@linxiraos/pi-ai 1.0.0

package/src/providers/vision-guard.ts

@@ -0,0 +1,54 @@
+import { isDashscopeCompatibleModeUrl } from "@linxiraos/pi-catalog/hosts";
+import { isQwenModelId } from "@linxiraos/pi-catalog/identity";
+
+import type { ImageContent, Model, TextContent } from "../types";
+
+export const NON_VISION_IMAGE_PLACEHOLDER = "[image omitted: model does not support vision]";
+
+export function partitionVisionContent(
+	content: ReadonlyArray<TextContent | ImageContent>,
+	supportsImages: boolean,
+): {
+	textBlocks: TextContent[];
+	imageBlocks: ImageContent[];
+	omittedImages: boolean;
+} {
+	const textBlocks = content.filter((block): block is TextContent => block.type === "text");
+	const imageBlocks = content.filter((block): block is ImageContent => block.type === "image");
+	return {
+		textBlocks,
+		imageBlocks: supportsImages ? imageBlocks : [],
+		omittedImages: !supportsImages && imageBlocks.length > 0,
+	};
+}
+
+export function joinTextWithImagePlaceholder(text: string, omittedImages: boolean): string {
+	const parts: string[] = [];
+	if (text.length > 0) {
+		parts.push(text);
+	}
+	if (omittedImages) {
+		parts.push(NON_VISION_IMAGE_PLACEHOLDER);
+	}
+	return parts.join("\n");
+}
+
+/**
+ * Detect known text-only Qwen models served via Alibaba DashScope's consumer
+ * `compatible-mode` endpoint that the upstream chat-completions API rejects
+ * multimodal content arrays for. The compatible-mode endpoint also serves
+ * multimodal Qwen SKUs without `vl` in the id (e.g. `qwen3.7-plus`), so this
+ * guard only covers families verified to be text-only for issue #1859:
+ * `qwen*-max` and `qwen*-coder*`.
+ *
+ * Used as a defensive override in `convertMessages` so a misconfigured custom
+ * provider (issue #1859) can't drive the request into an unrecoverable 400.
+ */
+export function isDashscopeCompatibleModeTextOnlyQwen(model: Model<"openai-completions">): boolean {
+	if (!isDashscopeCompatibleModeUrl(model.baseUrl)) {
+		return false;
+	}
+	const id = model.id.toLowerCase();
+	if (!isQwenModelId(model.id)) return false;
+	return /\bqwen(?:[\d.]+)?-max\b/.test(id) || /\bqwen(?:[\d.]+)?-coder\b/.test(id);
+}

package/src/registry/aiand.ts

@@ -0,0 +1,22 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginAiand = createApiKeyLogin({
+	providerLabel: "ai&",
+	authUrl: "https://console.aiand.com/api-keys",
+	instructions: "Copy your API key from the ai& console",
+	promptMessage: "Paste your ai& API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "ai&",
+		modelsUrl: "https://api.aiand.com/v1/models",
+	},
+});
+
+export const aiandProvider = {
+	id: "aiand",
+	name: "ai&",
+	login: (cb: OAuthLoginCallbacks) => loginAiand(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/aimlapi.ts

@@ -0,0 +1,6 @@
+import type { ProviderDefinition } from "./types";
+
+export const aimlApiProvider = {
+	id: "aimlapi",
+	name: "AIML API",
+} as const satisfies ProviderDefinition;

package/src/registry/alibaba-coding-plan.ts

@@ -0,0 +1,104 @@
+import * as AIError from "../error";
+import * as apiKeyValidation from "./api-key-validation";
+import type { OAuthController, OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const DEFAULT_AUTH_URL = "https://modelstudio.console.alibabacloud.com/";
+const CHINA_AUTH_URL = "https://dashscope.console.aliyun.com/";
+const DEFAULT_API_BASE_URL = "https://coding-intl.dashscope.aliyuncs.com/v1";
+const CHINA_API_BASE_URL = "https://coding.dashscope.aliyuncs.com/v1";
+const VALIDATION_MODEL = "qwen3.5-plus";
+
+export async function loginAlibabaCodingPlan(options: OAuthController): Promise<OAuthCredentials> {
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError("Alibaba Coding Plan");
+	}
+
+	// Ask which endpoint to use
+	const endpointChoice = await options.onPrompt({
+		message: "Select Alibaba Coding Plan endpoint: 1=International (default), 2=China, 3=Custom — enter 1, 2, or 3",
+		placeholder: "1",
+	});
+
+	// Check for abort after endpoint selection (Escape returns "")
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const choice = endpointChoice.trim();
+	let baseUrl: string;
+	let authUrl: string;
+	let instructions: string;
+	if (choice === "2") {
+		baseUrl = CHINA_API_BASE_URL;
+		authUrl = CHINA_AUTH_URL;
+		instructions = "Copy your API key from the Alibaba Cloud DashScope console (China mainland)";
+	} else if (choice === "3") {
+		const customUrl = await options.onPrompt({
+			message: "Enter custom base URL",
+			placeholder: "https://your-proxy.com/v1",
+		});
+		const trimmedUrl = customUrl.trim().replace(/\/+$/, "");
+		if (!trimmedUrl) {
+			throw new AIError.ConfigurationError("Custom URL is required for option 3");
+		}
+		baseUrl = trimmedUrl;
+		authUrl = DEFAULT_AUTH_URL;
+		instructions = "Copy your API key from the Alibaba Cloud DashScope console";
+	} else {
+		baseUrl = DEFAULT_API_BASE_URL;
+		authUrl = DEFAULT_AUTH_URL;
+		instructions = "Copy your API key from the Alibaba Cloud DashScope console (International)";
+	}
+
+	options.onAuth?.({
+		url: authUrl,
+		instructions,
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Alibaba Coding Plan API key",
+		placeholder: "sk-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new AIError.ApiKeyRequiredError();
+	}
+
+	options.onProgress?.("Validating API key...");
+	if (choice === "3") {
+		await apiKeyValidation.validateApiKeyAgainstModelsEndpoint({
+			provider: "Alibaba Coding Plan",
+			apiKey: trimmed,
+			modelsUrl: `${baseUrl}/models`,
+			signal: options.signal,
+		});
+	} else {
+		await apiKeyValidation.validateOpenAICompatibleApiKey({
+			provider: "Alibaba Coding Plan",
+			apiKey: trimmed,
+			baseUrl,
+			model: VALIDATION_MODEL,
+			signal: options.signal,
+		});
+	}
+
+	return {
+		access: trimmed,
+		refresh: trimmed,
+		expires: Number.MAX_SAFE_INTEGER,
+		enterpriseUrl: baseUrl,
+	};
+}
+
+export const alibabaCodingPlanProvider = {
+	id: "alibaba-coding-plan",
+	name: "Alibaba Coding Plan",
+	login: (cb: OAuthLoginCallbacks) => loginAlibabaCodingPlan(cb),
+	getApiKey: credentials => credentials.access,
+} as const satisfies ProviderDefinition;

package/src/registry/alibaba-token-plan.ts

@@ -0,0 +1,125 @@
+import {
+	ALIBABA_TOKEN_PLAN_BASE_URL,
+	ALIBABA_TOKEN_PLAN_CN_BASE_URL,
+	serializeAlibabaTokenPlanCredential,
+} from "@linxiraos/pi-catalog/wire/alibaba-token-plan";
+import * as AIError from "../error";
+import { validateApiKeyAgainstModelsEndpoint } from "./api-key-validation";
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const INTERNATIONAL_AUTH_URL = "https://home.qwencloud.com/billing/subscription/token-plan-individual";
+const CHINA_AUTH_URL = "https://www.aliyun.com/benefit/scene/tokenplan";
+
+/**
+ * Log in to the QwenCloud Token Plan provider.
+ *
+ * The Token Plan ships as two regionally separate products with
+ * non-interchangeable keys — International (Singapore) and China (Beijing) —
+ * so login first selects the region (or a custom base URL) before pasting the
+ * key, mirroring {@link loginAlibabaCodingPlan}. The chosen region is validated
+ * against its own `/models` endpoint and, when it diverges from the default
+ * international endpoint, stored in the credential so inference and discovery
+ * both target it (#6682).
+ */
+export async function loginAlibabaTokenPlan(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError("QwenCloud Token Plan");
+	}
+
+	const endpointChoice = await options.onPrompt({
+		message:
+			"Select QwenCloud Token Plan region: 1=International (default), 2=China (Beijing), 3=Custom — enter 1, 2, or 3",
+		placeholder: "1",
+	});
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const choice = endpointChoice.trim();
+	let baseUrl: string;
+	let authUrl: string;
+	let instructions: string;
+	if (choice === "2") {
+		baseUrl = ALIBABA_TOKEN_PLAN_CN_BASE_URL;
+		authUrl = CHINA_AUTH_URL;
+		instructions = "Subscribe to the China (Beijing) 百炼 Token Plan and copy its dedicated API key";
+	} else if (choice === "3") {
+		const customUrl = await options.onPrompt({
+			message: "Enter custom Token Plan base URL",
+			placeholder: "https://token-plan.<region>.maas.aliyuncs.com/compatible-mode/v1",
+		});
+		const trimmedUrl = customUrl.trim().replace(/\/+$/, "");
+		if (!trimmedUrl) {
+			throw new AIError.ConfigurationError("Custom URL is required for option 3");
+		}
+		baseUrl = trimmedUrl;
+		authUrl = INTERNATIONAL_AUTH_URL;
+		instructions = "Copy your Token Plan API key for the custom endpoint";
+	} else {
+		baseUrl = ALIBABA_TOKEN_PLAN_BASE_URL;
+		authUrl = INTERNATIONAL_AUTH_URL;
+		instructions =
+			"Subscribe to Token Plan Individual and copy its dedicated API key. Keep this page open; the next prompt explains how to enable optional quota reporting.";
+	}
+
+	options.onAuth?.({ url: authUrl, instructions });
+
+	const apiKeyInput = await options.onPrompt({
+		message: "Paste your QwenCloud Token Plan API key",
+		placeholder: "sk-sp-...",
+	});
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+	const apiKey = apiKeyInput.trim();
+	if (!apiKey) {
+		throw new AIError.ApiKeyRequiredError();
+	}
+
+	options.onProgress?.("Validating API key...");
+	await validateApiKeyAgainstModelsEndpoint({
+		provider: "QwenCloud Token Plan",
+		apiKey,
+		modelsUrl: `${baseUrl}/models`,
+		signal: options.signal,
+		fetch: options.fetch,
+	});
+
+	const rawCookie = await options.onPrompt({
+		message:
+			"Optional quota reporting: open browser DevTools → Network, reload the Token Plan page, filter for api.json, and select the cs-data.qwencloud.com/data/api.json request whose api query ends in /tokenplan/personal/api/v2/usage. Copy Request Headers → Cookie, then paste the complete name=value; ... value here, or press Enter to skip.",
+		placeholder: "name=value; name=value; ...",
+		allowEmpty: true,
+	});
+	const cookie = rawCookie
+		.trim()
+		.replace(/^Cookie:\s*/i, "")
+		.trim();
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+	if (
+		cookie &&
+		!cookie.split(";").some(segment => {
+			const separator = segment.indexOf("=");
+			return separator > 0 && Boolean(segment.slice(0, separator).trim() && segment.slice(separator + 1).trim());
+		})
+	) {
+		throw new AIError.ConfigurationError(
+			"Invalid QwenCloud Cookie header. Copy the complete Cookie request header from the cs-data.qwencloud.com usage request, not a single cookie value.",
+		);
+	}
+
+	// International (default) logins keep their existing bare/cookie credential
+	// form; only a diverging region is persisted so it can override the catalog
+	// base URL at inference and discovery time.
+	const regionUrl = baseUrl === ALIBABA_TOKEN_PLAN_BASE_URL ? undefined : baseUrl;
+	return serializeAlibabaTokenPlanCredential(apiKey, cookie, regionUrl);
+}
+
+export const alibabaTokenPlanProvider = {
+	id: "alibaba-token-plan",
+	name: "QwenCloud Token Plan",
+	login: (cb: OAuthLoginCallbacks) => loginAlibabaTokenPlan(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/amazon-bedrock.ts

@@ -0,0 +1,22 @@
+import { $env } from "@linxiraos/pi-utils";
+import type { ProviderDefinition } from "./types";
+
+export const amazonBedrockProvider = {
+	id: "amazon-bedrock",
+	name: "Amazon Bedrock",
+	// Amazon Bedrock accepts bearer tokens, IAM keys, profiles, ECS/IRSA credential chains.
+	envKeys: () => {
+		const hasEcsCredentials =
+			!!$env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || !!$env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+		const hasWebIdentity = !!$env.AWS_WEB_IDENTITY_TOKEN_FILE && !!$env.AWS_ROLE_ARN;
+		if (
+			$env.AWS_PROFILE ||
+			($env.AWS_ACCESS_KEY_ID && $env.AWS_SECRET_ACCESS_KEY) ||
+			$env.AWS_BEARER_TOKEN_BEDROCK ||
+			hasEcsCredentials ||
+			hasWebIdentity
+		) {
+			return "<authenticated>";
+		}
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/anthropic.ts

@@ -0,0 +1,26 @@
+import { $pickenv } from "@linxiraos/pi-utils";
+import { isFoundryEnabled } from "../utils/foundry";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const anthropicProvider = {
+	id: "anthropic",
+	name: "Anthropic (Claude Pro/Max)",
+	// Foundry mode optionally switches Anthropic auth to enterprise gateway credentials.
+	envKeys: () =>
+		isFoundryEnabled()
+			? $pickenv("ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY")
+			: $pickenv("ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"),
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginAnthropic } = await import("./oauth/anthropic");
+		return loginAnthropic(cb);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { refreshAnthropicToken } = await import("./oauth/anthropic");
+		return refreshAnthropicToken(credentials.refresh);
+	},
+	callbackPort: 54545,
+	pasteCodeFlow: true,
+} as const satisfies ProviderDefinition;

package/src/registry/api-key-login.ts

@@ -0,0 +1,115 @@
+/**
+ * Shared factory for API-key-paste "login" flows.
+ *
+ * Several providers (Cerebras, Synthetic, Moonshot, Together, NanoGPT, ZenMux)
+ * don't actually implement OAuth — they just ask the user to paste an API key,
+ * optionally validate it, and return the trimmed key.
+ */
+
+import * as AIError from "../error";
+import {
+	validateAnthropicCompatibleApiKey,
+	validateApiKeyAgainstModelsEndpoint,
+	validateOpenAICompatibleApiKey,
+} from "./api-key-validation";
+import type { OAuthController } from "./oauth/types";
+
+type ChatCompletionsValidation = {
+	kind: "chat-completions";
+	provider: string;
+	baseUrl: string;
+	model: string;
+};
+
+type AnthropicMessagesValidation = {
+	kind: "anthropic-messages";
+	provider: string;
+	baseUrl: string;
+	model: string;
+};
+
+type ModelsEndpointValidation = {
+	kind: "models-endpoint";
+	provider: string;
+	modelsUrl: string | (() => string);
+	headers?: Record<string, string> | (() => Record<string, string> | undefined);
+};
+
+export type ApiKeyLoginConfig = {
+	/** Display name used in error messages, e.g. "Cerebras", "NanoGPT". */
+	providerLabel: string;
+	/** URL opened in browser for the user to grab their key. */
+	authUrl: string;
+	/** Instructions shown with the onAuth callback. */
+	instructions: string;
+	/** Prompt message shown when asking for the key paste. */
+	promptMessage: string;
+	/** Placeholder string for the prompt (e.g. "sk-...", "csk-..."). */
+	placeholder: string;
+	/** Validation strategy, or `null` to skip validation. */
+	validation: ChatCompletionsValidation | AnthropicMessagesValidation | ModelsEndpointValidation | null;
+};
+
+export function createApiKeyLogin(config: ApiKeyLoginConfig): (options: OAuthController) => Promise<string> {
+	return async function login(options: OAuthController): Promise<string> {
+		if (!options.onPrompt) {
+			throw new AIError.OnPromptRequiredError(config.providerLabel);
+		}
+
+		options.onAuth?.({
+			url: config.authUrl,
+			instructions: config.instructions,
+		});
+
+		const apiKey = await options.onPrompt({
+			message: config.promptMessage,
+			placeholder: config.placeholder,
+		});
+
+		if (options.signal?.aborted) {
+			throw new AIError.LoginCancelledError();
+		}
+
+		const trimmed = apiKey.trim();
+		if (!trimmed) {
+			throw new AIError.ApiKeyRequiredError();
+		}
+
+		if (config.validation) {
+			options.onProgress?.("Validating API key...");
+			if (config.validation.kind === "chat-completions") {
+				await validateOpenAICompatibleApiKey({
+					provider: config.validation.provider,
+					apiKey: trimmed,
+					baseUrl: config.validation.baseUrl,
+					model: config.validation.model,
+					signal: options.signal,
+					fetch: options.fetch,
+				});
+			} else if (config.validation.kind === "anthropic-messages") {
+				await validateAnthropicCompatibleApiKey({
+					provider: config.validation.provider,
+					apiKey: trimmed,
+					baseUrl: config.validation.baseUrl,
+					model: config.validation.model,
+					signal: options.signal,
+					fetch: options.fetch,
+				});
+			} else {
+				await validateApiKeyAgainstModelsEndpoint({
+					provider: config.validation.provider,
+					apiKey: trimmed,
+					modelsUrl:
+						typeof config.validation.modelsUrl === "function"
+							? config.validation.modelsUrl()
+							: config.validation.modelsUrl,
+					headers: config.validation.headers,
+					signal: options.signal,
+					fetch: options.fetch,
+				});
+			}
+		}
+
+		return trimmed;
+	};
+}

package/src/registry/api-key-validation.ts

@@ -0,0 +1,145 @@
+import { ProviderHttpError } from "../error/classes";
+import type { FetchImpl } from "../types";
+
+type OpenAICompatibleValidationOptions = {
+	provider: string;
+	apiKey: string;
+	baseUrl: string;
+	model: string;
+	signal?: AbortSignal;
+	fetch?: FetchImpl;
+};
+type AnthropicCompatibleValidationOptions = {
+	provider: string;
+	apiKey: string;
+	baseUrl: string;
+	model: string;
+	signal?: AbortSignal;
+	fetch?: FetchImpl;
+};
+
+type ModelListValidationOptions = {
+	provider: string;
+	apiKey: string;
+	modelsUrl: string;
+	headers?: Record<string, string> | (() => Record<string, string> | undefined);
+	signal?: AbortSignal;
+	fetch?: FetchImpl;
+};
+
+const VALIDATION_TIMEOUT_MS = 15_000;
+
+function normalizeAnthropicCompatibleBaseUrl(baseUrl: string): string {
+	const trimmed = baseUrl.trim().replace(/\/+$/, "");
+	return trimmed.endsWith("/v1") ? trimmed.slice(0, -3) : trimmed;
+}
+
+function resolveValidationHeaders(
+	headers: Record<string, string> | (() => Record<string, string> | undefined) | undefined,
+): Record<string, string> | undefined {
+	return typeof headers === "function" ? headers() : headers;
+}
+
+async function createApiKeyValidationError(provider: string, response: Response): Promise<ProviderHttpError> {
+	let details = "";
+	try {
+		details = (await response.text()).trim();
+	} catch {
+		// Ignore body read errors; the HTTP status still preserves the failure category.
+	}
+
+	const message = details
+		? `${provider} API key validation failed (${response.status}): ${details}`
+		: `${provider} API key validation failed (${response.status})`;
+	return new ProviderHttpError(message, response.status, { headers: response.headers });
+}
+
+/**
+ * Validate an API key against an OpenAI-compatible chat completions endpoint.
+ *
+ * Performs a minimal request to verify credentials and endpoint access.
+ */
+export async function validateOpenAICompatibleApiKey(options: OpenAICompatibleValidationOptions): Promise<void> {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const fetchImpl = options.fetch ?? fetch;
+
+	const response = await fetchImpl(`${options.baseUrl}/chat/completions`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${options.apiKey}`,
+		},
+		body: JSON.stringify({
+			model: options.model,
+			messages: [{ role: "user", content: "ping" }],
+			max_tokens: 1,
+			temperature: 0,
+		}),
+		signal,
+	});
+
+	if (response.ok) {
+		return;
+	}
+
+	throw await createApiKeyValidationError(options.provider, response);
+}
+
+/**
+ * Validate an API key against an Anthropic-compatible messages endpoint.
+ */
+export async function validateAnthropicCompatibleApiKey(options: AnthropicCompatibleValidationOptions): Promise<void> {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const baseUrl = normalizeAnthropicCompatibleBaseUrl(options.baseUrl);
+	const fetchImpl = options.fetch ?? fetch;
+
+	const response = await fetchImpl(`${baseUrl}/v1/messages`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"anthropic-version": "2023-06-01",
+			"x-api-key": options.apiKey,
+		},
+		body: JSON.stringify({
+			model: options.model,
+			messages: [{ role: "user", content: "ping" }],
+			max_tokens: 1,
+		}),
+		signal,
+	});
+
+	if (response.ok) {
+		return;
+	}
+
+	throw await createApiKeyValidationError(options.provider, response);
+}
+
+/**
+ * Validate an API key against a provider models endpoint.
+ *
+ * Useful for providers where access to specific models may vary by plan and
+ * should not block key validation.
+ */
+export async function validateApiKeyAgainstModelsEndpoint(options: ModelListValidationOptions): Promise<void> {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const fetchImpl = options.fetch ?? fetch;
+
+	const response = await fetchImpl(options.modelsUrl, {
+		method: "GET",
+		headers: {
+			...(resolveValidationHeaders(options.headers) ?? {}),
+			Authorization: `Bearer ${options.apiKey}`,
+		},
+		signal,
+	});
+
+	if (response.ok) {
+		return;
+	}
+
+	throw await createApiKeyValidationError(options.provider, response);
+}

package/src/registry/aws.ts

@@ -0,0 +1,57 @@
+import * as fs from "node:fs";
+import { $env } from "@linxiraos/pi-utils";
+import { hasConfiguredAwsProfile } from "../utils/aws-profile";
+import { AUTHENTICATED_SENTINEL } from "./types";
+
+export interface AwsBedrockProviderOptions extends Readonly<Record<string, unknown>> {
+	/** AWS region used in the service endpoint and SigV4 credential scope. */
+	region?: string;
+	/** Named AWS shared-credentials/config profile. */
+	profile?: string;
+	/** Amazon Bedrock API key sent as a bearer token, ahead of SigV4 credential resolution. */
+	bearerToken?: string;
+}
+
+function isEc2Host(): boolean {
+	for (const candidate of [
+		"/sys/hypervisor/uuid",
+		"/sys/devices/virtual/dmi/id/product_uuid",
+		"/sys/devices/virtual/dmi/id/board_asset_tag",
+	]) {
+		try {
+			const value = fs.readFileSync(candidate, "utf8").trim().toLowerCase();
+			if (value.startsWith("ec2")) return true;
+		} catch {
+			// Missing/unreadable DMI metadata means this probe is inconclusive.
+		}
+	}
+	return false;
+}
+
+export function hasAwsCredentialSource(): boolean {
+	const hasEcsCredentials = !!$env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || !!$env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+	const hasWebIdentity = !!$env.AWS_WEB_IDENTITY_TOKEN_FILE && !!$env.AWS_ROLE_ARN;
+	const hasProfile = hasConfiguredAwsProfile();
+	const hasInstanceRole =
+		$env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true" &&
+		(!!$env.AWS_EC2_METADATA_SERVICE_ENDPOINT || isEc2Host());
+	return !!(
+		($env.AWS_ACCESS_KEY_ID && $env.AWS_SECRET_ACCESS_KEY) ||
+		$env.AWS_BEARER_TOKEN_BEDROCK ||
+		hasWebIdentity ||
+		hasProfile ||
+		hasEcsCredentials ||
+		hasInstanceRole
+	);
+}
+
+/** Registry key marker for AWS transports that resolve their own bearer/IAM credentials. */
+export function resolveAwsRegistryApiKey(): string | undefined {
+	return hasAwsCredentialSource() ? AUTHENTICATED_SENTINEL : undefined;
+}
+
+/** Resolve a real AWS bearer token while filtering the registry's auth marker. */
+export function resolveAwsBearerToken(apiKey?: string, bearerToken?: string): string | undefined {
+	const resolvedApiKey = apiKey === AUTHENTICATED_SENTINEL ? undefined : apiKey;
+	return bearerToken || resolvedApiKey || $env.AWS_BEARER_TOKEN_BEDROCK;
+}

package/src/registry/azure.ts

@@ -0,0 +1,6 @@
+import type { ProviderDefinition } from "./types";
+
+export const azureProvider = {
+	id: "azure",
+	name: "Azure OpenAI",
+} as const satisfies ProviderDefinition;