cartethyia 2.7.4 → 2.7.5

package/src/persistence/stores/share-store.ts

@@ -7,7 +7,7 @@ import { createHash, randomBytes, randomInt } from "node:crypto";
 import { and, desc, eq, isNull, or, sql, type SQL } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../db-handle";
 import { lockRows } from "../dialect";
-import { apiKeys, shareLinks, sharePopups, type ShareLinkKind, type ApiKeyModelAccessMode } from "../schema";
+import { apiKeys, shareLinks, sharePopups, type ShareLinkKind, type ApiKeyModelAccessMode, type ApiKeyConcurrencyScope } from "../schema";
 
 /** Hashes a share bearer token for storage and lookup. */
 /**
@@ -38,7 +38,7 @@ function addressMatches(address: string): SQL {
 }
 
 /** Newly created share-link metadata. */
-export interface ShareLinkRecord {
+interface ShareLinkRecord {
   readonly id: string;
   readonly apiKeyId: string;
   readonly kind: ShareLinkKind;
@@ -61,7 +61,7 @@ export interface ShareLinkSummary {
 }
 
 /** A stable link's encrypted token, or null when it predates token retention. */
-export interface ShareLinkToken {
+interface ShareLinkToken {
   readonly id: string;
   readonly apiKeyId: string;
   readonly kind: ShareLinkKind;
@@ -86,6 +86,7 @@ export interface ShareLinkPolicy {
   readonly monthlyTokenLimit: number | null;
   readonly lifetimeTokenBudget: number | null;
   readonly maxConcurrentRequests: number | null;
+  readonly concurrencyScope: ApiKeyConcurrencyScope;
   readonly modelAccessMode: ApiKeyModelAccessMode | null;
   readonly modelList: readonly string[] | null;
   readonly modelPrefix: string | null;
@@ -102,13 +103,13 @@ export interface ShareLinkPolicy {
 }
 
 /** Public template fields authorized for a valid enrollment-link lookup. */
-export interface ShareApiKeyRow extends ShareLinkPolicy {
+interface ShareApiKeyRow extends ShareLinkPolicy {
   readonly active: boolean;
   readonly createdAt: string;
 }
 
 /** A personal key revealed by its handoff link. */
-export interface ShareHandoffRow extends ShareLinkPolicy {
+interface ShareHandoffRow extends ShareLinkPolicy {
   /** Encrypted personal credential; null when the row predates secret storage. */
   readonly keyEncrypted: Buffer | null;
 }
@@ -118,7 +119,7 @@ export interface ShareHandoffRow extends ShareLinkPolicy {
  * public lookup answers with a discriminated result instead of the caller
  * guessing which endpoint to try.
  */
-export type ShareLinkResolution =
+type ShareLinkResolution =
   | { readonly kind: "enroll"; readonly key: ShareApiKeyRow }
   | { readonly kind: "handoff"; readonly key: ShareHandoffRow };
 
@@ -136,7 +137,7 @@ export type ShareLinkOutcome =
   | { readonly ok: true; readonly resolution: ShareLinkResolution }
   | { readonly ok: false; readonly refusal: ShareLinkRefusal };
 
-export interface SharedApiKeyMaterial {
+interface SharedApiKeyMaterial {
   readonly keyHash: string;
   readonly keyPrefix: string;
   readonly clientIp: string;
@@ -145,7 +146,7 @@ export interface SharedApiKeyMaterial {
   readonly nameHint?: string;
 }
 
-export type SharedApiKeyIssueResult =
+type SharedApiKeyIssueResult =
   | {
       readonly kind: "issued";
       readonly apiKeyId: string;
@@ -185,6 +186,7 @@ function mapShareRow(key: ApiKeyRow, link: ShareLinkRow, popup?: PopupRow): Shar
     monthlyTokenLimit: key.monthlyTokenLimit,
     lifetimeTokenBudget: key.lifetimeTokenBudget,
     maxConcurrentRequests: key.maxConcurrentRequests,
+    concurrencyScope: key.concurrencyScope ?? "family",
     modelAccessMode: key.modelAccessMode as ApiKeyModelAccessMode | null,
     modelList: key.modelList as readonly string[] | null,
     modelPrefix: key.modelPrefix,
@@ -213,6 +215,7 @@ function mapHandoffRow(key: ApiKeyRow, link: ShareLinkRow, popup?: PopupRow): Sh
     monthlyTokenLimit: key.monthlyTokenLimit,
     lifetimeTokenBudget: key.lifetimeTokenBudget,
     maxConcurrentRequests: key.maxConcurrentRequests,
+    concurrencyScope: key.concurrencyScope ?? "family",
     modelAccessMode: key.modelAccessMode as ApiKeyModelAccessMode | null,
     modelList: key.modelList as readonly string[] | null,
     modelPrefix: key.modelPrefix,
@@ -557,6 +560,12 @@ export class DrizzleShareLinkStore implements ShareLinkStore {
       // Nullable policy columns stay NULL; `model_access_mode` takes its
       // NOT NULL default ('whitelist'). Keep in sync with migration 0029 and
       // `normalizeShareChildPolicy` in `src/console/backup/store.ts`.
+      //
+      // Exception: a template with `concurrencyScope: "per_key"` lets each
+      // recipient carry its own concurrency cap, so the cap is copied to the
+      // child at issue (the child's admission identity is its own id, not the
+      // parent's). The `family` default keeps child caps NULL — they inherit
+      // the parent's cap through auth.
       const [child] = await tx
         .insert(apiKeys)
         .values({
@@ -571,6 +580,9 @@ export class DrizzleShareLinkStore implements ShareLinkStore {
           keyPrefix: material.keyPrefix,
           keyEncrypted: null,
           lifetimeTokensConsumed: 0,
+          ...(parent.concurrencyScope === "per_key"
+            ? { concurrencyScope: "per_key" as const, maxConcurrentRequests: parent.maxConcurrentRequests }
+            : {}),
         })
         .returning({ id: apiKeys.id, tenantId: apiKeys.tenantId, createdAt: apiKeys.createdAt });
       if (!child) throw new Error("shared API-key insert returned no row");

package/src/persistence/system-prompt-store.ts

@@ -7,15 +7,20 @@ import { eq } from "drizzle-orm";
 import type { CartethyiaDatabase } from "./db-handle";
 import { tenantSystemPrompts } from "./schema";
 import type {
-  ProviderPromptEntry,
-  PromptSetting,
+  ScopePromptRef,
+  SystemPromptPreset,
   TenantSystemPrompts,
 } from "../console/system-prompt/contracts";
 import {
   EMPTY_TENANT_SYSTEM_PROMPTS,
+  SYSTEM_PROMPT_ALIAS_LIMIT,
+  SYSTEM_PROMPT_COMBO_LIMIT,
   SYSTEM_PROMPT_MODEL_LIMIT,
+  SYSTEM_PROMPT_PRESET_LIMIT,
   SYSTEM_PROMPT_PROVIDER_LIMIT,
   isPromptSetting,
+  isScopePromptRef,
+  isSystemPromptPreset,
   parseSystemPromptModelKey,
 } from "../console/system-prompt/contracts";
 import { bumpSettingsRevision } from "./settings-revision";
@@ -23,6 +28,24 @@ import { bumpSettingsRevision } from "./settings-revision";
 /** The stored row, normalized. Absent row reads as the empty configuration. */
 export type StoredTenantSystemPrompts = TenantSystemPrompts;
 
+/**
+ * Normalizes one scope reference value. Accepts the new `{ kind, ... }` shape
+ * and the legacy per-provider entry shape (`{ followGlobal, setting? }`) so a
+ * hand-edited or pre-migration row stays valid. Invalid values become
+ * `undefined` (the caller drops the key).
+ */
+function normalizeScopeRef(value: unknown, legacyProviderEntry?: boolean): ScopePromptRef | undefined {
+  if (isScopePromptRef(value)) return value;
+  if (legacyProviderEntry && typeof value === "object" && value !== null) {
+    const candidate = value as { followGlobal?: unknown; setting?: unknown };
+    if (candidate.followGlobal === true) return { kind: "global" };
+    if (candidate.followGlobal === false && isPromptSetting(candidate.setting)) {
+      return { kind: "custom", setting: candidate.setting };
+    }
+  }
+  return undefined;
+}
+
 /**
  * Reads the tenant's stored configuration, defensively normalized: a
  * hand-edited or legacy row must not poison the dispatch path, so malformed
@@ -35,8 +58,11 @@ export async function readTenantSystemPrompts(
   const rows = await db
     .select({
       global: tenantSystemPrompts.global,
+      presets: tenantSystemPrompts.presets,
       providers: tenantSystemPrompts.providers,
       models: tenantSystemPrompts.models,
+      combos: tenantSystemPrompts.combos,
+      aliases: tenantSystemPrompts.aliases,
     })
     .from(tenantSystemPrompts)
     .where(eq(tenantSystemPrompts.tenantId, tenantId))
@@ -44,30 +70,43 @@ export async function readTenantSystemPrompts(
   const row = rows[0];
   if (row === undefined) return EMPTY_TENANT_SYSTEM_PROMPTS;
 
-  const providers: Record<string, ProviderPromptEntry> = {};
-  for (const [providerId, entry] of Object.entries(row.providers ?? {})) {
-    if (typeof entry !== "object" || entry === null) continue;
-    const candidate = entry as Partial<ProviderPromptEntry>;
-    if (typeof candidate.followGlobal !== "boolean") continue;
-    if (candidate.followGlobal === false) {
-      if (!isPromptSetting(candidate.setting)) continue;
-      providers[providerId] = { followGlobal: false, setting: candidate.setting };
-    } else {
-      providers[providerId] = { followGlobal: true };
-    }
+  const presets: Record<string, SystemPromptPreset> = {};
+  for (const [id, preset] of Object.entries(row.presets ?? {})) {
+    if (isSystemPromptPreset(preset) && preset.id === id) presets[id] = preset;
   }
 
-  const models: Record<string, PromptSetting> = {};
-  for (const [key, setting] of Object.entries(row.models ?? {})) {
+  const providers: Record<string, ScopePromptRef> = {};
+  for (const [providerId, value] of Object.entries(row.providers ?? {})) {
+    const ref = normalizeScopeRef(value, true);
+    if (ref !== undefined) providers[providerId] = ref;
+  }
+
+  const models: Record<string, ScopePromptRef> = {};
+  for (const [key, value] of Object.entries(row.models ?? {})) {
     if (parseSystemPromptModelKey(key) === null) continue;
-    if (!isPromptSetting(setting)) continue;
-    models[key] = setting;
+    const ref = normalizeScopeRef(value);
+    if (ref !== undefined) models[key] = ref;
+  }
+
+  const combos: Record<string, ScopePromptRef> = {};
+  for (const [name, value] of Object.entries(row.combos ?? {})) {
+    const ref = normalizeScopeRef(value);
+    if (ref !== undefined) combos[name] = ref;
+  }
+
+  const aliases: Record<string, ScopePromptRef> = {};
+  for (const [name, value] of Object.entries(row.aliases ?? {})) {
+    const ref = normalizeScopeRef(value);
+    if (ref !== undefined) aliases[name] = ref;
   }
 
   return {
-    global: row.global !== null && isPromptSetting(row.global) ? row.global : null,
+    global: row.global !== null && isScopePromptRef(row.global) ? row.global : null,
+    presets,
     providers,
     models,
+    combos,
+    aliases,
   };
 }
 
@@ -79,12 +118,18 @@ export async function writeTenantSystemPrompts(
 ): Promise<void> {
   // Keep the row bounded even though the API already enforces the caps: a
   // direct store caller must not be able to plant an unbounded map.
+  const presets = Object.entries(next.presets).slice(0, SYSTEM_PROMPT_PRESET_LIMIT);
   const providers = Object.entries(next.providers).slice(0, SYSTEM_PROMPT_PROVIDER_LIMIT);
   const models = Object.entries(next.models).slice(0, SYSTEM_PROMPT_MODEL_LIMIT);
+  const combos = Object.entries(next.combos).slice(0, SYSTEM_PROMPT_COMBO_LIMIT);
+  const aliases = Object.entries(next.aliases).slice(0, SYSTEM_PROMPT_ALIAS_LIMIT);
   const values = {
     global: next.global,
+    presets: Object.fromEntries(presets),
     providers: Object.fromEntries(providers),
     models: Object.fromEntries(models),
+    combos: Object.fromEntries(combos),
+    aliases: Object.fromEntries(aliases),
     updatedAt: new Date(),
   };
   await db

package/src/persistence/tenant-preferences.ts

@@ -29,7 +29,7 @@ export class DrizzlePreferencesReader implements PreferencesReader {
   }
 }
 
-export interface CachedPreferencesReaderOptions {
+interface CachedPreferencesReaderOptions {
   readonly ttlMs?: number;
   readonly maxEntries?: number;
   readonly revision?: () => number;

package/src/persistence/ttl-cache.ts

@@ -7,13 +7,13 @@ import { dedupeRequest } from "../network/deduplication";
  * - Revision-aware key invalidation
  */
 
-export interface TtlCacheOptions {
+interface TtlCacheOptions {
   readonly ttlMs?: number;
   readonly maxEntries?: number;
   readonly now?: () => number;
 }
 
-export interface TtlCacheEntry<T> {
+interface TtlCacheEntry<T> {
   readonly value: T;
   readonly at: number;
 }
@@ -134,7 +134,7 @@ export class TtlCache<T> {
 }
 
 /** One TTL-sized cache inside a {@link TtlCacheFamily}. */
-export interface TtlCacheFamilyOptions {
+interface TtlCacheFamilyOptions {
   /** TTL applied when a caller does not pass its own. */
   readonly defaultTtlMs: number;
   /** Entry cap per TTL-sized cache. */

package/src/persistence/usage-flush.ts

@@ -65,14 +65,19 @@ async function writeLifetimeDeltas(
   // text and the join against a uuid key fails. SQLite stores the key as text
   // and rejects `UPDATE ... FROM (VALUES ...)` outright, so the same rows are
   // a SELECT with named columns instead.
-  const source = sqliteDialect()
+  const sqlite = sqliteDialect();
+  const source = sqlite
     ? `(${rows.map((row) => `SELECT '${row.apiKeyId}' AS id, ${row.delta} AS delta`).join(" UNION ALL ")})`
     : `(VALUES ${rows.map((row) => `('${row.apiKeyId}'::uuid, ${row.delta}::bigint)`).join(", ")}) AS v(id, delta)`;
+  // PostgreSQL already carries its alias in `source`; only the bare SQLite
+  // subquery needs the trailing alias appended. Emitting both (`AS v(id, delta) v`)
+  // is a syntax error on Postgres, so the flush silently never ran.
+  const from = sqlite ? `${source} v` : source;
   await db.execute(sql.raw(`
     UPDATE "api_keys"
     SET "lifetime_tokens_consumed" =
       COALESCE("api_keys"."lifetime_tokens_consumed", 0) + v.delta
-    FROM ${source} v
+    FROM ${from}
     WHERE "api_keys"."id" = v.id
   `));
 }

package/src/protocol/canonical-model.ts

@@ -614,7 +614,7 @@ export function hasEncryptedReasoning(parts: readonly ContentPart[]): boolean {
  * concurrent preflights would be an aliasing hazard; the memoized summary and
  * its extension set are treated as read-only.)
  */
-export interface PartSummary {
+interface PartSummary {
   readonly hasImage: boolean;
   readonly hasDocument: boolean;
   readonly hasAudio: boolean;

package/src/protocol/codecs.ts

@@ -89,7 +89,7 @@ export function hash32(input: string): number {
   return hash;
 }
 
-export const CLAUDE_TOOL_PREFIX = "_";
+const CLAUDE_TOOL_PREFIX = "_";
 
 export type ClaudeWireObject = Record<string, unknown>;
 
@@ -408,13 +408,9 @@ export function isClaudeBillingHeaderText(text: string): boolean {
 // Well-formed UTF-16 coercion
 
 export function toWellFormedString(value: string): string {
-  const maybe = value as unknown as { toWellFormed?: () => string };
-  if (typeof maybe.toWellFormed === "function") return maybe.toWellFormed();
-  // Fallback for runtimes without String.prototype.toWellFormed (replace lone surrogates)
-  return value.replace(
-    /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g,
-    "\uFFFD",
-  );
+  // String.prototype.toWellFormed is ES2024; guaranteed by Bun ≥1.4, the only
+  // supported runtime.
+  return value.toWellFormed();
 }
 
 export function toWellFormedDeep(value: unknown): unknown {
@@ -873,7 +869,7 @@ export const BARE_ROOT_ENDPOINTS: Partial<Record<WireFamily, string>> = {
 };
 
 /** An image part's provider-neutral source, resolved from any supported origin shape. */
-export interface ResolvedImageSource {
+interface ResolvedImageSource {
   /** URL or `data:` URI. Mutually usable with `fileId`. */
   url?: string;
   /** Files API reference (Chat/Responses `file_id`). */
@@ -883,7 +879,7 @@ export interface ResolvedImageSource {
 }
 
 /** An RFC 2397 base64 `data:` URL split into the media type and bytes it carries. */
-export interface DataUrlPayload {
+interface DataUrlPayload {
   /** The declared media type (the `image/png` of `data:image/png;base64,…`). */
   readonly mediaType: string;
   /** The base64 payload, with the `data:` prefix and media type removed. */

package/src/protocol/dsml.ts

@@ -24,7 +24,7 @@ export interface DsmlToolCall {
   readonly arguments: string;
 }
 
-export interface DsmlRecovery {
+interface DsmlRecovery {
   readonly calls: readonly DsmlToolCall[];
   readonly clean: string;
 }
@@ -63,7 +63,7 @@ const DEFAULT_MAX_BLOCK_BYTES = 256 * 1024;
 const TOOL_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.:-]{0,63}$/;
 
 /** Escapes regex metacharacters so a `|` separator is literal, not alternation. */
-export function escapeRegExp(value: string): string {
+function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
@@ -79,7 +79,7 @@ function uuidId(_call: { readonly name: string }, _index: number, _seq: number):
   return `call_${randomUUID().replace(/-/g, "").slice(0, 16)}`;
 }
 
-export interface DsmlParseResult {
+interface DsmlParseResult {
   readonly text: string;
   readonly calls: readonly DsmlToolCall[];
 }
@@ -306,15 +306,6 @@ function parseFuzzyDsml(text: string, options: DsmlParseOptions): DsmlRecovery {
   return { calls, clean };
 }
 
-/**
- * Recovers DSML tool calls from one plain-text string using the Qoder fuzzy
- * dialect. Always returns `{ calls, clean }` — no-DSML input returns the text
- * unchanged with no calls.
- */
-export function parseFuzzyDsmlToolCalls(text: string): DsmlRecovery {
-  return parseFuzzyDsml(text, {});
-}
-
 /**
  * Recovers DSML tool calls from one plain-text string. The dialect is chosen
  * by `options.fuzzy`; each dialect keeps its exact public shape:
@@ -338,40 +329,3 @@ export function parseDsmlToolCalls(
   const recovered = [...first.calls, ...last.calls];
   return recovered.length === 0 ? undefined : { text: `${first.text}${last.text}`.trim(), calls: recovered };
 }
-
-/**
- * The holdable tail of a content chunk: a short suffix that looks like the
- * start of a DSML tag and may finish in the next frame. Empty when there is
- * nothing worth holding. Mirrors `_dsml_tail_hold` in the reference bridge.
- */
-export function dsmlTailHold(text: string): string {
-  const at = text.lastIndexOf("<");
-  if (at < 0 || text.length - at > 24) return "";
-  const tail = text.slice(at);
-  // A complete tag already — nothing to wait for.
-  if (tail.includes(">")) return "";
-  const body = tail.replace(/\uFF5C/g, "|").toUpperCase().slice(1).replace(/^\//, "");
-  if (body.length === 0) return tail; // bare "<" or "</"
-  if (!body.startsWith("|")) return "";
-  const rest = body.slice(1);
-  if (rest.length === 0) return tail;
-  if ("DSML".startsWith(rest) || rest.startsWith("DSML")) return tail;
-  return "";
-}
-
-const DSML_CLOSE_TAG_RE = /<\/(?:[^>]*DSML[^>]*|parameter|invoke|calls|tool_calls|function_calls)\s*>\s*$/i;
-
-/**
- * Removes leftover DSML closing tags from the tail of a text. Anchored to the
- * end and looped, so several trailing tags come off one per pass; a closing
- * tag in the middle of a text is not residue and is preserved.
- */
-export function stripDsmlCloseTags(text: string): string {
-  let previous: string | null = null;
-  let out = text.trimEnd();
-  while (previous !== out) {
-    previous = out;
-    out = out.replace(DSML_CLOSE_TAG_RE, "").trimEnd();
-  }
-  return out;
-}

package/src/protocol/image-clamp.ts

@@ -69,7 +69,7 @@ export interface ImageClampInput {
   readonly maxBytesOverride?: number;
 }
 
-export interface ImageClampDecision {
+interface ImageClampDecision {
   readonly action: ImageClampAction;
   readonly reason: ImageClampReason;
   /** Longest edge allowed for this image, given how many the request carries. */
@@ -96,7 +96,7 @@ export function base64DecodedByteLength(data: string): number {
 }
 
 /** The per-image longest-edge ceiling for a request carrying `imageCount` images. */
-export function imageClampMaxDimensionPx(imageCount: number): number {
+function imageClampMaxDimensionPx(imageCount: number): number {
   return imageCount > IMAGE_CLAMP_MANY_IMAGE_COUNT
     ? IMAGE_CLAMP_MANY_IMAGE_MAX_DIMENSION_PX
     : IMAGE_CLAMP_MAX_DIMENSION_PX;

package/src/protocol/reasoning-text.ts

@@ -1,6 +1,6 @@
 /** The reasoning-shaped part this reads. Structural, so any reasoning part —
  *  including a `ContentPart` narrowed to `kind: "reasoning"` — is accepted. */
-export interface ReasoningTextSource {
+interface ReasoningTextSource {
   readonly payload?: unknown;
   readonly summary?: string;
   readonly opaque?: boolean;

package/src/protocol/reasoning.ts

@@ -1,6 +1,7 @@
 import type { CanonicalRequest, ReasoningEffort, ReasoningIntent } from "./canonical-model";
 import { budgetToLevel } from "./translation/thinking";
 import { isRecord } from "./codecs";
+import { DEEPSEEK_DEFAULT_EFFORT } from "./translation/dialect/thinking-ladder";
 
 /**
  * The effective reasoning effort for a canonical intent, deriving one from an
@@ -47,7 +48,7 @@ export function applyDeepSeekReasoning(payload: Record<string, unknown>): void {
   if (thinking === undefined) payload["thinking"] = { type: "enabled" };
   else if (type.length === 0) thinking["type"] = "enabled";
   if (typeof payload["reasoning_effort"] !== "string" || payload["reasoning_effort"].length === 0)
-    payload["reasoning_effort"] = "high";
+    payload["reasoning_effort"] = DEEPSEEK_DEFAULT_EFFORT;
 }
 
 /**
@@ -151,59 +152,13 @@ export function geminiThinkingOutputFloor(reasoning: CanonicalRequest["reasoning
 
 /**
  * Minimum output budget for a caller whose requested effort the ladder could
- * not serve as asked.
+ * not serve as asked. See the module doc for why both clamp directions need it.
+ * Only ever raises, and only to the model's own catalog limit.
  *
- * A wire ladder can only serve levels the upstream accepts, so a request for
- * `low` may be clamped up to whatever that model offers — `hy4-preview-f`
- * serves `high` and nothing else — and a request for `max` may be clamped down
- * to it. Either way the caller sized `max_tokens` for the effort it asked for,
- * and effort is not free: the applied level spends its budget on reasoning
- * before it writes the answer, so an answer that fit in 2048 tokens of visible
- * text no longer fits once the reasoning share is taken out of the same 2048.
- *
- * Both directions need the floor, because the mismatch is what costs tokens,
- * not its sign. A caller who asked for `max` with a 2048-token answer in mind
- * is owed the same headroom as one who asked for `low`: the applied level is
- * `high` either way, and `high` reasons out of that 2048 regardless.
- *
- * The symptom this removes is a truncated answer that an agent retries from
- * the top — reading as a loop ("let me do / let me go / let me do it") rather
- * than as a short limit.
- *
- * Only ever raises, and only to the model's own catalog limit: a caller whose
- * effort was served exactly as asked keeps its number, and no provider is
- * asked for more output than it declares.
+ * Re-exported from `translation/dialect/model-thinking` (the canonical helper);
+ * this shim keeps existing importers (e.g. buddy-chat-shared) stable.
  */
-export function clampedEffortOutputFloor(
-  requested: string | undefined,
-  applied: string | undefined,
-  modelOutputLimit: number | undefined,
-): number | undefined {
-  if (requested === undefined || applied === undefined) return undefined;
-  const from = BUDDY_LEVEL_RANK[requested.trim().toLowerCase()];
-  const to = BUDDY_LEVEL_RANK[applied.trim().toLowerCase()];
-  if (from === undefined || to === undefined || from === to) return undefined;
-  if (modelOutputLimit === undefined || !Number.isFinite(modelOutputLimit) || modelOutputLimit <= 0)
-    return undefined;
-  // Leave headroom instead of claiming the whole catalog limit: the caller's
-  // number was a real preference about answer size, and the goal is to stop
-  // truncating, not to spend the model's ceiling on every turn.
-  return Math.max(CLAMPED_EFFORT_MIN_OUTPUT_TOKENS, Math.floor(modelOutputLimit / 2));
-}
-
-const CLAMPED_EFFORT_MIN_OUTPUT_TOKENS = 16_384;
-
-const BUDDY_LEVEL_RANK: Readonly<Record<string, number>> = {
-  off: 0,
-  none: 0,
-  instant: 1,
-  minimal: 2,
-  low: 3,
-  medium: 4,
-  high: 5,
-  xhigh: 6,
-  max: 7,
-};
+export { outputFloorFor as clampedEffortOutputFloor } from "./translation/dialect/model-thinking";
 
 /** Builds the Anthropic thinking block from canonical reasoning intent. */
 export function buildAnthropicThinkingPayload(reasoning: ReasoningIntent): Record<string, unknown> {