pullfrog 0.1.89 → 0.1.91

package/dist/internal/index.d.ts

@@ -24,6 +24,7 @@ export { countOutstandingPullfrogThreads } from "../utils/outstandingThreads.ts"
 export type { CreateProgressCommentTarget, ProgressComment, ProgressCommentType, } from "../utils/progressComment.ts";
 export { createLeapingProgressComment, deleteProgressCommentApi, getProgressComment, updateProgressComment, } from "../utils/progressComment.ts";
 export { PROVIDER_DASHBOARDS, type ProviderDashboard } from "../utils/providerDashboards.ts";
+export { detectProviderError } from "../utils/providerErrors.ts";
 export type { RunStatusCheckConclusion, RunStatusCheckOctokit, } from "../utils/runStatusCheck.ts";
 export { APPROVAL_CHECK_NAME, createRunStatusCheck, finalizeRunStatusCheck, RUN_STATUS_CHECK_NAME, runStatusCheckNeedsFinalizing, } from "../utils/runStatusCheck.ts";
 export * from "../utils/subscriptionCredentials.ts";

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.89",
+  version: "0.1.91",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -16246,15 +16246,6 @@ function commercialPaywallBody(params) {
 // utils/buildPullfrogFooter.ts
 var PULLFROG_DIVIDER = "<!-- PULLFROG_DIVIDER_DO_NOT_REMOVE_PLZ -->";
 var FROG_LOGO = `<a href="https://pullfrog.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pullfrog.com/logos/frog-white-full-18px.png"><img src="https://pullfrog.com/logos/frog-green-full-18px.png" width="9px" height="9px" style="vertical-align: middle; " alt="Pullfrog"></picture></a>`;
-function providerDisplayName(slug) {
-  try {
-    const key = getModelProvider(slug);
-    const meta3 = providers[key];
-    return meta3?.displayName ?? key;
-  } catch {
-    return slug;
-  }
-}
 function formatModelLabel(params) {
   const alias = resolveDisplayAlias(params.model) ?? // reverse-lookup: when the caller passes an effective model (proxy or
   // resolved target like "openrouter/anthropic/claude-opus-4.7") instead of
@@ -16269,9 +16260,6 @@ function formatModelLabel(params) {
     return `${ossBase} (${configured} not used \u2014 pick one of the [funded models](https://docs.pullfrog.com/models#pullfrog-for-oss) or add a [provider key](https://docs.pullfrog.com/keys) to run your own)`;
   }
   const base = alias?.isFree ? `\`${displayName}\` (free)` : `\`${displayName}\``;
-  if (params.fallbackFrom) {
-    return `${base} (credentials for ${providerDisplayName(params.fallbackFrom)} were rejected by the provider)`;
-  }
   if (params.clamped?.reason === "trial") {
     return `${base} (model usage covered by Pullfrog)`;
   }
@@ -16312,7 +16300,6 @@ function buildPullfrogFooter(params) {
     parts.push(
       `Using ${formatModelLabel({
         model: params.model,
-        fallbackFrom: params.fallbackFrom,
         clamped: params.clamped,
         unselectedProxyDefault: params.unselectedProxyDefault,
         oss: params.oss
@@ -16480,10 +16467,12 @@ async function preflightClaudeSubscription(params) {
   if (res.status !== 401 && res.status !== 403 && res.status !== 429)
     return { usable: true, status: res.status };
   const body = await res.text().catch(() => "");
+  const reset = Number(res.headers.get("anthropic-ratelimit-unified-reset"));
   return {
     usable: false,
     status: res.status,
-    reason: `${res.status}: ${extractApiErrorMessage(body)}`
+    reason: `${res.status}: ${extractApiErrorMessage(body)}`,
+    resetAt: res.status === 429 && reset > 0 ? new Date(reset * 1e3) : void 0
   };
 }
 function extractApiErrorMessage(body) {
@@ -16821,6 +16810,146 @@ var PROVIDER_DASHBOARDS = {
   }
 };
 
+// utils/providerErrors.ts
+var PROVIDER_BILLING_EXHAUSTED_LABEL = "provider billing exhausted";
+var PROVIDER_NO_ENDPOINTS_LABEL = "provider no routable endpoints";
+var PROVIDER_USAGE_LIMIT_LABEL = "provider usage limit reached";
+var statusKey = `\\b(?:status[_ ]?code|http[_ ]?status|status)["']?\\s*[:=]\\s*["']?`;
+var ANTHROPIC_SPEND_CAP_PATTERN = /reached your specified API usage limits\.?(?:\s*You will regain access on ([^"\n]+?)\.)?/i;
+var PROVIDER_ERROR_PATTERNS = [
+  // billing-payload patterns come BEFORE bare status-code patterns. providers
+  // commonly return 401 / 429 for billing/quota exhaustion (OpenCode Zen
+  // `CreditsError` / `FreeUsageLimitError`, Gemini `RESOURCE_EXHAUSTED` +
+  // "spending cap", Anthropic "Insufficient balance" / "credit balance is
+  // too low"). these are non-retryable and require user-billing action —
+  // distinct from a transient auth error or rate-limit. status-code patterns
+  // would otherwise win and surface "auth error (401)" / "rate limited (429)"
+  // with no billing hint. see #778, #835.
+  { regex: /\bCreditsError\b/, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  { regex: /\bFreeUsageLimitError\b/, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  // `balance` is DeepSeek's noun, `credits` is OpenRouter's for the SAME
+  // terminal state — #1164's run 7 (`Insufficient credits. Add more using
+  // …/settings/credits`) matched neither this nor `requires more credits`, so
+  // the one run in that episode that was a genuinely empty wallet rendered with
+  // no CTA at all while runs 1-6 rendered correctly.
+  { regex: /Insufficient (?:balance|credits)/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  { regex: /credit balance is too low/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  // "spending cap" (Gemini) and "spending limit" (xAI, #1076) are the same
+  // condition in two house styles — a configured ceiling was reached.
+  { regex: /spending (?:cap|limit)/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  // xAI exhausts credits and the monthly ceiling in one 403 whose status code
+  // sits nowhere near a `status:` key, so no status pattern below fires (#1076).
+  { regex: /used all available credits/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  // Gemini's daily / free-tier cap. it tells the user to "check your plan and
+  // billing details" in its own words but matches none of the wallet wordings
+  // above, so it fell to the catch-all `quota` label — which is not the label
+  // the actionable copy is keyed on, so the run rendered a blank comment for a
+  // condition the provider had spelled out (#1114).
+  {
+    regex: /exceeded your current quota, please check your plan and billing/i,
+    label: PROVIDER_BILLING_EXHAUSTED_LABEL
+  },
+  { regex: /generate_content_free_tier_requests/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  // Anthropic's Console spend cap. its noun is "API usage limits", which none of
+  // the wallet-shaped patterns above reach, and its 400 sits nowhere near a
+  // `status:` key either — so the whole message was dropped on the floor (#1208).
+  { regex: ANTHROPIC_SPEND_CAP_PATTERN, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  // OpenCode Zen / Codex-subscription cap: `AI_APICallError: The usage limit has
+  // been reached`. Its noun is "usage limit" with no "rate", no status code and
+  // no wallet wording, so every pattern here missed it and `lastProviderError`
+  // stayed unset — which suppresses nothing, so the run was reported as "The
+  // model produced no output at all … usually transient; re-running often
+  // succeeds" while the same log held nine of these. Measured on a live account
+  // whose ChatGPT subscription was capped.
+  { regex: /\bthe usage limit has been reached\b/i, label: PROVIDER_USAGE_LIMIT_LABEL },
+  // the OpenRouter shapes `isRouterKeylimitExhaustedError` matches. on a Router
+  // run those mean the PULLFROG wallet is empty and `renderRunError` returns a
+  // `BillingError` before ever reaching this list; on a BYOK run the very same
+  // wire text means the user's OWN OpenRouter wallet is empty, and this entry is
+  // what gives them the right dashboard instead of ours. see #1135.
+  {
+    regex: /requires more credits|Key limit exceeded \(total limit\)/i,
+    label: PROVIDER_BILLING_EXHAUSTED_LABEL
+  },
+  // OpenRouter has no endpoint it is allowed to route to: the customer's
+  // data-policy / guardrail settings exclude every provider serving the model.
+  // dies ~2s into the session with nothing billed, so it is neither a billing
+  // nor an auth condition — and both of those patterns would otherwise be
+  // reached first for a message that mentions neither. see #1164.
+  {
+    regex: /No endpoints available matching your (?:guardrail restrictions|data policy)/i,
+    label: PROVIDER_NO_ENDPOINTS_LABEL
+  },
+  // auth patterns must come BEFORE rate-limit patterns. OpenRouter 401 error
+  // payloads carry `x-ratelimit-*` response headers in the dump, and the
+  // free-form rate-limit regex below would otherwise win on word-boundary
+  // matches inside header names. canonical 401 messages: OpenRouter returns
+  // `{"error":{"message":"User not found","code":401}}` for disabled or
+  // invalid keys (https://openai.luzhipeng.com/docs/api/reference/errors-and-debugging).
+  { regex: new RegExp(`${statusKey}401\\b`, "i"), label: "auth error (401)" },
+  { regex: new RegExp(`${statusKey}403\\b`, "i"), label: "auth error (403)" },
+  { regex: /\bUser not found\b/i, label: "auth error (invalid/disabled key)" },
+  { regex: /\bInvalid authentication\b/i, label: "auth error (invalid credentials)" },
+  { regex: /\bNo auth credentials found\b/i, label: "auth error (missing credentials)" },
+  { regex: new RegExp(`${statusKey}429\\b`, "i"), label: "rate limited (429)" },
+  { regex: new RegExp(`${statusKey}500\\b`, "i"), label: "provider 500 error" },
+  { regex: new RegExp(`${statusKey}503\\b`, "i"), label: "provider unavailable (503)" },
+  // matches `rate limit`, `rate limited`, `rate limits exceeded`,
+  // `rate_limit_error`, `rate_limit_exceeded`. the leading `\b` + `[_ ]`
+  // separator rejects `x-ratelimit-*` / `anthropic-ratelimit-*` response
+  // headers (no separator between "rate" and "limit") which routinely
+  // appear in dumped 401 / 4xx error JSON.
+  { regex: /\brate[_ ]limit/i, label: "rate limited" },
+  { regex: /\bRESOURCE_EXHAUSTED\b/, label: "quota exhausted" },
+  // Google gRPC `INTERNAL` status. word-boundary anchors reject
+  // `INTERNAL_SERVER_ERROR` (HTTP 500 message that may appear in unrelated
+  // log lines) and identifiers like `INTERNALS`.
+  { regex: /\bINTERNAL\b/, label: "provider internal error" },
+  { regex: /\bUNAVAILABLE\b/, label: "provider unavailable" },
+  // matches `quota`, `insufficient_quota`, `quota_exceeded`, `quotaExceeded`.
+  // word-character lookarounds would reject `_quota` / `quotaX`; `quota` is
+  // specific enough that a plain substring match is safe.
+  { regex: /quota/i, label: "quota error" },
+  // explicit zero-quota response, e.g. `{"limit": 0}`. the `\b` anchor
+  // around `limit` rejects keys like `time_limit` or `field_limit`.
+  { regex: /["']?\blimit\b["']?\s*:\s*0\b/, label: "zero quota" }
+];
+var EXCERPT_MAX_BYTES = 600;
+var LINES_BEFORE = 1;
+var LINES_AFTER = 2;
+function findProviderErrorMatch(text) {
+  for (const entry of PROVIDER_ERROR_PATTERNS) {
+    const m = entry.regex.exec(text);
+    if (!m) continue;
+    return { label: entry.label, excerpt: extractExcerpt(text, m.index) };
+  }
+  return null;
+}
+function detectProviderError(text) {
+  return findProviderErrorMatch(text)?.label ?? null;
+}
+function extractExcerpt(text, matchIndex) {
+  const lineStart = text.lastIndexOf("\n", matchIndex - 1) + 1;
+  const lineEndRaw = text.indexOf("\n", matchIndex);
+  const lineEnd = lineEndRaw === -1 ? text.length : lineEndRaw;
+  let start = lineStart;
+  for (let i = 0; i < LINES_BEFORE && start > 0; i++) {
+    const prev = text.lastIndexOf("\n", start - 2);
+    start = prev < 0 ? 0 : prev + 1;
+  }
+  let end = lineEnd;
+  for (let i = 0; i < LINES_AFTER && end < text.length; i++) {
+    const next = text.indexOf("\n", end + 1);
+    end = next < 0 ? text.length : next;
+  }
+  let excerpt = text.slice(start, end);
+  if (excerpt.length > EXCERPT_MAX_BYTES) {
+    excerpt = text.slice(lineStart, lineEnd);
+    if (excerpt.length > EXCERPT_MAX_BYTES) excerpt = excerpt.slice(0, EXCERPT_MAX_BYTES);
+  }
+  return excerpt.trim();
+}
+
 // utils/runStatusCheck.ts
 var RUN_STATUS_CHECK_NAME = "pullfrog";
 var GITHUB_ACTIONS_APP_SLUG = "github-actions";
@@ -16950,7 +17079,10 @@ var subscriptionSchema = external_exports.object({
   owner: external_exports.string(),
   inherited: external_exports.boolean(),
   shared: external_exports.boolean(),
-  registeredAt: external_exports.string()
+  registeredAt: external_exports.string(),
+  /** the provider's last verdict on the current value; null = usable or never checked. */
+  status: external_exports.enum(["rejected", "exhausted"]).nullish(),
+  resetAt: external_exports.string().nullish()
 });
 var subscriptionListSchema = external_exports.object({
   subscriptions: external_exports.array(subscriptionSchema),
@@ -17050,9 +17182,16 @@ var identitySchema = external_exports.object({
   account_id: external_exports.string().optional(),
   email_verified: external_exports.boolean().optional()
 });
+var codexWindowSchema = external_exports.object({ used_percent: external_exports.number().optional(), reset_at: external_exports.number().optional() }).nullish();
 var codexUsageSchema = external_exports.object({
-  rate_limit: external_exports.object({ allowed: external_exports.boolean(), limit_reached: external_exports.boolean() }).optional()
+  rate_limit: external_exports.object({
+    allowed: external_exports.boolean(),
+    limit_reached: external_exports.boolean(),
+    primary_window: codexWindowSchema,
+    secondary_window: codexWindowSchema
+  }).optional()
 });
+var unknown2 = { status: "unknown" };
 var SubscriptionCredentialError = class extends Error {
 };
 async function subscriptionIdentity(input) {
@@ -17091,12 +17230,16 @@ async function readSubscriptionEndpoint(input) {
 async function probeSubscription(input) {
   if (input.name === "CLAUDE_CODE_OAUTH_TOKEN") {
     const result = await preflightClaudeSubscription({ token: input.value, model: input.model });
-    return result.usable ? "usable" : "rejected";
+    if (result.usable)
+      return result.status !== void 0 && result.status < 300 ? { status: "usable" } : unknown2;
+    return result.status === 429 ? { status: "exhausted", detail: result.reason, resetAt: result.resetAt } : { status: "rejected", detail: result.reason };
   }
   const codex = input.name === "CODEX_AUTH_JSON" ? parseCodexAuthBody(input.value) : null;
   const grok = input.name === "GROK_AUTH_JSON" ? parseXaiAuthBody(input.value) : null;
   const auth = codex ?? grok;
-  if (!auth || auth.refresh_rejected_at) return "rejected";
+  if (!auth) return { status: "rejected", detail: "the stored credential is malformed" };
+  if (auth.refresh_rejected_at)
+    return { status: "rejected", detail: `refresh rejected at ${auth.refresh_rejected_at}` };
   if (grok && input.model)
     return probeInference({
       name: "XAI_API_KEY",
@@ -17109,23 +17252,31 @@ async function probeSubscription(input) {
     accountId: codex?.tokens.account_id,
     grokBilling: !!grok
   });
-  if (response?.status === 401) return "rejected";
-  if (!response?.ok) return "unknown";
+  if (response?.status === 401) return { status: "rejected", detail: "rejected with 401" };
+  if (!response?.ok) return unknown2;
   const body = await response.json().catch(() => null);
-  if (codex) {
-    const parsed = codexUsageSchema.safeParse(body);
-    const limit = parsed.success ? parsed.data.rate_limit : void 0;
-    if (!limit) return "unknown";
-    return limit.allowed && !limit.limit_reached ? "usable" : "rejected";
-  }
-  return "unknown";
+  if (!codex) return unknown2;
+  const parsed = codexUsageSchema.safeParse(body);
+  const limit = parsed.success ? parsed.data.rate_limit : void 0;
+  if (!limit) return unknown2;
+  if (limit.allowed && !limit.limit_reached) return { status: "usable" };
+  const windows = [limit.primary_window, limit.secondary_window];
+  const full = windows.filter((window) => (window?.used_percent ?? 0) >= 100);
+  const resets = (full.length ? full : windows).flatMap(
+    (window) => window?.reset_at ? [window.reset_at] : []
+  );
+  return {
+    status: "exhausted",
+    detail: "the ChatGPT plan's usage limit is reached",
+    resetAt: resets.length ? new Date(Math.max(...resets) * 1e3) : void 0
+  };
 }
 async function probeInference(input) {
   const anthropic = input.name === "ANTHROPIC_API_KEY";
   const openai = input.name === "OPENAI_API_KEY";
   if (!anthropic && !openai && input.name !== "XAI_API_KEY") {
     const result = await verifyCredential({ envVar: input.name, value: input.value });
-    return result === "dead" ? "rejected" : result === "alive" ? "usable" : "unknown";
+    return result === "dead" ? { status: "rejected", detail: "rejected by its provider" } : result === "alive" ? { status: "usable" } : unknown2;
   }
   const headers = new Headers({ "content-type": "application/json" });
   if (anthropic) {
@@ -17150,12 +17301,20 @@ async function probeInference(input) {
   ).catch(() => null);
   if (response?.status === 400 && input.name === "XAI_API_KEY") {
     const error48 = external_exports.object({ error: external_exports.string() }).safeParse(await response.json().catch(() => null));
-    return error48.success && error48.data.error.startsWith("Incorrect API key provided.") ? "rejected" : "unknown";
+    return error48.success && error48.data.error.startsWith("Incorrect API key provided.") ? { status: "rejected", detail: "rejected with 400: incorrect API key" } : unknown2;
+  }
+  if (response?.status === 429 && openai) {
+    const error48 = external_exports.object({ error: external_exports.object({ code: external_exports.string() }) }).safeParse(await response.json().catch(() => null));
+    return error48.success && error48.data.error.code === "insufficient_quota" ? { status: "exhausted", detail: "refused with 429: insufficient quota", resetAt: void 0 } : unknown2;
   }
   await response?.body?.cancel();
-  if (!response) return "unknown";
-  if (response.ok) return "usable";
-  return [401, 402, 403, 429].includes(response.status) ? "rejected" : "unknown";
+  if (!response) return unknown2;
+  if (response.ok) return { status: "usable" };
+  if (response.status === 401 || response.status === 403)
+    return { status: "rejected", detail: `rejected with ${response.status}` };
+  if (response.status === 402)
+    return { status: "exhausted", detail: "refused with 402", resetAt: void 0 };
+  return unknown2;
 }
 
 // utils/time.ts
@@ -17214,6 +17373,7 @@ export {
   decodeJwtExpMs,
   defaultAutoTier,
   deleteProgressCommentApi,
+  detectProviderError,
   finalizeRunStatusCheck,
   getAutoSelectHintModel,
   getModelEffortLevels,

package/dist/toolState.d.ts

@@ -138,9 +138,6 @@ export interface ToolState {
     model?: string | undefined;
     agent?: string | undefined;
     credential?: AgentCredential | undefined;
-    modelFallback?: {
-        from: string;
-    } | undefined;
     unselectedProxyDefault?: boolean | undefined;
     modelClamped?: {
         from: string;

package/dist/utils/buildPullfrogFooter.d.ts

@@ -17,13 +17,6 @@ export interface BuildPullfrogFooterParams {
     customParts?: string[] | undefined;
     /** model slug from payload (e.g., "anthropic/claude-opus"). shown in footer as "Using `Model Name`" */
     model?: string | undefined;
-    /**
-     * When a credential was rejected and the run moved to another model, this is
-     * the slug the user had configured (e.g. "anthropic/claude-opus") — the footer
-     * renders `Using <model> (credentials for <configured> were rejected by the
-     * provider)` so the substitution is visible in PR comments + reviews.
-     */
-    fallbackFrom?: string | undefined;
     /**
      * When a Router account had a model (or the intelligent tier) selected that
      * the server clamped to the efficient default — custom picks are card-gated

package/dist/utils/claudeSubscription.d.ts

@@ -12,6 +12,7 @@ export type SubscriptionPreflight = {
     usable: false;
     status: number;
     reason: string;
+    resetAt: Date | undefined;
 };
 /**
  * preflight a Claude subscription OAuth token (`CLAUDE_CODE_OAUTH_TOKEN`)

package/dist/utils/credentialFallback.d.ts

@@ -1,20 +1,13 @@
 /**
  * `ok` covers "the credential works", "we couldn't tell", and "something else
  * on this model still works" — the run proceeds as it did before this check
- * existed. The other two are only reached when every credential the configured
- * model could use has been explicitly rejected by its own provider.
- *
- * `replacement` is a concrete model, never a "just auto-select something":
- * deciding an alternative exists and picking it have to be the SAME decision,
- * or the picker can land back on the provider that just failed.
+ * existed. `dead` is only reached when every credential the configured model
+ * could use has been explicitly rejected by its own provider. A run never moves
+ * to a different model: the pool of credentials for THIS provider is where a
+ * rejected one is routed around (see wiki/subscription-credentials.md).
  */
 export type CredentialOutcome = {
     kind: "ok";
-} | {
-    kind: "fellBack";
-    credential: string;
-    reason: string | undefined;
-    replacement: string;
 } | {
     kind: "dead";
     credential: string;
@@ -22,10 +15,10 @@ export type CredentialOutcome = {
 };
 /**
  * Ask the providers whether the credentials behind the configured model still
- * work, BEFORE the agent spawns — so a rejected one becomes either a run on a
- * model that does work or an accurate error, instead of the agent 401ing three
- * seconds in against a "rotate your GitHub Actions secret" CTA naming a place
- * the user never put a key.
+ * work, BEFORE the agent spawns — so a rejected one becomes either a run on
+ * another credential for the same model or an accurate error, instead of the
+ * agent 401ing three seconds in against a "rotate your GitHub Actions secret"
+ * CTA naming a place the user never put a key.
  *
  * Failed credentials are deleted from `process.env` only when this run can
  * still proceed without them. Nothing downstream infers anything from that
@@ -38,5 +31,4 @@ export type CredentialOutcome = {
  */
 export declare function checkConfiguredCredentials(params: {
     model: string | undefined;
-    authorized: Set<string>;
 }): Promise<CredentialOutcome>;

package/dist/utils/credentialPool.d.ts

@@ -0,0 +1,18 @@
+import type { RunContextData } from "./runContextData.ts";
+/**
+ * load one subscription per provider for model discovery; keep the pool unflattened. runs
+ * after the account secrets are injected: `injected` names the ones that came from storage,
+ * so everything else set here is a workflow credential.
+ */
+export declare function initializeCredentialPool(input: {
+    ctx: RunContextData;
+    slug: string | undefined;
+    injected: string[];
+}): Promise<void>;
+export declare function resolvePoolModel(input: {
+    codexAgent: boolean;
+}): string | undefined;
+export declare function selectConfiguredCredential(input: {
+    ctx: RunContextData;
+    model: string | undefined;
+}): Promise<boolean>;

package/dist/utils/openCodeModels.d.ts

@@ -14,6 +14,10 @@ export declare function captureBaselineModels(cliPath: string): void;
  * Codex auth.json are in place. Logs the diff against the baseline as
  * `» BYOK auth enabled N model(s): …`. */
 export declare function captureAuthorizedModels(cliPath: string): void;
+/** A model whose credential the pool just probed. Added directly: a second
+ * `opencode models` would run inside the checkout and load the repo's own
+ * `.opencode` plugins, which can outlast its timeout and empty the set. */
+export declare function authorizeModel(model: string): void;
 /** Authorized set captured after Pullfrog-stored auth is applied. Throws if
  * called before `captureAuthorizedModels` — the call sites (api-key
  * validation, auto-select) all run strictly after capture. */

package/dist/utils/subscriptionCredentials.d.ts

@@ -18,6 +18,11 @@ export declare const subscriptionSchema: z.ZodObject<{
     inherited: z.ZodBoolean;
     shared: z.ZodBoolean;
     registeredAt: z.ZodString;
+    status: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        rejected: "rejected";
+        exhausted: "exhausted";
+    }>>>;
+    resetAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 export type Subscription = z.infer<typeof subscriptionSchema>;
 export declare const subscriptionListSchema: z.ZodObject<{
@@ -34,6 +39,11 @@ export declare const subscriptionListSchema: z.ZodObject<{
         inherited: z.ZodBoolean;
         shared: z.ZodBoolean;
         registeredAt: z.ZodString;
+        status: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            rejected: "rejected";
+            exhausted: "exhausted";
+        }>>>;
+        resetAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
     writable: z.ZodBoolean;
 }, z.core.$strip>;

package/dist/utils/subscriptionProbe.d.ts

@@ -1,4 +1,20 @@
 import type { SubscriptionName } from "./subscriptionCredentials.ts";
+/**
+ * the provider's answer about one credential. only `rejected` and `exhausted`
+ * advance the chain; `unknown` never changes who pays.
+ */
+export type ProbeVerdict = {
+    status: "usable";
+} | {
+    status: "unknown";
+} | {
+    status: "rejected";
+    detail: string;
+} | {
+    status: "exhausted";
+    detail: string;
+    resetAt: Date | undefined;
+};
 export declare class SubscriptionCredentialError extends Error {
 }
 export declare function subscriptionIdentity(input: {
@@ -13,10 +29,10 @@ export declare function probeSubscription(input: {
     name: SubscriptionName;
     value: string;
     model?: string | undefined;
-}): Promise<"usable" | "rejected" | "unknown">;
+}): Promise<ProbeVerdict>;
 /** probe the chosen model, not a models-list permission a restricted key may lack. */
 export declare function probeInference(input: {
     name: string;
     value: string;
     model: string;
-}): Promise<"usable" | "rejected" | "unknown">;
+}): Promise<ProbeVerdict>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.89",
+  "version": "0.1.91",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {