@oh-my-pi/pi-catalog 18.10.2 → 18.10.4

package/src/build.ts

@@ -10,8 +10,16 @@
 import { resolveDiscoveryApi, resolveModelPolicy } from "./compat/resolve";
 import type { ModelIdentity } from "./compat/types";
 import { resolveModelTokenizer } from "./model-tokenizer";
-import { materializeTimeBasedCost } from "./pricing";
-import { type Api, MODEL_KINDS, type Model, type ModelSpec } from "./types";
+import {
+	applyDueDatedCostCard,
+	type DatedCostCard,
+	dueEffectiveRate,
+	EARLIEST_EFFECTIVE_FROM,
+	materializeTimeBasedCost,
+	NO_RECURRING_TARIFF,
+	parseDatedCostCards,
+} from "./pricing";
+import { type Api, type EffectiveTokenCost, MODEL_KINDS, type Model, type ModelCost, type ModelSpec } from "./types";
 import { cleanModelName } from "./utils";
 
 function numberField(source: object, key: string): number | undefined {
@@ -24,41 +32,6 @@ function objectPayload(value: unknown): object | undefined {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
 }
 
-/**
- * Overwrite seeded fallback rates with the latest dated card whose
- * `effectiveFrom` is already due. Leaves the seed unchanged when no card
- * has started, and never attaches a `timeBased` tariff.
- */
-function applyEffectiveFallbackRates(
-	cost: { input: number; output: number; cacheRead: number; cacheWrite: number },
-	effectiveRates: unknown,
-	now = Date.now(),
-): void {
-	const rates = objectPayload(effectiveRates);
-	if (rates === undefined) return;
-	let latestFrom = Number.NEGATIVE_INFINITY;
-	let latest: object | undefined;
-	for (const entry of Object.values(rates)) {
-		const payload = objectPayload(entry);
-		if (payload === undefined) continue;
-		const date = Reflect.get(payload, "effectiveFrom");
-		if (typeof date !== "string") continue;
-		const from = Date.parse(date);
-		if (!Number.isFinite(from) || from > now || from < latestFrom) continue;
-		latestFrom = from;
-		latest = payload;
-	}
-	if (latest === undefined) return;
-	const input = numberField(latest, "input");
-	if (input !== undefined) cost.input = input;
-	const output = numberField(latest, "output");
-	if (output !== undefined) cost.output = output;
-	const cacheRead = numberField(latest, "cacheRead");
-	if (cacheRead !== undefined) cost.cacheRead = cacheRead;
-	const cacheWrite = numberField(latest, "cacheWrite");
-	if (cacheWrite !== undefined) cost.cacheWrite = cacheWrite;
-}
-
 /** Narrow a compiled `input-modalities` axis value to the model input union. */
 function isInputModalities(value: unknown): value is ("text" | "image")[] {
 	return Array.isArray(value) && value.every(entry => entry === "text" || entry === "image");
@@ -164,52 +137,65 @@ function applyCatalogAssignments<TApi extends Api>(model: Model<TApi>, catalog:
 	}
 }
 
+/** The parsed dated cards of a row's `cost-patch` and `cost-fallback`. */
+interface DatedCostCards {
+	patch: readonly DatedCostCard[];
+	fallback: readonly DatedCostCard[];
+}
+
 /**
- * Applies reviewed catalog-data value corrections (`cost-patch`,
- * `cache-read-at-input-rate`, `limits-patch`, `long-context-cost`,
- * `context-window-floor`, `input-modalities`) onto an upstream-sourced spec. Applied by
- * `buildModel` to every upstream-sourced spec; user-authored overrides are
- * recomposed after building by the override applicators, so explicit user
- * limits and pricing still win.
+ * The row's corrected price card at `now`: `cost-patch`, then `cost-fallback`
+ * (each with its dated card due at `now`), then the long-context tier and
+ * cache-rate derivations, all from the upstream card.
  */
-export function applyCatalogCorrections(
-	model: Pick<ModelSpec<Api>, "cost" | "contextWindow" | "maxTokens" | "input">,
+function correctedCost(
+	upstream: ModelCost,
 	catalog: Record<string, unknown>,
-): void {
+	cards: DatedCostCards,
+	now: number,
+): ModelCost {
+	let cost: ModelCost = { ...upstream };
+	const upstreamCard =
+		upstream.timeBased?.effectiveRates?.[0]?.effectiveFrom === EARLIEST_EFFECTIVE_FROM
+			? dueEffectiveRate(upstream.timeBased, now)
+			: undefined;
+	if (upstreamCard !== undefined) {
+		// A row rebuilt from an already built one (dynamic merges, overrides)
+		// carries the dated schedule compiled below. Its leading card covers all
+		// history, so the scalar legs only ever held the card due at the first
+		// build; start from the card due now instead.
+		const { effectiveFrom: _effectiveFrom, ...card } = upstreamCard;
+		const { longContext: _longContext, ...base } = cost;
+		cost = { ...base, ...card };
+	}
 	const patch = objectPayload(catalog.costPatch);
 	if (patch !== undefined) {
-		model.cost = { ...model.cost };
 		const input = numberField(patch, "input");
-		if (input !== undefined) model.cost.input = input;
+		if (input !== undefined) cost.input = input;
 		const output = numberField(patch, "output");
-		if (output !== undefined) model.cost.output = output;
+		if (output !== undefined) cost.output = output;
 		const cacheRead = numberField(patch, "cacheRead");
-		if (cacheRead !== undefined) model.cost.cacheRead = cacheRead;
+		if (cacheRead !== undefined) cost.cacheRead = cacheRead;
 		const cacheWrite = numberField(patch, "cacheWrite");
-		if (cacheWrite !== undefined) model.cost.cacheWrite = cacheWrite;
+		if (cacheWrite !== undefined) cost.cacheWrite = cacheWrite;
+		applyDueDatedCostCard(cost, cards.patch, now);
 	}
 	const fallback = objectPayload(catalog.costFallback);
 	if (fallback !== undefined) {
-		const base = model.cost;
-		const hasTokenPrice = base.input !== 0 || base.output !== 0 || base.cacheRead !== 0 || base.cacheWrite !== 0;
+		const hasTokenPrice = cost.input !== 0 || cost.output !== 0 || cost.cacheRead !== 0 || cost.cacheWrite !== 0;
 		if (!hasTokenPrice) {
 			// Upstream reported no token price (plan-included or promo-free
 			// rows): seed the reviewed list price instead of overwriting real
 			// discovery data the way `cost-patch` would.
-			model.cost = { ...model.cost };
 			const input = numberField(fallback, "input");
-			if (input !== undefined) model.cost.input = input;
+			if (input !== undefined) cost.input = input;
 			const output = numberField(fallback, "output");
-			if (output !== undefined) model.cost.output = output;
+			if (output !== undefined) cost.output = output;
 			const cacheRead = numberField(fallback, "cacheRead");
-			if (cacheRead !== undefined) model.cost.cacheRead = cacheRead;
+			if (cacheRead !== undefined) cost.cacheRead = cacheRead;
 			const cacheWrite = numberField(fallback, "cacheWrite");
-			if (cacheWrite !== undefined) model.cost.cacheWrite = cacheWrite;
-			// Dated fallback rates overwrite the seeded numbers when they have
-			// already taken effect. They are not a recurring tariff: wrapping
-			// them in `timeBased` with empty peak windows would report
-			// permanent off-peak and never wake at the dated boundary.
-			applyEffectiveFallbackRates(model.cost, Reflect.get(fallback, "effectiveRates"));
+			if (cacheWrite !== undefined) cost.cacheWrite = cacheWrite;
+			applyDueDatedCostCard(cost, cards.fallback, now);
 		}
 	}
 	const longContext = objectPayload(catalog.longContext);
@@ -221,20 +207,19 @@ export function applyCatalogCorrections(
 		const output = numberField(longContext, "output");
 		const cacheRead = numberField(longContext, "cacheRead");
 		const cacheWrite = numberField(longContext, "cacheWrite");
-		const base = model.cost;
-		const hasTokenPrice = base.input !== 0 || base.output !== 0 || base.cacheRead !== 0 || base.cacheWrite !== 0;
+		const hasTokenPrice = cost.input !== 0 || cost.output !== 0 || cost.cacheRead !== 0 || cost.cacheWrite !== 0;
 		if (inputThreshold !== undefined && multiplier !== undefined && hasTokenPrice) {
 			// Multiplier form: tier rates derive from the row's final base card,
 			// after `cost-patch`/`cost-fallback` corrected the live list price.
-			model.cost = {
-				...base,
+			cost = {
+				...cost,
 				longContext: {
 					inputThreshold,
 					...(inclusive && { inputThresholdInclusive: true }),
-					input: base.input * multiplier,
-					output: base.output * multiplier,
-					cacheRead: base.cacheRead * multiplier,
-					cacheWrite: base.cacheWrite * multiplier,
+					input: cost.input * multiplier,
+					output: cost.output * (numberField(longContext, "outputMultiplier") ?? multiplier),
+					cacheRead: cost.cacheRead * multiplier,
+					cacheWrite: cost.cacheWrite * multiplier,
 				},
 			};
 		} else if (
@@ -244,19 +229,94 @@ export function applyCatalogCorrections(
 			cacheRead !== undefined &&
 			cacheWrite !== undefined
 		) {
-			model.cost = { ...model.cost, longContext: { inputThreshold, input, output, cacheRead, cacheWrite } };
+			cost = { ...cost, longContext: { inputThreshold, input, output, cacheRead, cacheWrite } };
 		}
 	}
 	if (catalog.cacheReadAtInputRate === true) {
-		const { longContext } = model.cost;
-		model.cost = {
-			...model.cost,
-			cacheRead: model.cost.input,
+		const { longContext } = cost;
+		cost = {
+			...cost,
+			cacheRead: cost.input,
 			...(longContext && { longContext: { ...longContext, cacheRead: longContext.input } }),
 		};
 	}
-	if (catalog.timeBased !== undefined) {
-		model.cost = { ...model.cost, timeBased: materializeTimeBasedCost(catalog.timeBased) };
+	const cacheWriteRate = catalog.cacheWriteRate;
+	if (typeof cacheWriteRate === "number") {
+		const { longContext } = cost;
+		cost = {
+			...cost,
+			cacheWrite: cost.input * cacheWriteRate,
+			...(longContext && { longContext: { ...longContext, cacheWrite: longContext.input * cacheWriteRate } }),
+		};
+	}
+	return cost;
+}
+
+/**
+ * Every price period the dated `cost-patch`/`cost-fallback` cards define, for
+ * request-time selection (`calculateUsageCost`): a row built before a change
+ * still bills requests after it at the new price, and a leading card keeps
+ * earlier requests at the old one on rows built after it. Undefined when no
+ * card changes the price (no cards, or a fallback the upstream price outranks).
+ */
+function scheduledRates(
+	upstream: ModelCost,
+	catalog: Record<string, unknown>,
+	cards: DatedCostCards,
+): EffectiveTokenCost[] | undefined {
+	const dates = [...cards.patch, ...cards.fallback].map(card => card.effectiveFrom).sort((a, b) => a - b);
+	if (dates.length === 0) return undefined;
+	const periods: EffectiveTokenCost[] = [];
+	let previousPrice: string | undefined;
+	for (const effectiveFrom of [EARLIEST_EFFECTIVE_FROM, ...dates]) {
+		const { input, output, cacheRead, cacheWrite, longContext } = correctedCost(
+			upstream,
+			catalog,
+			cards,
+			effectiveFrom,
+		);
+		const price = { input, output, cacheRead, cacheWrite, ...(longContext && { longContext }) };
+		const key = JSON.stringify(price);
+		if (key === previousPrice) continue;
+		previousPrice = key;
+		periods.push({ effectiveFrom, ...price });
+	}
+	return periods.length > 1 ? periods : undefined;
+}
+
+/**
+ * Applies reviewed catalog-data value corrections (`cost-patch`,
+ * `cache-read-at-input-rate`, `cache-write-rate`, `limits-patch`,
+ * `long-context-cost`, `context-window-floor`, `input-modalities`) onto an
+ * upstream-sourced spec. Applied by
+ * `buildModel` to every upstream-sourced spec; user-authored overrides are
+ * recomposed after building by the override applicators, so explicit user
+ * limits and pricing still win.
+ */
+export function applyCatalogCorrections(
+	model: Pick<ModelSpec<Api>, "cost" | "contextWindow" | "maxTokens" | "input">,
+	catalog: Record<string, unknown>,
+): void {
+	const upstream = model.cost;
+	const cards: DatedCostCards = {
+		patch: parseDatedCostCards(catalog.costPatch, "cost-patch"),
+		fallback: parseDatedCostCards(catalog.costFallback, "cost-fallback"),
+	};
+	// The card due now is the row's displayed price; the dated schedule rides
+	// along so rows reused past a change (bundles, caches, long sessions) still
+	// bill each request at the card in force when it was made.
+	model.cost = correctedCost(upstream, catalog, cards, Date.now());
+	const recurring = catalog.timeBased === undefined ? undefined : materializeTimeBasedCost(catalog.timeBased);
+	const dated = scheduledRates(upstream, catalog, cards);
+	if (dated !== undefined) {
+		if (recurring?.effectiveRates !== undefined) {
+			throw new Error(
+				"Dated cost-patch/cost-fallback effective-rates cannot combine with time-based-cost effective-rates",
+			);
+		}
+		model.cost = { ...model.cost, timeBased: { ...(recurring ?? NO_RECURRING_TARIFF), effectiveRates: dated } };
+	} else if (recurring !== undefined) {
+		model.cost = { ...model.cost, timeBased: recurring };
 	}
 	const limitsPatch = objectPayload(catalog.limitsPatch);
 	if (limitsPatch !== undefined) {
@@ -351,8 +411,9 @@ export function buildModel<TApi extends Api>(spec: ModelSpec<TApi>): Model<TApi>
 	const model: Model<TApi> = {
 		...spec,
 		// A reviewed `thinking-upgrade-neutral` policy can repair a stale
-		// `reasoning: false` discovery default (see `resolveThinkingPolicy`);
-		// materialize the correction for transports and the picker.
+		// `reasoning: false` discovery default, and an unclassified neutral spec
+		// gets an unverified ladder (see `resolveThinkingPolicy`); materialize
+		// either for transports and the picker.
 		reasoning: spec.reasoning || policy.thinking !== undefined,
 		name: cleanModelName(spec.name),
 		identity: policy.identity,

package/src/compat/axes.ts

@@ -244,8 +244,8 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"first-party-provider": wire("firstPartyProvider", ["anthropic"]),
 	"honors-claude-code-beta-kill-switch": wire("honorsClaudeCodeBetaKillSwitch", ["anthropic"]),
 	"inject-claude-code-instruction": wire("injectClaudeCodeInstruction", ["anthropic"]),
-	"max-image-dimension": wire("maxImageDimension", ["anthropic"]),
-	"max-image-payload-bytes": wire("maxImagePayloadBytes", ["anthropic"]),
+	"max-image-dimension": wire("maxImageDimension", ["anthropic", "google"]),
+	"max-image-payload-bytes": wire("maxImagePayloadBytes", ["anthropic", "google"]),
 	"official-endpoint": wire("officialEndpoint", ["anthropic", "openai-responses"]),
 	"replay-unsigned-thinking": wire("replayUnsignedThinking", ["anthropic"]),
 	"requires-thinking-enabled": wire("requiresThinkingEnabled", ["anthropic"]),
@@ -329,6 +329,8 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"thinking-suppress-when-off": { key: "suppressWhenOff", set: "thinking", shape: "scalar" },
 	"thinking-supports-display": { key: "supportsDisplay", set: "thinking", shape: "scalar" },
 	"thinking-upgrade-neutral": { key: "upgradeNeutral", set: "thinking", shape: "scalar" },
+	/** Unclassified neutral ids here are capability-unknown: offer the ladder as opt-in. */
+	"thinking-unverified": { key: "unverified", set: "thinking", shape: "scalar" },
 
 	// ── catalog metadata ──
 	"apply-patch-tool-type": {
@@ -368,6 +370,19 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 		shape: "scalar",
 		values: [true, false],
 	},
+	/**
+	 * The model's input classifier refuses requests that reproduce assistant
+	 * reasoning as quoted text (`reasoning_extraction`), so reasoning must not
+	 * be replayed as text into its input: compaction archives, summarizer
+	 * transcripts and demoted interrupted turns leave it out. Declared per class
+	 * in `classes/*.kdl`.
+	 */
+	"classifier-cot-extraction": {
+		key: "classifierCotExtraction",
+		set: "catalog",
+		shape: "scalar",
+		values: [true, false],
+	},
 	"clamp-context-override": { key: "clampContextOverride", set: "catalog", shape: "scalar" },
 	"context-promotion-target": { key: "contextPromotionTarget", set: "catalog", shape: "scalar" },
 	"context-window-floor": { key: "contextWindowFloor", set: "catalog", shape: "scalar" },
@@ -389,6 +404,26 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 		shape: "scalar",
 		values: [true, false],
 	},
+	/**
+	 * The host bills cache writes at this multiple of the row's live `input`
+	 * price, for hosts whose discovery reports cache-write tokens but no
+	 * cache-write rate. It replaces any `cacheWrite` the row carries, including
+	 * a `cost-patch`/`cost-fallback` value and an absolute long-context tier's
+	 * `cacheWrite` (rebased on the tier's `input`).
+	 */
+	"cache-write-rate": { key: "cacheWriteRate", set: "catalog", shape: "scalar" },
+	/**
+	 * How the model line bills a replayed signed thinking block as input:
+	 * `output` bills the reasoning its signature carries, at the size the turn
+	 * billed as output, and not the signature's bytes. Unassigned: estimated
+	 * from the signature's bytes. Read through `./thinking-replay`.
+	 */
+	"thinking-replay-tokens": {
+		key: "thinkingReplayTokens",
+		set: "catalog",
+		shape: "scalar",
+		values: ["output", "signature"],
+	},
 	"delegation-bias": { key: "delegationBias", set: "catalog", shape: "scalar", values: DELEGATION_BIASES },
 	"discovery-api": { key: "discoveryApi", set: "catalog", shape: "scalar" },
 	"edit-prompt-variant": { key: "editPromptVariant", set: "catalog", shape: "scalar", values: ["full", "compact"] },
@@ -405,7 +440,28 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"hosted-image": { key: "hostedImage", set: "catalog", shape: "scalar", values: [true, false] },
 	/** How the model line bills an input image; shape and formulas in `./image-tokenization`. */
 	"image-tokenization": { key: "imageTokenization", set: "catalog", shape: "object" },
+	/**
+	 * Most images one request may carry, documents included where the host
+	 * counts them. Unassigned: unknown host, held to a conservative floor.
+	 */
+	"image-count-budget": { key: "imageCountBudget", set: "catalog", shape: "scalar" },
+	/**
+	 * Replaces `image-count-budget` while the request reaches the official
+	 * endpoint (pi-ai `reachesOfficialEndpoint`): a limit measured or documented
+	 * for the host's own endpoint, which a custom `baseUrl` or an
+	 * `ANTHROPIC_BASE_URL`/`FOUNDRY_BASE_URL` reroute (proxy, gateway) need not share.
+	 */
+	"official-image-count-budget": { key: "officialImageCountBudget", set: "catalog", shape: "scalar" },
+	/**
+	 * Opt-in: the reader may get a fresh `read` result as snapcompact frames
+	 * (`snapcompact.toolResults`), because it edits as exactly from frames as
+	 * from text. Unassigned: `read` results stay text, since a reader that
+	 * misreads indentation in frames makes inexact edits.
+	 */
+	"snapcompact-image-reads": { key: "snapcompactImageReads", set: "catalog", shape: "scalar", values: [true, false] },
 	"image-model": { key: "imageModel", set: "catalog", shape: "scalar" },
+	/** Longest image edge the host passes to the model: it downscales larger images to fit first. */
+	"image-max-edge": { key: "imageMaxEdge", set: "catalog", shape: "scalar" },
 	"inline-image-byte-budget": { key: "inlineImageByteBudget", set: "catalog", shape: "scalar" },
 	/**
 	 * Most questions one System One judgment request may carry; the judge
@@ -415,6 +471,12 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"limits-patch": { key: "limitsPatch", set: "catalog", shape: "object" },
 	"long-context-cost": { key: "longContext", set: "catalog", shape: "object" },
 	"prompt-cache": { key: "promptCache", set: "catalog", shape: "object" },
+	"task-sibling-prompt-cache": {
+		key: "taskSiblingPromptCache",
+		set: "catalog",
+		shape: "scalar",
+		values: [true, false],
+	},
 	/**
 	 * Prompt-cache lookback in block positions: how far back from a cache
 	 * breakpoint the provider looks for an earlier request's cache entry.

package/src/compat/cascade.ts

@@ -409,13 +409,16 @@ function resolveOverIndex(index: RuleIndex, target: ResolveTarget): ResolvedAxes
 			reasoning = true;
 		}
 	}
+	// Unclassified targets get their provider's ladder too: it is offered as
+	// unverified thinking (`resolveThinkingPolicy`), never as reasoning capability.
+	const offersThinking = reasoning || target.class === "unknown";
 	const wire: WinnerTable = {};
 	const thinking: WinnerTable = {};
 	const catalog: WinnerTable = {};
 	for (const { rule, rank } of ranked) {
 		contest(wire, rule.compiled.wire, rank, rule, target);
 		contest(catalog, rule.compiled.catalog, rank, rule, target);
-		if (reasoning) contest(thinking, rule.compiled.thinking, rank, rule, target);
+		if (offersThinking) contest(thinking, rule.compiled.thinking, rank, rule, target);
 	}
 	return {
 		wire: collect(wire, rule => rule.wire),

package/src/compat/image-tokenization.ts

@@ -37,12 +37,16 @@ export interface OpenAiPatchTokenization {
 }
 
 /** One model line's image billing rule: the vendor formula and its per-model numbers. */
-export type ImageTokenization =
+export type ImageTokenization = (
 	| OpenAiPatchTokenization
 	/** Anthropic 28px patches, resized to fit a padded-edge limit and a visual-token budget. */
 	| { regime: "anthropic-patch"; maxEdge: number; maxTokens: number }
 	/** A fixed per-image budget regardless of pixels (Gemini 3 `media_resolution`). */
-	| { regime: "fixed"; tokens: number };
+	| { regime: "fixed"; tokens: number }
+) & {
+	/** Provider billing was measured to match this rule; unset for docs-only rules and wire fallbacks. */
+	verified?: boolean;
+};
 
 /** A `class: "unknown"` identity for targets resolved by wire API alone. */
 const UNCLASSIFIED: Pick<ModelIdentity, "class"> = { class: "unknown" };
@@ -62,17 +66,13 @@ export interface ImageTokenizationTarget {
 	identity?: Pick<ModelIdentity, "class" | "family" | "revision">;
 }
 
-/**
- * The reader's image billing rule: its lineage rule, else its wire API's
- * fallback; undefined when neither covers it (an unclassified model on an
- * unregistered API).
- */
-export function resolveImageTokenization(target: ImageTokenizationTarget): ImageTokenization | undefined {
+/** Catalog axes for `target`'s identity on its host and wire API. */
+function resolveImageAxes(target: ImageTokenizationTarget): Record<string, unknown> {
 	const provider = target.provider ?? "";
 	const model = target.id ?? "";
 	const identity: Pick<ModelIdentity, "class" | "family" | "revision"> =
 		target.identity ?? (model ? classifyModel(provider, model, { lenient: true }) : UNCLASSIFIED);
-	const rule = resolveCascade({
+	return resolveCascade({
 		provider,
 		api: target.api ?? "",
 		class: identity.class,
@@ -80,10 +80,28 @@ export function resolveImageTokenization(target: ImageTokenizationTarget): Image
 		reasoning: false,
 		...(identity.family !== undefined && { family: identity.family }),
 		...(identity.revision !== undefined && { revision: identity.revision }),
-	}).catalog.imageTokenization;
+	}).catalog;
+}
+
+/**
+ * The reader's image billing rule: its lineage rule, else its wire API's
+ * fallback; undefined when neither covers it (an unclassified model on an
+ * unregistered API).
+ */
+export function resolveImageTokenization(target: ImageTokenizationTarget): ImageTokenization | undefined {
+	const rule = resolveImageAxes(target).imageTokenization;
 	return isImageTokenization(rule) ? rule : undefined;
 }
 
+/**
+ * Longest image edge the reader's host passes to the model (`image-max-edge`),
+ * or undefined when the host keeps the image's size.
+ */
+export function resolveImageMaxEdge(target: ImageTokenizationTarget): number | undefined {
+	const edge = resolveImageAxes(target).imageMaxEdge;
+	return typeof edge === "number" && edge > 0 ? edge : undefined;
+}
+
 /** Scale `size` down (never up) so its longest side is at most `maxEdge`. */
 function fitLongEdge(size: ImageSize, maxEdge: number): ImageSize {
 	const longest = Math.max(size.width, size.height);

package/src/compat/request-size.ts

@@ -1,5 +1,6 @@
 import { toModelSpec } from "../provider-models/bundled-references";
 import type { Model } from "../types";
+import { resolveCatalogPolicy } from "./catalog-policy";
 import { resolveCatalogAxes } from "./resolve";
 
 const imageBudgetCache = new Map<string, number | null>();
@@ -7,12 +8,12 @@ const IMAGE_BUDGET_CACHE_MAX = 8192;
 
 /**
  * Maximum encoded inline-image bytes retained per request for a deployment with a documented body-size limit.
- * The axis is a host contract: a rerouted `baseUrl` (proxy, gateway) imposes its own limit, so the budget
- * applies only while the model targets its official endpoint.
+ * The axis is a host contract: a rerouted endpoint (proxy, gateway) imposes its own limit, so the budget applies
+ * only when `officialEndpoint` says the request reaches the model's official endpoint. `compat.officialEndpoint`
+ * classifies only the configured `baseUrl`; pi-ai's `reachesOfficialEndpoint` also follows request-time reroutes.
  */
-export function resolveInlineImageByteBudget(model: Model): number | undefined {
-	const compat = model.compat;
-	if (!compat || !("officialEndpoint" in compat) || !compat.officialEndpoint) return undefined;
+export function resolveInlineImageByteBudget(model: Model, officialEndpoint: boolean): number | undefined {
+	if (!officialEndpoint) return undefined;
 	const key = `${model.provider} ${model.id} ${model.api}`;
 	let budget = imageBudgetCache.get(key);
 	if (budget === undefined) {
@@ -23,3 +24,15 @@ export function resolveInlineImageByteBudget(model: Model): number | undefined {
 	}
 	return budget ?? undefined;
 }
+
+/**
+ * Most images one request to this deployment may carry, or `undefined` when no rule names the host. The
+ * `official-image-count-budget` axis replaces `image-count-budget` only when `officialEndpoint` says the request
+ * reaches the model's official endpoint (see {@link resolveInlineImageByteBudget}); a rerouted endpoint keeps the
+ * provider's generic budget.
+ */
+export function resolveImageCountBudget(model: Model, officialEndpoint: boolean): number | undefined {
+	const policy = resolveCatalogPolicy(model);
+	const value = (officialEndpoint && policy.officialImageCountBudget) || policy.imageCountBudget;
+	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined;
+}

package/src/compat/resolve.ts

@@ -17,6 +17,7 @@
  */
 import { Effort, THINKING_EFFORTS } from "../effort";
 import { hostMatchesUrl, modelMatchesHost } from "../hosts";
+import { withoutUnverifiedThinking } from "../model-thinking";
 import type {
 	Api,
 	CompatOf,
@@ -31,6 +32,7 @@ import type {
 	ResolvedOpenAISharedCompat,
 	ThinkingConfig,
 } from "../types";
+import { isOfficialCodexApiUrl } from "../wire/codex";
 import {
 	isAnthropicSigningProxyUrl,
 	isAzureAnthropicRoute,
@@ -117,11 +119,24 @@ class IdentityFacts {
 	}
 }
 
+/**
+ * The id a spec resolves identity and rules under: its own, unless that names
+ * no model and the row sends a model that does on the wire. A Devin Fusion
+ * pairing runs only its lead, so the lead's reviewed rules (cache-write rate,
+ * long-context tier) apply to it at build time.
+ */
+function policyModelId<TApi extends Api>(spec: ModelSpec<TApi>): string {
+	const wireId = spec.requestModelId;
+	if (wireId === undefined || wireId === spec.id) return spec.id;
+	if (classifyModel(spec.provider, spec.id).class !== "unknown") return spec.id;
+	return classifyModel(spec.provider, wireId).class === "unknown" ? spec.id : wireId;
+}
+
 function resolveIdentity<TApi extends Api>(spec: ModelSpec<TApi>): ModelIdentity {
 	// Strict on purpose: ambiguous identity is a rule-authoring defect surfaced
 	// at build/CI time, never silently degraded to `unknown`. Discovery
 	// normalization opts into leniency through `classifyModel` directly.
-	return classifyModel(spec.provider, spec.id);
+	return classifyModel(spec.provider, policyModelId(spec));
 }
 
 // ---------------------------------------------------------------------------
@@ -796,7 +811,11 @@ function resolveOpenAIResponsesPolicy(
 		supportsObfuscationOptOut: isOpenAIUrl || provider === "openai",
 		storeResponses: false,
 		connectionBoundNativeHistory: false,
-		officialEndpoint: isOfficialOpenAIEndpoint(provider, baseUrl),
+		// The Codex backend is official at the URL its requests default to when `baseUrl` is unset, and at paths
+		// under it such as `/codex` and `/codex/responses`, which its requests resolve to the same endpoint.
+		officialEndpoint:
+			isOfficialOpenAIEndpoint(provider, baseUrl) ||
+			(api === "openai-codex-responses" && isOfficialCodexApiUrl(baseUrl)),
 		harmonyLeakMitigation: false,
 		rejectRootObjectUnion: false,
 		retryWithoutStrictOnGrammarError: false,
@@ -980,6 +999,10 @@ function resolveGooglePolicy(
 		claudeThinkingBetaHeader: false,
 		antigravityClaudeToolMode: false,
 		stripImageInput: false,
+		// Unset means "no image contract": images go out as sent. Keys exist so
+		// a KDL rule or a user `compat` block can declare one.
+		maxImageDimension: undefined,
+		maxImagePayloadBytes: undefined,
 	};
 	applyWireAxes(compat, axes.wire, spec.api);
 	applyCompatOverrides(compat, spec.compat);
@@ -1089,6 +1112,7 @@ interface RuleThinking {
 	supportsDisplay?: boolean;
 	prefixBinding?: boolean;
 	upgradeNeutral?: boolean;
+	unverified?: boolean;
 }
 
 function readRuleThinking(axes: ResolvedAxes): RuleThinking {
@@ -1109,6 +1133,7 @@ function readRuleThinking(axes: ResolvedAxes): RuleThinking {
 	if (typeof raw.supportsDisplay === "boolean") out.supportsDisplay = raw.supportsDisplay;
 	if (typeof raw.prefixBinding === "boolean") out.prefixBinding = raw.prefixBinding;
 	if (typeof raw.upgradeNeutral === "boolean") out.upgradeNeutral = raw.upgradeNeutral;
+	if (typeof raw.unverified === "boolean") out.unverified = raw.unverified;
 	return out;
 }
 
@@ -1156,8 +1181,16 @@ function resolveThinkingPolicy<TApi extends Api>(
 	// not re-expand it into an unadvertised ladder. Absent metadata is
 	// repaired only where KDL opts in with `thinking-upgrade-neutral`
 	// alongside a reviewed `thinking-efforts` ladder (the cascade upgrade for
-	// stale source capability data); otherwise the neutral default holds.
-	if (!spec.reasoning && (explicitThinking !== undefined || rule.upgradeNeutral !== true)) return undefined;
+	// stale source capability data). On deployments whose discovery reports no
+	// capabilities (`thinking-unverified`), an unclassified neutral spec — nothing
+	// says whether it reasons — gets an unverified ladder the user may opt into.
+	const unverified = !compatReasoning(spec, axes);
+	if (
+		unverified &&
+		(explicitThinking !== undefined || facts.identity.class !== "unknown" || rule.unverified !== true)
+	) {
+		return undefined;
+	}
 	if (
 		spec.provider === "cline-pass" &&
 		compat !== undefined &&
@@ -1181,9 +1214,14 @@ function resolveThinkingPolicy<TApi extends Api>(
 	if (config.efforts.length === 0) {
 		throw new Error(`Model ${spec.provider}/${spec.id} resolved to an empty thinking range`);
 	}
-	if (rule.defaultLevel !== undefined) config.defaultLevel = rule.defaultLevel;
 	const effortMap = mergeEffortMap(spec, rule.effortMap, compat, config.efforts);
 	if (effortMap !== undefined) config.effortMap = effortMap;
+	if (unverified) {
+		// Off-by-default opt-in: no default level, mandatory effort, or wire off-switch.
+		config.unverified = true;
+		return config;
+	}
+	if (rule.defaultLevel !== undefined) config.defaultLevel = rule.defaultLevel;
 	if (rule.effortBudgets !== undefined) config.effortBudgets = rule.effortBudgets;
 	const supportsDisplay = rule.supportsDisplay ?? defaultSupportsDisplay(spec, facts);
 	if (supportsDisplay) config.supportsDisplay = true;
@@ -1280,7 +1318,7 @@ function buildResolveTarget<TApi extends Api>(
 		provider: providerType,
 		api: spec.api,
 		class: identity.class,
-		model: spec.id,
+		model: policyModelId(spec),
 		reasoning: Boolean(spec.reasoning),
 	};
 	if (identity.family !== undefined) target.family = identity.family;
@@ -1316,7 +1354,8 @@ export function resolveModelPolicy<TApi extends Api>(
 	spec: ModelSpec<TApi>,
 	route?: ResolveRoute,
 ): ResolvedModelPolicy<TApi>;
-export function resolveModelPolicy(spec: ModelSpec<Api>, route?: ResolveRoute): ResolvedModelPolicy<Api> {
+export function resolveModelPolicy(input: ModelSpec<Api>, route?: ResolveRoute): ResolvedModelPolicy<Api> {
+	const spec = withoutUnverifiedThinking(input);
 	const identity = resolveIdentity(spec);
 	const facts = new IdentityFacts(identity);
 	const target = buildResolveTarget(spec, identity);