codex-multi-auth 2.11.0 → 2.13.0

package/dist/lib/runtime-rotation-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AAkCvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAkDtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AA8DtE,kFAAkF;AAClF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAmBR;AA8gBD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAmLrC"}
+{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AAkCvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAkDtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AA8DtE,kFAAkF;AAClF;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC9C,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,GACC,MAAM,CAmBR;AAED,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAER;AA8gBD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAmLrC"}

package/dist/lib/runtime-rotation-proxy.js

@@ -80,7 +80,15 @@ const PINNED_PERMANENT_SKIP_REASONS = new Set([
 ]);
 const DEFAULT_QUOTA_REMAINING_THRESHOLD = 10;
 /** @internal Stable identity key for in-memory quota snapshots across reloads. */
-export function buildQuotaScheduleKey(account, family, model) {
+/**
+ * Quota-scheduler key prefix identifying ONE account across every family and
+ * model key it owns.
+ *
+ * The trailing separator is part of the contract: without it the prefix
+ * `account:email:foo` also matches `account:email:foobar:codex`, so clearing
+ * one account's observations would silently clear a neighbour's.
+ */
+export function buildQuotaScheduleAccountPrefix(account) {
     const emailKey = normalizeEmailKey(account.email);
     const accountId = account.accountId?.trim();
     const refreshToken = account.refreshToken?.trim() ?? "";
@@ -97,7 +105,10 @@ export function buildQuotaScheduleKey(account, family, model) {
             : accountId
                 ? `id:${accountId}${recordDiscriminator}`
                 : `refresh:${createHash("sha256").update(refreshToken).digest("hex")}${recordDiscriminator}`;
-    return `account:${accountIdentity}:${model ?? family}`;
+    return `account:${accountIdentity}:`;
+}
+export function buildQuotaScheduleKey(account, family, model) {
+    return `${buildQuotaScheduleAccountPrefix(account)}${model ?? family}`;
 }
 const DEFAULT_MAX_RUNTIME_ACCOUNT_ATTEMPTS = 4;
 // This is a hard safety ceiling over every pinned selection pass, including
@@ -862,7 +873,37 @@ async function handleRequestInner(state, req, res, traceId) {
         // otherwise glue an in-flight chat thread to the previously selected
         // account. The proxy itself never bumps the generation, so its own
         // debounced disk writes do not clear affinity. See issue #474.
-        const storageMeta = readStorageMetaFromDisk();
+        /** Reconcile once before selection or recording a new upstream observation. */
+        const reconcileManualSelection = () => {
+            const meta = readStorageMetaFromDisk();
+            for (const manager of state.knownAccountManagers) {
+                manager.applyManualSelection(meta);
+            }
+            if (meta.affinityGeneration > state.lastObservedAffinityGeneration) {
+                const switchedAccount = meta.pinnedAccountIndex === null
+                    ? null
+                    : accountManager.getAccountByIndex(meta.pinnedAccountIndex);
+                if (switchedAccount) {
+                    state.preemptiveQuotaScheduler.clearByPrefix(buildQuotaScheduleAccountPrefix(switchedAccount));
+                }
+                else if (meta.pinnedAccountIndex !== null) {
+                    // A pin we cannot resolve: this long-lived proxy re-reads only
+                    // pin/gen, never the account list, so a `login` that appended an
+                    // account before the `switch` leaves the new index out of range
+                    // here. The generation only bumps on the NEXT user-initiated
+                    // switch, so skipping the clear and advancing anyway would strand
+                    // the pre-switch quota observation forever, which is the exact
+                    // deferral this reconciliation exists to end. Drop every cached
+                    // observation instead: it only costs a re-probe, and real 429
+                    // windows live on the accounts themselves, not in this cache.
+                    state.preemptiveQuotaScheduler.clearAll();
+                }
+                state.sessionAffinityStore?.clearAll();
+                state.lastObservedAffinityGeneration = meta.affinityGeneration;
+            }
+            return meta;
+        };
+        const storageMeta = reconcileManualSelection();
         // The ephemeral --account pin (issue #623) takes precedence over the
         // persisted `switch` pin for this invocation, without ever mutating disk
         // state. Use `??` (not `||`) so a forced index of 0 is honored. When set,
@@ -899,10 +940,6 @@ async function handleRequestInner(state, req, res, traceId) {
         if (isPinned) {
             transientAttemptLimit = Math.max(1, Math.min(state.maxRuntimeAccountAttempts, MAX_PINNED_TRANSIENT_ATTEMPTS));
         }
-        if (storageMeta.affinityGeneration > state.lastObservedAffinityGeneration) {
-            state.sessionAffinityStore?.clearAll();
-            state.lastObservedAffinityGeneration = storageMeta.affinityGeneration;
-        }
         let runtimeSelectionIterations = 0;
         while ((isPinned || attemptedIndexes.size < accountCount) &&
             transientAttempts < transientAttemptLimit &&
@@ -1153,6 +1190,7 @@ async function handleRequestInner(state, req, res, traceId) {
                 noteRotation();
                 continue;
             }
+            reconcileManualSelection();
             const quotaSnapshot = readQuotaSchedulerSnapshot(upstream.headers, upstream.status, state.now());
             if (quotaSnapshot) {
                 state.preemptiveQuotaScheduler.update(quotaScheduleKey, quotaSnapshot);
@@ -1162,6 +1200,8 @@ async function handleRequestInner(state, req, res, traceId) {
                 const retryAfterMs = parseRetryAfterHeaderMs(upstream.headers, state.now()) ??
                     parseRetryAfterBodyMs(bodyText, state.now()) ??
                     60_000;
+                // Reading the body awaited I/O; a switch may have landed meanwhile.
+                reconcileManualSelection();
                 state.preemptiveQuotaScheduler.markRateLimited(quotaScheduleKey, retryAfterMs, state.now());
                 // A 429 is the upstream quota signal for the attempted account, so
                 // keep the consumed runtime token drained.

package/dist/lib/storage.d.ts

@@ -109,9 +109,27 @@ export declare function bumpStorageAffinityGeneration(storage: {
  * persisting routine state (rate-limit hits, cooldowns, etc.) so a CLI
  * `switch`/`unpin` that landed between proxy startup and the save is not
  * clobbered. Returns `pinnedAccountIndex: undefined` and
- * `affinityGeneration: 0` on any failure. See issue #474.
+ * `affinityGeneration: 0` on any failure by default. See issue #474.
+ *
+ * `strict` callers additionally need to know when the metadata could not be
+ * OBSERVED AT ALL, because persisting a stale in-memory pin over a newer disk
+ * pin is exactly the #474 regression. Strict mode therefore throws for the two
+ * cases where a newer selection may be hiding behind the failure:
+ *   - the file exists but cannot be read (EBUSY/EPERM/EACCES: on Windows an AV
+ *     scanner or indexer can hold accounts.json open), and
+ *   - the bytes are not valid JSON (a torn read of a concurrent atomic write).
+ *
+ * A MISSING file and a successfully parsed file with INVALID field values are
+ * deliberately not failures, in either mode. Neither can be concealing a newer
+ * pin (there is no file, or we can see the whole file and the field is
+ * unusable), and both are self-repaired by the very write that follows. Making
+ * them throw would wedge persistence permanently, since recreating or repairing
+ * storage goes through the same save path, and it would take every rate-limit
+ * window, cooldown and rotated refresh token in memory down with it.
  */
-export declare function readPinAndGenFromDisk(path: string): {
+export declare function readPinAndGenFromDisk(path: string, options?: {
+    strict?: boolean;
+}): {
     pinnedAccountIndex: number | undefined;
     affinityGeneration: number;
 };

package/dist/lib/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA2CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAoJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA8BA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA2CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAqJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,MAAM,CAmBR;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5B;IACF,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA6CA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}

package/dist/lib/storage.js

@@ -898,7 +898,8 @@ export function normalizeAccountStorage(data) {
             return undefined;
         if (typeof raw !== "number" ||
             !Number.isFinite(raw) ||
-            !Number.isInteger(raw) ||
+            // See readAffinityGenerationFromDisk: an unsafe integer wedges the bump.
+            !Number.isSafeInteger(raw) ||
             raw < 0) {
             log.warn("Dropping invalid affinityGeneration from storage", {
                 value: raw,
@@ -941,7 +942,11 @@ export function readAffinityGenerationFromDisk(path) {
         const generation = parsed.affinityGeneration;
         if (typeof generation === "number" &&
             Number.isFinite(generation) &&
-            Number.isInteger(generation) &&
+            // Safe, not merely integral: past 2^53 `Math.max(gen, disk) + 1 === gen`,
+            // so `bumpStorageAffinityGeneration` silently stops advancing and no
+            // running proxy ever observes another `switch`. Rejecting the value
+            // lets the next bump write 1 and repair the file.
+            Number.isSafeInteger(generation) &&
             generation >= 0) {
             return generation;
         }
@@ -978,7 +983,12 @@ export function bumpStorageAffinityGeneration(storage, storagePath) {
         // No resolvable storage path (never configured). The in-memory counter
         // is still bumped below; only the lost-update guard is unavailable.
     }
-    const inMemoryGeneration = storage.affinityGeneration ?? 0;
+    // Guard the in-memory side too, not just the disk read. Past 2^53
+    // `Math.max(gen, disk) + 1 === gen`, so an unsafe value here would write the
+    // same generation forever and no running proxy would observe another
+    // `switch`. Treating it as 0 makes the next write repair the counter.
+    const rawInMemory = storage.affinityGeneration ?? 0;
+    const inMemoryGeneration = Number.isSafeInteger(rawInMemory) && rawInMemory >= 0 ? rawInMemory : 0;
     const next = Math.max(inMemoryGeneration, diskGeneration) + 1;
     storage.affinityGeneration = next;
     return next;
@@ -990,34 +1000,68 @@ export function bumpStorageAffinityGeneration(storage, storagePath) {
  * persisting routine state (rate-limit hits, cooldowns, etc.) so a CLI
  * `switch`/`unpin` that landed between proxy startup and the save is not
  * clobbered. Returns `pinnedAccountIndex: undefined` and
- * `affinityGeneration: 0` on any failure. See issue #474.
+ * `affinityGeneration: 0` on any failure by default. See issue #474.
+ *
+ * `strict` callers additionally need to know when the metadata could not be
+ * OBSERVED AT ALL, because persisting a stale in-memory pin over a newer disk
+ * pin is exactly the #474 regression. Strict mode therefore throws for the two
+ * cases where a newer selection may be hiding behind the failure:
+ *   - the file exists but cannot be read (EBUSY/EPERM/EACCES: on Windows an AV
+ *     scanner or indexer can hold accounts.json open), and
+ *   - the bytes are not valid JSON (a torn read of a concurrent atomic write).
+ *
+ * A MISSING file and a successfully parsed file with INVALID field values are
+ * deliberately not failures, in either mode. Neither can be concealing a newer
+ * pin (there is no file, or we can see the whole file and the field is
+ * unusable), and both are self-repaired by the very write that follows. Making
+ * them throw would wedge persistence permanently, since recreating or repairing
+ * storage goes through the same save path, and it would take every rate-limit
+ * window, cooldown and rotated refresh token in memory down with it.
  */
-export function readPinAndGenFromDisk(path) {
+export function readPinAndGenFromDisk(path, options) {
+    const unselected = {
+        pinnedAccountIndex: undefined,
+        affinityGeneration: 0,
+    };
     if (!existsSync(path)) {
-        return { pinnedAccountIndex: undefined, affinityGeneration: 0 };
+        return { ...unselected };
     }
+    let parsed;
     try {
-        const bytes = readFileSync(path);
-        const parsed = JSON.parse(bytes.toString("utf8"));
-        const rawPin = parsed.pinnedAccountIndex;
-        const pinnedAccountIndex = typeof rawPin === "number" &&
-            Number.isFinite(rawPin) &&
-            Number.isInteger(rawPin) &&
-            rawPin >= 0
-            ? rawPin
-            : undefined;
-        const rawGen = parsed.affinityGeneration;
-        const affinityGeneration = typeof rawGen === "number" &&
-            Number.isFinite(rawGen) &&
-            Number.isInteger(rawGen) &&
-            rawGen >= 0
-            ? rawGen
-            : 0;
-        return { pinnedAccountIndex, affinityGeneration };
+        parsed = JSON.parse(readFileSync(path, "utf8"));
     }
-    catch {
-        return { pinnedAccountIndex: undefined, affinityGeneration: 0 };
+    catch (error) {
+        // The file was deleted or renamed between existsSync and the read; same
+        // reasoning as the missing-file branch above.
+        if (error.code === "ENOENT") {
+            return { ...unselected };
+        }
+        if (options?.strict) {
+            throw new Error("Unable to read account selection metadata", {
+                cause: error,
+            });
+        }
+        return { ...unselected };
+    }
+    if (!isRecord(parsed)) {
+        return { ...unselected };
     }
+    const rawPin = parsed.pinnedAccountIndex;
+    const pinnedAccountIndex = typeof rawPin === "number" &&
+        Number.isFinite(rawPin) &&
+        Number.isInteger(rawPin) &&
+        rawPin >= 0
+        ? rawPin
+        : undefined;
+    const rawGen = parsed.affinityGeneration;
+    const affinityGeneration = typeof rawGen === "number" &&
+        Number.isFinite(rawGen) &&
+        // See readAffinityGenerationFromDisk: an unsafe integer wedges the bump.
+        Number.isSafeInteger(rawGen) &&
+        rawGen >= 0
+        ? rawGen
+        : 0;
+    return { pinnedAccountIndex, affinityGeneration };
 }
 /**
  * Loads OAuth accounts from disk storage.

package/dist/lib/usage/ledger.d.ts

@@ -1,4 +1,4 @@
-import type { UsageLedgerAppendInput, UsageLedgerPaths, UsageLedgerQuery, UsageLedgerRow, UsageSummary, UsageSummaryQuery } from "./types.js";
+import { type UsageLedgerAppendInput, type UsageLedgerPaths, type UsageLedgerQuery, type UsageLedgerRow, type UsageSummary, type UsageSummaryQuery } from "./types.js";
 export declare function getUsageLedgerPaths(): UsageLedgerPaths;
 export declare function appendUsageLedgerRow(input: UsageLedgerAppendInput): Promise<UsageLedgerRow>;
 export declare function readUsageLedgerRows(query?: UsageLedgerQuery): Promise<UsageLedgerRow[]>;

package/dist/lib/usage/ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../lib/usage/ledger.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACX,sBAAsB,EAEtB,gBAAgB,EAChB,gBAAgB,EAEhB,cAAc,EAEd,YAAY,EAGZ,iBAAiB,EAEjB,MAAM,YAAY,CAAC;AAqOpB,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED,wBAAsB,oBAAoB,CACzC,KAAK,EAAE,sBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CASzB;AA+JD,wBAAsB,mBAAmB,CACxC,KAAK,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,EAAE,CAAC,CAc3B;AAuDD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,cAAc,EAAE,EACtB,KAAK,GAAE,iBAAsB,GAC3B,YAAY,CAwBd;AAED,wBAAsB,oBAAoB,CACzC,KAAK,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B9B;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../lib/usage/ledger.ts"],"names":[],"mappings":"AASA,OAAO,EAEN,KAAK,sBAAsB,EAE3B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EAErB,KAAK,cAAc,EAEnB,KAAK,YAAY,EAGjB,KAAK,iBAAiB,EAEtB,MAAM,YAAY,CAAC;AAqOpB,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED,wBAAsB,oBAAoB,CACzC,KAAK,EAAE,sBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CASzB;AAuKD,wBAAsB,mBAAmB,CACxC,KAAK,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,EAAE,CAAC,CAc3B;AAuDD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,cAAc,EAAE,EACtB,KAAK,GAAE,iBAAsB,GAC3B,YAAY,CAwBd;AAED,wBAAsB,oBAAoB,CACzC,KAAK,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B9B;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/lib/usage/ledger.js

@@ -4,6 +4,7 @@ import { getCodexMultiAuthDir } from "../runtime-paths.js";
 import { logWarn } from "../logger.js";
 import { isRecord, sleep } from "../utils.js";
 import { normalizeUsageLedgerRow, usageRowToJsonLine, } from "./redaction.js";
+import { isKnownServiceTier, } from "./types.js";
 const USAGE_DIR_NAME = "usage";
 const USAGE_LEDGER_FILE_NAME = "usage-ledger.jsonl";
 const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
@@ -287,6 +288,14 @@ function normalizeParsedUsageRow(value) {
             Number.isFinite(value.tokens.totalTokens)
             ? Math.max(0, Math.trunc(value.tokens.totalTokens))
             : 0,
+        // Validated against the union rather than passed through: the file is
+        // on disk and can be edited, and an unrecognised string would reach the
+        // pricer as a tier it has no rate for. Rebuilding only the numeric
+        // fields dropped this entirely, so a persisted Fast row read back as
+        // standard in `usage` reports.
+        ...(isKnownServiceTier(value.tokens.serviceTier)
+            ? { serviceTier: value.tokens.serviceTier }
+            : {}),
     };
     const account = isRecord(value.account)
         ? {

package/dist/lib/usage/pricing.d.ts

@@ -1,9 +1,24 @@
-import type { UsageTokenCounts } from "./types.js";
+import type { UsageServiceTier, UsageTokenCounts } from "./types.js";
 export interface UsageModelPricing {
     inputUsdPerMillion: number;
     outputUsdPerMillion: number;
     cachedInputUsdPerMillion?: number;
     reasoningUsdPerMillion?: number;
+    /**
+     * Rates for non-standard service tiers, keyed by `UsageServiceTier`.
+     *
+     * Every entry in `MODEL_PRICING` is a STANDARD-tier rate. OpenAI's Fast tier
+     * costs more (2x for GPT-6 Astra), so pricing a Fast session off the standard
+     * row under-counts it by half and lets a `maxCostUsd` cap overrun.
+     *
+     * A tier absent from this map is deliberately NOT approximated from the
+     * standard rate. Only Astra's Fast multiplier is published; inventing one for
+     * the rest would move a budget's trip point on a guess, which is the failure
+     * this file exists to avoid. `estimateUsageCostUsd` reports an unlisted tier
+     * as unknown cost instead, so a budget fails closed the same way it does for
+     * an unpriced model.
+     */
+    serviceTiers?: Partial<Record<UsageServiceTier, UsageModelPricing>>;
 }
 /**
  * Models the router can normalize to that have no published rate here yet.

package/dist/lib/usage/pricing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../../lib/usage/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AAwED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,0MAkB3B,CAAC;AAOX,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,iBAAiB,GAAG,IAAI,CAiB1B;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,gBAAgB,GACtB,MAAM,GAAG,IAAI,CAqBf;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAEzE"}
+{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../../lib/usage/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,WAAW,iBAAiB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,CAAC;CACpE;AAyFD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,0MAkB3B,CAAC;AAOX,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,iBAAiB,GAAG,IAAI,CAiB1B;AAmBD,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,gBAAgB,GACtB,MAAM,GAAG,IAAI,CA8Bf;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAEzE"}

package/dist/lib/usage/pricing.js

@@ -1,16 +1,33 @@
 const MODEL_PRICING = {
     // GPT-6 Astra, published at the 2026-09-03 launch: $10 / 1M input,
-    // $50 / 1M output on the standard service tier. Fast mode is 2x standard
-    // ($20 / $100); this table has no service-tier dimension, so it prices the
-    // standard tier and a Fast-mode session is under-counted by half. No cached
-    // input rate was published, so `cachedInputUsdPerMillion` is deliberately
-    // absent: `estimateUsageCostUsd` then bills cached tokens at the full input
-    // rate, which over-states cost. That is the safe direction for a
-    // `maxCostUsd` budget — it trips early, never late.
+    // $50 / 1M output on the standard service tier, and $20 / $100 on Fast,
+    // carried in `serviceTiers` below.
+    //
+    // The cached-input rate is the platform-wide 90% cached discount, which every
+    // other row in this table already encodes at exactly input/10. It shipped
+    // absent at first, on the reasoning that no Astra-specific cached figure was
+    // published; that made Astra the only model billing cached tokens at the FULL
+    // input rate, over-stating a cache-heavy session tenfold and tripping a
+    // `maxCostUsd` cap far too early. Over-stating is the safer direction than
+    // under-stating, but a 10x error blocks legitimate work, and the discount is
+    // a uniform platform rate rather than a per-model guess.
     "gpt-6-astra": {
         inputUsdPerMillion: 10,
         outputUsdPerMillion: 50,
+        cachedInputUsdPerMillion: 1,
         reasoningUsdPerMillion: 50,
+        serviceTiers: {
+            // Published at launch alongside the standard rate: Fast mode is up to
+            // 2.5x the speed at 2x the price, $20 / $100 per 1M. This is the only
+            // tier multiplier OpenAI has published for any model in this table,
+            // which is why it is the only one listed anywhere in this file.
+            priority: {
+                inputUsdPerMillion: 20,
+                outputUsdPerMillion: 100,
+                cachedInputUsdPerMillion: 2,
+                reasoningUsdPerMillion: 100,
+            },
+        },
     },
     "gpt-5-codex": {
         inputUsdPerMillion: 1.25,
@@ -122,8 +139,29 @@ export function getUsageModelPricing(model) {
     }
     return MODEL_PRICING[normalized] ?? null;
 }
+/**
+ * Pick the rate that applies to a response's service tier.
+ *
+ * Returns `null` when the tier is real but this table has no rate for it, which
+ * the caller turns into an unknown cost. `standard` and an absent tier both use
+ * the base row, because every entry in `MODEL_PRICING` is a standard-tier rate.
+ */
+function resolveServiceTierPricing(pricing, serviceTier) {
+    if (!serviceTier || serviceTier === "standard") {
+        return pricing;
+    }
+    return pricing.serviceTiers?.[serviceTier] ?? null;
+}
 export function estimateUsageCostUsd(model, tokens) {
-    const pricing = getUsageModelPricing(model);
+    const basePricing = getUsageModelPricing(model);
+    if (!basePricing) {
+        return null;
+    }
+    // Resolve the tier BEFORE any arithmetic. A response billed at a tier this
+    // table has no rate for must report unknown cost, not a standard-tier
+    // figure: under-counting is what lets a `maxCostUsd` cap overrun, and
+    // `evaluateBudgetGuard` already knows how to fail closed on `null`.
+    const pricing = resolveServiceTierPricing(basePricing, tokens.serviceTier);
     if (!pricing) {
         return null;
     }

package/dist/lib/usage/redaction.d.ts

@@ -1,4 +1,4 @@
-import type { UsageLedgerAccountRef, UsageLedgerAppendInput, UsageLedgerRow } from "./types.js";
+import { type UsageLedgerAccountRef, type UsageLedgerAppendInput, type UsageLedgerRow } from "./types.js";
 export declare function hashUsageIdentifier(value: string): string;
 export declare function createUsageAccountRef(input: {
     accountId?: string | null;

package/dist/lib/usage/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../lib/usage/redaction.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,qBAAqB,EACrB,sBAAsB,EAGtB,cAAc,EAGd,MAAM,YAAY,CAAC;AA2EpB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,qBAAqB,GAAG,IAAI,CAkB/B;AAsBD,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,sBAAsB,GAC3B,cAAc,CA0BhB;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAE9D"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../lib/usage/redaction.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAG3B,KAAK,cAAc,EAGnB,MAAM,YAAY,CAAC;AA2EpB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,qBAAqB,GAAG,IAAI,CAkB/B;AAkCD,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,sBAAsB,GAC3B,cAAc,CA0BhB;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAE9D"}

package/dist/lib/usage/redaction.js

@@ -1,4 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
+import { isKnownServiceTier, } from "./types.js";
 import { estimateUsageCostUsd } from "./pricing.js";
 const VALID_SOURCES = new Set([
     "runtime-proxy",
@@ -98,6 +99,18 @@ function normalizeTokens(input) {
         totalTokens: providedTotal === null
             ? computedTotal
             : Math.max(0, Math.trunc(providedTotal)),
+        // Carried through so `estimateUsageCostUsd` below can refuse to price a
+        // tier it has no rate for. Dropping it here would silently restore the
+        // standard-rate under-count this field exists to prevent.
+        //
+        // Validated, not passed through on truthiness. Every other field in this
+        // normaliser is checked against its allowed set (`normalizeSource`,
+        // `normalizeOperation`, `normalizeOutcome`), and the ledger READ path
+        // already rejects an unknown tier. Accepting one here made the write
+        // path the only unvalidated way onto a row.
+        ...(isKnownServiceTier(input.serviceTier)
+            ? { serviceTier: input.serviceTier }
+            : {}),
     };
 }
 export function normalizeUsageLedgerRow(input) {

package/dist/lib/usage/types.d.ts

@@ -1,12 +1,40 @@
 export type UsageLedgerSource = "runtime-proxy" | "plugin-host" | "local-bridge" | "cli" | "unknown";
 export type UsageLedgerOperation = "responses" | "models" | "thread-goal" | "auth-refresh" | "diagnostic" | "unknown";
 export type UsageLedgerOutcome = "success" | "failure" | "blocked" | "cancelled";
+/**
+ * The service tier a response was actually billed at.
+ *
+ * OpenAI's Fast/priority tier costs more than standard (2x for GPT-6 Astra), so
+ * a rate table with no tier dimension under-counts such a session. `standard`
+ * and `default` are the same thing on the wire; anything this union does not
+ * name is normalised to `unknown`, which is treated as unpriced rather than
+ * assumed cheap.
+ */
+export declare const USAGE_SERVICE_TIERS: readonly ["standard", "priority", "flex", "batch", "scale", "unknown"];
+export type UsageServiceTier = (typeof USAGE_SERVICE_TIERS)[number];
+/**
+ * Narrow an unvalidated value to a known tier.
+ *
+ * The ledger is JSONL on disk and can be hand-edited, so a value read back from
+ * it is untrusted. An unrecognised string reaching the pricer would be treated
+ * as a tier with no rate and silently make every affected row unpriced.
+ */
+export declare function isKnownServiceTier(value: unknown): value is UsageServiceTier;
 export interface UsageTokenCounts {
     inputTokens: number;
     outputTokens: number;
     cachedInputTokens: number;
     reasoningTokens: number;
     totalTokens: number;
+    /**
+     * Rides on the token counts rather than a separate parameter so it reaches
+     * the ledger through every existing path: the `onUsage` callback in
+     * `response-handler.ts` carries this shape, and both the streaming scanner
+     * and the non-streaming branch already funnel through
+     * `extractResponsesUsage`. Absent when the response did not report one,
+     * which is the common case and is priced as `standard`.
+     */
+    serviceTier?: UsageServiceTier;
 }
 export interface UsageLedgerAccountRef {
     accountHash?: string;
@@ -50,6 +78,11 @@ export interface UsageLedgerAppendInput {
     cachedInputTokens?: number | null;
     reasoningTokens?: number | null;
     totalTokens?: number | null;
+    /**
+     * The tier the response reported. Absent means standard, which is what every
+     * rate in `MODEL_PRICING` is quoted at.
+     */
+    serviceTier?: UsageServiceTier;
     costUsd?: number | null;
 }
 export type UsageSummaryGroupBy = "model" | "account" | "project" | "outcome" | "day";

package/dist/lib/usage/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../lib/usage/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAC1B,eAAe,GACf,aAAa,GACb,cAAc,GACd,KAAK,GACL,SAAS,CAAC;AAEb,MAAM,MAAM,oBAAoB,GAC7B,WAAW,GACX,QAAQ,GACR,aAAa,GACb,cAAc,GACd,YAAY,GACZ,SAAS,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,WAAW,CAAC;AAEf,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC5B,OAAO,GACP,SAAS,GACT,SAAS,GACT,SAAS,GACT,KAAK,CAAC;AAET,MAAM,WAAW,gBAAgB;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IAC1D,EAAE,CAAC,EAAE,mBAAmB,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,EAAE,EAAE,mBAAmB,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../lib/usage/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAC1B,eAAe,GACf,aAAa,GACb,cAAc,GACd,KAAK,GACL,SAAS,CAAC;AAEb,MAAM,MAAM,oBAAoB,GAC7B,WAAW,GACX,QAAQ,GACR,aAAa,GACb,cAAc,GACd,YAAY,GACZ,SAAS,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,WAAW,CAAC;AAEf;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,wEAOtB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAK5E;AAED,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC5B,OAAO,GACP,SAAS,GACT,SAAS,GACT,SAAS,GACT,KAAK,CAAC;AAET,MAAM,WAAW,gBAAgB;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IAC1D,EAAE,CAAC,EAAE,mBAAmB,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,EAAE,EAAE,mBAAmB,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CAChB"}

package/dist/lib/usage/types.js

@@ -1 +1,28 @@
-export {};
+/**
+ * The service tier a response was actually billed at.
+ *
+ * OpenAI's Fast/priority tier costs more than standard (2x for GPT-6 Astra), so
+ * a rate table with no tier dimension under-counts such a session. `standard`
+ * and `default` are the same thing on the wire; anything this union does not
+ * name is normalised to `unknown`, which is treated as unpriced rather than
+ * assumed cheap.
+ */
+export const USAGE_SERVICE_TIERS = [
+    "standard",
+    "priority",
+    "flex",
+    "batch",
+    "scale",
+    "unknown",
+];
+/**
+ * Narrow an unvalidated value to a known tier.
+ *
+ * The ledger is JSONL on disk and can be hand-edited, so a value read back from
+ * it is untrusted. An unrecognised string reaching the pricer would be treated
+ * as a tier with no rate and silently make every affected row unpriced.
+ */
+export function isKnownServiceTier(value) {
+    return (typeof value === "string" &&
+        USAGE_SERVICE_TIERS.includes(value));
+}

package/dist/lib/usage/usage-extraction.d.ts

@@ -17,7 +17,8 @@ import type { UsageTokenCounts } from "./types.js";
 export declare function extractUsageTokenCounts(usage: unknown): UsageTokenCounts | null;
 /**
  * Pull the `usage` object out of a Responses payload, whether it arrived as a
- * bare response object (non-streaming) or wrapped in a stream event envelope.
+ * bare response object (non-streaming) or wrapped in a stream event envelope,
+ * and attach the tier it was billed at.
  */
 export declare function extractResponsesUsage(payload: unknown): UsageTokenCounts | null;
 export interface UsageStreamScanner {

package/dist/lib/usage/usage-extraction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage-extraction.d.ts","sourceRoot":"","sources":["../../../lib/usage/usage-extraction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA+BnD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,OAAO,GACZ,gBAAgB,GAAG,IAAI,CA+BzB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAQ/E;AAED,MAAM,WAAW,kBAAkB;IAClC,8CAA8C;IAC9C,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAClC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IACjD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,kBAAkB,CA6ErB"}
+{"version":3,"file":"usage-extraction.d.ts","sourceRoot":"","sources":["../../../lib/usage/usage-extraction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA+BrE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,OAAO,GACZ,gBAAgB,GAAG,IAAI,CA+BzB;AAoCD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAa/E;AAED,MAAM,WAAW,kBAAkB;IAClC,8CAA8C;IAC9C,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAClC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IACjD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,kBAAkB,CA6ErB"}