@wardby/cli 0.2.1 → 0.4.0

package/dist/providers/llm/catalog-shipped.js

@@ -0,0 +1,197 @@
+export const SHIPPED_CATALOG_VERSION = "2026-10-03";
+const ALL_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+export const SHIPPED_CATALOG = [
+    // OpenAI
+    {
+        provider: "openai",
+        modelId: "gpt-4o",
+        encoding: "o200k_base",
+        inputPerMTok: 2.5,
+        outputPerMTok: 10.0,
+        cachedInputPerMTok: 1.25,
+        cacheWritePerMTok: 2.5,
+        efforts: [],
+        thinkingMode: "none",
+    },
+    {
+        provider: "openai",
+        modelId: "gpt-4o-mini",
+        encoding: "o200k_base",
+        inputPerMTok: 0.15,
+        outputPerMTok: 0.6,
+        cachedInputPerMTok: 0.075,
+        cacheWritePerMTok: 0.15,
+        efforts: [],
+        thinkingMode: "none",
+    },
+    {
+        provider: "openai",
+        modelId: "gpt-4.1",
+        encoding: "o200k_base",
+        inputPerMTok: 2.0,
+        outputPerMTok: 8.0,
+        cachedInputPerMTok: 0.5,
+        cacheWritePerMTok: 2.0,
+        efforts: [],
+        thinkingMode: "none",
+    },
+    {
+        provider: "openai",
+        modelId: "gpt-4.1-mini",
+        encoding: "o200k_base",
+        inputPerMTok: 0.4,
+        outputPerMTok: 1.6,
+        cachedInputPerMTok: 0.1,
+        cacheWritePerMTok: 0.4,
+        efforts: [],
+        thinkingMode: "none",
+    },
+    {
+        provider: "openai",
+        modelId: "gpt-4.1-nano",
+        encoding: "o200k_base",
+        inputPerMTok: 0.1,
+        outputPerMTok: 0.4,
+        cachedInputPerMTok: 0.025,
+        cacheWritePerMTok: 0.1,
+        efforts: [],
+        thinkingMode: "none",
+    },
+    {
+        provider: "openai",
+        modelId: "gpt-6-astra",
+        encoding: "o200k_base",
+        inputPerMTok: 10.0,
+        outputPerMTok: 50.0,
+        cachedInputPerMTok: 1.0,
+        cacheWritePerMTok: 12.5,
+        efforts: [],
+        thinkingMode: "none",
+    },
+    {
+        provider: "openai",
+        modelId: "gpt-5.6-sol",
+        encoding: "o200k_base",
+        inputPerMTok: 4.0,
+        outputPerMTok: 20.0,
+        cachedInputPerMTok: 0.4,
+        cacheWritePerMTok: 5.0,
+        efforts: [],
+        thinkingMode: "none",
+    },
+    {
+        provider: "openai",
+        modelId: "gpt-5.6-terra",
+        encoding: "o200k_base",
+        inputPerMTok: 2.0,
+        outputPerMTok: 12.0,
+        cachedInputPerMTok: 0.2,
+        cacheWritePerMTok: 2.5,
+        efforts: [],
+        thinkingMode: "none",
+    },
+    {
+        provider: "openai",
+        modelId: "gpt-5.6-luna",
+        encoding: "o200k_base",
+        inputPerMTok: 0.2,
+        outputPerMTok: 1.2,
+        cachedInputPerMTok: 0.02,
+        cacheWritePerMTok: 0.25,
+        efforts: [],
+        thinkingMode: "none",
+    },
+    // Anthropic (direct API)
+    {
+        provider: "anthropic",
+        modelId: "claude-opus-5",
+        encoding: "o200k_base",
+        inputPerMTok: 5,
+        outputPerMTok: 25,
+        cachedInputPerMTok: 0.5,
+        cacheWritePerMTok: 6.25,
+        efforts: ALL_EFFORTS,
+        thinkingMode: "adaptive",
+    },
+    {
+        provider: "anthropic",
+        modelId: "claude-sonnet-5",
+        encoding: "o200k_base",
+        inputPerMTok: 2,
+        outputPerMTok: 10,
+        cachedInputPerMTok: 0.2,
+        cacheWritePerMTok: 2.5,
+        efforts: ALL_EFFORTS,
+        thinkingMode: "adaptive",
+    },
+    {
+        provider: "anthropic",
+        modelId: "claude-fable-5",
+        encoding: "o200k_base",
+        inputPerMTok: 10,
+        outputPerMTok: 50,
+        cachedInputPerMTok: 1,
+        cacheWritePerMTok: 12.5,
+        efforts: ALL_EFFORTS,
+        thinkingMode: "adaptive",
+    },
+    // Haiku 4.5 rejects adaptive thinking and any effort level.
+    {
+        provider: "anthropic",
+        modelId: "claude-haiku-4-5",
+        encoding: "o200k_base",
+        inputPerMTok: 1,
+        outputPerMTok: 5,
+        cachedInputPerMTok: 0.1,
+        cacheWritePerMTok: 1.25,
+        efforts: [],
+        thinkingMode: "manual",
+    },
+    // Bedrock-Claude (`us.` cross-region inference profiles). Effort is never sent
+    // through Bedrock (unconfirmed per model), and wardby sends Bedrock no thinking
+    // parameter at all, so thinkingMode is inert here; "adaptive" by convention.
+    {
+        provider: "bedrock-claude",
+        modelId: "us.anthropic.claude-sonnet-4-6",
+        encoding: "o200k_base",
+        inputPerMTok: 3,
+        outputPerMTok: 15,
+        cachedInputPerMTok: 0.3,
+        cacheWritePerMTok: 3.75,
+        efforts: [],
+        thinkingMode: "adaptive",
+    },
+    {
+        provider: "bedrock-claude",
+        modelId: "us.anthropic.claude-opus-4-6-v1",
+        encoding: "o200k_base",
+        inputPerMTok: 5,
+        outputPerMTok: 25,
+        cachedInputPerMTok: 0.5,
+        cacheWritePerMTok: 6.25,
+        efforts: [],
+        thinkingMode: "adaptive",
+    },
+    {
+        provider: "bedrock-claude",
+        modelId: "us.anthropic.claude-opus-4-8",
+        encoding: "o200k_base",
+        inputPerMTok: 5,
+        outputPerMTok: 25,
+        cachedInputPerMTok: 0.5,
+        cacheWritePerMTok: 6.25,
+        efforts: [],
+        thinkingMode: "adaptive",
+    },
+    {
+        provider: "bedrock-claude",
+        modelId: "us.anthropic.claude-haiku-4-5-20251001-v1:0",
+        encoding: "o200k_base",
+        inputPerMTok: 1,
+        outputPerMTok: 5,
+        cachedInputPerMTok: 0.1,
+        cacheWritePerMTok: 1.25,
+        efforts: [],
+        thinkingMode: "adaptive",
+    },
+];

package/dist/providers/llm/catalog-store.d.ts

@@ -0,0 +1,58 @@
+import { type ModelCatalog } from "./catalog.js";
+export interface CatalogDb {
+    modelCatalogEntry: {
+        findMany(): Promise<Record<string, unknown>[]>;
+    };
+}
+export interface CatalogLog {
+    warn(payload: Record<string, unknown>, message: string): void;
+    info(payload: Record<string, unknown>, message: string): void;
+}
+export declare function refreshIntervalMs(env?: NodeJS.ProcessEnv): number;
+export declare class CatalogStore {
+    private readonly db;
+    private catalog;
+    private timer;
+    private readonly intervalMs;
+    private readonly log;
+    /** Monotonic id handed out per load attempt (poll or refreshNow), taken before the
+     *  awaited fetch starts so loads can be ordered by when they were *initiated*, not
+     *  when they happen to resolve. */
+    private loadSeq;
+    /** The seq of the load currently reflected in `catalog`. A load whose result arrives
+     *  after a newer one already applied is discarded — see `applyLoad`. */
+    private appliedSeq;
+    /** True once `close()` has run; a load already in flight at that point must not
+     *  assign into `catalog` or log on failure when it eventually settles. */
+    private closed;
+    /** True while a poll-triggered load is in flight, so a slow load doesn't overlap
+     *  with the next interval tick. */
+    private polling;
+    constructor(db: CatalogDb, options?: {
+        intervalMs?: number;
+        log?: CatalogLog;
+    });
+    start(): Promise<void>;
+    current(): ModelCatalog;
+    refreshNow(): Promise<void>;
+    close(): void;
+    /** Runs one load, then applies it only if it is still the newest load to have
+     *  started and the store hasn't been closed in the meantime. Rejects (without
+     *  touching `catalog`) if the underlying load fails. */
+    private applyLoad;
+    private load;
+}
+/**
+ * Starts a store against `db`, installs it as what `currentModelCatalog()`
+ * returns process-wide, and returns it. Throws (via `CatalogStore.start()`)
+ * if the database is unreachable — every process that calls this fails
+ * fast at startup rather than silently running on the shipped catalog
+ * alone, which would quietly re-enable models an admin turned off.
+ */
+export declare function startModelCatalog(db: CatalogDb, options?: {
+    intervalMs?: number;
+    log?: CatalogLog;
+}): Promise<CatalogStore>;
+export declare function installModelCatalog(store: CatalogStore): void;
+export declare function currentModelCatalog(): ModelCatalog;
+export declare function uninstallModelCatalogForTests(): void;

package/dist/providers/llm/catalog-store.js

@@ -0,0 +1,138 @@
+/**
+ * Holds this process's merged model catalog. Loads it at startup (failing
+ * the process if the database is unreachable: running on the shipped catalog
+ * alone would quietly re-enable models an admin turned off), then polls
+ * ModelCatalogEntry every WARDBY_MODEL_CATALOG_REFRESH_SECONDS (default 45)
+ * and swaps in a new immutable catalog. A failed poll keeps the last good
+ * catalog. current() is synchronous: per-token pricing reads it.
+ *
+ * One store per process (serve, mcp, scheduler); installModelCatalog makes
+ * it what currentModelCatalog() returns everywhere. Before a store is
+ * installed (unit tests, offline CLI commands) currentModelCatalog() is the
+ * shipped catalog.
+ */
+import { logger } from "../../core/logger.js";
+import { buildCatalog, rowFromRecord, shippedCatalog } from "./catalog.js";
+import { SHIPPED_CATALOG, SHIPPED_CATALOG_VERSION } from "./catalog-shipped.js";
+const DEFAULT_REFRESH_SECONDS = 45;
+export function refreshIntervalMs(env = process.env) {
+    const raw = env.WARDBY_MODEL_CATALOG_REFRESH_SECONDS;
+    if (raw === undefined || raw === "")
+        return DEFAULT_REFRESH_SECONDS * 1000;
+    if (!/^[1-9]\d*$/.test(raw)) {
+        throw new Error(`WARDBY_MODEL_CATALOG_REFRESH_SECONDS must be a positive whole number of seconds (got "${raw}").`);
+    }
+    return Number(raw) * 1000;
+}
+export class CatalogStore {
+    db;
+    catalog = shippedCatalog();
+    timer;
+    intervalMs;
+    log;
+    /** Monotonic id handed out per load attempt (poll or refreshNow), taken before the
+     *  awaited fetch starts so loads can be ordered by when they were *initiated*, not
+     *  when they happen to resolve. */
+    loadSeq = 0;
+    /** The seq of the load currently reflected in `catalog`. A load whose result arrives
+     *  after a newer one already applied is discarded — see `applyLoad`. */
+    appliedSeq = 0;
+    /** True once `close()` has run; a load already in flight at that point must not
+     *  assign into `catalog` or log on failure when it eventually settles. */
+    closed = false;
+    /** True while a poll-triggered load is in flight, so a slow load doesn't overlap
+     *  with the next interval tick. */
+    polling = false;
+    constructor(db, options = {}) {
+        this.db = db;
+        this.intervalMs = options.intervalMs ?? refreshIntervalMs();
+        this.log = options.log ?? logger.child({ module: "model-catalog" });
+    }
+    async start() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+        this.closed = false;
+        try {
+            await this.applyLoad();
+        }
+        catch (err) {
+            throw new Error(`Could not load the model catalog from the database: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+        }
+        this.timer = setInterval(() => {
+            if (this.polling)
+                return;
+            this.polling = true;
+            this.applyLoad().then(() => {
+                this.polling = false;
+            }, (err) => {
+                this.polling = false;
+                if (this.closed)
+                    return;
+                this.log.warn({ event: "models.catalog.refresh_failed", err: err instanceof Error ? err.message : String(err) }, "model catalog refresh failed; keeping the last good catalog");
+            });
+        }, this.intervalMs);
+        this.timer.unref?.();
+    }
+    current() {
+        return this.catalog;
+    }
+    async refreshNow() {
+        await this.applyLoad();
+    }
+    close() {
+        this.closed = true;
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = undefined;
+    }
+    /** Runs one load, then applies it only if it is still the newest load to have
+     *  started and the store hasn't been closed in the meantime. Rejects (without
+     *  touching `catalog`) if the underlying load fails. */
+    async applyLoad() {
+        const seq = ++this.loadSeq;
+        const next = await this.load();
+        if (this.closed)
+            return;
+        if (seq > this.appliedSeq) {
+            this.catalog = next;
+            this.appliedSeq = seq;
+        }
+    }
+    async load() {
+        const records = await this.db.modelCatalogEntry.findMany();
+        const rows = [];
+        for (const record of records) {
+            const row = rowFromRecord(record);
+            if (row)
+                rows.push(row);
+            else
+                this.log.warn({ event: "models.catalog.row_invalid", provider: record.provider, modelId: record.modelId }, "skipping a malformed ModelCatalogEntry row");
+        }
+        return buildCatalog(SHIPPED_CATALOG, rows, SHIPPED_CATALOG_VERSION, (message) => this.log.warn({ event: "models.catalog.conflict" }, message));
+    }
+}
+/**
+ * Starts a store against `db`, installs it as what `currentModelCatalog()`
+ * returns process-wide, and returns it. Throws (via `CatalogStore.start()`)
+ * if the database is unreachable — every process that calls this fails
+ * fast at startup rather than silently running on the shipped catalog
+ * alone, which would quietly re-enable models an admin turned off.
+ */
+export async function startModelCatalog(db, options = {}) {
+    const store = new CatalogStore(db, options);
+    await store.start();
+    installModelCatalog(store);
+    return store;
+}
+let installed;
+export function installModelCatalog(store) {
+    installed = store;
+}
+export function currentModelCatalog() {
+    return installed?.current() ?? shippedCatalog();
+}
+export function uninstallModelCatalogForTests() {
+    installed = undefined;
+}

package/dist/providers/llm/catalog-types.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The model catalog's shapes. A CatalogEntry is everything wardby needs to
+ * route, price, tokenize and shape requests for one model; every field is
+ * required (CLAUDE.md "LLM pricing tables — STRICT": cache rates are never
+ * omitted and never derived).
+ */
+import type { TokenizerEncoding } from "./pricing-core.js";
+import { type LlmEffort } from "./types.js";
+export declare const MODEL_PROVIDERS: readonly ["openai", "anthropic", "bedrock-claude"];
+export type ModelProvider = (typeof MODEL_PROVIDERS)[number];
+/**
+ * How a Claude model takes extended thinking. adaptive: `{type: "adaptive"}`
+ * plus an effort level. manual: `{type: "enabled", budget_tokens}` and no
+ * effort (Claude Haiku 4.5 returns a 400 for adaptive). none: no thinking
+ * parameter (OpenAI models).
+ */
+export declare const THINKING_MODES: readonly ["adaptive", "manual", "none"];
+export type ThinkingMode = (typeof THINKING_MODES)[number];
+export declare const TOKENIZER_ENCODINGS: readonly ["cl100k_base", "o200k_base"];
+export interface CatalogEntry {
+    provider: ModelProvider;
+    /** Exact string an Agent.model must equal. */
+    modelId: string;
+    encoding: TokenizerEncoding;
+    inputPerMTok: number;
+    outputPerMTok: number;
+    cachedInputPerMTok: number;
+    cacheWritePerMTok: number;
+    /** Effort levels the model accepts; empty = never send one. */
+    efforts: readonly LlmEffort[];
+    thinkingMode: ThinkingMode;
+}
+/** An entry as the merged catalog serves it. */
+export interface ResolvedCatalogEntry extends CatalogEntry {
+    origin: "shipped" | "override";
+    /** "shipped:<SHIPPED_CATALOG_VERSION>" or the override row's updatedAt (ISO). */
+    priceVersion: string;
+    /** Overrides of a shipped model only: whether the shipped entry now differs. */
+    shippedDiffers?: boolean;
+    /** Overrides only. */
+    sourceUrl?: string;
+    updatedBy?: string;
+    updatedAt?: Date;
+}
+/** A ModelCatalogEntry row, validated. */
+export interface CatalogRow extends CatalogEntry {
+    enabled: boolean;
+    sourceUrl: string;
+    updatedBy: string;
+    /** When the row was first written: decides which provider owns a non-shipped id (ownerOf). */
+    createdAt: Date;
+    updatedAt: Date;
+}
+export type ModelUnavailableReason = "not_in_catalog" | "disabled" | "provider_not_configured";
+/** A model the deployment cannot run. Thrown before any spend. */
+export declare class ModelUnavailableError extends Error {
+    readonly modelId: string;
+    readonly reason: ModelUnavailableReason;
+    readonly code: "model_unavailable";
+    constructor(modelId: string, reason: ModelUnavailableReason);
+}
+/** Strips a resolved entry down to the stored snapshot shape. */
+export declare function entryOf(entry: CatalogEntry): CatalogEntry;
+export declare function sameEntry(a: CatalogEntry, b: CatalogEntry): boolean;
+/** Parses a stored snapshot (Run.pricingSnapshot, CodingProxySession.catalogEntry); null if absent or malformed. */
+export declare function parseStoredEntry(value: unknown): CatalogEntry | null;

package/dist/providers/llm/catalog-types.js

@@ -0,0 +1,64 @@
+import { isLlmEffort } from "./types.js";
+export const MODEL_PROVIDERS = ["openai", "anthropic", "bedrock-claude"];
+/**
+ * How a Claude model takes extended thinking. adaptive: `{type: "adaptive"}`
+ * plus an effort level. manual: `{type: "enabled", budget_tokens}` and no
+ * effort (Claude Haiku 4.5 returns a 400 for adaptive). none: no thinking
+ * parameter (OpenAI models).
+ */
+export const THINKING_MODES = ["adaptive", "manual", "none"];
+export const TOKENIZER_ENCODINGS = ["cl100k_base", "o200k_base"];
+const REASON_TEXT = {
+    not_in_catalog: "is not in this deployment's model catalog",
+    disabled: "is disabled in this deployment's model catalog",
+    provider_not_configured: "belongs to a provider with no credentials configured in this deployment",
+};
+/** A model the deployment cannot run. Thrown before any spend. */
+export class ModelUnavailableError extends Error {
+    modelId;
+    reason;
+    code = "model_unavailable";
+    constructor(modelId, reason) {
+        super(`model_unavailable: Model "${modelId}" ${REASON_TEXT[reason]} (reason: ${reason}). See list_models.`);
+        this.modelId = modelId;
+        this.reason = reason;
+        this.name = "ModelUnavailableError";
+    }
+}
+/** Strips a resolved entry down to the stored snapshot shape. */
+export function entryOf(entry) {
+    return {
+        provider: entry.provider,
+        modelId: entry.modelId,
+        encoding: entry.encoding,
+        inputPerMTok: entry.inputPerMTok,
+        outputPerMTok: entry.outputPerMTok,
+        cachedInputPerMTok: entry.cachedInputPerMTok,
+        cacheWritePerMTok: entry.cacheWritePerMTok,
+        efforts: [...entry.efforts],
+        thinkingMode: entry.thinkingMode,
+    };
+}
+export function sameEntry(a, b) {
+    return JSON.stringify(entryOf(a)) === JSON.stringify(entryOf(b));
+}
+const rate = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+/** Parses a stored snapshot (Run.pricingSnapshot, CodingProxySession.catalogEntry); null if absent or malformed. */
+export function parseStoredEntry(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const v = value;
+    if (!MODEL_PROVIDERS.includes(v.provider))
+        return null;
+    if (typeof v.modelId !== "string" || v.modelId.length === 0)
+        return null;
+    if (!TOKENIZER_ENCODINGS.includes(v.encoding))
+        return null;
+    if (![v.inputPerMTok, v.outputPerMTok, v.cachedInputPerMTok, v.cacheWritePerMTok].every(rate))
+        return null;
+    if (!Array.isArray(v.efforts) || !v.efforts.every(isLlmEffort))
+        return null;
+    if (!THINKING_MODES.includes(v.thinkingMode))
+        return null;
+    return entryOf(v);
+}

package/dist/providers/llm/catalog.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The merged model catalog: the shipped catalog (code) overlaid with a
+ * deployment's ModelCatalogEntry rows (admins, via set_model). Immutable;
+ * CatalogStore swaps in a new one on each refresh. Pure — no I/O.
+ *
+ * A row replaces the shipped entry with the same (provider, modelId)
+ * completely; enabled=false removes the model; a row with no shipped match
+ * adds one. Routing is by model id alone, so one model id can belong to only
+ * one provider (ownerOf): a row that would claim an id another provider owns
+ * is skipped (set_model refuses it at write time; this is the backstop).
+ */
+import { type CatalogEntry, type CatalogRow, type ResolvedCatalogEntry } from "./catalog-types.js";
+export declare class ModelCatalog {
+    private readonly active;
+    private readonly disabled;
+    private readonly shipped;
+    constructor(active: ReadonlyMap<string, ResolvedCatalogEntry>, disabled: ReadonlyMap<string, ResolvedCatalogEntry>, shipped: ReadonlyMap<string, CatalogEntry>);
+    get(modelId: string): ResolvedCatalogEntry | undefined;
+    /** Throws ModelUnavailableError (not_in_catalog | disabled). */
+    require(modelId: string): ResolvedCatalogEntry;
+    entries(): ResolvedCatalogEntry[];
+    disabledEntries(): ResolvedCatalogEntry[];
+    shippedEntry(modelId: string): CatalogEntry | undefined;
+}
+/** What deciding a model id's owner needs from one of its ModelCatalogEntry rows. */
+export interface CatalogClaim {
+    provider: string;
+    enabled: boolean;
+    createdAt: Date;
+}
+/**
+ * Orders claims on one model id: the earliest-created row first, ties broken
+ * by provider name. createdAt, never updatedAt: an owner editing its own row
+ * (set_model, disable_model) must not hand the id to a row claimed after it.
+ */
+export declare function compareClaims(a: CatalogClaim, b: CatalogClaim): number;
+/**
+ * The one ownership rule, shared by buildCatalog (the merge) and set_model
+ * (its write-time conflict check), so the two can never disagree. A shipped
+ * model id ALWAYS belongs to its shipped provider: any row for it under
+ * another provider is a dead orphan, however many there are and whenever
+ * they were written. A non-shipped id belongs to the provider of its
+ * earliest-created row (compareClaims) until reset_model clears every row.
+ * `enabled` is the owner's row's (a disabled row still reserves the id); a
+ * shipped provider with no row is the untouched, enabled shipped entry.
+ * Null only for an id that is neither shipped nor claimed by any row.
+ *
+ * Which rows count as claims is the caller's call: buildCatalog passes only
+ * rows that passed rowFromRecord (CatalogStore drops malformed ones), while
+ * set_model passes every raw row, malformed included, so a malformed row
+ * still reserves its id until reset_model clears it.
+ */
+export declare function ownerOf(shippedEntry: Pick<CatalogEntry, "provider"> | undefined, claims: readonly CatalogClaim[]): {
+    provider: string;
+    enabled: boolean;
+} | null;
+export declare function buildCatalog(shipped: readonly CatalogEntry[], rows: readonly CatalogRow[], shippedVersion: string, onConflict?: (message: string) => void): ModelCatalog;
+/** The shipped catalog with no overrides (tests, tools without a database, old proxy sessions). */
+export declare function shippedCatalog(): ModelCatalog;
+/** Validates one ModelCatalogEntry record; null (and the caller logs) if it is malformed. */
+export declare function rowFromRecord(record: Record<string, unknown>): CatalogRow | null;