@goodandready/dsh-subscriptions 0.6.72 → 0.6.83

package/lib/http.js

@@ -79,7 +79,34 @@ export function isLoopback(value) {
 
 
 
+function hostNameOf(hostHeader) {
+  const raw = String(Array.isArray(hostHeader) ? (hostHeader[0] || '') : (hostHeader || '')).trim().toLowerCase()
+  if (!raw) return ''
+  if (raw === '::1') return '::1'
+  if (raw.startsWith('[')) {
+    const end = raw.indexOf(']')
+    return end > 0 ? raw.slice(0, end + 1) : raw
+  }
+  return raw.split(':')[0]
+}
+
+function configuredTrustedHosts(targetCtx) {
+  const out = new Set()
+  for (const part of String(process.env.DSH_TRUSTED_HOSTS || '').split(',')) {
+    const host = hostNameOf(part)
+    if (host) out.add(host)
+  }
+  try {
+    const url = targetCtx && targetCtx.webServer && targetCtx.webServer.url
+    if (url) out.add(hostNameOf(new URL(url).host))
+  } catch { /* ignore malformed web server url */ }
+  return out
+}
+
 /**
+ * @param {import('node:http').IncomingMessage} request
+ * @param {any} [targetCtx]
+ * @returns {boolean}/**
  * @param {import('node:http').IncomingMessage} request
  * @param {any} [targetCtx]
  * @returns {boolean}
@@ -103,7 +130,17 @@ export function isTrustedSettingsRequest(request, targetCtx) {
         if (!host || u.host.toLowerCase() !== host.toLowerCase()) {
           return false
         }
-      } else if (u.protocol !== 'dsh-app:') {
+      } else if (u.protocol === 'dsh-app:') {
+        const appHost = u.host.toLowerCase()
+        if (appHost && appHost !== 'app' && appHost !== 'localhost') {
+          return false
+        }
+        const remoteAddr = request?.socket?.remoteAddress || request?.connection?.remoteAddress
+        const hasRemote = Boolean(remoteAddr || request?.socket || request?.connection)
+        if (hasRemote && !isLoopback(request)) {
+          return false
+        }
+      } else {
         return false
       }
     } catch {
@@ -120,7 +157,17 @@ export function isTrustedSettingsRequest(request, targetCtx) {
         if (!host || u.host.toLowerCase() !== host.toLowerCase()) {
           return false
         }
-      } else if (u.protocol !== 'dsh-app:') {
+      } else if (u.protocol === 'dsh-app:') {
+        const appHost = u.host.toLowerCase()
+        if (appHost && appHost !== 'app' && appHost !== 'localhost') {
+          return false
+        }
+        const remoteAddr = request?.socket?.remoteAddress || request?.connection?.remoteAddress
+        const hasRemote = Boolean(remoteAddr || request?.socket || request?.connection)
+        if (hasRemote && !isLoopback(request)) {
+          return false
+        }
+      } else {
         return false
       }
     } catch {
@@ -128,6 +175,20 @@ export function isTrustedSettingsRequest(request, targetCtx) {
     }
   }
 
+  // 4a. Loopback peers must present a loopback or configured Host.
+  // A loopback socket with a foreign Host is a DNS-rebinding attempt.
+  const peerAddress = request?.socket?.remoteAddress || request?.connection?.remoteAddress
+  if (peerAddress && isLoopback(peerAddress)) {
+    const host = hostNameOf(headers.host)
+    const loopbackHost = host === ''
+      || host === 'localhost'
+      || host === 'localhost.'
+      || host === '127.0.0.1'
+      || host === '::1'
+      || host === '[::1]'
+    if (!loopbackHost && !configuredTrustedHosts(targetCtx).has(host)) return false
+  }
+
   // 4. Delegate to DSH connection service if available (#374)
   let conn = null
   try {
@@ -177,7 +238,8 @@ export function isTrustedSettingsRequest(request, targetCtx) {
         if (u.protocol === 'http:' || u.protocol === 'https:') {
           if (u.host.toLowerCase() === host.toLowerCase()) return true
         } else if (u.protocol === 'dsh-app:') {
-          return true
+          const appHost = u.host.toLowerCase()
+          if (!appHost || appHost === 'app' || appHost === 'localhost') return true
         }
       } catch { /* bestEffort */ }
     }
@@ -187,7 +249,8 @@ export function isTrustedSettingsRequest(request, targetCtx) {
         if (u.protocol === 'http:' || u.protocol === 'https:') {
           if (u.host.toLowerCase() === host.toLowerCase()) return true
         } else if (u.protocol === 'dsh-app:') {
-          return true
+          const appHost = u.host.toLowerCase()
+          if (!appHost || appHost === 'app' || appHost === 'localhost') return true
         }
       } catch { /* bestEffort */ }
     }

package/lib/import-auth.js

@@ -6,7 +6,7 @@ import { readClaudeCredentials } from './vendors/claude-cli.js'
 import { readCopilotCredentials } from './vendors/copilot-cli.js'
 import { normalizeExpiresAt } from './blob.js'
 import { isGoogleClientId, extractGoogleClientIdFromJwt, emailFromToken } from './jwt.js'
-import { DEFAULT_CLI_CLIENT_ID, DEFAULT_CLI_CLIENT_SECRET } from './vendors/antigravity.js'
+
 
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
@@ -146,7 +146,8 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  if (!detected.antigravity && (process.platform === 'win32' || activeWindowsCredentialReader)) {
+  const canReadWindowsCredentialManager = Boolean(activeWindowsCredentialReader) || (!activeHome && process.platform === 'win32')
+  if (!detected.antigravity && canReadWindowsCredentialManager) {
     const winCred = readWindowsAntigravityCredential()
     const tok = winCred && winCred.token ? winCred.token : winCred
     if (tok && (tok.access_token || tok.accessToken)) {
@@ -453,10 +454,6 @@ export async function loadLocalCliBlob(provider, options = {}) {
       raw.installed?.client_secret || raw.web?.client_secret || ''
     let clientSecret = typeof directSecret === 'string' ? directSecret.trim() : ''
 
-    if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
-      clientSecret = DEFAULT_CLI_CLIENT_SECRET
-    }
-
     const rawExpiry = tok.expiry ?? tok.expires_at ?? tok.expiresAt ?? tok.expiry_date ?? raw.expiry_date ?? raw.expiry ?? (tok.expires_in ? Date.now() + Number(tok.expires_in) * 1000 : 0)
     const expiresAt = normalizeExpiresAt(rawExpiry)
 

package/lib/index.js

@@ -2,6 +2,7 @@ import { plainConfig } from './config-schema.js'
 export { plainConfig } from './config-schema.js'
 import { readFileSync } from 'node:fs'
 import { bestEffort } from './utils.js'
+import { sweepExpiredPending } from './oauth-pending.js'
 export { Config, publicConfig, Slot, defaultSlots } from './config-schema.js'
 import { Config } from './config-schema.js'
 import { registerRoutes } from './routes.js'
@@ -21,8 +22,10 @@ import { proxyFetch } from './proxy.js'
 import { HistoryStore, resolveHistoryDir } from './history.js'
 import { createDiagnosticsReport } from './diagnostics.js'
 import { createAccountsView } from './accounts-view.js'
+import { inspectScopes } from './scope-inspector.js'
 import { createAdapterManager } from './adapter-manager.js'
-import { pickAccount } from './rotate.js'
+import { pickAccount, isAuthError } from './rotate.js'
+import { notifySessionExpired } from './alerts.js'
 
 export { observeForecast, estimateForecast } from './forecast.js'
 export { formatRelativeReset } from './relative-time.js'
@@ -31,6 +34,9 @@ export { exportVault, importVault } from './vault.js'
 export { recordAlert, getRecentAlerts, checkQuotaThresholds, notifySessionExpired } from './alerts.js'
 export { calculateBurnRatePerHour, computePacingRisk } from './forecast.js'
 export { needsWarmupProbe, enterProbing, resolveWarmupSuccess, resolveWarmupFailure } from './quarantine.js'
+export { encodeQrMatrix, renderAsciiQr, renderSvgQr, renderSvgDataUrl, generateSshTunnelCommand, getHeadlessAuthInfo, handleHeadlessRedirect } from './headless-auth.js'
+export { pushToWebdav, pullFromWebdav, pushToGist, pullFromGist, buildS3SigV4Headers, pushToS3, pullFromS3, syncVaultPush, syncVaultPull, getVaultSyncStatus, resetVaultSyncStatus } from './vault-sync.js'
+import { syncVaultPush, syncVaultPull, getVaultSyncStatus } from './vault-sync.js'
 
 export const name = '@goodandready/dsh-subscriptions'
 export const inject = ['llm', 'credentials', 'webServer', 'settings']
@@ -129,6 +135,7 @@ export function apply(ctx, rawConfig) {
 
   const settingsApi = {
     get: () => live(),
+    revision: () => describeRow()?.revision,
     replace: async (next, expectedRevision) => {
       const parsed = plainConfig(next)
       const prevConfig = cachedConfig
@@ -380,11 +387,15 @@ export function apply(ctx, rawConfig) {
   const pending = new Map()
 
   function sweepPending(now) {
-    for (const [stateKey, row] of pending) {
-      if (now - row.createdAt > PENDING_TTL_MS) pending.delete(stateKey)
-    }
+    sweepExpiredPending(pending, now, PENDING_TTL_MS)
   }
 
+  ctx.effect(() => {
+    const id = setInterval(() => sweepPending(Date.now()), 60 * 1000)
+    if (id && typeof id.unref === 'function') id.unref()
+    return () => clearInterval(id)
+  }, 'dsh-subscriptions: pending oauth sweep')
+
   async function completeOAuth({ provider, index, code, state }) {
     if (!state) throw new Error('missing oauth state')
     sweepPending(Date.now())
@@ -401,14 +412,26 @@ export function apply(ctx, rawConfig) {
       challenge: row.challenge,
       state: row.state,
     }, code, fetchForRef(ref) || fetch)
+    const inspection = inspectScopes(actualProvider, blob.scopes)
+    blob.scopes = inspection.scopes
+    blob.scopeWarning = inspection.scopeWarning || ""
     const slots = normalizeSlots(live().slots)
     const slot = slots.find((s) => s.ref === ref)
     if (slot && slot.label) blob.label = slot.label
-    await store.saveBlob(ref, blob)
+    let existing = {}
+    try { existing = await store.loadBlob(ref) } catch { /* no existing blob on fresh auth */ }
+    const merged = { ...existing, ...blob }
+    await store.saveBlob(ref, merged)
+    store.recordSuccess(ref)
+    store.clearRefreshFailure(ref)
+    store.clearCooldown(ref)
     pending.delete(row.state)
     await syncAdapter()
     refreshModels().catch(() => {})
-    return { ref, label: pmL(blob.label || blob.email) || displayName(actualProvider) }
+    if (live().vaultSyncEnabled && live().vaultSyncAutoPush) {
+      syncVaultPush({ live: live(), store }).catch(() => {})
+    }
+    return { ref, label: pmL(merged.label || merged.email) || displayName(actualProvider) }
   }
 
   // Privacy masking
@@ -449,7 +472,7 @@ export function apply(ctx, rawConfig) {
   }
 
   const diagnosticsReport = () => createDiagnosticsReport({ live, store, history, NS, pkgVersion, heartbeatStats })
-  const accountsView = () => createAccountsView({ live, store, fetch, pmL })
+  const accountsView = () => createAccountsView({ live, store, fetch, pmL, pmE, history })
 
   // Ponytail: background refresh ahead of expiry, single timer
   ctx.effect(() => {
@@ -473,15 +496,51 @@ export function apply(ctx, rawConfig) {
           if (!raw) continue
           const blob = await store.loadBlob(ref).catch(() => null)
           if (!blob || !blob.refreshToken) continue
-          const fresh = await store.ensureFresh(slot.provider, blob, ref).catch(() => null)
+          let fresh
+          try {
+            fresh = await store.ensureFresh(slot.provider, blob, ref)
+          } catch (refreshErr) {
+            if (isAuthError(refreshErr)) {
+              store.recordBroken(ref)
+              store.rememberQuarantine(ref, "SESSION_REVOKED", Date.now() + 86400000, 1)
+              try {
+                notifySessionExpired({
+                  ref,
+                  provider: slot.provider,
+                  message: refreshErr && refreshErr.message,
+                  webhookUrl: cfg.webhookUrl,
+                  fetchImpl: fetch,
+                  nowMs: Date.now(),
+                })
+              } catch { /* alert best-effort */ }
+            }
+            continue
+          }
           if (!fresh) continue
           const vendor = getVendor(slot.provider)
           if (typeof vendor.check !== 'function') continue
           const cfg2 = vendorConfig(slot.provider, live())
           const probeFetch = async (u, i) => ((typeof fetchForRef === 'function' && fetchForRef(ref)) || fetch)(u, i)
-          await vendor.check(fresh, cfg2, probeFetch).catch((e) => {
-            if (logger && logger.warn) logger.warn('[dsh-subscriptions] probe ' + ref + ': ' + String(e && e.message || e).slice(0, 200))
-          })
+          try {
+            await vendor.check(fresh, cfg2, probeFetch)
+            if (typeof store.rememberDoctorVerdict === 'function') store.rememberDoctorVerdict(ref, null)
+          } catch (checkErr) {
+            if (isAuthError(checkErr)) {
+              store.recordBroken(ref)
+              store.rememberQuarantine(ref, "SESSION_REVOKED", Date.now() + 86400000, 1)
+              try {
+                notifySessionExpired({
+                  ref,
+                  provider: slot.provider,
+                  message: checkErr && checkErr.message,
+                  webhookUrl: cfg.webhookUrl,
+                  fetchImpl: fetch,
+                  nowMs: Date.now(),
+                })
+              } catch { /* alert best-effort */ }
+            }
+            if (logger && logger.warn) logger.warn('[dsh-subscriptions] probe ' + ref + ': ' + String(checkErr && checkErr.message || checkErr).slice(0, 200))
+          }
         } catch { /* best-effort */ }
       }
     }
@@ -499,6 +558,35 @@ export function apply(ctx, rawConfig) {
     return () => clearInterval(timer)
   }, 'dsh-subscriptions: probe loop')
 
+  // #562: Background automated remote vault sync loop
+  ctx.effect(() => {
+    const checkSync = async () => {
+      const cfg = live()
+      if (!cfg.vaultSyncEnabled || !cfg.vaultSyncIntervalHours || cfg.vaultSyncIntervalHours <= 0) return
+      const status = getVaultSyncStatus()
+      const now = Date.now()
+      const intervalMs = cfg.vaultSyncIntervalHours * 3600 * 1000
+      const lastPull = status.lastPullAt ? new Date(status.lastPullAt).getTime() : 0
+      if (now - lastPull >= intervalMs) {
+        try {
+          await syncVaultPull({
+            live: cfg,
+            store,
+            settingsApi: getSettingsApi(),
+            syncAdapter,
+            refreshModels,
+          })
+        } catch { /* status captures error */ }
+      }
+    }
+    const intervalId = setInterval(() => { checkSync().catch(() => {}) }, 60 * 60 * 1000)
+    const initialTimer = setTimeout(() => { checkSync().catch(() => {}) }, 30 * 1000)
+    return () => {
+      clearInterval(intervalId)
+      clearTimeout(initialTimer)
+    }
+  }, 'dsh-subscriptions: vault-sync-loop')
+
   registerRoutes(ctx, {
     NS,
     live,

package/lib/jwt.js

@@ -1,9 +1,9 @@
-function decodeJwtPayload(token) {
-  const raw = String(token || '')
-  const parts = raw.split('.')
+export function decodeJwtPayload(token) {
+  const raw = String(token || "")
+  const parts = raw.split(".")
   if (parts.length < 2) return null
   try {
-    const json = Buffer.from(parts[1], 'base64url').toString('utf8')
+    const json = Buffer.from(parts[1], "base64url").toString("utf8")
     return JSON.parse(json)
   } catch {
     return null
@@ -12,42 +12,84 @@ function decodeJwtPayload(token) {
 
 export function chatgptAccountId(token) {
   const payload = decodeJwtPayload(token)
-  if (!payload || typeof payload !== 'object') return ''
+  if (!payload || typeof payload !== "object") return ""
   if (payload.chatgpt_account_id) return String(payload.chatgpt_account_id)
-  const nested = payload['https://api.openai.com/auth']
+  const nested = payload["https://api.openai.com/auth"]
   if (nested && nested.chatgpt_account_id) return String(nested.chatgpt_account_id)
+  if (nested && nested.user_id) return String(nested.user_id)
   const orgs = payload.organizations
   if (Array.isArray(orgs) && orgs[0] && orgs[0].id) return String(orgs[0].id)
-  return ''
+  if (payload.sub) return String(payload.sub)
+  return ""
 }
 
 export function emailFromToken(token) {
   const payload = decodeJwtPayload(token)
-  if (!payload) return ''
-  return String(payload.email || payload.preferred_username || '')
+  if (!payload || typeof payload !== "object") return ""
+  if (payload.email) return String(payload.email)
+  const openaiProf = payload["https://api.openai.com/profile"]
+  if (openaiProf && openaiProf.email) return String(openaiProf.email)
+  if (payload.preferred_username) return String(payload.preferred_username)
+  if (payload.upn) return String(payload.upn)
+  return ""
+}
+
+export function planFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return ""
+  const nested = payload["https://api.openai.com/auth"]
+  if (nested && nested.chatgpt_plan_type) return String(nested.chatgpt_plan_type)
+  const anthropic = payload["https://api.anthropic.com"]
+  if (anthropic && anthropic.plan) return String(anthropic.plan)
+  if (payload.plan_type) return String(payload.plan_type)
+  if (payload.plan) return typeof payload.plan === "string" ? payload.plan : (payload.plan.name || "")
+  if (payload.subscription && payload.subscription.tier) return String(payload.subscription.tier)
+  if (payload.subscription_tier) return String(payload.subscription_tier)
+  if (payload.paidTierName) return String(payload.paidTierName)
+  return ""
+}
+
+export function avatarFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return ""
+  if (payload.picture && typeof payload.picture === "string") return payload.picture
+  if (payload.avatar_url && typeof payload.avatar_url === "string") return payload.avatar_url
+  if (payload.avatar && typeof payload.avatar === "string") return payload.avatar
+  const openaiProf = payload["https://api.openai.com/profile"]
+  if (openaiProf && openaiProf.picture && typeof openaiProf.picture === "string") return openaiProf.picture
+  return ""
+}
+
+export function scopesFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return []
+  const raw = payload.scope || payload.scp || ""
+  if (Array.isArray(raw)) return raw.map(String).filter(Boolean)
+  if (typeof raw === "string") return raw.split(/[\s,]+/).filter(Boolean)
+  return []
 }
 
 export function isGoogleClientId(str) {
-  if (typeof str !== 'string') return false
+  if (typeof str !== "string") return false
   const trimmed = str.trim()
   return /^[0-9]+-[a-zA-Z0-9_-]+\.apps\.googleusercontent\.com$/.test(trimmed)
 }
 
 export function extractGoogleClientIdFromJwt(token) {
   const payload = decodeJwtPayload(token)
-  if (!payload || typeof payload !== 'object') return ''
+  if (!payload || typeof payload !== "object") return ""
 
-  const azp = typeof payload.azp === 'string' ? payload.azp.trim() : ''
+  const azp = typeof payload.azp === "string" ? payload.azp.trim() : ""
   const rawAud = payload.aud
 
   const audiences = Array.isArray(rawAud)
-    ? rawAud.filter(a => typeof a === 'string').map(a => a.trim())
-    : (typeof rawAud === 'string' && rawAud.trim() ? [rawAud.trim()] : [])
+    ? rawAud.filter(a => typeof a === "string").map(a => a.trim())
+    : (typeof rawAud === "string" && rawAud.trim() ? [rawAud.trim()] : [])
 
   if (azp) {
-    if (!isGoogleClientId(azp)) return ''
+    if (!isGoogleClientId(azp)) return ""
     if (audiences.length > 0 && !audiences.includes(azp)) {
-      return ''
+      return ""
     }
     return azp
   }
@@ -57,5 +99,30 @@ export function extractGoogleClientIdFromJwt(token) {
     return validAuds[0]
   }
 
-  return ''
+  return ""
+}
+
+export function organizationsFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return []
+  const raw = payload.organizations ||
+    (payload["https://api.openai.com/auth"] && payload["https://api.openai.com/auth"].organizations) ||
+    payload.orgs ||
+    (payload["https://api.anthropic.com/auth"] && payload["https://api.anthropic.com/auth"].organizations) ||
+    []
+  if (!Array.isArray(raw)) return []
+  const out = []
+  for (const item of raw) {
+    if (typeof item === "string" && item.trim()) {
+      out.push({ id: item.trim(), name: item.trim() })
+    } else if (item && typeof item === "object") {
+      const id = String(item.id || item.org_id || item.uuid || "").trim()
+      const name = String(item.title || item.name || item.org_name || id).trim()
+      const role = item.role ? String(item.role).trim() : undefined
+      if (id) {
+        out.push({ id, name: name || id, ...(role ? { role } : {}) })
+      }
+    }
+  }
+  return out
 }

package/lib/loopback.js

@@ -30,8 +30,9 @@ export function startLoopback({ redirectUri, timeoutMs = 10 * 60 * 1000, onCode
   const promise = new Promise((resolve, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || '/', `http://127.0.0.1:${port}`)
-      // The provider may redirect to a suffixed path (e.g. /auth/callback/extra)
-      if (!url.pathname.startsWith(path)) {
+      // The provider may redirect to a suffixed path (e.g. /auth/callback/extra) (#545)
+      const matchesPath = url.pathname === path || (path.endsWith("/") ? url.pathname.startsWith(path) : url.pathname.startsWith(path + "/"));
+      if (!matchesPath) {
         res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' })
         res.end(ERR_HTML)
         return

package/lib/mask.js

@@ -20,6 +20,22 @@ export function maskText(value) {
   return String(value || '').replace(EMAIL_RE, (m) => maskEmail(m))
 }
 
+const SECRET_PATTERNS = [
+  [/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED]'],
+  [/\b(?:sk|ghp|gho|ghu|ghs|ghr|github_pat|xox[baprs])[-_][A-Za-z0-9._-]{8,}/g, '[REDACTED]'],
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, '[REDACTED]'],
+  [/\b(access_token|refresh_token|token|key|secret|password)=([^&\s]+)/gi, '$1=[REDACTED]'],
+]
+
+// #578: redact credentials as well as emails from free-text diagnostics.
+export function maskSecrets(value) {
+  let text = maskText(value)
+  for (const [pattern, replacement] of SECRET_PATTERNS) {
+    text = text.replace(pattern, replacement)
+  }
+  return text
+}
+
 export function cleanErrorMessage(raw) {
   if (!raw) return ''
   let text = typeof raw === 'string' ? raw : (raw.message || String(raw))

package/lib/oauth-pending.js

@@ -0,0 +1,12 @@
+// #580: shared expiry sweep for in-memory OAuth pending rows.
+export function sweepExpiredPending(pending, nowMs, ttlMs) {
+  let removed = 0
+  for (const [stateKey, row] of pending) {
+    const createdAt = Number(row && row.createdAt)
+    if (!Number.isFinite(createdAt) || Number(nowMs) - createdAt > Number(ttlMs)) {
+      pending.delete(stateKey)
+      removed += 1
+    }
+  }
+  return removed
+}

package/lib/pricing.js

@@ -0,0 +1,89 @@
+// Subscription Value Delivered & API Cost Equivalent Counter (#561)
+// Translates raw prompt, completion and cache tokens into equivalent official API pricing,
+// comparing delivered value against monthly subscription fee ($20/mo standard).
+
+export const DEFAULT_SUBSCRIPTION_MONTHLY_COST = 20.0
+
+export const TOKEN_RATES = {
+  'claude-3-7-sonnet': { prompt: 3.0, completion: 15.0, cacheRead: 0.3 },
+  'claude-3-5-sonnet': { prompt: 3.0, completion: 15.0, cacheRead: 0.3 },
+  'claude-3-5-haiku': { prompt: 0.8, completion: 4.0, cacheRead: 0.08 },
+  'claude-3-opus': { prompt: 15.0, completion: 75.0, cacheRead: 1.5 },
+  'gpt-4o': { prompt: 2.5, completion: 10.0, cacheRead: 1.25 },
+  'gpt-4o-mini': { prompt: 0.15, completion: 0.6, cacheRead: 0.075 },
+  'o1': { prompt: 15.0, completion: 60.0, cacheRead: 7.5 },
+  'o3-mini': { prompt: 1.1, completion: 4.4, cacheRead: 0.55 },
+  'grok-2': { prompt: 2.0, completion: 10.0, cacheRead: 0.2 },
+  'sonar-reasoning': { prompt: 5.0, completion: 25.0, cacheRead: 0.5 },
+  'sonar-pro': { prompt: 3.0, completion: 15.0, cacheRead: 0.3 },
+  'sonar': { prompt: 1.0, completion: 5.0, cacheRead: 0.1 },
+  'gemini-1.5-pro': { prompt: 1.25, completion: 5.0, cacheRead: 0.3 },
+  'gemini-2.0-flash': { prompt: 0.1, completion: 0.4, cacheRead: 0.025 },
+  'default': { prompt: 2.5, completion: 10.0, cacheRead: 0.5 },
+}
+
+/**
+ * Resolves standard token rates per 1M tokens for a given model identifier.
+ * @param {string} [modelId]
+ * @returns {{ prompt: number, completion: number, cacheRead: number }}
+ */
+export function lookupTokenRate(modelId = '') {
+  const m = String(modelId || '').toLowerCase()
+  for (const [key, rates] of Object.entries(TOKEN_RATES)) {
+    if (key !== 'default' && m.includes(key)) {
+      return rates
+    }
+  }
+  return TOKEN_RATES.default
+}
+
+/**
+ * Calculates dollar cost equivalent for the given token quantities.
+ * @param {number} promptTokens
+ * @param {number} completionTokens
+ * @param {number} [cacheReadTokens]
+ * @param {string} [modelId]
+ * @returns {number}
+ */
+export function calculateEquivalentCost(promptTokens = 0, completionTokens = 0, cacheReadTokens = 0, modelId = 'default') {
+  const rates = lookupTokenRate(modelId)
+  const p = (Number(promptTokens) || 0) * (rates.prompt / 1_000_000)
+  const c = (Number(completionTokens) || 0) * (rates.completion / 1_000_000)
+  const cr = (Number(cacheReadTokens) || 0) * (rates.cacheRead / 1_000_000)
+  return Math.round((p + c + cr) * 100) / 100
+}
+
+/**
+ * Computes value delivered metrics and ROI ratio for an account.
+ * @param {object} params
+ * @param {number} [params.promptTokens]
+ * @param {number} [params.completionTokens]
+ * @param {number} [params.cacheReadTokens]
+ * @param {string} [params.modelId]
+ * @param {number} [params.subscriptionCost]
+ * @returns {object}
+ */
+export function calculateValueDelivered({
+  promptTokens = 0,
+  completionTokens = 0,
+  cacheReadTokens = 0,
+  modelId = 'default',
+  subscriptionCost = DEFAULT_SUBSCRIPTION_MONTHLY_COST,
+} = {}) {
+  const equivalentCost = calculateEquivalentCost(promptTokens, completionTokens, cacheReadTokens, modelId)
+  const subCost = Number(subscriptionCost) > 0 ? Number(subscriptionCost) : DEFAULT_SUBSCRIPTION_MONTHLY_COST
+  const roiMultiplier = Math.round((equivalentCost / subCost) * 10) / 10
+  const roiLabel = `${roiMultiplier}x`
+
+  return {
+    equivalentCost,
+    formattedCost: `$${equivalentCost.toFixed(2)}`,
+    subscriptionCost: subCost,
+    formattedSubscriptionCost: `$${subCost.toFixed(2)}`,
+    roiMultiplier,
+    roiLabel,
+    promptTokens: Number(promptTokens) || 0,
+    completionTokens: Number(completionTokens) || 0,
+    cacheReadTokens: Number(cacheReadTokens) || 0,
+  }
+}

package/lib/refs.js

@@ -56,6 +56,8 @@ const DISPLAY = {
   cursor: 'Cursor',
   kiro: 'AWS Kiro',
   copilot: 'GitHub Copilot',
+  perplexity: 'Perplexity Pro',
+  jetbrains: 'JetBrains AI',
 }
 
 export function displayName(provider) {