@oh-my-pi/pi-ai 17.2.11 → 17.2.13

package/src/registry/litellm.ts

@@ -1,5 +1,5 @@
-import * as AIError from "../error";
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
 const AUTH_URL = "https://docs.litellm.ai/docs/proxy/deploy";
@@ -10,33 +10,15 @@ const AUTH_URL = "https://docs.litellm.ai/docs/proxy/deploy";
  * Opens browser to LiteLLM setup docs, prompts user to paste their API key.
  * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
  */
-export async function loginLiteLLM(options: OAuthController): Promise<string> {
-	if (!options.onPrompt) {
-		throw new AIError.OnPromptRequiredError("LiteLLM");
-	}
-
-	options.onAuth?.({
-		url: AUTH_URL,
-		instructions:
-			"Run LiteLLM proxy (default http://localhost:4000/v1; set LITELLM_BASE_URL to customize it), then copy your master key or virtual key",
-	});
-
-	const apiKey = await options.onPrompt({
-		message: "Paste your LiteLLM API key (master key or virtual key)",
-		placeholder: "sk-...",
-	});
-
-	if (options.signal?.aborted) {
-		throw new AIError.LoginCancelledError();
-	}
-
-	const trimmed = apiKey.trim();
-	if (!trimmed) {
-		throw new AIError.ApiKeyRequiredError();
-	}
-
-	return trimmed;
-}
+export const loginLiteLLM = createApiKeyLogin({
+	providerLabel: "LiteLLM",
+	authUrl: AUTH_URL,
+	instructions:
+		"Run LiteLLM proxy (default http://localhost:4000/v1; set LITELLM_BASE_URL to customize it), then copy your master key or virtual key",
+	promptMessage: "Paste your LiteLLM API key (master key or virtual key)",
+	placeholder: "sk-...",
+	validation: null,
+});
 
 export const litellmProvider = {
 	id: "litellm",

package/src/registry/llama-cpp.ts

@@ -1,5 +1,5 @@
-import * as AIError from "../error";
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
 const PROVIDER_ID = "llama.cpp";
@@ -7,25 +7,15 @@ const AUTH_URL = "https://github.com/ggml-org/llama.cpp#quick-start";
 const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:8080";
 const DEFAULT_LOCAL_TOKEN = "llama-cpp-local";
 
-export async function loginLlamaCpp(options: OAuthController): Promise<string> {
-	if (!options.onPrompt) {
-		throw new AIError.OnPromptRequiredError(PROVIDER_ID);
-	}
-	options.onAuth?.({
-		url: AUTH_URL,
-		instructions: `Paste your llama.cpp API key if your server requires auth. Leave empty for local no-auth mode (default base URL: ${DEFAULT_LOCAL_BASE_URL}; set LLAMA_CPP_BASE_URL to customize).`,
-	});
-	const apiKey = await options.onPrompt({
-		message: "Paste your llama.cpp API key (optional for local no-auth)",
-		placeholder: DEFAULT_LOCAL_TOKEN,
-		allowEmpty: true,
-	});
-	if (options.signal?.aborted) {
-		throw new AIError.LoginCancelledError();
-	}
-	const trimmed = apiKey.trim();
-	return trimmed || DEFAULT_LOCAL_TOKEN;
-}
+export const loginLlamaCpp = createApiKeyLogin({
+	providerLabel: PROVIDER_ID,
+	authUrl: AUTH_URL,
+	instructions: `Paste your llama.cpp API key if your server requires auth. Leave empty for local no-auth mode (default base URL: ${DEFAULT_LOCAL_BASE_URL}; set LLAMA_CPP_BASE_URL to customize).`,
+	promptMessage: "Paste your llama.cpp API key (optional for local no-auth)",
+	placeholder: DEFAULT_LOCAL_TOKEN,
+	validation: null,
+	emptyKeyFallback: DEFAULT_LOCAL_TOKEN,
+});
 
 export const llamaCppProvider = {
 	id: PROVIDER_ID,

package/src/registry/lm-studio.ts

@@ -1,28 +1,17 @@
-import * as AIError from "../error";
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
 const PROVIDER_ID = "lm-studio";
 export const DEFAULT_LOCAL_TOKEN = "lm-studio-local";
 
-export async function loginLmStudio(options: OAuthController): Promise<string> {
-	if (!options.onPrompt) {
-		throw new AIError.OnPromptRequiredError(PROVIDER_ID);
-	}
-
-	const apiKey = await options.onPrompt({
-		message: "Optional: Paste LM Studio API key (to customize endpoint URL, set LM_STUDIO_BASE_URL env var)",
-		placeholder: DEFAULT_LOCAL_TOKEN,
-		allowEmpty: true,
-	});
-
-	if (options.signal?.aborted) {
-		throw new AIError.LoginCancelledError();
-	}
-
-	const trimmed = apiKey.trim();
-	return trimmed || DEFAULT_LOCAL_TOKEN;
-}
+export const loginLmStudio = createApiKeyLogin({
+	providerLabel: PROVIDER_ID,
+	promptMessage: "Optional: Paste LM Studio API key (to customize endpoint URL, set LM_STUDIO_BASE_URL env var)",
+	placeholder: DEFAULT_LOCAL_TOKEN,
+	validation: null,
+	emptyKeyFallback: DEFAULT_LOCAL_TOKEN,
+});
 
 export const lmStudioProvider = {
 	id: "lm-studio",

package/src/registry/oauth/callback-server.ts

@@ -17,6 +17,15 @@ import type { OAuthController, OAuthCredentials } from "./types";
 const DEFAULT_TIMEOUT = 300_000;
 const DEFAULT_HOSTNAME = "localhost";
 const CALLBACK_PATH = "/callback";
+const IPV4_LOOPBACK = "127.0.0.1";
+const IPV6_LOOPBACK = "::1";
+/**
+ * How many times a random-port bind may be redrawn when the ephemeral port it
+ * landed on is already held on {@link IPV6_LOOPBACK} by that exact address.
+ * Small on purpose: each redraw picks a fresh port, so a repeat collision is
+ * vanishingly unlikely.
+ */
+const IPV6_COMPANION_ATTEMPTS = 4;
 /**
  * Path served by {@link OAuthCallbackFlow} that 302-redirects to the pending
  * authorization URL. Kept out of {@link OAuthCallbackFlowOptions} because it
@@ -28,6 +37,27 @@ const LAUNCH_PATH = "/launch";
 
 export type CallbackResult = { code: string; state: string };
 
+/**
+ * Subset of {@link Bun.Server} this flow depends on, so a `localhost` flow can
+ * hand back one listener per loopback address family while still looking like a
+ * single server to callers.
+ */
+interface CallbackServer {
+	readonly port: Bun.Server<unknown>["port"];
+	stop: Bun.Server<unknown>["stop"];
+}
+
+/**
+ * Whether a failed bind means "another process already holds this port".
+ * Bun surfaces `EADDRINUSE` on the error's `code` where the platform reports
+ * it, and otherwise only in the message, so both are checked.
+ */
+function isAddressInUse(error: unknown): boolean {
+	const code = (error as { code?: unknown } | null | undefined)?.code;
+	if (typeof code === "string") return code === "EADDRINUSE";
+	return error instanceof Error && /EADDRINUSE|in use/i.test(error.message);
+}
+
 export interface OAuthCallbackFlowOptions {
 	preferredPort: number;
 	callbackPath?: string;
@@ -192,7 +222,7 @@ export abstract class OAuthCallbackFlow {
 	 */
 	async #startCallbackServer(
 		expectedState: string,
-	): Promise<{ server: Bun.Server<unknown>; redirectUri: string; launchUrl: string | undefined }> {
+	): Promise<{ server: CallbackServer; redirectUri: string; launchUrl: string | undefined }> {
 		try {
 			const server = this.#createServer(this.preferredPort, expectedState);
 			// `preferredPort: 0` opts into a random port — read the actual bound
@@ -233,7 +263,7 @@ export abstract class OAuthCallbackFlow {
 	 * but every callback flow uses TCP; a missing port here indicates a
 	 * configuration error rather than a fallback case.
 	 */
-	#resolveServerPort(server: Bun.Server<unknown>): number {
+	#resolveServerPort(server: CallbackServer): number {
 		const port = server.port;
 		if (typeof port !== "number") {
 			throw new AIError.ConfigurationError(
@@ -277,10 +307,68 @@ export abstract class OAuthCallbackFlow {
 	}
 
 	/**
-	 * Create HTTP server for OAuth callback.
+	 * Create the HTTP listener(s) for the OAuth callback.
+	 *
+	 * `localhost` is not a single endpoint: it resolves to both
+	 * {@link IPV4_LOOPBACK} and {@link IPV6_LOOPBACK}, and clients commonly try
+	 * `::1` first. Binding only the IPv4 literal hands the authorization code to
+	 * whatever holds the IPv6 loopback on the same port — a dev server on
+	 * `*:3000` is the common case — which answers from its own routes while this
+	 * flow waits out the full {@link DEFAULT_TIMEOUT}. Nothing detects it either:
+	 * a specific-address bind coexists with another process's wildcard bind, so
+	 * `Bun.serve` reports the port as free and the random-port fallback in
+	 * {@link #startCallbackServer} never runs.
+	 *
+	 * Binding both loopback literals fixes the delivery rather than dodging it:
+	 * the kernel routes a connection to the most specific matching bind, so our
+	 * `::1` listener receives `localhost` traffic that would otherwise reach a
+	 * process bound to the `::` wildcard. Both listeners answer the same routes,
+	 * so which family the client resolves stops mattering.
+	 *
+	 * A genuine collision — another process on exactly this loopback address and
+	 * port — still raises EADDRINUSE and reaches the caller's in-use policy. A
+	 * host that cannot bind `::1` at all (IPv6 disabled, address unavailable) is
+	 * not a collision: the IPv4 listener is the only reachable endpoint there, so
+	 * it serves alone.
 	 */
-	#createServer(port: number, expectedState: string): Bun.Server<unknown> {
-		const hostname = this.callbackHostname === DEFAULT_HOSTNAME ? "127.0.0.1" : this.callbackHostname;
+	#createServer(port: number, expectedState: string): CallbackServer {
+		if (this.callbackHostname !== DEFAULT_HOSTNAME) {
+			return this.#serve(this.callbackHostname, port, expectedState);
+		}
+		for (let attempt = 0; ; attempt++) {
+			const primary = this.#serve(IPV4_LOOPBACK, port, expectedState);
+			const boundPort = primary.port;
+			// A non-TCP endpoint has no port for the companion to target;
+			// #resolveServerPort reports that case precisely.
+			if (typeof boundPort !== "number") return primary;
+			let companion: Bun.Server<unknown>;
+			try {
+				companion = this.#serve(IPV6_LOOPBACK, boundPort, expectedState);
+			} catch (cause) {
+				if (!isAddressInUse(cause)) return primary;
+				void primary.stop(true);
+				// A pinned port has no alternative, so surface it as in use and let
+				// the caller apply its fallback or diagnostic policy. A random port
+				// can just be redrawn, since only that one number clashed.
+				if (port !== 0 || attempt >= IPV6_COMPANION_ATTEMPTS) throw cause;
+				continue;
+			}
+			// One server to callers. The IPv4 listener stays authoritative for
+			// `port` because the companion was bound to the port it resolved.
+			return {
+				get port() {
+					return primary.port;
+				},
+				stop: (closeActiveConnections?: boolean) => {
+					void companion.stop(closeActiveConnections);
+					return primary.stop(closeActiveConnections);
+				},
+			};
+		}
+	}
+
+	/** Bind one loopback listener serving the callback and launch routes. */
+	#serve(hostname: string, port: number, expectedState: string): Bun.Server<unknown> {
 		return Bun.serve({
 			hostname,
 			port,

package/src/registry/parallel.ts

@@ -1,5 +1,5 @@
-import * as AIError from "../error";
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
 const AUTH_URL = "https://platform.parallel.ai/settings?tab=api-keys";
@@ -10,32 +10,14 @@ const AUTH_URL = "https://platform.parallel.ai/settings?tab=api-keys";
  * Opens browser to the API keys page, prompts the user to paste their API key,
  * and returns the API key directly.
  */
-export async function loginParallel(options: OAuthController): Promise<string> {
-	if (!options.onPrompt) {
-		throw new AIError.OnPromptRequiredError("Parallel");
-	}
-
-	options.onAuth?.({
-		url: AUTH_URL,
-		instructions: "Copy your Parallel API key from the Parallel settings page.",
-	});
-
-	const apiKey = await options.onPrompt({
-		message: "Paste your Parallel API key",
-		placeholder: "sk_...",
-	});
-
-	if (options.signal?.aborted) {
-		throw new AIError.LoginCancelledError();
-	}
-
-	const trimmed = apiKey.trim();
-	if (!trimmed) {
-		throw new AIError.ApiKeyRequiredError();
-	}
-
-	return trimmed;
-}
+export const loginParallel = createApiKeyLogin({
+	providerLabel: "Parallel",
+	authUrl: AUTH_URL,
+	instructions: "Copy your Parallel API key from the Parallel settings page.",
+	promptMessage: "Paste your Parallel API key",
+	placeholder: "sk_...",
+	validation: null,
+});
 
 export const parallelProvider = {
 	id: "parallel",

package/src/registry/tavily.ts

@@ -1,4 +1,4 @@
-import * as AIError from "../error";
+import { createApiKeyLogin } from "./api-key-login";
 import type { OAuthLoginCallbacks } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
@@ -10,32 +10,14 @@ const AUTH_URL = "https://app.tavily.com/home";
  * Opens browser to API keys page and prompts user to paste their API key.
  * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
  */
-export async function loginTavily(options: OAuthLoginCallbacks): Promise<string> {
-	if (!options.onPrompt) {
-		throw new AIError.OnPromptRequiredError("Tavily");
-	}
-
-	options.onAuth?.({
-		url: AUTH_URL,
-		instructions: "Copy your Tavily API key from the API Keys page.",
-	});
-
-	const apiKey = await options.onPrompt({
-		message: "Paste your Tavily API key",
-		placeholder: "tvly-...",
-	});
-
-	if (options.signal?.aborted) {
-		throw new AIError.LoginCancelledError();
-	}
-
-	const trimmed = apiKey.trim();
-	if (!trimmed) {
-		throw new AIError.ApiKeyRequiredError();
-	}
-
-	return trimmed;
-}
+export const loginTavily = createApiKeyLogin({
+	providerLabel: "Tavily",
+	authUrl: AUTH_URL,
+	instructions: "Copy your Tavily API key from the API Keys page.",
+	promptMessage: "Paste your Tavily API key",
+	placeholder: "tvly-...",
+	validation: null,
+});
 
 export const tavilyProvider = {
 	id: "tavily",

package/src/registry/vercel-ai-gateway.ts

@@ -1,35 +1,17 @@
-import * as AIError from "../error";
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
 const AUTH_URL = "https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai-gateway%2Fapi-keys&title=AI+Gateway+API+Keys";
 
-export async function loginVercelAiGateway(options: OAuthController): Promise<string> {
-	if (!options.onPrompt) {
-		throw new AIError.OnPromptRequiredError("Vercel AI Gateway");
-	}
-
-	options.onAuth?.({
-		url: AUTH_URL,
-		instructions: "Copy your Vercel AI Gateway API key from the Vercel dashboard",
-	});
-
-	const apiKey = await options.onPrompt({
-		message: "Paste your Vercel AI Gateway API key",
-		placeholder: "vck_...",
-	});
-
-	if (options.signal?.aborted) {
-		throw new AIError.LoginCancelledError();
-	}
-
-	const trimmed = apiKey.trim();
-	if (!trimmed) {
-		throw new AIError.ApiKeyRequiredError();
-	}
-
-	return trimmed;
-}
+export const loginVercelAiGateway = createApiKeyLogin({
+	providerLabel: "Vercel AI Gateway",
+	authUrl: AUTH_URL,
+	instructions: "Copy your Vercel AI Gateway API key from the Vercel dashboard",
+	promptMessage: "Paste your Vercel AI Gateway API key",
+	placeholder: "vck_...",
+	validation: null,
+});
 
 export const vercelAiGatewayProvider = {
 	id: "vercel-ai-gateway",

package/src/registry/vllm.ts

@@ -1,5 +1,5 @@
-import * as AIError from "../error";
-import type { OAuthController, OAuthLoginCallbacks, OAuthProvider } from "./oauth/types";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks, OAuthProvider } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
 const PROVIDER_ID: OAuthProvider = "vllm";
@@ -7,25 +7,15 @@ const AUTH_URL = "https://docs.vllm.ai/en/latest/serving/openai_compatible_serve
 const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:8000/v1";
 const DEFAULT_LOCAL_TOKEN = "vllm-local";
 
-export async function loginVllm(options: OAuthController): Promise<string> {
-	if (!options.onPrompt) {
-		throw new AIError.OnPromptRequiredError(PROVIDER_ID);
-	}
-	options.onAuth?.({
-		url: AUTH_URL,
-		instructions: `Paste your vLLM API key if your server requires auth. Leave empty for local no-auth mode (default base URL: ${DEFAULT_LOCAL_BASE_URL}).`,
-	});
-	const apiKey = await options.onPrompt({
-		message: "Paste your vLLM API key (optional for local no-auth)",
-		placeholder: DEFAULT_LOCAL_TOKEN,
-		allowEmpty: true,
-	});
-	if (options.signal?.aborted) {
-		throw new AIError.LoginCancelledError();
-	}
-	const trimmed = apiKey.trim();
-	return trimmed || DEFAULT_LOCAL_TOKEN;
-}
+export const loginVllm = createApiKeyLogin({
+	providerLabel: PROVIDER_ID,
+	authUrl: AUTH_URL,
+	instructions: `Paste your vLLM API key if your server requires auth. Leave empty for local no-auth mode (default base URL: ${DEFAULT_LOCAL_BASE_URL}).`,
+	promptMessage: "Paste your vLLM API key (optional for local no-auth)",
+	placeholder: DEFAULT_LOCAL_TOKEN,
+	validation: null,
+	emptyKeyFallback: DEFAULT_LOCAL_TOKEN,
+});
 
 export const vllmProvider = {
 	id: "vllm",

package/src/stream.ts

@@ -990,17 +990,19 @@ function extractStatusFromAssistantError(message: AssistantMessage): number | un
 function isRetryableUpstreamError(error: unknown, status: number | undefined, message: string | undefined): boolean {
 	// 401 means the credential is bad; 403 is its valid-token twin (access
 	// denied by plan, model policy, or org restriction — a sibling account may
-	// not share it). Usage-limit phrasing (Codex's
+	// not share it). Explicit account-scoped policy errors such as Codex
+	// `cyber_policy` are likewise rotatable: another account may carry the
+	// required approval. Usage-limit phrasing (Codex's
 	// "You have hit your ChatGPT usage limit", Anthropic's "usage_limit_reached",
 	// Google's "resource_exhausted", OpenAI's "insufficient_quota") and 429s
 	// without transient rate-limit wording mean this account is parked but a
 	// sibling credential can usually pick the request up. Both are rotatable
-	// via `onAuthError` — the auth-gateway maps the former to
-	// `invalidateCredentialMatching` and the latter to
-	// `markUsageLimitReached`. Transient 429s ("Too many requests",
-	// per-minute caps) classify as RATE_LIMIT_EXCEEDED in
-	// `parseRateLimitReason` and stay in the provider's own backoff layer
-	// instead of burning siblings.
+	// via `onAuthError` — the auth-gateway maps hard auth failures to
+	// `invalidateCredentialMatching` and temporary account constraints to a
+	// credential block. Transient 429s ("Too many requests", per-minute caps)
+	// classify as RATE_LIMIT_EXCEEDED in `parseRateLimitReason` and stay in the
+	// provider's own backoff layer instead of burning siblings.
+	if (AIError.isAccountPolicyError(error)) return true;
 	if (AIError.isUsageLimit(error)) return true;
 	if (isInvalidatedOAuthTokenError(error)) return true;
 	if (status === 401 || (status === 403 && !isConcurrencyCapExclusion(status, message))) return true;
@@ -1506,6 +1508,7 @@ function mapOptionsForApi<TApi extends Api>(
 		execHandlers: options?.execHandlers,
 		fetch: options?.fetch,
 		fallbacks: options?.fallbacks,
+		acceptEmptyResponse: options?.acceptEmptyResponse,
 		...simpleProviderOptions,
 	};
 

package/src/types.ts

@@ -552,6 +552,13 @@ export interface StreamOptions {
 	 * Optional retry delay hook for tests and transports that need custom scheduling.
 	 */
 	providerRetryWait?: (delayMs: number, signal?: AbortSignal) => Promise<void>;
+	/**
+	 * Accept a Google `STOP` response with no visible text or tool call as a
+	 * successful completion. Passive callers such as advisors use this because
+	 * silence is a valid result; interactive agent turns retain empty-response
+	 * retries by default. Ignored by non-Google providers.
+	 */
+	acceptEmptyResponse?: boolean;
 	/**
 	 * Optional `fetch` implementation override. Providers route every HTTP
 	 * request — direct calls, SDK clients, and retry helpers — through this

package/src/usage/alibaba-token-plan.ts

@@ -1,3 +1,4 @@
+import { toNumber } from "@oh-my-pi/pi-catalog/utils";
 import { parseAlibabaTokenPlanCredential } from "@oh-my-pi/pi-catalog/wire/alibaba-token-plan";
 import type {
 	CredentialRankingStrategy,
@@ -8,7 +9,7 @@ import type {
 	UsageReport,
 } from "../usage";
 import { isRecord } from "../utils";
-import { toNumber } from "./shared";
+import { HOUR_MS, parsePositiveTimestamp, WEEK_MS } from "./shared";
 
 const PROVIDER = "alibaba-token-plan";
 const CONSOLE_ORIGIN = "https://home.qwencloud.com";
@@ -19,8 +20,6 @@ const USAGE_API = "zeldaHttp.apikeyMgr./tokenplan/personal/api/v2/usage";
 const USAGE_URL = `https://cs-data.qwencloud.com/data/api.json?product=sfm_bailian&action=${GATEWAY_ACTION}&api=${encodeURIComponent(USAGE_API)}`;
 const BROWSER_USER_AGENT =
 	"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36";
-const FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
-const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
 const CONSOLE_CORNERSTONE_PARAM = {
 	domain: "home.qwencloud.com",
 	consoleSite: "QWENCLOUD",
@@ -55,12 +54,6 @@ function unwrapGatewayData(value: Record<string, unknown>): Record<string, unkno
 	return current;
 }
 
-function parseResetTime(value: unknown): number | undefined {
-	const parsed = toNumber(value);
-	if (parsed === undefined || parsed <= 0) return undefined;
-	return parsed < 1_000_000_000_000 ? parsed * 1000 : parsed;
-}
-
 function parseUsedFraction(value: unknown): number | undefined {
 	const parsed = toNumber(value);
 	if (parsed === undefined || parsed < 0) return undefined;
@@ -178,17 +171,17 @@ async function fetchAlibabaTokenPlanUsage(
 			buildLimit(
 				"5h",
 				"5 Hour Credits",
-				FIVE_HOURS_MS,
+				5 * HOUR_MS,
 				parseUsedFraction(responseData.per5HourPercentage),
-				parseResetTime(responseData.per5HourResetTime),
+				parsePositiveTimestamp(responseData.per5HourResetTime),
 				accountId,
 			),
 			buildLimit(
 				"7d",
 				"7 Day Credits",
-				SEVEN_DAYS_MS,
+				WEEK_MS,
 				parseUsedFraction(responseData.per1WeekPercentage),
-				parseResetTime(responseData.per1WeekResetTime),
+				parsePositiveTimestamp(responseData.per1WeekResetTime),
 				accountId,
 			),
 		].filter((limit): limit is UsageLimit => limit !== undefined);
@@ -224,7 +217,7 @@ export const alibabaTokenPlanRankingStrategy: CredentialRankingStrategy = {
 		secondary: report.limits.find(limit => limit.id === "credits:7d"),
 	}),
 	windowDefaults: {
-		primaryMs: FIVE_HOURS_MS,
-		secondaryMs: SEVEN_DAYS_MS,
+		primaryMs: 5 * HOUR_MS,
+		secondaryMs: WEEK_MS,
 	},
 };