Knowing when a provider is out
When an upstream account runs out of credit, each provider says so differently: a payment error from one, a bad request from another, a rate limit from a third. Onde Cloud used to pass those statuses straight through, so callers saw three different errors for one problem. Every request still paid a round trip to the empty account, and nothing told the operator. v1.1.1 fixes all three.
Failures that mean what they say
Every upstream failure is now classified before it reaches you: out of credit, misconfigured, rate limited, rejected, server error, or unreachable. An exhausted account is answered with 503 rather than whatever the provider sent, so it no longer reads as your own payment problem. A rejected request keeps its 4xx, since it is still yours to fix, and a rate limit passes on the provider's Retry-After. Error messages still never name a provider.
Circuit breakers
Each provider and each upstream model now has a breaker. An account that is out of credit or refusing our key is taken out of rotation after one failure; a model that keeps failing is rested after three. Requests skip anything resting and fall through to the next candidate for the same model id. When nothing is left, the answer is 503 with Retry-After set to when the first candidate comes back, without an upstream call. After a cooldown, one request is let through to check, and the breaker closes again as soon as it succeeds.
Operator view and alerts
Two operator-only endpoints show provider health and spend, and an account going down, staying down, or recovering is posted to a webhook, so an empty account is noticed the same hour instead of when a customer asks.