create-quorum-router 0.1.5 → 0.1.8

package/templates/basic/src/cost_aware.ts

@@ -0,0 +1,150 @@
+import { readRouterEnv } from "./env.ts";
+import type { CostAwareTrace, ModelInventoryEntry } from "./schema.ts";
+
+export type CostExclusion = {
+  model_id: string;
+  estimated_cost_usd?: number;
+  reason: "missing_estimate" | "budget_exceeded";
+};
+
+export type CostAwareSelection =
+  | CostAwareTrace
+  | {
+    enabled: false;
+    selected_model_ids: string[];
+    excluded: CostExclusion[];
+  };
+
+export type CostAwareConfig = {
+  maxBudgetUsd: number;
+  estimates: Map<string, number>;
+};
+
+function normalizedModelId(value: string): string {
+  return value.trim().toLowerCase();
+}
+
+function parsePositiveBudget(raw: string): number {
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new Error(
+      "QuorumRouter blocked: QUORUM_ROUTER_MAX_BUDGET_USD must be a finite number > 0",
+    );
+  }
+  return value;
+}
+
+function parseEstimates(raw: string): Map<string, number> {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      "QuorumRouter blocked: QUORUM_ROUTER_ESTIMATED_COSTS_JSON must be valid JSON",
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(
+      "QuorumRouter blocked: QUORUM_ROUTER_ESTIMATED_COSTS_JSON must be a model-id to USD object",
+    );
+  }
+
+  const estimates = new Map<string, number>();
+  for (const [rawModelId, rawCost] of Object.entries(parsed)) {
+    const modelId = normalizedModelId(rawModelId);
+    if (
+      !modelId || typeof rawCost !== "number" || !Number.isFinite(rawCost) ||
+      rawCost < 0
+    ) {
+      throw new Error(
+        "QuorumRouter blocked: every cost estimate must use a non-empty model id and a finite USD number >= 0",
+      );
+    }
+    if (estimates.has(modelId)) {
+      throw new Error(
+        `QuorumRouter blocked: duplicate normalized cost estimate for ${modelId}`,
+      );
+    }
+    estimates.set(modelId, rawCost);
+  }
+  if (estimates.size === 0) {
+    throw new Error(
+      "QuorumRouter blocked: QUORUM_ROUTER_ESTIMATED_COSTS_JSON must contain at least one estimate",
+    );
+  }
+  return estimates;
+}
+
+export function readCostAwareConfig(): CostAwareConfig | undefined {
+  const rawBudget = readRouterEnv("QUORUM_ROUTER_MAX_BUDGET_USD");
+  const rawEstimates = readRouterEnv("QUORUM_ROUTER_ESTIMATED_COSTS_JSON");
+  if (rawBudget === undefined && rawEstimates === undefined) return undefined;
+  if (rawBudget === undefined || rawEstimates === undefined) {
+    throw new Error(
+      "QuorumRouter blocked: cost-aware routing requires both QUORUM_ROUTER_MAX_BUDGET_USD and QUORUM_ROUTER_ESTIMATED_COSTS_JSON",
+    );
+  }
+  return {
+    maxBudgetUsd: parsePositiveBudget(rawBudget),
+    estimates: parseEstimates(rawEstimates),
+  };
+}
+
+export function selectCandidatesWithinBudget(
+  candidates: ModelInventoryEntry[],
+  config = readCostAwareConfig(),
+): { candidates: ModelInventoryEntry[]; cost: CostAwareSelection } {
+  if (!config) {
+    return {
+      candidates,
+      cost: {
+        enabled: false,
+        selected_model_ids: candidates.map((candidate) => candidate.model_id),
+        excluded: [],
+      },
+    };
+  }
+
+  const selected: ModelInventoryEntry[] = [];
+  const excluded: CostExclusion[] = [];
+  let estimatedTotalUsd = 0;
+  for (const candidate of candidates) {
+    const estimate = config.estimates.get(
+      normalizedModelId(candidate.model_id),
+    );
+    if (estimate === undefined) {
+      excluded.push({
+        model_id: candidate.model_id,
+        reason: "missing_estimate",
+      });
+      continue;
+    }
+    if (estimatedTotalUsd + estimate > config.maxBudgetUsd) {
+      excluded.push({
+        model_id: candidate.model_id,
+        estimated_cost_usd: estimate,
+        reason: "budget_exceeded",
+      });
+      continue;
+    }
+    selected.push(candidate);
+    estimatedTotalUsd += estimate;
+  }
+
+  if (selected.length === 0) {
+    throw new Error(
+      "QuorumRouter blocked: cost-aware routing selected no candidates within the configured budget",
+    );
+  }
+  return {
+    candidates: selected,
+    cost: {
+      enabled: true,
+      pricing_source: "configured_estimate_not_live_billing",
+      max_budget_usd: config.maxBudgetUsd,
+      estimated_total_usd: estimatedTotalUsd,
+      selected_model_ids: selected.map((candidate) => candidate.model_id),
+      excluded,
+    },
+  };
+}

package/templates/basic/src/provider_registry.ts

@@ -9,6 +9,7 @@ export type ProviderSpec = {
   source: "wrapper" | "oauth_session" | "local_cli" | "env_fallback";
   command?: string;
   args_template?: string[];
+  prompt_transport?: "stdin" | "file";
   list_models_args?: string[];
   list_blocked_reason?: string;
   notes: string[];
@@ -145,8 +146,9 @@ export const LOCAL_PROVIDER_SPECS: ProviderSpec[] = [
       "__CWD__",
       "--output-last-message",
       "__OUT__",
-      "__PROMPT__",
+      "-",
     ],
+    prompt_transport: "stdin",
     list_blocked_reason:
       "codex models is tty/stdin dependent in this environment; model catalog listing is unavailable from non-interactive Deno.",
     notes: [
@@ -160,7 +162,8 @@ export const LOCAL_PROVIDER_SPECS: ProviderSpec[] = [
     auth_mode: "oauth",
     source: "oauth_session",
     command: "claude",
-    args_template: ["-p", "__PROMPT__"],
+    args_template: ["-p"],
+    prompt_transport: "stdin",
     list_blocked_reason:
       "Claude Code model listing is blocked by organization policy / disabled subscription access in this environment.",
     notes: [
@@ -174,7 +177,8 @@ export const LOCAL_PROVIDER_SPECS: ProviderSpec[] = [
     auth_mode: "oauth",
     source: "oauth_session",
     command: "gemini",
-    args_template: ["-p", "__PROMPT__"],
+    args_template: ["-p", ""],
+    prompt_transport: "stdin",
     list_blocked_reason:
       "Gemini CLI list/invoke paths require a trusted directory in non-interactive runs unless the user opts into the trust setting.",
     notes: [
@@ -189,14 +193,15 @@ export const LOCAL_PROVIDER_SPECS: ProviderSpec[] = [
     source: "oauth_session",
     command: "grok",
     args_template: [
-      "-p",
-      "__PROMPT__",
+      "--prompt-file",
+      "__PROMPT_FILE__",
       "--output-format",
       "plain",
       "--permission-mode",
       "plan",
       "--disable-web-search",
     ],
+    prompt_transport: "file",
     list_models_args: ["models"],
     notes: [
       "Uses existing Grok CLI session; `grok models` is safe list-only discovery.",
@@ -209,7 +214,8 @@ export const LOCAL_PROVIDER_SPECS: ProviderSpec[] = [
     auth_mode: "session",
     source: "local_cli",
     command: "devin",
-    args_template: ["-p", "__PROMPT__"],
+    args_template: ["-p", "--prompt-file", "__PROMPT_FILE__"],
+    prompt_transport: "file",
     list_blocked_reason:
       "Devin CLI does not expose a models subcommand in this environment.",
     notes: ["Uses existing Devin CLI session."],
@@ -221,7 +227,8 @@ export const LOCAL_PROVIDER_SPECS: ProviderSpec[] = [
     auth_mode: "session",
     source: "local_cli",
     command: "qwen",
-    args_template: ["-p", "__PROMPT__"],
+    args_template: ["-p", ""],
+    prompt_transport: "stdin",
     list_blocked_reason:
       "Qwen CLI model listing path is stdin/API-key dependent in this environment.",
     notes: ["Uses existing local Qwen CLI session."],

package/templates/basic/src/schema.ts

@@ -1,3 +1,75 @@
+import { z } from "zod";
+
+export const SupabaseAuditModeSchema = z.enum([
+  "disabled",
+  "optional",
+  "required",
+]);
+
+export type SupabaseAuditMode = z.infer<typeof SupabaseAuditModeSchema>;
+
+export const SupabaseFeatureConfigSchema = z.object({
+  audit: z.object({
+    mode: SupabaseAuditModeSchema,
+  }).strict(),
+}).strict();
+
+export type SupabaseFeatureConfig = z.infer<
+  typeof SupabaseFeatureConfigSchema
+>;
+
+export const SelectiveFeatureConfigSchema = z.object({
+  supabase: SupabaseFeatureConfigSchema.optional(),
+}).strict();
+
+const SECRET_CONFIG_KEY =
+  /^(?:quorum_router_)?supabase_(?:url|anon_key|publishable_key|session_jwt|access_token|service_role_key|admin_key)$/i;
+
+function normalizedConfigKey(key: string): string {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^a-z0-9]+/gi, "_")
+    .toLowerCase();
+}
+
+function findSupabaseCredentialPath(
+  value: unknown,
+  path: Array<string | number> = [],
+): Array<string | number> | undefined {
+  if (Array.isArray(value)) {
+    for (let index = 0; index < value.length; index += 1) {
+      const found = findSupabaseCredentialPath(value[index], [...path, index]);
+      if (found) return found;
+    }
+    return undefined;
+  }
+  if (!value || typeof value !== "object") return undefined;
+  for (const [key, nested] of Object.entries(value)) {
+    const normalized = normalizedConfigKey(key);
+    if (
+      SECRET_CONFIG_KEY.test(normalized) ||
+      (/supabase/.test(normalized) &&
+        /(secret|token|key|credential|password|url)/.test(normalized))
+    ) {
+      return [...path, key];
+    }
+    const found = findSupabaseCredentialPath(nested, [...path, key]);
+    if (found) return found;
+  }
+  return undefined;
+}
+
+export const GeneratedRouterConfigSchema = z.object({
+  features: SelectiveFeatureConfigSchema.optional(),
+}).passthrough().superRefine((value, context) => {
+  const path = findSupabaseCredentialPath(value);
+  if (path) {
+    context.addIssue({
+      code: z.ZodIssueCode.custom,
+      path,
+      message: "Supabase runtime credentials belong in the environment only",
+    });
+  }
+});
+
 export type AuthMode = "auto" | "wrapper" | "oauth" | "session" | "env";
 export type InventorySource =
   | "wrapper"
@@ -21,6 +93,7 @@ export type ModelInventoryEntry = {
   notes: string[];
   command?: string;
   args_template?: string[];
+  prompt_transport?: "stdin" | "file";
   invocation_model?: string;
 };
 
@@ -82,6 +155,19 @@ export type PromptContextTrace = {
   context_fetch_error?: string;
 };
 
+export type CostAwareTrace = {
+  enabled: boolean;
+  pricing_source: "configured_estimate_not_live_billing";
+  max_budget_usd?: number;
+  estimated_total_usd?: number;
+  selected_model_ids: string[];
+  excluded: Array<{
+    model_id: string;
+    estimated_cost_usd?: number;
+    reason: "missing_estimate" | "budget_exceeded";
+  }>;
+};
+
 export type DogfoodTrace = {
   run_id: string;
   timestamp: string;
@@ -99,6 +185,7 @@ export type DogfoodTrace = {
   prompt_hash?: string;
   prompt_summary?: string;
   prompt_context?: PromptContextTrace;
+  cost_aware?: CostAwareTrace;
   response_summary?: string;
   schema_valid: boolean;
   redaction_ok: boolean;