dsh-model-groups 0.3.7 → 0.3.9

package/native/pi-ai.patch.json

@@ -3,8 +3,369 @@
   "packageName": "@deepseek-ai/dsh-llm-pi-ai",
   "target": "node_modules/@deepseek-ai/dsh-llm-pi-ai/lib/index.js",
   "baseSha256": "070c839e2c00e2d5f7c5d82307ca3d84dbb2323e46979daf265908751bbe8ae8",
-  "resultSha256": "7c234a4d68794ee54112583c4d4bfaf7c9819b9227c3149f58fa7584883c7aff",
+  "resultSha256": "7c91a878438fd82f047e365a07235aa0aabd62fb749a1bc0292fef91e0f16809",
   "variants": [
+    {
+      "source": "multi-key revision before per-entry API overrides",
+      "baseSha256": "070c839e2c00e2d5f7c5d82307ca3d84dbb2323e46979daf265908751bbe8ae8",
+      "resultSha256": "bd5b251b3d1d8441ee7aa552b537d0331b3f8f78c0f9f26f3b5035e5a36fe5ed",
+      "replacements": [
+        {
+          "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
+          "after": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\n// Model selection carries an opaque entry identity, never a credential or a wire alias.\nconst KEY_MODEL_PREFIX = \"@dsh-key/\";\nconst KEY_ENTRY_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/;\nconst FORBIDDEN_KEY_ENTRY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst AUTH_HEADER_NAMES = new Set([\"authorization\", \"proxy-authorization\", \"x-api-key\", \"api-key\", \"cf-aig-authorization\"]);\nfunction validKeyEntryId(id) {\n\treturn KEY_ENTRY_ID.test(id) && !FORBIDDEN_KEY_ENTRY_IDS.has(id);\n}\nfunction keyModelId(entryId, model) {\n\treturn `${KEY_MODEL_PREFIX}${encodeURIComponent(entryId)}/${encodeURIComponent(model)}`;\n}\nfunction keyModelRoute(model) {\n\tif (!model.startsWith(KEY_MODEL_PREFIX)) return void 0;\n\ttry {\n\t\tconst parts = model.slice(KEY_MODEL_PREFIX.length).split(\"/\");\n\t\tif (parts.length === 2) {\n\t\t\tconst entryId = decodeURIComponent(parts[0]);\n\t\t\tconst wireModel = decodeURIComponent(parts[1]);\n\t\t\tif (validKeyEntryId(entryId) && wireModel.length > 0 && !wireModel.startsWith(KEY_MODEL_PREFIX) && keyModelId(entryId, wireModel) === model) return { entryId, wireModel };\n\t\t}\n\t} catch {}\n\tthrow new LlmError(`invalid multi-key model selection \"${model}\"`, \"UNKNOWN_MODEL\");\n}\nconst keyEntryProfile = z.object({\n\tname: z.string().max(120).required(),\n\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});\nconst profile = z.object({\n\tmultiKey: z.boolean().default(false),\n\tkeyEntries: z.dict(keyEntryProfile).default({}),\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n"
+        },
+        {
+          "before": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\") {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n",
+          "after": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\", forKeyEntry = false) {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n"
+        },
+        {
+          "before": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n",
+          "after": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst entrySources = source.keyEntries ?? {};\n\t\tif (typeof entrySources !== \"object\" || entrySources === null || Array.isArray(entrySources)) throw new Error(`llm-pi-ai: provider \"${provider}\" keyEntries must be a dictionary`);\n\t\tconst assertWireModels = (models, site) => {\n\t\t\tfor (const model of models ?? []) if (typeof model.id !== \"string\" || model.id.length === 0 || model.id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} must use non-empty upstream model ids outside the reserved ${KEY_MODEL_PREFIX} prefix`);\n\t\t};\n\t\tassertWireModels(source.models, \"models\");\n\t\tfor (const id of Object.keys(source.modelOverrides ?? {})) if (id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" modelOverrides uses reserved prefix ${KEY_MODEL_PREFIX}`);\n\t\tfor (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tif (!validKeyEntryId(id)) throw new Error(`llm-pi-ai: provider \"${provider}\" has an invalid key entry id \"${id}\"`);\n\t\t\tif (typeof entry !== \"object\" || entry === null || typeof entry.name !== \"string\" || entry.name.trim().length === 0 || entry.name.length > 120) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs a name of 1-120 characters`);\n\t\t\tif (typeof entry.apiKeyEnv !== \"string\" || entry.apiKeyEnv.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own apiKeyEnv`);\n\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own models list`);\n\t\t\tassertWireModels(entry.models, `key entry \"${id}\" models`);\n\t\t}\n\t\tconst assertEntryHeaders = (headers, site) => {\n\t\t\tfor (const name of Object.keys(headers ?? {})) if (AUTH_HEADER_NAMES.has(name.toLowerCase())) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} authentication header \"${name}\" would override the selected key; remove it before enabling multiKey`);\n\t\t};\n\t\tif (source.multiKey === true || forKeyEntry) {\n\t\t\tassertEntryHeaders(source.headers, \"shared\");\n\t\t\tfor (const model of source.models ?? []) assertEntryHeaders(model.headers, `model \"${model.id}\"`);\n\t\t\tfor (const [id, override] of Object.entries(source.modelOverrides ?? {})) assertEntryHeaders(override.headers, `model override \"${id}\"`);\n\t\t}\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n"
+        },
+        {
+          "before": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\ttry {\n\t\t\tcatalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n",
+          "after": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tconst keyEntries = new Map();\n\t\t// Disabled entries remain stored, but cannot constrain legacy single-key runtime behavior.\n\t\tif (source.multiKey === true) for (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,\n\t\t\t\tkeyEntries: {},\n\t\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\t\tmodels: entry.models,\n\t\t\t\tmodelOverrides: void 0\n\t\t\t} }, validation, true).get(provider);\n\t\t\t// Entry auth must not consult a catalog provider's ambient/OAuth credential or endpoint.\n\t\t\tkeyEntries.set(id, {\n\t\t\t\t...child,\n\t\t\t\tkeyEntryId: id,\n\t\t\t\tkeyEntryName: entry.name,\n\t\t\t\t...child.piProvider === void 0 ? {} : { piProvider: { ...child.piProvider, auth: { apiKey: harnessApiKeyAuth(entry.name) } } }\n\t\t\t});\n\t\t}\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\tconst entryOnly = forKeyEntry && source.models.length === 0 || source.multiKey === true && keyEntries.size > 0 && (source.models ?? []).length === 0 && catalogModels(provider).size === 0;\n\t\ttry {\n\t\t\tif (entryOnly) catalog = { models: [], configuredMaxTokens: new Map(), modelErrors: new Map() };\n\t\t\telse catalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n"
+        },
+        {
+          "before": "\t\t\t}, validation);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;",
+          "after": "\t\t\t}, validation);\n\t\t\tif (source.multiKey === true || forKeyEntry) for (const model of catalog.models) assertEntryHeaders(model.headers, `resolved model \"${model.id}\"`);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;"
+        },
+        {
+          "before": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },",
+          "after": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, keyEntries: _keyEntries, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\tkeyEntries,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },"
+        },
+        {
+          "before": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/**\n* pi-ai-backed multi-provider adapter.",
+          "after": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/** Decode only the selected replay owner at the pi boundary; never merge equal wire ids across keys. */\nfunction replayContextForRoute(context, provider, requestedModel, wireModel) {\n\tconst selectedEntry = requestedModel.startsWith(KEY_MODEL_PREFIX);\n\treturn {\n\t\t...context,\n\t\tmessages: context.messages.map((message) => {\n\t\t\tif (message.role !== \"assistant\") return message;\n\t\t\tif (message.provider === provider && message.model === requestedModel) return { ...message, model: wireModel.id };\n\t\t\tif (!message.model.startsWith(KEY_MODEL_PREFIX) && !(selectedEntry && message.provider === provider && message.model === wireModel.id)) return message;\n\t\t\treturn {\n\t\t\t\trole: \"assistant\",\n\t\t\t\tapi: \"dsh-foreign\",\n\t\t\t\tprovider: message.provider,\n\t\t\t\tmodel: \"dsh-foreign\",\n\t\t\t\tcontent: message.content.flatMap((block) => {\n\t\t\t\t\tif (block.type === \"thinking\") return [];\n\t\t\t\t\tif (block.type === \"text\") return [{ type: \"text\", text: block.text }];\n\t\t\t\t\tif (block.type === \"toolCall\") return [{ type: \"toolCall\", id: block.id, name: block.name, arguments: block.arguments }];\n\t\t\t\t\treturn [block];\n\t\t\t\t}),\n\t\t\t\tusage: message.usage,\n\t\t\t\tstopReason: message.stopReason,\n\t\t\t\ttimestamp: message.timestamp\n\t\t\t};\n\t\t})\n\t};\n}\n/**\n* pi-ai-backed multi-provider adapter."
+        },
+        {
+          "before": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tfor (const profile of profiles.values()) if (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n",
+          "after": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tconst entryModels = new Map();\n\t\tfor (const [provider, profile] of profiles) {\n\t\t\tif (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\t\tconst entries = new Map();\n\t\t\tfor (const [id, entry] of profile.keyEntries) {\n\t\t\t\tconst collection = createModels(this.config.auth);\n\t\t\t\tif (entry.piProvider !== void 0) collection.setProvider(entry.piProvider);\n\t\t\t\tentries.set(id, collection);\n\t\t\t}\n\t\t\tentryModels.set(provider, entries);\n\t\t}\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels,\n\t\t\tentryModels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n"
+        },
+        {
+          "before": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst failure = profile.modelErrors.get(model) ?? (profile.piProvider === void 0 ? profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = snapshot.models.getModel(provider, model);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n",
+          "after": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** Bind the public selection to an exact profile, independent model collection, and upstream id. */\n\trouteOf(snapshot, provider, model) {\n\t\tconst root = this.profileOf(snapshot, provider);\n\t\tconst entry = keyModelRoute(model);\n\t\tif (entry === void 0) return { profile: root, models: snapshot.models, wireModel: model };\n\t\tif (root.multiKey !== true) throw new LlmError(`multi-key selection is disabled for provider \"${provider}\"`, \"UNKNOWN_MODEL\");\n\t\tconst profile = root.keyEntries.get(entry.entryId);\n\t\tconst models = snapshot.entryModels.get(provider)?.get(entry.entryId);\n\t\tif (profile === void 0 || models === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${entry.entryId}\"`, \"UNKNOWN_MODEL\");\n\t\treturn { profile, models, wireModel: entry.wireModel };\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst route = this.routeOf(snapshot, provider, model);\n\t\tconst failure = route.profile.modelErrors.get(route.wireModel) ?? (route.profile.piProvider === void 0 ? route.profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = route.models.getModel(provider, route.wireModel);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n"
+        },
+        {
+          "before": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\ttry {\n\t\t\t\tawait this.config.resolveApiKey(provider, profile);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return [];\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn snapshot.models.getModels(provider).map((model) => ({\n\t\t\t\tprovider,\n\t\t\t\tid: model.id,\n\t\t\t\tname: model.name,\n\t\t\t\tinputModalities: [...model.input]\n\t\t\t}));\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n",
+          "after": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\tconst listed = [];\n\t\t\tconst append = async (owner, models, entryId) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst key = await this.config.resolveApiKey(provider, owner);\n\t\t\t\t\tif (entryId !== void 0 && (key === void 0 || key.length === 0)) return;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return;\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tfor (const model of models.getModels(provider)) listed.push({\n\t\t\t\t\tprovider,\n\t\t\t\t\tid: entryId === void 0 ? model.id : keyModelId(entryId, model.id),\n\t\t\t\t\tname: model.name,\n\t\t\t\t\tinputModalities: [...model.input]\n\t\t\t\t});\n\t\t\t};\n\t\t\t// Keep raw root models advertised so old sessions remain routable without changing keys.\n\t\t\tawait append(profile, snapshot.models);\n\t\t\tif (profile.multiKey === true) for (const [id, entry] of profile.keyEntries) await append(entry, snapshot.entryModels.get(provider).get(id), id);\n\t\t\treturn listed;\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n"
+        },
+        {
+          "before": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(model);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n",
+          "after": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst { profile, wireModel } = this.routeOf(snapshot, provider, model);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(wireModel);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n"
+        },
+        {
+          "before": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => this.streamWithSnapshot(options, snapshot)\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot(options, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n",
+          "after": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => {\n\t\t\t\tif (options.provider !== provider || options.model !== model) throw new LlmError(\"prepared multi-key model selection changed before adapter dispatch\", \"INVALID_CONFIG\");\n\t\t\t\t// Async generators are lazy; pin the owner before returning one to caller-owned code.\n\t\t\t\treturn this.streamWithSnapshot({ ...options, provider, model }, snapshot);\n\t\t\t}\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot({ ...options }, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n"
+        },
+        {
+          "before": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst profile = this.profileOf(snapshot, options.provider);\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n",
+          "after": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst route = this.routeOf(snapshot, options.provider, options.model);\n\t\t\tconst profile = route.profile;\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n"
+        },
+        {
+          "before": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n",
+          "after": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tif (profile.keyEntryId !== void 0 && (apiKey === void 0 || apiKey.length === 0)) throw new LlmError(`provider \"${options.provider}\" key entry \"${profile.keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n"
+        },
+        {
+          "before": "\t\t\t\tconst iterator = toStreamChunks(snapshot.models.streamSimple(model, context, {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, model.id)[Symbol.asyncIterator]();",
+          "after": "\t\t\t\tconst iterator = toStreamChunks(route.models.streamSimple(model, replayContextForRoute(context, options.provider, options.model, model), {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, options.model)[Symbol.asyncIterator]();"
+        },
+        {
+          "before": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n",
+          "after": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\t// Validate host-owned entry identity even on the installed-catalog shortcut.\n\tconst selectedStored = request.keyEntryId === void 0 ? void 0 : storedProfile?.();\n\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n",
+          "after": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = selectedStored ?? storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n"
+        },
+        {
+          "before": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n",
+          "after": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy,\n\t\tmultiKey: profile.multiKey === true,\n\t\tapiKeyEnv: profile.apiKeyEnv,\n\t\tmodels: profile.piProvider?.getModels(),\n\t\tmodelErrors: [...profile.modelErrors],\n\t\tkeyEntries: [...profile.keyEntries].map(([id, entry]) => ({\n\t\t\tid,\n\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),\n\t\t\tmodelErrors: [...entry.modelErrors]\n\t\t})).sort((left, right) => left.id.localeCompare(right.id))\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n"
+        },
+        {
+          "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
+          "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        },
+        {
+          "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
+          "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+        },
+        {
+          "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
+          "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+        },
+        {
+          "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
+          "after": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\t...entry.api === void 0 ? {} : { api: entry.api },\n\t\t\t\tmultiKey: false,"
+        },
+        {
+          "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api !== void 0 ? request.api : selectedStored?.api !== void 0 ? selectedStored.api : \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
+          "after": "\tconst baseURL = request.baseURL ?? selectedStored?.baseURL;\n\tif (baseURL === void 0 || baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(baseURL, api);"
+        },
+        {
+          "before": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),",
+          "after": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tapi: entry.api,\n\t\t\tmodels: entry.piProvider?.getModels(),"
+        },
+        {
+          "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
+          "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+        },
+        {
+          "before": "function listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");",
+          "after": "/** Strip trailing slashes and one trailing `/v1`, the segment the Anthropic SDK adds itself. */\nfunction anthropicRoot(baseURL) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");\n\treturn base.endsWith(\"/v1\") ? base.slice(0, -3) : base;\n}\nfunction listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");"
+        },
+        {
+          "before": "\t\tconst baseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (baseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);",
+          "after": "\t\tconst configuredBaseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (configuredBaseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);\n\t\tconst baseUrl = api === \"anthropic-messages\" ? anthropicRoot(configuredBaseUrl) : configuredBaseUrl;"
+        },
+        {
+          "before": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${base.endsWith(\"/v1\") ? base.slice(0, -3) : base}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;",
+          "after": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${anthropicRoot(base)}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;"
+        },
+        {
+          "before": "* gateway documentation publishes both spellings of the same root. Only this\n* listing URL normalizes that segment; model requests receive the configured\n* `baseURL` unchanged.\n*/",
+          "after": "* gateway documentation publishes both spellings of the same root. Anthropic\n* listings and model requests both normalize it, because the Anthropic SDK\n* appends `/v1/messages` on its own while OpenAI protocols append\n* `/chat/completions`; without this, one root would work for chat and double\n* the segment for Anthropic.\n*/"
+        }
+      ]
+    },
+    {
+      "source": "multi-key revision before per-entry API overrides",
+      "baseSha256": "070c839e2c00e2d5f7c5d82307ca3d84dbb2323e46979daf265908751bbe8ae8",
+      "resultSha256": "56b60061cc2ca642d3572214a40dbd679390c7f5427e739a11b3230ac2169ded",
+      "replacements": [
+        {
+          "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
+          "after": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\n// Model selection carries an opaque entry identity, never a credential or a wire alias.\nconst KEY_MODEL_PREFIX = \"@dsh-key/\";\nconst KEY_ENTRY_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/;\nconst FORBIDDEN_KEY_ENTRY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst AUTH_HEADER_NAMES = new Set([\"authorization\", \"proxy-authorization\", \"x-api-key\", \"api-key\", \"cf-aig-authorization\"]);\nfunction validKeyEntryId(id) {\n\treturn KEY_ENTRY_ID.test(id) && !FORBIDDEN_KEY_ENTRY_IDS.has(id);\n}\nfunction keyModelId(entryId, model) {\n\treturn `${KEY_MODEL_PREFIX}${encodeURIComponent(entryId)}/${encodeURIComponent(model)}`;\n}\nfunction keyModelRoute(model) {\n\tif (!model.startsWith(KEY_MODEL_PREFIX)) return void 0;\n\ttry {\n\t\tconst parts = model.slice(KEY_MODEL_PREFIX.length).split(\"/\");\n\t\tif (parts.length === 2) {\n\t\t\tconst entryId = decodeURIComponent(parts[0]);\n\t\t\tconst wireModel = decodeURIComponent(parts[1]);\n\t\t\tif (validKeyEntryId(entryId) && wireModel.length > 0 && !wireModel.startsWith(KEY_MODEL_PREFIX) && keyModelId(entryId, wireModel) === model) return { entryId, wireModel };\n\t\t}\n\t} catch {}\n\tthrow new LlmError(`invalid multi-key model selection \"${model}\"`, \"UNKNOWN_MODEL\");\n}\nconst keyEntryProfile = z.object({\n\tname: z.string().max(120).required(),\n\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});\nconst profile = z.object({\n\tmultiKey: z.boolean().default(false),\n\tkeyEntries: z.dict(keyEntryProfile).default({}),\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n"
+        },
+        {
+          "before": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\") {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n",
+          "after": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\", forKeyEntry = false) {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n"
+        },
+        {
+          "before": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n",
+          "after": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst entrySources = source.keyEntries ?? {};\n\t\tif (typeof entrySources !== \"object\" || entrySources === null || Array.isArray(entrySources)) throw new Error(`llm-pi-ai: provider \"${provider}\" keyEntries must be a dictionary`);\n\t\tconst assertWireModels = (models, site) => {\n\t\t\tfor (const model of models ?? []) if (typeof model.id !== \"string\" || model.id.length === 0 || model.id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} must use non-empty upstream model ids outside the reserved ${KEY_MODEL_PREFIX} prefix`);\n\t\t};\n\t\tassertWireModels(source.models, \"models\");\n\t\tfor (const id of Object.keys(source.modelOverrides ?? {})) if (id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" modelOverrides uses reserved prefix ${KEY_MODEL_PREFIX}`);\n\t\tfor (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tif (!validKeyEntryId(id)) throw new Error(`llm-pi-ai: provider \"${provider}\" has an invalid key entry id \"${id}\"`);\n\t\t\tif (typeof entry !== \"object\" || entry === null || typeof entry.name !== \"string\" || entry.name.trim().length === 0 || entry.name.length > 120) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs a name of 1-120 characters`);\n\t\t\tif (typeof entry.apiKeyEnv !== \"string\" || entry.apiKeyEnv.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own apiKeyEnv`);\n\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own models list`);\n\t\t\tassertWireModels(entry.models, `key entry \"${id}\" models`);\n\t\t}\n\t\tconst assertEntryHeaders = (headers, site) => {\n\t\t\tfor (const name of Object.keys(headers ?? {})) if (AUTH_HEADER_NAMES.has(name.toLowerCase())) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} authentication header \"${name}\" would override the selected key; remove it before enabling multiKey`);\n\t\t};\n\t\tif (source.multiKey === true || forKeyEntry) {\n\t\t\tassertEntryHeaders(source.headers, \"shared\");\n\t\t\tfor (const model of source.models ?? []) assertEntryHeaders(model.headers, `model \"${model.id}\"`);\n\t\t\tfor (const [id, override] of Object.entries(source.modelOverrides ?? {})) assertEntryHeaders(override.headers, `model override \"${id}\"`);\n\t\t}\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n"
+        },
+        {
+          "before": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\ttry {\n\t\t\tcatalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n",
+          "after": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tconst keyEntries = new Map();\n\t\t// Disabled entries remain stored, but cannot constrain legacy single-key runtime behavior.\n\t\tif (source.multiKey === true) for (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,\n\t\t\t\tkeyEntries: {},\n\t\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\t\tmodels: entry.models,\n\t\t\t\tmodelOverrides: void 0\n\t\t\t} }, validation, true).get(provider);\n\t\t\t// Entry auth must not consult a catalog provider's ambient/OAuth credential or endpoint.\n\t\t\tkeyEntries.set(id, {\n\t\t\t\t...child,\n\t\t\t\tkeyEntryId: id,\n\t\t\t\tkeyEntryName: entry.name,\n\t\t\t\t...child.piProvider === void 0 ? {} : { piProvider: { ...child.piProvider, auth: { apiKey: harnessApiKeyAuth(entry.name) } } }\n\t\t\t});\n\t\t}\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\tconst entryOnly = forKeyEntry && source.models.length === 0 || source.multiKey === true && keyEntries.size > 0 && (source.models ?? []).length === 0 && catalogModels(provider).size === 0;\n\t\ttry {\n\t\t\tif (entryOnly) catalog = { models: [], configuredMaxTokens: new Map(), modelErrors: new Map() };\n\t\t\telse catalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n"
+        },
+        {
+          "before": "\t\t\t}, validation);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;",
+          "after": "\t\t\t}, validation);\n\t\t\tif (source.multiKey === true || forKeyEntry) for (const model of catalog.models) assertEntryHeaders(model.headers, `resolved model \"${model.id}\"`);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;"
+        },
+        {
+          "before": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },",
+          "after": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, keyEntries: _keyEntries, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\tkeyEntries,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },"
+        },
+        {
+          "before": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/**\n* pi-ai-backed multi-provider adapter.",
+          "after": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/** Decode only the selected replay owner at the pi boundary; never merge equal wire ids across keys. */\nfunction replayContextForRoute(context, provider, requestedModel, wireModel) {\n\tconst selectedEntry = requestedModel.startsWith(KEY_MODEL_PREFIX);\n\treturn {\n\t\t...context,\n\t\tmessages: context.messages.map((message) => {\n\t\t\tif (message.role !== \"assistant\") return message;\n\t\t\tif (message.provider === provider && message.model === requestedModel) return { ...message, model: wireModel.id };\n\t\t\tif (!message.model.startsWith(KEY_MODEL_PREFIX) && !(selectedEntry && message.provider === provider && message.model === wireModel.id)) return message;\n\t\t\treturn {\n\t\t\t\trole: \"assistant\",\n\t\t\t\tapi: \"dsh-foreign\",\n\t\t\t\tprovider: message.provider,\n\t\t\t\tmodel: \"dsh-foreign\",\n\t\t\t\tcontent: message.content.flatMap((block) => {\n\t\t\t\t\tif (block.type === \"thinking\") return [];\n\t\t\t\t\tif (block.type === \"text\") return [{ type: \"text\", text: block.text }];\n\t\t\t\t\tif (block.type === \"toolCall\") return [{ type: \"toolCall\", id: block.id, name: block.name, arguments: block.arguments }];\n\t\t\t\t\treturn [block];\n\t\t\t\t}),\n\t\t\t\tusage: message.usage,\n\t\t\t\tstopReason: message.stopReason,\n\t\t\t\ttimestamp: message.timestamp\n\t\t\t};\n\t\t})\n\t};\n}\n/**\n* pi-ai-backed multi-provider adapter."
+        },
+        {
+          "before": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tfor (const profile of profiles.values()) if (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n",
+          "after": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tconst entryModels = new Map();\n\t\tfor (const [provider, profile] of profiles) {\n\t\t\tif (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\t\tconst entries = new Map();\n\t\t\tfor (const [id, entry] of profile.keyEntries) {\n\t\t\t\tconst collection = createModels(this.config.auth);\n\t\t\t\tif (entry.piProvider !== void 0) collection.setProvider(entry.piProvider);\n\t\t\t\tentries.set(id, collection);\n\t\t\t}\n\t\t\tentryModels.set(provider, entries);\n\t\t}\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels,\n\t\t\tentryModels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n"
+        },
+        {
+          "before": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst failure = profile.modelErrors.get(model) ?? (profile.piProvider === void 0 ? profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = snapshot.models.getModel(provider, model);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n",
+          "after": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** Bind the public selection to an exact profile, independent model collection, and upstream id. */\n\trouteOf(snapshot, provider, model) {\n\t\tconst root = this.profileOf(snapshot, provider);\n\t\tconst entry = keyModelRoute(model);\n\t\tif (entry === void 0) return { profile: root, models: snapshot.models, wireModel: model };\n\t\tif (root.multiKey !== true) throw new LlmError(`multi-key selection is disabled for provider \"${provider}\"`, \"UNKNOWN_MODEL\");\n\t\tconst profile = root.keyEntries.get(entry.entryId);\n\t\tconst models = snapshot.entryModels.get(provider)?.get(entry.entryId);\n\t\tif (profile === void 0 || models === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${entry.entryId}\"`, \"UNKNOWN_MODEL\");\n\t\treturn { profile, models, wireModel: entry.wireModel };\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst route = this.routeOf(snapshot, provider, model);\n\t\tconst failure = route.profile.modelErrors.get(route.wireModel) ?? (route.profile.piProvider === void 0 ? route.profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = route.models.getModel(provider, route.wireModel);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n"
+        },
+        {
+          "before": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\ttry {\n\t\t\t\tawait this.config.resolveApiKey(provider, profile);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return [];\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn snapshot.models.getModels(provider).map((model) => ({\n\t\t\t\tprovider,\n\t\t\t\tid: model.id,\n\t\t\t\tname: model.name,\n\t\t\t\tinputModalities: [...model.input]\n\t\t\t}));\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n",
+          "after": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\tconst listed = [];\n\t\t\tconst append = async (owner, models, entryId) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst key = await this.config.resolveApiKey(provider, owner);\n\t\t\t\t\tif (entryId !== void 0 && (key === void 0 || key.length === 0)) return;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return;\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tfor (const model of models.getModels(provider)) listed.push({\n\t\t\t\t\tprovider,\n\t\t\t\t\tid: entryId === void 0 ? model.id : keyModelId(entryId, model.id),\n\t\t\t\t\tname: model.name,\n\t\t\t\t\tinputModalities: [...model.input]\n\t\t\t\t});\n\t\t\t};\n\t\t\t// Keep raw root models advertised so old sessions remain routable without changing keys.\n\t\t\tawait append(profile, snapshot.models);\n\t\t\tif (profile.multiKey === true) for (const [id, entry] of profile.keyEntries) await append(entry, snapshot.entryModels.get(provider).get(id), id);\n\t\t\treturn listed;\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n"
+        },
+        {
+          "before": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(model);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n",
+          "after": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst { profile, wireModel } = this.routeOf(snapshot, provider, model);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(wireModel);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n"
+        },
+        {
+          "before": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => this.streamWithSnapshot(options, snapshot)\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot(options, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n",
+          "after": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => {\n\t\t\t\tif (options.provider !== provider || options.model !== model) throw new LlmError(\"prepared multi-key model selection changed before adapter dispatch\", \"INVALID_CONFIG\");\n\t\t\t\t// Async generators are lazy; pin the owner before returning one to caller-owned code.\n\t\t\t\treturn this.streamWithSnapshot({ ...options, provider, model }, snapshot);\n\t\t\t}\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot({ ...options }, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n"
+        },
+        {
+          "before": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst profile = this.profileOf(snapshot, options.provider);\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n",
+          "after": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst route = this.routeOf(snapshot, options.provider, options.model);\n\t\t\tconst profile = route.profile;\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n"
+        },
+        {
+          "before": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n",
+          "after": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tif (profile.keyEntryId !== void 0 && (apiKey === void 0 || apiKey.length === 0)) throw new LlmError(`provider \"${options.provider}\" key entry \"${profile.keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n"
+        },
+        {
+          "before": "\t\t\t\tconst iterator = toStreamChunks(snapshot.models.streamSimple(model, context, {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, model.id)[Symbol.asyncIterator]();",
+          "after": "\t\t\t\tconst iterator = toStreamChunks(route.models.streamSimple(model, replayContextForRoute(context, options.provider, options.model, model), {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, options.model)[Symbol.asyncIterator]();"
+        },
+        {
+          "before": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n",
+          "after": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\t// Validate host-owned entry identity even on the installed-catalog shortcut.\n\tconst selectedStored = request.keyEntryId === void 0 ? void 0 : storedProfile?.();\n\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n",
+          "after": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = selectedStored ?? storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n"
+        },
+        {
+          "before": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n",
+          "after": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy,\n\t\tmultiKey: profile.multiKey === true,\n\t\tapiKeyEnv: profile.apiKeyEnv,\n\t\tmodels: profile.piProvider?.getModels(),\n\t\tmodelErrors: [...profile.modelErrors],\n\t\tkeyEntries: [...profile.keyEntries].map(([id, entry]) => ({\n\t\t\tid,\n\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),\n\t\t\tmodelErrors: [...entry.modelErrors]\n\t\t})).sort((left, right) => left.id.localeCompare(right.id))\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n"
+        },
+        {
+          "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
+          "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        },
+        {
+          "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
+          "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+        },
+        {
+          "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
+          "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+        },
+        {
+          "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
+          "after": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\t...entry.api === void 0 ? {} : { api: entry.api },\n\t\t\t\tmultiKey: false,"
+        },
+        {
+          "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api !== void 0 ? request.api : selectedStored?.api !== void 0 ? selectedStored.api : \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
+          "after": "\tconst baseURL = request.baseURL ?? selectedStored?.baseURL;\n\tif (baseURL === void 0 || baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(baseURL, api);"
+        },
+        {
+          "before": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),",
+          "after": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tapi: entry.api,\n\t\t\tmodels: entry.piProvider?.getModels(),"
+        },
+        {
+          "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
+          "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+        },
+        {
+          "before": "function listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");",
+          "after": "/** Strip trailing slashes and one trailing `/v1`, the segment the Anthropic SDK adds itself. */\nfunction anthropicRoot(baseURL) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");\n\treturn base.endsWith(\"/v1\") ? base.slice(0, -3) : base;\n}\nfunction listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");"
+        },
+        {
+          "before": "\t\tconst baseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (baseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);",
+          "after": "\t\tconst configuredBaseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (configuredBaseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);\n\t\tconst baseUrl = api === \"anthropic-messages\" ? anthropicRoot(configuredBaseUrl) : configuredBaseUrl;"
+        },
+        {
+          "before": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${base.endsWith(\"/v1\") ? base.slice(0, -3) : base}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;",
+          "after": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${anthropicRoot(base)}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;"
+        }
+      ]
+    },
+    {
+      "source": "multi-key revision before per-entry API overrides",
+      "baseSha256": "070c839e2c00e2d5f7c5d82307ca3d84dbb2323e46979daf265908751bbe8ae8",
+      "resultSha256": "7c234a4d68794ee54112583c4d4bfaf7c9819b9227c3149f58fa7584883c7aff",
+      "replacements": [
+        {
+          "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
+          "after": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\n// Model selection carries an opaque entry identity, never a credential or a wire alias.\nconst KEY_MODEL_PREFIX = \"@dsh-key/\";\nconst KEY_ENTRY_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/;\nconst FORBIDDEN_KEY_ENTRY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst AUTH_HEADER_NAMES = new Set([\"authorization\", \"proxy-authorization\", \"x-api-key\", \"api-key\", \"cf-aig-authorization\"]);\nfunction validKeyEntryId(id) {\n\treturn KEY_ENTRY_ID.test(id) && !FORBIDDEN_KEY_ENTRY_IDS.has(id);\n}\nfunction keyModelId(entryId, model) {\n\treturn `${KEY_MODEL_PREFIX}${encodeURIComponent(entryId)}/${encodeURIComponent(model)}`;\n}\nfunction keyModelRoute(model) {\n\tif (!model.startsWith(KEY_MODEL_PREFIX)) return void 0;\n\ttry {\n\t\tconst parts = model.slice(KEY_MODEL_PREFIX.length).split(\"/\");\n\t\tif (parts.length === 2) {\n\t\t\tconst entryId = decodeURIComponent(parts[0]);\n\t\t\tconst wireModel = decodeURIComponent(parts[1]);\n\t\t\tif (validKeyEntryId(entryId) && wireModel.length > 0 && !wireModel.startsWith(KEY_MODEL_PREFIX) && keyModelId(entryId, wireModel) === model) return { entryId, wireModel };\n\t\t}\n\t} catch {}\n\tthrow new LlmError(`invalid multi-key model selection \"${model}\"`, \"UNKNOWN_MODEL\");\n}\nconst keyEntryProfile = z.object({\n\tname: z.string().max(120).required(),\n\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});\nconst profile = z.object({\n\tmultiKey: z.boolean().default(false),\n\tkeyEntries: z.dict(keyEntryProfile).default({}),\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n"
+        },
+        {
+          "before": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\") {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n",
+          "after": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\", forKeyEntry = false) {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n"
+        },
+        {
+          "before": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n",
+          "after": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst entrySources = source.keyEntries ?? {};\n\t\tif (typeof entrySources !== \"object\" || entrySources === null || Array.isArray(entrySources)) throw new Error(`llm-pi-ai: provider \"${provider}\" keyEntries must be a dictionary`);\n\t\tconst assertWireModels = (models, site) => {\n\t\t\tfor (const model of models ?? []) if (typeof model.id !== \"string\" || model.id.length === 0 || model.id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} must use non-empty upstream model ids outside the reserved ${KEY_MODEL_PREFIX} prefix`);\n\t\t};\n\t\tassertWireModels(source.models, \"models\");\n\t\tfor (const id of Object.keys(source.modelOverrides ?? {})) if (id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" modelOverrides uses reserved prefix ${KEY_MODEL_PREFIX}`);\n\t\tfor (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tif (!validKeyEntryId(id)) throw new Error(`llm-pi-ai: provider \"${provider}\" has an invalid key entry id \"${id}\"`);\n\t\t\tif (typeof entry !== \"object\" || entry === null || typeof entry.name !== \"string\" || entry.name.trim().length === 0 || entry.name.length > 120) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs a name of 1-120 characters`);\n\t\t\tif (typeof entry.apiKeyEnv !== \"string\" || entry.apiKeyEnv.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own apiKeyEnv`);\n\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own models list`);\n\t\t\tassertWireModels(entry.models, `key entry \"${id}\" models`);\n\t\t}\n\t\tconst assertEntryHeaders = (headers, site) => {\n\t\t\tfor (const name of Object.keys(headers ?? {})) if (AUTH_HEADER_NAMES.has(name.toLowerCase())) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} authentication header \"${name}\" would override the selected key; remove it before enabling multiKey`);\n\t\t};\n\t\tif (source.multiKey === true || forKeyEntry) {\n\t\t\tassertEntryHeaders(source.headers, \"shared\");\n\t\t\tfor (const model of source.models ?? []) assertEntryHeaders(model.headers, `model \"${model.id}\"`);\n\t\t\tfor (const [id, override] of Object.entries(source.modelOverrides ?? {})) assertEntryHeaders(override.headers, `model override \"${id}\"`);\n\t\t}\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n"
+        },
+        {
+          "before": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\ttry {\n\t\t\tcatalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n",
+          "after": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tconst keyEntries = new Map();\n\t\t// Disabled entries remain stored, but cannot constrain legacy single-key runtime behavior.\n\t\tif (source.multiKey === true) for (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,\n\t\t\t\tkeyEntries: {},\n\t\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\t\tmodels: entry.models,\n\t\t\t\tmodelOverrides: void 0\n\t\t\t} }, validation, true).get(provider);\n\t\t\t// Entry auth must not consult a catalog provider's ambient/OAuth credential or endpoint.\n\t\t\tkeyEntries.set(id, {\n\t\t\t\t...child,\n\t\t\t\tkeyEntryId: id,\n\t\t\t\tkeyEntryName: entry.name,\n\t\t\t\t...child.piProvider === void 0 ? {} : { piProvider: { ...child.piProvider, auth: { apiKey: harnessApiKeyAuth(entry.name) } } }\n\t\t\t});\n\t\t}\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\tconst entryOnly = forKeyEntry && source.models.length === 0 || source.multiKey === true && keyEntries.size > 0 && (source.models ?? []).length === 0 && catalogModels(provider).size === 0;\n\t\ttry {\n\t\t\tif (entryOnly) catalog = { models: [], configuredMaxTokens: new Map(), modelErrors: new Map() };\n\t\t\telse catalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n"
+        },
+        {
+          "before": "\t\t\t}, validation);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;",
+          "after": "\t\t\t}, validation);\n\t\t\tif (source.multiKey === true || forKeyEntry) for (const model of catalog.models) assertEntryHeaders(model.headers, `resolved model \"${model.id}\"`);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;"
+        },
+        {
+          "before": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },",
+          "after": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, keyEntries: _keyEntries, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\tkeyEntries,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },"
+        },
+        {
+          "before": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/**\n* pi-ai-backed multi-provider adapter.",
+          "after": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/** Decode only the selected replay owner at the pi boundary; never merge equal wire ids across keys. */\nfunction replayContextForRoute(context, provider, requestedModel, wireModel) {\n\tconst selectedEntry = requestedModel.startsWith(KEY_MODEL_PREFIX);\n\treturn {\n\t\t...context,\n\t\tmessages: context.messages.map((message) => {\n\t\t\tif (message.role !== \"assistant\") return message;\n\t\t\tif (message.provider === provider && message.model === requestedModel) return { ...message, model: wireModel.id };\n\t\t\tif (!message.model.startsWith(KEY_MODEL_PREFIX) && !(selectedEntry && message.provider === provider && message.model === wireModel.id)) return message;\n\t\t\treturn {\n\t\t\t\trole: \"assistant\",\n\t\t\t\tapi: \"dsh-foreign\",\n\t\t\t\tprovider: message.provider,\n\t\t\t\tmodel: \"dsh-foreign\",\n\t\t\t\tcontent: message.content.flatMap((block) => {\n\t\t\t\t\tif (block.type === \"thinking\") return [];\n\t\t\t\t\tif (block.type === \"text\") return [{ type: \"text\", text: block.text }];\n\t\t\t\t\tif (block.type === \"toolCall\") return [{ type: \"toolCall\", id: block.id, name: block.name, arguments: block.arguments }];\n\t\t\t\t\treturn [block];\n\t\t\t\t}),\n\t\t\t\tusage: message.usage,\n\t\t\t\tstopReason: message.stopReason,\n\t\t\t\ttimestamp: message.timestamp\n\t\t\t};\n\t\t})\n\t};\n}\n/**\n* pi-ai-backed multi-provider adapter."
+        },
+        {
+          "before": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tfor (const profile of profiles.values()) if (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n",
+          "after": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tconst entryModels = new Map();\n\t\tfor (const [provider, profile] of profiles) {\n\t\t\tif (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\t\tconst entries = new Map();\n\t\t\tfor (const [id, entry] of profile.keyEntries) {\n\t\t\t\tconst collection = createModels(this.config.auth);\n\t\t\t\tif (entry.piProvider !== void 0) collection.setProvider(entry.piProvider);\n\t\t\t\tentries.set(id, collection);\n\t\t\t}\n\t\t\tentryModels.set(provider, entries);\n\t\t}\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels,\n\t\t\tentryModels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n"
+        },
+        {
+          "before": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst failure = profile.modelErrors.get(model) ?? (profile.piProvider === void 0 ? profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = snapshot.models.getModel(provider, model);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n",
+          "after": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** Bind the public selection to an exact profile, independent model collection, and upstream id. */\n\trouteOf(snapshot, provider, model) {\n\t\tconst root = this.profileOf(snapshot, provider);\n\t\tconst entry = keyModelRoute(model);\n\t\tif (entry === void 0) return { profile: root, models: snapshot.models, wireModel: model };\n\t\tif (root.multiKey !== true) throw new LlmError(`multi-key selection is disabled for provider \"${provider}\"`, \"UNKNOWN_MODEL\");\n\t\tconst profile = root.keyEntries.get(entry.entryId);\n\t\tconst models = snapshot.entryModels.get(provider)?.get(entry.entryId);\n\t\tif (profile === void 0 || models === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${entry.entryId}\"`, \"UNKNOWN_MODEL\");\n\t\treturn { profile, models, wireModel: entry.wireModel };\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst route = this.routeOf(snapshot, provider, model);\n\t\tconst failure = route.profile.modelErrors.get(route.wireModel) ?? (route.profile.piProvider === void 0 ? route.profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = route.models.getModel(provider, route.wireModel);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n"
+        },
+        {
+          "before": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\ttry {\n\t\t\t\tawait this.config.resolveApiKey(provider, profile);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return [];\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn snapshot.models.getModels(provider).map((model) => ({\n\t\t\t\tprovider,\n\t\t\t\tid: model.id,\n\t\t\t\tname: model.name,\n\t\t\t\tinputModalities: [...model.input]\n\t\t\t}));\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n",
+          "after": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\tconst listed = [];\n\t\t\tconst append = async (owner, models, entryId) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst key = await this.config.resolveApiKey(provider, owner);\n\t\t\t\t\tif (entryId !== void 0 && (key === void 0 || key.length === 0)) return;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return;\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tfor (const model of models.getModels(provider)) listed.push({\n\t\t\t\t\tprovider,\n\t\t\t\t\tid: entryId === void 0 ? model.id : keyModelId(entryId, model.id),\n\t\t\t\t\tname: model.name,\n\t\t\t\t\tinputModalities: [...model.input]\n\t\t\t\t});\n\t\t\t};\n\t\t\t// Keep raw root models advertised so old sessions remain routable without changing keys.\n\t\t\tawait append(profile, snapshot.models);\n\t\t\tif (profile.multiKey === true) for (const [id, entry] of profile.keyEntries) await append(entry, snapshot.entryModels.get(provider).get(id), id);\n\t\t\treturn listed;\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n"
+        },
+        {
+          "before": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(model);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n",
+          "after": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst { profile, wireModel } = this.routeOf(snapshot, provider, model);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(wireModel);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n"
+        },
+        {
+          "before": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => this.streamWithSnapshot(options, snapshot)\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot(options, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n",
+          "after": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => {\n\t\t\t\tif (options.provider !== provider || options.model !== model) throw new LlmError(\"prepared multi-key model selection changed before adapter dispatch\", \"INVALID_CONFIG\");\n\t\t\t\t// Async generators are lazy; pin the owner before returning one to caller-owned code.\n\t\t\t\treturn this.streamWithSnapshot({ ...options, provider, model }, snapshot);\n\t\t\t}\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot({ ...options }, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n"
+        },
+        {
+          "before": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst profile = this.profileOf(snapshot, options.provider);\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n",
+          "after": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst route = this.routeOf(snapshot, options.provider, options.model);\n\t\t\tconst profile = route.profile;\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n"
+        },
+        {
+          "before": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n",
+          "after": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tif (profile.keyEntryId !== void 0 && (apiKey === void 0 || apiKey.length === 0)) throw new LlmError(`provider \"${options.provider}\" key entry \"${profile.keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n"
+        },
+        {
+          "before": "\t\t\t\tconst iterator = toStreamChunks(snapshot.models.streamSimple(model, context, {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, model.id)[Symbol.asyncIterator]();",
+          "after": "\t\t\t\tconst iterator = toStreamChunks(route.models.streamSimple(model, replayContextForRoute(context, options.provider, options.model, model), {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, options.model)[Symbol.asyncIterator]();"
+        },
+        {
+          "before": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n",
+          "after": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\t// Validate host-owned entry identity even on the installed-catalog shortcut.\n\tconst selectedStored = request.keyEntryId === void 0 ? void 0 : storedProfile?.();\n\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n",
+          "after": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = selectedStored ?? storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n"
+        },
+        {
+          "before": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n",
+          "after": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy,\n\t\tmultiKey: profile.multiKey === true,\n\t\tapiKeyEnv: profile.apiKeyEnv,\n\t\tmodels: profile.piProvider?.getModels(),\n\t\tmodelErrors: [...profile.modelErrors],\n\t\tkeyEntries: [...profile.keyEntries].map(([id, entry]) => ({\n\t\t\tid,\n\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),\n\t\t\tmodelErrors: [...entry.modelErrors]\n\t\t})).sort((left, right) => left.id.localeCompare(right.id))\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n"
+        },
+        {
+          "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
+          "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        },
+        {
+          "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
+          "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+        },
+        {
+          "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
+          "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+        },
+        {
+          "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
+          "after": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\t...entry.api === void 0 ? {} : { api: entry.api },\n\t\t\t\tmultiKey: false,"
+        },
+        {
+          "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api !== void 0 ? request.api : selectedStored?.api !== void 0 ? selectedStored.api : \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
+          "after": "\tconst baseURL = request.baseURL ?? selectedStored?.baseURL;\n\tif (baseURL === void 0 || baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(baseURL, api);"
+        },
+        {
+          "before": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),",
+          "after": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tapi: entry.api,\n\t\t\tmodels: entry.piProvider?.getModels(),"
+        },
+        {
+          "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
+          "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+        }
+      ]
+    },
     {
       "source": "multi-key revision before per-entry API overrides",
       "baseSha256": "070c839e2c00e2d5f7c5d82307ca3d84dbb2323e46979daf265908751bbe8ae8",
@@ -100,7 +461,478 @@
         },
         {
           "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
-          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api ?? selectedStored?.api ?? \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api ?? selectedStored?.api ?? \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
+          "after": "\tconst baseURL = request.baseURL ?? selectedStored?.baseURL;\n\tif (baseURL === void 0 || baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(baseURL, api);"
+        },
+        {
+          "before": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),",
+          "after": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tapi: entry.api,\n\t\t\tmodels: entry.piProvider?.getModels(),"
+        },
+        {
+          "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
+          "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+        }
+      ]
+    },
+    {
+      "source": "multi-key revision before per-entry API overrides",
+      "baseSha256": "070c839e2c00e2d5f7c5d82307ca3d84dbb2323e46979daf265908751bbe8ae8",
+      "resultSha256": "a2b3bcda38015026ed58074cef0d508bbd2d7cb1423c00331651fcbd1a9f6b55",
+      "replacements": [
+        {
+          "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
+          "after": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\n// Model selection carries an opaque entry identity, never a credential or a wire alias.\nconst KEY_MODEL_PREFIX = \"@dsh-key/\";\nconst KEY_ENTRY_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/;\nconst FORBIDDEN_KEY_ENTRY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst AUTH_HEADER_NAMES = new Set([\"authorization\", \"proxy-authorization\", \"x-api-key\", \"api-key\", \"cf-aig-authorization\"]);\nfunction validKeyEntryId(id) {\n\treturn KEY_ENTRY_ID.test(id) && !FORBIDDEN_KEY_ENTRY_IDS.has(id);\n}\nfunction keyModelId(entryId, model) {\n\treturn `${KEY_MODEL_PREFIX}${encodeURIComponent(entryId)}/${encodeURIComponent(model)}`;\n}\nfunction keyModelRoute(model) {\n\tif (!model.startsWith(KEY_MODEL_PREFIX)) return void 0;\n\ttry {\n\t\tconst parts = model.slice(KEY_MODEL_PREFIX.length).split(\"/\");\n\t\tif (parts.length === 2) {\n\t\t\tconst entryId = decodeURIComponent(parts[0]);\n\t\t\tconst wireModel = decodeURIComponent(parts[1]);\n\t\t\tif (validKeyEntryId(entryId) && wireModel.length > 0 && !wireModel.startsWith(KEY_MODEL_PREFIX) && keyModelId(entryId, wireModel) === model) return { entryId, wireModel };\n\t\t}\n\t} catch {}\n\tthrow new LlmError(`invalid multi-key model selection \"${model}\"`, \"UNKNOWN_MODEL\");\n}\nconst keyEntryProfile = z.object({\n\tname: z.string().max(120).required(),\n\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});\nconst profile = z.object({\n\tmultiKey: z.boolean().default(false),\n\tkeyEntries: z.dict(keyEntryProfile).default({}),\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n"
+        },
+        {
+          "before": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\") {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n",
+          "after": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\", forKeyEntry = false) {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n"
+        },
+        {
+          "before": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n",
+          "after": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst entrySources = source.keyEntries ?? {};\n\t\tif (typeof entrySources !== \"object\" || entrySources === null || Array.isArray(entrySources)) throw new Error(`llm-pi-ai: provider \"${provider}\" keyEntries must be a dictionary`);\n\t\tconst assertWireModels = (models, site) => {\n\t\t\tfor (const model of models ?? []) if (typeof model.id !== \"string\" || model.id.length === 0 || model.id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} must use non-empty upstream model ids outside the reserved ${KEY_MODEL_PREFIX} prefix`);\n\t\t};\n\t\tassertWireModels(source.models, \"models\");\n\t\tfor (const id of Object.keys(source.modelOverrides ?? {})) if (id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" modelOverrides uses reserved prefix ${KEY_MODEL_PREFIX}`);\n\t\tfor (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tif (!validKeyEntryId(id)) throw new Error(`llm-pi-ai: provider \"${provider}\" has an invalid key entry id \"${id}\"`);\n\t\t\tif (typeof entry !== \"object\" || entry === null || typeof entry.name !== \"string\" || entry.name.trim().length === 0 || entry.name.length > 120) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs a name of 1-120 characters`);\n\t\t\tif (typeof entry.apiKeyEnv !== \"string\" || entry.apiKeyEnv.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own apiKeyEnv`);\n\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own models list`);\n\t\t\tassertWireModels(entry.models, `key entry \"${id}\" models`);\n\t\t}\n\t\tconst assertEntryHeaders = (headers, site) => {\n\t\t\tfor (const name of Object.keys(headers ?? {})) if (AUTH_HEADER_NAMES.has(name.toLowerCase())) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} authentication header \"${name}\" would override the selected key; remove it before enabling multiKey`);\n\t\t};\n\t\tif (source.multiKey === true || forKeyEntry) {\n\t\t\tassertEntryHeaders(source.headers, \"shared\");\n\t\t\tfor (const model of source.models ?? []) assertEntryHeaders(model.headers, `model \"${model.id}\"`);\n\t\t\tfor (const [id, override] of Object.entries(source.modelOverrides ?? {})) assertEntryHeaders(override.headers, `model override \"${id}\"`);\n\t\t}\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n"
+        },
+        {
+          "before": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\ttry {\n\t\t\tcatalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n",
+          "after": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tconst keyEntries = new Map();\n\t\t// Disabled entries remain stored, but cannot constrain legacy single-key runtime behavior.\n\t\tif (source.multiKey === true) for (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,\n\t\t\t\tkeyEntries: {},\n\t\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\t\tmodels: entry.models,\n\t\t\t\tmodelOverrides: void 0\n\t\t\t} }, validation, true).get(provider);\n\t\t\t// Entry auth must not consult a catalog provider's ambient/OAuth credential or endpoint.\n\t\t\tkeyEntries.set(id, {\n\t\t\t\t...child,\n\t\t\t\tkeyEntryId: id,\n\t\t\t\tkeyEntryName: entry.name,\n\t\t\t\t...child.piProvider === void 0 ? {} : { piProvider: { ...child.piProvider, auth: { apiKey: harnessApiKeyAuth(entry.name) } } }\n\t\t\t});\n\t\t}\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\tconst entryOnly = forKeyEntry && source.models.length === 0 || source.multiKey === true && keyEntries.size > 0 && (source.models ?? []).length === 0 && catalogModels(provider).size === 0;\n\t\ttry {\n\t\t\tif (entryOnly) catalog = { models: [], configuredMaxTokens: new Map(), modelErrors: new Map() };\n\t\t\telse catalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n"
+        },
+        {
+          "before": "\t\t\t}, validation);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;",
+          "after": "\t\t\t}, validation);\n\t\t\tif (source.multiKey === true || forKeyEntry) for (const model of catalog.models) assertEntryHeaders(model.headers, `resolved model \"${model.id}\"`);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;"
+        },
+        {
+          "before": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },",
+          "after": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, keyEntries: _keyEntries, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\tkeyEntries,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },"
+        },
+        {
+          "before": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/**\n* pi-ai-backed multi-provider adapter.",
+          "after": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/** Decode only the selected replay owner at the pi boundary; never merge equal wire ids across keys. */\nfunction replayContextForRoute(context, provider, requestedModel, wireModel) {\n\tconst selectedEntry = requestedModel.startsWith(KEY_MODEL_PREFIX);\n\treturn {\n\t\t...context,\n\t\tmessages: context.messages.map((message) => {\n\t\t\tif (message.role !== \"assistant\") return message;\n\t\t\tif (message.provider === provider && message.model === requestedModel) return { ...message, model: wireModel.id };\n\t\t\tif (!message.model.startsWith(KEY_MODEL_PREFIX) && !(selectedEntry && message.provider === provider && message.model === wireModel.id)) return message;\n\t\t\treturn {\n\t\t\t\trole: \"assistant\",\n\t\t\t\tapi: \"dsh-foreign\",\n\t\t\t\tprovider: message.provider,\n\t\t\t\tmodel: \"dsh-foreign\",\n\t\t\t\tcontent: message.content.flatMap((block) => {\n\t\t\t\t\tif (block.type === \"thinking\") return [];\n\t\t\t\t\tif (block.type === \"text\") return [{ type: \"text\", text: block.text }];\n\t\t\t\t\tif (block.type === \"toolCall\") return [{ type: \"toolCall\", id: block.id, name: block.name, arguments: block.arguments }];\n\t\t\t\t\treturn [block];\n\t\t\t\t}),\n\t\t\t\tusage: message.usage,\n\t\t\t\tstopReason: message.stopReason,\n\t\t\t\ttimestamp: message.timestamp\n\t\t\t};\n\t\t})\n\t};\n}\n/**\n* pi-ai-backed multi-provider adapter."
+        },
+        {
+          "before": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tfor (const profile of profiles.values()) if (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n",
+          "after": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tconst entryModels = new Map();\n\t\tfor (const [provider, profile] of profiles) {\n\t\t\tif (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\t\tconst entries = new Map();\n\t\t\tfor (const [id, entry] of profile.keyEntries) {\n\t\t\t\tconst collection = createModels(this.config.auth);\n\t\t\t\tif (entry.piProvider !== void 0) collection.setProvider(entry.piProvider);\n\t\t\t\tentries.set(id, collection);\n\t\t\t}\n\t\t\tentryModels.set(provider, entries);\n\t\t}\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels,\n\t\t\tentryModels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n"
+        },
+        {
+          "before": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst failure = profile.modelErrors.get(model) ?? (profile.piProvider === void 0 ? profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = snapshot.models.getModel(provider, model);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n",
+          "after": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** Bind the public selection to an exact profile, independent model collection, and upstream id. */\n\trouteOf(snapshot, provider, model) {\n\t\tconst root = this.profileOf(snapshot, provider);\n\t\tconst entry = keyModelRoute(model);\n\t\tif (entry === void 0) return { profile: root, models: snapshot.models, wireModel: model };\n\t\tif (root.multiKey !== true) throw new LlmError(`multi-key selection is disabled for provider \"${provider}\"`, \"UNKNOWN_MODEL\");\n\t\tconst profile = root.keyEntries.get(entry.entryId);\n\t\tconst models = snapshot.entryModels.get(provider)?.get(entry.entryId);\n\t\tif (profile === void 0 || models === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${entry.entryId}\"`, \"UNKNOWN_MODEL\");\n\t\treturn { profile, models, wireModel: entry.wireModel };\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst route = this.routeOf(snapshot, provider, model);\n\t\tconst failure = route.profile.modelErrors.get(route.wireModel) ?? (route.profile.piProvider === void 0 ? route.profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = route.models.getModel(provider, route.wireModel);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n"
+        },
+        {
+          "before": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\ttry {\n\t\t\t\tawait this.config.resolveApiKey(provider, profile);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return [];\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn snapshot.models.getModels(provider).map((model) => ({\n\t\t\t\tprovider,\n\t\t\t\tid: model.id,\n\t\t\t\tname: model.name,\n\t\t\t\tinputModalities: [...model.input]\n\t\t\t}));\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n",
+          "after": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\tconst listed = [];\n\t\t\tconst append = async (owner, models, entryId) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst key = await this.config.resolveApiKey(provider, owner);\n\t\t\t\t\tif (entryId !== void 0 && (key === void 0 || key.length === 0)) return;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return;\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tfor (const model of models.getModels(provider)) listed.push({\n\t\t\t\t\tprovider,\n\t\t\t\t\tid: entryId === void 0 ? model.id : keyModelId(entryId, model.id),\n\t\t\t\t\tname: model.name,\n\t\t\t\t\tinputModalities: [...model.input]\n\t\t\t\t});\n\t\t\t};\n\t\t\t// Keep raw root models advertised so old sessions remain routable without changing keys.\n\t\t\tawait append(profile, snapshot.models);\n\t\t\tif (profile.multiKey === true) for (const [id, entry] of profile.keyEntries) await append(entry, snapshot.entryModels.get(provider).get(id), id);\n\t\t\treturn listed;\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n"
+        },
+        {
+          "before": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(model);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n",
+          "after": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst { profile, wireModel } = this.routeOf(snapshot, provider, model);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(wireModel);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n"
+        },
+        {
+          "before": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => this.streamWithSnapshot(options, snapshot)\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot(options, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n",
+          "after": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => {\n\t\t\t\tif (options.provider !== provider || options.model !== model) throw new LlmError(\"prepared multi-key model selection changed before adapter dispatch\", \"INVALID_CONFIG\");\n\t\t\t\t// Async generators are lazy; pin the owner before returning one to caller-owned code.\n\t\t\t\treturn this.streamWithSnapshot({ ...options, provider, model }, snapshot);\n\t\t\t}\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot({ ...options }, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n"
+        },
+        {
+          "before": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst profile = this.profileOf(snapshot, options.provider);\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n",
+          "after": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst route = this.routeOf(snapshot, options.provider, options.model);\n\t\t\tconst profile = route.profile;\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n"
+        },
+        {
+          "before": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n",
+          "after": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tif (profile.keyEntryId !== void 0 && (apiKey === void 0 || apiKey.length === 0)) throw new LlmError(`provider \"${options.provider}\" key entry \"${profile.keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n"
+        },
+        {
+          "before": "\t\t\t\tconst iterator = toStreamChunks(snapshot.models.streamSimple(model, context, {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, model.id)[Symbol.asyncIterator]();",
+          "after": "\t\t\t\tconst iterator = toStreamChunks(route.models.streamSimple(model, replayContextForRoute(context, options.provider, options.model, model), {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, options.model)[Symbol.asyncIterator]();"
+        },
+        {
+          "before": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n",
+          "after": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\t// Validate host-owned entry identity even on the installed-catalog shortcut.\n\tconst selectedStored = request.keyEntryId === void 0 ? void 0 : storedProfile?.();\n\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n",
+          "after": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = selectedStored ?? storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n"
+        },
+        {
+          "before": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n",
+          "after": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy,\n\t\tmultiKey: profile.multiKey === true,\n\t\tapiKeyEnv: profile.apiKeyEnv,\n\t\tmodels: profile.piProvider?.getModels(),\n\t\tmodelErrors: [...profile.modelErrors],\n\t\tkeyEntries: [...profile.keyEntries].map(([id, entry]) => ({\n\t\t\tid,\n\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),\n\t\t\tmodelErrors: [...entry.modelErrors]\n\t\t})).sort((left, right) => left.id.localeCompare(right.id))\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n"
+        },
+        {
+          "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
+          "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        }
+      ]
+    },
+    {
+      "source": "0.2.2-rc.1 with tool lookup optimization and credential cancellation",
+      "baseSha256": "0a99a2fc903a4285044b09114b3bd20ee1e612f39aa381e4a71b10d48ee9e9f7",
+      "resultSha256": "c87f965d9fcc5bbcd386e98ea3b292b05ec7a55d80df1266e18234031b80990e",
+      "replacements": [
+        {
+          "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
+          "after": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\n// Model selection carries an opaque entry identity, never a credential or a wire alias.\nconst KEY_MODEL_PREFIX = \"@dsh-key/\";\nconst KEY_ENTRY_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/;\nconst FORBIDDEN_KEY_ENTRY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst AUTH_HEADER_NAMES = new Set([\"authorization\", \"proxy-authorization\", \"x-api-key\", \"api-key\", \"cf-aig-authorization\"]);\nfunction validKeyEntryId(id) {\n\treturn KEY_ENTRY_ID.test(id) && !FORBIDDEN_KEY_ENTRY_IDS.has(id);\n}\nfunction keyModelId(entryId, model) {\n\treturn `${KEY_MODEL_PREFIX}${encodeURIComponent(entryId)}/${encodeURIComponent(model)}`;\n}\nfunction keyModelRoute(model) {\n\tif (!model.startsWith(KEY_MODEL_PREFIX)) return void 0;\n\ttry {\n\t\tconst parts = model.slice(KEY_MODEL_PREFIX.length).split(\"/\");\n\t\tif (parts.length === 2) {\n\t\t\tconst entryId = decodeURIComponent(parts[0]);\n\t\t\tconst wireModel = decodeURIComponent(parts[1]);\n\t\t\tif (validKeyEntryId(entryId) && wireModel.length > 0 && !wireModel.startsWith(KEY_MODEL_PREFIX) && keyModelId(entryId, wireModel) === model) return { entryId, wireModel };\n\t\t}\n\t} catch {}\n\tthrow new LlmError(`invalid multi-key model selection \"${model}\"`, \"UNKNOWN_MODEL\");\n}\nconst keyEntryProfile = z.object({\n\tname: z.string().max(120).required(),\n\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});\nconst profile = z.object({\n\tmultiKey: z.boolean().default(false),\n\tkeyEntries: z.dict(keyEntryProfile).default({}),\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n"
+        },
+        {
+          "before": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\") {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n",
+          "after": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\", forKeyEntry = false) {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n"
+        },
+        {
+          "before": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n",
+          "after": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst entrySources = source.keyEntries ?? {};\n\t\tif (typeof entrySources !== \"object\" || entrySources === null || Array.isArray(entrySources)) throw new Error(`llm-pi-ai: provider \"${provider}\" keyEntries must be a dictionary`);\n\t\tconst assertWireModels = (models, site) => {\n\t\t\tfor (const model of models ?? []) if (typeof model.id !== \"string\" || model.id.length === 0 || model.id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} must use non-empty upstream model ids outside the reserved ${KEY_MODEL_PREFIX} prefix`);\n\t\t};\n\t\tassertWireModels(source.models, \"models\");\n\t\tfor (const id of Object.keys(source.modelOverrides ?? {})) if (id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" modelOverrides uses reserved prefix ${KEY_MODEL_PREFIX}`);\n\t\tfor (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tif (!validKeyEntryId(id)) throw new Error(`llm-pi-ai: provider \"${provider}\" has an invalid key entry id \"${id}\"`);\n\t\t\tif (typeof entry !== \"object\" || entry === null || typeof entry.name !== \"string\" || entry.name.trim().length === 0 || entry.name.length > 120) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs a name of 1-120 characters`);\n\t\t\tif (typeof entry.apiKeyEnv !== \"string\" || entry.apiKeyEnv.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own apiKeyEnv`);\n\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own models list`);\n\t\t\tassertWireModels(entry.models, `key entry \"${id}\" models`);\n\t\t}\n\t\tconst assertEntryHeaders = (headers, site) => {\n\t\t\tfor (const name of Object.keys(headers ?? {})) if (AUTH_HEADER_NAMES.has(name.toLowerCase())) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} authentication header \"${name}\" would override the selected key; remove it before enabling multiKey`);\n\t\t};\n\t\tif (source.multiKey === true || forKeyEntry) {\n\t\t\tassertEntryHeaders(source.headers, \"shared\");\n\t\t\tfor (const model of source.models ?? []) assertEntryHeaders(model.headers, `model \"${model.id}\"`);\n\t\t\tfor (const [id, override] of Object.entries(source.modelOverrides ?? {})) assertEntryHeaders(override.headers, `model override \"${id}\"`);\n\t\t}\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n"
+        },
+        {
+          "before": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\ttry {\n\t\t\tcatalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n",
+          "after": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tconst keyEntries = new Map();\n\t\t// Disabled entries remain stored, but cannot constrain legacy single-key runtime behavior.\n\t\tif (source.multiKey === true) for (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,\n\t\t\t\tkeyEntries: {},\n\t\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\t\tmodels: entry.models,\n\t\t\t\tmodelOverrides: void 0\n\t\t\t} }, validation, true).get(provider);\n\t\t\t// Entry auth must not consult a catalog provider's ambient/OAuth credential or endpoint.\n\t\t\tkeyEntries.set(id, {\n\t\t\t\t...child,\n\t\t\t\tkeyEntryId: id,\n\t\t\t\tkeyEntryName: entry.name,\n\t\t\t\t...child.piProvider === void 0 ? {} : { piProvider: { ...child.piProvider, auth: { apiKey: harnessApiKeyAuth(entry.name) } } }\n\t\t\t});\n\t\t}\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\tconst entryOnly = forKeyEntry && source.models.length === 0 || source.multiKey === true && keyEntries.size > 0 && (source.models ?? []).length === 0 && catalogModels(provider).size === 0;\n\t\ttry {\n\t\t\tif (entryOnly) catalog = { models: [], configuredMaxTokens: new Map(), modelErrors: new Map() };\n\t\t\telse catalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n"
+        },
+        {
+          "before": "\t\t\t}, validation);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;",
+          "after": "\t\t\t}, validation);\n\t\t\tif (source.multiKey === true || forKeyEntry) for (const model of catalog.models) assertEntryHeaders(model.headers, `resolved model \"${model.id}\"`);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;"
+        },
+        {
+          "before": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },",
+          "after": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, keyEntries: _keyEntries, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\tkeyEntries,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },"
+        },
+        {
+          "before": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/**\n* pi-ai-backed multi-provider adapter.",
+          "after": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/** Decode only the selected replay owner at the pi boundary; never merge equal wire ids across keys. */\nfunction replayContextForRoute(context, provider, requestedModel, wireModel) {\n\tconst selectedEntry = requestedModel.startsWith(KEY_MODEL_PREFIX);\n\treturn {\n\t\t...context,\n\t\tmessages: context.messages.map((message) => {\n\t\t\tif (message.role !== \"assistant\") return message;\n\t\t\tif (message.provider === provider && message.model === requestedModel) return { ...message, model: wireModel.id };\n\t\t\tif (!message.model.startsWith(KEY_MODEL_PREFIX) && !(selectedEntry && message.provider === provider && message.model === wireModel.id)) return message;\n\t\t\treturn {\n\t\t\t\trole: \"assistant\",\n\t\t\t\tapi: \"dsh-foreign\",\n\t\t\t\tprovider: message.provider,\n\t\t\t\tmodel: \"dsh-foreign\",\n\t\t\t\tcontent: message.content.flatMap((block) => {\n\t\t\t\t\tif (block.type === \"thinking\") return [];\n\t\t\t\t\tif (block.type === \"text\") return [{ type: \"text\", text: block.text }];\n\t\t\t\t\tif (block.type === \"toolCall\") return [{ type: \"toolCall\", id: block.id, name: block.name, arguments: block.arguments }];\n\t\t\t\t\treturn [block];\n\t\t\t\t}),\n\t\t\t\tusage: message.usage,\n\t\t\t\tstopReason: message.stopReason,\n\t\t\t\ttimestamp: message.timestamp\n\t\t\t};\n\t\t})\n\t};\n}\n/**\n* pi-ai-backed multi-provider adapter."
+        },
+        {
+          "before": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tfor (const profile of profiles.values()) if (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n",
+          "after": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tconst entryModels = new Map();\n\t\tfor (const [provider, profile] of profiles) {\n\t\t\tif (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\t\tconst entries = new Map();\n\t\t\tfor (const [id, entry] of profile.keyEntries) {\n\t\t\t\tconst collection = createModels(this.config.auth);\n\t\t\t\tif (entry.piProvider !== void 0) collection.setProvider(entry.piProvider);\n\t\t\t\tentries.set(id, collection);\n\t\t\t}\n\t\t\tentryModels.set(provider, entries);\n\t\t}\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels,\n\t\t\tentryModels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n"
+        },
+        {
+          "before": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst failure = profile.modelErrors.get(model) ?? (profile.piProvider === void 0 ? profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = snapshot.models.getModel(provider, model);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n",
+          "after": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** Bind the public selection to an exact profile, independent model collection, and upstream id. */\n\trouteOf(snapshot, provider, model) {\n\t\tconst root = this.profileOf(snapshot, provider);\n\t\tconst entry = keyModelRoute(model);\n\t\tif (entry === void 0) return { profile: root, models: snapshot.models, wireModel: model };\n\t\tif (root.multiKey !== true) throw new LlmError(`multi-key selection is disabled for provider \"${provider}\"`, \"UNKNOWN_MODEL\");\n\t\tconst profile = root.keyEntries.get(entry.entryId);\n\t\tconst models = snapshot.entryModels.get(provider)?.get(entry.entryId);\n\t\tif (profile === void 0 || models === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${entry.entryId}\"`, \"UNKNOWN_MODEL\");\n\t\treturn { profile, models, wireModel: entry.wireModel };\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst route = this.routeOf(snapshot, provider, model);\n\t\tconst failure = route.profile.modelErrors.get(route.wireModel) ?? (route.profile.piProvider === void 0 ? route.profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = route.models.getModel(provider, route.wireModel);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n"
+        },
+        {
+          "before": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\ttry {\n\t\t\t\tawait this.config.resolveApiKey(provider, profile);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return [];\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn snapshot.models.getModels(provider).map((model) => ({\n\t\t\t\tprovider,\n\t\t\t\tid: model.id,\n\t\t\t\tname: model.name,\n\t\t\t\tinputModalities: [...model.input]\n\t\t\t}));\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n",
+          "after": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\tconst listed = [];\n\t\t\tconst append = async (owner, models, entryId) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst key = await this.config.resolveApiKey(provider, owner);\n\t\t\t\t\tif (entryId !== void 0 && (key === void 0 || key.length === 0)) return;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return;\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tfor (const model of models.getModels(provider)) listed.push({\n\t\t\t\t\tprovider,\n\t\t\t\t\tid: entryId === void 0 ? model.id : keyModelId(entryId, model.id),\n\t\t\t\t\tname: model.name,\n\t\t\t\t\tinputModalities: [...model.input]\n\t\t\t\t});\n\t\t\t};\n\t\t\t// Keep raw root models advertised so old sessions remain routable without changing keys.\n\t\t\tawait append(profile, snapshot.models);\n\t\t\tif (profile.multiKey === true) for (const [id, entry] of profile.keyEntries) await append(entry, snapshot.entryModels.get(provider).get(id), id);\n\t\t\treturn listed;\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n"
+        },
+        {
+          "before": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(model);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n",
+          "after": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst { profile, wireModel } = this.routeOf(snapshot, provider, model);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(wireModel);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n"
+        },
+        {
+          "before": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => this.streamWithSnapshot(options, snapshot)\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot(options, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n",
+          "after": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => {\n\t\t\t\tif (options.provider !== provider || options.model !== model) throw new LlmError(\"prepared multi-key model selection changed before adapter dispatch\", \"INVALID_CONFIG\");\n\t\t\t\t// Async generators are lazy; pin the owner before returning one to caller-owned code.\n\t\t\t\treturn this.streamWithSnapshot({ ...options, provider, model }, snapshot);\n\t\t\t}\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot({ ...options }, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n"
+        },
+        {
+          "before": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst profile = this.profileOf(snapshot, options.provider);\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n",
+          "after": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst route = this.routeOf(snapshot, options.provider, options.model);\n\t\t\tconst profile = route.profile;\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n"
+        },
+        {
+          "before": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n",
+          "after": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tif (profile.keyEntryId !== void 0 && (apiKey === void 0 || apiKey.length === 0)) throw new LlmError(`provider \"${options.provider}\" key entry \"${profile.keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n"
+        },
+        {
+          "before": "\t\t\t\tconst iterator = toStreamChunks(snapshot.models.streamSimple(model, context, {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, model.id)[Symbol.asyncIterator]();",
+          "after": "\t\t\t\tconst iterator = toStreamChunks(route.models.streamSimple(model, replayContextForRoute(context, options.provider, options.model, model), {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, options.model)[Symbol.asyncIterator]();"
+        },
+        {
+          "before": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n",
+          "after": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\t// Validate host-owned entry identity even on the installed-catalog shortcut.\n\tconst selectedStored = request.keyEntryId === void 0 ? void 0 : storedProfile?.();\n\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n",
+          "after": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = selectedStored ?? storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n"
+        },
+        {
+          "before": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n",
+          "after": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy,\n\t\tmultiKey: profile.multiKey === true,\n\t\tapiKeyEnv: profile.apiKeyEnv,\n\t\tmodels: profile.piProvider?.getModels(),\n\t\tmodelErrors: [...profile.modelErrors],\n\t\tkeyEntries: [...profile.keyEntries].map(([id, entry]) => ({\n\t\t\tid,\n\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),\n\t\t\tmodelErrors: [...entry.modelErrors]\n\t\t})).sort((left, right) => left.id.localeCompare(right.id))\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n"
+        },
+        {
+          "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
+          "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        }
+      ]
+    },
+    {
+      "source": "npm official 0.2.2-rc.1",
+      "baseSha256": "1a3ae58f9b4493e15459cc5000ec80f21b5d3f4a9dea6ffb6bc28e5b8817ae8a",
+      "resultSha256": "b9416207cc7c27aff40cb2b877c9176e53809eb2f6dc741828c2ed6f6bdf541b",
+      "replacements": [
+        {
+          "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
+          "after": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\n// Model selection carries an opaque entry identity, never a credential or a wire alias.\nconst KEY_MODEL_PREFIX = \"@dsh-key/\";\nconst KEY_ENTRY_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/;\nconst FORBIDDEN_KEY_ENTRY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst AUTH_HEADER_NAMES = new Set([\"authorization\", \"proxy-authorization\", \"x-api-key\", \"api-key\", \"cf-aig-authorization\"]);\nfunction validKeyEntryId(id) {\n\treturn KEY_ENTRY_ID.test(id) && !FORBIDDEN_KEY_ENTRY_IDS.has(id);\n}\nfunction keyModelId(entryId, model) {\n\treturn `${KEY_MODEL_PREFIX}${encodeURIComponent(entryId)}/${encodeURIComponent(model)}`;\n}\nfunction keyModelRoute(model) {\n\tif (!model.startsWith(KEY_MODEL_PREFIX)) return void 0;\n\ttry {\n\t\tconst parts = model.slice(KEY_MODEL_PREFIX.length).split(\"/\");\n\t\tif (parts.length === 2) {\n\t\t\tconst entryId = decodeURIComponent(parts[0]);\n\t\t\tconst wireModel = decodeURIComponent(parts[1]);\n\t\t\tif (validKeyEntryId(entryId) && wireModel.length > 0 && !wireModel.startsWith(KEY_MODEL_PREFIX) && keyModelId(entryId, wireModel) === model) return { entryId, wireModel };\n\t\t}\n\t} catch {}\n\tthrow new LlmError(`invalid multi-key model selection \"${model}\"`, \"UNKNOWN_MODEL\");\n}\nconst keyEntryProfile = z.object({\n\tname: z.string().max(120).required(),\n\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});\nconst profile = z.object({\n\tmultiKey: z.boolean().default(false),\n\tkeyEntries: z.dict(keyEntryProfile).default({}),\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n"
+        },
+        {
+          "before": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\") {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n",
+          "after": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\", forKeyEntry = false) {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n"
+        },
+        {
+          "before": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n",
+          "after": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst entrySources = source.keyEntries ?? {};\n\t\tif (typeof entrySources !== \"object\" || entrySources === null || Array.isArray(entrySources)) throw new Error(`llm-pi-ai: provider \"${provider}\" keyEntries must be a dictionary`);\n\t\tconst assertWireModels = (models, site) => {\n\t\t\tfor (const model of models ?? []) if (typeof model.id !== \"string\" || model.id.length === 0 || model.id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} must use non-empty upstream model ids outside the reserved ${KEY_MODEL_PREFIX} prefix`);\n\t\t};\n\t\tassertWireModels(source.models, \"models\");\n\t\tfor (const id of Object.keys(source.modelOverrides ?? {})) if (id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" modelOverrides uses reserved prefix ${KEY_MODEL_PREFIX}`);\n\t\tfor (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tif (!validKeyEntryId(id)) throw new Error(`llm-pi-ai: provider \"${provider}\" has an invalid key entry id \"${id}\"`);\n\t\t\tif (typeof entry !== \"object\" || entry === null || typeof entry.name !== \"string\" || entry.name.trim().length === 0 || entry.name.length > 120) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs a name of 1-120 characters`);\n\t\t\tif (typeof entry.apiKeyEnv !== \"string\" || entry.apiKeyEnv.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own apiKeyEnv`);\n\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own models list`);\n\t\t\tassertWireModels(entry.models, `key entry \"${id}\" models`);\n\t\t}\n\t\tconst assertEntryHeaders = (headers, site) => {\n\t\t\tfor (const name of Object.keys(headers ?? {})) if (AUTH_HEADER_NAMES.has(name.toLowerCase())) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} authentication header \"${name}\" would override the selected key; remove it before enabling multiKey`);\n\t\t};\n\t\tif (source.multiKey === true || forKeyEntry) {\n\t\t\tassertEntryHeaders(source.headers, \"shared\");\n\t\t\tfor (const model of source.models ?? []) assertEntryHeaders(model.headers, `model \"${model.id}\"`);\n\t\t\tfor (const [id, override] of Object.entries(source.modelOverrides ?? {})) assertEntryHeaders(override.headers, `model override \"${id}\"`);\n\t\t}\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n"
+        },
+        {
+          "before": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\ttry {\n\t\t\tcatalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n",
+          "after": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tconst keyEntries = new Map();\n\t\t// Disabled entries remain stored, but cannot constrain legacy single-key runtime behavior.\n\t\tif (source.multiKey === true) for (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,\n\t\t\t\tkeyEntries: {},\n\t\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\t\tmodels: entry.models,\n\t\t\t\tmodelOverrides: void 0\n\t\t\t} }, validation, true).get(provider);\n\t\t\t// Entry auth must not consult a catalog provider's ambient/OAuth credential or endpoint.\n\t\t\tkeyEntries.set(id, {\n\t\t\t\t...child,\n\t\t\t\tkeyEntryId: id,\n\t\t\t\tkeyEntryName: entry.name,\n\t\t\t\t...child.piProvider === void 0 ? {} : { piProvider: { ...child.piProvider, auth: { apiKey: harnessApiKeyAuth(entry.name) } } }\n\t\t\t});\n\t\t}\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\tconst entryOnly = forKeyEntry && source.models.length === 0 || source.multiKey === true && keyEntries.size > 0 && (source.models ?? []).length === 0 && catalogModels(provider).size === 0;\n\t\ttry {\n\t\t\tif (entryOnly) catalog = { models: [], configuredMaxTokens: new Map(), modelErrors: new Map() };\n\t\t\telse catalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n"
+        },
+        {
+          "before": "\t\t\t}, validation);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;",
+          "after": "\t\t\t}, validation);\n\t\t\tif (source.multiKey === true || forKeyEntry) for (const model of catalog.models) assertEntryHeaders(model.headers, `resolved model \"${model.id}\"`);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;"
+        },
+        {
+          "before": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },",
+          "after": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, keyEntries: _keyEntries, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\tkeyEntries,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },"
+        },
+        {
+          "before": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/**\n* pi-ai-backed multi-provider adapter.",
+          "after": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/** Decode only the selected replay owner at the pi boundary; never merge equal wire ids across keys. */\nfunction replayContextForRoute(context, provider, requestedModel, wireModel) {\n\tconst selectedEntry = requestedModel.startsWith(KEY_MODEL_PREFIX);\n\treturn {\n\t\t...context,\n\t\tmessages: context.messages.map((message) => {\n\t\t\tif (message.role !== \"assistant\") return message;\n\t\t\tif (message.provider === provider && message.model === requestedModel) return { ...message, model: wireModel.id };\n\t\t\tif (!message.model.startsWith(KEY_MODEL_PREFIX) && !(selectedEntry && message.provider === provider && message.model === wireModel.id)) return message;\n\t\t\treturn {\n\t\t\t\trole: \"assistant\",\n\t\t\t\tapi: \"dsh-foreign\",\n\t\t\t\tprovider: message.provider,\n\t\t\t\tmodel: \"dsh-foreign\",\n\t\t\t\tcontent: message.content.flatMap((block) => {\n\t\t\t\t\tif (block.type === \"thinking\") return [];\n\t\t\t\t\tif (block.type === \"text\") return [{ type: \"text\", text: block.text }];\n\t\t\t\t\tif (block.type === \"toolCall\") return [{ type: \"toolCall\", id: block.id, name: block.name, arguments: block.arguments }];\n\t\t\t\t\treturn [block];\n\t\t\t\t}),\n\t\t\t\tusage: message.usage,\n\t\t\t\tstopReason: message.stopReason,\n\t\t\t\ttimestamp: message.timestamp\n\t\t\t};\n\t\t})\n\t};\n}\n/**\n* pi-ai-backed multi-provider adapter."
+        },
+        {
+          "before": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tfor (const profile of profiles.values()) if (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n",
+          "after": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tconst entryModels = new Map();\n\t\tfor (const [provider, profile] of profiles) {\n\t\t\tif (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\t\tconst entries = new Map();\n\t\t\tfor (const [id, entry] of profile.keyEntries) {\n\t\t\t\tconst collection = createModels(this.config.auth);\n\t\t\t\tif (entry.piProvider !== void 0) collection.setProvider(entry.piProvider);\n\t\t\t\tentries.set(id, collection);\n\t\t\t}\n\t\t\tentryModels.set(provider, entries);\n\t\t}\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels,\n\t\t\tentryModels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n"
+        },
+        {
+          "before": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst failure = profile.modelErrors.get(model) ?? (profile.piProvider === void 0 ? profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = snapshot.models.getModel(provider, model);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n",
+          "after": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** Bind the public selection to an exact profile, independent model collection, and upstream id. */\n\trouteOf(snapshot, provider, model) {\n\t\tconst root = this.profileOf(snapshot, provider);\n\t\tconst entry = keyModelRoute(model);\n\t\tif (entry === void 0) return { profile: root, models: snapshot.models, wireModel: model };\n\t\tif (root.multiKey !== true) throw new LlmError(`multi-key selection is disabled for provider \"${provider}\"`, \"UNKNOWN_MODEL\");\n\t\tconst profile = root.keyEntries.get(entry.entryId);\n\t\tconst models = snapshot.entryModels.get(provider)?.get(entry.entryId);\n\t\tif (profile === void 0 || models === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${entry.entryId}\"`, \"UNKNOWN_MODEL\");\n\t\treturn { profile, models, wireModel: entry.wireModel };\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst route = this.routeOf(snapshot, provider, model);\n\t\tconst failure = route.profile.modelErrors.get(route.wireModel) ?? (route.profile.piProvider === void 0 ? route.profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = route.models.getModel(provider, route.wireModel);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n"
+        },
+        {
+          "before": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\ttry {\n\t\t\t\tawait this.config.resolveApiKey(provider, profile);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return [];\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn snapshot.models.getModels(provider).map((model) => ({\n\t\t\t\tprovider,\n\t\t\t\tid: model.id,\n\t\t\t\tname: model.name,\n\t\t\t\tinputModalities: [...model.input]\n\t\t\t}));\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n",
+          "after": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\tconst listed = [];\n\t\t\tconst append = async (owner, models, entryId) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst key = await this.config.resolveApiKey(provider, owner);\n\t\t\t\t\tif (entryId !== void 0 && (key === void 0 || key.length === 0)) return;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return;\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tfor (const model of models.getModels(provider)) listed.push({\n\t\t\t\t\tprovider,\n\t\t\t\t\tid: entryId === void 0 ? model.id : keyModelId(entryId, model.id),\n\t\t\t\t\tname: model.name,\n\t\t\t\t\tinputModalities: [...model.input]\n\t\t\t\t});\n\t\t\t};\n\t\t\t// Keep raw root models advertised so old sessions remain routable without changing keys.\n\t\t\tawait append(profile, snapshot.models);\n\t\t\tif (profile.multiKey === true) for (const [id, entry] of profile.keyEntries) await append(entry, snapshot.entryModels.get(provider).get(id), id);\n\t\t\treturn listed;\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n"
+        },
+        {
+          "before": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(model);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n",
+          "after": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst { profile, wireModel } = this.routeOf(snapshot, provider, model);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(wireModel);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n"
+        },
+        {
+          "before": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => this.streamWithSnapshot(options, snapshot)\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot(options, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n",
+          "after": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => {\n\t\t\t\tif (options.provider !== provider || options.model !== model) throw new LlmError(\"prepared multi-key model selection changed before adapter dispatch\", \"INVALID_CONFIG\");\n\t\t\t\t// Async generators are lazy; pin the owner before returning one to caller-owned code.\n\t\t\t\treturn this.streamWithSnapshot({ ...options, provider, model }, snapshot);\n\t\t\t}\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot({ ...options }, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n"
+        },
+        {
+          "before": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst profile = this.profileOf(snapshot, options.provider);\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n",
+          "after": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst route = this.routeOf(snapshot, options.provider, options.model);\n\t\t\tconst profile = route.profile;\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n"
+        },
+        {
+          "before": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n",
+          "after": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tif (profile.keyEntryId !== void 0 && (apiKey === void 0 || apiKey.length === 0)) throw new LlmError(`provider \"${options.provider}\" key entry \"${profile.keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n"
+        },
+        {
+          "before": "\t\t\t\tconst iterator = toStreamChunks(snapshot.models.streamSimple(model, context, {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, model.id)[Symbol.asyncIterator]();",
+          "after": "\t\t\t\tconst iterator = toStreamChunks(route.models.streamSimple(model, replayContextForRoute(context, options.provider, options.model, model), {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, options.model)[Symbol.asyncIterator]();"
+        },
+        {
+          "before": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n",
+          "after": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\t// Validate host-owned entry identity even on the installed-catalog shortcut.\n\tconst selectedStored = request.keyEntryId === void 0 ? void 0 : storedProfile?.();\n\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n",
+          "after": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = selectedStored ?? storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n"
+        },
+        {
+          "before": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n",
+          "after": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy,\n\t\tmultiKey: profile.multiKey === true,\n\t\tapiKeyEnv: profile.apiKeyEnv,\n\t\tmodels: profile.piProvider?.getModels(),\n\t\tmodelErrors: [...profile.modelErrors],\n\t\tkeyEntries: [...profile.keyEntries].map(([id, entry]) => ({\n\t\t\tid,\n\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),\n\t\t\tmodelErrors: [...entry.modelErrors]\n\t\t})).sort((left, right) => left.id.localeCompare(right.id))\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n"
+        },
+        {
+          "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
+          "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        }
+      ]
+    },
+    {
+      "source": "npm official 0.2.2-rc.1 with per-entry API overrides",
+      "baseSha256": "1a3ae58f9b4493e15459cc5000ec80f21b5d3f4a9dea6ffb6bc28e5b8817ae8a",
+      "resultSha256": "5ea8e84da726c04caa6bb321cf41617051ad9a80444834328007643b09b43a32",
+      "replacements": [
+        {
+          "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
+          "after": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\n// Model selection carries an opaque entry identity, never a credential or a wire alias.\nconst KEY_MODEL_PREFIX = \"@dsh-key/\";\nconst KEY_ENTRY_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/;\nconst FORBIDDEN_KEY_ENTRY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst AUTH_HEADER_NAMES = new Set([\"authorization\", \"proxy-authorization\", \"x-api-key\", \"api-key\", \"cf-aig-authorization\"]);\nfunction validKeyEntryId(id) {\n\treturn KEY_ENTRY_ID.test(id) && !FORBIDDEN_KEY_ENTRY_IDS.has(id);\n}\nfunction keyModelId(entryId, model) {\n\treturn `${KEY_MODEL_PREFIX}${encodeURIComponent(entryId)}/${encodeURIComponent(model)}`;\n}\nfunction keyModelRoute(model) {\n\tif (!model.startsWith(KEY_MODEL_PREFIX)) return void 0;\n\ttry {\n\t\tconst parts = model.slice(KEY_MODEL_PREFIX.length).split(\"/\");\n\t\tif (parts.length === 2) {\n\t\t\tconst entryId = decodeURIComponent(parts[0]);\n\t\t\tconst wireModel = decodeURIComponent(parts[1]);\n\t\t\tif (validKeyEntryId(entryId) && wireModel.length > 0 && !wireModel.startsWith(KEY_MODEL_PREFIX) && keyModelId(entryId, wireModel) === model) return { entryId, wireModel };\n\t\t}\n\t} catch {}\n\tthrow new LlmError(`invalid multi-key model selection \"${model}\"`, \"UNKNOWN_MODEL\");\n}\nconst keyEntryProfile = z.object({\n\tname: z.string().max(120).required(),\n\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});\nconst profile = z.object({\n\tmultiKey: z.boolean().default(false),\n\tkeyEntries: z.dict(keyEntryProfile).default({}),\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n"
+        },
+        {
+          "before": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\") {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n",
+          "after": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\", forKeyEntry = false) {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n"
+        },
+        {
+          "before": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n",
+          "after": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst entrySources = source.keyEntries ?? {};\n\t\tif (typeof entrySources !== \"object\" || entrySources === null || Array.isArray(entrySources)) throw new Error(`llm-pi-ai: provider \"${provider}\" keyEntries must be a dictionary`);\n\t\tconst assertWireModels = (models, site) => {\n\t\t\tfor (const model of models ?? []) if (typeof model.id !== \"string\" || model.id.length === 0 || model.id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} must use non-empty upstream model ids outside the reserved ${KEY_MODEL_PREFIX} prefix`);\n\t\t};\n\t\tassertWireModels(source.models, \"models\");\n\t\tfor (const id of Object.keys(source.modelOverrides ?? {})) if (id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" modelOverrides uses reserved prefix ${KEY_MODEL_PREFIX}`);\n\t\tfor (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tif (!validKeyEntryId(id)) throw new Error(`llm-pi-ai: provider \"${provider}\" has an invalid key entry id \"${id}\"`);\n\t\t\tif (typeof entry !== \"object\" || entry === null || typeof entry.name !== \"string\" || entry.name.trim().length === 0 || entry.name.length > 120) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs a name of 1-120 characters`);\n\t\t\tif (typeof entry.apiKeyEnv !== \"string\" || entry.apiKeyEnv.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own apiKeyEnv`);\n\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own models list`);\n\t\t\tassertWireModels(entry.models, `key entry \"${id}\" models`);\n\t\t}\n\t\tconst assertEntryHeaders = (headers, site) => {\n\t\t\tfor (const name of Object.keys(headers ?? {})) if (AUTH_HEADER_NAMES.has(name.toLowerCase())) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} authentication header \"${name}\" would override the selected key; remove it before enabling multiKey`);\n\t\t};\n\t\tif (source.multiKey === true || forKeyEntry) {\n\t\t\tassertEntryHeaders(source.headers, \"shared\");\n\t\t\tfor (const model of source.models ?? []) assertEntryHeaders(model.headers, `model \"${model.id}\"`);\n\t\t\tfor (const [id, override] of Object.entries(source.modelOverrides ?? {})) assertEntryHeaders(override.headers, `model override \"${id}\"`);\n\t\t}\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n"
+        },
+        {
+          "before": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\ttry {\n\t\t\tcatalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n",
+          "after": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tconst keyEntries = new Map();\n\t\t// Disabled entries remain stored, but cannot constrain legacy single-key runtime behavior.\n\t\tif (source.multiKey === true) for (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,\n\t\t\t\tkeyEntries: {},\n\t\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\t\tmodels: entry.models,\n\t\t\t\tmodelOverrides: void 0\n\t\t\t} }, validation, true).get(provider);\n\t\t\t// Entry auth must not consult a catalog provider's ambient/OAuth credential or endpoint.\n\t\t\tkeyEntries.set(id, {\n\t\t\t\t...child,\n\t\t\t\tkeyEntryId: id,\n\t\t\t\tkeyEntryName: entry.name,\n\t\t\t\t...child.piProvider === void 0 ? {} : { piProvider: { ...child.piProvider, auth: { apiKey: harnessApiKeyAuth(entry.name) } } }\n\t\t\t});\n\t\t}\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\tconst entryOnly = forKeyEntry && source.models.length === 0 || source.multiKey === true && keyEntries.size > 0 && (source.models ?? []).length === 0 && catalogModels(provider).size === 0;\n\t\ttry {\n\t\t\tif (entryOnly) catalog = { models: [], configuredMaxTokens: new Map(), modelErrors: new Map() };\n\t\t\telse catalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n"
+        },
+        {
+          "before": "\t\t\t}, validation);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;",
+          "after": "\t\t\t}, validation);\n\t\t\tif (source.multiKey === true || forKeyEntry) for (const model of catalog.models) assertEntryHeaders(model.headers, `resolved model \"${model.id}\"`);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;"
+        },
+        {
+          "before": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },",
+          "after": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, keyEntries: _keyEntries, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\tkeyEntries,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },"
+        },
+        {
+          "before": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/**\n* pi-ai-backed multi-provider adapter.",
+          "after": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/** Decode only the selected replay owner at the pi boundary; never merge equal wire ids across keys. */\nfunction replayContextForRoute(context, provider, requestedModel, wireModel) {\n\tconst selectedEntry = requestedModel.startsWith(KEY_MODEL_PREFIX);\n\treturn {\n\t\t...context,\n\t\tmessages: context.messages.map((message) => {\n\t\t\tif (message.role !== \"assistant\") return message;\n\t\t\tif (message.provider === provider && message.model === requestedModel) return { ...message, model: wireModel.id };\n\t\t\tif (!message.model.startsWith(KEY_MODEL_PREFIX) && !(selectedEntry && message.provider === provider && message.model === wireModel.id)) return message;\n\t\t\treturn {\n\t\t\t\trole: \"assistant\",\n\t\t\t\tapi: \"dsh-foreign\",\n\t\t\t\tprovider: message.provider,\n\t\t\t\tmodel: \"dsh-foreign\",\n\t\t\t\tcontent: message.content.flatMap((block) => {\n\t\t\t\t\tif (block.type === \"thinking\") return [];\n\t\t\t\t\tif (block.type === \"text\") return [{ type: \"text\", text: block.text }];\n\t\t\t\t\tif (block.type === \"toolCall\") return [{ type: \"toolCall\", id: block.id, name: block.name, arguments: block.arguments }];\n\t\t\t\t\treturn [block];\n\t\t\t\t}),\n\t\t\t\tusage: message.usage,\n\t\t\t\tstopReason: message.stopReason,\n\t\t\t\ttimestamp: message.timestamp\n\t\t\t};\n\t\t})\n\t};\n}\n/**\n* pi-ai-backed multi-provider adapter."
+        },
+        {
+          "before": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tfor (const profile of profiles.values()) if (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n",
+          "after": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tconst entryModels = new Map();\n\t\tfor (const [provider, profile] of profiles) {\n\t\t\tif (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\t\tconst entries = new Map();\n\t\t\tfor (const [id, entry] of profile.keyEntries) {\n\t\t\t\tconst collection = createModels(this.config.auth);\n\t\t\t\tif (entry.piProvider !== void 0) collection.setProvider(entry.piProvider);\n\t\t\t\tentries.set(id, collection);\n\t\t\t}\n\t\t\tentryModels.set(provider, entries);\n\t\t}\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels,\n\t\t\tentryModels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n"
+        },
+        {
+          "before": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst failure = profile.modelErrors.get(model) ?? (profile.piProvider === void 0 ? profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = snapshot.models.getModel(provider, model);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n",
+          "after": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** Bind the public selection to an exact profile, independent model collection, and upstream id. */\n\trouteOf(snapshot, provider, model) {\n\t\tconst root = this.profileOf(snapshot, provider);\n\t\tconst entry = keyModelRoute(model);\n\t\tif (entry === void 0) return { profile: root, models: snapshot.models, wireModel: model };\n\t\tif (root.multiKey !== true) throw new LlmError(`multi-key selection is disabled for provider \"${provider}\"`, \"UNKNOWN_MODEL\");\n\t\tconst profile = root.keyEntries.get(entry.entryId);\n\t\tconst models = snapshot.entryModels.get(provider)?.get(entry.entryId);\n\t\tif (profile === void 0 || models === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${entry.entryId}\"`, \"UNKNOWN_MODEL\");\n\t\treturn { profile, models, wireModel: entry.wireModel };\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst route = this.routeOf(snapshot, provider, model);\n\t\tconst failure = route.profile.modelErrors.get(route.wireModel) ?? (route.profile.piProvider === void 0 ? route.profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = route.models.getModel(provider, route.wireModel);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n"
+        },
+        {
+          "before": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\ttry {\n\t\t\t\tawait this.config.resolveApiKey(provider, profile);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return [];\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn snapshot.models.getModels(provider).map((model) => ({\n\t\t\t\tprovider,\n\t\t\t\tid: model.id,\n\t\t\t\tname: model.name,\n\t\t\t\tinputModalities: [...model.input]\n\t\t\t}));\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n",
+          "after": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\tconst listed = [];\n\t\t\tconst append = async (owner, models, entryId) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst key = await this.config.resolveApiKey(provider, owner);\n\t\t\t\t\tif (entryId !== void 0 && (key === void 0 || key.length === 0)) return;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return;\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tfor (const model of models.getModels(provider)) listed.push({\n\t\t\t\t\tprovider,\n\t\t\t\t\tid: entryId === void 0 ? model.id : keyModelId(entryId, model.id),\n\t\t\t\t\tname: model.name,\n\t\t\t\t\tinputModalities: [...model.input]\n\t\t\t\t});\n\t\t\t};\n\t\t\t// Keep raw root models advertised so old sessions remain routable without changing keys.\n\t\t\tawait append(profile, snapshot.models);\n\t\t\tif (profile.multiKey === true) for (const [id, entry] of profile.keyEntries) await append(entry, snapshot.entryModels.get(provider).get(id), id);\n\t\t\treturn listed;\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n"
+        },
+        {
+          "before": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(model);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n",
+          "after": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst { profile, wireModel } = this.routeOf(snapshot, provider, model);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(wireModel);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n"
+        },
+        {
+          "before": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => this.streamWithSnapshot(options, snapshot)\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot(options, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n",
+          "after": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => {\n\t\t\t\tif (options.provider !== provider || options.model !== model) throw new LlmError(\"prepared multi-key model selection changed before adapter dispatch\", \"INVALID_CONFIG\");\n\t\t\t\t// Async generators are lazy; pin the owner before returning one to caller-owned code.\n\t\t\t\treturn this.streamWithSnapshot({ ...options, provider, model }, snapshot);\n\t\t\t}\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot({ ...options }, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n"
+        },
+        {
+          "before": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst profile = this.profileOf(snapshot, options.provider);\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n",
+          "after": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst route = this.routeOf(snapshot, options.provider, options.model);\n\t\t\tconst profile = route.profile;\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n"
+        },
+        {
+          "before": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n",
+          "after": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tif (profile.keyEntryId !== void 0 && (apiKey === void 0 || apiKey.length === 0)) throw new LlmError(`provider \"${options.provider}\" key entry \"${profile.keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n"
+        },
+        {
+          "before": "\t\t\t\tconst iterator = toStreamChunks(snapshot.models.streamSimple(model, context, {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, model.id)[Symbol.asyncIterator]();",
+          "after": "\t\t\t\tconst iterator = toStreamChunks(route.models.streamSimple(model, replayContextForRoute(context, options.provider, options.model, model), {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, options.model)[Symbol.asyncIterator]();"
+        },
+        {
+          "before": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n",
+          "after": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\t// Validate host-owned entry identity even on the installed-catalog shortcut.\n\tconst selectedStored = request.keyEntryId === void 0 ? void 0 : storedProfile?.();\n\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n",
+          "after": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = selectedStored ?? storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n"
+        },
+        {
+          "before": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n",
+          "after": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy,\n\t\tmultiKey: profile.multiKey === true,\n\t\tapiKeyEnv: profile.apiKeyEnv,\n\t\tmodels: profile.piProvider?.getModels(),\n\t\tmodelErrors: [...profile.modelErrors],\n\t\tkeyEntries: [...profile.keyEntries].map(([id, entry]) => ({\n\t\t\tid,\n\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),\n\t\t\tmodelErrors: [...entry.modelErrors]\n\t\t})).sort((left, right) => left.id.localeCompare(right.id))\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n"
+        },
+        {
+          "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
+          "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        },
+        {
+          "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
+          "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+        },
+        {
+          "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
+          "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+        },
+        {
+          "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
+          "after": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\t...entry.api === void 0 ? {} : { api: entry.api },\n\t\t\t\tmultiKey: false,"
+        },
+        {
+          "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api ?? selectedStored?.api ?? \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
+          "after": "\tconst baseURL = request.baseURL ?? selectedStored?.baseURL;\n\tif (baseURL === void 0 || baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(baseURL, api);"
+        },
+        {
+          "before": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),",
+          "after": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tapi: entry.api,\n\t\t\tmodels: entry.piProvider?.getModels(),"
+        },
+        {
+          "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
+          "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+        }
+      ]
+    },
+    {
+      "source": "npm official 0.2.2-rc.1 with per-entry API overrides",
+      "baseSha256": "1a3ae58f9b4493e15459cc5000ec80f21b5d3f4a9dea6ffb6bc28e5b8817ae8a",
+      "resultSha256": "9ca2b07c19694a4521a29c82b7948fb6326d80ee7741200a1d7b0f3f06e1da19",
+      "replacements": [
+        {
+          "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
+          "after": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\n// Model selection carries an opaque entry identity, never a credential or a wire alias.\nconst KEY_MODEL_PREFIX = \"@dsh-key/\";\nconst KEY_ENTRY_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/;\nconst FORBIDDEN_KEY_ENTRY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst AUTH_HEADER_NAMES = new Set([\"authorization\", \"proxy-authorization\", \"x-api-key\", \"api-key\", \"cf-aig-authorization\"]);\nfunction validKeyEntryId(id) {\n\treturn KEY_ENTRY_ID.test(id) && !FORBIDDEN_KEY_ENTRY_IDS.has(id);\n}\nfunction keyModelId(entryId, model) {\n\treturn `${KEY_MODEL_PREFIX}${encodeURIComponent(entryId)}/${encodeURIComponent(model)}`;\n}\nfunction keyModelRoute(model) {\n\tif (!model.startsWith(KEY_MODEL_PREFIX)) return void 0;\n\ttry {\n\t\tconst parts = model.slice(KEY_MODEL_PREFIX.length).split(\"/\");\n\t\tif (parts.length === 2) {\n\t\t\tconst entryId = decodeURIComponent(parts[0]);\n\t\t\tconst wireModel = decodeURIComponent(parts[1]);\n\t\t\tif (validKeyEntryId(entryId) && wireModel.length > 0 && !wireModel.startsWith(KEY_MODEL_PREFIX) && keyModelId(entryId, wireModel) === model) return { entryId, wireModel };\n\t\t}\n\t} catch {}\n\tthrow new LlmError(`invalid multi-key model selection \"${model}\"`, \"UNKNOWN_MODEL\");\n}\nconst keyEntryProfile = z.object({\n\tname: z.string().max(120).required(),\n\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});\nconst profile = z.object({\n\tmultiKey: z.boolean().default(false),\n\tkeyEntries: z.dict(keyEntryProfile).default({}),\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n"
+        },
+        {
+          "before": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\") {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n",
+          "after": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\", forKeyEntry = false) {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n"
+        },
+        {
+          "before": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n",
+          "after": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst entrySources = source.keyEntries ?? {};\n\t\tif (typeof entrySources !== \"object\" || entrySources === null || Array.isArray(entrySources)) throw new Error(`llm-pi-ai: provider \"${provider}\" keyEntries must be a dictionary`);\n\t\tconst assertWireModels = (models, site) => {\n\t\t\tfor (const model of models ?? []) if (typeof model.id !== \"string\" || model.id.length === 0 || model.id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} must use non-empty upstream model ids outside the reserved ${KEY_MODEL_PREFIX} prefix`);\n\t\t};\n\t\tassertWireModels(source.models, \"models\");\n\t\tfor (const id of Object.keys(source.modelOverrides ?? {})) if (id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" modelOverrides uses reserved prefix ${KEY_MODEL_PREFIX}`);\n\t\tfor (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tif (!validKeyEntryId(id)) throw new Error(`llm-pi-ai: provider \"${provider}\" has an invalid key entry id \"${id}\"`);\n\t\t\tif (typeof entry !== \"object\" || entry === null || typeof entry.name !== \"string\" || entry.name.trim().length === 0 || entry.name.length > 120) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs a name of 1-120 characters`);\n\t\t\tif (typeof entry.apiKeyEnv !== \"string\" || entry.apiKeyEnv.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own apiKeyEnv`);\n\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own models list`);\n\t\t\tassertWireModels(entry.models, `key entry \"${id}\" models`);\n\t\t}\n\t\tconst assertEntryHeaders = (headers, site) => {\n\t\t\tfor (const name of Object.keys(headers ?? {})) if (AUTH_HEADER_NAMES.has(name.toLowerCase())) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} authentication header \"${name}\" would override the selected key; remove it before enabling multiKey`);\n\t\t};\n\t\tif (source.multiKey === true || forKeyEntry) {\n\t\t\tassertEntryHeaders(source.headers, \"shared\");\n\t\t\tfor (const model of source.models ?? []) assertEntryHeaders(model.headers, `model \"${model.id}\"`);\n\t\t\tfor (const [id, override] of Object.entries(source.modelOverrides ?? {})) assertEntryHeaders(override.headers, `model override \"${id}\"`);\n\t\t}\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n"
+        },
+        {
+          "before": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\ttry {\n\t\t\tcatalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n",
+          "after": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tconst keyEntries = new Map();\n\t\t// Disabled entries remain stored, but cannot constrain legacy single-key runtime behavior.\n\t\tif (source.multiKey === true) for (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,\n\t\t\t\tkeyEntries: {},\n\t\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\t\tmodels: entry.models,\n\t\t\t\tmodelOverrides: void 0\n\t\t\t} }, validation, true).get(provider);\n\t\t\t// Entry auth must not consult a catalog provider's ambient/OAuth credential or endpoint.\n\t\t\tkeyEntries.set(id, {\n\t\t\t\t...child,\n\t\t\t\tkeyEntryId: id,\n\t\t\t\tkeyEntryName: entry.name,\n\t\t\t\t...child.piProvider === void 0 ? {} : { piProvider: { ...child.piProvider, auth: { apiKey: harnessApiKeyAuth(entry.name) } } }\n\t\t\t});\n\t\t}\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\tconst entryOnly = forKeyEntry && source.models.length === 0 || source.multiKey === true && keyEntries.size > 0 && (source.models ?? []).length === 0 && catalogModels(provider).size === 0;\n\t\ttry {\n\t\t\tif (entryOnly) catalog = { models: [], configuredMaxTokens: new Map(), modelErrors: new Map() };\n\t\t\telse catalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n"
+        },
+        {
+          "before": "\t\t\t}, validation);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;",
+          "after": "\t\t\t}, validation);\n\t\t\tif (source.multiKey === true || forKeyEntry) for (const model of catalog.models) assertEntryHeaders(model.headers, `resolved model \"${model.id}\"`);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;"
+        },
+        {
+          "before": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },",
+          "after": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, keyEntries: _keyEntries, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\tkeyEntries,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },"
+        },
+        {
+          "before": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/**\n* pi-ai-backed multi-provider adapter.",
+          "after": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/** Decode only the selected replay owner at the pi boundary; never merge equal wire ids across keys. */\nfunction replayContextForRoute(context, provider, requestedModel, wireModel) {\n\tconst selectedEntry = requestedModel.startsWith(KEY_MODEL_PREFIX);\n\treturn {\n\t\t...context,\n\t\tmessages: context.messages.map((message) => {\n\t\t\tif (message.role !== \"assistant\") return message;\n\t\t\tif (message.provider === provider && message.model === requestedModel) return { ...message, model: wireModel.id };\n\t\t\tif (!message.model.startsWith(KEY_MODEL_PREFIX) && !(selectedEntry && message.provider === provider && message.model === wireModel.id)) return message;\n\t\t\treturn {\n\t\t\t\trole: \"assistant\",\n\t\t\t\tapi: \"dsh-foreign\",\n\t\t\t\tprovider: message.provider,\n\t\t\t\tmodel: \"dsh-foreign\",\n\t\t\t\tcontent: message.content.flatMap((block) => {\n\t\t\t\t\tif (block.type === \"thinking\") return [];\n\t\t\t\t\tif (block.type === \"text\") return [{ type: \"text\", text: block.text }];\n\t\t\t\t\tif (block.type === \"toolCall\") return [{ type: \"toolCall\", id: block.id, name: block.name, arguments: block.arguments }];\n\t\t\t\t\treturn [block];\n\t\t\t\t}),\n\t\t\t\tusage: message.usage,\n\t\t\t\tstopReason: message.stopReason,\n\t\t\t\ttimestamp: message.timestamp\n\t\t\t};\n\t\t})\n\t};\n}\n/**\n* pi-ai-backed multi-provider adapter."
+        },
+        {
+          "before": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tfor (const profile of profiles.values()) if (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n",
+          "after": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tconst entryModels = new Map();\n\t\tfor (const [provider, profile] of profiles) {\n\t\t\tif (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\t\tconst entries = new Map();\n\t\t\tfor (const [id, entry] of profile.keyEntries) {\n\t\t\t\tconst collection = createModels(this.config.auth);\n\t\t\t\tif (entry.piProvider !== void 0) collection.setProvider(entry.piProvider);\n\t\t\t\tentries.set(id, collection);\n\t\t\t}\n\t\t\tentryModels.set(provider, entries);\n\t\t}\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels,\n\t\t\tentryModels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n"
+        },
+        {
+          "before": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst failure = profile.modelErrors.get(model) ?? (profile.piProvider === void 0 ? profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = snapshot.models.getModel(provider, model);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n",
+          "after": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** Bind the public selection to an exact profile, independent model collection, and upstream id. */\n\trouteOf(snapshot, provider, model) {\n\t\tconst root = this.profileOf(snapshot, provider);\n\t\tconst entry = keyModelRoute(model);\n\t\tif (entry === void 0) return { profile: root, models: snapshot.models, wireModel: model };\n\t\tif (root.multiKey !== true) throw new LlmError(`multi-key selection is disabled for provider \"${provider}\"`, \"UNKNOWN_MODEL\");\n\t\tconst profile = root.keyEntries.get(entry.entryId);\n\t\tconst models = snapshot.entryModels.get(provider)?.get(entry.entryId);\n\t\tif (profile === void 0 || models === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${entry.entryId}\"`, \"UNKNOWN_MODEL\");\n\t\treturn { profile, models, wireModel: entry.wireModel };\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst route = this.routeOf(snapshot, provider, model);\n\t\tconst failure = route.profile.modelErrors.get(route.wireModel) ?? (route.profile.piProvider === void 0 ? route.profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = route.models.getModel(provider, route.wireModel);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n"
+        },
+        {
+          "before": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\ttry {\n\t\t\t\tawait this.config.resolveApiKey(provider, profile);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return [];\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn snapshot.models.getModels(provider).map((model) => ({\n\t\t\t\tprovider,\n\t\t\t\tid: model.id,\n\t\t\t\tname: model.name,\n\t\t\t\tinputModalities: [...model.input]\n\t\t\t}));\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n",
+          "after": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\tconst listed = [];\n\t\t\tconst append = async (owner, models, entryId) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst key = await this.config.resolveApiKey(provider, owner);\n\t\t\t\t\tif (entryId !== void 0 && (key === void 0 || key.length === 0)) return;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return;\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tfor (const model of models.getModels(provider)) listed.push({\n\t\t\t\t\tprovider,\n\t\t\t\t\tid: entryId === void 0 ? model.id : keyModelId(entryId, model.id),\n\t\t\t\t\tname: model.name,\n\t\t\t\t\tinputModalities: [...model.input]\n\t\t\t\t});\n\t\t\t};\n\t\t\t// Keep raw root models advertised so old sessions remain routable without changing keys.\n\t\t\tawait append(profile, snapshot.models);\n\t\t\tif (profile.multiKey === true) for (const [id, entry] of profile.keyEntries) await append(entry, snapshot.entryModels.get(provider).get(id), id);\n\t\t\treturn listed;\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n"
+        },
+        {
+          "before": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(model);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n",
+          "after": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst { profile, wireModel } = this.routeOf(snapshot, provider, model);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(wireModel);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n"
+        },
+        {
+          "before": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => this.streamWithSnapshot(options, snapshot)\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot(options, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n",
+          "after": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => {\n\t\t\t\tif (options.provider !== provider || options.model !== model) throw new LlmError(\"prepared multi-key model selection changed before adapter dispatch\", \"INVALID_CONFIG\");\n\t\t\t\t// Async generators are lazy; pin the owner before returning one to caller-owned code.\n\t\t\t\treturn this.streamWithSnapshot({ ...options, provider, model }, snapshot);\n\t\t\t}\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot({ ...options }, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n"
+        },
+        {
+          "before": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst profile = this.profileOf(snapshot, options.provider);\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n",
+          "after": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst route = this.routeOf(snapshot, options.provider, options.model);\n\t\t\tconst profile = route.profile;\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n"
+        },
+        {
+          "before": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n",
+          "after": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tif (profile.keyEntryId !== void 0 && (apiKey === void 0 || apiKey.length === 0)) throw new LlmError(`provider \"${options.provider}\" key entry \"${profile.keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n"
+        },
+        {
+          "before": "\t\t\t\tconst iterator = toStreamChunks(snapshot.models.streamSimple(model, context, {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, model.id)[Symbol.asyncIterator]();",
+          "after": "\t\t\t\tconst iterator = toStreamChunks(route.models.streamSimple(model, replayContextForRoute(context, options.provider, options.model, model), {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, options.model)[Symbol.asyncIterator]();"
+        },
+        {
+          "before": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n",
+          "after": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\t// Validate host-owned entry identity even on the installed-catalog shortcut.\n\tconst selectedStored = request.keyEntryId === void 0 ? void 0 : storedProfile?.();\n\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n",
+          "after": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = selectedStored ?? storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n"
+        },
+        {
+          "before": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n",
+          "after": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy,\n\t\tmultiKey: profile.multiKey === true,\n\t\tapiKeyEnv: profile.apiKeyEnv,\n\t\tmodels: profile.piProvider?.getModels(),\n\t\tmodelErrors: [...profile.modelErrors],\n\t\tkeyEntries: [...profile.keyEntries].map(([id, entry]) => ({\n\t\t\tid,\n\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),\n\t\t\tmodelErrors: [...entry.modelErrors]\n\t\t})).sort((left, right) => left.id.localeCompare(right.id))\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n"
+        },
+        {
+          "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
+          "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        },
+        {
+          "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
+          "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+        },
+        {
+          "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
+          "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+        },
+        {
+          "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
+          "after": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\t...entry.api === void 0 ? {} : { api: entry.api },\n\t\t\t\tmultiKey: false,"
+        },
+        {
+          "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api !== void 0 ? request.api : selectedStored?.api !== void 0 ? selectedStored.api : \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
         },
         {
           "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
@@ -117,9 +949,9 @@
       ]
     },
     {
-      "source": "multi-key revision before per-entry API overrides",
-      "baseSha256": "070c839e2c00e2d5f7c5d82307ca3d84dbb2323e46979daf265908751bbe8ae8",
-      "resultSha256": "a2b3bcda38015026ed58074cef0d508bbd2d7cb1423c00331651fcbd1a9f6b55",
+      "source": "0.2.2-rc.1 with tool lookup optimization and credential cancellation with per-entry API overrides",
+      "baseSha256": "0a99a2fc903a4285044b09114b3bd20ee1e612f39aa381e4a71b10d48ee9e9f7",
+      "resultSha256": "e999e1a7f2352177c653ff0cea6485c3b1d1ea95b40ea613fc0549e2c8e49662",
       "replacements": [
         {
           "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
@@ -196,13 +1028,41 @@
         {
           "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
           "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        },
+        {
+          "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
+          "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+        },
+        {
+          "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
+          "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+        },
+        {
+          "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
+          "after": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\t...entry.api === void 0 ? {} : { api: entry.api },\n\t\t\t\tmultiKey: false,"
+        },
+        {
+          "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api !== void 0 ? request.api : selectedStored?.api !== void 0 ? selectedStored.api : \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
+          "after": "\tconst baseURL = request.baseURL ?? selectedStored?.baseURL;\n\tif (baseURL === void 0 || baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(baseURL, api);"
+        },
+        {
+          "before": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),",
+          "after": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tapi: entry.api,\n\t\t\tmodels: entry.piProvider?.getModels(),"
+        },
+        {
+          "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
+          "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
         }
       ]
     },
     {
-      "source": "0.2.2-rc.1 with tool lookup optimization and credential cancellation",
+      "source": "0.2.2-rc.1 with tool lookup optimization and credential cancellation with per-entry API overrides",
       "baseSha256": "0a99a2fc903a4285044b09114b3bd20ee1e612f39aa381e4a71b10d48ee9e9f7",
-      "resultSha256": "c87f965d9fcc5bbcd386e98ea3b292b05ec7a55d80df1266e18234031b80990e",
+      "resultSha256": "0a398e35a7e66f0cb547da9c421e33123b9959bd058c3d006baf3c587ff4c596",
       "replacements": [
         {
           "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
@@ -279,13 +1139,176 @@
         {
           "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
           "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        },
+        {
+          "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
+          "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+        },
+        {
+          "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
+          "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+        },
+        {
+          "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
+          "after": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\t...entry.api === void 0 ? {} : { api: entry.api },\n\t\t\t\tmultiKey: false,"
+        },
+        {
+          "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api !== void 0 ? request.api : selectedStored?.api !== void 0 ? selectedStored.api : \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
+          "after": "\tconst baseURL = request.baseURL ?? selectedStored?.baseURL;\n\tif (baseURL === void 0 || baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(baseURL, api);"
+        },
+        {
+          "before": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),",
+          "after": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tapi: entry.api,\n\t\t\tmodels: entry.piProvider?.getModels(),"
+        },
+        {
+          "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
+          "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+        },
+        {
+          "before": "function listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");",
+          "after": "/** Strip trailing slashes and one trailing `/v1`, the segment the Anthropic SDK adds itself. */\nfunction anthropicRoot(baseURL) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");\n\treturn base.endsWith(\"/v1\") ? base.slice(0, -3) : base;\n}\nfunction listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");"
+        },
+        {
+          "before": "\t\tconst baseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (baseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);",
+          "after": "\t\tconst configuredBaseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (configuredBaseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);\n\t\tconst baseUrl = api === \"anthropic-messages\" ? anthropicRoot(configuredBaseUrl) : configuredBaseUrl;"
+        },
+        {
+          "before": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${base.endsWith(\"/v1\") ? base.slice(0, -3) : base}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;",
+          "after": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${anthropicRoot(base)}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;"
         }
       ]
     },
     {
-      "source": "npm official 0.2.2-rc.1",
+      "source": "npm official 0.2.2-rc.1 with per-entry API overrides",
       "baseSha256": "1a3ae58f9b4493e15459cc5000ec80f21b5d3f4a9dea6ffb6bc28e5b8817ae8a",
-      "resultSha256": "b9416207cc7c27aff40cb2b877c9176e53809eb2f6dc741828c2ed6f6bdf541b",
+      "resultSha256": "432b9050dff97c9dae6744b6c6189e0c4a4363321afab6310aec4d5fcb418681",
+      "replacements": [
+        {
+          "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
+          "after": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\n// Model selection carries an opaque entry identity, never a credential or a wire alias.\nconst KEY_MODEL_PREFIX = \"@dsh-key/\";\nconst KEY_ENTRY_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/;\nconst FORBIDDEN_KEY_ENTRY_IDS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\nconst AUTH_HEADER_NAMES = new Set([\"authorization\", \"proxy-authorization\", \"x-api-key\", \"api-key\", \"cf-aig-authorization\"]);\nfunction validKeyEntryId(id) {\n\treturn KEY_ENTRY_ID.test(id) && !FORBIDDEN_KEY_ENTRY_IDS.has(id);\n}\nfunction keyModelId(entryId, model) {\n\treturn `${KEY_MODEL_PREFIX}${encodeURIComponent(entryId)}/${encodeURIComponent(model)}`;\n}\nfunction keyModelRoute(model) {\n\tif (!model.startsWith(KEY_MODEL_PREFIX)) return void 0;\n\ttry {\n\t\tconst parts = model.slice(KEY_MODEL_PREFIX.length).split(\"/\");\n\t\tif (parts.length === 2) {\n\t\t\tconst entryId = decodeURIComponent(parts[0]);\n\t\t\tconst wireModel = decodeURIComponent(parts[1]);\n\t\t\tif (validKeyEntryId(entryId) && wireModel.length > 0 && !wireModel.startsWith(KEY_MODEL_PREFIX) && keyModelId(entryId, wireModel) === model) return { entryId, wireModel };\n\t\t}\n\t} catch {}\n\tthrow new LlmError(`invalid multi-key model selection \"${model}\"`, \"UNKNOWN_MODEL\");\n}\nconst keyEntryProfile = z.object({\n\tname: z.string().max(120).required(),\n\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});\nconst profile = z.object({\n\tmultiKey: z.boolean().default(false),\n\tkeyEntries: z.dict(keyEntryProfile).default({}),\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n"
+        },
+        {
+          "before": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\") {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n",
+          "after": "* @param providers - configured provider profiles keyed by route.\n* @param validation - writes require a complete catalog; stored reads retain catalog diagnostics.\n* @returns validated profiles in configuration order.\n*/\nfunction resolveProfiles(providers, validation = \"strict\", forKeyEntry = false) {\n\tif (Array.isArray(providers)) throw new Error(\"llm-pi-ai: providers is now a dict keyed by provider route, not an array of profiles\");\n\tconst entries = Object.entries(providers ?? {});\n\tconst resolved = /* @__PURE__ */ new Map();\n\tfor (const [provider, source] of entries) {\n"
+        },
+        {
+          "before": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n",
+          "after": "\t\tif (provider.length === 0) throw new Error(\"llm-pi-ai: provider names must be non-empty\");\n\t\tif (source.baseURL !== void 0 && source.baseURL.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty baseURL`);\n\t\tif (source.displayName !== void 0 && source.displayName.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" has an empty displayName`);\n\t\tassertValidHeaders(provider, source.headers);\n\t\tconst entrySources = source.keyEntries ?? {};\n\t\tif (typeof entrySources !== \"object\" || entrySources === null || Array.isArray(entrySources)) throw new Error(`llm-pi-ai: provider \"${provider}\" keyEntries must be a dictionary`);\n\t\tconst assertWireModels = (models, site) => {\n\t\t\tfor (const model of models ?? []) if (typeof model.id !== \"string\" || model.id.length === 0 || model.id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} must use non-empty upstream model ids outside the reserved ${KEY_MODEL_PREFIX} prefix`);\n\t\t};\n\t\tassertWireModels(source.models, \"models\");\n\t\tfor (const id of Object.keys(source.modelOverrides ?? {})) if (id.startsWith(KEY_MODEL_PREFIX)) throw new Error(`llm-pi-ai: provider \"${provider}\" modelOverrides uses reserved prefix ${KEY_MODEL_PREFIX}`);\n\t\tfor (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tif (!validKeyEntryId(id)) throw new Error(`llm-pi-ai: provider \"${provider}\" has an invalid key entry id \"${id}\"`);\n\t\t\tif (typeof entry !== \"object\" || entry === null || typeof entry.name !== \"string\" || entry.name.trim().length === 0 || entry.name.length > 120) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs a name of 1-120 characters`);\n\t\t\tif (typeof entry.apiKeyEnv !== \"string\" || entry.apiKeyEnv.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own apiKeyEnv`);\n\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" needs its own models list`);\n\t\t\tassertWireModels(entry.models, `key entry \"${id}\" models`);\n\t\t}\n\t\tconst assertEntryHeaders = (headers, site) => {\n\t\t\tfor (const name of Object.keys(headers ?? {})) if (AUTH_HEADER_NAMES.has(name.toLowerCase())) throw new Error(`llm-pi-ai: provider \"${provider}\" ${site} authentication header \"${name}\" would override the selected key; remove it before enabling multiKey`);\n\t\t};\n\t\tif (source.multiKey === true || forKeyEntry) {\n\t\t\tassertEntryHeaders(source.headers, \"shared\");\n\t\t\tfor (const model of source.models ?? []) assertEntryHeaders(model.headers, `model \"${model.id}\"`);\n\t\t\tfor (const [id, override] of Object.entries(source.modelOverrides ?? {})) assertEntryHeaders(override.headers, `model override \"${id}\"`);\n\t\t}\n\t\tconst streamIdleTimeoutMs = source.streamIdleTimeoutMs ?? 3e5;\n\t\tif (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0 || streamIdleTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-pi-ai: provider \"${provider}\" streamIdleTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);\n\t\tconst maxRequestImageBytes = source.maxRequestImageBytes ?? 20971520;\n\t\tif (!Number.isInteger(maxRequestImageBytes) || maxRequestImageBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" maxRequestImageBytes must be a positive integer`);\n"
+        },
+        {
+          "before": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\ttry {\n\t\t\tcatalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n",
+          "after": "\t\tif (!Number.isSafeInteger(requestImageMaxBytes) || requestImageMaxBytes <= 0) throw new Error(`llm-pi-ai: provider \"${provider}\" requestImageMaxBytes must be a positive safe integer`);\n\t\tconst defaultInput = [...source.defaultInput ?? DEFAULT_INPUT];\n\t\tif (defaultInput.length === 0) throw new Error(`llm-pi-ai: provider \"${provider}\" defaultInput must name at least one modality`);\n\t\tconst displayName = source.displayName ?? provider;\n\t\tconst keyEntries = new Map();\n\t\t// Disabled entries remain stored, but cannot constrain legacy single-key runtime behavior.\n\t\tif (source.multiKey === true) for (const [id, entry] of Object.entries(entrySources)) {\n\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,\n\t\t\t\tkeyEntries: {},\n\t\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\t\tmodels: entry.models,\n\t\t\t\tmodelOverrides: void 0\n\t\t\t} }, validation, true).get(provider);\n\t\t\t// Entry auth must not consult a catalog provider's ambient/OAuth credential or endpoint.\n\t\t\tkeyEntries.set(id, {\n\t\t\t\t...child,\n\t\t\t\tkeyEntryId: id,\n\t\t\t\tkeyEntryName: entry.name,\n\t\t\t\t...child.piProvider === void 0 ? {} : { piProvider: { ...child.piProvider, auth: { apiKey: harnessApiKeyAuth(entry.name) } } }\n\t\t\t});\n\t\t}\n\t\tlet catalog;\n\t\tlet piProvider;\n\t\tlet catalogError;\n\t\tconst entryOnly = forKeyEntry && source.models.length === 0 || source.multiKey === true && keyEntries.size > 0 && (source.models ?? []).length === 0 && catalogModels(provider).size === 0;\n\t\ttry {\n\t\t\tif (entryOnly) catalog = { models: [], configuredMaxTokens: new Map(), modelErrors: new Map() };\n\t\t\telse catalog = resolveRouteModels({\n\t\t\t\tprovider,\n\t\t\t\t...source.api === void 0 ? {} : { api: source.api },\n\t\t\t\t...source.baseURL === void 0 ? {} : { baseURL: source.baseURL },\n\t\t\t\t...source.models === void 0 ? {} : { models: source.models },\n"
+        },
+        {
+          "before": "\t\t\t}, validation);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;",
+          "after": "\t\t\t}, validation);\n\t\t\tif (source.multiKey === true || forKeyEntry) for (const model of catalog.models) assertEntryHeaders(model.headers, `resolved model \"${model.id}\"`);\n\t\t\tcatalogError = catalog.modelErrors.values().next().value;"
+        },
+        {
+          "before": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },",
+          "after": "\t\tconst { apiKeyEnv, retryPolicy, models: _models, displayName: _displayName, keyEntries: _keyEntries, ...rest } = source;\n\t\tresolved.set(provider, {\n\t\t\t...rest,\n\t\t\tprovider,\n\t\t\tdisplayName,\n\t\t\tkeyEntries,\n\t\t\t...apiKeyEnv === void 0 ? {} : { apiKeyEnv: credentialRef(apiKeyEnv) },"
+        },
+        {
+          "before": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/**\n* pi-ai-backed multi-provider adapter.",
+          "after": "\t} catch (error) {\n\t\tthrow new LlmError(`pi-ai request header preparation failed for provider \"${options.provider}\": ${requestHeaderDiagnostic(error)}`, \"REQUEST_HEADERS\", { cause: error });\n\t}\n}\n/** Decode only the selected replay owner at the pi boundary; never merge equal wire ids across keys. */\nfunction replayContextForRoute(context, provider, requestedModel, wireModel) {\n\tconst selectedEntry = requestedModel.startsWith(KEY_MODEL_PREFIX);\n\treturn {\n\t\t...context,\n\t\tmessages: context.messages.map((message) => {\n\t\t\tif (message.role !== \"assistant\") return message;\n\t\t\tif (message.provider === provider && message.model === requestedModel) return { ...message, model: wireModel.id };\n\t\t\tif (!message.model.startsWith(KEY_MODEL_PREFIX) && !(selectedEntry && message.provider === provider && message.model === wireModel.id)) return message;\n\t\t\treturn {\n\t\t\t\trole: \"assistant\",\n\t\t\t\tapi: \"dsh-foreign\",\n\t\t\t\tprovider: message.provider,\n\t\t\t\tmodel: \"dsh-foreign\",\n\t\t\t\tcontent: message.content.flatMap((block) => {\n\t\t\t\t\tif (block.type === \"thinking\") return [];\n\t\t\t\t\tif (block.type === \"text\") return [{ type: \"text\", text: block.text }];\n\t\t\t\t\tif (block.type === \"toolCall\") return [{ type: \"toolCall\", id: block.id, name: block.name, arguments: block.arguments }];\n\t\t\t\t\treturn [block];\n\t\t\t\t}),\n\t\t\t\tusage: message.usage,\n\t\t\t\tstopReason: message.stopReason,\n\t\t\t\ttimestamp: message.timestamp\n\t\t\t};\n\t\t})\n\t};\n}\n/**\n* pi-ai-backed multi-provider adapter."
+        },
+        {
+          "before": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tfor (const profile of profiles.values()) if (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n",
+          "after": "\tcurrent() {\n\t\tconst profiles = this.config.profiles();\n\t\tif (this.snapshot?.profiles === profiles) return this.snapshot;\n\t\tconst models = createModels(this.config.auth);\n\t\tconst entryModels = new Map();\n\t\tfor (const [provider, profile] of profiles) {\n\t\t\tif (profile.piProvider !== void 0) models.setProvider(profile.piProvider);\n\t\t\tconst entries = new Map();\n\t\t\tfor (const [id, entry] of profile.keyEntries) {\n\t\t\t\tconst collection = createModels(this.config.auth);\n\t\t\t\tif (entry.piProvider !== void 0) collection.setProvider(entry.piProvider);\n\t\t\t\tentries.set(id, collection);\n\t\t\t}\n\t\t\tentryModels.set(provider, entries);\n\t\t}\n\t\tthis.snapshot = {\n\t\t\tprofiles,\n\t\t\tmodels,\n\t\t\tentryModels\n\t\t};\n\t\treturn this.snapshot;\n\t}\n\t/** The profile for one route within one snapshot, or the not-owned failure. */\n"
+        },
+        {
+          "before": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst failure = profile.modelErrors.get(model) ?? (profile.piProvider === void 0 ? profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = snapshot.models.getModel(provider, model);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n",
+          "after": "\t\tconst profile = snapshot.profiles.get(provider);\n\t\tif (profile === void 0) throw new LlmError(`pi-ai adapter does not own provider \"${provider}\"`, \"NO_ADAPTER\");\n\t\treturn profile;\n\t}\n\t/** Bind the public selection to an exact profile, independent model collection, and upstream id. */\n\trouteOf(snapshot, provider, model) {\n\t\tconst root = this.profileOf(snapshot, provider);\n\t\tconst entry = keyModelRoute(model);\n\t\tif (entry === void 0) return { profile: root, models: snapshot.models, wireModel: model };\n\t\tif (root.multiKey !== true) throw new LlmError(`multi-key selection is disabled for provider \"${provider}\"`, \"UNKNOWN_MODEL\");\n\t\tconst profile = root.keyEntries.get(entry.entryId);\n\t\tconst models = snapshot.entryModels.get(provider)?.get(entry.entryId);\n\t\tif (profile === void 0 || models === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${entry.entryId}\"`, \"UNKNOWN_MODEL\");\n\t\treturn { profile, models, wireModel: entry.wireModel };\n\t}\n\t/** The configured descriptor for one exact route/model pair within one snapshot. */\n\tmodelOf(snapshot, provider, model) {\n\t\tconst route = this.routeOf(snapshot, provider, model);\n\t\tconst failure = route.profile.modelErrors.get(route.wireModel) ?? (route.profile.piProvider === void 0 ? route.profile.catalogError : void 0);\n\t\tif (failure !== void 0) throw new LlmError(failure, \"INVALID_CONFIG\");\n\t\tconst resolved = route.models.getModel(provider, route.wireModel);\n\t\tif (resolved === void 0) throw new LlmError(`pi-ai provider \"${provider}\" has no configured model \"${model}\"`, \"UNKNOWN_MODEL\");\n\t\treturn resolved;\n\t}\n\tproviderInfo(provider) {\n"
+        },
+        {
+          "before": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\ttry {\n\t\t\t\tawait this.config.resolveApiKey(provider, profile);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return [];\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn snapshot.models.getModels(provider).map((model) => ({\n\t\t\t\tprovider,\n\t\t\t\tid: model.id,\n\t\t\t\tname: model.name,\n\t\t\t\tinputModalities: [...model.input]\n\t\t\t}));\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n",
+          "after": "\tlistModels(provider) {\n\t\treturn Promise.resolve().then(async () => {\n\t\t\tconst snapshot = this.current();\n\t\t\tconst profile = this.profileOf(snapshot, provider);\n\t\t\tconst listed = [];\n\t\t\tconst append = async (owner, models, entryId) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst key = await this.config.resolveApiKey(provider, owner);\n\t\t\t\t\tif (entryId !== void 0 && (key === void 0 || key.length === 0)) return;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof LlmError && error.code === \"MISSING_CREDENTIAL\") return;\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tfor (const model of models.getModels(provider)) listed.push({\n\t\t\t\t\tprovider,\n\t\t\t\t\tid: entryId === void 0 ? model.id : keyModelId(entryId, model.id),\n\t\t\t\t\tname: model.name,\n\t\t\t\t\tinputModalities: [...model.input]\n\t\t\t\t});\n\t\t\t};\n\t\t\t// Keep raw root models advertised so old sessions remain routable without changing keys.\n\t\t\tawait append(profile, snapshot.models);\n\t\t\tif (profile.multiKey === true) for (const [id, entry] of profile.keyEntries) await append(entry, snapshot.entryModels.get(provider).get(id), id);\n\t\t\treturn listed;\n\t\t});\n\t}\n\tresolveModel(provider, model, _signal) {\n\t\treturn Promise.resolve().then(() => {\n"
+        },
+        {
+          "before": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst profile = this.profileOf(snapshot, provider);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(model);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n",
+          "after": "\t\t\treturn this.modelInfo(snapshot, provider, model);\n\t\t});\n\t}\n\tmodelInfo(snapshot, provider, model) {\n\t\tconst { profile, wireModel } = this.routeOf(snapshot, provider, model);\n\t\tconst resolvedModel = this.modelOf(snapshot, provider, model);\n\t\tconst defaultLevel = describableReasoningLevel(resolvedModel, profile.reasoning);\n\t\tconst configuredMaxTokens = profile.configuredMaxTokens.get(wireModel);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tid: model,\n\t\t\tname: resolvedModel.name,\n"
+        },
+        {
+          "before": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => this.streamWithSnapshot(options, snapshot)\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot(options, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n",
+          "after": "\tprepareCall(provider, model, _signal) {\n\t\tconst snapshot = this.current();\n\t\treturn Promise.resolve({\n\t\t\tmodel: this.modelInfo(snapshot, provider, model),\n\t\t\tstream: (options) => {\n\t\t\t\tif (options.provider !== provider || options.model !== model) throw new LlmError(\"prepared multi-key model selection changed before adapter dispatch\", \"INVALID_CONFIG\");\n\t\t\t\t// Async generators are lazy; pin the owner before returning one to caller-owned code.\n\t\t\t\treturn this.streamWithSnapshot({ ...options, provider, model }, snapshot);\n\t\t\t}\n\t\t});\n\t}\n\tstream(options) {\n\t\treturn this.streamWithSnapshot({ ...options }, this.current());\n\t}\n\tasync *streamWithSnapshot(options, snapshot) {\n\t\tconst env_1 = {\n\t\t\tstack: [],\n"
+        },
+        {
+          "before": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst profile = this.profileOf(snapshot, options.provider);\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n",
+          "after": "\t\t\thasError: false\n\t\t};\n\t\ttry {\n\t\t\tif (options.stop !== void 0) throw new LlmError(\"llm-pi-ai does not support GenerateOptions.stop\", \"UNSUPPORTED_OPTION\");\n\t\t\tconst route = this.routeOf(snapshot, options.provider, options.model);\n\t\t\tconst profile = route.profile;\n\t\t\tconst model = this.modelOf(snapshot, options.provider, options.model);\n\t\t\tconst updates = conversationUpdates(model);\n\t\t\tconst tools = options.tools ?? [];\n\t\t\tconst request = model.api === \"anthropic-messages\" && updates.toolUpdate === \"in-history\" && tools.every((tool) => tool.deferLoading === true) && options.messages.some((message) => message.role === \"developer\" && message.content.some((block) => block.type === \"tool-addition\" || block.type === \"tool-removal\")) ? {\n"
+        },
+        {
+          "before": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n",
+          "after": "\t\t\t\ttools: [ANTHROPIC_TOOL_UPDATE_PLACEHOLDER, ...tools]\n\t\t\t} : options;\n\t\t\tconst reasoning = resolveReasoningLevel(model, options.reasoningEffort ?? profile.reasoning);\n\t\t\tconst apiKey = await this.config.resolveApiKey(options.provider, profile);\n\t\t\tif (profile.keyEntryId !== void 0 && (apiKey === void 0 || apiKey.length === 0)) throw new LlmError(`provider \"${options.provider}\" key entry \"${profile.keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\tconst consumer = new AbortController();\n\t\t\tconst upstream = options.signal === void 0 ? consumer.signal : AbortSignal.any([options.signal, consumer.signal]);\n\t\t\tconst streamIdleTimeoutMs = profile.streamIdleTimeoutMs;\n\t\t\tconst watchdog = __addDisposableResource(env_1, idleWatchdog(upstream, streamIdleTimeoutMs, \"LLM_STREAM_IDLE_TIMEOUT\"), false);\n"
+        },
+        {
+          "before": "\t\t\t\tconst iterator = toStreamChunks(snapshot.models.streamSimple(model, context, {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, model.id)[Symbol.asyncIterator]();",
+          "after": "\t\t\t\tconst iterator = toStreamChunks(route.models.streamSimple(model, replayContextForRoute(context, options.provider, options.model, model), {\n\t\t\t\t\t...profileOptions(profile, reasoning, apiKey),\n\t\t\t\t\t...options.temperature === void 0 ? {} : { temperature: options.temperature },\n\t\t\t\t\t...options.maxTokens === void 0 ? {} : { maxTokens: options.maxTokens },\n\t\t\t\t\t...options.sessionId === void 0 ? {} : { sessionId: String(options.sessionId) },\n\t\t\t\t\tsignal: watchdog.signal,\n\t\t\t\t\theaders: requestHeaders(profile.headers, options, model.baseUrl, this.config.prepareHeaders)\n\t\t\t\t}), model.contextWindow, options.signal, options.model)[Symbol.asyncIterator]();"
+        },
+        {
+          "before": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n",
+          "after": "* @throws LlmError when the protocol has no readable listing, the endpoint\n*   refuses or fails the request, or the reply is not a model listing.\n*/\nasync function discoverModels(request, storedProfile) {\n\t// Validate host-owned entry identity even on the installed-catalog shortcut.\n\tconst selectedStored = request.keyEntryId === void 0 ? void 0 : storedProfile?.();\n\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {\n\t\tconst installed = catalogModels(request.provider);\n\t\tif (installed.size > 0) return [...installed.values()].map((model) => ({\n\t\t\tid: model.id,\n"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n",
+          "after": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);\n\tconst stored = selectedStored ?? storedProfile?.();\n\tconst supplied = request.apiKey ?? await stored?.resolveApiKey();\n\tconst apiKey = supplied === void 0 ? void 0 : usableProbeKey(supplied);\n\tlet response;\n\ttry {\n"
+        },
+        {
+          "before": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n",
+          "after": "function registrationFacts(profiles) {\n\treturn [...profiles.entries()].map(([provider, profile]) => ({\n\t\tprovider,\n\t\tdisplayName: profile.displayName,\n\t\tretryPolicy: profile.retryPolicy,\n\t\tmultiKey: profile.multiKey === true,\n\t\tapiKeyEnv: profile.apiKeyEnv,\n\t\tmodels: profile.piProvider?.getModels(),\n\t\tmodelErrors: [...profile.modelErrors],\n\t\tkeyEntries: [...profile.keyEntries].map(([id, entry]) => ({\n\t\t\tid,\n\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),\n\t\t\tmodelErrors: [...entry.modelErrors]\n\t\t})).sort((left, right) => left.id.localeCompare(right.id))\n\t})).sort((left, right) => left.provider.localeCompare(right.provider));\n}\n/**\n* The configurable-provider directory: every installed catalog route, plus\n"
+        },
+        {
+          "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
+          "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        },
+        {
+          "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
+          "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+        },
+        {
+          "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
+          "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+        },
+        {
+          "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
+          "after": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\t...entry.api === void 0 ? {} : { api: entry.api },\n\t\t\t\tmultiKey: false,"
+        },
+        {
+          "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api !== void 0 ? request.api : selectedStored?.api !== void 0 ? selectedStored.api : \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
+          "after": "\tconst baseURL = request.baseURL ?? selectedStored?.baseURL;\n\tif (baseURL === void 0 || baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(baseURL, api);"
+        },
+        {
+          "before": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),",
+          "after": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tapi: entry.api,\n\t\t\tmodels: entry.piProvider?.getModels(),"
+        },
+        {
+          "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
+          "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+        },
+        {
+          "before": "function listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");",
+          "after": "/** Strip trailing slashes and one trailing `/v1`, the segment the Anthropic SDK adds itself. */\nfunction anthropicRoot(baseURL) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");\n\treturn base.endsWith(\"/v1\") ? base.slice(0, -3) : base;\n}\nfunction listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");"
+        },
+        {
+          "before": "\t\tconst baseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (baseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);",
+          "after": "\t\tconst configuredBaseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (configuredBaseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);\n\t\tconst baseUrl = api === \"anthropic-messages\" ? anthropicRoot(configuredBaseUrl) : configuredBaseUrl;"
+        },
+        {
+          "before": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${base.endsWith(\"/v1\") ? base.slice(0, -3) : base}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;",
+          "after": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${anthropicRoot(base)}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;"
+        }
+      ]
+    },
+    {
+      "source": "0.2.2-rc.1 with tool lookup optimization and credential cancellation with per-entry API overrides",
+      "baseSha256": "0a99a2fc903a4285044b09114b3bd20ee1e612f39aa381e4a71b10d48ee9e9f7",
+      "resultSha256": "c7d20ebe93753ae6f30d614121bac533fe5a8fa9372ea1c5fdc8bf2f7eba1d1d",
       "replacements": [
         {
           "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
@@ -362,13 +1385,57 @@
         {
           "before": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider) => {\n\t\tif (provider === void 0) return void 0;\n\t\tconst profile = profiles().get(provider);\n\t\tif (profile === void 0) return void 0;\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: () => resolveApiKey(provider, profile)\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n",
           "after": "\t\tdirectoryFacts = entries;\n\t};\n\tensureDirectory();\n\t/** Host-owned request inputs for discovery of one configured route. */\n\tconst storedDiscoveryProfile = (provider, keyEntryId) => {\n\t\tif (provider === void 0) {\n\t\t\tif (keyEntryId !== void 0) throw new LlmError(\"multi-key discovery needs a provider id\", \"INVALID_CONFIG\");\n\t\t\treturn void 0;\n\t\t}\n\t\tconst root = profiles().get(provider);\n\t\tif (keyEntryId === void 0) return root === void 0 ? void 0 : { headers: root.headers, resolveApiKey: () => resolveApiKey(provider, root) };\n\t\tif (!validKeyEntryId(keyEntryId) || root?.multiKey !== true) throw new LlmError(`multi-key discovery is not enabled for provider \"${provider}\"`, \"INVALID_CONFIG\");\n\t\tconst profile = root.keyEntries.get(keyEntryId);\n\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,\n\t\t\tresolveApiKey: async () => {\n\t\t\t\tconst key = await resolveApiKey(provider, profile);\n\t\t\t\tif (key === void 0 || key.length === 0) throw new LlmError(`provider \"${provider}\" key entry \"${keyEntryId}\" has no credential`, \"MISSING_CREDENTIAL\");\n\t\t\t\treturn key;\n\t\t\t}\n\t\t};\n\t};\n\tctx.llm.registerModelDiscovery(settingsNs, (request, signal) => discoverModels({\n\t\t...request,\n\t\t...signal === void 0 ? {} : { signal }\n\t}, () => storedDiscoveryProfile(request.provider, request.keyEntryId)));\n\tlet registration;\n\tlet registeredFacts;\n\tconst ensureRegistrationFacts = () => {\n\t\tconst facts = registrationFacts(profiles());\n"
+        },
+        {
+          "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
+          "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+        },
+        {
+          "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
+          "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+        },
+        {
+          "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
+          "after": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\t...entry.api === void 0 ? {} : { api: entry.api },\n\t\t\t\tmultiKey: false,"
+        },
+        {
+          "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api !== void 0 ? request.api : selectedStored?.api !== void 0 ? selectedStored.api : \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+        },
+        {
+          "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
+          "after": "\tconst baseURL = request.baseURL ?? selectedStored?.baseURL;\n\tif (baseURL === void 0 || baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(baseURL, api);"
+        },
+        {
+          "before": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tmodels: entry.piProvider?.getModels(),",
+          "after": "\t\t\tname: entry.keyEntryName,\n\t\t\tapiKeyEnv: entry.apiKeyEnv,\n\t\t\tapi: entry.api,\n\t\t\tmodels: entry.piProvider?.getModels(),"
+        },
+        {
+          "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
+          "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+        },
+        {
+          "before": "function listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");",
+          "after": "/** Strip trailing slashes and one trailing `/v1`, the segment the Anthropic SDK adds itself. */\nfunction anthropicRoot(baseURL) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");\n\treturn base.endsWith(\"/v1\") ? base.slice(0, -3) : base;\n}\nfunction listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");"
+        },
+        {
+          "before": "\t\tconst baseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (baseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);",
+          "after": "\t\tconst configuredBaseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (configuredBaseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);\n\t\tconst baseUrl = api === \"anthropic-messages\" ? anthropicRoot(configuredBaseUrl) : configuredBaseUrl;"
+        },
+        {
+          "before": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${base.endsWith(\"/v1\") ? base.slice(0, -3) : base}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;",
+          "after": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${anthropicRoot(base)}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;"
+        },
+        {
+          "before": "* gateway documentation publishes both spellings of the same root. Only this\n* listing URL normalizes that segment; model requests receive the configured\n* `baseURL` unchanged.\n*/",
+          "after": "* gateway documentation publishes both spellings of the same root. Anthropic\n* listings and model requests both normalize it, because the Anthropic SDK\n* appends `/v1/messages` on its own while OpenAI protocols append\n* `/chat/completions`; without this, one root would work for chat and double\n* the segment for Anthropic.\n*/"
         }
       ]
     },
     {
       "source": "npm official 0.2.2-rc.1 with per-entry API overrides",
       "baseSha256": "1a3ae58f9b4493e15459cc5000ec80f21b5d3f4a9dea6ffb6bc28e5b8817ae8a",
-      "resultSha256": "5ea8e84da726c04caa6bb321cf41617051ad9a80444834328007643b09b43a32",
+      "resultSha256": "2e00ea0c1b447153e341a1ca675ed6a829094c7caf62c6524e6809bd6540be71",
       "replacements": [
         {
           "before": "\t...modelFields\n});\n/** A {@link modelProfile} whose id lives in the `modelOverrides` dict key. */\nconst modelOverride = z.object(modelFields);\nconst profile = z.object({\n\tapiKeyEnv: z.string().role(\"credential-ref\"),\n\tdisplayName: z.string(),\n\tapi: z.union(supportedProtocols()),\n\tbaseURL: z.string(),\n",
@@ -460,7 +1527,7 @@
         },
         {
           "before": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tif (request.provider !== void 0) {",
-          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api ?? selectedStored?.api ?? \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
+          "after": "\tif (request.keyEntryId !== void 0 && selectedStored === void 0) throw new LlmError(\"multi-key model discovery requires an existing provider key entry\", \"INVALID_CONFIG\");\n\tconst api = request.api !== void 0 ? request.api : selectedStored?.api !== void 0 ? selectedStored.api : \"openai-completions\";\n\tif (!supportedProtocols().includes(api)) throw new LlmError(`pi-ai model discovery api must be a supported protocol`, \"INVALID_CONFIG\");\n\t// A selected entry must probe its effective protocol, not a catalog for another API.\n\tconst entryProtocol = request.keyEntryId !== void 0 && (request.api !== void 0 || selectedStored.api !== void 0);\n\tif (!entryProtocol && request.provider !== void 0) {"
         },
         {
           "before": "\tif (request.baseURL === void 0 || request.baseURL.length === 0) throw new LlmError(`pi-ai ships no catalog for provider \"${request.provider ?? \"\"}\", so its models can only come from its endpoint; set a baseURL, or enter this provider's models by hand`, \"DISCOVERY_FAILED\");\n\tconst api = request.api ?? \"openai-completions\";\n\tif (!LISTABLE_PROTOCOLS.has(api)) throw new LlmError(`pi-ai protocol \"${api}\" has no model listing this build can read; enter this provider's models by hand`, \"DISCOVERY_UNSUPPORTED\");\n\tconst url = listingUrl(request.baseURL, api);",
@@ -473,19 +1540,35 @@
         {
           "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
           "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+        },
+        {
+          "before": "function listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");",
+          "after": "/** Strip trailing slashes and one trailing `/v1`, the segment the Anthropic SDK adds itself. */\nfunction anthropicRoot(baseURL) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");\n\treturn base.endsWith(\"/v1\") ? base.slice(0, -3) : base;\n}\nfunction listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");"
+        },
+        {
+          "before": "\t\tconst baseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (baseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);",
+          "after": "\t\tconst configuredBaseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (configuredBaseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);\n\t\tconst baseUrl = api === \"anthropic-messages\" ? anthropicRoot(configuredBaseUrl) : configuredBaseUrl;"
+        },
+        {
+          "before": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${base.endsWith(\"/v1\") ? base.slice(0, -3) : base}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;",
+          "after": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${anthropicRoot(base)}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;"
+        },
+        {
+          "before": "* gateway documentation publishes both spellings of the same root. Only this\n* listing URL normalizes that segment; model requests receive the configured\n* `baseURL` unchanged.\n*/",
+          "after": "* gateway documentation publishes both spellings of the same root. Anthropic\n* listings and model requests both normalize it, because the Anthropic SDK\n* appends `/v1/messages` on its own while OpenAI protocols append\n* `/chat/completions`; without this, one root would work for chat and double\n* the segment for Anthropic.\n*/"
         }
       ]
     },
     {
       "source": "npm official 0.2.2-rc.1 with per-entry API overrides",
       "baseSha256": "1a3ae58f9b4493e15459cc5000ec80f21b5d3f4a9dea6ffb6bc28e5b8817ae8a",
-      "resultSha256": "9ca2b07c19694a4521a29c82b7948fb6326d80ee7741200a1d7b0f3f06e1da19",
+      "resultSha256": "97baad73bbaa8e71c7a4b0a76cab946d0aee8d94a81bafc1cdbfa9100feec3b6",
       "current": true
     },
     {
       "source": "0.2.2-rc.1 with tool lookup optimization and credential cancellation with per-entry API overrides",
       "baseSha256": "0a99a2fc903a4285044b09114b3bd20ee1e612f39aa381e4a71b10d48ee9e9f7",
-      "resultSha256": "e999e1a7f2352177c653ff0cea6485c3b1d1ea95b40ea613fc0549e2c8e49662",
+      "resultSha256": "70dd30c46c5504422738a158acf789bb6fe43cff9b134d5ddf5e5c3da3236340",
       "current": true
     }
   ],
@@ -568,11 +1651,11 @@
     },
     {
       "before": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tmodels: z.array(modelProfile).required()\n});",
-      "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tmodels: z.array(modelProfile).required()\n});"
+      "after": "\tapiKeyEnv: z.string().role(\"credential-ref\").required(),\n\tapi: z.union(supportedProtocols()),\n\tsortOrder: z.number().step(1).min(0).max(Number.MAX_SAFE_INTEGER),\n\tmodels: z.array(modelProfile).required()\n});"
     },
     {
       "before": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (!Array.isArray(entry.models))",
-      "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (!Array.isArray(entry.models))"
+      "after": "\t\t\tcredentialRef(entry.apiKeyEnv);\n\t\t\tif (entry.api !== void 0 && !supportedProtocols().includes(entry.api)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" api must be a supported protocol`);\n\t\t\tif (entry.sortOrder !== void 0 && (!Number.isSafeInteger(entry.sortOrder) || entry.sortOrder < 0)) throw new Error(`llm-pi-ai: provider \"${provider}\" key entry \"${id}\" sortOrder must be a nonnegative safe integer`);\n\t\t\tif (!Array.isArray(entry.models))"
     },
     {
       "before": "\t\t\tconst child = resolveProfiles({ [provider]: {\n\t\t\t\t...source,\n\t\t\t\tmultiKey: false,",
@@ -593,6 +1676,22 @@
     {
       "before": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\theaders: profile.headers,",
       "after": "\t\tif (profile === void 0) throw new LlmError(`provider \"${provider}\" has no key entry \"${keyEntryId}\"`, \"INVALID_CONFIG\");\n\t\treturn {\n\t\t\tapi: profile.api,\n\t\t\tbaseURL: profile.baseURL ?? catalogProvider(provider)?.baseUrl,\n\t\t\theaders: profile.headers,"
+    },
+    {
+      "before": "function listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");",
+      "after": "/** Strip trailing slashes and one trailing `/v1`, the segment the Anthropic SDK adds itself. */\nfunction anthropicRoot(baseURL) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");\n\treturn base.endsWith(\"/v1\") ? base.slice(0, -3) : base;\n}\nfunction listingUrl(baseURL, api) {\n\tconst base = baseURL.replace(/\\/+$/, \"\");"
+    },
+    {
+      "before": "\t\tconst baseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (baseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);",
+      "after": "\t\tconst configuredBaseUrl = request.baseURL ?? base?.baseUrl ?? providerBaseUrl;\n\t\tif (configuredBaseUrl === void 0) invalid(provider, `model \"${entry.id}\" needs a baseURL; the installed catalog does not describe this route`);\n\t\tconst baseUrl = api === \"anthropic-messages\" ? anthropicRoot(configuredBaseUrl) : configuredBaseUrl;"
+    },
+    {
+      "before": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${base.endsWith(\"/v1\") ? base.slice(0, -3) : base}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;",
+      "after": "\tif (api !== \"anthropic-messages\") return `${base}/models`;\n\treturn `${anthropicRoot(base)}/v1/models?limit=${String(ANTHROPIC_MODEL_LIMIT)}`;"
+    },
+    {
+      "before": "* gateway documentation publishes both spellings of the same root. Only this\n* listing URL normalizes that segment; model requests receive the configured\n* `baseURL` unchanged.\n*/",
+      "after": "* gateway documentation publishes both spellings of the same root. Anthropic\n* listings and model requests both normalize it, because the Anthropic SDK\n* appends `/v1/messages` on its own while OpenAI protocols append\n* `/chat/completions`; without this, one root would work for chat and double\n* the segment for Anthropic.\n*/"
     }
   ],
   "current": true,