@goodandready/dsh-cost-meter 0.8.8 → 0.8.10

package/lib/index.js

@@ -21,6 +21,9 @@ import { dirname, join } from 'node:path'
 import z from '@deepseek-ai/schemastery'
 import { z as zod } from 'zod'
 
+export * from './tariff.js'
+import { indexCatalog, resolveTariff, matchModel } from './tariff.js'
+
 export const name = '@goodandready/dsh-cost-meter'
 export const inject = ['webServer']
 
@@ -35,21 +38,40 @@ export function isLoopback(value) {
 }
 
 export function isTrustedCaller(request) {
-  const remote = request?.socket?.remoteAddress || request?.connection?.remoteAddress
-  if (isLoopback(remote)) return true
-  const site = request?.headers?.['sec-fetch-site']
-  if (site === 'same-origin' || site === 'same-site') return true
+  if (!request) return false
+  const remote = request.socket?.remoteAddress || request.connection?.remoteAddress
+  const site = request.headers?.['sec-fetch-site']
   if (site === 'cross-site') return false
-  const origin = request?.headers?.['origin']
-  const host = request?.headers?.['host']
-  if (origin && host) {
+
+  const host = request.headers?.['x-forwarded-host'] || request.headers?.['host']
+  const origin = request.headers?.['origin']
+  if (origin) {
     try {
       const url = new URL(origin)
-      if (url.host === host) return true
-    } catch (e) {
-      /* invalid url */
+      if (host && url.host.toLowerCase() === host.toLowerCase()) return true
+      if (isLoopback(url.hostname) && isLoopback(remote)) return true
+      return false
+    } catch {
+      return false
+    }
+  }
+
+  const referer = request.headers?.['referer']
+  if (referer) {
+    try {
+      const url = new URL(referer)
+      if (host && url.host.toLowerCase() === host.toLowerCase()) return true
+      if (isLoopback(url.hostname) && isLoopback(remote)) return true
+      return false
+    } catch {
+      return false
     }
   }
+
+  if (site === 'same-site') return false
+  if (site === 'same-origin') return true
+  if (isLoopback(remote)) return true
+
   return false
 }
 
@@ -64,35 +86,6 @@ const PriceRow = z.object({
   output: z.number().description('Output tokens (reasoning included).').default(0),
 })
 
-/**
- * DeepSeek's own tariff, from https://api-docs.deepseek.com/quick_start/pricing.
- * Their API publishes no prices (/models lists ids, there is no pricing route),
- * and OpenRouter's `deepseek/*` entries quote different numbers, so this table
- * is the authoritative source for the official route. Values are PEAK, USD per
- * 1M tokens; off-peak is exactly half. Peak: 01:00-04:00 and 06:00-10:00 UTC.
- */
-const DEEPSEEK_PEAK_RATES = {
-  'deepseek-v4-flash': { cacheHit: 0.014, input: 0.44, cacheWrite: 0.44, output: 1.32 },
-  'deepseek-v4-pro': { cacheHit: 0.044, input: 1.32, cacheWrite: 1.32, output: 3.96 },
-}
-const DEEPSEEK_PEAK_WINDOWS = [{ start: 60, end: 240 }, { start: 360, end: 600 }]
-
-/** Common provider / vendor aliases for seamless catalog matching. */
-export const VENDOR_ALIASES = {
-  'z-ai': 'zai',
-  'zai': 'zai',
-  'google': 'google',
-  'gemini': 'google',
-  'deepseek-ai': 'deepseek',
-  'deepseek-official': 'deepseek',
-  'deepseek': 'deepseek',
-  'anthropic-ai': 'anthropic',
-  'anthropic': 'anthropic',
-  'openai': 'openai',
-  'meta-llama': 'meta-llama',
-  'meta': 'meta-llama',
-}
-
 export const Config = z.object({
   currency: z.string().description('Currency symbol shown in the widget.').default('$'),
   usdRate: z.number().description('Units of `currency` per USD. 1 keeps everything in USD.').default(1),
@@ -131,113 +124,6 @@ export const Config = z.object({
     .default(1),
 })
 
-/** OpenRouter prices are USD per token; the widget speaks per 1M tokens. */
-function perMillion(value) {
-  const n = Number(value)
-  return Number.isFinite(n) ? n * 1e6 : 0
-}
-
-/** Pull the four buckets out of one OpenRouter pricing object. */
-function bucketsOf(pricing) {
-  return {
-    cacheHit: perMillion(pricing.input_cache_read),
-    input: perMillion(pricing.prompt),
-    cacheWrite: perMillion(pricing.input_cache_write),
-    output: perMillion(pricing.completion),
-  }
-}
-
-/** OpenRouter encodes window edges as UTC HHMM integers (1000 = 10:00). */
-export function hhmmToMinutes(value) {
-  const n = Number(value)
-  if (!Number.isFinite(n) || n < 0 || n > 2400) return undefined
-  return Math.floor(n / 100) * 60 + (n % 100)
-}
-
-/** "HH:MM-HH:MM" -> {start,end} in minutes; undefined when malformed. */
-export function parseWindow(spec) {
-  const m = /^(\d{1,2}):(\d{2})-(\d{1,2}):(\d{2})$/.exec(String(spec).trim())
-  if (!m) return undefined
-  return { start: Number(m[1]) * 60 + Number(m[2]), end: Number(m[3]) * 60 + Number(m[4]) }
-}
-
-/**
- * Normalize one catalog entry into the schedule the browser consumes:
- * a base rate card plus the discount windows that shadow it.
- */
-function scheduleOf(entry) {
-  const pricing = entry.pricing || {}
-  const base = bucketsOf(pricing)
-  const windows = []
-  for (const override of pricing.overrides || []) {
-    const start = hhmmToMinutes(override.utc_start)
-    const end = hhmmToMinutes(override.utc_end)
-    if (start === undefined || end === undefined) continue
-    // An override omits buckets it does not change; fall back to the base.
-    const rates = bucketsOf(override)
-    windows.push({
-      start,
-      end,
-      rates: {
-        cacheHit: rates.cacheHit || base.cacheHit,
-        input: rates.input || base.input,
-        cacheWrite: rates.cacheWrite || base.cacheWrite,
-        output: rates.output || base.output,
-      },
-    })
-  }
-  return { base, windows }
-}
-
-/**
- * Map a harness route onto an OpenRouter id. Exact id first, then normalized
- * vendor alias + model, then vendor suffix.
- */
-export function matchModel(index, route, modelMap) {
-  if (!route || !index) return undefined
-  const key = route.provider ? route.provider + '/' + route.model : route.model
-  const mapped = modelMap && (modelMap[key] || modelMap[route.model])
-  if (mapped && index.byId && index.byId[mapped]) return mapped
-  if (index.byId && index.byId[key]) return key
-  if (index.byId && index.byId[route.model]) return route.model
-
-  // Provider alias check (e.g. z-ai -> zai, deepseek-official -> deepseek)
-  const prov = String(route.provider || '').toLowerCase()
-  const aliasProv = VENDOR_ALIASES[prov]
-  if (aliasProv && route.model) {
-    const aliasKey = (aliasProv + '/' + route.model).toLowerCase()
-    if (index.byLowerId && index.byLowerId[aliasKey]) return index.byLowerId[aliasKey]
-  }
-
-  // Harness routes name models in their own casing (`MiniMax-M3`), the catalog
-  // is lower-case (`minimax/minimax-m3`), so matching is case-insensitive.
-  const lower = String(route.model).toLowerCase()
-  const byLowerId = index.byLowerId || {}
-  if (byLowerId[lower]) return byLowerId[lower]
-  if (byLowerId[key.toLowerCase()]) return byLowerId[key.toLowerCase()]
-  const bySuffix = index.bySuffix || {}
-  const list = bySuffix[lower]
-  return list && list.length ? list[0] : undefined
-}
-
-/** Build lookup tables once per fetch; the raw catalog is ~700 KB. */
-export function indexCatalog(models) {
-  const byId = {}
-  const byLowerId = {}
-  const bySuffix = {}
-  for (const entry of models) {
-    if (!entry || typeof entry.id !== 'string' || !entry.pricing) continue
-    // Variants like ":batch" or ":free" are different products; skip them so a
-    // suffix match cannot silently price against a cheaper batch tier.
-    if (entry.id.includes(':')) continue
-    byId[entry.id] = scheduleOf(entry)
-    byLowerId[entry.id.toLowerCase()] = entry.id
-    const suffix = entry.id.includes('/') ? entry.id.slice(entry.id.indexOf('/') + 1) : entry.id
-    ;(bySuffix[suffix.toLowerCase()] = bySuffix[suffix.toLowerCase()] || []).push(entry.id)
-  }
-  return { byId, byLowerId, bySuffix }
-}
-
 // ---------------------------------------------------------------------------
 // Per-model usage projection
 // ---------------------------------------------------------------------------
@@ -300,15 +186,35 @@ export function slotOf(timeMs) {
   return Math.floor((d.getUTCHours() * 60 + d.getUTCMinutes()) / 30)
 }
 
-const usageByModelProjection = {
+const modelSlotsSchema = zod.record(zod.string(), bucketSchema)
+
+const costByModelViewSchema = zod.object({
+  models: zod.array(zod.object({
+    provider: zod.string(),
+    model: zod.string(),
+    slots: modelSlotsSchema,
+  }).strict()),
+}).strict()
+
+const costByModelStateSchema = zod.object({
+  route: zod.object({
+    provider: zod.string(),
+    model: zod.string(),
+  }).nullable(),
+  byKey: zod.record(zod.string(), modelSlotsSchema),
+  last: zod.object({
+    turn: zod.number().int().nonnegative(),
+    step: zod.number().int().nonnegative(),
+    key: zod.string(),
+    slot: zod.string(),
+    buckets: bucketSchema,
+  }).nullable(),
+}).strict()
+
+export const usageByModelProjection = {
   key: 'costByModel',
-  schema: zod.object({
-    models: zod.array(zod.object({
-      provider: zod.string(),
-      model: zod.string(),
-      slots: zod.record(zod.string(), bucketSchema),
-    })),
-  }).strict(),
+  stateVersion: 2,
+  stateSchema: costByModelStateSchema,
   init: () => ({ route: null, byKey: {}, last: null }),
   apply: (state, event) => {
     if (event.type === 'request/header') {
@@ -344,17 +250,19 @@ const usageByModelProjection = {
       last: { turn: sample.turn, step: sample.step, key, slot, buckets },
     }
   },
-  view: (state) => ({
-    models: Object.keys(state.byKey).map((key) => {
-      const slash = key.indexOf('/')
-      return {
-        provider: key.slice(0, slash),
-        model: key.slice(slash + 1),
-        slots: state.byKey[key],
-      }
+  wire: {
+    viewSchema: costByModelViewSchema,
+    view: (state) => ({
+      models: Object.keys(state.byKey).map((key) => {
+        const slash = key.indexOf('/')
+        return {
+          provider: key.slice(0, slash),
+          model: key.slice(slash + 1),
+          slots: state.byKey[key],
+        }
+      }),
     }),
-  }),
-  stateVersion: 2,
+  },
 }
 
 /** The agent's default route, read off settings descriptors when available. */
@@ -373,80 +281,6 @@ function defaultRoute(ctx) {
   }
 }
 
-/**
- * Resolve one route's tariff: manual config wins, then DeepSeek's own table,
- * then the OpenRouter catalog.
- */
-export function resolveTariff(cfg, index, route) {
-  if (!route) return { schedule: null, source: 'none', matchedId: null }
-  const key = route.provider ? route.provider + '/' + route.model : route.model
-  const prices = cfg.prices || {}
-  const manual = prices[key] || prices[route.model] || prices['*']
-
-  if (manual) {
-    const base = {
-      cacheHit: Number(manual.cacheHit) || 0,
-      input: Number(manual.input) || 0,
-      cacheWrite: Number(manual.cacheWrite) || 0,
-      output: Number(manual.output) || 0,
-    }
-    const factor = Number(cfg.manualOffPeakMultiplier) || 1
-    const windows = []
-    for (const spec of cfg.manualPeakWindowsUtc || []) {
-      const parsed = parseWindow(spec)
-      if (parsed) windows.push({ start: parsed.start, end: parsed.end, rates: base })
-    }
-    const schedule = windows.length
-      ? {
-          base: {
-            cacheHit: base.cacheHit * factor,
-            input: base.input * factor,
-            cacheWrite: base.cacheWrite * factor,
-            output: base.output * factor,
-          },
-          windows,
-        }
-      : { base, windows: [] }
-    return { schedule, source: 'manual', matchedId: key }
-  }
-
-  const providerLower = String(route.provider || '').toLowerCase()
-  if (providerLower === 'openrouter' && cfg.useOpenRouter !== false) {
-    const matchedId = matchModel(index, route, cfg.modelMap)
-    if (matchedId) return { schedule: index.byId[matchedId], source: 'openrouter', matchedId }
-  }
-
-  const base = String(route.model).toLowerCase().split(':')[0]
-  const peak = (cfg.deepseekPeakPrices || {})[base] || DEEPSEEK_PEAK_RATES[base]
-  if (peak) {
-    const full = {
-      cacheHit: Number(peak.cacheHit) || 0,
-      input: Number(peak.input) || 0,
-      cacheWrite: Number(peak.cacheWrite) || 0,
-      output: Number(peak.output) || 0,
-    }
-    return {
-      schedule: {
-        base: {
-          cacheHit: full.cacheHit / 2,
-          input: full.input / 2,
-          cacheWrite: full.cacheWrite / 2,
-          output: full.output / 2,
-        },
-        windows: DEEPSEEK_PEAK_WINDOWS.map((w) => ({ start: w.start, end: w.end, rates: full })),
-      },
-      source: 'deepseek',
-      matchedId: base,
-    }
-  }
-
-  if (cfg.useOpenRouter !== false) {
-    const matchedId = matchModel(index, route, cfg.modelMap)
-    if (matchedId) return { schedule: index.byId[matchedId], source: 'openrouter', matchedId }
-  }
-  return { schedule: null, source: 'none', matchedId: null }
-}
-
 /** "provider/model" -> {provider, model}; the model half may contain slashes. */
 export function splitRoute(key) {
   const str = String(key || '').trim()
@@ -516,109 +350,102 @@ export function apply(ctx, config) {
     }
   }
 
-  // Live config from the GUI, with the composition entry as the base layer.
-  ctx.inject(['settings'], (sctx) => {
-    const scope = sctx.settings.register(NS, Config, { base: config })
-    current = scope.get() ?? config
-    const stop = scope.watch(() => {
-      current = scope.get() ?? config
+  // Live config reaction from GUI / settings service
+  ctx.on('settings/updated', (ns, next) => {
+    if (ns === NS && next) {
+      current = { ...config, ...next }
       clearResolveCache()
-      void refresh()
-    })
-    sctx.effect(() => () => {
-      stop()
-      current = config
+    }
+  })
+
+  ctx.on('settings/document-updated', (ns) => {
+    if (!ns || ns === NS) {
       clearResolveCache()
-    })
+    }
+  })
+
+  ctx.inject(['settings'], (sctx) => {
+    if (typeof sctx.settings?.describe === 'function') {
+      try {
+        const desc = sctx.settings.describe(NS)
+        if (desc?.value && typeof desc.value === 'object') {
+          current = { ...config, ...desc.value }
+          clearResolveCache()
+        }
+      } catch {
+        /* namespace might not have descriptor yet */
+      }
+    }
   })
 
-  // Optional capability: headless assemblies without the registry keep working
+  // Hook the session projection so the widget can show spend breakdown.
   ctx.inject(['sessionProjections'], (pctx) => {
     pctx.sessionProjections.register(usageByModelProjection)
   })
 
-  ctx.effect(() => {
-    const controller = new AbortController()
-    void refresh(controller.signal)
-    const timer = setInterval(() => void refresh(controller.signal), 3600e3)
-    return () => {
-      clearInterval(timer)
-      controller.abort()
-    }
-  }, 'dsh-cost-meter: catalog refresh')
-
-  // Route 1: POST /dsh-cost-meter/refresh (manual on-demand sync with 30s cooldown)
+  // Route 1: POST /dsh-cost-meter/refresh (manual catalog reload)
   ctx.effect(
     () =>
       ctx.webServer.register({
-        kind: 'exact',
         path: REFRESH_PATH,
+        method: 'POST',
         handler: async (req, res) => {
-          if (req.method !== 'POST') {
-            res.writeHead(405, { 'Content-Type': 'application/json' })
-            res.end(JSON.stringify({ error: 'method not allowed' }))
-            return
-          }
           if (!isTrustedCaller(req)) {
             res.writeHead(403, { 'Content-Type': 'application/json' })
-            res.end(JSON.stringify({ error: 'forbidden source origin' }))
+            res.end(JSON.stringify({ error: 'forbidden' }))
             return
           }
           const now = Date.now()
-          const COOLDOWN_MS = 30000
-          if (now - lastManualRefreshAt < COOLDOWN_MS) {
-            const retryAfter = Math.ceil((COOLDOWN_MS - (now - lastManualRefreshAt)) / 1000)
-            res.writeHead(429, {
-              'Content-Type': 'application/json',
-              'Retry-After': String(retryAfter),
-            })
-            res.end(JSON.stringify({ error: 'rate limit exceeded', retryAfter }))
+          if (now - lastManualRefreshAt < 60_000) {
+            res.writeHead(429, { 'Content-Type': 'application/json' })
+            res.end(JSON.stringify({ error: 'rate_limited', retryAfterMs: 60_000 - (now - lastManualRefreshAt) }))
             return
           }
           lastManualRefreshAt = now
-          const controller = new AbortController()
-          await refresh(controller.signal, true)
-          const modelsCount = Object.keys((catalog.index && catalog.index.byId) || {}).length
+          await refresh(null, true)
           res.writeHead(200, { 'Content-Type': 'application/json' })
-          res.end(JSON.stringify({
-            ok: !catalog.error,
-            fetchedAt: catalog.fetchedAt,
-            modelsCount,
-            error: catalog.error,
-          }))
+          res.end(
+            JSON.stringify({
+              ok: !catalog.error,
+              fetchedAt: catalog.fetchedAt,
+              models: Object.keys((catalog.index && catalog.index.byId) || {}).length,
+              error: catalog.error,
+            }),
+          )
         },
       }),
     'dsh-cost-meter: refresh route',
   )
 
-  // Route 2: GET /dsh-cost-meter/state (with ETag and 304 Not Modified)
+  // Route 2: GET /dsh-cost-meter/state (the browser poller hits this)
   ctx.effect(
     () =>
       ctx.webServer.register({
-        kind: 'exact',
         path: STATE_PATH,
-        handler: (req, res) => {
-          if (req.method !== 'GET') {
-            res.writeHead(405, { 'Content-Type': 'application/json' })
-            res.end(JSON.stringify({ error: 'method not allowed' }))
-            return
-          }
+        method: 'GET',
+        handler: async (req, res) => {
           const cfg = current ?? config
+
+          // On the very first request after boot, wait for the fetch if we have
+          // no disk cache either. Later runs refresh in the background.
+          if (!catalog.fetchedAt && !catalog.error) {
+            await refresh()
+          } else {
+            void refresh()
+          }
+
           const route = defaultRoute(ctx) ?? null
           const own = getCachedTariff(cfg, route)
 
+          // Also resolve tariffs for any session routes requested in query params
           const schedules = {}
-          const asked = new URL(req.url, 'http://localhost').searchParams.get('models')
-          for (const key of (asked ? asked.split(',') : []).slice(0, 24)) {
-            const trimmed = String(key || '').trim()
-            if (!trimmed || trimmed.length > 128) continue
-            const parsed = splitRoute(trimmed)
-            if (!parsed) continue
-            const resolved = getCachedTariff(cfg, parsed)
-            schedules[trimmed] = {
-              schedule: resolved.schedule,
-              source: resolved.source,
-              matchedId: resolved.matchedId,
+          const url = new URL(req.url, 'http://localhost')
+          const extraRoutes = url.searchParams.getAll('route')
+          for (const key of extraRoutes) {
+            const parsed = splitRoute(key)
+            if (parsed) {
+              const res = getCachedTariff(cfg, parsed)
+              if (res && res.schedule) schedules[key] = res.schedule
             }
           }
 

package/lib/tariff.js

@@ -0,0 +1,236 @@
+// Tariff calculation, normalization, catalog indexing, and model matching.
+// Extracted from lib/index.js for modularity (<600 LOC per file).
+
+/**
+ * DeepSeek's own tariff, from https://api-docs.deepseek.com/quick_start/pricing.
+ * Their API publishes no prices (/models lists ids, there is no pricing route),
+ * and OpenRouter's `deepseek/*` entries quote different numbers, so this table
+ * is the authoritative source for the official route. Values are PEAK, USD per
+ * 1M tokens; off-peak is exactly half. Peak: 01:00-04:00 and 06:00-10:00 UTC.
+ */
+export const DEEPSEEK_PEAK_RATES = {
+  'deepseek-v4-flash': { cacheHit: 0.014, input: 0.44, cacheWrite: 0.44, output: 1.32 },
+  'deepseek-v4-pro': { cacheHit: 0.044, input: 1.32, cacheWrite: 1.32, output: 3.96 },
+}
+export const DEEPSEEK_PEAK_WINDOWS = [{ start: 60, end: 240 }, { start: 360, end: 600 }]
+
+/** Common provider / vendor aliases for seamless catalog matching. */
+export const VENDOR_ALIASES = {
+  'z-ai': 'zai',
+  'zai': 'zai',
+  'google': 'google',
+  'gemini': 'google',
+  'deepseek-ai': 'deepseek',
+  'deepseek-official': 'deepseek',
+  'deepseek': 'deepseek',
+  'anthropic-ai': 'anthropic',
+  'anthropic': 'anthropic',
+  'openai': 'openai',
+  'meta-llama': 'meta-llama',
+  'meta': 'meta-llama',
+}
+
+/** OpenRouter prices are USD per token; the widget speaks per 1M tokens. */
+export function perMillion(value) {
+  const n = Number(value)
+  return Number.isFinite(n) ? n * 1e6 : 0
+}
+
+/** Pull the four buckets out of one OpenRouter pricing object. */
+export function bucketsOf(pricing) {
+  return {
+    cacheHit: perMillion(pricing.input_cache_read),
+    input: perMillion(pricing.prompt),
+    cacheWrite: perMillion(pricing.input_cache_write),
+    output: perMillion(pricing.completion),
+  }
+}
+
+/** OpenRouter encodes window edges as UTC HHMM integers (1000 = 10:00). */
+export function hhmmToMinutes(value) {
+  const n = Number(value)
+  if (!Number.isFinite(n) || n < 0 || n > 2400) return undefined
+  return Math.floor(n / 100) * 60 + (n % 100)
+}
+
+/** "HH:MM-HH:MM" -> {start,end} in minutes; undefined when malformed. */
+export function parseWindow(spec) {
+  const m = /^(\d{1,2}):(\d{2})-(\d{1,2}):(\d{2})$/.exec(String(spec).trim())
+  if (!m) return undefined
+  return { start: Number(m[1]) * 60 + Number(m[2]), end: Number(m[3]) * 60 + Number(m[4]) }
+}
+
+export function overrideBucket(overrideVal, baseVal) {
+  if (overrideVal !== undefined && overrideVal !== null && overrideVal !== '') {
+    const n = Number(overrideVal)
+    if (Number.isFinite(n)) return n * 1e6
+  }
+  return baseVal
+}
+
+/**
+ * Normalize one catalog entry into the schedule the browser consumes:
+ * a base rate card plus the discount windows that shadow it.
+ */
+export function scheduleOf(entry) {
+  const pricing = entry.pricing || {}
+  const base = bucketsOf(pricing)
+  const windows = []
+  for (const override of pricing.overrides || []) {
+    const start = hhmmToMinutes(override.utc_start)
+    const end = hhmmToMinutes(override.utc_end)
+    if (start === undefined || end === undefined) continue
+    // An override omits buckets it does not change; fall back to the base.
+    // Explicit 0 in override must NOT fall back to non-zero base price.
+    windows.push({
+      start,
+      end,
+      rates: {
+        cacheHit: overrideBucket(override.input_cache_read, base.cacheHit),
+        input: overrideBucket(override.prompt, base.input),
+        cacheWrite: overrideBucket(override.input_cache_write, base.cacheWrite),
+        output: overrideBucket(override.completion, base.output),
+      },
+    })
+  }
+  return { base, windows }
+}
+
+/**
+ * Map a harness route onto an OpenRouter id. Exact id first, then normalized
+ * vendor alias + model, then vendor suffix.
+ */
+export function matchModel(index, route, modelMap) {
+  if (!route || !index) return undefined
+  const key = route.provider ? route.provider + '/' + route.model : route.model
+  const mapped = modelMap && (modelMap[key] || modelMap[route.model])
+  if (mapped && index.byId && index.byId[mapped]) return mapped
+  if (index.byId && index.byId[key]) return key
+  if (index.byId && index.byId[route.model]) return route.model
+
+  // Provider alias check (e.g. z-ai -> zai, deepseek-official -> deepseek)
+  const prov = String(route.provider || '').toLowerCase()
+  const aliasProv = VENDOR_ALIASES[prov]
+  if (aliasProv && route.model) {
+    const aliasKey = (aliasProv + '/' + route.model).toLowerCase()
+    if (index.byLowerId && index.byLowerId[aliasKey]) return index.byLowerId[aliasKey]
+  }
+
+  // Harness routes name models in their own casing (`MiniMax-M3`), the catalog
+  // is lower-case (`minimax/minimax-m3`), so matching is case-insensitive.
+  const lower = String(route.model).toLowerCase()
+  const byLowerId = index.byLowerId || {}
+  if (byLowerId[lower]) return byLowerId[lower]
+  if (byLowerId[key.toLowerCase()]) return byLowerId[key.toLowerCase()]
+  const bySuffix = index.bySuffix || {}
+  const list = bySuffix[lower]
+  if (!list || !list.length) return undefined
+  if (list.length === 1) return list[0]
+
+  // Multiple catalog entries share the same model suffix: disambiguate by provider
+  if (route.provider) {
+    const provLower = String(route.provider).toLowerCase()
+    const normProv = VENDOR_ALIASES[provLower] || provLower
+    const matched = list.find((id) => {
+      const slash = id.indexOf('/')
+      if (slash < 0) return false
+      const prefix = id.slice(0, slash).toLowerCase()
+      return prefix === normProv || prefix === provLower
+    })
+    if (matched) return matched
+  }
+  // Ambiguous suffix with no provider match: do not guess arbitrarily
+  return undefined
+}
+
+/** Build lookup tables once per fetch; the raw catalog is ~700 KB. */
+export function indexCatalog(models) {
+  const byId = {}
+  const byLowerId = {}
+  const bySuffix = {}
+  for (const entry of models) {
+    if (!entry || typeof entry.id !== 'string' || !entry.pricing) continue
+    // Variants like ":batch" or ":free" are different products; skip them so a
+    // suffix match cannot silently price against a cheaper batch tier.
+    if (entry.id.includes(':')) continue
+    byId[entry.id] = scheduleOf(entry)
+    byLowerId[entry.id.toLowerCase()] = entry.id
+    const suffix = entry.id.includes('/') ? entry.id.slice(entry.id.indexOf('/') + 1) : entry.id
+    ;(bySuffix[suffix.toLowerCase()] = bySuffix[suffix.toLowerCase()] || []).push(entry.id)
+  }
+  return { byId, byLowerId, bySuffix }
+}
+
+/**
+ * Resolve one route's tariff: manual config wins, then DeepSeek's own table,
+ * then the OpenRouter catalog.
+ */
+export function resolveTariff(cfg, index, route) {
+  if (!route) return { schedule: null, source: 'none', matchedId: null }
+  const key = route.provider ? route.provider + '/' + route.model : route.model
+  const prices = cfg.prices || {}
+  const manual = prices[key] || prices[route.model] || prices['*']
+
+  if (manual) {
+    const base = {
+      cacheHit: Number(manual.cacheHit) || 0,
+      input: Number(manual.input) || 0,
+      cacheWrite: Number(manual.cacheWrite) || 0,
+      output: Number(manual.output) || 0,
+    }
+    const factor = Number(cfg.manualOffPeakMultiplier) || 1
+    const windows = []
+    for (const spec of cfg.manualPeakWindowsUtc || []) {
+      const parsed = parseWindow(spec)
+      if (parsed) windows.push({ start: parsed.start, end: parsed.end, rates: base })
+    }
+    const schedule = windows.length
+      ? {
+          base: {
+            cacheHit: base.cacheHit * factor,
+            input: base.input * factor,
+            cacheWrite: base.cacheWrite * factor,
+            output: base.output * factor,
+          },
+          windows,
+        }
+      : { base, windows: [] }
+    return { schedule, source: 'manual', matchedId: key }
+  }
+
+  const providerLower = String(route.provider || '').toLowerCase()
+  if (providerLower === 'openrouter' && cfg.useOpenRouter !== false) {
+    const matchedId = matchModel(index, route, cfg.modelMap)
+    if (matchedId) return { schedule: index.byId[matchedId], source: 'openrouter', matchedId }
+  }
+
+  const base = String(route.model).toLowerCase().split(':')[0]
+  const peak = (cfg.deepseekPeakPrices || {})[base] || DEEPSEEK_PEAK_RATES[base]
+  if (peak) {
+    const full = {
+      cacheHit: Number(peak.cacheHit) || 0,
+      input: Number(peak.input) || 0,
+      cacheWrite: Number(peak.cacheWrite) || 0,
+      output: Number(peak.output) || 0,
+    }
+    return {
+      schedule: {
+        base: {
+          cacheHit: full.cacheHit / 2,
+          input: full.input / 2,
+          cacheWrite: full.cacheWrite / 2,
+          output: full.output / 2,
+        },
+        windows: DEEPSEEK_PEAK_WINDOWS.map((w) => ({ start: w.start, end: w.end, rates: full })),
+      },
+      source: 'deepseek',
+      matchedId: base,
+    }
+  }
+
+  if (cfg.useOpenRouter !== false) {
+    const matchedId = matchModel(index, route, cfg.modelMap)
+    if (matchedId) return { schedule: index.byId[matchedId], source: 'openrouter', matchedId }
+  }
+  return { schedule: null, source: 'none', matchedId: null }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cost-meter",
-  "version": "0.8.8",
+  "version": "0.8.10",
   "description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
   "type": "module",
   "main": "lib/index.js",