@oh-my-pi/pi-ai 18.3.0 → 18.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.3.0",
+	"version": "18.3.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.3.0",
-		"@oh-my-pi/pi-catalog": "18.3.0",
-		"@oh-my-pi/pi-natives": "18.3.0",
-		"@oh-my-pi/pi-utils": "18.3.0",
-		"@oh-my-pi/pi-wire": "18.3.0"
+		"@oh-my-pi/omptype": "18.3.2",
+		"@oh-my-pi/pi-catalog": "18.3.2",
+		"@oh-my-pi/pi-natives": "18.3.2",
+		"@oh-my-pi/pi-utils": "18.3.2",
+		"@oh-my-pi/pi-wire": "18.3.2"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/policy.ts

@@ -22,20 +22,41 @@ export function matchesAuthAccountSelector(selector: AuthAccountSelector, identi
 /** Validated per-account routing policies (priority/reserve) plus the global reserve fallback. */
 export class AccountPolicies {
 	#accountPolicies: AuthAccountPolicies;
-	readonly defaultReservePct: number;
+	#defaultReservePct: number;
 
 	constructor(policies: AuthAccountPolicies, defaultReservePct: number | undefined) {
+		AccountPolicies.#validateAccountPolicyConfiguration(policies);
 		this.#accountPolicies = policies;
-		this.defaultReservePct =
+		this.#defaultReservePct =
 			typeof defaultReservePct === "number" && Number.isFinite(defaultReservePct)
 				? Math.max(0, Math.min(100, defaultReservePct))
 				: DEFAULT_USAGE_RESERVE_PCT;
-		this.#validateAccountPolicyConfiguration();
 	}
 
-	#validateAccountPolicyConfiguration(): void {
-		for (let index = 0; index < this.#accountPolicies.length; index += 1) {
-			const policy = this.#accountPolicies[index]!;
+	/** Global usage reserve (0–100) for accounts without a per-account `reservePct`. */
+	get defaultReservePct(): number {
+		return this.#defaultReservePct;
+	}
+
+	/**
+	 * Replace the policy set and global reserve in place (live settings change).
+	 * Validates the configuration and every provider in `storedCredentials` before
+	 * committing; on error the previous policies stay active.
+	 */
+	replace(
+		policies: AuthAccountPolicies,
+		defaultReservePct: number | undefined,
+		storedCredentials: ReadonlyMap<string, readonly AuthCredential[]> = new Map(),
+	): void {
+		const next = new AccountPolicies(policies, defaultReservePct);
+		for (const [provider, credentials] of storedCredentials) next.validateFor(provider, credentials);
+		this.#accountPolicies = next.#accountPolicies;
+		this.#defaultReservePct = next.#defaultReservePct;
+	}
+
+	static #validateAccountPolicyConfiguration(accountPolicies: AuthAccountPolicies): void {
+		for (let index = 0; index < accountPolicies.length; index += 1) {
+			const policy = accountPolicies[index]!;
 			const path = `auth.accountPolicies[${index}]`;
 			if (
 				typeof policy.provider !== "string" ||

package/src/auth/pool.ts

@@ -31,6 +31,23 @@ function fingerprintOAuthBearer(bearer: string): string {
 /** One stored credential row as cached in memory. */
 export type StoredCredential = { id: number; credential: AuthCredential };
 
+/** {@link CredentialDisabledEvent} for a torn-down row, carrying the account identity it was signed in as. */
+export function credentialDisabledEvent(
+	provider: string,
+	row: StoredCredential,
+	disabledCause: string,
+): CredentialDisabledEvent {
+	const event: CredentialDisabledEvent = { provider, disabledCause, credentialId: row.id };
+	const { credential } = row;
+	if (credential.type === "oauth") {
+		if (credential.email) event.email = credential.email;
+		if (credential.accountId) event.accountId = credential.accountId;
+		if (credential.orgId) event.orgId = credential.orgId;
+		if (credential.orgName) event.orgName = credential.orgName;
+	}
+	return event;
+}
+
 /** Credential equality used for snapshot change detection. */
 export function authCredentialEquals(left: AuthCredential, right: AuthCredential): boolean {
 	if (left.type !== right.type) return false;
@@ -189,6 +206,19 @@ export class CredentialPool implements CredentialsApi {
 		}
 	}
 
+	/**
+	 * Take over the subscribers, buffered disable events, and generation counter of
+	 * the pool this one replaces (store swap). Listener sets are shared, so
+	 * unsubscribe functions handed out by `previous` keep working.
+	 */
+	adoptSubscribers(previous: CredentialPool): void {
+		this.#credentialDisabledListeners = previous.#credentialDisabledListeners;
+		this.#generationListeners = previous.#generationListeners;
+		this.#pendingDisabledEvents = previous.#pendingDisabledEvents;
+		previous.#pendingDisabledEvents = [];
+		this.#generation = previous.#generation;
+	}
+
 	onGeneration(listener: (generation: number) => void): () => void {
 		this.#generationListeners.add(listener);
 		return () => {
@@ -430,7 +460,7 @@ export class CredentialPool implements CredentialsApi {
 		const updated = entries.filter((_value, idx) => idx !== index);
 		this.replace(provider, updated);
 		this.reset(provider);
-		this.emitDisabled({ provider, disabledCause });
+		this.emitDisabled(credentialDisabledEvent(provider, target, disabledCause));
 		return true;
 	}
 
@@ -481,6 +511,9 @@ export class CredentialPool implements CredentialsApi {
 	}
 
 	emitDisabled(event: CredentialDisabledEvent): void {
+		// Every automatic disable leaves a log line, with or without subscribers: the event
+		// alone left nothing on disk once a session had moved on to a sibling account.
+		logger.warn("Auth credential disabled", { ...event });
 		if (this.#credentialDisabledListeners.size === 0) {
 			// No subscribers — buffer for later replay. Cap the backlog so a process that runs
 			// without subscribers for a long time can't grow memory unboundedly; drop oldest
@@ -721,7 +754,7 @@ export class CredentialPool implements CredentialsApi {
 			const next = entries.filter((_value, idx) => idx !== index);
 			this.replace(provider, next);
 			this.reset(provider);
-			this.emitDisabled({ provider, disabledCause });
+			this.emitDisabled(credentialDisabledEvent(provider, entries[index]!, disabledCause));
 			return true;
 		}
 		return false;

package/src/auth/refresh.ts

@@ -4,7 +4,7 @@ import { getOAuthProvider, normalizeOAuthCredentialExpiry, refreshOAuthToken } f
 import type { OAuthCredentials, OAuthProvider } from "../registry/oauth/types";
 import type { Provider } from "../types";
 import { raceSignal } from "./abort";
-import { authCredentialEquals, type CredentialPool } from "./pool";
+import { authCredentialEquals, type CredentialPool, credentialDisabledEvent } from "./pool";
 import type { AccountPolicies } from "./policy";
 import { resolveCredentialIdentityKey, serializeCredential } from "./sqlite-credential-store";
 import { hasRefreshLeases, type AuthCredentialStore } from "./store";
@@ -226,7 +226,7 @@ export class OAuthRefresher {
 									})),
 							);
 							this.#deps.pool.reset(provider);
-							this.#deps.pool.emitDisabled({ provider, disabledCause });
+							this.#deps.pool.emitDisabled(credentialDisabledEvent(provider, row, disabledCause));
 							return { credential: undefined, refreshed: false, removed: true };
 						}
 						await this.#deps.pool.reload();

package/src/auth/types.ts

@@ -300,9 +300,11 @@ export interface AuthCredentialSnapshot {
 /**
  * Event payload describing a credential that was just soft-disabled.
  *
- * Today the only call site is OAuth refresh failures with a definitive cause
- * (`invalid_grant`, `401/403` not from a network blip, etc.) — the
- * disabled_cause string is the verbatim error captured for forensics.
+ * Fired for automatic disables: a definitive OAuth refresh failure
+ * (`invalid_grant`, `401/403` not from a network blip, etc.), an upstream
+ * token invalidation, and an auth-broker disable. The disabled_cause string is
+ * the verbatim error captured for forensics. Every emission is also logged as
+ * a warning.
  *
  * Subscribers can use this to surface a notification, banner, or auto-launch
  * a re-login flow instead of letting the credential silently disappear.
@@ -310,6 +312,14 @@ export interface AuthCredentialSnapshot {
 export interface CredentialDisabledEvent {
 	provider: string;
 	disabledCause: string;
+	/** Database row id of the disabled credential (matches {@link StoredAuthCredential.id}). */
+	credentialId?: number;
+	/** Account identity recorded on the disabled OAuth credential, when the provider supplied one. */
+	email?: string;
+	accountId?: string;
+	/** Organization/workspace the credential was scoped to (Anthropic/ChatGPT multi-subscription). */
+	orgId?: string;
+	orgName?: string;
 }
 
 /** Configuration supplied when constructing credential storage. */
@@ -330,10 +340,10 @@ export type AuthStorageOptions = {
 	configValueResolver?: (config: string) => Promise<string | undefined>;
 	/**
 	 * Optional callback fired when AuthStorage automatically disables a
-	 * credential because something detected it as no longer usable — today
-	 * that's the OAuth refresh-failure path in `getApiKey`. NOT fired for
-	 * user-initiated `remove()` (the user already knows) or dedup of
-	 * duplicate credentials (uninteresting hygiene).
+	 * credential because something detected it as no longer usable (see
+	 * {@link CredentialDisabledEvent}). NOT fired for user-initiated `remove()`
+	 * (the user already knows) or dedup of duplicate credentials
+	 * (uninteresting hygiene).
 	 */
 	onCredentialDisabled?: (event: CredentialDisabledEvent) => void | Promise<void>;
 	/**

package/src/auth/usage.ts

@@ -151,6 +151,11 @@ export class UsageService implements UsageApi {
 		});
 		this.#deps.cache.invalidateForProvider(provider);
 	}
+	/** Carry runtime usage provider overrides over from the service this one replaces (store swap). */
+	adoptRuntimeProviders(previous: UsageService): void {
+		this.#runtimeUsageProviderOverrides = previous.#runtimeUsageProviderOverrides;
+	}
+
 	/** Remove a runtime usage provider override and restore configured/default resolution. */
 	removeProvider(provider: Provider): void {
 		if (!this.#runtimeUsageProviderOverrides.has(provider)) return;

package/src/auth-broker/discover.ts

@@ -19,9 +19,11 @@ import {
 import { YAML } from "bun";
 import {
 	type AuthAccountPolicies,
+	type AuthCredentialStore,
 	AuthStorage,
 	type AuthStorageOptions,
 	DEFAULT_USAGE_RESERVE_PCT,
+	SqliteAuthCredentialStore,
 } from "../auth-storage";
 import * as AIError from "../error";
 import { AuthBrokerClient, AuthBrokerError } from "./client";
@@ -363,23 +365,32 @@ export async function resolveAuthBrokerConfig(
 	return { url, token };
 }
 
+export interface OpenAuthCredentialStoreOptions {
+	/** Broker to connect to; `null` opens the local SQLite store under `agentDir`. */
+	brokerConfig: AuthBrokerClientConfig | null;
+	agentDir?: string;
+	cachePath?: string;
+	sourceLabel?: string;
+	/** Programmatic pool for SDK hosts. Takes precedence over the environment file. */
+	accountPool?: AuthBrokerAccountPool;
+}
+
+/** Credential store opened by {@link openAuthCredentialStore} plus its diagnostics label. */
+export interface OpenedAuthCredentialStore {
+	store: AuthCredentialStore;
+	sourceLabel: string;
+}
+
 /**
- * Create an AuthStorage instance, using the broker when configured and falling
- * back to the local SQLite store otherwise. This is the single source of truth
- * for the TUI and the catalog generator.
+ * Open the credential store {@link discoverAuthStorage} would use for
+ * `brokerConfig`: the remote broker store (fails fast when the broker has no
+ * usable snapshot) or the local SQLite store. Also feeds
+ * {@link AuthStorage.replaceStore} when broker settings change at runtime.
  */
-export async function discoverAuthStorage(options: DiscoverAuthStorageOptions = {}): Promise<AuthStorage> {
-	const agentDir = options.agentDir ?? getAgentDir();
-	const brokerConfig = await resolveAuthBrokerConfig({
-		agentDir,
-		configValueResolver: options.configValueResolver,
-	});
-	const { accountPolicies, defaultReservePct } = await loadAuthAccountPolicyConfig({
-		agentDir,
-		accountPolicies: options.accountPolicies,
-		usageReservePct: options.authStorageOptions?.defaultReservePct,
-	});
-
+export async function openAuthCredentialStore(
+	options: OpenAuthCredentialStoreOptions,
+): Promise<OpenedAuthCredentialStore> {
+	const brokerConfig = options.brokerConfig;
 	if (brokerConfig) {
 		const accountPool = options.accountPool ?? (await loadAuthBrokerAccountPool());
 		const client = new AuthBrokerClient({ url: brokerConfig.url, token: brokerConfig.token });
@@ -437,22 +448,41 @@ export async function discoverAuthStorage(options: DiscoverAuthStorageOptions =
 			onSnapshot: persist,
 			accountPool,
 		});
-		const storage = new AuthStorage(store, {
-			...options.authStorageOptions,
-			configValueResolver: options.configValueResolver,
-			sourceLabel: options.sourceLabel ?? `broker ${brokerConfig.url}`,
-			accountPolicies,
-			defaultReservePct,
-		});
-		await storage.credentials.reload();
-		return storage;
+		return { store, sourceLabel: options.sourceLabel ?? `broker ${brokerConfig.url}` };
 	}
 
-	const dbPath = getAgentDbPath(agentDir);
-	const storage = await AuthStorage.create(dbPath, {
+	const dbPath = getAgentDbPath(options.agentDir ?? getAgentDir());
+	const store = await SqliteAuthCredentialStore.open(dbPath);
+	return { store, sourceLabel: options.sourceLabel ?? `local ${dbPath}` };
+}
+
+/**
+ * Create an AuthStorage instance, using the broker when configured and falling
+ * back to the local SQLite store otherwise. This is the single source of truth
+ * for the TUI and the catalog generator.
+ */
+export async function discoverAuthStorage(options: DiscoverAuthStorageOptions = {}): Promise<AuthStorage> {
+	const agentDir = options.agentDir ?? getAgentDir();
+	const brokerConfig = await resolveAuthBrokerConfig({
+		agentDir,
+		configValueResolver: options.configValueResolver,
+	});
+	const { accountPolicies, defaultReservePct } = await loadAuthAccountPolicyConfig({
+		agentDir,
+		accountPolicies: options.accountPolicies,
+		usageReservePct: options.authStorageOptions?.defaultReservePct,
+	});
+	const { store, sourceLabel } = await openAuthCredentialStore({
+		brokerConfig,
+		agentDir,
+		cachePath: options.cachePath,
+		sourceLabel: options.sourceLabel,
+		accountPool: options.accountPool,
+	});
+	const storage = new AuthStorage(store, {
 		...options.authStorageOptions,
 		configValueResolver: options.configValueResolver,
-		sourceLabel: options.sourceLabel ?? `local ${dbPath}`,
+		sourceLabel,
 		accountPolicies,
 		defaultReservePct,
 	});

package/src/auth-storage.ts

@@ -33,7 +33,9 @@ import { CredentialSelector } from "./auth/select";
 import { SqliteAuthCredentialStore } from "./auth/sqlite-credential-store";
 import type { AuthCredentialStore } from "./auth/store";
 import type {
+	AuthAccountPolicies,
 	AuthApiKeyOptions,
+	AuthCredential,
 	AuthStorageOptions,
 	BlocksApi,
 	CredentialsApi,
@@ -54,36 +56,120 @@ export { isSqliteBusyError, isSqliteCorruptionError, SqliteAuthCredentialStore }
 export * from "./auth/store";
 export * from "./auth/types";
 
+/** Store-bound credential modules; rebuilt as a unit by {@link AuthStorage.replaceStore}. */
+interface AuthStorageModules {
+	pool: CredentialPool;
+	keys: KeyCascade;
+	oauth: OAuthAccounts;
+	sessions: SessionAffinity;
+	usage: UsageService;
+	health: CredentialHealth;
+	limits: RateLimits;
+	resets: ResetCredits;
+	blocks: CredentialBlocks;
+}
+
 /**
  * Credential management over an {@link AuthCredentialStore}: multi-account
  * selection with usage-aware ranking, rate-limit blocks, OAuth refresh, and
  * usage reporting. See the module doc for the namespace layout.
+ *
+ * Namespaces resolve against the current store on every access, so holders of
+ * this instance follow {@link AuthStorage.replaceStore} without re-wiring.
  */
 export class AuthStorage {
+	readonly #options: AuthStorageOptions;
+	readonly #overrides: KeyOverrides;
+	readonly #policies: AccountPolicies;
+	#modules: AuthStorageModules;
+
+	constructor(store: AuthCredentialStore, options: AuthStorageOptions = {}) {
+		this.#options = options;
+		this.#overrides = new KeyOverrides(options.configValueResolver);
+		this.#policies = new AccountPolicies(options.accountPolicies ?? [], options.defaultReservePct);
+		this.#modules = this.#compose(store, options.sourceLabel);
+		if (options.onCredentialDisabled) this.#modules.pool.onDisabled(options.onCredentialDisabled);
+	}
+
 	/** Stored credential rows, change/disable events, broker snapshot. */
-	readonly credentials: CredentialsApi;
+	get credentials(): CredentialsApi {
+		return this.#modules.pool;
+	}
 	/** Provider auth cascade and key overrides. */
-	readonly keys: KeysApi;
+	get keys(): KeysApi {
+		return this.#modules.keys;
+	}
 	/** OAuth login, account access, listings, refresh. */
-	readonly oauth: OAuthApi;
+	get oauth(): OAuthApi {
+		return this.#modules.oauth;
+	}
 	/** Session → account pins. */
-	readonly sessions: SessionsApi;
+	get sessions(): SessionsApi {
+		return this.#modules.sessions;
+	}
 	/** Usage reports, header ingestion, history. */
-	readonly usage: UsageApi;
+	get usage(): UsageApi {
+		return this.#modules.usage;
+	}
 	/** Model pool health and per-credential probes. */
-	readonly health: HealthApi;
+	get health(): HealthApi {
+		return this.#modules.health;
+	}
 	/** Usage-limit marking and credential rotation. */
-	readonly limits: LimitsApi;
+	get limits(): LimitsApi {
+		return this.#modules.limits;
+	}
 	/** Saved rate-limit resets. */
-	readonly resets: ResetsApi;
+	get resets(): ResetsApi {
+		return this.#modules.resets;
+	}
 	/** Persisted rate-limit blocks (auth-broker server seam). */
-	readonly blocks: BlocksApi;
-	#pool: CredentialPool;
+	get blocks(): BlocksApi {
+		return this.#modules.blocks;
+	}
 
-	constructor(store: AuthCredentialStore, options: AuthStorageOptions = {}) {
-		const overrides = new KeyOverrides(options.configValueResolver);
-		const policies = new AccountPolicies(options.accountPolicies ?? [], options.defaultReservePct);
-		const blockHealth = new BlockStoreHealth(options.sourceLabel);
+	/**
+	 * Apply new account routing policy (live `auth.accountPolicies` /
+	 * `retry.usageReservePct` change). Throws a configuration error, leaving the
+	 * active policy untouched, when the policy is malformed or does not match the
+	 * stored OAuth accounts.
+	 */
+	setAccountPolicies(config: { accountPolicies: AuthAccountPolicies; defaultReservePct: number }): void {
+		const pool = this.#modules.pool;
+		const stored = new Map<string, AuthCredential[]>();
+		for (const provider of pool.providers()) stored.set(provider, pool.credentials(provider));
+		this.#policies.replace(config.accountPolicies, config.defaultReservePct, stored);
+	}
+
+	/**
+	 * Swap the backing credential store in place (live `auth.broker.url` change).
+	 * Loads `store` into fresh store-bound state — pins, blocks, and usage caches are
+	 * keyed by the old store's row ids — then closes the previous store. Runtime key
+	 * overrides, account policies, usage-provider overrides, and credential event
+	 * subscribers carry over. On a load failure `store` is closed and the current
+	 * store stays active.
+	 */
+	async replaceStore(store: AuthCredentialStore, options: { sourceLabel?: string } = {}): Promise<void> {
+		const next = this.#compose(store, options.sourceLabel ?? this.#options.sourceLabel);
+		try {
+			await next.pool.reload();
+		} catch (error) {
+			next.pool.close();
+			throw error;
+		}
+		const previous = this.#modules;
+		next.pool.adoptSubscribers(previous.pool);
+		next.usage.adoptRuntimeProviders(previous.usage);
+		this.#modules = next;
+		previous.pool.close();
+		next.pool.bump("store-replaced");
+	}
+
+	#compose(store: AuthCredentialStore, sourceLabel: string | undefined): AuthStorageModules {
+		const options = this.#options;
+		const overrides = this.#overrides;
+		const policies = this.#policies;
+		const blockHealth = new BlockStoreHealth(sourceLabel);
 		const strategies = options.rankingStrategyResolver ?? defaultRankingStrategy;
 		const pool = new CredentialPool(store, {
 			policies,
@@ -134,32 +220,32 @@ export class AuthStorage {
 			selector,
 			affinity,
 			rotate: (provider, sessionId, rotateOptions) => limits.rotate(provider, sessionId, rotateOptions),
-			sourceLabel: options.sourceLabel,
+			sourceLabel,
 		});
 		const oauth = new OAuthAccounts({ pool, overrides, policies, selector, affinity, refresher });
 
-		this.#pool = pool;
-		this.credentials = pool;
-		this.keys = keys;
-		this.oauth = oauth;
-		this.sessions = affinity;
-		this.usage = usage;
-		this.health = new CredentialHealth({
-			store,
+		return {
 			pool,
 			keys,
-			policies,
-			blocks,
-			affinity,
+			oauth,
+			sessions: affinity,
 			usage,
-			refresher,
-			overrides,
-			strategies,
-		});
-		this.limits = limits;
-		this.resets = new ResetCredits({ store, pool, oauth, usage, usageCache, blocks });
-		this.blocks = blocks;
-		if (options.onCredentialDisabled) pool.onDisabled(options.onCredentialDisabled);
+			health: new CredentialHealth({
+				store,
+				pool,
+				keys,
+				policies,
+				blocks,
+				affinity,
+				usage,
+				refresher,
+				overrides,
+				strategies,
+			}),
+			limits,
+			resets: new ResetCredits({ store, pool, oauth, usage, usageCache, blocks }),
+			blocks,
+		};
 	}
 
 	/** Open the SQLite store at `dbPath` and wrap it (standalone use, e.g. the pi-ai CLI). */
@@ -170,7 +256,7 @@ export class AuthStorage {
 
 	/** Close the underlying credential store; the instance must not be reused. */
 	close(): void {
-		this.#pool.close();
+		this.#modules.pool.close();
 	}
 
 	/**

package/src/error/flags.ts

@@ -659,7 +659,8 @@ export function classify(error: unknown, api?: Api): number {
 				code === "usage_limit_reached" ||
 				(code === "insufficient_quota" && !isDashScopeTokenLimitText(link.message)) ||
 				(codeStatus === 402 &&
-					(code === "payment_required" || code === "deactivated_workspace" || is402BillingCapBody(link.message)))
+					(is402BillingCapBody(link.message) ||
+						(code !== undefined && !isOpaqueStatusBody(code) && is402BillingCapBody(code))))
 			) {
 				linkKinds |= Flag.UsageLimit;
 			}

package/src/error/rate-limit.ts

@@ -37,7 +37,10 @@ const CREDITS_EXHAUSTED_PATTERN =
 // in unrelated diagnostics ("Failed to fetch usage credits from billing
 // service"), which must not rotate a healthy credential.
 const ANTHROPIC_CREDITS_REQUIRED_PATTERN = /\busage credits are required\b|\bcredits_required\b/i;
-const SPEND_LIMIT_PATTERN = /spend.?limit/i;
+// Account billing ceilings: Anthropic "monthly spend limit" (#4787) and Google
+// "Your project has exceeded its monthly spending cap" (#13090). The `\b` after
+// `cap` keeps "spending capacity" — a throttle, not a billing ceiling — out.
+const SPEND_LIMIT_PATTERN = /spend(?:ing)?[\s_-]?(?:limit|cap)\b/i;
 const SUBSCRIPTION_CAP_PATTERN =
 	/\b(?:subscription|plan|membership)\b[^\n]{0,80}\b(?:rate.?limits?|quota|cap)\b|\b(?:rate.?limits?|quota|cap)\b[^\n]{0,80}\b(?:subscription|plan|membership)\b/i;
 const TRANSIENT_INTERVAL_RATE_LIMIT_PATTERN = /\bper\s+(?:second|minute)\b/i;
@@ -313,8 +316,9 @@ const USAGE_LIMIT_PATTERN =
  * account-local usage cap rather than a bad credential or a transient blip.
  * HTTP 402 Payment Required represents an account-billing cap (xAI
  * Grok Build "usage balance exhausted", DeepSeek "Insufficient Balance",
- * OpenRouter credit exhaustion) when opaque, payment/deactivation/balance-worded,
- * or QUOTA_EXHAUSTED/CONCURRENT_LIMIT, while informative non-quota 402s (e.g.
+ * OpenCode Go "Insufficient account funds", OpenRouter credit exhaustion)
+ * when opaque, payment/deactivation/balance/funds-worded, or
+ * QUOTA_EXHAUSTED/CONCURRENT_LIMIT. Informative non-quota 402s (e.g.
  * endpoint subscription requirements) remain non-usage-limits. Always combine
  * with {@link isUsageLimitOutcome} when a message is available.
  */
@@ -322,7 +326,7 @@ export function isUsageLimitStatus(status: number | undefined): boolean {
 	return status === 429 || status === 402;
 }
 const STATUS_402_QUOTA_PATTERN =
-	/\b(?:payment(?:\s+is)?[-_.\s]*required|deactivated_workspace|insufficient.?balance)\b/i;
+	/\b(?:payment(?:\s+is)?[-_.\s]*required|deactivated_workspace|insufficient.?(?:balance|account.?funds))\b/i;
 
 export function is402BillingCapBody(message: string | undefined): boolean {
 	if (message === undefined || isOpaqueStatusBody(message)) return true;

package/src/index.ts

@@ -22,6 +22,7 @@ export * from "./providers/anthropic-identity";
 export * from "./providers/anthropic-state";
 export type * from "./providers/anthropic-client";
 export * from "./providers/anthropic-user-profiles";
+export * from "./providers/anthropic-slow-mode";
 export type * from "./providers/apple-foundation-models";
 export type * from "./providers/azure-openai-responses";
 export type * from "./providers/cursor";