/**
 * OSK-3891 (ADR-102) — the loopback credential broker, as a shared package.
 *
 * ── The invariant this package exists to serve ─────────────────────────────
 *
 * **No cloud-reusable credential enters the harness process.** Not its
 * environment, not its address space, not a file it can read. The harness gets a
 * random secret bound to a Unix socket that dies with the session; the credential
 * stays with the parent.
 *
 * ── Why it is a package and not a daemon module ────────────────────────────
 *
 * The 2026-08-08 token-plane document phrased that invariant as *"the Daemon is
 * the sole local injection authority"*, which welded a correct requirement to one
 * implementation. In a cloud-dispatched session the daemon IS the harness's
 * parent; in a session a human starts with `skrr code` the CLI is, and the daemon
 * is a sibling background service. Requiring the daemon there makes a long-lived
 * service a prerequisite for an interactive command.
 *
 * The requirement is about the harness PROCESS. So the broker lives here, where
 * either parent can host it, and the server-side authorization is identical in
 * both cases.
 *
 * ── Why NOT reimplement it in the CLI instead ──────────────────────────────
 *
 * The loopback server enforces the request envelope — model, route, dialect, byte
 * ceiling, concurrency, rate — before anything leaves the machine. That
 * enforcement IS the security value of the design. A second implementation would
 * fork it, and the fork would drift silently because both halves would keep
 * working.
 *
 * ── What the broker does and does not buy ──────────────────────────────────
 *
 * It reduces the blast radius of ACCIDENTAL disclosure: a crash dump, a verbose
 * log, a repository plugin that prints `process.env`. That is the live risk,
 * because a coding harness runs code authored by whoever wrote the repository it
 * was pointed at.
 *
 * It is NOT a boundary against a MALICIOUS harness. Same UID means the child can
 * read the parent's memory or simply ask for another session. Process confinement
 * is a separate, unshipped control, and this package must not be described as
 * providing it.
 *
 * (Its earlier stated rationale — that the daemon would otherwise hold a LiteLLM
 * virtual key — is obsolete: current servers deliver an `agst_` session token and
 * resolve the virtual key server-side. Recorded because an expired rationale does
 * not fail loudly; it just invites someone to delete a still-needed control.)
 *
 * ── Dual build, deliberately ───────────────────────────────────────────────
 *
 * ESM and CJS are both emitted because the daemon is ESM and the CLI is CJS, and
 * this package exists precisely so both can host the broker.
 */
export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, INFERENCE_BROKER_HOST, inferenceBrokerNoProxyEnv, type ManagedSessionStatus, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, type GatewayCredential, type ManagedCapabilityRefresh, type ManagedCapabilityRefreshResult, type ManagedInferenceBrokerOptions, type ManagedInferenceBrokerSession, type ManagedInferenceInputTokenAccounting, type ManagedInferenceModelScope, type ManagedInferenceRequestEnvelope, type ManagedReasoningPolicy, } from './managed-inference-broker.js';
export { minimumCapabilityWindowMs, scheduleRenewalDelay, startRenewalLoop, type CapabilityRefreshOutcome, type RenewalLoop, type RenewalLoopOptions, type RenewalOutcome, type RenewalStopReason, } from './managed-inference-renewal.js';
export { ModelProxyLoopbackServer, type ModelProxyForwarder } from './loopback-server.js';
export * from './contract.js';