@opengeni/config 0.10.0 → 0.10.1

package/dist/index.d.ts

@@ -163,6 +163,7 @@ declare const SettingsSchema: z.ZodObject<{
     openaiBaseUrl: z.ZodOptional<z.ZodString>;
     openaiModel: z.ZodDefault<z.ZodString>;
     openaiAllowedModels: z.ZodDefault<z.ZodString>;
+    vercelAiGatewayApiKey: z.ZodOptional<z.ZodString>;
     voiceInputMaxDurationSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     voiceInputMaxSizeBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     voiceInputProviderOrder: z.ZodDefault<z.ZodString>;
@@ -620,6 +621,19 @@ export declare const ModelCapabilitiesV1Schema: z.ZodObject<{
             runnable: z.ZodBoolean;
         }, z.core.$strip>;
     }, z.core.$strip>;
+    promptCaching: z.ZodOptional<z.ZodObject<{
+        upstream: z.ZodEnum<{
+            supported: "supported";
+            unknown: "unknown";
+            unsupported: "unsupported";
+        }>;
+        runnable: z.ZodBoolean;
+        mode: z.ZodEnum<{
+            automatic: "automatic";
+            implicit: "implicit";
+            none: "none";
+        }>;
+    }, z.core.$strip>>;
     latencyModes: z.ZodArray<z.ZodObject<{
         id: z.ZodEnum<{
             fast: "fast";
@@ -680,6 +694,8 @@ export type ModelProviderApi = z.infer<typeof ModelProviderApi>;
 export declare const RegistryProviderKind: z.ZodEnum<{
     "api-key": "api-key";
     "codex-subscription": "codex-subscription";
+    "vercel-gateway-managed": "vercel-gateway-managed";
+    "vercel-gateway-workspace": "vercel-gateway-workspace";
 }>;
 export type RegistryProviderKind = z.infer<typeof RegistryProviderKind>;
 /** A non-built-in provider declared by the host via OPENGENI_MODEL_PROVIDERS_JSON. */
@@ -687,6 +703,8 @@ declare const RegistryProviderSchema: z.ZodObject<{
     kind: z.ZodDefault<z.ZodEnum<{
         "api-key": "api-key";
         "codex-subscription": "codex-subscription";
+        "vercel-gateway-managed": "vercel-gateway-managed";
+        "vercel-gateway-workspace": "vercel-gateway-workspace";
     }>>;
     id: z.ZodString;
     label: z.ZodOptional<z.ZodString>;
@@ -818,6 +836,19 @@ declare const RegistryProviderSchema: z.ZodObject<{
                     runnable: z.ZodBoolean;
                 }, z.core.$strip>;
             }, z.core.$strip>;
+            promptCaching: z.ZodOptional<z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    supported: "supported";
+                    unknown: "unknown";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+                mode: z.ZodEnum<{
+                    automatic: "automatic";
+                    implicit: "implicit";
+                    none: "none";
+                }>;
+            }, z.core.$strip>>;
             latencyModes: z.ZodArray<z.ZodObject<{
                 id: z.ZodEnum<{
                     fast: "fast";
@@ -907,6 +938,12 @@ export interface ConfiguredModel {
     credentialSource: CredentialSourceV1;
     billing: BillingAttributionV1;
     capabilities: ModelCapabilitiesV1;
+    requestPolicy?: {
+        gateway: {
+            only: [string];
+            caching: "auto" | "none";
+        };
+    };
     pricing?: ModelPricingScheduleV1 | undefined;
     definitionVersion: string;
     contextWindowTokens?: number | undefined;
@@ -916,6 +953,30 @@ export interface ConfiguredModel {
     reasoningEffort: boolean;
     hostedWebSearch: boolean;
 }
+export declare const VERCEL_AI_GATEWAY_BASE_URL: "https://ai-gateway.vercel.sh/v1";
+export declare const OPENGENI_GATEWAY_PROVIDER_ID: "opengeni-gateway";
+export declare const WORKSPACE_GATEWAY_PROVIDER_ID: "workspace-gateway";
+export declare const WORKSPACE_GATEWAY_MODEL_ID_PREFIX: "workspace-gateway/";
+export declare const VERCEL_AI_GATEWAY_CONNECTION_DOMAIN: "ai-gateway.vercel.sh";
+export declare const VERCEL_AI_GATEWAY_CONNECTION_ROLE: "vercel_ai_gateway";
+export declare const OPENGENI_GATEWAY_MODELS: {
+    readonly deepseek: {
+        readonly productId: "deepseek-v4-flash-0731";
+        readonly workspaceProductId: "workspace-gateway/deepseek-v4-flash-0731";
+        readonly upstreamModelId: "deepseek/deepseek-v4-flash-0731";
+        readonly label: "DeepSeek V4 Flash 0731";
+        readonly provider: "deepinfra";
+        readonly implicitCaching: true;
+    };
+    readonly kimi: {
+        readonly productId: "kimi-k3-fast";
+        readonly workspaceProductId: "workspace-gateway/kimi-k3-fast";
+        readonly upstreamModelId: "moonshotai/kimi-k3-fast";
+        readonly label: "Kimi K3 Fast";
+        readonly provider: "wafer";
+        readonly implicitCaching: true;
+    };
+};
 /**
  * Built-in OpenGeni credit pricing schedules.
  *
@@ -977,6 +1038,11 @@ export declare function collectSandboxEnvironment(settings: Settings, source?: N
  * explicit environment in tests.
  */
 export declare function resolveProviderApiKey(provider: Pick<RegistryProvider, "apiKey" | "apiKeyEnv">, source?: NodeJS.ProcessEnv): string | undefined;
+export declare function gatewayRequestPolicyForUpstreamModel(upstreamModelId: string): ConfiguredModel["requestPolicy"];
+/** Static catalog overlay; it contains no concrete workspace credential. */
+export declare function withWorkspaceGatewayCatalogProvider(settings: Settings): Settings;
+/** Runtime overlay after the worker resolves the workspace's encrypted key. */
+export declare function withWorkspaceGatewayCredential(settings: Settings, apiKey: string): Settings;
 /**
  * Product display label for catalog/picker UI.
  * Same string for OpenAI and Codex copies of a slug (`gpt-5.6-luna` and

package/dist/index.js

@@ -292,6 +292,10 @@ var SettingsSchema = z.object({
   openaiBaseUrl: z.string().optional(),
   openaiModel: z.string().default("gpt-5.6-sol"),
   openaiAllowedModels: z.string().default("gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna"),
+  // OpenGeni-managed Vercel AI Gateway. When configured, the two reviewed
+  // Gateway models below are added to the managed-credit catalog. Workspace
+  // Gateway keys use the encrypted connection broker and never this secret.
+  vercelAiGatewayApiKey: z.string().optional(),
   // Native composer voice input (browser MediaRecorder → API transcription).
   // Provider credentials stay server-side; ClientConfig only projects availability
   // and hard ceilings. Selection happens once before audio is sent — never retry
@@ -965,6 +969,9 @@ var ModelCapabilitiesV1Schema = z.object({
     responsesWebSocket: CapabilityStateV1Schema,
     realtimeAudio: CapabilityStateV1Schema
   }),
+  promptCaching: CapabilityStateV1Schema.extend({
+    mode: z.enum(["implicit", "automatic", "none"])
+  }).optional(),
   latencyModes: z.array(
     z.object({
       id: ModelLatencyModeV1,
@@ -1025,7 +1032,12 @@ var ModelCapabilitiesV1Schema = z.object({
   }
 });
 var ModelProviderApi = z.enum(["responses", "chat"]);
-var RegistryProviderKind = z.enum(["api-key", "codex-subscription"]);
+var RegistryProviderKind = z.enum([
+  "api-key",
+  "codex-subscription",
+  "vercel-gateway-managed",
+  "vercel-gateway-workspace"
+]);
 var RegistryModelSchema = z.object({
   id: z.string().min(1),
   // canonical OpenGeni product id
@@ -1069,7 +1081,6 @@ var RegistryModelSchema = z.object({
 });
 var RegistryProviderSchema = z.object({
   kind: RegistryProviderKind.default("api-key"),
-  // "codex-subscription" => per-request token, no static key
   id: z.string().min(1).regex(registryId),
   // stable provider id, e.g. "fireworks"
   label: z.string().min(1).optional(),
@@ -1094,6 +1105,30 @@ var IntegrationOAuthClientConfigSchema = z.object({
   clientSecret: z.string().min(1).optional(),
   tokenEndpointAuthMethod: z.enum(["none", "client_secret_post", "client_secret_basic"]).default("none")
 });
+var VERCEL_AI_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh/v1";
+var OPENGENI_GATEWAY_PROVIDER_ID = "opengeni-gateway";
+var WORKSPACE_GATEWAY_PROVIDER_ID = "workspace-gateway";
+var WORKSPACE_GATEWAY_MODEL_ID_PREFIX = "workspace-gateway/";
+var VERCEL_AI_GATEWAY_CONNECTION_DOMAIN = "ai-gateway.vercel.sh";
+var VERCEL_AI_GATEWAY_CONNECTION_ROLE = "vercel_ai_gateway";
+var OPENGENI_GATEWAY_MODELS = {
+  deepseek: {
+    productId: "deepseek-v4-flash-0731",
+    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}deepseek-v4-flash-0731`,
+    upstreamModelId: "deepseek/deepseek-v4-flash-0731",
+    label: "DeepSeek V4 Flash 0731",
+    provider: "deepinfra",
+    implicitCaching: true
+  },
+  kimi: {
+    productId: "kimi-k3-fast",
+    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}kimi-k3-fast`,
+    upstreamModelId: "moonshotai/kimi-k3-fast",
+    label: "Kimi K3 Fast",
+    provider: "wafer",
+    implicitCaching: true
+  }
+};
 var defaultModelPricing = {
   "gpt-5.6-sol": {
     default: {
@@ -1153,6 +1188,27 @@ var defaultModelPricing = {
       }
     ]
   },
+  // Vercel AI Gateway endpoint prices, provider-pinned in the runtime.
+  // Snapshot: 2026-08-02. Both pinned routes returned discounted implicit
+  // cache reads in live Gateway responses. Wafer/Kimi reported $0.45/M even
+  // though the provider-discovery flag currently says otherwise; bill from
+  // the response-backed rate, not that inconsistent boolean.
+  [OPENGENI_GATEWAY_MODELS.deepseek.productId]: {
+    default: {
+      inputMicrosPerMillionTokens: 9e4,
+      cachedInputMicrosPerMillionTokens: 18e3,
+      outputMicrosPerMillionTokens: 18e4,
+      marginBps: 2500
+    }
+  },
+  [OPENGENI_GATEWAY_MODELS.kimi.productId]: {
+    default: {
+      inputMicrosPerMillionTokens: 45e5,
+      cachedInputMicrosPerMillionTokens: 45e4,
+      outputMicrosPerMillionTokens: 225e5,
+      marginBps: 2500
+    }
+  },
   // Fireworks AI / GLM 5.2 — the first shipped non-OpenAI registry model. A
   // built-in default pricing entry makes managed billing work out of the box
   // for hosts that expose this model via OPENGENI_MODEL_PROVIDERS_JSON without
@@ -1292,6 +1348,7 @@ function getSettings() {
     openaiBaseUrl: optional("OPENGENI_OPENAI_BASE_URL") ?? optional("OPENAI_BASE_URL"),
     openaiModel: optional("OPENGENI_OPENAI_MODEL"),
     openaiAllowedModels: optional("OPENGENI_OPENAI_ALLOWED_MODELS"),
+    vercelAiGatewayApiKey: optional("OPENGENI_VERCEL_AI_GATEWAY_API_KEY"),
     voiceInputMaxDurationSeconds: optional("OPENGENI_VOICE_INPUT_MAX_DURATION_SECONDS"),
     voiceInputMaxSizeBytes: optional("OPENGENI_VOICE_INPUT_MAX_SIZE_BYTES"),
     voiceInputProviderOrder: optional("OPENGENI_VOICE_INPUT_PROVIDER_ORDER"),
@@ -1743,6 +1800,108 @@ function legacyModelCapabilities(settings, input) {
     latencyModes: [{ id: "standard", upstream: "unknown", runnable: true }]
   });
 }
+function gatewayRequestPolicyForUpstreamModel(upstreamModelId) {
+  const model = Object.values(OPENGENI_GATEWAY_MODELS).find(
+    (candidate) => candidate.upstreamModelId === upstreamModelId
+  );
+  if (!model) {
+    return void 0;
+  }
+  return {
+    gateway: {
+      only: [model.provider],
+      caching: model.implicitCaching ? "auto" : "none"
+    }
+  };
+}
+function gatewayModelCapabilities(settings, input) {
+  const legacy = legacyModelCapabilities(settings, {
+    reasoningEffort: true,
+    hostedWebSearch: false
+  });
+  return normalizeCapabilities({
+    ...legacy,
+    functionCalling: { upstream: "supported", runnable: true },
+    inputModalities: input.vision ? ["text", "image"] : ["text"],
+    transports: {
+      ...legacy.transports,
+      sse: { upstream: "supported", runnable: true }
+    },
+    promptCaching: input.implicitCaching ? { upstream: "supported", runnable: true, mode: "implicit" } : { upstream: "unsupported", runnable: false, mode: "none" },
+    // "Fast" is part of Kimi's product name, not OpenGeni's separately billed
+    // latency mode. Both Gateway products expose only standard here.
+    latencyModes: [{ id: "standard", upstream: "supported", runnable: true }]
+  });
+}
+function gatewayRegistryProvider(settings, input) {
+  const workspace = input.kind === "vercel-gateway-workspace";
+  const models = [OPENGENI_GATEWAY_MODELS.deepseek, OPENGENI_GATEWAY_MODELS.kimi].map((model) => ({
+    id: workspace ? model.workspaceProductId : model.productId,
+    upstreamModelId: model.upstreamModelId,
+    label: model.label,
+    capabilities: gatewayModelCapabilities(settings, {
+      implicitCaching: model.implicitCaching,
+      vision: model === OPENGENI_GATEWAY_MODELS.kimi
+    }),
+    contextWindowTokens: 1e6,
+    effectiveContextWindowTokens: 9e5,
+    autoCompactTokenLimit: 85e4,
+    toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens
+  }));
+  return {
+    kind: input.kind,
+    id: workspace ? WORKSPACE_GATEWAY_PROVIDER_ID : OPENGENI_GATEWAY_PROVIDER_ID,
+    label: workspace ? "Your Gateway" : "OpenGeni",
+    // Responses preserves vision, reasoning items, and provider-native usage.
+    // Model-specific compatibility stays at the reviewed request fence rather
+    // than downgrading the whole provider wire.
+    api: "responses",
+    baseUrl: VERCEL_AI_GATEWAY_BASE_URL,
+    ...input.apiKey ? { apiKey: input.apiKey } : {},
+    models
+  };
+}
+function configuredRegistryProviders(settings) {
+  const providers = parseModelProvidersJson(settings.modelProvidersJson);
+  if (!settings.vercelAiGatewayApiKey) {
+    return providers;
+  }
+  if (providers.some((provider) => provider.id === OPENGENI_GATEWAY_PROVIDER_ID)) {
+    throw new Error(
+      `${OPENGENI_GATEWAY_PROVIDER_ID} is reserved for OPENGENI_VERCEL_AI_GATEWAY_API_KEY`
+    );
+  }
+  return [
+    ...providers,
+    gatewayRegistryProvider(settings, {
+      kind: "vercel-gateway-managed",
+      apiKey: settings.vercelAiGatewayApiKey
+    })
+  ];
+}
+function withWorkspaceGatewayCatalogProvider(settings) {
+  const providers = parseModelProvidersJson(settings.modelProvidersJson);
+  if (providers.some((provider) => provider.id === WORKSPACE_GATEWAY_PROVIDER_ID)) {
+    return settings;
+  }
+  return {
+    ...settings,
+    modelProvidersJson: JSON.stringify([
+      ...providers,
+      gatewayRegistryProvider(settings, { kind: "vercel-gateway-workspace" })
+    ])
+  };
+}
+function withWorkspaceGatewayCredential(settings, apiKey) {
+  if (!apiKey.trim()) {
+    throw new Error("workspace AI Gateway credential is empty");
+  }
+  const catalogSettings = withWorkspaceGatewayCatalogProvider(settings);
+  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map(
+    (provider) => provider.id === WORKSPACE_GATEWAY_PROVIDER_ID ? { ...provider, apiKey } : provider
+  );
+  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };
+}
 var GPT56_FAST_BILLING_MULTIPLIER_BPS = 2e4;
 function productLabelForModelId(modelId) {
   const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? modelId.slice(CODEX_MODEL_ID_PREFIX.length) : modelId;
@@ -1772,6 +1931,10 @@ function builtinLatencyModesForModel(modelId) {
   }
   return [{ id: "standard", upstream: "unknown", runnable: true }];
 }
+function builtinPromptCachingForModel(modelId) {
+  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? modelId.slice(CODEX_MODEL_ID_PREFIX.length) : modelId;
+  return slug.startsWith("gpt-5.6-") ? { upstream: "supported", runnable: true, mode: "implicit" } : void 0;
+}
 function serviceTierForLatencyMode(providerId, latencyMode) {
   if (latencyMode === "standard") {
     return void 0;
@@ -1806,10 +1969,22 @@ function assertLatencyModeRunnable(settings, modelId, latencyMode) {
   }
 }
 function registryCredentialSource(provider) {
-  return provider.kind === "codex-subscription" ? { kind: "connected_subscription", provider: "codex" } : { kind: "deployment", mechanism: "api_key" };
+  if (provider.kind === "codex-subscription") {
+    return { kind: "connected_subscription", provider: "codex" };
+  }
+  if (provider.kind === "vercel-gateway-workspace") {
+    return { kind: "workspace_connection", mechanism: "api_key" };
+  }
+  return { kind: "deployment", mechanism: "api_key" };
 }
 function registryBilling(provider) {
-  return provider.kind === "codex-subscription" ? { upstreamPayer: "connected_subscription", metering: "external" } : { upstreamPayer: "deployment", metering: "opengeni_credits" };
+  if (provider.kind === "codex-subscription") {
+    return { upstreamPayer: "connected_subscription", metering: "external" };
+  }
+  if (provider.kind === "vercel-gateway-workspace") {
+    return { upstreamPayer: "workspace", metering: "external" };
+  }
+  return { upstreamPayer: "deployment", metering: "opengeni_credits" };
 }
 function builtinCredentialSource(settings) {
   if (settings.openaiProvider === "azure" && !settings.azureOpenaiApiKey) {
@@ -1866,6 +2041,7 @@ function definitionVersionFor(model, provider) {
     billing: model.billing,
     executionLimits: model.executionLimits,
     capabilities: model.capabilities,
+    ...model.requestPolicy ? { requestPolicy: model.requestPolicy } : {},
     pricing: model.pricing ?? null
   });
   return `sha256:${createHash("sha256").update("opengeni:model-definition:v1\n", "utf8").update(digestInput, "utf8").digest("hex")}`;
@@ -1895,7 +2071,7 @@ function configuredProviders(settings) {
     builtin.baseUrl = settings.openaiBaseUrl ? normalizeRegistryBaseUrl(settings.openaiBaseUrl, builtin.id) : void 0;
     builtin.apiKey = settings.openaiApiKey;
   }
-  const registry = parseModelProvidersJson(settings.modelProvidersJson).map(
+  const registry = configuredRegistryProviders(settings).map(
     (provider) => ({
       id: provider.id,
       label: provider.label ?? provider.id,
@@ -1931,6 +2107,9 @@ function withCodexCatalogProvider(settings) {
           reasoningEffort: true,
           hostedWebSearch: true
         }),
+        ...builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`) ? {
+          promptCaching: builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)
+        } : {},
         latencyModes: builtinLatencyModesForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)
       };
       return {
@@ -1961,6 +2140,9 @@ function policyProviderIdForModel(settings, modelId) {
   if (canonicalModelId.startsWith(CODEX_MODEL_ID_PREFIX)) {
     return CODEX_PROVIDER_ID;
   }
+  if (canonicalModelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {
+    return WORKSPACE_GATEWAY_PROVIDER_ID;
+  }
   const configured = configuredModels(settings).find((model) => model.id === canonicalModelId);
   return configured?.providerId ?? builtinProviderId(settings);
 }
@@ -1973,9 +2155,11 @@ function resolvedExecutionLimits(settings, model) {
   };
 }
 function finalizeConfiguredModel(settings, provider, input) {
+  const requestPolicy = provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace" ? gatewayRequestPolicyForUpstreamModel(input.upstreamModelId) : void 0;
   const modelWithoutVersion = {
     schemaVersion: 1,
     ...input,
+    ...requestPolicy ? { requestPolicy } : {},
     executionLimits: resolvedExecutionLimits(settings, input)
   };
   return {
@@ -2020,7 +2204,7 @@ function configuredModels(settings) {
   const providers = configuredProviders(settings);
   const providerById = new Map(providers.map((provider) => [provider.id, provider]));
   const pricingSchedules = configuredModelPricingSchedules(settings);
-  const parsedRegistry = parseModelProvidersJson(settings.modelProvidersJson);
+  const parsedRegistry = configuredRegistryProviders(settings);
   const registryOwnedIds = new Set(
     parsedRegistry.flatMap((provider) => provider.models.map((model) => model.id))
   );
@@ -2041,6 +2225,7 @@ function configuredModels(settings) {
         reasoningEffort: true,
         hostedWebSearch: settings.webSearchEnabled
       }),
+      ...builtinPromptCachingForModel(id) ? { promptCaching: builtinPromptCachingForModel(id) } : {},
       latencyModes: builtinLatencyModesForModel(id)
     };
     return finalizeConfiguredModel(settings, builtinProvider, {
@@ -2129,7 +2314,13 @@ function resolveModelProvider(settings, modelId) {
   return { provider, model };
 }
 function settingsForTurnExecutionPolicy(settings, modelId) {
-  return settings.codexSubscriptionEnabled && modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? withCodexCatalogProvider(settings) : settings;
+  if (settings.codexSubscriptionEnabled && modelId.startsWith(CODEX_MODEL_ID_PREFIX)) {
+    return withCodexCatalogProvider(settings);
+  }
+  if (modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {
+    return withWorkspaceGatewayCatalogProvider(settings);
+  }
+  return settings;
 }
 function resolveTurnExecutionPolicyV1(settings, input) {
   const catalogSettings = settingsForTurnExecutionPolicy(settings, input.modelId);
@@ -2193,7 +2384,7 @@ function configuredModelPricingSchedules(settings) {
     ])
   );
   const registry = {};
-  for (const provider of parseModelProvidersJson(settings.modelProvidersJson)) {
+  for (const provider of configuredRegistryProviders(settings)) {
     for (const model of provider.models) {
       if (model.pricing) {
         registry[model.id] = normalizeModelPricingSchedule(model.pricing);
@@ -3132,6 +3323,11 @@ function validateSettings(settings) {
   const builtinId = builtinProviderId(settings);
   const providerIds = /* @__PURE__ */ new Set();
   for (const provider of registryProviders) {
+    if (provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace") {
+      throw new Error(
+        `OPENGENI_MODEL_PROVIDERS_JSON provider kind ${provider.kind} is reserved for the reviewed AI Gateway broker`
+      );
+    }
     if (provider.id === builtinId) {
       throw new Error(
         `OPENGENI_MODEL_PROVIDERS_JSON provider id ${provider.id} collides with the built-in provider id`
@@ -3143,7 +3339,7 @@ function validateSettings(settings) {
       );
     }
     providerIds.add(provider.id);
-    if (!resolveProviderApiKey(provider)) {
+    if (provider.kind !== "codex-subscription" && !resolveProviderApiKey(provider)) {
       throw new Error(
         `OPENGENI_MODEL_PROVIDERS_JSON provider ${provider.id} requires a resolvable API key (set apiKey or apiKeyEnv)`
       );
@@ -3242,9 +3438,16 @@ export {
   McpServerConnectionRefSchema,
   ModelCapabilitiesV1Schema,
   ModelProviderApi,
+  OPENGENI_GATEWAY_MODELS,
+  OPENGENI_GATEWAY_PROVIDER_ID,
   RegistryProviderKind,
   SANDBOX_REQUIRED_ENV,
   SocialOAuthClientConfigSchema,
+  VERCEL_AI_GATEWAY_BASE_URL,
+  VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
+  VERCEL_AI_GATEWAY_CONNECTION_ROLE,
+  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
+  WORKSPACE_GATEWAY_PROVIDER_ID,
   applyGitAuthPointerEnvironment,
   assertTurnExecutionPolicyMatchesConfigV1,
   builtinProviderId,
@@ -3267,6 +3470,7 @@ export {
   environmentsEncryptionKeyBytes,
   firstPartyMcpBaseUrl,
   firstPartyMcpWorkspaceUrl,
+  gatewayRequestPolicyForUpstreamModel,
   getSettings,
   hasGitCredentialRepositorySelection,
   hasGitHubRepositorySelection,
@@ -3309,6 +3513,8 @@ export {
   streamTokenDegraded,
   temporalConnectionOptions,
   voiceInputDeploymentConfigured,
-  withCodexCatalogProvider
+  withCodexCatalogProvider,
+  withWorkspaceGatewayCatalogProvider,
+  withWorkspaceGatewayCredential
 };
 //# sourceMappingURL=index.js.map