fix(cli): reject invalid --since and --until date bounds - #1502

The date filtering section showed `--since` and `--until` examples but
never stated which spellings are accepted or what happens to an invalid
value. Record both documented formats, their inclusiveness, the non-zero
exit on rejection, and that config-file bounds get the same check.

…#1506)

`package.nix` restated the name, description, homepage, license, and
`mainProgram` that `apps/ccusage/package.json` already declares, so the
two drifted: the manifest describes the CLI as "Analyze coding (agent)
CLI token usage and costs from local data" while Nix dropped the
parentheses, and nothing tied the Nix `mainProgram` to the manifest's
`bin` entry.

Import the published manifest and derive all of it, following the
pattern in yusukebe/ax: `lib.getLicenseFromSpdxId` turns the SPDX string
into a nixpkgs license, and `mainProgram` comes from the sole `bin` key.
`ccusage-static` and `ccusage-darwin-x64` already build their `meta`
from `config.packages.ccusage.meta`, so they inherit this too.

`version` still comes from the root manifest. `rust/crates/ccusage/
build.rs` falls back to reading it when `CCUSAGE_VERSION` is unset, and
`compiled_version_matches_release_package` asserts the compiled version
matches it, so moving the Nix source would split the version's origin
between the Nix and plain-cargo builds. tagpr bumps both manifests
together.

`meta.homepage` gains the `#readme` fragment the manifest carries. The
URL resolves to the same page.

Verified with `nix eval`: `pname`, `version`, `license.spdxId`, and
`mainProgram` are unchanged, and `ccusage-darwin-x64` still inherits the
license and `mainProgram`.

* fix(nix): call the standalone renovate config validator

`renovate --strict config-validator` exits with "unknown option '--strict'"
on renovate 43: `config-validator` is not a subcommand, and `--strict` only
exists on the separate `renovate-config-validator` binary. The hook only
runs when a renovate config file is staged, which is why the breakage went
unnoticed.

* chore(renovate): unblock automated dependency updates

Renovate has not opened a PR since 2026-06-22 even though the app is
installed org-wide and the config validates. A local `renovate
--dry-run=full` against ccusage/ccusage finishes with result "done" and 25
pending updates, all of them held back by the `schedule:weekly` window
(`before 3am on monday`) that came in through the shared preset: unless a
hosted run happens to land inside that window, nothing is ever created.

The preset is now inlined instead of extended. ryoppippi/renovate-config
lives outside this org, and the two settings that need to differ here are
exactly the ones that caused the outage, so tracking the preset no longer
buys anything.

Changes against the inlined preset:

- no `schedule:weekly`, so any hosted run can act on the backlog
- `dependencyDashboard` enabled: it is the only place the hosted app
  reports config errors and the only way to trigger a run by hand, and with
  it disabled this outage was completely invisible
- `lockFileMaintenance` runs at any time rather than weekly, so flake.lock,
  pnpm-lock.yaml and rust/Cargo.lock refresh as soon as inputs move

`nix.enabled` stays on: the manager is off by default, and it is what keeps
flake.lock in the lock file maintenance branch at all.

…sage#1509)

* ci(pricing): land pricing updates on main instead of opening PRs

The hourly pricing refresh opened a PR with github.token, which cannot
trigger ci.yaml, so the PR arrived with no checks and nothing merged it.
Pricing data was therefore only as fresh as the last time someone merged
that PR by hand, even though the workflow already accepts a
workflow_dispatch.

Both jobs now run the checks that a pull request would have run - flake
check, Rust tests and the Node tests, in a parallel step - and push the
result straight to main. `just gen-models-dev-pricing` already runs before
validation, so the committed snapshots never lag the locked revision.

The commit and rebase-onto-main dance is shared by both jobs, so it lives in
a composite action. A concurrency group keeps a manual dispatch from racing
the hourly run's push.

* refactor(pricing): move the lock update logic into nushell scripts

The two update steps were shell pipelines around jq, curl and cmp writing
JSON to /tmp. Nushell handles the same work as structured data: the lock
file is read with `open`, the pricing document is fetched with `http get`
and compared as a record, so no temporary files or byte-level formatting
assumptions are involved.

The scripts carry the repository's Nix shebang, so they need no extra
nushell setup step in the workflow and stay runnable by hand.

models.dev now decides through a `match` over {snapshots, lock}, which
names the three states the step can end in - snapshots moved, only the lock
moved, nothing moved - instead of inferring them from consecutive `git
diff` calls.

* ci(pricing): run the full check set for both pricing sources

The validation legs only covered flake check, the Rust tests and the Node
tests, so the Babashka harness test from ci.yaml's test job was missing. Now
that the push lands on main without any pull request checks behind it, the
workflow has to run what a PR would have run: `nix flake check` already
covers the preflight job's treefmt and gitleaks checks, and the remaining
legs match the test job leg for leg.

The two sources were separate jobs with a duplicated leg list, which is how
the Babashka leg went missing in the first place. They are a matrix now, so
the checks are written once and both sources cannot drift apart.
`max-parallel: 1` preserves the sequential push the previous `needs:`
ordering gave.

…cusage#1510)

* fix(pricing): commit the codex fallback snapshot from its real path

The models.dev job has failed on every hourly run since ccusage#1428 moved the
adapter crates:

  fatal: pathspec
  'rust/crates/ccusage-adapter-codex/src/codex-auto-review-fallbacks.json'
  did not match any files

The file lives at rust/adapters/codex/src/codex-auto-review-fallbacks.json,
so models.dev pricing has not been refreshed since that move; only the
LiteLLM half of the workflow still worked.

The path was duplicated between the update script and the workflow, which is
how it drifted from the Rust tree in the first place. The script now reports
the paths it owns through GITHUB_OUTPUT and the workflow passes that straight
to the push action, so there is one list. The script also asserts up front
that the snapshots exist, so the next move fails immediately instead of
after a full regenerate-and-validate cycle.

* refactor(pricing): share the GITHUB_OUTPUT report helper between lock scripts

Both update scripts carried a byte-identical `report` definition, so any change
to the GITHUB_OUTPUT format had to be made twice. Move it to a
`.github/scripts/pricing-lock.nu` module both scripts import.

Nushell resolves relative `use` paths against the importing file, so the module
loads regardless of the workflow's working directory.

Co-authored-by: Codesmith <[email protected]>

---------

Co-authored-by: Codesmith <[email protected]>

main has no required status checks, so GitHub auto-merge has nothing to wait
for: `gh pr merge --auto` merged ccusage#1509 while its CI was still running, and
renovate's platformAutomerge would merge dependency PRs the same way.

Requiring the existing checks directly does not work, because everything
behind `changes` is skipped on docs-only pull requests and a skipped check
never satisfies a requirement. This adds the usual aggregator instead: it
needs every job action-timeline already waits for, treats skipped as fine,
and fails only when a job failed or was cancelled. That single "ci gate"
check is what main's ruleset can require.

)

main has no required status checks, so GitHub's auto-merge merges the moment
it is enabled - that is how ccusage#1509 landed mid-CI. platformAutomerge hands
renovate's automerge to that same mechanism, which would merge dependency
PRs before their checks report.

Requiring the new `ci gate` check on main would fix it for every merge path
at once, but a repository ruleset cannot list the built-in GitHub Actions
integration as a bypass actor:

  Actor GitHub Actions integration must be part of the ruleset source or
  owner organization

and required status checks reject direct pushes too, so the rule would break
update-pricing.yaml's push to main. Bypassing by write role does not help
either, because renovate holds write and would bypass the gate it is meant
to obey.

With platformAutomerge off, renovate merges the branch itself once it has
seen the branch checks pass, which needs no repository rules at all.

…e#1516)

The Mend dashboard explains the silence: the ccusage org's Default Engine
Settings have `Dependency Updates (Renovate): Silent`, while the repository
row itself reads Enabled/activated with jobs completing every few hours. In
silent mode renovate does all the work and then creates no branches, pull
requests or issues, which is exactly what we saw - a config that validates, a
local dry-run that finds 26 updates, and nothing ever appearing.

`mode` is not a global-only option, so a repository config may set it. If the
platform applies silent as an org default, this overrides it; if it applies it
as forced config, only the dashboard toggle will help and this line is inert.

…1517)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

ccusage#1523)

`fuzzy_match_allows_date_like_suffixes_for_known_numeric_model_versions`
loads the embedded catalogue and then asserted that `claude-opus-4-9` and
`claude-opus-5` resolve to nothing. Both litellm and models.dev now ship
`claude-opus-5`, so the assertion fails the moment either input is refreshed:
every hourly update-pricing run has failed its Rust test leg since, and the
snapshot could no longer land on main.

The remaining assertion is the one the test is named after - a date-like
suffix on a version the catalogue really has. Which versions must not fuzzy
match is already covered by fuzzy_match_requires_model_key_boundaries and
fuzzy_match_does_not_fall_back_across_numeric_model_versions, which build
their own maps and therefore cannot rot when upstream adds a version.

Verified by updating both inputs, regenerating the snapshots and running the
suite against data that does contain claude-opus-5.

)

* refactor(scripts): replace side-effecting loops with Nushell pipelines

The three CI scripts each drove output through a statement sequence where a
pipeline expression says the same thing directly.

pricing-lock.nu ran `save --append` once per line inside `each`, then discarded
the resulting list of nothings with `ignore`. `to text` already renders a list
as newline-terminated lines, so the whole thing collapses to one append with no
per-iteration side effect.

generate-e2e-fixture.nu bound the generated rows to `lines` only to immediately
join them, and wrapped each `claude_line` call in a redundant `$"(...)"`
interpolation of an already-string value. Feeding the range straight through
`each | flatten | to text | save` drops the binding and the string round-trip.
Verified byte-identical output against the previous implementation.

upsert-pr-comment.nu staged the request body in a `mktemp` file, passed the path
to `gh api --input`, and removed it afterwards. `gh api --input -` reads the body
from standard input, and pipeline input reaches an external command inside a
custom command via `$in`, so the temp file, its `save`, and its `rm` all go away.
Callers that send no body pipe nothing, which `run-external` treats as empty
stdin.

Exercised upsert-pr-comment.nu end to end against a stub `gh` covering the
create, update, HTTP 404 recreate, and HTTP 403 skip paths.

* refactor(scripts): share otool parsing between native package scripts

ensure-native-binary.nu and stage-native-package.nu both defined `binary_name`
and both turned `otool -L` output into a list of linked dylibs, so the two
copies of the parse had already drifted: the staging copy kept blank rows the
checking copy filtered out. Extract both into a `native-binary.nu` module
alongside them, following the `pricing-lock.nu` precedent for a shared
non-executable module.

`linked-dylibs` returns `{ok, stderr, dylibs}` rather than erroring, because the
two callers want different failure handling — staging aborts with the captured
stderr, the portability check treats an otool failure as not portable.

Selecting dylib rows by their tab indent instead of `skip 1` also fixes a latent
bug. `otool -L` repeats an unindented `<binary> (architecture <arch>):` header
once per architecture, so `skip 1` dropped only the first and fed the remaining
headers through as if they were linked libraries. Any fat binary was therefore
reported as depending on itself, and since a binary path does not start with
/usr/lib/ or /System/Library/ the portability check failed it. Cargo emits
single-architecture binaries, so the shipped path never hit this, and old and
new parsing agree exactly on single-architecture input.

Verified against real Mach-O binaries: identical dylib lists to the previous
implementations for single-architecture input, and /bin/ls now reports its 6
real dylibs and passes the portability check instead of failing it. Also ran a
full darwin staging cycle over a nix-store binary that links nix-store libiconv,
confirming the install_name_tool rewrite and the prepack verification still pass.

The dashboard issue adds noise without being used for triage; Renovate PRs
already automerge, so the aggregated overview provides no value.

…age#1518)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Date bound errors shared the pi-store error field, whose gate only
exposes errors to commands that read named pi stores. Split the two
fields so invalid config since/until values are rejected for blocks,
statusline, all, and agent reports as well, while pi-store parse errors
stay gated to the commands that consume them.

Co-Authored-By: Claude Fable 5 <[email protected]>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…ge#1541)

* fix(pricing): take models.dev rates from the authoring catalog

models.dev publishes one catalog per provider, so every model appears once
per provider that serves it. Resellers publish their own rates, and the
generator picked between duplicates by how many fields an entry carried,
with a hardcoded preference for three provider ids. Two problems followed.

The committed snapshot billed resold models at marketplace rates. It held
`moonshotai/kimi-k2.7-code` at 0.73 USD/Mtok, which is OpenRouter's
discounted rate rather than MoonshotAI's 0.95 list rate, alongside a
correct `kimi-k2.7-code` at 0.95; which one a lookup resolved depended on
the fuzzy key match. `moonshotai/kimi-k3`, `moonshotai/Kimi-K3` and
`kimi-k3` each carried a different price for the same model.

Coverage was also decided by a model-name pattern, `/claude|anthropic|kimi
|moonshot/i`, so any family nobody had added to that pattern was unpriced
offline even when models.dev published it and LiteLLM did not.
`xai/grok-build-0.1` is the current example: models.dev carries it under
its authoring catalog, LiteLLM has no entry at all, and `--offline`
reported no cost for it.

Rank catalogs by trust instead. The authoring catalog wins, cloud
platforms that resell at list price plus a published regional premium come
next, and everything else is a last resort used only for models the
authored catalog still knows - which is what keeps retired releases such as
`claude-3-5-haiku-20241022`, now listed by resellers only. Authorship comes
from the `models/<author>/<id>.toml` directory scan rather than a provider
list, so new authors need no maintenance; only `zai`, which serves models
authored under `models/zhipuai/`, needs an alias entry.

The name pattern is gone, and entries whose costs are all zero (flat-fee
plans such as `kimi-for-coding`) or that price assets rather than output
text tokens are skipped instead.

The snapshot grows from 335 to 422 entries. No surviving entry changes
price; the 234 dropped keys are reseller-invented aliases and speed tiers
(`kimi-k2.6-nitro`, `accounts/fireworks/...`, `TEE/...`) and dotted or
`-thinking` spellings the fuzzy matcher already resolves to their base key.

The derived provider trust lists are emitted alongside the snapshot for the
Rust runtime loader, which sees only the live api.json and so cannot scan
the authored catalog itself.

* perf(pricing): minify the embedded models.dev snapshot

The committed snapshot is indented so its regeneration diffs stay
reviewable, and `include_str!` embedded it byte for byte, so the
indentation shipped in every binary. At 422 entries the whitespace is
about 19 KiB of the 58 KiB file.

Strip it in `build.rs` on the way in, the same place the LiteLLM snapshot
is already compacted. The committed file keeps its formatting.

Together with the broader coverage this keeps the release binary flat:
3,162,832 bytes before, 3,162,880 after, for 87 more priced models.

* fix(pricing): rank models.dev catalogs when refreshing pricing online

The runtime models.dev fallback loaded providers straight out of an
`FxHashMap`, and the first catalog to claim a model id keeps it. Which
catalog that was therefore depended on hash iteration order, so a reseller
could supply a model the authoring catalog also publishes, and the
selection could change whenever models.dev adds or removes a provider.
`grok-build-0.1`, for example, is served by 13 catalogs whose input rates
range from 0 to 1 USD/Mtok.

Rank the catalogs before loading, using the provider trust lists the
snapshot generator derives from the authored catalog, and sort by provider
id within a tier so the result no longer depends on hash order at all.

Also skip entries whose input and output costs are both zero. Flat-fee
subscription catalogs publish those - `kimi-for-coding` is one, and it is
among the 13 that serve `grok-build-0.1` - so loading one reported every
request as free. The snapshot generator already skipped them; the runtime
loader did not.

* fix(pricing): keep asset-priced models out of the models.dev snapshot

Dropping the model-name filter let two kinds of non-token pricing into the
snapshot, where the runtime divides the rate by a million and multiplies it
by token counts.

`whisper-large-v3` prices per second of audio. It reached the snapshot at
0.003 USD because the catalogs serving it advertise text output, and the
previous check only looked at the output side.

`gemini-2.5-flash-image` and `gemini-3-pro-image-preview` price per
generated image - 30 and 120 USD respectively. Google authors both with
image output, so the output check did reject Google's entry, but `302ai`
lists the same models as text-only and its entry was embedded instead. A
sloppier reseller description could therefore override the author's.

Read the modalities off the authored catalog rather than the catalog being
loaded, so one reseller's description cannot decide eligibility, and require
that the input modalities include text. A model that accepts no text is a
transcription or vision-only endpoint billed by duration; accepting audio,
video, image or PDF alongside text is normal for chat models and is
tokenised, so `kimi-k3` and `gemini-3-flash-preview`, which take video and
audio input, stay eligible. An earlier attempt rejected any audio or video
input and dropped both of them.

The snapshot goes from 422 to 418 entries. The Rust test asserts both
directions against the committed artifact so a future regeneration cannot
reintroduce either case.

* fix(pricing): apply the snapshot's selection rules to live models.dev too

The asset-priced guard and the same-tier tie-break existed only in the
snapshot generator, so an online refresh could still price a model the
embedded snapshot deliberately excludes, and could pick a different catalog
than the snapshot for the same model. Offline and default runs disagreed.

The live `api.json` records neither who authored a model nor the authored
modalities, so both have to be carried in from generation time. The
generated artifact therefore grows an `assetPricedModelIds` list, and is
renamed from `models-dev-provider-trust.json` to
`models-dev-catalog-rules.json` now that it carries more than provider
trust.

The loader applies it the same way the generator does: the authored verdict
decides where it exists, so a reseller describing an image model as
text-only cannot reintroduce a per-image rate, and entries the authored
catalog has never seen fall back to their own modalities, which is enough to
reject an audio-only transcriber from any catalog.

Same-tier ties now compare how much pricing detail an entry carries -
explicit cache-read, cache-write, context limit - before falling back to the
provider id, matching `shouldReplaceModelsDevPricingCandidate`. That needed
the loader to track which catalog claimed each id during a pass, so a better
candidate can replace a weaker one; ids absent from that record still belong
to another pricing source and are left alone. Replacements do not increment
the loaded count, which stays a count of resolved models.

Reported by cubic on ccusage#1541.

* style(pricing): collapse the nested modality check

clippy::collapsible_if. Rewriting the two checks as slice patterns reads
better than collapsing the condition and drops the redundant emptiness
tests.

* fix(pricing): keep separately priced tiers of the models we carry

Dropping reseller-only ids took the speed and effort tiers with them:
`kimi-k2.6-nitro`, `kimi-k2.7-code-flex`, `glm-5.2-nitro`, `claude-opus-4-6-think`
and about 140 others. Those are their own routes at their own rates, usually
cheaper than the author's, so resolving them to the base model by name
similarity over-reports them. `kimi-k2.6-nitro` went from 0.275 to 0.95
USD/Mtok - 3.5x - which is worse than the reseller duplicate this series set
out to remove.

Keep a reseller entry when its id is the authored id plus a suffix, and only
for bare ids: an id carrying a provider path is that provider's catalog entry
for a model some trusted catalog publishes anyway, which is the duplicate
case.

A tier the author prices itself does not qualify. `claude-opus-5-fast` and
`claude-opus-4-8-fast` exist in exactly one reseller catalog at 12 USD/Mtok
while Anthropic publishes 10, so taking the reseller rate would over-report
them; the fast multiplier the runtime already applies is correct. The check
reads those modes from the authoring provider's catalog entry, because
`experimental.modes` lives in `providers/<author>/models/<id>.toml` rather
than in the `models/` metadata.

Snapshot 418 -> 559 entries, binary 3,162,832 -> 3,179,440 bytes (+0.5%).
`ccusage daily --until 20260728` over a real 169-day Claude and Codex log
stays byte-identical to main in both online and offline modes.

The broader alternative - keep every reseller id that does not reduce to an
authored one - was measured at 1804 entries and +136 KiB, because it drags in
every third-party host's copy of every open-weight model.

* fix(pricing): match generation's candidate ordering in the live loader

Three defects in the same-tier tie-break, all reported on ccusage#1541.

The detail comparison summed how many optional fields an entry carried, but
generation compares cache-read, then cache-write, then context-limit presence
in that order. A cache-read-only entry therefore lost online to one carrying
cache-write and a context limit, while the committed snapshot picked the
former. A `ModelsDevClaim` struct with the fields declared in that order
fixes it, because `derive(PartialOrd)` compares them in declaration order.

A replacement that publishes no context limit left the replaced catalog's
limit in `context_limits`, reporting a window the selected rates do not
belong to. It is now removed, and only when the id was claimed in this pass,
so another pricing source's limit is never touched.

Two source keys in one catalog can carry the same `id`, and the first to
arrive claimed it, which meant hash iteration order decided the winner again.
Generation walks each catalog in key order and keeps the first of an
equal-strength tie, so the entries are sorted by key before loading.

Today's models.dev response has no such duplicate, because `generateProviders`
sets `id` to the source key, but nothing in the schema guarantees that.

* fix(treefmt): stop typos rewriting model ids in generated snapshots

One Gemini id in the models.dev snapshot ends in a clipped "no thinking",
which typos treats as a misspelling and corrects. The committed snapshot
therefore carried a model id that does not exist upstream, so that model
could never match and would report no cost - a silent data corruption in a
file nobody reads by hand.

This only surfaced now because the previous commits widened the snapshot from
the Claude and Kimi families to every token-priced model, which is what first
pulled a typos-sensitive id into it. CI caught it as a treefmt-check failure
on the generated file.

Exclude the three generated snapshots from typos alone; they stay in the JSON
formatter, which is what keeps their regeneration diffs reviewable.

The same rewrite applies to prose, so the comment explaining this cannot
spell the id out - it was rewritten on the first `just fmt` after being
written.

* fix(pricing): carry the authored catalog's verdicts into the live loader

The rules artifact listed only the models the authored catalog prices per
asset, so the live loader could reject a model the snapshot carries: an
authored token-priced model whose serving catalog describes it as
image-output fell through to that catalog's modalities and was dropped, while
generation had accepted it on the authored verdict. The asymmetry only ran one
way, so `--offline` priced the model and a default run did not.

Carry `authoredModelIds` as well. An authored id absent from the asset list is
authored as token-priced, which settles it whatever the serving catalog
claims, and only ids the authored catalog never listed still fall back to live
modalities.

The same artifact then closes the loader's other gap. Generation embeds a
reseller entry only when the authored catalog knows the model or when the id
names a separately priced tier of one; the loader checked token pricing alone,
so an online refresh priced 1705 ids the embedded snapshot deliberately omits,
each at that reseller's own promotional or marked-up rate. Only the tiers an
author prices itself were missing from the artifact, so with `authoredModes`
alongside the authored id set the loader can apply
`isEmbeddableModelsDevCandidate` too, and simulating it over the pinned catalog
now reproduces the committed snapshot exactly: same 559 ids, same rates. The
artifact grows to 8.0 KB.

Also rank and tie-break catalogs by `provider.id` rather than the key they are
filed under, which is what `provider.id ?? providerId` gives the generator.
models.dev assigns the id from the directory name today, so the two agree, but
nothing in the schema requires it.

Reported by cubic on ccusage#1541.

* fix(pricing): stop pruning models.dev ids and gate the fuzzy lookup instead

Pruning ids to keep the snapshot small was the wrong lever. `PricingMap::find`
falls back to substring matching that prefers the longest matching key, so
removing an id does not make its lookups fail - it makes them resolve to
whichever remaining key happens to match. Three pruning rules were tried and
each mispriced something different, measured by pricing all 829 ids either
side of the diff knows:

- reseller ids dropped: `kimi-k2-7-code` resolved to `kimi-k2.7-code-highspeed`
  and doubled, from 4.95 to 9.90 USD for 1M+1M tokens, and about 40 Claude
  spellings such as `claude-4.5-sonnet` and `claude-3-7-sonnet-latest` went
  unpriced because the authored id is `claude-sonnet-4-5` and neither spelling
  contains the other
- tiers marked exact-only on top of that: `moonshotai/kimi-k2.7-code-highspeed`
  then fell to the base rate instead
- bare ids kept, namespaced ones dropped: 31 ids changed price, in both
  directions

Keep every id the catalog publishes, so each resolves exactly and the fuzzy
fallback only ever sees ids models.dev has never heard of - which is where it
was before this branch. The rules now decide only *which* catalog's rates an id
gets.

Two kinds of key must still stay out of the fuzzy candidates, because they
would answer a lookup for a different model:

- a separately priced tier: `kimi-k2.7-code-highspeed`, `kimi-k2.6-nitro`,
  `claude-opus-5-fast`
- an id with no version in it: models.dev carries one called `auto`, which
  answered `codex-auto-review` - a Codex label that has to resolve through the
  adapter's date mapping rather than be priced directly. An existing test
  caught it

`PricingMap` gains an `exact_only` set, excluded from the fuzzy scan in
`find_entry` and `context_limit_entry`, and the snapshot marks those keys.

Snapshot 335 -> 2362 entries, 476 of them exact-only. The binary grows
3,162,832 -> 3,444,032 bytes, 8.9%. That is the price of the guarantee: across
all 829 ids, 367 are newly priced, none lost pricing, and none changed price.

Two follow-ups the online path needed for the same reasons, folded in here
because the workspace cannot author a separate commit GitHub will accept:

`exactOnly` is a field this commit writes into the snapshot, and a live
`api.json` has none, so nothing was ever added to `PricingMap::exact_only`
online: a refreshed run put every tier back into the fuzzy scan, where a live
`kimi-k2.7-code-highspeed` answered `kimi-k2-7-code` and `auto` answered
`codex-auto-review`. The loader now rederives the verdict from the rules
artifact, asking the tier half about the catalog's source key and the
unversioned half about the pricing key it resolves to. It also stops pruning
reseller ids with `is_embeddable`, the rule this commit dropped from
generation, which had the online refresh carrying 601 ids where the snapshot
carries 2362. The tier check folds `@` as `normalizeModelId` does, so the 25
Vertex regional ids such as `claude-opus-5@eu` are recognized as tiers of the
model they shadow. Replaying the loader over the pinned revision's catalog now
reproduces the committed snapshot exactly: the same 2362 ids, the same rates,
the same 476 exact-only keys.

Generation resolves `provider.id ?? providerId` before ranking a catalog, the
way the loader does, so a catalog filed under an alias cannot be an owner
online and a reseller in the snapshot. models.dev assigns that id from the
directory it scanned, so the artifacts regenerate byte for byte.

Co-authored-by: Codesmith <[email protected]>

Test the two gates directly: unit tests for isUnversionedModelId in the
generator, and a grok candidate test whose priced key no -build candidate
can reach, so it exercises the strip instead of the fuzzy lookup answering
xai/<raw> with a key the raw form already contains.

* fix(pricing): keep the fuzzy lookup off exact-only ids

`exact_only` kept a separately priced tier from answering another model's
lookup, but not the reverse: the embedded models.dev snapshot is a
separate map consulted only after the primary LiteLLM one misses, so
`claude-opus-5-fast` matched LiteLLM's `claude-opus-5` in the primary
fuzzy scan and billed the tier at list price, 5/25 instead of 12/60. The
same shadowing hit the regional aliases, `claude-opus-5@eu` and friends.

Gate the fuzzy scan on whether a consulted catalog carries the requested
id as exact-only, so it falls through to that exact entry instead. Only a
carried entry gates the scan, leaving ids nothing prices exactly on the
fuzzy path they had.

Co-authored-by: Codesmith <[email protected]>

* fix(pricing): deny the fuzzy scan when an alias names an exact-only id

A `CCUSAGE_MODEL_ALIASES` entry is only tried after the map has answered
for the spelling the log recorded, so gating on that spelling alone left
the tier the alias names unreachable: `claude-opus-5-turbo` aliased to
`claude-opus-5-fast` still fuzzy-matched LiteLLM's `claude-opus-5` and
billed the list rate. Carry the verdict for the resolved alias into the
first lookup, in the context-limit path too. Exact entries for the
recorded spelling keep their precedence, and the alias, the network
catalog and the snapshot all still resolve fuzzily on their own terms.

Co-authored-by: Codesmith <[email protected]>

* perf(pricing): deflate the embedded pricing snapshots

Dropping the coverage filters grew the embedded models.dev snapshot to a
quarter megabyte of JSON, all of it shipped verbatim in every binary:
3,162,832 bytes on main to 3,444,032, 8.9%. The JSON deflates to a ninth of
its size, so compress all three embedded snapshots in build.rs and inflate
each one once, on first use. The committed files stay indented for reviewable
regeneration diffs.

  models-dev-pricing.json    259,174 -> 28,448 bytes
  binary                     3,444,032 -> 3,179,904 (+0.5% over main)

The inflate side is miniz_oxide without default features, pure Rust; under
the fat-LTO opt-level=z release profile the decompressor costs a few KiB.
Inflation runs once per snapshot per process and is not measurable at
startup. Compression runs in build.rs at maximum effort, where its cost is
paid only when a snapshot changes.

Verifying the round-trip surfaced a pre-existing wrinkle: serde_json's
default float parsing is not correctly rounded, so the minification
introduced in an earlier commit shifted eleven prices by one ULP on their way
into the binary - harmless at 1e-16 relative, but it broke the invariant that
the embedded data equals the committed data. The build script now enables
serde_json's float_roundtrip feature, which is host-only and costs the
shipped binary nothing; the inflated snapshots are byte-faithful to the
committed files again.

Re-verified against main across every id either snapshot knows: 367 newly
priced, none lost, none changed. The two ids that moved in the raw probe,
TEE/kimi-k2.5 and its -thinking sibling, no longer exist at the pinned
models.dev revision, so both binaries guess through the fuzzy fallback and
their guesses differ - the pre-existing unknown-id behavior, not a change in
it. Real-log reports stay byte-identical to main in both modes.

* fix(pricing): gate every separator spelling of an exact-only id

models.dev writes a regional alias as claude-opus-5@eu, and the fuzzy scan
reads @, . and - as one separator, so a request recording claude-opus-5-eu
passed the raw-string exact-only gate and was billed at the base model's
list rate. Index exact-only ids under their normalized spelling too, and
answer such a request from the id it names rather than losing its rate.

Co-authored-by: Codesmith <[email protected]>

* fix(pricing): index dash-spelled exact-only ids by their normalized form

normalized_pricing_key borrows a key already spelled with dashes alone, so
the normalized index skipped it and a request writing that id with . or @
answered neither membership question: the fuzzy scan then billed the base
model instead of the exact-only tier.

Co-authored-by: Codesmith <[email protected]>

* refactor(pricing): name the failing snapshot in build panics

embed_snapshot runs for two snapshots and the LiteLLM path used the same
message, so a build failure did not say which file it failed on. Reported
by CodeRabbit on ccusage#1541.

* feat(pricing): price long-context tiers from models.dev data

Grok, GPT-5.x and Gemini bill requests above a context boundary at higher
rates, and `--mode calculate` ignored that everywhere the data came from
models.dev: the generator dropped `cost.tiers` on the floor, and the only
two-stage rates the runtime knew were a hardcoded table for six GPT-5
models. On a real Grok Build log, 94 of 172 requests exceed the 200K
boundary and were billed at half the correct input rate.

The generator now emits each model's long-context band in the upstream
`cost.tiers` shape, so the Rust loader parses the embedded snapshot and a
live `api.json` response with the same code. `Pricing` holds one above-base
band, so the band with the lowest context threshold is kept - it is the one
a request crosses first, and the handful of models publishing a second,
higher band would otherwise contribute nothing.

Models whose base rates come from LiteLLM get the band filled in from the
models.dev snapshot after every load, replacing the hardcoded
`builtin_long_context_rates` table. The overlay consults exact ids only
(after date-suffix and alias resolution): a fuzzy match here could graft one
model's tier onto another's base rates. `long_context_split_threshold`,
which the Codex aggregation uses to bucket per-request context sizes, now
reads the same data.

Deleting the table also fixes two prices it had frozen: OpenAI cut
gpt-5.6-terra to 2/12 USD/Mtok (tier 4/18) and gpt-5.6-luna to 0.2/1.2
(tier 0.4/1.8) after it was written, and `put_builtin_pricing` was
overwriting the corrected rates LiteLLM already publishes - luna reported
at five times its price. Built-in entries are now a last resort for keys
the snapshots miss, never an overwrite, with one exception kept: z.ai's
GLM cache facts (no cache-write billing, own cache-read rate) are patched
onto entries whose snapshot did not publish cache rates, base rates
untouched.

* fix(cost): select the long-context tier by the whole context

The two-stage branch compared only `input_tokens` against the model's
threshold, but adapters normalize usage into the Claude shape where that
field is the uncached remainder. The vendor picks the tier by the request's
whole context, cached or not, so a turn re-reading megabytes of cached
prompt with a few thousand fresh tokens was billed at the short-context
rate. Grok logs are the extreme case: prompt caching leaves days where
cache reads outnumber fresh input fifty to one, so effectively no request
ever crossed the boundary.

Sum uncached input, cache reads and cache writes for the comparison. The
Codex path already compares OpenAI's raw `input_tokens`, which includes
the cached share, so the two paths now agree on what a request's size is.

Billing itself is unchanged - each bucket still bills at its own rate -
only the tier selection sees the full context.

* fix(grok): resolve pricing candidates exactly before falling back to fuzzy

`PricingMap::find` falls back to substring matching, so once the snapshot
carries `grok-4.5`, the raw candidate `grok-4.5-build` fuzzy-hits it on the
first iteration and every later candidate is dead code - including the
`xai/`-prefixed spellings a user pricing override may be keyed by.

Try every candidate exactly first, then repeat the walk with the fuzzy
lookup. An override naming the request's model precisely now beats a fuzzy
hit on a shorter spelling, and with no override the result is unchanged:
both passes land on the same grok-4.5 rates.

* fix(pricing): merge dotted and dashed spellings onto one models.dev entry

models.dev catalogs spell the same version with dots or dashes, and each
spelling got its own snapshot entry from whichever catalog published it.
The two entries then tied in the fuzzy lookup - equal length, arbitrary
tie-break - so `grok-4.5-build` resolved to `grok-4-5`, a reseller's flat
copy, instead of `grok-4.5`, xAI's tiered one, and every long-context Grok
turn was billed at the base rate even after the tiers landed.

Spellings now contend for one slot keyed by the normalized id, in the
generator and in the live loader alike, and the losing spelling's entry is
removed outright - entry, exact-only flag and context limit - or both would
stay findable and the tie would return. The winner also gains a comparison
step: within a trust tier, a catalog publishing a long-context band beats
one with more cache detail, because the band is the rate data hardest to
come by. Lookups by the losing spelling still resolve through the fuzzy
normalization, now onto the surviving entry.

The snapshot shrinks from 2363 to 2159 entries, all spelling duplicates.

* docs(grok): describe long-context tier estimation

The estimate now applies xAI's long-context rates when a turn's whole
context crosses the model boundary, so the guide stops claiming the tiering
is not reproduced and states the per-turn approximation instead.

* test(pricing): carry the tier flag in generator candidate fixtures

oxlint's type-aware pass requires the new field the runtime comparison
gained; node --test does not type-check, so it passed without it.

* fix(pricing): normalize catalog verdict lookups and stop the last overwrites

Review findings from cubic on ccusage#1541, all in the new tier and selection code.

The authored catalog's verdicts - asset-priced, authored, its modalities -
were keyed by the exact source id, so a catalog spelling a model with
different separators or case dodged them: a reseller listing
`gemini-2-5-flash-image` as text-only would have put its per-image rate
into the snapshot. The verdict maps and the rules artifact now hold
normalized ids, and every lookup normalizes the same way generation does,
case folding included; the live loader's claim slots fold case too, so
case-variant spellings merge online exactly as they merge offline.

Generation also disagreed with the runtime about an authored model that
publishes no modalities: the generator fell back to the serving catalog's
description while the loader kept every authored id, so a mislabeling
catalog could make the snapshot skip what a live refresh keeps. Authored
ids without authored modalities are now token-priced in both paths.

Three built-in entries still overwrote refreshed pricing - the two
claude-3-5-haiku spellings and z.ai's free glm-4.5-flash - and now go
through the fallback and patch helpers like the rest. The GLM cache patch
also repairs a defaulted cache-write on entries whose cache-read rate was
published: `Pricing` records only read explicitness, but the derived
default is recognizable exactly, being this same computation.

The long-context sum saturates instead of wrapping, so a corrupt JSONL
line cannot flip a request under the threshold or abort under overflow
checks.

* fix(pricing): key empty declared ids by their source and order same-id catalogs

Two live-loader gaps against generation, reported by cubic on ccusage#1541.

A live catalog can declare `id` as an empty string, and the loader stored
the model under "" - a name no lookup ever asks for - where the generator's
`selectModelsDevPricingKey` falls back to the source key. Empty ids now
fall back the same way, for the pricing key and for the exact-only verdict
alike.

Two catalogs can also declare the same provider id, which tied the sort and
left their order to hash iteration. The unique provider map key settles the
tie now, matching the order of generation's provider-key walk.

* fix(pricing): track cache-write explicitness instead of inferring it

The z.ai cache patch recognized a defaulted cache-write by its value - it
equals `input * 1.25` - which misreads a catalog explicitly publishing that
same number. The heuristic was a dodge around `Pricing` only recording
cache-read explicitness; recording both is the honest shape, so every
constructor now says where its cache-write rate came from: published data
or the derived default. The patch repairs reads and writes independently
and only ever the derived ones.

Reported by cubic on ccusage#1541, and it also closes the round-3 finding this
heuristic had answered halfway.

The Grok guide's troubleshooting note still credited LiteLLM for
`--mode calculate` estimates; it now matches the Pricing bullet above it.

* fix(pricing): break exact claim ties by source key within a declared id

Two catalogs declaring the same provider id are one provider to generation,
which breaks exact-strength ties by `(sourceProviderId, sourceModelId)` -
and with the ids colliding, by the source model key. The live loader kept
whichever catalog arrived first instead, so a same-strength duplicate could
resolve to a different rate online than in the snapshot. The claim slot now
records the declared id and source key it was claimed under, and an exactly
equal claim yields to a smaller source key from the same declared id.
Differing declared ids were already settled by arrival order, which matches
generation's ascending walk.

Reported by pullfrog on ccusage#1541.

Also narrows the new `cache_create_explicit` field to `pub(crate)`: nothing
outside the crate reads it, and the hawk gate fails the build for exactly
that.

* style(pricing): make the cache-write flag private

hawk: pub(crate) was still wider than its uses, which never leave the
pricing module.

---------

Co-authored-by: Codesmith <[email protected]>

Bring the date-bound validation branch up to the current main so the existing parser regression tests and the new validation coverage coexist without merge conflicts.