@thebtf/dsh-cliproxyapi-provider 0.4.3 → 0.4.4

package/src/migration.js

@@ -1,132 +1,132 @@
-import { createHash } from 'node:crypto'
-import { ConnectionError, validateEndpoint } from './connection.js'
-import { credentialField } from './secrets.js'
-import { PROTOCOLS, validatePolicy } from './policy.js'
-
-const OWN = 'llm-cliproxyapi'
-const LEGACY = 'llm-pi-ai'
-const PROVIDER = 'CLIProxyAPI'
-const fingerprintOf = (profile) => createHash('sha256').update(JSON.stringify(profile)).digest('hex')
-const PLACEHOLDER = 'Bearer dsh-cliproxyapi-no-key'
-function portableProfile(value) {
-  const profile = structuredClone(value)
-  if (profile.headers) {
-    for (const [key, header] of Object.entries(profile.headers)) {
-      if (key.toLowerCase() === 'x-dsh-provider-cpa-sync' || key.toLowerCase() === 'authorization' && header === PLACEHOLDER) delete profile.headers[key]
-    }
-  }
-  return profile
-}
-function containsSecrets(value) {
-  if (!value || typeof value !== 'object') return false
-  return Object.entries(value).some(([key, item]) => credentialField(key) || containsSecrets(item))
-}
-function rows(settings) {
-  const entries = settings.describe()
-  return { own: entries.find((row) => row.ns === OWN), legacy: entries.find((row) => row.ns === LEGACY) }
-}
-export function legacyView(settings) {
-  const { legacy } = rows(settings)
-  const profile = legacy?.user?.providers?.[PROVIDER]
-  if (!profile) return { available: false }
-  if (legacy.base?.providers?.[PROVIDER]) return { available: false, reason: 'Legacy provider also exists in a base layer' }
-  if (!profile.baseURL) return { available: false, reason: 'Legacy endpoint is missing' }
-  if (containsSecrets(portableProfile(profile))) return { available: false, reason: 'Legacy provider contains a secret field requiring manual migration' }
-  return { available: true, baseURL: profile.baseURL, revision: legacy.revision, fingerprint: fingerprintOf(profile) }
-}
-async function setOwn(settings, values, revision) {
-  await settings.mutate(OWN, Object.entries(values).map(([key, value]) => ({ op: 'set', path: [key], value })), revision)
-}
-export async function prepareLegacy(settings, input) {
-  const { own, legacy } = rows(settings)
-  if (!own || !legacy || own.revision !== input.expectedRevision || legacy.revision !== input.expectedLegacyRevision) throw new ConnectionError('SETTINGS_CONFLICT', 'Settings changed before migration')
-  if (own.value?.baseURL || own.value?.migration) throw new ConnectionError('MIGRATION_CONFLICT', 'Connection already exists')
-  const summary = legacyView(settings)
-  if (!summary.available || summary.fingerprint !== input.fingerprint) throw new ConnectionError('MIGRATION_CONFLICT', summary.reason ?? 'Legacy provider changed')
-  const profile = portableProfile(legacy.user.providers[PROVIDER])
-  validateEndpoint(profile.baseURL)
-  if (profile.api !== undefined && !PROTOCOLS.includes(profile.api)) throw new ConnectionError('MIGRATION_UNSUPPORTED', 'Legacy wire protocol cannot be migrated')
-  const known = new Set(['displayName', 'api', 'baseURL', 'apiKeyEnv', 'models', 'modelOverrides', 'defaultContextWindow', 'defaultMaxTokens', 'defaultInput', 'headers', 'compat', 'retryPolicy', 'reasoning', 'thinkingBudgets', 'streamIdleTimeoutMs', 'maxRequestImageBytes', 'maxRequestImages', 'imageOffloadCountQuantum', 'requestImagePixelBudget', 'requestImageMaxBytes', 'cacheRetention', 'transport', 'timeoutMs', 'websocketConnectTimeoutMs'])
-  if (Object.keys(profile).some((key) => !known.has(key))) throw new ConnectionError('MIGRATION_UNSUPPORTED', 'Legacy provider has unsupported fields')
-  if (typeof input.operationId !== 'string' || !input.operationId) throw new ConnectionError('INVALID_OPERATION', 'An operation ID is required')
-  const generation = createHash('sha256').update(input.operationId).update('\0').update(String(own.revision)).digest('hex')
-  const authIdentity = profile.apiKeyEnv ? { type: 'reference', ref: profile.apiKeyEnv } : { type: 'none' }
-  const { baseURL, apiKeyEnv, models, modelOverrides, ...policy } = profile
-  validatePolicy(policy)
-  const overrides = {}
-  for (const model of models ?? []) {
-    const { id, input, ...rest } = model
-    if (typeof id !== 'string' || !id || Object.keys(rest).some((key) => !['name', 'contextWindow', 'maxTokens', 'reasoningEfforts', 'compat'].includes(key))) throw new ConnectionError('MIGRATION_UNSUPPORTED', 'Legacy model has unsupported fields')
-    overrides[id] = { ...rest, ...(input === undefined ? {} : { inputModalities: input }) }
-  }
-  for (const [id, value] of Object.entries(modelOverrides ?? {})) {
-    const { input, ...rest } = value
-    if (Object.keys(rest).some((key) => !['name', 'contextWindow', 'maxTokens', 'reasoningEfforts', 'compat'].includes(key))) throw new ConnectionError('MIGRATION_UNSUPPORTED', 'Legacy model override has unsupported fields')
-    overrides[id] = { ...overrides[id], ...rest, ...(rest.compat && overrides[id]?.compat ? { compat: { ...overrides[id].compat, ...rest.compat } } : {}), ...(input === undefined ? {} : { inputModalities: input }) }
-  }
-  const migration = { phase: 'prepared', operationId: input.operationId, generation, legacyRevision: legacy.revision, fingerprint: summary.fingerprint, backupFingerprint: fingerprintOf(profile), backup: profile, provenance: 'legacy' }
-  await setOwn(settings, { baseURL, authIdentity, enabled: true, generation, operationId: input.operationId, policy, overrides, migration }, own.revision)
-  return migration
-}
-// Undo a prepared-but-not-cut-over migration. The legacy provider is still in
-// place at this point, so only our own row is cleared; rollbackLegacy is for the
-// post-cutover case where the legacy entry has to be restored.
-export async function discardPrepared(settings) {
-  const { own } = rows(settings)
-  const migration = own?.value?.migration
-  if (!migration || migration.phase !== 'prepared') return false
-  if (own.value.generation !== migration.generation) throw new ConnectionError('MIGRATION_CONFLICT', 'Connection changed after migration; forward repair is required')
-  await settings.mutate(OWN, ['baseURL', 'authIdentity', 'generation', 'operationId', 'policy', 'overrides', 'migration'].map((key) => ({ op: 'unset', path: [key] })), own.revision)
-  return true
-}
-export async function cutoverLegacy(settings) {
-  let { own, legacy } = rows(settings)
-  let migration = own?.value?.migration
-  if (!migration || !['prepared', 'cutover'].includes(migration.phase)) return false
-  const current = legacy?.user?.providers?.[PROVIDER]
-  if (legacy?.base?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider exists in a base layer')
-  if (current && fingerprintOf(current) !== migration.fingerprint) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider changed during migration')
-  if (migration.phase === 'prepared') {
-    if (!current || legacy.revision !== migration.legacyRevision) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider changed before cutover')
-    migration = { ...migration, phase: 'cutover' }
-    await setOwn(settings, { migration }, own.revision)
-      ; ({ own, legacy } = rows(settings))
-  }
-  if (legacy?.user?.providers?.[PROVIDER]) await settings.mutate(LEGACY, [{ op: 'unset', path: ['providers', PROVIDER] }], legacy.revision)
-    ; ({ legacy } = rows(settings))
-  if (legacy?.value?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider remains after cutover')
-  return true
-}
-export async function finishLegacy(settings) {
-  const { own, legacy } = rows(settings)
-  if (own?.value?.migration?.phase !== 'cutover' || legacy?.value?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy cutover is not complete')
-  await setOwn(settings, { migration: { ...own.value.migration, phase: 'active' } }, own.revision)
-}
-
-export async function rollbackLegacy(settings, releaseRoute) {
-  let { own, legacy } = rows(settings)
-  const migration = own?.value?.migration
-  if (!migration || own.value.generation !== migration.generation) throw new ConnectionError('MIGRATION_CONFLICT', 'Connection changed after migration; forward repair is required')
-  let ownedRevision = own.revision
-  const checkOwner = () => {
-    const current = rows(settings).own
-    if (current?.revision !== ownedRevision || current.value?.generation !== migration.generation || current.value?.migration?.operationId !== migration.operationId || current.value?.migration?.generation !== migration.generation) throw new ConnectionError('MIGRATION_CONFLICT', 'Connection changed during rollback; forward repair is required')
-  }
-  if (legacy?.base?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider exists in a base layer')
-  if (migration.phase !== 'rollback') {
-    if (legacy?.value?.providers?.[PROVIDER] || legacy?.user?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider already exists')
-    await setOwn(settings, { migration: { ...migration, phase: 'rollback' } }, own.revision)
-    ownedRevision += 1
-    checkOwner()
-  }
-  await releaseRoute()
-  checkOwner()
-    ; ({ own, legacy } = rows(settings))
-  const existing = legacy?.user?.providers?.[PROVIDER]
-  if (legacy?.base?.providers?.[PROVIDER] || (existing && fingerprintOf(existing) !== migration.backupFingerprint) || (!existing && legacy?.value?.providers?.[PROVIDER])) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider appeared during rollback')
-  if (!existing) await settings.mutate(LEGACY, [{ op: 'set', path: ['providers', PROVIDER], value: migration.backup }], legacy.revision)
-  checkOwner()
-    ; ({ own, legacy } = rows(settings))
-  if (!legacy?.user?.providers?.[PROVIDER] || fingerprintOf(legacy.user.providers[PROVIDER]) !== migration.backupFingerprint) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy rollback could not be confirmed')
-  await settings.mutate(OWN, ['baseURL', 'authIdentity', 'generation', 'operationId', 'policy', 'overrides', 'migration'].map((key) => ({ op: 'unset', path: [key] })), ownedRevision)
-}
+import { createHash } from 'node:crypto'
+import { ConnectionError, validateEndpoint } from './connection.js'
+import { credentialField } from './secrets.js'
+import { PROTOCOLS, validatePolicy } from './policy.js'
+
+const OWN = 'llm-cliproxyapi'
+const LEGACY = 'llm-pi-ai'
+const PROVIDER = 'CLIProxyAPI'
+const fingerprintOf = (profile) => createHash('sha256').update(JSON.stringify(profile)).digest('hex')
+const PLACEHOLDER = 'Bearer dsh-cliproxyapi-no-key'
+function portableProfile(value) {
+  const profile = structuredClone(value)
+  if (profile.headers) {
+    for (const [key, header] of Object.entries(profile.headers)) {
+      if (key.toLowerCase() === 'x-dsh-provider-cpa-sync' || key.toLowerCase() === 'authorization' && header === PLACEHOLDER) delete profile.headers[key]
+    }
+  }
+  return profile
+}
+function containsSecrets(value) {
+  if (!value || typeof value !== 'object') return false
+  return Object.entries(value).some(([key, item]) => credentialField(key) || containsSecrets(item))
+}
+function rows(settings) {
+  const entries = settings.describe()
+  return { own: entries.find((row) => row.ns === OWN), legacy: entries.find((row) => row.ns === LEGACY) }
+}
+export function legacyView(settings) {
+  const { legacy } = rows(settings)
+  const profile = legacy?.user?.providers?.[PROVIDER]
+  if (!profile) return { available: false }
+  if (legacy.base?.providers?.[PROVIDER]) return { available: false, reason: 'Legacy provider also exists in a base layer' }
+  if (!profile.baseURL) return { available: false, reason: 'Legacy endpoint is missing' }
+  if (containsSecrets(portableProfile(profile))) return { available: false, reason: 'Legacy provider contains a secret field requiring manual migration' }
+  return { available: true, baseURL: profile.baseURL, revision: legacy.revision, fingerprint: fingerprintOf(profile) }
+}
+async function setOwn(settings, values, revision) {
+  await settings.mutate(OWN, Object.entries(values).map(([key, value]) => ({ op: 'set', path: [key], value })), revision)
+}
+export async function prepareLegacy(settings, input) {
+  const { own, legacy } = rows(settings)
+  if (!own || !legacy || own.revision !== input.expectedRevision || legacy.revision !== input.expectedLegacyRevision) throw new ConnectionError('SETTINGS_CONFLICT', 'Settings changed before migration')
+  if (own.value?.baseURL || own.value?.migration) throw new ConnectionError('MIGRATION_CONFLICT', 'Connection already exists')
+  const summary = legacyView(settings)
+  if (!summary.available || summary.fingerprint !== input.fingerprint) throw new ConnectionError('MIGRATION_CONFLICT', summary.reason ?? 'Legacy provider changed')
+  const profile = portableProfile(legacy.user.providers[PROVIDER])
+  validateEndpoint(profile.baseURL)
+  if (profile.api !== undefined && !PROTOCOLS.includes(profile.api)) throw new ConnectionError('MIGRATION_UNSUPPORTED', 'Legacy wire protocol cannot be migrated')
+  const known = new Set(['displayName', 'api', 'baseURL', 'apiKeyEnv', 'models', 'modelOverrides', 'defaultContextWindow', 'defaultMaxTokens', 'defaultInput', 'headers', 'compat', 'retryPolicy', 'reasoning', 'thinkingBudgets', 'streamIdleTimeoutMs', 'maxRequestImageBytes', 'maxRequestImages', 'imageOffloadCountQuantum', 'requestImagePixelBudget', 'requestImageMaxBytes', 'cacheRetention', 'transport', 'timeoutMs', 'websocketConnectTimeoutMs'])
+  if (Object.keys(profile).some((key) => !known.has(key))) throw new ConnectionError('MIGRATION_UNSUPPORTED', 'Legacy provider has unsupported fields')
+  if (typeof input.operationId !== 'string' || !input.operationId) throw new ConnectionError('INVALID_OPERATION', 'An operation ID is required')
+  const generation = createHash('sha256').update(input.operationId).update('\0').update(String(own.revision)).digest('hex')
+  const authIdentity = profile.apiKeyEnv ? { type: 'reference', ref: profile.apiKeyEnv } : { type: 'none' }
+  const { baseURL, apiKeyEnv, models, modelOverrides, ...policy } = profile
+  validatePolicy(policy)
+  const overrides = {}
+  for (const model of models ?? []) {
+    const { id, input, ...rest } = model
+    if (typeof id !== 'string' || !id || Object.keys(rest).some((key) => !['name', 'contextWindow', 'maxTokens', 'reasoningEfforts', 'compat'].includes(key))) throw new ConnectionError('MIGRATION_UNSUPPORTED', 'Legacy model has unsupported fields')
+    overrides[id] = { ...rest, ...(input === undefined ? {} : { inputModalities: input }) }
+  }
+  for (const [id, value] of Object.entries(modelOverrides ?? {})) {
+    const { input, ...rest } = value
+    if (Object.keys(rest).some((key) => !['name', 'contextWindow', 'maxTokens', 'reasoningEfforts', 'compat'].includes(key))) throw new ConnectionError('MIGRATION_UNSUPPORTED', 'Legacy model override has unsupported fields')
+    overrides[id] = { ...overrides[id], ...rest, ...(rest.compat && overrides[id]?.compat ? { compat: { ...overrides[id].compat, ...rest.compat } } : {}), ...(input === undefined ? {} : { inputModalities: input }) }
+  }
+  const migration = { phase: 'prepared', operationId: input.operationId, generation, legacyRevision: legacy.revision, fingerprint: summary.fingerprint, backupFingerprint: fingerprintOf(profile), backup: profile, provenance: 'legacy' }
+  await setOwn(settings, { baseURL, authIdentity, enabled: true, generation, operationId: input.operationId, policy, overrides, migration }, own.revision)
+  return migration
+}
+// Undo a prepared-but-not-cut-over migration. The legacy provider is still in
+// place at this point, so only our own row is cleared; rollbackLegacy is for the
+// post-cutover case where the legacy entry has to be restored.
+export async function discardPrepared(settings) {
+  const { own } = rows(settings)
+  const migration = own?.value?.migration
+  if (!migration || migration.phase !== 'prepared') return false
+  if (own.value.generation !== migration.generation) throw new ConnectionError('MIGRATION_CONFLICT', 'Connection changed after migration; forward repair is required')
+  await settings.mutate(OWN, ['baseURL', 'authIdentity', 'generation', 'operationId', 'policy', 'overrides', 'migration'].map((key) => ({ op: 'unset', path: [key] })), own.revision)
+  return true
+}
+export async function cutoverLegacy(settings) {
+  let { own, legacy } = rows(settings)
+  let migration = own?.value?.migration
+  if (!migration || !['prepared', 'cutover'].includes(migration.phase)) return false
+  const current = legacy?.user?.providers?.[PROVIDER]
+  if (legacy?.base?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider exists in a base layer')
+  if (current && fingerprintOf(current) !== migration.fingerprint) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider changed during migration')
+  if (migration.phase === 'prepared') {
+    if (!current || legacy.revision !== migration.legacyRevision) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider changed before cutover')
+    migration = { ...migration, phase: 'cutover' }
+    await setOwn(settings, { migration }, own.revision)
+      ; ({ own, legacy } = rows(settings))
+  }
+  if (legacy?.user?.providers?.[PROVIDER]) await settings.mutate(LEGACY, [{ op: 'unset', path: ['providers', PROVIDER] }], legacy.revision)
+    ; ({ legacy } = rows(settings))
+  if (legacy?.value?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider remains after cutover')
+  return true
+}
+export async function finishLegacy(settings) {
+  const { own, legacy } = rows(settings)
+  if (own?.value?.migration?.phase !== 'cutover' || legacy?.value?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy cutover is not complete')
+  await setOwn(settings, { migration: { ...own.value.migration, phase: 'active' } }, own.revision)
+}
+
+export async function rollbackLegacy(settings, releaseRoute) {
+  let { own, legacy } = rows(settings)
+  const migration = own?.value?.migration
+  if (!migration || own.value.generation !== migration.generation) throw new ConnectionError('MIGRATION_CONFLICT', 'Connection changed after migration; forward repair is required')
+  let ownedRevision = own.revision
+  const checkOwner = () => {
+    const current = rows(settings).own
+    if (current?.revision !== ownedRevision || current.value?.generation !== migration.generation || current.value?.migration?.operationId !== migration.operationId || current.value?.migration?.generation !== migration.generation) throw new ConnectionError('MIGRATION_CONFLICT', 'Connection changed during rollback; forward repair is required')
+  }
+  if (legacy?.base?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider exists in a base layer')
+  if (migration.phase !== 'rollback') {
+    if (legacy?.value?.providers?.[PROVIDER] || legacy?.user?.providers?.[PROVIDER]) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider already exists')
+    await setOwn(settings, { migration: { ...migration, phase: 'rollback' } }, own.revision)
+    ownedRevision += 1
+    checkOwner()
+  }
+  await releaseRoute()
+  checkOwner()
+    ; ({ own, legacy } = rows(settings))
+  const existing = legacy?.user?.providers?.[PROVIDER]
+  if (legacy?.base?.providers?.[PROVIDER] || (existing && fingerprintOf(existing) !== migration.backupFingerprint) || (!existing && legacy?.value?.providers?.[PROVIDER])) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy provider appeared during rollback')
+  if (!existing) await settings.mutate(LEGACY, [{ op: 'set', path: ['providers', PROVIDER], value: migration.backup }], legacy.revision)
+  checkOwner()
+    ; ({ own, legacy } = rows(settings))
+  if (!legacy?.user?.providers?.[PROVIDER] || fingerprintOf(legacy.user.providers[PROVIDER]) !== migration.backupFingerprint) throw new ConnectionError('MIGRATION_CONFLICT', 'Legacy rollback could not be confirmed')
+  await settings.mutate(OWN, ['baseURL', 'authIdentity', 'generation', 'operationId', 'policy', 'overrides', 'migration'].map((key) => ({ op: 'unset', path: [key] })), ownedRevision)
+}

package/src/policy.js

@@ -1,42 +1,42 @@
-import { resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
-import { Config as NativePiAiConfig } from '@deepseek-ai/dsh-llm-pi-ai'
-import { ConnectionError } from './connection.js'
-import { credentialField } from './secrets.js'
-
-// The wire protocols this build can serve. The order is the presentation order:
-// the first entry is the default a fresh connection starts with.
-export const PROTOCOLS = ['openai-responses', 'openai-completions', 'anthropic-messages', 'google-generative-ai']
-export const DEFAULT_PROTOCOL = PROTOCOLS[0]
-
-const fields = new Set(['displayName', 'api', 'defaultContextWindow', 'defaultMaxTokens', 'defaultInput', 'headers', 'compat', 'retryPolicy', 'reasoning', 'thinkingBudgets', 'streamIdleTimeoutMs', 'maxRequestImageBytes', 'maxRequestImages', 'imageOffloadCountQuantum', 'requestImagePixelBudget', 'requestImageMaxBytes', 'cacheRetention', 'transport', 'timeoutMs', 'websocketConnectTimeoutMs'])
-const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v)
-const containsCredentials = (v) => object(v) && Object.entries(v).some(([k, x]) => credentialField(k) || containsCredentials(x)) || Array.isArray(v) && v.some(containsCredentials)
-export function protocolOf(policy) {
-  return PROTOCOLS.includes(policy?.api) ? policy.api : DEFAULT_PROTOCOL
-}
-export function validatePolicy(policy = {}) {
-  try {
-    if (!object(policy) || containsCredentials(policy) || Object.keys(policy).some((k) => !fields.has(k))) throw 0
-    for (const key of ['defaultContextWindow', 'defaultMaxTokens', 'maxRequestImageBytes', 'maxRequestImages', 'imageOffloadCountQuantum', 'requestImagePixelBudget', 'requestImageMaxBytes']) if (policy[key] !== undefined && (!Number.isSafeInteger(policy[key]) || policy[key] <= 0)) throw 0
-    for (const key of ['timeoutMs', 'websocketConnectTimeoutMs']) if (policy[key] !== undefined && (!Number.isSafeInteger(policy[key]) || policy[key] < 0)) throw 0
-    if (policy.streamIdleTimeoutMs !== undefined && (!Number.isFinite(policy.streamIdleTimeoutMs) || policy.streamIdleTimeoutMs <= 0 || policy.streamIdleTimeoutMs > 2147483647)) throw 0
-    if (policy.imageOffloadCountQuantum > (policy.maxRequestImages ?? 50)) throw 0
-    if (policy.defaultInput !== undefined && (!Array.isArray(policy.defaultInput) || !policy.defaultInput.length || policy.defaultInput.some((x) => !['text', 'image'].includes(x)))) throw 0
-    if (policy.headers !== undefined && (!object(policy.headers) || Object.values(policy.headers).some((x) => typeof x !== 'string'))) throw 0
-    if (policy.compat !== undefined && !object(policy.compat) || policy.thinkingBudgets !== undefined && (!object(policy.thinkingBudgets) || Object.values(policy.thinkingBudgets).some((x) => !Number.isSafeInteger(x) || x < 0))) throw 0
-    if (policy.cacheRetention !== undefined && !['none', 'short', 'long'].includes(policy.cacheRetention)) throw 0
-    if (policy.transport !== undefined && !['auto', 'sse', 'websocket', 'websocket-cached'].includes(policy.transport)) throw 0
-    if (policy.reasoning !== undefined && !['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'].includes(policy.reasoning)) throw 0
-    if (policy.displayName !== undefined && typeof policy.displayName !== 'string' || policy.api !== undefined && !PROTOCOLS.includes(policy.api)) throw 0
-    if (policy.retryPolicy !== undefined && (!object(policy.retryPolicy) || policy.retryPolicy.backoff !== undefined && !object(policy.retryPolicy.backoff) || policy.retryPolicy.retryableCodes !== undefined && !Array.isArray(policy.retryPolicy.retryableCodes))) throw 0
-    resolveRetryPolicy(policy.retryPolicy, 'CPA')
-    const checked = NativePiAiConfig['~standard'].validate({
-      providers: { 'cpa-policy-validation': { ...policy, api: protocolOf(policy), baseURL: 'https://policy.invalid/v1', models: [{ id: 'policy-validation' }] } },
-    })
-    if (!checked || typeof checked.then === 'function' || checked.issues) throw 0
-    const parsed = checked.value.providers.get()['cpa-policy-validation']
-    for (const [key, value] of Object.entries(policy.compat ?? {})) {
-      if (JSON.stringify(parsed.compat?.[key]) !== JSON.stringify(value)) throw 0
-    }
-  } catch { throw new ConnectionError('INVALID_POLICY', 'Invalid or unsupported public policy') }
-}
+import { resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
+import { Config as NativePiAiConfig } from '@deepseek-ai/dsh-llm-pi-ai'
+import { ConnectionError } from './connection.js'
+import { credentialField } from './secrets.js'
+
+// The wire protocols this build can serve. The order is the presentation order:
+// the first entry is the default a fresh connection starts with.
+export const PROTOCOLS = ['openai-responses', 'openai-completions', 'anthropic-messages', 'google-generative-ai']
+export const DEFAULT_PROTOCOL = PROTOCOLS[0]
+
+const fields = new Set(['displayName', 'api', 'defaultContextWindow', 'defaultMaxTokens', 'defaultInput', 'headers', 'compat', 'retryPolicy', 'reasoning', 'thinkingBudgets', 'streamIdleTimeoutMs', 'maxRequestImageBytes', 'maxRequestImages', 'imageOffloadCountQuantum', 'requestImagePixelBudget', 'requestImageMaxBytes', 'cacheRetention', 'transport', 'timeoutMs', 'websocketConnectTimeoutMs'])
+const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v)
+const containsCredentials = (v) => object(v) && Object.entries(v).some(([k, x]) => credentialField(k) || containsCredentials(x)) || Array.isArray(v) && v.some(containsCredentials)
+export function protocolOf(policy) {
+  return PROTOCOLS.includes(policy?.api) ? policy.api : DEFAULT_PROTOCOL
+}
+export function validatePolicy(policy = {}) {
+  try {
+    if (!object(policy) || containsCredentials(policy) || Object.keys(policy).some((k) => !fields.has(k))) throw 0
+    for (const key of ['defaultContextWindow', 'defaultMaxTokens', 'maxRequestImageBytes', 'maxRequestImages', 'imageOffloadCountQuantum', 'requestImagePixelBudget', 'requestImageMaxBytes']) if (policy[key] !== undefined && (!Number.isSafeInteger(policy[key]) || policy[key] <= 0)) throw 0
+    for (const key of ['timeoutMs', 'websocketConnectTimeoutMs']) if (policy[key] !== undefined && (!Number.isSafeInteger(policy[key]) || policy[key] < 0)) throw 0
+    if (policy.streamIdleTimeoutMs !== undefined && (!Number.isFinite(policy.streamIdleTimeoutMs) || policy.streamIdleTimeoutMs <= 0 || policy.streamIdleTimeoutMs > 2147483647)) throw 0
+    if (policy.imageOffloadCountQuantum > (policy.maxRequestImages ?? 50)) throw 0
+    if (policy.defaultInput !== undefined && (!Array.isArray(policy.defaultInput) || !policy.defaultInput.length || policy.defaultInput.some((x) => !['text', 'image'].includes(x)))) throw 0
+    if (policy.headers !== undefined && (!object(policy.headers) || Object.values(policy.headers).some((x) => typeof x !== 'string'))) throw 0
+    if (policy.compat !== undefined && !object(policy.compat) || policy.thinkingBudgets !== undefined && (!object(policy.thinkingBudgets) || Object.values(policy.thinkingBudgets).some((x) => !Number.isSafeInteger(x) || x < 0))) throw 0
+    if (policy.cacheRetention !== undefined && !['none', 'short', 'long'].includes(policy.cacheRetention)) throw 0
+    if (policy.transport !== undefined && !['auto', 'sse', 'websocket', 'websocket-cached'].includes(policy.transport)) throw 0
+    if (policy.reasoning !== undefined && !['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'].includes(policy.reasoning)) throw 0
+    if (policy.displayName !== undefined && typeof policy.displayName !== 'string' || policy.api !== undefined && !PROTOCOLS.includes(policy.api)) throw 0
+    if (policy.retryPolicy !== undefined && (!object(policy.retryPolicy) || policy.retryPolicy.backoff !== undefined && !object(policy.retryPolicy.backoff) || policy.retryPolicy.retryableCodes !== undefined && !Array.isArray(policy.retryPolicy.retryableCodes))) throw 0
+    resolveRetryPolicy(policy.retryPolicy, 'CPA')
+    const checked = NativePiAiConfig['~standard'].validate({
+      providers: { 'cpa-policy-validation': { ...policy, api: protocolOf(policy), baseURL: 'https://policy.invalid/v1', models: [{ id: 'policy-validation' }] } },
+    })
+    if (!checked || typeof checked.then === 'function' || checked.issues) throw 0
+    const parsed = checked.value.providers.get()['cpa-policy-validation']
+    for (const [key, value] of Object.entries(policy.compat ?? {})) {
+      if (JSON.stringify(parsed.compat?.[key]) !== JSON.stringify(value)) throw 0
+    }
+  } catch { throw new ConnectionError('INVALID_POLICY', 'Invalid or unsupported public policy') }
+}

package/src/secrets.js

@@ -1 +1 @@
-export const credentialField = (name) => /^(?:(?:x[-_])?api[-_]?key|(?:[\w]+[-_])*authorization|cookie|set[-_]?cookie|password|secret|token|key|access[-_]?token|refresh[-_]?token|credential)$/i.test(name)
+export const credentialField = (name) => /^(?:(?:x[-_])?api[-_]?key|(?:[\w]+[-_])*authorization|cookie|set[-_]?cookie|password|secret|token|key|access[-_]?token|refresh[-_]?token|credential)$/i.test(name)

package/src/transport.js

@@ -1,114 +1,114 @@
-import { openAIResponsesApi } from '@earendil-works/pi-ai/api/openai-responses.lazy'
-import { openAICompletionsApi } from '@earendil-works/pi-ai/api/openai-completions.lazy'
-import { anthropicMessagesApi } from '@earendil-works/pi-ai/api/anthropic-messages.lazy'
-import { googleGenerativeAIApi } from '@earendil-works/pi-ai/api/google-generative-ai.lazy'
-import { PROTOCOLS } from './policy.js'
-
-const FACTORIES = {
-  'openai-responses': openAIResponsesApi,
-  'openai-completions': openAICompletionsApi,
-  'anthropic-messages': anthropicMessagesApi,
-  'google-generative-ai': googleGenerativeAIApi,
-}
-
-// Each wire protocol ends its SSE stream differently. The scanner only feeds the
-// diagnostics panel, so an unknown protocol degrades to "no terminal event seen"
-// instead of guessing.
-const TERMINALS = {
-  'openai-responses': (line) => {
-    const match = /^(?:event:\s*|data:\s*\{"type"\s*:\s*")(response\.(?:completed|failed|incomplete))/.exec(line)
-    return match ? match[1].replace('response.', 'sse-') : undefined
-  },
-  'openai-completions': (line) => {
-    if (/^data:\s*\[DONE\]/.test(line)) return 'sse-completed'
-    return /^data:\s*\{/.test(line) && /"error"\s*:/.test(line) ? 'sse-failed' : undefined
-  },
-  'anthropic-messages': (line) => {
-    const match = /^(?:event:\s*|data:\s*\{[^\n]*"type"\s*:\s*")(message_stop|error)/.exec(line)
-    if (!match) return undefined
-    return match[1] === 'error' ? 'sse-failed' : 'sse-completed'
-  },
-  'google-generative-ai': (line) => {
-    const match = /^(?:event:\s*|data:\s*\{[^\n]*"type"\s*:\s*")(result|error)/.exec(line)
-    if (!match) return undefined
-    return match[1] === 'error' ? 'sse-failed' : 'sse-completed'
-  },
-}
-
-export function resolveProtocol(protocol) {
-  return PROTOCOLS.includes(protocol) ? protocol : 'openai-responses'
-}
-
-export function terminalStage(protocol, line) {
-  return TERMINALS[resolveProtocol(protocol)](line)
-}
-
-export function createTransport(protocol, baseURL, diagnostics, fetchImpl = globalThis.fetch, keyless = false) {
-  const api = resolveProtocol(protocol)
-  const origin = new URL(baseURL).origin
-  const native = FACTORIES[api]()
-  const terminalOf = TERMINALS[api]
-  // Google streams carry no sentinel, so a clean flush is a completed stream.
-  const flushStage = api === 'google-generative-ai' ? 'sse-completed' : 'sse-incomplete'
-  const record = (entry) => {
-    diagnostics.push({ at: Date.now(), ...entry })
-    if (diagnostics.length > 50) diagnostics.splice(0, diagnostics.length - 50)
-  }
-  const scopedFetch = async (input, init = {}) => {
-    const url = input instanceof Request ? input.url : String(input)
-    if (new URL(url).origin !== origin) throw new Error('CPA request origin changed')
-    try {
-      const headers = new Headers(input instanceof Request ? input.headers : undefined)
-      if (init.headers) new Headers(init.headers).forEach((value, key) => headers.set(key, value))
-      if (keyless) headers.delete('authorization')
-      const response = await fetchImpl(input, { ...init, headers, redirect: 'error' })
-      const requestId = response.headers.get('x-request-id')
-      record({ stage: 'http', status: response.status, ...(/^[A-Za-z0-9._:-]{1,128}$/.test(requestId ?? '') ? { requestId } : {}) })
-      if (!response.body || !response.headers.get('content-type')?.toLowerCase().includes('text/event-stream')) return response
-      let pending = ''
-      let terminal = false
-      const signal = init.signal ?? (input instanceof Request ? input.signal : undefined)
-      const onAbort = () => { if (!terminal) { terminal = true; record({ stage: signal?.reason?.name === 'TimeoutError' ? 'timeout' : 'abort' }) } }
-      if (signal?.aborted) onAbort()
-      else signal?.addEventListener('abort', onAbort, { once: true })
-      const cleanup = () => signal?.removeEventListener('abort', onAbort)
-      const decoder = new TextDecoder()
-      const inspect = (text) => {
-        pending += text
-        const lines = pending.split(/\r?\n/)
-        pending = lines.pop().slice(-1024)
-        for (const line of lines) {
-          const stage = terminalOf(line)
-          if (stage && !terminal) { terminal = true; cleanup(); record({ stage }) }
-        }
-      }
-      const body = response.body.pipeThrough(new TransformStream({
-        transform(chunk, controller) { inspect(decoder.decode(chunk, { stream: true })); controller.enqueue(chunk) },
-        flush() { inspect(decoder.decode() + '\n'); cleanup(); if (!terminal) record({ stage: flushStage }) },
-      }))
-      return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers })
-    } catch (error) {
-      record({ stage: error?.name === 'TimeoutError' ? 'timeout' : error?.name === 'AbortError' ? 'abort' : 'before-http' })
-      throw error
-    }
-  }
-  const withPolicy = (options) => ({
-    ...options,
-    maxRetries: 0,
-    fetch: scopedFetch,
-    onPayload(payload, model) {
-      const applyPolicy = (value) => {
-        const updated = { ...value }
-        if (Array.isArray(value.tools)) updated.tools = value.tools.map((tool) => tool.type === 'function' ? { ...tool, strict: false } : tool)
-        record({ stage: 'payload', toolCount: Array.isArray(value.tools) ? value.tools.length : 0 })
-        return updated
-      }
-      const original = options?.onPayload?.(payload, model)
-      return original instanceof Promise ? original.then((value) => applyPolicy(value ?? payload)) : applyPolicy(original ?? payload)
-    },
-  })
-  return {
-    stream: (model, context, options) => native.stream(model, context, withPolicy(options)),
-    streamSimple: (model, context, options) => native.streamSimple(model, context, withPolicy(options)),
-  }
-}
+import { openAIResponsesApi } from '@earendil-works/pi-ai/api/openai-responses.lazy'
+import { openAICompletionsApi } from '@earendil-works/pi-ai/api/openai-completions.lazy'
+import { anthropicMessagesApi } from '@earendil-works/pi-ai/api/anthropic-messages.lazy'
+import { googleGenerativeAIApi } from '@earendil-works/pi-ai/api/google-generative-ai.lazy'
+import { PROTOCOLS } from './policy.js'
+
+const FACTORIES = {
+  'openai-responses': openAIResponsesApi,
+  'openai-completions': openAICompletionsApi,
+  'anthropic-messages': anthropicMessagesApi,
+  'google-generative-ai': googleGenerativeAIApi,
+}
+
+// Each wire protocol ends its SSE stream differently. The scanner only feeds the
+// diagnostics panel, so an unknown protocol degrades to "no terminal event seen"
+// instead of guessing.
+const TERMINALS = {
+  'openai-responses': (line) => {
+    const match = /^(?:event:\s*|data:\s*\{"type"\s*:\s*")(response\.(?:completed|failed|incomplete))/.exec(line)
+    return match ? match[1].replace('response.', 'sse-') : undefined
+  },
+  'openai-completions': (line) => {
+    if (/^data:\s*\[DONE\]/.test(line)) return 'sse-completed'
+    return /^data:\s*\{/.test(line) && /"error"\s*:/.test(line) ? 'sse-failed' : undefined
+  },
+  'anthropic-messages': (line) => {
+    const match = /^(?:event:\s*|data:\s*\{[^\n]*"type"\s*:\s*")(message_stop|error)/.exec(line)
+    if (!match) return undefined
+    return match[1] === 'error' ? 'sse-failed' : 'sse-completed'
+  },
+  'google-generative-ai': (line) => {
+    const match = /^(?:event:\s*|data:\s*\{[^\n]*"type"\s*:\s*")(result|error)/.exec(line)
+    if (!match) return undefined
+    return match[1] === 'error' ? 'sse-failed' : 'sse-completed'
+  },
+}
+
+export function resolveProtocol(protocol) {
+  return PROTOCOLS.includes(protocol) ? protocol : 'openai-responses'
+}
+
+export function terminalStage(protocol, line) {
+  return TERMINALS[resolveProtocol(protocol)](line)
+}
+
+export function createTransport(protocol, baseURL, diagnostics, fetchImpl = globalThis.fetch, keyless = false) {
+  const api = resolveProtocol(protocol)
+  const origin = new URL(baseURL).origin
+  const native = FACTORIES[api]()
+  const terminalOf = TERMINALS[api]
+  // Google streams carry no sentinel, so a clean flush is a completed stream.
+  const flushStage = api === 'google-generative-ai' ? 'sse-completed' : 'sse-incomplete'
+  const record = (entry) => {
+    diagnostics.push({ at: Date.now(), ...entry })
+    if (diagnostics.length > 50) diagnostics.splice(0, diagnostics.length - 50)
+  }
+  const scopedFetch = async (input, init = {}) => {
+    const url = input instanceof Request ? input.url : String(input)
+    if (new URL(url).origin !== origin) throw new Error('CPA request origin changed')
+    try {
+      const headers = new Headers(input instanceof Request ? input.headers : undefined)
+      if (init.headers) new Headers(init.headers).forEach((value, key) => headers.set(key, value))
+      if (keyless) headers.delete('authorization')
+      const response = await fetchImpl(input, { ...init, headers, redirect: 'error' })
+      const requestId = response.headers.get('x-request-id')
+      record({ stage: 'http', status: response.status, ...(/^[A-Za-z0-9._:-]{1,128}$/.test(requestId ?? '') ? { requestId } : {}) })
+      if (!response.body || !response.headers.get('content-type')?.toLowerCase().includes('text/event-stream')) return response
+      let pending = ''
+      let terminal = false
+      const signal = init.signal ?? (input instanceof Request ? input.signal : undefined)
+      const onAbort = () => { if (!terminal) { terminal = true; record({ stage: signal?.reason?.name === 'TimeoutError' ? 'timeout' : 'abort' }) } }
+      if (signal?.aborted) onAbort()
+      else signal?.addEventListener('abort', onAbort, { once: true })
+      const cleanup = () => signal?.removeEventListener('abort', onAbort)
+      const decoder = new TextDecoder()
+      const inspect = (text) => {
+        pending += text
+        const lines = pending.split(/\r?\n/)
+        pending = lines.pop().slice(-1024)
+        for (const line of lines) {
+          const stage = terminalOf(line)
+          if (stage && !terminal) { terminal = true; cleanup(); record({ stage }) }
+        }
+      }
+      const body = response.body.pipeThrough(new TransformStream({
+        transform(chunk, controller) { inspect(decoder.decode(chunk, { stream: true })); controller.enqueue(chunk) },
+        flush() { inspect(decoder.decode() + '\n'); cleanup(); if (!terminal) record({ stage: flushStage }) },
+      }))
+      return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers })
+    } catch (error) {
+      record({ stage: error?.name === 'TimeoutError' ? 'timeout' : error?.name === 'AbortError' ? 'abort' : 'before-http' })
+      throw error
+    }
+  }
+  const withPolicy = (options) => ({
+    ...options,
+    maxRetries: 0,
+    fetch: scopedFetch,
+    onPayload(payload, model) {
+      const applyPolicy = (value) => {
+        const updated = { ...value }
+        if (Array.isArray(value.tools)) updated.tools = value.tools.map((tool) => tool.type === 'function' ? { ...tool, strict: false } : tool)
+        record({ stage: 'payload', toolCount: Array.isArray(value.tools) ? value.tools.length : 0 })
+        return updated
+      }
+      const original = options?.onPayload?.(payload, model)
+      return original instanceof Promise ? original.then((value) => applyPolicy(value ?? payload)) : applyPolicy(original ?? payload)
+    },
+  })
+  return {
+    stream: (model, context, options) => native.stream(model, context, withPolicy(options)),
+    streamSimple: (model, context, options) => native.streamSimple(model, context, withPolicy(options)),
+  }
+}