@sriinnu/kosha-discovery 1.1.0 → 1.5.0

package/README.md

@@ -1,19 +1,10 @@
 <p align="center">
-  <img src="logo.png" alt="Kosha — AI Model Discovery" width="140" />
+  <img src="logo.svg" alt="Kosha — AI Model Discovery" width="140" />
 </p>
 
-<h1 align="center">kosha-discovery — कोश</h1>
+# kosha-discovery
 
-<p align="center"><strong>AI Model & Provider Discovery Registry</strong></p>
-
-<p align="center">
-  <a href="https://www.npmjs.com/package/@sriinnu/kosha-discovery"><img src="https://img.shields.io/npm/v/%40sriinnu%2Fkosha-discovery?color=7C3AED&label=npm" alt="npm version" /></a>
-  <a href="https://www.npmjs.com/package/@sriinnu/kosha-discovery"><img src="https://img.shields.io/npm/dm/%40sriinnu%2Fkosha-discovery?color=0EA5E9&label=downloads" alt="npm downloads" /></a>
-  <a href="https://github.com/sriinnu/kosha-discovery/blob/main/LICENSE"><img src="https://img.shields.io/github/license/sriinnu/kosha-discovery?color=F59E0B" alt="license" /></a>
-  <a href="https://www.npmjs.com/package/@sriinnu/kosha-discovery"><img src="https://img.shields.io/node/v/%40sriinnu%2Fkosha-discovery?color=5B21B6" alt="node version" /></a>
-</p>
-
-Kosha (कोश — *treasury*) discovers AI models across providers, resolves credentials, enriches with pricing, and exposes the catalog through a library, CLI, HTTP API, and a built-in OpenAI-compatible proxy. One source of truth for model identity, pricing, and routing — so your app doesn't break when providers ship new SKUs or change rates.
+AI model and provider discovery registry. Discovers models across providers, resolves credentials, enriches with pricing, and exposes the catalog through a library, CLI, HTTP API, and an OpenAI-compatible proxy.
 
 ## Install
 
@@ -22,6 +13,8 @@ npm install @sriinnu/kosha-discovery       # library / server
 npm install -g @sriinnu/kosha-discovery    # global `kosha` CLI
 ```
 
+Requires Node.js 22+.
+
 ## Quick start
 
 ### Library
@@ -31,9 +24,9 @@ import { createKosha } from "@sriinnu/kosha-discovery";
 
 const kosha = await createKosha();
 
-const models    = kosha.models();                          // all
-const cheapest  = kosha.cheapestModels({ role: "image" }); // ranked
-const sonnet    = kosha.model("sonnet");                   // alias resolves
+const models   = kosha.models();                          // all discovered models
+const cheapest = kosha.cheapestModels({ role: "image" }); // ranked by price
+const sonnet   = kosha.model("sonnet");                   // alias resolves to canonical ID
 console.log(sonnet.pricing); // { inputPerMillion: 3, outputPerMillion: 15, ... }
 ```
 
@@ -45,10 +38,10 @@ kosha list --provider anthropic      # filter from local cache
 kosha model sonnet                   # details for one model (alias-aware)
 kosha cheapest --role embeddings     # rank cheapest for a role
 kosha update                         # force a fresh fetch
-kosha serve --port 3000              # HTTP API
+kosha serve --port 3000              # HTTP API (binds 127.0.0.1; --host 0.0.0.0 + KOSHA_PROXY_TOKEN to expose)
 ```
 
-After each discovery, a stable v1 manifest lands at `~/.kosha/registry.json` — any tool that reads JSON can consume it:
+After each discovery, a stable v1 manifest lands at `~/.kosha/registry.json`:
 
 ```bash
 jq '.models[] | select(.pricing.inputPerMillion < 0.1) | .modelId' ~/.kosha/registry.json
@@ -108,7 +101,19 @@ const routed = await client.chat.completions.create({
 
 The response always includes `x-kosha-model`, `x-kosha-provider`, and `x-kosha-requested` headers so the caller knows exactly what ran.
 
-Supported transports: `openai`, `openai-compatible-http`, `ollama`. Anthropic, Google, Bedrock, and Vertex require wire-format translation — not yet proxied.
+Supported transports: `openai`, `openai-compatible-http`, `ollama`, and `anthropic`. Anthropic is bridged through a built-in OpenAI ↔ Anthropic wire-format translator that carries streaming, tools and tool calls, `image_url` parts, `response_format`, and `reasoning_effort`; anything it can't map faithfully (audio input, non-function tools) fails over to a native OpenAI-compatible route. Google, Bedrock, and Vertex speak SDK-specific wire formats and are not yet proxied.
+
+The server binds `127.0.0.1` by default. To expose it, run `kosha serve --host 0.0.0.0` **with** `KOSHA_PROXY_TOKEN` set; the proxy then requires `Authorization: Bearer <token>` (or `x-kosha-token`). Full reference: [docs/api.md](docs/api.md#openai-compatible-proxy).
+
+### MCP server
+
+`kosha-mcp` exposes the registry to AI agents over the Model Context Protocol on stdio: model lookup, cheapest / strategy-ranked routes, provider health, and context-management advice.
+
+```bash
+claude mcp add kosha -- kosha-mcp
+```
+
+Tools and protocol details: [docs/mcp.md](docs/mcp.md).
 
 ## Supported providers
 
@@ -121,6 +126,7 @@ Supported transports: `openai`, `openai-compatible-http`, `ollama`. Anthropic, G
 | Vertex AI | API + gcloud | `GOOGLE_APPLICATION_CREDENTIALS`, ADC |
 | Ollama | local API | — (local) |
 | OpenRouter | API | `OPENROUTER_API_KEY` *(optional)* |
+| Vercel AI Gateway | `/v1/models` | `AI_GATEWAY_API_KEY`, `VERCEL_OIDC_TOKEN` *(public discovery, required for execution)* |
 | NVIDIA / Together / Fireworks / Groq / Cerebras / Cohere / DeepInfra / Perplexity | API | provider key env var |
 | DeepSeek / Mistral / Moonshot (Kimi) / GLM (Zhipu) / Z.AI / MiniMax | API | provider key env var |
 
@@ -128,11 +134,47 @@ Full credential setup: [docs/credentials.md](docs/credentials.md).
 
 ## Architecture
 
-<p align="center">
-  <img src="architecture.svg" alt="Kosha Architecture" width="720" />
-</p>
+Discovery layer talks to provider APIs and local catalogs. Enrichment layer fills pricing and context windows from the LiteLLM catalog and models.dev. Resilience layer (circuit breaker + stale-cache fallback + health tracker) keeps a flaky provider a degraded read, never a crash. Manifest layer writes a v1-stable JSON snapshot so downstream consumers read prices from one source instead of inventing their own. Proxy layer exposes an OpenAI-compatible endpoint that resolves `kosha:cheapest[…]` hints at request time, injects credentials, and forwards to the winning provider.
+
+## Development
+
+```bash
+pnpm install
+pnpm run build        # compile to dist/
+pnpm run typecheck    # tsc --noEmit
+pnpm run lint         # biome lint
+pnpm test             # vitest run
+pnpm run check        # lint + build + test
+```
+
+### Project layout
 
-Discovery layer talks to provider APIs and local catalogs. Enrichment layer fills pricing and context windows from the LiteLLM catalog and models.dev. Resilience layer (circuit breaker + stale-cache fallback + health tracker) keeps a flaky provider a degraded read, never a crash. Manifest layer writes a v1-stable JSON snapshot so downstream consumers — `tokmeter`, `chitragupta`, `ayuh` — read prices from one source instead of inventing their own. Proxy layer exposes an OpenAI-compatible endpoint that resolves `kosha:cheapest[…]` hints at request time, injects credentials, and forwards to the winning provider.
+```
+src/
+  cli.ts                 # CLI entry point
+  cli-commands.ts        # command implementations
+  registry.ts            # ModelRegistry public API
+  registry-runtime.ts    # discovery, enrichment, cache, manifest export
+  registry-query.ts      # model/role/capability queries
+  registry-selection.ts  # cheapest candidates, binding hints
+  registry-routing.ts    # route ranking strategies
+  discovery/             # provider discoverers
+  enrichment/            # LiteLLM pricing enrichment
+  credentials/           # credential resolution
+  proxy.ts               # OpenAI-compatible proxy
+  server.ts              # HTTP API server
+  mcp-server.ts          # MCP server
+  tally.ts               # zero-dependency token usage + cost tally
+  cost.ts                # ledger I/O, budget gates
+  types.ts               # shared types
+```
+
+### Adding a provider
+
+1. Create `src/discovery/<provider>.ts` implementing `ProviderDiscoverer`.
+2. Register it in `src/discovery/index.ts` `DISCOVERER_REGISTRY`.
+3. Add credential env vars to `src/provider-catalog.ts`.
+4. Add tests in `test/discovery/<provider>.test.ts`.
 
 ## Docs
 
@@ -141,9 +183,11 @@ Discovery layer talks to provider APIs and local catalogs. Enrichment layer fill
 | [Credentials](docs/credentials.md) | Env vars, CLI tools, and config files for every provider |
 | [CLI](docs/cli.md) | Commands, flags, examples |
 | [HTTP API](docs/api.md) | Endpoints, parameters, response schemas |
+| [MCP server](docs/mcp.md) | Tools, protocol negotiation, client setup |
 | [Configuration](docs/configuration.md) | Aliases, routing, enrichment, programmatic config |
 | [Architecture](docs/architecture.md) | Discovery flow, module map, adding providers |
 | [Resilience](docs/resilience.md) | Circuit breakers, stale cache, health |
+| [Operations](docs/operations.md) | Deployment sizing, metrics, spend ledger, recovery recipes |
 | [Security](docs/security.md) | Threat catalogue, runtime scanning, pre-commit hook |
 | [Discovery Plane v1](docs/discovery-plane-v1.md) | Stable daemon contract (deltas, SSE watch, binding hints) |
 
@@ -158,10 +202,6 @@ git tag -s vX.Y.Z -m "vX.Y.Z" && git push origin vX.Y.Z
 
 The workflow checks tag ↔ package.json match, builds, tests, publishes to npm, and creates the GitHub Release. Requires the `NPM_TOKEN` secret.
 
-## Credits
-
-[litellm](https://github.com/BerriAI/litellm) (pricing data) · [openrouter](https://openrouter.ai) · [ollama](https://ollama.ai) · [chitragupta](https://github.com/sriinnu/chitragupta) (registry patterns) · [takumi](https://github.com/sriinnu/takumi) (routing needs that drove kosha's creation).
-
 ## License
 
 MIT

package/dist/aliases.d.ts

@@ -9,7 +9,12 @@
  * Curated default aliases mapping short names to canonical model IDs.
  *
  * These are production-ready and cover the most commonly referenced
- * models across major providers. Updated February 2026.
+ * models across major providers. Updated September 2026.
+ *
+ * Convention: a bare family name (`opus`, `sonnet`, `gemini-pro`) always
+ * tracks the newest generally-available model in that family; a suffixed
+ * form (`opus-4.8`, `sonnet-4`) pins a generation and is kept for
+ * backward compatibility when the bare alias moves on.
  */
 export declare const DEFAULT_ALIASES: Readonly<Record<string, string>>;
 /**

package/dist/aliases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aliases.d.ts","sourceRoot":"","sources":["../src/aliases.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgD5D,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,aAAa;IACzB,sEAAsE;IACtE,OAAO,CAAC,OAAO,CAAsB;IAErC;;;OAGG;gBACS,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAUlD;;;OAGG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAIpC;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAI9C;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIhC;;OAEG;IACH,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAG7B"}
+{"version":3,"file":"aliases.d.ts","sourceRoot":"","sources":["../src/aliases.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsE5D,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,aAAa;IACzB,sEAAsE;IACtE,OAAO,CAAC,OAAO,CAAsB;IAErC;;;OAGG;IACH,YAAY,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAQjD;IAED;;;OAGG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEnC;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQxC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE/B;IAED;;OAEG;IACH,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5B;CACD"}

package/dist/aliases.js

@@ -9,27 +9,53 @@
  * Curated default aliases mapping short names to canonical model IDs.
  *
  * These are production-ready and cover the most commonly referenced
- * models across major providers. Updated February 2026.
+ * models across major providers. Updated September 2026.
+ *
+ * Convention: a bare family name (`opus`, `sonnet`, `gemini-pro`) always
+ * tracks the newest generally-available model in that family; a suffixed
+ * form (`opus-4.8`, `sonnet-4`) pins a generation and is kept for
+ * backward compatibility when the bare alias moves on.
  */
 export const DEFAULT_ALIASES = {
-    // ── Anthropic — Claude 4.6 family (latest as of Feb 2026) ──
-    "opus": "claude-opus-4-6",
-    "opus-4": "claude-opus-4-6",
-    "sonnet": "claude-sonnet-4-6",
+    // ── Anthropic — Claude 5 family (latest as of Sep 2026) ──
+    // Bare IDs, never date-suffixed: `claude-haiku-4-5` is the canonical
+    // form; the dated `claude-haiku-4-5-20251001` snapshot still resolves via
+    // normalizeModelId() for callers that pinned it.
+    "fable": "claude-fable-5-1",
+    "fable-5.1": "claude-fable-5-1",
+    "fable-5": "claude-fable-5",
+    "mythos": "claude-mythos-5-1",
+    "mythos-5.1": "claude-mythos-5-1",
+    "opus": "claude-opus-5",
+    "opus-5": "claude-opus-5",
+    "opus-4": "claude-opus-4-8",
+    "opus-4.8": "claude-opus-4-8",
+    "opus-4.7": "claude-opus-4-7",
+    "sonnet": "claude-sonnet-5",
+    "sonnet-5": "claude-sonnet-5",
     "sonnet-4": "claude-sonnet-4-6",
-    "haiku": "claude-haiku-4-5-20251001",
-    "haiku-4.5": "claude-haiku-4-5-20251001",
-    // ── OpenAI — latest reasoning and chat models ──
+    "sonnet-4.6": "claude-sonnet-4-6",
+    "haiku": "claude-haiku-4-5",
+    "haiku-4.5": "claude-haiku-4-5",
+    // ── OpenAI — GPT-5 family, GPT-4o, and o-series reasoning ──
+    "gpt5": "gpt-5",
+    "gpt5-mini": "gpt-5-mini",
+    "gpt5-nano": "gpt-5-nano",
+    "gpt5-pro": "gpt-5-pro",
+    "gpt4.1": "gpt-4.1",
     "gpt4o": "gpt-4o",
     "gpt4o-mini": "gpt-4o-mini",
     "o1": "o1",
     "o3": "o3",
     "o3-mini": "o3-mini",
     "o4-mini": "o4-mini",
-    // ── Google — Gemini 2.5 series ──
-    "gemini-pro": "gemini-2.5-pro-preview-05-06",
-    "gemini-flash": "gemini-2.5-flash-preview-04-17",
-    "gemini-flash-lite": "gemini-2.0-flash-lite",
+    // ── Google — Gemini 2.5 GA IDs (the dated -preview- IDs are retired) ──
+    "gemini-pro": "gemini-2.5-pro",
+    "gemini-flash": "gemini-2.5-flash",
+    "gemini-flash-lite": "gemini-2.5-flash-lite",
+    // ── Moonshot — Kimi family ──
+    "kimi": "kimi-k3",
+    "kimi-k3": "kimi-k3",
     // ── Local — latest popular open-weight models for Ollama ──
     "qwen": "qwen3:8b",
     "llama": "llama3.3:latest",

package/dist/aliases.js.map

@@ -1 +1 @@
-{"version":3,"file":"aliases.js","sourceRoot":"","sources":["../src/aliases.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqC;IAChE,8DAA8D;IAC9D,MAAM,EAAE,iBAAiB;IACzB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,UAAU,EAAE,mBAAmB;IAC/B,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,2BAA2B;IAExC,kDAAkD;IAClD,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,aAAa;IAC3B,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,SAAS;IAEpB,mCAAmC;IACnC,YAAY,EAAE,8BAA8B;IAC5C,cAAc,EAAE,gCAAgC;IAChD,mBAAmB,EAAE,uBAAuB;IAE5C,6DAA6D;IAC7D,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,iBAAiB;IAC1B,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,oBAAoB;IAEhC,sDAAsD;IACtD,gBAAgB,EAAE,yCAAyC;IAC3D,gBAAgB,EAAE,wCAAwC;IAC1D,eAAe,EAAE,sCAAsC;IAEvD,mCAAmC;IACnC,eAAe,EAAE,sBAAsB;IACvC,eAAe,EAAE,sBAAsB;IACvC,mBAAmB,EAAE,kBAAkB;IACvC,SAAS,EAAE,sBAAsB;IAEjC,8BAA8B;IAC9B,YAAY,EAAE,yBAAyB;IACvC,cAAc,EAAE,oBAAoB;IAEpC,gEAAgE;IAChE,aAAa,EAAE,wBAAwB;IACvC,aAAa,EAAE,wBAAwB;IACvC,OAAO,EAAE,kBAAkB;IAC3B,cAAc,EAAE,sBAAsB;CACtC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACzB,sEAAsE;IAC9D,OAAO,CAAsB;IAErC;;;OAGG;IACH,YAAY,aAAsC;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAExD,IAAI,aAAa,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,WAAmB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAe;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAa,EAAE,OAAe;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,GAAG;QACF,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;CACD"}
+{"version":3,"file":"aliases.js","sourceRoot":"","sources":["../src/aliases.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqC;IAChE,4DAA4D;IAC5D,qEAAqE;IACrE,0EAA0E;IAC1E,iDAAiD;IACjD,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EAAE,kBAAkB;IAC/B,SAAS,EAAE,gBAAgB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,YAAY,EAAE,mBAAmB;IACjC,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,eAAe;IACzB,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,mBAAmB;IAC/B,YAAY,EAAE,mBAAmB;IACjC,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EAAE,kBAAkB;IAE/B,8DAA8D;IAC9D,MAAM,EAAE,OAAO;IACf,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,aAAa;IAC3B,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,SAAS;IAEpB,yEAAyE;IACzE,YAAY,EAAE,gBAAgB;IAC9B,cAAc,EAAE,kBAAkB;IAClC,mBAAmB,EAAE,uBAAuB;IAE5C,+BAA+B;IAC/B,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,SAAS;IAEpB,6DAA6D;IAC7D,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,iBAAiB;IAC1B,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,oBAAoB;IAEhC,sDAAsD;IACtD,gBAAgB,EAAE,yCAAyC;IAC3D,gBAAgB,EAAE,wCAAwC;IAC1D,eAAe,EAAE,sCAAsC;IAEvD,mCAAmC;IACnC,eAAe,EAAE,sBAAsB;IACvC,eAAe,EAAE,sBAAsB;IACvC,mBAAmB,EAAE,kBAAkB;IACvC,SAAS,EAAE,sBAAsB;IAEjC,8BAA8B;IAC9B,YAAY,EAAE,yBAAyB;IACvC,cAAc,EAAE,oBAAoB;IAEpC,gEAAgE;IAChE,aAAa,EAAE,wBAAwB;IACvC,aAAa,EAAE,wBAAwB;IACvC,OAAO,EAAE,kBAAkB;IAC3B,cAAc,EAAE,sBAAsB;CACtC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACzB,sEAAsE;IAC9D,OAAO,CAAsB;IAErC;;;OAGG;IACH,YAAY,aAAsC;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAExD,IAAI,aAAa,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,WAAmB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAe;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAa,EAAE,OAAe;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,GAAG;QACF,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;CACD"}

package/dist/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,UAAU,UAAU,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,UAAU;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,CAAC,EAAE,MAAM;IAI7B;;;OAGG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAmBxD;;;;;OAKG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjD;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B;;OAEG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAQpD;;;OAGG;IACH,OAAO,CAAC,SAAS;IAKjB;;OAEG;YACW,SAAS;CAGvB"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,UAAU,UAAU,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,MAAM,CAAC;CAClB;AAqBD;;;;;GAKG;AACH,qBAAa,UAAU;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,YAAY,QAAQ,CAAC,EAAE,MAAM,EAE5B;IAED;;;OAGG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAyBvD;IAED;;;;;OAKG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAehD;IAED;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3C;IAED;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED;;OAEG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;IAMD;;;OAGG;IACH,OAAO,CAAC,SAAS;IAKjB;;OAEG;YACW,SAAS;CAGvB"}

package/dist/cache.js

@@ -6,11 +6,28 @@
  * Each cache key maps to a `{key}.json` file inside the cache directory.
  * @module
  */
-import { mkdir, readFile, readdir, rename, unlink, writeFile } from "fs/promises";
+import { mkdir, readFile, readdir, rename, stat, unlink, writeFile } from "fs/promises";
 import { randomBytes } from "crypto";
 import { homedir } from "os";
 import { join } from "path";
 import { assertCleanPayload } from "./security.js";
+/**
+ * Hard ceiling on a single cache file before we even attempt to parse it.
+ * A legitimate full-registry snapshot is a few hundred KB; anything past
+ * this is either corruption or a hostile payload crafted to exhaust memory
+ * (a "JSON bomb"). We reject it as a cache miss rather than feeding it to
+ * `JSON.parse`, which buffers and parses the whole string eagerly.
+ */
+const MAX_CACHE_FILE_BYTES = 25 * 1024 * 1024;
+/**
+ * Strip CR/LF (and other control chars) from a cache key before it is
+ * interpolated into a log line. A key can derive from a CLI/HTTP-supplied
+ * provider id (`provider_<id>`), so logging it verbatim would let crafted
+ * input forge extra log records (log injection / CWE-117).
+ */
+function sanitizeKeyForLog(key) {
+    return key.replace(/[\r\n\t]/g, "").slice(0, 200);
+}
 /**
  * Simple file-based JSON cache with TTL support.
  * Stores discovered provider data to avoid re-fetching on every startup.
@@ -29,6 +46,12 @@ export class KoshaCache {
     async get(key) {
         try {
             const filePath = this.keyToPath(key);
+            const { size } = await stat(filePath);
+            if (size > MAX_CACHE_FILE_BYTES) {
+                console.warn(`KoshaCache: cache file for key "${sanitizeKeyForLog(key)}" is ${size} bytes (> ${MAX_CACHE_FILE_BYTES}); refusing to parse and invalidating`);
+                await this.invalidate(key);
+                return null;
+            }
             const raw = await readFile(filePath, "utf-8");
             const entry = JSON.parse(raw);
             assertCleanPayload(entry, `cache/${key}`);
@@ -41,7 +64,7 @@ export class KoshaCache {
                 await this.invalidate(key);
             }
             else if (err instanceof SyntaxError) {
-                console.warn(`KoshaCache: corrupted cache file for key "${key}"`);
+                console.warn(`KoshaCache: corrupted cache file for key "${sanitizeKeyForLog(key)}"`);
             }
             return null;
         }

package/dist/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAM,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOnD;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IACL,QAAQ,CAAS;IAElC,YAAY,QAAiB;QAC5B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAI,GAAW;QACvB,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAC/C,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC;QACd,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACvB,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,iFAAiF;gBACjF,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,6CAA6C,GAAG,GAAG,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,IAAO;QAChC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAkB;YAC5B,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACpE,IAAI,CAAC;YACJ,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW;QAC3B,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,+BAA+B;QAChC,CAAC;IACF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACV,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACR,8BAA8B;QAC/B,CAAC;IACF,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,SAAiB,EAAE,KAAa;QACzC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,CAAC;IACvC,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;OAGG;IACK,SAAS,CAAC,GAAW;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACtB,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;CACD"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAM,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOnD;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IACL,QAAQ,CAAS;IAElC,YAAY,QAAiB;QAC5B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAI,GAAW;QACvB,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,IAAI,GAAG,oBAAoB,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CACX,mCAAmC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,oBAAoB,uCAAuC,CAC7I,CAAC;gBACF,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACb,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAC/C,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC;QACd,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACvB,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,iFAAiF;gBACjF,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,6CAA6C,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,IAAO;QAChC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAkB;YAC5B,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACpE,IAAI,CAAC;YACJ,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW;QAC3B,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,+BAA+B;QAChC,CAAC;IACF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACV,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACR,8BAA8B;QAC/B,CAAC;IACF,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,SAAiB,EAAE,KAAa;QACzC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,CAAC;IACvC,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;OAGG;IACK,SAAS,CAAC,GAAW;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACtB,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;CACD"}

package/dist/claude-generation.d.ts

@@ -0,0 +1,59 @@
+/**
+ * kosha-discovery — Claude generation parsing and per-generation behaviour.
+ *
+ * One source of truth for "which Claude is this and what does it accept",
+ * shared by the catalog feature inference (`model-features.ts`) and the
+ * proxy's wire translator (`wire-anthropic.ts`). Keeping it in one module
+ * means an OpenRouter-style `anthropic/claude-sonnet-4.6`, a Bedrock-style
+ * `anthropic.claude-opus-4-8-v1:0`, and the bare `claude-opus-4-8` all
+ * classify identically everywhere.
+ * @module
+ */
+export interface ClaudeGeneration {
+    family: "opus" | "sonnet" | "haiku" | "fable" | "mythos";
+    major: number;
+    minor: number;
+}
+/**
+ * Parse the generation out of a family-first Claude ID such as
+ * `claude-opus-4-8`, `claude-sonnet-5`, `claude-fable-5-1`, a dated
+ * `claude-haiku-4-5-20251001`, or a prefixed / dotted variant. Legacy
+ * version-first IDs (`claude-3-5-sonnet-…`, `claude-2.1`) and non-Claude IDs
+ * return `undefined`.
+ */
+export declare function parseClaudeGeneration(modelId: string): ClaudeGeneration | undefined;
+/** How a Claude model treats `temperature` / `top_p`. */
+export type SamplingSupport = "both" | "one" | "none";
+/**
+ * Sampling parameters were removed on Opus 4.7 and every later model (Opus
+ * 4.8, Opus 5, Sonnet 5, Fable, Mythos): sending them returns a 400. Every
+ * Claude 4.x model accepts at most one of `temperature` / `top_p` (sending
+ * both is a 400). Claude 3.x and unrecognized IDs accept both.
+ */
+export declare function claudeSamplingSupport(modelId: string): SamplingSupport;
+/** Anthropic's accepted `temperature` range; OpenAI's is 0..2. */
+export declare const CLAUDE_TEMPERATURE_MAX = 1;
+export type ClaudeEffort = "low" | "medium" | "high" | "xhigh" | "max";
+/**
+ * Effort levels a generation accepts under `output_config.effort`; empty when
+ * effort is unsupported. `xhigh` arrived with Opus 4.7; `max` with 4.6; in
+ * the 4.5 generation only Opus 4.5 had an effort parameter at all (Sonnet
+ * 4.5 and Haiku 4.5 reject it).
+ */
+export declare function claudeEffortLadder(modelId: string): readonly ClaudeEffort[];
+/**
+ * Last-assistant-turn prefill returns a 400 on Opus 4.6 / Sonnet 4.6 and every
+ * later model. Older generations still accept a trailing assistant message.
+ */
+export declare function claudeSupportsPrefill(modelId: string): boolean;
+/**
+ * Native JSON-schema structured outputs (`output_config.format`) shipped with
+ * the 4.5 generation (Sonnet 4.5, Haiku 4.5, Opus 4.1) and every model since.
+ */
+export declare function claudeSupportsNativeJsonSchema(modelId: string): boolean;
+/**
+ * Claude Fable 5.1 and Claude Mythos 5.1 return a 400 for forced tool use
+ * (`tool_choice` `any` / `tool`); everything else still honours it.
+ */
+export declare function claudeSupportsForcedToolChoice(modelId: string): boolean;
+//# sourceMappingURL=claude-generation.d.ts.map

package/dist/claude-generation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-generation.d.ts","sourceRoot":"","sources":["../src/claude-generation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAgBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAUnF;AAMD,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAEtD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAMtE;AAED,kEAAkE;AAClE,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,YAAY,EAAE,CAO3E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAKvE;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAKvE"}

package/dist/claude-generation.js

@@ -0,0 +1,117 @@
+/**
+ * kosha-discovery — Claude generation parsing and per-generation behaviour.
+ *
+ * One source of truth for "which Claude is this and what does it accept",
+ * shared by the catalog feature inference (`model-features.ts`) and the
+ * proxy's wire translator (`wire-anthropic.ts`). Keeping it in one module
+ * means an OpenRouter-style `anthropic/claude-sonnet-4.6`, a Bedrock-style
+ * `anthropic.claude-opus-4-8-v1:0`, and the bare `claude-opus-4-8` all
+ * classify identically everywhere.
+ * @module
+ */
+/**
+ * Normalize the many spellings of a Claude ID down to the bare family-first
+ * form: strip a `vendor/` or `anthropic.` prefix, a Bedrock `-v1:0` suffix,
+ * and turn dotted versions (`4.6`) into dashed (`4-6`).
+ */
+function normalizeClaudeId(modelId) {
+    return modelId
+        .toLowerCase()
+        .replace(/^.*\//, "")
+        .replace(/^anthropic\./, "")
+        .replace(/-v\d+:\d+$/, "")
+        .replace(/\./g, "-");
+}
+/**
+ * Parse the generation out of a family-first Claude ID such as
+ * `claude-opus-4-8`, `claude-sonnet-5`, `claude-fable-5-1`, a dated
+ * `claude-haiku-4-5-20251001`, or a prefixed / dotted variant. Legacy
+ * version-first IDs (`claude-3-5-sonnet-…`, `claude-2.1`) and non-Claude IDs
+ * return `undefined`.
+ */
+export function parseClaudeGeneration(modelId) {
+    // Minor is 1-2 digits so an 8-digit date suffix (`-20250514`) is never
+    // mistaken for a minor version.
+    const m = /^claude-(opus|sonnet|haiku|fable|mythos)-(\d+)(?:-(\d{1,2}))?(?:-\d{8})?$/.exec(normalizeClaudeId(modelId));
+    if (!m)
+        return undefined;
+    return {
+        family: m[1],
+        major: Number(m[2]),
+        minor: m[3] !== undefined ? Number(m[3]) : 0,
+    };
+}
+function atLeast(gen, major, minor) {
+    return gen.major > major || (gen.major === major && gen.minor >= minor);
+}
+/**
+ * Sampling parameters were removed on Opus 4.7 and every later model (Opus
+ * 4.8, Opus 5, Sonnet 5, Fable, Mythos): sending them returns a 400. Every
+ * Claude 4.x model accepts at most one of `temperature` / `top_p` (sending
+ * both is a 400). Claude 3.x and unrecognized IDs accept both.
+ */
+export function claudeSamplingSupport(modelId) {
+    const gen = parseClaudeGeneration(modelId);
+    if (!gen)
+        return "both";
+    if (atLeast(gen, 4, 7))
+        return "none";
+    if (gen.major >= 4)
+        return "one";
+    return "both";
+}
+/** Anthropic's accepted `temperature` range; OpenAI's is 0..2. */
+export const CLAUDE_TEMPERATURE_MAX = 1;
+/**
+ * Effort levels a generation accepts under `output_config.effort`; empty when
+ * effort is unsupported. `xhigh` arrived with Opus 4.7; `max` with 4.6; in
+ * the 4.5 generation only Opus 4.5 had an effort parameter at all (Sonnet
+ * 4.5 and Haiku 4.5 reject it).
+ */
+export function claudeEffortLadder(modelId) {
+    const gen = parseClaudeGeneration(modelId);
+    if (!gen)
+        return [];
+    if (atLeast(gen, 4, 7))
+        return ["low", "medium", "high", "xhigh", "max"];
+    if (atLeast(gen, 4, 6))
+        return ["low", "medium", "high", "max"];
+    if (atLeast(gen, 4, 5))
+        return gen.family === "opus" ? ["low", "medium", "high"] : [];
+    return [];
+}
+/**
+ * Last-assistant-turn prefill returns a 400 on Opus 4.6 / Sonnet 4.6 and every
+ * later model. Older generations still accept a trailing assistant message.
+ */
+export function claudeSupportsPrefill(modelId) {
+    const gen = parseClaudeGeneration(modelId);
+    if (!gen)
+        return true;
+    return !atLeast(gen, 4, 6);
+}
+/**
+ * Native JSON-schema structured outputs (`output_config.format`) shipped with
+ * the 4.5 generation (Sonnet 4.5, Haiku 4.5, Opus 4.1) and every model since.
+ */
+export function claudeSupportsNativeJsonSchema(modelId) {
+    const gen = parseClaudeGeneration(modelId);
+    if (!gen)
+        return false;
+    if (atLeast(gen, 4, 5))
+        return true;
+    return gen.family === "opus" && gen.major === 4 && gen.minor === 1;
+}
+/**
+ * Claude Fable 5.1 and Claude Mythos 5.1 return a 400 for forced tool use
+ * (`tool_choice` `any` / `tool`); everything else still honours it.
+ */
+export function claudeSupportsForcedToolChoice(modelId) {
+    const gen = parseClaudeGeneration(modelId);
+    if (!gen)
+        return true;
+    if (gen.family !== "fable" && gen.family !== "mythos")
+        return true;
+    return !atLeast(gen, 5, 1);
+}
+//# sourceMappingURL=claude-generation.js.map

package/dist/claude-generation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-generation.js","sourceRoot":"","sources":["../src/claude-generation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACzC,OAAO,OAAO;SACZ,WAAW,EAAE;SACb,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,CAAC,GAAG,2EAA2E,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACvH,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,OAAO;QACN,MAAM,EAAE,CAAC,CAAC,CAAC,CAA+B;QAC1C,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC5C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAqB,EAAE,KAAa,EAAE,KAAa;IACnE,OAAO,GAAG,CAAC,KAAK,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;AACzE,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IACxB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAIxC;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC7D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC7D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC"}

package/dist/cli-cmd-doctor.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `kosha doctor` — surface deprecation warnings and provider health at a
+ * glance. Pure projection over the registry: it reports what kosha already
+ * knows (deprecationDate, replacedBy, breaker state, routing reliability)
+ * without making any extra network calls.
+ *
+ * Pair with `kosha refresh` if you want the freshest deprecation metadata
+ * from each provider.
+ * @module
+ */
+import type { ModelRegistry } from "./registry.js";
+/** Exit code `doctor` uses to fail a CI run without looking like a crash. */
+export declare const DOCTOR_CI_EXIT_CODE = 2;
+/** Default deprecation window in days when `--deprecation-window` is absent. */
+export declare const DOCTOR_DEFAULT_DEPRECATION_WINDOW = 30;
+export declare function cmdDoctor(registry: ModelRegistry, flags: Record<string, string | boolean>): Promise<void>;
+//# sourceMappingURL=cli-cmd-doctor.d.ts.map

package/dist/cli-cmd-doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-cmd-doctor.d.ts","sourceRoot":"","sources":["../src/cli-cmd-doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAanD,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,gFAAgF;AAChF,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAsBpD,wBAAsB,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC/G"}