@plurnk/plurnk-providers 1.0.4 → 1.0.6

package/.env.defaults

@@ -1,24 +1,28 @@
-# ⚠ REFERENCE — @plurnk/plurnk-providers' shipped .env.defaults: the operative floor for the
-# PLURNK_PROVIDERS_* knobs (ecosystem standard, providers#44: every package owns its knobs; the
-# file IS the documentation). The daemon assembles every installed member's file into one floor
-# (set-if-unset under the operator's env) — do NOT edit this file; put YOUR config in
-# ~/.plurnk/.env or ./.env. A key claimed by two packages crashes boot naming both.
+# REFERENCE - @plurnk/plurnk-providers' shipped .env.defaults: the operative floor for the
+# PLURNK_PROVIDERS_* knobs AND the standard providers' endpoints + alias config (ecosystem
+# standard, providers#44: every package owns what it reads; the file IS the documentation).
+# The daemon assembles every installed member's file into one floor (set-if-unset under the
+# operator's env) - do NOT edit this file; put YOUR config in ~/.plurnk/.env or ./.env. A key
+# claimed by two packages crashes boot naming both.
 #
-# EVERY knob here is per-alias-scopable: PLURNK_PROVIDERS_<KNOB>_<alias> wins over the bare name
-# for that alias (suffix case-folds; SPEC §4). Set lines are the floor; commented keys are
-# knobs whose UNSET state is meaningful (derive/auto/off) — uncomment to pin.
-# Vendor facts (API keys, base URLs: XAI_API_KEY, FIREWORKS_BASE_URL, …) are NOT knobs and
-# carry no defaults — they stay operator-declared, fail-hard when required (SPEC §3).
+# EVERY PLURNK_PROVIDERS_* knob is per-alias-scopable: PLURNK_PROVIDERS_<KNOB>_<alias> wins over
+# the bare name (suffix case-folds; SPEC §4). Set lines are the floor; commented lines are values
+# whose UNSET state is meaningful (derive/auto/off, or a required secret) - uncomment to pin.
+#
+# Base URLs are SHIPPED DEFAULTS - the canonical vendor endpoint lives HERE (overridable in your
+# .env, or per-alias via PLURNK_BASEURL_<alias>), so the happy path needs ZERO endpoint config.
+# The ONLY required per-provider input is the API KEY: a secret with no default, set in your own
+# .env; an unset key for a provider you actually use fails hard at construction naming the var.
 
 # --- Side-channel reasoning (SPEC §4, #32/#33/#399) ---
 # ACTIVATION and BUDGET are separate so a numeric can never silently flip wire flags.
 # off | adaptive | on. The provider maps intent to each backend's native mechanism
-# (reasoning_effort, enable_thinking, think, …). Default ADAPTIVE (owner ruling,
+# (reasoning_effort, enable_thinking, think, ...). Default ADAPTIVE (owner ruling,
 # #399): reasoning ACTIVE on a fresh install, each backend's own adaptive depth,
-# no shipped magnitude — a reasoning model that ships un-reasoning blind-edits and
-# declares done (svc#396 A/B: 25 EXECs → 0, build broken, confident SEND[200]).
+# no shipped magnitude - a reasoning model that ships un-reasoning blind-edits and
+# declares done (svc#396 A/B: 25 EXECs -> 0, build broken, confident SEND[200]).
 PLURNK_PROVIDERS_REASONING=adaptive
-# Positive int, REQUIRED iff REASONING=on — the magnitude for tier/budget mapping. On
+# Positive int, REQUIRED iff REASONING=on - the magnitude for tier/budget mapping. On
 # llama.cpp the ENFORCEMENT is the box's --reasoning-budget LAUNCH flag (per-request
 # numerics are ignored): env budget and launch flag are the same number, changed together.
 # PLURNK_PROVIDERS_REASONING_BUDGET=4096
@@ -28,6 +32,13 @@ PLURNK_PROVIDERS_REASONING=adaptive
 # the floor the provider manages wherever a grammar rides (greedy-under-mask loops without it).
 PLURNK_PROVIDERS_TEMPERATURE=0.2
 PLURNK_PROVIDERS_REPEAT_PENALTY=1.15
+# FREQUENCY_PENALTY (#426): the anti-degeneration guard on the CLOUD path. repeat_penalty is a
+# llama.cpp/vLLM MULTIPLIER the plain cloud path (grammarStyle "none") can't use; frequency_penalty
+# is OpenAI-standard, so every OpenAI-compat backend accepts it (verified live: together, deepinfra,
+# fireworks). Without it a cloud alias ran the sampler bare and looped to the token cap. 0 = off.
+# NOTE: 0.4 is a STARTING value (acceptance-verified, not yet effectiveness-benched) - raise it if a
+# firefast/deepseek re-bench still degenerates.
+PLURNK_PROVIDERS_FREQUENCY_PENALTY=0.4
 
 # --- Transport budgets (§4, #18) ---
 # Per-attempt fetch timeout (ms); the caller's abort signal spans retries.
@@ -45,26 +56,26 @@ PLURNK_PROVIDERS_PROBE_DELAY=250
 
 # --- Grammar (GBNF, SPEC §13) ---
 # The grammar artifact the consumer resolves and passes per call (providers transport it
-# verbatim; enforcement is per-backend — see constrainsOutput). Read by the service.
+# verbatim; enforcement is per-backend - see constrainsOutput). Read by the service.
 # OFF by default (bare unset = off): core opts IN per alias via PLURNK_PROVIDERS_GBNF_<alias>
-# (Engine §353). A GLOBAL rails default is unsafe — providers that ACCEPT a grammar quietly
+# (Engine §353). A GLOBAL rails default is unsafe - providers that ACCEPT a grammar quietly
 # disable reasoning as a side effect, invisible to the constrainsOutput gate (it verifies rails
 # are ENFORCED, not that reasoning SURVIVED). The reasoning model then blind-edits and looks
 # like plurnk's fault on their platform (svc#396). Off degrades gracefully (free output, still
-# verified; divergence → grammar_unenforced telemetry, #24); rails-on-where-unsafe degrades
+# verified; divergence -> grammar_unenforced telemetry, #24); rails-on-where-unsafe degrades
 # silently. Turn ON per alias where rails coexist (local llama-server) or the reasoning
 # tradeoff is deliberate.
 # PLURNK_PROVIDERS_GBNF=plurnk.gbnf
 # Debug toggle (0/empty = off): validate a transported grammar locally, throw on malformed,
-# and WITHHOLD it so the model runs unconstrained — the free output is still verified and a
+# and WITHHOLD it so the model runs unconstrained - the free output is still verified and a
 # divergence surfaces as grammar_unenforced telemetry. Dev aid; leave off in production.
 # PLURNK_PROVIDERS_GBNF_DEBUG=0
 
 # --- Window (SPEC §11) ---
-# Unset = derive: env → live endpoint probe (n_ctx) → models.dev catalog → null (surfaced
-# once via PLURNK_CONTEXT_UNKNOWN naming the model). Set to pin the window deliberately —
+# Unset = derive: env -> live endpoint probe (n_ctx) -> models.dev catalog -> null (surfaced
+# once via PLURNK_CONTEXT_UNKNOWN naming the model). Set to pin the window deliberately -
 # per-alias (_<alias>) for a box whose model the catalog doesn't know.
-# PLURNK_PROVIDERS_CONTEXT_SIZE=200000
+# PLURNK_PROVIDERS_CONTEXT_WINDOW=200000
 
 # --- llama-server detection pin (#34) ---
 # Unset = auto-detect from the /v1/models fingerprint. 1 = pin llama-server capabilities
@@ -72,10 +83,67 @@ PLURNK_PROVIDERS_PROBE_DELAY=250
 # remote even when the fingerprint matches. Usually per-alias: _<alias>.
 # PLURNK_PROVIDERS_LLAMA_SERVER=1
 
-# --- Data capture (#36, SPEC §14) — OFF by default; the flag IS the isolation ---
+# --- Data capture (#36, SPEC §14) - OFF by default; the flag IS the isolation ---
 # Enable ONLY on a dataset-scraping alias (append _<alias>); serving turns then request and
-# carry nothing. LOGPROB: non-negative int = top_logprobs (surfaced on assistant.logprobs;
-# raw model logprob, the sampling-invariant confidence). RAWBODY: truthy → verbatim wire
+# carry nothing. TOP_LOGPROBS: non-negative int = the OpenAI top_logprobs count (surfaced on
+# assistant.logprobs; raw model logprob, the sampling-invariant confidence). RAWBODY: truthy -> verbatim wire
 # body on response.rawBody (keeps sampling_logprob/token_id/bytes the digest drops).
-# PLURNK_PROVIDERS_LOGPROB_myscraper=3
+# PLURNK_PROVIDERS_TOP_LOGPROBS_myscraper=3
 # PLURNK_PROVIDERS_RAWBODY_myscraper=1
+
+# --- Alias cascade (SPEC §5) - declare aliases, then pick the active one ---
+# First path segment is the provider name; the rest is the provider-native model id (may
+# contain "/"). Operator-specific, no default - the examples are commented.
+# PLURNK_MODEL_gemma=openai/macher.gguf
+# PLURNK_MODEL_opus=anthropic/claude-opus-4-8
+# PLURNK_MODEL_sonnet=openrouter/anthropic/claude-sonnet-latest
+# PLURNK_MODEL=gemma
+#
+# PLURNK_BASEURL_<alias> - bind an endpoint to ONE alias (the only way to run N self-hosted
+# boxes of one provider: openai=llama.cpp/vLLM, ollama). WINS over the provider's *_BASE_URL;
+# a dangling override fails hard.
+# PLURNK_MODEL_HAZEL1=openai/qwen2.5-coder
+# PLURNK_BASEURL_HAZEL1=http://hazel1:8080/v1
+# PLURNK_MODEL_NOOK=ollama/qwen2.5-coder
+# PLURNK_BASEURL_NOOK=http://nook:11434
+
+# --- Standard provider endpoints (frozen table) ---
+# Base URLs ship at their canonical vendor default - zero endpoint config for the happy path.
+# Override in your .env (proxy/self-host/regional twin), or per-alias with PLURNK_BASEURL_<alias>
+# (which wins over these). Each provider ALSO needs its API KEY - a required secret with no
+# default, set in ~/.plurnk/.env; the key var mirrors the *_BASE_URL prefix (FIREWORKS_API_KEY,
+# ...) except where noted. An unset key fails hard at construction naming the var.
+
+# Generic OpenAI-compat - OpenAI proper by default; for a local llama-server/vLLM, override the
+# endpoint per-alias (PLURNK_BASEURL_<alias>). OPENAI_API_BASE is a legacy URL alias.
+OPENAI_BASE_URL=https://api.openai.com/v1
+GROQ_BASE_URL=https://api.groq.com/openai/v1
+DEEPSEEK_BASE_URL=https://api.deepseek.com/v1
+MISTRAL_BASE_URL=https://api.mistral.ai/v1
+TOGETHER_BASE_URL=https://api.together.xyz/v1
+FIREWORKS_BASE_URL=https://api.fireworks.ai/inference/v1
+DEEPINFRA_BASE_URL=https://api.deepinfra.com/v1/openai   # key aliases: DEEPINFRA_API_TOKEN, DEEPINFRA_TOKEN
+
+# Chinese cloud hosts - base ships INTERNATIONAL; mainland operators repoint *_BASE_URL at the `.cn` twin.
+MOONSHOT_BASE_URL=https://api.moonshot.ai/v1
+DASHSCOPE_BASE_URL=https://dashscope-intl.aliyuncs.com/compatible-mode/v1   # Alibaba Qwen
+ZHIPU_BASE_URL=https://api.z.ai/api/paas/v4   # Zhipu GLM; key ZHIPUAI_API_KEY (alias ZAI_API_KEY)
+ARK_BASE_URL=https://ark.ap-southeast.bytepluses.com/api/v3   # ByteDance Doubao (BytePlus ModelArk)
+HUNYUAN_BASE_URL=https://api.hunyuan.cloud.tencent.com/v1   # Tencent Hunyuan
+MINIMAX_BASE_URL=https://api.minimax.io/v1
+STEPFUN_BASE_URL=https://api.stepfun.com/v1   # StepFun; key STEP_API_KEY
+BAICHUAN_BASE_URL=https://api.baichuan-ai.com/v1
+QIANFAN_BASE_URL=https://qianfan.baidubce.com/v2   # Baidu ERNIE (Qianfan v2)
+SILICONFLOW_BASE_URL=https://api.siliconflow.com/v1
+MODELSCOPE_BASE_URL=https://api-inference.modelscope.cn/v1   # key alias: MODELSCOPE_TOKEN
+
+# First-party Claude (Anthropic's OpenAI-compat endpoint).
+ANTHROPIC_BASE_URL=https://api.anthropic.com/v1
+
+# AWS Bedrock (OpenAI-compat path /openai/v1) - base is REGION-templated: leave unset to derive
+# from AWS_REGION / AWS_DEFAULT_REGION, or pin explicitly. No static default. Key AWS_BEARER_TOKEN_BEDROCK.
+# BEDROCK_BASE_URL=https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1
+
+# plurnk hosted model - PLURNK_API_KEY is an OPTIONAL bearer (sent only when set).
+PLURNK_BASE_URL=https://plurnk.ai/v1
+# PLURNK_BASE_URL=http://plurnksnr2kihuukt6v22ko72r34dxeatbsfhgow3hvnlw6btanxphad.onion/v1   # Tor

package/README.md

@@ -5,7 +5,7 @@ Framework + contract for `@plurnk/plurnk-providers-*` sibling packages (LLM tran
 ## Documentation
 
 - [`SPEC.md`](./SPEC.md) — author-facing contract for sibling implementers.
-- [`.env.example`](./.env.example) — the authoritative operator config reference: every env knob the provider layer reads (all required, fail-hard, no defaults).
+- [`.env.defaults`](./.env.defaults) — the shipped floor AND operator config reference: every var the provider layer reads, each with its default (canonical endpoints + measured tuning); only the API keys are secrets with no default (fail-hard). Assembled into the daemon floor at boot (#44).
 - Constellation: [plurnk-grammar](https://github.com/plurnk/plurnk-grammar) (HEREDOC + AST), [plurnk-mimetypes](https://github.com/plurnk/plurnk-mimetypes), [plurnk-schemes](https://github.com/plurnk/plurnk-schemes), [plurnk-execs](https://github.com/plurnk/plurnk-execs) (the reference family this one mirrors).
 
 ## Write a provider
@@ -27,13 +27,13 @@ One package is **one** provider identity — the `<name>` segment of `PLURNK_MOD
 The framework calls `YourClass.fromEnv(env, model, options?)` (sync or async) and expects a `Provider`. `options.baseUrl` is the per-alias endpoint override (`PLURNK_BASEURL_<alias>`) — honor it if you're a self-hosted provider so two aliases can reach two boxes; ignore it otherwise. Two ways in:
 
 - **OpenAI-compatible backends** (the common case): `fromEnv` reads its env (base URL, key), probes whatever it needs (catalog, context window, pricing), and returns **`new OpenAICompatProvider(config)`**. You write a `fromEnv` and a config object — the transport spine (SSE, usage normalization, `finishReason`, grammar transport, slot affinity) is inherited. See `OpenAICompatConfig` / SPEC §11.
-- **Non-OpenAI backends**: `implements Provider` directly — `generate`, `contextSize`, `model`, `countTokens(text)`, `costFor(usage)`.
+- **Non-OpenAI backends**: `implements Provider` directly — `generate`, `contextWindow`, `model`, `countTokens(text)`, `costFor(usage)`.
 
 `fromEnv` **MUST fail fast with a named error** when required env is missing — name the var the operator must set. (Why a factory, not a base-class constructor like execs/mimes: a provider often async-probes at construction — SPEC §3.)
 
 ### 3. What `generate` receives — and returns
 
-`generate({ messages, runId, signal?, grammar?, maxTokens?, attributions?, client? }) → Promise<ProviderResponse>`. Return **raw** wire output: `content` unparsed (the consumer parses the plurnk DSL — never parse it yourself), `reasoning` is the wire-reported CoT only. Honor `signal`. The provider never mutates `messages` or injects turns. `grammar` (GBNF) is attached only by backends that support it; all others ignore it (SPEC §13). When a grammar *is* transported, the provider verifies the backend actually enforced it — non-conforming output rejects with a `grammar_unenforced` `ProviderError` (a conformance check via `@plurnk/gbnf`, never a plurnk-DSL parse). In **GBNF-filter mode** (`PLURNK_GBNF_DEBUG`, grammar withheld) the same non-conformance is **non-fatal**: `generate` returns the model's bytes and attaches a `grammar_unenforced` event to `ProviderResponse.telemetry` with the divergence `position`, so the consumer can drive self-correction instead of losing the turn (#24). `attributions`/`client` are per-turn first-party metadata, forwarded as `Plurnk-*` headers **only** by a provider configured with `firstPartyMetadata` (the plurnk endpoint); every other provider drops them, so they can never reach a third-party backend (SPEC §11). The response carries a `meta?` bag — the backend's extra top-level fields passed through, plus validated known keys (e.g. `meta.balancePico`, pico-USD, normalized only from the plurnk endpoint) — for the service's per-turn metadata (#23).
+`generate({ messages, workerId, signal?, grammar?, maxTokens?, attributions?, client? }) → Promise<ProviderResponse>`. Return **raw** wire output: `content` unparsed (the consumer parses the plurnk DSL — never parse it yourself), `reasoning` is the wire-reported CoT only. Honor `signal`. The provider never mutates `messages` or injects turns. `grammar` (GBNF) is attached only by backends that support it; all others ignore it (SPEC §13). When a grammar *is* transported, the provider verifies the backend actually enforced it — non-conforming output rejects with a `grammar_unenforced` `ProviderError` (a conformance check via `@plurnk/gbnf`, never a plurnk-DSL parse). In **GBNF-filter mode** (`PLURNK_GBNF_DEBUG`, grammar withheld) the same non-conformance is **non-fatal**: `generate` returns the model's bytes and attaches a `grammar_unenforced` event to `ProviderResponse.telemetry` with the divergence `position`, so the consumer can drive self-correction instead of losing the turn (#24). `attributions`/`client` are per-turn first-party metadata, forwarded as `Plurnk-*` headers **only** by a provider configured with `firstPartyMetadata` (the plurnk endpoint); every other provider drops them, so they can never reach a third-party backend (SPEC §11). The response carries a `meta?` bag — the backend's extra top-level fields passed through, plus validated known keys (e.g. `meta.balancePico`, pico-USD, normalized only from the plurnk endpoint) — for the service's per-turn metadata (#23).
 
 ## Discovery & trust
 
@@ -51,7 +51,7 @@ First-party daughters install flat via [`@plurnk/plurnk-providers-all`](https://
 - `parseAliasesFromEnv`, `resolveActiveAlias`, `instantiateProvider`, `loadActiveProvider`, `discover`, `resetDiscoveryCache` — alias-cascade resolution + two-tier provider instantiation (`resetDiscoveryCache` clears the memoized tier-2 scan; for tests). Tier 1 is the standard table; tier 2 is a scope-agnostic `node_modules` scan for `plurnk.kind:"provider"` packages — first-party daughters (flat via `@plurnk/plurnk-providers-all`) and third-party providers under any scope, gated by the host `PLURNK_PLUGINS_TRUSTED_ONLY` allowlist. The framework is contract-only (SPEC §5).
 - `OpenAICompatProvider` (+ `OpenAICompatConfig`, `ReasoningStyle`, `GrammarStyle`, `effortFromBudget`) — shared OpenAI-compatible transport spine; siblings extend it (SPEC §11). Transports a GBNF grammar via `grammarStyle` — `llamacpp` (top-level `grammar` field) or `response_format` (Fireworks); `none` drops it — and verifies the backend enforced it against `@plurnk/gbnf`, rejecting non-conforming output as `grammar_unenforced` (SPEC §13).
 - `chatCompletionStream`, `chatCompletion`, `OpenAiHttpError`, `StreamResponse` — the shared SSE client (`chatCompletion` is the non-streaming variant).
-- `parseRequiredInt`, `parseOptionalInt`, `requireEnv`, `reasoningBudgetFromEnv` — env helpers (SPEC §4; all required-with-named-errors, no in-code defaults).
+- `parseRequiredInt`, `parseOptionalInt`, `parseRequiredFloat`, `requireEnv`, `reasoningFromEnv` — env helpers (SPEC §4; all required-with-named-errors, no in-code defaults).
 - `normalizeUsage`, `computeCost` (+ `RawUsage`, `TokenRates`) — usage normalization to the §2 invariant and the single cost formula (SPEC §11).
 - `ProviderError`, `classifyProviderError`, `toProviderError`, `providerSource` (+ `TelemetryEvent`, `ProviderTelemetryKind`) — the TelemetryEvent envelope for transport failures (SPEC §12).
 - `tokenizerFor`, `tokenizerByPublisher`, `parseTokenizerFamily` (+ `TokenizerFamily`, `CountTokens`) — synchronous tokenizer strategies.

package/SPEC.md

@@ -23,7 +23,7 @@ Collision on `(kind: "provider", name)` at discovery: fail-hard.
 ```ts
 interface Provider {
     // Identity (immutable across lifetime)
-    readonly contextSize: number | null;  // context tokens, null if unresolved.
+    readonly contextWindow: number | null;  // context tokens, null if unresolved.
                                           // PER SLOT under llama-server --parallel N
                                           // (the server splits --ctx-size and reports
                                           // the divided value; verified live).
@@ -54,7 +54,7 @@ interface Provider {
     readonly constrainsOutput?: boolean;
     readonly requiresMaxTokens?: boolean;
 
-    // Transport. `runId` is REQUIRED: the opaque, stable identity of the
+    // Transport. `workerId` is REQUIRED: the opaque, stable identity of the
     // consumer's work stream — providers may key backend affinity on it and
     // never interpret it. `grammar` is an optional GBNF string for
     // grammar-constrained sampling (§13) — attached verbatim by capable
@@ -67,25 +67,31 @@ interface Provider {
     // `sampling` is an optional bag of standard OpenAI-compat sampling params
     // (temperature, top_p, top_k, min_p, penalties, stop, seed, …) merged into the
     // body UNDER the managed fields — model/messages/grammar/reasoning/max_tokens/
-    // slot always win, and transport/protocol keys (stream, response_format,
-    // grammar, id_slot) are stripped, so it carries sampling intent only and can't
-    // bypass grammar transport (§8). For a PROXY consumer forwarding its own
+    // slot always win, and reserved keys are stripped (#477): transport/protocol
+    // (stream, response_format, grammar, id_slot, logprobs), paradigm breakers
+    // (n, the tools/functions family, modalities/audio, prediction), and the
+    // token caps (max_tokens/max_completion_tokens -- the envelope is the managed
+    // maxTokens, never bypassable). It carries sampling intent + platform knobs
+    // only (§8). For a PROXY consumer forwarding its own
     // caller's sampling knobs (the plurnk endpoint fronting gemma/Fireworks); a
     // direct consumer leaves it unset.
-    // `strikes` is the run's CURRENT rail-strike streak at time-of-generate
+    // `strikes` is the worker's CURRENT rail-strike streak at time-of-generate
     // (0 = clean, distinct from absent = unreported; contract plurnk-service#313).
     // Forwarded as `Plurnk-Strikes` ONLY under the firstPartyMetadata gate,
     // dropped everywhere else. Headers only — never placed in the packet.
-    // `sessionId`/`loop`/`turn` (#404): the turn coordinate, stamped as
-    // `Plurnk-Session-Id`/`Plurnk-Loop`/`Plurnk-Turn` under the SAME gate.
+    // `workspaceId`/`loop`/`turn` (#404): the turn coordinate, stamped as
+    // `Plurnk-Workspace-Id`/`Plurnk-Loop`/`Plurnk-Turn` under the SAME gate.
     // 1-based; absent/0 emits no header. Headers only, never the packet.
-    generate(args: { messages: ChatMessage[]; runId: string; signal?: AbortSignal; grammar?: string; maxTokens?: number; attributions?: string[]; client?: string; strikes?: number; sessionId?: string; loop?: number; turn?: number; sampling?: Record<string, unknown> }): Promise<ProviderResponse>;
+    generate(args: { messages: ChatMessage[]; workerId: string; signal?: AbortSignal; grammar?: string; maxTokens?: number; attributions?: string[]; client?: string; strikes?: number; workspaceId?: string; loop?: number; turn?: number; sampling?: Record<string, unknown> }): Promise<ProviderResponse>;
 }
 
 interface ProviderResponse {
     assistant: {
         content: string;            // raw model emission; consumer parses
-        reasoning: string | null;   // wire-reported CoT; null if absent
+        reasoning: string | null;   // wire-reported reasoning content; null if absent
+        // sealed relay reasoning (#482): { data, format } blobs verbatim, never
+        // decoded; absent when none. agui projects REASONING_ENCRYPTED_VALUE.
+        reasoningEncrypted?: Array<{ data: string; format: string | null }>;
         usage: ProviderUsage;       // { prompt, completion, reasoning, cached, total }
         finishReason: "stop" | "length" | "tool_calls" | "content_filter" | null;
         model: string;              // wire-reported (may differ from requested for relay providers)
@@ -97,13 +103,13 @@ interface ProviderResponse {
 interface ProviderUsage {
     prompt: number;       // input tokens (cached ones included)
     completion: number;   // visible output tokens, EXCLUDING reasoning
-    reasoning: number;    // reasoning/thinking tokens, billed as output
+    reasoning: number;    // reasoning tokens, billed as output
     cached: number;       // subset of prompt served from cache
     total: number;        // prompt + completion + reasoning
 }
 ```
 
-Usage invariant: `total = prompt + completion + reasoning`; `cached ⊆ prompt`; `completion` excludes reasoning; **billable output = `completion + reasoning`**. Providers report reasoning two ways — inside `completion_tokens` (OpenAI, via `completion_tokens_details.reasoning_tokens`) or only as the `total − prompt − completion` gap (Gemini). The framework's `normalizeUsage` (§11) collapses both to this invariant, so siblings on `OpenAICompatProvider` get it for free.
+Usage invariant: `total = prompt + completion + reasoning`; `cached ⊆ prompt`; `completion` excludes reasoning; **billable output = `completion + reasoning`**. Providers report reasoning THREE ways: inside `completion_tokens` (OpenAI, via `completion_tokens_details.reasoning_tokens`), only as the `total - prompt - completion` gap (Gemini), or folded into `completion_tokens` with NO itemization while shipping the reasoning as TEXT (Fireworks, #425). The framework's `normalizeUsage` (§11) collapses all three to this invariant -- re-splitting the Fireworks case by the emitted text lengths, sum-preserving so cost is unchanged -- so siblings on `OpenAICompatProvider` get it for free.
 
 ### Promises
 
@@ -114,11 +120,11 @@ Usage invariant: `total = prompt + completion + reasoning`; `cached ⊆ prompt`;
 - `countTokens` is **synchronous**, returns a non-negative integer, deterministic for the same input. Without an exact tokenizer family configured it is the **chars/2 UPPER BOUND** — deliberately conservative (real agentic text measures ~2.9–3.2 chars/token on gemma/deepseek, so the former chars/4 silently UNDERcounted 20–27%; a fallback may overcount, never under) — and it is **surfaced at construction** (`process.emitWarning`, code `PLURNK_TOKENIZER_HEURISTIC`), never silent. Exact counting is the tokenizer seam's job (mimetypes family), fed by `tokenize()` where available.
 - `tokenize?` is an **optional async capability**: token ids in the model's real vocabulary, served by the backend itself (llama-server's native root `/tokenize`, surfaced when the §11 probe fingerprints a llama-server and `detectLlamaServer` isn't false). `tokenize === undefined` is the honest "backend can't" signal. Exact-counting consumers prefer it over any client-side tokenizer data — the local model's own vocab needs no bundled `tokenizer.json` at all.
 - `costFor` is **pure**, returns pico-USD non-negative integer. Returns `0` for siblings with no known rates (local Ollama, generic OpenAI-compat shims).
-- `contextSize` resolves to `null` when provider can't determine the model's context window. Consumer treats null as "no budget info available."
+- `contextWindow` resolves to `null` when a PROBING provider (openai/llama-server) can't determine the window (consumer treats null as "no budget info"); a CLOUD provider with no window source FAILS HARD instead (#419, §11).
 - `generate` rejects on signal abort — does NOT resolve with partial content.
 - `generate` transports `grammar` verbatim when the backend supports grammar-constrained sampling, and silently ignores it otherwise (§13). The provider never chooses or modifies the grammar.
 - `generate` **returns for every completed exchange — bytes always present, the conformance verdict attached as an observation.** When a grammar was transported (or validated in filter mode), the returned `content` is checked against it; a non-accept verdict rides `response.telemetry` as a `grammar_unenforced` event (message + divergence `position`) and the response returns normally. The provider transports and observes; it never adjudicates — discard, retry, escalate, or feed-back is consumer policy. This is a grammar-**conformance** check against the grammar the provider already holds — *not* a plurnk-DSL parse (that stays consumer-side, below) — so it remains backend- and DSL-agnostic. `ProviderError` remains reserved for exchanges that did NOT complete (transport failure, abort, boundary violations).
-- **Backend affinity is the provider's internal guarantee, keyed by `runId`.** The consumer says *which run this is*, never *which backend resource serves it* — raw resource identifiers (slot integers, connections) never cross the contract in either direction. On slot-pinning backends (llama-server `--parallel N>1`), the provider keeps each run sticky to one slot and spreads distinct runs across slots, so each concurrent run keeps its KV-cache prefix warm (un-pinned routing is the server's similarity heuristic — slot hops re-pay full prefills). Backends without affinity semantics ignore `runId` entirely.
+- **Backend affinity is the provider's internal guarantee, keyed by `workerId`.** The consumer says *which run this is*, never *which backend resource serves it* — raw resource identifiers (slot integers, connections) never cross the contract in either direction. On slot-pinning backends (llama-server `--parallel N>1`), the provider keeps each worker sticky to one slot and spreads distinct runs across slots, so each concurrent run keeps its KV-cache prefix warm (un-pinned routing is the server's similarity heuristic — slot hops re-pay full prefills). Backends without affinity semantics ignore `workerId` entirely.
 
 ## §3 `fromEnv(env, model, options?)` factory
 
@@ -129,7 +135,7 @@ class OpenAI {
     static fromEnv(env: NodeJS.ProcessEnv, model: string, options?: ProviderOptions): OpenAI | Promise<OpenAI> {
         // Read provider-specific env (OPENAI_BASE_URL, OPENAI_API_KEY, ...)
         // plus universal operator knobs (PLURNK_PROVIDERS_REASONING, PLURNK_PROVIDERS_FETCH_TIMEOUT,
-        // PLURNK_PROVIDERS_CONTEXT_SIZE). `options.baseUrl`, when set, is the per-alias
+        // PLURNK_PROVIDERS_CONTEXT_WINDOW). `options.baseUrl`, when set, is the per-alias
         // endpoint override (PLURNK_BASEURL_<alias>, §5) and wins over the env base URL.
         return new OpenAI({ /* ... */ });
     }
@@ -149,10 +155,11 @@ Each provider's `fromEnv` reads these:
 
 - **`PLURNK_PROVIDERS_REASONING`** — REQUIRED, one of `off | adaptive | on` (#33). Pure ACTIVATION intent; **`PLURNK_PROVIDERS_REASONING_BUDGET`** (positive int, REQUIRED iff `on`) carries the magnitude separately, so a number can never silently flip wire flags. The provider maps intent to the active backend's mechanism — llama-server `chat_template_kwargs: { enable_thinking }` (always emitted; the explicit FALSE is the only working off-switch; the NUMERIC clamp is the box's `--reasoning-budget` LAUNCH flag — per-request numerics are ignored, so env budget and launch flag are the same number, changed together), Ollama `think`, relay `include_reasoning`, cloud `reasoning_effort` (tier from budget when `on`; `off`/`adaptive` omit), fireworks `reasoning_effort` **explicit** (`effort_explicit`: `off` SENDS `"none"` — omission is NOT off on reason-by-default models like DeepSeek V4, #30; `adaptive` OMITS the field — the backend default IS adaptive, and the literal `"adaptive"` is MiniMax-M3-only, 400 elsewhere, #403. Intent maps **identically under a transported grammar** (the former #32 clamp-to-`"none"` is lifted — it caused plan-less turns, service#331; the lift enables best-effort reasoning). BUT reasoning and hard-masked GBNF rails do **NOT reliably coexist** on fireworks (TUNING-EPIC **F9-final**, ~60 live tests). Fireworks' docs: `response_format` (which includes grammar mode) **disables reasoning output**; measured, reasoning reaches the usable `reasoning_content` channel only stochastically (~1/8) and otherwise collapses or leaks into `content` — best lever (prefill `<think>\n`) tops out at 7/10 with a runaway tail. So under a transported grammar, reasoning is **best-effort and unsegregated** (lands in `content`, not `reasoning_content`), and NOT tunable — a consumer wanting the reasoning parses the preplan region of `content`. Fireworks is rails-first; single-call reasoning+rails needs a llama.cpp lazy-grammar host. Envelope: `max_tokens` is a cost circuit-breaker (reasoning-on can run away), not a reasoning reserve), Anthropic `thinking: disabled | enabled+budget_tokens(budget) | omit`. Consumers state intent, never mechanism. (In-DSL `<<PLAN>>` reasoning has **no provider footprint** and no operator knob: `PLAN` is a required element of the canonical plurnk grammar the consumer attaches via `generate`'s `grammar`. The provider transports that grammar verbatim and never forces, prefills, or toggles `PLAN`.)
 
-Read via `reasoningBudgetFromEnv` and **fail hard when unset** — configuration lives in the operator's env (the consumer's `.env.example` declares every var); the framework never defaults a knob in code.
+Read via `reasoningFromEnv` and **fail hard when unset**: the budget is required only when `on` and carries no floor default. Configuration lives in the operator's env over the package's `.env.defaults` floor (which declares every var and ships its default); the framework never bakes a knob default into code.
 - **`PLURNK_PROVIDERS_FETCH_TIMEOUT`** — service-wide ms ceiling on any single outbound request (**per attempt**, not shared across retries). Each `fromEnv` reads and passes as `AbortSignal.timeout`. Per-provider override envs are NOT part of the contract.
 - **`PLURNK_PROVIDERS_RETRY_ATTEMPTS`** — REQUIRED non-negative integer (read via `parseRequiredInt`). The transient-failure retry budget: **`0`** surfaces the first failure; **`N`** retries up to `N` times on a *transient* classification only (`rate_limit` / `network_failure` — 429, 5xx, timeout, connection reset). Terminal kinds (`unauthorized`, `quota_exceeded`, `invalid_response`, `model_refused`) are never retried. Backoff is exponential from a `2000ms` base (`base * 2^(attempt-1)`), unless the server sent a `Retry-After` (which wins). The caller's `signal` aborts both the in-flight request and the backoff sleep. Lives in the shared `OpenAICompatProvider` so every provider inherits it uniformly; rides on the existing `classifyProviderError` (#18).
-- **`PLURNK_PROVIDERS_CONTEXT_SIZE`** — optional positive-integer override for the model's reported context window. Resolution: this env var → provider probe/config/table → `null`.
+- **`PLURNK_PROVIDERS_CONTEXT_WINDOW`** -- optional positive-integer override (alias-scopable) for the model's context window. Resolution (#419): this env var -> endpoint `n_ctx` probe (probing specs only) -> `@plurnk/plurnk-models` catalog -> then a PROBING provider degrades to `null`, a CLOUD provider (no probe) FAILS HARD (an uncataloged, unpinned cloud model is a config error, not a guessable window). See §11.
+- **`PLURNK_PROVIDERS_TEMPERATURE` / `PLURNK_PROVIDERS_REPEAT_PENALTY` / `PLURNK_PROVIDERS_FREQUENCY_PENALTY`** -- REQUIRED sampling + anti-degeneration floors (read via `parseRequiredFloat`, values from the `.env.defaults` floor). `REPEAT_PENALTY` (canonical `1.15`) is the llama.cpp/Fireworks multiplier; `FREQUENCY_PENALTY` (canonical `0.4`, #426) is the OpenAI-standard guard on the plain cloud path, which has no `repeat_penalty`. Applied to EVERY request, keyed per backend (§13).
 
 ## §5 Alias cascade resolution
 
@@ -190,18 +197,18 @@ This package's exported resolution surface:
 
 **Two-tier provider resolution — owned entirely by this package.** A provider name resolves in this order:
 
-1. **Standard provider** (`§11`) — if `isStandardProvider(name)`, instantiated directly via `standardProviderFromEnv(name, env, model)`. No package is imported. Covers every plain OpenAI-compatible endpoint (`openai`, `groq`, `deepseek`, `mistral`, `together`, `fireworks`, `deepinfra`, `anthropic`, `bedrock`, `plurnk`, …) — including first-party Claude (Anthropic's compat endpoint, bearer auth, the `thinking` reasoning param), AWS Bedrock (its compat endpoint at the `/openai/v1` path, Bedrock-API-key bearer; the base is `BEDROCK_BASE_URL` if set, else derived as `https://bedrock-runtime.{region}.amazonaws.com/openai/v1` from the standard `AWS_REGION`/`AWS_DEFAULT_REGION`; its inference-profile model ids resolve a catalog **context window** by stripping the region and looking the model up under its publisher (#22), while cost stays unknown — bedrock marks up over the native rate), and the **`plurnk` hosted model** (a plain remote OpenAI endpoint at its `PLURNK_BASE_URL` base, `.env.example` → `https://plurnk.ai/v1`; reads its server-controlled context window from upstream, sends no grammar and no tuning); none needs a daughter. `plurnk` authenticates with a single optional bearer (`PLURNK_API_KEY`, sent only when set), like any other standard bearer. A spec's `apiKeyVar`/`baseUrlVar` may be a **list** of accepted env-var aliases — the conventional names the wild uses for one credential/base (e.g. `deepinfra` → `DEEPINFRA_API_KEY` / `DEEPINFRA_API_TOKEN` / `DEEPINFRA_TOKEN`; `openai` base → `OPENAI_BASE_URL` / `OPENAI_API_BASE`). First set non-empty wins; a required key unset across *all* aliases fails hard naming each. This is alias resolution over operator-set values, never a fabricated default. (An entry MAY instead supply a custom `headersFromEnv` builder for auth a bearer can't express — multi-header/credential schemes — or a `baseUrlFromEnv` builder to template the base from env, as bedrock does.) The standard table is **authoritative**: a scanned package whose name duplicates a standard one is shadowed (tier 1 returns first).
+1. **Standard provider** (`§11`) — if `isStandardProvider(name)`, instantiated directly via `standardProviderFromEnv(name, env, model)`. No package is imported. Covers every plain OpenAI-compatible endpoint (`openai`, `groq`, `deepseek`, `mistral`, `together`, `fireworks`, `deepinfra`, `anthropic`, `bedrock`, `plurnk`, …) — including first-party Claude (Anthropic's compat endpoint, bearer auth, the `thinking` reasoning param), AWS Bedrock (its compat endpoint at the `/openai/v1` path, Bedrock-API-key bearer; the base is `BEDROCK_BASE_URL` if set, else derived as `https://bedrock-runtime.{region}.amazonaws.com/openai/v1` from the standard `AWS_REGION`/`AWS_DEFAULT_REGION`; its inference-profile model ids resolve a catalog **context window** by stripping the region and looking the model up under its publisher (#22), while cost stays unknown — bedrock marks up over the native rate), and the **`plurnk` hosted model** (a plain remote OpenAI endpoint at its `PLURNK_BASE_URL` base, `.env.defaults` → `https://plurnk.ai/v1`; reads its server-controlled context window from upstream, sends no grammar and no tuning); none needs a daughter. `plurnk` authenticates with a single optional bearer (`PLURNK_API_KEY`, sent only when set), like any other standard bearer. A spec's `apiKeyVar`/`baseUrlVar` may be a **list** of accepted env-var aliases — the conventional names the wild uses for one credential/base (e.g. `deepinfra` → `DEEPINFRA_API_KEY` / `DEEPINFRA_API_TOKEN` / `DEEPINFRA_TOKEN`; `openai` base → `OPENAI_BASE_URL` / `OPENAI_API_BASE`). First set non-empty wins; a required key unset across *all* aliases fails hard naming each. This is alias resolution over operator-set values, never a fabricated default. (An entry MAY instead supply a custom `headersFromEnv` builder for auth a bearer can't express — multi-header/credential schemes — or a `baseUrlFromEnv` builder to template the base from env, as bedrock does.) The standard table is **authoritative**: a scanned package whose name duplicates a standard one is shadowed (tier 1 returns first).
 2. **Discovered package** — otherwise, a **scope-agnostic `node_modules` scan** (`discover()`) maps the provider name to the installed package that declares `plurnk: { kind: "provider", name }`, which is dynamic-imported and `fromEnv(env, model, options?)`-called. Covers first-party daughters with real runtime surface (`openrouter`, `ollama`, `google`, `xai`, `cloudflare`, the planned `vertex`/`cohere`) **and any third-party provider published under its own scope** (`@acme/llm-provider-foo`) — no involvement from us, no `@plurnk` scope assumption. Two installed packages claiming the same name → fail-hard naming both. Unknown name → fail-hard. The scan runs once per process and is memoized.
 
    Discovery honors the host **trust gate** `PLURNK_PLUGINS_TRUSTED_ONLY` — the same env var the execs/mimes/schemes families read (plurnk-service#229, #15). OFF (unset/empty/`0`) trusts every installed provider; ON (any value) trusts `@plurnk/*` plus a comma-separated allowlist and declines the rest. A declined package is recorded in `skipped` (never registered, never thrown), so requesting its name yields a precise *untrusted* error rather than *unknown*.
 
-The framework is **contract-only** — it does **not** depend on its daughters. First-party daughters install flat via the [`@plurnk/plurnk-providers-all`](https://github.com/plurnk/plurnk-providers-all) aggregator (a code-free package depping the five daughters directly), so npm hoists them to the top of `node_modules` where the scan finds them; a consumer installs `@plurnk/plurnk-providers` + `@plurnk/plurnk-providers-all`. Each daughter declares the framework as a `peerDependency` with a deliberately wide range (`>=0.7.0 <1.0.0`) so one shared copy lives in the tree (class identity for `instanceof ProviderError` included) **without** a framework minor forcing a daughter republish — the next forced bump is `1.0.0`. This mirrors `@plurnk/plurnk-execs` + `@plurnk/plurnk-execs-all`, which proved that framework-aggregates-daughters (execs `0.4.2`) nests the daughters and breaks the scan — reverted at `0.4.3` to exactly this flat-aggregator shape (#12/#14).
+The framework is **contract-only** -- it does **not** depend on its daughters. First-party daughters install flat (via the [`@plurnk/plurnk-providers-all`](https://github.com/plurnk/plurnk-providers-all) aggregator) so npm hoists them where the scan finds them; a framework that instead aggregated its own daughters would nest and hide them from the scan (the execs #12/#14 lesson). Each daughter declares the framework as a `peerDependency` (`^1`) so one shared copy lives in the tree -- class identity for `instanceof ProviderError` included -- without a framework minor forcing a daughter republish.
 
 ## §6 Engine → provider guarantees (consumer side)
 
 - `messages` is a complete prompt. Consumer has pre-assembled all sections. Provider does not add, reorder, or inject turns — the wire `messages` are exactly what the consumer passed. (The provider injects no `PLAN` turn — `PLAN` is part of the consumer's grammar contract, §4.)
-- Every `generate` carries `runId` — the run's stable, opaque identity. Same run → same string across its turns; distinct runs → distinct strings.
-- `signal` is wired to the run's AbortController.
+- Every `generate` carries `workerId` — the worker's stable, opaque identity. Same run → same string across its turns; distinct runs → distinct strings.
+- `signal` is wired to the worker's AbortController.
 - `generate` is single-call per turn. No parallel calls on the same instance.
 - `assistantRaw` is opaque to the consumer (forensics-only).
 - `meta` is the per-turn provider→client metadata bag: the backend's **non-standard top-level response fields passed through verbatim** (every provider), PLUS **validated known keys** the framework holds a contract for — currently `balancePico` (a finite pico-USD number normalized from the plurnk endpoint's balance field, renamed off its raw key; dropped if non-numeric). Absent when the backend reported no extras. The consumer (service) merges `meta` into its Turn metadata and filters what reaches the client; it reads `meta`, never mines `assistantRaw` (#23).
@@ -243,7 +250,7 @@ The framework is **contract-only** — it does **not** depend on its daughters.
 import { Mock } from "@plurnk/plurnk-providers";
 
 const mock = new Mock({
-    contextSize: 100000,
+    contextWindow: 100000,
     responses: [{ assistant: { content: "<<SEND[200]:hi:SEND", reasoning: null } }],
 });
 const result = await mock.generate({ messages: [] });
@@ -256,7 +263,7 @@ const result = await mock.generate({ messages: [] });
 A sibling package satisfies the contract when:
 
 1. Default export is a class with `static fromEnv(env, model, options?)` factory.
-2. Instance exposes `contextSize: number | null` and `model: string` (non-empty).
+2. Instance exposes `contextWindow: number | null` and `model: string` (non-empty).
 3. Instance exposes `countTokens(text): number` and `costFor(usage): number`.
 4. `countTokens("")` returns `0`; `countTokens("…")` returns a non-negative integer.
 5. `costFor({prompt:0,completion:0,reasoning:0,cached:0,total:0})` returns `0` (or non-negative pico-USD for non-free models).
@@ -276,39 +283,40 @@ Sibling-specific behavioral tests (wire-format compliance, model-family quirks,
 
 The framework ships the transport spine every OpenAI-compatible provider had been duplicating. Build a sibling *on top of these* — don't re-implement them.
 
-- **`OpenAICompatProvider`** — a `Provider` implementation built by composition. Its `generate` does the universal work (merge `signal` with a `PLURNK_PROVIDERS_FETCH_TIMEOUT` deadline, stream the completion, map `usage`, normalize `finishReason` to the §2 set, assemble the response). Per-provider deltas arrive as config:
+- **`OpenAICompatProvider`** — a `Provider` implementation built by composition. Its `generate` does the universal work (merge `signal` with a `PLURNK_PROVIDERS_FETCH_TIMEOUT` deadline, stream the completion, map `usage`, normalize `finishReason` to the §2 set (translating known per-backend cap synonyms -- `max_tokens`, `MAX_TOKENS`, ... -> `length` -- so a consumer's `=== "length"` holds across backends, warning once on any unmapped value, #425), assemble the response). Per-provider deltas arrive as config:
 
   ```ts
   new OpenAICompatProvider({
       model, url,            // fully-resolved chat-completions URL
       fetchTimeoutMs,
       headers,               // fully-resolved request headers (incl. auth)
-      contextSize,           // number | null
-      reasoningBudget, reasoningStyle,   // "none" | "think" | "include_reasoning" | "effort" | "template" | "anthropic"
+      contextWindow,           // number | null
+      reasoning, reasoningStyle,   // {mode,budget} intent + style: "none"|"think"|"include_reasoning"|"effort"|"effort_explicit"|"template"|"anthropic"
+      temperature, repeatPenalty, frequencyPenalty,  // sampling + anti-degeneration floor; frequency_penalty guards the plain cloud path (#426)
       countTokens, costFor,  // strategies; default heuristic / free
       grammarStyle,          // "none" | "llamacpp" | "response_format" — GBNF wire shape (§13); default "none"
       gbnfDebug,             // PLURNK_PROVIDERS_GBNF_DEBUG: validate a grammar locally + throw on invalid, but DON'T send it (§13); default false
       streaming,             // SSE transport; default true (false → one non-streamed JSON)
       supportsSlotPinning, slotCount,  // INTERNAL slot-affinity wiring (run→id_slot); never consumer-facing
-      logprobs, rawBody,     // #36 opt-in data capture (PLURNK_PROVIDERS_LOGPROB / _RAWBODY); default off
+      topLogprobs, rawBody,  // #36 opt-in data capture (PLURNK_PROVIDERS_TOP_LOGPROBS / _RAWBODY); default off
       servedModel,           // #37 backend's self-reported served id (from the probe) → Provider.servedModel
   });
   ```
 
-  The `openai` standard provider sets `grammarStyle: "llamacpp"`, `supportsSlotPinning`, and `slotCount` from the same llama-server fingerprint (`/v1/models` `meta` block + `/props`). The run→slot mapping lives inside `OpenAICompatProvider`: sticky per `runId`, round-robin across new runs, LRU-bounded.
+  The `openai` standard provider sets `grammarStyle: "llamacpp"`, `supportsSlotPinning`, and `slotCount` from the same llama-server fingerprint (`/v1/models` `meta` block + `/props`). The worker→slot mapping lives inside `OpenAICompatProvider`: sticky per `workerId`, round-robin across new runs, LRU-bounded.
 
 - **`chatCompletionStream` / `chatCompletion` / `OpenAiHttpError` / `StreamResponse`** — the shared HTTP client (`chatCompletionStream` for SSE, `chatCompletion` for the non-streamed JSON the `streaming: false` path uses). One shared copy.
-- **`normalizeUsage(raw)` / `computeCost(usage, {input, output, cached})`** — usage normalization to the §2 invariant (handles both reasoning-reporting conventions) and the single cost formula (bills `completion + reasoning` at the output rate). `OpenAICompatProvider` applies `normalizeUsage` automatically; siblings pass their per-token rates to `computeCost` in their `costFor`.
+- **`normalizeUsage(raw, reasoningText?, contentText?)` / `computeCost(usage, {input, output, cached})`** — usage normalization to the §2 invariant (handles all three reasoning-reporting conventions; the optional text args feed the Fireworks re-split, #425) and the single cost formula (bills `completion + reasoning` at the output rate). `OpenAICompatProvider` applies `normalizeUsage` automatically; siblings pass their per-token rates to `computeCost` in their `costFor`.
 - **`parseRequiredInt` / `parseOptionalInt` / `requireEnv`** — env helpers; each takes a provider `label` for error prefixing.
-- **`effortFromBudget(budget)`** — the shared thinking-budget → `low|medium|high` breakpoints.
+- **`effortFromBudget(budget)`** — the shared reasoning-budget → `low|medium|high` breakpoints.
 
-A **bespoke sibling** therefore reduces to a thin class whose `fromEnv` probes whatever it needs (model catalog, pricing, context window), builds the config, and returns `new OpenAICompatProvider(config)`. A **standard provider** (§5 tier 1) needs no sibling at all — it's a frozen entry in `STANDARD_PROVIDERS` describing its key var, base-URL var, reasoning style, and tokenizer; `standardProviderFromEnv(name, env, model)` (async — returns `Promise<Provider | null>`) does the rest. The endpoint is **required operator config** — read from the base-URL var (or a `baseUrlFromEnv` deriver) with **no in-code default**; the canonical URL lives uncommented in `.env.example`, never baked into the table.
+A **bespoke sibling** therefore reduces to a thin class whose `fromEnv` probes whatever it needs (model catalog, pricing, context window), builds the config, and returns `new OpenAICompatProvider(config)`. A **standard provider** (§5 tier 1) needs no sibling at all — it's a frozen entry in `STANDARD_PROVIDERS` describing its key var, base-URL var, reasoning style, and tokenizer; `standardProviderFromEnv(name, env, model)` (async — returns `Promise<Provider | null>`) does the rest. The endpoint's **canonical URL ships as a floored default** in `.env.defaults` (set-if-unset, overridable in the operator's env or per-alias); it is read from the base-URL var (or a `baseUrlFromEnv` deriver) with **no in-code default**, the value living in the shipped floor, never baked into the table. Only the API **key** is required operator config (a secret with no default; fail-hard when unset).
 
-The `plurnk` entry alone sets **`firstPartyMetadata: true`** — it forwards the consumer's per-turn `generate()` `attributions` (which installed plugin packages dispatched) and `client` (the originating frontend, e.g. `plurnk.nvim/1.4.0`) as `Plurnk-Attribution` / `Plurnk-Client` headers, and the opaque `runId` as `Plurnk-Run-Id` (#26). The gate lives on the provider, not the call site, so these first-party signals are **structurally incapable** of reaching a third-party backend. Empty values emit no header. It also alone sets **`balanceMetaKey: "balance_pico"`** — the top-level response field the plurnk endpoint reports the running account balance (pico-USD) in. `OpenAICompatProvider` surfaces the backend's extra top-level fields as `ProviderResponse.meta` for **every** provider (passed through), and for a provider that set `balanceMetaKey` it additionally normalizes that field into a validated `meta.balancePico`. So `balancePico` appears only from plurnk; the raw pass-through `meta` is general (#23).
+The `plurnk` entry alone sets **`firstPartyMetadata: true`** — it forwards the consumer's per-turn `generate()` `attributions` (which installed plugin packages dispatched) and `client` (the originating frontend, e.g. `plurnk.nvim/1.4.0`) as `Plurnk-Attribution` / `Plurnk-Client` headers, and the opaque `workerId` as `Plurnk-Run-Id` (#26). The gate lives on the provider, not the call site, so these first-party signals are **structurally incapable** of reaching a third-party backend. Empty values emit no header. It also alone sets **`balanceMetaKey: "balance_pico"`** — the top-level response field the plurnk endpoint reports the running account balance (pico-USD) in. `OpenAICompatProvider` surfaces the backend's extra top-level fields as `ProviderResponse.meta` for **every** provider (passed through), and for a provider that set `balanceMetaKey` it additionally normalizes that field into a validated `meta.balancePico`. So `balancePico` appears only from plurnk; the raw pass-through `meta` is general (#23).
 
 A spec may carry a **`modelPrefix`** — a constant model-id segment the backend requires but the operator's alias shouldn't repeat. `fireworks` sets `"accounts/fireworks/models/"`, so `PLURNK_MODEL_fast=fireworks/deepseek-v4-pro` carries only the distinctive tail; `standardProviderFromEnv` prepends it idempotently (an already-prefixed id is untouched) to form the wire id, which is **also** the catalog key (models.dev keys fireworks-ai on the full id). Specs without a `modelPrefix` use the model string verbatim.
 
-`contextSize` for a standard provider resolves: `PLURNK_PROVIDERS_CONTEXT_SIZE` → endpoint `n_ctx` (for `probeNctx`-flagged specs like `openai`, queried from `GET /v1/models` — llama-server reports its loaded window at `data[].meta.n_ctx`, vLLM top-level; cloud endpoints don't, yielding `null`) → `null`. The same probe fingerprints llama-server (the `meta` block) to enable grammar transport (§13), and reads the row's `id` as `servedModel` (#37) — the real served name behind a local alias — so it runs even when the env var pins the window. The probe is best-effort: any failure resolves to `null` context / no grammar capability (a legitimate "unknown"), never throws. An underivable window (env, probe, and catalog ALL missed) is surfaced once via a **`PLURNK_CONTEXT_UNKNOWN`** warning naming the model and the remediation (`PLURNK_PROVIDERS_CONTEXT_SIZE`, alias-scopable) — null stays legitimate but never silent, since budget-partitioning consumers otherwise fall back to bare numbers tuned for a different model. Operator-facing warnings (`PLURNK_TOKENIZER_HEURISTIC`, `PLURNK_PROBE_FAILED`, `PLURNK_GRAMMAR_UNVERIFIABLE`, `PLURNK_CONTEXT_UNKNOWN`) are deduplicated **once per process per (code, message)** (#40) — repeat constructions don't re-fire them, but a *different* provider/model's first surfacing is never suppressed.
+`contextWindow` for a standard provider resolves (#419): `PLURNK_PROVIDERS_CONTEXT_WINDOW` -> endpoint `n_ctx` (for `probeNctx`-flagged specs like `openai`, queried from `GET /v1/models`: llama-server reports its loaded window at `data[].meta.n_ctx`, vLLM top-level; cloud endpoints don't) -> the `@plurnk/plurnk-models` catalog -> **then the hybrid: a PROBING provider degrades to `null`, a CLOUD provider (no probe) FAILS HARD** (uncataloged + unpinned = config error, the #417 kimi case, not a guessed window). The same probe fingerprints llama-server (the `meta` block) to enable grammar transport (§13), and reads the row's `id` as `servedModel` (#37) — the real served name behind a local alias — so it runs even when the env var pins the window. The probe is best-effort: any failure resolves to `null` context / no grammar capability (a legitimate "unknown"), never throws. For a PROBING provider, an underivable window (env, probe, and catalog ALL missed) is surfaced once via a **`PLURNK_CONTEXT_UNKNOWN`** warning naming the model and the remediation (`PLURNK_PROVIDERS_CONTEXT_WINDOW`, alias-scopable) -- null stays legitimate but never silent (a CLOUD provider throws here instead, above). Operator-facing warnings (`PLURNK_TOKENIZER_HEURISTIC`, `PLURNK_PROBE_FAILED`, `PLURNK_GRAMMAR_UNVERIFIABLE`, `PLURNK_CONTEXT_UNKNOWN`, `PLURNK_FINISH_REASON_UNKNOWN`) are deduplicated **once per process per (code, message)** (#40) — repeat constructions don't re-fire them, but a *different* provider/model's first surfacing is never suppressed.
 
 ## §12 Telemetry — provider failures
 
@@ -333,11 +341,13 @@ The `TelemetryEvent` shape is mirrored **locally** (`./telemetry.ts`), structura
 - **This layer** owns capability detection, transport, **and enforcement verification**: `generate({ …, grammar })` attaches the string **verbatim** as the `grammar` body field when the backend supports it, sends no grammar-related field otherwise (cloud APIs reject unknown params), and — when it did transport a grammar — checks that the response actually conforms. The provider never chooses or modifies the grammar.
 - **The consumer** owns policy: whether to constrain a given call, and which root variant to send (e.g. the `root ::= statement` single-statement substitution that forces EOS at the close tag — the shipped `statement+` root never forces EOS, so greedy generation runs to `max_tokens`).
 
-**Sampling guard.** Greedy decoding under hard constraint degenerates into repetition loops without a penalty floor, so `OpenAICompatProvider` sends a per-request `1.15` floor alongside **every** attached grammar — never relying on server launch flags. The wire field differs by style: `repeat_penalty` on `llamacpp`, `repetition_penalty` on `response_format` (the OpenAI-compat spelling; verified honored on Fireworks, #20). (Probed live on llama.cpp b894 + gemma-4-26B; reference: plurnk-grammar `test/llama/gbnf-live.test.ts`.)
+**Sampling guard (anti-degeneration, #426).** Degeneration into repetition loops is NOT grammar-specific -- greedy/low-temperature decoding loops on the plain cloud path too -- so the penalty rides **every** request, not just grammar'd ones, and never relies on server launch flags. The wire field is keyed on the backend (`grammarStyle`): `repeat_penalty` on `llamacpp` (the managed multiplier floor, `PLURNK_PROVIDERS_REPEAT_PENALTY`, canonical `1.15`), `repetition_penalty` on `response_format`/Fireworks (same floor, the OpenAI-compat spelling, verified honored #20), and `frequency_penalty` on `none`/plain cloud (`PLURNK_PROVIDERS_FREQUENCY_PENALTY`, canonical `0.4` -- the OpenAI-standard field, since the llama.cpp `repeat_penalty` multiplier isn't accepted there). A hard grammar makes the loop WORSE (masking removes the model's natural exits), which is why the floor was born on the grammar path; #426 promoted it to the universal guard it always needed to be. (Probed live on llama.cpp b894 + gemma-4-26B; reference: plurnk-grammar `test/llama/gbnf-live.test.ts`.)
 
 **The cap is the consumer's required guard.** The repeat-penalty floor suppresses short repetition cycles, NOT long-cycle degeneration: under the multi-op root (optional EOS) at near-greedy temperatures, a constrained emission can answer correctly in its first tokens and then loop to the **context wall** (observed live: 30,736 junk tokens to `finish_reason: length`, minutes of decode reading as a "hang", with the junk echoed into the next turn's prompt — providers#10). No layer defaults a cap: the wire default is unbounded (`n_predict: -1`) and the provider transports policy, never invents it. A consumer enabling constrained sampling MUST pass `maxTokens` (or send a root variant that forces EOS).
 
-**Native reasoning and the grammar are mutually exclusive; in-DSL reasoning is the working pattern.** The GBNF masks every sampled token. With NATIVE thinking live (llama-server's own `--reasoning-budget` default, or `enable_thinking: true`), the server auto-gates the grammar past the think block — reasoning flows free — but content-channel enforcement then **leaks** (unconstrained prose, degenerates) or content never arrives; explicit `grammar_lazy`/`grammar_triggers` are ignored on the chat-completions path. The constrained configuration therefore requires the native channel **explicitly closed** — `PLURNK_PROVIDERS_REASONING=off`, which the `template` style emits as `enable_thinking: false`; mere field omission leaves the server default live, and think-inviting tasks then break the loop. With the channel closed, the model reasons **inside the DSL**: the canonical grammar's required `PLAN` statement is a free-text body the model fills with genuine step-by-step reasoning before acting (probed live, b894+gemma: correct chain-of-thought inside `<<PLAN:…:PLAN`, then a clean `SEND`, `finish_reason: stop`). The `PLAN` element belongs to the consumer's grammar contract; the provider's only job is closing the native channel deterministically.
+**Native reasoning and the grammar COEXIST on llama-server; the sanctioned think block is the protection, not the hazard (#488 postmortem).** With `enable_thinking: true`, the server auto-gates the grammar around the SANCTIONED reasoning block — the model thinks up front (routed to `reasoning_content`), then content decodes constrained. Verified: a 26-run baseline green under exactly this configuration, and ZERO grammar rejects across every #488 "railless" specimen (`@plurnk/gbnf` verdicts: accept or cap-truncated incomplete — the rail never left). The #488 rails-win-the-channel clamp (grammar forces `enable_thinking:false`) is REVERTED: closing the channel starves a reasoning-tuned model of its outlet, and it ESCAPES mid-content into the raw thought channel — which the server then discards while the decode runs unconstrained and billed (measured: 12,288 completion tokens billed, 1,033 chars visible, reasoning empty). So intent maps identically under a transported grammar, and the failure mode is SURFACED instead of traded against:
+- **Per-request rail state on `meta` (#488):** every observed-grammar response carries `meta.railsAttached` (was the grammar transported) and `meta.railsVerdict` (`accept | incomplete | reject | unverifiable` from the conformance check) — the consumer's turn row then answers "did the rail ride, and did the output conform" PER TURN from the run db, so rail presence is never again inferred from output shape.
+- **Channel-escape telemetry (#488):** billed completion tokens vastly exceeding every visible channel (`usage.completion > countTokens(content) + countTokens(reasoning) + 64`; countTokens overcounts text, so the excess is real vanishing) attaches a `grammar_unenforced` event naming the vanished balance — the run105 class (escape into a discarded reasoning block) is loud, not invisible. With the channel closed, the model reasons **inside the DSL**: the canonical grammar's required `PLAN` statement is a free-text body the model fills with genuine step-by-step reasoning before acting (probed live, b894+gemma: correct chain-of-thought inside `<<PLAN:…:PLAN`, then a clean `SEND`, `finish_reason: stop`). The `PLAN` element belongs to the consumer's grammar contract; the provider's only job is closing the native channel deterministically.
 
 **Grammar transport — same GBNF, different wire shapes (`grammarStyle`, default `"none"`).** Backends carry the *same* grammar string differently:
 - **`"llamacpp"`** — top-level `grammar` field + the repeat-penalty floor (`PLURNK_PROVIDERS_REPEAT_PENALTY`, §9). Detected from the §11 probe: only llama-server rows on `GET /v1/models` carry a `meta` block. This is any local llama-server (e.g. the generic `openai` provider fronting llama.cpp). `plurnk` opts out via `detectLlamaServer: false` — it reads a window but is treated as a plain OpenAI endpoint, never fingerprinted and never sent a grammar.
@@ -361,7 +371,7 @@ Zero grammar dependency (§11) is preserved: the GBNF string arrives per call; t
 
 Two OPT-IN knobs surface the full signal of a paid turn for downstream IQ scoring and model distillation. Both are **OFF by default** and **per-alias-scopable** (`PLURNK_PROVIDERS_<KNOB>_<alias>`): the flag *is* the isolation, so a serving turn requests nothing on the wire and carries nothing on the response — only a dataset-scraping alias opts in. Universal: any provider (standard or daughter), any backend that returns the data.
 
-**`PLURNK_PROVIDERS_LOGPROB`** (non-negative int = `top_logprobs`; unset = off). When set, `generate` requests `logprobs:true, top_logprobs:<n>` and surfaces `response.assistant.logprobs: Array<{ token, logprob, top? }>` plus `assistant.meanLogprob`. These are **managed fields** — reserved from caller `sampling`, so the env flag is the single control (a proxy consumer can't forge them). A backend that returns no logprobs yields an absent field — **never synthesized**.
+**`PLURNK_PROVIDERS_TOP_LOGPROBS`** (non-negative int = the OpenAI `top_logprobs`; unset = off). When set, `generate` requests `logprobs:true, top_logprobs:<n>` and surfaces `response.assistant.logprobs: Array<{ token, logprob, top? }>` plus `assistant.meanLogprob`. These are **managed fields** — reserved from caller `sampling`, so the env flag is the single control (a proxy consumer can't forge them). A backend that returns no logprobs yields an absent field — **never synthesized**.
 
 **The `logprob` vs `sampling_logprob` decision (the honest-confidence call).** Fireworks returns both per token: `logprob` (raw model log-probability) and `sampling_logprob` (post-sampling-transform). The structured `logprob` we surface is the **raw** value — the sampling-transform-invariant measure of the model's native belief, the correct confidence signal AND distillation target. This was settled empirically, not by assumption: under grammar the two measured **identical to full float precision**, including an *adversarial* mask (grammar forcing a token the model assigned ~8%: `logprob` −2.5229365 == `sampling_logprob` −2.5229365). A post-mask renormalization would inflate confidence toward the constraint; the raw value stays honest. Anyone wanting `sampling_logprob` reads it from `rawBody`.
 

package/dist/Mock.d.ts

@@ -17,17 +17,17 @@ export type MockReturnedAssistant = ProviderAssistant & {
 declare const DEFAULT_USAGE: ProviderUsage;
 export default class Mock implements Provider {
     #private;
-    constructor({ contextSize, responses }: {
-        contextSize: number | null;
+    constructor({ contextWindow, responses }: {
+        contextWindow: number | null;
         responses: MockResponse[];
     });
-    get contextSize(): number | null;
+    get contextWindow(): number | null;
     get model(): string;
     countTokens(text: string): number;
     costFor(_usage: ProviderUsage): number;
     generate({ signal }: {
         messages: ChatMessage[];
-        runId?: string;
+        workerId?: string;
         signal?: AbortSignal;
     }): Promise<{
         assistant: MockReturnedAssistant;

package/dist/Mock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Mock.d.ts","sourceRoot":"","sources":["../src/Mock.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExG,MAAM,MAAM,aAAa,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,KAAK,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IAKf,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACvB,SAAS,EAAE,aAAa,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG;IAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC;AAE5E,QAAA,MAAM,aAAa,EAAE,aAA+E,CAAC;AAErG,MAAM,CAAC,OAAO,OAAO,IAAK,YAAW,QAAQ;;IAIzC,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE;QAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,EAGhG;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAA8B;IAC9D,IAAI,KAAK,IAAI,MAAM,CAAmB;IAItC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhC;IAGD,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAc;IAE9C,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE;QAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,qBAAqB,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC,CAgBlK;IAED,IAAI,SAAS,IAAI,MAAM,CAA+B;CACzD;AAED,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"Mock.d.ts","sourceRoot":"","sources":["../src/Mock.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExG,MAAM,MAAM,aAAa,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,KAAK,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IAKf,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACvB,SAAS,EAAE,aAAa,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG;IAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC;AAE5E,QAAA,MAAM,aAAa,EAAE,aAA+E,CAAC;AAErG,MAAM,CAAC,OAAO,OAAO,IAAK,YAAW,QAAQ;;IAIzC,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE;QAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,EAGpG;IAED,IAAI,aAAa,IAAI,MAAM,GAAG,IAAI,CAAgC;IAClE,IAAI,KAAK,IAAI,MAAM,CAAmB;IAItC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhC;IAGD,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAc;IAE9C,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE;QAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,qBAAqB,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC,CAgBrK;IAED,IAAI,SAAS,IAAI,MAAM,CAA+B;CACzD;AAED,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,CAAC"}

package/dist/Mock.js

@@ -6,13 +6,13 @@
 // hatch — that's an intg-only convenience.
 const DEFAULT_USAGE = { prompt: 0, completion: 0, reasoning: 0, cached: 0, total: 0 };
 export default class Mock {
-    #contextSize;
+    #contextWindow;
     #queue;
-    constructor({ contextSize, responses }) {
-        this.#contextSize = contextSize;
+    constructor({ contextWindow, responses }) {
+        this.#contextWindow = contextWindow;
         this.#queue = [...responses];
     }
-    get contextSize() { return this.#contextSize; }
+    get contextWindow() { return this.#contextWindow; }
     get model() { return "mock"; }
     // Heuristic tokenizer (chars/2 upper bound, matching the framework's
     // fallback). Mock is test-only; real provider siblings ship exact counts.

package/dist/Mock.js.map

@@ -1 +1 @@
-{"version":3,"file":"Mock.js","sourceRoot":"","sources":["../src/Mock.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,2CAA2C;AA0B3C,MAAM,aAAa,GAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAErG,MAAM,CAAC,OAAO,OAAO,IAAI;IACrB,YAAY,CAAgB;IAC5B,MAAM,CAAiB;IAEvB,YAAY,EAAE,WAAW,EAAE,SAAS,EAA6D;QAC7F,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,WAAW,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAa,OAAO,MAAM,CAAC,CAAC,CAAC;IAEtC,qEAAqE;IACrE,0EAA0E;IAC1E,WAAW,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,gBAAgB;IAChB,OAAO,CAAC,MAAqB,IAAY,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpD,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAqE;QACxF,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,MAAM,SAAS,GAA0B;YACrC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,KAAK,EAAE,EAAE,GAAG,aAAa,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE;YACvC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,MAAM;YACtC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,MAAM;YACxB,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,SAAS,KAAa,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"Mock.js","sourceRoot":"","sources":["../src/Mock.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,2CAA2C;AA0B3C,MAAM,aAAa,GAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAErG,MAAM,CAAC,OAAO,OAAO,IAAI;IACrB,cAAc,CAAgB;IAC9B,MAAM,CAAiB;IAEvB,YAAY,EAAE,aAAa,EAAE,SAAS,EAA+D;QACjG,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,aAAa,KAAoB,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,KAAa,OAAO,MAAM,CAAC,CAAC,CAAC;IAEtC,qEAAqE;IACrE,0EAA0E;IAC1E,WAAW,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,gBAAgB;IAChB,OAAO,CAAC,MAAqB,IAAY,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpD,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAwE;QAC3F,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,MAAM,SAAS,GAA0B;YACrC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,KAAK,EAAE,EAAE,GAAG,aAAa,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE;YACvC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,MAAM;YACtC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,MAAM;YACxB,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,SAAS,KAAa,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,CAAC"}