@gajae-code/ai 0.18.12 → 0.19.0

package/src/auth-storage.ts

@@ -1210,7 +1210,7 @@ export function formatOAuthIdentityLabel(
 	return base ? `${base} (${organization})` : organization;
 }
 
-type OAuthResolutionResult = { apiKey: string; credential: OAuthCredential };
+type OAuthResolutionResult = { apiKey: string; credential: OAuthCredential; credentialRowId: number };
 
 /**
  * Refreshed OAuth access plus identity metadata returned by
@@ -1525,6 +1525,15 @@ type ConfigApiKeyOwnerFork = {
  * Reads from storage on reload(), manages round-robin credential selection,
  * usage limit tracking, and OAuth token refresh.
  */
+/** Tier names that denote a model family rather than a plan or quota tier. */
+const MODEL_FAMILY_TIERS: ReadonlySet<string> = new Set(["opus", "sonnet", "haiku"]);
+
+/** A recorded usage-limit backoff; `modelId` scopes it to one model or model family. */
+interface CredentialBackoffEntry {
+	untilMs: number;
+	modelId?: string;
+}
+
 export class AuthStorage {
 	static readonly #defaultBackoffMs = 60_000; // Default backoff when no reset time available
 
@@ -1566,7 +1575,7 @@ export class AuthStorage {
 	/** Tracks the last used credential per provider for a session (used for rate-limit switching). */
 	#sessionLastCredential: Map<string, Map<string, { type: AuthCredential["type"]; index: number }>> = new Map();
 	/** Maps provider:type -> credentialIndex -> blockedUntilMs for temporary backoff. */
-	#credentialBackoff: Map<string, Map<number, number>> = new Map();
+	#credentialBackoff: Map<string, Map<number, CredentialBackoffEntry[]>> = new Map();
 	#usageProviderResolver?: (provider: Provider) => UsageProvider | undefined;
 	#rankingStrategyResolver?: (provider: Provider) => CredentialRankingStrategy | undefined;
 	#usageCache: UsageCache;
@@ -3050,32 +3059,60 @@ export class AuthStorage {
 		return order;
 	}
 
-	/** Returns block expiry timestamp for a credential, cleaning up expired entries. */
-	#getCredentialBlockedUntil(providerKey: string, credentialIndex: number): number | undefined {
+	/**
+	 * Returns the block expiry for a credential, cleaning up expired entries.
+	 * A block recorded for one model only applies to that model; a block without a
+	 * model applies to the whole credential. `modelId` is the requested model, so
+	 * omitting it asks only about credential-wide blocks.
+	 */
+	#getCredentialBlockedUntil(providerKey: string, credentialIndex: number, modelId?: string): number | undefined {
 		const backoffMap = this.#credentialBackoff.get(providerKey);
 		if (!backoffMap) return undefined;
-		const blockedUntil = backoffMap.get(credentialIndex);
-		if (!blockedUntil) return undefined;
-		if (blockedUntil <= Date.now()) {
-			backoffMap.delete(credentialIndex);
-			if (backoffMap.size === 0) {
-				this.#credentialBackoff.delete(providerKey);
-			}
-			return undefined;
+		const entries = backoffMap.get(credentialIndex);
+		if (!entries || entries.length === 0) return undefined;
+		const now = Date.now();
+		const live = entries.filter(entry => entry.untilMs > now);
+		if (live.length !== entries.length) {
+			if (live.length > 0) backoffMap.set(credentialIndex, live);
+			else backoffMap.delete(credentialIndex);
+			if (backoffMap.size === 0) this.#credentialBackoff.delete(providerKey);
+		}
+		let blockedUntil: number | undefined;
+		const wanted = modelId?.trim().toLowerCase();
+		// A recorded scope may name a model or a model-family tier, so match a tier
+		// against the requested model id the same way limit scoping does.
+		const entryApplies = (entryModel: string): boolean => {
+			if (wanted === undefined) return false;
+			const scope = entryModel.toLowerCase();
+			if (scope === wanted) return true;
+			return MODEL_FAMILY_TIERS.has(scope) && wanted.includes(scope);
+		};
+		for (const entry of live) {
+			if (entry.modelId !== undefined && !entryApplies(entry.modelId)) continue;
+			if (blockedUntil === undefined || entry.untilMs > blockedUntil) blockedUntil = entry.untilMs;
 		}
 		return blockedUntil;
 	}
 
 	/** Checks if a credential is temporarily blocked due to usage limits. */
-	#isCredentialBlocked(providerKey: string, credentialIndex: number): boolean {
-		return this.#getCredentialBlockedUntil(providerKey, credentialIndex) !== undefined;
+	#isCredentialBlocked(providerKey: string, credentialIndex: number, modelId?: string): boolean {
+		return this.#getCredentialBlockedUntil(providerKey, credentialIndex, modelId) !== undefined;
 	}
 
-	/** Marks a credential as blocked until the specified time. */
-	#markCredentialBlocked(providerKey: string, credentialIndex: number, blockedUntilMs: number): void {
-		const backoffMap = this.#credentialBackoff.get(providerKey) ?? new Map<number, number>();
-		const existing = backoffMap.get(credentialIndex) ?? 0;
-		backoffMap.set(credentialIndex, Math.max(existing, blockedUntilMs));
+	/** Marks a credential as blocked until the specified time, optionally for one model. */
+	#markCredentialBlocked(
+		providerKey: string,
+		credentialIndex: number,
+		blockedUntilMs: number,
+		modelId?: string,
+	): void {
+		const scoped = modelId?.trim() || undefined;
+		const backoffMap = this.#credentialBackoff.get(providerKey) ?? new Map<number, CredentialBackoffEntry[]>();
+		const entries = backoffMap.get(credentialIndex) ?? [];
+		const existing = entries.find(entry => entry.modelId === scoped);
+		if (existing) existing.untilMs = Math.max(existing.untilMs, blockedUntilMs);
+		else entries.push({ untilMs: blockedUntilMs, modelId: scoped });
+		backoffMap.set(credentialIndex, entries);
 		this.#credentialBackoff.set(providerKey, backoffMap);
 	}
 
@@ -3366,12 +3403,14 @@ export class AuthStorage {
 				`Credential selector ${this.#formatCredentialSelector(selector)} cannot be used for ${provider} while a runtime API key override is active`,
 			);
 		}
-		if (this.#hasConfigOverride(provider, owner)) {
+		const selected = this.#findCredentialBySelector(provider, selector);
+		const configOverride = this.#configOverrideRegistration(provider, owner);
+		if (configOverride && !(configOverride.envSourced && selected?.credential.type === "api_key")) {
 			throw new Error(
 				`Credential selector ${this.#formatCredentialSelector(selector)} cannot be used for ${provider} while a config API key override is active`,
 			);
 		}
-		if (!this.#findCredentialBySelector(provider, selector)) {
+		if (!selected) {
 			throw new Error(`No credential found for ${provider} matching ${this.#formatCredentialSelector(selector)}`);
 		}
 	}
@@ -5123,15 +5162,40 @@ export class AuthStorage {
 	}
 
 	/** Returns true if usage indicates rate limit has been reached. */
-	#isUsageLimitReached(report: UsageReport): boolean {
-		return report.limits.some(limit => this.#isUsageLimitExhausted(limit));
+	/**
+	 * True when an exhausted limit applies to `modelId`. A limit scoped to one
+	 * model (or one tier's model entry) does not exhaust the credential for other
+	 * models; a limit with no model scope and not marked shared-blocking applies to
+	 * every model.
+	 */
+	#isUsageLimitReached(report: UsageReport, modelId?: string): boolean {
+		return report.limits.some(
+			limit => this.#limitAppliesToModel(limit, modelId) && this.#isUsageLimitExhausted(limit),
+		);
+	}
+
+	/**
+	 * Whether a usage limit constrains the requested model. Only model-family
+	 * tiers are treated as model scoping: `scope.tier` also carries plans
+	 * (Codex/Copilot) and quota tiers (Gemini), which apply to every model.
+	 */
+	#limitAppliesToModel(limit: UsageLimit, modelId?: string): boolean {
+		const wanted = modelId?.trim();
+		// Without a requested model, every limit applies: callers that do not know
+		// the model keep today's conservative "any exhausted limit blocks".
+		if (wanted === undefined) return true;
+		const scopedModel = limit.scope?.modelId?.trim();
+		if (scopedModel) return wanted === scopedModel;
+		const tier = limit.scope?.tier?.trim().toLowerCase();
+		if (tier && MODEL_FAMILY_TIERS.has(tier)) return wanted.toLowerCase().includes(tier);
+		return true;
 	}
 
 	/** Extracts the earliest reset timestamp from exhausted windows (in ms). */
-	#getUsageResetAtMs(report: UsageReport, nowMs: number): number | undefined {
+	#getUsageResetAtMs(report: UsageReport, nowMs: number, modelId?: string): number | undefined {
 		const candidates: number[] = [];
 		for (const limit of report.limits) {
-			if (!this.#isUsageLimitExhausted(limit)) continue;
+			if (!this.#limitAppliesToModel(limit, modelId) || !this.#isUsageLimitExhausted(limit)) continue;
 			const window = limit.window;
 			if (window?.resetsAt && window.resetsAt > nowMs) {
 				candidates.push(window.resetsAt);
@@ -5141,6 +5205,33 @@ export class AuthStorage {
 		return Math.min(...candidates);
 	}
 
+	/**
+	 * Backoff targets implied by an exhausted usage report: a credential-wide
+	 * until for limits that are not model-scoped, plus one entry per exhausted
+	 * model-scoped limit. A model-scoped limit must not take the whole credential
+	 * out of rotation for other models.
+	 */
+	#exhaustedLimitBlockTargets(
+		report: UsageReport,
+		nowMs: number,
+	): { wideUntil?: number; scoped: Array<{ modelId: string; untilMs: number }> } {
+		let wideUntil: number | undefined;
+		const scoped: Array<{ modelId: string; untilMs: number }> = [];
+		for (const limit of report.limits) {
+			if (!this.#isUsageLimitExhausted(limit)) continue;
+			const resetsAt = limit.window?.resetsAt;
+			if (!resetsAt || resetsAt <= nowMs) continue;
+			const scopeModel = limit.scope?.modelId?.trim();
+			const tier = limit.scope?.tier?.trim().toLowerCase();
+			if (!scopeModel && !(tier && MODEL_FAMILY_TIERS.has(tier))) {
+				wideUntil = wideUntil === undefined ? resetsAt : Math.min(wideUntil, resetsAt);
+				continue;
+			}
+			scoped.push({ modelId: scopeModel ?? tier!, untilMs: resetsAt });
+		}
+		return wideUntil === undefined ? { scoped } : { wideUntil, scoped };
+	}
+
 	async #getUsageReport(
 		provider: Provider,
 		credential: OAuthCredential,
@@ -5669,7 +5760,15 @@ export class AuthStorage {
 	async markUsageLimitReached(
 		provider: string,
 		sessionId: string | undefined,
-		options?: { retryAfterMs?: number; baseUrl?: string; signal?: AbortSignal; owner?: object; rowId?: number },
+		options?: {
+			retryAfterMs?: number;
+			baseUrl?: string;
+			signal?: AbortSignal;
+			owner?: object;
+			rowId?: number;
+			/** Scope the block to one model; other models keep using the credential. */
+			modelId?: string;
+		},
 	): Promise<UsageLimitMarkResult> {
 		provider = resolveOAuthStorageProvider(provider);
 		const ownerOverride = this.#configOverrideRegistration(provider, options?.owner);
@@ -5690,11 +5789,19 @@ export class AuthStorage {
 		const now = Date.now();
 		let blockedUntil = now + (options?.retryAfterMs ?? AuthStorage.#defaultBackoffMs);
 
+		// Model-scoped exhausted limits only constrain their own model; an
+		// unscoped or shared limit raises the credential-wide backoff.
+		let scopedBlocks: Array<{ modelId: string; untilMs: number }> = [];
+		let reportHasWideLimit = false;
 		if (initial.credential.type === "oauth" && this.#rankingStrategyResolver?.(provider)) {
 			const report = await this.#getUsageReport(provider, initial.credential, options);
-			if (report && this.#isUsageLimitReached(report)) {
-				const resetAtMs = this.#getUsageResetAtMs(report, Date.now());
-				if (resetAtMs && resetAtMs > blockedUntil) blockedUntil = resetAtMs;
+			if (report) {
+				const targets = this.#exhaustedLimitBlockTargets(report, Date.now());
+				if (targets.wideUntil !== undefined) {
+					reportHasWideLimit = true;
+					if (targets.wideUntil > blockedUntil) blockedUntil = targets.wideUntil;
+				}
+				scopedBlocks = targets.scoped;
 			}
 		}
 
@@ -5712,7 +5819,11 @@ export class AuthStorage {
 						candidate.entry.credential.type === credentialKind &&
 						candidate.entry.id !== failedRowId &&
 						(!enabledIds || enabledIds.has(candidate.entry.id)) &&
-						!this.#isCredentialBlocked(this.#getProviderTypeKey(provider, credentialKind), candidate.index),
+						!this.#isCredentialBlocked(
+							this.#getProviderTypeKey(provider, credentialKind),
+							candidate.index,
+							options?.modelId,
+						),
 				)
 				.map(candidate => candidate.entry.id);
 		};
@@ -5725,7 +5836,15 @@ export class AuthStorage {
 			};
 		}
 		const providerKey = this.#getProviderTypeKey(provider, credentialKind);
-		this.#markCredentialBlocked(providerKey, targetIndex, blockedUntil);
+		// A report whose only exhausted limits are model-scoped must not take the
+		// whole credential out of rotation; the caller's retry-after backoff applies
+		// to those models instead.
+		if (!(scopedBlocks.length > 0 && !reportHasWideLimit)) {
+			this.#markCredentialBlocked(providerKey, targetIndex, blockedUntil, options?.modelId);
+		}
+		for (const scoped of scopedBlocks) {
+			this.#markCredentialBlocked(providerKey, targetIndex, scoped.untilMs, scoped.modelId);
+		}
 		return {
 			state: "marked",
 			failedRowId,
@@ -5734,6 +5853,30 @@ export class AuthStorage {
 		};
 	}
 
+	/**
+	 * Opaque stored row IDs for credentials whose resolved key matches `apiKey`.
+	 * Unlike the session's sticky row pointer, these remain tied to the actual key
+	 * when concurrent requests share a credential session ID.
+	 * A row that cannot be resolved is skipped so an unrelated resolver failure
+	 * cannot prevent callers from using already-known credential identity.
+	 */
+	async getCredentialRowIdsMatchingApiKey(provider: string, apiKey: string): Promise<number[]> {
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		const rowIds: number[] = [];
+		for (const entry of this.#getStoredCredentials(storageProvider)) {
+			try {
+				if (await this.#credentialMatchesApiKey(storageProvider, entry.credential, apiKey)) rowIds.push(entry.id);
+			} catch (error) {
+				logger.warn("Failed to resolve stored API key while matching credential rows", {
+					provider: storageProvider,
+					credentialId: entry.id,
+					errorType: error instanceof Error ? error.name : typeof error,
+				});
+			}
+		}
+		return rowIds;
+	}
+
 	/**
 	 * Mark the stored credential whose key matches `apiKey` usage-limited for
 	 * `retryAfterMs` (or the default backoff). Used when the caller knows
@@ -5866,7 +6009,11 @@ export class AuthStorage {
 			args.order.map(async idx => {
 				const selection = args.credentials[idx];
 				if (!selection) return null;
-				const blockedUntil = this.#getCredentialBlockedUntil(args.providerKey, selection.index);
+				const blockedUntil = this.#getCredentialBlockedUntil(
+					args.providerKey,
+					selection.index,
+					args.options?.modelId,
+				);
 				if (blockedUntil !== undefined) return { selection, usage: null, usageChecked: false, blockedUntil };
 				const usage = await this.#getUsageReport(args.provider, selection.credential, {
 					baseUrl: args.options?.baseUrl,
@@ -5904,13 +6051,29 @@ export class AuthStorage {
 			const { selection, usage, usageChecked } = result;
 			let { blockedUntil } = result;
 			let blocked = blockedUntil !== undefined;
-			if (!blocked && usage && this.#isUsageLimitReached(usage)) {
-				const resetAtMs = this.#getUsageResetAtMs(usage, nowMs);
+			if (!blocked && usage && this.#isUsageLimitReached(usage, args.options?.modelId)) {
+				const resetAtMs = this.#getUsageResetAtMs(usage, nowMs, args.options?.modelId);
 				blockedUntil = resetAtMs ?? Date.now() + AuthStorage.#defaultBackoffMs;
-				this.#markCredentialBlocked(args.providerKey, selection.index, blockedUntil);
+				const targets = this.#exhaustedLimitBlockTargets(usage, nowMs);
+				if (targets.wideUntil === undefined && targets.scoped.length > 0) {
+					for (const scoped of targets.scoped) {
+						this.#markCredentialBlocked(args.providerKey, selection.index, scoped.untilMs, scoped.modelId);
+					}
+				} else {
+					this.#markCredentialBlocked(args.providerKey, selection.index, blockedUntil);
+				}
 				blocked = true;
 			}
-			const windows = usage ? strategy.findWindowLimits(usage) : undefined;
+			// Rank on the windows that apply to the requested model so a limit scoped
+			// to another model does not depress this credential's drain metrics.
+			const scopedUsage =
+				usage && args.options?.modelId
+					? {
+							...usage,
+							limits: usage.limits.filter(limit => this.#limitAppliesToModel(limit, args.options?.modelId)),
+						}
+					: usage;
+			const windows = scopedUsage ? strategy.findWindowLimits(scopedUsage) : undefined;
 			const primary = windows?.primary;
 			const secondary = windows?.secondary;
 			const secondaryTarget = secondary ?? primary;
@@ -6037,7 +6200,8 @@ export class AuthStorage {
 		// (no preference) and sessions whose preferred is blocked still rank, so we pick the account
 		// with the most headroom proactively and fall back intelligently when rate-limited.
 		const sessionPreferredIsAvailable =
-			sessionPreferredIndex !== undefined && !this.#isCredentialBlocked(providerKey, sessionPreferredIndex);
+			sessionPreferredIndex !== undefined &&
+			!this.#isCredentialBlocked(providerKey, sessionPreferredIndex, options?.modelId);
 		const shouldRank = !selectedCredential && checkUsage && !sessionPreferredIsAvailable;
 		const candidates = shouldRank
 			? await this.#rankOAuthSelections({ providerKey, provider, order, credentials, options, strategy: strategy! })
@@ -6077,7 +6241,7 @@ export class AuthStorage {
 		if (!selectedCredential && sessionPreferredIndex !== undefined) {
 			const sessionPreferredCandidate = candidates.findIndex(
 				candidate =>
-					!this.#isCredentialBlocked(providerKey, candidate.selection.index) &&
+					!this.#isCredentialBlocked(providerKey, candidate.selection.index, options?.modelId) &&
 					candidate.selection.index === sessionPreferredIndex,
 			);
 			if (sessionPreferredCandidate > 0) {
@@ -6143,7 +6307,7 @@ export class AuthStorage {
 			if (resolved) return resolved;
 		}
 
-		if (fallback && this.#isCredentialBlocked(providerKey, fallback.selection.index)) {
+		if (fallback && this.#isCredentialBlocked(providerKey, fallback.selection.index, options?.modelId)) {
 			return this.#tryOAuthCredential(
 				provider,
 				fallback.selection,
@@ -6540,7 +6704,7 @@ export class AuthStorage {
 	): Promise<OAuthResolutionResult | undefined> {
 		const { checkUsage, allowBlocked, prefetchedUsage = null, usagePrechecked = false } = usageOptions;
 		if (!this.#reconcileOAuthCredentialSelection(provider, selection)) return undefined;
-		if (!allowBlocked && this.#isCredentialBlocked(providerKey, selection.index)) {
+		if (!allowBlocked && this.#isCredentialBlocked(providerKey, selection.index, options?.modelId)) {
 			return undefined;
 		}
 
@@ -6562,8 +6726,8 @@ export class AuthStorage {
 				});
 				usageChecked = true;
 			}
-			if (checkUsage && !allowBlocked && usage && this.#isUsageLimitReached(usage)) {
-				const resetAtMs = this.#getUsageResetAtMs(usage, Date.now());
+			if (checkUsage && !allowBlocked && usage && this.#isUsageLimitReached(usage, options?.modelId)) {
+				const resetAtMs = this.#getUsageResetAtMs(usage, Date.now(), options?.modelId);
 				this.#markCredentialBlocked(
 					providerKey,
 					selection.index,
@@ -6644,8 +6808,8 @@ export class AuthStorage {
 					});
 					usageChecked = true;
 				}
-				if (checkUsage && !allowBlocked && usage && this.#isUsageLimitReached(usage)) {
-					const resetAtMs = this.#getUsageResetAtMs(usage, Date.now());
+				if (checkUsage && !allowBlocked && usage && this.#isUsageLimitReached(usage, options?.modelId)) {
+					const resetAtMs = this.#getUsageResetAtMs(usage, Date.now(), options?.modelId);
 					this.#markCredentialBlocked(
 						providerKey,
 						selection.index,
@@ -6657,7 +6821,7 @@ export class AuthStorage {
 			if (!this.#reconcileOAuthCredentialSelection(provider, selection)) return undefined;
 			if (!authCredentialEquals(selection.credential, updated)) return undefined;
 			this.#recordSessionCredential(provider, sessionId, "oauth", selection.index);
-			return { apiKey: result.apiKey, credential: updated };
+			return { apiKey: result.apiKey, credential: updated, credentialRowId: selection.id };
 		} catch (error) {
 			if (options?.signal?.aborted) throw error;
 			if (isSqliteError(error)) throw error;
@@ -7000,6 +7164,31 @@ export class AuthStorage {
 	 * 10. Fallback resolver (models.yml custom providers, last-resort)
 	 */
 	async getApiKey(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<string | undefined> {
+		return this.#resolveApiKey(provider, sessionId, options);
+	}
+
+	/**
+	 * Resolve an API key and retain the selected stored row identity across token refreshes
+	 * and concurrent changes to the session's sticky credential pointer.
+	 */
+	async getApiKeyWithCredentialRowId(
+		provider: string,
+		sessionId?: string,
+		options?: AuthApiKeyOptions,
+	): Promise<{ apiKey: string | undefined; credentialRowId: number | undefined }> {
+		let credentialRowId: number | undefined;
+		const apiKey = await this.#resolveApiKey(provider, sessionId, options, rowId => {
+			credentialRowId = rowId;
+		});
+		return { apiKey, credentialRowId };
+	}
+
+	async #resolveApiKey(
+		provider: string,
+		sessionId?: string,
+		options?: AuthApiKeyOptions,
+		onCredentialRowResolved?: (rowId: number) => void,
+	): Promise<string | undefined> {
 		provider = resolveOAuthStorageProvider(provider);
 		const selectedCredential = this.#resolveSelectedStoredCredential(provider, options, sessionId);
 
@@ -7021,7 +7210,12 @@ export class AuthStorage {
 			// (validated at login, rotated on 401), while the pointed-to env
 			// value can go stale with no recovery path — prefer the stored
 			// credential. Stored OAuth credentials still yield to the override.
-			const storedApiKey = await this.#resolveStoredApiKeyOverEnvConfig(provider, selectedCredential, sessionId);
+			const storedApiKey = await this.#resolveStoredApiKeyOverEnvConfig(
+				provider,
+				selectedCredential,
+				sessionId,
+				onCredentialRowResolved,
+			);
 			if (storedApiKey) return storedApiKey;
 			return configKey;
 		}
@@ -7036,14 +7230,19 @@ export class AuthStorage {
 
 		if (selectedCredential?.credential.type === "api_key") {
 			this.#recordSessionCredential(provider, sessionId, "api_key", selectedCredential.index);
-			return this.#resolveStoredApiKey(provider, selectedCredential.credential.key);
+			const apiKey = await this.#resolveStoredApiKey(provider, selectedCredential.credential.key);
+			if (apiKey) onCredentialRowResolved?.(selectedCredential.id);
+			return apiKey;
 		}
 
 		let oauthAttempted = false;
 		if (!selectedCredential && this.#getSessionCredential(provider, sessionId)?.type === "oauth") {
 			const oauthResolved = await this.#resolveOAuthSelection(provider, sessionId, options);
 			oauthAttempted = true;
-			if (oauthResolved) return oauthResolved.apiKey;
+			if (oauthResolved) {
+				onCredentialRowResolved?.(oauthResolved.credentialRowId);
+				return oauthResolved.apiKey;
+			}
 		}
 
 		const attemptedApiKeyIndices = new Set<number>();
@@ -7055,6 +7254,7 @@ export class AuthStorage {
 				const resolved = await this.#resolveStoredApiKey(provider, apiKeySelection.credential.key);
 				if (resolved) {
 					this.#recordSessionCredential(provider, sessionId, "api_key", apiKeySelection.index);
+					onCredentialRowResolved?.(apiKeySelection.id);
 					return resolved;
 				}
 			}
@@ -7062,7 +7262,10 @@ export class AuthStorage {
 
 		if (!oauthAttempted) {
 			const oauthResolved = await this.#resolveOAuthSelection(provider, sessionId, options);
-			if (oauthResolved) return oauthResolved.apiKey;
+			if (oauthResolved) {
+				onCredentialRowResolved?.(oauthResolved.credentialRowId);
+				return oauthResolved.apiKey;
+			}
 		}
 
 		if (!selectedCredential) {
@@ -7073,6 +7276,7 @@ export class AuthStorage {
 				const resolved = await this.#resolveStoredApiKey(provider, apiKeySelection.credential.key);
 				if (resolved) {
 					this.#recordSessionCredential(provider, sessionId, "api_key", apiKeySelection.index);
+					onCredentialRowResolved?.(apiKeySelection.id);
 					return resolved;
 				}
 			}
@@ -7091,21 +7295,25 @@ export class AuthStorage {
 	/**
 	 * Resolve a stored api_key credential that outranks an env-sourced config
 	 * override (`apiKeyEnv`). Mirrors the api_key branches of {@link getApiKey}:
-	 * the selector-pinned credential first, then the round-robin/session pool.
-	 * Returns undefined when no stored api_key credential resolves, leaving the
-	 * env-sourced override in effect.
+	 * a selected credential must resolve or fail closed; unpinned resolution then
+	 * tries the round-robin/session pool. Returns undefined when no unpinned
+	 * stored api_key credential resolves, leaving the env-sourced override in
+	 * effect.
 	 */
 	async #resolveStoredApiKeyOverEnvConfig(
 		provider: string,
 		selectedCredential: ({ index: number } & StoredCredential) | undefined,
 		sessionId?: string,
+		onCredentialRowResolved?: (rowId: number) => void,
 	): Promise<string | undefined> {
 		if (selectedCredential?.credential.type === "api_key") {
 			const resolved = await this.#resolveStoredApiKey(provider, selectedCredential.credential.key);
 			if (resolved) {
 				this.#recordSessionCredential(provider, sessionId, "api_key", selectedCredential.index);
+				onCredentialRowResolved?.(selectedCredential.id);
 				return resolved;
 			}
+			throw new Error(`Selected credential for ${provider} (id:${selectedCredential.id}) is unavailable`);
 		}
 		const attemptedApiKeyIndices = new Set<number>();
 		for (;;) {
@@ -7115,6 +7323,7 @@ export class AuthStorage {
 			const resolved = await this.#resolveStoredApiKey(provider, apiKeySelection.credential.key);
 			if (resolved) {
 				this.#recordSessionCredential(provider, sessionId, "api_key", apiKeySelection.index);
+				onCredentialRowResolved?.(apiKeySelection.id);
 				return resolved;
 			}
 		}

package/src/model-pricing.d.ts

@@ -1,3 +1,11 @@
 import type { Api, Model, ModelCost } from "./types";
 export declare function getOpenAIModelCost<TApi extends Api>(model: Model<TApi>, inputTokens: number): ModelCost | undefined;
+export declare function getAnthropicModelCost<TApi extends Api>(model: Model<TApi>, inputTokens: number): ModelCost | undefined;
+/**
+ * $/million rate for 1-hour cache writes, or undefined when the model has a single
+ * cache-write rate. Cost calculation applies it to `usage.cttl.ephemeral1h` and bills
+ * the remaining cache-write tokens at `ModelCost.cacheWrite`.
+ */
+export declare function getAnthropicCacheWriteOneHourRate<TApi extends Api>(model: Model<TApi>, inputTokens: number): number | undefined;
+export declare function applyAnthropicModelPricing<TApi extends Api>(model: Model<TApi>): void;
 export declare function applyOpenAIModelPricing<TApi extends Api>(model: Model<TApi>): void;

package/src/model-pricing.ts

@@ -6,6 +6,17 @@ interface TieredPricing {
 }
 
 const LONG_CONTEXT_THRESHOLD = 272_000;
+// Anthropic Haiku 5.5's direct Messages API charges five times the base rates
+// when prompt input exceeds 100K tokens, including cached input.
+// https://platform.claude.com/docs/en/models/haiku-5-5/overview#pricing
+const ANTHROPIC_HAIKU_5_5_LONG_CONTEXT_PRICING: LongContextPricing = {
+	threshold: 100_000,
+	cost: { input: 0.5, output: 2.5, cacheRead: 0.05, cacheWrite: 0.625 },
+};
+// `ModelCost.cacheWrite` is the 5-minute cache-write rate. Haiku 5.5 charges 1-hour
+// writes at twice the base input rate in each prompt-length tier ($0.20 up to 100K
+// tokens, $1 above), and the provider defaults to `ttl: "1h"`.
+const ANTHROPIC_HAIKU_5_5_CACHE_WRITE_1H = { standard: 0.2, longContext: 1 };
 
 const GPT_5_6_SOL_PRICING: TieredPricing = {
 	cost: { input: 5, output: 30, cacheRead: 0.5, cacheWrite: 6.25 },
@@ -95,6 +106,82 @@ export function getOpenAIModelCost<TApi extends Api>(model: Model<TApi>, inputTo
 	return inputTokens > pricing.longContextPricing.threshold ? pricing.longContextPricing.cost : pricing.cost;
 }
 
+const BEDROCK_HAIKU_5_5_ID = /^(?:(?:au|eu|global|jp|us).)?anthropic.claude-haiku-5-5$/;
+// Bedrock bills Haiku 5.5 prompts above 100K tokens at higher "Long Context" rates.
+// AWS documents the threshold but the per-token rates only on its pricing page,
+// which is not machine-readable; mirror Anthropic's published 5x multiplier on each
+// inference profile's own base rates.
+// https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-haiku-5-5.html#model-card-anthropic-claude-haiku-5-5-pricing
+const BEDROCK_HAIKU_5_5_LONG_CONTEXT_MULTIPLIER = 5;
+
+function getAnthropicLongContextPricing<TApi extends Api>(model: Model<TApi>): LongContextPricing | undefined {
+	if (model.provider === "anthropic" && model.api === "anthropic-messages" && model.id === "claude-haiku-5-5") {
+		return {
+			threshold: ANTHROPIC_HAIKU_5_5_LONG_CONTEXT_PRICING.threshold,
+			cost: { ...ANTHROPIC_HAIKU_5_5_LONG_CONTEXT_PRICING.cost },
+		};
+	}
+	if (
+		model.provider === "amazon-bedrock" &&
+		model.api === "bedrock-converse-stream" &&
+		BEDROCK_HAIKU_5_5_ID.test(model.id)
+	) {
+		const m = BEDROCK_HAIKU_5_5_LONG_CONTEXT_MULTIPLIER;
+		const scale = (rate: number): number => Math.round(rate * m * 1e9) / 1e9;
+		return {
+			threshold: ANTHROPIC_HAIKU_5_5_LONG_CONTEXT_PRICING.threshold,
+			cost: {
+				input: scale(model.cost.input),
+				output: scale(model.cost.output),
+				cacheRead: scale(model.cost.cacheRead),
+				cacheWrite: scale(model.cost.cacheWrite),
+			},
+		};
+	}
+	return undefined;
+}
+
+export function getAnthropicModelCost<TApi extends Api>(
+	model: Model<TApi>,
+	inputTokens: number,
+): ModelCost | undefined {
+	const pricing = getAnthropicLongContextPricing(model);
+	if (!pricing || inputTokens <= pricing.threshold) return undefined;
+	return pricing.cost;
+}
+
+/**
+ * $/million rate for 1-hour cache writes, or undefined when the model has a single
+ * cache-write rate. Cost calculation applies it to `usage.cttl.ephemeral1h` and bills
+ * the remaining cache-write tokens at `ModelCost.cacheWrite`.
+ */
+export function getAnthropicCacheWriteOneHourRate<TApi extends Api>(
+	model: Model<TApi>,
+	inputTokens: number,
+): number | undefined {
+	const aboveThreshold = inputTokens > ANTHROPIC_HAIKU_5_5_LONG_CONTEXT_PRICING.threshold;
+	if (model.provider === "anthropic" && model.api === "anthropic-messages" && model.id === "claude-haiku-5-5") {
+		return aboveThreshold
+			? ANTHROPIC_HAIKU_5_5_CACHE_WRITE_1H.longContext
+			: ANTHROPIC_HAIKU_5_5_CACHE_WRITE_1H.standard;
+	}
+	if (
+		model.provider === "amazon-bedrock" &&
+		model.api === "bedrock-converse-stream" &&
+		BEDROCK_HAIKU_5_5_ID.test(model.id)
+	) {
+		// Same structure as direct: 1-hour writes cost twice the tier's input rate.
+		const multiplier = aboveThreshold ? BEDROCK_HAIKU_5_5_LONG_CONTEXT_MULTIPLIER : 1;
+		return Math.round(2 * model.cost.input * multiplier * 1e9) / 1e9;
+	}
+	return undefined;
+}
+
+export function applyAnthropicModelPricing<TApi extends Api>(model: Model<TApi>): void {
+	const pricing = getAnthropicLongContextPricing(model);
+	if (pricing) model.longContextPricing = pricing;
+}
+
 export function applyOpenAIModelPricing<TApi extends Api>(model: Model<TApi>): void {
 	if (model.provider !== "openai" && model.provider !== "openai-codex") {
 		return;