@oh-my-pi/pi-ai 18.2.5 → 18.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.2.5",
+	"version": "18.2.7",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -128,11 +128,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.2.5",
-		"@oh-my-pi/pi-catalog": "18.2.5",
-		"@oh-my-pi/pi-natives": "18.2.5",
-		"@oh-my-pi/pi-utils": "18.2.5",
-		"@oh-my-pi/pi-wire": "18.2.5"
+		"@oh-my-pi/omptype": "18.2.7",
+		"@oh-my-pi/pi-catalog": "18.2.7",
+		"@oh-my-pi/pi-natives": "18.2.7",
+		"@oh-my-pi/pi-utils": "18.2.7",
+		"@oh-my-pi/pi-wire": "18.2.7"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth-broker/discover.ts

@@ -4,6 +4,7 @@
  * token file → local SQLite) in one place so build-time tooling sees the same
  * credentials as the TUI.
  */
+import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import {
 	$envExact,
@@ -60,7 +61,7 @@ async function defaultResolveConfigValue(config: string): Promise<string | undef
 
 async function readTokenFile(): Promise<string | null> {
 	try {
-		const raw = await Bun.file(getAuthBrokerTokenFilePath()).text();
+		const raw = await fs.readFile(getAuthBrokerTokenFilePath(), "utf8");
 		const trimmed = raw.trim();
 		return trimmed.length > 0 ? trimmed : null;
 	} catch (err) {
@@ -99,7 +100,7 @@ async function readConfigYaml(agentDir: string): Promise<ConfigSnapshot> {
 	for (const filename of MAIN_CONFIG_FILENAMES) {
 		const configPath = path.join(agentDir, filename);
 		try {
-			const raw = await Bun.file(configPath).text();
+			const raw = await fs.readFile(configPath, "utf8");
 			const parsed = YAML.parse(raw);
 			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
 			const record = parsed as Record<string, unknown>;
@@ -121,7 +122,8 @@ export async function loadAuthBrokerAccountPool(): Promise<AuthBrokerAccountPool
 
 	let parsed: unknown;
 	try {
-		parsed = await Bun.file(filePath).json();
+		const raw = await fs.readFile(filePath, "utf8");
+		parsed = JSON.parse(raw.charCodeAt(0) === 0xfeff ? raw.slice(1) : raw);
 	} catch (error) {
 		throw new AIError.ConfigurationError(`Unable to read OMP_AUTH_BROKER_ACCOUNT_POOL_FILE at ${filePath}`, {
 			cause: error,

package/src/auth-retry.ts

@@ -43,6 +43,9 @@ export type ApiKeyResolver = (ctx: ApiKeyResolveContext) => Promise<string | und
 /** A static bearer string, or a {@link ApiKeyResolver} that mints/rotates one. */
 export type ApiKey = string | ApiKeyResolver;
 
+/** Keyless-provider credential marker; transports must not send it in authentication headers. */
+export const NO_AUTH_SENTINEL = "N/A";
+
 /** Narrows {@link ApiKey} to its resolver form. */
 export function isApiKeyResolver(key: ApiKey | undefined): key is ApiKeyResolver {
 	return typeof key === "function";

package/src/auth-storage.ts

@@ -4707,7 +4707,7 @@ export class AuthStorage {
 	async #resolveCredentialTarget(
 		provider: string,
 		sessionId: string | undefined,
-		options?: { credentialId?: number; apiKey?: string },
+		options?: { credentialId?: number; apiKey?: string; allowStaleOAuthBearer?: boolean },
 	): Promise<{ type: AuthCredential["type"]; index: number; explicit: boolean } | undefined> {
 		const explicit = options?.credentialId !== undefined || options?.apiKey !== undefined;
 		if (explicit) {
@@ -4731,6 +4731,15 @@ export class AuthStorage {
 					return { type: entry.credential.type, index, explicit: true };
 				}
 			}
+			// Quota and account policy survive token refresh; hard auth failures do not.
+			if (options.allowStaleOAuthBearer && options.credentialId === undefined) {
+				const credentialId = this.#findOAuthCredentialIdForBearer(provider, options.apiKey);
+				const index =
+					credentialId === undefined
+						? -1
+						: stored.findIndex(entry => entry.id === credentialId && entry.credential.type === "oauth");
+				if (index >= 0) return { type: "oauth", index, explicit: true };
+			}
 		}
 		if (explicit) return undefined;
 		const sessionCredential = this.#getSessionCredential(provider, sessionId);
@@ -4866,23 +4875,11 @@ export class AuthStorage {
 		},
 	): Promise<UsageLimitMarkResult> {
 		await this.#adoptExternalCredentialChanges();
-		let sessionCredential = await this.#resolveCredentialTarget(provider, sessionId, {
+		const sessionCredential = await this.#resolveCredentialTarget(provider, sessionId, {
 			credentialId: options?.credentialId,
 			apiKey: options?.apiKey,
+			allowStaleOAuthBearer: true,
 		});
-		if (!sessionCredential && options?.credentialId === undefined && options?.apiKey !== undefined) {
-			// Account quota survives OAuth bearer rotation. Attribute a delayed
-			// usage-limit response through the durable row id captured when this
-			// exact bearer was resolved; never use this alias for hard auth errors.
-			const credentialId = this.#findOAuthCredentialIdForBearer(provider, options.apiKey);
-			const index =
-				credentialId === undefined
-					? -1
-					: this.#getStoredCredentials(provider).findIndex(
-							entry => entry.id === credentialId && entry.credential.type === "oauth",
-						);
-			if (index >= 0) sessionCredential = { type: "oauth", index, explicit: true };
-		}
 		if (!sessionCredential) return { switched: false };
 		const target = this.#getStoredCredentials(provider)[sessionCredential.index];
 		if (!target || target.credential.type !== sessionCredential.type) return { switched: false };
@@ -6974,8 +6971,8 @@ export class AuthStorage {
 	 * stale session stickiness. Fall back to the session-sticky credential only
 	 * when neither explicit target is available. For hard-auth errors, an explicit
 	 * target that no longer matches storage returns `false` without mutation.
-	 * Delayed usage-limit errors may instead recover the durable OAuth row from
-	 * the bearer fingerprint recorded when the request resolved.
+	 * Delayed usage-limit and account-policy errors may instead recover the durable
+	 * OAuth row from the bearer fingerprint recorded when the request resolved.
 	 *
 	 * - usage-limit / account-rate-limit error → {@link AuthStorage.markUsageLimitReached}
 	 *   (temporary block via its own backoff — default plus server usage-report
@@ -7024,16 +7021,16 @@ export class AuthStorage {
 			).switched;
 		}
 
+		const deniedModel = AIError.codexChatGPTAccountPolicyModel(error);
+		const exactCodexModelPolicy =
+			deniedModel !== undefined && AIError.isCodexChatGPTAccountPolicyError(error, provider, options?.modelId);
+		const exactModelPolicy = exactCodexModelPolicy || exactCursorModelPolicy;
 		const sessionCredential = await this.#resolveCredentialTarget(provider, sessionId, {
 			credentialId: options?.credentialId,
 			apiKey: options?.apiKey,
+			allowStaleOAuthBearer: accountPolicy || exactModelPolicy,
 		});
 		if (!sessionCredential) return false;
-
-		const deniedModel = AIError.codexChatGPTAccountPolicyModel(error);
-		const exactCodexModelPolicy =
-			deniedModel !== undefined && AIError.isCodexChatGPTAccountPolicyError(error, provider, options?.modelId);
-		const exactModelPolicy = exactCodexModelPolicy || exactCursorModelPolicy;
 		// The exact sentence is provider-controlled input. A non-Codex provider,
 		// absent request model, or mismatched model must not turn it into either a
 		// global block or a hard-auth invalidation.
@@ -7049,6 +7046,15 @@ export class AuthStorage {
 				options?.modelId,
 				modelPolicyScope,
 			);
+			// Account-wide denials must not inherit a quota scope that healthy usage can heal.
+			routing.blockScope = modelPolicyScope;
+			const sticky = this.#getSessionCredential(provider, sessionId);
+			if (
+				!sessionCredential.explicit ||
+				(sticky?.type === sessionCredential.type && sticky.index === sessionCredential.index)
+			) {
+				this.#clearSessionCredential(provider, sessionId);
+			}
 			return this.#blockCredentialForRotation(
 				provider,
 				sessionCredential.type,

package/src/error/auth-classify.ts

@@ -41,8 +41,16 @@ export function isAuthRetryableError(error: unknown): boolean {
 	if (isUsageLimit(error)) return true;
 	if (isAccountPolicyError(error)) return true;
 	if (isInvalidatedOAuthTokenError(error)) return true;
-	const httpStatus = extractHttpStatusFromError(error);
-	const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;
+	let httpStatus = extractHttpStatusFromError(error);
+	let message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;
+	if (typeof error === "object" && error !== null) {
+		if (httpStatus === undefined && "errorStatus" in error && typeof error.errorStatus === "number") {
+			httpStatus = error.errorStatus;
+		}
+		if (message === undefined && "errorMessage" in error && typeof error.errorMessage === "string") {
+			message = error.errorMessage;
+		}
+	}
 	const embeddedStatus = message ? extractHttpStatusFromError({ message }) : undefined;
 	const status = httpStatus ?? embeddedStatus;
 	if (isConcurrencyCapExclusion(status, message)) return false;

package/src/error/classes.ts

@@ -90,8 +90,8 @@ export class AnthropicApiError extends ProviderHttpError {
 	declare readonly headers: Headers;
 	readonly requestId: string | null;
 
-	constructor(status: number, message: string, headers: Headers) {
-		super(message, status, { headers });
+	constructor(status: number, message: string, headers: Headers, options?: { code?: string; cause?: unknown }) {
+		super(message, status, { headers, code: options?.code, cause: options?.cause });
 		this.name = "AnthropicApiError";
 		this.requestId = headers.get("request-id");
 	}
@@ -176,7 +176,27 @@ export class AnthropicApiError extends ProviderHttpError {
 		}
 
 		const detail = bodyChunks.join("").trim() || "status code (no body)";
-		return new AnthropicApiError(response.status, `${response.status} ${detail}`, response.headers);
+		let code: string | undefined;
+		try {
+			const parsed: unknown = JSON.parse(detail);
+			if (parsed && typeof parsed === "object" && "error" in parsed) {
+				const err = parsed.error;
+				if (err && typeof err === "object") {
+					if (
+						"details" in err &&
+						err.details &&
+						typeof err.details === "object" &&
+						"error_code" in err.details &&
+						typeof err.details.error_code === "string"
+					) {
+						code = err.details.error_code;
+					} else if ("type" in err && typeof err.type === "string") {
+						code = err.type;
+					}
+				}
+			}
+		} catch {}
+		return new AnthropicApiError(response.status, `${response.status} ${detail}`, response.headers, { code });
 	}
 }
 

package/src/error/flags.ts

@@ -1,5 +1,5 @@
 import { isUnexpectedSocketCloseMessage } from "@oh-my-pi/pi-utils/fetch-retry";
-import type { Api, AssistantMessage } from "../types";
+import type { Api, AssistantMessage, Usage } from "../types";
 import { AwsCredentialsError } from "./aws";
 import {
 	AnthropicConnectionError,
@@ -194,6 +194,17 @@ const PROVIDER_FINISH_ERROR_PATTERN = /\bProvider (?:returned error finish_reaso
 const EMPTY_RESPONSE_PATTERN = /\bthought-only response without final output\b/i;
 const CONTENT_FILTER_PATTERN = /\b(?:incomplete:\s*)?content_filter\b/i;
 const ACCOUNT_POLICY_PATTERN = /\bcyber_policy\b|trusted access for cyber/i;
+export const ANTHROPIC_ACCOUNT_POLICY_PATTERN =
+	/\b(?:oauth_not_allowed_for_organization|permission_error)\b|\bOAuth authentication is currently not allowed for this organization\b/i;
+
+/** Whether an error message represents an Anthropic account-scoped permission/policy denial. */
+export function isAnthropicAccountPolicyText(text: string, provider?: string, statusArg?: number): boolean {
+	if (provider !== undefined && provider !== "anthropic") return false;
+	const statusCandidate = statusArg ?? (text ? status({ message: text }) : undefined);
+	if (statusCandidate !== undefined && statusCandidate !== 403) return false;
+	return ANTHROPIC_ACCOUNT_POLICY_PATTERN.test(text);
+}
+
 const CODEX_CHATGPT_ACCOUNT_MODEL_POLICY_PATTERN =
 	/\bThe ['"]([^'"\r\n]+)['"] model is not supported when using Codex with a ChatGPT account\./i;
 const CODEX_CHATGPT_ACCOUNT_MODEL_MAX_LENGTH = 256;
@@ -381,6 +392,9 @@ function statusInternal(error: unknown, depth: number): number | undefined {
 		if (typeof errObj.statusCode === "number" && errObj.statusCode >= 100 && errObj.statusCode <= 599) {
 			return errObj.statusCode;
 		}
+		if (typeof errObj.errorStatus === "number" && errObj.errorStatus >= 100 && errObj.errorStatus <= 599) {
+			return errObj.errorStatus;
+		}
 		if (typeof errObj.response === "object" && errObj.response !== null) {
 			const resp = errObj.response as Record<string, unknown>;
 			if (typeof resp.status === "number" && resp.status >= 100 && resp.status <= 599) {
@@ -490,6 +504,8 @@ function classifyText(
 		if (isProviderFinishErrorText(errorMessage)) kinds |= Flag.ProviderFinishError;
 		if (EMPTY_RESPONSE_PATTERN.test(errorMessage)) kinds |= Flag.EmptyResponse | Flag.Transient;
 		if (isContentBlockedText(errorMessage)) kinds |= Flag.ContentBlocked;
+		const statusClean = errorStatus ? errorStatus : (status({ message: errorMessage }) ?? undefined);
+
 		if (
 			ACCOUNT_POLICY_PATTERN.test(errorMessage) ||
 			isCodexChatGPTAccountPolicyText(errorMessage, provider, modelId) ||
@@ -497,9 +513,10 @@ function classifyText(
 		) {
 			kinds |= Flag.AccountPolicy | Flag.ContentBlocked;
 		}
+		if (isAnthropicAccountPolicyText(errorMessage, provider, statusClean)) {
+			kinds |= Flag.AccountPolicy;
+		}
 		if (isAuthFailureText(errorMessage)) kinds |= Flag.AuthFailed;
-
-		const statusClean = errorStatus ? errorStatus : (status({ message: errorMessage }) ?? undefined);
 		const cleanMessage = errorMessage;
 		const isOpaque = isOpaqueStatusBody(cleanMessage);
 
@@ -597,8 +614,12 @@ export function classify(error: unknown, api?: Api): number {
 			if ("errorId" in link && typeof (link as { errorId: unknown }).errorId === "number") {
 				kinds |= (link as { errorId: number }).errorId & KIND_MASK;
 			}
-			if ("code" in link && typeof link.code === "string" && ACCOUNT_POLICY_PATTERN.test(link.code)) {
-				kinds |= Flag.AccountPolicy | Flag.ContentBlocked;
+			if ("code" in link && typeof link.code === "string") {
+				if (ACCOUNT_POLICY_PATTERN.test(link.code)) {
+					kinds |= Flag.AccountPolicy | Flag.ContentBlocked;
+				} else if (ANTHROPIC_ACCOUNT_POLICY_PATTERN.test(link.code)) {
+					kinds |= Flag.AccountPolicy;
+				}
 			}
 		}
 
@@ -635,6 +656,13 @@ export function classify(error: unknown, api?: Api): number {
 			if (code === "overloaded_error" || code === "rate_limit_error") {
 				linkKinds |= Flag.Transient;
 			}
+			if (
+				code === "oauth_not_allowed_for_organization" ||
+				code === "permission_error" ||
+				(codeStatus === 403 && ANTHROPIC_ACCOUNT_POLICY_PATTERN.test(link.message))
+			) {
+				linkKinds |= Flag.AccountPolicy;
+			}
 			if (
 				(codeStatus === 401 || codeStatus === 403) &&
 				!(codeStatus === 403 && parseRateLimitReason(link.message) === "CONCURRENT_LIMIT")
@@ -655,12 +683,12 @@ export function classify(error: unknown, api?: Api): number {
 			linkMessage = link.message;
 		} else if (typeof link === "string") {
 			linkMessage = link;
-		} else if (
-			typeof link === "object" &&
-			"message" in link &&
-			typeof (link as { message: unknown }).message === "string"
-		) {
-			linkMessage = (link as { message: string }).message;
+		} else if (typeof link === "object") {
+			if ("message" in link && typeof link.message === "string") {
+				linkMessage = link.message;
+			} else if ("errorMessage" in link && typeof link.errorMessage === "string") {
+				linkMessage = link.errorMessage;
+			}
 		}
 
 		const linkStatus = status(link);
@@ -834,14 +862,21 @@ export function attach<E extends object>(error: E, id: number): E {
 	return error;
 }
 
+/** Overflow-classification evidence, including errors received before token usage is available. */
+export interface ContextOverflowMessage extends Pick<AssistantMessage, "errorId" | "stopReason" | "errorMessage"> {
+	readonly usage?: Pick<Usage, "input" | "cacheRead" | "cacheWrite">;
+}
+
 /** Provider-reported usage proves context-window excess — authoritative, compaction-owned (#9235). */
-export function isUsageBackedContextOverflow(message: AssistantMessage, contextWindow?: number): boolean {
-	if (!contextWindow) return false;
-	const inputTokens = message.usage.input + message.usage.cacheRead + message.usage.cacheWrite;
+export function isUsageBackedContextOverflow(message: ContextOverflowMessage, contextWindow?: number): boolean {
+	const usage = message.usage;
+	if (!contextWindow || !usage) return false;
+	const inputTokens = usage.input + usage.cacheRead + usage.cacheWrite;
 	return inputTokens > contextWindow;
 }
 
-export function isContextOverflow(message: AssistantMessage, contextWindow?: number): boolean {
+/** Classify overflow from error flags, available token usage, or provider error text. */
+export function isContextOverflow(message: ContextOverflowMessage, contextWindow?: number): boolean {
 	if (is(message.errorId, Flag.ContextOverflow)) return true;
 	if (isUsageBackedContextOverflow(message, contextWindow)) return true;
 	return message.stopReason === "error" && !!message.errorMessage && matchesOverflowText(message.errorMessage);
@@ -861,7 +896,7 @@ export function isPayloadRejection(message: AssistantMessage): boolean {
  *  Usage-backed overflows are authoritative window excesses and never ambiguous. */
 export function isTextAmbiguousContextOverflow(
 	errorId: number,
-	message: AssistantMessage | undefined,
+	message: ContextOverflowMessage | undefined,
 	contextWindow?: number,
 ): boolean {
 	const overflowFlagged =

package/src/index.ts

@@ -10,22 +10,25 @@ export * from "./judgment";
 export * from "./oneshot-retry";
 export * from "./provider-details";
 export * from "./provider-session-state";
-export * from "./providers/anthropic";
-export * from "./providers/anthropic-client";
-export * from "./providers/azure-openai-responses";
+// Provider-specific runtime APIs are imported from their providers/* subpaths.
+export type * from "./providers/anthropic";
+export * from "./providers/anthropic-identity";
+export * from "./providers/anthropic-state";
+export type * from "./providers/anthropic-client";
+export type * from "./providers/azure-openai-responses";
 export type * from "./providers/cursor";
-export * from "./providers/gitlab-duo";
-export * from "./providers/gitlab-duo-workflow";
+export type * from "./providers/gitlab-duo";
+export type * from "./providers/gitlab-duo-workflow";
 export type * from "./providers/google";
 export type * from "./providers/google-gemini-cli";
 export type * from "./providers/google-vertex";
-export * from "./providers/kimi";
-export * from "./providers/mock";
-export * from "./providers/ollama";
-export * from "./providers/openai-codex-responses";
-export * from "./providers/openai-completions";
-export * from "./providers/openai-responses";
-export * from "./providers/synthetic";
+export type * from "./providers/kimi";
+export type * from "./providers/mock";
+export type * from "./providers/ollama";
+export type * from "./providers/openai-codex-responses";
+export type * from "./providers/openai-completions";
+export type * from "./providers/openai-responses";
+export type * from "./providers/synthetic";
 export * from "./registry";
 export * from "./stream";
 export * from "./types";

package/src/judgment/types.ts

@@ -115,14 +115,17 @@ export class JudgmentParseError extends Error {
 	}
 }
 
-/** Zero-cost usage for a request whose backend reports only token counts. */
-export function tokenUsage(input: number, output: number): Usage {
+/**
+ * Usage from a backend that reports token counts and, optionally, one billed
+ * USD amount. Judgment pricing is input-only, so the amount lands on `input`.
+ */
+export function tokenUsage(input: number, output: number, cost = 0): Usage {
 	return {
 		input,
 		output,
 		cacheRead: 0,
 		cacheWrite: 0,
 		totalTokens: input + output,
-		cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+		cost: { input: cost, output: 0, cacheRead: 0, cacheWrite: 0, total: cost },
 	};
 }

package/src/judgment/typesafe.ts

@@ -1,16 +1,20 @@
 /**
  * TypeSafe System One client: the native {@link Judge} backend.
  *
- * Forwards a {@link JudgmentRequest} verbatim to `POST /v1/systemone` and maps
- * the typed answers back. Credentials flow through {@link withAuth}, so a
- * stored key rotates on 401/403 exactly like chat providers; transient
- * 429/5xx responses retry with bounded, `retry-after`-aware backoff.
+ * Forwards a {@link JudgmentRequest} verbatim to the judgment route of its
+ * API ({@link JUDGMENT_ROUTES}) and maps the typed answers back. TypeSafe's
+ * own `POST /v1/systemone` and OpenRouter's `POST /api/alpha/decisions` share
+ * the request and answer wire shape, so one client serves both. Credentials
+ * flow through {@link withAuth}, so a stored key rotates on 401/403 exactly
+ * like chat providers; transient 429/5xx responses retry with bounded,
+ * `retry-after`-aware backoff.
  *
  * Environment (mirrors the official SDK): `TYPESAFE_API_KEY` is resolved by
  * the auth registry (`rules/auth/typesafe.kdl`), `TYPESAFE_BASE_URL`
  * overrides the API root, `TYPESAFE_DEFAULT_MODEL` the model.
  */
-import type { FetchImpl } from "@oh-my-pi/pi-catalog/types";
+import { TYPESAFE_DEFAULT_BASE_URL } from "@oh-my-pi/pi-catalog/discovery";
+import type { Api, FetchImpl } from "@oh-my-pi/pi-catalog/types";
 import { $env } from "@oh-my-pi/pi-utils";
 import { type ApiKey, withAuth } from "../auth-retry";
 import * as AIError from "../error";
@@ -26,9 +30,22 @@ import {
 } from "./types";
 
 export const TYPESAFE_PROVIDER = "typesafe";
-export const TYPESAFE_DEFAULT_BASE_URL = "https://api.typesafe.ai";
 export const TYPESAFE_DEFAULT_MODEL = "jev-latest";
 
+/** Judgment `POST` path under a model's base URL, per System One–compatible API. */
+export const JUDGMENT_ROUTES = {
+	typesafe: "/v1/systemone",
+	"openrouter-decisions": "/decisions",
+} as const satisfies Partial<Record<Api, string>>;
+
+/** APIs {@link TypeSafeJudge} can serve. */
+export type JudgmentApi = keyof typeof JUDGMENT_ROUTES;
+
+/** Whether a catalog API answers System One judgments natively. */
+export function isJudgmentApi(api: Api): api is JudgmentApi {
+	return Object.hasOwn(JUDGMENT_ROUTES, api);
+}
+
 /** `TYPESAFE_BASE_URL` when set, else the public API root; trailing slashes stripped. */
 export function typesafeBaseUrl(): string {
 	return ($env.TYPESAFE_BASE_URL?.trim() || TYPESAFE_DEFAULT_BASE_URL).replace(/\/+$/, "");
@@ -41,6 +58,10 @@ export function typesafeModel(): string {
 
 export interface TypeSafeJudgeOptions {
 	apiKey: ApiKey;
+	/** Wire route; defaults to TypeSafe's own API. */
+	api?: JudgmentApi;
+	/** Catalog provider reported on results; defaults to {@link TYPESAFE_PROVIDER}. */
+	provider?: string;
 	/** Defaults to {@link typesafeBaseUrl}. */
 	baseUrl?: string;
 	/** Defaults to {@link typesafeModel}. */
@@ -60,17 +81,11 @@ const MAX_ATTEMPTS = 3;
 const BACKOFF_BASE_MS = 500;
 const BACKOFF_MAX_MS = 5_000;
 
-/** Wire shape of `GET /v1/models`. */
-export interface TypeSafeModelCard {
-	name: string;
-	description: string;
-	release_date: string;
-}
-
 interface SystemOneResponse {
 	model: string;
 	answers: Record<string, Answer>;
-	usage: { input_tokens: number; output_tokens: number };
+	/** OpenRouter adds the billed `cost` in USD; TypeSafe reports tokens only. */
+	usage: { input_tokens: number; output_tokens: number; cost?: number };
 }
 
 /** Server hint wins (capped); otherwise exponential backoff from {@link BACKOFF_BASE_MS}. */
@@ -82,6 +97,8 @@ function backoffMs(attempt: number, headers: Headers | undefined): number {
 
 export class TypeSafeJudge implements Judge {
 	readonly label: string;
+	readonly api: JudgmentApi;
+	readonly provider: string;
 	readonly model: string;
 	readonly baseUrl: string;
 	readonly #apiKey: ApiKey;
@@ -90,67 +107,55 @@ export class TypeSafeJudge implements Judge {
 
 	constructor(options: TypeSafeJudgeOptions) {
 		this.#apiKey = options.apiKey;
+		this.api = options.api ?? TYPESAFE_PROVIDER;
+		this.provider = options.provider ?? TYPESAFE_PROVIDER;
 		this.baseUrl = (options.baseUrl ?? typesafeBaseUrl()).replace(/\/+$/, "");
 		this.model = options.model ?? typesafeModel();
 		this.#fetch = options.fetch ?? fetch;
 		this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-		this.label = `${TYPESAFE_PROVIDER}/${this.model}`;
+		this.label = `${this.provider}/${this.model}`;
 	}
 
 	async judge<Q extends Questions>(request: JudgmentRequest<Q>, options?: JudgeOptions): Promise<JudgmentResult<Q>> {
 		const body = JSON.stringify({ state: request.state, model: this.model, questions: request.questions });
-		const response = await this.#request<SystemOneResponse>("POST", "/v1/systemone", body, options?.signal);
+		const signal = options?.signal;
+		const response = await withAuth(
+			this.#apiKey,
+			key => this.#attempt<SystemOneResponse>(JUDGMENT_ROUTES[this.api], body, key, signal),
+			{ signal },
+		);
 		for (const id in request.questions) {
 			const answer = response.answers[id];
 			if (answer === undefined || answer.type !== request.questions[id].type) {
 				throw new AIError.ProviderResponseError(
-					`TypeSafe response is missing a "${request.questions[id].type}" answer for question "${id}"`,
-					{ provider: TYPESAFE_PROVIDER, kind: "envelope" },
+					`${this.label} response is missing a "${request.questions[id].type}" answer for question "${id}"`,
+					{ provider: this.provider, kind: "envelope" },
 				);
 			}
 		}
 		return {
-			api: TYPESAFE_PROVIDER,
-			provider: TYPESAFE_PROVIDER,
+			api: this.api,
+			provider: this.provider,
 			model: response.model,
 			answers: response.answers as JudgmentResult<Q>["answers"],
-			usage: tokenUsage(response.usage.input_tokens, response.usage.output_tokens),
+			usage: tokenUsage(response.usage.input_tokens, response.usage.output_tokens, response.usage.cost),
 		};
 	}
 
-	/** Models available to the account (`GET /v1/models`); also the login validation probe. */
-	async listModels(signal?: AbortSignal): Promise<TypeSafeModelCard[]> {
-		const response = await this.#request<{ models: TypeSafeModelCard[] }>("GET", "/v1/models", undefined, signal);
-		if (!Array.isArray(response.models)) {
-			throw new AIError.ProviderResponseError("TypeSafe /v1/models response is missing `models`", {
-				provider: TYPESAFE_PROVIDER,
-				kind: "envelope",
-			});
-		}
-		return response.models;
-	}
-
-	async #request<T>(method: "GET" | "POST", path: string, body: string | undefined, signal?: AbortSignal): Promise<T> {
-		return withAuth(this.#apiKey, key => this.#attempt<T>(method, path, body, key, signal), { signal });
-	}
-
-	async #attempt<T>(
-		method: "GET" | "POST",
-		path: string,
-		body: string | undefined,
-		key: string,
-		signal: AbortSignal | undefined,
-	): Promise<T> {
+	async #attempt<T>(path: string, body: string, key: string, signal: AbortSignal | undefined): Promise<T> {
 		const url = `${this.baseUrl}${path}`;
-		const headers: Record<string, string> = { Authorization: `Bearer ${key}`, Accept: "application/json" };
-		if (body !== undefined) headers["Content-Type"] = "application/json";
+		const headers: Record<string, string> = {
+			Authorization: `Bearer ${key}`,
+			Accept: "application/json",
+			"Content-Type": "application/json",
+		};
 		for (let attempt = 0; ; attempt++) {
 			signal?.throwIfAborted();
 			const timeout = AbortSignal.timeout(this.#timeoutMs);
 			let response: Response;
 			try {
 				response = await this.#fetch(url, {
-					method,
+					method: "POST",
 					headers,
 					body,
 					signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
@@ -162,7 +167,7 @@ export class TypeSafeJudge implements Judge {
 			}
 			if (response.ok) return (await response.json()) as T;
 			const text = await response.text();
-			const error = new TypeSafeApiError(`TypeSafe API error (${response.status}): ${text}`, response.status, {
+			const error = new TypeSafeApiError(`${this.label} API error (${response.status}): ${text}`, response.status, {
 				headers: response.headers,
 			});
 			const transient = response.status === 408 || response.status === 429 || response.status >= 500;

package/src/provider-session-state.ts

@@ -38,7 +38,7 @@
  *   very turn that rotated; it stays on its existing session-close path.
  */
 
-import { clearAnthropicFastModeFallback } from "./providers/anthropic";
+import { clearAnthropicFastModeFallback } from "./providers/anthropic-state";
 import { resetOpenAIResponsesAccountScopedState } from "./providers/openai-responses";
 import type { ProviderSessionState } from "./types";