@oh-my-pi/pi-catalog 18.4.2 → 18.4.4

package/src/compat/types.ts

@@ -377,8 +377,17 @@ export type CompiledAuthValidation =
 			maxTokensField?: "max_tokens" | "max_completion_tokens";
 			maxTokens?: number;
 			optional?: boolean;
+			/** With `optional`: a 403 also trusts the key; only a 401 rejects it. */
+			trustForbidden?: boolean;
+	  }
+	| {
+			kind: "anthropic-messages";
+			label?: string;
+			baseUrl: string;
+			model: string;
+			optional?: boolean;
+			trustForbidden?: boolean;
 	  }
-	| { kind: "anthropic-messages"; label?: string; baseUrl: string; model: string; optional?: boolean }
 	| {
 			kind: "models-endpoint";
 			label?: string;
@@ -388,6 +397,7 @@ export type CompiledAuthValidation =
 			/** Hook returning extra request headers (may throw a configuration error). */
 			headersHook?: string;
 			optional?: boolean;
+			trustForbidden?: boolean;
 	  };
 
 /** Paste-an-API-key login: optional browser hint, prompt, optional validation. */

package/src/discovery/codex.ts

@@ -71,6 +71,7 @@ const codexModelEntrySchema = type({
 	"use_responses_lite?": "unknown",
 	"tool_mode?": "unknown",
 	"available_access_programs?": "unknown",
+	"service_tiers?": "unknown",
 });
 
 const codexModelsResponseSchema = type({
@@ -303,6 +304,8 @@ interface ParsedCodexModelEntry {
 	useResponsesLite: boolean;
 	toolMode: boolean;
 	priority: number;
+	/** Advertised tier ids; `undefined` when the entry has no `service_tiers` array. */
+	serviceTiers: string[] | undefined;
 }
 
 function parseCodexModelEntry(entry: unknown): ParsedCodexModelEntry | null {
@@ -332,6 +335,17 @@ function parseCodexModelEntry(entry: unknown): ParsedCodexModelEntry | null {
 		}
 	}
 
+	// codex-rs `ModelServiceTier { id, name, description }`; only the id reaches the wire.
+	// An explicit empty array is kept: it means the model offers no optional tier.
+	let serviceTiers: string[] | undefined;
+	if (Array.isArray(payload.service_tiers)) {
+		serviceTiers = [];
+		for (const tier of payload.service_tiers) {
+			const id = tier !== null && typeof tier === "object" && "id" in tier ? toNonEmptyString(tier.id) : null;
+			if (id && !serviceTiers.includes(id)) serviceTiers.push(id);
+		}
+	}
+
 	return {
 		slug,
 		cyberPrograms,
@@ -344,6 +358,7 @@ function parseCodexModelEntry(entry: unknown): ParsedCodexModelEntry | null {
 		useResponsesLite: toBoolean(payload.use_responses_lite) === true,
 		toolMode: payload.tool_mode === "code_mode_only",
 		priority: toFiniteNumber(payload.priority) ?? Number.MAX_SAFE_INTEGER,
+		serviceTiers,
 	};
 }
 
@@ -408,6 +423,7 @@ function buildNormalizedCodexModel(
 			...(parsed.preferWebsockets ? { preferWebsockets: true } : {}),
 			...(parsed.useResponsesLite ? { useResponsesLite: true } : {}),
 			...(parsed.toolMode ? { toolMode: "code_mode_only" as const } : {}),
+			...(parsed.serviceTiers !== undefined ? { serviceTiers: parsed.serviceTiers } : {}),
 			...(parsed.priority !== Number.MAX_SAFE_INTEGER ? { priority: parsed.priority } : {}),
 		},
 	};

package/src/hosts.ts

@@ -169,6 +169,53 @@ export function isAzureDeploymentsUrl(baseUrl: string): boolean {
 	return baseUrl.includes("/deployments/");
 }
 
+// Bedrock inference endpoints, per AWS's endpoint and PrivateLink docs:
+// - bedrock-runtime: `bedrock-runtime.<region>.amazonaws.com`, FIPS `bedrock-runtime-fips.<region>.amazonaws.com`
+// - bedrock-mantle: `bedrock-mantle.<region>.api.aws`; the bundled provider keeps a `{region}`
+//   template until request preparation fills it in
+// - PrivateLink endpoint-specific names for either service, Regional or zonal:
+//   `<vpce-id>[-<az>].<service>.<region>.vpce.amazonaws.com`
+// With private DNS enabled, a VPC endpoint answers on the public names above.
+const BEDROCK_PUBLIC_HOST =
+	/^(?:(?<runtime>bedrock-runtime(?:-fips)?)\.[a-z0-9-]+\.amazonaws\.com|bedrock-mantle\.(?:[a-z0-9-]+|\{region\})\.api\.aws)$/;
+const BEDROCK_PRIVATELINK_HOST =
+	/^vpce-[a-z0-9-]+\.(?:(?<runtime>bedrock-runtime(?:-fips)?)|bedrock-mantle)\.[a-z0-9-]+\.vpce\.amazonaws\.com$/;
+
+function hasPathPrefix(pathname: string, prefix: string): boolean {
+	return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+
+/**
+ * Amazon Bedrock API route on a bedrock-runtime or bedrock-mantle endpoint
+ * (public, FIPS, or PrivateLink hostname):
+ * - `anthropic`: the Anthropic Messages API under `/anthropic`.
+ * - `openai`: the OpenAI-compatible APIs under `/openai`, plus Mantle's
+ *   documented `/v1` base (`https://bedrock-mantle.<region>.api.aws/v1`).
+ *
+ * Hostnames are parsed strictly so proxies that embed these hosts in a path
+ * do not match.
+ */
+export function isBedrockRouteUrl(baseUrl: string | undefined, route: "openai" | "anthropic"): boolean {
+	if (!baseUrl) return false;
+	let url: URL;
+	try {
+		url = new URL(baseUrl);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "https:") return false;
+	const host = BEDROCK_PUBLIC_HOST.exec(url.hostname) ?? BEDROCK_PRIVATELINK_HOST.exec(url.hostname);
+	if (!host) return false;
+	if (route === "anthropic") return hasPathPrefix(url.pathname, "/anthropic");
+	const isMantle = host.groups?.runtime === undefined;
+	return hasPathPrefix(url.pathname, "/openai") || (isMantle && hasPathPrefix(url.pathname, "/v1"));
+}
+
+/** Amazon Bedrock's OpenAI-compatible routes; see {@link isBedrockRouteUrl}. */
+export function isBedrockOpenAIUrl(baseUrl: string | undefined): boolean {
+	return isBedrockRouteUrl(baseUrl, "openai");
+}
+
 /** Alibaba DashScope consumer `compatible-mode` endpoint (rejects multimodal arrays for some text-only SKUs). */
 export function isDashscopeCompatibleModeUrl(baseUrl: string): boolean {
 	const normalized = baseUrl.toLowerCase();