@sriinnu/kosha-discovery 1.5.1 → 1.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +65 -7
- package/dist/aliases.d.ts.map +1 -1
- package/dist/aliases.js +24 -0
- package/dist/aliases.js.map +1 -1
- package/dist/cost.d.ts.map +1 -1
- package/dist/cost.js +9 -1
- package/dist/cost.js.map +1 -1
- package/dist/credentials/resolver.d.ts +9 -0
- package/dist/credentials/resolver.d.ts.map +1 -1
- package/dist/credentials/resolver.js +21 -2
- package/dist/credentials/resolver.js.map +1 -1
- package/dist/discovery/generic-openai.d.ts +109 -0
- package/dist/discovery/generic-openai.d.ts.map +1 -0
- package/dist/discovery/generic-openai.js +366 -0
- package/dist/discovery/generic-openai.js.map +1 -0
- package/dist/discovery/index.d.ts +2 -0
- package/dist/discovery/index.d.ts.map +1 -1
- package/dist/discovery/index.js +15 -2
- package/dist/discovery/index.js.map +1 -1
- package/dist/discovery/litellm-seed.d.ts.map +1 -1
- package/dist/discovery/litellm-seed.js +7 -0
- package/dist/discovery/litellm-seed.js.map +1 -1
- package/dist/discovery/minimax.d.ts +12 -4
- package/dist/discovery/minimax.d.ts.map +1 -1
- package/dist/discovery/minimax.js +18 -4
- package/dist/discovery/minimax.js.map +1 -1
- package/dist/discovery/modelsdev-catalog.d.ts +10 -2
- package/dist/discovery/modelsdev-catalog.d.ts.map +1 -1
- package/dist/discovery/modelsdev-catalog.js +24 -5
- package/dist/discovery/modelsdev-catalog.js.map +1 -1
- package/dist/discovery/modelsdev-seed.d.ts.map +1 -1
- package/dist/discovery/modelsdev-seed.js +24 -1
- package/dist/discovery/modelsdev-seed.js.map +1 -1
- package/dist/discovery/moonshot.d.ts +14 -4
- package/dist/discovery/moonshot.d.ts.map +1 -1
- package/dist/discovery/moonshot.js +20 -4
- package/dist/discovery/moonshot.js.map +1 -1
- package/dist/discovery/openai-compatible.d.ts.map +1 -1
- package/dist/discovery/openai-compatible.js +41 -3
- package/dist/discovery/openai-compatible.js.map +1 -1
- package/dist/discovery/static-direct.d.ts +32 -2
- package/dist/discovery/static-direct.d.ts.map +1 -1
- package/dist/discovery/static-direct.js +128 -9
- package/dist/discovery/static-direct.js.map +1 -1
- package/dist/discovery/typesafe.d.ts +41 -0
- package/dist/discovery/typesafe.d.ts.map +1 -0
- package/dist/discovery/typesafe.js +112 -0
- package/dist/discovery/typesafe.js.map +1 -0
- package/dist/discovery-contract.d.ts +1 -1
- package/dist/discovery-contract.d.ts.map +1 -1
- package/dist/discovery-contract.js +12 -0
- package/dist/discovery-contract.js.map +1 -1
- package/dist/discovery-routes.js +1 -1
- package/dist/discovery-routes.js.map +1 -1
- package/dist/enrichment/litellm-catalog.d.ts +12 -1
- package/dist/enrichment/litellm-catalog.d.ts.map +1 -1
- package/dist/enrichment/litellm-catalog.js +25 -4
- package/dist/enrichment/litellm-catalog.js.map +1 -1
- package/dist/mcp-server.d.ts +1 -1
- package/dist/mcp-server.d.ts.map +1 -1
- package/dist/mcp-server.js +1 -1
- package/dist/mcp-server.js.map +1 -1
- package/dist/provider-catalog.d.ts.map +1 -1
- package/dist/provider-catalog.js +298 -2
- package/dist/provider-catalog.js.map +1 -1
- package/dist/registry-runtime.d.ts +2 -2
- package/dist/registry-runtime.d.ts.map +1 -1
- package/dist/registry-runtime.js +2 -0
- package/dist/registry-runtime.js.map +1 -1
- package/dist/registry-selection.js +8 -0
- package/dist/registry-selection.js.map +1 -1
- package/dist/security.d.ts +35 -1
- package/dist/security.d.ts.map +1 -1
- package/dist/security.js +195 -16
- package/dist/security.js.map +1 -1
- package/dist/tally.d.ts +7 -0
- package/dist/tally.d.ts.map +1 -1
- package/dist/tally.js +18 -2
- package/dist/tally.js.map +1 -1
- package/dist/types.d.ts +19 -2
- package/dist/types.d.ts.map +1 -1
- package/package.json +10 -1
- package/server.json +73 -0
package/dist/security.d.ts
CHANGED
|
@@ -30,7 +30,7 @@ export interface ThreatHit {
|
|
|
30
30
|
*
|
|
31
31
|
* @returns The first {@link ThreatHit} found, or `undefined` if clean.
|
|
32
32
|
*/
|
|
33
|
-
export declare function scanPayload(obj: unknown, path?: string): ThreatHit | undefined;
|
|
33
|
+
export declare function scanPayload(obj: unknown, path?: string, depth?: number): ThreatHit | undefined;
|
|
34
34
|
/**
|
|
35
35
|
* Throw if the given payload contains **any** security threat — base64,
|
|
36
36
|
* leaked credentials, script injection, shell injection, data URIs,
|
|
@@ -41,4 +41,38 @@ export declare function scanPayload(obj: unknown, path?: string): ThreatHit | un
|
|
|
41
41
|
* @throws {Error} with the threat name and offending path.
|
|
42
42
|
*/
|
|
43
43
|
export declare function assertCleanPayload(data: unknown, source: string): void;
|
|
44
|
+
/** One entry dropped by {@link quarantineEntries}. */
|
|
45
|
+
export interface QuarantinedEntry {
|
|
46
|
+
/** Top-level key that was dropped. */
|
|
47
|
+
key: string;
|
|
48
|
+
/** Threat name that tripped. */
|
|
49
|
+
threat: string;
|
|
50
|
+
/** Path of the offending value inside the dropped entry. */
|
|
51
|
+
path: string;
|
|
52
|
+
}
|
|
53
|
+
/** Outcome of a per-entry quarantine pass. */
|
|
54
|
+
export interface QuarantineResult {
|
|
55
|
+
/** Entries that scanned clean. */
|
|
56
|
+
clean: Record<string, unknown>;
|
|
57
|
+
/** Entries that were dropped, with the reason. */
|
|
58
|
+
dropped: QuarantinedEntry[];
|
|
59
|
+
}
|
|
60
|
+
/**
|
|
61
|
+
* Scan a keyed catalog entry-by-entry, dropping the entries that trip a threat
|
|
62
|
+
* instead of rejecting the whole payload.
|
|
63
|
+
*
|
|
64
|
+
* {@link assertCleanPayload} is the right call for a payload kosha depends on
|
|
65
|
+
* in full — a provider's own `/v1/models` response, a cache file it wrote. It
|
|
66
|
+
* is the wrong call for the big third-party catalogs (models.dev, LiteLLM),
|
|
67
|
+
* where one unusual model name from any of 200+ contributors would otherwise
|
|
68
|
+
* take out every keyless fallback at once. Here, the bad entry is dropped and
|
|
69
|
+
* named, and the rest of the catalog still loads.
|
|
70
|
+
*
|
|
71
|
+
* A feed where more than {@link MAX_QUARANTINE_RATIO} of entries trip is not
|
|
72
|
+
* one bad row — that still throws.
|
|
73
|
+
*
|
|
74
|
+
* @throws {Error} when the payload is not a plain object, or when too much of
|
|
75
|
+
* it is unclean to be a localized problem.
|
|
76
|
+
*/
|
|
77
|
+
export declare function quarantineEntries(data: unknown, source: string): QuarantineResult;
|
|
44
78
|
//# sourceMappingURL=security.d.ts.map
|
package/dist/security.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;
|
|
1
|
+
{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA2RH,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACd;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,SAAK,EAAE,KAAK,SAAI,GAAG,SAAS,GAAG,SAAS,CAqCrF;AAMD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAOtE;AAMD,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAChC,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;CACb;AAED,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAChC,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,kDAAkD;IAClD,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AASD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAmCjF"}
|
package/dist/security.js
CHANGED
|
@@ -22,20 +22,119 @@
|
|
|
22
22
|
/** 32+ chars of pure base64 alphabet with optional `=` padding. */
|
|
23
23
|
const BASE64_PATTERN = /^[A-Za-z0-9+/]{32,}={0,2}$/;
|
|
24
24
|
/**
|
|
25
|
-
*
|
|
26
|
-
*
|
|
27
|
-
*
|
|
28
|
-
*
|
|
29
|
-
*
|
|
30
|
-
*
|
|
31
|
-
*
|
|
32
|
-
*
|
|
33
|
-
*
|
|
34
|
-
*
|
|
35
|
-
*
|
|
25
|
+
* Base64 of random binary data draws near-uniformly from a 64-character
|
|
26
|
+
* alphabet, so a 32-character run contains an uppercase letter, a lowercase
|
|
27
|
+
* letter, *and* a digit with overwhelming probability. Human-authored
|
|
28
|
+
* identifiers that happen to live in the base64 alphabet — URL paths,
|
|
29
|
+
* namespaced model IDs, slugs — routinely lack one of the three.
|
|
30
|
+
*
|
|
31
|
+
* Both requirements were added after real false positives:
|
|
32
|
+
*
|
|
33
|
+
* - Mixed case, for OpenRouter's `links.details =
|
|
34
|
+
* "/api/v1/models/openrouter/free/endpoints"` — 40 chars of `[A-Za-z0-9/]`,
|
|
35
|
+
* plainly a URL.
|
|
36
|
+
* - A digit, for the models.dev key `deepinfra/thinkingmachines/Inkling`
|
|
37
|
+
* — 33 chars, mixed case, no digit. That single key inside one third-party
|
|
38
|
+
* aggregator's entry made the scan reject the *entire* 222-provider
|
|
39
|
+
* catalog, which silently disabled every keyless provider fallback kosha
|
|
40
|
+
* has. A new model shipping upstream should never be able to do that.
|
|
41
|
+
*
|
|
42
|
+
* Measured cost of requiring a digit (200k samples each): a random 32-byte
|
|
43
|
+
* blob's base64 lacks a digit 0.06% of the time, and a `sk-`-shaped ASCII key
|
|
44
|
+
* never did — 0 in 200,000 — because base64 of ASCII text is digit-dense. So
|
|
45
|
+
* the narrowing gives up essentially nothing against the case that matters,
|
|
46
|
+
* and {@link decodesToThreat} covers the remainder by decoding rather than
|
|
47
|
+
* guessing from shape.
|
|
36
48
|
*/
|
|
37
49
|
const BASE64_HAS_UPPER = /[A-Z]/;
|
|
38
50
|
const BASE64_HAS_LOWER = /[a-z]/;
|
|
51
|
+
const BASE64_HAS_DIGIT = /[0-9]/;
|
|
52
|
+
/** Longest base64 candidate worth decoding. Bounds the work per value. */
|
|
53
|
+
const MAX_DECODE_LENGTH = 8192;
|
|
54
|
+
/**
|
|
55
|
+
* True when a base64-alphabet string is genuinely suspicious.
|
|
56
|
+
*
|
|
57
|
+
* Two independent signals, either of which is enough:
|
|
58
|
+
*
|
|
59
|
+
* 1. **Statistical.** Upper, lower *and* digit present — what random binary
|
|
60
|
+
* data looks like once encoded, and what hand-written identifiers usually
|
|
61
|
+
* are not.
|
|
62
|
+
* 2. **Semantic.** The string decodes to text that trips a credential,
|
|
63
|
+
* script, or shell pattern. This is the signal that actually matters: it
|
|
64
|
+
* catches an encoded secret regardless of how the characters happen to be
|
|
65
|
+
* distributed, so narrowing (1) to stop rejecting namespaced model IDs
|
|
66
|
+
* does not narrow what kosha catches. A model path like
|
|
67
|
+
* `deepinfra/thinkingmachines/Inkling` decodes to binary noise and stays
|
|
68
|
+
* clean; an encoded `sk-…` key trips (2) even with no digit in sight.
|
|
69
|
+
*/
|
|
70
|
+
function looksLikeBase64(value) {
|
|
71
|
+
if (!BASE64_PATTERN.test(value))
|
|
72
|
+
return false;
|
|
73
|
+
if (BASE64_HAS_UPPER.test(value) && BASE64_HAS_LOWER.test(value) && BASE64_HAS_DIGIT.test(value)) {
|
|
74
|
+
return true;
|
|
75
|
+
}
|
|
76
|
+
return decodesToThreat(value);
|
|
77
|
+
}
|
|
78
|
+
/**
|
|
79
|
+
* Decode a base64 candidate and report whether the plaintext carries a
|
|
80
|
+
* credential, script, or shell payload.
|
|
81
|
+
*
|
|
82
|
+
* Only these three families are re-checked: they are the ones an attacker has
|
|
83
|
+
* a reason to hide behind an encoding. Re-running the whole registry (base64
|
|
84
|
+
* included) would recurse.
|
|
85
|
+
*/
|
|
86
|
+
function decodesToThreat(value) {
|
|
87
|
+
if (value.length > MAX_DECODE_LENGTH)
|
|
88
|
+
return false;
|
|
89
|
+
let decoded;
|
|
90
|
+
try {
|
|
91
|
+
decoded = Buffer.from(value, "base64").toString("utf8");
|
|
92
|
+
}
|
|
93
|
+
catch {
|
|
94
|
+
return false;
|
|
95
|
+
}
|
|
96
|
+
if (decoded.length === 0)
|
|
97
|
+
return false;
|
|
98
|
+
return (CREDENTIAL_PATTERNS.some((pattern) => pattern.test(decoded)) ||
|
|
99
|
+
SCRIPT_PATTERN.test(decoded) ||
|
|
100
|
+
JAVASCRIPT_URI_PATTERN.test(decoded) ||
|
|
101
|
+
SHELL_INJECTION_PATTERNS.some((pattern) => pattern.test(decoded)));
|
|
102
|
+
}
|
|
103
|
+
/**
|
|
104
|
+
* C0 and C1 control characters plus DEL, excluding tab, newline, and carriage
|
|
105
|
+
* return, which appear legitimately in prose fields.
|
|
106
|
+
*
|
|
107
|
+
* This is the ANSI-injection guard. kosha prints catalog-derived model IDs and
|
|
108
|
+
* names straight to a terminal, so an ESC in an upstream model name is enough
|
|
109
|
+
* to move the cursor, clear the screen, rewrite earlier output, or set the
|
|
110
|
+
* window title — a provider could make `kosha list` display a different model
|
|
111
|
+
* than the one it routes to. Catching it at ingestion covers every print site
|
|
112
|
+
* at once, and the CLI, HTTP API, and MCP server all inherit it.
|
|
113
|
+
*/
|
|
114
|
+
// Built through `new RegExp` from escape sequences rather than written as a
|
|
115
|
+
// literal, matching how NULL_BYTE_PATTERN above is constructed: the ranges are
|
|
116
|
+
// resolved by the regex parser, so no control character appears in the source.
|
|
117
|
+
const CONTROL_CHAR_PATTERN = new RegExp("[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f-\\u009f]");
|
|
118
|
+
/**
|
|
119
|
+
* Bidirectional overrides, embeddings, and isolates — the "trojan source"
|
|
120
|
+
* family (CVE-2021-42574). These reorder how text renders without changing the
|
|
121
|
+
* bytes, so a model ID can display as one thing and resolve as another.
|
|
122
|
+
*
|
|
123
|
+
* Scoped deliberately to U+202A–U+202E and U+2066–U+2069, the controls that
|
|
124
|
+
* actually reorder. The zero-width formatting characters are NOT here, and that
|
|
125
|
+
* is the point:
|
|
126
|
+
*
|
|
127
|
+
* - U+200C ZWNJ and U+200D ZWJ are *required* for correct rendering of
|
|
128
|
+
* Devanagari, Persian, and Arabic, and for emoji sequences. A registry named
|
|
129
|
+
* कोश has no business calling them attacks.
|
|
130
|
+
* - U+2060 WORD JOINER, U+200B ZWSP, and U+FEFF BOM are typographic. Flagging
|
|
131
|
+
* them cost 372 models: OpenAI's own description of GPT-5.2-Codex carries a
|
|
132
|
+
* WORD JOINER, which made the scan reject Vercel AI Gateway's entire payload.
|
|
133
|
+
*
|
|
134
|
+
* That is the same failure this module was just fixed for — an over-broad rule
|
|
135
|
+
* failing closed over a whole feed — so the rule now names only what reorders.
|
|
136
|
+
*/
|
|
137
|
+
const BIDI_OVERRIDE_PATTERN = /[\u202a-\u202e\u2066-\u2069]/;
|
|
39
138
|
/** Known credential prefixes — each must be followed by enough chars to be a real key. */
|
|
40
139
|
const CREDENTIAL_PATTERNS = [
|
|
41
140
|
/\bsk-[A-Za-z0-9]{20,}/, // OpenAI API keys
|
|
@@ -90,6 +189,13 @@ const HEX_BLOB_PATTERN = /^(0x)?[0-9a-fA-F]{64,}$/;
|
|
|
90
189
|
const PROTO_POLLUTION_KEY = "__proto__";
|
|
91
190
|
/** Maximum reasonable string length for model metadata values. */
|
|
92
191
|
const MAX_STRING_LENGTH = 2048;
|
|
192
|
+
/**
|
|
193
|
+
* Maximum nesting depth accepted in an external payload. The deepest real
|
|
194
|
+
* shape kosha ingests is roughly `provider.models.<id>.cost.batch.input` —
|
|
195
|
+
* six levels. 64 leaves generous headroom while keeping the recursive scan
|
|
196
|
+
* inside its stack budget.
|
|
197
|
+
*/
|
|
198
|
+
const MAX_SCAN_DEPTH = 64;
|
|
93
199
|
// ---------------------------------------------------------------------------
|
|
94
200
|
// Threat registry — evaluated once per string value during scan.
|
|
95
201
|
// ---------------------------------------------------------------------------
|
|
@@ -101,6 +207,14 @@ const VALUE_THREATS = [
|
|
|
101
207
|
name: "null_byte",
|
|
102
208
|
test: (v) => NULL_BYTE_PATTERN.test(v),
|
|
103
209
|
},
|
|
210
|
+
{
|
|
211
|
+
name: "control_chars",
|
|
212
|
+
test: (v) => CONTROL_CHAR_PATTERN.test(v),
|
|
213
|
+
},
|
|
214
|
+
{
|
|
215
|
+
name: "bidi_override",
|
|
216
|
+
test: (v) => BIDI_OVERRIDE_PATTERN.test(v),
|
|
217
|
+
},
|
|
104
218
|
{
|
|
105
219
|
name: "credential_leak",
|
|
106
220
|
test: (v) => CREDENTIAL_PATTERNS.some((p) => p.test(v)),
|
|
@@ -127,7 +241,7 @@ const VALUE_THREATS = [
|
|
|
127
241
|
},
|
|
128
242
|
{
|
|
129
243
|
name: "base64",
|
|
130
|
-
test:
|
|
244
|
+
test: looksLikeBase64,
|
|
131
245
|
},
|
|
132
246
|
];
|
|
133
247
|
/** Threats checked against object keys specifically. */
|
|
@@ -136,6 +250,14 @@ const KEY_THREATS = [
|
|
|
136
250
|
name: "null_byte",
|
|
137
251
|
test: (v) => NULL_BYTE_PATTERN.test(v),
|
|
138
252
|
},
|
|
253
|
+
{
|
|
254
|
+
name: "control_chars",
|
|
255
|
+
test: (v) => CONTROL_CHAR_PATTERN.test(v),
|
|
256
|
+
},
|
|
257
|
+
{
|
|
258
|
+
name: "bidi_override",
|
|
259
|
+
test: (v) => BIDI_OVERRIDE_PATTERN.test(v),
|
|
260
|
+
},
|
|
139
261
|
{
|
|
140
262
|
name: "proto_pollution",
|
|
141
263
|
test: (v) => v === PROTO_POLLUTION_KEY,
|
|
@@ -146,7 +268,7 @@ const KEY_THREATS = [
|
|
|
146
268
|
},
|
|
147
269
|
{
|
|
148
270
|
name: "base64",
|
|
149
|
-
test:
|
|
271
|
+
test: looksLikeBase64,
|
|
150
272
|
},
|
|
151
273
|
];
|
|
152
274
|
// ---------------------------------------------------------------------------
|
|
@@ -158,7 +280,14 @@ const KEY_THREATS = [
|
|
|
158
280
|
*
|
|
159
281
|
* @returns The first {@link ThreatHit} found, or `undefined` if clean.
|
|
160
282
|
*/
|
|
161
|
-
export function scanPayload(obj, path = "") {
|
|
283
|
+
export function scanPayload(obj, path = "", depth = 0) {
|
|
284
|
+
// A payload nested deeper than anything a model catalogue needs is itself
|
|
285
|
+
// the finding: without this, a few megabytes of `[[[[…]]]]` overflows the
|
|
286
|
+
// stack inside the scanner and takes the process down before any field is
|
|
287
|
+
// read. Reported rather than thrown so callers handle it like any threat.
|
|
288
|
+
if (depth > MAX_SCAN_DEPTH) {
|
|
289
|
+
return { threat: "excessive_nesting", path, value: `depth > ${MAX_SCAN_DEPTH}` };
|
|
290
|
+
}
|
|
162
291
|
if (typeof obj === "string") {
|
|
163
292
|
for (const t of VALUE_THREATS) {
|
|
164
293
|
if (t.test(obj)) {
|
|
@@ -169,7 +298,7 @@ export function scanPayload(obj, path = "") {
|
|
|
169
298
|
}
|
|
170
299
|
if (Array.isArray(obj)) {
|
|
171
300
|
for (let i = 0; i < obj.length; i++) {
|
|
172
|
-
const hit = scanPayload(obj[i], `${path}[${i}]
|
|
301
|
+
const hit = scanPayload(obj[i], `${path}[${i}]`, depth + 1);
|
|
173
302
|
if (hit)
|
|
174
303
|
return hit;
|
|
175
304
|
}
|
|
@@ -184,7 +313,7 @@ export function scanPayload(obj, path = "") {
|
|
|
184
313
|
}
|
|
185
314
|
}
|
|
186
315
|
// Recurse into the value
|
|
187
|
-
const hit = scanPayload(obj[key], `${path}.${key}
|
|
316
|
+
const hit = scanPayload(obj[key], `${path}.${key}`, depth + 1);
|
|
188
317
|
if (hit)
|
|
189
318
|
return hit;
|
|
190
319
|
}
|
|
@@ -209,4 +338,54 @@ export function assertCleanPayload(data, source) {
|
|
|
209
338
|
throw new Error(`Rejected ${source} data: ${hit.threat} detected at "${hit.path}" — refusing to load potentially compromised payload`);
|
|
210
339
|
}
|
|
211
340
|
}
|
|
341
|
+
/**
|
|
342
|
+
* Fraction of entries that may be dropped before the whole feed is treated as
|
|
343
|
+
* compromised. A handful of odd rows in a community catalog is normal; most of
|
|
344
|
+
* the feed tripping the scanner is not.
|
|
345
|
+
*/
|
|
346
|
+
const MAX_QUARANTINE_RATIO = 0.5;
|
|
347
|
+
/**
|
|
348
|
+
* Scan a keyed catalog entry-by-entry, dropping the entries that trip a threat
|
|
349
|
+
* instead of rejecting the whole payload.
|
|
350
|
+
*
|
|
351
|
+
* {@link assertCleanPayload} is the right call for a payload kosha depends on
|
|
352
|
+
* in full — a provider's own `/v1/models` response, a cache file it wrote. It
|
|
353
|
+
* is the wrong call for the big third-party catalogs (models.dev, LiteLLM),
|
|
354
|
+
* where one unusual model name from any of 200+ contributors would otherwise
|
|
355
|
+
* take out every keyless fallback at once. Here, the bad entry is dropped and
|
|
356
|
+
* named, and the rest of the catalog still loads.
|
|
357
|
+
*
|
|
358
|
+
* A feed where more than {@link MAX_QUARANTINE_RATIO} of entries trip is not
|
|
359
|
+
* one bad row — that still throws.
|
|
360
|
+
*
|
|
361
|
+
* @throws {Error} when the payload is not a plain object, or when too much of
|
|
362
|
+
* it is unclean to be a localized problem.
|
|
363
|
+
*/
|
|
364
|
+
export function quarantineEntries(data, source) {
|
|
365
|
+
if (data === null || typeof data !== "object" || Array.isArray(data)) {
|
|
366
|
+
throw new Error(`Rejected ${source} data: expected an object of entries`);
|
|
367
|
+
}
|
|
368
|
+
const clean = Object.create(null);
|
|
369
|
+
const dropped = [];
|
|
370
|
+
for (const [key, value] of Object.entries(data)) {
|
|
371
|
+
// A poisoned key is not quarantinable — `__proto__` and null bytes are
|
|
372
|
+
// structural attacks on the object itself, so the feed is rejected.
|
|
373
|
+
for (const threat of KEY_THREATS) {
|
|
374
|
+
if (threat.test(key)) {
|
|
375
|
+
throw new Error(`Rejected ${source} data: ${threat.name} detected in top-level key "${key}" — refusing to load potentially compromised payload`);
|
|
376
|
+
}
|
|
377
|
+
}
|
|
378
|
+
const hit = scanPayload(value, `.${key}`, 1);
|
|
379
|
+
if (hit) {
|
|
380
|
+
dropped.push({ key, threat: hit.threat, path: hit.path });
|
|
381
|
+
continue;
|
|
382
|
+
}
|
|
383
|
+
clean[key] = value;
|
|
384
|
+
}
|
|
385
|
+
const total = dropped.length + Object.keys(clean).length;
|
|
386
|
+
if (total > 0 && dropped.length / total > MAX_QUARANTINE_RATIO) {
|
|
387
|
+
throw new Error(`Rejected ${source} data: ${dropped.length} of ${total} entries tripped the threat scan (${dropped[0]?.threat} at "${dropped[0]?.path}") — refusing to load a feed this unclean`);
|
|
388
|
+
}
|
|
389
|
+
return { clean, dropped };
|
|
390
|
+
}
|
|
212
391
|
//# sourceMappingURL=security.js.map
|
package/dist/security.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAWH,mEAAmE;AACnE,MAAM,cAAc,GAAG,4BAA4B,CAAC;AACpD
|
|
1
|
+
{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAWH,mEAAmE;AACnE,MAAM,cAAc,GAAG,4BAA4B,CAAC;AACpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CAAC,KAAa;IACrC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CACN,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5B,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QACpC,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,+DAA+D,CAAC,CAAC;AAEzG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAE7D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG;IAC3B,uBAAuB,EAAY,kBAAkB;IACrD,4BAA4B,EAAO,sBAAsB;IACzD,oBAAoB,EAAe,qBAAqB;IACxD,wBAAwB,EAAW,gCAAgC;IACnE,wBAAwB,EAAW,sBAAsB;IACzD,wBAAwB,EAAW,iCAAiC;IACpE,0BAA0B,EAAS,mBAAmB;IACtD,0BAA0B,EAAS,oBAAoB;IACvD,0BAA0B,EAAS,kBAAkB;IACrD,4BAA4B,EAAO,6BAA6B;IAChE,2BAA2B,EAAQ,gCAAgC;IACnE,wBAAwB,EAAW,aAAa;IAChD,yBAAyB,EAAU,cAAc;IACjD,uBAAuB,EAAY,sBAAsB;IACzD,iCAAiC,EAAE,gCAAgC;CACnE,CAAC;AAEF,2DAA2D;AAC3D,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AACrD,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,MAAM,wBAAwB,GAAG;IAChC,aAAa,EAAsB,aAAa;IAChD,0BAA0B,EAAS,iCAAiC;IACpE,yFAAyF,EAAE,qCAAqC;IAChI,6DAA6D,EAAE,8BAA8B;CAC7F,CAAC;AAEF,mDAAmD;AACnD,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAE7D,6BAA6B;AAC7B,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;AAExF,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD;;;8DAG8D;AAC9D,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAExC,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,2EAA2E;AAC3E,6EAA6E;AAC7E,kCAAkC;AAClC,MAAM,aAAa,GAAa;IAC/B;QACC,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;KACtC;IACD;QACC,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KACzC;IACD;QACC,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC1C;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACvD;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;KACtG;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC5D;IACD;QACC,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;KACrC;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,iBAAiB;KACzC;IACD;QACC,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;KACrC;IACD;QACC,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,eAAe;KACrB;CACD,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,GAAa;IAC7B;QACC,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;KACtC;IACD;QACC,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KACzC;IACD;QACC,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC1C;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,mBAAmB;KACtC;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACvD;IACD;QACC,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,eAAe;KACrB;CACD,CAAC;AAYF,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC;IAC7D,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,cAAc,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACxF,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5D,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,uBAAuB;YACvB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjB,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;gBAC/D,CAAC;YACF,CAAC;YACD,yBAAyB;YACzB,MAAM,GAAG,GAAG,WAAW,CAAE,GAA+B,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5F,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACrB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa,EAAE,MAAc;IAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACd,YAAY,MAAM,UAAU,GAAG,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAI,sDAAsD,CACrH,CAAC;IACH,CAAC;AACF,CAAC;AAwBD;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAa,EAAE,MAAc;IAC9D,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,YAAY,MAAM,sCAAsC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,KAAK,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QAC5E,uEAAuE;QACvE,oEAAoE;QACpE,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACd,YAAY,MAAM,UAAU,MAAM,CAAC,IAAI,+BAA+B,GAAG,sDAAsD,CAC/H,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,SAAS;QACV,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,GAAG,oBAAoB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACd,YAAY,MAAM,UAAU,OAAO,CAAC,MAAM,OAAO,KAAK,qCAAqC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,2CAA2C,CAChL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}
|
package/dist/tally.d.ts
CHANGED
|
@@ -20,6 +20,13 @@ export interface TokenUsage {
|
|
|
20
20
|
cachedInputTokens?: number;
|
|
21
21
|
/** Cache-write input tokens (Anthropic-style cache creation), if reported. */
|
|
22
22
|
cacheWriteTokens?: number;
|
|
23
|
+
/**
|
|
24
|
+
* The share of `cacheWriteTokens` written with a 1-hour TTL, when the
|
|
25
|
+
* provider breaks the lifetime down. A SUBSET of `cacheWriteTokens`, never
|
|
26
|
+
* an additional bucket — it changes which rate applies, not how many tokens
|
|
27
|
+
* were written.
|
|
28
|
+
*/
|
|
29
|
+
cacheWrite1hTokens?: number;
|
|
23
30
|
/** Reasoning/thinking output tokens, if the provider bills or reports them separately. */
|
|
24
31
|
reasoningTokens?: number;
|
|
25
32
|
}
|
package/dist/tally.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tally.d.ts","sourceRoot":"","sources":["../src/tally.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,sDAAsD;AACtD,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0FAA0F;IAC1F,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,4EAA4E;AAC5E,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACvD,WAAW,EAAE,MAAM,CAAC;CACpB;
|
|
1
|
+
{"version":3,"file":"tally.d.ts","sourceRoot":"","sources":["../src/tally.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,sDAAsD;AACtD,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0FAA0F;IAC1F,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,4EAA4E;AAC5E,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACvD,WAAW,EAAE,MAAM,CAAC;CACpB;AA4CD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB,GAAG,IAAI,CA8BhH;AAOD,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,gBAAgB,CA4B1F;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;CAClB;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;CAClB;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAY,SAAQ,gBAAgB;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,kGAAkG;IAClG,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACzB,KAAK,EAAE,SAAS,SAAS,EAAE,EAC3B,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,GAAG,IAAI,GAAG,SAAS,GAClE,WAAW,CA6Cb"}
|
package/dist/tally.js
CHANGED
|
@@ -25,6 +25,12 @@ const FIELD_ALIASES = {
|
|
|
25
25
|
"prompt_tokens_details.cached_tokens",
|
|
26
26
|
],
|
|
27
27
|
cacheWriteTokens: ["cacheWriteTokens", "cache_creation_input_tokens", "cacheCreationInputTokens"],
|
|
28
|
+
// Anthropic nests the TTL split under cache_creation alongside the total.
|
|
29
|
+
cacheWrite1hTokens: [
|
|
30
|
+
"cacheWrite1hTokens",
|
|
31
|
+
"cache_creation.ephemeral_1h_input_tokens",
|
|
32
|
+
"cacheCreation.ephemeral1hInputTokens",
|
|
33
|
+
],
|
|
28
34
|
reasoningTokens: ["reasoningTokens", "reasoning_tokens", "completion_tokens_details.reasoning_tokens"],
|
|
29
35
|
};
|
|
30
36
|
function readField(raw, aliases) {
|
|
@@ -61,6 +67,7 @@ export function normalizeTokenUsage(raw) {
|
|
|
61
67
|
const outputTokens = readField(raw, FIELD_ALIASES.outputTokens) ?? 0;
|
|
62
68
|
const cachedInputTokens = readField(raw, FIELD_ALIASES.cachedInputTokens);
|
|
63
69
|
const cacheWriteTokens = readField(raw, FIELD_ALIASES.cacheWriteTokens);
|
|
70
|
+
const cacheWrite1hTokens = readField(raw, FIELD_ALIASES.cacheWrite1hTokens);
|
|
64
71
|
const reasoningTokens = readField(raw, FIELD_ALIASES.reasoningTokens);
|
|
65
72
|
const hasAnyUsage = inputTokens > 0 ||
|
|
66
73
|
outputTokens > 0 ||
|
|
@@ -75,6 +82,8 @@ export function normalizeTokenUsage(raw) {
|
|
|
75
82
|
outputTokens,
|
|
76
83
|
...(cachedInputTokens !== undefined ? { cachedInputTokens } : {}),
|
|
77
84
|
...(cacheWriteTokens !== undefined ? { cacheWriteTokens } : {}),
|
|
85
|
+
// Subset of cacheWriteTokens — deliberately absent from totalTokens.
|
|
86
|
+
...(cacheWrite1hTokens !== undefined ? { cacheWrite1hTokens } : {}),
|
|
78
87
|
...(reasoningTokens !== undefined ? { reasoningTokens } : {}),
|
|
79
88
|
totalTokens,
|
|
80
89
|
};
|
|
@@ -95,8 +104,15 @@ export function estimateUsdCost(usage, pricing) {
|
|
|
95
104
|
const cachedInputUsd = usage.cachedInputTokens
|
|
96
105
|
? tokensTimesRate(usage.cachedInputTokens, pricing.cacheReadPerMillion)
|
|
97
106
|
: 0;
|
|
98
|
-
|
|
99
|
-
|
|
107
|
+
// Split the write by cache lifetime: a 1-hour write costs more than a
|
|
108
|
+
// 5-minute one, and the catalog's cacheWritePerMillion is the 5-minute rate.
|
|
109
|
+
// Without an explicit 1-hour rate the short-TTL rate is the only honest
|
|
110
|
+
// number here — estimateUsdCost has no usage shape to infer a ratio from.
|
|
111
|
+
const cacheWriteTotal = usage.cacheWriteTokens ?? 0;
|
|
112
|
+
const cacheWrite1h = Math.max(0, Math.min(usage.cacheWrite1hTokens ?? 0, cacheWriteTotal));
|
|
113
|
+
const cacheWriteUsd = cacheWriteTotal
|
|
114
|
+
? tokensTimesRate(cacheWriteTotal - cacheWrite1h, pricing.cacheWritePerMillion) +
|
|
115
|
+
tokensTimesRate(cacheWrite1h, pricing.cacheWrite1hPerMillion ?? pricing.cacheWritePerMillion)
|
|
100
116
|
: 0;
|
|
101
117
|
const reasoningUsd = usage.reasoningTokens
|
|
102
118
|
? tokensTimesRate(usage.reasoningTokens, pricing.reasoningOutputPerMillion ?? pricing.outputPerMillion)
|
package/dist/tally.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tally.js","sourceRoot":"","sources":["../src/tally.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;
|
|
1
|
+
{"version":3,"file":"tally.js","sourceRoot":"","sources":["../src/tally.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4BH,gFAAgF;AAChF,MAAM,aAAa,GAAgD;IAClE,WAAW,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC;IAC7E,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;IACxF,iBAAiB,EAAE;QAClB,mBAAmB;QACnB,eAAe;QACf,cAAc;QACd,yBAAyB;QACzB,sBAAsB;QACtB,gEAAgE;QAChE,qCAAqC;KACrC;IACD,gBAAgB,EAAE,CAAC,kBAAkB,EAAE,6BAA6B,EAAE,0BAA0B,CAAC;IACjG,0EAA0E;IAC1E,kBAAkB,EAAE;QACnB,oBAAoB;QACpB,0CAA0C;QAC1C,sCAAsC;KACtC;IACD,eAAe,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,4CAA4C,CAAC;CACtG,CAAC;AAEF,SAAS,SAAS,CAAC,GAA4B,EAAE,OAA0B;IAC1E,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3E,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,GAA4B,EAAE,IAAc;IAC7D,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,GAAG,GAAI,GAA+B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAA+C;IAClF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,WAAW,GAChB,WAAW,GAAG,CAAC;QACf,YAAY,GAAG,CAAC;QAChB,CAAC,iBAAiB,IAAI,CAAC,CAAC,GAAG,CAAC;QAC5B,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC;QAC3B,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,WAAW,GAAG,WAAW,GAAG,YAAY,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IAE7H,OAAO;QACN,WAAW;QACX,YAAY;QACZ,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,qEAAqE;QACrE,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,WAAW;KACX,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,MAAc,EAAE,UAA8B;IACtE,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,OAAqB;IACvE,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,KAAK,CAAC,iBAAiB;QAC7C,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,mBAAmB,CAAC;QACvE,CAAC,CAAC,CAAC,CAAC;IACL,sEAAsE;IACtE,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,eAAe,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IAC3F,MAAM,aAAa,GAAG,eAAe;QACpC,CAAC,CAAC,eAAe,CAAC,eAAe,GAAG,YAAY,EAAE,OAAO,CAAC,oBAAoB,CAAC;YAC9E,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,sBAAsB,IAAI,OAAO,CAAC,oBAAoB,CAAC;QAC9F,CAAC,CAAC,CAAC,CAAC;IACL,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe;QACzC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,yBAAyB,IAAI,OAAO,CAAC,gBAAgB,CAAC;QACvG,CAAC,CAAC,CAAC,CAAC;IAEL,OAAO;QACN,QAAQ;QACR,SAAS;QACT,cAAc;QACd,aAAa;QACb,YAAY;QACZ,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,aAAa,GAAG,YAAY;KAC9E,CAAC;AACH,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACzB,KAA2B,EAC3B,cAAoE;IAEpE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;gBACxB,GAAG,IAAI;aACP,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QAED,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACpB,QAAQ,CAAC,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;QACnC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACrC,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC;QAC/C,QAAQ,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC;QAC7C,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC3C,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IACpC,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO;QACN,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;QACzD,aAAa,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QACvD,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QACrD,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC/C,OAAO;QACN,WAAW,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW;QAC1C,YAAY,EAAE,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;QAC7C,iBAAiB,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,IAAI,SAAS;QACvF,gBAAgB,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,IAAI,SAAS;QACpF,eAAe,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,IAAI,SAAS;KACjF,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAI,KAAmB,EAAE,IAAyB;IAC/D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC;AACd,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -6,8 +6,14 @@
|
|
|
6
6
|
* map provider-specific API responses into these shapes.
|
|
7
7
|
* @module
|
|
8
8
|
*/
|
|
9
|
-
/**
|
|
10
|
-
|
|
9
|
+
/**
|
|
10
|
+
* Supported model operational modes.
|
|
11
|
+
*
|
|
12
|
+
* `judgment` covers models that return typed decisions rather than generated
|
|
13
|
+
* text — TypeSafe's System One family (Jev) answers a question with a choice,
|
|
14
|
+
* a probability, or a score, so it is neither `chat` nor `moderation`.
|
|
15
|
+
*/
|
|
16
|
+
export type ModelMode = "chat" | "embedding" | "image" | "video" | "audio" | "moderation" | "rerank" | "judgment";
|
|
11
17
|
/** Normalized transport families used by discovery consumers. */
|
|
12
18
|
export type ProviderTransport = "native-http" | "openai-compatible-http" | "cloud-sdk";
|
|
13
19
|
/** High-level provider origin classifications. */
|
|
@@ -59,6 +65,17 @@ export interface ModelPricing {
|
|
|
59
65
|
cacheReadPerMillion?: number;
|
|
60
66
|
/** USD cost per 1 million cache-write tokens (optional). */
|
|
61
67
|
cacheWritePerMillion?: number;
|
|
68
|
+
/**
|
|
69
|
+
* USD cost per 1 million cache-write tokens written with a 1-hour TTL
|
|
70
|
+
* (optional). Providers that offer more than one cache lifetime charge more
|
|
71
|
+
* for the longer one — Anthropic bills a 5-minute write at 1.25× input and a
|
|
72
|
+
* 1-hour write at 2× — while every upstream catalog we ingest publishes only
|
|
73
|
+
* a single `cache_write` rate, which is the short-TTL one. Populated from a
|
|
74
|
+
* source or an operator override; when absent, consumers fall back to the
|
|
75
|
+
* provider's published ratio rather than silently pricing a 1-hour write as
|
|
76
|
+
* if it were a 5-minute one.
|
|
77
|
+
*/
|
|
78
|
+
cacheWrite1hPerMillion?: number;
|
|
62
79
|
/** USD cost per 1 million input tokens via the Batch API (optional). */
|
|
63
80
|
batchInputPerMillion?: number;
|
|
64
81
|
/** USD cost per 1 million output tokens via the Batch API (optional). */
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAClB,MAAM,GACN,WAAW,GACX,OAAO,GACP,OAAO,GACP,OAAO,GACP,YAAY,GACZ,QAAQ,GACR,UAAU,CAAC;AAEd,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,wBAAwB,GAAG,WAAW,CAAC;AAEvF,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1D,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEjE,yDAAyD;AACzD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,MAAM,CAAC;AAElF,4CAA4C;AAC5C,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,UAAU,EAAE,OAAO,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC5B,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,iEAAiE;IACjE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,yDAAyD;IACzD,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;OAEG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW;AACtB,2EAA2E;AACzE,cAAc;AAChB,6EAA6E;GAC3E,kBAAkB;AACpB,wEAAwE;GACtE,iBAAiB;AACnB,oEAAoE;GAClE,kBAAkB;AACpB,uEAAuE;GACrE,cAAc;AAChB,yEAAyE;GACvE,eAAe;AACjB,qEAAqE;GACnE,cAAc;AAChB,sDAAsD;GACpD,MAAM,CAAC;AAEV;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB;AAC/B,yDAAyD;AACvD,WAAW;AACb,gFAAgF;GAC9E,aAAa;AACf,2EAA2E;GACzE,iBAAiB;AACnB,4EAA4E;GAC1E,iBAAiB;AACnB,8EAA8E;GAC5E,SAAS;AACX,6DAA6D;GAC3D,aAAa;AACf,qEAAqE;GACnE,KAAK,CAAC;AAET;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uCAAuC;IACvC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,6EAA6E;IAC7E,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACzB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC;IACX,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,IAAI,EAAE,SAAS,CAAC;IAChB,4FAA4F;IAC5F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,uEAAuE;IACvE,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC/C,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAC/C;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC7B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wDAAwD;IACxD,OAAO,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAChC,4BAA4B;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAC;IACvB,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IAC/D,0DAA0D;IAC1D,MAAM,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAChC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,kEAAkE;AAClE,MAAM,WAAW,wBAAwB;IACxC,qBAAqB;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,kDAAkD;AAClD,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC7D,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IAClC,8BAA8B;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,WAAW,EAAE,aAAa,CAAC;CAC3B;AAED,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IACnC,gDAAgD;IAChD,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,WAAW,EAAE,aAAa,CAAC;IAC3B,2DAA2D;IAC3D,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;CAC/C;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IACjC,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iEAAiE;IACjE,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC9B,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC9B,0CAA0C;IAC1C,KAAK,EAAE,SAAS,CAAC;IACjB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,cAAc,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,QAAQ,EAAE,OAAO,CAAC;IAClB,0DAA0D;IAC1D,WAAW,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,aAAa,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IAC/D,gDAAgD;IAChD,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,uDAAuD;IACvD,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,qEAAqE;AACrE,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC;CAAG;AAElF,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACrC,qDAAqD;IACrD,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CACjB,MAAM,EACN;QACC,2DAA2D;QAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,kEAAkE;QAClE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;KACjB,CACD,CAAC;IACF,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IACpD,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;CAC7F;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;CAClD"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@sriinnu/kosha-discovery",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.6.1",
|
|
4
4
|
"description": "AI Model & Provider Discovery Registry -- kosha (कोश) treasury of models",
|
|
5
|
+
"mcpName": "io.github.sriinnu/kosha-discovery",
|
|
5
6
|
"type": "module",
|
|
6
7
|
"packageManager": "pnpm@10.33.0",
|
|
7
8
|
"license": "MIT",
|
|
@@ -28,6 +29,13 @@
|
|
|
28
29
|
"vertex-ai",
|
|
29
30
|
"ai-models",
|
|
30
31
|
"provider-discovery",
|
|
32
|
+
"mcp",
|
|
33
|
+
"mcp-server",
|
|
34
|
+
"model-context-protocol",
|
|
35
|
+
"xai",
|
|
36
|
+
"grok",
|
|
37
|
+
"qwen",
|
|
38
|
+
"typesafe",
|
|
31
39
|
"model-routing",
|
|
32
40
|
"pricing",
|
|
33
41
|
"cli"
|
|
@@ -82,6 +90,7 @@
|
|
|
82
90
|
},
|
|
83
91
|
"files": [
|
|
84
92
|
"dist",
|
|
93
|
+
"server.json",
|
|
85
94
|
"logo.svg",
|
|
86
95
|
"README.md",
|
|
87
96
|
"LICENSE"
|