@superjackfruitlabs/salaam 0.0.1 → 0.0.2

package/dist/src/managed.js

@@ -122,7 +122,11 @@ export class ManagedWork {
         const connector = this.options.connector;
         if (kind === 'effect' && !connector)
             throw new ServiceError('effect_disabled', 'No external effect connector is configured');
-        const version = kind === 'review' ? 'read-only' : await connector.version(target, AbortSignal.timeout(2500));
+        const version = kind === 'harness'
+            ? 'owned-once-only'
+            : kind === 'review'
+                ? 'read-only'
+                : await connector.version(target, AbortSignal.timeout(2500));
         return this.store.transaction(() => {
             this.options.assertActive(session, epoch, attempt);
             const existing = this.store.db
@@ -152,8 +156,12 @@ export class ManagedWork {
                 value,
                 target_version: version,
                 policy_digest: POLICY_DIGEST,
-                connector: kind === 'review' ? 'local-review-v1' : connector.id,
-                replay: kind === 'review' ? 'read-only' : connector.replay,
+                connector: kind === 'harness'
+                    ? 'external-harness-once-v1'
+                    : kind === 'review'
+                        ? 'local-review-v1'
+                        : connector.id,
+                replay: kind === 'harness' ? 'opaque' : kind === 'review' ? 'read-only' : connector.replay,
                 revision: 1,
                 state: 'prepared',
                 receipt: null,
@@ -299,6 +307,8 @@ export class ManagedWork {
     }
     start(id, session, epoch, attempt) {
         const op = this.operation(id);
+        if (op.kind === 'harness')
+            throw new ServiceError('operation_scope', 'A harness permission can only be consumed by its owned runtime');
         if (op.session_id !== session || op.worker_epoch !== epoch || op.attempt_id !== attempt)
             throw new ServiceError('operation_scope', 'Operation belongs to another invocation', 403);
         if (op.state !== 'prepared' || this.active.has(id))
@@ -322,6 +332,26 @@ export class ManagedWork {
             argument_digest: op.argument_digest,
         };
     }
+    /** Commit a one-time grant handoff before replying to the owned runtime. This is not a tool receipt. */
+    takePermission(id) {
+        return this.store.transaction(() => {
+            const op = this.operation(id);
+            if (op.kind !== 'harness' || op.state !== 'prepared')
+                return false;
+            this.fresh(op);
+            const approval = this.forOperation(id);
+            if (approval.state !== 'decided' || approval.decision !== 'approve')
+                return false;
+            this.transition(op, 'dispatching');
+            return true;
+        });
+    }
+    permissionResult(id, success, receipt) {
+        const op = this.operation(id);
+        if (op.kind !== 'harness' || op.state !== 'dispatching')
+            return;
+        this.store.transaction(() => this.transition(op, success ? 'succeeded' : 'outcome_unknown', success ? null : 'Harness tool failed after permission delivery; inspect actual effects', JSON.stringify(receipt), 'owned-harness-tool-return'));
+    }
     async dispatch(id, signal) {
         try {
             let op = this.operation(id);

package/dist/src/protocol.js

@@ -8,6 +8,7 @@ export const CAPABILITIES = [
     'durable-approvals',
     'operation-ledger',
     'child-work',
+    'worker-boundary-v1',
     'usage-ledger',
     'durable-task-context',
     'managed-compaction',
@@ -20,20 +21,23 @@ export const TOOLS = [
     'consume_child_result',
     'salaam_history',
 ];
-export function workerCapabilities(coding) {
+export function workerCapabilities(coding, childTools) {
     return [
         ...CAPABILITIES,
-        ...(coding ? ['workspace-files'] : []),
+        ...(coding?.files ? ['workspace-files'] : []),
         ...(coding?.commands ? ['command-execution'] : []),
+        ...(childTools?.includes('salaam_repository') ? ['repository-snapshot-read'] : []),
+        ...(childTools?.includes('salaam_findings') ? ['structured-findings'] : []),
+        ...(childTools?.includes('salaam_team') ? ['durable-team-messages'] : []),
     ];
 }
-export function workerTools(effects, child = false, coding) {
+export function workerTools(effects, child = false, coding, childTools) {
     return child
-        ? ['salaam_probe']
+        ? [...(childTools ?? ['salaam_probe'])].sort()
         : [
             ...TOOLS,
             ...(effects ? ['salaam_effect'] : []),
-            ...(coding ? ['salaam_files'] : []),
+            ...(coding?.files ? ['salaam_files'] : []),
             ...(coding?.commands ? ['salaam_command'] : []),
         ].sort();
 }

package/dist/src/provider-auth.js

@@ -0,0 +1,300 @@
+import { builtinModels } from '@earendil-works/pi-ai/providers/all';
+import { defaultProviderAuthContext, } from '@earendil-works/pi-ai';
+import { loadSharedConfigFiles } from '@smithy/core/config';
+import { DatabaseSync } from 'node:sqlite';
+import { existsSync, lstatSync, mkdirSync, chmodSync, openSync, closeSync, constants, fstatSync, readFileSync, writeFileSync, fsyncSync, renameSync, unlinkSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { credentialPath, loadApiKey, validateApiKey } from './credentials.js';
+import { getProvider, getProviderModel } from './provider-config.js';
+export const authDirectory = () => join(homedir(), '.config', 'salaam', 'credentials');
+function providerId(id) {
+    if (!getProvider(id) || !/^[a-z0-9-]+$/.test(id))
+        throw new Error('Unknown Pi provider');
+    return id;
+}
+function secureDirectory(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(dir);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.())
+        throw new Error('Unsafe credential directory');
+    chmodSync(dir, 0o700);
+}
+function privateRead(path) {
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw new Error('Unsafe provider credential file');
+    }
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.mode & 0o077 || stat.size > 65536)
+            throw new Error('Provider credential file must be private (mode 600)');
+        return readFileSync(fd, 'utf8');
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Serialize OAuth refresh across daemon and CLI processes; OS locks release on death. */
+export class ProviderCredentialStore {
+    dir;
+    constructor(dir = authDirectory()) {
+        this.dir = dir;
+    }
+    path(id) {
+        return join(this.dir, providerId(id) + '.json');
+    }
+    async read(id, options) {
+        options?.signal?.throwIfAborted();
+        const raw = privateRead(this.path(id));
+        if (raw !== undefined) {
+            const value = JSON.parse(raw);
+            if (!['api_key', 'oauth'].includes(value.type))
+                throw new Error('Invalid stored provider credential');
+            return value;
+        }
+        // Preserve existing Salaam installs without reading Pi's credential home.
+        if (id === 'anthropic' && this.dir === authDirectory() && existsSync(credentialPath()))
+            return { type: 'api_key', key: loadApiKey(credentialPath(), '') };
+        return undefined;
+    }
+    async list(options) {
+        const result = [];
+        for (const p of builtinModels().getProviders()) {
+            const value = await this.read(p.id, options);
+            if (value)
+                result.push({ providerId: p.id, type: value.type });
+        }
+        return result;
+    }
+    async locked(id, fn, options) {
+        secureDirectory(this.dir);
+        const path = join(this.dir, providerId(id) + '.lock.sqlite');
+        if (existsSync(path))
+            privateRead(path);
+        const fd = openSync(path, constants.O_RDWR | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+        closeSync(fd);
+        const db = new DatabaseSync(path);
+        const deadline = Date.now() + 120000;
+        try {
+            db.exec('PRAGMA busy_timeout=0');
+            while (true) {
+                options?.signal?.throwIfAborted();
+                try {
+                    db.exec('BEGIN EXCLUSIVE');
+                    break;
+                }
+                catch (error) {
+                    if (!String(error).includes('locked') || Date.now() > deadline)
+                        throw new Error('Provider credential lock unavailable');
+                    await new Promise((resolve) => setTimeout(resolve, 25));
+                }
+            }
+            try {
+                return await fn();
+            }
+            finally {
+                db.exec('ROLLBACK');
+            }
+        }
+        finally {
+            db.close();
+        }
+    }
+    async modify(id, fn, options) {
+        return this.locked(id, async () => {
+            const current = await this.read(id, options), value = await fn(current);
+            options?.signal?.throwIfAborted();
+            if (value !== undefined) {
+                const temp = join(this.dir, '.' + id + '-' + randomUUID()), fd = openSync(temp, 'wx', 0o600);
+                try {
+                    writeFileSync(fd, JSON.stringify(value));
+                    fsyncSync(fd);
+                }
+                finally {
+                    closeSync(fd);
+                }
+                renameSync(temp, this.path(id));
+                const directory = openSync(this.dir, 'r');
+                try {
+                    fsyncSync(directory);
+                }
+                finally {
+                    closeSync(directory);
+                }
+            }
+            return value ?? current;
+        }, options);
+    }
+    async delete(id, options) {
+        await this.locked(id, async () => {
+            for (const path of [
+                this.path(id),
+                ...(id === 'anthropic' && this.dir === authDirectory() ? [credentialPath()] : []),
+            ])
+                try {
+                    unlinkSync(path);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+        }, options);
+    }
+}
+export function providerModels(store = new ProviderCredentialStore()) {
+    return builtinModels({ credentials: store });
+}
+export function providerDeviceId(dir = authDirectory()) {
+    secureDirectory(dir);
+    const path = join(dir, '.device-id');
+    let value = privateRead(path);
+    if (value === undefined) {
+        const id = randomUUID();
+        try {
+            const fd = openSync(path, 'wx', 0o600);
+            try {
+                writeFileSync(fd, id);
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        value = privateRead(path);
+    }
+    if (!value || !/^[a-f0-9-]{36}$/.test(value))
+        throw new Error('Invalid provider device identity');
+    return value;
+}
+export async function loginProvider(id, type, interaction) {
+    providerId(id);
+    try {
+        return await providerModels().login(id, type, interaction, {
+            agentName: 'Salaam',
+            getDeviceId: () => providerDeviceId(),
+        });
+    }
+    catch {
+        throw new Error('Provider login failed or was cancelled; retry salaam auth login ' + id);
+    }
+}
+// These are SDK configuration fields, never a general process environment inheritance.
+const sdkEnvironment = {
+    'amazon-bedrock': [
+        'AWS_REGION',
+        'AWS_DEFAULT_REGION',
+        'AWS_PROFILE',
+        'AWS_ACCESS_KEY_ID',
+        'AWS_SECRET_ACCESS_KEY',
+        'AWS_SESSION_TOKEN',
+        'AWS_BEARER_TOKEN_BEDROCK',
+        'AWS_SHARED_CREDENTIALS_FILE',
+        'AWS_CONFIG_FILE',
+        'AWS_WEB_IDENTITY_TOKEN_FILE',
+        'AWS_ROLE_ARN',
+        'AWS_ROLE_SESSION_NAME',
+        'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
+        'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+        'AWS_CONTAINER_AUTHORIZATION_TOKEN',
+        'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE',
+    ],
+    'google-vertex': [
+        'GOOGLE_CLOUD_PROJECT',
+        'GCLOUD_PROJECT',
+        'GOOGLE_CLOUD_LOCATION',
+        'GOOGLE_APPLICATION_CREDENTIALS',
+        'GOOGLE_CLOUD_API_KEY',
+    ],
+    azure: [
+        'AZURE_OPENAI_BASE_URL',
+        'AZURE_OPENAI_RESOURCE_NAME',
+        'AZURE_OPENAI_API_VERSION',
+        'AZURE_OPENAI_DEPLOYMENT_NAME_MAP',
+    ],
+};
+export async function resolveProviderAuth(route, store, environment = process.env) {
+    if (!store && route.provider === 'anthropic' && environment.ANTHROPIC_API_KEY)
+        return { auth: { apiKey: validateApiKey(environment.ANTHROPIC_API_KEY) }, env: {} };
+    const model = getProviderModel(route);
+    if (!model)
+        throw new Error('Pinned provider model missing');
+    const baseContext = defaultProviderAuthContext();
+    const ambient = {
+        ...baseContext,
+        env: async (name) => environment[name]?.trim() || undefined,
+    };
+    const context = {
+        ...ambient,
+        env: async (name) => (await ambient.env(name)) ?? route.connection?.configuration[name],
+    }, captured = {};
+    const models = builtinModels({
+        credentials: store ?? new ProviderCredentialStore(),
+        authContext: {
+            ...context,
+            async env(name) {
+                const value = await context.env(name);
+                if (value !== undefined)
+                    captured[name] = value;
+                return value;
+            },
+        },
+    });
+    let result;
+    try {
+        result = await models.getAuth(model);
+    }
+    catch {
+        throw new Error('Provider authentication failed; run salaam auth login ' + route.provider);
+    }
+    if (!result)
+        throw new Error('Provider credentials missing. Run: salaam auth login ' + route.provider);
+    for (const name of sdkEnvironment[route.provider] ?? [])
+        if (!(route.provider === 'amazon-bedrock' &&
+            result.auth.apiKey &&
+            ![
+                'AWS_REGION',
+                'AWS_DEFAULT_REGION',
+                'AWS_PROFILE',
+                'AWS_CONFIG_FILE',
+                'AWS_SHARED_CREDENTIALS_FILE',
+            ].includes(name)) &&
+            (await context.env(name)))
+            captured[name] = (await context.env(name));
+    if (route.provider === 'amazon-bedrock') {
+        captured.AWS_MAX_ATTEMPTS = '1';
+        captured.AWS_SHARED_CREDENTIALS_FILE ??= join(homedir(), '.aws', 'credentials');
+        captured.AWS_CONFIG_FILE ??= join(homedir(), '.aws', 'config');
+        const configured = { ...captured, ...result.env };
+        if (!configured.AWS_REGION && !configured.AWS_DEFAULT_REGION) {
+            const files = await loadSharedConfigFiles({
+                filepath: configured.AWS_SHARED_CREDENTIALS_FILE,
+                configFilepath: configured.AWS_CONFIG_FILE,
+            });
+            const profile = configured.AWS_PROFILE ?? 'default';
+            captured.AWS_REGION =
+                files.configFile[profile]?.region ?? files.credentialsFile[profile]?.region ?? 'us-east-1';
+        }
+    }
+    if (route.provider === 'google-vertex' && !result.auth.apiKey)
+        captured.GOOGLE_APPLICATION_CREDENTIALS ??= join(homedir(), '.config/gcloud/application_default_credentials.json');
+    const allowed = new Set([
+        ...Object.keys(captured),
+        ...(sdkEnvironment[route.provider] ?? []),
+        ...(route.provider.startsWith('cloudflare-')
+            ? ['CLOUDFLARE_ACCOUNT_ID', 'CLOUDFLARE_GATEWAY_ID']
+            : []),
+    ]);
+    const env = Object.fromEntries(Object.entries({ ...captured, ...result.env }).filter(([key]) => allowed.has(key)));
+    return { ...result, env };
+}

package/dist/src/provider-config.js

@@ -1,37 +1,77 @@
-import { anthropicProvider } from '@earendil-works/pi-ai/providers/anthropic';
+import { builtinProviders } from '@earendil-works/pi-ai/providers/all';
 import { ServiceError, object, canonical } from './protocol.js';
+// Constructing the pinned catalog is offline; never refresh it implicitly during a turn.
+export const PI_PROVIDERS = builtinProviders();
+export function getProvider(id) {
+    return PI_PROVIDERS.find((provider) => provider.id === id);
+}
+export function getProviderModel(route) {
+    return getProvider(route.provider)
+        ?.getModels()
+        .find((model) => model.id === route.model);
+}
 export function getClaudeModel(id) {
-    return anthropicProvider()
-        .getModels()
-        .find((model) => model.id === id);
+    return getProviderModel({ provider: 'anthropic', model: id });
 }
+export const ROUTING_FIELDS = [
+    'AWS_REGION',
+    'AWS_DEFAULT_REGION',
+    'AWS_PROFILE',
+    'GOOGLE_CLOUD_PROJECT',
+    'GCLOUD_PROJECT',
+    'GOOGLE_CLOUD_LOCATION',
+    'AZURE_OPENAI_API_VERSION',
+    'AZURE_OPENAI_BASE_URL',
+    'AZURE_OPENAI_RESOURCE_NAME',
+    'AZURE_OPENAI_DEPLOYMENT_NAME_MAP',
+    'CLOUDFLARE_ACCOUNT_ID',
+    'CLOUDFLARE_GATEWAY_ID',
+];
 export const OFFLINE_ROUTE = {
     provider: 'salaam-proof',
     model: 'scripted',
     max_tokens: 1024,
 };
 export const DEFAULT_CLAUDE_MODEL = 'claude-sonnet-5-5';
-export function providerRoute(provider = 'offline', model, maxTokens, workspace) {
+export function providerRoute(provider = 'offline', model, maxTokens, workspace, connection) {
     if (provider === 'offline') {
-        if (model || maxTokens || workspace)
-            throw new ServiceError('invalid_provider', 'Offline mode does not take Claude options');
+        if (model || maxTokens !== undefined || workspace)
+            throw new ServiceError('invalid_provider', 'Offline mode does not take provider options');
         return { ...OFFLINE_ROUTE };
     }
-    if (provider !== 'anthropic')
-        throw new ServiceError('invalid_provider', 'Provider must be offline or anthropic');
-    const id = model ?? DEFAULT_CLAUDE_MODEL;
-    if (!['claude-sonnet-5-5', 'claude-sonnet-4-6'].includes(id) || !getClaudeModel(id))
-        throw new ServiceError('invalid_model', 'This route supports pinned claude-sonnet-5-5 or claude-sonnet-4-6');
-    const cap = maxTokens ?? 4096;
-    if (!Number.isSafeInteger(cap) || cap < 128 || cap > 8192)
-        throw new ServiceError('invalid_limit', 'Max output tokens must be 128–8192');
-    if (workspace && !/^[a-zA-Z0-9_-]{1,128}$/.test(workspace))
+    const catalog = getProvider(provider);
+    if (!catalog)
+        throw new ServiceError('invalid_provider', 'Provider must be offline or a pinned Pi provider; run salaam providers list');
+    const id = model ?? (provider === 'anthropic' ? DEFAULT_CLAUDE_MODEL : undefined);
+    if (!id)
+        throw new ServiceError('invalid_model', 'Select --model from salaam models list ' + provider);
+    const entry = getProviderModel({ provider, model: id });
+    if (!entry)
+        throw new ServiceError('invalid_model', 'This route supports pinned Pi chat models; run salaam models list ' + provider);
+    const cap = maxTokens ?? Math.min(4096, entry.maxTokens);
+    if (!Number.isSafeInteger(cap) || cap < 128 || cap > Math.min(8192, entry.maxTokens))
+        throw new ServiceError('invalid_limit', 'Max output tokens must be 128–' + Math.min(8192, entry.maxTokens));
+    if (workspace && (provider !== 'anthropic' || !/^[a-zA-Z0-9_-]{1,128}$/.test(workspace)))
         throw new ServiceError('invalid_workspace', 'Invalid Anthropic workspace ID');
+    if (connection) {
+        if (Object.keys(connection).some((key) => !['endpoint', 'configuration'].includes(key)) ||
+            Object.keys(connection.configuration).some((key) => !ROUTING_FIELDS.includes(key)))
+            throw new ServiceError('invalid_provider', 'Unsupported provider configuration');
+        const url = new URL(connection.endpoint);
+        if (url.protocol !== 'https:' ||
+            url.username ||
+            url.password ||
+            url.hash ||
+            url.search ||
+            Object.values(connection.configuration).some((value) => typeof value !== 'string' || value.length > 4096 || /[^\x20-\x7e]/.test(value)))
+            throw new ServiceError('invalid_provider', 'Invalid provider connection');
+    }
     return {
-        provider: 'anthropic',
+        provider,
         model: id,
         max_tokens: cap,
         ...(workspace ? { workspace_id: workspace } : {}),
+        ...(connection ? { connection } : {}),
     };
 }
 /** Validate the final serialized HTTP payload, after all Pi payload hooks. */
@@ -73,3 +113,11 @@ export function validateClaudePayload(value, route, frame, tools) {
         if (payload[key] !== undefined)
             throw new Error('Unsupported Claude execution feature');
 }
+export function providerHasOutputCap(route, auth) {
+    const model = getProviderModel(route);
+    return (model?.api !== 'openai-codex-responses' &&
+        !(model?.compat &&
+            'supportsMaxOutputTokens' in model.compat &&
+            model.compat.supportsMaxOutputTokens === false) &&
+        !(route.provider === 'openai' && !!auth.auth.apiKey && !auth.auth.apiKey.startsWith('sk-')));
+}

package/dist/src/provider-model.js

@@ -0,0 +1,78 @@
+import { clampMaxTokensToContext } from '@earendil-works/pi-ai/api/simple-options';
+import { canonical } from './protocol.js';
+import { getProviderModel, ROUTING_FIELDS } from './provider-config.js';
+export function materialize(model, auth) {
+    let baseUrl = auth.auth.baseUrl ?? model.baseUrl;
+    for (const [key, value] of Object.entries(auth.env ?? {}))
+        baseUrl = baseUrl.replaceAll('{' + key + '}', value);
+    if (model.provider === 'azure') {
+        const env = auth.env ?? {};
+        baseUrl =
+            env.AZURE_OPENAI_BASE_URL ??
+                (env.AZURE_OPENAI_RESOURCE_NAME
+                    ? `https://${env.AZURE_OPENAI_RESOURCE_NAME}.openai.azure.com/openai/v1`
+                    : baseUrl);
+    }
+    if (model.provider === 'google-vertex') {
+        const location = auth.env?.GOOGLE_CLOUD_LOCATION ?? 'global';
+        if (!/^[a-z0-9-]+$/.test(location))
+            throw new Error('Invalid Google Cloud location');
+        baseUrl =
+            location === 'global'
+                ? 'https://aiplatform.googleapis.com'
+                : `https://${location}-aiplatform.googleapis.com`;
+    }
+    if (model.provider === 'amazon-bedrock') {
+        const region = /^arn:aws[^:]*:bedrock:([^:]+):/.exec(model.id)?.[1] ??
+            auth.env?.AWS_REGION ??
+            auth.env?.AWS_DEFAULT_REGION;
+        if (region) {
+            if (!/^[a-z0-9]+(?:-[a-z0-9]+)+$/.test(region))
+                throw new Error('Invalid AWS region');
+            baseUrl = `https://bedrock-runtime.${region}.amazonaws.com${region.startsWith('cn-') ? '.cn' : ''}`;
+        }
+    }
+    const url = new URL(baseUrl);
+    if (url.protocol !== 'https:' ||
+        url.username ||
+        url.password ||
+        url.hash ||
+        url.search ||
+        /[{}]/.test(baseUrl))
+        throw new Error('Provider endpoint is not configured');
+    return {
+        ...model,
+        baseUrl: baseUrl.replace(/\/$/, ''),
+        headers: model.headers,
+        compat: {
+            ...model.compat,
+            supportsMidConvoSystemMessages: false,
+            supportsMidConvoToolChanges: false,
+            supportsMidConvoEffort: false,
+            supportsAdditionalTools: false,
+            supportsToolSearch: false,
+            supportsOpenAIGrammarTools: false,
+            allowedFallbackModels: [],
+        },
+    };
+}
+/** Non-secret routing configuration becomes part of durable session identity. */
+export function bindProviderConfiguration(route, auth) {
+    const catalog = getProviderModel(route);
+    if (!catalog)
+        throw new Error('Pinned provider model missing');
+    const model = materialize(catalog, auth);
+    const configuration = Object.fromEntries(ROUTING_FIELDS.flatMap((key) => (auth.env?.[key] ? [[key, auth.env[key]]] : [])));
+    const changed = route.provider !== 'anthropic' ||
+        model.baseUrl !== catalog.baseUrl ||
+        Object.keys(configuration).length > 0;
+    const binding = changed ? { endpoint: model.baseUrl, configuration } : undefined;
+    if (route.connection && canonical(route.connection) !== canonical(binding))
+        throw new Error('Provider endpoint or routing configuration changed; use the original configuration or a new session');
+    return binding ? { ...route, connection: binding } : route;
+}
+/** Leave room for the answer instead of emitting Pi's minimum 1,024-token thinking budget under a smaller ceiling. */
+export function generationOptions(model, context, cap) {
+    const maxTokens = clampMaxTokensToContext(model, context, cap);
+    return { maxTokens, reasoning: maxTokens >= 2048 ? 'low' : undefined };
+}