@oh-my-pi/pi-ai 16.5.0 → 16.5.1

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [16.5.1] - 2026-07-14
+
+### Added
+
+- Added Cursor OAuth and access-token usage reporting to `omp usage` via Cursor's account usage endpoint.
+
+### Fixed
+
+- Fixed OpenAI Responses `content_filter` terminal events being auto-retried as provider finish errors, ensuring content-filtered turns remain hard failures without triggering a retry loop.
+- Improved credential rotation on usage and account-quota failures to cycle through all eligible credentials instead of stopping early, while maintaining rate-limit backoffs and safety guards.
+- Fixed GLM tool call parsing to correctly handle and recover from missing or mistyped argument closers, preventing subsequent arguments from being swallowed.
+- Fixed Anthropic credential management and usage routing for users with multiple organizations under a single email. Credentials, OAuth refreshes, usage reports, and active sessions are now correctly partitioned and isolated by organization, preventing subscriptions from overwriting or merging with each other.
+- Fixed OpenAI and Codex response finalization to preserve streamed text when receiving empty content on completion. ([#5146])
+- Fixed OpenAI Chat Completions request parsing to correctly accept assistant tool-call replay messages with null content. ([#5121])
+- Fixed session-sticky OAuth credential mappings remaining active after credential changes, ensuring sessions correctly reselect accounts after login or logout. ([#4982])
+- Fixed concurrent reasoning summaries to ignore legacy streaming events under cutoff contracts.
+- Fixed Codex saved-reset redemption to apply to the selected OpenAI account in multi-account configurations. ([#5054])
+- Updated the OAuth completion page to instruct users to close the tab manually when the browser blocks automatic window closing. ([#4855])
+- Fixed Cursor `max_mode` requests to correctly send max-mode metadata on both model payload fields. ([#4797])
+- Fixed configuration discovery to support both nested and flat YAML formats for `auth.broker.url` and `auth.broker.token` keys. ([#4734])
+
 ## [16.5.0] - 2026-07-13
 
 ### Added

package/dist/types/auth-broker/remote-store.d.ts

@@ -79,6 +79,8 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     deleteAuthCredentialsRemote(provider: string, disabledCause: string): Promise<void>;
     getCache(key: string): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    /** Drop all cache rows whose keys start with the supplied prefix. */
+    deleteCachePrefix(prefix: string): void;
     cleanExpiredCache(): void;
     invalidateUsageCache(signal?: AbortSignal): Promise<void>;
     /**

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -9,6 +9,8 @@ export declare const oauthCredentialSchema: import("arktype/internal/variants/ob
     projectId?: string | undefined;
     email?: string | undefined;
     accountId?: string | undefined;
+    orgId?: string | undefined;
+    orgName?: string | undefined;
 }, {}>;
 /** OAuth credential as it appears in broker snapshots — refresh replaced with sentinel. */
 export declare const remoteOauthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
@@ -21,6 +23,8 @@ export declare const remoteOauthCredentialSchema: import("arktype/internal/varia
     projectId?: string | undefined;
     email?: string | undefined;
     accountId?: string | undefined;
+    orgId?: string | undefined;
+    orgName?: string | undefined;
 }, {}>;
 export declare const apiKeyCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     type: "api_key";
@@ -37,6 +41,8 @@ export declare const writableAuthCredentialSchema: import("arktype/internal/vari
     projectId?: string | undefined;
     email?: string | undefined;
     accountId?: string | undefined;
+    orgId?: string | undefined;
+    orgName?: string | undefined;
 } | {
     type: "api_key";
     key: string;
@@ -52,6 +58,8 @@ export declare const snapshotCredentialSchema: import("arktype/internal/variants
     projectId?: string | undefined;
     email?: string | undefined;
     accountId?: string | undefined;
+    orgId?: string | undefined;
+    orgName?: string | undefined;
 } | {
     type: "api_key";
     key: string;
@@ -69,6 +77,8 @@ export declare const credentialSnapshotEntrySchema: import("arktype/internal/var
         projectId?: string | undefined;
         email?: string | undefined;
         accountId?: string | undefined;
+        orgId?: string | undefined;
+        orgName?: string | undefined;
     } | {
         type: "api_key";
         key: string;
@@ -94,6 +104,8 @@ export declare const snapshotEntrySchema: import("arktype/internal/variants/obje
         projectId?: string | undefined;
         email?: string | undefined;
         accountId?: string | undefined;
+        orgId?: string | undefined;
+        orgName?: string | undefined;
     } | {
         type: "api_key";
         key: string;
@@ -136,6 +148,8 @@ export declare const snapshotResponseSchema: import("arktype/internal/variants/o
             projectId?: string | undefined;
             email?: string | undefined;
             accountId?: string | undefined;
+            orgId?: string | undefined;
+            orgName?: string | undefined;
         } | {
             type: "api_key";
             key: string;
@@ -174,6 +188,8 @@ export declare const snapshotStreamSnapshotEventSchema: import("arktype/internal
             projectId?: string | undefined;
             email?: string | undefined;
             accountId?: string | undefined;
+            orgId?: string | undefined;
+            orgName?: string | undefined;
         } | {
             type: "api_key";
             key: string;
@@ -213,6 +229,8 @@ export declare const snapshotStreamEntryEventSchema: import("arktype/internal/va
             projectId?: string | undefined;
             email?: string | undefined;
             accountId?: string | undefined;
+            orgId?: string | undefined;
+            orgName?: string | undefined;
         } | {
             type: "api_key";
             key: string;
@@ -264,6 +282,8 @@ export declare const snapshotStreamEventSchema: import("arktype/internal/variant
             projectId?: string | undefined;
             email?: string | undefined;
             accountId?: string | undefined;
+            orgId?: string | undefined;
+            orgName?: string | undefined;
         } | {
             type: "api_key";
             key: string;
@@ -301,6 +321,8 @@ export declare const snapshotStreamEventSchema: import("arktype/internal/variant
             projectId?: string | undefined;
             email?: string | undefined;
             accountId?: string | undefined;
+            orgId?: string | undefined;
+            orgName?: string | undefined;
         } | {
             type: "api_key";
             key: string;
@@ -400,6 +422,8 @@ export declare const credentialRefreshResponseSchema: import("arktype/internal/v
             projectId?: string | undefined;
             email?: string | undefined;
             accountId?: string | undefined;
+            orgId?: string | undefined;
+            orgName?: string | undefined;
         } | {
             type: "api_key";
             key: string;
@@ -440,6 +464,8 @@ export declare const credentialUploadRequestSchema: import("arktype/internal/var
         projectId?: string | undefined;
         email?: string | undefined;
         accountId?: string | undefined;
+        orgId?: string | undefined;
+        orgName?: string | undefined;
     } | {
         type: "api_key";
         key: string;
@@ -459,6 +485,8 @@ export declare const credentialUploadResponseSchema: import("arktype/internal/va
             projectId?: string | undefined;
             email?: string | undefined;
             accountId?: string | undefined;
+            orgId?: string | undefined;
+            orgName?: string | undefined;
         } | {
             type: "api_key";
             key: string;

package/dist/types/auth-retry.d.ts

@@ -3,8 +3,8 @@ import { isAuthRetryableError } from "./error/auth-classify.js";
 /**
  * Context passed to an {@link ApiKeyResolver} on each resolution attempt.
  *
- * The `error`/`lastChance` pair drives the central a/b/c retry policy shared by
- * the streaming ({@link streamSimple}) and non-streaming ({@link withAuth})
+ * The `error`/`lastChance` pair preserves the legacy a/b/c resolver contract
+ * shared by streaming ({@link streamSimple}) and non-streaming ({@link withAuth})
  * drivers:
  * - `error === undefined` → **initial resolve** (no force-refresh; cheap, may
  *   return a locally-cached not-yet-expired token).
@@ -13,11 +13,13 @@ import { isAuthRetryableError } from "./error/auth-classify.js";
  * - `error !== undefined && lastChance` → **step (c): switch account**
  *   (invalidate/usage-limit the current credential and rotate to a sibling).
  *
- * The resolver returns the bearer to send, or `undefined` to stop retrying and
- * surface the last error to the caller.
+ * Current drivers preserve that bounded a/b/c sequence for ordinary 401/auth
+ * failures. Usage/account-limit failures skip refresh and may repeat step (c)
+ * until the resolver returns `undefined`, cycles, or hits
+ * {@link AUTH_RETRY_MAX_ATTEMPTS}.
  */
 export interface ApiKeyResolveContext {
-    /** True on the final retry step — the resolver should rotate to a sibling credential. */
+    /** True when the resolver should rotate to a sibling credential. */
     lastChance: boolean;
     /** The auth error that triggered this re-resolution, or `undefined` on the initial resolve. */
     error: unknown;
@@ -51,23 +53,39 @@ export declare function resolveApiKeyOnce(key: ApiKey | undefined, signal?: Abor
 export declare function seedApiKeyResolver(seed: string | undefined, resolver: ApiKeyResolver): ApiKeyResolver;
 export { isAuthRetryableError };
 /**
- * The ordered `lastChance` values for the retry steps after the initial
- * attempt fails: `false` → step (b) refresh-same, `true` → step (c) switch.
- * Shared by {@link withAuth} and the streaming retry driver so both run the
- * same policy.
+ * Legacy bounded a/b/c retry sequence retained for public compatibility:
+ * `false` → refresh-same, `true` → rotate/switch. Current drivers consume it
+ * once for ordinary 401/auth failures; usage/account-limit failures may repeat
+ * sibling rotation until a termination guard fires.
  */
 export declare const AUTH_RETRY_STEPS: readonly boolean[];
+export declare const AUTH_RETRY_MAX_ATTEMPTS = 64;
 /** Resolve a single retry step, swallowing resolver failures into `undefined`. */
 export declare function resolveRetryKey(resolver: ApiKeyResolver, lastChance: boolean, error: unknown, signal?: AbortSignal, previousKey?: string): Promise<string | undefined>;
+export interface AuthRetryKeyState {
+    /** Bearer strings already sent during this logical operation. */
+    attemptedKeys: Set<string>;
+    /** Bearer used by the most recent failed attempt. */
+    lastKey: string;
+    /** Whether the current credential already consumed its 401 refresh-same retry. */
+    refreshedCurrent: boolean;
+    /** Whether the legacy non-usage auth path already switched to one sibling. */
+    legacyAuthSwitchUsed: boolean;
+    /** Total outbound attempts accepted for this logical operation, including the initial request. */
+    attempts: number;
+}
+export declare function createAuthRetryKeyState(initialKey: string): AuthRetryKeyState;
+export declare function resolveNextAuthRetryKey(state: AuthRetryKeyState, resolver: ApiKeyResolver, error: unknown, signal?: AbortSignal): Promise<string | undefined>;
 /**
  * Runs an auth-protected operation through the central a/b/c retry policy.
  *
  * - A static string key (or any non-resolver) → a single `attempt` with no
  *   retry (identical to the legacy static-key path).
- * - A resolver → initial `attempt`, then on a retryable auth error up to two
- *   more attempts (refresh-same, then switch). A step is skipped when the
- *   resolver returns the same key it just tried or `undefined`; non-auth errors
- *   propagate immediately.
+ * - A resolver → initial `attempt`, then resolver-driven retries until the
+ *   applicable policy is exhausted, the resolver declines or cycles, or the
+ *   operation reaches {@link AUTH_RETRY_MAX_ATTEMPTS}. Ordinary 401/auth
+ *   failures retain one refresh-same plus one sibling switch; usage/account
+ *   limits rotate directly through distinct siblings.
  *
  * Used by non-streaming consumers (image generation, web search, completion
  * helpers). The streaming driver in `stream.ts` implements the same policy with
@@ -91,6 +109,8 @@ export interface OAuthAccessSource {
     rotateSessionCredential(provider: string, sessionId: string | undefined, options?: {
         error?: unknown;
         signal?: AbortSignal;
+        apiKey?: string;
+        credentialId?: number;
     }): Promise<boolean>;
 }
 export interface WithOAuthAccessOptions {
@@ -114,13 +134,17 @@ export interface WithOAuthAccessOptions {
  * `projectId`, `enterpriseUrl`) instead of bare API-key bytes.
  *
  * - initial → `getOAuthAccess` (or `opts.seed`).
- * - step (b) → `getOAuthAccess` with `forceRefresh: true` (re-mint the SAME
- *   account; picks up peer/broker rotations).
- * - step (c) → `rotateSessionCredential` then re-resolve (switch to a sibling).
+ * - 401/auth failure → one `getOAuthAccess` with `forceRefresh: true` for the
+ *   current account, then sibling rotation.
+ * - usage-limit failure → `rotateSessionCredential` directly, without a
+ *   force-refresh detour.
  *
- * A step is skipped when it yields no access or the same `accessToken` that
- * just failed; non-auth errors propagate immediately. Use this instead of
- * hand-rolled `getOAuthAccess` + fetch flows so 401s and usage-limits rotate
- * credentials instead of failing the call.
+ * A refresh-same step may retry a new bearer for the same credential identity;
+ * sibling rotation stops when it yields a credential identity
+ * (`credentialId ?? accessToken`) or bearer already attempted in this turn.
+ * All OAuth attempts share the {@link AUTH_RETRY_MAX_ATTEMPTS} ceiling.
+ * Non-auth errors propagate immediately. Use this instead of hand-rolled
+ * `getOAuthAccess` + fetch flows so 401s and usage-limits rotate credentials
+ * instead of failing the call.
  */
 export declare function withOAuthAccess<T>(storage: OAuthAccessSource, provider: string, attempt: (access: OAuthAccess) => Promise<T>, opts?: WithOAuthAccessOptions): Promise<T>;

package/dist/types/auth-storage.d.ts

@@ -97,8 +97,11 @@ export interface CredentialHealthResult {
     type: AuthCredential["type"];
     /** OAuth email if known on the stored credential or surfaced by the probe. */
     email?: string;
-    /** OAuth account id / org id if known. */
+    /** OAuth account id if known. */
     accountId?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic multi-subscription). */
+    orgId?: string;
+    orgName?: string;
     /** `true` when the refresh token lives on a remote broker (sentinel was present). */
     remoteRefresh?: true;
     ok: boolean | null;
@@ -247,6 +250,8 @@ export interface AuthCredentialStore {
         includeExpired?: boolean;
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    /** Drop all cache rows whose keys start with the supplied prefix. */
+    deleteCachePrefix?(prefix: string): void;
     cleanExpiredCache(): void;
     /** Non-expired block for one (credential, providerKey, scope) key, or undefined. */
     getCredentialBlock?(credentialId: number, providerKey: string, blockScope: string): number | undefined;
@@ -485,6 +490,21 @@ export interface OAuthAccess {
     projectId?: string;
     enterpriseUrl?: string;
     apiEndpoint?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic multi-subscription). */
+    orgId?: string;
+    orgName?: string;
+}
+/**
+ * Identity slice of the credential a successful {@link AuthStorage.login}
+ * stored — lets callers confirm WHICH account (and for Anthropic, which
+ * organization/subscription) was added, without exposing tokens.
+ */
+export interface OAuthLoginIdentity {
+    type: "oauth" | "api_key";
+    email?: string;
+    accountId?: string;
+    orgId?: string;
+    orgName?: string;
 }
 export interface OAuthAccessFailure {
     credentialId?: number;
@@ -493,6 +513,9 @@ export interface OAuthAccessFailure {
     projectId?: string;
     enterpriseUrl?: string;
     apiEndpoint?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic multi-subscription). */
+    orgId?: string;
+    orgName?: string;
     error: string;
 }
 /**
@@ -505,6 +528,9 @@ export interface OAuthAccountIdentity {
     accountId?: string;
     email?: string;
     projectId?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic multi-subscription). */
+    orgId?: string;
+    orgName?: string;
 }
 export type OAuthAccessResolution = ({
     ok: true;
@@ -523,6 +549,9 @@ export interface OAuthAccountSummary {
     email?: string;
     projectId?: string;
     enterpriseUrl?: string;
+    /** Organization/workspace the credential is scoped to (Anthropic multi-subscription). */
+    orgId?: string;
+    orgName?: string;
 }
 export interface InvalidateCredentialMatchingOptions {
     signal?: AbortSignal;
@@ -753,7 +782,10 @@ export declare class AuthStorage {
      */
     getAll(): AuthStorageData;
     /**
-     * Login to an OAuth provider.
+     * Login to an OAuth provider. Resolves with the stored credential's
+     * identity slice (or `undefined` when nothing was stored) so callers can
+     * surface which account — and for Anthropic, which organization — the
+     * login registered.
      */
     login(provider: OAuthProviderId, ctrl: OAuthController & {
         /** onAuth is required by auth-storage but optional in OAuthController */
@@ -763,7 +795,7 @@ export declare class AuthStorage {
             message: string;
             placeholder?: string;
         }) => Promise<string>;
-    }): Promise<void>;
+    }): Promise<OAuthLoginIdentity | undefined>;
     /**
      * Logout from a provider.
      */
@@ -835,6 +867,7 @@ export declare class AuthStorage {
         baseUrl?: string;
         modelId?: string;
         apiKey?: string;
+        credentialId?: number;
         signal?: AbortSignal;
     }): Promise<UsageLimitMarkResult>;
     /**
@@ -942,17 +975,22 @@ export declare class AuthStorage {
     invalidateCredentialMatching(provider: string, apiKey: string, options?: InvalidateCredentialMatchingOptions): Promise<boolean>;
     invalidateCredentialMatching(provider: string, apiKey: string, signal?: AbortSignal): Promise<boolean>;
     /**
-     * Rotate away from the session's current credential after a retryable auth
-     * error — step (c) of the auth-retry policy. Stateless: looks up the
-     * session-sticky credential (no API-key matching needed), applies the
-     * storage action for the error class, then clears the sticky so the next
-     * {@link AuthStorage.getApiKey} for this session picks a sibling.
+     * Rotate away from the credential that failed after a retryable auth error —
+     * step (c) of the auth-retry policy. Prefer the failed stored row id supplied
+     * in `options.credentialId`, then the failed bearer supplied in
+     * `options.apiKey`, so overlapping requests cannot redirect rotation through
+     * stale session stickiness. Fall back to the session-sticky credential only
+     * when neither explicit target is available. For hard-auth errors, an explicit
+     * target that no longer matches storage returns `false` without mutation.
+     * Delayed usage-limit errors may instead recover the durable OAuth row from
+     * the bearer fingerprint recorded when the request resolved.
      *
      * - usage-limit / account-rate-limit error → {@link AuthStorage.markUsageLimitReached}
      *   (temporary block via its own backoff — default plus server usage-report
      *   reset; sticky left intact so the next resolve re-ranks around the block).
      * - otherwise (hard 401 / auth failure) → mark the credential suspect (or
-     *   reload when no broker hook is wired) and block it, then drop the sticky.
+     *   reload when no broker hook is wired) and block it, then drop matching
+     *   sticky state.
      *
      * Returns whether another usable credential of the same type remains.
      */
@@ -960,6 +998,7 @@ export declare class AuthStorage {
         error?: unknown;
         modelId?: string;
         apiKey?: string;
+        credentialId?: number;
         signal?: AbortSignal;
     }): Promise<boolean>;
     /**
@@ -968,7 +1007,7 @@ export declare class AuthStorage {
      *
      * - initial (`error: undefined`) → resolve the session credential.
      * - step (b) `!lastChance` → force-refresh the SAME session-sticky credential.
-     * - step (c) `lastChance` → rotate to a sibling credential, then re-resolve.
+     * - step (c) `lastChance` → rotate to a sibling and re-resolve, unless quota exhaustion has no sibling.
      *
      * Used by web-search providers and other consumers that hold an AuthStorage
      * directly (no ModelRegistry in scope).
@@ -1083,6 +1122,8 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
         includeExpired?: boolean;
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    /** Drop all cache rows whose keys start with the supplied prefix. */
+    deleteCachePrefix(prefix: string): void;
     cleanExpiredCache(): void;
     getCredentialBlock(credentialId: number, providerKey: string, blockScope: string): number | undefined;
     getCredentialBlockReconcileAfter(credentialId: number, providerKey: string, blockScope: string): number | undefined;

package/dist/types/error/flags.d.ts

@@ -8,6 +8,7 @@ export declare const Flag: {
     readonly StaleResponsesItem: 1048576;
     readonly MalformedFunctionCall: 2097152;
     readonly ProviderFinishError: 4194304;
+    readonly ContentBlocked: 32768;
     readonly ContextOverflow: 8388608;
     readonly AuthFailed: 16777216;
     readonly SilentAbort: 33554432;

package/dist/types/index.d.ts

@@ -29,6 +29,7 @@ export * from "./stream.js";
 export * from "./types.js";
 export * from "./usage.js";
 export * from "./usage/claude.js";
+export * from "./usage/cursor.js";
 export * from "./usage/gemini.js";
 export * from "./usage/github-copilot.js";
 export * from "./usage/google-antigravity.js";

package/dist/types/providers/openai-chat-server-schema.d.ts

@@ -232,7 +232,7 @@ export declare const assistantMessageSchema: import("arktype/internal/variants/o
         refusal: string;
     } | {
         type: string;
-    })[] | undefined;
+    })[] | null | undefined;
     tool_calls?: {
         id: string;
         type?: "function" | undefined;
@@ -404,7 +404,7 @@ export declare const messageSchema: import("arktype/internal/variants/object.ts"
         refusal: string;
     } | {
         type: string;
-    })[] | undefined;
+    })[] | null | undefined;
     tool_calls?: {
         id: string;
         type?: "function" | undefined;
@@ -581,7 +581,7 @@ export declare const openaiChatRequestSchema: import("arktype/internal/variants/
             refusal: string;
         } | {
             type: string;
-        })[] | undefined;
+        })[] | null | undefined;
         tool_calls?: {
             id: string;
             type?: "function" | undefined;

package/dist/types/providers/openai-shared.d.ts

@@ -428,6 +428,8 @@ export declare function appendReasoningSummaryPartDone(item: ResponseReasoningIt
 export declare function applyReasoningSummaryDone(state: SequentialCutoffSummaryState, block: ThinkingContent, text: string, summaryIndex: number, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number): void;
 export declare function appendMessageContentPart(item: ResponseOutputMessage, part: ResponseContentPartAddedEvent["part"] | undefined): void;
 export declare function appendMessageTextDelta(item: ResponseOutputMessage, block: TextContent, delta: string, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number, partType: "output_text" | "refusal"): void;
+/** Chooses final message text while treating non-empty terminal content as authoritative. */
+export declare function finalizeMessageText(item: ResponseOutputMessage, streamedText: string): string;
 export declare function accumulateToolCallArgumentsDelta(block: ResponsesToolCallBlock, delta: string, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number): void;
 /**
  * Finalize streamed function-call arguments from the authoritative `.done`

package/dist/types/registry/oauth/types.d.ts

@@ -9,6 +9,14 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
     apiEndpoint?: string;
+    /**
+     * Organization/workspace the token is scoped to (e.g. an Anthropic org
+     * UUID). Captured once at login; token refreshes never rewrite it. Lets
+     * one account email hold credentials for multiple subscriptions.
+     */
+    orgId?: string;
+    /** Human-readable organization name for display (may embed the email). */
+    orgName?: string;
 };
 export type OAuthProvider = OAuthProviderUnion;
 export type OAuthProviderId = OAuthProvider | (string & {});

package/dist/types/usage/cursor.d.ts

@@ -0,0 +1,3 @@
+import type { UsageProvider, UsageReport } from "../usage.js";
+export declare function parseCursorUsage(payload: unknown, fetchedAt?: number): UsageReport | null;
+export declare const cursorUsageProvider: UsageProvider;

package/dist/types/usage/openai-codex-reset.d.ts

@@ -8,7 +8,7 @@
  *
  *   GET  /wham/rate-limit-reset-credits           → list redeemable credits
  *   POST /wham/rate-limit-reset-credits/consume   → spend one credit
- *        body: { credit_id, redeem_request_id }
+ *        body: { credit_id, redeem_request_id, account_id? }
  *
  * `redeem_request_id` is a client-generated idempotency key (UUID). The consume
  * response carries a `code`: `"reset"` on success, otherwise a business reason

package/dist/types/usage/zai.d.ts

@@ -1,2 +1,3 @@
-import type { UsageProvider } from "../usage.js";
+import type { CredentialRankingStrategy, UsageProvider } from "../usage.js";
 export declare const zaiUsageProvider: UsageProvider;
+export declare const zaiRankingStrategy: CredentialRankingStrategy;

package/dist/types/usage.d.ts

@@ -281,6 +281,10 @@ export interface UsageCredential {
     accountId?: string;
     projectId?: string;
     email?: string;
+    /** Organization/workspace the credential is scoped to (see OAuthCredentials.orgId). */
+    orgId?: string;
+    /** Human-readable organization name for display. */
+    orgName?: string;
     enterpriseUrl?: string;
     metadata?: Record<string, unknown>;
     apiEndpoint?: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.5.0",
+	"version": "16.5.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/pi-catalog": "16.5.0",
-		"@oh-my-pi/pi-utils": "16.5.0",
-		"@oh-my-pi/pi-wire": "16.5.0",
+		"@oh-my-pi/pi-catalog": "16.5.1",
+		"@oh-my-pi/pi-utils": "16.5.1",
+		"@oh-my-pi/pi-wire": "16.5.1",
 		"arktype": "2.2.3",
 		"zod": "^4"
 	},

package/src/auth-broker/discover.ts

@@ -72,6 +72,26 @@ interface ConfigSnapshot {
 	token?: string;
 }
 
+/**
+ * Resolve a dotted config key (e.g. `auth.broker.url`) against a parsed YAML
+ * record, accepting both nested form (`auth: { broker: { url } }`) and the
+ * legacy flat literal-dot key (`"auth.broker.url": ...`). Nested wins when both
+ * are present. Returns the value only when it is a string.
+ */
+function readDottedString(record: Record<string, unknown>, dottedKey: string): string | undefined {
+	let current: unknown = record;
+	for (const segment of dottedKey.split(".")) {
+		if (current === null || typeof current !== "object" || Array.isArray(current)) {
+			current = undefined;
+			break;
+		}
+		current = (current as Record<string, unknown>)[segment];
+	}
+	if (typeof current === "string") return current;
+	const flat = record[dottedKey];
+	return typeof flat === "string" ? flat : undefined;
+}
+
 async function readConfigYaml(agentDir: string): Promise<ConfigSnapshot> {
 	for (const filename of MAIN_CONFIG_FILENAMES) {
 		const configPath = path.join(agentDir, filename);
@@ -80,9 +100,8 @@ async function readConfigYaml(agentDir: string): Promise<ConfigSnapshot> {
 			const parsed = YAML.parse(raw);
 			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
 			const record = parsed as Record<string, unknown>;
-			const url = typeof record["auth.broker.url"] === "string" ? (record["auth.broker.url"] as string) : undefined;
-			const token =
-				typeof record["auth.broker.token"] === "string" ? (record["auth.broker.token"] as string) : undefined;
+			const url = readDottedString(record, "auth.broker.url");
+			const token = readDottedString(record, "auth.broker.token");
 			return { url, token };
 		} catch (err) {
 			if (isEnoent(err)) continue;