@oh-my-pi/pi-catalog 18.2.2 → 18.2.4

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [18.2.4] - 2026-09-17
+
+### Added
+
+- Added `typesafe` authentication for TypeSafe System One judgments via the `TYPESAFE_API_KEY` configuration and API-key validation against the TypeSafe models endpoint.
+
+## [18.2.3] - 2026-09-17
+
+### Added
+
+- Models can carry deferred request-header resolvers, and model managers can reconstruct omitted cached headers from authoritative local configuration without persisting credentials.
+
 ## [18.2.2] - 2026-09-16
 
 ### Added

package/dist/types/compat/auth-ids.d.ts

@@ -1,4 +1,4 @@
 /** Every provider with an `auth/<id>.kdl` policy. */
-export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "synthetic" | "tavily" | "together" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
 /** Providers whose policy declares a `login` flow (the `/login` roster). */
-export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "synthetic" | "tavily" | "together" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";

package/dist/types/model-manager.d.ts

@@ -45,6 +45,13 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
      * bearer header comes from the current local config.
      */
     restorableHeaderFallback?: Record<string, string>;
+    /**
+     * Reconstruct omitted request headers from authoritative local configuration
+     * when no trusted static source remains. Return undefined to keep the row
+     * unavailable. This hook must not perform I/O; attach `resolveHeaders` for
+     * command-backed credentials that must wait until an actual request.
+     */
+    restoreCachedHeaders?: (model: Readonly<Model>) => Pick<Model, "headers" | "resolveHeaders"> | undefined;
     /** Optional dynamic endpoint fetcher. */
     fetchDynamicModels?: () => Promise<readonly ModelSpec<TApi>[] | null>;
     /** Optional stencil.so fallback hook. */

package/dist/types/types.d.ts

@@ -1043,6 +1043,12 @@ export interface Model<TApi extends Api = Api> {
      */
     omitMaxOutputTokens?: boolean;
     headers?: Record<string, string>;
+    /**
+     * Materialize config-backed headers immediately before a request. Catalog
+     * inspection never invokes this hook; transports receive a cloned model
+     * whose `headers` is a plain resolved record and whose hook is removed.
+     */
+    resolveHeaders?: (signal?: AbortSignal) => Promise<Record<string, string> | undefined>;
     /**
      * Streaming transport override. When `"pi-native"`, `streamSimple` routes
      * the request to the model's `baseUrl` via the auth-gateway's

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-catalog",
-	"version": "18.2.2",
+	"version": "18.2.4",
 	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
 	"homepage": "https://omp.sh",
 	"author": "Stencil Labs, Inc.",
@@ -35,12 +35,12 @@
 		"gen:proto": "bun scripts/generate-protocols.ts"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.2.2",
-		"@oh-my-pi/pi-utils": "18.2.2"
+		"@oh-my-pi/omptype": "18.2.4",
+		"@oh-my-pi/pi-utils": "18.2.4"
 	},
 	"devDependencies": {
 		"@bgotink/kdl": "0.4.0",
-		"@oh-my-pi/pi-ai": "18.2.2",
+		"@oh-my-pi/pi-ai": "18.2.4",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/compat/auth-ids.ts

@@ -69,6 +69,7 @@ export type AuthProviderId =
 	| "synthetic"
 	| "tavily"
 	| "together"
+	| "typesafe"
 	| "umans"
 	| "venice"
 	| "vercel-ai-gateway"
@@ -145,6 +146,7 @@ export type LoginProviderId =
 	| "synthetic"
 	| "tavily"
 	| "together"
+	| "typesafe"
 	| "umans"
 	| "venice"
 	| "vercel-ai-gateway"

package/src/compat/rules/auth/_order.kdl

@@ -9,5 +9,5 @@ login-order "openai-codex" "anthropic" "zai" "zai-coding-plan" "kimi-code" "open
 	"cerebras" "baseten" "fireworks" "together" "nvidia" "novita" "deepinfra" "huggingface" "perplexity" \
 	"qianfan" "venice" "siliconflow" "siliconflow-cn" "synthetic" "nanogpt" "wafer-serverless" "coreweave" \
 	"vercel-ai-gateway" "cloudflare-ai-gateway" "litellm" "kilo" "zenmux" "opencode-zen" "opencode-go" \
-	"yolo-auto" "tavily" "kagi" "exa" "parallel" "ollama" "ollama-cloud" "lm-studio" "llama.cpp" "vllm" \
+	"yolo-auto" "tavily" "kagi" "exa" "parallel" "typesafe" "ollama" "ollama-cloud" "lm-studio" "llama.cpp" "vllm" \
 	"gmi-cloud"

package/src/compat/rules/auth/typesafe.kdl

@@ -0,0 +1,16 @@
+// TypeSafe (System One judgments) is not a chat-model provider: it answers
+// typed questions (choice / yes-no / score) over JSON state via
+// `POST /v1/systemone`, consumed through `@oh-my-pi/pi-ai`'s `TypeSafeJudge`.
+// No `providers/typesafe.kdl` entry exists on purpose — it has no chat models,
+// so it never appears in the model picker; the credential alone is what the
+// judgment resolver checks.
+auth "typesafe" {
+	name "TypeSafe"
+	env "TYPESAFE_API_KEY"
+	login "api-key" {
+		auth-url "https://console.typesafe.ai/"
+		instructions "Create or copy your API key from the TypeSafe console."
+		prompt "Paste your TypeSafe API key" placeholder="API key"
+		validate "models-endpoint" label="TypeSafe" url="https://api.typesafe.ai/v1/models" base-url-env="TYPESAFE_BASE_URL"
+	}
+}