@pugi/cli 0.1.0-beta.4 → 0.1.0-beta.40

package/dist/core/compact/token-counter.js

@@ -0,0 +1,108 @@
+/**
+ * Approximate token counter for the `/compact` auto-trigger gate.
+ *
+ * Pugi does not bundle tiktoken — adding a 3 MB native module for a
+ * single heuristic check after every turn is the wrong trade. We instead
+ * use the OpenAI rule-of-thumb that 1 token ≈ 4 characters of English
+ * (≈ ¾ of a word). For mixed-language conversations the approximation
+ * skews high by 10-20% which is the safe direction — the auto-compact
+ * threshold trips slightly EARLY, never LATE. A late trigger would
+ * exceed the model's actual context window and crash the next turn.
+ *
+ * Per-model context windows are exported from `MODEL_CONTEXT_WINDOW` so
+ * the caller can resolve the budget from the active model slug without
+ * round-tripping to the server. New models added in Anvil should grow
+ * this table in lockstep; the fall-back is the conservative 32k window.
+ *
+ * Override hook: when `PUGI_TOKEN_COUNTER_OVERRIDE` is set the function
+ * parses it as a JSON object `{"text": <n>}` (number of tokens to claim
+ * per char). Used only by the integration spec — never by production.
+ */
+/** Default chars-per-token ratio for the OpenAI rule-of-thumb. */
+const DEFAULT_CHARS_PER_TOKEN = 4;
+/**
+ * Conservative fallback window when the model slug is unknown. 32k is
+ * the smallest window any current Anvil-served model exposes; using it
+ * as a fall-back guarantees we never overestimate budget and skip a
+ * compaction that should have fired.
+ */
+const FALLBACK_WINDOW = 32_000;
+/**
+ * Known context windows for models Anvil exposes today. Keep in sync
+ * with `apps/admin-api/src/pugi/model-registry.ts` — when a new model
+ * lands there, add it here. The table is intentionally narrow: only
+ * models we have actually validated.
+ */
+export const MODEL_CONTEXT_WINDOW = Object.freeze({
+    'sonnet-4.6': 200_000,
+    'sonnet-4.5': 200_000,
+    'opus-4.7': 1_000_000,
+    'opus-4.6': 200_000,
+    'haiku-4.5': 200_000,
+    'deepseek-chat-v3.1': 128_000,
+    'gpt-5': 200_000,
+    'gemini-2.5-pro': 1_000_000,
+});
+/**
+ * Estimate the token count of a single string. Returns a positive
+ * integer for non-empty input and zero for empty input. The function is
+ * pure — same input always yields the same output.
+ *
+ * The approximation is `ceil(byteLength / chars-per-token)`. We use
+ * `Buffer.byteLength` so multi-byte UTF-8 sequences count proportionally
+ * to their on-the-wire size, not their char count — this matches the
+ * tokenizer's behaviour on CJK / cyrillic / emoji where one char often
+ * eats 3-4 tokens.
+ */
+export function estimateTokens(text) {
+    if (text.length === 0)
+        return 0;
+    const ratio = readCharsPerTokenOverride() ?? DEFAULT_CHARS_PER_TOKEN;
+    const bytes = Buffer.byteLength(text, 'utf8');
+    return Math.max(1, Math.ceil(bytes / ratio));
+}
+/**
+ * Resolve the context window in tokens for the given model slug. Falls
+ * back to the conservative 32k window when the slug is unknown.
+ */
+export function contextWindowForModel(model) {
+    if (!model)
+        return FALLBACK_WINDOW;
+    const known = MODEL_CONTEXT_WINDOW[model];
+    return known ?? FALLBACK_WINDOW;
+}
+/**
+ * Sum the token estimates of an arbitrary list of strings. Convenience
+ * for the auto-trigger which has to count across N transcript turns.
+ */
+export function estimateTokensInMany(parts) {
+    let total = 0;
+    for (const part of parts) {
+        total += estimateTokens(part);
+    }
+    return total;
+}
+/**
+ * Read the test override env. Returns the parsed chars-per-token ratio
+ * when set, or undefined when absent / malformed. Never throws.
+ */
+function readCharsPerTokenOverride() {
+    const raw = process.env['PUGI_TOKEN_COUNTER_OVERRIDE'];
+    if (!raw)
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object'
+            && parsed !== null
+            && typeof parsed.charsPerToken === 'number') {
+            const ratio = parsed.charsPerToken;
+            if (Number.isFinite(ratio) && ratio > 0)
+                return ratio;
+        }
+    }
+    catch {
+        /* malformed env, fall through */
+    }
+    return undefined;
+}
+//# sourceMappingURL=token-counter.js.map

package/dist/core/consensus/diff-capture.js

@@ -6,6 +6,10 @@
  *
  *   1. `--pr <number>`    — uses `gh pr diff <num>` (gh CLI required).
  *   2. `--commit <sha>`   — diff of that commit vs its first parent.
+ *                           When `--base <ref>` is ALSO provided, the
+ *                           diff is the range `<base>..<commit>` instead
+ *                           (mirrors `git diff base..commit` — covers the
+ *                           full PR-style payload, not just the tip).
  *   3. `--branch <name>`  — diff of HEAD vs `origin/<name>` merge-base.
  *   4. (default)          — diff of HEAD vs `origin/main` merge-base
  *                           covering BOTH committed-since-base AND
@@ -95,6 +99,16 @@ export function captureDiff(spec) {
         return captureFromPr(cwd, spec.pr);
     }
     if (typeof spec.commit === 'string' && spec.commit.length > 0) {
+        // When `--base` is supplied alongside `--commit`, callers want the
+        // full PR-style range diff (`base..commit`), not just the tip
+        // commit's parent diff. This matches the convention used by
+        // `git diff <base>..<commit>` everywhere else in the toolchain and
+        // is the verified-correct mode for reviewing a PR head ref. Without
+        // this branch, `--base` was silently ignored when `--commit` was
+        // present — see feedback_pugi_review_use_range_diff_not_worktree.
+        if (typeof spec.baseRef === 'string' && spec.baseRef.length > 0) {
+            return captureFromRange(cwd, spec.baseRef, spec.commit);
+        }
         return captureFromCommit(cwd, spec.commit);
     }
     if (typeof spec.branch === 'string' && spec.branch.length > 0) {
@@ -192,6 +206,65 @@ function captureFromCommit(cwd, commit) {
         },
     };
 }
+/**
+ * Range capture for `--commit <X> --base <Y>` — diff equivalent to
+ * `git diff <base>..<commit>`. Used when the operator names BOTH endpoints
+ * (typical PR review against a remote head SHA).
+ *
+ * Critical: this MUST be a pure read-only range diff against named refs.
+ * The previous behavior fell through to `captureFromCommit` which only
+ * showed the tip commit (`commit~1..commit`) — fine for single-commit
+ * review, wrong for multi-commit PRs. Worse, a stale fallback path was
+ * sending the working tree diff (`git diff` with no args), which caused
+ * every review on 2026-05-27 to surface identical noise from uncommitted
+ * `.gitignore` edits instead of the actual PR contents.
+ *
+ * Working tree integrity: only `git diff <ref>..<ref>` and metadata
+ * `log` / `rev-parse` / `name-rev` are used — none of these touch the
+ * index, working tree, or HEAD.
+ */
+function captureFromRange(cwd, baseRef, commit) {
+    // Resolve both endpoints up front so an unknown ref errors with a
+    // clear message before the diff invocation. `rev-parse` is read-only.
+    const fullCommit = safeExec(cwd, 'git', ['rev-parse', commit]).trim();
+    if (!fullCommit)
+        throw new Error(`Unknown commit ref: ${commit}`);
+    // Resolve the base: accept already-qualified refs (`origin/main`,
+    // `refs/heads/foo`) and bare branch names. If the bare name isn't
+    // locally resolvable, retry against `origin/<name>` — the common
+    // CI shape where local main is absent but the remote tracking ref is.
+    let resolvedBase = safeExecOptional(cwd, 'git', ['rev-parse', baseRef]).trim();
+    let effectiveBase = baseRef;
+    if (!resolvedBase && !baseRef.includes('/')) {
+        const remoteBase = `origin/${baseRef}`;
+        resolvedBase = safeExecOptional(cwd, 'git', ['rev-parse', remoteBase]).trim();
+        if (resolvedBase)
+            effectiveBase = remoteBase;
+    }
+    if (!resolvedBase)
+        throw new Error(`Unknown base ref: ${baseRef}`);
+    const diff = safeExec(cwd, 'git', [
+        'diff',
+        `${resolvedBase}..${fullCommit}`,
+        '--',
+        '.',
+        ...PROTECTED_PATHSPEC_EXCLUDES,
+    ]);
+    const cappedDiff = capDiff(diff);
+    const subject = safeExec(cwd, 'git', ['log', '-1', '--pretty=%s', fullCommit]).trim();
+    const branch = safeExec(cwd, 'git', ['name-rev', '--name-only', fullCommit]).trim() || 'detached';
+    const stats = computeStats(cappedDiff);
+    return {
+        diff: cappedDiff,
+        context: {
+            branch,
+            commit: shortSha(fullCommit),
+            title: subject || `commit ${shortSha(fullCommit)}`,
+            ref: `range:${effectiveBase}..${shortSha(fullCommit)}`,
+            stats,
+        },
+    };
+}
 function captureFromBranch(cwd, branch, baseRef) {
     const remoteRef = branch.includes('/') ? branch : `origin/${branch}`;
     const mergeBase = safeExec(cwd, 'git', ['merge-base', baseRef, remoteRef]).trim();

package/dist/core/context/index.js

@@ -18,4 +18,11 @@ export { BASELINE_IGNORE_PATTERNS, SECRET_IGNORE_PATTERNS, globalPugiIgnorePath,
 export { COLLAPSE_DIR_ENTRIES, MAX_README_LINES, MAX_SKELETON_BYTES, MAX_TREE_DEPTH, MAX_WALK_NODES, TOP_LANGUAGES, buildRepoSkeleton, detectPackageManager, languageForExtension, readGitBranch, readPackageJson, readReadme, renderSkeleton, topLanguages, } from './repo-skeleton.js';
 export { DEFAULT_WORKING_SET_CAPACITY, WorkingSet, } from './working-set.js';
 export { MAX_WATCHED_PATHS, PugiWatcher, THROTTLE_WINDOW_MS, } from './watcher.js';
+/**
+ * β5a R4+P5 — per-directory PUGI.md / AGENTS.md / CLAUDE.md / GEMINI.md
+ * traverse-up. Loads agent-context markdown at every directory between
+ * `cwd` and `workspaceRoot` (workspace root file is owned by
+ * `loadMarkdownContext` in `markdown-loader.ts` — no double-load).
+ */
+export { MAX_TRAVERSE_BYTES, MAX_TRAVERSE_PER_FILE_BYTES, MAX_TRAVERSE_DEPTH, TRAVERSE_SOURCES, loadTraversedMarkdown, } from './markdown-traverse.js';
 //# sourceMappingURL=index.js.map

package/dist/core/context/markdown-traverse.js

@@ -0,0 +1,255 @@
+/**
+ * Per-directory PUGI.md / AGENTS.md / CLAUDE.md / GEMINI.md traverse-up
+ * loader — β5a R4+P5.
+ *
+ * Claude Code, Codex CLI, and Gemini CLI all support a "walk up from
+ * cwd to the workspace root, pick up agent-context markdown at every
+ * level" pattern. Without this, a `pugi explain` invoked from
+ * `apps/admin-api/` cannot see project-local conventions encoded in
+ * `apps/admin-api/PUGI.md` (or the cross-CLI shim files) — the
+ * existing `loadMarkdownContext` only reads files at `workspaceRoot`.
+ *
+ * The β5a quality gate (≥80% win-rate vs Claude Code per CEO 2026-05-26)
+ * surfaces this gap repeatedly: monorepo-local conventions (NestJS
+ * controller style, Prisma migration name format, cabinet brand voice
+ * gates) live in per-app context files, and Pugi was blind to them
+ * pre-β5a.
+ *
+ * Contract:
+ *
+ *   - Walk from `cwd` upward until we reach `workspaceRoot` OR cross
+ *     the filesystem boundary. The workspace root file itself is
+ *     loaded by the legacy `loadMarkdownContext` so we do NOT include
+ *     it here (no double-load, no double-budget-charge).
+ *
+ *   - At each intermediate directory, look for the four canonical
+ *     filenames: `PUGI.md` (native), `AGENTS.md` (cross-CLI shim),
+ *     `CLAUDE.md` (Claude Code compat), `GEMINI.md` (Gemini CLI compat).
+ *
+ *   - HTML comments stripped, identical to the legacy loader.
+ *
+ *   - `@import` expansion is intentionally NOT performed here — the
+ *     per-dir surface is "drop a small file with the local
+ *     conventions"; deep @import chains belong at workspace root.
+ *     Keeping this surface flat means the per-dir budget cannot be
+ *     blown out by a runaway @import in an unrelated subtree.
+ *
+ *   - Aggregate budget: `MAX_TRAVERSE_BYTES` across ALL files found
+ *     in the walk. When exhausted, remaining files are skipped with
+ *     a `budget_exhausted` warning. Default 32 KB — half the
+ *     workspace-root budget, because per-dir files are meant to be
+ *     terse delta conventions, not full project briefs.
+ *
+ *   - The walk is bounded: `MAX_TRAVERSE_DEPTH` levels above
+ *     workspaceRoot are NEVER traversed (defense against being
+ *     invoked from a malicious cwd outside the workspace; in
+ *     practice cwd is always inside workspaceRoot but the symlink
+ *     case demands belt + suspenders).
+ *
+ *   - Order returned: shallowest-first (workspace root would be
+ *     first if included, then each level closer to cwd). Closest-
+ *     to-cwd files are the most specific and the context builder
+ *     emits them LAST so the model treats them as the highest-
+ *     priority conventions.
+ *
+ * This module is pure: no logging, no network, no fs writes. Filesystem
+ * reads only.
+ */
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { stripHtmlComments } from './markdown-loader.js';
+/**
+ * Per-traverse total byte cap. Half the workspace-root budget — these
+ * files are meant to be terse "in this subdir, do X". 32 KB still fits
+ * ~8000 words of guidance.
+ */
+export const MAX_TRAVERSE_BYTES = 32 * 1024;
+/**
+ * Per-file byte cap. A single per-dir file should never dominate; the
+ * 8 KB cap keeps any one level honest. Files larger than this are
+ * loaded up to the cap and flagged truncated.
+ */
+export const MAX_TRAVERSE_PER_FILE_BYTES = 8 * 1024;
+/**
+ * Maximum number of parent directories above workspaceRoot we will
+ * traverse. Zero in normal operation — cwd is always inside the
+ * workspace; the cap exists so a misconfigured invocation never
+ * walks the whole filesystem looking for AGENTS.md.
+ */
+export const MAX_TRAVERSE_DEPTH = 0;
+/**
+ * Filenames we look for at every level of the walk. The order here
+ * also defines the per-directory load order: PUGI.md first (highest
+ * trust), then cross-CLI compat shims. When the same directory has
+ * multiple files (e.g. both PUGI.md AND CLAUDE.md), all are loaded
+ * — operators sometimes keep both during a tool migration.
+ */
+export const TRAVERSE_SOURCES = ['PUGI.md', 'AGENTS.md', 'CLAUDE.md', 'GEMINI.md'];
+/**
+ * Walk from `opts.cwd` upward toward `opts.workspaceRoot`, loading
+ * every PUGI.md / AGENTS.md / CLAUDE.md / GEMINI.md we encounter at
+ * intermediate levels. The workspace root itself is NOT loaded here
+ * — `loadMarkdownContext(workspaceRoot)` owns that file.
+ *
+ * Returned `loaded` is sorted shallowest-first (closest-to-root) so
+ * the caller can emit per-dir context in increasing specificity.
+ *
+ * Safety properties (proven by spec):
+ *
+ *   - Never reads outside the workspace tree (symlinks resolved via
+ *     realpathSync; off-tree symlinks rejected as
+ *     `import_escapes_workspace`).
+ *   - Never reads more than `MAX_TRAVERSE_BYTES` total or more than
+ *     `MAX_TRAVERSE_PER_FILE_BYTES` per file.
+ *   - Never walks above the workspace root.
+ *   - Never visits the workspace root itself (single source of truth
+ *     for workspace-level docs stays with `loadMarkdownContext`).
+ */
+export async function loadTraversedMarkdown(opts) {
+    const warnings = [];
+    const loaded = [];
+    let budgetRemaining = MAX_TRAVERSE_BYTES;
+    let absRoot;
+    let absCwd;
+    try {
+        absRoot = realpathSync(resolve(opts.workspaceRoot));
+        absCwd = realpathSync(resolve(opts.cwd));
+    }
+    catch (error) {
+        warnings.push({
+            kind: 'read_error',
+            message: `realpath failed for traverse anchor: ${error.message}`,
+        });
+        return { loaded, warnings, totalBytes: 0 };
+    }
+    // Containment guard: if cwd is not inside workspaceRoot, refuse
+    // to walk. Returning a clean empty result keeps the engine happy
+    // and surfaces nothing about the off-tree cwd to the model.
+    const relCwd = relative(absRoot, absCwd);
+    if (relCwd.startsWith('..') || isAbsolute(relCwd)) {
+        warnings.push({
+            kind: 'import_escapes_workspace',
+            message: `cwd is outside workspaceRoot; per-dir traverse skipped (cwd=${absCwd}, root=${absRoot})`,
+            path: absCwd,
+        });
+        return { loaded, warnings, totalBytes: 0 };
+    }
+    // Collect the walk: every directory from cwd UP TO (but not
+    // including) workspaceRoot.
+    const dirsToVisit = [];
+    let current = absCwd;
+    while (current !== absRoot) {
+        dirsToVisit.push(current);
+        const parent = dirname(current);
+        if (parent === current)
+            break; // hit filesystem root before workspaceRoot — defensive
+        current = parent;
+        if (dirsToVisit.length > 64)
+            break; // pathological depth, refuse
+    }
+    // Walk shallowest-first so we charge the budget in the order
+    // that matches what we return.
+    dirsToVisit.reverse();
+    for (const dir of dirsToVisit) {
+        if (budgetRemaining <= 0) {
+            warnings.push({
+                kind: 'budget_exhausted',
+                message: `per-dir traverse budget exhausted before reaching ${dir}`,
+                path: dir,
+            });
+            break;
+        }
+        for (const source of TRAVERSE_SOURCES) {
+            const candidate = resolve(dir, source);
+            if (!existsSync(candidate))
+                continue;
+            // Symlink guard: same realpath check as the workspace-root
+            // loader. A symlink inside the workspace that points outside
+            // the workspace must NOT be inlined.
+            let realCandidate;
+            try {
+                realCandidate = realpathSync(candidate);
+            }
+            catch (error) {
+                warnings.push({
+                    kind: 'read_error',
+                    message: `realpath failed for ${candidate}: ${error.message}`,
+                    path: candidate,
+                });
+                continue;
+            }
+            const realRel = relative(absRoot, realCandidate);
+            if (realRel.startsWith('..') || isAbsolute(realRel)) {
+                warnings.push({
+                    kind: 'import_escapes_workspace',
+                    message: `traverse file escapes workspace via symlink: ${candidate} -> ${realCandidate}`,
+                    path: candidate,
+                });
+                continue;
+            }
+            let raw;
+            let rawBytes;
+            try {
+                rawBytes = statSync(candidate).size;
+                raw = readFileSync(candidate, 'utf8');
+            }
+            catch (error) {
+                warnings.push({
+                    kind: 'read_error',
+                    message: `could not read ${candidate}: ${error.message}`,
+                    path: candidate,
+                });
+                continue;
+            }
+            const stripped = stripHtmlComments(raw);
+            // Per-file cap first, then global budget.
+            const perFileCap = Math.min(MAX_TRAVERSE_PER_FILE_BYTES, budgetRemaining);
+            let content = stripped;
+            let truncated = false;
+            let contentBytes = Buffer.byteLength(content, 'utf8');
+            if (contentBytes > perFileCap) {
+                // Codepoint-safe slice: convert byte cap to char cap by
+                // taking min(byte cap, char-length-up-to-cap). We accept
+                // mild over-trim for safety.
+                content = content.slice(0, perFileCap);
+                truncated = true;
+                contentBytes = Buffer.byteLength(content, 'utf8');
+            }
+            const distance = distanceSegments(absCwd, dir);
+            loaded.push({
+                source,
+                resolvedPath: candidate,
+                dir,
+                distanceFromCwd: distance,
+                rawBytes,
+                loadedBytes: contentBytes,
+                truncated,
+                content,
+            });
+            budgetRemaining -= contentBytes;
+            if (budgetRemaining <= 0)
+                break;
+        }
+    }
+    return {
+        loaded,
+        warnings,
+        totalBytes: MAX_TRAVERSE_BYTES - budgetRemaining,
+    };
+}
+/**
+ * How many path segments separate `from` and `to`. Both must be
+ * absolute. `to` is assumed to be an ancestor of (or equal to)
+ * `from`; if not, returns -1 so callers can ignore the file.
+ */
+function distanceSegments(from, to) {
+    if (from === to)
+        return 0;
+    const rel = relative(to, from);
+    if (rel.startsWith('..') || isAbsolute(rel))
+        return -1;
+    if (rel.length === 0)
+        return 0;
+    return rel.split(sep).length;
+}
+//# sourceMappingURL=markdown-traverse.js.map

package/dist/core/cost/rate-card.js

@@ -0,0 +1,129 @@
+/**
+ * Rate card for the `pugi cost` / `/cost` / `/usage` surface — L19 sprint.
+ *
+ * Distinct from `core/repl/model-pricing.ts` on purpose:
+ *
+ *   - `model-pricing.ts` powers the TUI cost meter (per-turn flash, status
+ *     row USD). Its ladder is keyed against the live Anvil model slugs and
+ *     intentionally inflates an honest worst-case figure via the Sonnet
+ *     fallback so an operator on a quiet model never gets billed by a
+ *     surprise. It rounds to USD per 1M tokens at runtime.
+ *
+ *   - `rate-card.ts` (this file) powers the persisted `/cost` table the
+ *     operator reads to plan budget. It distinguishes open-weight models
+ *     ($0 / $0 — infra cost only) from hosted closed models so the table
+ *     does not double-charge an operator running a self-hosted Qwen or
+ *     Kimi behind Pugi. The L19 spec calls these out by name.
+ *
+ * Both ladders intentionally agree on Anthropic Claude family pricing so
+ * the TUI flash and the persisted table cannot disagree on a Claude turn.
+ * If they diverge, the per-model-pricing ladder wins for live UI; the
+ * rate card here wins for the persisted `.pugi/cost.json` aggregate.
+ *
+ * Prices are USD per 1,000,000 tokens, sourced from the L19 spec
+ * (2026-05-27) which mirrors provider list-price pages as of that date.
+ */
+/**
+ * Exact-match price ladder keyed by model slug. Slugs match the L19 task
+ * spec verbatim so a copy-paste from the sprint doc resolves without
+ * normalisation.
+ */
+export const RATES_PER_MTOKEN = Object.freeze({
+    // Anthropic Claude family (hosted, billed).
+    'claude-opus-4-7': { input: 15, output: 75 },
+    'claude-opus-4-6': { input: 15, output: 75 },
+    'claude-sonnet-4-6': { input: 3, output: 15 },
+    'claude-sonnet-4-5': { input: 3, output: 15 },
+    'claude-haiku-4-5-20251001': { input: 1, output: 5 },
+    'claude-haiku-4-5': { input: 1, output: 5 },
+    // Open-weight models — infra cost only, never per-token billed. The
+    // note column surfaces the reason so a CFO reading the JSON envelope
+    // does not assume the row is broken.
+    'qwen3-coder-480b-instruct-fp8': { input: 0, output: 0, note: 'open-weight' },
+    'kimi-k2.6': { input: 0, output: 0, note: 'open-weight' },
+    'deepseek-v4-pro': { input: 0, output: 0, note: 'open-weight' },
+});
+/**
+ * Family-prefix fallback — used only when an exact slug miss. Mirrors the
+ * approach in `model-pricing.ts` so a future model rebind (e.g.
+ * `claude-opus-4-8`) prices reasonably without a code edit.
+ */
+const FAMILY_FALLBACKS = [
+    ['claude-opus-', { input: 15, output: 75 }],
+    ['claude-sonnet-', { input: 3, output: 15 }],
+    ['claude-haiku-', { input: 1, output: 5 }],
+    ['qwen', { input: 0, output: 0, note: 'open-weight' }],
+    ['kimi', { input: 0, output: 0, note: 'open-weight' }],
+    ['deepseek', { input: 0, output: 0, note: 'open-weight' }],
+];
+/**
+ * Final fallback for unknown slugs. Pinned to Sonnet-tier — same posture
+ * as `model-pricing.ts`'s default, so an unrecognised hosted model bills
+ * "honestly conservative" rather than $0 (which would silently hide cost
+ * from the operator).
+ */
+const DEFAULT_RATE = { input: 3, output: 15, note: 'unknown model — Sonnet-tier estimate' };
+/**
+ * Look up the rate for a model slug.
+ *
+ * Resolution order:
+ *   1. Exact match in `RATES_PER_MTOKEN`.
+ *   2. Family-prefix match (first hit wins).
+ *   3. Default Sonnet-tier estimate.
+ *
+ * Pure, never throws. Called on every cost-tracker write so the hot path
+ * stays branch-cheap.
+ */
+export function rateFor(model) {
+    if (!model || typeof model !== 'string')
+        return DEFAULT_RATE;
+    const exact = RATES_PER_MTOKEN[model];
+    if (exact)
+        return exact;
+    for (const [prefix, rate] of FAMILY_FALLBACKS) {
+        if (model.startsWith(prefix))
+            return rate;
+    }
+    return DEFAULT_RATE;
+}
+/**
+ * Compute the USD cost for a single (model, inputTokens, outputTokens)
+ * triple. Defensive against negative / NaN inputs — out-of-range values
+ * floor to zero so a buggy upstream cannot credit a negative cost.
+ */
+export function estimateUsd(model, inputTokens, outputTokens) {
+    const rate = rateFor(model);
+    const safeIn = Number.isFinite(inputTokens) && inputTokens > 0 ? inputTokens : 0;
+    const safeOut = Number.isFinite(outputTokens) && outputTokens > 0 ? outputTokens : 0;
+    const usd = (safeIn * rate.input + safeOut * rate.output) / 1_000_000;
+    return Number.isFinite(usd) && usd > 0 ? usd : 0;
+}
+/**
+ * Format a USD figure for the `/cost` table.
+ *
+ *   - `≥ $0.01` → two decimals (`$0.46`).
+ *   - `< $0.01` but `> 0` → three decimals (`$0.003`) so fractions of a
+ *     cent are honest instead of rounding to `$0.00`.
+ *   - Exactly `0` or NaN → `$0.00`.
+ *
+ * Mirrors `formatCostUsd` from `model-pricing.ts` intentionally — both
+ * surfaces should print the same number in the same shape.
+ */
+export function formatUsd(value) {
+    if (!Number.isFinite(value) || value <= 0)
+        return '$0.00';
+    if (value >= 0.01)
+        return `$${value.toFixed(2)}`;
+    return `$${value.toFixed(3)}`;
+}
+/**
+ * Format a token count for the `/cost` table. Uses comma-thousands so the
+ * table reads `14,300` instead of `14.3k` — distinct from the TUI status
+ * row which uses `k`/`m` shortening to save column width.
+ */
+export function formatTokensWithCommas(value) {
+    if (!Number.isFinite(value) || value <= 0)
+        return '0';
+    return Math.floor(value).toLocaleString('en-US');
+}
+//# sourceMappingURL=rate-card.js.map