@rivus/agent 0.16.1 → 0.16.6

package/dist/bootstrap/pi-feishu.js

@@ -1,4336 +1,2 @@
-import { i as resolvePiSessionToolNames, l as validatePiSkillCommand, m as createPiBashTool, n as createPiToolProxyDefinitions, p as createPiSkillReadTools, r as createPiSessionResources, t as createPiToolNameResolver } from "../chunks/pi.js";
-import { d as resolveInvocationAuthority, r as createPiSkillRuntime, s as createToolInputDigest, u as createInvocationAuthority } from "../chunks/rivus-tool.js";
-import { $t as openJsonlRecoveryControl, A as createScheduledAutomation, An as createLangfuseAgentTelemetry, Bn as createFeishuTopicContextResolver, Dn as createPiAgentLoop, Dt as createBackgroundSessionHostTools, Ei as openJsonFeishuSessionStore, En as createPiSessionRegistry, Gi as readPersistenceFile, Hi as ToolInvocationDenied, Ii as createFeishuCardDeliveryReconciler, In as createJsonlAgentEventLog, Ji as mergePiProviderModelDeclaration, Jt as createFeishuPresentationPreparation, K as createRivusMemoryToolDescriptor, Ki as isRecord$4, Lt as createBackgroundSessionService, Nt as openJsonlBackgroundSessionDeliveryStore, Oi as openJsonlFeishuInboxRepository, Ot as createBackgroundSessionSupervisor, Pi as openJsonlFeishuCardDeliveryLedger, Qr as createUuidRunIds, Si as createJsonFetchRequest, Ti as createSessionScheduler, Tn as readAutomationPresentation, Ui as createToolBroker, Un as createConfiguredFeishuTextReplySender, W as createProjectMemoryPromptPreparer, Wi as openJsonlToolOperationLedger, Wn as createConfiguredFeishuCardRolloverRuntime, Xt as createAgentHarnessPooledRuntime, Yi as writeAtomicTextFile, Yt as createFeishuDeploymentEndpoint, Zr as createSystemClock, an as createAgentsMdInstructionsProvider, bn as createJsonFileFeishuCardTargetRegistry, c as createConfiguredFeishuAutomationCardSender, d as createHumanInteractionToolApprovalGateway, en as openJsonlToolOperationLedger$1, f as createHumanInteractionEndpointRegistry, g as loadRivusDeploymentManifest, hr as createLazyFeishuWebSocketEventDispatcher, ht as resolveFeishuDeliveryChatId, ii as createAgentHarness, j as AUTOMATION_SUPPRESSION_PREFIX, jn as resolveLangfuseTelemetryConfig, jt as openJsonlBackgroundSessionRepository, k as openJsonAutomationTickRepository, l as createRoutedHumanInteractionToolApprovalService, mn as createFeishuCotPublisher, mt as createConfiguredFeishuBackgroundSessionDelivery, n as createConfiguredFeishuHumanInteractionPresenter, o as createJsonlHumanInteractionRepository, on as createWorkspaceRootHandle, qi as mergePiProviderBaseUrlOverride, t as createHumanInteractionService, tn as createToolBroker$1, tr as createConfiguredFeishuOpenApiClient, u as createHumanInteractionModelChangeApproval, wt as resolveBackgroundSessionSupervisorIntervalMs, z as openJsonlAgentMemoryService } from "../chunks/src.js";
-import { I as resolveFeishuEndpointCredentials, J as migrateRivusModelManagementConfig, K as installRivusModelManagementCliLauncher, U as runDeploymentProcessEffect, X as loadMergedLocalEnvFile, Y as parseRivusModelManagementHomeConfig, q as installRivusRuntimeManagementSkill } from "../chunks/rivus-daemon-cli.js";
-import { t as createSha256Digest } from "../chunks/sha256-digest.js";
-import { a as toRivusModelManagementSubmission, i as projectRivusModelCliResponse, r as parseRivusModelManagementWireRequest, t as createRivusModelManagementFailure } from "../chunks/rivus-model-management-wire.js";
-import { f as createBackgroundSessionStepSourceMessageId } from "../chunks/background-session-authority.js";
-import { Effect, Either } from "effect";
-import { createHash, randomUUID } from "node:crypto";
-import { chmod, mkdir, open, readFile, realpath, rename, stat, unlink } from "node:fs/promises";
-import { delimiter, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { ModelRuntime, SessionManager, SettingsManager, createAgentSession, estimateTokens } from "@earendil-works/pi-coding-agent";
-import { homedir } from "node:os";
-import { fileURLToPath } from "node:url";
-import { Type } from "typebox";
-import { createConnection, createServer } from "node:net";
-import * as Lark from "@larksuiteoapi/node-sdk";
-//#region src/adapters/pi/model-management/pi-model-run-context.ts
-const RIVUS_MODEL_CONTEXT_ENV = "RIVUS_MODEL_CONTEXT";
-const RIVUS_MODEL_SOCKET_ENV = "RIVUS_MODEL_SOCKET";
-const RIVUS_MODEL_CHANGE_TOOL_ID = "rivus.model.change";
-var PiModelRunContextError = class extends Error {
-	code;
-	name = "PiModelRunContextError";
-	constructor(code, message) {
-		super(message);
-		this.code = code;
-	}
-};
-/**
-* Keep the model-management capability bound to a concrete host-owned Run.
-* The reference is the only value that crosses into a child process; all
-* invocation identity stays in this process behind the authority WeakMap.
-*/
-function createPiModelRunContextRegistry(options) {
-	validateRegistryOptions(options);
-	const entries = /* @__PURE__ */ new Map();
-	const toolGrantSet = createToolGrantSet(options);
-	const revoke = (reference) => {
-		const normalizedReference = reference;
-		const entry = entries.get(normalizedReference);
-		if (!entry) return false;
-		entries.delete(normalizedReference);
-		entry.abortSignal.removeEventListener("abort", entry.revokeOnAbort);
-		return true;
-	};
-	const issue = (input) => {
-		const invocation = validateAgentLoopInput(input);
-		const reference = randomUUID();
-		const authority = createInvocationAuthority({
-			agentId: options.agentId,
-			allowedActorOpenIds: [...invocation.allowedActorOpenIds],
-			endpointId: invocation.endpointId,
-			instanceId: options.instanceId,
-			runId: input.runId,
-			sessionKey: input.sessionKey,
-			sourceMessageId: invocation.sourceMessageId,
-			tenantKey: invocation.tenantKey,
-			toolGrantSet
-		});
-		const context = Object.freeze({
-			reference,
-			runId: input.runId
-		});
-		const trustedRun = Object.freeze({
-			authority,
-			kind: "human"
-		});
-		const entry = {
-			abortSignal: input.abortSignal,
-			context,
-			revokeOnAbort: () => {
-				revoke(reference);
-			},
-			trustedRun
-		};
-		entries.set(reference, entry);
-		input.abortSignal.addEventListener("abort", entry.revokeOnAbort, { once: true });
-		return context;
-	};
-	return Object.freeze({
-		issue,
-		resolveRun: (reference) => entries.get(reference)?.trustedRun,
-		revoke
-	});
-}
-/**
-* Inject the private transport values at process spawn time. The SDK passes
-* this hook the command and environment separately, so the opaque reference
-* never becomes model prompt content, an argv item, or a JSON request field.
-*/
-function createPiModelManagementBashSpawnHook(options) {
-	if (!isAbsolute(options.socketPath)) throw new Error(`${RIVUS_MODEL_SOCKET_ENV} must be an absolute path`);
-	if (!isContextReference(options.context.reference)) throw new Error(`${RIVUS_MODEL_CONTEXT_ENV} must be an issued opaque reference`);
-	const socketPath = options.socketPath;
-	const contextReference = options.context.reference;
-	return ({ command, cwd, env }) => ({
-		command,
-		cwd,
-		env: {
-			...env,
-			[RIVUS_MODEL_CONTEXT_ENV]: contextReference,
-			[RIVUS_MODEL_SOCKET_ENV]: socketPath
-		}
-	});
-}
-function validateRegistryOptions(options) {
-	if (!isNonEmptyString(options.agentId) || !isNonEmptyString(options.instanceId)) throw new Error("model Run context registry requires a Host agentId and instanceId");
-	if (!isNonEmptyString(options.toolGrantSet.revision)) throw new Error("model Run context registry requires a tool grant revision");
-	if (options.toolGrantSet.toolIds.some((toolId) => !isNonEmptyString(toolId))) throw new Error("model Run context registry requires non-empty tool grant ids");
-}
-function createToolGrantSet(options) {
-	const toolIds = new Set(options.toolGrantSet.toolIds);
-	if (options.modelManagementEnabled === true) toolIds.add(RIVUS_MODEL_CHANGE_TOOL_ID);
-	return {
-		revision: options.toolGrantSet.revision,
-		toolIds: [...toolIds]
-	};
-}
-function validateAgentLoopInput(input) {
-	if (!isRecord$3(input) || !isAbortSignal(input.abortSignal) || !isNonEmptyString(input.runId) || !isNonEmptyString(input.sessionKey) || typeof input.text !== "string") throw new PiModelRunContextError("invalid-input", "model management requires a concrete AgentLoopInput from the active Host Run");
-	if (input.abortSignal.aborted) throw new PiModelRunContextError("run-aborted", "model management cannot issue a context for an aborted Run");
-	const invocation = input.invocation;
-	if (!isHumanTrustedFeishuInvocation(invocation)) throw new PiModelRunContextError("untrusted-invocation", "model management requires one trusted human Feishu invocation actor");
-	return invocation;
-}
-function isHumanTrustedFeishuInvocation(value) {
-	if (!isRecord$3(value) || value.kind !== "feishu" || !Array.isArray(value.allowedActorOpenIds) || value.allowedActorOpenIds.length !== 1) return false;
-	return value.allowedActorOpenIds.every(isNonEmptyString) && isNonEmptyString(value.endpointId) && isNonEmptyString(value.sourceMessageId) && isNonEmptyString(value.tenantKey);
-}
-function isContextReference(value) {
-	return /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
-}
-function isAbortSignal(value) {
-	return isRecord$3(value) && typeof value.aborted === "boolean" && typeof value.addEventListener === "function" && typeof value.removeEventListener === "function";
-}
-function isNonEmptyString(value) {
-	return typeof value === "string" && value.trim().length > 0;
-}
-function isRecord$3(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-//#endregion
-//#region src/adapters/pi/model-management/pi-managed-session-context.ts
-/** Bind the existing Bash tool to the current Run without adding a model-visible tool. */
-function createPiManagedSessionContext(options) {
-	let context;
-	const deactivate = () => {
-		if (context) options.contexts.revoke(context.reference);
-		context = void 0;
-	};
-	return {
-		activate: (input) => {
-			deactivate();
-			if (input.invocation?.kind === "feishu" && input.invocation.allowedActorOpenIds.length === 1) context = options.contexts.issue(input);
-		},
-		deactivate,
-		tool: createPiBashTool(options.cwd, {
-			...options.bashToolOptions,
-			spawnHook: (spawn) => {
-				const { RIVUS_MODEL_CONTEXT: _context, RIVUS_MODEL_SOCKET: _socket, ...baseEnv } = spawn.env;
-				const prepared = {
-					...spawn,
-					env: {
-						...baseEnv,
-						PATH: [
-							options.binDirectory,
-							dirname(options.nodeExecutable),
-							baseEnv.PATH
-						].filter(Boolean).join(delimiter),
-						RIVUS_MODEL_MANAGEMENT_ENABLED: "true",
-						RIVUS_MODEL_SOCKET: options.socketPath
-					}
-				};
-				return context ? createPiModelManagementBashSpawnHook({
-					context,
-					socketPath: options.socketPath
-				})(prepared) : prepared;
-			}
-		})
-	};
-}
-//#endregion
-//#region src/adapters/pi/model-management/pi-model-resolution.ts
-var PiModelResolutionError = class extends Error {
-	name = "PiModelResolutionError";
-	code;
-	resolutionCode;
-	constructor(resolutionCode, message) {
-		super(message);
-		this.code = resolutionCode === "provider-unknown" ? "model_change_provider_unsupported" : "model_change_target_unsupported";
-		this.resolutionCode = resolutionCode;
-	}
-};
-/**
-* Resolve one exact provider/model pair from the installed Pi model runtime.
-*
-* Model aliases and fuzzy matches are intentionally excluded here. Natural-language
-* interpretation belongs to the application/Agent; the activation boundary must bind
-* to the exact model that the SDK can actually construct.
-*/
-function resolvePiModel(options) {
-	const provider = options.target.provider.trim();
-	const modelId = options.target.model.trim();
-	if (!provider || !modelId || provider.includes("/") || modelId.includes("\n")) throw new PiModelResolutionError("invalid-reference", "Pi model target must contain a provider and model id without a provider separator in either component");
-	if (options.modelRuntime.getModels(provider).length === 0) {
-		if (!options.modelRuntime.getProvider(provider)) throw new PiModelResolutionError("provider-unknown", `Pi provider is not installed: ${provider}`);
-		throw new PiModelResolutionError("model-unknown", `Pi provider ${provider} has no known model metadata; configure a declarative model before activation`);
-	}
-	const model = options.modelRuntime.getModel(provider, modelId);
-	if (!model) throw new PiModelResolutionError("model-unknown", `Pi model ${provider}/${modelId} is not present in the installed model catalog`);
-	return model;
-}
-/**
-* Ensure metadata for an exact model id that is absent from the installed SDK
-* catalog, then recompose the provider from models.json. Phase 1 only ships the
-* verified DeepSeek declaration required by the management contract; all other
-* unknown ids fail closed and must be supplied by a future explicit catalog path.
-*/
-async function ensurePiModel(options) {
-	try {
-		return resolvePiModel(options);
-	} catch (error) {
-		if (!(error instanceof PiModelResolutionError) || error.resolutionCode !== "model-unknown") throw error;
-	}
-	const definition = knownPiDeclarativeModel(options.modelRuntime, options.target);
-	if (!definition) throw new PiModelResolutionError("model-unknown", `Pi model ${options.target.provider}/${options.target.model} is not present in the installed model catalog and has no approved declarative metadata`);
-	await mergePiProviderModelDeclaration({
-		filePath: options.modelsPath,
-		model: definition,
-		provider: options.target.provider
-	});
-	const refreshError = (await refreshPiModelCatalog(options.modelRuntime, {
-		allowNetwork: false,
-		provider: options.target.provider,
-		...options.signal ? { signal: options.signal } : {}
-	})).errors.get(options.target.provider);
-	if (refreshError) throw new PiModelResolutionError("model-unknown", `Pi provider ${options.target.provider} could not load declarative model metadata: ${refreshError.message}`);
-	return resolvePiModel(options);
-}
-/** Refresh installed SDK metadata, retaining the SDK's persisted declarative catalog. */
-async function refreshPiModelCatalog(modelRuntime, options = {}) {
-	const providers = options.provider === void 0 ? void 0 : [options.provider];
-	const result = await modelRuntime.refresh({
-		allowNetwork: options.allowNetwork ?? false,
-		...providers ? { providers } : {},
-		...options.signal ? { signal: options.signal } : {}
-	});
-	const refreshedProviders = providers ?? modelRuntime.getRegisteredProviderIds();
-	return Object.freeze({
-		errors: result.errors,
-		refreshedProviders: Object.freeze([...refreshedProviders])
-	});
-}
-function knownPiDeclarativeModel(modelRuntime, target) {
-	if (target.provider !== "deepseek" || target.model !== "deepseek-flash") return void 0;
-	const source = modelRuntime.getModel("deepseek", "deepseek-v4-flash");
-	if (!source) return void 0;
-	return {
-		api: source.api,
-		baseUrl: source.baseUrl,
-		...source.compat ? { compat: source.compat } : {},
-		contextWindow: 1e6,
-		cost: {
-			cacheRead: .006,
-			cacheWrite: 0,
-			input: .3,
-			output: 1.2
-		},
-		id: target.model,
-		input: ["text", "image"],
-		maxTokens: 384e3,
-		name: "DeepSeek V4.1 Flash",
-		reasoning: true,
-		...source.samplingParams ? { samplingParams: source.samplingParams } : {},
-		...source.thinkingLevelMap ? { thinkingLevelMap: source.thinkingLevelMap } : {}
-	};
-}
-//#endregion
-//#region src/adapters/pi/model-management/pi-model-management-grant.ts
-/** Read the Host's current grant and provider binding without exposing credentials. */
-async function readPiModelManagementGrant(options, homeId, baseline) {
-	const env = options.envFilePath ? await loadMergedLocalEnvFile(options.envFilePath, options.environmentOverrides) : options.environmentOverrides;
-	const configuration = parseRivusModelManagementHomeConfig(env);
-	const keyFile = env.PI_API_KEY_FILE?.trim();
-	const inlineKey = env.PI_API_KEY?.trim();
-	if (keyFile && inlineKey) throw new Error("PI_API_KEY and PI_API_KEY_FILE cannot both be set.");
-	const credential = keyFile ? (await readFile(keyFile, "utf8")).trim() : inlineKey || (options.modelAuthPath ? await readPersistenceFile(options.modelAuthPath) ?? "runtime-auth" : "runtime-auth");
-	if (!credential) throw new Error("The model provider credential is empty.");
-	return {
-		bindingRevision: createToolInputDigest({
-			adapter: "pi-model-management-v1",
-			baseUrl: env.PI_BASE_URL?.trim() || "provider-default",
-			credential,
-			provider: baseline.provider,
-			configuredThinkingLevel: env.PI_THINKING_LEVEL?.trim() || null,
-			thinkingLevel: options.thinkingLevel
-		}, createSha256Digest),
-		budget: {
-			maxOutputTokens: 40960,
-			maxPaidRequests: 5,
-			recoveryReserveOutputTokens: 8192,
-			recoveryReservePaidRequests: 1
-		},
-		enabled: configuration.enabled,
-		endpointId: options.endpointId,
-		homeId,
-		operations: ["set", "rollback"],
-		ownerId: configuration.ownerOpenId ?? "disabled",
-		provider: baseline.provider,
-		revision: 1,
-		requireApproval: configuration.requireApproval,
-		tenantKey: configuration.tenantKey ?? "disabled",
-		timeoutMs: 3e5
-	};
-}
-//#endregion
-//#region src/adapters/pi/model-management/pi-history-compatibility.ts
-var PiHistoryCompatibilityError = class extends Error {
-	name = "PiHistoryCompatibilityError";
-	code = "model_change_history_incompatible";
-	messageIndex;
-	constructor(message, messageIndex) {
-		super(message);
-		this.messageIndex = messageIndex;
-	}
-};
-/**
-* Check the structural parts of a persisted Pi transcript that providers need for
-* the next request. The transcript is never returned or copied; only counts are
-* exposed for diagnostics. This deliberately rejects orphaned tool calls/results
-* instead of deleting or rewriting history during a model change.
-*/
-function inspectPiSessionHistory(sessionManager) {
-	const context = sessionManager.buildSessionContext();
-	const pendingToolCalls = /* @__PURE__ */ new Map();
-	let assistantThinkingBlocks = 0;
-	let assistantToolCalls = 0;
-	let imageBlocks = 0;
-	let toolResults = 0;
-	for (const [messageIndex, message] of context.messages.entries()) {
-		if (!isRecord$2(message) || typeof message.role !== "string") throw new PiHistoryCompatibilityError("Pi session history contains a malformed message", messageIndex);
-		if (message.role === "assistant") {
-			const content = message.content;
-			if (!Array.isArray(content)) throw new PiHistoryCompatibilityError("Pi assistant history message content must be an array", messageIndex);
-			for (const block of content) {
-				if (!isRecord$2(block) || typeof block.type !== "string") throw new PiHistoryCompatibilityError("Pi assistant history contains a malformed content block", messageIndex);
-				if (block.type === "thinking") {
-					if (typeof block.thinking !== "string") throw new PiHistoryCompatibilityError("Pi assistant thinking content is malformed", messageIndex);
-					assistantThinkingBlocks += 1;
-					continue;
-				}
-				if (block.type === "toolCall") {
-					if (typeof block.id !== "string" || !block.id || typeof block.name !== "string" || !block.name) throw new PiHistoryCompatibilityError("Pi assistant tool call is malformed", messageIndex);
-					if (!isRecord$2(block.arguments)) throw new PiHistoryCompatibilityError("Pi assistant tool call arguments are malformed", messageIndex);
-					pendingToolCalls.set(block.id, block.name);
-					assistantToolCalls += 1;
-					continue;
-				}
-				if (block.type === "text") {
-					if (typeof block.text !== "string") throw new PiHistoryCompatibilityError("Pi assistant text content is malformed", messageIndex);
-					continue;
-				}
-				if (block.type === "image") {
-					if (typeof block.data !== "string" || typeof block.mimeType !== "string") throw new PiHistoryCompatibilityError("Pi assistant image content is malformed", messageIndex);
-					imageBlocks += 1;
-					continue;
-				}
-				throw new PiHistoryCompatibilityError(`Pi assistant content type is unsupported: ${String(block.type)}`, messageIndex);
-			}
-			continue;
-		}
-		if (message.role === "toolResult") {
-			const content = message.content;
-			if (!Array.isArray(content)) throw new PiHistoryCompatibilityError("Pi tool result content must be an array", messageIndex);
-			if (typeof message.toolCallId !== "string" || !pendingToolCalls.has(message.toolCallId)) throw new PiHistoryCompatibilityError("Pi tool result has no preceding assistant tool call", messageIndex);
-			if (typeof message.toolName !== "string" || !message.toolName) throw new PiHistoryCompatibilityError("Pi tool result is missing its tool name", messageIndex);
-			if (pendingToolCalls.get(message.toolCallId) !== message.toolName) throw new PiHistoryCompatibilityError("Pi tool result tool name does not match its assistant tool call", messageIndex);
-			imageBlocks += countImageBlocks(content);
-			validatePlainContent(content, messageIndex, "tool result");
-			pendingToolCalls.delete(message.toolCallId);
-			toolResults += 1;
-			continue;
-		}
-		if (message.role === "user") {
-			if (typeof message.content !== "string") {
-				if (!Array.isArray(message.content)) throw new PiHistoryCompatibilityError("Pi user history content must be text or an array", messageIndex);
-				imageBlocks += countImageBlocks(message.content);
-				validatePlainContent(message.content, messageIndex, "user");
-			}
-			continue;
-		}
-		if (message.role === "custom") {
-			if (typeof message.customType !== "string" || typeof message.display !== "boolean") throw new PiHistoryCompatibilityError("Pi custom history message metadata is malformed", messageIndex);
-			if (typeof message.content === "string") continue;
-			if (!Array.isArray(message.content)) throw new PiHistoryCompatibilityError("Pi custom history content must be text or an array", messageIndex);
-			imageBlocks += countImageBlocks(message.content);
-			validatePlainContent(message.content, messageIndex, "custom");
-			continue;
-		}
-		if (message.role === "bashExecution") {
-			if (typeof message.command !== "string" || typeof message.output !== "string" || typeof message.cancelled !== "boolean" || typeof message.truncated !== "boolean" || message.exitCode !== void 0 && message.exitCode !== null && typeof message.exitCode !== "number" || message.fullOutputPath !== void 0 && typeof message.fullOutputPath !== "string" || message.excludeFromContext !== void 0 && typeof message.excludeFromContext !== "boolean") throw new PiHistoryCompatibilityError("Pi bash history message is malformed", messageIndex);
-			continue;
-		}
-		if (message.role === "branchSummary") {
-			if (typeof message.summary !== "string" || typeof message.fromId !== "string") throw new PiHistoryCompatibilityError("Pi branch summary history message is malformed", messageIndex);
-			continue;
-		}
-		if (message.role === "compactionSummary") {
-			if (typeof message.summary !== "string" || typeof message.tokensBefore !== "number" || !Number.isFinite(message.tokensBefore) || message.tokensBefore < 0) throw new PiHistoryCompatibilityError("Pi compaction summary history message is malformed", messageIndex);
-			continue;
-		}
-		throw new PiHistoryCompatibilityError(`Pi history role is unsupported: ${String(message.role)}`, messageIndex);
-	}
-	if (pendingToolCalls.size > 0) throw new PiHistoryCompatibilityError("Pi session history contains an assistant tool call without a result", context.messages.length);
-	return Object.freeze({
-		assistantThinkingBlocks,
-		assistantToolCalls,
-		compatible: true,
-		imageBlocks,
-		messageCount: context.messages.length,
-		toolResults
-	});
-}
-function countImageBlocks(content) {
-	return content.filter((block) => isRecord$2(block) && block.type === "image").length;
-}
-function assertPiSessionHistoryCompatible(sessionManager) {
-	return inspectPiSessionHistory(sessionManager);
-}
-function validatePlainContent(content, messageIndex, role) {
-	for (const block of content) {
-		if (!isRecord$2(block) || typeof block.type !== "string") throw new PiHistoryCompatibilityError(`Pi ${role} history contains a malformed content block`, messageIndex);
-		if (block.type === "text") {
-			if (typeof block.text !== "string") throw new PiHistoryCompatibilityError(`Pi ${role} text content is malformed`, messageIndex);
-			continue;
-		}
-		if (block.type === "image") {
-			if (typeof block.data !== "string" || typeof block.mimeType !== "string") throw new PiHistoryCompatibilityError(`Pi ${role} image content is malformed`, messageIndex);
-			continue;
-		}
-		throw new PiHistoryCompatibilityError(`Pi ${role} content type is unsupported: ${block.type}`, messageIndex);
-	}
-}
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region src/adapters/pi/model-management/pi-model-call-deadline.ts
-var PiModelCallDeadlineExceeded = class extends Error {
-	name = "PiModelCallDeadlineExceeded";
-};
-/** Race a provider or SDK promise against the Run deadline without retaining a late result. */
-async function awaitPiModelCall(promise, options = {}) {
-	const completion = Promise.resolve(promise);
-	const signal = options.signal;
-	if (!signal) return completion;
-	let settled = false;
-	const observed = completion.then((value) => {
-		settled = true;
-		return value;
-	}, (error) => {
-		settled = true;
-		throw error;
-	});
-	let removeAbortListener;
-	const aborted = new Promise((_resolve, reject) => {
-		const handleAbort = () => {
-			if (settled) return;
-			options.onAbort?.();
-			reject(options.isDeadlineExceeded?.() ? new PiModelCallDeadlineExceeded(options.deadlineMessage ?? "Pi model call deadline elapsed") : signal.reason instanceof Error ? signal.reason : new Error(options.abortMessage ?? "Pi model call aborted"));
-		};
-		if (options.isDeadlineExceeded?.() || signal.aborted) handleAbort();
-		else {
-			signal.addEventListener("abort", handleAbort, { once: true });
-			removeAbortListener = () => signal.removeEventListener("abort", handleAbort);
-		}
-	});
-	try {
-		const value = await Promise.race([observed, aborted]);
-		if (options.isDeadlineExceeded?.()) throw new PiModelCallDeadlineExceeded(options.deadlineMessage ?? "Pi model call deadline elapsed");
-		return value;
-	} finally {
-		removeAbortListener?.();
-		if (!settled) observed.catch(() => void 0);
-	}
-}
-//#endregion
-//#region src/adapters/pi/model-management/pi-model-probe.ts
-const PI_MODEL_PROBE_TOOL_NAME = "rivus_model_management_probe";
-const PI_MODEL_PROBE_TOOL_RESULT = "RIVUS_MODEL_PROBE_TOOL_OK";
-const probeToolParameters = Type.Object({ probe: Type.String() });
-var PiModelProbeError = class extends Error {
-	name = "PiModelProbeError";
-	code;
-	outcome;
-	constructor(message, outcome, options, code = "model_change_probe_failed") {
-		super(message, options);
-		this.code = code;
-		this.outcome = outcome;
-	}
-};
-/**
-* Exercise a candidate through the same Pi model runtime used by business runs.
-* The probe builds an in-memory synthetic context, performs an actual streamed
-* tool call, feeds the real fixed tool result into a second streamed request, and
-* then sends a separate follow-up request. It never loads a persisted transcript
-* or exposes business tools.
-*/
-function probePiModel(options) {
-	return Effect.gen(function* () {
-		const context = {
-			messages: [{
-				content: "This is an isolated compatibility probe. Call the fixed probe Tool exactly once, then repeat the exact Tool result in your response.",
-				role: "user",
-				timestamp: Date.now()
-			}],
-			systemPrompt: "You are running an isolated model compatibility probe. You must call the rivus_model_management_probe Tool exactly once with a short probe value. After receiving its result, repeat its exact result text in your response. Do not call any other Tool.",
-			tools: [{
-				description: "A fixed no-side-effect probe Tool used only for model compatibility checks.",
-				name: PI_MODEL_PROBE_TOOL_NAME,
-				parameters: probeToolParameters
-			}]
-		};
-		const transcript = [];
-		const initial = yield* streamProbeTurn(options, context, "initial");
-		transcript.push(initial.turn);
-		const toolCall = findSingleProbeToolCall(initial.message);
-		if (!toolCall) return yield* Effect.fail(new PiModelProbeError("candidate did not request the fixed probe Tool in its first streamed response", "known"));
-		if (typeof toolCall.arguments.probe !== "string" || toolCall.arguments.probe.length === 0) return yield* Effect.fail(new PiModelProbeError("candidate supplied invalid arguments to the fixed probe Tool", "known"));
-		const toolResult = {
-			content: [{
-				text: `${PI_MODEL_PROBE_TOOL_RESULT}:${randomUUID()}`,
-				type: "text"
-			}],
-			details: { probe: true },
-			isError: false,
-			role: "toolResult",
-			timestamp: Date.now(),
-			toolCallId: toolCall.id,
-			toolName: PI_MODEL_PROBE_TOOL_NAME
-		};
-		context.messages.push(initial.message, toolResult);
-		const toolResultText = toolResult.content[0].text;
-		const afterTool = yield* streamProbeTurn(options, context, "tool-result");
-		transcript.push({
-			...afterTool.turn,
-			toolResult: {
-				content: toolResultText,
-				toolCallId: toolCall.id,
-				toolName: PI_MODEL_PROBE_TOOL_NAME
-			}
-		});
-		if (!readText(afterTool.message).includes(toolResultText)) return yield* Effect.fail(new PiModelProbeError("candidate did not consume the fixed probe Tool result in its next streamed response", "known"));
-		if (findToolCalls(afterTool.message).length > 0) return yield* Effect.fail(new PiModelProbeError("candidate requested an additional Tool during the probe", "known"));
-		context.messages.push(afterTool.message, {
-			content: "Follow up after the Tool roundtrip. Reply with RIVUS_MODEL_PROBE_FOLLOWUP_OK.",
-			role: "user",
-			timestamp: Date.now()
-		});
-		const followup = yield* streamProbeTurn(options, context, "follow-up");
-		transcript.push(followup.turn);
-		if (findToolCalls(followup.message).length > 0) return yield* Effect.fail(new PiModelProbeError("candidate requested a Tool during the probe follow-up", "known"));
-		const followupText = readText(followup.message);
-		if (!followupText.includes("RIVUS_MODEL_PROBE_FOLLOWUP_OK")) return yield* Effect.fail(new PiModelProbeError("candidate did not produce the fixed probe follow-up response", "known"));
-		const assistantThinkingBlocks = transcript.reduce((count, turn) => count + turn.assistant.content.filter((content) => isRecord$1(content) && content.type === "thinking").length, 0);
-		const outputTokens = transcript.reduce((sum, turn) => sum + readOutputTokens(turn.assistant.usage), 0);
-		return Object.freeze({
-			assistantThinkingBlocks,
-			followupText,
-			model: Object.freeze({
-				id: options.model.id,
-				provider: options.model.provider
-			}),
-			outputTokens,
-			passed: true,
-			thinkingLevel: options.thinkingLevel,
-			toolResultText,
-			toolCallId: toolCall.id,
-			toolName: PI_MODEL_PROBE_TOOL_NAME,
-			transcript: Object.freeze(transcript)
-		});
-	});
-}
-function streamProbeTurn(options, context, kind) {
-	return streamPaidProbeCall({
-		budget: options.budget,
-		context,
-		description: `Pi model probe ${kind}`,
-		kind: "validation",
-		model: options.model,
-		modelRuntime: options.modelRuntime,
-		...options.signal ? { signal: options.signal } : {},
-		thinkingLevel: options.thinkingLevel,
-		validate: (message) => assertProbeStopReason(message, kind)
-	}).pipe(Effect.map(({ message, reservation }) => ({
-		message,
-		turn: {
-			assistant: snapshotAssistant(message),
-			kind,
-			reservationId: reservation.id
-		}
-	})));
-}
-/** Run one bounded, synthetic request for activation/recovery canaries. */
-function runPiModelCanary(options) {
-	return streamPaidProbeCall({
-		budget: options.budget,
-		context: {
-			messages: [{
-				content: "Reply with the exact text RIVUS_MODEL_CANARY_OK.",
-				role: "user",
-				timestamp: Date.now()
-			}],
-			systemPrompt: "This is an isolated model canary. Reply with RIVUS_MODEL_CANARY_OK and do not call tools."
-		},
-		description: `Pi model ${options.kind} canary`,
-		kind: options.kind,
-		model: options.model,
-		modelRuntime: options.modelRuntime,
-		...options.signal ? { signal: options.signal } : {},
-		thinkingLevel: options.thinkingLevel,
-		validate: (message) => {
-			assertCanaryStopReason(message);
-			if (!readText(message).includes("RIVUS_MODEL_CANARY_OK")) throw new PiModelProbeError("model canary did not produce the fixed response", "known");
-		}
-	}).pipe(Effect.map(({ message, outputTokens }) => Object.freeze({
-		assistant: snapshotAssistant(message),
-		outputTokens
-	})));
-}
-function streamPaidProbeCall(options) {
-	return Effect.gen(function* () {
-		const reservation = yield* options.budget.reservePaidCall({ kind: options.kind });
-		const callSignal = yield* Effect.sync(() => createPaidCallSignal(options.signal, options.budget.deadlineAt));
-		let settled = false;
-		const settle = (input) => options.budget.settlePaidCall({
-			...input,
-			reservation
-		}).pipe(Effect.tap(() => Effect.sync(() => {
-			settled = true;
-		})));
-		return yield* Effect.gen(function* () {
-			if (callSignal.expired) {
-				yield* settle({
-					outcome: "known",
-					outputTokens: 0
-				});
-				return yield* Effect.fail(new PiModelProbeError("model change deadline elapsed before the provider request", "known", void 0, "model_change_deadline_exceeded"));
-			}
-			const message = yield* Effect.tryPromise({
-				try: async () => {
-					const stream = options.modelRuntime.streamSimple(options.model, options.context, {
-						signal: callSignal.signal,
-						maxTokens: reservation.maxOutputTokens,
-						maxRetries: 0,
-						maxRetryDelayMs: 0,
-						...options.thinkingLevel === "off" ? {} : { reasoning: options.thinkingLevel }
-					});
-					return await awaitPiModelCall((async () => {
-						for await (const _event of stream) callSignal.signal.throwIfAborted();
-						callSignal.signal.throwIfAborted();
-						return await stream.result();
-					})(), {
-						abortMessage: "model probe aborted",
-						deadlineMessage: "model change deadline elapsed during provider streaming",
-						isDeadlineExceeded: callSignal.isDeadlineExceeded,
-						signal: callSignal.signal
-					});
-				},
-				catch: (error) => error
-			}).pipe(Effect.catchAll((error) => {
-				const deadlineExceeded = callSignal.isDeadlineExceeded() || error instanceof PiModelCallDeadlineExceeded;
-				const probeError = new PiModelProbeError(deadlineExceeded ? `${options.description} stream exceeded the model change deadline` : `${options.description} stream failed: ${error instanceof Error ? error.message : String(error)}`, "unknown", { cause: error }, deadlineExceeded ? "model_change_deadline_exceeded" : "model_change_probe_failed");
-				return settle({
-					outcome: "unknown",
-					outputTokens: reservation.maxOutputTokens
-				}).pipe(Effect.zipRight(Effect.fail(probeError)));
-			}));
-			const outputTokens = readOutputTokens(message.usage);
-			yield* settle({
-				outcome: "known",
-				outputTokens
-			});
-			yield* Effect.try({
-				try: () => options.validate(message),
-				catch: (error) => error
-			});
-			return {
-				message,
-				outputTokens,
-				reservation
-			};
-		}).pipe(Effect.ensuring(Effect.uninterruptible(Effect.suspend(() => settled ? Effect.void : settle({
-			outcome: "unknown",
-			outputTokens: reservation.maxOutputTokens
-		})).pipe(Effect.orDie))), Effect.ensuring(Effect.sync(callSignal.dispose)));
-	});
-}
-function createPaidCallSignal(parent, deadlineAt) {
-	const controller = new AbortController();
-	const deadlineMs = Date.parse(deadlineAt);
-	const remainingMs = deadlineMs - Date.now();
-	let deadlineExceeded = !Number.isFinite(deadlineMs) || remainingMs <= 0;
-	let timer;
-	const onParentAbort = () => controller.abort(parent?.reason);
-	if (parent) if (parent.aborted) controller.abort(parent.reason);
-	else parent.addEventListener("abort", onParentAbort, { once: true });
-	if (remainingMs > 0 && !controller.signal.aborted) timer = setTimeout(() => {
-		deadlineExceeded = true;
-		controller.abort(/* @__PURE__ */ new Error("model change deadline elapsed"));
-	}, Math.min(remainingMs, 2147483647));
-	return {
-		expired: deadlineExceeded,
-		isDeadlineExceeded: () => deadlineExceeded || Number.isFinite(deadlineMs) && Date.now() >= deadlineMs,
-		signal: controller.signal,
-		dispose: () => {
-			if (timer) clearTimeout(timer);
-			parent?.removeEventListener("abort", onParentAbort);
-			if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("model probe cancelled"));
-		}
-	};
-}
-function assertProbeStopReason(message, kind) {
-	if (message.stopReason === "error" || message.stopReason === "aborted") throw new PiModelProbeError(`candidate streamed an ${message.stopReason} response: ${message.errorMessage ?? "unknown provider error"}`, "known");
-	if (message.stopReason === "length" || message.stopReason === "deferred") throw new PiModelProbeError(`candidate response was truncated or deferred during ${kind}`, "known");
-	if (kind !== "initial" && message.stopReason !== "stop") throw new PiModelProbeError(`candidate used unsupported stop reason ${message.stopReason} during ${kind}`, "known");
-}
-function assertCanaryStopReason(message) {
-	if (message.stopReason === "error" || message.stopReason === "aborted") throw new PiModelProbeError(`model canary streamed an ${message.stopReason} response: ${message.errorMessage ?? "unknown provider error"}`, "known");
-	if (message.stopReason === "length" || message.stopReason === "deferred" || message.stopReason !== "stop") throw new PiModelProbeError(`model canary used unsupported stop reason ${message.stopReason}`, "known");
-}
-function findSingleProbeToolCall(message) {
-	const calls = findToolCalls(message);
-	if (calls.length !== 1 || calls[0]?.name !== "rivus_model_management_probe") return void 0;
-	const call = calls[0];
-	return {
-		arguments: call.arguments,
-		id: call.id
-	};
-}
-function findToolCalls(message) {
-	return message.content.flatMap((content) => {
-		if (!isRecord$1(content) || content.type !== "toolCall") return [];
-		return [{
-			arguments: isRecord$1(content.arguments) ? content.arguments : {},
-			id: typeof content.id === "string" ? content.id : "",
-			name: typeof content.name === "string" ? content.name : ""
-		}];
-	});
-}
-function readText(message) {
-	return message.content.filter((content) => isRecord$1(content) && content.type === "text" && typeof content.text === "string").map((content) => content.text).join("");
-}
-function snapshotAssistant(message) {
-	return Object.freeze({
-		content: Object.freeze(message.content.map((content) => cloneSerializable(content))),
-		model: message.model,
-		provider: message.provider,
-		stopReason: message.stopReason,
-		usage: Object.freeze(cloneSerializable(message.usage))
-	});
-}
-function readOutputTokens(usage) {
-	if (isRecord$1(usage) && typeof usage.output === "number" && Number.isSafeInteger(usage.output) && usage.output >= 0) return usage.output;
-	return 0;
-}
-function cloneSerializable(value) {
-	if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value;
-	if (Array.isArray(value)) return value.map(cloneSerializable);
-	if (!isRecord$1(value)) return void 0;
-	return Object.fromEntries(Object.entries(value).filter(([, nested]) => typeof nested !== "function" && nested !== void 0).map(([key, nested]) => [key, cloneSerializable(nested)]));
-}
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region src/adapters/pi/model-management/pi-model-runtime.ts
-var PiModelRuntimeMutationUnknownError = class extends Error {
-	name = "PiModelRuntimeMutationUnknownError";
-	outcome = "unknown";
-	constructor(message, options) {
-		super(message, options);
-	}
-};
-var PiModelTargetCompatibilityError = class extends Error {
-	name = "PiModelTargetCompatibilityError";
-	code = "model_change_target_unsupported";
-};
-/**
-* Adapter around Pi's live AgentSession instances.
-*
-* The application owns the safe Run boundary. Once that boundary is held, this
-* adapter waits for every cached session, validates its persisted context, and
-* calls AgentSession.setModel so the session manager and conversation history
-* survive the switch. Disposing cached sessions would silently create a new
-* transcript on the next Run and is therefore intentionally unsupported here.
-*/
-function createPiModelRuntime(options) {
-	const registries = new Set(options.sessionRegistries ?? []);
-	const unsettledMutations = /* @__PURE__ */ new Set();
-	let active = options.initial;
-	let selectionInitializationStarted = options.initial !== void 0;
-	const resolveCandidate = async (context, operation) => {
-		assertOperationActive(operation);
-		const model = options.modelRuntime.getModel(context.target.provider, context.target.model);
-		const resolved = model ? model : options.modelCatalogPath ? await ensurePiModel({
-			modelRuntime: options.modelRuntime,
-			modelsPath: options.modelCatalogPath,
-			target: context.target,
-			...operation?.signal ? { signal: operation.signal } : {}
-		}) : resolvePiModel({
-			modelRuntime: options.modelRuntime,
-			target: context.target
-		});
-		assertOperationActive(operation);
-		return Object.freeze({
-			binding: Object.freeze({
-				bindingRevision: context.bindingRevision,
-				model: resolved.id,
-				provider: resolved.provider
-			}),
-			model: resolved
-		});
-	};
-	const listSessions = async () => {
-		const handles = await Promise.all([...registries].map((registry) => registry.list()));
-		const unique = [];
-		const seen = /* @__PURE__ */ new Set();
-		for (const handle of handles.flat()) {
-			if (seen.has(handle)) continue;
-			seen.add(handle);
-			unique.push(handle);
-		}
-		return unique;
-	};
-	const waitForIdleAndCheckHistory = async (model, operation) => {
-		assertOperationActive(operation);
-		const sessions = await listSessions();
-		let abortPromise;
-		const abortSessions = () => {
-			if (abortPromise) return abortPromise;
-			abortPromise = Promise.all(sessions.map((handle) => Promise.resolve().then(() => handle.session.abort?.()))).then(() => void 0);
-			return abortPromise;
-		};
-		const onAbort = () => {
-			abortSessions();
-		};
-		const signal = operation?.signal;
-		if (signal) signal.addEventListener("abort", onAbort, { once: true });
-		try {
-			if (signal?.aborted) abortSessions();
-			await awaitPiModelCall(Promise.all(sessions.map((handle) => Promise.resolve().then(() => handle.session.waitForIdle?.()))), {
-				onAbort: abortSessions,
-				...signal ? { signal } : {}
-			});
-			assertOperationActive(operation);
-			for (const handle of sessions) {
-				assertOperationActive(operation);
-				const manager = handle.session.sessionManager;
-				if (!manager) continue;
-				const context = manager.buildSessionContext();
-				const history = assertPiSessionHistoryCompatible(manager);
-				if (model) {
-					if (history.imageBlocks > 0 && !model.input.includes("image")) throw new PiModelTargetCompatibilityError(`Pi model ${model.provider}/${model.id} does not support ${history.imageBlocks} image history block(s)`);
-					if (hasTextInput(context.messages) && !model.input.includes("text")) throw new PiModelTargetCompatibilityError(`Pi model ${model.provider}/${model.id} does not support text history input`);
-					const estimatedTokens = context.messages.reduce((total, message) => total + estimateTokens(message), 0);
-					if (!Number.isFinite(model.contextWindow) || estimatedTokens > model.contextWindow) throw new PiModelTargetCompatibilityError(`Pi model ${model.provider}/${model.id} context window ${model.contextWindow} is smaller than the estimated ${estimatedTokens}-token session history`);
-				}
-			}
-			assertOperationActive(operation);
-		} finally {
-			if (signal) signal.removeEventListener("abort", onAbort);
-			if (abortPromise) abortPromise.catch(() => void 0);
-		}
-		return sessions;
-	};
-	const setSessionsModel = async (sessions, model, thinkingLevel, operation) => {
-		assertNoUnsettledMutations();
-		for (const handle of sessions) {
-			assertOperationActive(operation);
-			if (!handle.session.setModel) throw new Error("Pi session does not expose live setModel; refusing to discard its history");
-			await awaitModelMutation(Promise.resolve().then(() => {
-				assertOperationActive(operation);
-				return handle.session.setModel(model);
-			}), operation);
-			assertOperationActive(operation);
-			handle.session.setThinkingLevel?.(thinkingLevel);
-			assertOperationActive(operation);
-			await awaitModelMutation(Promise.resolve().then(() => {
-				assertOperationActive(operation);
-				return handle.refreshResources?.();
-			}), operation);
-			assertOperationActive(operation);
-			await awaitModelMutation(Promise.resolve().then(() => {
-				assertOperationActive(operation);
-				return handle.session.reload?.();
-			}), operation);
-			assertOperationActive(operation);
-		}
-	};
-	const trackUnsettledMutation = (promise) => {
-		const tracked = promise.then(() => void 0, () => void 0);
-		unsettledMutations.add(tracked);
-		tracked.then(() => unsettledMutations.delete(tracked), () => unsettledMutations.delete(tracked));
-	};
-	const awaitModelMutation = async (promise, operation) => {
-		let timedOut = false;
-		const completion = Promise.resolve(promise);
-		try {
-			if (!operation?.signal) return completion;
-			return await awaitPiModelCall(completion, {
-				onAbort: () => {
-					timedOut = true;
-					trackUnsettledMutation(completion);
-				},
-				signal: operation.signal
-			});
-		} catch (error) {
-			if (timedOut) throw new PiModelRuntimeMutationUnknownError("Pi model session mutation did not settle before the model change deadline", { cause: error });
-			throw error;
-		}
-	};
-	const assertNoUnsettledMutations = () => {
-		if (unsettledMutations.size > 0) throw new PiModelRuntimeMutationUnknownError("A previous Pi model session mutation is still settling; refusing a concurrent mutation");
-	};
-	const createProbeBudget = (budget) => {
-		const settlements = /* @__PURE__ */ new Map();
-		return {
-			deadlineAt: budget.deadlineAt,
-			reservePaidCall: ({ kind, maxOutputTokens }) => budget.reservePaidCall({
-				kind,
-				...maxOutputTokens === void 0 ? {} : { maxOutputTokens }
-			}).pipe(Effect.tap((result) => Effect.sync(() => settlements.set(result.reservation.id, result.settle))), Effect.map((result) => result.reservation)),
-			settlePaidCall: ({ outcome, outputTokens, reservation }) => Effect.suspend(() => {
-				const settle = settlements.get(reservation.id);
-				if (!settle) return Effect.fail(/* @__PURE__ */ new Error(`Pi probe attempted to settle unknown budget reservation: ${reservation.id}`));
-				return settle({
-					outcome,
-					outputTokens
-				}).pipe(Effect.tap(() => Effect.sync(() => settlements.delete(reservation.id))), Effect.asVoid);
-			})
-		};
-	};
-	const runCanary = (kind, model, budget, operation) => runPiModelCanary({
-		budget: createProbeBudget(budget),
-		kind,
-		model,
-		modelRuntime: options.modelRuntime,
-		signal: operation.signal,
-		thinkingLevel: currentThinkingLevel()
-	});
-	return {
-		activate: (input) => Effect.gen(function* () {
-			const operation = yield* Effect.sync(() => createOperationSignal(input.budget.deadlineAt));
-			return yield* Effect.gen(function* () {
-				yield* Effect.try({
-					try: assertNoUnsettledMutations,
-					catch: (error) => error
-				});
-				const candidate = yield* Effect.tryPromise({
-					try: () => resolveCandidate(input.context, operation),
-					catch: (error) => error
-				});
-				if (!sameTarget$1(candidate.binding, input.validation.model)) return yield* Effect.fail(/* @__PURE__ */ new Error("Pi activation candidate does not match validated model"));
-				const canary = yield* runCanary("activation", candidate.model, input.budget, operation);
-				const sessions = yield* Effect.tryPromise({
-					try: () => waitForIdleAndCheckHistory(candidate.model, operation),
-					catch: (error) => error
-				});
-				if (input.beforeApply) yield* input.beforeApply();
-				yield* Effect.tryPromise({
-					try: () => setSessionsModel(sessions, candidate.model, currentThinkingLevel(), operation),
-					catch: (error) => error
-				});
-				active = {
-					binding: candidate.binding,
-					model: candidate.model,
-					thinkingLevel: currentThinkingLevel()
-				};
-				return Object.freeze({
-					evidence: Object.freeze({
-						canary: canary.assistant,
-						kind: "pi-model-activation-canary-v1",
-						model: candidate.binding,
-						sessionCount: sessions.length
-					}),
-					outputTokens: canary.outputTokens,
-					switched: true
-				});
-			}).pipe(Effect.ensuring(Effect.sync(operation.dispose)));
-		}),
-		current: () => Effect.succeed(active?.binding),
-		drain: (context) => Effect.gen(function* () {
-			const operation = yield* Effect.sync(() => createOperationSignal(context.deadlineAt));
-			yield* Effect.tryPromise({
-				try: async () => {
-					try {
-						const candidate = await resolveCandidate(context, operation);
-						await waitForIdleAndCheckHistory(candidate.model, operation);
-					} finally {
-						operation.dispose();
-					}
-				},
-				catch: (error) => error
-			});
-		}),
-		refreshModelCatalog: (input = {}) => Effect.tryPromise({
-			try: async () => {
-				const operation = createOperationSignal(input.deadlineAt, input.signal);
-				try {
-					assertOperationActive({
-						...input.deadlineAt === void 0 ? {} : { deadlineAt: input.deadlineAt },
-						signal: operation.signal
-					});
-					const result = await options.modelRuntime.refresh({
-						allowNetwork: input.allowNetwork ?? false,
-						...input.provider ? { providers: [input.provider] } : {},
-						signal: operation.signal
-					});
-					if (result.errors.size > 0) throw new Error([...result.errors.entries()].map(([provider, error]) => `${provider}: ${error.message}`).join("; "));
-					assertOperationActive({
-						...input.deadlineAt === void 0 ? {} : { deadlineAt: input.deadlineAt },
-						signal: operation.signal
-					});
-				} finally {
-					operation.dispose();
-				}
-			},
-			catch: (error) => error
-		}),
-		registerSessionRegistry: (registry) => {
-			registries.add(registry);
-			return () => registries.delete(registry);
-		},
-		initializeSelection: (input) => Effect.tryPromise({
-			try: async () => {
-				if (selectionInitializationStarted || active !== void 0) throw new Error("Pi model runtime selection has already been initialized");
-				if (registries.size > 0) throw new Error("Pi model runtime selection must be initialized before any Pi session registry is attached");
-				selectionInitializationStarted = true;
-				try {
-					const context = {
-						baseline: input.binding,
-						bindingRevision: input.binding.bindingRevision,
-						requestId: "startup",
-						target: input.binding
-					};
-					const candidate = await resolveCandidate(context);
-					active = {
-						binding: candidate.binding,
-						model: candidate.model,
-						thinkingLevel: input.thinkingLevel
-					};
-				} catch (error) {
-					selectionInitializationStarted = false;
-					throw error;
-				}
-			},
-			catch: (error) => error
-		}),
-		getSessionOptions: () => Object.freeze({
-			...active?.model ? { model: active.model } : {},
-			...active?.thinkingLevel ? { thinkingLevel: active.thinkingLevel } : {}
-		}),
-		releasePrevious: (input) => Effect.try({
-			try: () => {
-				assertBeforeDeadline$1(input.deadlineAt);
-			},
-			catch: (error) => error
-		}),
-		restore: (input) => Effect.gen(function* () {
-			const baselineContext = {
-				...input.context,
-				target: input.context.baseline
-			};
-			const operation = yield* Effect.sync(() => createOperationSignal(input.budget.deadlineAt));
-			return yield* Effect.gen(function* () {
-				yield* Effect.try({
-					try: assertNoUnsettledMutations,
-					catch: (error) => error
-				});
-				const baseline = yield* Effect.tryPromise({
-					try: () => resolveCandidate(baselineContext, operation),
-					catch: (error) => error
-				});
-				const canary = yield* runCanary("restore", baseline.model, input.budget, operation);
-				const sessions = yield* Effect.tryPromise({
-					try: () => waitForIdleAndCheckHistory(baseline.model, operation),
-					catch: (error) => error
-				});
-				yield* Effect.tryPromise({
-					try: () => setSessionsModel(sessions, baseline.model, currentThinkingLevel(), operation),
-					catch: (error) => error
-				});
-				active = {
-					binding: baseline.binding,
-					model: baseline.model,
-					thinkingLevel: currentThinkingLevel()
-				};
-				return Object.freeze({
-					evidence: Object.freeze({
-						canary: canary.assistant,
-						kind: "pi-model-restore-canary-v1",
-						model: baseline.binding,
-						reason: input.reason,
-						sessionCount: sessions.length
-					}),
-					restored: true
-				});
-			}).pipe(Effect.ensuring(Effect.sync(operation.dispose)));
-		}),
-		validate: (input) => Effect.gen(function* () {
-			const operation = yield* Effect.sync(() => createOperationSignal(input.budget.deadlineAt));
-			return yield* Effect.gen(function* () {
-				const candidate = yield* Effect.tryPromise({
-					try: () => resolveCandidate(input.context, operation),
-					catch: (error) => error
-				});
-				const probe = yield* probePiModel({
-					budget: createProbeBudget(input.budget),
-					model: candidate.model,
-					modelRuntime: options.modelRuntime,
-					signal: operation.signal,
-					thinkingLevel: currentThinkingLevel()
-				});
-				return Object.freeze({
-					evidence: Object.freeze({
-						assistantThinkingBlocks: probe.assistantThinkingBlocks,
-						followupText: probe.followupText,
-						kind: "pi-model-probe-v1",
-						model: probe.model,
-						outputTokens: probe.outputTokens,
-						toolCallId: probe.toolCallId,
-						toolName: probe.toolName,
-						transcript: probe.transcript,
-						toolRoundtrip: true
-					}),
-					model: candidate.binding,
-					outputTokens: probe.outputTokens,
-					passed: true
-				});
-			}).pipe(Effect.ensuring(Effect.sync(operation.dispose)));
-		})
-	};
-	function currentThinkingLevel() {
-		return active?.thinkingLevel ?? "medium";
-	}
-}
-function sameTarget$1(left, right) {
-	return left.bindingRevision === right.bindingRevision && left.provider === right.provider && left.model === right.model;
-}
-function hasTextInput(messages) {
-	return messages.some((message) => {
-		if (!isRecord(message) || typeof message.role !== "string") return false;
-		if (message.role === "user" || message.role === "custom" || message.role === "toolResult") return hasTextContent(message.content);
-		if (message.role === "assistant") return Array.isArray(message.content) ? message.content.some((block) => isRecord(block) && (block.type === "text" && typeof block.text === "string" || block.type === "thinking" || block.type === "toolCall")) : false;
-		return message.role === "bashExecution" || message.role === "branchSummary" || message.role === "compactionSummary";
-	});
-}
-function hasTextContent(content) {
-	if (typeof content === "string") return content.length > 0;
-	return Array.isArray(content) && content.some((block) => isRecord(block) && block.type === "text" && typeof block.text === "string");
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function createOperationSignal(deadlineAt, parent) {
-	const controller = new AbortController();
-	let timer;
-	const onParentAbort = () => controller.abort(parent?.reason);
-	if (parent) if (parent.aborted) onParentAbort();
-	else parent.addEventListener("abort", onParentAbort, { once: true });
-	if (deadlineAt !== void 0) {
-		const remaining = Date.parse(deadlineAt) - Date.now();
-		if (!Number.isFinite(remaining) || remaining <= 0) controller.abort(/* @__PURE__ */ new Error("Pi model management deadline elapsed"));
-		else timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("Pi model management deadline elapsed")), remaining);
-	}
-	return {
-		signal: controller.signal,
-		dispose: () => {
-			if (timer) clearTimeout(timer);
-			if (parent) parent.removeEventListener("abort", onParentAbort);
-			if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("Pi model operation disposed"));
-		}
-	};
-}
-function assertBeforeDeadline$1(deadlineAt) {
-	if (deadlineAt === void 0) return;
-	const deadline = Date.parse(deadlineAt);
-	if (!Number.isFinite(deadline) || Date.now() >= deadline) throw new Error("Pi model management deadline elapsed");
-}
-function assertOperationActive(operation) {
-	assertBeforeDeadline$1(operation?.deadlineAt);
-	if (operation?.signal?.aborted) {
-		const reason = operation.signal.reason;
-		throw reason instanceof Error ? reason : /* @__PURE__ */ new Error("Pi model operation aborted");
-	}
-}
-//#endregion
-//#region src/core/application/deployment/model/model-change-contracts.ts
-var ModelChangeRequestConflict = class extends Error {
-	name = "ModelChangeRequestConflict";
-};
-var ModelChangeRevisionConflict = class extends Error {
-	name = "ModelChangeRevisionConflict";
-};
-var ModelChangeBusy = class extends Error {
-	name = "ModelChangeBusy";
-};
-var ModelChangeNotFound = class extends Error {
-	name = "ModelChangeNotFound";
-};
-var ModelChangeAuthorizationRejected = class extends Error {
-	name = "ModelChangeAuthorizationRejected";
-};
-//#endregion
-//#region src/core/application/deployment/model/model-change-budget.ts
-var ModelChangeBudgetExceeded = class extends Error {
-	name = "ModelChangeBudgetExceeded";
-};
-var ModelChangeBudgetCorrupted = class extends Error {
-	name = "ModelChangeBudgetCorrupted";
-};
-function createModelChangeBudget(limits, now) {
-	assertBudgetLimits(limits);
-	assertBeforeDeadline(now, limits.deadlineAt);
-	return Object.freeze({
-		deadlineAt: limits.deadlineAt,
-		identity: limits.identity,
-		maxOutputTokens: limits.maxOutputTokens,
-		maxPaidRequests: limits.maxPaidRequests,
-		outputTokens: 0,
-		paidRequests: 0,
-		recoveryReserveOutputTokens: limits.recoveryReserveOutputTokens,
-		recoveryReservePaidRequests: limits.recoveryReservePaidRequests,
-		reservations: Object.freeze({}),
-		reservedOutputTokens: 0,
-		reservedPaidRequests: 0
-	});
-}
-function createAwaitingModelChangeBudget(deadlineAt) {
-	if (!Number.isFinite(Date.parse(deadlineAt))) throw new ModelChangeBudgetCorrupted("invalid awaiting Model change deadline");
-	return Object.freeze({
-		deadlineAt,
-		identity: "awaiting-approval",
-		maxOutputTokens: 0,
-		maxPaidRequests: 0,
-		outputTokens: 0,
-		paidRequests: 0,
-		recoveryReserveOutputTokens: 0,
-		recoveryReservePaidRequests: 0,
-		reservations: Object.freeze({}),
-		reservedOutputTokens: 0,
-		reservedPaidRequests: 0
-	});
-}
-function carryModelChangeBudgetUsage(budget, usage) {
-	validateModelChangeBudget(budget);
-	if (!Number.isSafeInteger(usage.paidRequests) || usage.paidRequests < 0 || !Number.isSafeInteger(usage.outputTokens) || usage.outputTokens < 0 || usage.paidRequests > budget.maxPaidRequests || usage.outputTokens > budget.maxOutputTokens) throw new ModelChangeBudgetExceeded("existing Model change budget usage is invalid");
-	return Object.freeze({
-		...budget,
-		outputTokens: usage.outputTokens,
-		paidRequests: usage.paidRequests
-	});
-}
-function reserveModelChangeBudget(budget, input) {
-	validateModelChangeBudget(budget);
-	assertBeforeDeadline(input.at, budget.deadlineAt);
-	if (budget.reservations[input.id]) throw new ModelChangeBudgetCorrupted(`duplicate budget reservation: ${input.id}`);
-	if (budget.maxPaidRequests - budget.paidRequests - budget.reservedPaidRequests <= (input.kind === "restore" ? 0 : budget.recoveryReservePaidRequests)) throw new ModelChangeBudgetExceeded("model change paid request budget exhausted");
-	const remaining = budget.maxOutputTokens - budget.outputTokens - budget.reservedOutputTokens;
-	const outputRecoveryReserve = input.kind === "restore" ? 0 : budget.recoveryReserveOutputTokens;
-	if (remaining <= outputRecoveryReserve) throw new ModelChangeBudgetExceeded("model change output token recovery reserve exhausted");
-	const availableOutputTokens = remaining - outputRecoveryReserve;
-	const maxOutputTokens = input.maxOutputTokens ?? availableOutputTokens;
-	if (!Number.isSafeInteger(maxOutputTokens) || maxOutputTokens <= 0 || maxOutputTokens > availableOutputTokens) throw new ModelChangeBudgetExceeded("model change output token budget exhausted");
-	const reservation = Object.freeze({
-		id: input.id,
-		kind: input.kind,
-		maxOutputTokens,
-		paidRequests: 1,
-		reservedAt: input.at
-	});
-	return {
-		budget: Object.freeze({
-			...budget,
-			reservations: Object.freeze({
-				...budget.reservations,
-				[input.id]: reservation
-			}),
-			reservedOutputTokens: budget.reservedOutputTokens + maxOutputTokens,
-			reservedPaidRequests: budget.reservedPaidRequests + 1
-		}),
-		reservation
-	};
-}
-function settleModelChangeBudget(budget, input) {
-	validateModelChangeBudget(budget);
-	const reservation = budget.reservations[input.id];
-	if (!reservation) throw new ModelChangeBudgetCorrupted(`unknown budget reservation: ${input.id}`);
-	if (!Number.isSafeInteger(input.outputTokens) || input.outputTokens < 0) throw new ModelChangeBudgetCorrupted("model change output token usage must be a non-negative integer");
-	if (input.outputTokens > reservation.maxOutputTokens) throw new ModelChangeBudgetExceeded("model change output token budget exceeded by paid call");
-	const { [input.id]: _removed, ...remainingReservations } = budget.reservations;
-	return Object.freeze({
-		...budget,
-		outputTokens: budget.outputTokens + input.outputTokens,
-		paidRequests: budget.paidRequests + reservation.paidRequests,
-		reservations: Object.freeze(remainingReservations),
-		reservedOutputTokens: budget.reservedOutputTokens - reservation.maxOutputTokens,
-		reservedPaidRequests: budget.reservedPaidRequests - reservation.paidRequests
-	});
-}
-/** Unknown provider results consume the reservation and must never be retried. */
-function settleUnknownModelChangeBudget(budget, input) {
-	const reservation = budget.reservations[input.id];
-	if (!reservation) throw new ModelChangeBudgetCorrupted(`unknown budget reservation: ${input.id}`);
-	return settleModelChangeBudget(budget, {
-		id: input.id,
-		outputTokens: reservation.maxOutputTokens
-	});
-}
-function settleModelChangePaidCall(pending, input) {
-	if (input.outcome === "unknown") return {
-		...pending,
-		budget: settleUnknownModelChangeBudget(pending.budget, { id: input.id }),
-		phase: input.kind === "restore" ? "recovery-required" : "validation-unknown",
-		unknownPaidCallId: input.id
-	};
-	const budget = settleModelChangeBudget(pending.budget, {
-		id: input.id,
-		outputTokens: input.outputTokens
-	});
-	const { unknownPaidCallId: _unknownPaidCallId, ...withoutUnknown } = pending;
-	return {
-		...withoutUnknown,
-		budget
-	};
-}
-function validateModelChangeBudget(budget) {
-	if (typeof budget.identity !== "string" || budget.identity.length === 0 || !Number.isSafeInteger(budget.maxPaidRequests) || budget.maxPaidRequests < 0 || !Number.isSafeInteger(budget.maxOutputTokens) || budget.maxOutputTokens < 0 || !Number.isSafeInteger(budget.recoveryReserveOutputTokens) || budget.recoveryReserveOutputTokens < 0 || budget.recoveryReserveOutputTokens > budget.maxOutputTokens || !Number.isSafeInteger(budget.recoveryReservePaidRequests) || budget.recoveryReservePaidRequests < 0 || budget.recoveryReservePaidRequests > budget.maxPaidRequests || !Number.isSafeInteger(budget.paidRequests) || budget.paidRequests < 0 || !Number.isSafeInteger(budget.outputTokens) || budget.outputTokens < 0 || !Number.isSafeInteger(budget.reservedPaidRequests) || budget.reservedPaidRequests < 0 || !Number.isSafeInteger(budget.reservedOutputTokens) || budget.reservedOutputTokens < 0 || budget.paidRequests + budget.reservedPaidRequests > budget.maxPaidRequests || budget.outputTokens + budget.reservedOutputTokens > budget.maxOutputTokens || !Number.isFinite(Date.parse(budget.deadlineAt))) throw new ModelChangeBudgetCorrupted("invalid model change budget");
-	let paidReservations = 0;
-	let outputReservations = 0;
-	for (const reservation of Object.values(budget.reservations)) {
-		if (reservation.paidRequests !== 1 || reservation.kind !== "activation" && reservation.kind !== "restore" && reservation.kind !== "validation" || !Number.isSafeInteger(reservation.maxOutputTokens) || reservation.maxOutputTokens <= 0 || !Number.isFinite(Date.parse(reservation.reservedAt))) throw new ModelChangeBudgetCorrupted("invalid model change budget reservation");
-		paidReservations += reservation.paidRequests;
-		outputReservations += reservation.maxOutputTokens;
-	}
-	if (paidReservations !== budget.reservedPaidRequests || outputReservations !== budget.reservedOutputTokens) throw new ModelChangeBudgetCorrupted("model change budget reservation totals do not match");
-}
-function assertBudgetLimits(limits) {
-	if (typeof limits.identity !== "string" || limits.identity.length === 0 || !Number.isSafeInteger(limits.maxPaidRequests) || limits.maxPaidRequests < 0 || !Number.isSafeInteger(limits.maxOutputTokens) || limits.maxOutputTokens < 0 || !Number.isSafeInteger(limits.recoveryReserveOutputTokens) || limits.recoveryReserveOutputTokens < 0 || limits.recoveryReserveOutputTokens > limits.maxOutputTokens || !Number.isSafeInteger(limits.recoveryReservePaidRequests) || limits.recoveryReservePaidRequests < 0 || limits.recoveryReservePaidRequests > limits.maxPaidRequests || !Number.isFinite(Date.parse(limits.deadlineAt))) throw new ModelChangeBudgetCorrupted("invalid model change budget limits");
-}
-function assertBeforeDeadline(now, deadlineAt) {
-	const nowMs = Date.parse(now);
-	const deadlineMs = Date.parse(deadlineAt);
-	if (!Number.isFinite(nowMs) || !Number.isFinite(deadlineMs)) throw new ModelChangeBudgetCorrupted("model change budget timestamps must be ISO timestamps");
-	if (nowMs >= deadlineMs) throw new ModelChangeBudgetExceeded("model change budget deadline has passed");
-}
-//#endregion
-//#region src/adapters/outbound/persistence/deployment/model-state/model-state-codec.ts
-function encodeModelState(state) {
-	validateModelState(state);
-	const document = {
-		state: structuredClone(state),
-		version: 1
-	};
-	return `${JSON.stringify(document)}\n`;
-}
-function decodeModelState(raw) {
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		throw new Error("Model state is not valid JSON");
-	}
-	if (!isRecord$4(parsed) || parsed.version !== 1 || !isRecord$4(parsed.state)) throw new Error("Unsupported Model state document");
-	return validateModelState(parsed.state);
-}
-function validateModelState(value) {
-	if (!isRecord$4(value) || value.schemaVersion !== 1) throw new Error("invalid Model state schema version");
-	if (typeof value.homeId !== "string" || value.homeId.length === 0 || typeof value.ownerId !== "string" || value.ownerId.length === 0 || !Number.isSafeInteger(value.revision) || value.revision < 0 || typeof value.updatedAt !== "string" || !Number.isFinite(Date.parse(value.updatedAt)) || !isRecord$4(value.requests)) throw new Error("invalid Model state metadata");
-	const current = readBinding(value.current, "current");
-	const previous = value.previous === void 0 ? void 0 : readBinding(value.previous, "previous");
-	if (previous && sameModelBinding(previous, current)) throw new Error("Model state previous binding must differ from current");
-	const requests = {};
-	for (const [requestId, receipt] of Object.entries(value.requests)) {
-		if (requestId.length === 0) throw new Error("Model state request id cannot be empty");
-		const restored = readReceipt(receipt);
-		if (restored.requestId !== requestId) throw new Error(`Model state request key mismatch: ${requestId}`);
-		requests[requestId] = restored;
-	}
-	const pending = value.pending === void 0 ? void 0 : readPending(value.pending);
-	if (pending) {
-		const receipt = requests[pending.request.requestId];
-		if (!receipt || receipt.status !== "pending") throw new Error(`Model state pending request is missing its pending receipt: ${pending.request.requestId}`);
-		if (pending.expectedRevision !== value.revision || pending.bindingRevision !== current.bindingRevision) throw new Error("Model state pending revision or binding mismatch");
-		if (pending.ownerId !== void 0 && pending.ownerId !== value.ownerId || pending.principal !== void 0 && (pending.principal.homeId !== value.homeId || pending.principal.ownerId !== value.ownerId)) throw new Error("Model state pending principal does not own this Home");
-		if (receipt.inputDigest !== pending.inputDigest || receipt.operation !== pending.operation || receipt.expectedRevision !== pending.expectedRevision || receipt.bindingRevision !== pending.bindingRevision || receipt.budgetIdentity !== pending.budgetIdentity || !sameReference(receipt.target, pending.target) || !sameBudget(receipt.budget, pending.budget) || !samePrincipal(receipt.principal, pending.principal) || !sameOptionalBinding(receipt.previous, previous) || receipt.phase !== pending.phase || receipt.current === void 0 || !sameModelBinding(receipt.current, current)) throw new Error("Model state pending receipt does not match its durable request");
-	} else if (Object.values(requests).some((receipt) => receipt.status === "pending")) throw new Error("Model state contains a pending receipt without a pending request");
-	const state = {
-		current,
-		homeId: value.homeId,
-		ownerId: value.ownerId,
-		...pending ? { pending } : {},
-		...previous ? { previous } : {},
-		...value.recoveryRequired === void 0 ? {} : { recoveryRequired: readError(value.recoveryRequired) },
-		requests: Object.freeze(requests),
-		revision: value.revision,
-		schemaVersion: 1,
-		updatedAt: value.updatedAt
-	};
-	return structuredClone(state);
-}
-function readBinding(value, label) {
-	if (!isRecord$4(value) || typeof value.provider !== "string" || value.provider.length === 0 || typeof value.model !== "string" || value.model.length === 0 || typeof value.bindingRevision !== "string" || value.bindingRevision.length === 0) throw new Error(`invalid Model state ${label} binding`);
-	return Object.freeze({
-		bindingRevision: value.bindingRevision,
-		model: value.model,
-		provider: value.provider
-	});
-}
-function readSource(value) {
-	if (!isRecord$4(value) || value.kind !== "automation" && value.kind !== "human" || typeof value.reference !== "string" || value.reference.length === 0) throw new Error("invalid Model change source");
-	return Object.freeze({
-		kind: value.kind,
-		reference: value.reference
-	});
-}
-function readBudget(value) {
-	if (!isRecord$4(value) || typeof value.deadlineAt !== "string" || typeof value.identity !== "string" || typeof value.maxOutputTokens !== "number" || typeof value.maxPaidRequests !== "number" || typeof value.outputTokens !== "number" || typeof value.paidRequests !== "number" || typeof value.recoveryReserveOutputTokens !== "number" || typeof value.recoveryReservePaidRequests !== "number" || typeof value.reservedOutputTokens !== "number" || typeof value.reservedPaidRequests !== "number" || !isRecord$4(value.reservations)) throw new Error("invalid Model change budget");
-	const reservations = {};
-	for (const [id, reservation] of Object.entries(value.reservations)) {
-		if (!isRecord$4(reservation) || reservation.id !== id || reservation.kind !== "activation" && reservation.kind !== "restore" && reservation.kind !== "validation" || reservation.paidRequests !== 1 || typeof reservation.maxOutputTokens !== "number" || typeof reservation.reservedAt !== "string") throw new Error(`invalid Model change budget reservation: ${id}`);
-		reservations[id] = Object.freeze({
-			id,
-			kind: reservation.kind,
-			maxOutputTokens: reservation.maxOutputTokens,
-			paidRequests: 1,
-			reservedAt: reservation.reservedAt
-		});
-	}
-	const budget = {
-		deadlineAt: value.deadlineAt,
-		identity: value.identity,
-		maxOutputTokens: value.maxOutputTokens,
-		maxPaidRequests: value.maxPaidRequests,
-		outputTokens: value.outputTokens,
-		paidRequests: value.paidRequests,
-		recoveryReserveOutputTokens: value.recoveryReserveOutputTokens,
-		recoveryReservePaidRequests: value.recoveryReservePaidRequests,
-		reservations: Object.freeze(reservations),
-		reservedOutputTokens: value.reservedOutputTokens,
-		reservedPaidRequests: value.reservedPaidRequests
-	};
-	validateModelChangeBudget(budget);
-	return Object.freeze(budget);
-}
-function readError(value) {
-	if (!isRecord$4(value) || typeof value.code !== "string" || typeof value.message !== "string" || value.outcome !== "known" && value.outcome !== "unknown" || value.stage !== "activation" && value.stage !== "boundary" && value.stage !== "commit" && value.stage !== "notification" && value.stage !== "restore" && value.stage !== "validation") throw new Error("invalid Model change error");
-	return Object.freeze({
-		code: value.code,
-		message: value.message,
-		outcome: value.outcome,
-		stage: value.stage
-	});
-}
-function readNotification(value) {
-	if (!isRecord$4(value) || !Number.isSafeInteger(value.attempts) || value.attempts < 0 || value.status !== "pending" && value.status !== "sent" && value.status !== "unknown" || value.lastAttemptAt !== void 0 && (typeof value.lastAttemptAt !== "string" || !Number.isFinite(Date.parse(value.lastAttemptAt)))) throw new Error("invalid Model change notification state");
-	return Object.freeze({
-		attempts: value.attempts,
-		...value.lastAttemptAt === void 0 ? {} : { lastAttemptAt: value.lastAttemptAt },
-		status: value.status
-	});
-}
-function readReceipt(value) {
-	if (!isRecord$4(value) || typeof value.requestId !== "string" || value.requestId.length === 0 || value.operation !== "set" && value.operation !== "rollback" || typeof value.acceptedAt !== "string" || !Number.isFinite(Date.parse(value.acceptedAt)) || typeof value.updatedAt !== "string" || !Number.isFinite(Date.parse(value.updatedAt)) || !Number.isSafeInteger(value.expectedRevision) || value.expectedRevision < 0 || !Number.isSafeInteger(value.revision) || value.revision < 0 || typeof value.inputDigest !== "string" || typeof value.bindingRevision !== "string" || value.bindingRevision.length === 0 || typeof value.budgetIdentity !== "string" || value.budgetIdentity.length === 0 || value.inputDigest.length === 0 || value.status !== "pending" && value.status !== "applied" && value.status !== "failed" && value.status !== "restored" && value.status !== "recovery-required" || !isModelChangePhase(value.phase)) throw new Error("invalid Model change receipt");
-	const budget = readBudget(value.budget);
-	const current = value.current === void 0 ? void 0 : readBinding(value.current, "receipt current");
-	const previous = value.previous === void 0 ? void 0 : readBinding(value.previous, "receipt previous");
-	const target = readTarget(value.target);
-	const error = value.error === void 0 ? void 0 : readError(value.error);
-	const notification = value.notification === void 0 ? void 0 : readNotification(value.notification);
-	const principal = value.principal === void 0 ? void 0 : readPrincipal(value.principal);
-	const authorizationId = value.authorizationId === void 0 ? void 0 : requireString(value.authorizationId, "authorizationId");
-	if (value.operation === "set" && target === void 0) throw new Error("Model set receipt requires a target");
-	if (value.operation === "rollback" && target !== void 0) throw new Error("Model rollback receipt cannot contain a target");
-	if (value.status === "pending") {
-		if (value.phase === "awaiting-approval") {
-			if (authorizationId === void 0 || principal === void 0 || budget.identity !== "awaiting-approval") throw new Error("Model state awaiting receipt is missing its durable approval binding");
-		} else if (authorizationId === void 0 || principal === void 0 || budget.identity === "awaiting-approval") throw new Error("Model state pending receipt is missing trusted authorization state");
-	} else if (authorizationId === void 0 || principal === void 0 || budget.identity === "awaiting-approval") throw new Error("Model state final receipt is missing trusted authorization state");
-	validateReceiptPhase(value.status, value.phase);
-	if (budget.identity !== value.budgetIdentity) throw new Error("Model change receipt budget identity mismatch");
-	return Object.freeze({
-		...modelChangeRecordBase(value.acceptedAt, authorizationId, value.bindingRevision, budget, value.budgetIdentity),
-		...current ? { current } : {},
-		...error ? { error } : {},
-		expectedRevision: value.expectedRevision,
-		inputDigest: value.inputDigest,
-		operation: value.operation,
-		phase: value.phase,
-		...previous ? { previous } : {},
-		...principal ? { principal } : {},
-		requestId: value.requestId,
-		revision: value.revision,
-		status: value.status,
-		...target ? { target } : {},
-		updatedAt: value.updatedAt,
-		...notification ? { notification } : {}
-	});
-}
-function readPending(value) {
-	if (!isRecord$4(value) || typeof value.acceptedAt !== "string" || !Number.isFinite(Date.parse(value.acceptedAt)) || typeof value.bindingRevision !== "string" || value.bindingRevision.length === 0 || typeof value.budgetIdentity !== "string" || value.budgetIdentity.length === 0 || typeof value.expectedRevision !== "number" || !Number.isSafeInteger(value.expectedRevision) || value.expectedRevision < 0 || typeof value.inputDigest !== "string" || value.inputDigest.length === 0 || !isModelChangePhase(value.phase) || typeof value.updatedAt !== "string" || !Number.isFinite(Date.parse(value.updatedAt))) throw new Error("invalid Model change pending record");
-	const request = readSubmission(value.request);
-	if (request.expectedRevision !== value.expectedRevision || request.operation !== value.operation) throw new Error("Model state pending request metadata mismatch");
-	const target = readTarget(value.target);
-	if (!sameReference(target, request.target)) throw new Error("Model state pending target mismatch");
-	const budget = readBudget(value.budget);
-	if (budget.identity !== value.budgetIdentity) throw new Error("Model state pending budget identity mismatch");
-	const principal = value.principal === void 0 ? void 0 : readPrincipal(value.principal);
-	const authorizationId = value.authorizationId === void 0 ? void 0 : requireString(value.authorizationId, "authorizationId");
-	const ownerId = value.ownerId === void 0 ? void 0 : requireString(value.ownerId, "ownerId");
-	if (principal && ownerId !== principal.ownerId) throw new Error("Model state pending owner mismatch");
-	if (value.phase === "awaiting-approval") {
-		if (authorizationId === void 0 || principal === void 0 || budget.identity !== "awaiting-approval") throw new Error("Model state awaiting approval record is missing its durable approval binding");
-	} else if (authorizationId === void 0 || principal === void 0 || budget.identity === "awaiting-approval") throw new Error("Model state accepted request is missing trusted authorization state");
-	if (value.phase === "recovery-required" && value.recoveryAttemptedAt === void 0) throw new Error("Model state recovery-required record is missing its attempt marker");
-	if (value.recoveryAttemptedAt !== void 0 && value.phase !== "recovery-required") throw new Error("Model state recovery marker has an invalid phase");
-	if (value.unknownPaidCallId !== void 0 && value.phase !== "validation-unknown" && value.phase !== "recovery-required") throw new Error("Model state unknown paid call has an invalid phase");
-	return Object.freeze({
-		...modelChangeRecordBase(value.acceptedAt, authorizationId, value.bindingRevision, budget, value.budgetIdentity),
-		expectedRevision: value.expectedRevision,
-		inputDigest: value.inputDigest,
-		operation: value.operation,
-		...ownerId === void 0 ? {} : { ownerId },
-		phase: value.phase,
-		...principal ? { principal } : {},
-		request,
-		...value.recoveryAttemptedAt === void 0 ? {} : { recoveryAttemptedAt: requireTimestamp$1(value.recoveryAttemptedAt, "recoveryAttemptedAt") },
-		...value.unknownPaidCallId === void 0 ? {} : { unknownPaidCallId: requireString(value.unknownPaidCallId, "unknownPaidCallId") },
-		...target ? { target } : {},
-		updatedAt: value.updatedAt
-	});
-}
-function readPrincipal(value) {
-	if (!isRecord$4(value) || typeof value.homeId !== "string" || value.homeId.length === 0 || typeof value.ownerId !== "string" || value.ownerId.length === 0) throw new Error("invalid Model change principal");
-	return Object.freeze({
-		homeId: value.homeId,
-		ownerId: value.ownerId,
-		source: readSource(value.source)
-	});
-}
-function readTarget(value) {
-	if (value === void 0) return void 0;
-	if (!isRecord$4(value) || typeof value.provider !== "string" || value.provider.length === 0 || typeof value.model !== "string" || value.model.length === 0) throw new Error("invalid Model change target");
-	return Object.freeze({
-		model: value.model,
-		provider: value.provider
-	});
-}
-function readSubmission(value) {
-	if (!isRecord$4(value) || typeof value.requestId !== "string" || value.requestId.length === 0 || value.operation !== "set" && value.operation !== "rollback" || !Number.isSafeInteger(value.expectedRevision) || value.expectedRevision < 0) throw new Error("invalid Model change request");
-	const target = readTarget(value.target);
-	if (value.operation === "set" && target === void 0) throw new Error("Model set request requires a target");
-	if (value.operation === "rollback" && target !== void 0) throw new Error("Model rollback request cannot contain a target");
-	return {
-		expectedRevision: value.expectedRevision,
-		operation: value.operation,
-		requestId: value.requestId,
-		...target ? { target } : {}
-	};
-}
-function validateReceiptPhase(status, phase) {
-	if (status === "pending" && (phase === "completed" || phase === "notifying") || status === "applied" && phase !== "notifying" && phase !== "completed" || status === "restored" && phase !== "completed" || status === "failed" && phase !== "completed" && phase !== "validation-unknown" && phase !== "recovery-required" || status === "recovery-required" && phase !== "recovery-required") throw new Error("Model change receipt status and phase mismatch");
-}
-function sameReference(left, right) {
-	return left?.model === right?.model && left?.provider === right?.provider;
-}
-function sameOptionalBinding(left, right) {
-	if (left === void 0 || right === void 0) return left === right;
-	return sameModelBinding(left, right);
-}
-function samePrincipal(left, right) {
-	return left?.homeId === right?.homeId && left?.ownerId === right?.ownerId && left?.source.kind === right?.source.kind && left?.source.reference === right?.source.reference;
-}
-function sameBudget(left, right) {
-	if (left.deadlineAt !== right.deadlineAt || left.identity !== right.identity || left.maxOutputTokens !== right.maxOutputTokens || left.maxPaidRequests !== right.maxPaidRequests || left.outputTokens !== right.outputTokens || left.paidRequests !== right.paidRequests || left.recoveryReserveOutputTokens !== right.recoveryReserveOutputTokens || left.recoveryReservePaidRequests !== right.recoveryReservePaidRequests || left.reservedOutputTokens !== right.reservedOutputTokens || left.reservedPaidRequests !== right.reservedPaidRequests) return false;
-	const leftIds = Object.keys(left.reservations);
-	const rightIds = Object.keys(right.reservations);
-	if (leftIds.length !== rightIds.length) return false;
-	return leftIds.every((id) => {
-		const leftReservation = left.reservations[id];
-		const rightReservation = right.reservations[id];
-		return leftReservation !== void 0 && rightReservation !== void 0 && leftReservation.id === rightReservation.id && leftReservation.kind === rightReservation.kind && leftReservation.maxOutputTokens === rightReservation.maxOutputTokens && leftReservation.paidRequests === rightReservation.paidRequests && leftReservation.reservedAt === rightReservation.reservedAt;
-	});
-}
-function requireString(value, label) {
-	if (typeof value !== "string" || value.length === 0) throw new Error(`invalid Model state ${label}`);
-	return value;
-}
-function requireTimestamp$1(value, label) {
-	const timestamp = requireString(value, label);
-	if (!Number.isFinite(Date.parse(timestamp))) throw new Error(`invalid Model state ${label}`);
-	return timestamp;
-}
-function sameModelBinding(left, right) {
-	return left.provider === right.provider && left.model === right.model && left.bindingRevision === right.bindingRevision;
-}
-function isModelChangePhase(value) {
-	return value === "awaiting-approval" || value === "accepted" || value === "waiting-for-boundary" || value === "validating" || value === "activating" || value === "committing" || value === "notifying" || value === "completed" || value === "validation-unknown" || value === "recovery-required";
-}
-function modelChangeRecordBase(acceptedAt, authorizationId, bindingRevision, budget, budgetIdentity) {
-	return {
-		acceptedAt,
-		...authorizationId === void 0 ? {} : { authorizationId },
-		bindingRevision,
-		budget,
-		budgetIdentity
-	};
-}
-//#endregion
-//#region src/adapters/outbound/persistence/deployment/model-state/in-memory-model-state-repository.ts
-var ModelStateRepositoryConflict = class extends Error {
-	name = "ModelStateRepositoryConflict";
-};
-function createInMemoryModelStateRepository(options) {
-	let current = cloneAndValidate(options.initial);
-	const serial = Effect.unsafeMakeSemaphore(1);
-	return {
-		load: () => Effect.sync(() => structuredClone(current)),
-		persist: (input) => serial.withPermits(1)(Effect.uninterruptible(Effect.gen(function* () {
-			const next = yield* Effect.try({
-				try: () => validateNextState(current, input),
-				catch: (error) => error
-			});
-			yield* options.persist?.(structuredClone(next)) ?? Effect.void;
-			current = next;
-			return structuredClone(current);
-		}))),
-		snapshot: () => structuredClone(current)
-	};
-}
-function cloneAndValidate(input) {
-	return validateModelState(structuredClone(input));
-}
-function validateNextState(previous, input) {
-	const next = cloneAndValidate(input);
-	if (next.homeId !== previous.homeId || next.ownerId !== previous.ownerId) throw new ModelStateRepositoryConflict("Model state owner or Home cannot change");
-	if (next.revision < previous.revision || next.revision > previous.revision + 1) throw new ModelStateRepositoryConflict("Model state revision must stay or advance by one");
-	if (next.revision === previous.revision && !sameModelBinding(next.current, previous.current)) throw new ModelStateRepositoryConflict("Model state current binding changed without a revision advance");
-	if (next.revision === previous.revision + 1) {
-		if (!next.previous || !sameModelBinding(next.previous, previous.current) || next.pending !== void 0) throw new ModelStateRepositoryConflict("Model state applied revision must preserve the previous binding");
-	}
-	if (next.pending && next.pending.expectedRevision !== next.revision) throw new ModelStateRepositoryConflict("Model state pending request must target the current revision");
-	return next;
-}
-//#endregion
-//#region src/adapters/outbound/persistence/deployment/model-state/json-model-state-repository.ts
-var ModelStatePersistenceError = class extends Error {
-	operation;
-	cause;
-	name = "ModelStatePersistenceError";
-	constructor(operation, cause) {
-		super(`failed to ${operation} Model state`);
-		this.operation = operation;
-		this.cause = cause;
-	}
-};
-function openJsonModelStateRepository(options) {
-	return Effect.tryPromise({
-		try: () => readPersistenceFile(options.filePath),
-		catch: (error) => new ModelStatePersistenceError("load", error)
-	}).pipe(Effect.flatMap((raw) => Effect.gen(function* () {
-		if (raw !== void 0) yield* Effect.tryPromise({
-			try: () => chmod(options.filePath, 384),
-			catch: (error) => new ModelStatePersistenceError("load", error)
-		});
-		return yield* Effect.try({
-			try: () => raw === void 0 ? structuredClone(options.initial) : decodeModelState(raw),
-			catch: (error) => new ModelStatePersistenceError("load", error)
-		});
-	})), Effect.map((initial) => createInMemoryModelStateRepository({
-		initial,
-		persist: (state) => Effect.tryPromise({
-			try: async () => {
-				try {
-					await chmod(options.filePath, 384);
-				} catch (error) {
-					if (!isMissingFileError(error)) throw error;
-				}
-				await writeAtomicTextFile(options.filePath, encodeModelState(state), {
-					durable: true,
-					mode: 384
-				});
-			},
-			catch: (error) => new ModelStatePersistenceError("save", error)
-		})
-	})));
-}
-function isMissingFileError(error) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-//#endregion
-//#region src/core/application/deployment/model/model-change-run-boundary.ts
-/**
-* Home-wide admission fence shared by every foreground/background runtime.
-* Waiting Runs are parked outside the active count, so a model-change drain
-* can close admission and wait only for work that actually started.
-*/
-function createModelChangeRunBoundary(options) {
-	let open = true;
-	let active = 0;
-	const runWaiters = /* @__PURE__ */ new Set();
-	let boundaryWaiter;
-	const createLease = () => {
-		let released = false;
-		active += 1;
-		return Object.freeze({ release: () => {
-			if (released) return;
-			released = true;
-			active -= 1;
-			if (active === 0) resolveBoundaryWaiter();
-		} });
-	};
-	const acquireRun = (input = {}) => Effect.suspend(() => {
-		const signal = input.signal;
-		if (signal?.aborted) return Effect.fail(abortError(signal));
-		const remaining = input.deadlineAt === void 0 ? void 0 : remainingUntil(options.clock, input.deadlineAt);
-		if (remaining !== void 0 && remaining <= 0) return Effect.fail(new ModelChangeBoundaryDeadlineError("Run admission deadline has passed"));
-		if (open) return Effect.sync(createLease);
-		const waiting = Effect.async((resume) => {
-			let settled = false;
-			let waiter;
-			let onAbort;
-			const remove = () => {
-				runWaiters.delete(waiter);
-				if (signal && onAbort) signal.removeEventListener("abort", onAbort);
-			};
-			const cleanup = () => {
-				if (settled) return;
-				settled = true;
-				remove();
-			};
-			const resumeWaiter = (effect) => {
-				if (settled) return;
-				settled = true;
-				remove();
-				resume(effect);
-			};
-			onAbort = signal ? () => resumeWaiter(Effect.fail(abortError(signal))) : void 0;
-			waiter = {
-				cleanup,
-				resume: resumeWaiter
-			};
-			runWaiters.add(waiter);
-			if (onAbort && signal) signal.addEventListener("abort", onAbort, { once: true });
-			return Effect.sync(cleanup);
-		});
-		return remaining === void 0 ? waiting : waiting.pipe(Effect.timeoutFail({
-			duration: Math.min(remaining, 2147483647),
-			onTimeout: () => new ModelChangeBoundaryDeadlineError("Run admission deadline has passed")
-		}));
-	});
-	const fence = () => {
-		open = false;
-	};
-	const waitForSafeBoundary = (input) => Effect.suspend(() => {
-		fence();
-		if (boundaryWaiter) return Effect.fail(/* @__PURE__ */ new Error("Model change boundary is already draining"));
-		const remaining = remainingUntil(options.clock, input.deadlineAt);
-		if (remaining <= 0) return Effect.fail(new ModelChangeBoundaryDeadlineError("Model change boundary deadline has passed"));
-		if (active === 0) return Effect.succeed({
-			activeRuns: 0,
-			completedAt: options.clock.now()
-		});
-		return Effect.async((resume) => {
-			let settled = false;
-			const cleanup = () => {
-				if (settled) return;
-				settled = true;
-				if (boundaryWaiter?.cleanup === cleanup) boundaryWaiter = void 0;
-			};
-			const resumeWaiter = (effect) => {
-				if (settled) return;
-				settled = true;
-				if (boundaryWaiter?.cleanup === cleanup) boundaryWaiter = void 0;
-				resume(effect);
-			};
-			boundaryWaiter = {
-				cleanup,
-				resume: resumeWaiter
-			};
-			return Effect.sync(cleanup);
-		}).pipe(Effect.timeoutFail({
-			duration: Math.min(remaining, 2147483647),
-			onTimeout: () => new ModelChangeBoundaryDeadlineError("Active Runs did not drain before the model change deadline")
-		}));
-	});
-	const resumeAfterChange = () => Effect.sync(() => {
-		open = true;
-		const waiting = [...runWaiters];
-		runWaiters.clear();
-		for (const waiter of waiting) waiter.resume(Effect.succeed(createLease()));
-	});
-	function resolveBoundaryWaiter() {
-		const waiter = boundaryWaiter;
-		if (!waiter || active !== 0) return;
-		waiter.resume(Effect.succeed({
-			activeRuns: 0,
-			completedAt: options.clock.now()
-		}));
-	}
-	return Object.freeze({
-		acquireRun,
-		activeRunCount: () => active,
-		admissionOpen: () => open,
-		fence,
-		resumeAfterChange,
-		waitForSafeBoundary
-	});
-}
-var ModelChangeBoundaryDeadlineError = class extends Error {
-	name = "ModelChangeBoundaryDeadlineError";
-};
-function remainingUntil(clock, deadlineAt) {
-	const deadline = Date.parse(deadlineAt);
-	const now = Date.parse(clock.now());
-	return Number.isFinite(deadline) && Number.isFinite(now) ? deadline - now : 0;
-}
-function abortError(signal) {
-	return signal.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("Run admission aborted");
-}
-//#endregion
-//#region src/core/application/tool-execution/brokerage/model-change-authorization.ts
-const TOOL_ID = "rivus.model.change";
-const TOOL_VERSION = "1";
-/** Reuses Broker policy, exact approval binding and its durable operation ledger. */
-function createModelChangeAuthorization(options) {
-	if (typeof options.managementAgentId !== "string" || options.managementAgentId.trim() === "") throw new Error("managementAgentId must be a non-empty string");
-	const serial = Effect.unsafeMakeSemaphore(1);
-	const digest = (value) => createToolInputDigest(value, options.digest);
-	const admissions = /* @__PURE__ */ new Map();
-	const broker = createToolBroker({
-		approvals: { consume: (request) => Effect.sync(() => {
-			const admission = admissions.get(request.operationId);
-			return admission !== void 0 && digest(request) === digest(admission.approval);
-		}) },
-		catalog: { snapshot: () => ({ tools: [] }) },
-		digest: options.digest,
-		hostTools: [{
-			createExecutor: () => ({ execute: (_input, context) => {
-				const admission = context.operationId ? admissions.get(context.operationId) : void 0;
-				return admission ? Effect.succeed(admission.result) : Effect.fail(/* @__PURE__ */ new Error("model grant admission is missing"));
-			} }),
-			id: TOOL_ID,
-			idempotency: "required",
-			risk: "host-control",
-			version: TOOL_VERSION
-		}],
-		operations: options.operations,
-		policy: { current: () => options.grant.current().pipe(Effect.map((grant) => ({
-			epoch: grant.revision,
-			revokedToolIds: grant.enabled ? [] : [TOOL_ID]
-		}))) }
-	});
-	const executeBrokerAuthorization = (run, grant, principal, request, authorizationId, deadlineAt) => {
-		const operationId = `model-authorization:${authorizationId}`;
-		const approvalId = `model-grant:${authorizationId}`;
-		const callId = operationId;
-		const payload = {
-			authorizationId,
-			grantRevision: grant.revision,
-			request
-		};
-		const approved = approvedAuthorization(grant, principal, authorizationId, deadlineAt, digest);
-		const brokerAuthority = createModelChangeBrokerAuthority(run.authority, authorizationId, options.managementAgentId);
-		const authority = resolveInvocationAuthority(brokerAuthority);
-		const approval = {
-			agentId: authority.agentId,
-			approvalId,
-			callId,
-			inputDigest: digest(payload),
-			instanceId: authority.instanceId,
-			operationId,
-			risk: "host-control",
-			runId: authority.runId,
-			sessionKey: authority.sessionKey,
-			tenantKey: authority.tenantKey,
-			toolId: TOOL_ID,
-			toolVersion: TOOL_VERSION
-		};
-		admissions.set(operationId, {
-			approval,
-			result: approved
-		});
-		return broker.execute({
-			approvalId,
-			authority: brokerAuthority,
-			callId,
-			input: payload,
-			operationId,
-			toolId: TOOL_ID,
-			version: TOOL_VERSION
-		}).pipe(Effect.ensuring(Effect.sync(() => admissions.delete(operationId))), Effect.map((result) => result));
-	};
-	return {
-		authorize: (input) => serial.withPermits(1)(Effect.gen(function* () {
-			const run = yield* options.resolveRun(input.transport.reference);
-			if (!run || run.kind !== "human") return rejected("trusted_context_invalid", "A trusted human Run is required.");
-			const authority = yield* Effect.try({
-				catch: (error) => error,
-				try: () => resolveInvocationAuthority(run.authority)
-			});
-			const grant = yield* options.grant.current();
-			if (!grant.enabled) return rejected("management_disabled", "Model management is disabled for this Home.");
-			if (input.homeId !== grant.homeId || authority.endpointId !== grant.endpointId || authority.tenantKey !== grant.tenantKey || !authority.allowedActorOpenIds?.includes(grant.ownerId) || authority.allowedActorOpenIds.length !== 1) return rejected("owner_mismatch", "The current conversation is outside the model management grant.");
-			if (!grant.operations.includes(input.request.operation)) return rejected("operation_not_granted", "This model operation is outside the configured grant.");
-			if (input.current.provider !== grant.provider || input.request.target && input.request.target.provider !== grant.provider || input.current.bindingRevision !== grant.bindingRevision) return rejected("binding_changed", "The model provider or binding is outside the current grant.");
-			if (!authority.toolGrantSet.toolIds.includes(TOOL_ID)) return yield* Effect.fail(new ToolInvocationDenied(`tool is not granted for this run: ${TOOL_ID}`));
-			const principal = {
-				homeId: grant.homeId,
-				ownerId: grant.ownerId,
-				source: {
-					kind: "human",
-					reference: authority.sourceMessageId
-				}
-			};
-			const authorizationId = authorizationIdentity(digest, grant, principal, input.request);
-			if (input.existing?.authorizationId && input.existing.authorizationId !== authorizationId) return rejected("authorization_changed", "The existing model approval binding no longer matches this request.");
-			const deadlineAt = input.existing?.deadlineAt ?? grantDeadline(options, grant);
-			if (grant.requireApproval) {
-				if (!options.approval) return rejected("approval_unavailable", "This model operation requires a durable human approval service.");
-				const approval = yield* options.approval.requestOrGet(createApprovalInput(authorizationId, deadlineAt, grant, principal, input.request, {
-					agentId: authority.agentId,
-					...authority.endpointId ? { endpointId: authority.endpointId } : {},
-					instanceId: authority.instanceId,
-					runId: authority.runId,
-					sessionKey: authority.sessionKey,
-					sourceMessageId: authority.sourceMessageId,
-					tenantKey: authority.tenantKey
-				}));
-				if (approval.status === "pending") return {
-					authorizationId,
-					bindingRevision: grant.bindingRevision,
-					deadlineAt,
-					principal,
-					reason: approval.reason ?? "Model management approval is pending.",
-					status: "awaiting-approval"
-				};
-				if (approval.status === "rejected") return rejected("approval_rejected", approval.reason ?? "Model management approval was rejected.");
-				return yield* executeBrokerAuthorization(run, grant, principal, input.request, authorizationId, deadlineAt);
-			}
-			return yield* executeBrokerAuthorization(run, grant, principal, input.request, authorizationId, deadlineAt);
-		})),
-		revalidate: (input) => Effect.gen(function* () {
-			const grant = yield* options.grant.current();
-			const principal = input.pending.principal;
-			const invalid = invalidPendingGrant(input.homeId, input.current, input.pending, input.authorizationId, grant, principal, digest);
-			if (invalid) return invalid;
-			if (grant.requireApproval) {
-				if (!options.approval) return rejected("approval_unavailable", "Durable model management approval is unavailable.");
-				const approval = yield* options.approval.requestOrGet(createApprovalInput(input.authorizationId, input.pending.budget.deadlineAt, grant, principal, input.pending.request));
-				if (approval.status === "pending") return rejected("approval_pending", "Model management approval is still pending.");
-				if (approval.status === "rejected") return rejected("approval_rejected", approval.reason ?? "Model management approval was rejected.");
-			}
-			return {
-				bindingRevision: grant.bindingRevision,
-				status: "approved"
-			};
-		}),
-		resolvePending: (input) => Effect.gen(function* () {
-			const grant = yield* options.grant.current();
-			const pending = input.pending;
-			const principal = pending.principal;
-			const authorizationId = pending.authorizationId;
-			if (!authorizationId || !principal) return rejected("approval_binding_missing", "The durable approval binding is missing.");
-			const invalid = invalidPendingGrant(input.homeId, input.current, pending, authorizationId, grant, principal, digest, true);
-			if (invalid) return invalid;
-			if (!grant.requireApproval) return yield* executeWorkerBrokerAuthorization(grant, principal, pending.request, authorizationId, pending.budget.deadlineAt);
-			if (!options.approval) return rejected("approval_unavailable", "Durable model management approval is unavailable.");
-			const approval = yield* options.approval.waitForResolution(createApprovalInput(authorizationId, pending.budget.deadlineAt, grant, principal, pending.request));
-			const latestGrant = yield* options.grant.current();
-			const latestInvalid = invalidPendingGrant(input.homeId, input.current, pending, authorizationId, latestGrant, principal, digest, true);
-			if (latestInvalid) return latestInvalid;
-			if (approval.status === "pending") return {
-				authorizationId,
-				bindingRevision: latestGrant.bindingRevision,
-				deadlineAt: pending.budget.deadlineAt,
-				principal,
-				reason: approval.reason ?? "Model management approval is pending.",
-				status: "awaiting-approval"
-			};
-			if (approval.status === "rejected") return rejected("approval_rejected", approval.reason ?? "Model management approval was rejected.");
-			return yield* executeWorkerBrokerAuthorization(latestGrant, principal, pending.request, authorizationId, pending.budget.deadlineAt);
-		})
-	};
-	function executeWorkerBrokerAuthorization(grant, principal, request, authorizationId, deadlineAt) {
-		return Effect.gen(function* () {
-			if (!options.resolveWorkerRun) return rejected("worker_authority_unavailable", "The accepted model worker authority is unavailable.");
-			const worker = yield* options.resolveWorkerRun({
-				authorizationId,
-				grant,
-				principal,
-				request
-			});
-			if (!worker || worker.kind !== "human") return rejected("worker_authority_unavailable", "The accepted model worker authority is unavailable.");
-			return yield* executeBrokerAuthorization(worker, grant, principal, request, authorizationId, deadlineAt);
-		});
-	}
-}
-function authorizationIdentity(digest, grant, principal, request) {
-	return digest({
-		grant,
-		principal,
-		request
-	});
-}
-function createModelChangeBrokerAuthority(run, authorizationId, managementAgentId) {
-	const authority = resolveInvocationAuthority(run);
-	const operationIdentity = `model-change:${authorizationId}`;
-	return createInvocationAuthority({
-		...authority,
-		agentId: managementAgentId,
-		instanceId: operationIdentity,
-		runId: operationIdentity,
-		sessionKey: operationIdentity
-	});
-}
-function approvedAuthorization(grant, principal, authorizationId, deadlineAt, digest) {
-	return {
-		authorizationId,
-		bindingRevision: grant.bindingRevision,
-		budget: {
-			...grant.budget,
-			deadlineAt,
-			identity: digest({
-				grant,
-				principal
-			})
-		},
-		principal,
-		status: "approved"
-	};
-}
-function grantDeadline(options, grant) {
-	const now = Date.parse(options.clock.now());
-	if (!Number.isFinite(now) || !Number.isFinite(grant.timeoutMs) || grant.timeoutMs <= 0) throw new Error("invalid model management grant deadline");
-	return new Date(now + grant.timeoutMs).toISOString();
-}
-function createApprovalInput(authorizationId, expiresAt, grant, principal, request, authority) {
-	return {
-		...authority ? { authority } : {},
-		budget: grant.budget,
-		expiresAt,
-		grantRevision: grant.revision,
-		interactionId: `model-change-approval:${authorizationId}`,
-		principal,
-		request
-	};
-}
-function invalidPendingGrant(homeId, current, pending, authorizationId, grant, principal, digest, awaiting = false) {
-	if (!grant.enabled || !principal || principal.homeId !== grant.homeId || homeId !== grant.homeId || principal.ownerId !== grant.ownerId || principal.source.kind !== "human" || current.provider !== grant.provider || current.bindingRevision !== grant.bindingRevision || pending.target?.provider !== grant.provider || !grant.operations.includes(pending.operation) || authorizationId !== authorizationIdentity(digest, grant, principal, pending.request) || !awaiting && pending.budgetIdentity !== digest({
-		grant,
-		principal
-	})) return rejected("authorization_revoked", "The accepted model management grant is no longer valid.");
-}
-function rejected(code, reason) {
-	return {
-		code,
-		reason,
-		status: "rejected"
-	};
-}
-//#endregion
-//#region src/adapters/cli/model/rivus-model-management-socket-server.ts
-const MAX_FRAME_BYTES = 64 * 1024;
-function createRivusModelManagementSocketServer(options) {
-	assertAbsoluteSocketPath(options.socketPath);
-	let server;
-	let socketIdentity;
-	let listening = false;
-	let startPromise;
-	return {
-		close: async () => {
-			if (startPromise) await startPromise.catch(() => void 0);
-			const current = server;
-			const identity = socketIdentity;
-			server = void 0;
-			socketIdentity = void 0;
-			if (current && listening) await closeServer(current);
-			listening = false;
-			if (identity) await unlinkOwnedSocket(options.socketPath, identity);
-		},
-		listening: () => listening,
-		start: async () => {
-			if (listening) return;
-			if (startPromise) return startPromise;
-			startPromise = startServer(options, (next, identity) => {
-				server = next;
-				socketIdentity = identity;
-				listening = true;
-			});
-			try {
-				await startPromise;
-			} finally {
-				startPromise = void 0;
-			}
-		}
-	};
-}
-async function startServer(options, onStarted) {
-	await prepareSocketParentDirectory(options.socketPath);
-	const lockPath = `${options.socketPath}.lock`;
-	const lock = await acquireStartLock(lockPath);
-	const next = createServer((socket) => handleConnection(socket, options));
-	let bound = false;
-	try {
-		await prepareSocketPath(options.socketPath);
-		await listen(next, options.socketPath);
-		bound = true;
-		await chmod(options.socketPath, 384);
-		onStarted(next, await readSocketIdentity(options.socketPath));
-	} catch (error) {
-		await closeServer(next).catch(() => void 0);
-		if (bound) await unlinkSocketIfPresent(options.socketPath);
-		throw error;
-	} finally {
-		await releaseStartLock(lock, lockPath);
-	}
-}
-async function handleConnection(socket, options) {
-	let buffer = "";
-	let handled = false;
-	socket.setEncoding("utf8");
-	socket.on("data", (chunk) => {
-		if (handled) return;
-		buffer += chunk;
-		if (Buffer.byteLength(buffer, "utf8") > MAX_FRAME_BYTES) {
-			handled = true;
-			writeResponse(socket, createRivusModelManagementFailure("request_too_large", "model management request is too large"));
-			return;
-		}
-		const newline = buffer.indexOf("\n");
-		if (newline < 0) return;
-		handled = true;
-		handleFrame(buffer.slice(0, newline).trim(), socket, options);
-	});
-	socket.on("end", () => {
-		if (handled || buffer.trim() === "") return;
-		handled = true;
-		handleFrame(buffer.trim(), socket, options);
-	});
-	socket.on("error", () => {
-		handled = true;
-	});
-}
-async function handleFrame(frame, socket, options) {
-	let response;
-	let request;
-	try {
-		request = parseRivusModelManagementWireRequest(JSON.parse(frame));
-	} catch (error) {
-		response = createRivusModelManagementFailure("invalid_request", error instanceof Error ? error.message : "invalid model request");
-		writeResponse(socket, response);
-		return;
-	}
-	try {
-		if (request.operation === "status") response = projectRivusModelCliResponse(await options.handlers.status({
-			...request.requestId ? { requestId: request.requestId } : {},
-			...request.verbose ? { verbose: true } : {}
-		}), request.operation);
-		else response = await handleMutation(request, options);
-	} catch {
-		response = createRivusModelManagementFailure("handler_failed", "the model management request could not be completed");
-	}
-	writeResponse(socket, response);
-}
-async function handleMutation(request, options) {
-	if (!request.context || !options.resolveTrustedRun) return createRivusModelManagementFailure("trusted_context_required", "a trusted Run context is required for model changes");
-	let trustedRun;
-	try {
-		trustedRun = await options.resolveTrustedRun.resolve(request.context);
-	} catch {
-		trustedRun = void 0;
-	}
-	if (trustedRun === void 0 || trustedRun === null) return createRivusModelManagementFailure("trusted_context_invalid", "the trusted Run context is invalid or expired");
-	try {
-		return projectRivusModelCliResponse(await options.handlers.handle(toRivusModelManagementSubmission(request), trustedRun), request.operation);
-	} catch {
-		return createRivusModelManagementFailure("handler_failed", "the model management request could not be completed");
-	}
-}
-function writeResponse(socket, response) {
-	try {
-		socket.end(`${JSON.stringify(response)}\n`);
-	} catch {
-		socket.destroy();
-	}
-}
-async function prepareSocketPath(socketPath) {
-	try {
-		const metadata = await stat(socketPath);
-		if (!metadata.isSocket()) throw new Error(`refusing to replace non-socket model path: ${socketPath}`);
-		if (await socketIsLive(socketPath)) throw new Error(`model management socket is already active: ${socketPath}`);
-		const current = await stat(socketPath);
-		if (current.dev !== metadata.dev || current.ino !== metadata.ino) throw new Error(`model management socket changed while starting: ${socketPath}`);
-		await unlink(socketPath);
-	} catch (error) {
-		if (!isMissing(error)) throw error;
-	}
-}
-async function prepareSocketParentDirectory(socketPath) {
-	const parent = dirname(socketPath);
-	await mkdir(parent, {
-		mode: 448,
-		recursive: true
-	});
-	await chmod(parent, 448);
-}
-async function socketIsLive(socketPath) {
-	return new Promise((resolve, reject) => {
-		const socket = createConnection(socketPath);
-		let settled = false;
-		const finish = (result, error) => {
-			if (settled) return;
-			settled = true;
-			socket.destroy();
-			if (error) reject(error);
-			else resolve(result);
-		};
-		socket.setTimeout(250, () => finish(false, /* @__PURE__ */ new Error("model management socket liveness could not be verified")));
-		socket.once("connect", () => finish(true));
-		socket.once("error", (error) => {
-			if (error.code === "ECONNREFUSED" || error.code === "ENOENT") finish(false);
-			else finish(false, error);
-		});
-	});
-}
-async function acquireStartLock(path) {
-	for (let attempt = 0; attempt < 3; attempt += 1) {
-		let handle;
-		try {
-			handle = await open(path, "wx", 384);
-			await handle.writeFile(`${process.pid}\n`, "utf8");
-			const metadata = await handle.stat();
-			return {
-				handle,
-				identity: {
-					dev: metadata.dev,
-					ino: metadata.ino
-				}
-			};
-		} catch (error) {
-			await handle?.close().catch(() => void 0);
-			if (!isAlreadyExists(error)) throw new Error("model management socket startup is already in progress", { cause: error });
-			const pid = parseLockOwner(await readPersistenceFile(path));
-			if (pid === void 0) throw new Error("model management socket startup lock owner could not be verified; manual recovery is required");
-			if (processIsAlive(pid)) throw new Error("model management socket startup is already in progress");
-			const reclaimed = `${path}.reclaim-${process.pid}-${randomUUID()}`;
-			try {
-				await rename(path, reclaimed);
-			} catch (reclaimError) {
-				if (isMissing(reclaimError)) continue;
-				throw new Error("model management socket startup lock could not be reclaimed safely", { cause: reclaimError });
-			}
-			await unlink(reclaimed).catch((reclaimError) => {
-				if (!isMissing(reclaimError)) throw reclaimError;
-			});
-		}
-	}
-	throw new Error("model management socket startup lock changed during stale-owner recovery; manual recovery is required");
-}
-async function releaseStartLock(lock, path) {
-	await lock.handle.close();
-	try {
-		const current = await stat(path);
-		if (current.dev !== lock.identity.dev || current.ino !== lock.identity.ino) return;
-		await unlink(path);
-	} catch (error) {
-		if (!isMissing(error)) throw error;
-	}
-}
-async function unlinkSocketIfPresent(socketPath) {
-	try {
-		if ((await stat(socketPath)).isSocket()) await unlink(socketPath);
-	} catch (error) {
-		if (!isMissing(error)) throw error;
-	}
-}
-async function unlinkOwnedSocket(socketPath, identity) {
-	try {
-		const current = await readSocketIdentity(socketPath);
-		if (current.dev !== identity.dev || current.ino !== identity.ino) return;
-		await unlink(socketPath);
-	} catch (error) {
-		if (!isMissing(error)) throw error;
-	}
-}
-async function readSocketIdentity(socketPath) {
-	const metadata = await stat(socketPath);
-	return {
-		dev: metadata.dev,
-		ino: metadata.ino
-	};
-}
-function listen(server, socketPath) {
-	return new Promise((resolve, reject) => {
-		const onError = (error) => {
-			server.off("listening", onListening);
-			reject(error);
-		};
-		const onListening = () => {
-			server.off("error", onError);
-			resolve();
-		};
-		server.once("error", onError);
-		server.once("listening", onListening);
-		server.listen(socketPath);
-	});
-}
-function closeServer(server) {
-	return new Promise((resolve, reject) => {
-		server.close((error) => error ? reject(error) : resolve());
-	});
-}
-function assertAbsoluteSocketPath(socketPath) {
-	if (!isAbsolute(socketPath)) throw new Error("model socket path must be absolute");
-}
-function isMissing(error) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-function isAlreadyExists(error) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
-}
-function processIsAlive(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (error) {
-		return typeof error === "object" && error !== null && "code" in error && error.code !== "ESRCH";
-	}
-}
-function parseLockOwner(value) {
-	const normalized = value?.trim();
-	if (!normalized || !/^\d+$/.test(normalized)) return void 0;
-	const pid = Number(normalized);
-	return Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
-}
-//#endregion
-//#region src/core/application/deployment/model/model-change-recovery.ts
-const recoveryPhases = /* @__PURE__ */ new Set([
-	"activating",
-	"committing",
-	"validation-unknown",
-	"recovery-required"
-]);
-function pendingRequiresModelChangeRecovery(pending) {
-	return recoveryPhases.has(pending.phase) || pending.unknownPaidCallId !== void 0;
-}
-//#endregion
-//#region src/core/application/deployment/model/model-change-projection.ts
-function stateWithPending(state, pending, receipt) {
-	return {
-		...state,
-		pending,
-		requests: {
-			...state.requests,
-			[receipt.requestId]: receipt
-		},
-		updatedAt: receipt.updatedAt
-	};
-}
-function stateWithReceipt(state, receipt, recovery) {
-	const { pending: _pending, recoveryRequired: _recoveryRequired, ...stateWithoutTransient } = state;
-	return {
-		...stateWithoutTransient,
-		...recovery ? { recoveryRequired: recovery } : {},
-		requests: {
-			...state.requests,
-			[receipt.requestId]: receipt
-		},
-		updatedAt: receipt.updatedAt
-	};
-}
-function pendingReceipt(state, pending, updatedAt) {
-	return {
-		acceptedAt: pending.acceptedAt,
-		...pending.authorizationId ? { authorizationId: pending.authorizationId } : {},
-		bindingRevision: pending.bindingRevision,
-		budget: pending.budget,
-		budgetIdentity: pending.budgetIdentity,
-		current: state.current,
-		expectedRevision: pending.expectedRevision,
-		inputDigest: pending.inputDigest,
-		operation: pending.operation,
-		phase: pending.phase,
-		...state.previous ? { previous: state.previous } : {},
-		...pending.principal ? { principal: pending.principal } : {},
-		requestId: pending.request.requestId,
-		revision: state.revision,
-		status: "pending",
-		...pending.target ? { target: pending.target } : {},
-		updatedAt
-	};
-}
-function failedReceipt(state, pending, error, updatedAt) {
-	return {
-		...pendingReceipt(state, pending, updatedAt),
-		error,
-		phase: error.outcome === "unknown" ? "validation-unknown" : "completed",
-		status: "failed"
-	};
-}
-function restoredReceipt(state, pending, error, updatedAt) {
-	return {
-		...pendingReceipt(state, pending, updatedAt),
-		...error ? { error } : {},
-		phase: "completed",
-		status: "restored"
-	};
-}
-function recoveryReceipt(state, pending, error, updatedAt) {
-	return {
-		...pendingReceipt(state, pending, updatedAt),
-		error,
-		phase: "recovery-required",
-		status: "recovery-required"
-	};
-}
-function toStatusView(state, actual, receipt) {
-	return {
-		...actual ? { actual } : {},
-		current: state.current,
-		homeId: state.homeId,
-		...state.pending ? { pending: {
-			phase: state.pending.phase,
-			request: stripTransportContext(state.pending.request),
-			...state.pending.target ? { target: state.pending.target } : {},
-			updatedAt: state.pending.updatedAt
-		} } : {},
-		...state.previous ? { previous: state.previous } : {},
-		...receipt ? { request: toPublicReceipt(receipt) } : {},
-		persisted: state.current,
-		...state.recoveryRequired ? { recoveryRequired: state.recoveryRequired } : {},
-		revision: state.revision,
-		source: "managed"
-	};
-}
-function toPublicReceipt(receipt) {
-	return {
-		acceptedAt: receipt.acceptedAt,
-		budget: {
-			deadlineAt: receipt.budget.deadlineAt,
-			maxOutputTokens: receipt.budget.maxOutputTokens,
-			maxPaidRequests: receipt.budget.maxPaidRequests,
-			outputTokens: receipt.budget.outputTokens,
-			paidRequests: receipt.budget.paidRequests
-		},
-		...receipt.current ? { current: receipt.current } : {},
-		...receipt.error ? { error: receipt.error } : {},
-		expectedRevision: receipt.expectedRevision,
-		operation: receipt.operation,
-		phase: receipt.phase,
-		...receipt.previous ? { previous: receipt.previous } : {},
-		requestId: receipt.requestId,
-		revision: receipt.revision,
-		status: receipt.status,
-		...receipt.target ? { target: receipt.target } : {},
-		updatedAt: receipt.updatedAt
-	};
-}
-function resolveTarget(state, submission) {
-	if (submission.operation === "set") return submission.target ? toReference(submission.target) : void 0;
-	return state.previous ? toReference(state.previous) : void 0;
-}
-function runtimeContext(state, pending) {
-	if (!pending.target) throw new Error("Model change target is unavailable");
-	return {
-		baseline: state.current,
-		bindingRevision: pending.bindingRevision,
-		requestId: pending.request.requestId,
-		target: pending.target
-	};
-}
-function sameSubmission(receipt, submission) {
-	return receipt.requestId === submission.requestId && receipt.operation === submission.operation && receipt.expectedRevision === submission.expectedRevision && receipt.target?.provider === submission.target?.provider && receipt.target?.model === submission.target?.model;
-}
-function sameTarget(binding, target) {
-	return binding.provider === target.provider && binding.model === target.model;
-}
-function toReference(binding) {
-	return {
-		model: binding.model,
-		provider: binding.provider
-	};
-}
-function stripTransportContext(submission) {
-	return {
-		expectedRevision: submission.expectedRevision,
-		operation: submission.operation,
-		requestId: submission.requestId,
-		...submission.target ? { target: toReference(submission.target) } : {}
-	};
-}
-//#endregion
-//#region src/core/application/deployment/model/model-change-support.ts
-function loadState(options) {
-	return options.repository.load().pipe(Effect.flatMap((state) => state.homeId === options.homeId ? Effect.succeed(state) : Effect.fail(/* @__PURE__ */ new Error(`Model state belongs to unexpected Home: ${state.homeId}`))));
-}
-function persistState(options, state) {
-	return options.repository.persist(state);
-}
-function terminalReceiptForPersistence(options, receipt) {
-	return options.notification && receipt.notification === void 0 ? {
-		...receipt,
-		notification: {
-			attempts: 0,
-			status: "pending"
-		}
-	} : receipt;
-}
-function requireNow(options) {
-	return requireTimestamp(options.clock.now());
-}
-function requireTimestamp(value) {
-	if (!Number.isFinite(Date.parse(value))) throw new Error("Model change clock must return an ISO timestamp");
-	return value;
-}
-function modelError(code, message, stage, outcome = "known") {
-	return {
-		code,
-		message,
-		outcome,
-		stage
-	};
-}
-function modelErrorFrom(error, stage) {
-	const outcome = readOutcome(error);
-	const code = readControlledCode(error, stage);
-	return modelError(code, safeStageMessage(stage, outcome, code), stage, outcome);
-}
-function readOutcome(error) {
-	if (typeof error === "object" && error !== null && "outcome" in error && (error.outcome === "known" || error.outcome === "unknown")) return error.outcome;
-	return "known";
-}
-/** Only application-owned codes may cross the persistence/public projection boundary. */
-function readControlledCode(error, stage) {
-	if (typeof error !== "object" || error === null) return `model_change_${stage}_failed`;
-	if ("name" in error && error.name === "ModelChangeBudgetExceeded") return "model_change_budget_exhausted";
-	if ("name" in error && error.name === "ModelChangeBoundaryDeadlineError") return "model_change_deadline_exceeded";
-	if ("code" in error && typeof error.code === "string" && CONTROLLED_ERROR_CODES.has(error.code)) return error.code;
-	return `model_change_${stage}_failed`;
-}
-const CONTROLLED_ERROR_CODES = /* @__PURE__ */ new Set([
-	"model_change_activation_failed",
-	"model_change_boundary_failed",
-	"model_change_commit_failed",
-	"model_change_deadline_exceeded",
-	"model_change_notification_failed",
-	"model_change_probe_failed",
-	"model_change_restore_failed",
-	"model_change_validation_failed",
-	"model_change_target_unsupported",
-	"model_change_provider_unsupported",
-	"model_change_history_incompatible",
-	"model_change_budget_exhausted"
-]);
-function safeStageMessage(stage, outcome, code) {
-	const suffix = outcome === "unknown" ? " The provider result is unknown and must not be retried." : "";
-	const message = {
-		activation: "The model activation failed.",
-		boundary: "The model change could not reach a safe execution boundary.",
-		commit: "The model state could not be committed.",
-		notification: "The model change result could not be delivered.",
-		restore: "The previous model could not be restored.",
-		validation: "The target model did not pass validation."
-	}[stage];
-	return `${{
-		model_change_target_unsupported: "The exact target model has no supported metadata in this runtime.",
-		model_change_provider_unsupported: "The requested provider is unavailable in this runtime.",
-		model_change_history_incompatible: "The existing conversation history is incompatible with the target model.",
-		model_change_budget_exhausted: "The accepted model change budget is exhausted.",
-		model_change_deadline_exceeded: "The accepted model change deadline has elapsed."
-	}[code] ?? message}${suffix}`;
-}
-//#endregion
-//#region src/core/application/deployment/model/model-change-execution.ts
-function executeModelChangePending(options, initialState, initialPending) {
-	if (!initialPending.target) return Effect.fail(/* @__PURE__ */ new Error("Model change target is unavailable"));
-	let state = initialState;
-	let pending = initialPending;
-	const target = initialPending.target;
-	let paidCallSequence = Object.keys(pending.budget.reservations).length;
-	let boundaryHeld = false;
-	const savePending = (next) => Effect.gen(function* () {
-		const now = requireNow(options);
-		pending = {
-			...next,
-			updatedAt: now
-		};
-		const receipt = pendingReceipt(state, pending, now);
-		state = yield* persistState(options, stateWithPending(state, pending, receipt));
-		return receipt;
-	});
-	const saveFinal = (nextReceipt, recoveryRequired = false) => Effect.gen(function* () {
-		const { pending: _pending, recoveryRequired: _recoveryRequired, ...stateWithoutTransient } = state;
-		const durableReceipt = terminalReceiptForPersistence(options, nextReceipt);
-		state = yield* persistState(options, {
-			...stateWithoutTransient,
-			...recoveryRequired && durableReceipt.error ? { recoveryRequired: durableReceipt.error } : {},
-			requests: {
-				...state.requests,
-				[durableReceipt.requestId]: durableReceipt
-			},
-			updatedAt: durableReceipt.updatedAt
-		});
-		return durableReceipt;
-	});
-	const saveFailed = (error) => Effect.gen(function* () {
-		const receipt = failedReceipt(state, pending, error, requireNow(options));
-		state = yield* persistState(options, stateWithReceipt(state, terminalReceiptForPersistence(options, receipt)));
-		return state.requests[receipt.requestId];
-	});
-	const executionBudget = {
-		deadlineAt: pending.budget.deadlineAt,
-		reservePaidCall: ({ kind, maxOutputTokens }) => Effect.gen(function* () {
-			if (pending.phase === "validation-unknown" || pending.phase === "recovery-required") return yield* Effect.fail(/* @__PURE__ */ new Error("Model change cannot reserve a call after an unknown outcome"));
-			const id = `${pending.request.requestId}:paid:${++paidCallSequence}`;
-			const selected = reserveModelChangeBudget(pending.budget, {
-				at: requireNow(options),
-				id,
-				kind,
-				...maxOutputTokens === void 0 ? {} : { maxOutputTokens }
-			});
-			yield* savePending({
-				...pending,
-				budget: selected.budget
-			});
-			return {
-				reservation: selected.reservation,
-				settle: ({ outcome, outputTokens }) => settlePaidCall(() => pending, savePending, {
-					id,
-					kind,
-					outcome,
-					outputTokens
-				})
-			};
-		})
-	};
-	const revalidateAcceptedBinding = () => Effect.gen(function* () {
-		if (!pending.authorizationId || !pending.principal) return {
-			code: "authorization_incomplete",
-			reason: "The accepted Model change has no trusted authorization binding.",
-			status: "rejected"
-		};
-		const decision = yield* options.authorization.revalidate({
-			authorizationId: pending.authorizationId,
-			current: state.current,
-			homeId: options.homeId,
-			pending
-		});
-		if (decision.status === "rejected") return {
-			code: "authorization_revoked",
-			reason: decision.reason,
-			status: "rejected"
-		};
-		if (decision.bindingRevision !== pending.bindingRevision || state.current.bindingRevision !== pending.bindingRevision || state.revision !== pending.expectedRevision) return {
-			code: "binding_changed",
-			reason: "Model revision or provider binding changed before Model apply",
-			status: "rejected"
-		};
-		return {
-			bindingRevision: decision.bindingRevision,
-			status: "approved"
-		};
-	});
-	const finish = (effect) => Effect.exit(effect).pipe(Effect.flatMap((exit) => Effect.gen(function* () {
-		const requestId = pending.request.requestId;
-		const finalReceipt = state.requests[requestId];
-		const recoveryRequired = state.recoveryRequired !== void 0 || state.pending?.phase === "recovery-required" || finalReceipt?.status === "recovery-required";
-		const durableTerminalState = state.pending === void 0 && finalReceipt !== void 0 && (finalReceipt.status === "applied" || finalReceipt.status === "failed" || finalReceipt.status === "restored");
-		if (boundaryHeld && durableTerminalState && !recoveryRequired) yield* options.boundary.resumeAfterChange({ requestId });
-		if (exit._tag === "Failure") return yield* Effect.failCause(exit.cause);
-		return exit.value;
-	})));
-	return finish(Effect.gen(function* () {
-		yield* savePending({
-			...pending,
-			phase: "waiting-for-boundary"
-		});
-		boundaryHeld = true;
-		const boundary = yield* Effect.either(options.boundary.waitForSafeBoundary({
-			deadlineAt: pending.budget.deadlineAt,
-			requestId: pending.request.requestId
-		}));
-		if (Either.isLeft(boundary)) return yield* saveFailed(modelErrorFrom(boundary.left, "boundary"));
-		const authorization = yield* Effect.either(revalidateAcceptedBinding());
-		if (Either.isLeft(authorization)) return yield* saveFailed(modelErrorFrom(authorization.left, "boundary"));
-		if (authorization.right.status === "rejected") return yield* saveFailed(modelError(authorization.right.code, authorization.right.reason, "boundary"));
-		yield* savePending({
-			...pending,
-			phase: "validating"
-		});
-		const context = runtimeContext(state, pending);
-		const drained = yield* Effect.either(options.runtime.drain({
-			...context,
-			deadlineAt: pending.budget.deadlineAt
-		}));
-		if (Either.isLeft(drained)) return yield* restoreAfterFailure({
-			context,
-			error: modelErrorFrom(drained.left, "activation"),
-			options,
-			saveFinal,
-			savePending,
-			state: () => state,
-			pending: () => pending
-		});
-		const validated = yield* Effect.either(options.runtime.validate({
-			context,
-			budget: executionBudget
-		}));
-		if (Either.isLeft(validated)) return yield* restoreAfterFailure({
-			context,
-			error: modelErrorFrom(validated.left, "validation"),
-			options,
-			saveFinal,
-			savePending,
-			state: () => state,
-			pending: () => pending
-		});
-		if (!validated.right.passed || !sameTarget(validated.right.model, target)) return yield* restoreAfterFailure({
-			context,
-			error: modelError("validation_failed", "Model validation did not prove the requested target", "validation"),
-			options,
-			saveFinal,
-			savePending,
-			state: () => state,
-			pending: () => pending
-		});
-		const activationAuthorization = yield* Effect.either(revalidateAcceptedBinding());
-		if (Either.isLeft(activationAuthorization)) return yield* saveFailed(modelErrorFrom(activationAuthorization.left, "activation"));
-		if (activationAuthorization.right.status === "rejected") return yield* saveFailed(modelError(activationAuthorization.right.code, activationAuthorization.right.reason, "activation"));
-		yield* savePending({
-			...pending,
-			phase: "activating"
-		});
-		const activated = yield* Effect.either(options.runtime.activate({
-			beforeApply: () => Effect.gen(function* () {
-				const guard = yield* revalidateAcceptedBinding();
-				if (guard.status === "rejected") return yield* Effect.fail(new Error(guard.reason));
-			}),
-			context,
-			validation: validated.right,
-			budget: executionBudget
-		}));
-		if (Either.isLeft(activated)) return yield* restoreAfterFailure({
-			context,
-			error: modelErrorFrom(activated.left, "activation"),
-			options,
-			saveFinal,
-			savePending,
-			state: () => state,
-			pending: () => pending
-		});
-		if (Object.keys(pending.budget.reservations).length > 0) return yield* restoreAfterFailure({
-			context,
-			error: modelError("paid_call_unsettled", "Model runtime returned with an unsettled paid call", "activation"),
-			options,
-			saveFinal,
-			savePending,
-			state: () => state,
-			pending: () => pending
-		});
-		yield* savePending({
-			...pending,
-			phase: "committing"
-		});
-		const now = requireNow(options);
-		const applied = {
-			...pendingReceipt(state, pending, now),
-			current: validated.right.model,
-			phase: options.notification ? "notifying" : "completed",
-			previous: state.current,
-			revision: state.revision + 1,
-			status: "applied",
-			...options.notification ? { notification: {
-				attempts: 0,
-				status: "pending"
-			} } : {}
-		};
-		const { pending: _pending, recoveryRequired: _recoveryRequired, ...stateWithoutTransient } = state;
-		const appliedState = {
-			...stateWithoutTransient,
-			current: validated.right.model,
-			previous: state.current,
-			requests: {
-				...state.requests,
-				[pending.request.requestId]: applied
-			},
-			revision: state.revision + 1,
-			updatedAt: now
-		};
-		const committed = yield* Effect.either(persistState(options, appliedState));
-		if (Either.isLeft(committed)) return yield* restoreAfterFailure({
-			context,
-			error: modelErrorFrom(committed.left, "commit"),
-			options,
-			saveFinal,
-			savePending,
-			state: () => state,
-			pending: () => pending
-		});
-		state = committed.right;
-		pending = {
-			...pending,
-			phase: "completed",
-			updatedAt: now
-		};
-		const release = yield* Effect.either(options.runtime.releasePrevious({
-			...context,
-			deadlineAt: pending.budget.deadlineAt
-		}));
-		if (Either.isLeft(release)) {
-			const releaseError = modelErrorFrom(release.left, "activation");
-			const withReleaseError = {
-				...applied,
-				error: releaseError,
-				updatedAt: requireNow(options)
-			};
-			state = yield* persistState(options, {
-				...state,
-				requests: {
-					...state.requests,
-					[pending.request.requestId]: withReleaseError
-				},
-				updatedAt: withReleaseError.updatedAt
-			});
-		}
-		if (!options.notification) return state.requests[pending.request.requestId];
-		return state.requests[pending.request.requestId];
-	}));
-}
-function restoreAfterFailure(input) {
-	return Effect.gen(function* () {
-		const pending = input.pending();
-		if (pending.recoveryAttemptedAt) {
-			const recovery = recoveryReceipt(input.state(), pending, modelError("recovery_already_attempted", input.error.message, "restore"), requireNow(input.options));
-			return yield* input.saveFinal(recovery, true);
-		}
-		yield* input.savePending({
-			...pending,
-			phase: "recovery-required",
-			recoveryAttemptedAt: requireNow(input.options)
-		});
-		const marked = input.pending();
-		if (marked.unknownPaidCallId) {
-			const { unknownPaidCallId: _unknownPaidCallId, ...withoutUnknown } = marked;
-			yield* input.savePending({ ...withoutUnknown });
-		}
-		const restored = yield* Effect.either(input.options.runtime.restore({
-			budget: executionBudgetForRecovery(input),
-			context: input.context,
-			reason: input.error.message
-		}));
-		if (Either.isRight(restored) && !input.pending().unknownPaidCallId && Object.keys(input.pending().budget.reservations).length === 0) {
-			const receipt = restoredReceipt(input.state(), input.pending(), input.error, requireNow(input.options));
-			return yield* input.saveFinal(receipt);
-		}
-		const recoveryError = Either.isLeft(restored) ? modelErrorFrom(restored.left, "restore") : modelError("recovery_unknown", "Model restore outcome is unknown", "restore", "unknown");
-		const receipt = recoveryReceipt(input.state(), input.pending(), recoveryError, requireNow(input.options));
-		return yield* input.saveFinal(receipt, true);
-	});
-}
-function executionBudgetForRecovery(input) {
-	let sequence = Object.keys(input.pending().budget.reservations).length;
-	return {
-		get deadlineAt() {
-			return input.pending().budget.deadlineAt;
-		},
-		reservePaidCall: ({ kind, maxOutputTokens }) => Effect.gen(function* () {
-			if (kind !== "restore") return yield* Effect.fail(/* @__PURE__ */ new Error("recovery may only reserve a restore call"));
-			const pending = input.pending();
-			const id = `${pending.request.requestId}:recovery:${++sequence}`;
-			const selected = reserveModelChangeBudget(pending.budget, {
-				at: requireNow(input.options),
-				id,
-				kind,
-				...maxOutputTokens === void 0 ? {} : { maxOutputTokens }
-			});
-			yield* input.savePending({
-				...pending,
-				budget: selected.budget,
-				phase: "recovery-required"
-			});
-			return {
-				reservation: selected.reservation,
-				settle: ({ outcome, outputTokens }) => settlePaidCall(input.pending, input.savePending, {
-					id,
-					kind,
-					outcome,
-					outputTokens
-				})
-			};
-		})
-	};
-}
-function settlePaidCall(getPending, savePending, input) {
-	const nextPending = settleModelChangePaidCall(getPending(), input);
-	return savePending(nextPending).pipe(Effect.map(() => nextPending.budget));
-}
-//#endregion
-//#region src/core/application/deployment/model/model-change-recovery-workflow.ts
-function recoverModelChangeState(options) {
-	return Effect.gen(function* () {
-		let state = yield* loadState(options);
-		if (state.pending) state = yield* recoverModelChangePending(options, state, state.pending);
-		return state;
-	});
-}
-function recoverModelChangePending(options, initialState, initialPending) {
-	let state = initialState;
-	let pending = initialPending;
-	return Effect.gen(function* () {
-		if (pending.phase === "accepted" || pending.phase === "awaiting-approval" || pending.phase === "waiting-for-boundary") {
-			if (Object.keys(pending.budget.reservations).length === 0) {
-				const error = modelError("interrupted_before_verification", "Model change stopped before verification; the persisted current model was retained", "boundary");
-				const receipt = failedReceipt(state, pending, error, requireNow(options));
-				return yield* persistRecoveryReceipt(options, state, receipt);
-			}
-		}
-		if (pending.recoveryAttemptedAt) {
-			const settled = yield* settlePendingReservations(options, state, pending, () => "recovery-required");
-			state = settled.state;
-			pending = settled.pending;
-			const restoreReservation = settled.restoreReservation;
-			const error = modelError(restoreReservation ? "restore_outcome_unknown" : "recovery_already_attempted", restoreReservation ? "The restore call outcome is unknown; restore was not replayed" : "Model recovery was already attempted", "restore", restoreReservation ? "unknown" : "known");
-			const receipt = recoveryReceipt(state, pending, error, requireNow(options));
-			return yield* persistRecoveryReceipt(options, state, receipt, error);
-		}
-		const settled = yield* settlePendingReservations(options, state, pending, (reservation) => reservation.kind === "restore" ? "recovery-required" : "validation-unknown");
-		state = settled.state;
-		pending = settled.pending;
-		const restoreReservation = settled.restoreReservation;
-		if (pending.unknownPaidCallId) {
-			const { unknownPaidCallId: _unknownPaidCallId, ...withoutUnknown } = pending;
-			pending = {
-				...withoutUnknown,
-				updatedAt: requireNow(options)
-			};
-			state = yield* persistRecoveryPending(options, state, pending);
-		}
-		if (restoreReservation) {
-			const error = modelError("restore_outcome_unknown", "The restore call outcome is unknown; restore was not replayed", "restore", "unknown");
-			const receipt = recoveryReceipt(state, pending, error, requireNow(options));
-			return yield* persistRecoveryReceipt(options, state, receipt, error);
-		}
-		const context = pending.target ? runtimeContext(state, pending) : {
-			baseline: state.current,
-			bindingRevision: pending.bindingRevision,
-			requestId: pending.request.requestId,
-			target: toReference(state.current)
-		};
-		pending = {
-			...pending,
-			phase: "recovery-required",
-			recoveryAttemptedAt: requireNow(options),
-			updatedAt: requireNow(options)
-		};
-		state = yield* persistState(options, stateWithPending(state, pending, pendingReceipt(state, pending, pending.updatedAt)));
-		const restored = yield* Effect.either(options.runtime.restore({
-			budget: executionBudgetForRecovery({
-				options,
-				pending: () => pending,
-				savePending: (next) => Effect.gen(function* () {
-					pending = next;
-					const receipt = pendingReceipt(state, pending, pending.updatedAt);
-					state = yield* persistState(options, stateWithPending(state, pending, receipt));
-					return receipt;
-				})
-			}),
-			context,
-			reason: "recovering an interrupted Model change"
-		}));
-		if (Either.isRight(restored) && !pending.unknownPaidCallId && Object.keys(pending.budget.reservations).length === 0) {
-			const receipt = restoredReceipt(state, pending, void 0, requireNow(options));
-			return yield* persistRecoveryReceipt(options, state, receipt);
-		}
-		const error = Either.isLeft(restored) ? modelErrorFrom(restored.left, "restore") : modelError("recovery_unknown", "interrupted Model restore outcome is unknown", "restore", "unknown");
-		const receipt = recoveryReceipt(state, pending, error, requireNow(options));
-		return yield* persistRecoveryReceipt(options, state, receipt, error);
-	});
-}
-function persistRecoveryReceipt(options, state, receipt, error) {
-	return persistState(options, stateWithReceipt(state, terminalReceiptForPersistence(options, receipt), error));
-}
-function persistRecoveryPending(options, state, pending) {
-	return persistState(options, stateWithPending(state, pending, pendingReceipt(state, pending, pending.updatedAt)));
-}
-function markUnknownReservation(options, pending, reservation, phase) {
-	return {
-		...settleModelChangePaidCall(pending, {
-			id: reservation.id,
-			kind: reservation.kind,
-			outcome: "unknown",
-			outputTokens: reservation.maxOutputTokens
-		}),
-		phase,
-		updatedAt: requireNow(options)
-	};
-}
-function settlePendingReservations(options, initialState, initialPending, phaseFor) {
-	let state = initialState;
-	let pending = initialPending;
-	let restoreReservation = false;
-	return Effect.gen(function* () {
-		for (const reservation of Object.values(pending.budget.reservations)) {
-			restoreReservation ||= reservation.kind === "restore";
-			pending = markUnknownReservation(options, pending, reservation, phaseFor(reservation));
-			state = yield* persistRecoveryPending(options, state, pending);
-		}
-		return {
-			pending,
-			restoreReservation,
-			state
-		};
-	});
-}
-//#endregion
-//#region src/core/application/deployment/model/model-change-notification.ts
-/**
-* Deliver one durable terminal receipt. Each state update reloads the latest
-* model state under the coordinator's serial writer and patches only the
-* target receipt, so a delayed notification cannot restore an old current
-* binding, revision, or sibling request.
-*/
-function notifyModelChangeReceipt(options, requestId, retry, withModelSerial) {
-	const notification = options.notification;
-	if (!notification) return Effect.succeed(void 0);
-	return Effect.gen(function* () {
-		const attempted = yield* withModelSerial(beginNotificationAttempt(options, requestId));
-		if (!attempted) return void 0;
-		return yield* withModelSerial(finishNotificationAttempt(options, requestId, attempted, yield* Effect.either(notification.notify({
-			receipt: toPublicReceipt(attempted),
-			retry
-		}))));
-	});
-}
-function beginNotificationAttempt(options, requestId) {
-	return Effect.gen(function* () {
-		const state = yield* loadState(options);
-		const receipt = state.requests[requestId];
-		if (!receipt || receipt.status === "pending" || !receipt.notification || receipt.notification.status === "sent") return;
-		const attemptedAt = requireNow(options);
-		return (yield* persistReceiptPatch(options, state, {
-			...receipt,
-			notification: {
-				attempts: receipt.notification.attempts + 1,
-				lastAttemptAt: attemptedAt,
-				status: "pending"
-			},
-			updatedAt: attemptedAt
-		})).requests[requestId];
-	});
-}
-function finishNotificationAttempt(options, requestId, attempted, delivered) {
-	return Effect.gen(function* () {
-		const state = yield* loadState(options);
-		const latest = state.requests[requestId];
-		if (!latest || !latest.notification || latest.notification.status === "sent") return latest;
-		const updatedAt = requireNow(options);
-		return (yield* persistReceiptPatch(options, state, Either.isRight(delivered) ? {
-			...latest,
-			notification: {
-				...latest.notification,
-				status: "sent"
-			},
-			...latest.status === "applied" ? { phase: "completed" } : {},
-			updatedAt
-		} : {
-			...latest,
-			notification: {
-				...latest.notification,
-				attempts: Math.max(latest.notification.attempts, attempted.notification?.attempts ?? 0),
-				status: "unknown"
-			},
-			updatedAt
-		})).requests[requestId];
-	});
-}
-function persistReceiptPatch(options, state, receipt) {
-	return persistState(options, {
-		...state,
-		requests: {
-			...state.requests,
-			[receipt.requestId]: receipt
-		},
-		updatedAt: receipt.updatedAt
-	});
-}
-//#endregion
-//#region src/core/application/deployment/model/model-change-coordinator.ts
-function createModelChangeCoordinator(options) {
-	const serial = Effect.unsafeMakeSemaphore(1);
-	const notificationSerial = Effect.unsafeMakeSemaphore(1);
-	return {
-		accept: (submission, transport) => serial.withPermits(1)(Effect.uninterruptible(acceptRequest(options, submission, transport))).pipe(Effect.flatMap((receipt) => notifyPendingReceipt(options, receipt, serial, notificationSerial))),
-		recover: () => serial.withPermits(1)(Effect.uninterruptible(recoverModelChangeState(options))).pipe(Effect.flatMap(() => retryPendingNotifications(options, serial, notificationSerial))),
-		run: (requestId) => Effect.gen(function* () {
-			const initial = yield* loadState(options);
-			const decision = initial.pending?.request.requestId === requestId && initial.pending.phase === "awaiting-approval" && options.authorization.resolvePending ? yield* options.authorization.resolvePending({
-				current: initial.current,
-				homeId: options.homeId,
-				pending: initial.pending
-			}) : void 0;
-			return yield* notifyPendingReceipt(options, yield* serial.withPermits(1)(Effect.uninterruptible(runRequest(options, requestId, decision))), serial, notificationSerial);
-		}),
-		status: (requestId) => Effect.gen(function* () {
-			const state = yield* loadState(options);
-			const actual = options.runtime.current ? yield* options.runtime.current().pipe(Effect.catchAll(() => Effect.succeed(void 0))) : void 0;
-			const receipt = requestId === void 0 ? void 0 : state.requests[requestId];
-			if (requestId !== void 0 && !receipt) return yield* Effect.fail(new ModelChangeNotFound(`unknown Model change request: ${requestId}`));
-			return toStatusView(state, actual, receipt);
-		})
-	};
-}
-function acceptRequest(options, submission, transport) {
-	return Effect.gen(function* () {
-		validateSubmission(submission);
-		let state = yield* loadState(options);
-		const existing = state.requests[submission.requestId];
-		const decision = yield* options.authorization.authorize({
-			current: state.current,
-			homeId: options.homeId,
-			request: submission,
-			transport,
-			...existing && existing.authorizationId ? { existing: {
-				authorizationId: existing.authorizationId,
-				deadlineAt: existing.budget.deadlineAt
-			} } : {}
-		});
-		if (decision.status === "rejected") return yield* Effect.fail(new ModelChangeAuthorizationRejected(decision.reason));
-		if (existing) {
-			if (decision.status === "approved") {
-				assertPrincipal(options, decision.principal);
-				assertExistingPrincipal(existing, decision.principal);
-				if (existing.phase === "awaiting-approval" && state.pending?.request.requestId === submission.requestId) {
-					if (!sameSubmission(existing, submission)) return yield* Effect.fail(new ModelChangeRequestConflict(`request id has different input: ${submission.requestId}`));
-					return yield* upgradeAwaitingApproval(options, state, existing, decision);
-				}
-				const digest = digestFor(options, state, submission, decision, existing.bindingRevision);
-				if (existing.inputDigest !== digest) return yield* Effect.fail(new ModelChangeRequestConflict(`request id has different trusted input: ${submission.requestId}`));
-			} else {
-				if (!decision.principal) return yield* Effect.fail(new ModelChangeAuthorizationRejected("awaiting approval has no trusted principal"));
-				assertPrincipal(options, decision.principal);
-				if (decision.principal.ownerId !== state.ownerId) return yield* Effect.fail(new ModelChangeAuthorizationRejected("authorization owner does not match Model Home"));
-				if (!sameSubmission(existing, submission)) return yield* Effect.fail(new ModelChangeRequestConflict(`request id has different input: ${submission.requestId}`));
-				if (existing.phase !== "awaiting-approval") return yield* Effect.fail(new ModelChangeAuthorizationRejected("Model change authorization is no longer approved"));
-				assertExistingPrincipal(existing, decision.principal);
-			}
-			return existing;
-		}
-		if (state.recoveryRequired) return yield* Effect.fail(new ModelChangeAuthorizationRejected("Model change is blocked by recovery-required state"));
-		if (state.pending) return yield* Effect.fail(new ModelChangeBusy(`Model change already pending: ${state.pending.request.requestId}`));
-		if (submission.expectedRevision !== state.revision) return yield* Effect.fail(new ModelChangeRevisionConflict(`expected Model revision ${submission.expectedRevision}, current revision is ${state.revision}`));
-		const target = resolveTarget(state, submission);
-		const now = requireNow(options);
-		const principal = decision.status === "approved" ? decision.principal : decision.principal;
-		if (principal) {
-			assertPrincipal(options, principal);
-			if (principal.ownerId !== state.ownerId) return yield* Effect.fail(new ModelChangeAuthorizationRejected("authorization owner does not match Model Home"));
-		}
-		const bindingRevision = decision.status === "approved" ? decision.bindingRevision : decision.bindingRevision ?? state.current.bindingRevision;
-		const budget = decision.status === "approved" ? carryModelChangeBudgetUsage(createModelChangeBudget(decision.budget, now), sharedBudgetUsage(state, decision.budget.identity)) : createAwaitingModelChangeBudget(decision.deadlineAt ?? now);
-		const pending = {
-			acceptedAt: now,
-			...decision.authorizationId ? { authorizationId: decision.authorizationId } : {},
-			bindingRevision,
-			budget,
-			budgetIdentity: decision.status === "approved" ? decision.budget.identity : budget.identity,
-			expectedRevision: state.revision,
-			inputDigest: digestFor(options, state, submission, decision, bindingRevision),
-			operation: submission.operation,
-			...principal ? {
-				ownerId: principal.ownerId,
-				principal
-			} : {},
-			phase: decision.status === "awaiting-approval" ? "awaiting-approval" : "accepted",
-			request: stripTransportContext(submission),
-			...target ? { target } : {},
-			updatedAt: now
-		};
-		const receipt = pendingReceipt(state, pending, now);
-		state = yield* persistState(options, stateWithPending(state, pending, receipt));
-		return state.requests[submission.requestId];
-	});
-}
-function runRequest(options, requestId, resolvedAwaitingDecision) {
-	return Effect.gen(function* () {
-		let state = yield* loadState(options);
-		let pending = state.pending;
-		if (!pending || pending.request.requestId !== requestId) {
-			const receipt = state.requests[requestId];
-			if (!receipt) return yield* Effect.fail(new ModelChangeNotFound(`unknown Model change request: ${requestId}`));
-			return receipt;
-		}
-		if (pending.phase === "awaiting-approval") {
-			if (!options.authorization.resolvePending) return state.requests[requestId];
-			const decision = resolvedAwaitingDecision ?? (options.authorization.resolvePending ? yield* options.authorization.resolvePending({
-				current: state.current,
-				homeId: options.homeId,
-				pending
-			}) : void 0);
-			if (!decision) return state.requests[requestId];
-			if (decision.status === "awaiting-approval") return state.requests[requestId];
-			if (decision.status === "rejected") {
-				const receipt = failedReceipt(state, pending, modelError("authorization_rejected", decision.reason, "boundary"), requireNow(options));
-				return yield* persistTerminalReceipt(options, state, receipt);
-			}
-			assertPrincipal(options, decision.principal);
-			if (decision.principal.ownerId !== state.ownerId || decision.bindingRevision !== pending.bindingRevision || state.current.bindingRevision !== pending.bindingRevision || state.revision !== pending.expectedRevision) {
-				const receipt = failedReceipt(state, pending, modelError("binding_changed", "Model authorization binding changed before approval was applied", "boundary"), requireNow(options));
-				return yield* persistTerminalReceipt(options, state, receipt);
-			}
-			const promoted = promoteAwaitingPending(options, state, pending, decision);
-			const now = promoted.updatedAt;
-			const receipt = pendingReceipt(state, promoted, now);
-			state = yield* persistState(options, stateWithPending(state, promoted, receipt));
-			pending = promoted;
-		}
-		if (pendingRequiresModelChangeRecovery(pending) || Object.keys(pending.budget.reservations).length > 0) return (yield* recoverModelChangePending(options, state, pending)).requests[requestId];
-		const authorization = yield* revalidateAuthorization(options, state, pending);
-		if (authorization.status === "rejected") {
-			const error = modelError("authorization_revoked", authorization.reason, "boundary");
-			const receipt = failedReceipt(state, pending, error, requireNow(options));
-			return yield* persistTerminalReceipt(options, state, receipt);
-		}
-		if (authorization.bindingRevision !== pending.bindingRevision) {
-			const error = modelError("binding_changed", "provider binding changed before Model change apply", "boundary");
-			const receipt = failedReceipt(state, pending, error, requireNow(options));
-			return yield* persistTerminalReceipt(options, state, receipt);
-		}
-		if (state.revision !== pending.expectedRevision || state.current.bindingRevision !== pending.bindingRevision) {
-			const error = modelError("revision_changed", "Model revision changed before Model change apply", "boundary");
-			const receipt = failedReceipt(state, pending, error, requireNow(options));
-			return yield* persistTerminalReceipt(options, state, receipt);
-		}
-		if (!pending.target) {
-			const error = modelError("target_unavailable", "Model change target is unavailable", "validation");
-			const receipt = failedReceipt(state, pending, error, requireNow(options));
-			return yield* persistTerminalReceipt(options, state, receipt);
-		}
-		return yield* executeModelChangePending(options, state, pending);
-	});
-}
-function revalidateAuthorization(options, state, pending) {
-	if (!pending.authorizationId || !pending.principal) return Effect.succeed({
-		bindingRevision: pending.bindingRevision,
-		reason: "Model change authorization is incomplete",
-		status: "rejected"
-	});
-	return options.authorization.revalidate({
-		authorizationId: pending.authorizationId,
-		current: state.current,
-		homeId: options.homeId,
-		pending
-	}).pipe(Effect.map((decision) => decision.status === "approved" ? {
-		bindingRevision: decision.bindingRevision,
-		status: "approved"
-	} : {
-		bindingRevision: pending.bindingRevision,
-		reason: decision.reason,
-		status: "rejected"
-	}));
-}
-function upgradeAwaitingApproval(options, state, existing, decision) {
-	return Effect.gen(function* () {
-		const pending = state.pending;
-		if (!pending || pending.request.requestId !== existing.requestId) return yield* Effect.fail(new ModelChangeRequestConflict("awaiting-approval request is no longer pending"));
-		if (decision.principal.ownerId !== state.ownerId) return yield* Effect.fail(new ModelChangeAuthorizationRejected("authorization owner does not match Model Home"));
-		const upgraded = promoteAwaitingPending(options, state, pending, decision);
-		const now = upgraded.updatedAt;
-		return (yield* persistState(options, stateWithPending(state, upgraded, pendingReceipt(state, upgraded, now)))).requests[existing.requestId];
-	});
-}
-function promoteAwaitingPending(options, state, pending, decision) {
-	const now = requireNow(options);
-	const budget = carryModelChangeBudgetUsage(createModelChangeBudget(decision.budget, now), sharedBudgetUsage(state, decision.budget.identity));
-	return {
-		...pending,
-		authorizationId: decision.authorizationId,
-		bindingRevision: decision.bindingRevision,
-		budget,
-		budgetIdentity: decision.budget.identity,
-		inputDigest: digestFor(options, state, pending.request, decision, decision.bindingRevision),
-		ownerId: decision.principal.ownerId,
-		phase: "accepted",
-		principal: decision.principal,
-		updatedAt: now
-	};
-}
-function sharedBudgetUsage(state, budgetIdentity) {
-	let outputTokens = 0;
-	let paidRequests = 0;
-	for (const receipt of Object.values(state.requests)) {
-		if (receipt.budgetIdentity !== budgetIdentity) continue;
-		outputTokens += receipt.budget.outputTokens + receipt.budget.reservedOutputTokens;
-		paidRequests += receipt.budget.paidRequests + receipt.budget.reservedPaidRequests;
-	}
-	return {
-		outputTokens,
-		paidRequests
-	};
-}
-function digestFor(options, state, submission, decision, bindingRevision) {
-	const principal = decision.status === "approved" || decision.status === "awaiting-approval" ? decision.principal : void 0;
-	const source = principal?.source ?? {
-		kind: "human",
-		reference: "awaiting-approval"
-	};
-	return options.identity.digest({
-		...decision.status === "approved" ? { authorizationId: decision.authorizationId } : decision.status === "awaiting-approval" && decision.authorizationId ? { authorizationId: decision.authorizationId } : {},
-		bindingRevision,
-		...decision.status === "approved" ? { budgetIdentity: decision.budget.identity } : {},
-		expectedRevision: submission.expectedRevision,
-		homeId: options.homeId,
-		operation: submission.operation,
-		ownerId: principal?.ownerId ?? state.ownerId,
-		requestId: submission.requestId,
-		source,
-		...submission.target ? { target: toReference(submission.target) } : {}
-	});
-}
-function assertPrincipal(options, principal) {
-	if (principal.homeId !== options.homeId) throw new ModelChangeAuthorizationRejected("authorization Home does not match");
-}
-function assertExistingPrincipal(existing, principal) {
-	if (existing.principal && existing.principal.ownerId !== principal.ownerId) throw new ModelChangeAuthorizationRejected("request belongs to another owner");
-	if (existing.principal && (existing.principal.source.kind !== principal.source.kind || existing.principal.source.reference !== principal.source.reference)) throw new ModelChangeAuthorizationRejected("request belongs to another source");
-}
-function persistTerminalReceipt(options, state, receipt) {
-	return Effect.gen(function* () {
-		const durable = terminalReceiptForPersistence(options, receipt);
-		return (yield* persistState(options, stateWithReceipt(state, durable))).requests[durable.requestId];
-	});
-}
-function notifyPendingReceipt(options, receipt, serial, notificationSerial) {
-	if (!options.notification || receipt.status === "pending" || receipt.notification?.status !== "pending") return Effect.succeed(receipt);
-	return notificationSerial.withPermits(1)(notifyModelChangeReceipt(options, receipt.requestId, false, (effect) => serial.withPermits(1)(effect)).pipe(Effect.map((notified) => notified ?? receipt)));
-}
-function retryPendingNotifications(options, serial, notificationSerial) {
-	if (!options.notification) return loadState(options);
-	return notificationSerial.withPermits(1)(Effect.gen(function* () {
-		const initial = yield* loadState(options);
-		for (const receipt of Object.values(initial.requests)) {
-			if (receipt.status === "pending" || !receipt.notification || receipt.notification.status === "sent") continue;
-			yield* notifyModelChangeReceipt(options, receipt.requestId, true, (effect) => serial.withPermits(1)(effect));
-		}
-		return yield* loadState(options);
-	}));
-}
-function validateSubmission(submission) {
-	if (typeof submission.requestId !== "string" || submission.requestId.length === 0 || submission.operation !== "set" && submission.operation !== "rollback" || !Number.isSafeInteger(submission.expectedRevision) || submission.expectedRevision < 0) throw new Error("invalid Model change submission");
-	if (submission.target !== void 0 && (typeof submission.target.provider !== "string" || submission.target.provider.length === 0 || typeof submission.target.model !== "string" || submission.target.model.length === 0)) throw new Error("invalid Model change target");
-	if (submission.operation === "set" && submission.target === void 0) throw new Error("Model set requires a target");
-	if (submission.operation === "rollback" && submission.target !== void 0) throw new Error("Model rollback does not accept a target");
-}
-//#endregion
-//#region src/bootstrap/deployment/model-management/model-management-control.ts
-/** Owns the control socket and the accepted-operation worker for one Home. */
-function createModelManagementControl(options) {
-	const coordinator = createModelChangeCoordinator(options);
-	const workers = /* @__PURE__ */ new Map();
-	const transportReferences = /* @__PURE__ */ new WeakMap();
-	let closing = false;
-	let workerFailed = false;
-	let recovered = false;
-	const server = createRivusModelManagementSocketServer({
-		handlers: {
-			handle: async (input, trustedRun) => {
-				if (closing || workerFailed || !recovered) return createRivusModelManagementFailure("management_unavailable", "Model management requires Host recovery.");
-				const reference = typeof trustedRun === "object" && trustedRun !== null ? transportReferences.get(trustedRun) : void 0;
-				if (!reference) return createRivusModelManagementFailure("trusted_context_invalid", "The trusted Run context is no longer available.");
-				try {
-					const receipt = await runDeploymentProcessEffect(coordinator.accept({
-						expectedRevision: input.expectedRevision,
-						operation: input.operation,
-						requestId: input.requestId,
-						...input.target ? { target: input.target } : {}
-					}, { reference }));
-					if (receipt.status === "pending" && (receipt.phase !== "awaiting-approval" || options.authorization.resolvePending) && !workers.has(receipt.requestId)) {
-						const work = Promise.resolve().then(async () => {
-							try {
-								if ((await runDeploymentProcessEffect(coordinator.run(receipt.requestId))).status === "recovery-required") {
-									workerFailed = true;
-									options.stopBusinessWork();
-								}
-							} catch {
-								workerFailed = true;
-								options.stopBusinessWork();
-							} finally {
-								workers.delete(receipt.requestId);
-							}
-						});
-						workers.set(receipt.requestId, work);
-					}
-					return {
-						...receipt,
-						protocolVersion: 1,
-						runtimeVersion: options.runtimeVersion
-					};
-				} catch (error) {
-					return publicFailure(error);
-				}
-			},
-			status: async ({ requestId }) => {
-				try {
-					const view = await runDeploymentProcessEffect(coordinator.status(requestId));
-					return {
-						...view,
-						...workerFailed ? { error: {
-							code: "management_worker_failed",
-							message: "An accepted operation requires Host recovery."
-						} } : {},
-						protocolVersion: 1,
-						runtimeVersion: options.runtimeVersion,
-						status: workerFailed || view.recoveryRequired ? "recovery-required" : view.request?.status ?? (view.pending ? "pending" : "applied")
-					};
-				} catch (error) {
-					return publicFailure(error);
-				}
-			}
-		},
-		resolveTrustedRun: { resolve: async (reference) => {
-			if (!await options.resolveTrustedReference(reference)) return void 0;
-			const context = Object.freeze({});
-			transportReferences.set(context, reference);
-			return context;
-		} },
-		socketPath: options.socketPath
-	});
-	return {
-		close: async () => {
-			closing = true;
-			await server.close();
-			await Promise.all(workers.values());
-		},
-		recover: async () => {
-			if (!server.listening()) throw new Error("Acquire the model management socket before recovery.");
-			const state = await runDeploymentProcessEffect(coordinator.recover());
-			if (state.recoveryRequired || state.pending) {
-				workerFailed = true;
-				options.stopBusinessWork();
-			}
-			recovered = true;
-			return state;
-		},
-		start: () => server.start()
-	};
-}
-function publicFailure(error) {
-	const name = typeof error === "object" && error !== null && "name" in error ? error.name : void 0;
-	const failures = {
-		ModelChangeAuthorizationRejected: ["authorization_rejected", "The model management request is outside the current authorization."],
-		ModelChangeBusy: ["model_change_busy", "Another model change is pending. Query its status before submitting again."],
-		ModelChangeNotFound: ["request_not_found", "No model change exists with that request ID."],
-		ModelChangeRequestConflict: ["request_conflict", "The request ID is already bound to different input."],
-		ModelChangeRevisionConflict: ["revision_conflict", "The model revision changed. Read the current status."],
-		ModelChangeBudgetExceeded: ["budget_exhausted", "The existing model change budget is exhausted."]
-	};
-	const [code, message] = typeof name === "string" && failures[name] ? failures[name] : ["management_failed", "The model management request could not be completed."];
-	return createRivusModelManagementFailure(code, message);
-}
-//#endregion
-//#region src/bootstrap/deployment/model-management/pi-model-management-deployment.ts
-/** Assemble one Home's model authority without constructing a business session. */
-async function openPiModelManagementDeployment(options) {
-	const configuration = parseRivusModelManagementHomeConfig(options.env);
-	const managementDirectory = resolve(options.stateDirectory, "model-management");
-	const statePath = join(managementDirectory, "model-state.json");
-	const markerPath = join(managementDirectory, "legacy-export.json");
-	if (!configuration.enabled && await readPersistenceFile(statePath) === void 0) return void 0;
-	if (!Number.isSafeInteger(options.agentCount) || options.agentCount < 1) throw new Error("Model management requires a positive integer Agent count per Home.");
-	const homeId = createSha256Digest(await realpath(options.stateDirectory));
-	const runtimeVersion = options.runtimeVersion ?? JSON.parse(await readFile(new URL("../package.json", import.meta.resolve("@rivus/agent")), "utf8")).version;
-	const clock = { now: () => (/* @__PURE__ */ new Date()).toISOString() };
-	const boundary = createModelChangeRunBoundary({ clock });
-	boundary.fence();
-	const runtime = createPiModelRuntime({
-		modelCatalogPath: options.modelCatalogPath,
-		modelRuntime: options.modelRuntime
-	});
-	const resolvers = /* @__PURE__ */ new Set();
-	const resolveRun = (reference) => {
-		for (const resolver of resolvers) {
-			const run = resolver(reference);
-			if (run) return run;
-		}
-	};
-	let repository;
-	let authorization;
-	const requireRepository = () => {
-		if (!repository) throw new Error("Model state has not been opened under the control socket.");
-		return repository;
-	};
-	const socketPath = join(managementDirectory, "control.sock");
-	const control = createModelManagementControl({
-		authorization: {
-			authorize: (input) => Effect.suspend(() => authorization ? authorization.authorize(input) : Effect.fail(/* @__PURE__ */ new Error("Model authorization is not ready."))),
-			revalidate: (input) => Effect.suspend(() => authorization ? authorization.revalidate(input) : Effect.fail(/* @__PURE__ */ new Error("Model authorization is not ready."))),
-			resolvePending: (input) => Effect.suspend(() => authorization?.resolvePending ? authorization.resolvePending(input) : Effect.fail(/* @__PURE__ */ new Error("Model authorization is not ready.")))
-		},
-		boundary,
-		clock,
-		homeId,
-		identity: { digest: (input) => createToolInputDigest(input, createSha256Digest) },
-		notification: { notify: ({ receipt }) => Effect.gen(function* () {
-			const source = (yield* requireRepository().load()).requests[receipt.requestId]?.principal?.source;
-			if (!source || source.kind !== "human") return yield* Effect.fail(/* @__PURE__ */ new Error("Model result notification has no trusted human source."));
-			const selected = receipt.current ? `${receipt.current.provider}/${receipt.current.model}` : "unknown";
-			const text = `模型变更 ${receipt.requestId}: ${receipt.status}。当前模型 ${selected}，revision ${receipt.revision}。${receipt.error ? `原因：${receipt.error.code}。` : ""}`;
-			yield* options.reply(source.reference, text);
-			return { delivered: true };
-		}) },
-		repository: {
-			load: () => Effect.suspend(() => requireRepository().load()),
-			persist: (state) => Effect.suspend(() => requireRepository().persist(state))
-		},
-		resolveTrustedReference: async (reference) => resolveRun(reference) !== void 0,
-		runtime,
-		runtimeVersion,
-		socketPath,
-		stopBusinessWork: () => boundary.fence()
-	});
-	await control.start();
-	try {
-		const imported = await migrateRivusModelManagementConfig({
-			writeAtomicTextFile,
-			env: options.environmentOverrides,
-			...options.envFilePath ? { envFilePath: options.envFilePath } : {},
-			knownGoodModel: "unused",
-			knownGoodProvider: "unused",
-			managementEnabled: true
-		});
-		if (imported.status !== "enabled") throw new Error("Expected the original model configuration.");
-		const baseUrl = options.env.PI_BASE_URL?.trim();
-		if (baseUrl) {
-			await mergePiProviderBaseUrlOverride({
-				baseUrl,
-				filePath: options.modelCatalogPath,
-				provider: imported.initialModel.provider
-			});
-			await runDeploymentProcessEffect(runtime.refreshModelCatalog({
-				allowNetwork: false,
-				provider: imported.initialModel.provider
-			}));
-		}
-		const grant = await readPiModelManagementGrant(options, homeId, imported.initialModel);
-		const hadState = await readPersistenceFile(statePath) !== void 0;
-		repository = await runDeploymentProcessEffect(openJsonModelStateRepository({
-			filePath: statePath,
-			initial: {
-				current: {
-					...imported.initialModel,
-					bindingRevision: grant.bindingRevision
-				},
-				homeId,
-				ownerId: configuration.ownerOpenId ?? "disabled",
-				requests: {},
-				revision: 0,
-				schemaVersion: 1,
-				updatedAt: clock.now()
-			}
-		}));
-		const state = await runDeploymentProcessEffect(repository.load());
-		if (state.homeId !== homeId || configuration.enabled && state.ownerId !== configuration.ownerOpenId) throw new Error("Persisted model state belongs to another Home or owner.");
-		const marker = await readExportMarker(markerPath);
-		if (!configuration.enabled && marker?.revision === state.revision && !state.pending && !state.recoveryRequired) {
-			await control.close();
-			return {
-				enabled: false,
-				model: imported.initialModel
-			};
-		}
-		if (configuration.enabled && marker && !sameModel(imported.initialModel, state.current)) throw new Error("The legacy model changed after management was disabled. Reconcile the two selections before enabling management.");
-		if (configuration.enabled && state.current.bindingRevision !== grant.bindingRevision) throw new Error("Provider credentials, endpoint, thinking mode or adapter binding changed. Reconcile the persisted model binding before enabling management.");
-		if (!hadState) await runDeploymentProcessEffect(repository.persist(state));
-		const operations = await runDeploymentProcessEffect(openJsonlToolOperationLedger({ filePath: join(managementDirectory, "tool-operations.jsonl") }));
-		authorization = createModelChangeAuthorization({
-			...options.approval ? { approval: options.approval } : {},
-			clock,
-			digest: createSha256Digest,
-			grant: { current: () => Effect.tryPromise({
-				try: () => readPiModelManagementGrant(options, homeId, state.current),
-				catch: (error) => error
-			}) },
-			managementAgentId: options.agentId,
-			operations,
-			resolveWorkerRun: ({ grant: currentGrant, principal, request }) => Effect.sync(() => ({
-				authority: createInvocationAuthority({
-					agentId: options.agentId,
-					allowedActorOpenIds: [principal.ownerId],
-					endpointId: currentGrant.endpointId,
-					instanceId: `model-management:${homeId}`,
-					runId: `model-change:${request.requestId}`,
-					sessionKey: `model-management:${homeId}`,
-					sourceMessageId: principal.source.reference,
-					tenantKey: currentGrant.tenantKey,
-					toolGrantSet: {
-						revision: String(currentGrant.revision),
-						toolIds: ["rivus.model.change"]
-					}
-				}),
-				kind: "human"
-			})),
-			resolveRun: (reference) => Effect.sync(() => resolveRun(reference))
-		});
-		await runDeploymentProcessEffect(runtime.initializeSelection({
-			binding: state.current,
-			thinkingLevel: options.thinkingLevel
-		}));
-		const recovered = await control.recover();
-		const recoveryRequired = Boolean(recovered.recoveryRequired || recovered.pending);
-		if (!configuration.enabled && !recoveryRequired) {
-			if (!marker || marker.revision !== recovered.revision) {
-				await migrateRivusModelManagementConfig({
-					writeAtomicTextFile,
-					env: options.environmentOverrides,
-					...options.envFilePath ? { envFilePath: options.envFilePath } : {},
-					knownGoodModel: recovered.current.model,
-					knownGoodProvider: recovered.current.provider,
-					managementEnabled: false
-				});
-				await writeAtomicTextFile(markerPath, JSON.stringify({
-					revision: recovered.revision,
-					version: 1
-				}), {
-					durable: true,
-					mode: 384
-				});
-			}
-			await control.close();
-			return {
-				enabled: false,
-				model: recovered.current
-			};
-		}
-		if (marker && !recoveryRequired) await unlink(markerPath);
-		const skillInstallation = await installRivusRuntimeManagementSkill({
-			writeAtomicTextFile,
-			...options.homeDirectory ? { homeDirectory: options.homeDirectory } : {},
-			sourcePath: fileURLToPath(import.meta.resolve("@rivus/agent/skills/runtime-management/SKILL.md"))
-		});
-		const launcher = await installRivusModelManagementCliLauncher({
-			writeAtomicTextFile,
-			directory: managementDirectory,
-			cliEntryPath: fileURLToPath(new URL("./cli.js", import.meta.resolve("@rivus/agent"))),
-			nodeExecutable: process.execPath
-		});
-		if (!recoveryRequired) await runDeploymentProcessEffect(boundary.resumeAfterChange({ requestId: "startup" }));
-		return {
-			binDirectory: launcher.binDirectory,
-			boundary,
-			close: () => control.close(),
-			enabled: true,
-			recoveryRequired,
-			runtime,
-			socketPath,
-			skillInstallation,
-			createRunContexts: (input) => {
-				const registry = createPiModelRunContextRegistry({
-					...input,
-					modelManagementEnabled: true
-				});
-				const resolver = (reference) => registry.resolveRun(reference);
-				resolvers.add(resolver);
-				return {
-					registry,
-					unregister: () => {
-						resolvers.delete(resolver);
-					}
-				};
-			}
-		};
-	} catch (error) {
-		await control.close();
-		throw error;
-	}
-}
-async function readExportMarker(path) {
-	const raw = await readPersistenceFile(path);
-	if (raw === void 0) return void 0;
-	const value = JSON.parse(raw);
-	if (value.version !== 1 || typeof value.revision !== "number" || !Number.isSafeInteger(value.revision) || value.revision < 0) throw new Error("The model configuration export marker is invalid.");
-	return { revision: value.revision };
-}
-function sameModel(left, right) {
-	return left.provider === right.provider && left.model === right.model;
-}
-//#endregion
-//#region examples/pi-feishu-deployment.bootstrap.ts
-const STATE_DIR = process.env.RIVUS_DEPLOYMENT_STATE_DIR?.trim() || ".rivus/deployment";
-const PI_AGENT_DIR = join(STATE_DIR, "pi-agent");
-const PI_AUTH_FILE = join(STATE_DIR, "pi-auth.json");
-const PI_MODELS_FILE = join(STATE_DIR, "pi-models.json");
-const THINKING_LEVELS = /* @__PURE__ */ new Set([
-	"off",
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh"
-]);
-async function createRivusDeploymentAdapters(context) {
-	await mkdir(PI_AGENT_DIR, { recursive: true });
-	const hasManagedState = await stat(join(STATE_DIR, "model-management", "model-state.json")).then(() => true, (error) => {
-		if (error.code === "ENOENT") return false;
-		throw error;
-	});
-	const piOptions = await createPiSessionOptions(context, context.env.RIVUS_MODEL_MANAGEMENT_ENABLED?.trim() === "true" || hasManagedState);
-	const telemetryConfig = resolveLangfuseTelemetryConfig(context.env);
-	let telemetry;
-	const memory = await openJsonlAgentMemoryService({ filePath: join(STATE_DIR, "memory", "agent-memory.jsonl") });
-	const memoryTenantId = context.env.RIVUS_MEMORY_TENANT_ID?.trim() || "local";
-	const request = createJsonFetchRequest();
-	const createOpenApiClient = (config) => createConfiguredFeishuOpenApiClient({
-		config,
-		request: (input) => request(input).pipe(Effect.map((response) => response))
-	});
-	const interactionRegistry = createHumanInteractionEndpointRegistry();
-	const manifest = await loadRivusDeploymentManifest(context.manifestPath);
-	const defaultEndpoint = manifest.endpoints.find((endpoint) => endpoint.id === manifest.defaultEndpointId);
-	const management = await openPiModelManagementDeployment({
-		agentId: manifest.defaultAgentId,
-		approval: createHumanInteractionModelChangeApproval({
-			endpointId: manifest.defaultEndpointId,
-			registry: interactionRegistry
-		}),
-		agentCount: manifest.agents.length,
-		endpointId: manifest.defaultEndpointId,
-		env: context.env,
-		environmentOverrides: context.environmentOverrides ?? process.env,
-		...context.envFilePath ? { envFilePath: context.envFilePath } : {},
-		modelAuthPath: PI_AUTH_FILE,
-		modelCatalogPath: PI_MODELS_FILE,
-		modelRuntime: piOptions.modelRuntime,
-		reply: (messageId, text) => {
-			const config = createEndpointConfig(defaultEndpoint, manifest.defaultAgentId, context.env);
-			return createConfiguredFeishuTextReplySender({
-				config,
-				client: createOpenApiClient(config)
-			}).reply(messageId, text);
-		},
-		stateDirectory: STATE_DIR,
-		thinkingLevel: piOptions.thinkingLevel ?? "medium"
-	});
-	try {
-		telemetry = telemetryConfig ? createLangfuseAgentTelemetry(telemetryConfig) : void 0;
-		if (management && !management.enabled) piOptions.model = await ensurePiModel({
-			modelRuntime: piOptions.modelRuntime,
-			modelsPath: PI_MODELS_FILE,
-			target: management.model
-		});
-		if (management?.enabled && management.recoveryRequired) console.error("Model management requires recovery; business Runs are paused. Query rivus model status --json.");
-		if (management?.enabled && management.skillInstallation.status === "conflict") console.error("The runtime-management Skill has local edits; its installed instructions were preserved.");
-		const backgroundSessionsConfig = manifest.backgroundSessions;
-		const sessionRepository = backgroundSessionsConfig?.enabled ? await openJsonlBackgroundSessionRepository({ filePath: join(STATE_DIR, "background-sessions", "sessions.jsonl") }) : void 0;
-		const sessionDeliveries = backgroundSessionsConfig?.enabled ? await openJsonlBackgroundSessionDeliveryStore({ filePath: join(STATE_DIR, "background-sessions", "deliveries.jsonl") }) : void 0;
-		const deliveryClients = /* @__PURE__ */ new Map();
-		const backgroundService = backgroundSessionsConfig?.enabled ? createBackgroundSessionService({
-			clock: { now: () => (/* @__PURE__ */ new Date()).toISOString() },
-			deliveries: sessionDeliveries,
-			repository: sessionRepository
-		}) : void 0;
-		const createBackgroundSessionAdapter = (input) => {
-			const resolveDeliverySender = async (endpointId) => {
-				const existing = deliveryClients.get(endpointId);
-				if (existing) return existing;
-				const endpoint = manifest.endpoints.find(({ id }) => id === endpointId);
-				if (!endpoint) throw new Error(`background session delivery endpoint not found: ${endpointId}`);
-				const config = createEndpointConfig(endpoint, endpoint.agentId, context.env);
-				const sender = createConfiguredFeishuBackgroundSessionDelivery({
-					client: createOpenApiClient(config),
-					config
-				});
-				deliveryClients.set(endpointId, sender);
-				return sender;
-			};
-			const supervisor = createBackgroundSessionSupervisor({
-				clock: { now: () => (/* @__PURE__ */ new Date()).toISOString() },
-				config: {
-					intervalMs: resolveBackgroundSessionSupervisorIntervalMs(input.config.leaseMs),
-					leaseMs: input.config.leaseMs,
-					leaseRenewalIntervalMs: input.config.leaseRenewalIntervalMs,
-					maxConcurrentSessions: input.config.maxConcurrentSessions,
-					maxConsecutiveFailures: input.config.maxConsecutiveFailures,
-					retryBackoffMs: input.config.retryBackoffMs,
-					sessionLifetimeMs: input.config.sessionLifetimeMs
-				},
-				deliveries: sessionDeliveries,
-				deliver: async (delivery) => {
-					const session = await sessionRepository.get(delivery.sessionId);
-					if (!session) throw new Error(`background session not found for delivery: ${delivery.sessionId}`);
-					if (!session.origin.conversationId) throw new Error(`background session has no delivery conversation: ${delivery.sessionId}`);
-					return (await resolveDeliverySender(session.origin.endpointId)).deliver({
-						chatId: resolveFeishuDeliveryChatId(session.origin.conversationId),
-						deliveryId: delivery.deliveryId,
-						displayName: session.displayName,
-						kind: delivery.kind,
-						sessionId: session.sessionId,
-						text: delivery.text
-					});
-				},
-				onError: (error) => {
-					console.error("Background session supervisor failed", error);
-				},
-				repository: sessionRepository,
-				runStep: async ({ session, signal, wakeText }) => {
-					let runId;
-					const invocation = {
-						allowedActorOpenIds: session.origin.allowedActorOpenIds,
-						...session.origin.conversationId ? { conversationId: session.origin.conversationId } : {},
-						endpointId: session.origin.endpointId,
-						kind: "background-session",
-						...session.origin.memory ? { memory: session.origin.memory } : {},
-						sessionId: session.sessionId,
-						sourceMessageId: createBackgroundSessionStepSourceMessageId(session.sessionId, session.stepCount + 1),
-						tenantKey: session.origin.tenantKey
-					};
-					const abortPromise = new Promise((_resolve, reject) => {
-						signal.addEventListener("abort", () => {
-							if (runId) input.cancel({
-								agentId: session.authority.agentId,
-								reason: "background session step aborted",
-								runId,
-								sessionKey: session.authority.sessionKey
-							});
-							reject(/* @__PURE__ */ new Error("background session step aborted"));
-						}, { once: true });
-					});
-					const runPromise = input.run({
-						agentId: session.authority.agentId,
-						invocation,
-						onUpdate: (update) => {
-							if (update.event.type === "agent_run_accepted" && !runId) runId = update.event.runId;
-						},
-						sessionKey: session.authority.sessionKey,
-						text: wakeText
-					}).then((result) => readStepRunResult(result));
-					return Promise.race([runPromise, abortPromise]);
-				},
-				sleep
-			});
-			let running = false;
-			return {
-				running: () => running,
-				status: () => supervisor.status(),
-				start: async () => {
-					await Effect.runPromise(supervisor.recover());
-					await Effect.runPromise(supervisor.start());
-					running = true;
-				},
-				stop: async () => {
-					await Effect.runPromise(supervisor.stop());
-					running = false;
-				}
-			};
-		};
-		return {
-			dispose: async () => {
-				if (management?.enabled) await management.close();
-				await telemetry?.shutdown();
-			},
-			createRecoveryControl: () => openJsonlRecoveryControl({
-				endpointsDirectory: join(STATE_DIR, "endpoints"),
-				instancesDirectory: join(STATE_DIR, "instances")
-			}),
-			createBackgroundSession: backgroundSessionsConfig?.enabled ? (input) => createBackgroundSessionAdapter(input) : void 0,
-			createAutomation: async (input) => {
-				const config = createEndpointConfig(input.deliveryEndpoint, input.definition.agentId, context.env);
-				const sender = createConfiguredFeishuAutomationCardSender({
-					client: createOpenApiClient(config),
-					config
-				});
-				const repository = await openJsonAutomationTickRepository({ filePath: join(STATE_DIR, "automations", createHash("sha256").update(input.automationId).digest("hex").slice(0, 16), "ticks.json") });
-				const target = resolveAutomationTarget(input.definition.delivery.targetRef, context.env);
-				return createScheduledAutomation({
-					automationId: input.automationId,
-					binding: {
-						agentId: input.definition.agentId,
-						bindingId: input.automationId,
-						delivery: {
-							endpointId: input.definition.delivery.endpointId,
-							targetKey: createHash("sha256").update(target).digest("hex"),
-							targetType: input.definition.delivery.targetType
-						},
-						schedule: input.definition.schedule,
-						servicePrincipalId: `automation:${input.automationId}`,
-						skillGrantRevision: input.definition.runtimeDefinition.skillGrantSet.revision,
-						skillIds: input.definition.template.requestedSkillIds,
-						templateId: input.definition.templateId,
-						timeZone: input.definition.timeZone,
-						toolIds: input.definition.template.requestedToolIds
-					},
-					createInput: input.definition.template.createInput,
-					deliver: ({ body, idempotencyKey, presentation }) => Effect.runPromise(sender.send({
-						idempotencyKey,
-						receiveId: target,
-						receiveIdType: input.definition.delivery.targetType,
-						markdown: body,
-						...presentation === void 0 ? {} : { presentation }
-					})),
-					onError: () => {
-						console.error(`Scheduled Automation ${input.automationId} failed; it will retry`);
-					},
-					repository,
-					run: async (runInput) => {
-						const result = readAutomationRunResult(await input.run(runInput));
-						const projected = result.body === void 0 ? void 0 : input.definition.template.createPresentation?.({
-							occurrence: runInput.occurrence,
-							text: result.body
-						});
-						const presentation = projected ? readAutomationPresentation(projected) : void 0;
-						return {
-							...result,
-							...presentation === void 0 ? {} : { presentation }
-						};
-					}
-				});
-			},
-			createEndpoint: async (input) => {
-				const credentials = resolveFeishuEndpointCredentials(input.definition.credentialRef, context.env);
-				const botOpenId = await resolveFeishuBotOpenId(credentials, input.definition.baseUrl);
-				const endpointState = join(STATE_DIR, "endpoints", input.endpointId);
-				const cardTargets = createJsonFileFeishuCardTargetRegistry({ filePath: join(endpointState, "feishu-card-targets.json") });
-				const cardLedger = await openJsonlFeishuCardDeliveryLedger({ filePath: join(endpointState, "feishu-card-delivery.jsonl") });
-				const inbox = await openJsonlFeishuInboxRepository({ filePath: join(endpointState, "feishu-inbox.jsonl") });
-				const sessionStore = await openJsonFeishuSessionStore({ filePath: join(endpointState, "feishu-session-store.json") });
-				const config = createEndpointConfig(input.definition, input.agentId, context.env);
-				const openApiClient = createOpenApiClient(config);
-				const promptContext = createFeishuTopicContextResolver({
-					baseUrl: input.definition.baseUrl,
-					client: openApiClient
-				});
-				const cotPublisher = input.definition.experimental?.cotMessages ? createFeishuCotPublisher({
-					baseUrl: resolveExperimentalCotBaseUrl(context.env),
-					client: openApiClient,
-					minIntervalMs: input.definition.streamMinIntervalMs
-				}) : void 0;
-				const interactions = createHumanInteractionService({
-					clock: { now: () => (/* @__PURE__ */ new Date()).toISOString() },
-					presenter: createConfiguredFeishuHumanInteractionPresenter({
-						client: openApiClient,
-						config
-					}),
-					repository: createJsonlHumanInteractionRepository({ filePath: join(endpointState, "human-interactions.jsonl") })
-				});
-				const cardRollover = createConfiguredFeishuCardRolloverRuntime({
-					agentName: input.agentId,
-					cardTargets,
-					client: openApiClient,
-					clock: createSystemClock(),
-					config,
-					ledger: cardLedger,
-					onError: (error) => {
-						console.error(`Feishu card rollover failed for endpoint ${input.endpointId}`, error);
-					},
-					...input.definition.progressDisplay === void 0 ? {} : { progressDisplay: input.definition.progressDisplay },
-					sleep,
-					title: input.agentId
-				});
-				const publisher = cardRollover.rollover;
-				const endpointEvents = createJsonlAgentEventLog({ filePath: join(STATE_DIR, "instances", input.instanceId, "agent-events.jsonl") });
-				const endpointInitialEvents = await Effect.runPromise(endpointEvents.readAll());
-				await Effect.runPromise(createFeishuCardDeliveryReconciler({
-					events: endpointInitialEvents,
-					ledger: cardLedger,
-					publish: (action) => publisher.publish(action)
-				}).reconcile());
-				const replies = createConfiguredFeishuTextReplySender({
-					client: openApiClient,
-					config
-				});
-				const prepareCardTarget = (run) => cardRollover.prepareRun(run);
-				const endpoint = createFeishuDeploymentEndpoint({
-					agentId: input.agentId,
-					botOpenId,
-					cardRollover: cardRollover.transport,
-					finalizeRun: (runId) => cardRollover.rollover.releaseRun(runId),
-					cancel: input.cancel,
-					endpointId: input.endpointId,
-					eventDispatcher: createLazyFeishuWebSocketEventDispatcher(() => new Lark.EventDispatcher({})),
-					groupPolicy: input.definition.groupPolicy,
-					handle: input.handle,
-					inboxRepository: inbox,
-					initialEvents: endpointInitialEvents,
-					interactions,
-					maxPendingMessages: 100,
-					memoryTenantId,
-					...input.projectSpaceId ? { projectSpaceId: input.projectSpaceId } : {},
-					onCapacityExceeded: (payload) => replies.reply(payload.event.message.message_id, "Rivus is busy. Please retry in a moment."),
-					prepareRun: createFeishuPresentationPreparation({
-						...cotPublisher ? { cotPublisher } : {},
-						prepareCardTarget,
-						reportCotError: (operation, error) => reportCotError(input.endpointId, operation, error)
-					}),
-					promptContext,
-					publish: (action) => publisher.publish(action),
-					reply: (messageId, text) => replies.reply(messageId, text),
-					sessionStore,
-					...input.steer ? { steer: input.steer } : {},
-					...cotPublisher ? { publishRunUpdate: (update) => cotPublisher.publish(update).pipe(Effect.catchAll((error) => reportCotError(input.endpointId, "update", error))) } : {},
-					sessionNamespace: input.definition.sessionNamespace,
-					sleep,
-					websocketClient: createLazyFeishuWebSocketClient(credentials, input.definition.baseUrl),
-					workerConcurrency: 4
-				});
-				interactionRegistry.register(input.endpointId, interactions);
-				return endpoint;
-			},
-			createRuntime: async (input) => {
-				const instanceState = join(STATE_DIR, "instances", input.instanceId);
-				await mkdir(instanceState, { recursive: true });
-				const eventLog = createJsonlAgentEventLog({ filePath: join(instanceState, "agent-events.jsonl") });
-				const initialEvents = await Effect.runPromise(eventLog.readAll());
-				const broker = createToolBroker$1({
-					approvals: createRoutedHumanInteractionToolApprovalService(interactionRegistry),
-					catalog: input.catalog,
-					hostTools: [...input.definition.memory.tool ? [createRivusMemoryToolDescriptor({ memory })] : [], ...backgroundService ? [...createBackgroundSessionHostTools({
-						createSessionId: () => `bg-${randomUUID()}`,
-						definition: input.definition,
-						service: backgroundService
-					})] : []],
-					operations: await openJsonlToolOperationLedger$1({ filePath: join(instanceState, "tool-operations.jsonl") }),
-					policy: { current: async () => ({
-						epoch: 1,
-						revokedToolIds: []
-					}) }
-				});
-				const resolveToolName = createPiToolNameResolver(input.definition.tools);
-				const skillRuntime = createPiSkillRuntime(input.definition.skills);
-				const workingDirectory = input.projectSpace?.workingDirectory ?? process.cwd();
-				const runContexts = management?.enabled ? management.createRunContexts({
-					agentId: input.agentId,
-					instanceId: input.instanceId,
-					toolGrantSet: input.definition.toolGrantSet
-				}) : void 0;
-				const workspaceRoot = input.projectSpace?.root ?? process.cwd();
-				const workspaceInstructions = await createAgentsMdInstructionsProvider().resolve({
-					maxBytes: 64 * 1024,
-					workingDirectory: relative(workspaceRoot, workingDirectory) || ".",
-					workspaceRoot: await createWorkspaceRootHandle(workspaceRoot)
-				});
-				const prepareProjectMemory = input.projectSpace && input.definition.memory.scopes.includes("project") ? createProjectMemoryPromptPreparer({
-					agentId: input.agentId,
-					memory,
-					projectId: input.projectSpace.id
-				}) : void 0;
-				const sessionRegistry = createPiSessionRegistry({ createSession: async (firstInput) => {
-					let activeInput = firstInput;
-					const resources = await createPiSessionResources({
-						agentDir: PI_AGENT_DIR,
-						appendSystemPromptOverride: () => [workspaceInstructions.content, skillRuntime.prompt].filter((content) => content.length > 0),
-						cwd: workingDirectory,
-						homeDirectory: homedir(),
-						...input.projectSpace ? { projectSkillPaths: input.projectSpace.skillPaths } : {},
-						systemPromptOverride: () => input.definition.systemPrompt
-					});
-					const managedContext = management?.enabled && runContexts && input.definition.runtimeToolGrantSet.toolIds.includes("bash") ? createPiManagedSessionContext({
-						...resources.bashToolOptions ? { bashToolOptions: resources.bashToolOptions } : {},
-						binDirectory: management.binDirectory,
-						contexts: runContexts.registry,
-						cwd: workingDirectory,
-						nodeExecutable: process.execPath,
-						socketPath: management.socketPath
-					}) : void 0;
-					const bashTool = input.definition.runtimeToolGrantSet.toolIds.includes("bash") ? managedContext?.tool ?? createPiBashTool(workingDirectory, resources.bashToolOptions) : void 0;
-					const customTools = [
-						...bashTool ? [bashTool] : [],
-						...createPiSkillReadTools({
-							cwd: workingDirectory,
-							runtimeToolIds: input.definition.runtimeToolGrantSet.toolIds,
-							skillPaths: resources.skillNames.size > 0 ? resources.skillPaths : []
-						}),
-						...createPiToolProxyDefinitions({
-							agentId: input.agentId,
-							approvals: createHumanInteractionToolApprovalGateway({ registry: interactionRegistry }),
-							broker,
-							getActiveInput: () => activeInput,
-							instanceId: input.instanceId,
-							memoryScopes: input.definition.memory.scopes,
-							toolGrantSet: input.definition.toolGrantSet,
-							tools: input.definition.tools
-						}),
-						...skillRuntime.tool ? [skillRuntime.tool] : []
-					];
-					const activeToolNames = resolvePiSessionToolNames(bashTool ? input.definition.runtimeToolGrantSet.toolIds.filter((toolId) => toolId !== "bash") : input.definition.runtimeToolGrantSet.toolIds, customTools);
-					const result = await createAgentSession(resources.withSessionOptions({
-						...piOptions,
-						...management?.enabled ? management.runtime.getSessionOptions() : {},
-						customTools,
-						excludeTools: [],
-						sessionManager: SessionManager.create(workingDirectory, join(instanceState, "sessions")),
-						tools: [...activeToolNames]
-					}));
-					return {
-						activate: (loopInput) => {
-							activeInput = loopInput;
-							managedContext?.activate(loopInput);
-						},
-						deactivate: () => managedContext?.deactivate(),
-						dispose: () => result.session.dispose(),
-						preparePrompt: async (loopInput) => {
-							validatePiSkillCommand(loopInput.text, resources.skillNames);
-							return prepareProjectMemory ? prepareProjectMemory(loopInput) : loopInput.text;
-						},
-						resolveToolName,
-						refreshResources: () => resources.refresh(),
-						session: result.session
-					};
-				} });
-				const unregisterModels = management?.enabled ? management.runtime.registerSessionRegistry(sessionRegistry) : void 0;
-				const loop = createPiAgentLoop({
-					supportsSteering: true,
-					disposeSessionAfterRun: false,
-					...management?.enabled ? { runBoundary: management.boundary } : {},
-					...telemetry ? { modelContentObserver: telemetry.modelContentObserver } : {},
-					resolveSession: (loopInput) => sessionRegistry.resolve(loopInput)
-				});
-				const scheduler = createSessionScheduler({
-					createRuntime: (sessionKey) => createAgentHarnessPooledRuntime(createAgentHarness({
-						clock: createSystemClock(),
-						eventSinks: telemetry ? [eventLog, telemetry.sink] : [eventLog],
-						initialEvents: eventsForSession(initialEvents, sessionKey),
-						loop,
-						runIds: createUuidRunIds(),
-						...input.binding.kind === "background-session" && backgroundSessionsConfig ? { runTimeoutMs: backgroundSessionsConfig.stepTimeoutMs } : {}
-					})),
-					maxConcurrentSessions: input.binding.kind === "background-session" ? backgroundSessionsConfig?.maxConcurrentSessions ?? 4 : 4,
-					maxQueuedRuns: 32
-				});
-				return {
-					...scheduler,
-					dispose: async () => {
-						await scheduler.dispose?.();
-						await sessionRegistry.disposeAll();
-						unregisterModels?.();
-						runContexts?.unregister();
-					}
-				};
-			}
-		};
-	} catch (error) {
-		await Promise.allSettled([management?.enabled ? management.close() : Promise.resolve(), telemetry?.shutdown()]);
-		throw error;
-	}
-}
-function eventsForSession(events, sessionKey) {
-	const runIds = new Set(events.filter((event) => event.sessionKey === sessionKey).map((event) => event.runId));
-	return events.filter((event) => runIds.has(event.runId));
-}
-function resolveAutomationTarget(targetRef, env) {
-	if (!targetRef.startsWith("env:")) throw new Error("Automation delivery targetRef must use env:<VARIABLE>");
-	const variable = targetRef.slice(4);
-	if (!/^[A-Z][A-Z0-9_]*$/.test(variable)) throw new Error(`Invalid Automation delivery targetRef: ${targetRef}`);
-	const target = env[variable]?.trim();
-	if (!target) throw new Error(`${variable} is required`);
-	return target;
-}
-function resolveExperimentalCotBaseUrl(env) {
-	const baseUrl = env.RIVUS_FEISHU_COT_BASE_URL?.trim();
-	if (!baseUrl) throw new Error("RIVUS_FEISHU_COT_BASE_URL is required when experimental.cotMessages is enabled");
-	return baseUrl;
-}
-function reportCotError(endpointId, operation, error) {
-	return Effect.sync(() => {
-		const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
-		console.error(`Experimental Feishu COT ${operation} failed for endpoint ${endpointId}: ${detail}`);
-	});
-}
-function readAutomationRunResult(result) {
-	const { finalText, runId } = readStepRunResult(result);
-	const trimmedText = finalText.trim();
-	if (trimmedText.startsWith("RIVUS_AUTOMATION_SUPPRESSED:")) {
-		const reason = trimmedText.slice(AUTOMATION_SUPPRESSION_PREFIX.length).trim();
-		if (!reason) throw new Error("Scheduled Automation suppression requires a reason");
-		return {
-			runId,
-			suppressedReason: reason
-		};
-	}
-	if (!trimmedText) throw new Error("Scheduled Automation Agent Run did not produce final text");
-	return {
-		body: finalText,
-		runId
-	};
-}
-function readStepRunResult(result) {
-	if (result !== null && typeof result === "object" && "finalText" in result && typeof result.finalText === "string" && "runId" in result && typeof result.runId === "string" && result.runId.trim() !== "") return {
-		finalText: result.finalText,
-		runId: result.runId
-	};
-	throw new Error("Background session Agent Run did not produce a runId and final text");
-}
-function createLazyFeishuWebSocketClient(credentials, domain) {
-	let client;
-	let connected = false;
-	return {
-		connected: () => connected,
-		close: () => {
-			client?.close();
-			client = void 0;
-			connected = false;
-		},
-		start: (options) => new Promise((resolve, reject) => {
-			let settled = false;
-			const settle = (callback) => {
-				if (settled) return;
-				settled = true;
-				clearTimeout(timeout);
-				callback();
-			};
-			const timeout = setTimeout(() => settle(() => reject(/* @__PURE__ */ new Error("Feishu WebSocket handshake timed out after 15000ms"))), 15e3);
-			client ??= new Lark.WSClient({
-				...credentials,
-				domain,
-				handshakeTimeoutMs: 1e4,
-				onError: (error) => {
-					connected = false;
-					settle(() => reject(error));
-				},
-				onReady: () => {
-					connected = true;
-					settle(resolve);
-				},
-				onReconnected: () => {
-					connected = true;
-				},
-				onReconnecting: () => {
-					connected = false;
-				}
-			});
-			client.start(options).catch((error) => {
-				connected = false;
-				settle(() => reject(error));
-			});
-		})
-	};
-}
-async function resolveFeishuBotOpenId(credentials, domain) {
-	const response = await new Lark.Client({
-		...credentials,
-		domain
-	}).request({
-		method: "GET",
-		url: "/open-apis/bot/v3/info"
-	});
-	const openId = response.bot?.open_id;
-	if (response.code !== 0 || !openId) throw new Error(`Feishu bot identity lookup failed: ${response.msg ?? "response missing bot.open_id"}`);
-	return openId;
-}
-async function createPiSessionOptions(context, deferModel = false) {
-	const modelReference = optional(context.env.PI_MODEL);
-	const configuredModel = modelReference ? parseModelReference(modelReference) : void 0;
-	const provider = configuredModel?.provider;
-	const apiKey = await resolvePiApiKey(context.env);
-	const baseUrl = optional(context.env.PI_BASE_URL);
-	if ((apiKey || baseUrl) && !provider) throw new Error("PI_API_KEY and PI_BASE_URL require PI_MODEL in provider/model form");
-	if (baseUrl && !deferModel) await writeProviderBaseUrlOverride(provider, baseUrl);
-	const modelRuntime = await ModelRuntime.create({
-		allowModelNetwork: false,
-		authPath: PI_AUTH_FILE,
-		modelsPath: baseUrl || deferModel ? PI_MODELS_FILE : null
-	});
-	if (apiKey) await modelRuntime.setRuntimeApiKey(provider, apiKey);
-	const model = configuredModel && !deferModel ? modelRuntime.getModel(configuredModel.provider, configuredModel.modelId) : void 0;
-	if (modelReference && !model && !deferModel) throw new Error(`PI_MODEL ${modelReference} was not found in the Pi model runtime`);
-	const settings = deferModel ? SettingsManager.create(process.cwd(), PI_AGENT_DIR, { projectTrusted: false }) : void 0;
-	const thinkingLevel = readThinkingLevel(context.env.PI_THINKING_LEVEL) ?? (configuredModel ? settings?.getModelThinkingLevel(configuredModel.provider, configuredModel.modelId) : void 0) ?? settings?.getDefaultThinkingLevel();
-	return {
-		cwd: process.cwd(),
-		modelRuntime,
-		...model ? { model } : {},
-		...thinkingLevel ? { thinkingLevel } : {}
-	};
-}
-function createEndpointConfig(definition, agentId, env) {
-	return {
-		agentId,
-		feishu: {
-			...resolveFeishuEndpointCredentials(definition.credentialRef, env),
-			baseUrl: definition.baseUrl,
-			cardStreamLeaseMs: definition.cardStreamLeaseMs,
-			streamMinIntervalMs: definition.streamMinIntervalMs
-		},
-		pi: {}
-	};
-}
-async function resolvePiApiKey(env) {
-	const inline = optional(env.PI_API_KEY);
-	const filePath = optional(env.PI_API_KEY_FILE);
-	if (inline && filePath) throw new Error("PI_API_KEY and PI_API_KEY_FILE cannot both be set");
-	if (inline) return inline;
-	if (!filePath) return void 0;
-	const contents = optional(await readFile(filePath, "utf8"));
-	if (!contents) throw new Error("PI_API_KEY_FILE must not be empty");
-	return contents;
-}
-function optional(value) {
-	return value?.trim() || void 0;
-}
-function parseModelReference(reference) {
-	const separator = reference.indexOf("/");
-	if (separator <= 0 || separator === reference.length - 1) throw new Error("PI_MODEL must use provider/model form, for example zai/glm-5.2");
-	return {
-		modelId: reference.slice(separator + 1),
-		provider: reference.slice(0, separator)
-	};
-}
-function readThinkingLevel(value) {
-	const level = optional(value);
-	if (!level) return void 0;
-	if (!THINKING_LEVELS.has(level)) throw new Error("PI_THINKING_LEVEL must be one of off, minimal, low, medium, high, xhigh");
-	return level;
-}
-function sleep(ms) {
-	return Effect.promise(() => new Promise((resolve) => setTimeout(resolve, ms)));
-}
-async function writeProviderBaseUrlOverride(provider, baseUrl) {
-	await mergePiProviderBaseUrlOverride({
-		baseUrl,
-		filePath: PI_MODELS_FILE,
-		provider
-	});
-}
-//#endregion
+import { createRivusDeploymentAdapters } from "@rivus/gateway/bootstrap/pi-feishu";
 export { createRivusDeploymentAdapters };