@kenz1117/dsh-ui-usage-billing 1.4.2 → 1.4.4

package/lib/types/aggregate.d.ts

@@ -13,8 +13,9 @@
 import { SessionLogOffset } from '@deepseek-ai/dsh-session/types';
 import type { SessionEvent, SessionHeader, SessionId } from '@deepseek-ai/dsh-session/types';
 import type { TokenUsage } from '@deepseek-ai/dsh-llm';
-import { MODEL_KEY_ALIASES, resolveCatalogKey } from './client/pricing.ts';
-export { MODEL_KEY_ALIASES, resolveCatalogKey };
+import { resolveCatalogKey } from './client/pricing.ts';
+import { BUILTIN_MODEL_KEY_ALIASES } from './builtin-catalog.ts';
+export { BUILTIN_MODEL_KEY_ALIASES, resolveCatalogKey };
 /**
  * 走订阅套餐（coding / token plan / opencode 订阅）的 provider id：这些通道的
  * 调用按套餐计费，不再按 token 计费，因此即使模型 id 与计费表撞名也一律豁免。

package/lib/types/builtin-catalog.d.ts

@@ -0,0 +1,15 @@
+/**
+ * 内置价格目录与别名表的纯数据模块：只随 node 半构建发布（宿主聚合计价使用），
+ * 并经 /api/billing/pricing 下发给客户端注入——client bundle 不携带这份数据
+ * （瘦身：lib/client.js 约 -30 KiB）。条目结构与消费逻辑见 ./client/pricing.ts。
+ */
+import type { ModelEntry } from './client/pricing.ts';
+export declare const BUILTIN_MODEL_CATALOG: readonly ModelEntry[];
+/**
+ * 真实 provider model id → 计费目录键（`MODEL_CATALOG[].key`）的映射。未知 id
+ * 原样保留并落回 `other`（未知模型不估算费用）。聚合层（aggregate.ts）在折叠时
+ * 用同一张表把日志里的 model id 归并为目录键，客户端渲染（`modelOf`）也按它
+ * 解析，两侧共用一份映射，避免同一模型两侧不一致导致「未收录」。
+ */
+export declare const BUILTIN_MODEL_KEY_ALIASES: Readonly<Record<string, string>>;
+//# sourceMappingURL=builtin-catalog.d.ts.map

package/lib/types/client/TrendChart.d.ts

@@ -40,10 +40,11 @@ export type TrendMetric = 'cost' | 'tokens';
  * @param props.currency - display currency for the cost labels.
  * @param props.metric - `cost` (stacked per-model CNY, default) or `tokens` (single-color total tokens).
  */
-export declare function TrendChart({ data, models, currency, metric }: {
+export declare function TrendChart({ data, models, currency, metric, t }: {
     data: readonly TrendPoint[];
     models?: readonly TrendSeriesModel[];
     currency?: CostCurrency;
     metric?: TrendMetric;
+    t?: (key: 'trendEmpty' | 'trendTotal' | 'calls') => string;
 }): React.ReactNode;
 //# sourceMappingURL=TrendChart.d.ts.map

package/lib/types/client/heatmap.d.ts

@@ -20,18 +20,24 @@ export interface HeatmapDay {
     value: number;
 }
 /**
- * Render the month or year heatmap.
- * @param props.days - daily cost rows (keys are `YYYY-MM-DD`).
- * @param props.currency - display currency for the hover amount.
+ * Render the month or week-column heatmap.
+ * @param props.days - daily value rows (keys are `YYYY-MM-DD`); the value's
+ *   meaning follows `props.unit` (CNY cost or raw token count).
+ * @param props.currency - display currency for the hover amount (cost unit).
  * @param props.now - anchor date (defaults to today); injectable for tests.
  * @param props.t - locale function (used for the legend labels).
- * @param props.range - `month` (calendar month) or `year` (last 52 weeks, GitHub style).
+ * @param props.range - `month` (calendar month), `half` (last 26 weeks, large
+ *   cells — the screenshot-friendly Codex-style view) or `year` (last 52
+ *   weeks, GitHub style).
+ * @param props.unit - value metric: `cost` (default, money formatting) or
+ *   `tokens` (compact token formatting).
  */
-export declare function UsageHeatmap({ days, currency, now, t, range }: {
+export declare function UsageHeatmap({ days, currency, now, t, range, unit }: {
     days: readonly HeatmapDay[];
     currency: CostCurrency;
     now?: Date;
-    range?: 'month' | 'year';
+    range?: 'month' | 'half' | 'year';
+    unit?: 'cost' | 'tokens';
     t: (key: 'costAbbr' | 'noData' | 'heatmapLess' | 'heatmapMore') => string;
 }): React.ReactNode;
 //# sourceMappingURL=heatmap.d.ts.map

package/lib/types/client/label-display.d.ts

@@ -0,0 +1,19 @@
+/**
+ * 费率表附加行文案本地化：目录条目里的 `extraRows` `label`/`note`（`显式缓存创建`、
+ * `长期半价` 等）是数据层的中文字面量，同时充当渲染 key。与 provider-display.ts
+ * 同样的做法：不改动数据层形态，只在渲染层提供一张「中文文案 → 英文文案」映射，
+ * 未收录的字符串原样返回。集中一处便于统一管理与将来扩展第三语言。
+ */
+type LabelLang = 'zh' | 'en';
+/**
+ * 把费率表附加行的 label/note 按界面语言本地化：中文映射成英文，其余原样返回。
+ * 仅在渲染层调用，不影响数据层的中文字面量与 key 匹配。
+ * @param text - 数据层原始文案（可能为 undefined，例如没有 note 的行）。
+ * @param lang - 当前界面语言。
+ * @returns 本地化后的文案；`undefined` 原样传回。
+ */
+export declare function localizeRowLabel(text: string, lang: LabelLang): string;
+export declare function localizeRowLabel(text: undefined, lang: LabelLang): undefined;
+export declare function localizeRowLabel(text: string | undefined, lang: LabelLang): string | undefined;
+export {};
+//# sourceMappingURL=label-display.d.ts.map

package/lib/types/client/locales.d.ts

@@ -1,5 +1,5 @@
 /** Locale dictionaries for the usage billing surface. */
-export type UsageBillingKey = 'title' | 'cost' | 'todayCost' | 'monthCost' | 'yearCost' | 'monthProjected' | 'liveTurn' | 'liveSession' | 'calls' | 'cacheHitRate' | 'tokens' | 'inputTokens' | 'outputTokens' | 'avgCost' | 'kpiRange' | 'avgRangeToday' | 'avgRange7d' | 'avgRangeWeek' | 'avgRangeMonth' | 'avgRangeAll' | 'trend' | 'trend7d' | 'trend30d' | 'trendMetric' | 'trendMetricCost' | 'trendMetricTokens' | 'trendEmpty' | 'budget' | 'budgetRemain' | 'budgetAmount' | 'budgetSummary' | 'sessions' | 'sessionTitle' | 'lastActive' | 'sessionOverflow' | 'budgetTierBody' | 'models' | 'providerBilling' | 'channelUnknown' | 'directTag' | 'relayTag' | 'unknownTag' | 'planCountUnit' | 'actual' | 'pricing' | 'input' | 'output' | 'cacheHit' | 'peak' | 'offPeak' | 'flat' | 'band' | 'close' | 'footer' | 'footerCredit' | 'lastUpdated' | 'noData' | 'todayRate' | 'rateLive' | 'rateBuiltin' | 'promoBadge' | 'promoUntil' | 'promoOpenEnded' | 'pricingTip' | 'pricingUnit' | 'pricingNotes' | 'ubPeak' | 'ubOff' | 'ubStd' | 'peakBand' | 'pricingSource' | 'noteCache' | 'noteBand' | 'noteSource' | 'balance' | 'recharge' | 'rechargeHint' | 'balanceUnconfigured' | 'balanceUnauthorized' | 'balanceUnreachable' | 'uncatalogued' | 'estimatedPricing' | 'balanceDays' | 'balanceLowBody' | 'reconcileDrift' | 'reconcileDismiss' | 'subscriptionNotConfigured' | 'subscriptionUnauthorized' | 'subscriptionUnavailable' | 'subscriptionInvalid' | 'subscriptionRateLimited' | 'subscriptionSession' | 'subscriptionWeekly' | 'subscriptionMonthly' | 'subscriptionBilling' | 'subscriptionRemaining' | 'subscriptionExhausted' | 'subscriptionReset' | 'subscriptionNoApi' | 'floatWindow' | 'floatModeCombined' | 'floatModeSubscription' | 'floatMode' | 'floatTargets' | 'floatWindowHint' | 'floatPrimaryToday' | 'floatPrimaryWeek' | 'floatPrimaryMonth' | 'floatNoTargets' | 'floatNoTargetsHint' | 'cardDisplay' | 'cardDisplayHint' | 'cardMetric' | 'cardMetricMoney' | 'cardMetricTokens' | 'cardSpan' | 'cardSpanDay' | 'cardSpanWeek' | 'cardSpanMonth' | 'triggerMonthTokens' | 'triggerTodayTokens' | 'triggerWeekTokens' | 'subscriptionsStale' | 'staleLedgerNotice' | 'tokenCacheWrite' | 'toolRank' | 'toolName' | 'userPrices' | 'userPricesHint' | 'userPriceSave' | 'userPriceModel' | 'userPriceSource' | 'userPriceSourceHint' | 'userPriceOffPeak' | 'userPriceNormal' | 'userPriceCurrency' | 'userPriceAdd' | 'userPriceRemoveSelected' | 'userPriceSelect' | 'sessionStaleBadge' | 'sessionUntitled' | 'heatmapLess' | 'heatmapMore' | 'currency' | 'currencyCny' | 'currencyUsd' | 'heatmap' | 'rounds' | 'roundsHint' | 'anomaly' | 'model' | 'thModel' | 'thInputMiss' | 'thInputHit' | 'costAbbr' | 'tabOverview' | 'tabTrends' | 'tabProviders' | 'tabPricing' | 'tabSettings' | 'budgetHint' | 'peakAlertHint' | 'peakAlertDescPeak' | 'peakAlertDescOff' | 'peakAlertDescPeakZhipu' | 'peakAlertDescOffZhipu' | 'export' | 'exportCsvDay' | 'exportCsvSession' | 'exportJson' | 'peakShare' | 'peakSharePerCall' | 'offPeakSavings' | 'perfMax' | 'weekCost' | 'roleCost' | 'roleUser' | 'roleAssistant' | 'roleTool' | 'roleHint' | 'tierPeak' | 'tierOff' | 'tierToPeak' | 'tierToOff' | 'tierAlertEnterPeak' | 'tierAlertEnterOff' | 'tierAlertEnterPeakZhipu' | 'tierAlertEnterOffZhipu' | 'peakAlertTitlePeak' | 'peakAlertTitleOff' | 'peakAlert' | 'peakAlertLeadMin' | 'peakAlertPos' | 'peakAlertMode' | 'peakAlertPosCorner' | 'peakAlertPosCenter' | 'peakAlertModePeak' | 'peakAlertModeOff' | 'peakAlertModeBoth' | 'peakAlertWebNotify' | 'peakAlertPreview' | 'planTypeCode' | 'planTypeToken' | 'subscriptionFeePerMonth' | 'triggerToday' | 'triggerMonth' | 'subscriptionTag' | 'free' | 'perfSamples' | 'perfTtft' | 'perfP50' | 'perfP90' | 'perfTps' | 'perfLatency' | 'perfEstimated' | 'perfEmpty' | 'perfTpsUnit' | 'perfTitle' | 'perfHint' | 'perfAll' | 'perfChartEmpty' | 'heatmapYear' | 'heatmapMonth' | 'activeDays' | 'streakDays' | 'subscriptionAutoDetect' | 'pluginAuthor' | 'pluginRepository' | 'pluginNpm' | 'pluginLicense' | 'tabToken' | 'tokenExport' | 'tokenExportCsv' | 'tokenReasoningShare' | 'tokenReasoningShort' | 'tokenIo' | 'tokenPeak' | 'tokenDaily' | 'tokenByModel' | 'tokenMiss' | 'tokenHit' | 'tokenOutput' | 'tokenViewStructure' | 'tokenViewModel' | 'tokenHitShort' | 'tokenMissShort' | 'tokenTotal' | 'tokenShare' | 'usageStatsTool' | 'usageStatsToolHint' | 'balanceGranted' | 'balanceTopped' | 'balanceDaily' | 'balanceDaysLong' | 'balanceDaysUnit' | 'popTodayModel' | 'popNoConsumption' | 'popTitle' | 'popDirectLead' | 'popSubLead' | 'unpricedHint' | 'searchEstimateHint' | 'siteListDisplay' | 'siteListDisplayHint' | 'liveCostBar' | 'liveCostBarHint' | 'liveCostBarPosition' | 'liveCostBarPosBelow' | 'liveCostBarPosAbove' | 'liveCostBarPosToolbar' | 'exportCsvSite' | 'panelRelayQuota' | 'relayBalance' | 'relayNoQuota' | 'relayWindowUsed' | 'relayKindNewApi' | 'relayKindSub2Api' | 'relayKindUnknown';
+export type UsageBillingKey = 'title' | 'cost' | 'todayCost' | 'monthCost' | 'yearCost' | 'monthProjected' | 'liveTurn' | 'liveSession' | 'calls' | 'cacheHitRate' | 'tokens' | 'inputTokens' | 'outputTokens' | 'avgCost' | 'kpiRange' | 'avgRangeToday' | 'avgRange7d' | 'avgRangeWeek' | 'avgRangeMonth' | 'avgRangeAll' | 'trend' | 'trend7d' | 'trend30d' | 'trendMetric' | 'trendMetricCost' | 'trendMetricTokens' | 'trendEmpty' | 'trendTotal' | 'roundsUnit' | 'healthModelsLive' | 'healthVendorsDown' | 'healthVendorsUnavailable' | 'budget' | 'budgetRemain' | 'budgetAmount' | 'budgetSummary' | 'sessions' | 'sessionTitle' | 'lastActive' | 'sessionOverflow' | 'budgetTierBody' | 'models' | 'providerBilling' | 'channelUnknown' | 'directTag' | 'relayTag' | 'unknownTag' | 'planCountUnit' | 'actual' | 'pricing' | 'input' | 'output' | 'cacheHit' | 'peak' | 'offPeak' | 'flat' | 'band' | 'close' | 'footer' | 'footerCredit' | 'lastUpdated' | 'noData' | 'todayRate' | 'rateLive' | 'rateBuiltin' | 'pricingSyncedAt' | 'pricingSyncNow' | 'pricingSyncing' | 'promoBadge' | 'promoUntil' | 'promoOpenEnded' | 'pricingTip' | 'pricingUnit' | 'pricingNotes' | 'ubPeak' | 'ubOff' | 'ubStd' | 'peakBand' | 'pricingSource' | 'noteCache' | 'noteBand' | 'noteSource' | 'balance' | 'recharge' | 'rechargeHint' | 'balanceUnconfigured' | 'balanceUnauthorized' | 'balanceUnreachable' | 'uncatalogued' | 'estimatedPricing' | 'balanceDays' | 'balanceLowBody' | 'reconcileDrift' | 'reconcileDismiss' | 'subscriptionNotConfigured' | 'subscriptionUnauthorized' | 'subscriptionUnavailable' | 'subscriptionInvalid' | 'subscriptionRateLimited' | 'subscriptionSession' | 'subscriptionWeekly' | 'subscriptionMonthly' | 'subscriptionBilling' | 'subscriptionRemaining' | 'subscriptionExhausted' | 'subscriptionReset' | 'subscriptionNoApi' | 'floatWindow' | 'floatModeCombined' | 'floatModeSubscription' | 'floatMode' | 'floatTargets' | 'floatWindowHint' | 'floatPrimaryToday' | 'floatPrimaryWeek' | 'floatPrimaryMonth' | 'floatNoTargets' | 'floatNoTargetsHint' | 'cardDisplay' | 'cardDisplayHint' | 'cardMetric' | 'cardMetricMoney' | 'cardMetricTokens' | 'cardSpan' | 'cardSpanDay' | 'cardSpanWeek' | 'cardSpanMonth' | 'triggerMonthTokens' | 'triggerTodayTokens' | 'triggerWeekTokens' | 'subscriptionsStale' | 'staleLedgerNotice' | 'tokenCacheWrite' | 'toolRank' | 'toolName' | 'userPrices' | 'userPricesHint' | 'userPriceSave' | 'userPriceModel' | 'userPriceSource' | 'userPriceSourceHint' | 'userPriceOffPeak' | 'userPriceNormal' | 'userPriceCurrency' | 'userPriceAdd' | 'userPriceRemoveSelected' | 'userPriceSelect' | 'sessionStaleBadge' | 'sessionUntitled' | 'heatmapLess' | 'heatmapMore' | 'currency' | 'currencyCny' | 'currencyUsd' | 'heatmap' | 'rounds' | 'roundsHint' | 'anomaly' | 'model' | 'thModel' | 'thInputMiss' | 'thInputHit' | 'costAbbr' | 'tabOverview' | 'tabTrends' | 'tabProviders' | 'tabPricing' | 'tabSettings' | 'budgetHint' | 'peakAlertHint' | 'peakAlertDescPeak' | 'peakAlertDescOff' | 'peakAlertDescPeakZhipu' | 'peakAlertDescOffZhipu' | 'export' | 'exportCsvDay' | 'exportCsvSession' | 'exportJson' | 'peakShare' | 'peakSharePerCall' | 'offPeakSavings' | 'perfMax' | 'weekCost' | 'roleCost' | 'roleUser' | 'roleAssistant' | 'roleTool' | 'roleHint' | 'tierPeak' | 'tierOff' | 'tierToPeak' | 'tierToOff' | 'tierAlertEnterPeak' | 'tierAlertEnterOff' | 'tierAlertEnterPeakZhipu' | 'tierAlertEnterOffZhipu' | 'peakAlertTitlePeak' | 'peakAlertTitleOff' | 'peakAlert' | 'peakAlertLeadMin' | 'peakAlertPos' | 'peakAlertMode' | 'peakAlertPosCorner' | 'peakAlertPosCenter' | 'peakAlertModePeak' | 'peakAlertModeOff' | 'peakAlertModeBoth' | 'peakAlertWebNotify' | 'peakAlertPreview' | 'planTypeCode' | 'planTypeToken' | 'subscriptionFeePerMonth' | 'triggerToday' | 'triggerMonth' | 'subscriptionTag' | 'free' | 'perfSamples' | 'perfTtft' | 'perfP50' | 'perfP90' | 'perfTps' | 'perfLatency' | 'perfEstimated' | 'perfEmpty' | 'perfTpsUnit' | 'perfTitle' | 'perfHint' | 'perfAll' | 'perfChartEmpty' | 'heatmapYear' | 'heatmapHalf' | 'heatmapMonth' | 'metricCost' | 'metricTokens' | 'heatmapTotal' | 'activeDays' | 'streakDays' | 'subscriptionAutoDetect' | 'pluginAuthor' | 'pluginRepository' | 'pluginNpm' | 'pluginLicense' | 'tabToken' | 'tokenExport' | 'tokenExportCsv' | 'tokenReasoningShare' | 'tokenReasoningShort' | 'tokenIo' | 'tokenPeak' | 'tokenDaily' | 'tokenByModel' | 'tokenMiss' | 'tokenHit' | 'tokenOutput' | 'tokenViewStructure' | 'tokenViewModel' | 'tokenHitShort' | 'tokenMissShort' | 'tokenTotal' | 'tokenShare' | 'usageStatsTool' | 'usageStatsToolHint' | 'balanceGranted' | 'balanceTopped' | 'balanceDaily' | 'balanceDaysLong' | 'balanceDaysUnit' | 'popTodayModel' | 'popNoConsumption' | 'popTitle' | 'popDirectLead' | 'popSubLead' | 'unpricedHint' | 'searchEstimateHint' | 'siteListDisplay' | 'siteListDisplayHint' | 'liveCostBar' | 'liveCostBarHint' | 'liveCostBarPosition' | 'liveCostBarPosBelow' | 'liveCostBarPosAbove' | 'liveCostBarPosToolbar' | 'exportCsvSite' | 'panelRelayQuota' | 'relayBalance' | 'relayNoQuota' | 'relayWindowUsed' | 'relayKindNewApi' | 'relayKindSub2Api' | 'relayKindUnknown';
 export declare const NS = "usageBilling";
 export declare const zh: Record<UsageBillingKey, string>;
 export declare const en: Record<UsageBillingKey, string>;

package/lib/types/client/pricing.d.ts

@@ -341,14 +341,17 @@ export interface ModelEntry {
      */
     retired?: boolean;
 }
-export declare const MODEL_CATALOG: readonly ModelEntry[];
 /**
- * 真实 provider model id → 计费目录键（`MODEL_CATALOG[].key`）的映射。未知 id
- * 原样保留并落回 `other`（未知模型不估算费用）。聚合层（aggregate.ts）在折叠时
- * 用同一张表把日志里的 model id 归并为目录键，客户端渲染（`modelOf`）也按它
- * 解析，两侧共用一份映射，避免同一模型两侧不一致导致「未收录」。
+ * 注入内置目录与别名表（两侧各调用一次：宿主 activate、客户端首个 pricing 响应）。
+ * 重复注入整体替换并重建归一化索引。
+ * @param catalog - 内置目录条目（BUILTIN_MODEL_CATALOG 全量）。
+ * @param aliases - 内置别名表（BUILTIN_MODEL_KEY_ALIASES 全量）。
  */
-export declare const MODEL_KEY_ALIASES: Readonly<Record<string, string>>;
+export declare function applyBuiltinCatalog(catalog: readonly ModelEntry[], aliases: Readonly<Record<string, string>>): void;
+/** 内置目录当前快照：未注入为空数组（client 首帧前渲染加载态）。 */
+export declare function modelCatalog(): readonly ModelEntry[];
+/** 内置别名表当前快照：未注入为空对象。 */
+export declare function modelKeyAliases(): Readonly<Record<string, string>>;
 /**
  * 模型 id 归一化：小写、去括号附注（如 `gpt5.6 luna(go)` 只看主体）、再去所有
  * 非字母数字分隔符（空格 / 横杠 / 点 / 下划线）。用于日志里的模型 id 与计费

package/lib/types/client/round-chart.d.ts

@@ -32,6 +32,6 @@ export declare function RoundCostChart({ rounds, flags, currency, t }: {
     rounds: readonly RoundChartRow[];
     flags: readonly AnomalyFlag[];
     currency: CostCurrency;
-    t: (key: 'model' | 'costAbbr') => string;
+    t: (key: 'model' | 'costAbbr' | 'roundsUnit') => string;
 }): React.ReactNode;
 //# sourceMappingURL=round-chart.d.ts.map

package/lib/types/client/usage-billing-settings.d.ts

@@ -6,7 +6,7 @@
  * client 半区在「设置」Tab 渲染开关并写入同一命名空间。缺省的默认行为是关闭——
  * 避免该工具默认占用模型每次请求的上下文（coding 场景通常在仪表盘看用量）。
  */
-import type { UserPriceEntry } from './pricing.ts';
+import type { CostCurrency, UserPriceEntry } from './pricing.ts';
 /** 设置命名空间 id（小写 kebab-case）。 */
 export declare const BILLING_SETTINGS_NAMESPACE = "ui-usage-billing";
 /** 该命名空间下用户可编辑的字段名。 */
@@ -107,6 +107,20 @@ export declare const LIVE_COST_BAR_PREF_EVENT = "dsh.ui-usage-billing.livecost-p
 export declare function loadLiveCostBarPrefs(): LiveCostBarPrefs;
 /** 写入即时代费条偏好。失败静默（展示偏好非关键）。 */
 export declare function saveLiveCostBarPrefs(prefs: LiveCostBarPrefs): void;
+/**
+ * 显示币种（¥ / ≈$）。纯 client 偏好，存 localStorage；仪表盘、侧边栏卡片与
+ * 输入框胶囊分属不同 React 树，跨树同步走 localStorage + `CURRENCY_PREF_EVENT`
+ * CustomEvent（同文档即时生效，跨标签页靠 storage 事件）——与即时代费条偏好同一套做法。
+ */
+export declare const CURRENCY_STORAGE_KEY = "dsh.ui-usage-billing.currency";
+/** 币种切换后派发的 CustomEvent 名（另一棵树监听它即时重读）。 */
+export declare const CURRENCY_PREF_EVENT = "dsh.ui-usage-billing.currency-pref";
+/** 默认币种：人民币（保持历史行为）。 */
+export declare const DEFAULT_CURRENCY: CostCurrency;
+/** 读取显示币种（损坏/缺失/非法值一律回退默认）。仅在浏览器半区调用。 */
+export declare function loadCurrency(): CostCurrency;
+/** 写入显示币种。失败静默（展示偏好非关键）。 */
+export declare function saveCurrency(currency: CostCurrency): void;
 /** 用户自定义单价（与 client/pricing.ts 的 `UserPriceEntry` 同形；type import，无运行时依赖）。 */
 export type StoredUserPrice = UserPriceEntry;
 /** 自定义价表：模型（+可选来源）→ 单价，条目列表（支持同名模型绑定不同中转站 origin）。 */

package/lib/types/index.d.ts

@@ -19,6 +19,16 @@ import type { SettingsProvider } from '@deepseek-ai/dsh-settings';
 import { type UsageLedgerStore, type UsagePersistence } from './aggregate.ts';
 import type { CustomBalanceConfig, DeclaredEndpointConfig, SubscriptionPlanConfig } from './pricing-shared.ts';
 import { type IdentifiedSubscriptionPlan, type SubscriptionKeys } from './subscriptions.ts';
+/** 校验 Host 头是本机回环（精确 127.0.0.0/8 / ::1 / localhost 或空，供 curl 不带 Host 的极简请求）。
+ *  拒绝 `127.0.0.1.attacker.com` 这类以 `127.` 开头但解析到外部的 DNS rebinding 域名：
+ *  只用 `startsWith('127.')` 会被它穿透，必须精确匹配回环 IP 的字面量。 */
+/**
+ * 信任主机名归一化：去空白、去端口、转小写，丢弃空项。与请求侧
+ * `host.split(':')[0].toLowerCase()` 同口径，因此匹配忽略大小写与端口。
+ * @param hosts - 配置里的原始名单。
+ * @returns 归一化后的主机名集合（空集 = 与历史版本行为一致）。
+ */
+export declare function normalizeTrustedHosts(hosts: readonly string[] | undefined): ReadonlySet<string>;
 /**
  * 回环防护守卫：仅接受回环 GET 请求（peer socket 地址 + Host 头同时校验）。
  * 不满足时返回 403 并结束响应；调用方在 handler 顶部调用，返回 false 即已拒绝。
@@ -26,7 +36,7 @@ import { type IdentifiedSubscriptionPlan, type SubscriptionKeys } from './subscr
  * @param res - 当前响应。
  * @returns 是否放行；false = 已拒绝并结束响应。
  */
-export declare function guardLoopback(req: IncomingMessage, res: ServerResponse): boolean;
+export declare function guardLoopback(req: IncomingMessage, res: ServerResponse, trustedHosts?: ReadonlySet<string>): boolean;
 /** Plugin configuration. */
 export interface UsageBillingConfig {
     /** Absolute path to a `.dsh-usage-stats.json` fallback file. */
@@ -60,6 +70,14 @@ export interface UsageBillingConfig {
      * 写死在 declarative.ts。缺省空。
      */
     declaredEndpoints?: readonly DeclaredEndpointConfig[];
+    /**
+     * 允许通过 Host 头校验的额外主机名（反向代理场景）；缺省空，行为与历史版本完全一致。
+     * 仅在 peer socket 已通过回环校验后才参考：socket 校验仍为强制且不受本字段影响，
+     * 本名单只放宽「纵深防御」的第二层。匹配为**精确主机名**，忽略大小写与端口；
+     * 不支持后缀 / 通配符，因此 `evil.com` 永远无法满足 `trusted.com`。
+     * 例：`['llm.example.com']`。
+     */
+    trustedHosts?: string[];
     /** `usage_stats` 工具注入的组合 base（默认 false：不注入）；与设置命名空间同字段，
      *  作为用户设置（设置 Tab 开关）的组合兜底。该工具占用每次请求的上下文，coding 场景多在仪表盘查看。 */
     enableUsageStatsTool?: boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kenz1117/dsh-ui-usage-billing",
   "description": "Usage billing dashboard for DeepSeek Harness: sidebar cost metrics plus a full dashboard modal, priced from a current multi-provider catalog with real usage aggregated from session logs.",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "keywords": [
     "deepseek-harness",
     "deepseek",

package/lib/types/client/vendor-logos.d.ts

@@ -1,12 +0,0 @@
-/**
- * Vendor logos: inlined data URIs fetched from models.dev /logos/{id}.svg.
- * Kept to the highest-traffic providers only to hold the client bundle under the
- * DSH Store 256 KiB single-file cap. Every other provider falls back to a
- * brand-color letter badge in the UI (see VendorLogo in UsageBilling.tsx), so no
- * external asset or copyright risk is introduced for unlisted vendors. 月之暗面 is
- * a hand-redrawn minimal crescent — its official SVG is a multi-thousand-node path
- * that alone cost ~6.8 KiB.
- */
-export declare const VENDOR_LOGOS: Readonly<Record<string, string>>;
-export declare function vendorLogoOf(provider: string): string | undefined;
-//# sourceMappingURL=vendor-logos.d.ts.map