@sriinnu/kosha-discovery 1.13.0 → 1.15.0

package/dist/registry-runtime.js

@@ -12,13 +12,15 @@ import { dirname, join } from "path";
 import { catalogCacheKey, loadActiveCatalog, resolveCatalogSource } from "./catalog-source.js";
 import { buildCatalogOnlyRows } from "./discovery/catalog-only.js";
 import { priceAgreement } from "./discovery/price-evidence.js";
-import { applyPriceSchedules } from "./discovery/price-schedules.js";
+import { applyPriceSchedules, SCHEDULED_PRICES } from "./discovery/price-schedules.js";
 import { applyPromoOverrides } from "./discovery/promo-overrides.js";
 import { DISCOVERY_SCHEMA_VERSION } from "./discovery-contract.js";
-import { getProviderConfig, getProviderDescriptor, isLocalProvider, normalizeProviderId } from "./provider-catalog.js";
+import { PRICE_RATE_FIELDS, sanitizeModelPricing } from "./price-trust.js";
+import { getProviderConfig, getProviderDescriptor, isLocalProvider, normalizeProviderId, resolveEnvCredential, } from "./provider-catalog.js";
 import { registryDiscoverySnapshot } from "./registry-discovery.js";
 import { StaleCachePolicy } from "./resilience.js";
 import { assertCleanPayload } from "./security.js";
+import { getSubscriptionPlan } from "./subscription-plans.js";
 const DEFAULT_CACHE_TTL_MS = 86_400_000;
 const DEFAULT_TIMEOUT_MS = 10_000;
 const CACHE_KEY_PREFIX = "provider_";
@@ -50,10 +52,15 @@ export async function registryDiscover(state, dependencies, options) {
             // Only refresh the canonical manifest for full-registry cache hits.
             // Scoped provider rehydration can carry cache-derived state that should
             // not be published as a fresh top-level manifest snapshot.
+            sanitizeRegistryPricing(state);
             if (!providers || providers.length === 0) {
-                // A cache hit makes no network calls, and that includes this file:
-                // it waits for the next real discovery.
-                await exportRegistryManifest(state, { catalogOnly: false });
+                // A cache hit is not a discovery pass, so it doesn't rewrite the
+                // manifest (that would advance missingRunCount and reset price
+                // holds on every `kosha list`). It does read the manifest, so a
+                // price held there is the price kosha routes and budgets with.
+                const manifest = await readPreviousManifest(resolveManifestPath(state));
+                if (manifest && applyManifestHolds(state, manifest))
+                    state.lastSnapshotCache = null;
             }
             return Array.from(state.providerMap.values());
         }
@@ -63,7 +70,8 @@ export async function registryDiscover(state, dependencies, options) {
     // Providers whose credentialed call failed but which were still listed from
     // the public catalog: the error is reported, the provider is not dropped.
     const degraded = [];
-    const results = await Promise.allSettled(discoverers.map((discoverer) => discoverProvider(state, dependencies, discoverer, timeout, degraded)));
+    const sharedKeys = { accepted: new Set(), refused: new Map() };
+    const results = await Promise.allSettled(discoverers.map((discoverer) => discoverProvider(state, dependencies, discoverer, timeout, degraded, sharedKeys)));
     state.lastDiscoveryErrors = [...degraded];
     for (let index = 0; index < results.length; index += 1) {
         const result = results[index];
@@ -81,6 +89,7 @@ export async function registryDiscover(state, dependencies, options) {
             timestamp: Date.now(),
         });
     }
+    reportRefusedSharedKeys(state, sharedKeys);
     // Snapshot which models the discoverers already priced, BEFORE the
     // litellm enrichment pass runs. Pricing present here is attributed to
     // the discoverer's own origin (provider-live API vs static seed);
@@ -94,7 +103,7 @@ export async function registryDiscover(state, dependencies, options) {
     for (const [providerId, providerInfo] of state.providerMap) {
         state.providerMap.set(providerId, {
             ...providerInfo,
-            models: applyPriceSchedules(applyPromoOverrides(providerInfo.models)),
+            models: applyPriceSchedules(applyPromoOverrides(providerInfo.models)).map(sanitizeModelPricing),
         });
     }
     // Attribute pricing provenance at the enrich/merge boundary now that
@@ -107,7 +116,14 @@ export async function registryDiscover(state, dependencies, options) {
     // Write the consumer-facing manifest last, after recordDiscoveryMutation
     // has advanced the cursor — that way the snapshot's cursor reflects the
     // post-discovery revision instead of a stale pre-mutation value.
-    await exportRegistryManifest(state);
+    const merged = await exportRegistryManifest(state);
+    // Quarantine decides in the merge, so carry its verdict back into memory
+    // and the cache: kosha's own routing, `cheapest`, MCP and the budget must
+    // use the held price, not the suspect one the merge refused.
+    if (merged && applyManifestHolds(state, merged)) {
+        state.lastSnapshotCache = null;
+        await dependencies.saveToCache();
+    }
     return Array.from(state.providerMap.values());
 }
 /**
@@ -177,9 +193,10 @@ export function fallbackRegistryCredential(providerId, explicitKey) {
         if (oidcToken)
             return { accessToken: oidcToken, source: "env" };
     }
-    const envVar = getProviderDescriptor(normalizedProviderId)?.primaryCredentialEnvVar;
-    const value = envVar ? process.env[envVar] : undefined;
-    return value ? { apiKey: value, source: "env" } : { source: "none" };
+    const found = resolveEnvCredential(getProviderDescriptor(normalizedProviderId));
+    return found
+        ? { apiKey: found.apiKey, source: "env", envVar: found.envVar, shared: found.shared }
+        : { source: "none" };
 }
 /**
  * Enrich the in-memory model set with pricing metadata when available.
@@ -232,13 +249,17 @@ export async function registryEnrichOnly(state) {
     for (const [providerId, providerInfo] of state.providerMap) {
         state.providerMap.set(providerId, {
             ...providerInfo,
-            models: applyPriceSchedules(applyPromoOverrides(providerInfo.models)),
+            models: applyPriceSchedules(applyPromoOverrides(providerInfo.models)).map(sanitizeModelPricing),
         });
     }
     attributePricingSources(state, preEnrichmentPriced);
     populateRegistryModelAliases(state);
     await saveRegistryToCache(state);
-    await exportRegistryManifest(state);
+    const merged = await exportRegistryManifest(state);
+    if (merged && applyManifestHolds(state, merged)) {
+        state.lastSnapshotCache = null;
+        await saveRegistryToCache(state);
+    }
     const after = countPricingFields(state);
     return {
         modelCount: Array.from(state.providerMap.values()).reduce((sum, p) => sum + p.models.length, 0),
@@ -389,8 +410,10 @@ export async function exportRegistryManifest(state, options) {
     let manifestPath = null;
     let lockReleased = true;
     let lockPath = null;
+    let fresh = null;
+    let merged = null;
     try {
-        const fresh = state.lastSnapshotCache ?? registryDiscoverySnapshot(state);
+        fresh = state.lastSnapshotCache ?? registryDiscoverySnapshot(state);
         state.lastSnapshotCache = fresh;
         // Honour state.config.cacheDir so isolated tests (and any other caller
         // that pins a custom cache root) don't clobber the user's real
@@ -423,7 +446,7 @@ export async function exportRegistryManifest(state, options) {
         // the user's pricing for those models — they retain their last-known
         // values until a successful fetch supersedes them.
         const previousManifest = await readPreviousManifest(manifestPath);
-        const merged = mergeManifests(previousManifest, fresh);
+        merged = mergeManifests(previousManifest, fresh);
         // Pricing-diff alerts. The most dangerous failure mode isn't "kosha
         // returned null" (we already detect that). It's "kosha returned a
         // wrong number" — silent over- or undercharging. We compare prev vs
@@ -467,7 +490,8 @@ export async function exportRegistryManifest(state, options) {
         }
         warnOnNewlyDisputedPrices(previousManifest, merged);
         if (options?.catalogOnly !== false)
-            await exportCatalogOnlyManifest(manifestPath);
+            await exportCatalogOnlyManifest(manifestPath, new Set(state.providerMap.keys()));
+        return merged;
     }
     catch (err) {
         // Manifest export is best-effort — the cache still works either way.
@@ -476,6 +500,19 @@ export async function exportRegistryManifest(state, options) {
         // gated on a successful export.
         const reason = err instanceof Error ? err.message : String(err);
         console.warn(`[kosha] manifest export failed (${manifestPath ?? "unknown path"}): ${reason}`);
+        // The write failed, but the price verdicts must not: compute the merge in
+        // memory so the caller still applies its holds. Without this a lock
+        // timeout or a full disk let a suspect price straight into routing.
+        if (!merged && fresh) {
+            try {
+                const previous = manifestPath ? await readPreviousManifest(manifestPath) : null;
+                merged = mergeManifests(previous, fresh);
+            }
+            catch {
+                // Nothing left to judge against; the caller keeps what it has.
+            }
+        }
+        return merged;
     }
     finally {
         if (!lockReleased && lockPath) {
@@ -648,14 +685,17 @@ const MAX_CATALOG_ONLY_BYTES = 32 * 1024 * 1024;
  *
  * Failing leaves the previous file in place: the registry above is already saved.
  */
-async function exportCatalogOnlyManifest(manifestPath) {
+async function exportCatalogOnlyManifest(manifestPath, listedIds) {
     if (resolveCatalogSource().mode !== "community")
         return;
     const path = join(dirname(manifestPath), CATALOG_ONLY_FILE);
     let tmpPath = null;
     try {
         const { getAllDiscoverers } = await import("./discovery/index.js");
-        const models = await buildCatalogOnlyRows(getAllDiscoverers().map((discoverer) => discoverer.providerId));
+        const claimed = getAllDiscoverers()
+            .map((discoverer) => discoverer.providerId)
+            .filter((id) => !getSubscriptionPlan(id) || listedIds.has(id));
+        const models = await buildCatalogOnlyRows(claimed);
         if (models.length === 0)
             return;
         const fresh = {
@@ -684,6 +724,145 @@ async function exportCatalogOnlyManifest(manifestPath) {
         console.warn(`[kosha] ${CATALOG_ONLY_FILE} not updated: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/** Tags the manifest merge puts on a price that isn't settled. */
+const PRICE_HOLD_TAGS = ["pricing_quarantined", "pricing_sources_disagree", "pricing_single_source"];
+/** Run {@link sanitizeModelPricing} over every model in memory. */
+function sanitizeRegistryPricing(state) {
+    for (const [providerId, providerInfo] of state.providerMap) {
+        const models = providerInfo.models.map(sanitizeModelPricing);
+        if (models.some((m, i) => m !== providerInfo.models[i]))
+            state.providerMap.set(providerId, { ...providerInfo, models });
+    }
+}
+/**
+ * Copy the merge's price verdicts onto the in-memory registry. A quarantined
+ * row carries the held (previous) price, which replaces the suspect one in
+ * memory; dispute and single-source flags are copied onto rawCapabilities so
+ * every reader sees them. A secondary rate (cache, image, audio…) the merge
+ * kept because a catalog reported it as 0 is copied back too; before, only
+ * `registry.json` had it and routing and the budget used 0. Rows the manifest
+ * kept for a model this run didn't see are ignored. Returns true when anything
+ * in memory changed.
+ */
+export function applyManifestHolds(state, manifest) {
+    const rows = new Map();
+    for (const row of manifest.models ?? [])
+        rows.set(`${row.providerId}\u0000${row.modelId}`, row);
+    if (rows.size === 0)
+        return false;
+    let changed = false;
+    for (const [providerId, providerInfo] of state.providerMap) {
+        let touched = false;
+        const models = providerInfo.models.map((original) => {
+            const row = rows.get(`${providerId}\u0000${original.id}`);
+            if (!row)
+                return original;
+            const model = keepReportedSecondaryRates(row, original);
+            const next = { ...model };
+            const before = model.rawCapabilities ?? [];
+            let tags = before;
+            for (const tag of PRICE_HOLD_TAGS) {
+                if ((row.rawCapabilities ?? []).includes(tag) && !tags.includes(tag))
+                    tags = [...tags, tag];
+            }
+            let differs = model !== original || tags !== before;
+            if (tags.length > 0)
+                next.rawCapabilities = tags;
+            const quarantined = (row.rawCapabilities ?? []).includes("pricing_quarantined");
+            const disputed = (row.rawCapabilities ?? []).includes(PRICING_SOURCES_DISAGREE);
+            if (quarantined || disputed) {
+                // While a price is held or disputed, kosha routes and budgets on the
+                // highest rate anyone reported: the held one, the fresh one and each
+                // source's. Overpaying in the estimate is safe; undercounting isn't.
+                const base = quarantined ? (row.pricing ?? null) : (model.pricing ?? null);
+                const evidence = model.priceEvidence ?? row.priceEvidence ?? [];
+                const held = base
+                    ? (sanitizeModelPricing({ ...model, pricing: highestRates(base, model.pricing ?? null, evidence) }).pricing ??
+                        null)
+                    : null;
+                if (JSON.stringify(held) !== JSON.stringify(model.pricing ?? null)) {
+                    differs = true;
+                    if (held)
+                        next.pricing = held;
+                    else
+                        delete next.pricing;
+                }
+                if (quarantined && JSON.stringify(row.originPricing ?? null) !== JSON.stringify(model.originPricing ?? null)) {
+                    differs = true;
+                    if (row.originPricing)
+                        next.originPricing = row.originPricing;
+                    else
+                        delete next.originPricing;
+                }
+            }
+            if (!differs)
+                return original;
+            touched = true;
+            return next;
+        });
+        if (touched) {
+            state.providerMap.set(providerId, { ...providerInfo, models });
+            changed = true;
+        }
+    }
+    return changed;
+}
+/** Each rate at the highest of `base`, `other` and the sources' headline
+ *  rates. Fields `base` doesn't price stay unpriced. */
+export function highestRates(base, other, evidence) {
+    const out = { ...base };
+    for (const field of QUARANTINE_FIELDS) {
+        const current = out[field];
+        if (typeof current !== "number")
+            continue;
+        let highest = current;
+        const fresh = other?.[field];
+        if (typeof fresh === "number" && Number.isFinite(fresh))
+            highest = Math.max(highest, fresh);
+        if (field === "inputPerMillion" || field === "outputPerMillion") {
+            for (const entry of evidence) {
+                if (Number.isFinite(entry[field]))
+                    highest = Math.max(highest, entry[field]);
+            }
+        }
+        out[field] = highest;
+    }
+    return out;
+}
+/**
+ * Accept the price a quarantine is holding for one model. The hold remembers
+ * exactly which rates it's waiting on, so the acceptance covers those rates
+ * only: the next discovery pass takes them, and a different publish after
+ * that is judged afresh. Writes the manifest under the export lock.
+ */
+export async function acceptHeldPrice(state, providerId, modelId) {
+    const manifestPath = resolveManifestPath(state);
+    const lockPath = `${manifestPath}.lock`;
+    await acquireExportLock(lockPath);
+    try {
+        const manifest = await readManifestFile(manifestPath);
+        const row = manifest?.models.find((m) => m.providerId === providerId && m.modelId === modelId);
+        if (!manifest || !row)
+            return { status: "not-found" };
+        const hold = row.pricingHold;
+        if (!hold || !(row.rawCapabilities ?? []).includes("pricing_quarantined"))
+            return { status: "not-held" };
+        row.pricingHold = { ...hold, accepted: true };
+        const tmpPath = `${manifestPath}.${randomBytes(4).toString("hex")}.tmp`;
+        try {
+            await writeFile(tmpPath, JSON.stringify(manifest, null, 2), { encoding: "utf-8", mode: 0o600 });
+            await rename(tmpPath, manifestPath);
+        }
+        catch (err) {
+            await unlink(tmpPath).catch(() => { });
+            throw err;
+        }
+        return { status: "accepted", held: row.pricing ?? null, waitingSince: hold.since };
+    }
+    finally {
+        await unlink(lockPath).catch(() => { });
+    }
+}
 /** Resolve the on-disk path for the registry manifest. Tests + custom callers
  *  pin via `state.config.cacheDir`; production falls back to ~/.kosha. */
 function resolveManifestPath(state) {
@@ -708,14 +887,28 @@ function resolveManifestPath(state) {
  * fresh snapshot as-is (first run / corrupted file).
  */
 async function readPreviousManifest(manifestPath) {
+    const current = await readManifestFile(manifestPath);
+    if (current)
+        return current;
+    // The manifest holds every price baseline. Losing it to a corrupt write, a
+    // schema bump or a failed scan would accept every fresh price unchecked, so
+    // fall back to the newest readable backup in the rollback ring.
+    for (const backup of await listBackups(manifestPath)) {
+        const parsed = await readManifestFile(backup);
+        if (parsed)
+            return parsed;
+    }
+    return null;
+}
+async function readManifestFile(path) {
     try {
         const { readFile } = await import("fs/promises");
-        const raw = await readFile(manifestPath, "utf-8");
+        const raw = await readFile(path, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed?.models)
             return null;
         // Schema-version guard. A different version on disk means we can't
-        // trust the field shapes — caller falls through to fresh-only.
+        // trust the field shapes.
         if (parsed.schemaVersion !== DISCOVERY_SCHEMA_VERSION)
             return null;
         assertCleanPayload(parsed, "registry manifest");
@@ -725,6 +918,22 @@ async function readPreviousManifest(manifestPath) {
         return null; // missing or unreadable
     }
 }
+/** The manifest's `.bak.<YYYY-MM-DD>` copies, newest first. */
+async function listBackups(manifestPath) {
+    const dir = dirname(manifestPath);
+    const base = manifestPath.slice(dir.length + 1);
+    const bakRe = new RegExp(`^${escapeRegExp(base)}\\.bak\\.\\d{4}-\\d{2}-\\d{2}$`);
+    try {
+        return (await readdir(dir))
+            .filter((name) => bakRe.test(name))
+            .sort()
+            .reverse()
+            .map((name) => join(dir, name));
+    }
+    catch {
+        return [];
+    }
+}
 /** Beyond this fractional rate change in either direction, we treat a fresh
  *  price as suspect and keep the previous value (quarantine). The 25% delta
  *  used by anomaly logging is a UI-alert threshold; quarantine fires only on
@@ -745,14 +954,20 @@ const PRICING_DISPUTED_HOLD_MS = 7 * DAY_MS;
 const PRICING_SINGLE_SOURCE = "pricing_single_source";
 /** Sources list different prices for this model. */
 const PRICING_SOURCES_DISAGREE = "pricing_sources_disagree";
-/** After this many consecutive discovery passes in which a previously-known
- *  model is missing from the fresh snapshot, the model is dropped from the
- *  merged manifest. Prevents the manifest from becoming a graveyard of
- *  deprecated SKUs while still riding through transient outages. */
-const MISSING_RUNS_TTL = 14;
+/** A previously-known model missing from fresh snapshots for longer than this
+ *  is dropped from the merged manifest. Prevents the manifest from becoming a
+ *  graveyard of deprecated SKUs while still riding through outages. */
+const MISSING_MODEL_TTL_MS = 30 * DAY_MS;
 export function mergeManifests(previous, fresh) {
-    if (!previous)
-        return fresh;
+    if (!previous) {
+        // Nothing to judge against yet, but every price seen now is the anchor
+        // the next run is checked against.
+        const seen = fresh.discoveredAt ?? Date.now();
+        return {
+            ...fresh,
+            models: (fresh.models ?? []).map((m) => withAnchor({ ...m, lastSeenAt: seen }, null, seen)),
+        };
+    }
     // Index previous entries by key so we can both detect collisions AND
     // look back at the old data for pricing-degraded merge below.
     const previousByKey = new Map();
@@ -761,8 +976,8 @@ export function mergeManifests(previous, fresh) {
             previousByKey.set(m.key, m);
     }
     // Per-model merge with three rules:
-    //   (1) Old entries fresh dropped entirely → keep until missingRunCount
-    //       exceeds MISSING_RUNS_TTL (model lifecycle TTL).
+    //   (1) Old entries fresh dropped entirely → keep until unseen for
+    //       MISSING_MODEL_TTL_MS (model lifecycle TTL).
     //   (2) Fresh entries that came back with NO pricing while the old entry
     //       HAD pricing → keep the old pricing block (degraded-fresh defence).
     //   (3) Fresh entries whose rates moved beyond PRICING_QUARANTINE_THRESHOLD
@@ -771,35 +986,44 @@ export function mergeManifests(previous, fresh) {
     //       can't silently overcharge or underprice downstream consumers.
     //       The same rates are accepted after a day if two sources agree on them,
     //       after three days if only one lists them, and not while sources disagree.
+    const now = fresh.discoveredAt ?? Date.now();
     const freshModelKeys = new Set();
     const mergedModels = [];
     for (const f of fresh.models ?? []) {
         if (f.key)
             freshModelKeys.add(f.key);
         const old = f.key ? previousByKey.get(f.key) : undefined;
-        let kept = { ...f, missingRunCount: 0 };
+        let kept = { ...f, missingRunCount: 0, lastSeenAt: now };
+        // A secondary rate (cache, audio, image…) that falls from a price to 0
+        // reads as "not reported" in the catalogs, but billing it at 0 would
+        // undercount spend. Keep the last real rate instead.
+        if (old)
+            kept = keepReportedSecondaryRates(old, kept);
+        const anchor = old ? liveAnchor(old, now) : null;
         if (old && !hasUsablePricing(f) && hasUsablePricing(old)) {
             // Keep all of fresh's metadata but restore pricing from old.
             kept = { ...kept, pricing: old.pricing, originPricing: old.originPricing };
         }
-        else if (old && !f.pricing?.schedule && quarantinePricingMove(old, f)) {
+        else if (old && !isCuratedSchedule(f) && priceMoveSuspect(old, kept, anchor)) {
             // A scheduled price is curated and cited, not a catalog's publish, so
             // it skips quarantine. Otherwise the first move to it would be refused
-            // on every run.
-            //
-            const now = fresh.discoveredAt ?? Date.now();
-            const rates = pricingFingerprint(f);
+            // on every run. Only kosha's own schedule table counts: a `schedule`
+            // field carried in by a snapshot or a local file proves nothing.
+            const rates = pricingFingerprint(kept);
             const hold = old.pricingHold;
-            const since = hold?.rates === rates ? hold.since : now;
+            const same = hold !== undefined && (hold.rates === rates || hold.rates === legacyPricingFingerprint(kept));
+            const since = same ? hold.since : now;
+            const accepted = same && hold.accepted === true;
             const agreement = priceAgreement(f.priceEvidence);
             const window = agreement === "agree"
                 ? PRICING_AGREED_HOLD_MS
                 : agreement === "disagree"
                     ? PRICING_DISPUTED_HOLD_MS
                     : PRICING_SINGLE_SOURCE_HOLD_MS;
-            // A billed rate of $0 is never accepted this way: it poisons cheapest
-            // routing however long it's published.
-            if (billedRateDroppedToZero(old, f) || now - since < window) {
+            // A billed rate that collapses to $0, or to under 1% of what it was, is
+            // never accepted by waiting: it poisons cheapest routing however long
+            // it's published. Only `kosha registry accept` releases it.
+            if (!accepted && (billedRateCollapsed(old, kept) || now - since < window)) {
                 // Quarantine the suspect rates: keep the old pricing block and
                 // tag the operational `rawCapabilities` array (the trusted
                 // `capabilities` taxonomy stays clean, since this isn't a routing
@@ -820,7 +1044,7 @@ export function mergeManifests(previous, fresh) {
                 kept = { ...kept, rawCapabilities: tagCapability(kept.rawCapabilities, flag) };
             }
         }
-        else if (old && !f.pricing?.schedule) {
+        else if (old && !isCuratedSchedule(f)) {
             // Below the quarantine line a price still takes effect, but a move its
             // sources dispute is the believable lie, so it carries a flag. Flags
             // from an earlier move last until the rates change or the evidence does.
@@ -837,16 +1061,20 @@ export function mergeManifests(previous, fresh) {
             if (tags !== kept.rawCapabilities)
                 kept = { ...kept, rawCapabilities: tags };
         }
-        mergedModels.push(kept);
+        mergedModels.push(withAnchor(kept, anchor, now));
     }
     for (const old of previous.models) {
         if (!old.key || freshModelKeys.has(old.key))
             continue;
         const prevMissing = old.missingRunCount ?? 0;
-        const nextMissing = prevMissing + 1;
-        if (nextMissing > MISSING_RUNS_TTL)
+        // The row is the baseline a returning model's price is checked against,
+        // so it ages by time, not by how often discovery ran: an hourly loop
+        // would otherwise drop it in under a day. Rows written before lastSeenAt
+        // existed date from the previous run.
+        const lastSeenAt = old.lastSeenAt ?? previous.discoveredAt ?? now;
+        if (now - lastSeenAt > MISSING_MODEL_TTL_MS)
             continue; // drop after TTL
-        mergedModels.push({ ...old, missingRunCount: nextMissing });
+        mergedModels.push({ ...old, missingRunCount: prevMissing + 1, lastSeenAt });
     }
     const freshProviderIds = new Set((fresh.providers ?? []).map((p) => p.providerId));
     const mergedProviders = [...(fresh.providers ?? [])];
@@ -861,7 +1089,20 @@ export function mergeManifests(previous, fresh) {
         providers: mergedProviders,
     };
 }
+/** Every rate that bills or ranks. The long-context threshold is a token
+ *  count, not a price, so it isn't compared. */
+const QUARANTINE_FIELDS = PRICE_RATE_FIELDS.filter((field) => field !== "longContextThresholdTokens");
+/** The billed rates that decide a model's headline price. */
+const HEADLINE_FIELDS = new Set(["inputPerMillion", "outputPerMillion"]);
+/** A billed rate below this share of the one it replaces counts as a collapse,
+ *  like $0: never accepted by waiting. */
+const PRICING_COLLAPSE_RATIO = 0.01;
 function pricingFingerprint(model) {
+    return JSON.stringify([model.pricing, model.originPricing].map((side) => QUARANTINE_FIELDS.map((field) => side?.[field] ?? null)));
+}
+/** The five-field fingerprint holds recorded before every rate was compared.
+ *  Matching it keeps an upgrade from restarting every hold's clock. */
+function legacyPricingFingerprint(model) {
     const fields = [
         "inputPerMillion",
         "outputPerMillion",
@@ -871,48 +1112,142 @@ function pricingFingerprint(model) {
     ];
     return JSON.stringify([model.pricing, model.originPricing].map((side) => fields.map((field) => side?.[field] ?? null)));
 }
-/** True if a priced model's billed input or output rate fell to zero. */
-function billedRateDroppedToZero(previous, fresh) {
+/** True when the fresh row's pricing is kosha's own cited schedule for that model. */
+function isCuratedSchedule(row) {
+    if (!row.pricing?.schedule)
+        return false;
+    const match = SCHEDULED_PRICES.find((s) => s.providerId === row.providerId && s.modelId === row.modelId);
+    return (match !== undefined &&
+        row.pricing.inputPerMillion === match.peak.inputPerMillion &&
+        row.pricing.outputPerMillion === match.peak.outputPerMillion);
+}
+/** Restore a secondary billed rate that went from a price to 0. */
+function keepReportedSecondaryRates(previous, fresh) {
+    const a = previous.pricing;
+    const b = fresh.pricing;
+    if (!a || !b)
+        return fresh;
+    let pricing = null;
+    for (const field of QUARANTINE_FIELDS) {
+        if (HEADLINE_FIELDS.has(field))
+            continue;
+        const prev = a[field];
+        if (typeof prev === "number" && prev > 0 && b[field] === 0) {
+            pricing ??= { ...b };
+            pricing[field] = prev;
+        }
+    }
+    return pricing ? { ...fresh, pricing } : fresh;
+}
+/** True if a billed rate fell to zero (input or output) or to under 1% of the
+ *  rate it replaces (any field). */
+function billedRateCollapsed(previous, fresh) {
     const a = previous.pricing;
     const b = fresh.pricing;
     if (!a || !b)
         return false;
-    return ["inputPerMillion", "outputPerMillion"].some((field) => (a[field] ?? 0) > 0 && b[field] === 0);
+    return QUARANTINE_FIELDS.some((field) => {
+        const prev = a[field];
+        const next = b[field];
+        if (typeof prev !== "number" || typeof next !== "number" || prev <= 0)
+            return false;
+        if (next === 0)
+            return HEADLINE_FIELDS.has(field);
+        return next < prev * PRICING_COLLAPSE_RATIO;
+    });
 }
-/** True if any defined per-million rate moved by more than the quarantine
- *  threshold (either direction), compared to the previous snapshot. */
-function quarantinePricingMove(previous, fresh) {
-    const fields = [
-        "inputPerMillion",
-        "outputPerMillion",
-        "cacheReadPerMillion",
-        "cacheWritePerMillion",
-        "cacheWrite1hPerMillion",
-    ];
+/** How long a high price stays the anchor before the current one replaces it. */
+const PRICE_ANCHOR_WINDOW_MS = 30 * DAY_MS;
+/** A fresh headline rate below this share of the anchor is suspect: one real
+ *  50% cut passes, a second inside the window waits. */
+const PRICE_ANCHOR_FLOOR = 0.5;
+/** A fresh headline rate above this multiple of the anchor is suspect. */
+const PRICE_ANCHOR_CEILING = 4;
+function liveAnchor(row, now) {
+    const anchor = row.priceAnchor;
+    if (!anchor || typeof anchor.at !== "number" || now - anchor.at > PRICE_ANCHOR_WINDOW_MS)
+        return null;
+    return anchor;
+}
+/** Raise the anchor to the accepted price where it's higher; reset it once
+ *  the window has passed. Rows without headline rates carry no anchor. */
+function withAnchor(row, anchor, now) {
+    const pricing = row.pricing;
+    const next = { at: anchor?.at ?? now };
+    let raised = anchor === null;
+    for (const field of ["inputPerMillion", "outputPerMillion"]) {
+        const accepted = pricing?.[field];
+        const held = anchor?.[field];
+        if (typeof accepted === "number" && accepted > 0 && (typeof held !== "number" || accepted > held)) {
+            next[field] = accepted;
+            raised = true;
+        }
+        else if (typeof held === "number") {
+            next[field] = held;
+        }
+    }
+    if (next.inputPerMillion === undefined && next.outputPerMillion === undefined)
+        return row;
+    if (raised)
+        next.at = now;
+    return { ...row, priceAnchor: next };
+}
+/** True if a headline rate sits outside the anchor's band. */
+function driftsFromAnchor(anchor, fresh) {
+    const b = fresh.pricing;
+    return ["inputPerMillion", "outputPerMillion"].some((field) => {
+        const a = anchor[field];
+        const next = b?.[field];
+        if (typeof a !== "number" || a <= 0 || typeof next !== "number" || next <= 0)
+            return false;
+        return next < a * PRICE_ANCHOR_FLOOR || next > a * PRICE_ANCHOR_CEILING;
+    });
+}
+/**
+ * Whether a fresh price needs holding: a collapse, a drift outside the
+ * anchor's band, or a step past the threshold. A step back up toward the
+ * anchor is a correction, not a suspect publish, so it's taken at once:
+ * otherwise a wrong low price, once in, would be protected by its own hold.
+ */
+function priceMoveSuspect(previous, fresh, anchor) {
+    if (pricingFingerprint(previous) === pricingFingerprint(fresh))
+        return false;
+    if (billedRateCollapsed(previous, fresh))
+        return true;
+    if (anchor && driftsFromAnchor(anchor, fresh))
+        return true;
+    const steps = thresholdSteps(previous, fresh);
+    if (steps.length === 0)
+        return false;
+    if (!anchor)
+        return true;
+    return !steps.every((step) => step.side === "pricing" &&
+        HEADLINE_FIELDS.has(step.field) &&
+        step.next > step.prev &&
+        step.next <= (anchor[step.field] ?? 0));
+}
+/** The rates that moved by the quarantine threshold or more (either direction). */
+function thresholdSteps(previous, fresh) {
+    const steps = [];
     for (const side of ["pricing", "originPricing"]) {
         const a = previous[side] ?? null;
         const b = fresh[side] ?? null;
         if (!a || !b)
             continue;
-        for (const field of fields) {
+        for (const field of QUARANTINE_FIELDS) {
             const prev = a[field];
             const next = b[field];
             if (typeof prev !== "number" || typeof next !== "number")
                 continue;
-            // A priced model whose billed input or output rate drops to zero is
-            // the cheapest-routing poison case, not a placeholder. originPricing
-            // zeros stay placeholders ("no direct price known").
-            if (side === "pricing" && prev > 0 && next === 0 && (field === "inputPerMillion" || field === "outputPerMillion"))
-                return true;
             if (prev === 0 || next === 0)
                 continue; // zero on either side is a "not reported" placeholder, not a price move
             if (prev === next)
                 continue;
             if (Math.abs((next - prev) / prev) >= PRICING_QUARANTINE_THRESHOLD)
-                return true;
+                steps.push({ side, field, prev, next });
         }
     }
-    return false;
+    return steps;
 }
 /** Add a capability tag exactly once, preserving order. */
 function tagCapability(existing, tag) {
@@ -1063,7 +1398,7 @@ async function appendAnomalies(manifestDir, detected) {
     }
     return fresh.length;
 }
-async function discoverProvider(state, dependencies, discoverer, timeout, degraded) {
+async function discoverProvider(state, dependencies, discoverer, timeout, degraded, sharedKeys) {
     const breaker = state.healthTracker.breaker(discoverer.providerId);
     const startedAt = Date.now();
     if (!breaker.canExecute()) {
@@ -1074,6 +1409,11 @@ async function discoverProvider(state, dependencies, discoverer, timeout, degrad
     const credential = dependencies.resolveCredential
         ? await dependencies.resolveCredential(discoverer.providerId, explicitKey)
         : dependencies.fallbackCredential(discoverer.providerId, explicitKey);
+    // A plan is listed only for someone holding a key to it; without one its
+    // models stay price-only rows in catalog-only.json.
+    const isPlan = getProviderDescriptor(discoverer.providerId)?.subscriptionPlan === true;
+    if (isPlan && (credential.source === "none" || state.config.keyless))
+        return null;
     try {
         // Cloud discoverers fall back to ambient credentials (the AWS chain, gcloud)
         // whatever credential they're given, so keyless mode has its own path there.
@@ -1084,6 +1424,8 @@ async function discoverProvider(state, dependencies, discoverer, timeout, degrad
             latencyMs: Date.now() - startedAt,
             errorType: null,
         });
+        if (credential.shared && credential.envVar)
+            sharedKeys.accepted.add(credential.envVar);
         return {
             id: discoverer.providerId,
             name: discoverer.providerName,
@@ -1096,6 +1438,20 @@ async function discoverProvider(state, dependencies, discoverer, timeout, degrad
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
+        // A key borrowed from a shared env var (QWEN_API_KEY read by Alibaba's
+        // regions and plans) is expected to be refused by the siblings it isn't
+        // for. That is no fault of this provider, so no breaker failure and no
+        // warning here; only a key every reader refuses gets reported, once.
+        if (credential.shared && credential.envVar && isTentativeKeyMiss(error)) {
+            if (!isPlanKeyUnverified(error)) {
+                const refusers = sharedKeys.refused.get(credential.envVar) ?? [];
+                refusers.push(discoverer.providerId);
+                sharedKeys.refused.set(credential.envVar, refusers);
+            }
+            if (isPlan)
+                return null;
+            return listedWithoutKey(state, discoverer, timeout);
+        }
         breaker.onFailure(errorMessage);
         dependencies.recordObservation(discoverer.providerId, {
             latencyMs: Date.now() - startedAt,
@@ -1103,7 +1459,19 @@ async function discoverProvider(state, dependencies, discoverer, timeout, degrad
         });
         const stale = await StaleCachePolicy.getWithStale(state.cache, catalogCacheKey(`${CACHE_KEY_PREFIX}${discoverer.providerId}`));
         if (stale) {
-            return stale.data;
+            // Serving yesterday's listing is right; serving it silently is not.
+            // A key rejected today otherwise looks healthy for as long as the
+            // old cache lasts. A keyless failure (a local runtime that isn't
+            // up) stays quiet, as it always has.
+            if (credential.source === "none")
+                return stale.data;
+            degraded.push({
+                providerId: discoverer.providerId,
+                providerName: discoverer.providerName,
+                error: errorMessage,
+                timestamp: Date.now(),
+            });
+            return { ...stale.data, degradedReason: errorMessage, degradedSource: "cache" };
         }
         // A rejected or unreachable credentialed call says nothing about what
         // the provider serves or charges — that is public. Without this, one
@@ -1129,6 +1497,8 @@ async function discoverProvider(state, dependencies, discoverer, timeout, degrad
                         credentialSource: "none",
                         models,
                         lastRefreshed: Date.now(),
+                        degradedReason: errorMessage,
+                        degradedSource: "catalog",
                     };
                 }
             }
@@ -1139,4 +1509,66 @@ async function discoverProvider(state, dependencies, discoverer, timeout, degrad
         throw error;
     }
 }
+/** Matched by name: the discovery modules load lazily, so no class import here. */
+function isPlanKeyUnverified(error) {
+    return error instanceof Error && error.name === "PlanKeyUnverifiedError";
+}
+/** A 401/403, or a plan with no list to test the key on. A timeout is neither. */
+function isTentativeKeyMiss(error) {
+    if (isPlanKeyUnverified(error))
+        return true;
+    return error instanceof Error && /API error:\s*40[13]\b/.test(error.message);
+}
+/**
+ * The provider's public listing, used when a shared key turned out not to be
+ * its key. Quiet: the provider is fine, the key belongs to a sibling.
+ */
+async function listedWithoutKey(state, discoverer, timeout) {
+    try {
+        const models = await discoverer.discover({ source: "none" }, { timeout });
+        if (models.length > 0) {
+            return {
+                id: discoverer.providerId,
+                name: discoverer.providerName,
+                baseUrl: discoverer.baseUrl,
+                authenticated: false,
+                credentialSource: "none",
+                models,
+                lastRefreshed: Date.now(),
+            };
+        }
+    }
+    catch {
+        /* fall back to the last good listing */
+    }
+    const stale = await StaleCachePolicy.getWithStale(state.cache, catalogCacheKey(`${CACHE_KEY_PREFIX}${discoverer.providerId}`));
+    return stale ? { ...stale.data, authenticated: false, credentialSource: "none" } : null;
+}
+/**
+ * One warning per shared env var no provider accepted. It goes on each
+ * listed provider that refused it, so `update` and `doctor` show it, and
+ * names every host that said no.
+ */
+function reportRefusedSharedKeys(state, ledger) {
+    for (const [envVar, refusers] of ledger.refused) {
+        if (ledger.accepted.has(envVar))
+            continue;
+        const families = new Set(refusers.map((id) => getSubscriptionPlan(id)?.family ?? id));
+        const hint = families.has("alibaba")
+            ? " If it is an Alibaba Coding Plan key, set ALIBABA_CODING_PLAN_API_KEY instead: that host can't test a key."
+            : "";
+        const message = `${envVar} was refused by every provider that reads it: ${refusers.join(", ")} (API error: 401).${hint}`;
+        for (const id of refusers) {
+            const provider = state.providerMap.get(id);
+            if (provider)
+                state.providerMap.set(id, { ...provider, degradedReason: message, degradedSource: "catalog" });
+        }
+        state.lastDiscoveryErrors.push({
+            providerId: refusers[0],
+            providerName: envVar,
+            error: message,
+            timestamp: Date.now(),
+        });
+    }
+}
 //# sourceMappingURL=registry-runtime.js.map