@oh-my-pi/pi-catalog 18.9.1 → 18.9.2

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [18.9.2] - 2026-10-11
+
+### Removed
+
+- Removed `parseCloudflareAiGatewayCredential`, `serializeCloudflareAiGatewayCredential`, and `CloudflareAiGatewayCredential` from `@oh-my-pi/pi-catalog/wire/cloudflare-ai-gateway`. Use the equivalents from `@oh-my-pi/pi-catalog/wire/cloudflare` instead.
+
 ## [18.9.1] - 2026-10-11
 
 ### Added

package/dist/types/compat/auth-ids.d.ts

@@ -1,4 +1,4 @@
 /** Every provider with an `auth/<id>.kdl` policy. */
-export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coralbricks" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "factory-droid" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "helmcode" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "snowflake" | "stencil" | "stepfun" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "cloudflare-workers-ai" | "commandcode" | "coralbricks" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "factory-droid" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "helmcode" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "snowflake" | "stencil" | "stepfun" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
 /** Providers whose policy declares a `login` flow (the `/login` roster). */
-export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coralbricks" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "factory-droid" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "helmcode" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "snowflake" | "stencil" | "stepfun" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "cloudflare-workers-ai" | "commandcode" | "coralbricks" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "factory-droid" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "helmcode" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "snowflake" | "stencil" | "stepfun" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";

package/dist/types/compat/judgment-questions.d.ts

@@ -0,0 +1,7 @@
+import type { Model } from "../types.js";
+/**
+ * Most questions one System One judgment request to this model may carry
+ * (`judgment-questions-max` axis), or `undefined` when the endpoint takes any
+ * batch size.
+ */
+export declare function resolveJudgmentQuestionsMax(model: Model): number | undefined;

package/dist/types/compat/provider-ids.d.ts

@@ -1,2 +1,2 @@
 /** Every chat-model provider with a catalog entry (`default-model` in its provider rules). */
-export type KnownProvider = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coralbricks" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "factory-droid" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "helmcode" | "huggingface" | "kilo" | "kimi-code" | "litellm" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "opencode-go" | "opencode-zen" | "openrouter" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "snowflake" | "stepfun" | "synthetic" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zenmux" | "zhipu-coding-plan";
+export type KnownProvider = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "cloudflare-workers-ai" | "commandcode" | "coralbricks" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "factory-droid" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "helmcode" | "huggingface" | "kilo" | "kimi-code" | "litellm" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "opencode-go" | "opencode-zen" | "openrouter" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "snowflake" | "stepfun" | "synthetic" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zenmux" | "zhipu-coding-plan";

package/dist/types/compat/types.d.ts

@@ -593,6 +593,8 @@ export interface CompiledSeedModel {
     baseUrl: string;
     reasoning: boolean;
     input: ("text" | "image")[];
+    /** Wire model id sent upstream when it differs from the row id (`request-model-id`). */
+    requestModelId?: string;
     supportsTools?: boolean;
     cost: TokenCost;
     contextWindow: number | null;

package/dist/types/provider-models/openai-compat.d.ts

@@ -69,7 +69,7 @@ export interface OpenAIModelManagerConfig {
     baseUrl?: string;
     fetch?: FetchImpl;
 }
-export declare function openaiModelManagerOptions(config?: OpenAIModelManagerConfig): ModelManagerOptions<"openai-responses">;
+export declare function openaiModelManagerOptions(config?: OpenAIModelManagerConfig): ModelManagerOptions<Api>;
 /**
  * Re-derive the generated pro-reasoning aliases (`gpt-5.6-*-pro`) for the
  * first-party `openai` gpt-5.6 rows. Each alias inherits the base row's

package/dist/types/provider-models/special.d.ts

@@ -65,6 +65,8 @@ export declare function devinModelManagerOptions(config?: DevinModelManagerConfi
 export declare function factoryDroidModelManagerOptions(config?: FactoryDroidModelDiscoveryOptions): ModelManagerOptions<"factory-droid-agent">;
 export declare function localModelManagerOptions(): ModelManagerOptions<"local-inference">;
 export declare function webModelManagerOptions(): ModelManagerOptions<"web-search">;
+/** Cloudflare Workers AI judges: the authored Clef rows; the account id resolves per request. */
+export declare function cloudflareWorkersAiModelManagerOptions(): ModelManagerOptions<"workers-ai-systemone">;
 /** Credentials and endpoint overrides for the TypeSafe catalog manager. */
 export interface TypeSafeModelManagerConfig {
     apiKey?: string;

package/dist/types/types.d.ts

@@ -14,7 +14,7 @@ export type KindApiKind = (typeof KIND_API_KINDS)[number];
 /** Grounding transport available to chat models selected by the web role. */
 export type WebSearchGrounding = "gemini" | "anthropic" | "codex" | "xai" | "openrouter" | "openai";
 /** Non-chat runner protocols accepted by catalog seeds, outside the chat dispatch union. */
-export declare const RUNNER_APIS: readonly ["local-inference", "web-search", "typesafe", "openrouter-decisions", "openai-images", "openrouter-images", "xai-tts", "openai-speech", "openai-embeddings", "openrouter-rerank", "openrouter-video", "openai-transcriptions"];
+export declare const RUNNER_APIS: readonly ["local-inference", "web-search", "typesafe", "openrouter-decisions", "openai-decisions", "workers-ai-systemone", "openai-images", "openrouter-images", "xai-tts", "openai-speech", "openai-embeddings", "openrouter-rerank", "openrouter-video", "openai-transcriptions"];
 /** Kind each single-purpose runner API serves; `local-inference` hosts several kinds. */
 export declare const RUNNER_API_KINDS: Record<Exclude<(typeof RUNNER_APIS)[number], "local-inference">, ModelKind>;
 /** Kind a runner API serves; `undefined` for chat transports and multi-kind `local-inference`. */

package/dist/types/wire/cloudflare-ai-gateway.d.ts

@@ -6,13 +6,3 @@ export declare const CLOUDFLARE_AI_GATEWAY_ANTHROPIC_BASE_URL = "https://gateway
 export declare const CLOUDFLARE_AI_GATEWAY_OPENAI_BASE_URL = "https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/openai";
 /** OpenAI-compatible Workers AI endpoint. */
 export declare const CLOUDFLARE_AI_GATEWAY_COMPAT_BASE_URL = "https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/compat";
-/** Opaque API-key credential payload persisted by Cloudflare AI Gateway login. */
-export interface CloudflareAiGatewayCredential {
-    token: string;
-    accountId?: string;
-    gatewayId?: string;
-}
-/** Parse both structured login credentials and legacy plain gateway tokens. */
-export declare function parseCloudflareAiGatewayCredential(value: string): CloudflareAiGatewayCredential | null;
-/** Serialize the gateway token with the routing identifiers collected during login. */
-export declare function serializeCloudflareAiGatewayCredential(token: string, accountId: string, gatewayId: string): string;

package/dist/types/wire/cloudflare.d.ts

@@ -0,0 +1,10 @@
+/** Cloudflare credential persisted by the AI Gateway and Workers AI logins: a bearer token plus the routing ids collected at login. */
+export interface CloudflareCredential {
+    token: string;
+    accountId?: string;
+    gatewayId?: string;
+}
+/** Parses a structured login credential or a legacy plain token; null when empty or malformed. */
+export declare function parseCloudflareCredential(value: string): CloudflareCredential | null;
+/** Serializes a login credential, trimming fields and omitting empty optional ids. */
+export declare function serializeCloudflareCredential(credential: CloudflareCredential): string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-catalog",
-	"version": "18.9.1",
+	"version": "18.9.2",
 	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
 	"keywords": [
 		"ai",
@@ -93,12 +93,12 @@
 		"gen:proto": "bun scripts/generate-protocols.ts"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.9.1",
-		"@oh-my-pi/pi-utils": "18.9.1"
+		"@oh-my-pi/omptype": "18.9.2",
+		"@oh-my-pi/pi-utils": "18.9.2"
 	},
 	"devDependencies": {
 		"@bgotink/kdl": "0.4.0",
-		"@oh-my-pi/pi-ai": "18.9.1",
+		"@oh-my-pi/pi-ai": "18.9.2",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/compat/auth-ids.ts

@@ -17,6 +17,7 @@ export type AuthProviderId =
 	| "charm-hyper"
 	| "cline-pass"
 	| "cloudflare-ai-gateway"
+	| "cloudflare-workers-ai"
 	| "commandcode"
 	| "coralbricks"
 	| "coreweave"
@@ -110,6 +111,7 @@ export type LoginProviderId =
 	| "charm-hyper"
 	| "cline-pass"
 	| "cloudflare-ai-gateway"
+	| "cloudflare-workers-ai"
 	| "commandcode"
 	| "coralbricks"
 	| "coreweave"

package/src/compat/axes.ts

@@ -406,6 +406,11 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"image-tokenization": { key: "imageTokenization", set: "catalog", shape: "object" },
 	"image-model": { key: "imageModel", set: "catalog", shape: "scalar" },
 	"inline-image-byte-budget": { key: "inlineImageByteBudget", set: "catalog", shape: "scalar" },
+	/**
+	 * Most questions one System One judgment request may carry; the judge
+	 * splits larger requests. Unassigned: the endpoint takes any batch size.
+	 */
+	"judgment-questions-max": { key: "judgmentQuestionsMax", set: "catalog", shape: "scalar" },
 	"limits-patch": { key: "limitsPatch", set: "catalog", shape: "object" },
 	"long-context-cost": { key: "longContext", set: "catalog", shape: "object" },
 	"prompt-cache": { key: "promptCache", set: "catalog", shape: "object" },

package/src/compat/judgment-questions.ts

@@ -0,0 +1,12 @@
+import type { Model } from "../types";
+import { resolveCatalogPolicy } from "./catalog-policy";
+
+/**
+ * Most questions one System One judgment request to this model may carry
+ * (`judgment-questions-max` axis), or `undefined` when the endpoint takes any
+ * batch size.
+ */
+export function resolveJudgmentQuestionsMax(model: Model): number | undefined {
+	const value = resolveCatalogPolicy(model).judgmentQuestionsMax;
+	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined;
+}

package/src/compat/provider-ids.ts

@@ -17,6 +17,7 @@ export type KnownProvider =
 	| "charm-hyper"
 	| "cline-pass"
 	| "cloudflare-ai-gateway"
+	| "cloudflare-workers-ai"
 	| "commandcode"
 	| "coralbricks"
 	| "coreweave"

package/src/compat/rules/README.md

@@ -219,6 +219,8 @@ One object axis carries a computed form: `long-context-cost` accepts either the
 
 `inline-image-byte-budget` caps retained base64 image characters for a deployment's request body. It leaves room for tool schemas and text beneath the provider's body-size limit; the coding agent reads it through `resolveInlineImageByteBudget` before sending live history. The budget applies only while `compat.officialEndpoint` holds: a custom `baseUrl` imposes its own body limit.
 
+`judgment-questions-max` is the most questions one System One judgment request may carry (razorback16/openjev: 256; Cloudflare Clef on Workers AI and through OpenRouter Decisions: 64; unidentified `*openjev*` deployments: 16). The coding agent reads it through `resolveJudgmentQuestionsMax` and `NativeJudge` splits larger requests into parallel chunks; unassigned means the endpoint takes any batch size. [`providers/judgment-questions.kdl`](providers/judgment-questions.kdl) lists the servers verified uncapped or not isolatable.
+
 `prompt-cache-lookback` is how many block positions back from a cache breakpoint the model's prompt cache looks for an earlier request's entry (Claude: 20, counting the breakpoint; a run of consecutive `tool_use` or `tool_result` blocks is one position). The coding agent reads it through `resolvePromptCacheLookback` and keeps warm-cache tool-result pruning inside the window; unassigned means no known bound.
 
 The routed-subscription registry axes (`upstream-rotation`, `region-upstreams-global|us|eu`, `region-limits-eu`, `credit-rates`, `list-price-from`, `routing-family`, `policy-aliases`, `entitlement`, `default-reasoning-off`) describe a gateway whose proxy fans one model out to several upstreams. They are read through `src/compat/factory-droid.ts` by Factory Droid discovery and its request provider, not materialized by `buildModel`. A provider-wide `region-upstreams-*` rule is the upstream serving table and a model rule replaces it for that region. `list-price-from "<provider>" ["<id>"]` shows a bundled row's list price beside the subscription's own billing; unlike seed values it is resolved at runtime and degrades to the seed's zero cost when the row is gone. See [`providers/factory-droid.kdl`](providers/factory-droid.kdl), whose wire and billing pool per model are `api-routes` and `quota-tiers` rules in `runtime/behavior.kdl`.
@@ -425,7 +427,7 @@ Only `discovery` enrolls a provider in `generate-models.ts`; providers without i
 
 A `seed` _defines_ bundled rows for providers whose catalog cannot be discovered at generation time — credential-scoped rosters, unauthenticated regens, or models ahead of upstream catalogs. Every other stratum patches rows; this one authors them. Runtime model managers hand the rows to `staticModels` through `seedModels(provider)`; the generator bundles them per the seed's `bundle` policy. Values are literal — a seed never derives from another provider's row, and pricing is never borrowed.
 
-`seed` properties: `api` and `base-url` are per-row defaults (a `model` may override either with the same property names); `bundle` defaults to `always`; `precedence="seed"` is optional. `model` takes the wire id positionally, requires `name=`, and its body MUST declare `reasoning`, `input` (`"text"` and/or `"image"`), `cost` (all four per-million rates), and `limits` (`context=` / `max-tokens=`, an omitted limit is `null`); `supports-tools #true` is optional. Any other directive is an axis from the cascade vocabulary: thinking axes become the row's explicit `thinking` (then `thinking-mode` and `thinking-efforts` are both required), wire axes become its explicit `compat` and must apply to the row's API, and catalog axes are rejected because they stay rule-owned in the cascade block. Explicit `thinking`/`compat` on a seed row win over the cascade exactly as they do for any authored spec.
+`seed` properties: `api` and `base-url` are per-row defaults (a `model` may override either with the same property names); `bundle` defaults to `always`; `precedence="seed"` is optional. `model` takes the row id positionally, requires `name=`, and its body MUST declare `reasoning`, `input` (`"text"` and/or `"image"`), `cost` (all four per-million rates), and `limits` (`context=` / `max-tokens=`, an omitted limit is `null`); `supports-tools #true` is optional, and `request-model-id "<wire id>"` sets the row's `requestModelId` when the upstream id differs from the row id (an OpenAI Decisions judge row beside the same-id chat model). Any other directive is an axis from the cascade vocabulary: thinking axes become the row's explicit `thinking` (then `thinking-mode` and `thinking-efforts` are both required), wire axes become its explicit `compat` and must apply to the row's API, and catalog axes are rejected because they stay rule-owned in the cascade block. Explicit `thinking`/`compat` on a seed row win over the cascade exactly as they do for any authored spec.
 
 `bundle` decides when the generator includes the rows:
 

package/src/compat/rules/auth/_order.kdl

@@ -8,6 +8,6 @@ login-order "openai-codex" "anthropic" "zai" "zai-coding-plan" "kimi-code" "open
 	"xiaomi-token-plan-ams" "xiaomi-token-plan-cn" "firepass" "cline-pass" "factory-droid" "commandcode" "charm-hyper" "deepseek" "stepfun" "muse-code" "meta" "moonshot" \
 	"cerebras" "baseten" "helmcode" "fireworks" "together" "nvidia" "novita" "deepinfra" "huggingface" "perplexity" \
 	"qianfan" "venice" "siliconflow" "siliconflow-cn" "synthetic" "nanogpt" "wafer-serverless" "coreweave" \
-	"vercel-ai-gateway" "cloudflare-ai-gateway" "snowflake" "litellm" "kilo" "zenmux" "opencode-zen" "opencode-go" \
+	"vercel-ai-gateway" "cloudflare-ai-gateway" "cloudflare-workers-ai" "snowflake" "litellm" "kilo" "zenmux" "opencode-zen" "opencode-go" \
 	"yolo-auto" "tavily" "kagi" "exa" "parallel" "typesafe" "ollama" "ollama-cloud" "lm-studio" "llama.cpp" "vllm" \
 	"gmi-cloud" "stencil" "singularityapi-dev" "singularityapi-tech" "coralbricks"

package/src/compat/rules/auth/cloudflare-workers-ai.kdl

@@ -0,0 +1,9 @@
+// Cloudflare Workers AI runs the Clef decision models under
+// `/client/v4/accounts/{account_id}/ai/run`. Login stores the API token with
+// the account id (the shared Cloudflare credential); an env-supplied token
+// takes its account from `CLOUDFLARE_ACCOUNT_ID`.
+auth "cloudflare-workers-ai" {
+	name "Cloudflare Workers AI"
+	env "CLOUDFLARE_API_TOKEN" "CLOUDFLARE_AUTH_TOKEN"
+	login "custom" hook="cloudflare-workers-ai"
+}

package/src/compat/rules/classes/qwen.kdl

@@ -1,7 +1,8 @@
 // Model-lineage compat for "qwen"; regenerated from the frozen census using class taxonomy selectors.
 
 class "qwen" {
-	on "aiand" "aimlapi" "alibaba-coding-plan" "amazon-bedrock" "coreweave" "groq" "huggingface" \
+	// Groq owns its Qwen effort ladder in providers/groq.kdl.
+	on "aiand" "aimlapi" "alibaba-coding-plan" "amazon-bedrock" "coreweave" "huggingface" \
 		"kilo" "nanogpt" "novita" "nvidia" "ollama-cloud" "openrouter" "synthetic" \
 		"together" "venice" "wafer-serverless" "zenmux" {
 		thinking-efforts "minimal" "low" "medium" "high"

package/src/compat/rules/providers/cloudflare-workers-ai.kdl

@@ -0,0 +1,34 @@
+// Cloudflare Workers AI decision models. Clef and Clef Flash answer typed
+// questions over JSON state with the TypeSafe System One body
+// (`{model, state, questions}`) at
+// `POST /client/v4/accounts/{account_id}/ai/run/@cf/cloudflare/<model>`.
+// `<account>` in the base URL is resolved per request from the stored login
+// credential (else `CLOUDFLARE_ACCOUNT_ID`).
+
+provider "cloudflare-workers-ai" {
+	default-model "@cf/cloudflare/clef"
+	env "CLOUDFLARE_API_TOKEN" "CLOUDFLARE_AUTH_TOKEN"
+
+	// developers.cloudflare.com/workers-ai/models/clef and /clef-flash: both
+	// take text and image input and bill input tokens only.
+	seed api="workers-ai-systemone" base-url="https://api.cloudflare.com/client/v4/accounts/<account>/ai/run" bundle="always" {
+		model "@cf/cloudflare/clef" name="Clef" {
+			reasoning #false
+			input "text" "image"
+			cost input=0.24 output=0 cache-read=0 cache-write=0
+			limits context=65536
+			supports-tools #false
+		}
+		model "@cf/cloudflare/clef-flash" name="Clef Flash" {
+			reasoning #false
+			input "text" "image"
+			cost input=0.038 output=0 cache-read=0 cache-write=0
+			limits context=24576
+			supports-tools #false
+		}
+	}
+
+	models "*" {
+		kind "judge"
+	}
+}

package/src/compat/rules/providers/groq.kdl

@@ -4,8 +4,29 @@ provider "groq" {
 	default-model "openai/gpt-oss-120b"
 	env "GROQ_API_KEY"
 
+	// Groq validates assistant message properties and refuses `reasoning_content`
+	// (400 "property 'reasoning_content' is unsupported"), so the Kimi lineage's
+	// tool-call replay field, real or the "." placeholder, is never sent here.
+	requires-reasoning-content-for-tool-calls #false
 	thinking-mode "effort"
 	class "unknown" {
 		thinking-efforts "minimal" "low" "medium" "high" "xhigh"
 	}
+	// Groq accepts OpenAI `reasoning_effort` for Qwen, with `none` as its off
+	// value, not Qwen-native `enable_thinking` (400 "property 'enable_thinking'
+	// is unsupported"). Its documented Qwen ladder (Qwen 3.8) is low/medium/high;
+	// `minimal` answers 400 "invalid Qwen3.8 reasoning_effort".
+	class "qwen" {
+		thinking-format "openai"
+		reasoning-disable-mode "none-effort"
+		thinking-efforts "low" "medium" "high"
+	}
+	// Qwen 3.6 only takes `default` (thinking) or `none` (off), per its Groq
+	// model card.
+	models "qwen/qwen3.6-27b" {
+		thinking-efforts "high"
+		thinking-effort-map {
+			high "default"
+		}
+	}
 }

package/src/compat/rules/providers/judgment-questions.kdl

@@ -0,0 +1,53 @@
+// Most questions one System One judgment request may carry. A server that
+// validates the `questions` map rejects an oversized request (HTTP 400/422)
+// before judging anything, so the judge splits larger requests. Scoped by
+// adapter, not provider name: self-hosted servers are user-configured judge
+// rows under arbitrary provider ids.
+//
+// Unassigned, verified without a count cap (token budget only): TypeSafe jev
+// (docs.typesafe.ai/models: 64k tokens per request), the same jev behind
+// OpenRouter Decisions, Command Code and OpenCode Zen, Kev
+// (github.com/jaredpalmer/kev: "A request may carry any number of
+// questions"), and wev / OpenJev-4B (github.com/alanhuangyoo/OpenJev, which
+// answers under any requested name).
+//
+// Unassigned: OpenAI Decisions (`openai-decisions`); its guide
+// (developers.openai.com/api/docs/guides/decisions) documents no question cap.
+//
+// Not isolatable: openjev-sglang (github.com/ekzhang/openjev-sglang) caps at
+// 64 but answers as `jev-latest` or its upstream model name, the same ids as
+// uncapped hosts.
+on-api "typesafe" "openrouter-decisions" {
+	// residue: no taxonomy class covers self-hosted OpenJEV deployments. An
+	// `openjev-*` gateway answered HTTP 422 `at most 16 items`
+	// (https://github.com/can1357/oh-my-pi/issues/15081); which server that is
+	// remains unidentified, so unknown OpenJEV ids keep the smallest cap
+	// observed. Over-splitting costs requests; under-splitting fails them.
+	models "*openjev*" {
+		judgment-questions-max 16
+	}
+	// residue: razorback16/openjev and its Swift port (Algorythm-Canada/
+	// OpenJevSwift) reject more than OPENJEV_MAX_QUESTIONS, default 256, with
+	// `at most 256 questions per request`. These are the wire names their
+	// DiffusionGemma, Laya, Verdict and JevK5 backends answer under; exact ids
+	// outrank the glob above.
+	models "openjev-latest" "openjev-0.1" "laya-1.0" "verdict-1.4" "jevk5-0.2" {
+		judgment-questions-max 256
+	}
+}
+// Cloudflare Clef, Clef Flash and Clef Omni: the Workers AI input schema
+// bounds `questions` to 1-64 entries (`maxProperties: 64`,
+// developers.cloudflare.com/workers-ai/models/clef, /clef-flash, /clef-omni).
+on-api "workers-ai-systemone" {
+	models "@cf/cloudflare/clef*" {
+		judgment-questions-max 64
+	}
+}
+// OpenRouter Decisions serves its `cloudflare/clef*` rows from Workers AI (and
+// PrimeIntellect, whose cap is unpublished), so the Workers AI schema's 64
+// applies; scoped apart from the TypeSafe block above.
+on-api "openrouter-decisions" {
+	models "cloudflare/clef*" {
+		judgment-questions-max 64
+	}
+}

package/src/compat/rules/providers/openai.kdl

@@ -84,8 +84,23 @@ provider "openai" {
 			limits context=8192
 			supports-tools #false
 		}
+		// Decisions API (`POST /v1/decisions`, public beta,
+		// developers.openai.com/api/docs/guides/decisions) answers typed questions
+		// with GPT-6 Luna. The wire id is the chat row's `gpt-6-luna`, so the judge
+		// row takes its own id. Billed $0.10 per 1M input tokens, no output charge.
+		model "gpt-6-luna-decisions" name="GPT-6 Luna Decisions" api="openai-decisions" base-url="https://api.openai.com/v1" {
+			request-model-id "gpt-6-luna"
+			reasoning #false
+			input "text" "image"
+			cost input=0.1 output=0 cache-read=0 cache-write=0
+			limits context=1050000
+			supports-tools #false
+		}
 	}
 
+	models "gpt-6-luna-decisions" {
+		kind "judge"
+	}
 	models "whisper-1" "gpt-4o-transcribe" "gpt-4o-mini-transcribe" {
 		kind "stt"
 	}