@oh-my-pi/pi-catalog 18.2.11 → 18.3.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [18.3.0] - 2026-09-24
+
+### Added
+
+- Added compaction support for the `claude-mythos-preview` model.
+- Added provider and authentication rule definitions for on-device Apple Foundation Models.
+- Added per-account discovery of Codex cyber access entitlements.
+- Added `org-scoped-identity` and `oauth-token-env` authentication rules for providers.
+
 ## [18.2.11] - 2026-09-23
 
 ### Added

package/README.md

@@ -1,6 +1,6 @@
 # @oh-my-pi/pi-catalog
 
-Model catalog for [oh-my-pi](https://github.com/can1357/oh-my-pi): bundled model database, provider discovery, model identity, classification, and equivalence.
+Model catalog for [omp](https://github.com/can1357/oh-my-pi): bundled model database, provider discovery, model identity, classification, and equivalence.
 
 ## What's inside
 

package/THIRD-PARTY-NOTICES.txt

@@ -293,7 +293,7 @@ MIT License
 Copyright (c) 2026 Sander Land
   (measured tokenizer vocabulary data, reconstruction model, and reference
   implementation: https://github.com/sanderland/ctok)
-Copyright (c) 2026 Can Bölük and the Oh My Pi contributors
+Copyright (c) 2026 Can Bölük and the omp contributors
 Copyright (c) 2026 Stencil Labs, Inc.
   (Rust implementation and the compact binary vocabulary encoding in
   crates/pi-natives/src/utok/claude)

package/dist/types/compat/auth-ids.d.ts

@@ -1,4 +1,4 @@
 /** Every provider with an `auth/<id>.kdl` policy. */
-export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stencil" | "stepfun" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stencil" | "stepfun" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
 /** Providers whose policy declares a `login` flow (the `/login` roster). */
 export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stencil" | "stepfun" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";

package/dist/types/compat/provider-ids.d.ts

@@ -1,2 +1,2 @@
 /** Every chat-model provider with a catalog entry (`default-model` in its provider rules). */
-export type KnownProvider = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kilo" | "kimi-code" | "litellm" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "opencode-go" | "opencode-zen" | "openrouter" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stepfun" | "synthetic" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zenmux" | "zhipu-coding-plan";
+export type KnownProvider = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kilo" | "kimi-code" | "litellm" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "opencode-go" | "opencode-zen" | "openrouter" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stepfun" | "synthetic" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zenmux" | "zhipu-coding-plan";

package/dist/types/compat/types.d.ts

@@ -530,6 +530,10 @@ export interface CompiledAuthProvider {
         hook: string;
     };
     allowsMissingApiKey?: boolean;
+    /** Qualify credential and usage-report identity by org when an email may have multiple subscriptions. */
+    orgScopedIdentity?: boolean;
+    /** Environment variables carrying this provider's own OAuth bearer, excluding borrowed API-key aliases. */
+    oauthTokenEnv?: string[];
     /** APIs whose provider transport resolves credentials without a stored account. */
     nativeAuthApis?: string[];
     available?: boolean;

package/dist/types/discovery/cursor-proto.d.ts

@@ -1,5 +1,5 @@
 /**
- * Cursor agent protocol declarations used by Oh My Pi.
+ * Cursor agent protocol declarations used by omp.
  *
  * Each declaration retains only fields consumed by the client or its protocol tests.
  */

package/dist/types/discovery/devin-proto.d.ts

@@ -1,5 +1,5 @@
 /**
- * Devin protocol declarations used by Oh My Pi.
+ * Devin protocol declarations used by omp.
  *
  * Each declaration retains only fields consumed by the client or its protocol tests.
  */

package/dist/types/types.d.ts

@@ -2,7 +2,7 @@ import type { ModelIdentity } from "./compat/types.js";
 import type { Effort } from "./effort.js";
 export type { FetchImpl } from "@oh-my-pi/pi-utils";
 export type { KnownProvider } from "./provider-models/descriptors.js";
-export type KnownApi = "openai-completions" | "openai-responses" | "openrouter" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent" | "gitlab-duo-agent" | "devin-agent";
+export type KnownApi = "openai-completions" | "openai-responses" | "openrouter" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent" | "gitlab-duo-agent" | "devin-agent" | "apple-foundation-models";
 export type Api = KnownApi | (string & {});
 /** Catalog kinds used to isolate role-specific runners from session chat models. */
 export declare const MODEL_KINDS: readonly ["chat", "tiny", "image", "tts", "stt", "search", "judge", "embedding", "rerank", "video"];
@@ -441,17 +441,17 @@ export interface AnthropicCompat {
     /** Whether thinking requests may include `context_management` and its beta header. Default: true. */
     supportsContextManagement?: boolean;
     /**
-     * Whether the model lineage supports Anthropic server-side compaction
-     * (`compact-2026-01-12`: the `compact_20260112` edit and replayed
-     * `compaction` blocks). Rule-owned per model line; the beta covers the
-     * adaptive-thinking generation onward and rejects older lines. Default: false.
+     * Whether the model and host support Anthropic on-demand compaction
+     * (`compact-2026-09-04` requests and signed replay). Enabled on Opus 4.6+,
+     * Sonnet 4.6+, Fable/Mythos 5+ on supported hosts. Default: false.
      */
     supportsServerCompaction?: boolean;
     /**
      * Whether the model is served by the first-party Anthropic provider (its
      * default route is the official API). Rule-owned on the provider; the
      * compaction transport pairs it with a per-request effective-URL check
-     * because reroutes leave it stale-true. Default: false.
+     * because reroutes leave it stale-true. Vertex is selected by its provider
+     * contract instead. Default: false.
      */
     firstPartyProvider?: boolean;
     /**
@@ -953,6 +953,15 @@ export interface ModelCost extends TokenCost {
  * `"deepseek-v3"`; Kimi K2 through K3 share `"kimi-k2"`.
  */
 export type ModelTokenizer = "claude-v3" | "claude-v47" | "claude-v5" | "claude-v5-sonnet" | "qwen3" | "deepseek-v3" | "kimi-k2" | "glm5";
+/** One account's discovered entitlements on a model; see {@link Model.accountAccess}. */
+export interface ModelAccountAccess {
+    /**
+     * Codex `available_access_programs.cyber`: cyber access programs this account
+     * may request on the model (`standard`, `daybreak_blue`, `daybreak_red`).
+     * Absent when the backend reported no program metadata.
+     */
+    cyberPrograms?: readonly string[];
+}
 export interface Model<TApi extends Api = Api> {
     id: string;
     /** Role-specific runner capability; omitted for ordinary chat models. */
@@ -1046,6 +1055,15 @@ export interface Model<TApi extends Api = Api> {
      * their single wire id) and on bundled snapshots that predate discovery.
      */
     cursorMaxModeRoutes?: Readonly<Record<string, boolean>>;
+    /**
+     * Per-account availability recorded by multi-account discovery: provider
+     * account id (Codex: ChatGPT `chatgpt_account_id`) → that account's
+     * entitlements on this model. An account appears only when its own catalog
+     * lists the model, so credential selection can route account-gated models
+     * (e.g. `gpt-daybreak-blue-latest`) straight to eligible accounts. Absent on
+     * bundled/config rows and on single-account discovery.
+     */
+    accountAccess?: Readonly<Record<string, ModelAccountAccess>>;
     cost: ModelCost;
     /** Premium Copilot requests charged per user-initiated request (defaults to 1). */
     premiumMultiplier?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-catalog",
-	"version": "18.2.11",
+	"version": "18.3.0",
 	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
 	"keywords": [
 		"ai",
@@ -14,7 +14,10 @@
 		"url": "https://github.com/can1357/oh-my-pi/issues"
 	},
 	"license": "MIT",
-	"author": "Stencil Labs, Inc.",
+	"author": {
+		"name": "Stencil Labs, Inc.",
+		"url": "https://stencil.so"
+	},
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/can1357/oh-my-pi.git",
@@ -90,12 +93,12 @@
 		"gen:proto": "bun scripts/generate-protocols.ts"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.2.11",
-		"@oh-my-pi/pi-utils": "18.2.11"
+		"@oh-my-pi/omptype": "18.3.0",
+		"@oh-my-pi/pi-utils": "18.3.0"
 	},
 	"devDependencies": {
 		"@bgotink/kdl": "0.4.0",
-		"@oh-my-pi/pi-ai": "18.2.11",
+		"@oh-my-pi/pi-ai": "18.3.0",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/compat/auth-ids.ts

@@ -9,6 +9,7 @@ export type AuthProviderId =
 	| "alibaba-token-plan"
 	| "amazon-bedrock"
 	| "anthropic"
+	| "apple"
 	| "azure"
 	| "baseten"
 	| "bedrock-mantle"

package/src/compat/provider-ids.ts

@@ -9,6 +9,7 @@ export type KnownProvider =
 	| "alibaba-token-plan"
 	| "amazon-bedrock"
 	| "anthropic"
+	| "apple"
 	| "azure"
 	| "baseten"
 	| "bedrock-mantle"

package/src/compat/rules/README.md

@@ -346,12 +346,16 @@ auth "anthropic" {
     expiry "jwt-or-never"                        // session-JWT expiry policy
     result "api-key"                             // OAuth login persists only credentials.access as a plain API key
     allows-missing-api-key #true
+    org-scoped-identity #true                   // qualify credential/report identity by org (one email can have multiple subscriptions)
+    oauth-token-env "PROVIDER_OAUTH_TOKEN"      // dedicated OAuth bearer env vars, excluding borrowed API-key aliases in provider env
     native-auth-api "bedrock-converse-stream"     // provider transport resolves auth; scan plans pin this API without secrets
     available #false
     show-in-login-list #false
 }
 ```
 
+`org-scoped-identity #true` keeps credentials and usage reports for different organizations separate even when they share an email; absent or `#false` uses ordinary account identity. `oauth-token-env` takes one or more ordered, non-empty env names carrying this provider's own OAuth bearer. When present, availability ignores other provider-env aliases, and usage probes accept only stored OAuth credentials or the first set bearer from that list; absent providers keep the ordinary API-key env behavior.
+
 Login kinds:
 
 - `login "api-key" { auth-url "…"; instructions "…"; prompt "…" placeholder="…"; empty-fallback "…"; normalize "strip-bearer"; validate … }` — `validate "chat-completions" base-url= model= tolerate-model-denied= max-tokens-field= max-tokens=`, `validate "anthropic-messages" base-url= model=`, or `validate "models-endpoint" url= base-url-env= headers-hook=`; all accept `label=` (error-message label, defaults to `name`) and `optional=#true` (only auth failures reject).

package/src/compat/rules/auth/anthropic.kdl

@@ -1,5 +1,6 @@
 auth "anthropic" {
 	name "Anthropic (Claude Pro/Max)"
+	org-scoped-identity #true
 	// Foundry mode optionally switches Anthropic auth to enterprise gateway credentials.
 	env hook="anthropic-foundry"
 	login "oauth-code" {

package/src/compat/rules/auth/apple.kdl

@@ -0,0 +1,4 @@
+auth "apple" {
+	name "Apple Foundation Models (on-device)"
+	allows-missing-api-key #true
+}

package/src/compat/rules/auth/openai-codex.kdl

@@ -1,5 +1,6 @@
 auth "openai-codex" {
 	name "ChatGPT Plus/Pro (Codex Subscription)"
+	org-scoped-identity #true
 	login "oauth-code" {
 		client-id "app_EMoamEEZ73f0CkXaXp7hrann"
 		authorize-url "https://auth.openai.com/oauth/authorize"

package/src/compat/rules/auth/xai-oauth.kdl

@@ -1,6 +1,7 @@
 // Device authorization and token refresh adapted from NousResearch/hermes-agent (MIT).
 auth "xai-oauth" {
     name "xAI Grok OAuth (SuperGrok or X Premium+)"
+    oauth-token-env "XAI_OAUTH_TOKEN"
     login "device-code" {
         client-id "b1a00492-073a-47ea-816f-4c329264a828"
         scopes "openid" "profile" "email" "offline_access" "grok-cli:access" "api:access"

package/src/compat/rules/classes/anthropic.kdl

@@ -7,27 +7,32 @@ class "anthropic" {
 			thinking-prefix-binding #true
 		}
 	}
-	// Server-side compaction (compact-2026-01-12) is a lineage capability: the
-	// documented model list is the adaptive-thinking generation onward (Opus
-	// 4.6+, Sonnet 4.6+, Fable/Mythos 5+). Whether a host delivers the beta is
-	// decided at request time from the effective endpoint, not here.
-	family "fable" {
-		revision ">=5" {
-			supports-server-compaction #true
+	// On-demand compaction (compact-2026-09-04) is available on the Claude
+	// API and Vertex, not Amazon Bedrock or unverified gateway deployments.
+	// Foundry / Claude Platform on AWS are first-party Anthropic routes whose
+	// effective URLs are checked at request time.
+	on "anthropic" "google-vertex" {
+		family "fable" {
+			revision ">=5" {
+				supports-server-compaction #true
+			}
 		}
-	}
-	family "mythos" {
-		revision ">=5" {
-			supports-server-compaction #true
+		family "mythos" {
+			revision ">=5" {
+				supports-server-compaction #true
+			}
 		}
-	}
-	family "opus" {
-		revision ">=4.6" {
-			supports-server-compaction #true
+		family "opus" {
+			revision ">=4.6" {
+				supports-server-compaction #true
+			}
 		}
-	}
-	family "sonnet" {
-		revision ">=4.6" {
+		family "sonnet" {
+			revision ">=4.6" {
+				supports-server-compaction #true
+			}
+		}
+		models "claude-mythos-preview" {
 			supports-server-compaction #true
 		}
 	}

package/src/compat/rules/providers/apple.kdl

@@ -0,0 +1,8 @@
+// Apple Foundation Models: the on-device system language model (macOS 27+,
+// Apple silicon), bridged in-process by pi-natives. Models are discovered at
+// runtime from the model's availability; nothing is bundled.
+
+provider "apple" {
+	default-model "on-device"
+	allow-unauthenticated #true
+}