@oh-my-pi/pi-ai 17.2.5 → 17.2.6

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [17.2.6] - 2026-08-03
+
+### Added
+
+- Added profile-aware Bedrock Mantle region selection, authenticated model discovery, bearer-token or SigV4 authentication, and credential refresh handling for OpenAI Responses models.
+
+### Fixed
+
+- Fixed an issue where Ollama requests without a user-role message would fail to generate output or silently fail with a misleading error.
+
 ## [17.2.5] - 2026-08-03
 
 ### Changed

package/dist/types/dialect/examples.d.ts

@@ -8,3 +8,11 @@ import type { InbandTool } from "./types.js";
  * tool, and payload args (commands, code, patches) read best verbatim.
  */
 export declare function renderToolExamples(tool: InbandTool, intentField?: string): string;
+/**
+ * Render a tool's examples as JSDoc-style `@example` lines for comment-gutter
+ * contexts (the Harmony `namespace functions` inventory): `@example "caption"`
+ * followed by the call in the same Python kwargs syntax as the wire block. The
+ * tag line delimits each example, so no XML envelope is needed — which is why
+ * the inventory uses this instead of `//`-prefixing the `<examples>` block.
+ */
+export declare function renderToolExamplesJsdoc(tool: InbandTool): string;

package/dist/types/error/aws.d.ts

@@ -9,7 +9,11 @@ export type AwsCredentialsErrorKind =
 /** SSO `GetRoleCredentials` call failed or returned no role. */
  | "sso-role"
 /** External `credential_process` failed, timed out, or emitted bad output. */
- | "credential-process";
+ | "credential-process"
+/** STS web-identity exchange failed or returned malformed credentials. */
+ | "web-identity"
+/** ECS/container credential endpoint failed or returned malformed credentials. */
+ | "container";
 /** A failure resolving AWS credentials for the Bedrock provider. */
 export declare class AwsCredentialsError extends Error {
     readonly kind: AwsCredentialsErrorKind;

package/dist/types/providers/aws-credentials.d.ts

@@ -4,16 +4,11 @@
  * Chain (first hit wins):
  *  1. Static credentials from the environment
  *     (`AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` [+ `AWS_SESSION_TOKEN`]).
- *  2. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO):
- *      - static `aws_access_key_id` / `aws_secret_access_key` / `aws_session_token`
- *      - SSO profile referencing a cached token in `~/.aws/sso/cache/*.json`,
- *        which we exchange for short-lived role credentials via
- *        `https://portal.sso.{region}.amazonaws.com/federation/credentials`.
- *      - `credential_process` — an external command emitting the AWS SDK
- *        `Version: 1` JSON envelope on stdout. Used by `aws-vault`, `granted`,
- *        in-house brokers, etc.
- *  3. EC2 IMDSv2 (only when `AWS_EC2_METADATA_DISABLED` is unset / falsey and
- *     `169.254.169.254` is reachable within a 1 s timeout).
+ *  2. Web identity (`AWS_WEB_IDENTITY_TOKEN_FILE` + `AWS_ROLE_ARN`).
+ *  3. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO):
+ *      - static keys, SSO, or `credential_process`.
+ *  4. ECS/container credentials from `AWS_CONTAINER_CREDENTIALS_*`.
+ *  5. EC2 IMDSv2 when metadata is enabled.
  *
  * Resolved credentials are cached process-wide per profile and refreshed
  * 60 s before `Expiration` to absorb clock skew.

package/dist/types/providers/bedrock-mantle.d.ts

@@ -0,0 +1,13 @@
+import { type AwsBedrockProviderOptions } from "../registry/aws.js";
+import type { FetchImpl, Model } from "../types.js";
+import type { OpenAIResponsesOptions } from "./openai-responses.js";
+export type BedrockMantleProviderOptions = AwsBedrockProviderOptions;
+export interface BedrockMantleOptions extends OpenAIResponsesOptions {
+    providerOptions?: BedrockMantleProviderOptions;
+}
+export declare function createBedrockMantleAuthenticatedFetch(options?: BedrockMantleOptions): FetchImpl;
+export interface PreparedBedrockMantleRequest {
+    model: Model<"openai-responses">;
+    options: OpenAIResponsesOptions;
+}
+export declare function prepareBedrockMantleRequest(model: Model<"openai-responses">, options: BedrockMantleOptions): PreparedBedrockMantleRequest;

package/dist/types/registry/amazon-bedrock.d.ts

@@ -1,5 +1,11 @@
+import { resolveAwsRegistryApiKey } from "./aws.js";
 export declare const amazonBedrockProvider: {
     readonly id: "amazon-bedrock";
     readonly name: "Amazon Bedrock";
-    readonly envKeys: () => "<authenticated>" | undefined;
+    readonly envKeys: typeof resolveAwsRegistryApiKey;
+    readonly mapSimpleOptions: (options: import("../index.js").SimpleStreamOptions) => {
+        region: string | undefined;
+        profile: string | undefined;
+        bearerToken: string | undefined;
+    };
 };

package/dist/types/registry/aws.d.ts

@@ -0,0 +1,13 @@
+export interface AwsBedrockProviderOptions extends Readonly<Record<string, unknown>> {
+    /** AWS region used in the service endpoint and SigV4 credential scope. */
+    region?: string;
+    /** Named AWS shared-credentials/config profile. */
+    profile?: string;
+    /** Amazon Bedrock API key sent as a bearer token, ahead of SigV4 credential resolution. */
+    bearerToken?: string;
+}
+export declare function hasAwsCredentialSource(): boolean;
+/** Registry key marker for AWS transports that resolve their own bearer/IAM credentials. */
+export declare function resolveAwsRegistryApiKey(): string | undefined;
+/** Resolve a real AWS bearer token while filtering the registry's auth marker. */
+export declare function resolveAwsBearerToken(apiKey?: string, bearerToken?: string): string | undefined;

package/dist/types/registry/bedrock-mantle.d.ts

@@ -0,0 +1,22 @@
+import type { Model } from "../types.js";
+import { resolveAwsRegistryApiKey } from "./aws.js";
+export declare const bedrockMantleProvider: {
+    readonly id: "bedrock-mantle";
+    readonly name: "Amazon Bedrock Mantle";
+    readonly envKeys: typeof resolveAwsRegistryApiKey;
+    readonly allowsMissingApiKey: true;
+    readonly prepareRequest: (model: Model<import("@oh-my-pi/pi-catalog").Api>, options: import("../index.js").StreamOptions) => import("../providers/bedrock-mantle.js").PreparedBedrockMantleRequest;
+    readonly mapSimpleOptions: (options: import("../index.js").SimpleStreamOptions) => {
+        providerOptions: Readonly<Record<string, unknown>> | undefined;
+    };
+    readonly prepareModelDiscovery: (config: import("./types.js").ProviderModelDiscoveryConfig) => {
+        baseUrl?: string;
+        fetch?: import("@oh-my-pi/pi-utils").FetchImpl;
+        apiKey: undefined;
+        authenticated: false;
+    } | {
+        authenticated: true;
+        baseUrl: string;
+        fetch: import("@oh-my-pi/pi-utils").FetchImpl;
+    };
+};

package/dist/types/registry/registry.d.ts

@@ -25,7 +25,12 @@ declare const ALL: ({
 } | {
     readonly id: "amazon-bedrock";
     readonly name: "Amazon Bedrock";
-    readonly envKeys: () => "<authenticated>" | undefined;
+    readonly envKeys: typeof import("./aws.js").resolveAwsRegistryApiKey;
+    readonly mapSimpleOptions: (options: import("../index.js").SimpleStreamOptions) => {
+        region: string | undefined;
+        profile: string | undefined;
+        bearerToken: string | undefined;
+    };
 } | {
     readonly id: "anthropic";
     readonly name: "Anthropic (Claude Pro/Max)";
@@ -41,6 +46,25 @@ declare const ALL: ({
     readonly id: "baseten";
     readonly name: "Baseten";
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "bedrock-mantle";
+    readonly name: "Amazon Bedrock Mantle";
+    readonly envKeys: typeof import("./aws.js").resolveAwsRegistryApiKey;
+    readonly allowsMissingApiKey: true;
+    readonly prepareRequest: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>, options: import("../index.js").StreamOptions) => import("../providers/bedrock-mantle.js").PreparedBedrockMantleRequest;
+    readonly mapSimpleOptions: (options: import("../index.js").SimpleStreamOptions) => {
+        providerOptions: Readonly<Record<string, unknown>> | undefined;
+    };
+    readonly prepareModelDiscovery: (config: import("./types.js").ProviderModelDiscoveryConfig) => {
+        baseUrl?: string;
+        fetch?: import("@oh-my-pi/pi-utils").FetchImpl;
+        apiKey: undefined;
+        authenticated: false;
+    } | {
+        authenticated: true;
+        baseUrl: string;
+        fetch: import("@oh-my-pi/pi-utils").FetchImpl;
+    };
 } | {
     readonly id: "cerebras";
     readonly name: "Cerebras";

package/dist/types/registry/types.d.ts

@@ -9,6 +9,7 @@
  * (default model, model-manager factory, catalog discovery) lives in
  * `@oh-my-pi/pi-catalog`'s descriptor table.
  */
+import type { Api, FetchImpl, Model, SimpleStreamOptions, StreamOptions } from "../types.js";
 import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
 /**
  * API-key environment fallback: either a single env var name (e.g.
@@ -16,6 +17,21 @@ import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
  * the host (Vertex ADC, Bedrock credential chains, …).
  */
 export type KeyResolver = string | (() => string | undefined);
+/** Credentials are resolved by the provider transport rather than used as a bearer string. */
+export declare const AUTHENTICATED_SENTINEL = "<authenticated>";
+export interface PreparedProviderRequest {
+    readonly model: Model<Api>;
+    readonly options: StreamOptions;
+}
+export type ProviderRequestPreparer = (model: Model<Api>, options: StreamOptions) => PreparedProviderRequest;
+export type ProviderSimpleOptionsMapper = (options: SimpleStreamOptions) => Readonly<Record<string, unknown>>;
+export interface ProviderModelDiscoveryConfig {
+    readonly apiKey?: string;
+    readonly baseUrl?: string;
+    readonly fetch?: FetchImpl;
+    readonly authenticated?: boolean;
+}
+export type ProviderModelDiscoveryPreparer = (config: ProviderModelDiscoveryConfig) => ProviderModelDiscoveryConfig;
 /**
  * Declarative description of a single provider's auth/login wiring. All
  * fields are optional except `id`/`name`; presence of a field opts the
@@ -39,6 +55,14 @@ export interface ProviderDefinition {
     /** Whether to surface in the interactive login list. Defaults to true when `login` is present. */
     readonly showInLoginList?: boolean;
     readonly envKeys?: KeyResolver;
+    /** Provider transport can authenticate without a resolved API-key string. */
+    readonly allowsMissingApiKey?: boolean;
+    /** Provider-owned request shaping applied before generic API dispatch. */
+    readonly prepareRequest?: ProviderRequestPreparer;
+    /** Provider-owned projection from the generic simple-stream option bag. */
+    readonly mapSimpleOptions?: ProviderSimpleOptionsMapper;
+    /** Provider-owned authentication and endpoint setup for model discovery. */
+    readonly prepareModelDiscovery?: ProviderModelDiscoveryPreparer;
     readonly login?: (callbacks: OAuthLoginCallbacks) => Promise<OAuthCredentials | string>;
     readonly refreshToken?: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
     readonly getApiKey?: (credentials: OAuthCredentials) => string;

package/dist/types/types.d.ts

@@ -249,6 +249,11 @@ export interface StreamOptions {
      * For example, Anthropic uses `user_id` for abuse tracking and rate limiting.
      */
     metadata?: Record<string, unknown>;
+    /**
+     * Provider-owned request configuration. Provider hooks interpret this bag;
+     * generic API transports do not forward its fields onto the wire.
+     */
+    providerOptions?: Readonly<Record<string, unknown>>;
     /** OpenAI Responses/Codex response fields to include verbatim. */
     include?: OpenAIResponseInclude[];
     /**

package/dist/types/utils/aws-profile.d.ts

@@ -0,0 +1,17 @@
+/** INI sections with `profile ` / `sso-session ` prefixes normalized. */
+export type AwsIniFile = Record<string, Record<string, string>>;
+export declare function parseAwsIni(text: string): AwsIniFile;
+/** Resolve the selected shared-credentials profile. */
+export declare function resolveAwsProfile(profile?: string): string;
+/**
+ * Whether the shared config file participates in profile/region resolution.
+ * Explicit profile selection enables it; the implicit default profile follows
+ * the AWS SDK's `AWS_SDK_LOAD_CONFIG` opt-in.
+ */
+export declare function shouldLoadAwsSharedConfig(profile?: string): boolean;
+export declare function resolveAwsProfileRegion(profile?: string): string | undefined;
+/** Region selected by the environment or active shared-config profile. */
+export declare function resolveAwsAmbientRegion(profile?: string): string | undefined;
+/** Resolve the region precedence shared by AWS transports and credential exchanges. */
+export declare function resolveAwsRegion(explicitRegion?: string, profile?: string): string;
+export declare function hasConfiguredAwsProfile(profile?: string): boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.2.5",
+	"version": "17.2.6",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/pi-catalog": "17.2.5",
-		"@oh-my-pi/pi-utils": "17.2.5",
-		"@oh-my-pi/pi-wire": "17.2.5",
+		"@oh-my-pi/pi-catalog": "17.2.6",
+		"@oh-my-pi/pi-utils": "17.2.6",
+		"@oh-my-pi/pi-wire": "17.2.6",
 		"arktype": "2.2.3",
 		"zod": "^4"
 	},

package/src/auth-broker/wire-schema-resource.ts

@@ -12,7 +12,7 @@
  * exception (standard type keeps extra keys): it preserves provider-specific extension fields so
  * they round-trip through the broker instead of being dropped (see below).
  */
-import { type Type, type } from "arktype";
+import { scope, type Type } from "arktype";
 import {
 	type ApiKeyCredential,
 	type AuthCredential,
@@ -84,6 +84,11 @@ export interface AuthBrokerWireSchemas {
 }
 
 function buildAuthBrokerWireSchemas(): AuthBrokerWireSchemas {
+	// Wire schemas validate only a handful of times per process, so ArkType's
+	// definition-time JIT codegen is startup tax. A local jitless scope skips
+	// that codegen and uses interpreted traversal; correctness is unchanged.
+	const { type } = scope({}, { jitless: true });
+
 	// ─── Credential payloads ───────────────────────────────────────────────────
 
 	/** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */

package/src/dialect/examples.ts

@@ -15,17 +15,12 @@ export function renderToolExamples(tool: InbandTool, intentField?: string): stri
 	const examples = tool.examples;
 	if (!examples?.length) return "";
 	const renderCall = (args: Record<string, unknown>): string => {
-		let soleKey: string | undefined;
-		let argCount = 0;
-		for (const key in args) {
-			argCount++;
-			soleKey = key;
-		}
-		if (argCount === 1 && soleKey !== undefined && typeof args[soleKey] === "string") {
+		const bare = bareStringArg(args);
+		if (bare !== undefined) {
 			// Bare payload. The intent placeholder still rides on the envelope so
 			// intent-traced schemas (where `i` is required) keep teaching it.
 			const intentAttr = intentField ? ` ${intentField}="${INTENT_PLACEHOLDER}"` : "";
-			return `<example${intentAttr}>\n${args[soleKey]}\n</example>`;
+			return `<example${intentAttr}>\n${bare}\n</example>`;
 		}
 		// When intent tracing injects `i` into the schema, examples must show a
 		// placeholder so the model learns to emit it. Keep it first, matching the
@@ -43,3 +38,34 @@ export function renderToolExamples(tool: InbandTool, intentField?: string): stri
 	});
 	return `<examples>\n${parts.join("\n")}\n</examples>`;
 }
+
+/**
+ * Render a tool's examples as JSDoc-style `@example` lines for comment-gutter
+ * contexts (the Harmony `namespace functions` inventory): `@example "caption"`
+ * followed by the call in the same Python kwargs syntax as the wire block. The
+ * tag line delimits each example, so no XML envelope is needed — which is why
+ * the inventory uses this instead of `//`-prefixing the `<examples>` block.
+ */
+export function renderToolExamplesJsdoc(tool: InbandTool): string {
+	const examples = tool.examples;
+	if (!examples?.length) return "";
+	const renderCall = (args: Record<string, unknown>): string => bareStringArg(args) ?? pyCall(tool.name, args);
+	const parts = examples.map(ex => {
+		const head = ex.caption ? `@example ${JSON.stringify(ex.caption)}` : "@example";
+		if ("call" in ex) return `${head}\n${renderCall(ex.call)}`;
+		if ("good" in ex) return `${head}\nWRONG:\n${renderCall(ex.bad)}\nRIGHT:\n${renderCall(ex.good)}`;
+		return ex.note ? `${head}\n${ex.note}` : head;
+	});
+	return parts.join("\n");
+}
+
+/** Sole-argument string payload, if the call has exactly one string argument. */
+function bareStringArg(args: Record<string, unknown>): string | undefined {
+	let sole: unknown;
+	let count = 0;
+	for (const key in args) {
+		count++;
+		sole = args[key];
+	}
+	return count === 1 && typeof sole === "string" ? sole : undefined;
+}

package/src/dialect/inventory.ts

@@ -1,5 +1,5 @@
 import { jsonSchemaToTypeScript, toolWireSchema } from "../utils/schema";
-import { renderToolExamples } from "./examples";
+import { renderToolExamplesJsdoc } from "./examples";
 import type { InbandTool } from "./types";
 
 /**
@@ -18,7 +18,7 @@ export function renderToolInventory(tools: readonly InbandTool[]): string {
 		if (description) {
 			for (const line of description.split("\n")) lines.push(`// ${line}`.trimEnd());
 		}
-		const examples = renderToolExamples(tool);
+		const examples = renderToolExamplesJsdoc(tool);
 		if (examples) {
 			if (description) lines.push("//");
 			for (const line of examples.split("\n")) lines.push(`// ${line}`.trimEnd());

package/src/error/aws.ts

@@ -9,7 +9,11 @@ export type AwsCredentialsErrorKind =
 	/** SSO `GetRoleCredentials` call failed or returned no role. */
 	| "sso-role"
 	/** External `credential_process` failed, timed out, or emitted bad output. */
-	| "credential-process";
+	| "credential-process"
+	/** STS web-identity exchange failed or returned malformed credentials. */
+	| "web-identity"
+	/** ECS/container credential endpoint failed or returned malformed credentials. */
+	| "container";
 
 /** A failure resolving AWS credentials for the Bedrock provider. */
 export class AwsCredentialsError extends Error {

package/src/providers/amazon-bedrock.ts

@@ -10,9 +10,10 @@
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
 import { mapEffortToAnthropicAdaptiveEffort, requireSupportedEffort } from "@oh-my-pi/pi-catalog/model-thinking";
 import { calculateCost } from "@oh-my-pi/pi-catalog/models";
-import { $env, $flag, fetchWithRetry, parseStreamingJson, parseStreamingJsonThrottled } from "@oh-my-pi/pi-utils";
+import { $flag, fetchWithRetry, parseStreamingJson, parseStreamingJsonThrottled } from "@oh-my-pi/pi-utils";
 import { renderDemotedThinking } from "../dialect/demotion";
 import * as AIError from "../error";
+import { resolveAwsBearerToken } from "../registry/aws";
 import type {
 	Api,
 	AssistantMessage,
@@ -30,6 +31,7 @@ import type {
 	ToolResultMessage,
 } from "../types";
 import { normalizeSystemPrompts, normalizeToolCallId, resolveCacheRetention } from "../utils";
+import { resolveAwsAmbientRegion } from "../utils/aws-profile";
 import {
 	clearStreamingPartialJson,
 	kStreamingBlockIndex,
@@ -74,11 +76,9 @@ export interface BedrockOptions extends StreamOptions {
 	 */
 	thinkingDisplay?: BedrockThinkingDisplay;
 }
-const AUTHENTICATED_API_KEY_SENTINEL = "<authenticated>";
 
 function resolveBearerToken(options: BedrockOptions): string | undefined {
-	const apiKey = options.apiKey === AUTHENTICATED_API_KEY_SENTINEL ? undefined : options.apiKey;
-	return options.bearerToken || apiKey || $env.AWS_BEARER_TOKEN_BEDROCK;
+	return resolveAwsBearerToken(options.apiKey, options.bearerToken);
 }
 
 function inferRegionFromBedrockArn(modelId: string): string | undefined {
@@ -149,7 +149,7 @@ function regionServesGeo(region: string, geo: string): boolean {
 function resolveBedrockRegion(modelId: string, options: BedrockOptions): string {
 	const explicit = options.region || inferRegionFromBedrockArn(modelId);
 	if (explicit) return explicit;
-	const ambient = $env.AWS_REGION || $env.AWS_DEFAULT_REGION;
+	const ambient = resolveAwsAmbientRegion(options.profile);
 	const geo = inferenceProfileGeo(modelId);
 	if (geo) {
 		if (ambient && regionServesGeo(ambient, geo)) return ambient;