@oh-my-pi/pi-catalog 18.1.4 → 18.1.5

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [18.1.5] - 2026-09-03
+
+### Added
+
+- Added the Abliteration (abliteration.ai) provider, including its documented abliterated-model catalog and live model discovery.
+- Added the GLM 5.3 Promo 50 model.
+- Added computer-use capability metadata to model configurations.
+- Added declarative provider authentication policies covering login, refresh, environment-key, and credential behavior, with generated compatibility data and typed accessors.
+
+### Changed
+
+- Gemini 3.8 Flash now supports reasoning modes and image inputs.
+- Updated the GitHub Copilot API version to 2026-08-01.
+- Reduced input pricing for the minimax/minimax-m2 model.
+- Renamed Meta Model API contributor SKUs to use the Muse Spark 1.x (C) naming.
+
+### Fixed
+
+- GitHub Copilot model discovery now respects the Copilot CLI identity, ensuring eligible enterprise and experimental models are available.
+- Fixed startup failures when discovering Bedrock-style Mistral Mixtral models.
+- Fixed Muse Spark 1.3 contributor models on OpenCode gateways so they use the correct Responses API route.
+- Updated Meta and OpenCode Muse Spark 1.3 model metadata and capabilities, including context windows, reasoning levels, image input, pricing, and model naming; media-only Muse SKUs are no longer presented as chat models.
+
 ## [18.1.4] - 2026-09-02
 
 ### Changed

package/dist/types/compat/auth-ids.d.ts

@@ -0,0 +1,4 @@
+/** Every provider with an `auth/<id>.kdl` policy. */
+export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "cline-pass" | "cloudflare-ai-gateway" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "synthetic" | "tavily" | "together" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+/** Providers whose policy declares a `login` flow (the `/login` roster). */
+export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "cline-pass" | "cloudflare-ai-gateway" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "synthetic" | "tavily" | "together" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";

package/dist/types/compat/auth.d.ts

@@ -0,0 +1,7 @@
+import type { CompiledAuthProvider } from "./types.js";
+/** Every compiled auth provider in `/login` display order. */
+export declare function authProviders(): readonly CompiledAuthProvider[];
+/** The compiled auth policy for one provider id, if declared. */
+export declare function authPolicyFor(provider: string): CompiledAuthProvider | undefined;
+/** Every hook name referenced anywhere in the auth stratum, for registry completeness checks. */
+export declare function authHookNames(): Record<string, string[]>;

package/dist/types/compat/types.d.ts

@@ -302,6 +302,220 @@ export interface CompiledBehavior {
     pricingPeers: CompiledPricingPeer[];
     retiredProviders: string[];
 }
+/**
+ * A string setting from `auth/*.kdl` that may be overridden by environment
+ * variables (consulted in order before `value`), stored obfuscated, or
+ * resolved at runtime by a named `@oh-my-pi/pi-ai` hook.
+ */
+export interface CompiledAuthValue {
+    value?: string;
+    env?: string[];
+    /** `base64`: the rule tree stores the value base64-encoded; decode before use. */
+    encoding?: "base64";
+    /** Hook name resolving the value at runtime; mutually exclusive with `value`. */
+    hook?: string;
+}
+/** One API-key validation probe run after the user pastes a key. */
+export type CompiledAuthValidation = {
+    kind: "chat-completions";
+    label?: string;
+    baseUrl: string;
+    model: string;
+    tolerateModelDenied?: boolean;
+    maxTokensField?: "max_tokens" | "max_completion_tokens";
+    maxTokens?: number;
+    optional?: boolean;
+} | {
+    kind: "anthropic-messages";
+    label?: string;
+    baseUrl: string;
+    model: string;
+    optional?: boolean;
+} | {
+    kind: "models-endpoint";
+    label?: string;
+    url: string;
+    /** Env var holding an alternate base URL; `/models` is appended to it. */
+    baseUrlEnv?: string;
+    /** Hook returning extra request headers (may throw a configuration error). */
+    headersHook?: string;
+    optional?: boolean;
+};
+/** Paste-an-API-key login: optional browser hint, prompt, optional validation. */
+export interface CompiledApiKeyLogin {
+    kind: "api-key";
+    authUrl?: string;
+    instructions?: string;
+    prompt: string;
+    placeholder?: string;
+    /** Returned for an empty paste; presence also allows an empty answer. */
+    emptyFallback?: string;
+    normalize?: "strip-bearer";
+    validate?: CompiledAuthValidation;
+}
+/** How one `OAuthCredentials` field is derived from a token response. */
+export interface CompiledCredentialField {
+    /** Dot path into the JSON response body. */
+    path?: string;
+    /** JWT claim name read from the access token payload (first present wins). */
+    claim?: string[];
+    literal?: string;
+}
+/** Expiry derivation for a token response. */
+export type CompiledCredentialExpiry = {
+    mode: "seconds";
+    path: string;
+    fromPath?: string;
+    skewMs: number;
+} | {
+    mode: "jwt";
+    skewMs: number;
+    fallbackMs?: number;
+} | {
+    mode: "never";
+};
+/** Token-response → `OAuthCredentials` projection. */
+export interface CompiledCredentialMap {
+    access: CompiledCredentialField;
+    refresh?: CompiledCredentialField;
+    expires: CompiledCredentialExpiry;
+    email?: CompiledCredentialField;
+    accountId?: CompiledCredentialField;
+    orgId?: CompiledCredentialField;
+    orgName?: CompiledCredentialField;
+    projectId?: CompiledCredentialField;
+    apiEndpoint?: CompiledCredentialField;
+    enterpriseUrl?: CompiledCredentialField;
+}
+/** Bearer GET that enriches credentials with identity fields. */
+export interface CompiledUserinfo {
+    url: string;
+    email?: string;
+    accountId?: string;
+}
+/**
+ * One token-endpoint style request. `params` values may use `{placeholders}`
+ * (`code`, `state`, `redirect_uri`, `code_verifier`, `client_id`,
+ * `client_secret`, `refresh_token`, `device_code`, `scope`, `base`).
+ */
+export interface CompiledOAuthRequest {
+    url: CompiledAuthValue;
+    body: "form" | "json";
+    /** Include the grant's standard parameter set before `params`. */
+    standard: boolean;
+    params: Record<string, string>;
+    headers: Record<string, string>;
+    timeoutMs?: number;
+}
+/** Loopback callback configuration for authorization-code logins. */
+export interface CompiledCallback {
+    port: number;
+    path: string;
+    hostname: string;
+    redirectUri?: CompiledAuthValue;
+    portFallback: boolean;
+    manualOnly: boolean;
+}
+/** Authorization-code login through the loopback callback server. */
+export interface CompiledOAuthCodeLogin {
+    kind: "oauth-code";
+    clientId?: CompiledAuthValue;
+    clientSecret?: CompiledAuthValue;
+    authorizeUrl: CompiledAuthValue;
+    scopes: string[];
+    scopeSeparator: string;
+    pkce: boolean;
+    state: "hex" | "uuid" | "none";
+    /** Include the standard authorize query set before `authorizeParams`. */
+    standardAuthorizeParams: boolean;
+    authorizeParams: Record<string, string>;
+    instructions?: string;
+    callback: CompiledCallback;
+    token: CompiledOAuthRequest;
+    credential: CompiledCredentialMap;
+    userinfo?: CompiledUserinfo;
+    /** Hook run on the mapped credentials with the raw token response. */
+    afterExchange?: string;
+    /** Manual input starting with `prefix` is a pasted API key, validated at `validateUrl`. */
+    pasteKey?: {
+        prefix: string;
+        validateUrl: string;
+    };
+}
+/** RFC 8628 device-code login. */
+export interface CompiledDeviceCodeLogin {
+    kind: "device-code";
+    clientId: CompiledAuthValue;
+    /** `{base}` placeholder source for request URLs. */
+    baseUrl?: CompiledAuthValue;
+    scopes: string[];
+    scopeSeparator: string;
+    /** Hook returning headers merged into every request of the flow. */
+    headersHook?: string;
+    device: CompiledOAuthRequest;
+    token: CompiledOAuthRequest;
+    response: {
+        userCode: string;
+        deviceCode: string;
+        verificationUri: string;
+        verificationUriComplete?: string;
+        interval?: string;
+        expiresIn?: string;
+    };
+    /** `{user_code}` placeholder allowed. */
+    instructions: string;
+    credential: CompiledCredentialMap;
+    userinfo?: CompiledUserinfo;
+    afterExchange?: string;
+}
+/** Login implemented entirely by a named hook. */
+export interface CompiledCustomLogin {
+    kind: "custom";
+    hook: string;
+}
+export type CompiledLogin = CompiledApiKeyLogin | CompiledOAuthCodeLogin | CompiledDeviceCodeLogin | CompiledCustomLogin;
+/** Refresh-token grant declared for a provider. */
+export type CompiledRefresh = {
+    kind: "none";
+} | {
+    kind: "hook";
+    hook: string;
+} | {
+    kind: "request";
+    token: CompiledOAuthRequest;
+    /** Stored credential fields that must be present before refreshing. */
+    require: string[];
+    credential: CompiledCredentialMap;
+    userinfo?: CompiledUserinfo;
+    afterRefresh?: string;
+    headersHook?: string;
+};
+/** One provider's compiled auth policy (`auth/<id>.kdl`). */
+export interface CompiledAuthProvider {
+    id: string;
+    name: string;
+    env?: {
+        vars: string[];
+    } | {
+        hook: string;
+    };
+    allowsMissingApiKey?: boolean;
+    available?: boolean;
+    showInLoginList?: boolean;
+    storeAs?: string;
+    callbackPort?: number;
+    pasteCode?: boolean;
+    apiKeyFormat: "bearer" | "structured";
+    expiry?: "jwt-or-never";
+    /** `api-key`: an OAuth login persists only `credentials.access` as a plain API key. */
+    result?: "api-key";
+    login?: CompiledLogin;
+    refresh?: CompiledRefresh;
+}
+/** Compiled auth stratum: providers in `/login` display order. */
+export interface CompiledAuth {
+    providers: CompiledAuthProvider[];
+}
 /** The complete compiled rule tree persisted as `rules.json`. */
 export interface CompiledCompatRules {
     /** Compiled-format version; bump on incompatible shape changes. */
@@ -311,6 +525,7 @@ export interface CompiledCompatRules {
     taxonomy: CompiledTaxonomy;
     cascade: CompiledCascade;
     behavior: CompiledBehavior;
+    auth: CompiledAuth;
 }
 /** Structured identity of one classified model. */
 export interface ModelIdentity {

package/dist/types/provider-models/descriptors.d.ts

@@ -7,6 +7,15 @@
  */
 import type { ModelManagerConfig, ProviderCatalogEntry, ProviderDescriptor } from "./descriptor-types.js";
 export declare const CATALOG_PROVIDERS: readonly [{
+    readonly id: "abliteration";
+    readonly defaultModel: "abliterated-model";
+    readonly envVars: readonly ["ABLITERATION_API_KEY", "ABLIT_KEY"];
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("../index.js").ModelManagerOptions<"openai-responses", unknown>;
+    readonly dynamicModelsAuthoritative: true;
+    readonly catalogDiscovery: {
+        readonly label: "Abliteration";
+    };
+}, {
     readonly id: "aiand";
     readonly defaultModel: "moonshotai/kimi-k2.7-code";
     readonly envVars: readonly ["AIAND_API_KEY"];

package/dist/types/provider-models/openai-compat.d.ts

@@ -488,6 +488,12 @@ export interface CoreWeaveModelManagerConfig {
     fetch?: FetchImpl;
 }
 export declare function coreWeaveModelManagerOptions(config?: CoreWeaveModelManagerConfig): ModelManagerOptions<"openai-completions">;
+/**
+ * Muse Spark revisions served by Meta's first-party Responses API. Meta's
+ * `/v1/models` lists bare ids with no capability metadata, so every revision
+ * must be seeded here or discovery yields a text-only, non-reasoning model
+ * with an unknown context window.
+ */
 export declare const META_MUSE_STATIC_MODELS: readonly ModelSpec<"openai-responses">[];
 /**
  * OpenAI frontier models served exclusively through Bedrock Mantle's Responses
@@ -531,6 +537,21 @@ export interface AiandModelManagerConfig {
  * pricing metadata, so discovery is authoritative over the bundled seed.
  */
 export declare function aiandModelManagerOptions(config?: AiandModelManagerConfig): ModelManagerOptions<"openai-completions">;
+/**
+ * Documented abliteration.ai catalog (docs.abliteration.ai/models, 2026-09)
+ * bundled so the provider is usable when generation and first boot have no
+ * live key. The `/v1/models` response is authoritative once discovery runs.
+ * Rows carry only the documented limits and pricing; the per-model reasoning
+ * ladders, alias map and wire quirks come from `rules/classes/glm.kdl` and
+ * `rules/providers/abliteration.kdl` via `buildModel`.
+ */
+export declare const ABLITERATION_STATIC_MODELS: readonly ModelSpec<"openai-responses">[];
+export interface AbliterationModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+    fetch?: FetchImpl;
+}
+export declare function abliterationModelManagerOptions(config?: AbliterationModelManagerConfig): ModelManagerOptions<"openai-responses">;
 /**
  * Documented Yolo-Auto catalog (yolo-auto.com/docs, 2026-08) bundled so the
  * provider is usable when generation and first boot have no live key. The

package/dist/types/types.d.ts

@@ -781,8 +781,10 @@ export type ResolvedDevinCompat = Required<DevinCompat>;
 export interface GoogleCompat {
     /** Whether functionCall/functionResponse parts carry the `id` field. */
     supportsFunctionPartId?: boolean;
-    /** Whether replayed thinking parts must be skipped when they carry no signature. */
+    /** Add the bypass sentinel to every unsigned Gemini function call. */
     requiresSkipThoughtSignature?: boolean;
+    /** Add the bypass sentinel when a Gemini turn's first function call is unsigned. */
+    requiresSkipThoughtSignatureOnFirstFunctionCall?: boolean;
     /** Drop unsigned thinking blocks from replayed history (Antigravity Claude). */
     dropUnsignedThinking?: boolean;
     /** Cloud Code Assist legacy `parameters` schema field instead of `parametersJsonSchema`. */

package/dist/types/wire/github-copilot.d.ts

@@ -1,12 +1,15 @@
 import type { FetchImpl } from "../types.js";
-/**
- * GitHub Copilot wire metadata: API-key envelope parsing and endpoint
- * derivation shared by catalog discovery and the pi-ai OAuth flow. The device
- * login / token refresh flow lives in `@oh-my-pi/pi-ai`'s registry.
- */
-export declare const COPILOT_USER_AGENT: "opencode/1.3.15";
-export declare const OPENCODE_HEADERS: {
-    readonly "User-Agent": "opencode/1.3.15";
+/** Headers sent by Copilot CLI to GitHub API and OAuth endpoints. */
+export declare const COPILOT_GITHUB_HEADERS: {
+    readonly "User-Agent": "copilot/1.0.82";
+};
+/** Copilot CLI identity sent to the Copilot API. */
+export declare const COPILOT_CAPI_IDENTITY_HEADERS: {
+    readonly "User-Agent": "copilot/1.0.82";
+    readonly "Editor-Version": "copilot/1.0.82";
+    readonly "Copilot-Integration-Id": "copilot-developer-cli";
+    readonly "Copilot-Harness-Id": "copilot-sdk";
+    readonly "Openai-Intent": "conversation-agent";
 };
 /**
  * Copilot API version sent on `api.githubcopilot.com` requests (`/models`,
@@ -17,12 +20,28 @@ export declare const OPENCODE_HEADERS: {
  * of 1M for Claude Opus). Never send this to `api.github.com` REST endpoints —
  * they validate `X-GitHub-Api-Version` against the REST version vocabulary.
  */
-export declare const COPILOT_API_VERSION: "2026-06-01";
-/** Headers for `api.githubcopilot.com` (capi) requests: discovery, chat, policy. */
+export declare const COPILOT_API_VERSION: "2026-08-01";
+/** Headers shared by Copilot API model requests and model definitions. */
 export declare const COPILOT_API_HEADERS: {
-    readonly "User-Agent": "opencode/1.3.15";
-    readonly "X-GitHub-Api-Version": "2026-06-01";
+    readonly "User-Agent": "copilot/1.0.82";
+    readonly "Editor-Version": "copilot/1.0.82";
+    readonly "Copilot-Integration-Id": "copilot-developer-cli";
+    readonly "Copilot-Harness-Id": "copilot-sdk";
+    readonly "Openai-Intent": "conversation-agent";
+    readonly "X-GitHub-Api-Version": "2026-08-01";
+};
+/** Copilot CLI headers for user-initiated model discovery. */
+export declare const COPILOT_DISCOVERY_HEADERS: {
+    readonly "User-Agent": "copilot/1.0.82";
+    readonly "Editor-Version": "copilot/1.0.82";
+    readonly "Copilot-Integration-Id": "copilot-developer-cli";
+    readonly "Copilot-Harness-Id": "copilot-sdk";
+    readonly "Openai-Intent": "conversation-agent";
+    readonly "X-GitHub-Api-Version": "2026-08-01";
+    readonly "X-Initiator": "user";
 };
+/** Preserve model-specific headers while enforcing the current Copilot API identity. */
+export declare function mergeCopilotApiHeaders(headers?: Readonly<Record<string, string>>): Record<string, string>;
 export type ParsedGitHubCopilotApiKey = {
     accessToken: string;
     enterpriseUrl?: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-catalog",
-	"version": "18.1.4",
+	"version": "18.1.5",
 	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
 	"homepage": "https://omp.sh",
 	"author": "Stencil Labs, Inc.",
@@ -35,12 +35,12 @@
 		"gen:proto": "bun scripts/generate-protocols.ts"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.1.4",
-		"@oh-my-pi/pi-utils": "18.1.4"
+		"@oh-my-pi/omptype": "18.1.5",
+		"@oh-my-pi/pi-utils": "18.1.5"
 	},
 	"devDependencies": {
 		"@bgotink/kdl": "0.4.0",
-		"@oh-my-pi/pi-ai": "18.1.4",
+		"@oh-my-pi/pi-ai": "18.1.5",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/compat/auth-ids.ts

@@ -0,0 +1,157 @@
+// Generated by `bun run gen:compat` from `src/compat/rules/auth/*.kdl`; do not edit.
+
+/** Every provider with an `auth/<id>.kdl` policy. */
+export type AuthProviderId =
+	| "abliteration"
+	| "aiand"
+	| "aimlapi"
+	| "alibaba-coding-plan"
+	| "alibaba-token-plan"
+	| "amazon-bedrock"
+	| "anthropic"
+	| "azure"
+	| "baseten"
+	| "bedrock-mantle"
+	| "cerebras"
+	| "cline-pass"
+	| "cloudflare-ai-gateway"
+	| "coreweave"
+	| "cursor"
+	| "deepinfra"
+	| "deepseek"
+	| "devin"
+	| "exa"
+	| "firepass"
+	| "fireworks"
+	| "github-copilot"
+	| "gitlab-duo"
+	| "gitlab-duo-agent"
+	| "gmi-cloud"
+	| "google"
+	| "google-antigravity"
+	| "google-gemini-cli"
+	| "google-vertex"
+	| "groq"
+	| "huggingface"
+	| "kagi"
+	| "kilo"
+	| "kimi-code"
+	| "litellm"
+	| "llama.cpp"
+	| "lm-studio"
+	| "meta"
+	| "minimax"
+	| "minimax-code"
+	| "minimax-code-cn"
+	| "mistral"
+	| "moonshot"
+	| "nanogpt"
+	| "novita"
+	| "nvidia"
+	| "ollama"
+	| "ollama-cloud"
+	| "openai"
+	| "openai-codex"
+	| "openai-codex-device"
+	| "opencode-go"
+	| "opencode-zen"
+	| "openrouter"
+	| "parallel"
+	| "perplexity"
+	| "qianfan"
+	| "qwen-portal"
+	| "sakana"
+	| "siliconflow"
+	| "siliconflow-cn"
+	| "synthetic"
+	| "tavily"
+	| "together"
+	| "umans"
+	| "venice"
+	| "vercel-ai-gateway"
+	| "vllm"
+	| "wafer-serverless"
+	| "xai"
+	| "xai-oauth"
+	| "xiaomi"
+	| "xiaomi-token-plan-ams"
+	| "xiaomi-token-plan-cn"
+	| "xiaomi-token-plan-sgp"
+	| "yolo-auto"
+	| "zai"
+	| "zai-coding-plan"
+	| "zenmux"
+	| "zhipu-coding-plan";
+
+/** Providers whose policy declares a `login` flow (the `/login` roster). */
+export type LoginProviderId =
+	| "abliteration"
+	| "aiand"
+	| "alibaba-coding-plan"
+	| "alibaba-token-plan"
+	| "anthropic"
+	| "baseten"
+	| "cerebras"
+	| "cline-pass"
+	| "cloudflare-ai-gateway"
+	| "coreweave"
+	| "cursor"
+	| "deepinfra"
+	| "deepseek"
+	| "devin"
+	| "exa"
+	| "firepass"
+	| "fireworks"
+	| "github-copilot"
+	| "gitlab-duo"
+	| "gitlab-duo-agent"
+	| "gmi-cloud"
+	| "google-antigravity"
+	| "google-gemini-cli"
+	| "huggingface"
+	| "kagi"
+	| "kilo"
+	| "kimi-code"
+	| "litellm"
+	| "llama.cpp"
+	| "lm-studio"
+	| "meta"
+	| "minimax-code"
+	| "minimax-code-cn"
+	| "moonshot"
+	| "nanogpt"
+	| "novita"
+	| "nvidia"
+	| "ollama"
+	| "ollama-cloud"
+	| "openai-codex"
+	| "openai-codex-device"
+	| "opencode-go"
+	| "opencode-zen"
+	| "openrouter"
+	| "parallel"
+	| "perplexity"
+	| "qianfan"
+	| "qwen-portal"
+	| "sakana"
+	| "siliconflow"
+	| "siliconflow-cn"
+	| "synthetic"
+	| "tavily"
+	| "together"
+	| "umans"
+	| "venice"
+	| "vercel-ai-gateway"
+	| "vllm"
+	| "wafer-serverless"
+	| "xai"
+	| "xai-oauth"
+	| "xiaomi"
+	| "xiaomi-token-plan-ams"
+	| "xiaomi-token-plan-cn"
+	| "xiaomi-token-plan-sgp"
+	| "yolo-auto"
+	| "zai"
+	| "zai-coding-plan"
+	| "zenmux"
+	| "zhipu-coding-plan";

package/src/compat/auth.ts

@@ -0,0 +1,59 @@
+/**
+ * Typed accessors over the compiled auth stratum (`rules/auth/*.kdl`): per
+ * provider display metadata, env-var fallbacks and the declarative login /
+ * refresh flow that `@oh-my-pi/pi-ai`'s registry engines interpret.
+ */
+import rules from "./rules.json";
+import type { CompiledAuthProvider } from "./types";
+
+const providers = rules.auth.providers as readonly CompiledAuthProvider[];
+const byId: Record<string, CompiledAuthProvider> = Object.fromEntries(providers.map(p => [p.id, p]));
+
+/** Every compiled auth provider in `/login` display order. */
+export function authProviders(): readonly CompiledAuthProvider[] {
+	return providers;
+}
+
+/** The compiled auth policy for one provider id, if declared. */
+export function authPolicyFor(provider: string): CompiledAuthProvider | undefined {
+	return byId[provider];
+}
+
+/** Every hook name referenced anywhere in the auth stratum, for registry completeness checks. */
+export function authHookNames(): Record<string, string[]> {
+	const names: Record<string, string[]> = {};
+	const add = (kind: string, name: string | undefined) => {
+		if (!name) return;
+		(names[kind] ??= []).push(name);
+	};
+	for (const p of providers) {
+		if (p.env && "hook" in p.env) add("env", p.env.hook);
+		const login = p.login;
+		if (login?.kind === "custom") add("login", login.hook);
+		if (login?.kind === "api-key" && login.validate?.kind === "models-endpoint") {
+			add("headers", login.validate.headersHook);
+		}
+		if (login?.kind === "oauth-code") {
+			add("after-exchange", login.afterExchange);
+			add("value", login.clientId?.hook);
+			add("value", login.authorizeUrl.hook);
+			add("value", login.token.url.hook);
+		}
+		if (login?.kind === "device-code") {
+			add("after-exchange", login.afterExchange);
+			add("headers", login.headersHook);
+			add("value", login.clientId.hook);
+			add("value", login.baseUrl?.hook);
+			add("value", login.device.url.hook);
+			add("value", login.token.url.hook);
+		}
+		const refresh = p.refresh;
+		if (refresh?.kind === "hook") add("refresh", refresh.hook);
+		if (refresh?.kind === "request") {
+			add("after-exchange", refresh.afterRefresh);
+			add("headers", refresh.headersHook);
+			add("value", refresh.token.url.hook);
+		}
+	}
+	return names;
+}

package/src/compat/axes.ts

@@ -217,6 +217,9 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"flash-stream-leak-workaround": wire("flashStreamLeakWorkaround", ["google"]),
 	"multimodal-function-response": wire("multimodalFunctionResponse", ["google"]),
 	"requires-skip-thought-signature": wire("requiresSkipThoughtSignature", ["google"]),
+	"requires-skip-thought-signature-on-first-function-call": wire("requiresSkipThoughtSignatureOnFirstFunctionCall", [
+		"google",
+	]),
 	"supports-function-part-id": wire("supportsFunctionPartId", ["google"]),
 
 	// ── wire: shared across surfaces ──

package/src/compat/resolve.ts

@@ -903,6 +903,7 @@ function resolveGooglePolicy(
 	const compat: ResolvedGoogleCompat = {
 		supportsFunctionPartId: false,
 		requiresSkipThoughtSignature: false,
+		requiresSkipThoughtSignatureOnFirstFunctionCall: false,
 		dropUnsignedThinking: false,
 		ccaLegacyParametersSchema: false,
 		multimodalFunctionResponse: false,