planRespBody carries provider cache counters so the session ledger has real numbers to account.

* Hold `amount` against the ledger. Returns `undefined` when it does not fit, * which is the caller's signal to clamp, compact, or stop — never to

* Replace a reservation with the measured cost of the call it covered. * * `actual` is recorded as it came in. It is never clamped to the reserv

snippet trims an error body so we never echo a large/secret-bearing response.

CachePointEligibleModel reports whether the cache-point transform may run for a model: an Anthropic Claude id — bare or behind one inference-profile s

ContentType is the type this compressor handles (e.g. "json").

Credential returns the provider credential resolved from the environment. Empty means the caller must fail closed or use an explicit inbound credentia

DecodeAndValidate strictly parses a catalog. Unknown YAML fields, duplicate provider/model/region rows, invalid URLs/timestamps, and unsafe prices rej

Delete removes key (no error if already absent).

DetectVolatile returns content-blind pattern kind and byte offset only. It never copies matching values into traces or errors.

DialContext returns a DialContext function suitable for use in http.Transport.DialContext. It re-validates the resolved IP at the moment the kernel a

EvaluateObservedAgainstTrace requires exact request population and body joins.

For returns the compressor for a content type, or (nil, false).

ForInputTokens applies a catalog-declared long-context surcharge to a copy of price. The provider-reported total input count determines the threshold;

FromEnvironment loads production configuration. Endpoint is not configurable, preventing env-driven host redirection of KMS credentials.

FromPayloadEnvironment selects the payload KEK and permits the secrets KEK only for decrypting artifacts created before key separation shipped.

IsEnvelope reports whether blob uses versioned KMS envelope format.

IsRecoveryToolName reports whether a tool call is a caveman recovery call. It exists so every adapter agrees on one definition. A tool_result produce

ModelVisibleEquivalent strips only provider cache metadata and normalizes string-vs-single-text-block wire forms before comparing prompt semantics.

NewMemory returns an empty in-memory Store.

Observe normalizes provider cache telemetry. It never mints verified dollars; managed gateway accounting remains sole owner of that stronger claim.

ObserveSummarySince returns the compact observe-estimate object, optionally filtered to rows at or after an RFC3339 instant (the wrap session start).

Pack selects the best items that fit within the token budget. It scores in relevance order but returns selected items in their original order so messa

ReadAgentCorpus imports supported JSONL formats under explicit limits.

Seal compresses-agnostic: it encrypts plaintext with a fresh data key and returns (ciphertext, metadataJSON). ciphertext is nonce(12)||GCM(body).

ValidateHost resolves host (bare hostname or IP literal) and checks all resolved addresses. Use when you have a host/port pair rather than a full URL

ValidateProduction is the startup gate for the ClickHouse transport: call it from every service main alongside env.Refuse*ProductionDefaults, as early

VerifyChain re-walks a proposal's runs ordered by seq and asserts: - seq starts at 1 and increases by exactly 1 (no gaps, no dupes); - each row's prev

A urlopen stub plus the list it records lowercased headers into.

assertScoped verifies every produced row carries the authenticated org/project (never the file's) and the honest non-null defaults.

compressionSavingsUSD is the inferred dollar value of the input tokens that S4 content compression removed before the request reached the provider. It

dialContextWith resolves each hostname exactly once, validates every returned address, then dials a validated IP literal. net.Transport passes hostnam

* Create a one-call OTel exporter bound to this Cave's gateway config. * * The exporter ships spans to the gateway's OTLP endpoint * (`POST {

Zone tagging for the cross-turn prefix fix. Gemini caches repeated prompt prefixes implicitly, so a turn this proxy compressed while it was the live z

handleArgs dispatches a CLI subcommand against store, writing JSON (or raw recovered bytes) to stdout and diagnostics to stderr, and returns the proce