@wardby/cli 0.3.0 → 0.4.1

package/dist/providers/llm/catalog.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The merged model catalog: the shipped catalog (code) overlaid with a
+ * deployment's ModelCatalogEntry rows (admins, via set_model). Immutable;
+ * CatalogStore swaps in a new one on each refresh. Pure — no I/O.
+ *
+ * A row replaces the shipped entry with the same (provider, modelId)
+ * completely; enabled=false removes the model; a row with no shipped match
+ * adds one. Routing is by model id alone, so one model id can belong to only
+ * one provider (ownerOf): a row that would claim an id another provider owns
+ * is skipped (set_model refuses it at write time; this is the backstop).
+ */
+import { type CatalogEntry, type CatalogRow, type ResolvedCatalogEntry } from "./catalog-types.js";
+export declare class ModelCatalog {
+    private readonly active;
+    private readonly disabled;
+    private readonly shipped;
+    constructor(active: ReadonlyMap<string, ResolvedCatalogEntry>, disabled: ReadonlyMap<string, ResolvedCatalogEntry>, shipped: ReadonlyMap<string, CatalogEntry>);
+    get(modelId: string): ResolvedCatalogEntry | undefined;
+    /** Throws ModelUnavailableError (not_in_catalog | disabled). */
+    require(modelId: string): ResolvedCatalogEntry;
+    entries(): ResolvedCatalogEntry[];
+    disabledEntries(): ResolvedCatalogEntry[];
+    shippedEntry(modelId: string): CatalogEntry | undefined;
+}
+/** What deciding a model id's owner needs from one of its ModelCatalogEntry rows. */
+export interface CatalogClaim {
+    provider: string;
+    enabled: boolean;
+    createdAt: Date;
+}
+/**
+ * Orders claims on one model id: the earliest-created row first, ties broken
+ * by provider name. createdAt, never updatedAt: an owner editing its own row
+ * (set_model, disable_model) must not hand the id to a row claimed after it.
+ */
+export declare function compareClaims(a: CatalogClaim, b: CatalogClaim): number;
+/**
+ * The one ownership rule, shared by buildCatalog (the merge) and set_model
+ * (its write-time conflict check), so the two can never disagree. A shipped
+ * model id ALWAYS belongs to its shipped provider: any row for it under
+ * another provider is a dead orphan, however many there are and whenever
+ * they were written. A non-shipped id belongs to the provider of its
+ * earliest-created row (compareClaims) until reset_model clears every row.
+ * `enabled` is the owner's row's (a disabled row still reserves the id); a
+ * shipped provider with no row is the untouched, enabled shipped entry.
+ * Null only for an id that is neither shipped nor claimed by any row.
+ *
+ * Which rows count as claims is the caller's call: buildCatalog passes only
+ * rows that passed rowFromRecord (CatalogStore drops malformed ones), while
+ * set_model passes every raw row, malformed included, so a malformed row
+ * still reserves its id until reset_model clears it.
+ */
+export declare function ownerOf(shippedEntry: Pick<CatalogEntry, "provider"> | undefined, claims: readonly CatalogClaim[]): {
+    provider: string;
+    enabled: boolean;
+} | null;
+export declare function buildCatalog(shipped: readonly CatalogEntry[], rows: readonly CatalogRow[], shippedVersion: string, onConflict?: (message: string) => void): ModelCatalog;
+/** The shipped catalog with no overrides (tests, tools without a database, old proxy sessions). */
+export declare function shippedCatalog(): ModelCatalog;
+/** Validates one ModelCatalogEntry record; null (and the caller logs) if it is malformed. */
+export declare function rowFromRecord(record: Record<string, unknown>): CatalogRow | null;

package/dist/providers/llm/catalog.js

@@ -0,0 +1,147 @@
+/**
+ * The merged model catalog: the shipped catalog (code) overlaid with a
+ * deployment's ModelCatalogEntry rows (admins, via set_model). Immutable;
+ * CatalogStore swaps in a new one on each refresh. Pure — no I/O.
+ *
+ * A row replaces the shipped entry with the same (provider, modelId)
+ * completely; enabled=false removes the model; a row with no shipped match
+ * adds one. Routing is by model id alone, so one model id can belong to only
+ * one provider (ownerOf): a row that would claim an id another provider owns
+ * is skipped (set_model refuses it at write time; this is the backstop).
+ */
+import { MODEL_PROVIDERS, ModelUnavailableError, parseStoredEntry, sameEntry, } from "./catalog-types.js";
+import { SHIPPED_CATALOG, SHIPPED_CATALOG_VERSION } from "./catalog-shipped.js";
+export class ModelCatalog {
+    active;
+    disabled;
+    shipped;
+    constructor(active, disabled, shipped) {
+        this.active = active;
+        this.disabled = disabled;
+        this.shipped = shipped;
+    }
+    get(modelId) {
+        return this.active.get(modelId);
+    }
+    /** Throws ModelUnavailableError (not_in_catalog | disabled). */
+    require(modelId) {
+        const entry = this.active.get(modelId);
+        if (entry)
+            return entry;
+        throw new ModelUnavailableError(modelId, this.disabled.has(modelId) ? "disabled" : "not_in_catalog");
+    }
+    entries() {
+        return [...this.active.values()];
+    }
+    disabledEntries() {
+        return [...this.disabled.values()];
+    }
+    shippedEntry(modelId) {
+        return this.shipped.get(modelId);
+    }
+}
+/**
+ * Orders claims on one model id: the earliest-created row first, ties broken
+ * by provider name. createdAt, never updatedAt: an owner editing its own row
+ * (set_model, disable_model) must not hand the id to a row claimed after it.
+ */
+export function compareClaims(a, b) {
+    return a.createdAt.getTime() - b.createdAt.getTime() || a.provider.localeCompare(b.provider);
+}
+/**
+ * The one ownership rule, shared by buildCatalog (the merge) and set_model
+ * (its write-time conflict check), so the two can never disagree. A shipped
+ * model id ALWAYS belongs to its shipped provider: any row for it under
+ * another provider is a dead orphan, however many there are and whenever
+ * they were written. A non-shipped id belongs to the provider of its
+ * earliest-created row (compareClaims) until reset_model clears every row.
+ * `enabled` is the owner's row's (a disabled row still reserves the id); a
+ * shipped provider with no row is the untouched, enabled shipped entry.
+ * Null only for an id that is neither shipped nor claimed by any row.
+ *
+ * Which rows count as claims is the caller's call: buildCatalog passes only
+ * rows that passed rowFromRecord (CatalogStore drops malformed ones), while
+ * set_model passes every raw row, malformed included, so a malformed row
+ * still reserves its id until reset_model clears it.
+ */
+export function ownerOf(shippedEntry, claims) {
+    if (shippedEntry) {
+        const ownRow = claims.find((claim) => claim.provider === shippedEntry.provider);
+        return { provider: shippedEntry.provider, enabled: ownRow ? ownRow.enabled : true };
+    }
+    if (claims.length === 0)
+        return null;
+    const [first] = [...claims].sort(compareClaims);
+    return { provider: first.provider, enabled: first.enabled };
+}
+export function buildCatalog(shipped, rows, shippedVersion, onConflict = () => undefined) {
+    const shippedById = new Map(shipped.map((e) => [e.modelId, e]));
+    const active = new Map(shipped.map((e) => [e.modelId, { ...e, origin: "shipped", priceVersion: `shipped:${shippedVersion}` }]));
+    const disabled = new Map();
+    const sorted = [...rows].sort(compareClaims);
+    const rowsById = new Map();
+    for (const row of sorted)
+        rowsById.set(row.modelId, [...(rowsById.get(row.modelId) ?? []), row]);
+    for (const row of sorted) {
+        const shippedEntry = shippedById.get(row.modelId);
+        // ownerOf is never null here (the id has at least this row); the fallback only satisfies the type.
+        const owner = ownerOf(shippedEntry, rowsById.get(row.modelId) ?? [row])?.provider ?? row.provider;
+        if (owner !== row.provider) {
+            onConflict(`ModelCatalogEntry (${row.provider}, ${row.modelId}) skipped: model id already served by provider "${owner}".`);
+            continue;
+        }
+        const resolved = {
+            provider: row.provider,
+            modelId: row.modelId,
+            encoding: row.encoding,
+            inputPerMTok: row.inputPerMTok,
+            outputPerMTok: row.outputPerMTok,
+            cachedInputPerMTok: row.cachedInputPerMTok,
+            cacheWritePerMTok: row.cacheWritePerMTok,
+            efforts: [...row.efforts],
+            thinkingMode: row.thinkingMode,
+            origin: "override",
+            priceVersion: row.updatedAt.toISOString(),
+            ...(shippedEntry ? { shippedDiffers: !sameEntry(shippedEntry, row) } : {}),
+            sourceUrl: row.sourceUrl,
+            updatedBy: row.updatedBy,
+            updatedAt: row.updatedAt,
+        };
+        if (row.enabled) {
+            active.set(row.modelId, resolved);
+        }
+        else {
+            active.delete(row.modelId);
+            disabled.set(row.modelId, resolved);
+        }
+    }
+    return new ModelCatalog(active, disabled, shippedById);
+}
+let shippedOnly;
+/** The shipped catalog with no overrides (tests, tools without a database, old proxy sessions). */
+export function shippedCatalog() {
+    shippedOnly ??= buildCatalog(SHIPPED_CATALOG, [], SHIPPED_CATALOG_VERSION);
+    return shippedOnly;
+}
+/** Validates one ModelCatalogEntry record; null (and the caller logs) if it is malformed. */
+export function rowFromRecord(record) {
+    const entry = parseStoredEntry(record);
+    if (!entry)
+        return null;
+    if (typeof record.enabled !== "boolean")
+        return null;
+    if (typeof record.sourceUrl !== "string" || typeof record.updatedBy !== "string")
+        return null;
+    if (!(record.createdAt instanceof Date) || !(record.updatedAt instanceof Date))
+        return null;
+    if (!MODEL_PROVIDERS.includes(entry.provider))
+        return null;
+    return {
+        ...entry,
+        enabled: record.enabled,
+        sourceUrl: record.sourceUrl,
+        updatedBy: record.updatedBy,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
+}

package/dist/providers/llm/claude-provider.d.ts

@@ -1,12 +1,14 @@
 /**
  * LlmProvider implementation shared by every Claude-protocol adapter (direct
  * Anthropic API, Bedrock-Claude, and any future Claude-protocol client).
- * Imports no SDK — the client and pricing module are injected, so this file
+ * Imports no SDK — the client and catalog lookup are injected, so this file
  * stays exactly what each concrete adapter (anthropic.ts, bedrock.ts) has in
  * common, and nothing more.
  */
-import type { LlmEffort, LlmMessage, LlmProvider, LlmRequest, LlmStreamEvent, LlmToolDef } from "./types.js";
-import type { ModelPricing, UsageTokens } from "./pricing-core.js";
+import type { LlmMessage, LlmRequest, LlmStreamEvent, LlmToolDef } from "./types.js";
+import { type CatalogLookup } from "./catalog-lookup.js";
+import type { CatalogEntry } from "./catalog-types.js";
+import type { CatalogLlmAdapter } from "./routing.js";
 /**
  * Structural shape every Claude-protocol SDK client satisfies. Loose on
  * purpose — params/return are untyped here, mirroring the cast anthropic.ts
@@ -20,17 +22,11 @@ export interface ClaudeMessagesClient {
         }): unknown;
     };
 }
-export interface ClaudePricingModule {
-    /** Must throw on an unknown model — fail-closed, never price at zero. */
-    getPricing(model: string): ModelPricing;
-    priceUsd(model: string, usage: UsageTokens): number;
-    /** Effort levels the model accepts; empty = never send an effort. */
-    supportedEfforts(model: string): readonly LlmEffort[];
-}
-export declare class ClaudeLlmProvider implements LlmProvider {
-    private readonly client;
-    private readonly pricing;
-    constructor(client: ClaudeMessagesClient, pricing: ClaudePricingModule);
+export declare class ClaudeLlmProvider implements CatalogLlmAdapter {
+    protected readonly client: ClaudeMessagesClient;
+    private readonly lookup;
+    constructor(client: ClaudeMessagesClient, lookup?: CatalogLookup);
+    withEntry(entry: CatalogEntry): ClaudeLlmProvider;
     stream(req: LlmRequest, signal?: AbortSignal): AsyncIterable<LlmStreamEvent>;
     countTokens(model: string, messages: LlmMessage[], tools?: LlmToolDef[]): Promise<number>;
     priceUsd(model: string, usage: {

package/dist/providers/llm/claude-provider.js

@@ -1,4 +1,6 @@
 import { toClaudeRequest, withCacheBreakpoints, mapClaudeStream, estimateClaudeTokens, } from "./claude-messages.js";
+import { computeCost } from "./pricing-core.js";
+import { currentLookup, pinnedLookup } from "./catalog-lookup.js";
 // Anthropic's own guidance: don't lowball max_tokens — hitting the cap
 // truncates output mid-thought with no error, silently handing engine-native.ts
 // (which never sets LlmRequest.maxTokens, and never checks stopReason) a
@@ -11,25 +13,28 @@ const DEFAULT_MAX_TOKENS = 16000;
 const CLAUDE_TOKEN_INFLATION = 1.2;
 export class ClaudeLlmProvider {
     client;
-    pricing;
-    constructor(client, pricing) {
+    lookup;
+    constructor(client, lookup = currentLookup) {
         this.client = client;
-        this.pricing = pricing;
+        this.lookup = lookup;
+    }
+    withEntry(entry) {
+        return new ClaudeLlmProvider(this.client, pinnedLookup(entry));
     }
     async *stream(req, signal) {
         // Defence in depth behind config-time validation: a level the model
         // doesn't accept would fail the whole call, so it is dropped here.
         const { effort, ...rest } = req;
-        const accepted = effort && this.pricing.supportedEfforts(req.model).includes(effort);
+        const accepted = effort && this.lookup(req.model).efforts.includes(effort);
         const claudeReq = withCacheBreakpoints(toClaudeRequest(accepted ? { ...rest, effort } : rest, DEFAULT_MAX_TOKENS));
         const raw = this.client.messages.stream({ model: req.model, ...claudeReq }, { signal });
         yield* mapClaudeStream(raw, (usage) => this.priceUsd(req.model, usage));
     }
     async countTokens(model, messages, tools) {
-        this.pricing.getPricing(model); // fail-closed on unknown model
+        this.lookup(model); // fail-closed on a model the catalog does not serve
         return Math.ceil(estimateClaudeTokens(messages, tools) * CLAUDE_TOKEN_INFLATION);
     }
     priceUsd(model, usage) {
-        return this.pricing.priceUsd(model, usage);
+        return computeCost(this.lookup(model), usage);
     }
 }

package/dist/providers/llm/index.d.ts

@@ -1,10 +1,13 @@
 export * from "./types.js";
-export * from "./pricing.js";
+export * from "./pricing-core.js";
 export * from "./openai.js";
-export { AnthropicLlmProvider, anthropicCredentialsPresent, anthropicSupportedModels } from "./anthropic.js";
-export { BedrockClaudeLlmProvider, bedrockCredentialsPresent, bedrockClaudeSupportedModels } from "./bedrock.js";
-export { ClaudeLlmProvider, type ClaudeMessagesClient, type ClaudePricingModule } from "./claude-provider.js";
+export { AnthropicLlmProvider, anthropicCredentialsPresent } from "./anthropic.js";
+export { BedrockClaudeLlmProvider, bedrockCredentialsPresent } from "./bedrock.js";
+export { ClaudeLlmProvider, type ClaudeMessagesClient } from "./claude-provider.js";
 export { openaiCredentialsPresent } from "./openai.js";
-export { supportedModels as openaiSupportedModels } from "./pricing.js";
-export { RoutingLlmProvider, modelAcceptsEffort, modelSupportedEfforts, type LlmRegistration } from "./routing.js";
+export { RoutingLlmProvider, modelAcceptsEffort, modelSupportedEfforts, type CatalogLlmAdapter, type LlmRegistration, } from "./routing.js";
 export { resolveLlmRegistrations, type LlmRegistrationResult } from "./registration.js";
+export * from "./catalog-types.js";
+export { ModelCatalog, buildCatalog, shippedCatalog } from "./catalog.js";
+export { CatalogStore, currentModelCatalog, installModelCatalog, refreshIntervalMs } from "./catalog-store.js";
+export { SHIPPED_CATALOG, SHIPPED_CATALOG_VERSION } from "./catalog-shipped.js";

package/dist/providers/llm/index.js

@@ -1,10 +1,13 @@
 export * from "./types.js";
-export * from "./pricing.js";
+export * from "./pricing-core.js";
 export * from "./openai.js";
-export { AnthropicLlmProvider, anthropicCredentialsPresent, anthropicSupportedModels } from "./anthropic.js";
-export { BedrockClaudeLlmProvider, bedrockCredentialsPresent, bedrockClaudeSupportedModels } from "./bedrock.js";
+export { AnthropicLlmProvider, anthropicCredentialsPresent } from "./anthropic.js";
+export { BedrockClaudeLlmProvider, bedrockCredentialsPresent } from "./bedrock.js";
 export { ClaudeLlmProvider } from "./claude-provider.js";
 export { openaiCredentialsPresent } from "./openai.js";
-export { supportedModels as openaiSupportedModels } from "./pricing.js";
-export { RoutingLlmProvider, modelAcceptsEffort, modelSupportedEfforts } from "./routing.js";
+export { RoutingLlmProvider, modelAcceptsEffort, modelSupportedEfforts, } from "./routing.js";
 export { resolveLlmRegistrations } from "./registration.js";
+export * from "./catalog-types.js";
+export { ModelCatalog, buildCatalog, shippedCatalog } from "./catalog.js";
+export { CatalogStore, currentModelCatalog, installModelCatalog, refreshIntervalMs } from "./catalog-store.js";
+export { SHIPPED_CATALOG, SHIPPED_CATALOG_VERSION } from "./catalog-shipped.js";

package/dist/providers/llm/openai.d.ts

@@ -4,14 +4,23 @@
  * never imports it.
  */
 import OpenAI from "openai";
-import type { LlmMessage, LlmProvider, LlmRequest, LlmStreamEvent, LlmToolDef } from "./types.js";
+import type { LlmMessage, LlmRequest, LlmStreamEvent, LlmToolDef } from "./types.js";
+import { type CatalogLookup } from "./catalog-lookup.js";
+import type { CatalogEntry } from "./catalog-types.js";
+import type { CatalogLlmAdapter } from "./routing.js";
 /** Whether the OpenAI adapter has credentials to run (used by the router's enable-by-credential wiring). */
 export declare function openaiCredentialsPresent(env?: NodeJS.ProcessEnv): boolean;
-export declare function estimateTokens(model: string, messages: LlmMessage[], tools?: LlmToolDef[]): number;
-export declare class OpenAiLlmProvider implements LlmProvider {
+export declare function estimateTokens(model: string, messages: LlmMessage[], tools?: LlmToolDef[], lookup?: CatalogLookup): number;
+export declare class OpenAiLlmProvider implements CatalogLlmAdapter {
+    private readonly lookup;
     private readonly client;
-    /** `client` is an injection point for tests — a real adapter never passes it. */
-    constructor(apiKey?: string, client?: OpenAI);
+    /**
+     * `client` is an injection point for tests and withEntry — a real adapter
+     * never passes it. `lookup` is a parameter property so it is set before the
+     * early return below.
+     */
+    constructor(apiKey?: string, client?: OpenAI, lookup?: CatalogLookup);
+    withEntry(entry: CatalogEntry): OpenAiLlmProvider;
     stream(req: LlmRequest, signal?: AbortSignal): AsyncIterable<LlmStreamEvent>;
     countTokens(model: string, messages: LlmMessage[], tools?: LlmToolDef[]): Promise<number>;
     priceUsd(model: string, usage: {

package/dist/providers/llm/openai.js

@@ -6,7 +6,8 @@
 import OpenAI from "openai";
 import { encode as encodeCl100kBase } from "gpt-tokenizer/encoding/cl100k_base";
 import { encode as encodeO200kBase } from "gpt-tokenizer/encoding/o200k_base";
-import { getModelPricing, priceUsd as priceUsdFromTable } from "./pricing.js";
+import { computeCost } from "./pricing-core.js";
+import { currentLookup, pinnedLookup } from "./catalog-lookup.js";
 /** Whether the OpenAI adapter has credentials to run (used by the router's enable-by-credential wiring). */
 export function openaiCredentialsPresent(env = process.env) {
     return Boolean(env.OPENAI_API_KEY);
@@ -22,10 +23,10 @@ const TOKENS_PRIMING_REPLY = 3;
 // gpt-tokenizer's package default is cl100k_base, but every gpt-4o-and-later
 // model (all of Phase 1's roster) actually uses o200k_base — using the
 // wrong table skews the pre-flight token count, which is the budget
-// guardrail's input. The encoding lives on the pricing table (pricing.ts)
-// so a model can't be run without also declaring which tokenizer counts it.
-function encodeForModel(model, text) {
-    const { encoding } = getModelPricing(model);
+// guardrail's input. The encoding lives on the catalog entry, so a model
+// can't be run without also declaring which tokenizer counts it.
+function encodeForModel(model, text, lookup) {
+    const { encoding } = lookup(model);
     return encoding === "o200k_base" ? encodeO200kBase(text) : encodeCl100kBase(text);
 }
 /** Same shape sent to the API in `stream()` — kept as one function so the estimate can never drift from what's actually serialized. */
@@ -44,25 +45,31 @@ function toOpenAiTools(tools) {
 // is still an *approximation* (not OpenAI's undocumented exact tool-schema
 // tokenization), not a byte-for-byte match — calibration logging
 // (budget.ts's checkTokenCalibration) is what surfaces any remaining drift.
-export function estimateTokens(model, messages, tools) {
+export function estimateTokens(model, messages, tools, lookup = currentLookup) {
     let total = TOKENS_PRIMING_REPLY;
     for (const message of messages) {
         total += TOKENS_PER_MESSAGE;
-        total += encodeForModel(model, message.content).length;
-        total += encodeForModel(model, message.role).length;
+        total += encodeForModel(model, message.content, lookup).length;
+        total += encodeForModel(model, message.role, lookup).length;
         if (message.name) {
-            total += encodeForModel(model, message.name).length + TOKENS_PER_NAME;
+            total += encodeForModel(model, message.name, lookup).length + TOKENS_PER_NAME;
         }
     }
     if (tools && tools.length > 0) {
-        total += encodeForModel(model, JSON.stringify(toOpenAiTools(tools))).length;
+        total += encodeForModel(model, JSON.stringify(toOpenAiTools(tools)), lookup).length;
     }
     return total;
 }
 export class OpenAiLlmProvider {
+    lookup;
     client;
-    /** `client` is an injection point for tests — a real adapter never passes it. */
-    constructor(apiKey = process.env.OPENAI_API_KEY ?? "", client) {
+    /**
+     * `client` is an injection point for tests and withEntry — a real adapter
+     * never passes it. `lookup` is a parameter property so it is set before the
+     * early return below.
+     */
+    constructor(apiKey = process.env.OPENAI_API_KEY ?? "", client, lookup = currentLookup) {
+        this.lookup = lookup;
         if (client) {
             this.client = client;
             return;
@@ -72,6 +79,9 @@ export class OpenAiLlmProvider {
         }
         this.client = new OpenAI({ apiKey });
     }
+    withEntry(entry) {
+        return new OpenAiLlmProvider("", this.client, pinnedLookup(entry));
+    }
     async *stream(req, signal) {
         const stream = await this.client.chat.completions.create({
             model: req.model,
@@ -148,9 +158,9 @@ export class OpenAiLlmProvider {
         }
     }
     async countTokens(model, messages, tools) {
-        return estimateTokens(model, messages, tools);
+        return estimateTokens(model, messages, tools, this.lookup);
     }
     priceUsd(model, usage) {
-        return priceUsdFromTable(model, usage);
+        return computeCost(this.lookup(model), usage);
     }
 }

package/dist/providers/llm/pricing-core.d.ts

@@ -1,7 +1,9 @@
 /**
- * Shared pricing types + cost math, provider-agnostic. Each LLM adapter
- * owns its own model table but prices through this one `computeCost`, so the
- * cache-read/cache-write accounting can never diverge between providers.
+ * Shared pricing types + cost math, provider-agnostic. Rates come from the
+ * model catalog (docs/models.md: the shipped catalog plus this deployment's
+ * set_model overrides), not from a per-adapter table; every provider prices
+ * through this one `computeCost`, so the cache-read/cache-write accounting
+ * can never diverge between providers.
  */
 export type TokenizerEncoding = "cl100k_base" | "o200k_base";
 export interface ModelPricing {

package/dist/providers/llm/registration.js

@@ -10,30 +10,26 @@
  * OpenAI, direct Anthropic, and Bedrock-Claude can all be active in one
  * deployment at once. An agent's `model` field (routed by RoutingLlmProvider)
  * picks which one handles its calls; there is no exclusive global mode.
+ * A registration names only its provider — models come from the catalog.
  */
 import { OpenAiLlmProvider, openaiCredentialsPresent } from "./openai.js";
-import { supportedModels as openaiSupportedModels } from "./pricing.js";
-import { AnthropicLlmProvider, anthropicCredentialsPresent, anthropicSupportedModels } from "./anthropic.js";
-import { BedrockClaudeLlmProvider, bedrockCredentialsPresent, bedrockClaudeSupportedModels } from "./bedrock.js";
+import { AnthropicLlmProvider, anthropicCredentialsPresent } from "./anthropic.js";
+import { BedrockClaudeLlmProvider, bedrockCredentialsPresent } from "./bedrock.js";
 export function resolveLlmRegistrations(env = process.env) {
     const registrations = [];
     if (openaiCredentialsPresent(env)) {
-        registrations.push({ provider: new OpenAiLlmProvider(env.OPENAI_API_KEY), models: openaiSupportedModels() });
+        registrations.push({ provider: "openai", adapter: new OpenAiLlmProvider(env.OPENAI_API_KEY) });
     }
     if (anthropicCredentialsPresent(env)) {
-        registrations.push({
-            provider: new AnthropicLlmProvider(env.ANTHROPIC_API_KEY),
-            models: anthropicSupportedModels(),
-        });
+        registrations.push({ provider: "anthropic", adapter: new AnthropicLlmProvider(env.ANTHROPIC_API_KEY) });
     }
     if (bedrockCredentialsPresent(env)) {
         registrations.push({
-            provider: new BedrockClaudeLlmProvider(env.BEDROCK_REGION ?? env.AWS_REGION),
-            models: bedrockClaudeSupportedModels(),
+            provider: "bedrock-claude",
+            adapter: new BedrockClaudeLlmProvider(env.BEDROCK_REGION ?? env.AWS_REGION),
         });
     }
-    if (registrations.length === 0) {
+    if (registrations.length === 0)
         return { kind: "no-credentials" };
-    }
     return { kind: "registrations", registrations };
 }

package/dist/providers/llm/routing.d.ts

@@ -1,27 +1,28 @@
-/**
- * Model->provider routing. Becomes the single ProviderRegistry.llm and
- * dispatches each call to the adapter that owns `model`, so per-agent model
- * selection (Agent.model) selects the provider too — GPT and Claude agents
- * run in one deployment. Unknown model / duplicate registration fail closed.
- */
+import type { ModelCatalog } from "./catalog.js";
+import { type CatalogEntry, type ModelProvider, type ResolvedCatalogEntry } from "./catalog-types.js";
 import type { LlmEffort, LlmMessage, LlmProvider, LlmRequest, LlmStreamEvent, LlmToolDef } from "./types.js";
-/**
- * Effort levels `model` accepts, whichever provider owns it — for config-time
- * validation, so it needs no credentials. Each provider's own table is the
- * source of truth. OpenAI models accept none: the Chat Completions
- * `reasoning_effort` parameter is documented for o-series models only, and
- * none is on the roster.
- */
+/** Effort levels `model` accepts, from the current catalog; no credentials needed (config-time validation). */
 export declare function modelSupportedEfforts(model: string): readonly LlmEffort[];
 export declare function modelAcceptsEffort(model: string, effort: LlmEffort): boolean;
+/** An adapter that can be pinned to one run's stored catalog entry. */
+export interface CatalogLlmAdapter extends LlmProvider {
+    withEntry(entry: CatalogEntry): LlmProvider;
+}
 export interface LlmRegistration {
-    provider: LlmProvider;
-    models: string[];
+    provider: ModelProvider;
+    adapter: CatalogLlmAdapter;
 }
 export declare class RoutingLlmProvider implements LlmProvider {
-    private readonly byModel;
-    constructor(registrations: LlmRegistration[]);
+    private readonly catalog;
+    private readonly byProvider;
+    constructor(registrations: LlmRegistration[], catalog?: () => ModelCatalog);
+    hasProvider(provider: ModelProvider): boolean;
+    /** Model ids this deployment can run right now. */
     listModels(): string[];
+    /** The current catalog entry for a runnable model; throws ModelUnavailableError otherwise. */
+    entryFor(model: string): ResolvedCatalogEntry;
+    /** A provider bound to one run's stored entry: prices and shapes requests from it, never the live catalog. */
+    forRun(entry: CatalogEntry): LlmProvider;
     private resolve;
     stream(req: LlmRequest, signal?: AbortSignal): AsyncIterable<LlmStreamEvent>;
     countTokens(model: string, messages: LlmMessage[], tools?: LlmToolDef[]): Promise<number>;

package/dist/providers/llm/routing.js

@@ -1,42 +1,58 @@
-import { anthropicSupportedEfforts } from "./pricing-anthropic.js";
-import { bedrockClaudeSupportedEfforts } from "./pricing-bedrock-claude.js";
 /**
- * Effort levels `model` accepts, whichever provider owns it — for config-time
- * validation, so it needs no credentials. Each provider's own table is the
- * source of truth. OpenAI models accept none: the Chat Completions
- * `reasoning_effort` parameter is documented for o-series models only, and
- * none is on the roster.
+ * Model->provider routing over the model catalog. Becomes the single
+ * ProviderRegistry.llm: each call's model is looked up in the current
+ * catalog, and the adapter registered for that entry's provider handles it.
+ * A model is routable when it is in the catalog AND its provider has
+ * credentials (registration.ts). Unknown model / unconfigured provider /
+ * duplicate registration all fail closed.
  */
+import { currentModelCatalog } from "./catalog-store.js";
+import { ModelUnavailableError, } from "./catalog-types.js";
+/** Effort levels `model` accepts, from the current catalog; no credentials needed (config-time validation). */
 export function modelSupportedEfforts(model) {
-    const direct = anthropicSupportedEfforts(model);
-    if (direct.length > 0)
-        return direct;
-    return bedrockClaudeSupportedEfforts(model);
+    return currentModelCatalog().get(model)?.efforts ?? [];
 }
 export function modelAcceptsEffort(model, effort) {
     return modelSupportedEfforts(model).includes(effort);
 }
 export class RoutingLlmProvider {
-    byModel = new Map();
-    constructor(registrations) {
+    catalog;
+    byProvider = new Map();
+    constructor(registrations, catalog = currentModelCatalog) {
+        this.catalog = catalog;
         for (const reg of registrations) {
-            for (const model of reg.models) {
-                if (this.byModel.has(model)) {
-                    throw new Error(`Model "${model}" is registered by more than one LLM provider — check the routing configuration.`);
-                }
-                this.byModel.set(model, reg.provider);
+            if (this.byProvider.has(reg.provider)) {
+                throw new Error(`LLM provider "${reg.provider}" is registered more than once — check the routing configuration.`);
             }
+            this.byProvider.set(reg.provider, reg.adapter);
         }
     }
+    hasProvider(provider) {
+        return this.byProvider.has(provider);
+    }
+    /** Model ids this deployment can run right now. */
     listModels() {
-        return [...this.byModel.keys()];
+        return this.catalog()
+            .entries()
+            .filter((e) => this.byProvider.has(e.provider))
+            .map((e) => e.modelId);
+    }
+    /** The current catalog entry for a runnable model; throws ModelUnavailableError otherwise. */
+    entryFor(model) {
+        const entry = this.catalog().require(model);
+        if (!this.byProvider.has(entry.provider))
+            throw new ModelUnavailableError(model, "provider_not_configured");
+        return entry;
+    }
+    /** A provider bound to one run's stored entry: prices and shapes requests from it, never the live catalog. */
+    forRun(entry) {
+        const adapter = this.byProvider.get(entry.provider);
+        if (!adapter)
+            throw new ModelUnavailableError(entry.modelId, "provider_not_configured");
+        return adapter.withEntry(entry);
     }
     resolve(model) {
-        const provider = this.byModel.get(model);
-        if (!provider) {
-            throw new Error(`No LLM provider is registered for model "${model}". Known models: ${[...this.byModel.keys()].join(", ") || "(none)"}.`);
-        }
-        return provider;
+        return this.byProvider.get(this.entryFor(model).provider);
     }
     stream(req, signal) {
         return this.resolve(req.model).stream(req, signal);