@alumbwe/anvil 1.0.20 → 1.0.22

package/vendor/@anvil/common/src/constants/anvil-models.ts

@@ -0,0 +1,2130 @@
+import {
+  addDaysToYmd,
+  getUtcForZonedTime,
+  getZonedParts,
+  type ZonedDateParts,
+} from '../util/zoned-time'
+import { mimoModels } from './model-config'
+import {
+  ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID,
+  ANVIL_DEEPSEEK_V4_PRO_MODEL_ID,
+  ANVIL_MINIMAX_M3_MODEL_ID,
+} from './anvil-model-ids'
+import {
+  ANVIL_AI_TRAINING_NOTICE,
+  type AnvilModelDataUse,
+} from './anvil-data-use'
+import {
+  clampReasoningEffort,
+  type ReasoningEffort,
+} from './reasoning-effort'
+
+export {
+  ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID,
+  ANVIL_DEEPSEEK_V4_PRO_MODEL_ID,
+  ANVIL_MINIMAX_M3_MODEL_ID,
+} from './anvil-model-ids'
+
+/**
+ * Models a anvil user can pick between in the waiting-room model selector.
+ *
+ * Each model has its own queue (server keys queue position by `model`), so the
+ * list here is effectively the set of separate waiting lines. Order is the
+ * order shown in the UI.
+ */
+export interface AnvilModelOption {
+  /** Stable ID used in the wire protocol and DB. Matches the model id passed
+   *  to the chat-completions endpoint. */
+  id: string
+  /** Short label for the selector UI. */
+  displayName: string
+  /** One-line description shown next to the label. */
+  tagline: string
+  /** Availability policy for the selector and server-side admission. */
+  availability: 'always' | 'deployment_hours'
+  /** Optional caveat shown in the picker (e.g. AI-training warning).
+   *  Rendered in the warning/secondary color so users spot it before
+   *  picking the model. */
+  warning?: string
+  /** Machine-readable data-use policy. Never infer storage or training
+   *  behavior from the human-readable warning text. */
+  dataUse: AnvilModelDataUse
+  /** Premium models carry a per-day usage limit
+   *  (ANVIL_PREMIUM_SESSION_LIMIT). Surfaced in the UI as a "Premium"
+   *  badge with the limit. Derived from ANVIL_PREMIUM_MODEL_IDS so the two
+   *  never drift. */
+  premium: boolean
+  /** Whether the model accepts image input. Drives whether uploaded images
+   *  are forwarded as real multimodal content vs. dropped/inlined as text. */
+  multimodal: boolean
+  /** Reasoning effort Anvil turns run this model at. Not advisory: the
+   *  completions layer sends it whenever the caller names no reasoning of its
+   *  own (applyAnvilReasoningDefaults in web/src/llm-api/openrouter.ts),
+   *  and the Desktop and CLI pickers display the same field — one source, so
+   *  on those surfaces what users see and what the server sends cannot drift.
+   *  Omit where the model has no effort levels (MiniMax) or the provider
+   *  default should stand untouched (GLM, MiMo). CAUTION: both DeepSeek V4
+   *  models expose low/high/max and neither has a distinct medium rung — see
+   *  DEEPSEEK_V4_REASONING_EFFORTS. */
+  /** Reasoning effort sent for this model, on the PROVIDER's own scale.
+   *  Deliberately wider than the shared agent-definition enum: Meta's ladder is
+   *  minimal/low/medium/high/xhigh (its own 400 names the set). Not every
+   *  provider accepts every rung, so each model still declares its own ladder. */
+  reasoningEffort?: 'minimal' | 'low' | 'medium' | 'high' | 'xhigh'
+  /**
+   * The ladder a USER may pick from for this model, ascending. Absent means the
+   * model offers no choice and shows no control — the default for every row.
+   *
+   * Same field name and shape as Desktop's `ModelOption.efforts`
+   * (anvil-desktop/src/shared/models.ts), deliberately: Desktop already had
+   * per-model effort lists driving its Claude/Codex picker, and one pattern
+   * across surfaces beats two that must be kept in step.
+   *
+   * Values must be native provider settings, not compatibility aliases or
+   * prompt approximations. The model's ordinary setting belongs in
+   * `defaultEffort`; rungs may sit on either side of it.
+   */
+  efforts?: readonly ReasoningEffort[]
+  /**
+   * Where `efforts` starts before a user touches it.
+   *
+   * Usually equal to `reasoningEffort`, but kept separate so a future model can
+   * expose a picker default that differs from its server-owned wire default.
+   */
+  defaultEffort?: ReasoningEffort
+  /** Whether the model is still being trialed and may be unreliable. Surfaced
+   *  in the picker as a "TEST" badge with a tooltip so users know it is not
+   *  yet production-grade. */
+  experimental?: boolean
+  /** Tooltip attached to the tagline, for a tagline that names a behavior the
+   *  word alone cannot explain (e.g. "Queue"). Rendered with the same
+   *  dotted-underline affordance as the data-use "Data" label, so a row can
+   *  carry both without growing a second line. */
+  taglineTooltip?: string
+  /** Freshly released or freshly re-trained. Surfaced as a "NEW" badge so a
+   *  returning user notices the model changed rather than assuming it is the
+   *  same one they already formed an opinion about. Clear it once the model
+   *  stops being news. */
+  isNew?: boolean
+  /** Set when another model has overtaken this one and users should generally
+   *  move. Pickers render `notice` on the row and offer a one-click switch to
+   *  `modelId`. Kept structured rather than folded into `warning` so the button
+   *  has a real target, and so this stays distinct from the data-use caveat —
+   *  a row can carry both. */
+  supersededBy?: {
+    modelId: string
+    notice: string
+    actionLabel: string
+  }
+}
+
+/** Server-facing fallback copy for APIs and provider errors that can't know
+ *  the caller's local timezone. The CLI should render
+ *  `getAnvilDeploymentAvailabilityLabel()` instead. */
+export const ANVIL_DEPLOYMENT_HOURS_LABEL = '9am ET-5pm PT every day'
+export const ANVIL_GEMINI_PRO_MODEL_ID = 'google/gemini-3.1-pro-preview'
+/** Legacy wire id emitted by older anvil.com/chat deployments. The shared
+ *  completions API keeps accepting it, but routes it to DeepSeek direct. New
+ *  chat code must use ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID instead. */
+export const ANVIL_DEEPSEEK_V4_FLASH_FIREWORKS_MODEL_ID =
+  'fireworks/deepseek-v4-flash'
+// HY3 IS GONE, on every surface and every route (removed 2026-08-07). It left
+// Anvil on 2026-08-04 but its wire ids lived on for paid/BYOK callers via
+// web/src/llm-api/hy3-fallback.ts; that file, the Atlas Cloud adapter that was
+// its paid lane, and the `tencent/hy3*` model-config entries have all been
+// deleted. Nothing routes these slugs now — a request for one falls through to
+// the ordinary unknown-model path.
+export const ANVIL_MIMO_V25_MODEL_ID = mimoModels.mimoV25
+/** GLM 5.2, served by CrofAI's direct OpenAI-compatible API (moved off
+ *  Fireworks serverless 2026-07-29, at ~4x less than Fireworks' list price).
+ *  The `z-ai/` prefix is a wire id inherited from the Fireworks era — nothing
+ *  reaches Z.ai; CrofAI receives its native `glm-5.2` id (see CROF_MODEL_MAP).
+ *
+ *  This is the ONLY GLM 5.2 route. Unlike the other picker models it is NOT
+ *  freely available — it is unlocked by referring friends. Each qualified
+ *  referral grants one 1-hour GLM session per day, uncapped since 2026-07-30.
+ *  Gated by a per-user daily session pool whose limit equals the caller's GLM
+ *  referral score (see the free-session quota).
+ *
+ *  A second wire id (`crof/glm-5.2`) used to reach the same CrofAI upstream on
+ *  the ordinary daily PREMIUM pool. It was retired from the pickers 2026-07-30
+ *  and deleted outright 2026-08-04: the picker exclusion was client-side only,
+ *  so hand-written API callers kept admitting sessions on it and collecting
+ *  GLM 5.2 with zero referrals (12-49 distinct accounts/day, mostly known
+ *  sock-puppet clusters). Never reintroduce a second wire id for a
+ *  entitlement-gated model — the quota pool is chosen by model id, so an extra
+ *  id is an extra door. */
+export const ANVIL_GLM_V52_MODEL_ID = 'z-ai/glm-5.2'
+/** GPT-5.6 Luna (OpenAI), served through OpenRouter. The id is OpenRouter's own
+ *  slug, so it falls through to the default OpenRouter route with no
+ *  provider-specific handler (same as Ling 3.0 Flash).
+ *
+ *  Two things about this model are enforced server-side rather than left to the
+ *  agent definitions, so they hold for every Anvil surface, every subagent,
+ *  and BYOK callers alike (see applyOpenRouterProviderRouting and
+ *  applyAnvilReasoningDefaults in web/src/llm-api/openrouter.ts):
+ *
+ *   - Routing PREFERS OpenAI's own endpoint ($0.10/$0.60 per M) via `order`,
+ *     with fallbacks allowed and cost bounded by ANVIL_GPT_5_6_LUNA_MAX_PRICE
+ *     rather than by the pin. A hard pin (allow_fallbacks:false) held until
+ *     2026-08-16, when OpenAI began refusing every request from this account
+ *     ("Policy Violation: this user has been blocked") and took Luna to a 100%
+ *     failure rate with four usable endpoints sitting under the ceiling.
+ *   - Reasoning effort is `high`. Luna is cheap enough per token that the
+ *     quality is worth more than the reasoning tokens.
+ *
+ *  Both are scoped to ANVIL traffic on purpose: `LITE_MODEL`
+ *  (agents/constants.ts) is this same model id, so keying either off the model
+ *  alone would change Anvil's paid lite mode as a side effect. */
+export const ANVIL_GPT_5_6_LUNA_MODEL_ID = 'openai/gpt-5.6-luna'
+/** OpenRouter provider slug Luna prefers (first in `provider.order`). */
+export const ANVIL_GPT_5_6_LUNA_PROVIDER_ROUTE = 'openai'
+/** Price ceiling for Luna, USD per million tokens. Sent as OpenRouter's
+ *  `provider.max_price`, which REFUSES to route above it rather than serving
+ *  and billing, so a provider re-pricing surfaces as a loud error instead of a
+ *  surprise invoice. Since 2026-08-16 this — not a hard provider pin — is the
+ *  sole cost guarantee, so it must not be widened casually.
+ *
+ *  This is a COST FENCE, not an assertion of the list price, and the gap is
+ *  deliberate on both sides:
+ *
+ *   - It must sit ABOVE list. OpenRouter compares strictly: shipping the exact
+ *     list price (0.1 / 0.6) made every Luna request 404 with "No endpoints
+ *     found that satisfy the max price for this request" — verified against the
+ *     live API on 2026-07-30, where 0.11/0.61 passed and 0.1/0.6 did not. A
+ *     ceiling equal to list is an outage waiting on a rounding change.
+ *   - It must stay under the next tier up. Azure, Azure EU and Amazon Bedrock
+ *     listed $1.00/$6.00 when this was written and re-priced to $0.20/$1.20 by
+ *     2026-08-16; the ceiling admits them at today's price and would exclude
+ *     them again if they returned to the old one.
+ *
+ *  The headroom covers OpenAI's own tiers (list $0.10/$0.60, priority
+ *  $0.20/$1.20, flex $0.05/$0.30) and ordinary price drift, while still failing
+ *  closed well before a 10x endpoint could serve a request. */
+export const ANVIL_GPT_5_6_LUNA_MAX_PRICE = {
+  prompt: 0.5,
+  completion: 3.0,
+} as const
+/** Reasoning effort every Luna turn runs at. */
+export const ANVIL_GPT_5_6_LUNA_REASONING_EFFORT = 'high' as const
+/**
+ * Kimi K3 (Eco), served by CrofAI. God-only on Anvil Web, for testing.
+ *
+ * The `crof/` prefix names the only place this exists — unlike the retired
+ * `crof/glm-5.2`, which was a SECOND id for a model already offered under
+ * `z-ai/glm-5.2` and became a quota-bypass route. There is no other id for
+ * this, so the prefix creates no such door. (Note the paid `moonshotai/kimi-*`
+ * slugs in model-config.ts are different models on a different provider, not
+ * second doors onto this one.)
+ *
+ * `-eco` is load-bearing in the WIRE id and deliberately absent from the
+ * DISPLAY name. CrofAI serves two K3 builds — `kimi-k3` at $2.00/$8.00 per M
+ * and this Q2_K-quantized `kimi-k3-eco` at $1.00/$4.00 — so the id must name
+ * the exact build or a future `kimi-k3` row would collide with it. The picker
+ * label is plain "Kimi K3" by request; see KIMI_K3_ECO_MODEL.
+ */
+export const ANVIL_KIMI_K3_ECO_MODEL_ID = 'crof/kimi-k3-eco'
+/**
+ * Extended-context tiers for the DeepSeek V4 and Luna routes.
+ *
+ * Wire ids only. These are provisioned per-account rather than offered from a
+ * client catalog, so they are deliberately absent from ANVIL_MODELS and
+ * from every quota list — a client that rendered one would offer a row most
+ * accounts cannot run. Requests carry the id directly on any free-mode root.
+ *
+ * Pricing and context windows track their base tier; the suffix names the
+ * provisioned variant, not a different model family, so nothing here needs a
+ * second entry in the price tables.
+ */
+export const ANVIL_DEEPSEEK_V4_PRO_MAX_MODEL_ID =
+  'deepseek/deepseek-v4-pro-max'
+export const ANVIL_DEEPSEEK_V4_FLASH_MAX_MODEL_ID =
+  'deepseek/deepseek-v4-flash-max'
+export const ANVIL_GPT_5_6_LUNA_MAX_MODEL_ID = 'openai/gpt-5.6-luna-max'
+
+/**
+ * Claude Fable 5 — Anthropic's frontier model, offered to free CLI users as a
+ * capacity-limited trial rather than as a standing picker model.
+ *
+ * It is deliberately NOT in ANVIL_MODELS: no client may render it from its
+ * own catalog. The server decides, per request, whether the shared pool still
+ * has sessions left and says so in the session response
+ * (`limitedModelOffers`); a client that receives nothing renders exactly what
+ * it rendered before the offer existed. See ANVIL_LIMITED_OFFER_MODEL_IDS.
+ */
+export const ANVIL_FABLE_5_MODEL_ID = 'anthropic/claude-fable-5'
+
+/**
+ * Meta Muse Spark 1.2 (Contributor tier), served by Meta's own developer API
+ * (`https://api.meta.ai/v1`, OpenAI-compatible chat completions). The `meta/`
+ * prefix names the only place it exists — there is no second wire id, so it
+ * cannot become a quota-bypass route the way `crof/glm-5.2` did.
+ *
+ * ANVIL WEB ONLY. It is absent from ANVIL_MODELS and
+ * SUPPORTED_ANVIL_MODELS, so no CLI/Desktop build can select it and
+ * `isAnvilSessionModelId` refuses it on those surfaces. Web reaches it
+ * through ANVIL_WEB_MODELS.
+ *
+ * The reason for the narrow surface is the rate limit, not the price: the
+ * Contributor tier is capped at 60 RPM per TEAM — i.e. across every Anvil
+ * user at once — against Standard's 3,000. That is roughly one request per
+ * second for the whole product, so this model needs the Convex-side queue
+ * (see docs/anvil-muse-spark.md) that the browser can render a wait for.
+ * The CLI has no such queue and would just surface 429s.
+ *
+ * Contributor pricing ($0.10/$0.002/$0.20 per M against Standard's
+ * $1.25/$0.15/$4.25) is bought with training rights over prompts and
+ * completions, which is why this is `dataUse: 'training'` and carries the
+ * AI-training warning.
+ */
+export const ANVIL_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID =
+  'meta/muse-spark-1.2-contributor'
+/** Meta's own model id for the wire id above — what api.meta.ai receives. */
+export const MUSE_SPARK_12_CONTRIBUTOR_UPSTREAM_MODEL_ID =
+  'muse-spark-1.2-contributor'
+/** Published Contributor-tier limit: 60 requests/min PER TEAM, shared by every
+ *  Anvil user. Sizes the queue's drain rate, so keep it in sync with
+ *  https://dev.meta.ai/docs/pricing-rate-limits. */
+export const MUSE_SPARK_CONTRIBUTOR_RPM = 60
+/**
+ * Reasoning effort sent with every Muse Spark request.
+ *
+ * Muse Spark ALWAYS reasons — `reasoning_effort: "none"` is a hard 400 — so
+ * this chooses how much, not whether. The full ladder is
+ * minimal/low/medium/high/xhigh; Meta's own 400 on an unknown value names the
+ * set, which is the only place it is documented.
+ *
+ * Measured live 2026-08-06, same word problem, n=6 per level:
+ *
+ *   minimal   153 reasoning tokens   1.0s
+ *   low      ~300                    —
+ *   high      362                    1.9s
+ *   xhigh     391                    2.4s
+ *
+ * The top of the ladder is nearly flat: xhigh buys ~8% more reasoning than
+ * high, inside the run-to-run spread, and spends ~26% more latency for it.
+ * The real lever is downward — minimal is a 2.4x cut and still answered
+ * correctly on every sample. So read this constant as "max depth, latency
+ * accepted", and reach for `minimal` or `low` if a turn ever needs to feel
+ * fast. Cost barely enters into it: 500k output tokens across 347 prod
+ * requests came to roughly $0.10.
+ */
+export const ANVIL_MUSE_SPARK_REASONING_EFFORT = 'xhigh' as const
+
+/**
+ * The user-pickable ladders, named like Desktop's THROUGH_XHIGH / NO_XHIGH so
+ * the two catalogs read the same way.
+ *
+ * These are reusable provider-native ladders. A model's default is independent
+ * and may sit below the last rung.
+ */
+export const EFFORTS_THROUGH_HIGH = ['low', 'medium', 'high'] as const
+export const EFFORTS_THROUGH_XHIGH = [
+  'minimal',
+  'low',
+  'medium',
+  'high',
+  'xhigh',
+] as const
+export const EFFORTS_THROUGH_MAX = [
+  'low',
+  'medium',
+  'high',
+  'xhigh',
+  'max',
+] as const
+/**
+ * The three native DeepSeek V4 templates, shared by Flash 07/31 and Pro 08/13.
+ *
+ * DeepSeek publishes one requested→actual effort table for both models, and
+ * since the Pro 08/13 GA build it is genuinely identical (read off
+ * api-docs.deepseek.com/guides/thinking_mode, 2026-08-12): low→low, medium→high,
+ * high→high, xhigh→high, max→max. Pro used to collapse low into high, which is
+ * why it shipped a shorter ladder; that is no longer true, so the two rows now
+ * share this one. Medium is still not a distinct level on either model and is
+ * intentionally absent.
+ *
+ * The table is the ONLY source for this. DeepSeek's API accepts any
+ * `reasoning_effort` string without complaint — `"gigantic"` returns a normal
+ * 200 (verified against the live API, 2026-08-12) — so a rung being accepted
+ * proves nothing about it being distinct, and a ladder can never be derived by
+ * probing.
+ */
+const DEEPSEEK_V4_REASONING_EFFORTS = ['low', 'high', 'max'] as const
+/**
+ * The marker that turns a Muse Spark rate limit into a queued turn rather than
+ * a failed one.
+ *
+ * It travels twice in the same 429 — as `error.code`, and inside
+ * `error.message` — because only the message survives the whole path from
+ * `web/src/llm-api/meta.ts` through the AI SDK to the runner's error handling.
+ * The runner matches on it (see docs/anvil-muse-spark.md); if it ever stops
+ * matching, rate limits degrade to plain errors with no queue and no notice,
+ * which is exactly the failure this constant exists to make greppable.
+ */
+export const MUSE_SPARK_RATE_LIMITED_ERROR_CODE = 'muse_spark_rate_limited'
+
+/**
+ * Where a rate-limited Muse Spark request goes instead of waiting.
+ *
+ * DeepSeek V4 Pro since 2026-08-12 (GPT-5.6 Luna before it), and the choice is
+ * constrained rather than free on two counts:
+ *
+ *  - The fallback must be a model the caller is ALREADY entitled to, or a rate
+ *    limit would become a way to reach something they are not. Pro sits in the
+ *    same shared daily premium pool as Muse Spark
+ *    (ANVIL_WEB_PREMIUM_MODEL_IDS), so a rerouted request draws on exactly
+ *    the quota the original would have.
+ *  - It should be the model we would recommend anyway, since the user never
+ *    chose it: Pro is now DEFAULT_ANVIL_WEB_MODEL_ID, so a reroute lands on
+ *    the same model a new thread would have started on.
+ *
+ * Being text-only costs this nothing: images reaching a Anvil model that
+ * cannot see pixels are converted to vision-model descriptions at the
+ * completions layer (getAnvilModelImageSupport gates it), so a rerouted turn
+ * carrying an image still reads it.
+ */
+export const MUSE_SPARK_FALLBACK_MODEL_ID = ANVIL_DEEPSEEK_V4_PRO_MODEL_ID
+
+/**
+ * How long a caller may be asked to wait before the request is rerouted.
+ *
+ * Deliberately the same 10s as the provider's silent retry window, and that
+ * identity is the whole design: a wait we can hide costs nothing and keeps the
+ * user on the model they picked, while a wait we would have to *explain* is
+ * worse than quietly serving the answer on a peer model. Meta answers a real
+ * rate limit with `Retry-After: 60`, so in practice this splits cleanly —
+ * blips are absorbed, genuine saturation reroutes.
+ */
+export const MUSE_SPARK_FALLBACK_AFTER_MS = 10_000
+
+/** Picker copy for the tagline tooltip, and the single source for it — the
+ *  server's behavior and the row's promise must not drift. Names the model
+ *  MUSE_SPARK_FALLBACK_MODEL_ID actually points at; a catalog invariant test
+ *  checks the two agree. */
+export const MUSE_SPARK_FALLBACK_NOTICE =
+  'Falls back to DeepSeek V4 Pro if the queue is too long.'
+
+/** UI-only rollout switch. Backend support and free-mode allowlists remain
+ *  wired even when these models are hidden from the Anvil picker. */
+export const ANVIL_ENABLE_MIMO_MODELS_IN_UI = true
+/** UI-only rollout switch for the streak indicator in the waiting room. */
+export const ANVIL_ENABLE_STREAK_IN_UI = true
+/** Local/debug switch: force the localhost free-mode country bypass into
+ *  limited access so the limited Anvil UX can be exercised without an env
+ *  var. */
+export const ANVIL_FORCE_LIMITED_MODE = false
+export const ANVIL_PREMIUM_SESSION_LIMIT = 6
+export const ANVIL_LIMITED_SESSION_LIMIT = 6
+/** Full-access Web/Cloud models outside the premium/referral pools. The CLI
+ * keeps these models unlimited; browser surfaces cap fresh sessions to deter
+ * automated project/session churn. */
+export const ANVIL_WEB_STANDARD_SESSION_LIMIT = 6
+export const ANVIL_PREMIUM_SESSION_RESET_TIMEZONE = 'America/Los_Angeles'
+export const ANVIL_PREMIUM_SESSION_PERIOD = 'pacific_day'
+/** GLM 5.2 referral-reward session pool. Distinct from the shared premium
+ *  daily pool: GLM sessions reset daily (Pacific; weekly until 2026-07-29) and
+ *  the per-user limit is the caller's GLM referral score, uncapped since
+ *  2026-07-30. Note the streak GLM bonus is a live entitlement on this same
+ *  pool, so it refills at this cadence too. */
+export const ANVIL_GLM_V52_SESSION_PERIOD = ANVIL_PREMIUM_SESSION_PERIOD
+export const ANVIL_GLM_V52_SESSION_RESET_TIMEZONE =
+  ANVIL_PREMIUM_SESSION_RESET_TIMEZONE
+export const ANVIL_GLM_V52_SESSION_WINDOW_HOURS = 24
+// The GLM referral reward is UNCAPPED as of 2026-07-30 (it was
+// ANVIL_GLM_V52_REFERRAL_CAP = 10): every qualified full-access referral
+// grants one 1-hour GLM session per day, with no read-time ceiling. The only
+// remaining bound is ANVIL_REFERRAL_SIGNUP_LIMIT (100 attributed rows per
+// referrer, enforced at attribution), which is now the effective maximum
+// rather than the anti-spam backstop it used to be.
+/** Master kill-switch for the GLM 5.2 referral program. While true, qualified
+ *  referrals grant daily GLM sessions and the CLI advertises the perk. Flip to
+ *  false to wind the program down: entitlement drops to 0 for everyone and the
+ *  CLI stops showing the banner. The perk is intentionally framed as
+ *  limited-time in the UI so turning this off isn't a surprise. */
+export const ANVIL_GLM_V52_REFERRAL_ENABLED = true
+/** GLM sessions are exactly one hour of wall-clock time, regardless of the
+ *  global free-session length, so the "1 hour per referral per day" promise is
+ *  exact. */
+export const ANVIL_GLM_V52_SESSION_LENGTH_MS = 60 * 60 * 1000
+export const ANVIL_LIMITED_SESSION_RESET_TIMEZONE =
+  ANVIL_PREMIUM_SESSION_RESET_TIMEZONE
+export const ANVIL_LIMITED_SESSION_PERIOD = ANVIL_PREMIUM_SESSION_PERIOD
+export const ANVIL_WEB_STANDARD_SESSION_RESET_TIMEZONE =
+  ANVIL_PREMIUM_SESSION_RESET_TIMEZONE
+export const ANVIL_WEB_STANDARD_SESSION_PERIOD =
+  ANVIL_PREMIUM_SESSION_PERIOD
+
+/**
+ * Streak rewards. Once a user reaches a `ANVIL_STREAK_REWARD_INTERVAL_DAYS`
+ * (7)-day daily streak, they earn:
+ *   - +1 session in their primary daily pool (premium for full-access users,
+ *     limited for limited-access) **every day** the streak stays at 7+; and
+ *   - for full-access users, +1 GLM 5.2 session per GLM-pool window per
+ *     completed 7 days of the current streak (7 days → 1, 14 → 2), capped at
+ *     `ANVIL_STREAK_GLM_BONUS_MAX_MULTIPLIER` (28-day streak), on top of
+ *     referrals. The GLM pool resets daily (Pacific) since 2026-07-29, weekly
+ *     before.
+ *
+ * The daily premium/limited bonus is persisted after today's first use. The
+ * GLM bonus is derived live from the current streak, so it refills at the GLM
+ * pool reset and shuts off as soon as the streak breaks.
+ */
+export const ANVIL_STREAK_REWARD_INTERVAL_DAYS = 7
+/** Cap on the GLM streak bonus: at most this many 7-day tiers count, so a
+ *  28-day (or longer) streak earns 4 GLM sessions per pool window. */
+export const ANVIL_STREAK_GLM_BONUS_MAX_MULTIPLIER = 4
+/** Master kill-switch for streak rewards. When false, streaks grant nothing
+ *  and effective limits fall back to the base pool limits. */
+export const ANVIL_STREAK_REWARDS_ENABLED = true
+/** Sub-switch for the recurring full-access GLM 5.2 streak entitlement. Lets
+ *  the perk be wound down independently of the premium/limited bonus (and of
+ *  the separate referral-driven GLM program). */
+export const ANVIL_STREAK_GLM_BONUS_ENABLED = true
+/** Session units added to an eligible streak-reward pool. One whole session. */
+export const ANVIL_STREAK_BONUS_SESSION_UNITS = 1
+
+/** How much history the account hub's activity map covers. A year, matching
+ *  what the grid can legibly draw at 53 columns. Free: the map is drawn from
+ *  one narrow row per active day. */
+export const ANVIL_USAGE_MAP_DAYS = 365
+
+/** Lookback for the hub's token and message totals, which are aggregated from
+ *  `message` on demand. Days rather than months on purpose: that table's cost
+ *  scales with how much the account sent, not with the calendar. */
+export const ANVIL_RECENT_TOKENS_DAYS = 7
+
+/** Which session pool a streak bonus credit applies to. `premium` and `limited`
+ *  are the daily pools (full vs limited access); `glm` is the weekly GLM 5.2
+ *  pool (full access only). */
+export type AnvilStreakRewardPool = 'premium' | 'limited' | 'glm'
+/** Deprecated wire compatibility field. Session usage now resets at midnight
+ *  Pacific time rather than using a rolling hourly window. */
+export const ANVIL_PREMIUM_SESSION_WINDOW_HOURS = 24
+export const ANVIL_LIMITED_SESSION_WINDOW_HOURS =
+  ANVIL_PREMIUM_SESSION_WINDOW_HOURS
+
+const ANVIL_EASTERN_TIMEZONE = 'America/New_York'
+const ANVIL_PACIFIC_TIMEZONE = 'America/Los_Angeles'
+
+interface LocalTimeFormatOptions {
+  locale?: string
+  timeZone?: string
+}
+
+/** Full-access anvil models that benefit from spawning the gemini-thinker
+ *  subagent for deeper reasoning. Covers every full-access picker model except
+ *  the two limited-tier ones (DeepSeek V4 Flash, MiMo 2.5). Used by the CLI to
+ *  toggle the gemini-thinker spawnable + prompts based on the user's pick, and
+ *  by the server to admit gemini-thinker child requests against a parent
+ *  session bound to one of these models. */
+export const ANVIL_GEMINI_THINKER_PARENT_MODELS = new Set<string>([
+  ANVIL_DEEPSEEK_V4_PRO_MODEL_ID,
+  ANVIL_MINIMAX_M3_MODEL_ID,
+  ANVIL_GPT_5_6_LUNA_MODEL_ID,
+])
+
+export function canAnvilModelSpawnGeminiThinker(modelId: string): boolean {
+  return ANVIL_GEMINI_THINKER_PARENT_MODELS.has(modelId)
+}
+
+/**
+ * Hard context windows (in tokens) of the anvil models, keyed by the backend
+ * model id sent to the completions endpoint.
+ *
+ * Every number was read off a real provider rejection in prod rather than a
+ * spec sheet, so it is the limit the provider actually enforces:
+ *   minimax-m3            "model maximum context length: 524287"
+ *   deepseek-v4-flash     "model maximum context length: 1048575"
+ *   deepseek-v4-pro       "This model's maximum context length is 1048576
+ *                          tokens. However, you requested 1300092 tokens"
+ *   kimi-k2.7-code        "Range of input length should be [1, 262144]"
+ *
+ * The consumer is agents/base-chat.ts, which prunes a chat thread's replayed
+ * history to a fraction of the selected model's window. Its `handleSteps` is
+ * serialized with toString() and so cannot import — it inlines a copy of this
+ * table, and agents/__tests__/base-chat.test.ts fails if the two drift. This
+ * is the reference copy: add a model here (with the rejection text that proves
+ * the number) and the test will tell you to mirror it.
+ *
+ * Models absent from the map fall back to ANVIL_DEFAULT_CONTEXT_WINDOW. The
+ * risk is asymmetric — guessing too high silently wedges a thread forever,
+ * guessing too low only prunes earlier than strictly needed — so a model is
+ * added only once its real limit has been observed.
+ */
+export const ANVIL_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  [ANVIL_MINIMAX_M3_MODEL_ID]: 524_288,
+  [ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID]: 1_048_576,
+  // Read off the rejection above on 2026-08-12 — the same window as Flash, and
+  // the entry Pro had been missing since it shipped. Absent, base-chat gave a
+  // million-token model ANVIL_DEFAULT_CONTEXT_WINDOW's 131_072 and summarized
+  // a Pro chat thread at ~52k estimated tokens, 8x early. Unlike Luna and Muse
+  // Spark below this is an observed limit rather than a published one, so it is
+  // entered exactly.
+  [ANVIL_DEEPSEEK_V4_PRO_MODEL_ID]: 1_048_576,
+  // Luna is the one entry not read off a provider rejection. Every Luna
+  // endpoint OpenRouter lists (OpenAI, its flex/priority tiers, Azure, Bedrock)
+  // declares context_length 1_050_000, verified against the live endpoints API
+  // on 2026-08-01; 1_000_000 is deliberately entered instead, which stays on
+  // the safe side of the asymmetry above AND makes base-chat's 0.4 budget come
+  // out at exactly 400k.
+  //
+  // Absent, Luna fell to ANVIL_DEFAULT_CONTEXT_WINDOW and base-chat budgeted
+  // it 131_072 * 0.4 = 52_428 — a 20x under-estimate of a million-token model,
+  // which summarizes a chat thread that had plenty of room left. Every
+  // summarize rewrites history from the front and throws away the prompt cache
+  // with it.
+  [ANVIL_GPT_5_6_LUNA_MODEL_ID]: 1_000_000,
+  // Meta publishes 1,048,576 for every Muse Spark variant. Entered as 1_000_000
+  // for the same reason Luna is: it stays on the safe side of the asymmetry
+  // above while remaining an honest order of magnitude, where falling through
+  // to the 131_072 default would summarize a million-token thread 8x early.
+  [ANVIL_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID]: 1_000_000,
+}
+
+/** Window assumed for any model missing from ANVIL_MODEL_CONTEXT_WINDOWS.
+ *  Smaller than every window we have measured. */
+export const ANVIL_DEFAULT_CONTEXT_WINDOW = 131_072
+
+/** The "a better model exists" copy every superseded model points at, shared so
+ *  the rows that carry it can't drift into different sentences. Two rows do
+ *  today — MiniMax M3 and MiMo 2.5. (DeepSeek V4 Pro was the third until its
+ *  08/13 GA build overtook Flash again; see DEEPSEEK_V4_PRO_MODEL.)
+ *
+ *  Names the DATED build. The wire id is undated and auto-updates, so the row a
+ *  user is being steered TO is labelled "DeepSeek V4 Flash 07/31" in every
+ *  picker (see DEEPSEEK_V4_FLASH_MODEL.displayName) — matching it exactly is
+ *  what makes the notice point at something visible on screen rather than at a
+ *  name nothing in the list carries.
+ *
+ *  Kept short on purpose: pickers render it as its own line, and in the CLI it
+ *  is the longest line in the menu, so it sets the width of every card. */
+const FLASH_SUPERSEDES_NOTICE =
+  'DeepSeek V4 Flash 07/31 performs better for most tasks.'
+
+/** The same thing for the rows Pro overtook, which is currently GPT-5.6 Luna.
+ *
+ *  A SECOND notice rather than a reworded shared one, because the two point
+ *  somewhere different for different reasons: Flash's notice steers off models
+ *  that are dearer AND weaker, while against Luna the cost comparison does not
+ *  cleanly favor either side (see ANVIL_WEB_DEEMPHASIZED_MODEL_IDS for the
+ *  numbers). That is why Luna is superseded but not de-emphasized — the argument
+ *  here is quality and speed alone.
+ *
+ *  Names the dated build, matching DEEPSEEK_V4_PRO_MODEL.displayName, so the row
+ *  it steers to is one the user can see on screen. */
+const PRO_SUPERSEDES_NOTICE =
+  'DeepSeek V4 Pro 08/13 is smarter and faster.'
+
+/**
+ * DeepSeek V4 Pro, on the 08/13 GA build (2026-08-12).
+ *
+ * SAME ENDPOINT AND SAME WIRE ID as the preview build it replaces, and that is
+ * not an assumption: DeepSeek direct serves only the undated ids, so the GA
+ * build arrived on `deepseek-v4-pro` with no route to add. Every dated slug is
+ * refused outright — `deepseek-v4-pro-0813` returns "The supported API model
+ * names are deepseek-v4-pro or deepseek-v4-flash" (verified against the live
+ * API, 2026-08-12), and /v1/models lists exactly the two undated ids. So there
+ * is nothing to plumb for a new build; what changes is what this row SAYS.
+ *
+ * Pricing is unchanged by the GA release ($0.435 in / $0.003625 cache read /
+ * $0.87 out per M), so DEEPSEEK_V4_PRO_PRICING in web/src/llm-api/deepseek.ts
+ * still holds.
+ */
+const DEEPSEEK_V4_PRO_MODEL = {
+  id: ANVIL_DEEPSEEK_V4_PRO_MODEL_ID,
+  // Dated for the same reason Flash is: the wire id is undated and auto-updates,
+  // so an undated label tells a returning user nothing changed when in fact the
+  // GA build is a different model from the preview they formed an opinion about.
+  displayName: 'DeepSeek V4 Pro 08/13',
+  // Superlative on purpose, and it has to stay in step with Flash's: Pro is the
+  // recommended default, so the two DeepSeek rows are read against each other.
+  // "Smartest" vs Flash's "Smart & Fast" says which one is stronger and which
+  // one is the cheap, unlimited one — "Deep reasoning" said neither.
+  tagline: 'Smartest',
+  availability: 'always',
+  warning: ANVIL_AI_TRAINING_NOTICE,
+  dataUse: 'training',
+  premium: true,
+  multimodal: false,
+  // DeepSeek's own documented default (thinking on, effort high,
+  // api-docs.deepseek.com/guides/thinking_mode), sent explicitly so a
+  // provider-side default change cannot silently move Anvil. Unlike Flash,
+  // Pro has no fallback cascade — it is served on the direct lane only
+  // (deepseek-router.ts runs its lanes for Flash alone), so this is the one
+  // route the value has to be right for.
+  reasoningEffort: 'high',
+  // The 08/13 build maps low to a real low template, so Pro now offers the same
+  // three rungs as Flash. See DEEPSEEK_V4_REASONING_EFFORTS.
+  efforts: DEEPSEEK_V4_REASONING_EFFORTS,
+  defaultEffort: 'high',
+  // NOT superseded, and not de-emphasized (ANVIL_WEB_DEEMPHASIZED_MODEL_IDS)
+  // as of the 08/13 GA build. Pro carried a "V4 Flash performs better" notice
+  // from 2026-07-31, when the re-post-trained Flash-0731 beat the Pro PREVIEW on
+  // agent work. GA reversed that on exactly the benchmarks this product is:
+  // Terminal Bench 2.1 72.1 → 87.9, DeepSWE 12.8 → 62.7, CyberGym 52.7 → 83.3,
+  // DSBench-Hard 31.1 → 67.2, with 80.6% on SWE-bench Verified. Steering users
+  // off it would now be steering them off the stronger model.
+  //
+  // Pro is now the DEFAULT on every surface (DEFAULT_ANVIL_MODEL_ID for
+  // CLI/Desktop, DEFAULT_ANVIL_WEB_MODEL_ID for Web/Cloud). It is ~3x Flash's
+  // input and ~3x its output price and draws on the daily premium pool, which is
+  // why that was not automatic — but the pool is metered in SESSIONS, so leading
+  // with Pro moves nobody's quota, and the surfaces step down to
+  // FALLBACK_ANVIL_MODEL_ID (Flash) once a user's pool is spent.
+  isNew: true,
+} as const satisfies AnvilModelOption
+
+const MIMO_V25_MODEL = {
+  id: ANVIL_MIMO_V25_MODEL_ID,
+  displayName: 'MiMo 2.5',
+  tagline: 'Balanced',
+  availability: 'always',
+  dataUse: 'service',
+  premium: false,
+  multimodal: true,
+  // Xiaomi exposes only disabled and high (enabled) for MiMo 2.5. Since the
+  // product has no separate thinking on/off control, there is no depth ladder
+  // to render here; low/medium/max would merely be compatibility aliases.
+  // Same price as Flash and outclassed by it, so there is no cost argument to
+  // weigh — just a better model. Note this is the limited tier's other pick and
+  // its only natively-multimodal one; steering off it is only reasonable
+  // because Flash reads images through the describe pipeline on every surface
+  // (server/images/describe.ts, server/chat/image-context.ts).
+  supersededBy: {
+    modelId: ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID,
+    notice: FLASH_SUPERSEDES_NOTICE,
+    actionLabel: 'Switch to V4 Flash',
+  },
+} as const satisfies AnvilModelOption
+
+const DEEPSEEK_V4_FLASH_MODEL = {
+  id: ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID,
+  // Dated on purpose: the wire id is undated and auto-updates, so without the
+  // date a returning user sees the same name and assumes the same model. The
+  // 0731 GA build is a different, re-post-trained model.
+  displayName: 'DeepSeek V4 Flash 07/31',
+  // Stepped down from "Smartest & Fastest" when Pro took the recommendation on
+  // 2026-08-12: two rows cannot both claim the top. Flash is still the fastest
+  // thing here and the only unlimited one, which "Smart & Fast" keeps.
+  tagline: 'Smart & Fast',
+  availability: 'always',
+  warning: ANVIL_AI_TRAINING_NOTICE,
+  dataUse: 'training',
+  premium: false,
+  multimodal: false,
+  reasoningEffort: 'high',
+  // The 07/31 build has native low/high/max prompt templates. Medium is not a
+  // distinct level and is intentionally absent.
+  efforts: DEEPSEEK_V4_REASONING_EFFORTS,
+  defaultEffort: 'high',
+  isNew: true,
+} as const satisfies AnvilModelOption
+
+/**
+ * The provisioned extended-context tiers.
+ *
+ * Full rows so the provisioning tooling, the usage ledger and support have a
+ * display name and a data-use classification to read, exactly like every other
+ * model. They are deliberately NOT in ANVIL_MODELS, ANVIL_WEB_MODELS or
+ * any quota list: the tier is granted per account rather than picked, so a
+ * client that rendered one would offer a row most accounts cannot run, and a
+ * quota list would meter a tier whose ceiling is the grant itself.
+ *
+ * Reasoning defaults, pricing and context tracking their base tier is the
+ * point of the suffix — it names the provisioned variant, not a new family.
+ */
+const DEEPSEEK_V4_PRO_MAX_MODEL = {
+  id: ANVIL_DEEPSEEK_V4_PRO_MAX_MODEL_ID,
+  displayName: 'DeepSeek V4 Pro (Max context)',
+  tagline: 'Extended context',
+  availability: 'always',
+  warning: ANVIL_AI_TRAINING_NOTICE,
+  dataUse: 'training',
+  premium: false,
+  multimodal: false,
+  reasoningEffort: 'high',
+  defaultEffort: 'high',
+} as const satisfies AnvilModelOption
+
+const DEEPSEEK_V4_FLASH_MAX_MODEL = {
+  id: ANVIL_DEEPSEEK_V4_FLASH_MAX_MODEL_ID,
+  displayName: 'DeepSeek V4 Flash (Max context)',
+  tagline: 'Extended context',
+  availability: 'always',
+  warning: ANVIL_AI_TRAINING_NOTICE,
+  dataUse: 'training',
+  premium: false,
+  multimodal: false,
+  reasoningEffort: 'high',
+  defaultEffort: 'high',
+} as const satisfies AnvilModelOption
+
+const GPT_5_6_LUNA_MAX_MODEL = {
+  id: ANVIL_GPT_5_6_LUNA_MAX_MODEL_ID,
+  displayName: 'GPT-5.6 Luna (Max context)',
+  tagline: 'Extended context',
+  availability: 'always',
+  dataUse: 'service',
+  premium: true,
+  multimodal: false,
+  reasoningEffort: ANVIL_GPT_5_6_LUNA_REASONING_EFFORT,
+} as const satisfies AnvilModelOption
+
+/**
+ * The provisioned tiers, as rows. Exported for the provisioning tooling and
+ * for support lookups; NOT spread into any catalog, for the reason above.
+ */
+export const ANVIL_PROVISIONED_MODELS = [
+  DEEPSEEK_V4_PRO_MAX_MODEL,
+  DEEPSEEK_V4_FLASH_MAX_MODEL,
+  GPT_5_6_LUNA_MAX_MODEL,
+] as const satisfies readonly AnvilModelOption[]
+
+const MINIMAX_M3_MODEL = {
+  id: ANVIL_MINIMAX_M3_MODEL_ID,
+  displayName: 'MiniMax M3',
+  tagline: 'Fastest',
+  availability: 'always',
+  dataUse: 'service',
+  // M3 is served by Fireworks without provider-side training. Its `service`
+  // data-use classification keeps it out of ANVIL_TRACED_MODEL_IDS.
+  premium: true,
+  multimodal: true,
+  // MiniMax M3 supports adaptive thinking or disabled thinking, but no effort
+  // levels. A depth picker would therefore be cosmetic.
+  // Flash overtook M3 on quality and is free rather than premium-pooled. M3
+  // stays selectable — it is still the no-AI-training pick and natively
+  // multimodal — but the picker says Flash is the better default.
+  supersededBy: {
+    modelId: ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID,
+    notice: FLASH_SUPERSEDES_NOTICE,
+    actionLabel: 'Switch to V4 Flash',
+  },
+} as const satisfies AnvilModelOption
+
+const GPT_5_6_LUNA_MODEL = {
+  id: ANVIL_GPT_5_6_LUNA_MODEL_ID,
+  displayName: 'GPT-5.6 Luna',
+  // Luna is the general-purpose premium option; its row's own badges (Images,
+  // no training notice) distinguish it from the other all-around models.
+  tagline: 'Strong all-around',
+  availability: 'always',
+  // OpenAI's API does not train on request data, and the route carries
+  // data_collection: 'deny', so no AI-training notice and no trace storage
+  // (ANVIL_TRACED_MODEL_IDS keys off this).
+  dataUse: 'service',
+  premium: true,
+  // OpenRouter reports input modalities text + image + file for this model.
+  multimodal: true,
+  reasoningEffort: ANVIL_GPT_5_6_LUNA_REASONING_EFFORT,
+  // OpenRouter's model metadata advertises all five enabled effort levels.
+  efforts: EFFORTS_THROUGH_MAX,
+  defaultEffort: ANVIL_GPT_5_6_LUNA_REASONING_EFFORT,
+  // Luna led the browser surfaces from 2026-08-04 until Pro's 08/13 GA build
+  // took the recommendation on 2026-08-12. It stays fully selectable, and stays
+  // the one premium row with no AI-training notice and native image input —
+  // reasons a user may still deliberately want it — but the picker now says
+  // plainly that Pro is the better default.
+  //
+  // NOT in ANVIL_WEB_DEEMPHASIZED_MODEL_IDS — which is now empty, but Luna
+  // would not qualify anyway: muting is this product's "materially dearer"
+  // signal, and against Pro that does not resolve — Pro is 2.76x cheaper on the cache reads that
+  // dominate agent traffic, and dearer on fresh input and output (full table on
+  // that constant). Steering on quality is honest; implying a settled price
+  // difference in either direction would not be.
+  supersededBy: {
+    modelId: ANVIL_DEEPSEEK_V4_PRO_MODEL_ID,
+    notice: PRO_SUPERSEDES_NOTICE,
+    actionLabel: 'Switch to V4 Pro',
+  },
+} as const satisfies AnvilModelOption
+
+const GLM_V52_MODEL = {
+  id: ANVIL_GLM_V52_MODEL_ID,
+  displayName: 'GLM 5.2',
+  tagline: 'Unlock by referring friends',
+  availability: 'always',
+  dataUse: 'service',
+  // Served by Fireworks without provider-side training; its `service`
+  // data-use classification keeps GLM out of ANVIL_TRACED_MODEL_IDS.
+  // `premium` drives the "Premium" badge styling in the picker; GLM's real
+  // gate is its weekly referral-session pool, not the daily premium pool.
+  premium: true,
+  multimodal: false,
+  // Our CrofAI route accepts but ignores reasoning_effort (including invalid
+  // values), so OpenRouter's GLM ladder does not describe the route users run.
+} as const satisfies AnvilModelOption
+
+/**
+ * Kimi K3 (Eco), CrofAI. God-only, for testing, and the cost is part of why.
+ *
+ * List price per M (CrofAI catalog, read from the live /v1/models endpoint on
+ * 2026-08-07): $1.00 in, $0.10 cache read, $4.00 out. Against DeepSeek V4
+ * Flash's $0.12/$0.21 on the same provider that is ~8x input and ~19x output,
+ * which is the argument for keeping it off the public picker rather than
+ * merely marking it premium.
+ *
+ * `displayName` is 'Kimi K3', NOT 'Kimi K3 Eco', by explicit request. This
+ * breaks the convention DEEPSEEK_V4_FLASH_MODEL sets — name the exact build so
+ * a returning user cannot mistake one for another — and the divergence is
+ * deliberate rather than an oversight, so do not "fix" it: CrofAI also serves a
+ * full `kimi-k3` at twice the price, and this row is the Q2_K-quantized Eco
+ * build (1M context, 131,072 max completion tokens). The wire id keeps `-eco`
+ * so the two builds stay distinguishable everywhere it actually matters —
+ * routing, billing, and the CROF_MODEL_MAP entry. If the full K3 is ever added
+ * as its own row, this label has to be disambiguated at that point.
+ */
+const KIMI_K3_ECO_MODEL = {
+  id: ANVIL_KIMI_K3_ECO_MODEL_ID,
+  displayName: 'Kimi K3',
+  tagline: 'Via CrofAI',
+  availability: 'always',
+  dataUse: 'service',
+  premium: true,
+  multimodal: false,
+  experimental: true,
+  // CrofAI likewise ignores reasoning_effort for this build. Do not expose a
+  // control until this concrete route reports distinct supported levels.
+} as const satisfies AnvilModelOption
+
+const FABLE_5_MODEL = {
+  id: ANVIL_FABLE_5_MODEL_ID,
+  displayName: 'Claude Fable 5',
+  tagline: "Anthropic's most intelligent model",
+  availability: 'always',
+  // Load-bearing, not decoration: `dataUse: 'training'` is what puts this model
+  // in ANVIL_TRACED_MODEL_IDS, which is the entire point of the trial — we
+  // are buying hour-long agent traces with the pool. The warning is the
+  // disclosure that makes that legitimate, and the catalog invariant test
+  // requires the two to agree.
+  warning: ANVIL_AI_TRAINING_NOTICE,
+  dataUse: 'training',
+  // Not in ANVIL_PREMIUM_MODEL_IDS: the daily premium pool is shared across
+  // its models and Fable is metered by its OWN global pool instead (see
+  // ANVIL_LIMITED_OFFER_MODEL_IDS). The flag only marks it as scarce for the
+  // pickers' styling and for ANVIL_WEB_STANDARD_MODEL_IDS, which must not
+  // absorb it.
+  premium: true,
+  multimodal: true,
+  // OpenRouter reports low/medium/high/xhigh/max, with high as the default.
+  efforts: EFFORTS_THROUGH_MAX,
+  defaultEffort: 'high',
+  isNew: true,
+} as const satisfies AnvilModelOption
+
+/**
+ * Meta Muse Spark 1.2 Contributor. Premium on Web, and unusual in WHY: every
+ * other premium row is priced premium, while this one is cheaper per token than
+ * DeepSeek V4 Flash. What is scarce is the 60 RPM team-wide rate limit, so the
+ * daily premium session pool is doing double duty here as a way to bound how
+ * many people are inside that limit at once. See
+ * ANVIL_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID.
+ */
+const MUSE_SPARK_12_CONTRIBUTOR_MODEL = {
+  id: ANVIL_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID,
+  displayName: 'Muse Spark 1.2',
+  // The tagline names the thing that actually differentiates this row for a
+  // user: it is the one model that can make you wait. Context length is not
+  // what they need to know before picking it.
+  tagline: 'Queue',
+  taglineTooltip: MUSE_SPARK_FALLBACK_NOTICE,
+  availability: 'always',
+  // Load-bearing pair (a catalog invariant test enforces it): the Contributor
+  // tier's whole discount is Meta training on prompts and completions.
+  warning: ANVIL_AI_TRAINING_NOTICE,
+  dataUse: 'training',
+  premium: true,
+  multimodal: false,
+  reasoningEffort: ANVIL_MUSE_SPARK_REASONING_EFFORT,
+  efforts: EFFORTS_THROUGH_XHIGH,
+  defaultEffort: ANVIL_MUSE_SPARK_REASONING_EFFORT,
+} as const satisfies AnvilModelOption
+
+export const SUPPORTED_ANVIL_MODELS = [
+  DEEPSEEK_V4_PRO_MODEL,
+  MINIMAX_M3_MODEL,
+  GPT_5_6_LUNA_MODEL,
+  GLM_V52_MODEL,
+  DEEPSEEK_V4_FLASH_MODEL,
+  MIMO_V25_MODEL,
+  FABLE_5_MODEL,
+] as const satisfies readonly AnvilModelOption[]
+
+// GLM 5.2 is intentionally NOT in ANVIL_MODELS: it isn't a freely-pickable
+// grid model, it's a referral reward surfaced by the separate referral banner.
+// It stays in SUPPORTED_ANVIL_MODELS so the session/chat layers accept it as
+// a valid model id once the user's weekly entitlement admits them.
+//
+// MiMo 2.5 Pro is GONE (2026-08-04). It was hidden from the client pickers on
+// 2026-07-31 and kept server-valid for released clients, exactly as Kimi K2.7
+// Code was; this is the second stage of that same retirement. Requests for it
+// now 403 with free_mode_invalid_agent_model. The non-Pro MiMo 2.5 is
+// unaffected, and paid/BYOK MiMo Pro plus its llm-api provider routing are
+// untouched.
+// Order is the order shown in every picker: the recommended default leads, the
+// unlimited fallback it steps down to follows, then the rest of the full-access
+// grid. V4 Pro took the lead on 2026-08-12 (see DEFAULT_ANVIL_MODEL_ID); the
+// previous Flash-first order went stale with that flip.
+export const ANVIL_MODELS = [
+  DEEPSEEK_V4_PRO_MODEL,
+  DEEPSEEK_V4_FLASH_MODEL,
+  GPT_5_6_LUNA_MODEL,
+  MINIMAX_M3_MODEL,
+  ...(ANVIL_ENABLE_MIMO_MODELS_IN_UI ? [MIMO_V25_MODEL] : []),
+] as const satisfies readonly AnvilModelOption[]
+
+export const ANVIL_PREMIUM_MODEL_IDS = [
+  ANVIL_MINIMAX_M3_MODEL_ID,
+  ANVIL_DEEPSEEK_V4_PRO_MODEL_ID,
+  ANVIL_GPT_5_6_LUNA_MODEL_ID,
+] as const
+
+// ---------------------------------------------------------------------------
+// Limited-offer models
+//
+// A model here is NOT in any client's picker catalog. The server counts how
+// many sessions the current wave has left out of one GLOBAL pool and, only
+// while the pool has capacity, tells the client about it in the session
+// response (`limitedModelOffers`). Clients render the extra row from that
+// payload and nothing else — so when the pool is spent, the offer disappears
+// with no client release, and a client that never learned about the offer is
+// byte-identical to what it is today.
+//
+// This exists because these are frontier models we cannot afford to leave
+// standing open, and because the point of running them at all is the traces:
+// they are `dataUse: 'training'`, so every hour-long session lands in
+// chat_completion_traces (ANVIL_TRACED_MODEL_IDS).
+// ---------------------------------------------------------------------------
+
+/** Models offered only while their shared global pool has sessions left. */
+export const ANVIL_LIMITED_OFFER_MODEL_IDS = [
+  ANVIL_FABLE_5_MODEL_ID,
+] as const
+
+export type AnvilLimitedOfferModelId =
+  (typeof ANVIL_LIMITED_OFFER_MODEL_IDS)[number]
+
+/** Suffix-tolerant like the other model predicates, so a dated provider
+ *  snapshot can't dodge the pool accounting. */
+export function isAnvilLimitedOfferModelId(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  return ANVIL_LIMITED_OFFER_MODEL_IDS.some((modelId) =>
+    anvilModelIdMatches(id, modelId),
+  )
+}
+
+/**
+ * Per-user daily ceiling on limited-offer sessions, on top of the global pool.
+ *
+ * One. A 50-session pool spent by five people is five traces of five people's
+ * habits; spent by fifty people it is the distribution we actually want to
+ * learn from. It also bounds what one account can cost us on a frontier model
+ * whose sessions run a full hour.
+ */
+export const ANVIL_LIMITED_OFFER_SESSION_LIMIT = 1
+
+/** Reset cadence for the per-user ceiling above — same Pacific-day boundary as
+ *  every other anvil pool, so a user sees one reset time, not two. */
+export const ANVIL_LIMITED_OFFER_SESSION_PERIOD =
+  ANVIL_PREMIUM_SESSION_PERIOD
+export const ANVIL_LIMITED_OFFER_SESSION_RESET_TIMEZONE =
+  ANVIL_PREMIUM_SESSION_RESET_TIMEZONE
+export const ANVIL_LIMITED_OFFER_SESSION_WINDOW_HOURS =
+  ANVIL_PREMIUM_SESSION_WINDOW_HOURS
+
+/** Anvil Web-only picker/support set: the CLI/Desktop catalog plus the
+ *  earned GLM 5.2 row. */
+export const ANVIL_WEB_MODELS = [
+  MUSE_SPARK_12_CONTRIBUTOR_MODEL,
+  GLM_V52_MODEL,
+  ...ANVIL_MODELS,
+] as const satisfies readonly AnvilModelOption[]
+
+export const ANVIL_WEB_GOD_ONLY_MODELS = [
+  KIMI_K3_ECO_MODEL,
+] as const satisfies readonly AnvilModelOption[]
+
+export const ANVIL_WEB_ALL_MODELS = [
+  ...ANVIL_WEB_GOD_ONLY_MODELS,
+  ...ANVIL_WEB_MODELS,
+] as const satisfies readonly AnvilModelOption[]
+
+export const ANVIL_WEB_GOD_ONLY_MODEL_IDS = [
+  ANVIL_KIMI_K3_ECO_MODEL_ID,
+] as const
+
+/**
+ * Web/Cloud models the picker no longer offers, while the backend keeps
+ * honoring them so a session already running on one finishes normally: the id
+ * stays in ANVIL_WEB_MODELS and in whichever quota list meters it, because
+ * dropping a live session's model from the catalog fails admission mid-run and
+ * dropping it from its quota list alone would leave it metered by NO pool.
+ *
+ * DELIBERATELY EMPTY, and the bar for adding to it is high.
+ *
+ * A picker-only retirement is a UI change, not a gate: the filter runs
+ * client-side, so anything talking to the API directly still reaches the id.
+ * Both former occupants proved it. The CrofAI GLM 5.2 route sat here from
+ * 2026-07-30 and hand-written callers kept admitting free premium-pool GLM
+ * sessions on it for five days. HY3 sat here since the initial web rollout.
+ * Both were deleted outright on 2026-08-04.
+ *
+ * Park a model here ONLY to let genuinely live sessions drain, and only when
+ * the id being reachable in the meantime is harmless — never as the gate
+ * itself, and never for a model that costs real money or is entitlement-earned.
+ * Then finish the removal.
+ */
+export const ANVIL_WEB_RETIRED_PICKER_MODEL_IDS = [] as const
+
+/** Whether the Web/Cloud picker should offer `id` as a new selection. False
+ *  for retired routes (see ANVIL_WEB_RETIRED_PICKER_MODEL_IDS), which the
+ *  backend still serves for sessions already on them. */
+export function isAnvilWebSelectableModelId(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  return !ANVIL_WEB_RETIRED_PICKER_MODEL_IDS.some(
+    (modelId) => modelId === id,
+  )
+}
+
+/** Models metered by the SHARED daily premium pool, which every full-access
+ *  account is granted for free. GLM 5.2 (ANVIL_GLM_V52_MODEL_IDS) is held
+ *  out because its entitlement is earned rather than granted daily — putting
+ *  any GLM route in this list hands the model out for nothing. */
+export const ANVIL_WEB_PREMIUM_MODEL_IDS = [
+  ...ANVIL_PREMIUM_MODEL_IDS,
+  // Metered by the web premium pool like every other god-only row. Being in
+  // SOME pool is the point: ANVIL_WEB_STANDARD_MODEL_IDS is derived by
+  // filtering `!premium`, so a premium model left out of here would be metered
+  // by no pool at all rather than by a stricter one.
+  ANVIL_KIMI_K3_ECO_MODEL_ID,
+  // Not here for cost — Muse Spark Contributor is cheaper per token than the
+  // Standard pool's models. The premium pool is what bounds how many users sit
+  // inside its 60 RPM team-wide ceiling at once, and being in SOME pool is
+  // mandatory: ANVIL_WEB_STANDARD_MODEL_IDS is derived by filtering
+  // `!premium`, so a premium model left out of here is metered by no pool.
+  ANVIL_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID,
+] as const
+
+/** Full-access Web/Cloud models sharing the browser-only standard daily pool. */
+export const ANVIL_WEB_STANDARD_MODEL_IDS = Object.freeze(
+  ANVIL_WEB_ALL_MODELS.filter((model) => !model.premium).map(
+    (model) => model.id,
+  ),
+)
+
+/** Models unlocked by referrals, metered by the daily GLM session pool rather
+ *  than the daily premium pool. Kept separate from ANVIL_PREMIUM_MODEL_IDS
+ *  so GLM never falls into the shared daily premium quota. Since 2026-07-30
+ *  this is the ONLY way to reach GLM 5.2 on any surface. */
+export const ANVIL_GLM_V52_MODEL_IDS = [ANVIL_GLM_V52_MODEL_ID] as const
+
+/** Models that occupy the single per-user "premium-bucket" CONCURRENCY slot in
+ *  Anvil Desktop's multi-session mode: at most one of these may have an
+ *  active session per user at a time, while unlimited-bucket models (DeepSeek V4
+ *  Flash, MiMo 2.5) may run in up to three concurrent tabs. (On the LIMITED
+ *  access tier the admission path puts EVERY model in the slot regardless of
+ *  this list — limited users get one anvil tab at a time; see
+ *  `requestDesktopSession`.)
+ *
+ *  This is strictly a CONCURRENCY bucket, NOT a quota bucket. It is intentionally
+ *  a SUPERSET of ANVIL_PREMIUM_MODEL_IDS: it also includes GLM 5.2, which is
+ *  metered weekly for QUOTA purposes but expensive enough that we cap it to one
+ *  concurrent desktop session. Do NOT use this for the daily premium quota —
+ *  that stays on isAnvilPremiumModelId so GLM never starts burning the
+ *  5/day premium pool. */
+export const ANVIL_DESKTOP_PREMIUM_BUCKET_MODEL_IDS = [
+  ...ANVIL_PREMIUM_MODEL_IDS,
+  ANVIL_GLM_V52_MODEL_ID,
+] as const
+
+/** Concurrent Anvil Desktop sessions per model bucket. Premium is also
+ * enforced by the database's partial unique index; unlimited is enforced by
+ * the desktop soft gate and the chat-completions session gate. */
+export const ANVIL_DESKTOP_SESSION_LIMITS = {
+  premium: 1,
+  unlimited: 3,
+} as const
+export type AnvilDesktopSessionBucket =
+  keyof typeof ANVIL_DESKTOP_SESSION_LIMITS
+
+/** True when a desktop tab running `model` under `accessTier` occupies the
+ *  single per-user concurrency slot. On the full tier that's the premium
+ *  bucket; on the LIMITED tier EVERY model occupies it — limited users get one
+ *  anvil tab at a time. THE shared definition of the one-tab rule: the
+ *  server's admission path and the desktop's picker/soft-gate must both call
+ *  this so the client can't drift from what the server enforces. */
+export function occupiesAnvilDesktopSlot(
+  model: string,
+  accessTier: AnvilAccessTier | null | undefined,
+): boolean {
+  return (
+    accessTier === 'limited' || isAnvilDesktopPremiumBucketModelId(model)
+  )
+}
+
+export function getAnvilDesktopSessionBucket(
+  model: string,
+  accessTier: AnvilAccessTier | null | undefined,
+): AnvilDesktopSessionBucket {
+  return occupiesAnvilDesktopSlot(model, accessTier)
+    ? 'premium'
+    : 'unlimited'
+}
+
+/** Wire headers for the free-mode session endpoints
+ *  (/api/v1/anvil/session). Shared so the server handlers and every client
+ *  (CLI, desktop) agree on the exact strings instead of redefining literals. */
+export const ANVIL_INSTANCE_HEADER = 'x-anvil-instance-id'
+export const ANVIL_MODEL_HEADER = 'x-anvil-model'
+/** Trusted server-to-server header. Only the Anvil API may honor this when
+ *  the request authenticates as the Anvil Web service account; browser and
+ *  normal API callers must not be able to select another user's session row. */
+export const ANVIL_ACTING_USER_HEADER = 'x-anvil-acting-user-id'
+/** Trusted Anvil Web/Cloud session-proxy hint. Keeps the normal CLI GET
+ * response compact while letting the browser model picker request zero-usage
+ * quota snapshots so it can render accurate "N of M sessions" labels. */
+export const ANVIL_INCLUDE_UNUSED_RATE_LIMITS_HEADER =
+  'x-anvil-include-unused-rate-limits'
+/** Set by the CLI on its recurring active-session poll. The response keeps the
+ *  authoritative session state but omits quota snapshots the CLI already has
+ *  and does not need for its countdown. */
+export const ANVIL_COMPACT_SESSION_HEADER = 'x-anvil-compact-session'
+/** Set to '1' by Anvil Desktop to opt into multi-session mode (concurrent
+ *  per-tab sessions); absent for CLI/web, which keep one session per user. */
+export const ANVIL_MULTI_SESSION_HEADER = 'x-anvil-multi-session'
+/** Set to '1' on a per-instance GET /session to mark it as a liveness beat: the
+ *  client is telling the server this tab is still there. Only a beat writes the
+ *  row's `last_seen_at`, and only a row with a `last_seen_at` can give up its
+ *  concurrency slot for going quiet — so a client that never beats keeps the
+ *  `expires_at`-only rule and is never dropped mid-window. */
+export const ANVIL_HEARTBEAT_HEADER = 'x-anvil-heartbeat'
+/** How often a beating client re-beats. The server's liveness TTL is a multiple
+ *  of this (several missed beats), so a brief network blip never costs a live
+ *  tab its slot. */
+export const ANVIL_SESSION_HEARTBEAT_INTERVAL_MS = 45_000
+/** Set on POST /session to the instance id of the single-slot holder the caller
+ *  was just told about, meaning "end that tab's session and give me the slot"
+ *  (Desktop's "Use it here"). Liveness covers a holder that stopped beating, but
+ *  it cannot help when the holder is genuinely alive somewhere the user cannot
+ *  reach — another machine, or a window they have no way to close — so this is
+ *  the escape hatch that does not depend on us having modelled liveness right.
+ *
+ *  It names a holder rather than saying "take whatever is there": the server
+ *  only honors it when it still matches the holder the rejection identified, so
+ *  a click on a stale card can never end a tab the user was never shown. */
+export const ANVIL_TAKEOVER_INSTANCE_HEADER =
+  'x-anvil-takeover-instance-id'
+/** Drain window after a session's `expires_at`: the gate still serves an
+ *  in-flight agent run, but no new prompt should start. Shared because the
+ *  client has to know it too — a tab keeps beating until its row is past this,
+ *  which is what lets the server tell a run that is finishing from a tab that
+ *  died. Server-side accessor: `getSessionGraceMs()`. */
+export const ANVIL_SESSION_GRACE_MS = 30 * 60 * 1000
+
+/** Models that accept image input. Used to decide whether uploaded images are
+ *  forwarded to the model as real multimodal content. */
+export const ANVIL_MULTIMODAL_MODEL_IDS = Object.freeze(
+  SUPPORTED_ANVIL_MODELS.filter((model) => model.multimodal).map(
+    (model) => model.id,
+  ),
+)
+
+export const ANVIL_WEB_MULTIMODAL_MODEL_IDS = Object.freeze(
+  ANVIL_WEB_ALL_MODELS.filter((model) => model.multimodal).map(
+    (model) => model.id,
+  ),
+)
+
+/** Free-mode models whose chat-completion traces we store in our own dataset
+ *  (chat_completion_traces). Derived from machine-readable data-use metadata;
+ *  UI wording can change without changing retention behavior. */
+export const ANVIL_TRACED_MODEL_IDS = SUPPORTED_ANVIL_MODELS.filter(
+  (model: AnvilModelOption) => model.dataUse === 'training',
+).map((model) => model.id)
+
+export type AnvilModelId = (typeof ANVIL_MODELS)[number]['id']
+export type SupportedAnvilModelId =
+  (typeof SUPPORTED_ANVIL_MODELS)[number]['id']
+export type AnvilPremiumModelId = (typeof ANVIL_PREMIUM_MODEL_IDS)[number]
+export type AnvilWebModelId = (typeof ANVIL_WEB_ALL_MODELS)[number]['id']
+export type AnvilWebPremiumModelId =
+  (typeof ANVIL_WEB_PREMIUM_MODEL_IDS)[number]
+
+/** What new anvil users see selected in the CLI and Desktop pickers, and the
+ *  model their "RECOMMENDED" hero opens on. DeepSeek V4 Pro 08/13 as of
+ *  2026-08-12, taking over from DeepSeek V4 Flash, which held it from
+ *  2026-07-31 when the re-post-trained Flash-0731 beat the Pro PREVIEW on agent
+ *  work. The 08/13 GA build reversed that on the benchmarks a coding CLI runs
+ *  (the numbers are on DEEPSEEK_V4_PRO_MODEL), so both surfaces now lead with
+ *  it — as the browser ones already did (DEFAULT_ANVIL_WEB_MODEL_ID).
+ *
+ *  It is PREMIUM, which the Flash default was not, so it draws on the shared
+ *  daily pool and that pool CAN run dry. Surfaces that know the live quota must
+ *  step down to FALLBACK_ANVIL_MODEL_ID once it is spent —
+ *  getRecommendedAnvilModelId does that for the picker hero, Desktop's
+ *  availableAnvilDefault for an unpicked tab — or the default becomes a
+ *  model whose next send fails admission. Both kept that machinery from the
+ *  pre-2026-07-31 premium default, so this is a flip, not new plumbing.
+ *
+ *  Still three separate constants: this one, DEFAULT_ANVIL_WEB_MODEL_ID and
+ *  FALLBACK_ANVIL_MODEL_ID (what callers needing a guaranteed-available id
+ *  for resolution / auto-fallbacks should use). The first two name the same
+ *  model today and have diverged before; the third is now genuinely a different
+ *  model rather than the same one under two names.
+ *
+ *  It carries the AI-training notice like the Flash default did, so pickers
+ *  using it must render the model's `warning`. */
+export const DEFAULT_ANVIL_MODEL_ID: AnvilModelId =
+  ANVIL_DEEPSEEK_V4_PRO_MODEL_ID
+
+/** What new Anvil Web/Cloud users see selected in the browser pickers, and
+ *  the model a new Cloud thread starts on. DeepSeek V4 Pro 08/13 as of
+ *  2026-08-12, taking over from GPT-5.6 Luna (which held it from 2026-08-04).
+ *
+ *  A browser build is the workload where model quality shows up most — it is
+ *  one long agentic run against a live sandbox, and a wrong turn early costs
+ *  the whole first project, which 51% of Web users never come back from. The
+ *  Pro 08/13 GA build is the strongest agentic model in this catalog, which is
+ *  what that workload is, so it leads the browser surfaces and Luna carries a
+ *  switch-to-Pro notice (see GPT_5_6_LUNA_MODEL.supersededBy).
+ *
+ *  ONE KNOWN COST OF THIS CHOICE, deliberate rather than overlooked: Pro is
+ *  `dataUse: 'training'` while Luna was `service`, so the model a brand-new user
+ *  lands on now DOES carry the AI-training notice. Every picker already renders
+ *  `warning` for the default, so it is disclosed — but it is a real change to
+ *  what a first-time user sees.
+ *
+ *  Spend is NOT among the costs, which is why this is not the extravagant choice
+ *  it looks like next to Luna's headline $0.10 input: browser turns re-send their
+ *  whole prefix every step, so cache reads are ~98% of the tokens, and Pro reads
+ *  cache at $0.003625/M against Luna's $0.010/M. See
+ *  ANVIL_WEB_DEEMPHASIZED_MODEL_IDS for the full table and where the
+ *  break-even sits. Either way the daily premium pool is counted in SESSIONS, so
+ *  nobody's quota moves.
+ *
+ *  It is premium, so it draws on the shared daily pool. Surfaces that know the
+ *  live quota must step down to FALLBACK_ANVIL_MODEL_ID once that pool is
+ *  spent (getRecommendedAnvilWebModelId does this for the hero picker, and
+ *  the model selector coerces a spent default) — otherwise the default becomes
+ *  a model whose next send fails admission.
+ *
+ *  Kept as its own constant from DEFAULT_ANVIL_MODEL_ID (CLI/Desktop) so the
+ *  browser surfaces can steer independently. They name the same model as of
+ *  2026-08-12, and diverged as recently as 2026-08-04 → 2026-08-12 (Flash on
+ *  the CLI, Luna in the browser). */
+export const DEFAULT_ANVIL_WEB_MODEL_ID: AnvilWebModelId =
+  ANVIL_DEEPSEEK_V4_PRO_MODEL_ID
+
+/** Premium models the Web/Cloud picker renders small and muted: they are
+ *  materially more expensive per token than the recommended default without
+ *  being materially better for the browser surfaces' workloads. They stay
+ *  fully selectable — this only controls emphasis and ordering (they sort last
+ *  within the Premium group).
+ *
+ *  This tracks the models Flash superseded — costing more per token AND having
+ *  lost the quality argument — so muting them is what steers new picks to Flash.
+ *  Both halves of that test have to hold: DeepSeek V4 Pro left this list on
+ *  2026-08-12 because its 08/13 GA build wins the quality half again.
+ *
+ *  EMPTY as of 2026-08-12. MiniMax M3 was the last entry, and with Pro gone it
+ *  was the only muted row in a list of full-size ones — the compact treatment
+ *  folds the tagline up onto the name line, which next to four two-line rows
+ *  read as a broken row rather than as a de-emphasized one. M3 keeps its
+ *  supersededBy notice, which is the steering that was doing the real work.
+ *  Muting only pays for itself on a group of rows, so add entries back in
+ *  pairs or not at all.
+ *
+ *  GPT-5.6 Luna is superseded (by Pro) and deliberately NOT muted, because the
+ *  cost half genuinely does not resolve. Per M, read off OpenRouter 2026-08-12:
+ *
+ *                fresh input   cache read   output
+ *    V4 Pro         $0.435      $0.003625   $0.870
+ *    Luna           $0.100      $0.010      $0.600
+ *
+ *  Pro is 2.76x CHEAPER on cache reads — the term that dominates an agent
+ *  workload, where re-sent prefixes are ~98% of tokens — while being 4.35x
+ *  dearer on fresh input and 1.45x dearer on output. Break-even on the input
+ *  term alone is a ~98.1% cache-hit rate, so which model is cheaper depends on
+ *  the hit rate and on how output-heavy the traffic is. "Materially more
+ *  expensive" is a claim neither row can carry, and muting is reserved for rows
+ *  that clearly can. */
+export const ANVIL_WEB_DEEMPHASIZED_MODEL_IDS: readonly AnvilModelId[] =
+  []
+
+export function isAnvilWebDeemphasizedModelId(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  return ANVIL_WEB_DEEMPHASIZED_MODEL_IDS.some((modelId) =>
+    anvilModelIdMatches(id, modelId),
+  )
+}
+
+/** Always-available fallback used when the requested model can't be served
+ *  right now (unknown id, deployment hours closed, etc.). Kept distinct from
+ *  DEFAULT_ANVIL_MODEL_ID so a new user's "preferred default" can be the
+ *  smartest model without auto-flipping anyone to a closed serverless model. */
+export const FALLBACK_ANVIL_MODEL_ID: AnvilModelId =
+  ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID
+
+export const LIMITED_ANVIL_MODEL_ID: AnvilModelId =
+  ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID
+export const LIMITED_ANVIL_MODEL_IDS = [
+  ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID,
+  ANVIL_MIMO_V25_MODEL_ID,
+] as const
+export const LIMITED_ANVIL_MODELS = LIMITED_ANVIL_MODEL_IDS.map(
+  (modelId) => SUPPORTED_ANVIL_MODELS.find((model) => model.id === modelId)!,
+)
+
+export type AnvilAccessTier = 'full' | 'limited'
+
+/** Access tier carried in the Anvil Web Convex JWT. Extends the CLI tier
+ *  with 'blocked' (Tor / corroborated anonymous network): the app still
+ *  loads, but every agent send is rejected server-side. */
+export type AnvilWebAccessTier = AnvilAccessTier | 'blocked'
+
+/** How many of a user's projects may have an agent RUNNING at the same time on
+ *  Anvil Web/Cloud. Past the cap the take-over prompt appears, and taking
+ *  over stops only the longest-idle run.
+ *
+ *  STILL 1 — and raising it is a one-line change here ONLY once Anvil Web is
+ *  on the per-tab (multi-session) free-session store. On the single-session
+ *  store the web surface uses today, `admitOrTakeOver` rotates
+ *  `active_instance_id` on EVERY `requestSession`, including a same-model live
+ *  reclaim (web/src/server/free-session/store.ts). So the moment a second
+ *  project admitted its session, the first project's in-flight turn would fail
+ *  its next completions call with `session_superseded` — concurrency that
+ *  silently kills the run the user is watching. Desktop already runs concurrent
+ *  per-tab sessions via `requestSession({ multiSession, instanceId })`; wiring
+ *  Web to the same path (session request header + `anvil_multi_session` in
+ *  the runner's `anvil_metadata`) is what unblocks 2.
+ *
+ *  Everything else is already cap-agnostic: rows are per (user, project) and
+ *  only `agent_running` ones count, so opening or reading a second project is
+ *  free at any cap — that part shipped 2026-08-12. */
+export const ANVIL_MAX_CONCURRENT_PROJECTS = 1
+
+/** Abuse backstop on project creation for outer-region (limited-tier) Anvil
+ *  Web users. A project the user still has consumes one slot — creations that
+ *  failed and were rolled back do not, so a bad creation never costs quota.
+ *  The quota resets at midnight Pacific time.
+ *
+ *  This was 3 until 2026-08-12, which real users hit on their first session:
+ *  every rung of the creation ladder (warm pool → cold Daytona → browser
+ *  runtime) mints its own project row, so a couple of failed first builds
+ *  locked someone out for the day with nothing to show for it. 10 is high
+ *  enough that only automation reaches it. */
+export const ANVIL_WEB_LIMITED_PROJECT_DAILY_LIMIT = 10
+
+/** Per-day cap on blank ("plan a custom stack") Cloud projects, which unlike
+ *  connect-repo need no GitHub App install and each boot a full-size VM. Same
+ *  backstop role — and the same rollback exemption — as the web limit above.
+ *  Resets at midnight Pacific time. */
+export const ANVIL_CLOUD_BLANK_PROJECT_DAILY_LIMIT = 10
+
+/** Per-project ceiling on custom-stack planner turns.
+ *
+ * The planner is a free premium-model chat that never touches a sandbox, so
+ * without a ceiling one blank project is an unbounded free MiniMax M3
+ * conversation — the cheapest abuse route into the premium pool, since it skips
+ * the VM work every other free surface pays for.
+ *
+ * Sized well above honest use: the prompt caps discovery at two question
+ * rounds, so a real conversation is a seed turn, two answers, and a few stack
+ * revisions. Hitting this means the plan is not converging.
+ *
+ * Only planning turns count. "Start building" is a separate mutation, so a user
+ * who exhausts the cap with a finished plan can still build — they just cannot
+ * keep chatting. */
+export const ANVIL_CLOUD_PLANNER_TURN_LIMIT = 12
+
+/** Models available to limited-region Anvil Web users. They share the
+ * limited-region session pool; every other model remains geo-gated. */
+export const ANVIL_WEB_GEO_EXEMPT_MODEL_IDS = [
+  ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID,
+  ANVIL_MIMO_V25_MODEL_ID,
+] as const
+
+export function isAnvilWebGeoExemptModelId(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  return ANVIL_WEB_GEO_EXEMPT_MODEL_IDS.some((modelId) => modelId === id)
+}
+
+/** Models a limited-tier Anvil Web user may select. */
+export const ANVIL_WEB_LIMITED_MODEL_IDS = [
+  ...new Set<string>([
+    ...ANVIL_WEB_GEO_EXEMPT_MODEL_IDS,
+    ...LIMITED_ANVIL_MODEL_IDS,
+  ]),
+]
+
+export function isAnvilWebModelAllowedForLimitedTier(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  // GLM 5.2 is selectable from a limited region when the user holds a bounty
+  // grant — the entitlement gate is the GLM quota pool, not this allowlist
+  // (see isGlmRedeemableAtLimitedTier). Without this the Web picker coerced a
+  // GLM pick straight back to the flash model, so a bounty reward earned in a
+  // limited region was unspendable no matter what the server allowed.
+  return (
+    isGlmRedeemableAtLimitedTier(id) ||
+    ANVIL_WEB_LIMITED_MODEL_IDS.some((modelId) => modelId === id)
+  )
+}
+
+/** Coerce a limited-tier Anvil Web selection (premium ids, stale
+ * localStorage values) to the allowed default (DeepSeek V4 Flash). */
+export function resolveAnvilWebModelForLimitedTier(
+  id: string | null | undefined,
+): string {
+  return isAnvilWebModelAllowedForLimitedTier(id)
+    ? (id as string)
+    : LIMITED_ANVIL_MODEL_ID
+}
+
+export function getAnvilModelsForAccessTier(
+  accessTier: AnvilAccessTier | null | undefined,
+): readonly AnvilModelOption[] {
+  if (accessTier === 'limited') return LIMITED_ANVIL_MODELS
+  return ANVIL_MODELS
+}
+
+/** The model the CLI/Desktop picker highlights as the "recommended" hero so a
+ *  new user can start with one Enter press without scanning the full list. Full
+ *  access → DEFAULT_ANVIL_MODEL_ID (DeepSeek V4 Pro 08/13 — the strongest
+ *  agentic model in the catalog); limited → the always-available flash model.
+ *
+ *  Pro is premium, so ALWAYS pass `premiumExhausted` from the live quota
+ *  snapshot: the hero flips to the unlimited DeepSeek Flash once the daily pool
+ *  runs out, because the recommended pick has to stay joinable. A caller that
+ *  omits it will offer a hero whose next send fails admission. */
+export function getRecommendedAnvilModelId(
+  accessTier: AnvilAccessTier | null | undefined,
+  options: { premiumExhausted?: boolean } = {},
+): SupportedAnvilModelId {
+  if (accessTier === 'limited') return LIMITED_ANVIL_MODEL_ID
+  if (options.premiumExhausted) return FALLBACK_ANVIL_MODEL_ID
+  return DEFAULT_ANVIL_MODEL_ID
+}
+
+/** The Web/Cloud counterpart of getRecommendedAnvilModelId: full access →
+ *  DEFAULT_ANVIL_WEB_MODEL_ID (GPT-5.6 Luna); limited → the
+ *  always-available flash model. `premiumExhausted` flips the hero to the
+ *  unlimited flash model so the recommended pick is always joinable. */
+export function getRecommendedAnvilWebModelId(
+  accessTier: AnvilAccessTier | null | undefined,
+  options: { premiumExhausted?: boolean } = {},
+): AnvilWebModelId {
+  if (accessTier === 'limited') return LIMITED_ANVIL_MODEL_ID
+  if (options.premiumExhausted) return FALLBACK_ANVIL_MODEL_ID
+  return DEFAULT_ANVIL_WEB_MODEL_ID
+}
+
+/**
+ * GLM 5.2 is reachable from limited access, but only against a bounty-earned
+ * grant.
+ *
+ * The tier gate used to live here, in the model allowlist: a limited-tier
+ * (VPN / unsupported-country) user could not name GLM at all. Bounties pay a
+ * GLM session that is meant to be worth the same in every region, so the gate
+ * moved DOWN into the quota pool — at limited tier the GLM pool counts only
+ * grants minted `redeemable_at_limited_tier` (bounty payouts), and nothing
+ * else. Referral GLM entitlement still counts for nothing there, which is the
+ * anti-farming stance docs/referrals.md describes.
+ *
+ * The practical effect of allowing it here is that a limited user with no
+ * bounty grant gets `rate_limited` (limit 0) instead of `session_model_
+ * mismatch`. Clients only surface GLM to them once the server reports a
+ * balance, so that path is not a normal one to hit.
+ */
+export function isGlmRedeemableAtLimitedTier(
+  model: string | null | undefined,
+): boolean {
+  return ANVIL_GLM_V52_MODEL_IDS.some((modelId) => modelId === model)
+}
+
+export function isAnvilModelAllowedForAccessTier(
+  model: string | null | undefined,
+  accessTier: AnvilAccessTier | null | undefined,
+): boolean {
+  if (!model) return false
+  if (accessTier !== 'limited') return isAnvilModelId(model)
+  return (
+    isGlmRedeemableAtLimitedTier(model) ||
+    LIMITED_ANVIL_MODEL_IDS.some((modelId) => modelId === model)
+  )
+}
+
+/** Session admission is shared by CLI/Desktop/Web/Cloud. Client pickers use
+ *  ANVIL_MODELS or ANVIL_WEB_MODELS, while the server accepts their union
+ *  with temporarily retired models from SUPPORTED_ANVIL_MODELS. */
+export function isAnvilSessionModelId(
+  id: string | null | undefined,
+): id is SupportedAnvilModelId | AnvilWebModelId {
+  return (
+    isSupportedAnvilModelId(id) ||
+    isAnvilWebModelId(id, {
+      includeGodOnly: true,
+    })
+  )
+}
+
+export function isAnvilSessionModelAllowedForAccessTier(
+  model: string | null | undefined,
+  accessTier: AnvilAccessTier | null | undefined,
+): boolean {
+  if (!model) return false
+  if (accessTier !== 'limited') return isAnvilSessionModelId(model)
+  // See isGlmRedeemableAtLimitedTier: GLM's limited-tier gate is the quota
+  // pool (bounty grants only), not this allowlist.
+  return (
+    isGlmRedeemableAtLimitedTier(model) ||
+    LIMITED_ANVIL_MODEL_IDS.some((modelId) => modelId === model)
+  )
+}
+
+export function isAnvilModelId(
+  id: string | null | undefined,
+): id is AnvilModelId {
+  if (!id) return false
+  return ANVIL_MODELS.some((m) => m.id === id)
+}
+
+export function isAnvilWebModelId(
+  id: string | null | undefined,
+  options: { includeGodOnly?: boolean } = {},
+): id is AnvilWebModelId {
+  if (!id) return false
+  const models = options.includeGodOnly
+    ? ANVIL_WEB_ALL_MODELS
+    : ANVIL_WEB_MODELS
+  return models.some((m) => m.id === id)
+}
+
+export function isAnvilWebGodOnlyModelId(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  return ANVIL_WEB_GOD_ONLY_MODEL_IDS.some((modelId) => modelId === id)
+}
+
+export function resolveAnvilModel(
+  id: string | null | undefined,
+): AnvilModelId {
+  return isAnvilModelId(id) ? id : FALLBACK_ANVIL_MODEL_ID
+}
+
+export function resolveAnvilWebModel(
+  id: string | null | undefined,
+  options: { includeGodOnly?: boolean } = {},
+): AnvilWebModelId {
+  return isAnvilWebModelId(id, options)
+    ? id
+    : (FALLBACK_ANVIL_MODEL_ID as AnvilWebModelId)
+}
+
+/** Resolve an explicit CLI selection for an access tier. The ordinary picker
+ * uses `ANVIL_MODELS`; full-access users can also select referral-only GLM
+ * through its separate banner action, or a limited-offer model the server told
+ * them about this launch. Both live outside `ANVIL_MODELS`, so without these
+ * passes an explicit pick of either would be silently rewritten to the fallback
+ * model — the user would press Enter on Fable and land on DeepSeek. */
+export function resolveAnvilModelForAccessTier(
+  id: string | null | undefined,
+  accessTier: AnvilAccessTier | null | undefined,
+):
+  | AnvilModelId
+  | typeof ANVIL_GLM_V52_MODEL_ID
+  | AnvilLimitedOfferModelId {
+  if (accessTier === 'limited') {
+    // GLM survives the coercion at limited tier so a bounty-earned session is
+    // launchable from any region; the pool decides whether it is joinable.
+    if (id === ANVIL_GLM_V52_MODEL_ID) return id
+    return isAnvilModelAllowedForAccessTier(id, accessTier)
+      ? (id as AnvilModelId)
+      : LIMITED_ANVIL_MODEL_ID
+  }
+  if (id === ANVIL_GLM_V52_MODEL_ID) return id
+  const limitedOffer = ANVIL_LIMITED_OFFER_MODEL_IDS.find(
+    (modelId) => modelId === id,
+  )
+  if (limitedOffer) return limitedOffer
+  return resolveAnvilModel(id)
+}
+
+export function resolveAnvilSessionModelForAccessTier(
+  id: string | null | undefined,
+  accessTier: AnvilAccessTier | null | undefined,
+  options: { includeGodOnly?: boolean } = {},
+): SupportedAnvilModelId | AnvilWebModelId {
+  if (accessTier === 'limited') {
+    return isAnvilSessionModelAllowedForAccessTier(id, accessTier)
+      ? (id as SupportedAnvilModelId)
+      : LIMITED_ANVIL_MODEL_ID
+  }
+  if (isSupportedAnvilModelId(id)) return id
+  return resolveAnvilWebModel(id, {
+    includeGodOnly: options.includeGodOnly ?? true,
+  })
+}
+
+export function isSupportedAnvilModelId(
+  id: string | null | undefined,
+): id is SupportedAnvilModelId {
+  if (!id) return false
+  return SUPPORTED_ANVIL_MODELS.some((m) => m.id === id)
+}
+
+/**
+ * Match a model id against a base id, tolerating the dated provider snapshot
+ * suffix OpenRouter (and our own routing) appends, e.g.
+ * `google/gemini-3.1-pro-preview-20260219` for base `google/gemini-3.1-pro-preview`.
+ * Mirrors the suffix logic in `isFreeModeAllowedAgentModel` (free-agents.ts) —
+ * the two MUST stay in sync. Only a `-YYYYMMDD`-style suffix matches, so e.g.
+ * `mimo-v2.5-pro` never matches the base `mimo-v2.5`.
+ */
+export function anvilModelIdMatches(
+  candidate: string | null | undefined,
+  baseId: string,
+): boolean {
+  if (!candidate) return false
+  if (candidate === baseId) return true
+  const prefix = baseId + '-'
+  if (!candidate.startsWith(prefix)) return false
+  return /^\d{6,8}(?:$|[-:])/.test(candidate.slice(prefix.length))
+}
+
+/** Whether the requested model is Gemini Pro, tolerating the dated snapshot
+ *  suffix. Use this instead of `=== ANVIL_GEMINI_PRO_MODEL_ID` so a caller
+ *  can't dodge a Gemini gate by sending the dated id. */
+export function isAnvilGeminiProModelId(
+  id: string | null | undefined,
+): boolean {
+  return anvilModelIdMatches(id, ANVIL_GEMINI_PRO_MODEL_ID)
+}
+
+export function isAnvilPremiumModelId(
+  id: string | null | undefined,
+): id is AnvilPremiumModelId {
+  if (!id) return false
+  // Suffix-tolerant: a dated variant of a premium id (e.g. a dated Kimi) must
+  // still count as premium so it can't dodge the premium daily rate cap.
+  return ANVIL_PREMIUM_MODEL_IDS.some((modelId) =>
+    anvilModelIdMatches(id, modelId),
+  )
+}
+
+export function isAnvilWebPremiumModelId(
+  id: string | null | undefined,
+): id is AnvilWebPremiumModelId {
+  if (!id) return false
+  return ANVIL_WEB_PREMIUM_MODEL_IDS.some((modelId) =>
+    anvilModelIdMatches(id, modelId),
+  )
+}
+
+/** True for the Muse Spark wire id. Suffix-tolerant like the other model
+ *  predicates so a dated provider snapshot can't slip past the rate-limit queue
+ *  that keys off it (see docs/anvil-muse-spark.md). */
+export function isMuseSparkModelId(id: string | null | undefined): boolean {
+  if (!id) return false
+  return anvilModelIdMatches(id, ANVIL_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID)
+}
+
+export function isAnvilSessionPremiumModelId(
+  id: string | null | undefined,
+): boolean {
+  return isAnvilWebPremiumModelId(id)
+}
+
+/** Whether `model` occupies the one-per-user Anvil Desktop premium
+ *  CONCURRENCY slot (premium models + GLM 5.2). Suffix-tolerant
+ *  (dated snapshots) like the other model predicates so a dated variant can't
+ *  dodge the cap. Distinct from isAnvilPremiumModelId, which gates the daily
+ *  premium QUOTA and must NOT include GLM. */
+export function isAnvilDesktopPremiumBucketModelId(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  return ANVIL_DESKTOP_PREMIUM_BUCKET_MODEL_IDS.some((modelId) =>
+    anvilModelIdMatches(id, modelId),
+  )
+}
+
+/** Whether the requested model is the GLM 5.2 referral reward, tolerating the
+ *  dated snapshot suffix. GLM is metered by the weekly referral-session pool
+ *  rather than the daily premium pool, so callers branch on this before the
+ *  premium check. */
+export function isAnvilGlmV52ModelId(
+  id: string | null | undefined,
+): boolean {
+  return ANVIL_GLM_V52_MODEL_IDS.some((modelId) =>
+    anvilModelIdMatches(id, modelId),
+  )
+}
+
+/** Whether the requested model is GPT-5.6 Luna, tolerating the dated snapshot
+ *  suffix. Used by the OpenRouter layer to apply Luna's pinned routing and
+ *  reasoning effort, so a dated variant can't dodge either. */
+export function isAnvilGpt56LunaModelId(
+  id: string | null | undefined,
+): boolean {
+  return anvilModelIdMatches(id, ANVIL_GPT_5_6_LUNA_MODEL_ID)
+}
+
+/** The catalog's reasoning effort for the requested model, tolerating dated
+ *  snapshot suffixes like every other id helper. Null for models that carry
+ *  none — see AnvilModelOption.reasoningEffort. */
+/** The catalog row for any surface's id, or undefined. Both catalogs, for the
+ *  same reason getAnvilModelReasoningEffort reads both: a Web-only model is
+ *  absent from SUPPORTED_ANVIL_MODELS by design. */
+function findAnvilModelOption(
+  id: string | null | undefined,
+): AnvilModelOption | undefined {
+  return (
+    SUPPORTED_ANVIL_MODELS.find((m) => anvilModelIdMatches(id, m.id)) ??
+    ANVIL_WEB_ALL_MODELS.find((m) => anvilModelIdMatches(id, m.id))
+  )
+}
+
+/** The ladder a user may pick from for this model, or null when it offers no
+ *  choice — which is every model that has not opted in. */
+export function getAnvilModelEfforts(
+  id: string | null | undefined,
+): readonly ReasoningEffort[] | null {
+  const efforts = findAnvilModelOption(id)?.efforts
+  return efforts && efforts.length > 0 ? efforts : null
+}
+
+/** Where this model's ladder starts before a user touches it. */
+export function getAnvilModelDefaultEffort(
+  id: string | null | undefined,
+): ReasoningEffort | null {
+  const entry = findAnvilModelOption(id)
+  if (!entry?.efforts?.length) return null
+  return entry.defaultEffort ?? entry.efforts[entry.efforts.length - 1]!
+}
+
+/**
+ * THE authority on what effort a request runs at. Everything a client sends is
+ * a request, never a command.
+ *
+ * Keyed on the model the request will ACTUALLY run — not the one the user
+ * picked. Those differ more often than they look: a limited-tier user's premium
+ * pick is coerced (resolveAnvilSessionModelForAccessTier), the cloud build
+ * path rewrites it, and a Muse Spark turn can be rerouted to Luna mid-flight.
+ * Clamping against the requested model would then let one model's rung reach
+ * another's API — `xhigh` landing on DeepSeek maps to `max`, the most expensive
+ * rung there is, from a user who never asked for it.
+ *
+ * Clamp-DOWN (see clampReasoningEffort): a rung above the ceiling becomes the
+ * ceiling rather than snapping back to the default, so a rerouted user keeps
+ * the closest thing to what they chose. Models with no ladder return null and
+ * keep whatever `reasoningEffort` already says.
+ */
+export function resolveAnvilReasoningEffort(
+  modelId: string | null | undefined,
+  requested: unknown,
+): ReasoningEffort | null {
+  const efforts = getAnvilModelEfforts(modelId)
+  if (!efforts) return null
+  const fallback = getAnvilModelDefaultEffort(modelId)
+  if (!fallback) return null
+  // Medium was briefly offered for Flash before the 07/31 capability matrix was
+  // corrected, and reaches these models from persisted Desktop/Web preferences
+  // and from threads that switched model. DeepSeek maps that compatibility
+  // spelling to high (medium→high in its own effort table), so honor that rather
+  // than letting generic clamp-down turn a stale value into LOW while the UI
+  // displays high.
+  //
+  // Applies to Pro as well as Flash since Pro's 08/13 ladder gained `low`:
+  // before that, "everything on offer is above medium" already landed Pro's
+  // medium on high, and losing that to the clamp would be a silent downgrade of
+  // exactly the model users pick for deliberation.
+  if (
+    requested === 'medium' &&
+    (anvilModelIdMatches(modelId, ANVIL_DEEPSEEK_V4_FLASH_MODEL_ID) ||
+      anvilModelIdMatches(modelId, ANVIL_DEEPSEEK_V4_PRO_MODEL_ID))
+  ) {
+    return 'high'
+  }
+  return clampReasoningEffort(requested, efforts, fallback)
+}
+
+export function getAnvilModelReasoningEffort(
+  id: string | null | undefined,
+): NonNullable<AnvilModelOption['reasoningEffort']> | null {
+  // BOTH catalogs, and the Web one is not optional. This used to read
+  // SUPPORTED_ANVIL_MODELS alone — the CLI/Desktop catalog — which silently
+  // excluded every Web-only model. Muse Spark is deliberately absent from that
+  // list (its absence IS the Desktop gate), so setting `reasoningEffort` on its
+  // row did nothing at all and gave no hint why: the field was present, the
+  // lookup simply could not see the row. Any future Web-only model would have
+  // hit the same wall.
+  const entry: AnvilModelOption | undefined =
+    SUPPORTED_ANVIL_MODELS.find((m) => anvilModelIdMatches(id, m.id)) ??
+    ANVIL_WEB_ALL_MODELS.find((m) => anvilModelIdMatches(id, m.id))
+  return entry?.reasoningEffort ?? null
+}
+
+/**
+ * Whether a Web/Cloud selection may be REMEMBERED as the user's default model.
+ *
+ * GLM 5.2 is excluded. GLM is a scarce, hand-metered pick that a user runs out
+ * of far sooner than the rest of the picker, so pinning it as the remembered
+ * default strands them on a model they cannot start: the next new thread, a
+ * different app, or a plain page reload would open on GLM and fail admission.
+ * Picking GLM applies to the surface in front of you; anything that starts
+ * fresh falls back to DEFAULT_ANVIL_WEB_MODEL_ID.
+ *
+ * Every localStorage read AND write of the remembered model must go through
+ * this (via resolveRememberedAnvilWebModel), so a value saved before this
+ * rule existed self-heals on the next load instead of persisting forever.
+ */
+export function isAnvilWebRememberableModelId(
+  id: string | null | undefined,
+): boolean {
+  return !isAnvilGlmV52ModelId(id)
+}
+
+/**
+ * The model a surface should START on, given a remembered (localStorage)
+ * selection: the saved model when it is still valid and rememberable, else
+ * DEFAULT_ANVIL_WEB_MODEL_ID.
+ *
+ * Distinct from resolveAnvilWebModel, which resolves a LIVE selection and
+ * must leave a just-picked GLM alone.
+ */
+export function resolveRememberedAnvilWebModel(
+  id: string | null | undefined,
+  options: { includeGodOnly?: boolean } = {},
+): AnvilWebModelId {
+  const resolved = resolveAnvilWebModel(id, options)
+  return isAnvilWebRememberableModelId(resolved)
+    ? resolved
+    : DEFAULT_ANVIL_WEB_MODEL_ID
+}
+
+export function isAnvilMultimodalModelId(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  return ANVIL_MULTIMODAL_MODEL_IDS.some((modelId) => modelId === id)
+}
+
+/**
+ * Return whether a model used by a Anvil surface accepts image input.
+ * Unknown models return undefined so the provider backend does not strip
+ * images from newly added or paid models until their capability is known.
+ */
+export function getAnvilModelImageSupport(
+  id: string | null | undefined,
+): boolean | undefined {
+  if (!id) return undefined
+
+  // Keep the retired chat wire id text-only during a staggered deployment.
+  // It now routes to DeepSeek direct, but has no catalog option of its own.
+  if (
+    anvilModelIdMatches(id, ANVIL_DEEPSEEK_V4_FLASH_FIREWORKS_MODEL_ID)
+  ) {
+    return false
+  }
+
+  const model =
+    SUPPORTED_ANVIL_MODELS.find((option) =>
+      anvilModelIdMatches(id, option.id),
+    ) ??
+    ANVIL_WEB_ALL_MODELS.find((option) =>
+      anvilModelIdMatches(id, option.id),
+    )
+  return model?.multimodal
+}
+
+export function isAnvilWebMultimodalModelId(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  return ANVIL_WEB_MULTIMODAL_MODEL_IDS.some((modelId) => modelId === id)
+}
+
+/** Whether we store our own chat-completion traces for this free-mode model.
+ *  See ANVIL_TRACED_MODEL_IDS. */
+export function isAnvilTracedModelId(
+  id: string | null | undefined,
+): boolean {
+  if (!id) return false
+  return ANVIL_TRACED_MODEL_IDS.some((modelId) => modelId === id)
+}
+
+export function resolveSupportedAnvilModel(
+  id: string | null | undefined,
+): SupportedAnvilModelId {
+  return isSupportedAnvilModelId(id) ? id : FALLBACK_ANVIL_MODEL_ID
+}
+
+export function getAnvilModel(id: string): AnvilModelOption {
+  return (
+    SUPPORTED_ANVIL_MODELS.find((m) => m.id === id) ??
+    ANVIL_MODELS.find((m) => m.id === FALLBACK_ANVIL_MODEL_ID)!
+  )
+}
+
+export function getAnvilWebModel(id: string): AnvilModelOption {
+  return (
+    ANVIL_WEB_ALL_MODELS.find((m) => m.id === id) ??
+    ANVIL_WEB_ALL_MODELS.find((m) => m.id === FALLBACK_ANVIL_MODEL_ID)!
+  )
+}
+
+/** The "a better model exists" notice for `id`, or undefined when the model is
+ *  current. Returns nothing when the replacement is not itself selectable on
+ *  this surface, so a picker never offers a switch to a model it cannot show. */
+export function getAnvilModelSupersededBy(
+  id: string | null | undefined,
+  selectableModelIds: readonly string[],
+): AnvilModelOption['supersededBy'] | undefined {
+  if (!id) return undefined
+  const catalog: readonly AnvilModelOption[] = [
+    ...SUPPORTED_ANVIL_MODELS,
+    ...ANVIL_WEB_ALL_MODELS,
+  ]
+  const supersededBy = catalog.find(
+    (candidate) => candidate.id === id,
+  )?.supersededBy
+  if (!supersededBy) return undefined
+  return selectableModelIds.includes(supersededBy.modelId)
+    ? supersededBy
+    : undefined
+}
+
+/**
+ * The model a saved preference should be steered to, or null to keep it.
+ *
+ * Applied EVERY time a surface reads its remembered pick, so each new
+ * thread/session/launch starts on the replacement. A superseded model stays
+ * fully selectable — picking one mid-thread works and sticks for that thread —
+ * but it never becomes the model a fresh surface opens on again.
+ *
+ * This is deliberately aggressive: a saved preference outranks a changed
+ * default forever otherwise, which is exactly how users kept landing back on
+ * models we no longer recommend. The cost is that a user who wants a
+ * superseded model as their standing default cannot have one; the picker's
+ * per-row notice is what makes that visible rather than mysterious.
+ *
+ * Derived from the catalog's own `supersededBy` pointers, so a model marked
+ * superseded automatically gets BOTH the picker nudge and this steering —
+ * they can never disagree about which models are stale.
+ */
+export function migrateSupersededAnvilModelPreference(
+  id: string | null | undefined,
+  selectableModelIds: readonly string[],
+): string | null {
+  return getAnvilModelSupersededBy(id, selectableModelIds)?.modelId ?? null
+}
+
+function getNextAnvilDeploymentStart(now: Date): Date {
+  const easternNow = getZonedParts(now, ANVIL_EASTERN_TIMEZONE)
+  const isBeforeTodayOpen = easternNow.hour < 9
+
+  const offset = isBeforeTodayOpen ? 0 : 1
+
+  return getUtcForZonedTime(
+    addDaysToYmd(easternNow.year, easternNow.month, easternNow.day, offset),
+    ANVIL_EASTERN_TIMEZONE,
+    9,
+    0,
+  )
+}
+
+function getCurrentAnvilDeploymentEnd(now: Date): Date {
+  const pacificNow = getZonedParts(now, ANVIL_PACIFIC_TIMEZONE)
+  return getUtcForZonedTime(pacificNow, ANVIL_PACIFIC_TIMEZONE, 17, 0)
+}
+
+function isSameLocalDay(left: Date, right: Date, timeZone?: string): boolean {
+  const formatter = new Intl.DateTimeFormat('en-CA', {
+    timeZone,
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit',
+  })
+  return formatter.format(left) === formatter.format(right)
+}
+
+function formatLocalTime(
+  date: Date,
+  referenceNow: Date,
+  options: LocalTimeFormatOptions = {},
+): string {
+  const shouldShowWeekday = !isSameLocalDay(
+    date,
+    referenceNow,
+    options.timeZone,
+  )
+  return new Intl.DateTimeFormat(options.locale, {
+    timeZone: options.timeZone,
+    weekday: shouldShowWeekday ? 'short' : undefined,
+    hour: 'numeric',
+    minute: '2-digit',
+  }).format(date)
+}
+
+export function getAnvilDeploymentAvailabilityLabel(
+  now: Date = new Date(),
+  options: LocalTimeFormatOptions = {},
+): string {
+  if (isAnvilDeploymentHours(now)) {
+    const closesAt = getCurrentAnvilDeploymentEnd(now)
+    return `until ${formatLocalTime(closesAt, now, options)}`
+  }
+
+  const opensAt = getNextAnvilDeploymentStart(now)
+  return `opens ${formatLocalTime(opensAt, now, options)}`
+}
+
+export function isAnvilDeploymentHours(now: Date = new Date()): boolean {
+  const eastern = getZonedParts(now, ANVIL_EASTERN_TIMEZONE)
+  const pacific = getZonedParts(now, ANVIL_PACIFIC_TIMEZONE)
+  return (
+    eastern.hour * 60 + eastern.minute >= 9 * 60 &&
+    pacific.hour * 60 + pacific.minute < 17 * 60
+  )
+}
+
+export function isAnvilModelAvailable(
+  id: string,
+  now: Date = new Date(),
+): boolean {
+  const model = SUPPORTED_ANVIL_MODELS.find((m) => m.id === id)
+  if (!model) return false
+  return model.availability === 'always' || isAnvilDeploymentHours(now)
+}
+
+export function isAnvilSessionModelAvailable(
+  id: string,
+  now: Date = new Date(),
+): boolean {
+  const model =
+    SUPPORTED_ANVIL_MODELS.find((candidate) => candidate.id === id) ??
+    getAnvilWebModel(id)
+  return model.availability === 'always' || isAnvilDeploymentHours(now)
+}
+
+export function resolveAvailableAnvilModel(
+  id: string | null | undefined,
+  now: Date = new Date(),
+): AnvilModelId {
+  const resolved = resolveAnvilModel(id)
+  return isAnvilModelAvailable(resolved, now)
+    ? resolved
+    : FALLBACK_ANVIL_MODEL_ID
+}