@sriinnu/kosha-discovery 0.6.1 → 1.1.0

package/dist/discovery/litellm-seed.js

@@ -0,0 +1,252 @@
+/**
+ * kosha-discovery — Public-catalog seed for origin providers.
+ *
+ * Treats the LiteLLM community catalog as the canonical *public* source of
+ * "what models exist with what pricing/context/capabilities" and converts
+ * it into seed {@link ModelCard} arrays per origin provider.
+ *
+ * This decouples kosha discovery from API keys: anyone running `kosha
+ * latest`, with or without credentials, gets the current state of the
+ * world for every supported origin provider.
+ *
+ * Hardening notes:
+ *  - All fields are read defensively (`typeof` checks, length caps).
+ *  - Synthetic IDs are slugified to strict `[A-Za-z0-9._/:-]` so a
+ *    compromised catalog cannot smuggle injection-shaped strings into
+ *    downstream consumers.
+ *  - The maximum number of seeded models per provider is capped to bound
+ *    cost of a hostile catalog.
+ * @module
+ */
+import { applyFreeTierFlag } from "./free-tier.js";
+import { loadLiteLLMCatalog, } from "../enrichment/litellm-catalog.js";
+/** Per-token cost → per-million conversion factor. */
+const PER_MILLION = 1_000_000;
+/** Maximum models seeded for a single provider — defensive ceiling. */
+const MAX_MODELS_PER_SEED = 1_000;
+/** Strict charset for model IDs; everything else gets stripped or rejected. */
+const SAFE_ID_PATTERN = /^[A-Za-z0-9._:/\-]+$/;
+/** Maximum length we accept for a model ID. */
+const MAX_ID_LENGTH = 256;
+/**
+ * Map kosha provider IDs (the slugs used internally) to the set of
+ * `litellm_provider` values that should be treated as the same origin.
+ * LiteLLM's slugs differ from kosha's in a few places (`gemini`, `together_ai`,
+ * `fireworks_ai`, etc.), so we alias them here rather than scattering
+ * conditionals across discoverers.
+ */
+const PROVIDER_SLUG_ALIASES = {
+    anthropic: ["anthropic"],
+    openai: ["openai"],
+    google: ["gemini", "vertex_ai-language-models", "vertex_ai-image-models", "vertex_ai-embedding-models"],
+    deepseek: ["deepseek"],
+    zai: ["zai"],
+    minimax: ["minimax"],
+    moonshot: ["moonshot"],
+    mistral: ["mistral"],
+    cohere: ["cohere", "cohere_chat"],
+    groq: ["groq"],
+    together: ["together_ai"],
+    fireworks: ["fireworks_ai"],
+    perplexity: ["perplexity"],
+    cerebras: ["cerebras"],
+    deepinfra: ["deepinfra"],
+    xai: ["xai"],
+};
+/**
+ * Build a fresh array of seed {@link ModelCard}s for the given kosha
+ * provider ID, using the shared LiteLLM catalog. Returns `[]` if the
+ * provider has no entries in the catalog.
+ *
+ * The returned cards have `source: "litellm"` so downstream consumers
+ * (and the existing pricing enricher) can distinguish public-catalog
+ * data from live-API data.
+ */
+export async function getLiteLLMSeed(providerId) {
+    const slugs = PROVIDER_SLUG_ALIASES[providerId];
+    if (!slugs || slugs.length === 0)
+        return [];
+    const catalog = await loadLiteLLMCatalog();
+    const seeds = [];
+    const seenIds = new Set();
+    for (const [key, entry] of Object.entries(catalog)) {
+        if (seeds.length >= MAX_MODELS_PER_SEED)
+            break;
+        if (!entry || typeof entry !== "object")
+            continue;
+        const litellmProvider = entry.litellm_provider;
+        if (typeof litellmProvider !== "string")
+            continue;
+        if (!slugs.includes(litellmProvider))
+            continue;
+        const id = canonicaliseModelId(key, providerId);
+        if (!id || seenIds.has(id))
+            continue;
+        seenIds.add(id);
+        const card = buildSeedCard(id, providerId, entry);
+        if (card)
+            seeds.push(card);
+    }
+    return seeds;
+}
+/**
+ * Strip a LiteLLM catalog key down to the provider-native model ID.
+ *
+ * LiteLLM keys come in three shapes:
+ *   1. Bare ID:         `claude-opus-4-7`
+ *   2. Prefixed:        `anthropic/claude-opus-4-7`
+ *   3. Path-prefixed:   `vertex_ai/claude-opus-4-7@default`
+ *
+ * Returns null when the key is not safe (oversized, illegal chars,
+ * or empty after stripping).
+ */
+function canonicaliseModelId(rawKey, providerId) {
+    if (typeof rawKey !== "string" || rawKey.length === 0 || rawKey.length > MAX_ID_LENGTH) {
+        return null;
+    }
+    // Drop everything before the last `/`. Most public catalogs prefix the
+    // vendor; kosha stores the bare provider-native ID.
+    let id = rawKey.includes("/") ? rawKey.slice(rawKey.lastIndexOf("/") + 1) : rawKey;
+    // Drop deployment suffixes after `@` (Vertex naming).
+    const atIdx = id.indexOf("@");
+    if (atIdx > 0)
+        id = id.slice(0, atIdx);
+    if (!SAFE_ID_PATTERN.test(id))
+        return null;
+    // Skip pseudo entries the catalog uses for documentation (e.g. "sample_spec").
+    if (id === "sample_spec")
+        return null;
+    // For Google: only keep the gemini-* family, not other vertex bundle entries
+    // that aren't real model IDs.
+    if (providerId === "google" && !id.startsWith("gemini") && !id.startsWith("imagen") && !id.startsWith("veo")) {
+        return null;
+    }
+    return id;
+}
+/**
+ * Convert a single LiteLLM entry into a {@link ModelCard}. Returns null
+ * when the entry is too sparse to be useful (e.g. no mode and no pricing
+ * signal at all).
+ */
+function buildSeedCard(id, providerId, entry) {
+    const mode = inferMode(entry);
+    const capabilities = inferCapabilities(entry, mode);
+    const pricing = extractPricing(entry);
+    const contextWindow = pickPositive(entry.max_input_tokens, entry.max_tokens) ?? 0;
+    const maxOutputTokens = pickPositive(entry.max_output_tokens, entry.max_tokens) ?? 0;
+    const card = {
+        id,
+        name: id,
+        provider: providerId,
+        originProvider: providerId,
+        mode,
+        capabilities,
+        rawCapabilities: [...capabilities],
+        contextWindow,
+        maxOutputTokens,
+        maxInputTokens: pickPositive(entry.max_input_tokens),
+        dimensions: pickPositive(entry.output_vector_size),
+        pricing,
+        aliases: [],
+        discoveredAt: Date.now(),
+        source: "litellm",
+    };
+    return applyFreeTierFlag(card);
+}
+/** Pick the first finite, positive number from a list of optional values. */
+function pickPositive(...values) {
+    for (const value of values) {
+        if (typeof value === "number" && Number.isFinite(value) && value > 0)
+            return value;
+    }
+    return undefined;
+}
+/** Map LiteLLM mode strings to the kosha ModelMode union. */
+function inferMode(entry) {
+    switch (entry.mode) {
+        case "embedding":
+            return "embedding";
+        case "image_generation":
+            return "image";
+        case "audio_transcription":
+        case "audio_speech":
+            return "audio";
+        case "moderation":
+            return "moderation";
+        case "rerank":
+            return "rerank";
+        default:
+            return "chat";
+    }
+}
+/** Infer kosha capability flags from LiteLLM's structured boolean fields. */
+function inferCapabilities(entry, mode) {
+    if (mode === "embedding")
+        return ["embedding"];
+    if (mode === "image")
+        return ["image_generation"];
+    if (mode === "audio")
+        return ["audio"];
+    if (mode === "moderation")
+        return ["moderation"];
+    if (mode === "rerank")
+        return ["rerank"];
+    const caps = new Set(["chat"]);
+    if (entry.supports_vision)
+        caps.add("vision");
+    if (entry.supports_function_calling || entry.supports_tool_choice)
+        caps.add("function_calling");
+    if (entry.supports_prompt_caching)
+        caps.add("prompt_caching");
+    if (entry.supports_response_schema)
+        caps.add("structured_output");
+    // Most modern chat models cover code / NLU; LiteLLM doesn't expose those
+    // flags, but kosha consumers expect them present for chat-class models.
+    caps.add("code");
+    caps.add("nlu");
+    return Array.from(caps);
+}
+/**
+ * Convert LiteLLM per-token costs to per-million pricing.
+ * Returns undefined unless both base input and output pricing are present.
+ */
+function extractPricing(entry) {
+    const baseInput = isFinite(entry.input_cost_per_token) ? entry.input_cost_per_token : undefined;
+    const baseOutput = isFinite(entry.output_cost_per_token) ? entry.output_cost_per_token : undefined;
+    const reasoningInput = firstFinite(entry.input_cost_per_reasoning_token, entry.reasoning_input_cost_per_token);
+    const reasoningOutput = firstFinite(entry.output_cost_per_reasoning_token, entry.reasoning_output_cost_per_token);
+    if (baseInput === undefined || baseOutput === undefined)
+        return undefined;
+    const pricing = {
+        inputPerMillion: baseInput * PER_MILLION,
+        outputPerMillion: baseOutput * PER_MILLION,
+    };
+    if (reasoningInput !== undefined)
+        pricing.reasoningInputPerMillion = reasoningInput * PER_MILLION;
+    if (reasoningOutput !== undefined)
+        pricing.reasoningOutputPerMillion = reasoningOutput * PER_MILLION;
+    if (isFinite(entry.cache_read_input_token_cost)) {
+        pricing.cacheReadPerMillion = entry.cache_read_input_token_cost * PER_MILLION;
+    }
+    if (isFinite(entry.cache_creation_input_token_cost)) {
+        pricing.cacheWritePerMillion = entry.cache_creation_input_token_cost * PER_MILLION;
+    }
+    if (isFinite(entry.input_cost_per_token_batches)) {
+        pricing.batchInputPerMillion = entry.input_cost_per_token_batches * PER_MILLION;
+    }
+    if (isFinite(entry.output_cost_per_token_batches)) {
+        pricing.batchOutputPerMillion = entry.output_cost_per_token_batches * PER_MILLION;
+    }
+    return pricing;
+}
+function firstFinite(...values) {
+    for (const value of values) {
+        if (typeof value === "number" && Number.isFinite(value))
+            return value;
+    }
+    return undefined;
+}
+function isFinite(value) {
+    return typeof value === "number" && Number.isFinite(value);
+}
+//# sourceMappingURL=litellm-seed.js.map

package/dist/discovery/litellm-seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"litellm-seed.js","sourceRoot":"","sources":["../../src/discovery/litellm-seed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAEN,kBAAkB,GAClB,MAAM,kCAAkC,CAAC;AAE1C,sDAAsD;AACtD,MAAM,WAAW,GAAG,SAAS,CAAC;AAE9B,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,+EAA+E;AAC/E,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAE/C,+CAA+C;AAC/C,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAsC;IAChE,SAAS,EAAE,CAAC,WAAW,CAAC;IACxB,MAAM,EAAE,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,CAAC,QAAQ,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,4BAA4B,CAAC;IACvG,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,GAAG,EAAE,CAAC,KAAK,CAAC;IACZ,OAAO,EAAE,CAAC,SAAS,CAAC;IACpB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,CAAC,SAAS,CAAC;IACpB,MAAM,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,aAAa,CAAC;IACzB,SAAS,EAAE,CAAC,cAAc,CAAC;IAC3B,UAAU,EAAE,CAAC,YAAY,CAAC;IAC1B,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,SAAS,EAAE,CAAC,WAAW,CAAC;IACxB,GAAG,EAAE,CAAC,KAAK,CAAC;CACZ,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACtD,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE5C,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,MAAM,IAAI,mBAAmB;YAAE,MAAM;QAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAElD,MAAM,eAAe,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC/C,IAAI,OAAO,eAAe,KAAK,QAAQ;YAAE,SAAS;QAClD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,SAAS;QAE/C,MAAM,EAAE,GAAG,mBAAmB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,MAAc,EAAE,UAAkB;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACxF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,uEAAuE;IACvE,oDAAoD;IACpD,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAEnF,sDAAsD;IACtD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,GAAG,CAAC;QAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEvC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,+EAA+E;IAC/E,IAAI,EAAE,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAEtC,6EAA6E;IAC7E,8BAA8B;IAC9B,IAAI,UAAU,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,EAAU,EAAE,UAAkB,EAAE,KAAwB;IAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAErF,MAAM,IAAI,GAAc;QACvB,EAAE;QACF,IAAI,EAAE,EAAE;QACR,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,UAAU;QAC1B,IAAI;QACJ,YAAY;QACZ,eAAe,EAAE,CAAC,GAAG,YAAY,CAAC;QAClC,aAAa;QACb,eAAe;QACf,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACpD,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAClD,OAAO;QACP,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;QACxB,MAAM,EAAE,SAAS;KACjB,CAAC;IACF,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAG,MAAiC;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,6DAA6D;AAC7D,SAAS,SAAS,CAAC,KAAwB;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,WAAW;YACf,OAAO,WAAW,CAAC;QACpB,KAAK,kBAAkB;YACtB,OAAO,OAAO,CAAC;QAChB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,cAAc;YAClB,OAAO,OAAO,CAAC;QAChB,KAAK,YAAY;YAChB,OAAO,YAAY,CAAC;QACrB,KAAK,QAAQ;YACZ,OAAO,QAAQ,CAAC;QACjB;YACC,OAAO,MAAM,CAAC;IAChB,CAAC;AACF,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,KAAwB,EAAE,IAAe;IACnE,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,eAAe;QAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,yBAAyB,IAAI,KAAK,CAAC,oBAAoB;QAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,uBAAuB;QAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,wBAAwB;QAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClE,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAwB;IAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC/G,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAElH,IAAI,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE1E,MAAM,OAAO,GAAiB;QAC7B,eAAe,EAAE,SAAS,GAAG,WAAW;QACxC,gBAAgB,EAAE,UAAU,GAAG,WAAW;KAC1C,CAAC;IACF,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,wBAAwB,GAAG,cAAc,GAAG,WAAW,CAAC;IAClG,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,yBAAyB,GAAG,eAAe,GAAG,WAAW,CAAC;IACrG,IAAI,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC,2BAA4B,GAAG,WAAW,CAAC;IAChF,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAC,+BAAgC,GAAG,WAAW,CAAC;IACrF,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAC,4BAA6B,GAAG,WAAW,CAAC;IAClF,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC,6BAA8B,GAAG,WAAW,CAAC;IACpF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,MAAiC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC"}

package/dist/discovery/modelsdev-catalog.d.ts

@@ -0,0 +1,95 @@
+/**
+ * kosha-discovery — Shared models.dev catalog loader.
+ *
+ * Pulls the keyless community catalog at https://models.dev/api.json,
+ * which is maintained by the SST team and tends to surface new models
+ * faster than LiteLLM. Same hardening contract as the LiteLLM loader:
+ * HTTPS-pinned URL, assertCleanPayload scan, bounded body read, entry-count
+ * cap, promise-deduped singleton.
+ *
+ * Schema (top level):
+ *   {
+ *     [providerSlug]: {
+ *       id, name, env: string[], doc, npm, api,
+ *       models: {
+ *         [modelId]: {
+ *           id, name, family,
+ *           attachment, reasoning, tool_call, structured_output, temperature,
+ *           knowledge, release_date, last_updated,
+ *           modalities: { input: string[], output: string[] },
+ *           open_weights,
+ *           cost: { input, output, cache_read?, cache_write?, ... },
+ *           limit: { context, output, input? }
+ *         }
+ *       }
+ *     }
+ *   }
+ * @module
+ */
+/** Pinned upstream catalog URL — HTTPS only. */
+export declare const MODELSDEV_CATALOG_URL = "https://models.dev/api.json";
+/** Cost block for a single model entry. Fields are optional / forward-compatible. */
+export interface ModelsDevCost {
+    input?: number;
+    output?: number;
+    cache_read?: number;
+    cache_write?: number;
+    /** Per-million tokens for >200K-context billing tier (OpenAI long-context tier). */
+    context_over_200k?: {
+        input?: number;
+        output?: number;
+        cache_read?: number;
+    };
+    /** Per-million tokens for batch API tier. */
+    batch?: {
+        input?: number;
+        output?: number;
+    };
+}
+/** Limit block — context window + output cap + optional input cap. */
+export interface ModelsDevLimit {
+    context?: number;
+    output?: number;
+    input?: number;
+}
+/** Modalities block — structured input/output media kinds. */
+export interface ModelsDevModalities {
+    input?: string[];
+    output?: string[];
+}
+/** A single model entry in models.dev. */
+export interface ModelsDevModel {
+    id: string;
+    name?: string;
+    family?: string;
+    attachment?: boolean;
+    reasoning?: boolean;
+    tool_call?: boolean;
+    structured_output?: boolean;
+    temperature?: boolean;
+    knowledge?: string;
+    release_date?: string;
+    last_updated?: string;
+    modalities?: ModelsDevModalities;
+    open_weights?: boolean;
+    cost?: ModelsDevCost;
+    limit?: ModelsDevLimit;
+}
+/** A single provider entry in models.dev. */
+export interface ModelsDevProvider {
+    id: string;
+    name?: string;
+    env?: string[];
+    api?: string;
+    doc?: string;
+    npm?: string;
+    models?: Record<string, ModelsDevModel>;
+}
+/**
+ * Fetch the models.dev catalog with full hardening. Concurrent callers
+ * share the same in-flight promise.
+ */
+export declare function loadModelsDevCatalog(): Promise<Record<string, ModelsDevProvider>>;
+/** Test-only helper to clear the cache between runs. */
+export declare function resetModelsDevCatalogCache(): void;
+//# sourceMappingURL=modelsdev-catalog.d.ts.map

package/dist/discovery/modelsdev-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelsdev-catalog.d.ts","sourceRoot":"","sources":["../../src/discovery/modelsdev-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AAWnE,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,iBAAiB,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,6CAA6C;IAC7C,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,KAAK,CAAC,EAAE,cAAc,CAAC;CACvB;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACxC;AAKD;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAQjF;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}

package/dist/discovery/modelsdev-catalog.js

@@ -0,0 +1,131 @@
+/**
+ * kosha-discovery — Shared models.dev catalog loader.
+ *
+ * Pulls the keyless community catalog at https://models.dev/api.json,
+ * which is maintained by the SST team and tends to surface new models
+ * faster than LiteLLM. Same hardening contract as the LiteLLM loader:
+ * HTTPS-pinned URL, assertCleanPayload scan, bounded body read, entry-count
+ * cap, promise-deduped singleton.
+ *
+ * Schema (top level):
+ *   {
+ *     [providerSlug]: {
+ *       id, name, env: string[], doc, npm, api,
+ *       models: {
+ *         [modelId]: {
+ *           id, name, family,
+ *           attachment, reasoning, tool_call, structured_output, temperature,
+ *           knowledge, release_date, last_updated,
+ *           modalities: { input: string[], output: string[] },
+ *           open_weights,
+ *           cost: { input, output, cache_read?, cache_write?, ... },
+ *           limit: { context, output, input? }
+ *         }
+ *       }
+ *     }
+ *   }
+ * @module
+ */
+import { assertCleanPayload } from "../security.js";
+/** Pinned upstream catalog URL — HTTPS only. */
+export const MODELSDEV_CATALOG_URL = "https://models.dev/api.json";
+/** Maximum response payload size (8 MB) — current catalog is ~600 KB. */
+const MAX_PAYLOAD_BYTES = 8 * 1024 * 1024;
+/** Maximum top-level provider entry count we accept. */
+const MAX_PROVIDER_ENTRIES = 1_000;
+/** Network timeout for the catalog fetch. */
+const FETCH_TIMEOUT_MS = 15_000;
+/** Module-level promise-dedup cache. */
+let inflight = null;
+/**
+ * Fetch the models.dev catalog with full hardening. Concurrent callers
+ * share the same in-flight promise.
+ */
+export function loadModelsDevCatalog() {
+    if (inflight)
+        return inflight;
+    inflight = fetchAndValidate().catch((error) => {
+        // Reset on failure so future calls can retry.
+        inflight = null;
+        throw error;
+    });
+    return inflight;
+}
+/** Test-only helper to clear the cache between runs. */
+export function resetModelsDevCatalogCache() {
+    inflight = null;
+}
+async function fetchAndValidate() {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetch(MODELSDEV_CATALOG_URL, { signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        throw new Error(`Failed to fetch models.dev catalog: ${response.status} ${response.statusText}`);
+    }
+    const text = await readBoundedText(response, MAX_PAYLOAD_BYTES);
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error("Failed to parse models.dev catalog: invalid JSON");
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("Failed to parse models.dev catalog: expected an object");
+    }
+    assertCleanPayload(parsed, "models.dev");
+    const entries = Object.entries(parsed);
+    if (entries.length > MAX_PROVIDER_ENTRIES) {
+        throw new Error(`models.dev catalog exceeds provider cap (${entries.length} > ${MAX_PROVIDER_ENTRIES}) — refusing to load`);
+    }
+    const out = Object.create(null);
+    for (const [key, value] of entries) {
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+/** Stream-read a Response body but cap total bytes received. */
+async function readBoundedText(response, maxBytes) {
+    const contentLength = Number(response.headers.get("content-length") ?? "0");
+    if (contentLength > maxBytes) {
+        throw new Error(`models.dev catalog too large (${contentLength} > ${maxBytes} bytes) — refusing to load`);
+    }
+    if (!response.body) {
+        const text = await response.text();
+        if (text.length > maxBytes) {
+            throw new Error(`models.dev catalog too large (${text.length} > ${maxBytes} chars) — refusing to load`);
+        }
+        return text;
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder("utf-8");
+    let received = 0;
+    let text = "";
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        received += value.byteLength;
+        if (received > maxBytes) {
+            try {
+                await reader.cancel();
+            }
+            catch {
+                /* swallow */
+            }
+            throw new Error(`models.dev catalog too large (>${maxBytes} bytes) — refusing to load`);
+        }
+        text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+    return text;
+}
+//# sourceMappingURL=modelsdev-catalog.js.map

package/dist/discovery/modelsdev-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelsdev-catalog.js","sourceRoot":"","sources":["../../src/discovery/modelsdev-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAEnE,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,wDAAwD;AACxD,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAyDhC,wCAAwC;AACxC,IAAI,QAAQ,GAAsD,IAAI,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IACnC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,QAAQ,GAAG,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,8CAA8C;QAC9C,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,KAAK,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B;IACzC,QAAQ,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC9B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAErE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACd,uCAAuC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAC/E,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAEhE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3E,CAAC;IAED,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACd,4CAA4C,OAAO,CAAC,MAAM,MAAM,oBAAoB,sBAAsB,CAC1G,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,GAAG,CAAC,GAAG,KAA0B,CAAC;QACvC,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAgB;IAClE,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IAC5E,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACd,iCAAiC,aAAa,MAAM,QAAQ,4BAA4B,CACxF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACd,iCAAiC,IAAI,CAAC,MAAM,MAAM,QAAQ,4BAA4B,CACtF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;QAC7B,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC;gBACJ,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACR,aAAa;YACd,CAAC;YACD,MAAM,IAAI,KAAK,CACd,kCAAkC,QAAQ,4BAA4B,CACtE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/discovery/modelsdev-seed.d.ts

@@ -0,0 +1,19 @@
+/**
+ * kosha-discovery — models.dev public-catalog seed.
+ *
+ * Translates the keyless models.dev catalog into normalized {@link ModelCard}
+ * arrays per kosha provider. Same defensive posture as the LiteLLM seed:
+ * strict ID charset, length cap, model-count cap, no spreading of arbitrary
+ * fields into ModelCard.
+ *
+ * models.dev publishes pricing already in per-million-tokens, so the
+ * conversion done by the LiteLLM seed is unnecessary here.
+ * @module
+ */
+import type { ModelCard } from "../types.js";
+/**
+ * Build seed {@link ModelCard}s for the given kosha provider, sourced from
+ * models.dev. Returns `[]` if the provider has no entries.
+ */
+export declare function getModelsDevSeed(providerId: string): Promise<ModelCard[]>;
+//# sourceMappingURL=modelsdev-seed.d.ts.map

package/dist/discovery/modelsdev-seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelsdev-seed.d.ts","sourceRoot":"","sources":["../../src/discovery/modelsdev-seed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAA2B,MAAM,aAAa,CAAC;AA8CtE;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CA4B/E"}