cartethyia 2.7.4 → 2.7.6

package/src/persistence/stores/share-store.ts

@@ -7,7 +7,7 @@ import { createHash, randomBytes, randomInt } from "node:crypto";
 import { and, desc, eq, isNull, or, sql, type SQL } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../db-handle";
 import { lockRows } from "../dialect";
-import { apiKeys, shareLinks, sharePopups, type ShareLinkKind, type ApiKeyModelAccessMode } from "../schema";
+import { apiKeys, shareLinks, sharePopups, type ShareLinkKind, type ApiKeyModelAccessMode, type ApiKeyConcurrencyScope } from "../schema";
 
 /** Hashes a share bearer token for storage and lookup. */
 /**
@@ -38,7 +38,7 @@ function addressMatches(address: string): SQL {
 }
 
 /** Newly created share-link metadata. */
-export interface ShareLinkRecord {
+interface ShareLinkRecord {
   readonly id: string;
   readonly apiKeyId: string;
   readonly kind: ShareLinkKind;
@@ -61,7 +61,7 @@ export interface ShareLinkSummary {
 }
 
 /** A stable link's encrypted token, or null when it predates token retention. */
-export interface ShareLinkToken {
+interface ShareLinkToken {
   readonly id: string;
   readonly apiKeyId: string;
   readonly kind: ShareLinkKind;
@@ -86,6 +86,7 @@ export interface ShareLinkPolicy {
   readonly monthlyTokenLimit: number | null;
   readonly lifetimeTokenBudget: number | null;
   readonly maxConcurrentRequests: number | null;
+  readonly concurrencyScope: ApiKeyConcurrencyScope;
   readonly modelAccessMode: ApiKeyModelAccessMode | null;
   readonly modelList: readonly string[] | null;
   readonly modelPrefix: string | null;
@@ -102,13 +103,13 @@ export interface ShareLinkPolicy {
 }
 
 /** Public template fields authorized for a valid enrollment-link lookup. */
-export interface ShareApiKeyRow extends ShareLinkPolicy {
+interface ShareApiKeyRow extends ShareLinkPolicy {
   readonly active: boolean;
   readonly createdAt: string;
 }
 
 /** A personal key revealed by its handoff link. */
-export interface ShareHandoffRow extends ShareLinkPolicy {
+interface ShareHandoffRow extends ShareLinkPolicy {
   /** Encrypted personal credential; null when the row predates secret storage. */
   readonly keyEncrypted: Buffer | null;
 }
@@ -118,7 +119,7 @@ export interface ShareHandoffRow extends ShareLinkPolicy {
  * public lookup answers with a discriminated result instead of the caller
  * guessing which endpoint to try.
  */
-export type ShareLinkResolution =
+type ShareLinkResolution =
   | { readonly kind: "enroll"; readonly key: ShareApiKeyRow }
   | { readonly kind: "handoff"; readonly key: ShareHandoffRow };
 
@@ -136,7 +137,7 @@ export type ShareLinkOutcome =
   | { readonly ok: true; readonly resolution: ShareLinkResolution }
   | { readonly ok: false; readonly refusal: ShareLinkRefusal };
 
-export interface SharedApiKeyMaterial {
+interface SharedApiKeyMaterial {
   readonly keyHash: string;
   readonly keyPrefix: string;
   readonly clientIp: string;
@@ -145,7 +146,7 @@ export interface SharedApiKeyMaterial {
   readonly nameHint?: string;
 }
 
-export type SharedApiKeyIssueResult =
+type SharedApiKeyIssueResult =
   | {
       readonly kind: "issued";
       readonly apiKeyId: string;
@@ -185,6 +186,7 @@ function mapShareRow(key: ApiKeyRow, link: ShareLinkRow, popup?: PopupRow): Shar
     monthlyTokenLimit: key.monthlyTokenLimit,
     lifetimeTokenBudget: key.lifetimeTokenBudget,
     maxConcurrentRequests: key.maxConcurrentRequests,
+    concurrencyScope: key.concurrencyScope ?? "family",
     modelAccessMode: key.modelAccessMode as ApiKeyModelAccessMode | null,
     modelList: key.modelList as readonly string[] | null,
     modelPrefix: key.modelPrefix,
@@ -213,6 +215,7 @@ function mapHandoffRow(key: ApiKeyRow, link: ShareLinkRow, popup?: PopupRow): Sh
     monthlyTokenLimit: key.monthlyTokenLimit,
     lifetimeTokenBudget: key.lifetimeTokenBudget,
     maxConcurrentRequests: key.maxConcurrentRequests,
+    concurrencyScope: key.concurrencyScope ?? "family",
     modelAccessMode: key.modelAccessMode as ApiKeyModelAccessMode | null,
     modelList: key.modelList as readonly string[] | null,
     modelPrefix: key.modelPrefix,
@@ -557,6 +560,12 @@ export class DrizzleShareLinkStore implements ShareLinkStore {
       // Nullable policy columns stay NULL; `model_access_mode` takes its
       // NOT NULL default ('whitelist'). Keep in sync with migration 0029 and
       // `normalizeShareChildPolicy` in `src/console/backup/store.ts`.
+      //
+      // Exception: a template with `concurrencyScope: "per_key"` lets each
+      // recipient carry its own concurrency cap, so the cap is copied to the
+      // child at issue (the child's admission identity is its own id, not the
+      // parent's). The `family` default keeps child caps NULL — they inherit
+      // the parent's cap through auth.
       const [child] = await tx
         .insert(apiKeys)
         .values({
@@ -571,6 +580,9 @@ export class DrizzleShareLinkStore implements ShareLinkStore {
           keyPrefix: material.keyPrefix,
           keyEncrypted: null,
           lifetimeTokensConsumed: 0,
+          ...(parent.concurrencyScope === "per_key"
+            ? { concurrencyScope: "per_key" as const, maxConcurrentRequests: parent.maxConcurrentRequests }
+            : {}),
         })
         .returning({ id: apiKeys.id, tenantId: apiKeys.tenantId, createdAt: apiKeys.createdAt });
       if (!child) throw new Error("shared API-key insert returned no row");

package/src/persistence/system-prompt-store.ts

@@ -7,15 +7,20 @@ import { eq } from "drizzle-orm";
 import type { CartethyiaDatabase } from "./db-handle";
 import { tenantSystemPrompts } from "./schema";
 import type {
-  ProviderPromptEntry,
-  PromptSetting,
+  ScopePromptRef,
+  SystemPromptPreset,
   TenantSystemPrompts,
 } from "../console/system-prompt/contracts";
 import {
   EMPTY_TENANT_SYSTEM_PROMPTS,
+  SYSTEM_PROMPT_ALIAS_LIMIT,
+  SYSTEM_PROMPT_COMBO_LIMIT,
   SYSTEM_PROMPT_MODEL_LIMIT,
+  SYSTEM_PROMPT_PRESET_LIMIT,
   SYSTEM_PROMPT_PROVIDER_LIMIT,
   isPromptSetting,
+  isScopePromptRef,
+  isSystemPromptPreset,
   parseSystemPromptModelKey,
 } from "../console/system-prompt/contracts";
 import { bumpSettingsRevision } from "./settings-revision";
@@ -23,6 +28,24 @@ import { bumpSettingsRevision } from "./settings-revision";
 /** The stored row, normalized. Absent row reads as the empty configuration. */
 export type StoredTenantSystemPrompts = TenantSystemPrompts;
 
+/**
+ * Normalizes one scope reference value. Accepts the new `{ kind, ... }` shape
+ * and the legacy per-provider entry shape (`{ followGlobal, setting? }`) so a
+ * hand-edited or pre-migration row stays valid. Invalid values become
+ * `undefined` (the caller drops the key).
+ */
+function normalizeScopeRef(value: unknown, legacyProviderEntry?: boolean): ScopePromptRef | undefined {
+  if (isScopePromptRef(value)) return value;
+  if (legacyProviderEntry && typeof value === "object" && value !== null) {
+    const candidate = value as { followGlobal?: unknown; setting?: unknown };
+    if (candidate.followGlobal === true) return { kind: "global" };
+    if (candidate.followGlobal === false && isPromptSetting(candidate.setting)) {
+      return { kind: "custom", setting: candidate.setting };
+    }
+  }
+  return undefined;
+}
+
 /**
  * Reads the tenant's stored configuration, defensively normalized: a
  * hand-edited or legacy row must not poison the dispatch path, so malformed
@@ -35,8 +58,11 @@ export async function readTenantSystemPrompts(
   const rows = await db
     .select({
       global: tenantSystemPrompts.global,
+      presets: tenantSystemPrompts.presets,
       providers: tenantSystemPrompts.providers,
       models: tenantSystemPrompts.models,
+      combos: tenantSystemPrompts.combos,
+      aliases: tenantSystemPrompts.aliases,
     })
     .from(tenantSystemPrompts)
     .where(eq(tenantSystemPrompts.tenantId, tenantId))
@@ -44,30 +70,43 @@ export async function readTenantSystemPrompts(
   const row = rows[0];
   if (row === undefined) return EMPTY_TENANT_SYSTEM_PROMPTS;
 
-  const providers: Record<string, ProviderPromptEntry> = {};
-  for (const [providerId, entry] of Object.entries(row.providers ?? {})) {
-    if (typeof entry !== "object" || entry === null) continue;
-    const candidate = entry as Partial<ProviderPromptEntry>;
-    if (typeof candidate.followGlobal !== "boolean") continue;
-    if (candidate.followGlobal === false) {
-      if (!isPromptSetting(candidate.setting)) continue;
-      providers[providerId] = { followGlobal: false, setting: candidate.setting };
-    } else {
-      providers[providerId] = { followGlobal: true };
-    }
+  const presets: Record<string, SystemPromptPreset> = {};
+  for (const [id, preset] of Object.entries(row.presets ?? {})) {
+    if (isSystemPromptPreset(preset) && preset.id === id) presets[id] = preset;
   }
 
-  const models: Record<string, PromptSetting> = {};
-  for (const [key, setting] of Object.entries(row.models ?? {})) {
+  const providers: Record<string, ScopePromptRef> = {};
+  for (const [providerId, value] of Object.entries(row.providers ?? {})) {
+    const ref = normalizeScopeRef(value, true);
+    if (ref !== undefined) providers[providerId] = ref;
+  }
+
+  const models: Record<string, ScopePromptRef> = {};
+  for (const [key, value] of Object.entries(row.models ?? {})) {
     if (parseSystemPromptModelKey(key) === null) continue;
-    if (!isPromptSetting(setting)) continue;
-    models[key] = setting;
+    const ref = normalizeScopeRef(value);
+    if (ref !== undefined) models[key] = ref;
+  }
+
+  const combos: Record<string, ScopePromptRef> = {};
+  for (const [name, value] of Object.entries(row.combos ?? {})) {
+    const ref = normalizeScopeRef(value);
+    if (ref !== undefined) combos[name] = ref;
+  }
+
+  const aliases: Record<string, ScopePromptRef> = {};
+  for (const [name, value] of Object.entries(row.aliases ?? {})) {
+    const ref = normalizeScopeRef(value);
+    if (ref !== undefined) aliases[name] = ref;
   }
 
   return {
-    global: row.global !== null && isPromptSetting(row.global) ? row.global : null,
+    global: row.global !== null && isScopePromptRef(row.global) ? row.global : null,
+    presets,
     providers,
     models,
+    combos,
+    aliases,
   };
 }
 
@@ -79,12 +118,18 @@ export async function writeTenantSystemPrompts(
 ): Promise<void> {
   // Keep the row bounded even though the API already enforces the caps: a
   // direct store caller must not be able to plant an unbounded map.
+  const presets = Object.entries(next.presets).slice(0, SYSTEM_PROMPT_PRESET_LIMIT);
   const providers = Object.entries(next.providers).slice(0, SYSTEM_PROMPT_PROVIDER_LIMIT);
   const models = Object.entries(next.models).slice(0, SYSTEM_PROMPT_MODEL_LIMIT);
+  const combos = Object.entries(next.combos).slice(0, SYSTEM_PROMPT_COMBO_LIMIT);
+  const aliases = Object.entries(next.aliases).slice(0, SYSTEM_PROMPT_ALIAS_LIMIT);
   const values = {
     global: next.global,
+    presets: Object.fromEntries(presets),
     providers: Object.fromEntries(providers),
     models: Object.fromEntries(models),
+    combos: Object.fromEntries(combos),
+    aliases: Object.fromEntries(aliases),
     updatedAt: new Date(),
   };
   await db

package/src/persistence/tenant-preferences.ts

@@ -29,7 +29,7 @@ export class DrizzlePreferencesReader implements PreferencesReader {
   }
 }
 
-export interface CachedPreferencesReaderOptions {
+interface CachedPreferencesReaderOptions {
   readonly ttlMs?: number;
   readonly maxEntries?: number;
   readonly revision?: () => number;

package/src/persistence/ttl-cache.ts

@@ -7,13 +7,13 @@ import { dedupeRequest } from "../network/deduplication";
  * - Revision-aware key invalidation
  */
 
-export interface TtlCacheOptions {
+interface TtlCacheOptions {
   readonly ttlMs?: number;
   readonly maxEntries?: number;
   readonly now?: () => number;
 }
 
-export interface TtlCacheEntry<T> {
+interface TtlCacheEntry<T> {
   readonly value: T;
   readonly at: number;
 }
@@ -134,7 +134,7 @@ export class TtlCache<T> {
 }
 
 /** One TTL-sized cache inside a {@link TtlCacheFamily}. */
-export interface TtlCacheFamilyOptions {
+interface TtlCacheFamilyOptions {
   /** TTL applied when a caller does not pass its own. */
   readonly defaultTtlMs: number;
   /** Entry cap per TTL-sized cache. */

package/src/persistence/usage-flush.ts

@@ -65,14 +65,19 @@ async function writeLifetimeDeltas(
   // text and the join against a uuid key fails. SQLite stores the key as text
   // and rejects `UPDATE ... FROM (VALUES ...)` outright, so the same rows are
   // a SELECT with named columns instead.
-  const source = sqliteDialect()
+  const sqlite = sqliteDialect();
+  const source = sqlite
     ? `(${rows.map((row) => `SELECT '${row.apiKeyId}' AS id, ${row.delta} AS delta`).join(" UNION ALL ")})`
     : `(VALUES ${rows.map((row) => `('${row.apiKeyId}'::uuid, ${row.delta}::bigint)`).join(", ")}) AS v(id, delta)`;
+  // PostgreSQL already carries its alias in `source`; only the bare SQLite
+  // subquery needs the trailing alias appended. Emitting both (`AS v(id, delta) v`)
+  // is a syntax error on Postgres, so the flush silently never ran.
+  const from = sqlite ? `${source} v` : source;
   await db.execute(sql.raw(`
     UPDATE "api_keys"
     SET "lifetime_tokens_consumed" =
       COALESCE("api_keys"."lifetime_tokens_consumed", 0) + v.delta
-    FROM ${source} v
+    FROM ${from}
     WHERE "api_keys"."id" = v.id
   `));
 }

package/src/protocol/canonical-model.ts

@@ -614,7 +614,7 @@ export function hasEncryptedReasoning(parts: readonly ContentPart[]): boolean {
  * concurrent preflights would be an aliasing hazard; the memoized summary and
  * its extension set are treated as read-only.)
  */
-export interface PartSummary {
+interface PartSummary {
   readonly hasImage: boolean;
   readonly hasDocument: boolean;
   readonly hasAudio: boolean;

package/src/protocol/codecs.ts

@@ -89,7 +89,7 @@ export function hash32(input: string): number {
   return hash;
 }
 
-export const CLAUDE_TOOL_PREFIX = "_";
+const CLAUDE_TOOL_PREFIX = "_";
 
 export type ClaudeWireObject = Record<string, unknown>;
 
@@ -408,13 +408,9 @@ export function isClaudeBillingHeaderText(text: string): boolean {
 // Well-formed UTF-16 coercion
 
 export function toWellFormedString(value: string): string {
-  const maybe = value as unknown as { toWellFormed?: () => string };
-  if (typeof maybe.toWellFormed === "function") return maybe.toWellFormed();
-  // Fallback for runtimes without String.prototype.toWellFormed (replace lone surrogates)
-  return value.replace(
-    /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g,
-    "\uFFFD",
-  );
+  // String.prototype.toWellFormed is ES2024; guaranteed by Bun ≥1.4, the only
+  // supported runtime.
+  return value.toWellFormed();
 }
 
 export function toWellFormedDeep(value: unknown): unknown {
@@ -873,7 +869,7 @@ export const BARE_ROOT_ENDPOINTS: Partial<Record<WireFamily, string>> = {
 };
 
 /** An image part's provider-neutral source, resolved from any supported origin shape. */
-export interface ResolvedImageSource {
+interface ResolvedImageSource {
   /** URL or `data:` URI. Mutually usable with `fileId`. */
   url?: string;
   /** Files API reference (Chat/Responses `file_id`). */
@@ -883,7 +879,7 @@ export interface ResolvedImageSource {
 }
 
 /** An RFC 2397 base64 `data:` URL split into the media type and bytes it carries. */
-export interface DataUrlPayload {
+interface DataUrlPayload {
   /** The declared media type (the `image/png` of `data:image/png;base64,…`). */
   readonly mediaType: string;
   /** The base64 payload, with the `data:` prefix and media type removed. */

package/src/protocol/dsml.ts

@@ -3,28 +3,18 @@
  *
  * DeepSeek-family models occasionally write their tool calls as XML-like DSML
  * markup inside the plain-text content stream instead of the structured
- * `tool_calls` field. Two upstream families in this gateway see it:
+ * `tool_calls` field. The gateway sees it from one upstream family:
  *
  * - CodeBuddy/WorkBuddy emit strict blocks (`<｜DSML｜ calls>…</｜DSML｜ calls>`)
  *   that must be parsed exactly, with declared-tool allowlisting.
- * - Qoder emits looser blocks (`<[^>]*DSML[^>]*calls>…`) that tolerate any
- *   intermediate characters in the tag, and its parameter values are plain
- *   strings.
- *
- * The two share the same recovery idea, so the mechanics live here once and
- * each caller picks its dialect through options. The defaults reproduce the
- * CodeBuddy dialect exactly (`app/dsml.py` in codebuddy2api); Qoder passes
- * `fuzzy: true` and its id factory, mirroring `qoder_proxy.py`.
  */
-import { randomUUID } from "node:crypto";
-
 export interface DsmlToolCall {
   readonly id: string;
   readonly name: string;
   readonly arguments: string;
 }
 
-export interface DsmlRecovery {
+interface DsmlRecovery {
   readonly calls: readonly DsmlToolCall[];
   readonly clean: string;
 }
@@ -34,19 +24,15 @@ export interface DsmlParseOptions {
   readonly separators?: readonly string[];
   /** Block names a strict opener may name. */
   readonly blockNames?: readonly string[];
-  /** When true, match the Qoder fuzzy form (`<[^>]*DSML[^>]*…`). */
-  readonly fuzzy?: boolean;
-  /** How parameter values decode: `json` (CodeBuddy) or `string` (Qoder). */
+  /** How parameter values decode: `json` (CodeBuddy) or `string`. */
   readonly params?: "json" | "string";
-  /** Call id factory. Defaults to sequential for strict, uuid for fuzzy. */
+  /** Call id factory. Defaults to sequential. */
   readonly id?: (call: { readonly name: string }, index: number, seq: number) => string;
   /** Non-empty allowlist makes the strict dialect reject undeclared names. */
   readonly allowedNames?: ReadonlySet<string>;
   /**
    * When true, JSON stringifies argument objects with recursively sorted keys,
-   * matching the reference bridge (`json.dumps(..., sort_keys=True)`). The
-   * strict dialect defaults to true; the fuzzy dialect never sorts, matching
-   * its reference's `json.dumps(params)`.
+   * matching the reference bridge (`json.dumps(..., sort_keys=True)`).
    */
   readonly sortKeys?: boolean;
   /**
@@ -63,7 +49,7 @@ const DEFAULT_MAX_BLOCK_BYTES = 256 * 1024;
 const TOOL_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.:-]{0,63}$/;
 
 /** Escapes regex metacharacters so a `|` separator is literal, not alternation. */
-export function escapeRegExp(value: string): string {
+function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
@@ -75,11 +61,7 @@ function sequentialId(_call: { readonly name: string }, _index: number, seq: num
   return `call_dsml_${seq}_${_call.name}`;
 }
 
-function uuidId(_call: { readonly name: string }, _index: number, _seq: number): string {
-  return `call_${randomUUID().replace(/-/g, "").slice(0, 16)}`;
-}
-
-export interface DsmlParseResult {
+interface DsmlParseResult {
   readonly text: string;
   readonly calls: readonly DsmlToolCall[];
 }
@@ -257,72 +239,11 @@ function normalizeForSort(value: unknown): unknown {
   return out;
 }
 
-/** The Qoder fuzzy block scanner, mirroring the reference bridge's regexes. */
-const FUZZY_CALLS_RE = /<[^>]*DSML[^>]*calls>([\s\S]*?)<\/[^>]*DSML[^>]*calls>/;
-const FUZZY_INVOKE_RE = /<[^>]*DSML[^>]*invoke\s+name=["']([^"']+)["']>([\s\S]*?)<\/[^>]*invoke>/g;
-const FUZZY_PARAM_RE = /<[^>]*DSML[^>]*parameter\s+name=["']([^"']+)["'][^>]*>([\s\S]*?)<\/[^>]*parameter>/g;
-
-function parseFuzzyDsml(text: string, options: DsmlParseOptions): DsmlRecovery {
-  const id = options.id ?? uuidId;
-  if (text.length === 0 || !text.includes("DSML")) return { calls: [], clean: text };
-
-  const callsMatch = FUZZY_CALLS_RE.exec(text);
-  let block: string;
-  let clean: string;
-
-  if (callsMatch) {
-    block = callsMatch[1] ?? "";
-    const before = text.slice(0, callsMatch.index).trimEnd();
-    const after = text.slice(callsMatch.index + callsMatch[0].length).trimStart();
-    clean = (before + " " + after).trim();
-  } else {
-    // No <calls> wrapper (issue #51): find bare <invoke> blocks in the whole
-    // text, then cut the prose off at the last `<` before the first invoke —
-    // exclusive of the invoke's own tag start, exactly like the reference's
-    // `text.rfind("<", 0, first_index)`.
-    FUZZY_INVOKE_RE.lastIndex = 0;
-    const first = FUZZY_INVOKE_RE.exec(text);
-    if (!first) return { calls: [], clean: text };
-    block = text;
-    const cut = text.lastIndexOf("<", first.index - 1);
-    clean = text.slice(0, cut >= 0 ? cut : first.index).trim();
-  }
-
-  const calls: DsmlToolCall[] = [];
-  FUZZY_INVOKE_RE.lastIndex = 0;
-  let inv: RegExpExecArray | null;
-  let seq = 0;
-  while ((inv = FUZZY_INVOKE_RE.exec(block)) !== null) {
-    const params: Record<string, string> = {};
-    FUZZY_PARAM_RE.lastIndex = 0;
-    let par: RegExpExecArray | null;
-    while ((par = FUZZY_PARAM_RE.exec(inv[2] ?? "")) !== null) {
-      params[par[1] ?? ""] = (par[2] ?? "").trim();
-    }
-    const call = { name: inv[1] ?? "", arguments: JSON.stringify(params) };
-    calls.push({ ...call, id: id(call, calls.length, seq++) });
-  }
-
-  return { calls, clean };
-}
-
 /**
- * Recovers DSML tool calls from one plain-text string using the Qoder fuzzy
- * dialect. Always returns `{ calls, clean }` — no-DSML input returns the text
- * unchanged with no calls.
- */
-export function parseFuzzyDsmlToolCalls(text: string): DsmlRecovery {
-  return parseFuzzyDsml(text, {});
-}
-
-/**
- * Recovers DSML tool calls from one plain-text string. The dialect is chosen
- * by `options.fuzzy`; each dialect keeps its exact public shape:
+ * Recovers DSML tool calls from one plain-text string.
  *
  * - strict (CodeBuddy): returns `{ text, calls }`, with `text` the clean
  *   prose; `undefined` when nothing was recovered.
- * - fuzzy (Qoder): returns `{ clean, calls }`, with no-DSML input returning
- *   `{ calls: [], clean: text }`.
  *
  * Callers that need the streaming strict parser use {@link DsmlStreamParser}.
  */
@@ -330,7 +251,6 @@ export function parseDsmlToolCalls(
   text: string,
   options: DsmlParseOptions = {},
 ): DsmlRecovery | DsmlParseResult | undefined {
-  if (options.fuzzy === true) return parseFuzzyDsml(text, options);
   if (!text.includes("DSML")) return undefined;
   const parser = new DsmlStreamParser(options);
   const first = parser.push(text);
@@ -338,40 +258,3 @@ export function parseDsmlToolCalls(
   const recovered = [...first.calls, ...last.calls];
   return recovered.length === 0 ? undefined : { text: `${first.text}${last.text}`.trim(), calls: recovered };
 }
-
-/**
- * The holdable tail of a content chunk: a short suffix that looks like the
- * start of a DSML tag and may finish in the next frame. Empty when there is
- * nothing worth holding. Mirrors `_dsml_tail_hold` in the reference bridge.
- */
-export function dsmlTailHold(text: string): string {
-  const at = text.lastIndexOf("<");
-  if (at < 0 || text.length - at > 24) return "";
-  const tail = text.slice(at);
-  // A complete tag already — nothing to wait for.
-  if (tail.includes(">")) return "";
-  const body = tail.replace(/\uFF5C/g, "|").toUpperCase().slice(1).replace(/^\//, "");
-  if (body.length === 0) return tail; // bare "<" or "</"
-  if (!body.startsWith("|")) return "";
-  const rest = body.slice(1);
-  if (rest.length === 0) return tail;
-  if ("DSML".startsWith(rest) || rest.startsWith("DSML")) return tail;
-  return "";
-}
-
-const DSML_CLOSE_TAG_RE = /<\/(?:[^>]*DSML[^>]*|parameter|invoke|calls|tool_calls|function_calls)\s*>\s*$/i;
-
-/**
- * Removes leftover DSML closing tags from the tail of a text. Anchored to the
- * end and looped, so several trailing tags come off one per pass; a closing
- * tag in the middle of a text is not residue and is preserved.
- */
-export function stripDsmlCloseTags(text: string): string {
-  let previous: string | null = null;
-  let out = text.trimEnd();
-  while (previous !== out) {
-    previous = out;
-    out = out.replace(DSML_CLOSE_TAG_RE, "").trimEnd();
-  }
-  return out;
-}

package/src/protocol/image-clamp.ts

@@ -69,7 +69,7 @@ export interface ImageClampInput {
   readonly maxBytesOverride?: number;
 }
 
-export interface ImageClampDecision {
+interface ImageClampDecision {
   readonly action: ImageClampAction;
   readonly reason: ImageClampReason;
   /** Longest edge allowed for this image, given how many the request carries. */
@@ -96,7 +96,7 @@ export function base64DecodedByteLength(data: string): number {
 }
 
 /** The per-image longest-edge ceiling for a request carrying `imageCount` images. */
-export function imageClampMaxDimensionPx(imageCount: number): number {
+function imageClampMaxDimensionPx(imageCount: number): number {
   return imageCount > IMAGE_CLAMP_MANY_IMAGE_COUNT
     ? IMAGE_CLAMP_MANY_IMAGE_MAX_DIMENSION_PX
     : IMAGE_CLAMP_MAX_DIMENSION_PX;

package/src/protocol/reasoning-text.ts

@@ -1,6 +1,6 @@
 /** The reasoning-shaped part this reads. Structural, so any reasoning part —
  *  including a `ContentPart` narrowed to `kind: "reasoning"` — is accepted. */
-export interface ReasoningTextSource {
+interface ReasoningTextSource {
   readonly payload?: unknown;
   readonly summary?: string;
   readonly opaque?: boolean;

package/src/protocol/reasoning.ts

@@ -1,6 +1,7 @@
 import type { CanonicalRequest, ReasoningEffort, ReasoningIntent } from "./canonical-model";
 import { budgetToLevel } from "./translation/thinking";
 import { isRecord } from "./codecs";
+import { DEEPSEEK_DEFAULT_EFFORT } from "./translation/dialect/thinking-ladder";
 
 /**
  * The effective reasoning effort for a canonical intent, deriving one from an
@@ -47,7 +48,7 @@ export function applyDeepSeekReasoning(payload: Record<string, unknown>): void {
   if (thinking === undefined) payload["thinking"] = { type: "enabled" };
   else if (type.length === 0) thinking["type"] = "enabled";
   if (typeof payload["reasoning_effort"] !== "string" || payload["reasoning_effort"].length === 0)
-    payload["reasoning_effort"] = "high";
+    payload["reasoning_effort"] = DEEPSEEK_DEFAULT_EFFORT;
 }
 
 /**
@@ -151,59 +152,13 @@ export function geminiThinkingOutputFloor(reasoning: CanonicalRequest["reasoning
 
 /**
  * Minimum output budget for a caller whose requested effort the ladder could
- * not serve as asked.
+ * not serve as asked. See the module doc for why both clamp directions need it.
+ * Only ever raises, and only to the model's own catalog limit.
  *
- * A wire ladder can only serve levels the upstream accepts, so a request for
- * `low` may be clamped up to whatever that model offers — `hy4-preview-f`
- * serves `high` and nothing else — and a request for `max` may be clamped down
- * to it. Either way the caller sized `max_tokens` for the effort it asked for,
- * and effort is not free: the applied level spends its budget on reasoning
- * before it writes the answer, so an answer that fit in 2048 tokens of visible
- * text no longer fits once the reasoning share is taken out of the same 2048.
- *
- * Both directions need the floor, because the mismatch is what costs tokens,
- * not its sign. A caller who asked for `max` with a 2048-token answer in mind
- * is owed the same headroom as one who asked for `low`: the applied level is
- * `high` either way, and `high` reasons out of that 2048 regardless.
- *
- * The symptom this removes is a truncated answer that an agent retries from
- * the top — reading as a loop ("let me do / let me go / let me do it") rather
- * than as a short limit.
- *
- * Only ever raises, and only to the model's own catalog limit: a caller whose
- * effort was served exactly as asked keeps its number, and no provider is
- * asked for more output than it declares.
+ * Re-exported from `translation/dialect/model-thinking` (the canonical helper);
+ * this shim keeps existing importers (e.g. buddy-chat-shared) stable.
  */
-export function clampedEffortOutputFloor(
-  requested: string | undefined,
-  applied: string | undefined,
-  modelOutputLimit: number | undefined,
-): number | undefined {
-  if (requested === undefined || applied === undefined) return undefined;
-  const from = BUDDY_LEVEL_RANK[requested.trim().toLowerCase()];
-  const to = BUDDY_LEVEL_RANK[applied.trim().toLowerCase()];
-  if (from === undefined || to === undefined || from === to) return undefined;
-  if (modelOutputLimit === undefined || !Number.isFinite(modelOutputLimit) || modelOutputLimit <= 0)
-    return undefined;
-  // Leave headroom instead of claiming the whole catalog limit: the caller's
-  // number was a real preference about answer size, and the goal is to stop
-  // truncating, not to spend the model's ceiling on every turn.
-  return Math.max(CLAMPED_EFFORT_MIN_OUTPUT_TOKENS, Math.floor(modelOutputLimit / 2));
-}
-
-const CLAMPED_EFFORT_MIN_OUTPUT_TOKENS = 16_384;
-
-const BUDDY_LEVEL_RANK: Readonly<Record<string, number>> = {
-  off: 0,
-  none: 0,
-  instant: 1,
-  minimal: 2,
-  low: 3,
-  medium: 4,
-  high: 5,
-  xhigh: 6,
-  max: 7,
-};
+export { outputFloorFor as clampedEffortOutputFloor } from "./translation/dialect/model-thinking";
 
 /** Builds the Anthropic thinking block from canonical reasoning intent. */
 export function buildAnthropicThinkingPayload(reasoning: ReasoningIntent): Record<string, unknown> {