@oh-my-pi/pi-ai 18.6.3 → 18.7.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [18.7.0] - 2026-10-06
+
+### Added
+
+- Added `getOAuthCredentialProvider()` to resolve login aliases, such as `openai-codex-device`, to the provider where their credentials are stored.
+
+### Fixed
+
+- Fixed Ultrafast service-tier billing and usage accounting: GPT-6 Astra now applies its published premium rates—6× on the OpenAI API and 8× included usage on Codex—and is counted toward the premium-request limit.
+- Fixed Vertex AI authentication on Windows when credentials are created with `gcloud auth application-default login`.
+- Fixed selecting Cursor accounts by email through `auth.accountPolicies` and `/session pin`; newly refreshed and existing accounts now retain the account email.
+
 ## [18.6.3] - 2026-10-06
 
 ### Added

package/dist/types/images/index.d.ts

@@ -1,4 +1,4 @@
-import type { Api, Model } from "@oh-my-pi/pi-catalog/types";
+import { type Api, type ImageGenerationApi, type Model } from "@oh-my-pi/pi-catalog/types";
 import type { ImageGenerationOptions, ImageGenerationRequest, ImageGenerationResult } from "./types.js";
 export * from "./google-antigravity.js";
 export * from "./google-generative-ai.js";
@@ -6,8 +6,7 @@ export * from "./openai-hosted.js";
 export * from "./openai-images.js";
 export * from "./openrouter-images.js";
 export * from "./types.js";
-/** Catalog APIs {@link generateImage} serves; the hosted Responses pair needs an explicit carrier model. */
-export type ImageGenerationApi = "openai-images" | "openrouter-images" | "google-generative-ai" | "google-gemini-cli" | "openai-responses" | "openai-codex-responses";
+export type { ImageGenerationApi } from "@oh-my-pi/pi-catalog/types";
 /** Whether a catalog API generates images through one of the pi-ai image clients. */
 export declare function isImageGenerationApi(api: Api): api is ImageGenerationApi;
 /** Generate (or edit, when `request.inputImages` is set) images through the transport selected by the model's `api`. */

package/dist/types/providers/google-auth.d.ts

@@ -5,13 +5,16 @@
  * Sources, in priority order:
  *   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)
  *     or `type: "authorized_user"` (refresh-token exchange).
- *   2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).
+ *   2. gcloud user ADC: `%APPDATA%\gcloud\application_default_credentials.json` on Windows,
+ *     `~/.config/gcloud/application_default_credentials.json` elsewhere (authorized_user flow).
  *   3. GCE / Cloud Run metadata server (`metadata.google.internal`).
  *
  * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry
  * (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.
  */
 import type { FetchImpl } from "../types.js";
+/** gcloud's user ADC file: `%APPDATA%\gcloud\…` on Windows, `~/.config/gcloud/…` elsewhere. */
+export declare function userAdcPath(platform?: typeof process.platform, appData?: string | undefined): string;
 /**
  * Returns a Bearer access token suitable for the `Authorization` header on Vertex AI calls.
  * The token is cached in module scope and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` ms before it expires.

package/dist/types/providers/mock.d.ts

@@ -41,7 +41,7 @@
  *   // Inspect calls afterwards.
  *   expect(mock.calls).toHaveLength(2);
  */
-import type { AnthropicFallbackCreditHandle, Api, Context, Model, SimpleStreamOptions, StopDetails, StopReason, Usage } from "../types.js";
+import type { AnthropicFallbackCreditHandle, Api, Context, Model, ServiceTier, SimpleStreamOptions, StopDetails, StopReason, Usage } from "../types.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 /** The API string this provider serves. */
 export declare const MOCK_API: "mock";
@@ -78,6 +78,8 @@ export interface MockResponse {
     usage?: Partial<Omit<Usage, "cost">> & {
         cost?: Partial<Usage["cost"]>;
     };
+    /** Service tier the mock reports serving the turn, as a real provider's response echo would. */
+    serviceTier?: ServiceTier;
     /** Pre-set responseId. */
     responseId?: string;
     /** If set, the stream emits a terminal error event instead of completing. */

package/dist/types/providers/openai-responses-wire.d.ts

@@ -906,60 +906,6 @@ export declare namespace Response {
              */
             type: "error";
         }
-        /**
-         * A moderation result produced for the response input or output.
-         */
-        interface ModerationResult {
-            /**
-             * A dictionary of moderation categories to booleans, True if the input is flagged
-             * under this category.
-             */
-            categories: {
-                [key: string]: boolean;
-            };
-            /**
-             * Which modalities of input are reflected by the score for each category.
-             */
-            category_applied_input_types: {
-                [key: string]: Array<"text" | "image">;
-            };
-            /**
-             * A dictionary of moderation categories to scores.
-             */
-            category_scores: {
-                [key: string]: number;
-            };
-            /**
-             * A boolean indicating whether the content was flagged by any category.
-             */
-            flagged: boolean;
-            /**
-             * The moderation model that produced this result.
-             */
-            model: string;
-            /**
-             * The object type, which was always `moderation_result` for successful moderation
-             * results.
-             */
-            type: "moderation_result";
-        }
-        /**
-         * An error produced while attempting moderation for the response input or output.
-         */
-        interface Error {
-            /**
-             * The error code.
-             */
-            code: string;
-            /**
-             * The error message.
-             */
-            message: string;
-            /**
-             * The object type, which was always `error` for moderation failures.
-             */
-            type: "error";
-        }
     }
 }
 /**

package/dist/types/providers/openai-shared.d.ts

@@ -76,8 +76,11 @@ export declare function applyOpenAIServiceTier(params: {
  * resolved request tier. Scoped to `provider: "openai"` (the only standard
  * Responses biller) so an echoed `service_tier` from an Azure/OpenRouter/Copilot
  * proxy can never skew those costs.
+ *
+ * Returns the tier the turn ran on for the caller to record on the message, and
+ * counts the premium request the tier bills.
  */
-export declare function applyOpenAIResponsesServiceTierCost(model: Pick<Model, "provider" | "serviceTierCost">, usage: AssistantMessage["usage"], responseServiceTier: unknown, requestServiceTier: ServiceTier | null | undefined): void;
+export declare function applyOpenAIResponsesServiceTierCost(model: Pick<Model, "provider" | "serviceTierCost" | "api" | "identity">, usage: AssistantMessage["usage"], responseServiceTier: unknown, requestServiceTier: ServiceTier | null | undefined): ServiceTier | undefined;
 /**
  * Reconcile token-price estimates with a gateway's authoritative account charge.
  * BYOK turns (`is_byok: true`) price from the provider spend in

package/dist/types/registry/oauth/cursor.d.ts

@@ -1,3 +1,4 @@
+import type { FetchImpl } from "../../types.js";
 import type { OAuthController, OAuthCredentials } from "./types.js";
 export interface CursorAuthParams {
     verifier: string;
@@ -13,6 +14,13 @@ export declare function pollCursorAuth(uuid: string, verifier: string): Promise<
 export declare function loginCursor(onAuthUrl: (url: string) => void, onPollStart?: () => void): Promise<OAuthCredentials>;
 export declare function loginCursorHook(callbacks: OAuthController): Promise<OAuthCredentials>;
 export declare function refreshCursorToken(apiKeyOrRefreshToken: string): Promise<OAuthCredentials>;
-export declare function refreshCursorHook(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+export declare function refreshCursorHook(credentials: OAuthCredentials, signal?: AbortSignal): Promise<OAuthCredentials>;
+/** Request headers that present `accessToken` to cursor.com as its user's web session. */
+export declare function cursorSessionHeaders(userId: string, accessToken: string): Record<string, string>;
+/**
+ * Email of the Cursor account that owns `accessToken`, read from its cursor.com
+ * profile. Undefined when the token names no user or the profile names another.
+ */
+export declare function fetchCursorAccountEmail(accessToken: string, fetchImpl?: FetchImpl, signal?: AbortSignal): Promise<string | undefined>;
 export declare function extractCursorAccessTokenUserId(accessToken: string): string | undefined;
 export declare function isCursorTokenExpiringSoon(token: string, thresholdSeconds?: number): boolean;

package/dist/types/registry/oauth/index.d.ts

@@ -43,3 +43,5 @@ export declare function getOAuthApiKey(provider: OAuthProvider, credentials: Rec
  * Get list of OAuth providers.
  */
 export declare function getOAuthProviders(): OAuthProviderInfo[];
+/** Provider id that stores `providerId`'s credentials: login aliases (`openai-codex-device`) map to their target (`openai-codex`). */
+export declare function getOAuthCredentialProvider(providerId: string): string;

package/dist/types/types.d.ts

@@ -157,18 +157,31 @@ export declare function shouldSendServiceTier(serviceTier: ServiceTier | null |
  */
 export declare function realizesPriorityServiceTier(serviceTier: ServiceTier | null | undefined, model: ServiceTierModel): boolean;
 /**
- * Premium-request weight contributed by a priority request to a provider that
- * realizes it and bills extra. Mirrors GitHub Copilot's `premiumRequests`
- * accounting so the "premium requests" stat aggregates priority traffic across
- * the OpenAI family, direct Anthropic fast mode, and Google priority.
+ * Premium-request weight contributed by a request a provider bills above
+ * standard. Priority (Fast mode) counts 1 on every provider that realizes it;
+ * `ultrafast` counts 1 on the OpenAI family, where it is a premium serving tier
+ * (its cost premium is recorded separately in `usage.cost`). Mirrors GitHub
+ * Copilot's `premiumRequests` accounting so the "premium requests" stat
+ * aggregates premium traffic across the OpenAI family, direct Anthropic fast
+ * mode, and Google priority.
  *
- * Returns 1 only when priority is actually realized on the wire for `model`
- * (see {@link realizesPriorityServiceTier}) and the provider bills it as a
- * premium request. OpenRouter is excluded — it bills per its own pricing, not
- * Copilot-premium semantics — as are Bedrock/Vertex Claude, where priority is
- * silently dropped.
+ * Returns 1 only when the tier is actually realized on the wire for `model`
+ * (see {@link realizesPriorityServiceTier} and {@link shouldSendServiceTier})
+ * and the provider bills it as a premium request. OpenRouter is excluded — it
+ * bills per its own pricing, not Copilot-premium semantics — as are
+ * Bedrock/Vertex Claude, where priority is silently dropped.
+ *
+ * Pass `served: true` when the tier is the one the provider reported serving
+ * (an assistant message's {@link AssistantMessage.serviceTier}) rather than a
+ * requested setting: realization is then already proven, so the wire gate is
+ * skipped and a model without discovery metadata (a stats-backfill row) still
+ * counts.
  */
-export declare function getPriorityPremiumRequests(serviceTier: ServiceTier | null | undefined, model: ServiceTierModel): number;
+export declare function getPremiumServiceTierRequests(serviceTier: ServiceTier | null | undefined, model: ServiceTierModel, options?: {
+    served?: boolean;
+}): number;
+/** Parse a provider-reported `service_tier` echo into a known tier, or `undefined` for anything else. */
+export declare function parseServiceTier(value: unknown): ServiceTier | undefined;
 /**
  * Coerce a persisted service-tier value to a {@link ServiceTierByFamily}. Newer
  * sessions store the family map directly; legacy sessions stored a single
@@ -965,6 +978,15 @@ export interface AssistantMessage {
      * other than what was requested.
      */
     upstreamModel?: string;
+    /**
+     * Service tier the provider reported serving this turn, when the API echoes
+     * one (`response.service_tier`), falling back to the tier the request carried
+     * when the response omits the echo. Absent when the provider reports no tier
+     * or the echo cannot be trusted (proxies). This is the tier the turn actually
+     * ran on, which is what cost, premium-request, and speed accounting key on —
+     * the session's live setting may already have changed.
+     */
+    serviceTier?: ServiceTier;
     usage: Usage;
     stopReason: StopReason;
     stopDetails?: StopDetails | null;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.6.3",
+	"version": "18.7.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.6.3",
-		"@oh-my-pi/pi-catalog": "18.6.3",
-		"@oh-my-pi/pi-natives": "18.6.3",
-		"@oh-my-pi/pi-utils": "18.6.3",
-		"@oh-my-pi/pi-wire": "18.6.3"
+		"@oh-my-pi/omptype": "18.7.0",
+		"@oh-my-pi/pi-catalog": "18.7.0",
+		"@oh-my-pi/pi-natives": "18.7.0",
+		"@oh-my-pi/pi-utils": "18.7.0",
+		"@oh-my-pi/pi-wire": "18.7.0"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/images/index.ts

@@ -1,4 +1,4 @@
-import type { Api, Model } from "@oh-my-pi/pi-catalog/types";
+import { type Api, IMAGE_GENERATION_APIS, type ImageGenerationApi, type Model } from "@oh-my-pi/pi-catalog/types";
 import * as AIError from "../error";
 import { generateAntigravityImage } from "./google-antigravity";
 import { generateGoogleImage } from "./google-generative-ai";
@@ -14,25 +14,11 @@ export * from "./openai-images";
 export * from "./openrouter-images";
 export * from "./types";
 
-/** Catalog APIs {@link generateImage} serves; the hosted Responses pair needs an explicit carrier model. */
-export type ImageGenerationApi =
-	| "openai-images"
-	| "openrouter-images"
-	| "google-generative-ai"
-	| "google-gemini-cli"
-	| "openai-responses"
-	| "openai-codex-responses";
+export type { ImageGenerationApi } from "@oh-my-pi/pi-catalog/types";
 
 /** Whether a catalog API generates images through one of the pi-ai image clients. */
 export function isImageGenerationApi(api: Api): api is ImageGenerationApi {
-	return (
-		api === "openai-images" ||
-		api === "openrouter-images" ||
-		api === "google-generative-ai" ||
-		api === "google-gemini-cli" ||
-		api === "openai-responses" ||
-		api === "openai-codex-responses"
-	);
+	return (IMAGE_GENERATION_APIS as readonly Api[]).includes(api);
 }
 
 /** Generate (or edit, when `request.inputImages` is set) images through the transport selected by the model's `api`. */

package/src/providers/google-auth.ts

@@ -5,7 +5,8 @@
  * Sources, in priority order:
  *   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)
  *     or `type: "authorized_user"` (refresh-token exchange).
- *   2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).
+ *   2. gcloud user ADC: `%APPDATA%\gcloud\application_default_credentials.json` on Windows,
+ *     `~/.config/gcloud/application_default_credentials.json` elsewhere (authorized_user flow).
  *   3. GCE / Cloud Run metadata server (`metadata.google.internal`).
  *
  * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry
@@ -66,8 +67,14 @@ function getRefreshSkewMs(): number {
 	return $envpos("GOOGLE_VERTEX_REFRESH_SKEW_MS", 60_000);
 }
 
-function userAdcPath(): string {
-	return path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json");
+/** gcloud's user ADC file: `%APPDATA%\gcloud\…` on Windows, `~/.config/gcloud/…` elsewhere. */
+export function userAdcPath(
+	platform: typeof process.platform = process.platform,
+	appData: string | undefined = Bun.env.APPDATA,
+): string {
+	const gcloudDir =
+		platform === "win32" && appData ? path.join(appData, "gcloud") : path.join(os.homedir(), ".config", "gcloud");
+	return path.join(gcloudDir, "application_default_credentials.json");
 }
 
 async function readJsonFile<T>(filePath: string): Promise<T | undefined> {

package/src/providers/mock.ts

@@ -51,6 +51,7 @@ import type {
 	AssistantMessage,
 	Context,
 	Model,
+	ServiceTier,
 	SimpleStreamOptions,
 	StopDetails,
 	StopReason,
@@ -93,6 +94,8 @@ export interface MockResponse {
 	errorMessage?: string;
 	/** Usage stats. Missing fields default to 0; missing `cost.total` is recomputed from components. */
 	usage?: Partial<Omit<Usage, "cost">> & { cost?: Partial<Usage["cost"]> };
+	/** Service tier the mock reports serving the turn, as a real provider's response echo would. */
+	serviceTier?: ServiceTier;
 	/** Pre-set responseId. */
 	responseId?: string;
 	/** If set, the stream emits a terminal error event instead of completing. */
@@ -409,6 +412,7 @@ async function runMock(
 	partial.fallbackCreditHandle = response.fallbackCreditHandle;
 	partial.errorMessage = response.errorMessage;
 	partial.usage = mergeUsage(response.usage);
+	partial.serviceTier = response.serviceTier;
 	partial.duration = performance.now() - perfStart;
 
 	if (reason === "aborted" || reason === "error") {

package/src/providers/openai-codex-responses.ts

@@ -45,6 +45,7 @@ import type {
 	ToolResultMessage,
 	Usage,
 } from "../types";
+import { getPremiumServiceTierRequests, parseServiceTier } from "../types";
 import {
 	clampOpenAIResponsesImageDetailForReplay,
 	createOpenAIResponsesHistoryPayload,
@@ -1336,9 +1337,11 @@ function getCodexServiceTierCostMultiplier(
 	model: Pick<Model<"openai-codex-responses">, "serviceTierCost">,
 	serviceTier: ServiceTier | "default" | undefined,
 ): number {
-	// `ultrafast` has no published price (API preview, Codex credits), so it is
-	// shown at 1x rather than an invented multiplier.
-	if (serviceTier !== "flex" && serviceTier !== "priority") return 1;
+	// The subscription route draws on included plan usage, so its cost is the
+	// usage-equivalent: each tier's multiplier comes from the catalog table, which
+	// uses OpenAI's included-usage rates (Astra: Fast 2.5x, Ultrafast 8x). A tier
+	// with no entry stays at 1x rather than an invented multiplier.
+	if (serviceTier !== "flex" && serviceTier !== "priority" && serviceTier !== "ultrafast") return 1;
 	return model.serviceTierCost?.[serviceTier] ?? 1;
 }
 
@@ -1346,26 +1349,29 @@ function getCodexServiceTierCostMultiplier(
  * The tier a Codex response was billed at. The response echo is authoritative
  * whenever it reports a tier (the backend may serve a requested priority/flex
  * turn as `default`); the requested tier is used only when the echo is absent.
+ * The tier's identity is preserved even when it has no pricing entry (`scale`),
+ * because the recorded tier also drives premium-request and speed accounting.
  */
-function resolveCodexCostServiceTier(res: ServiceTier | undefined, req?: unknown): ServiceTier | "default" | undefined {
-	const served = res ?? req;
-	return served === "flex" || served === "priority" ? served : "default";
+function resolveCodexCostServiceTier(res: ServiceTier | undefined, req?: unknown): ServiceTier {
+	return res ?? parseServiceTier(req) ?? "default";
 }
 
 function applyCodexServiceTierPricing(
-	model: Pick<Model<"openai-codex-responses">, "serviceTierCost">,
+	model: Pick<Model<"openai-codex-responses">, "provider" | "api" | "identity" | "serviceTierCost">,
 	usage: AssistantMessage["usage"],
 	resTier: ServiceTier | undefined,
 	reqTier: unknown,
-): void {
-	const resolvedTier = resolveCodexCostServiceTier(resTier, reqTier);
+): ServiceTier {
+	const resolvedTier = resolveCodexCostServiceTier(resTier, reqTier) ?? "default";
+	usage.premiumRequests ??= getPremiumServiceTierRequests(resolvedTier, model, { served: true });
 	const multiplier = getCodexServiceTierCostMultiplier(model, resolvedTier);
-	if (multiplier === 1) return;
+	if (multiplier === 1) return resolvedTier;
 	usage.cost.input *= multiplier;
 	usage.cost.output *= multiplier;
 	usage.cost.cacheRead *= multiplier;
 	usage.cost.cacheWrite *= multiplier;
 	usage.cost.total = usage.cost.input + usage.cost.output + usage.cost.cacheRead + usage.cost.cacheWrite;
+	return resolvedTier;
 }
 
 function resetOutputState(output: AssistantMessage): void {
@@ -2667,8 +2673,7 @@ class CodexStreamProcessor {
 		const response = rawResponse && typeof rawResponse === "object" ? rawResponse : undefined;
 		const responseId = response && "id" in response && typeof response.id === "string" ? response.id : undefined;
 		const usage = response && "usage" in response ? parseCodexResponseUsage(response.usage) : undefined;
-		const serviceTier =
-			response && "service_tier" in response ? parseCodexServiceTier(response.service_tier) : undefined;
+		const serviceTier = response && "service_tier" in response ? parseServiceTier(response.service_tier) : undefined;
 		const status = response && "status" in response ? parseCodexResponseStatus(response.status) : undefined;
 		const endTurn = response && "end_turn" in response ? response.end_turn : undefined;
 
@@ -2727,7 +2732,12 @@ class CodexStreamProcessor {
 		finalizePendingResponsesToolCalls(output);
 
 		calculateCost(model, output.usage, output.timestamp);
-		applyCodexServiceTierPricing(model, output.usage, serviceTier, runtime.requestBodyForState.service_tier);
+		output.serviceTier = applyCodexServiceTierPricing(
+			model,
+			output.usage,
+			serviceTier,
+			runtime.requestBodyForState.service_tier,
+		);
 		output.stopReason = mapOpenAIResponsesStopReason(steered ? "completed" : status);
 		promoteResponsesToolUseStopReason(
 			output,
@@ -3557,20 +3567,6 @@ function hashJson(value: unknown): string {
 	return String(Bun.hash(json === undefined ? "undefined" : json));
 }
 
-function parseCodexServiceTier(value: unknown): ServiceTier | undefined {
-	switch (value) {
-		case "auto":
-		case "default":
-		case "flex":
-		case "scale":
-		case "priority":
-		case "ultrafast":
-			return value;
-		default:
-			return undefined;
-	}
-}
-
 function parseCodexResponseStatus(value: unknown): ResponseStatus | undefined {
 	switch (value) {
 		case "completed":

package/src/providers/openai-responses-wire.ts

@@ -925,60 +925,6 @@ export declare namespace Response {
 			 */
 			type: "error";
 		}
-		/**
-		 * A moderation result produced for the response input or output.
-		 */
-		interface ModerationResult {
-			/**
-			 * A dictionary of moderation categories to booleans, True if the input is flagged
-			 * under this category.
-			 */
-			categories: {
-				[key: string]: boolean;
-			};
-			/**
-			 * Which modalities of input are reflected by the score for each category.
-			 */
-			category_applied_input_types: {
-				[key: string]: Array<"text" | "image">;
-			};
-			/**
-			 * A dictionary of moderation categories to scores.
-			 */
-			category_scores: {
-				[key: string]: number;
-			};
-			/**
-			 * A boolean indicating whether the content was flagged by any category.
-			 */
-			flagged: boolean;
-			/**
-			 * The moderation model that produced this result.
-			 */
-			model: string;
-			/**
-			 * The object type, which was always `moderation_result` for successful moderation
-			 * results.
-			 */
-			type: "moderation_result";
-		}
-		/**
-		 * An error produced while attempting moderation for the response input or output.
-		 */
-		interface Error {
-			/**
-			 * The error code.
-			 */
-			code: string;
-			/**
-			 * The error message.
-			 */
-			message: string;
-			/**
-			 * The object type, which was always `error` for moderation failures.
-			 */
-			type: "error";
-		}
 	}
 }
 /**

package/src/providers/openai-shared.ts

@@ -48,6 +48,8 @@ import {
 	type MessageAttribution,
 	type Model,
 	OPENAI_MAX_OUTPUT_TOKENS,
+	getPremiumServiceTierRequests,
+	parseServiceTier,
 	type ServiceTier,
 	type StopReason,
 	type StreamOptions,
@@ -359,14 +361,18 @@ export function applyOpenAIServiceTier(
 /**
  * Standard OpenAI Responses service-tier cost multipliers. The non-Codex
  * Responses path bills the tier it was served (or requested): Flex processing is
- * half price; Priority is a 2x premium. Codex bills the same tiers with its own
- * table (Priority is 2.5x on gpt-5.5) and applies that separately.
+ * half price; Priority (Fast mode) is a 2x premium. Codex bills the same tiers
+ * with its own table (Priority is 2.5x on gpt-5.5) and applies that separately.
+ * `ultrafast` has no API-generic default — only models with a published
+ * ultrafast price carry a `serviceTierCost.ultrafast` entry (Astra, 6x) and
+ * everything else stays at 1x rather than an invented multiplier.
  */
 function getOpenAIResponsesServiceTierCostMultiplier(
 	model: Pick<Model, "serviceTierCost">,
 	tier: string | null | undefined,
 ): number {
-	const resolvedMultiplier = tier === "flex" || tier === "priority" ? model.serviceTierCost?.[tier] : undefined;
+	const resolvedMultiplier =
+		tier === "flex" || tier === "priority" || tier === "ultrafast" ? model.serviceTierCost?.[tier] : undefined;
 	if (resolvedMultiplier !== undefined) return resolvedMultiplier;
 	switch (tier) {
 		case "flex":
@@ -385,25 +391,30 @@ function getOpenAIResponsesServiceTierCostMultiplier(
  * resolved request tier. Scoped to `provider: "openai"` (the only standard
  * Responses biller) so an echoed `service_tier` from an Azure/OpenRouter/Copilot
  * proxy can never skew those costs.
+ *
+ * Returns the tier the turn ran on for the caller to record on the message, and
+ * counts the premium request the tier bills.
  */
 export function applyOpenAIResponsesServiceTierCost(
-	model: Pick<Model, "provider" | "serviceTierCost">,
+	model: Pick<Model, "provider" | "serviceTierCost" | "api" | "identity">,
 	usage: AssistantMessage["usage"],
 	responseServiceTier: unknown,
 	requestServiceTier: ServiceTier | null | undefined,
-): void {
-	if (model.provider !== "openai") return;
+): ServiceTier | undefined {
+	if (model.provider !== "openai") return undefined;
 	// The response echo is authoritative when present (OpenAI may downgrade a
 	// requested priority/flex turn to default under load); only fall back to the
 	// requested tier when the response omits the echo entirely.
-	const served = typeof responseServiceTier === "string" ? responseServiceTier : (requestServiceTier ?? undefined);
+	const served = parseServiceTier(responseServiceTier) ?? requestServiceTier ?? undefined;
+	usage.premiumRequests ??= getPremiumServiceTierRequests(served, model);
 	const multiplier = getOpenAIResponsesServiceTierCostMultiplier(model, served);
-	if (multiplier === 1) return;
+	if (multiplier === 1) return served;
 	usage.cost.input *= multiplier;
 	usage.cost.output *= multiplier;
 	usage.cost.cacheRead *= multiplier;
 	usage.cost.cacheWrite *= multiplier;
 	usage.cost.total = usage.cost.input + usage.cost.output + usage.cost.cacheRead + usage.cost.cacheWrite;
+	return served;
 }
 
 /**
@@ -3693,7 +3704,7 @@ export async function processResponsesStream<TApi extends Api>(
 			populateResponsesUsageFromResponse(output, response?.usage);
 			calculateCost(model, output.usage, output.timestamp);
 			applyProviderReportedCost(model, output.usage, response?.usage);
-			applyOpenAIResponsesServiceTierCost(
+			output.serviceTier = applyOpenAIResponsesServiceTierCost(
 				model,
 				output.usage,
 				(response as { service_tier?: unknown } | undefined)?.service_tier,

package/src/registry/hooks/env.ts

@@ -3,9 +3,8 @@
  * than a fixed variable list (Foundry mode, AWS credential chains, Vertex ADC).
  */
 import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
 import { $env, $pickenv } from "@oh-my-pi/pi-utils";
+import { userAdcPath } from "../../providers/google-auth";
 import { isFoundryEnabled } from "../../utils/foundry";
 import { resolveAwsRegistryApiKey } from "../aws";
 import { AUTHENTICATED_SENTINEL } from "../types";
@@ -16,9 +15,7 @@ let cachedVertexAdcCredentialsExists: boolean | null = null;
 function hasVertexAdcCredentials(): boolean {
 	if (cachedVertexAdcCredentialsExists === null) {
 		const gacPath = $env.GOOGLE_APPLICATION_CREDENTIALS;
-		cachedVertexAdcCredentialsExists = fs.existsSync(
-			gacPath ?? path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json"),
-		);
+		cachedVertexAdcCredentialsExists = fs.existsSync(gacPath ?? userAdcPath());
 	}
 	return cachedVertexAdcCredentialsExists;
 }

package/src/registry/oauth/cursor.ts

@@ -1,10 +1,14 @@
 import * as AIError from "../../error";
+import type { FetchImpl } from "../../types";
+import { isRecord } from "../../utils";
 import { generatePKCE } from "./pkce";
 import type { OAuthController, OAuthCredentials } from "./types";
 
 const CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
 const CURSOR_POLL_URL = "https://api2.cursor.sh/auth/poll";
 const CURSOR_REFRESH_URL = "https://api2.cursor.sh/auth/exchange_user_api_key";
+const CURSOR_PROFILE_URL = "https://cursor.com/api/auth/me";
+const CURSOR_PROFILE_TIMEOUT_MS = 3_000;
 
 const POLL_MAX_ATTEMPTS = 150;
 const POLL_BASE_DELAY = 1000;
@@ -107,10 +111,11 @@ export async function loginCursor(
 }
 
 export async function loginCursorHook(callbacks: OAuthController): Promise<OAuthCredentials> {
-	return loginCursor(
+	const credentials = await loginCursor(
 		url => callbacks.onAuth?.({ url }),
 		callbacks.onProgress ? () => callbacks.onProgress?.("Waiting for browser authentication...") : undefined,
 	);
+	return withCursorAccountEmail(credentials, callbacks.fetch ?? fetch, callbacks.signal);
 }
 
 export async function refreshCursorToken(apiKeyOrRefreshToken: string): Promise<OAuthCredentials> {
@@ -145,8 +150,57 @@ export async function refreshCursorToken(apiKeyOrRefreshToken: string): Promise<
 	};
 }
 
-export async function refreshCursorHook(credentials: OAuthCredentials): Promise<OAuthCredentials> {
-	return refreshCursorToken(credentials.refresh);
+export async function refreshCursorHook(
+	credentials: OAuthCredentials,
+	signal?: AbortSignal,
+): Promise<OAuthCredentials> {
+	const refreshed = await refreshCursorToken(credentials.refresh);
+	// A stored email survives the refresh merge; rows stored before email capture gain it here.
+	return credentials.email ? refreshed : withCursorAccountEmail(refreshed, fetch, signal);
+}
+
+/** Request headers that present `accessToken` to cursor.com as its user's web session. */
+export function cursorSessionHeaders(userId: string, accessToken: string): Record<string, string> {
+	return {
+		Accept: "application/json",
+		Cookie: `WorkosCursorSessionToken=${encodeURIComponent(`${userId}::${accessToken}`)}`,
+	};
+}
+
+/**
+ * Email of the Cursor account that owns `accessToken`, read from its cursor.com
+ * profile. Undefined when the token names no user or the profile names another.
+ */
+export async function fetchCursorAccountEmail(
+	accessToken: string,
+	fetchImpl: FetchImpl = fetch,
+	signal?: AbortSignal,
+): Promise<string | undefined> {
+	const userId = extractCursorAccessTokenUserId(accessToken);
+	if (!userId) return undefined;
+	const response = await fetchImpl(CURSOR_PROFILE_URL, { headers: cursorSessionHeaders(userId, accessToken), signal });
+	if (!response.ok) {
+		throw new AIError.ProviderHttpError(`Cursor profile request failed: ${response.status}`, response.status);
+	}
+	const payload: unknown = await response.json();
+	if (!isRecord(payload) || payload.sub !== userId || typeof payload.email !== "string") return undefined;
+	return payload.email.trim() || undefined;
+}
+
+/** Attach the account email so account policies and pickers can name this login; a failed lookup leaves it off. */
+async function withCursorAccountEmail(
+	credentials: OAuthCredentials,
+	fetchImpl: FetchImpl,
+	signal?: AbortSignal,
+): Promise<OAuthCredentials> {
+	// Refresh runs under a 10s deadline; a stalled lookup must not discard tokens the exchange already minted.
+	const timeout = AbortSignal.timeout(CURSOR_PROFILE_TIMEOUT_MS);
+	const email = await fetchCursorAccountEmail(
+		credentials.access,
+		fetchImpl,
+		signal ? AbortSignal.any([signal, timeout]) : timeout,
+	).catch(() => undefined);
+	return email ? { ...credentials, email } : credentials;
 }
 
 function decodeCursorAccessTokenPayload(token: string): unknown | undefined {

package/src/registry/oauth/index.ts

@@ -166,3 +166,8 @@ export function getOAuthProviders(): OAuthProviderInfo[] {
 	}));
 	return [...builtInOAuthProviders, ...customProviders];
 }
+
+/** Provider id that stores `providerId`'s credentials: login aliases (`openai-codex-device`) map to their target (`openai-codex`). */
+export function getOAuthCredentialProvider(providerId: string): string {
+	return getOAuthProviders().find(provider => provider.id === providerId)?.storeCredentialsAs ?? providerId;
+}

package/src/types.ts

@@ -299,23 +299,40 @@ export function realizesPriorityServiceTier(
 }
 
 /**
- * Premium-request weight contributed by a priority request to a provider that
- * realizes it and bills extra. Mirrors GitHub Copilot's `premiumRequests`
- * accounting so the "premium requests" stat aggregates priority traffic across
- * the OpenAI family, direct Anthropic fast mode, and Google priority.
+ * Premium-request weight contributed by a request a provider bills above
+ * standard. Priority (Fast mode) counts 1 on every provider that realizes it;
+ * `ultrafast` counts 1 on the OpenAI family, where it is a premium serving tier
+ * (its cost premium is recorded separately in `usage.cost`). Mirrors GitHub
+ * Copilot's `premiumRequests` accounting so the "premium requests" stat
+ * aggregates premium traffic across the OpenAI family, direct Anthropic fast
+ * mode, and Google priority.
  *
- * Returns 1 only when priority is actually realized on the wire for `model`
- * (see {@link realizesPriorityServiceTier}) and the provider bills it as a
- * premium request. OpenRouter is excluded — it bills per its own pricing, not
- * Copilot-premium semantics — as are Bedrock/Vertex Claude, where priority is
- * silently dropped.
+ * Returns 1 only when the tier is actually realized on the wire for `model`
+ * (see {@link realizesPriorityServiceTier} and {@link shouldSendServiceTier})
+ * and the provider bills it as a premium request. OpenRouter is excluded — it
+ * bills per its own pricing, not Copilot-premium semantics — as are
+ * Bedrock/Vertex Claude, where priority is silently dropped.
+ *
+ * Pass `served: true` when the tier is the one the provider reported serving
+ * (an assistant message's {@link AssistantMessage.serviceTier}) rather than a
+ * requested setting: realization is then already proven, so the wire gate is
+ * skipped and a model without discovery metadata (a stats-backfill row) still
+ * counts.
  */
-export function getPriorityPremiumRequests(
+export function getPremiumServiceTierRequests(
 	serviceTier: ServiceTier | null | undefined,
 	model: ServiceTierModel,
+	options?: { served?: boolean },
 ): number {
-	if (!realizesPriorityServiceTier(serviceTier, model)) return 0;
 	const provider = model.provider;
+	if (serviceTier === "ultrafast") {
+		if (provider !== "openai" && provider !== "openai-codex") return 0;
+		return options?.served === true || shouldSendServiceTier("ultrafast", model) ? 1 : 0;
+	}
+	if (serviceTier !== "priority") return 0;
+	// A served tier is proof it reached the wire, so the realization gate only
+	// applies to requested-tier inference.
+	if (!options?.served && !realizesPriorityServiceTier(serviceTier, model)) return 0;
 	return provider === "openai" ||
 		provider === "openai-codex" ||
 		provider === "anthropic" ||
@@ -325,6 +342,21 @@ export function getPriorityPremiumRequests(
 		: 0;
 }
 
+/** Parse a provider-reported `service_tier` echo into a known tier, or `undefined` for anything else. */
+export function parseServiceTier(value: unknown): ServiceTier | undefined {
+	switch (value) {
+		case "auto":
+		case "default":
+		case "flex":
+		case "scale":
+		case "priority":
+		case "ultrafast":
+			return value;
+		default:
+			return undefined;
+	}
+}
+
 /**
  * Coerce a persisted service-tier value to a {@link ServiceTierByFamily}. Newer
  * sessions store the family map directly; legacy sessions stored a single
@@ -1197,6 +1229,15 @@ export interface AssistantMessage {
 	 * other than what was requested.
 	 */
 	upstreamModel?: string;
+	/**
+	 * Service tier the provider reported serving this turn, when the API echoes
+	 * one (`response.service_tier`), falling back to the tier the request carried
+	 * when the response omits the echo. Absent when the provider reports no tier
+	 * or the echo cannot be trusted (proxies). This is the tier the turn actually
+	 * ran on, which is what cost, premium-request, and speed accounting key on —
+	 * the session's live setting may already have changed.
+	 */
+	serviceTier?: ServiceTier;
 	usage: Usage;
 	stopReason: StopReason;
 	stopDetails?: StopDetails | null;

package/src/usage/cursor.ts

@@ -1,7 +1,11 @@
 import { quotaTierFor } from "@oh-my-pi/pi-catalog/compat/behavior";
 import { CURSOR_DEFAULT_BASE_URL } from "@oh-my-pi/pi-catalog/wire/cursor";
 import { toNumber } from "@oh-my-pi/pi-catalog/utils";
-import { extractCursorAccessTokenUserId } from "../registry/oauth/cursor";
+import {
+	cursorSessionHeaders,
+	extractCursorAccessTokenUserId,
+	fetchCursorAccountEmail,
+} from "../registry/oauth/cursor";
 import type {
 	CredentialRankingContext,
 	CredentialRankingStrategy,
@@ -27,7 +31,7 @@ function normalizeCursorBaseUrl(baseUrl?: string): string {
 	return baseUrl.replace(/\/+$/, "");
 }
 
-type CursorUsageSource = "auth-usage" | "usage-summary" | "auth-me";
+type CursorUsageSource = "auth-usage" | "usage-summary";
 
 async function fetchCursorJson(
 	ctx: UsageFetchContext,
@@ -435,37 +439,22 @@ export const cursorUsageProvider: UsageProvider = {
 		if (credential.type === "oauth" && baseUrl === CURSOR_DEFAULT_BASE_URL) {
 			const userId = extractCursorAccessTokenUserId(token);
 			if (userId) {
-				const sessionHeaders: Record<string, string> = {
-					Accept: "application/json",
-					Cookie: `WorkosCursorSessionToken=${encodeURIComponent(`${userId}::${token}`)}`,
-				};
 				summaryReportPromise = fetchCursorJson(
 					ctx,
 					"https://cursor.com/api/usage-summary",
 					{
-						headers: sessionHeaders,
+						headers: cursorSessionHeaders(userId, token),
 						signal: params.signal,
 					},
 					"usage-summary",
 				).then(payload => parseCursorIndividualUsage(payload, fetchedAt));
-				profileEmailPromise = fetchCursorJson(
-					ctx,
-					"https://cursor.com/api/auth/me",
-					{
-						headers: sessionHeaders,
-						signal: params.signal,
-					},
-					"auth-me",
-				).then(payload => {
-					if (
-						!isRecord(payload) ||
-						payload.sub !== userId ||
-						typeof payload.email !== "string" ||
-						!payload.email.trim()
-					) {
-						return undefined;
-					}
-					return payload.email.trim();
+				profileEmailPromise = fetchCursorAccountEmail(token, ctx.fetch, params.signal).catch(error => {
+					ctx.logger?.warn("Cursor usage request error", {
+						provider: "cursor",
+						source: "auth-me",
+						error: String(error),
+					});
+					return undefined;
 				});
 			}
 		}

package/src/usage/minimax-code.ts

@@ -201,7 +201,14 @@ async function fetchMiniMaxCodeUsage(params: UsageFetchParams, ctx: UsageFetchCo
 
 	try {
 		const configuredBaseUrl = params.baseUrl?.trim();
-		const baseUrl = configuredBaseUrl ? configuredBaseUrl.replace(/\/+$/, "").replace(/\/v1$/, "") : INTL_BASE_URL;
+		// Token Plan base URLs may point at the OpenAI (`/v1`) or Anthropic (`/anthropic`, `/anthropic/v1`)
+		// route; the quota endpoint lives at the host root.
+		const baseUrl = configuredBaseUrl
+			? configuredBaseUrl
+					.replace(/\/+$/, "")
+					.replace(/\/v1$/, "")
+					.replace(/\/anthropic$/, "")
+			: INTL_BASE_URL;
 		const response = await ctx.fetch(`${baseUrl}${REMAINS_PATH}`, {
 			headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
 			signal: params.signal,