caller lifts a one-message streaming guard only when streamKeepsHistory is true. */
-    get features(): RelayFeatures;
-    /** { name, version, features }: one object a caller can log or send on (no call, no network). */
-    hello(): RelayHello;
-    private providers;
-    private config;
-    private fallbackEngine;
-    private telemetryReporter;
-    private routingFn;
-    private license;
-    private licensePromise;
-    private licenseValidatedAt;
-    private callsSinceValidation;
-    private manifestDecryptor;
-    private capProbeTimer;
-    private capProbeTicksRemaining;
-    messages: {
-        create(params: CreateParams & {
-            stream?: false;
-        }, options?: {
-            signal?: AbortSignal;
-        }): Promise<RelayResult>;
-        create(params: CreateParams & {
-            stream: true;
-        }, options?: {
-            signal?: AbortSignal;
-        }): Promise<RelayStream>;
-        create(params: CreateParams, options?: {
-            signal?: AbortSignal;
-        }): Promise<RelayResult | RelayStream>;
-    };
-    constructor(config: InferenceRelayConfig);
-    /**
-     * Start the High-Frequency Probe: background poll of /v1/validate every
-     * 15 seconds for up to 5 minutes. Exits early when `lastCapChange` differs
-     * from the cached value — meaning a top-up purchase has landed — at which
-     * point the normal validation cache takes over and the next inference call
-     * succeeds.
-     *
-     * Idempotent: a second call while a probe is already running is a no-op.
-     * Properly cleaned up in dispose() so there are no timer leaks.
-     */
-    private startCapProbe;
-    /**
-     * Single validation call used by the cap probe loop. Extracted as a
-     * method so tests can override it without going through the RS256 JWS
-     * verification path. Production behavior delegates to the module-level
-     * validateLicense() function, which is the sole authoritative source of
-     * truth for the asymmetric trust chain.
-     */
-    private probeValidate;
-    private stopCapProbe;
-    static autoDetect(config?: Partial<InferenceRelayConfig>): Promise<InferenceRelay>;
-    /**
-     * Pre-flight: trigger the gateway bundle fetch + load now, so subsequent
-     * `messages.create` / `stream` calls don't pay the cold-start latency
-     * (and don't surface a gateway outage as a confusing chained provider
-     * error). Throws `GatewayUnavailableError` on sustained outage so the
-     * caller can early-skip a test cluster cleanly.
-     *
-     * No-op when the cascade has no claude-cli provider (API-only deployment).
-     * On failure, the lazy provider's `loadingPromise` is reset so the next
-     * call retries from scratch — `warmup()` doesn't poison subsequent calls.
-     *
-     * Added in 1.6.2.
-     */
-    warmup(): Promise<void>;
-    /**
-     * Clear all provider-health state on this client's fallback engine.
-     *
-     * Use between bench tasks, between user sessions, or after handling a
-     * known-transient upstream incident (e.g., a subscription auth flap
-     * that's been resolved). Equivalent to calling `markHealthy` for every
-     * provider type — every provider's next call gets a fresh attempt.
-     *
-     * Added in 1.6.4. Replaces the deep-import workaround
-     * `client.fallbackEngine.resetHealth()` (which relied on TypeScript
-     * `private` being compile-time-only).
-     */
-    resetHealth(): void;
-    /**
-     * Clear the unhealthy mark for a single provider type. Useful when you
-     * want to reset just (e.g.) `claude-cli` after a transient auth flap
-     * without disturbing other providers' degraded/rate-limited state.
-     *
-     * Provider type strings: `claude-cli`, `anthropic-api`, `openai-api`,
-     * `ollama`, plus any custom-provider type names you've registered.
-     *
-     * Added in 1.6.4.
-     */
-    markHealthy(providerType: string): void;
-    dispose(): void;
-    private resolveProviders;
-    private executeMessage;
-    private streamMessage;
-    private createProvider;
-}
-
-declare abstract class BaseProvider {
-    abstract readonly type: string;
-    abstract readonly supportsStreaming: boolean;
-    abstract readonly supportsMultimodal: boolean;
-    abstract readonly platformRequirement: 'desktop' | 'web' | 'any';
-    priority: number;
-    abstract probe(): Promise<ProbeResult>;
-    abstract execute(params: CreateParams, options?: {
-        signal?: AbortSignal;
-    }): Promise<RelayResult>;
-    /**
-     * Lower-level streaming entrypoint. Returns the raw provider event iterator
-     * with NO RelayStream wrapping. The FallbackEngine consumes streamRaw()
-     * directly so it can run mid-stream failover, accumulate state, and wrap
-     * the final output in createRelayStream exactly once.
-     *
-     * Returns a Promise so eager setup (auth, spawn, fetch) happens BEFORE the
-     * iterator is returned. This matches the previous stream() semantics — by
-     * the time streamRaw() resolves, any side effects (subprocess spawn, HTTP
-     * connection) have already started.
-     *
-     * Providers MUST override either streamRaw() OR stream() (preferably
-     * streamRaw — stream() will be removed once all callers migrate).
-     */
-    streamRaw(_params: CreateParams, _options?: {
-        signal?: AbortSignal;
-    }): Promise<AsyncIterable<any>>;
-    /**
-     * Default RelayStream wrapper. Most providers should NOT override this —
-     * implement streamRaw() instead. Kept as an instance method (not abstract)
-     * for backward compatibility with callers that hit providers directly.
-     */
-    stream(params: CreateParams, options?: {
-        signal?: AbortSignal;
-    }): Promise<RelayStream>;
-    abstract estimateCost(params: CreateParams): CostEstimate;
-    abstract getHealth(): ProviderHealth;
-    abstract reportRateLimit(event: RateLimitEvent): void;
-}
-
-interface AnthropicAPIOptions {
-    apiKey: string;
-    baseUrl?: string;
-    /** Set true when running in a browser context */
-    dangerousDirectBrowserAccess?: boolean;
-}
-declare class AnthropicAPIProvider extends BaseProvider {
-    readonly type = "anthropic-api";
-    readonly supportsStreaming = true;
-    readonly supportsMultimodal = true;
-    readonly platformRequirement: "any";
-    private apiKey;
-    private baseUrl;
-    private dangerousDirectBrowserAccess;
-    private health;
-    constructor(options: AnthropicAPIOptions);
-    probe(): Promise<ProbeResult>;
-    execute(params: CreateParams, options?: {
-        signal?: AbortSignal;
-    }): Promise<RelayResult>;
-    streamRaw(params: CreateParams, options?: {
-        signal?: AbortSignal;
-    }): Promise<AsyncIterable<any>>;
-    estimateCost(params: CreateParams): CostEstimate;
-    getHealth(): ProviderHealth;
-    reportRateLimit(event: RateLimitEvent): void;
-    private buildHeaders;
-    private buildRequestBody;
-    private handleErrorResponse;
-    private recordSuccess;
-}
-
-interface OpenAIAPIOptions {
-    apiKey: string;
-    baseUrl?: string;
-}
-declare class OpenAIAPIProvider extends BaseProvider {
-    readonly type = "openai-api";
-    readonly supportsStreaming = true;
-    readonly supportsMultimodal = true;
-    readonly platformRequirement: "any";
-    private apiKey;
-    private baseUrl;
-    private health;
-    constructor(options: OpenAIAPIOptions);
-    probe(): Promise<ProbeResult>;
-    execute(params: CreateParams, options?: {
-        signal?: AbortSignal;
-    }): Promise<RelayResult>;
-    streamRaw(params: CreateParams, options?: {
-        signal?: AbortSignal;
-    }): Promise<AsyncIterable<any>>;
-    estimateCost(params: CreateParams): CostEstimate;
-    getHealth(): ProviderHealth;
-    reportRateLimit(event: RateLimitEvent): void;
-    private buildHeaders;
-    private buildRequestBody;
-    private handleErrorResponse;
-    private recordSuccess;
-}
-
-interface OllamaOptions {
-    baseUrl?: string;
-}
-declare class OllamaProvider extends BaseProvider {
-    readonly type = "ollama";
-    readonly supportsStreaming = true;
-    readonly supportsMultimodal = false;
-    readonly platformRequirement: "desktop";
-    private baseUrl;
-    private health;
-    constructor(options?: OllamaOptions);
-    probe(): Promise<ProbeResult>;
-    execute(params: CreateParams, options?: {
-        signal?: AbortSignal;
-    }): Promise<RelayResult>;
-    streamRaw(params: CreateParams, options?: {
-        signal?: AbortSignal;
-    }): Promise<AsyncIterable<any>>;
-    estimateCost(params: CreateParams): CostEstimate;
-    getHealth(): ProviderHealth;
-    reportRateLimit(event: RateLimitEvent): void;
-    private buildRequestBody;
-    private handleErrorResponse;
-    private recordSuccess;
-}
-
-/**
- * Typed façade over Node's synchronous EventEmitter. Used by FallbackEngine
- * to emit lifecycle events that the TelemetryReporter buffers per-call and
- * flushes into a coherent AuditEvent at terminal stream_complete.
- *
- * MUST be synchronous (Node EventEmitter is). Do NOT replace with a custom
- * Promise/microtask-queued impl — audit-event ordering depends on synchronous
- * listener invocation so that lineage is fully buffered before flushLineageForCall
- * runs.
- */
-declare class EngineEventEmitter extends EventEmitter {
-    constructor();
-    emitTyped(event: EngineEvent): boolean;
-    onTyped<K extends EngineEvent['kind']>(kind: K, listener: (event: Extract<EngineEvent, {
-        kind: K;
-    }>) => void): this;
-    offTyped<K extends EngineEvent['kind']>(kind: K, listener: (event: Extract<EngineEvent, {
-        kind: K;
-    }>) => void): this;
-}
-
-interface FallbackOptions {
-    signal?: AbortSignal;
-    maxAttempts?: number;
-    /** Maximum mid-stream failovers per call. Default: 2. */
-    maxMidStreamFailovers?: number;
-    /** Security state of the licence chain. SEC_DEGRADED enables jitter. */
-    licenseState?: SecurityState$1;
-    /**
-     * Maximum same-provider retries on `transient` failures (e.g., Bun
-     * crash on Windows). Default: 2. Set to 0 to disable retries (failure
-     * immediately cascades to the next provider). Added 1.6.6.
-     */
-    maxSameProviderRetries?: number;
-    /**
-     * When true, refuses to cascade from `claude-cli` to any paid provider
-     * (`anthropic-api`, `openai-api`). The cascade halts with
-     * `subscription_only:cascade_halted` instead of falling through to a
-     * paid leg. Billing safety net for users with stale ANTHROPIC_API_KEY
-     * in env. Added 1.6.6.
-     */
-    subscriptionOnly?: boolean;
-}
-interface HealthRecord {
-    status: ProviderHealth['status'];
-    lastError?: string;
-    updatedAt: number;
-    /**
-     * TTL override in milliseconds. Optional — when omitted,
-     * `UNHEALTHY_TTL_DEFAULT_MS` is used. Set by `markUnhealthy` for
-     * classifications that auto-recover faster than the default (1.6.4
-     * adds 30s for `auth_failed`).
-     */
-    ttlMs?: number;
-}
-declare class RelayError extends Error {
-    readonly code = "ALL_PROVIDERS_FAILED";
-    readonly fallbackChain: string[];
-    constructor(chain: string[]);
-}
-/**
- * Thrown when the cascade exhausts and every provider failure classified as
- * `request_too_large` — i.e., the prompt exceeded the upstream API's input
- * token ceiling. Subclass of {@link RelayError} so existing
- * `instanceof RelayError` matchers and chain-inspecting code keep working.
- *
- * Callers should branch on `instanceof RequestTooLargeError` and apply
- * domain-specific distillation (drop oldest messages, summarize step
- * trajectories, filter screenshots) before retrying. IR cannot distill the
- * payload itself — it has no semantic understanding of what content matters.
- *
- * Detection: {@link classifyError} matches stderr patterns like
- * `prompt is too long`, `input length`, `request too large`, and tokens-
- * exceed strings. When EVERY provider in the cascade failed with this
- * classification, the cascade throws {@link RequestTooLargeError} instead
- * of vanilla {@link RelayError}. If even one provider failed for a
- * different reason (e.g., auth, gateway), the cascade throws plain
- * `RelayError` and the size-related entries appear in `fallbackChain`.
- *
- * Added in 1.6.3.
- */
-declare class RequestTooLargeError extends RelayError {
-    constructor(chain: string[]);
-}
-declare class FallbackEngine {
-    /** Tracks provider health across calls. Keyed by provider type string. */
-    private healthMap;
-    /**
-     * Public lifecycle event emitter. The TelemetryReporter subscribes to this
-     * to buffer per-call lineage and flush a coherent AuditEvent at terminal
-     * stream_complete. Synchronous semantics — see telemetry/engine-events.ts.
-     */
-    readonly engineEvents: EngineEventEmitter;
-    /**
-     * Default unhealthy TTL — appropriate for infrastructure outages
-     * (`gateway_unavailable`, `provider_incompatible`) that typically take
-     * minutes to resolve. Transient failure classes can override via the
-     * `ttlMs` arg to {@link markUnhealthy}.
-     */
-    static readonly UNHEALTHY_TTL_DEFAULT_MS: number;
-    /**
-     * Shorter TTL for `auth_failed` (1.6.4). Token-rotation flaps and
-     * brief auth-backend hiccups are typically sub-second; 5 minutes was
-     * too aggressive a blast radius for what's usually transient. After
-     * 1.6.4's auth-retry in claude-cli provider, anything that survives
-     * the in-call retry is more likely to be a real auth problem — but
-     * still recoverable in seconds-to-tens-of-seconds, not minutes.
-     */
-    static readonly UNHEALTHY_TTL_AUTH_MS: number;
-    getHealthStatus(providerType: string): HealthRecord['status'];
-    markUnhealthy(providerType: string, reason: string, ttlMs?: number): void;
-    markDegraded(providerType: string, reason: string): void;
-    markHealthy(providerType: string): void;
-    resetHealth(): void;
-    execute(params: CreateParams, providers: BaseProvider[], options?: FallbackOptions): Promise<RelayResult>;
-    stream(params: CreateParams, providers: BaseProvider[], options?: FallbackOptions): Promise<RelayStream>;
-    /**
-     * Find the next provider in priority order after `current` that supports
-     * streaming AND has not already been tried-and-failed in this call.
-     *
-     * IMPORTANT: this method intentionally does NOT consult `getHealthStatus`.
-     * Type-health is keyed by provider type string, but the documented "two
-     * API keys for redundancy" pattern uses two instances of the SAME type
-     * (e.g. primary + backup AnthropicAPIProvider with different keys). If we
-     * skipped by type-health, the first instance failing would poison the
-     * second instance because they share the type string. Per-call exclusion
-     * by INSTANCE preserves global health-tracking semantics for the next
-     * call's connect-time loop while letting same-type siblings serve as
-     * legitimate failover targets.
-     */
-    private nextHealthyProvider;
-    /**
-     * Internal emit shim — keeps the public emit API tight.
-     */
-    private emitEngineEvent;
-    /**
-     * Emit a stream_complete event on the terminal exhaustion path so the
-     * reporter flushes its lineage buffer for this callId and we don't leak
-     * Map entries forever (bug C3).
-     */
-    private emitTerminalExhaustion;
-}
-
-/**
- * Pre-flight input-token estimation for {@link CreateParams}.
- *
- * Lets callers gate distillation (drop screenshots, summarize trajectories,
- * filter DOM bits) BEFORE incurring the round-trip + reject cost of an
- * oversized prompt. The catch-it-after path is `instanceof
- * RequestTooLargeError`; this is the catch-it-before path.
- *
- * **Approximate, not exact.** Anthropic's BPE tokenizer is closed-source;
- * we use the standard 4-chars-per-token heuristic plus per-message
- * overhead. Within ±15% on typical English text. For budgeting against
- * a known ceiling, leave a 20% safety margin (e.g., target 100K when
- * the provider ceiling is 120K).
- *
- * Image content blocks count for `IMAGE_TOKENS_FLAT` each — Anthropic
- * bills images at a flat per-image rate that depends on dimensions, but
- * the size-vs-tokens function is non-linear. The flat estimate is
- * intentionally conservative (overcounts small images, slightly
- * undercounts very large ones) so callers planning around it lean safe.
- *
- * Added in 1.6.3.
- */
-
-/**
- * Estimate the input token count for a `messages.create` request.
- *
- * Counts: system prompt + every message content block (text + JSON-
- * serialized structured blocks) + per-message overhead + flat per-image
- * cost + request overhead. Excludes the `max_tokens` output reservation —
- * callers should add that themselves when budgeting against a context
- * window.
- *
- * @example
- *   const inputTokens = estimateInputTokens(params);
- *   if (inputTokens > 100_000) {
- *     params = distill(params);
- *   }
- *   const result = await client.messages.create(params);
- *
- * @example Budget against a 200K context window:
- *   const total = estimateInputTokens(params) + params.max_tokens;
- *   if (total > 180_000) {
- *     params = distill(params);
- *   }
- */
-declare function estimateInputTokens(params: CreateParams): number;
-
-/**
- * Model Registry — Single Source of Truth
- *
- * v1.4.0: expanded from alias-only to a full registry with capabilities,
- * pricing, and provider ownership. The `equivalents` field (cross-provider
- * model mapping) is intentionally absent here — it lives in the gateway
- * bundle as trade-secret IP.
- *
- * Public consumers use the helpers at the bottom (findModel, providerForModel,
- * modelsForProvider) to enumerate and route. The backwards-compat
- * MODEL_ALIASES + normalizeModel() exports are preserved.
- */
-type ProviderType = 'anthropic-api' | 'openai-api' | 'ollama' | 'claude-cli';
-interface ModelEntry {
-    /** Canonical short name customers use */
-    canonical: string;
-    /** Provider-specific dated/full ID (passed to the API) */
-    apiId: string;
-    /** Which provider class handles this model */
-    provider: ProviderType;
-    /** Capabilities the model supports */
-    capabilities: {
-        streaming: boolean;
-        tools: boolean;
-        multimodal: boolean;
-        /** Max context window in tokens */
-        contextWindow: number;
-    };
-    /** Pricing per million tokens [input, output] — undefined for local models */
-    pricing?: [number, number];
-}
-declare const MODEL_REGISTRY: ModelEntry[];
-declare const MODEL_ALIASES: Record<string, string>;
-declare function normalizeModel(model: string): string;
-declare function findModel(canonical: string): ModelEntry | undefined;
-declare function providerForModel(canonical: string): ProviderType | undefined;
-declare function modelsForProvider(provider: ProviderType): ModelEntry[];
-
-/**
- * Detect Claude CLI installation status.
- *
- * This is the public, lightweight binary-presence check. It runs entirely
- * within the public package and only checks (a) is the binary installed
- * (b) what version (c) version-drift warning. It does NOT check credential
- * status — that requires reading OS keychain stores, which is gateway-only.
- *
- * The `authenticated` field returned here is `null` to signal "not yet
- * checked." The LazyClaudeCLIProvider's probe() method calls this AND
- * the gateway-loaded credential resolver to fill in the full picture.
- *
- * Customers who want the full probe (including authenticated status)
- * should use `relay.providers[0].probe()` once the relay is constructed.
- */
-declare function detectCLI(): Promise<ProbeResult>;
-
-/**
- * Validates an Anthropic API key by making a minimal request.
- * 200 -> valid, 401 -> invalid, 429/529 -> valid but rate limited/overloaded.
- */
-declare function validateAnthropicKey(apiKey: string): Promise<{
-    valid: boolean;
-    error?: string;
-}>;
-
-interface CLIManifest {
-    version: string;
-    cliVersion: string;
-    eventTypes: {
-        system: string;
-        streamEvent: string;
-        assistant: string;
-        result: string;
-    };
-    fieldMappings: {
-        sessionId: string;
-        model: string;
-        cliVersion: string;
-        content: string;
-        usage: string;
-        inputTokens: string;
-        outputTokens: string;
-        stopReason: string;
-        isError: string;
-        totalCostUsd: string;
-        durationMs: string;
-        error: string;
-        event: string;
-    };
-    syntheticModel: string;
-}
-type SecurityState = 'SEC_NOMINAL' | 'SEC_CACHE' | 'SEC_RECOVERY' | 'SEC_DEGRADED';
-declare class ManifestDecryptor {
-    private verificationFailures;
-    private cachedManifest;
-    private currentSecurityState;
-    /**
-     * Verify a JWS-signed manifest from the backend.
-     * The server signs with RS256 private key; we verify with the embedded public key.
-     */
-    verifyManifest(jwsString: string): Promise<{
-        manifest: CLIManifest;
-        securityState: SecurityState;
-    }>;
-    getSecurityState(): SecurityState;
-    clearCache(): void;
-}
-declare function getLastKnownGoodManifest(): CLIManifest;
-/**
- * Path-based value accessor for manifest field mappings.
- * Zero-dependency alternative to lodash.get().
- * Prototype pollution guarded.
- */
-declare function getValue(obj: any, path: string): any;
-
-declare class TelemetryReporter {
-    private endpoint;
-    private enabled;
-    private keyId;
-    /**
-     * Lineage buffer: per-call accumulation of EngineEvents from FallbackEngine.
-     * Flushed into the AuditEvent.lineage field at terminal stream_complete.
-     * Keyed by callId so concurrent calls don't cross-contaminate.
-     */
-    private lineageBuffer;
-    /** Stored unsubscribe handlers so dispose() can detach cleanly. */
-    private unsubscribers;
-    constructor(options: {
-        endpoint?: string;
-        enabled?: boolean;
-        keyId?: string;
-    });
-    /**
-     * Subscribe to the FallbackEngine's lifecycle event stream. The reporter
-     * buffers per-call lineage and flushes a coherent AuditEvent at terminal
-     * stream_complete. Synchronous emit semantics from EngineEventEmitter
-     * guarantee that all lineage events for a callId are buffered before
-     * the stream_complete handler runs.
-     */
-    subscribeToEngine(engine: FallbackEngine): void;
-    /** Detach all engine subscriptions. Called by InferenceRelay.dispose(). */
-    unsubscribe(): void;
-    private bufferLineageEvent;
-    /**
-     * Construct the final AuditEvent from the stream_complete payload + buffered
-     * lineage and call report(). Privacy invariant: lineage carries IDs only,
-     * never content.
-     */
-    private flushLineageForCall;
-    report(event: AuditEvent): void;
-}
-
-type RoutingDecision = 'prefer-user' | 'prefer-app' | string;
-type RoutingFunction = (params: CreateParams, estimate: {
-    estimatedCost: number;
-}) => RoutingDecision;
-/**
- * Apply routing decision to reorder providers.
- * 'prefer-user' puts subscription-backed providers first (claude-cli, then user API keys).
- * 'prefer-app' puts app-owned providers first (app API key).
- * A specific provider name puts that provider first.
- */
-declare function applyRouting(providers: BaseProvider[], decision: RoutingDecision): BaseProvider[];
-/**
- * Create a routing function from a RoutingConfig.
- */
-declare function createRoutingFunction(config: RoutingConfig): RoutingFunction;
-
-/**
- * Estimate the cost of a request before sending it.
- * Used by routing to decide which provider handles the call.
- */
-declare function estimateCost(params: CreateParams): CostEstimate;
-
-/**
- * Get pricing for a model. Falls back to Sonnet pricing for unknown models.
- */
-declare function getModelPricing(model: string): [number, number];
-
-/**
- * CredentialStore — secure local storage for user API keys.
- * Keys never leave the client. Never sent to inference-relay servers.
- */
-interface CredentialStore {
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string): Promise<void>;
-    delete(key: string): Promise<void>;
-    has(key: string): Promise<boolean>;
-}
-
-/**
- * Electron safeStorage credential store.
- *
- * Uses Electron's safeStorage.encryptString() / decryptString() to protect
- * API keys at rest. Encrypted blobs are persisted as a JSON file in the
- * user's data directory (~/.inference-relay/credentials.enc by default).
- *
- * Falls back to an in-memory Map if safeStorage is unavailable (e.g. when
- * running outside Electron or before the app is ready).
- */
-declare class ElectronCredentialStore implements CredentialStore {
-    private filePath;
-    private safeStorage;
-    private memoryFallback;
-    constructor(options?: {
-        storagePath?: string;
-    });
-    private readDisk;
-    private writeDisk;
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string): Promise<void>;
-    delete(key: string): Promise<void>;
-    has(key: string): Promise<boolean>;
-}
-
-/**
- * IndexedDB credential store with AES-GCM encryption via Web Crypto API.
- *
- * Encryption key is derived from a user-provided passphrase (PBKDF2) or,
- * if no passphrase is given, a random key is generated and held in
- * sessionStorage for the lifetime of the browser tab. This means
- * credentials survive page refreshes within the same session but are
- * wiped when the tab closes — a deliberate safety tradeoff.
- */
-declare class IndexedDBCredentialStore implements CredentialStore {
-    private dbName;
-    private storeName;
-    private cryptoKey;
-    private passphrase?;
-    private initPromise;
-    constructor(options?: {
-        passphrase?: string;
-        dbName?: string;
-    });
-    private ensureReady;
-    private init;
-    private openDB;
-    private idbGet;
-    private idbPut;
-    private idbDelete;
-    private idbHas;
-    private getOrCreateSessionSalt;
-    private deriveKey;
-    private encrypt;
-    private decrypt;
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string): Promise<void>;
-    delete(key: string): Promise<void>;
-    has(key: string): Promise<boolean>;
-}
-
-/**
- * In-memory credential store. Volatile — cleared on process exit.
- * Suitable for testing, CLI apps, or as a fallback when no persistent
- * storage backend is available.
- */
-declare class MemoryCredentialStore implements CredentialStore {
-    private store;
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string): Promise<void>;
-    delete(key: string): Promise<void>;
-    has(key: string): Promise<boolean>;
-}
-
-/**
- * GatewayLoader — fetches the signed Native Subscription Gateway bundle
- * from the Protocol Authority on first use, verifies it against the
- * embedded RSA public key, caches it locally, and loads it into the
- * relay process via vm.Script.
- *
- * The bundle contains the implementation of the gateway providers
- * (subscription-bridged providers, stream parsers, credential resolvers).
- * It is NOT distributed via npm — it lives in Convex blob storage on the
- * Protocol Authority and is downloaded on demand by license holders.
- *
- * This file is bundled INTO the public npm package (no IP here). It is
- * the ONLY thing the public package needs to know about the gateway —
- * after `await GatewayLoader.load(licenseKey)`, the loader returns the
- * gateway module's exports as a plain object. Callers (specifically
- * gateway/lazy-provider.ts) treat that object as opaque.
- *
- * Threat model:
- * - Non-customer cannot fetch the bundle: the Protocol Authority's
- *   /v1/gateway/fetch endpoint requires a valid license key. Bundles are
- *   served via short-TTL pre-signed URLs.
- * - MITM attacker cannot substitute a malicious bundle: the bundle ships
- *   with an RS256 signature over `{ version, sha256, purpose: 'gateway-bundle' }`,
- *   verified against the embedded RSA public key. Cross-payload confusion
- *   is prevented by the `purpose` field — a manifest signature cannot be
- *   replayed as a gateway-bundle signature and vice versa.
- * - Customer who leaks bundle: contractual problem (covered by EULA).
- *   Each bundle has a build identifier embedded; leaked copies are
- *   identifiable.
- * - Local cache tampering: bundle SHA-256 is verified against the
- *   server-asserted SHA-256 before loading. A tampered cache file fails
- *   verification and triggers a fresh fetch.
- * - Gateway endpoint outage: fail closed. The relay cannot serve
- *   claude-cli requests until the gateway is reachable. The user can
- *   still configure direct API providers as a fallback.
- */
-/**
- * The shape of the gateway module's exports after loading. The lazy
- * proxies use these to instantiate concrete implementations without the
- * public package needing to know any internal details.
- */
-interface GatewayModule {
-    ClaudeCLIProvider: new () => any;
-    KimiCLIProvider?: new () => any;
-    ProcessPool: new (options?: {
-        maxSize?: number;
-        idleTimeoutMs?: number;
-    }) => any;
-    _lsp?: (model: string, baseUrl: string) => Promise<boolean>;
-    _lspClear?: () => void;
-    _lt?: (tools: any[]) => any[];
-    _lpc?: (toolCalls: any[]) => any[];
-    _lpsc?: (chunk: any, state: any) => any[];
-    _lcss?: () => any;
-    _rfp?: (model: string, targetProvider: string) => string | undefined;
-    _cfc?: (model: string) => string[];
-    _ge?: (model: string) => Record<string, string> | undefined;
-    _saf?: (input: any) => any | null;
-}
-/**
- * Errors thrown by the loader. Designed to be matched against by error
- * classification code in fallback/engine.ts and verify.ts so customer-
- * facing diagnostics stay structured.
- */
-declare class GatewayLoaderError extends Error {
-    readonly code: 'GATEWAY_FETCH_FAILED' | 'LICENSE_REJECTED' | 'NETWORK_TIMEOUT' | 'GATEWAY_VERIFICATION_FAILED' | 'GATEWAY_CACHE_WRITE_FAILED' | 'GATEWAY_LOAD_FAILED';
-    readonly cause?: unknown | undefined;
-    constructor(message: string, code: 'GATEWAY_FETCH_FAILED' | 'LICENSE_REJECTED' | 'NETWORK_TIMEOUT' | 'GATEWAY_VERIFICATION_FAILED' | 'GATEWAY_CACHE_WRITE_FAILED' | 'GATEWAY_LOAD_FAILED', cause?: unknown | undefined);
-}
-/**
- * Thrown specifically when /v1/gateway/fetch exhausts the retry budget —
- * Protocol Authority unreachable, returning 5xx, or DNS/network errored.
- * Branch on `instanceof GatewayUnavailableError` to handle gateway outages
- * separately from license/verification errors (which stay as
- * `GatewayLoaderError`).
- *
- * Inherits `code: 'GATEWAY_FETCH_FAILED'` and `name: 'GatewayLoaderError'`
- * (parent's name is intentionally preserved) so every existing string-match,
- * code-match, and name-match consumer keeps working. The new typed-error
- * path is purely additive — switch to `instanceof GatewayUnavailableError`
- * at your leisure.
- */
-declare class GatewayUnavailableError extends GatewayLoaderError {
-    constructor(message: string, cause?: unknown);
-}
-/**
- * Options for {@link GatewayLoader.load}. Added in 1.6.2 so callers can
- * extend the retry budget for sustained Cloudflare/Convex 502s (the default
- * `[0, 1000, 4000]` exhausts in ~5 seconds, which is too short for some
- * upstream incidents).
- */
-interface GatewayLoadOptions {
-    /**
-     * Per-attempt delay budget in milliseconds. Defaults to
-     * `[0, 1000, 4000]` (3 attempts over ~5s). Env override:
-     * `IR_GATEWAY_RETRY_DELAYS_MS=0,5000,15000,60000`.
-     *
-     * Explicit option wins over env; env wins over default. Malformed values
-     * (non-array, non-numeric, negative) log a `debugLog` warning and fall
-     * back to default — don't throw, so a typo doesn't brick startup.
-     */
-    retryDelaysMs?: number[];
-}
-declare class GatewayLoader {
-    /**
-     * Load (or resolve from cache) the gateway module for a given license
-     * key. On first call, fetches from the Protocol Authority, verifies the
-     * signature, writes to local cache, and instantiates the module.
-     *
-     * @param licenseKey - The customer's license key (`ir_live_…`)
-     * @param libraryVersion - The library version, used as the cache namespace
-     * @param baseUrl - Override the gateway endpoint (test fixture only)
-     * @param options - Optional load-time tuning (e.g., retry budget). Added 1.6.2.
-     */
-    static load(licenseKey: string, libraryVersion: string, baseUrl?: string, options?: GatewayLoadOptions): Promise<GatewayModule>;
-    /**
-     * Test helper: bypass the network and load from a local file path.
-     * Used by tests and by the airgapped pre-fetch flow.
-     */
-    static loadFromDisk(bundlePath: string): Promise<GatewayModule>;
-    private static tryLoadFromDisk;
-    private static fetchFromAuthority;
-    /**
-     * Verify the RS256 signature over
-     * { libraryVersion, bundleVersion, sha256, purpose: 'gateway-bundle' }.
-     *
-     * The `purpose` field is mandatory — a payload signed for `manifest`
-     * cannot be replayed here. The `libraryVersion` field is the
-     * version-rollback guard: a 1.3.0 bundle's signature cannot be replayed
-     * to satisfy a 1.4.0 client (the SHA-256 also pins the bytes, but
-     * comparing libraryVersion catches the case where an attacker somehow
-     * generates a SHA collision OR substitutes a different bundle whose
-     * libraryVersion field doesn't match what the client requested).
-     * The signature itself is a JWS compact form.
-     */
-    private static verifySignature;
-    /**
-     * Execute the gateway bundle as a CommonJS module.
-     *
-     * The bundle is a CJS module — it expects `module.exports = { ClaudeCLIProvider, ... }`
-     * after evaluation. We use Node's `vm.compileFunction` API, which is
-     * the same primitive Node's own CJS loader uses internally to evaluate
-     * every .js file in a Node process. The gateway bundle gets called as
-     * if it were a normal CJS module: with explicit `exports`, `require`,
-     * `module`, `__filename`, and `__dirname` parameters.
-     *
-     * Why not vm.Script + createContext: that approach captures `require`
-     * from the parent (loader.ts) module's scope, which under tsup ESM
-     * compilation becomes a dynamic-require shim that throws inside the
-     * sandbox. compileFunction passes `require` as an explicit named
-     * argument, so the gateway bundle's bare `require()` calls resolve to
-     * the function parameter, never to a captured outer-scope wrapper.
-     *
-     * The require we pass is built via createRequire() bound to a path
-     * inside the local cache directory. Node built-in modules resolve
-     * via this require regardless of the bound path; the path only
-     * matters for relative file resolves, which the gateway bundle does
-     * not perform (it's self-contained).
-     *
-     * Trust model: by accepting the EULA, the customer agrees that the
-     * gateway bundle runs with the privileges of their Node process.
-     * Removing the vm.Script sandbox does not change this — the prior
-     * sandbox provided full `require` access anyway, so it was security
-     * theater. compileFunction is more honest: the gateway runs with the
-     * same Node API surface as any other CJS file in the host process.
-     */
-    private static loadIntoVm;
-    /**
-     * Test helper: clear the in-process module cache. Tests use this between
-     * cases to force a fresh load.
-     */
-    static clearCache(): void;
-}
-
-export { AnthropicAPIProvider, AuditEvent, BaseProvider, type CLIManifest, CostEstimate, CreateParams, type CredentialStore, ElectronCredentialStore, EngineEvent, EngineEventEmitter, FallbackEngine, GatewayLoader, GatewayLoaderError, type GatewayModule, GatewayUnavailableError, IndexedDBCredentialStore, InferenceRelay, InferenceRelayConfig, type LicenseValidation, MODEL_ALIASES, MODEL_REGISTRY, ManifestDecryptor, MemoryCredentialStore, type ModelEntry, OllamaProvider, OpenAIAPIProvider, ProbeResult, ProviderHealth, type ProviderType, RELAY_FEATURES, RELAY_VERSION, RateLimitEvent, RelayError, type RelayFeatures, type RelayHello, RelayResult, RelayStream, RequestTooLargeError, RoutingConfig, type RoutingDecision, type RoutingFunction, SecurityState$1 as SecurityState, TelemetryReporter, applyRouting, createRoutingFunction, detectCLI, estimateCost, estimateInputTokens, findModel, getLastKnownGoodManifest, getModelPricing, getValue, modelsForProvider, normalizeModel, providerForModel, relayHello, validateAnthropicKey, validateLicense };