feat(pricing): model above-threshold price cliffs (incl. OpenAI's 272k), clear all dependency advisories, SHA-pin actions

[rocklambros]

Three related changes, all on the path to a correct and defensible production deploy.

1. Above-threshold price cliffs were silently ignored

parseTiers in src/registry/normalize.ts looked for exactly two hardcoded threshold labels, _above_128k_tokens and _above_200k_tokens. Upstream ships five (128k, 200k, 256k, 272k, 512k), so 42 models were priced completely flat above their cliff.

The concrete case: OpenAI documents gpt-5.6-sol as 2x input and 1.5x output for the full request past 272,000 input tokens (docs). The upstream data agrees ($5 -> $10 input, $30 -> $45 output). We were charging the base rate.

Measured impact on a 10,000-call/month forecast:

Prompt size	Before	After
270,000 tokens	$13,500/mo	$13,500/mo
275,000 tokens	$13,750/mo	$27,500/mo

A 1.9% larger prompt doubles the bill. We were understating it by 50% on input.

Fix: discover thresholds from each entry's own keys instead of a fixed list. A hardcoded list is the same stale-literal failure mode as the pinned-SHA test assertion (#26) and the dated provenance comment (#27): it goes silently wrong the moment a provider adds a tier, and it fails toward under-reporting cost, which is the worst direction for this product.

Guards retained: only the bare _above_<N>k_tokens suffix matches, so _flex, _priority and the _above_1hr_above_<N>k cache-write variant stay out; thresholds must land in 1k..100M; every rate still passes sanePrice; output is sorted ascending so the artifact stays byte-stable (A11).

Models carrying at least one tier: 62 -> 106. droppedCount unchanged at 585. Anchor prices untouched, so the hand-computed E2E oracles are unaffected.

The cliff semantics were already correct in rates.ts (effectiveInputRate reprices the whole request, not marginally) — only discovery was broken.

2. All four dependency advisories cleared

• dompurify 3.4.11 -> 3.4.13 (runtime, GHSA-c2j3-45gr-mqc4). Transitive via jspdf. Nothing calls jspdf's html(), so the bypass was unreachable, but DOMPurify still ships in the bundle.
• postcss 8.5.16 -> 8.5.18 (dev, path traversal).
• brace-expansion: three instances at 1.1.15 / 2.1.1 / 5.0.7, each with its own advisory range. Version-scoped override keys pin each to its own line. A blanket override would have downgraded the 5.x instance under vitest coverage.

npm audit: 0 vulnerabilities, with and without dev deps.

3. Every GitHub Action SHA-pinned

semgrep p/github-actions flagged 5 mutable-tag findings. Already a known deferred item (the D13 note in ci.yml), and the stakes rose this morning: refresh-pricing now mints a Contents:RW App token and pushes a branch that auto-merges to main and auto-deploys. A repointed create-github-app-token tag is a direct path to production.

Verification

• npm run test:ci: 65 files, 389 tests (up from 381), both tsconfigs.
• semgrep across p/typescript, p/react, p/security-audit, p/github-actions, p/secrets: 0 findings.
• gitleaks over 177 commits: no leaks. trivy fs (vuln+misconfig+secret): clean.
• Build, size budget, wasm-free, honest-claims, first-paint-lean, policy-fresh: all pass.

Known gap, not addressed here

tierStraddle is computed on every forecast and never rendered. A user whose workload crosses the 272k cliff now gets correct math but no explanation of the 2x jump, and no prompt that trimming a few thousand tokens halves the bill. That is the single largest optimization lever this change unlocks. Deliberately left for a follow-up rather than expanded into this PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
token-tally	Ready	Preview	Aug 3, 2026 3:37pm

[Copilot]

Pull request overview

This PR hardens TokenTally’s pricing correctness and deployment safety by (1) making above-threshold “price cliff” tier discovery data-driven (so new upstream thresholds like 272k are not silently missed), (2) clearing reported dependency advisories via targeted upgrades/overrides, and (3) SHA-pinning GitHub Actions used in CI and the pricing refresh workflow.

Changes:

• Discover and parse tier thresholds from upstream entry keys (supporting additional thresholds such as 256k/272k/512k), with tests covering sorting, filtering, and service-tier exclusions.
• Add “shipped registry” wiring tests to ensure tier cliffs reprice the whole request as intended by the effective-rate functions.
• Update dependencies/overrides to clear advisories and SHA-pin key GitHub Actions in CI + refresh workflow.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/registry/normalize.ts	Replaces hardcoded tier threshold list with key-driven threshold discovery and uses it in parseTiers.
src/registry/tests/parseTiers.test.ts	Adds coverage for discovered thresholds (e.g., 272k), ordering stability, and ignoring service-tier variants.
src/engine/cost/tests/rates.test.ts	Adds tests against the shipped registry artifact to validate “whole request repricing” semantics for tiers.
package.json	Updates postcss and adds advisory-clearing overrides (DOMPurify, brace-expansion, postcss).
package-lock.json	Locks updated dependency graph reflecting advisory-clearing versions.
.github/workflows/refresh-pricing.yml	SHA-pins actions (notably token-minting step) used in automated pricing refresh.
.github/workflows/ci.yml	SHA-pins checkout/setup-node actions in CI to prevent mutable-tag drift.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 19 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/registry/normalize.ts:137

• countUnparsedTierKeys is meant to make any unreadable _above_*_tokens key loud, but UNPARSED_TIER_KEY = /_above_[^_]*_tokens$/ only matches labels with no underscores. That means keys like _above_1hr_above_200k_tokens (mentioned in the comment) or any future threshold label containing _ will never be counted, defeating the purpose of surfacing new upstream shapes.

// Any `_above_*_tokens` key whose label this parser does NOT understand. Counted rather than ignored: a
// label shape we cannot read (`_above_1m_tokens`, a raw token count) reproduces the exact silent
// flat-pricing bug this module exists to prevent, and silence is how it stayed hidden last time.
// Deliberately excludes the service-tier and long-TTL variants, which are known-out-of-scope, not missed.
const UNPARSED_TIER_KEY = /_above_[^_]*_tokens$/;

scripts/registry/refresh.mjs:101

• The comment says “Models that are NEW this refresh are not flagged”, but unparsedUp is computed from the snapshot-wide unparsedTierKeyCount and will also flip true if added models introduce unreadable tier keys (even though they were never priced before). Either adjust the logic to exclude added models or update the comment so the workflow behavior is not misleading.

// Tier deltas are invisible to the anchor fingerprint (neither gpt-4o nor gpt-4o-mini has a tier), yet a
// changed above-threshold rate reprices a long-context forecast by up to 2x. Since the refresh now
// auto-merges and auto-deploys, any tier change on a model we already shipped, or any newly unreadable
// threshold key, has to stop the unattended path and wait for a human. Models that are NEW this refresh are
// not flagged: they are already listed in the added section and were never priced before.
const tierFingerprint = (snap) =>

[Copilot]

Pull request overview

Copilot reviewed 17 out of 19 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

src/engine/caching/policy.ts:50

• The comment says the 1‑hour write rate is derived from the “BASE input rate”, but callers now pass the tier-aware effective input rate (and may pass a tier-aware 5‑min write rate). Updating this wording would avoid confusion about which input rate the C6 conformance check uses.

  // C6: derive the 1-hr rate from the BASE input rate, not by scaling the stored 5-min field - but only
  // when the stored 5-min rate actually equals base*1.25; a non-conforming SKU returns null (unknown),
  // never a fabricated guess.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 27 changed files in this pull request and generated no new comments.

Suppressed comments (3)

src/workloads/tiers.ts:68

• The crossedThresholds doc comment says cache-only tiers are excluded only when the workload has no cache, but the implementation always excludes cache-only tiers (it only considers tiers with inputPrice/outputPrice). This mismatch is likely to confuse future callers/maintainers; either include cache tiers conditionally or adjust the comment to match current behavior.

// The distinct thresholds the accumulation actually crosses between unit 1 and unit `units`, ascending.
// Only tiers that change a rate count: a cache-only tier crossed by a workload with no cache is not a
// price cliff the user can act on, and reporting it would be a false signal.

src/engine/cost/tests/rates.test.ts:128

• The shipped-registry wiring test treats a tier as non-empty only if it defines input/output/cacheRead/cacheWrite, but parseTiers can now emit a tier that only defines cacheWriteHr1PerMToken. That would incorrectly fail this test when such a tier appears in the catalog.

        const definesSomething =
          t.inputPrice !== null ||
          t.outputPrice !== null ||
          t.cacheReadPerMToken !== undefined ||
          t.cacheWritePerMToken !== undefined;

src/workloads/tiers.ts:91

• detectStraddle currently uses tierFor(..., model.tiers), which will treat cache-only tiers as straddles even when no input/output rate changes. That can make tierStraddle true while tierThresholds is empty (since crossedThresholds excludes cache-only tiers) and can trigger unnecessary banded correction work. Consider filtering to tiers that can affect input/output rates so the flags and correction trigger stay aligned.

// True when unit 1 and unit `units` select different tiers (the accumulation crosses a threshold).
export function detectStraddle(
  model: ModelRecord,

[Copilot]

Pull request overview

Copilot reviewed 25 out of 27 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/engine/cost/tests/rates.test.ts:129

• The “none is an empty shell” assertion doesn’t consider the newly added cacheWriteHr1PerMToken tier field. If upstream ever ships a threshold tier that only publishes the 1‑hour write rate (without cacheWritePerMToken), this test will fail even though the tier is meaningful. Include cacheWriteHr1PerMToken in definesSomething.

        const definesSomething =
          t.inputPrice !== null ||
          t.outputPrice !== null ||
          t.cacheReadPerMToken !== undefined ||
          t.cacheWritePerMToken !== undefined;

src/workloads/forecast.ts:60

• CHARS_PER_TOKEN_FOR_TIERS duplicates ASCII_CHARS_PER_TOKEN from src/tokenizer/heuristic.ts (and the comment says they must match). Keeping these as separate literals risks silent drift if the heuristic constants change, which would reintroduce tier-threshold unit mismatch for per_character models. Consider exporting a shared constant (or a small shared helper) and importing it here.

// Latin-text characters per token, matching ASCII_CHARS_PER_TOKEN in the tokenizer heuristic. Used ONLY to
// put a per_character character count into the token unit that tier thresholds are specified in.
const CHARS_PER_TOKEN_FOR_TIERS = 4;