@stablekernel/opencode-bifrost 0.1.0

package/README.md

@@ -0,0 +1,26 @@
+# @stablekernel/opencode-bifrost
+
+OpenCode plugin that routes model traffic through a [Bifrost](https://docs.getbifrost.ai) LLM gateway, with per-project virtual-key resolution delegated to `gateway-cli`.
+
+## What it does
+
+- Registers a `bifrost` provider on OpenCode's OpenAI-compatible surface.
+- Fetches the model list at startup through `gateway-cli models --wire=openai`, with per-model context/output limits and pricing already applied — no catalog is checked in, so a model added to the gateway appears without a local edit.
+- Seeds reasoning capability per model: catalog-flagged models are registered `reasoning: true` with one variant per effort value they accept, and the config cascade's default `reasoning_effort` is seeded as the model's `options.reasoningEffort` when the model accepts it. The static `gateway-cli emit opencode` block mirrors this.
+- Resolves the virtual key per project directory (`gateway-cli resolve` / `gateway-cli key print`), so two projects on different keys never collide in OpenCode's global auth store. Falls back to a credential stored via `opencode auth login` on machines without `gateway-cli`.
+
+No secret is held by the plugin; the key is read at runtime.
+
+## Requirements
+
+- `gateway-cli` on `PATH` (or the `GATEWAY_CLI_BIN` env var pointing at it), connected once with `gateway-cli connect`.
+
+## Install
+
+```
+opencode plugin @stablekernel/opencode-bifrost
+```
+
+## License
+
+UNLICENSED — published for installation convenience; all rights reserved. Intended for use within the organization that operates the Bifrost gateway.

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@stablekernel/opencode-bifrost",
+  "version": "0.1.0",
+  "description": "OpenCode plugin that routes models through the Bifrost gateway, resolving per-project virtual keys via gateway-cli.",
+  "type": "module",
+  "main": "src/index.ts",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "files": [
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@opencode-ai/plugin": ">=1.18.0"
+  },
+  "devDependencies": {
+    "@opencode-ai/plugin": "^1.18.18",
+    "@opencode-ai/sdk": "^1.18.18",
+    "@types/bun": "^1.3.14",
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.0"
+  },
+  "license": "UNLICENSED",
+  "private": false
+}

package/src/index.test.ts

@@ -0,0 +1,364 @@
+import { describe, expect, test } from "bun:test";
+import {
+  BifrostGateway,
+  isAllowedGatewayUrl,
+  toConfigModels,
+} from "./index.js";
+
+const RESOLUTION = {
+  env: "prod",
+  root: "/repo",
+  anthropic_base_url: "https://gw.example/anthropic",
+  openai_base_url: "https://gw.example/openai/v1",
+  has_key: true,
+  key_name: "acme",
+  key_source: "/keys/acme.env",
+  headers: { "X-Org-Route": "prod" },
+};
+
+/** One model as `gateway-cli models` reports it. */
+type CliModel = {
+  id: string;
+  name: string;
+  context_window: number;
+  max_output_tokens: number;
+  cost?: {
+    input: number;
+    output: number;
+    cache_read: number;
+    cache_write: number;
+  };
+  limits_source: string;
+  cost_source?: string;
+  /** Reasoning capability and applicable efforts, from the catalog. */
+  reasoning?: boolean;
+  reasoning_efforts?: string[];
+  reasoning_budget_min?: number;
+};
+
+function cliPayload(models: CliModel[]): string {
+  return JSON.stringify({
+    wire: "openai-completions",
+    env: "prod",
+    catalog: {
+      source: "https://models.dev/api.json",
+      fetched: "2026-01-01T00:00:00Z",
+    },
+    models,
+  });
+}
+
+const HAIKU: CliModel = {
+  id: "anthropic/claude-haiku-4-5-20251001",
+  name: "Claude Haiku 4.5",
+  context_window: 200000,
+  max_output_tokens: 64000,
+  cost: { input: 1, output: 5, cache_read: 0.1, cache_write: 1.25 },
+  limits_source: "gateway",
+  cost_source: "catalog",
+};
+
+const NOVA: CliModel = {
+  id: "bedrock/amazon.nova-lite-v1:0",
+  name: "Nova Lite",
+  context_window: 300000,
+  max_output_tokens: 8192,
+  cost: { input: 0.06, output: 0.24, cache_read: 0.015, cache_write: 0 },
+  limits_source: "catalog",
+  cost_source: "catalog",
+};
+
+/** A model nothing could price. */
+const UNPRICED: CliModel = {
+  id: "bedrock/deepseek.v3.1",
+  name: "deepseek.v3.1 (bedrock)",
+  context_window: 200000,
+  max_output_tokens: 4096,
+  limits_source: "floor",
+};
+
+/**
+ * Fake Bun shell. The plugin calls $`${CLI} ${args}`.cwd(d).quiet().text(),
+ * so the tag must return a chainable object.
+ */
+function fakeShell(responses: Record<string, string>, calls: string[] = []) {
+  return (_strings: TemplateStringsArray, ...values: unknown[]) => {
+    const argv = (values[1] as string[]) ?? [];
+    const cmd = argv.join(" ");
+    const chain = {
+      cwd: () => chain,
+      quiet: () => chain,
+      text: async () => {
+        calls.push(cmd);
+        if (!(cmd in responses)) throw new Error(`command failed: ${cmd}`);
+        return responses[cmd];
+      },
+    };
+    return chain;
+  };
+}
+
+const OK_SHELL = {
+  "resolve --json": JSON.stringify(RESOLUTION),
+  "key print": "sk-bf-projectkey\n",
+  "models --wire=openai": cliPayload([HAIKU, NOVA]),
+};
+
+async function load(responses: Record<string, string>, calls: string[] = []) {
+  const $ = fakeShell(responses, calls);
+  return BifrostGateway({ directory: "/repo", $ } as never);
+}
+
+async function applyConfig(responses: Record<string, string>, seed = {}) {
+  const hooks = await load(responses);
+  const cfg: Record<string, any> = { ...seed };
+  await hooks.config!(cfg as never);
+  return cfg;
+}
+
+describe("config hook", () => {
+  test("registers the provider and its live models without touching the repo", async () => {
+    const cfg = await applyConfig(OK_SHELL);
+    const p = cfg.provider.bifrost;
+    expect(p.npm).toBe("@ai-sdk/openai-compatible");
+    expect(p.options.baseURL).toBe("https://gw.example/openai/v1");
+    expect(p.options.headers).toEqual({ "X-Org-Route": "prod" });
+
+    // Verified against OpenCode 1.18.18: this map is what reaches the picker.
+    expect(Object.keys(p.models).sort()).toEqual([
+      "anthropic/claude-haiku-4-5-20251001",
+      "bedrock/amazon.nova-lite-v1:0",
+    ]);
+    expect(p.models["anthropic/claude-haiku-4-5-20251001"].name).toBe(
+      "Claude Haiku 4.5",
+    );
+  });
+
+  test("publishes the real per-model limits from the CLI", async () => {
+    const cfg = await applyConfig(OK_SHELL);
+    const m = cfg.provider.bifrost.models;
+    expect(m["anthropic/claude-haiku-4-5-20251001"].limit).toEqual({
+      context: 200000,
+      output: 64000,
+    });
+    // Nova's real cap is 10000; the declared value must stay under it.
+    expect(m["bedrock/amazon.nova-lite-v1:0"].limit.output).toBe(8192);
+    expect(m["bedrock/amazon.nova-lite-v1:0"].limit.output).toBeLessThan(10000);
+  });
+
+  test("publishes pricing so the cost readout is no longer zero", async () => {
+    const cfg = await applyConfig(OK_SHELL);
+    expect(
+      cfg.provider.bifrost.models["anthropic/claude-haiku-4-5-20251001"].cost,
+    ).toEqual({ input: 1, output: 5, cache_read: 0.1, cache_write: 1.25 });
+  });
+
+  test("does not read the key: discovery goes through the CLI", async () => {
+    // The CLI holds the credential and returns only non-secret metadata.
+    const calls: string[] = [];
+    const hooks = await load(OK_SHELL, calls);
+    await hooks.config!({} as never);
+    expect(calls).toContain("models --wire=openai");
+    expect(calls).not.toContain("key print");
+  });
+
+  test("leaves config untouched when gateway-cli is missing", async () => {
+    const cfg = await applyConfig({});
+    expect(cfg.provider).toBeUndefined();
+  });
+
+  test("registers with an empty picker when the CLI cannot list models", async () => {
+    const cfg = await applyConfig({
+      "resolve --json": JSON.stringify(RESOLUTION),
+      "key print": "sk-bf-projectkey\n",
+      // models command omitted: it fails
+    });
+    expect(cfg.provider.bifrost.models).toEqual({});
+  });
+
+  test("registers with an empty picker when the CLI emits unparseable output", async () => {
+    const cfg = await applyConfig({
+      ...OK_SHELL,
+      "models --wire=openai": "not json",
+    });
+    expect(cfg.provider.bifrost.models).toEqual({});
+  });
+
+  test("does not clobber a user's existing bifrost overrides", async () => {
+    const cfg = await applyConfig(OK_SHELL, {
+      provider: {
+        bifrost: { name: "Mine", models: { "my/model": { name: "Mine" } } },
+      },
+    });
+    expect(cfg.provider.bifrost.name).toBe("Mine");
+    expect(cfg.provider.bifrost.models["my/model"].name).toBe("Mine");
+    // Gateway models are still merged in alongside the override.
+    expect(
+      cfg.provider.bifrost.models["anthropic/claude-haiku-4-5-20251001"],
+    ).toBeDefined();
+  });
+
+  test("refuses a non-TLS remote gateway", async () => {
+    const cfg = await applyConfig({
+      ...OK_SHELL,
+      "resolve --json": JSON.stringify({
+        ...RESOLUTION,
+        openai_base_url: "http://evil.example/v1",
+      }),
+    });
+    expect(cfg.provider).toBeUndefined();
+  });
+});
+
+describe("unpriced models", () => {
+  test("omits cost entirely rather than declaring zero", () => {
+    // A zeroed rate card renders as free, which is worse than blank.
+    const models = toConfigModels({ models: [UNPRICED] });
+    expect(models["bedrock/deepseek.v3.1"].cost).toBeUndefined();
+  });
+
+  test("says so in the name, since a blank cost is ambiguous", () => {
+    const models = toConfigModels({ models: [UNPRICED] });
+    expect(models["bedrock/deepseek.v3.1"].name).toContain("pricing unknown");
+  });
+
+  test("leaves a priced model's name alone", () => {
+    const models = toConfigModels({ models: [NOVA] });
+    expect(models["bedrock/amazon.nova-lite-v1:0"].name).toBe("Nova Lite");
+  });
+
+  test("tolerates an empty or absent model list", () => {
+    expect(toConfigModels(null)).toEqual({});
+    expect(toConfigModels({})).toEqual({});
+    expect(toConfigModels({ models: [] })).toEqual({});
+  });
+});
+
+describe("reasoning", () => {
+  /** A reasoning model with a discrete effort set, like Fireworks kimi-k3. */
+  const REASONING: CliModel = {
+    id: "fireworks/models/kimi-k3",
+    name: "Kimi K3",
+    context_window: 256000,
+    max_output_tokens: 32768,
+    cost: { input: 0.6, output: 2.5, cache_read: 0.1, cache_write: 0.6 },
+    limits_source: "gateway",
+    reasoning: true,
+    reasoning_efforts: ["low", "medium", "high", "max"],
+  };
+
+  /** A toggle-only reasoning model: on/off, no effort levels. */
+  const TOGGLE_ONLY: CliModel = {
+    id: "fireworks/models/qwen3p8-max",
+    name: "Qwen3.8 Max",
+    context_window: 128000,
+    max_output_tokens: 8192,
+    limits_source: "catalog",
+    reasoning: true,
+  };
+
+  test("surfaces reasoning: true and one variant per effort value", () => {
+    const models = toConfigModels({ models: [REASONING] });
+    const m = models["fireworks/models/kimi-k3"];
+    expect(m.reasoning).toBe(true);
+    expect(m.variants).toEqual({
+      low: { reasoningEffort: "low" },
+      medium: { reasoningEffort: "medium" },
+      high: { reasoningEffort: "high" },
+      max: { reasoningEffort: "max" },
+    });
+  });
+
+  test("seeds the default effort as model options when the model accepts it", () => {
+    const models = toConfigModels({ models: [REASONING] }, "high");
+    expect(models["fireworks/models/kimi-k3"].options).toEqual({
+      reasoningEffort: "high",
+    });
+  });
+
+  test("omits the default when the model does not accept that effort", () => {
+    // "medium" is not in deepseek-v4-flash's {high, max} set; seeding it
+    // would send a value the provider rejects. The capability + variants
+    // still ship so the user can pick an applicable one.
+    const FLASH: CliModel = {
+      ...REASONING,
+      id: "fireworks/models/deepseek-v4-flash",
+      reasoning_efforts: ["high", "max"],
+    };
+    const models = toConfigModels({ models: [FLASH] }, "medium");
+    expect(
+      models["fireworks/models/deepseek-v4-flash"].options,
+    ).toBeUndefined();
+    expect(models["fireworks/models/deepseek-v4-flash"].variants).toBeDefined();
+  });
+
+  test("omits variants for a toggle-only reasoning model", () => {
+    const models = toConfigModels({ models: [TOGGLE_ONLY] });
+    const m = models["fireworks/models/qwen3p8-max"];
+    expect(m.reasoning).toBe(true);
+    expect(m.variants).toBeUndefined();
+  });
+
+  test("leaves a non-reasoning model alone", () => {
+    const models = toConfigModels({ models: [NOVA] }, "high");
+    const m = models["bedrock/amazon.nova-lite-v1:0"];
+    expect(m.reasoning).toBeUndefined();
+    expect(m.variants).toBeUndefined();
+    expect(m.options).toBeUndefined();
+  });
+});
+
+describe("auth.loader", () => {
+  test("prefers the CLI-resolved key so the project cascade wins", async () => {
+    const hooks = await load(OK_SHELL);
+    const opts = await hooks.auth!.loader!(
+      async () => ({ type: "api", key: "stored" }) as never,
+      {} as never,
+    );
+    expect(opts.apiKey).toBe("sk-bf-projectkey");
+    expect(opts.baseURL).toBe("https://gw.example/openai/v1");
+  });
+
+  test("falls back to the stored credential without gateway-cli", async () => {
+    const hooks = await load({});
+    const opts = await hooks.auth!.loader!(
+      async () => ({ type: "api", key: "stored-key" }) as never,
+      {} as never,
+    );
+    expect(opts.apiKey).toBe("stored-key");
+  });
+
+  test("returns no options when there is no credential at all", async () => {
+    const hooks = await load({});
+    const opts = await hooks.auth!.loader!(async () => {
+      throw new Error("none");
+    }, {} as never);
+    expect(opts).toEqual({});
+  });
+});
+
+describe("auth.methods", () => {
+  test("rejects a value that is not a Bifrost virtual key", async () => {
+    const hooks = await load(OK_SHELL);
+    const method = hooks.auth!.methods[0] as any;
+    expect(await method.authorize({ key: "nope" })).toEqual({ type: "failed" });
+    expect(await method.authorize({ key: "sk-bf-good" })).toEqual({
+      type: "success",
+      key: "sk-bf-good",
+    });
+    expect(method.prompts[0].validate("nope")).toBeString();
+    expect(method.prompts[0].validate("sk-bf-good")).toBeUndefined();
+  });
+});
+
+describe("gateway URL allowlist", () => {
+  test("accepts TLS and loopback, rejects everything else", () => {
+    expect(isAllowedGatewayUrl("https://gateway.example.com/openai/v1")).toBe(
+      true,
+    );
+    expect(isAllowedGatewayUrl("http://localhost:8080/openai/v1")).toBe(true);
+    expect(isAllowedGatewayUrl("http://evil.example/v1")).toBe(false);
+    expect(isAllowedGatewayUrl("file:///etc/passwd")).toBe(false);
+    expect(isAllowedGatewayUrl("not a url")).toBe(false);
+  });
+});

package/src/index.ts

@@ -0,0 +1,268 @@
+import type { Plugin } from "@opencode-ai/plugin";
+
+/** Provider id registered with OpenCode. */
+const PROVIDER_ID = "bifrost";
+
+/** Overridable so a non-PATH install still works. */
+const CLI = process.env.GATEWAY_CLI_BIN ?? "gateway-cli";
+
+/**
+ * Suffix for models nothing could price.
+ *
+ * The gateway reports no pricing, and the public catalog does not cover every
+ * model it serves. Declaring a zero rate would render as "free", so the rate
+ * card is omitted entirely and the name carries the caveat instead.
+ */
+const UNPRICED_SUFFIX = " (pricing unknown)";
+
+/**
+ * Non-secret wiring emitted by `gateway-cli resolve --json`. The virtual key
+ * is deliberately absent: it is read separately via `gateway-cli key print`
+ * so this payload can be logged.
+ */
+type Resolution = {
+  env: string;
+  root: string;
+  anthropic_base_url: string;
+  openai_base_url: string;
+  has_key: boolean;
+  key_name?: string;
+  key_source?: string;
+  headers?: Record<string, string>;
+  /** Resolved default reasoning effort (project over user), empty unset. */
+  reasoning_effort?: string;
+};
+
+/** The model shape OpenCode reads from `provider.<id>.models`. */
+type ConfigModel = {
+  name: string;
+  limit: { context: number; output: number };
+  /** Per-million-token rates. Absent when unknown — never zeroed. */
+  cost?: {
+    input: number;
+    output: number;
+    cache_read: number;
+    cache_write: number;
+  };
+  /** Whether the model supports extended thinking. */
+  reasoning?: boolean;
+  /** Named per-effort variants; each body is a provider-options overlay. */
+  variants?: Record<string, { reasoningEffort: string }>;
+  /** Provider options passed on every request (e.g. a seeded default
+   * reasoningEffort); a variant or agent override replaces these. */
+  options?: Record<string, unknown>;
+};
+
+/** One model as reported by `gateway-cli models`. */
+type CliModel = {
+  id: string;
+  name: string;
+  context_window: number;
+  max_output_tokens: number;
+  cost?: {
+    input: number;
+    output: number;
+    cache_read: number;
+    cache_write: number;
+  };
+  limits_source: string;
+  cost_source?: string;
+  /** Reasoning capability and applicable efforts, from the catalog. */
+  reasoning?: boolean;
+  reasoning_efforts?: string[];
+  reasoning_budget_min?: number;
+};
+
+type CliModels = { models?: CliModel[] };
+
+/**
+ * Bifrost gateway provider for OpenCode.
+ *
+ * Resolution is delegated to gateway-cli, run with the plugin's `directory`
+ * as its working directory. That makes the key cascade
+ * ($BIFROST_VK > project > user default) apply per project, which OpenCode's
+ * own auth store cannot express: it holds one credential per provider id
+ * globally, so two projects on different virtual keys would collide.
+ *
+ * Models, limits and pricing all come from `gateway-cli models`, which reads
+ * the gateway live and fills in what the gateway does not report. Nothing is
+ * written into the project and no catalog goes stale. Verified against
+ * OpenCode 1.18.18: `provider.<id>.models` in config is the list that reaches
+ * the picker. The v2 `provider.models` hook is not used because the v2
+ * catalog is not active in this version.
+ */
+export const BifrostGateway: Plugin = async ({ directory, $ }) => {
+  async function cli(args: string[]): Promise<string | null> {
+    try {
+      const out = await $`${CLI} ${args}`.cwd(directory).quiet().text();
+      return out.trim();
+    } catch {
+      return null;
+    }
+  }
+
+  async function resolve(): Promise<Resolution | null> {
+    const raw = await cli(["resolve", "--json"]);
+    if (!raw) return null;
+    try {
+      const parsed = JSON.parse(raw) as Resolution;
+      // Allowlist the outbound origin before any derived URL is fetched.
+      return isAllowedGatewayUrl(parsed.openai_base_url) ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+
+  async function readKey(): Promise<string | null> {
+    const key = await cli(["key", "print"]);
+    return key && key.startsWith("sk-bf-") ? key : null;
+  }
+
+  // Model discovery goes through the CLI, so the key is never needed here —
+  // only auth.loader below, which must hand it to the SDK, sees it.
+  async function listModels(): Promise<CliModels | null> {
+    const raw = await cli(["models", "--wire=openai"]);
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw) as CliModels;
+    } catch {
+      return null;
+    }
+  }
+
+  return {
+    /**
+     * Register the provider and its live model list. Runs at startup and
+     * writes only to the in-memory config object.
+     */
+    config: async (cfg) => {
+      const info = await resolve();
+      if (!info) return;
+
+      const providers = ((cfg as Record<string, any>).provider ??= {});
+      const existing = providers[PROVIDER_ID] ?? {};
+      const models = toConfigModels(await listModels(), info.reasoning_effort);
+
+      providers[PROVIDER_ID] = {
+        npm: "@ai-sdk/openai-compatible",
+        name: `Bifrost Gateway (${info.env})`,
+        // A user's own overrides win over everything generated here.
+        ...existing,
+        options: {
+          baseURL: info.openai_base_url,
+          ...(info.headers ? { headers: info.headers } : {}),
+          ...(existing.options ?? {}),
+        },
+        models: { ...models, ...(existing.models ?? {}) },
+      };
+    },
+
+    auth: {
+      provider: PROVIDER_ID,
+
+      /**
+       * Supply provider options at startup. Prefers the CLI-resolved key so
+       * the per-project cascade wins; falls back to a credential stored by
+       * `opencode auth login` for machines without gateway-cli.
+       */
+      loader: async (getAuth) => {
+        const info = await resolve();
+        let apiKey = await readKey();
+        if (!apiKey) {
+          const stored = await getAuth().catch(() => undefined);
+          if (stored && stored.type === "api") apiKey = stored.key;
+        }
+        if (!apiKey) return {};
+        return {
+          apiKey,
+          ...(info ? { baseURL: info.openai_base_url } : {}),
+          ...(info?.headers ? { headers: info.headers } : {}),
+        };
+      },
+
+      methods: [
+        {
+          type: "api",
+          label: "Bifrost Gateway (paste a virtual key from the dashboard)",
+          prompts: [
+            {
+              type: "text",
+              key: "key",
+              message: "Virtual key",
+              placeholder: "sk-bf-…",
+              validate: (value: string) =>
+                value.startsWith("sk-bf-")
+                  ? undefined
+                  : "Expected a Bifrost virtual key starting with sk-bf-",
+            },
+          ],
+          authorize: async (inputs?: Record<string, string>) => {
+            const key = inputs?.key?.trim();
+            if (!key || !key.startsWith("sk-bf-"))
+              return { type: "failed" as const };
+            return { type: "success" as const, key };
+          },
+        },
+      ],
+    },
+  };
+};
+
+/**
+ * Map the CLI's model list into OpenCode's provider config shape.
+ *
+ * Pricing is passed through only when known. OpenCode renders per-model cost,
+ * so a zeroed rate card would advertise a paid model as free; omitting it
+ * leaves the figure blank and the name carries the caveat.
+ */
+export function toConfigModels(
+  payload: CliModels | null,
+  defaultEffort?: string,
+): Record<string, ConfigModel> {
+  const out: Record<string, ConfigModel> = {};
+  for (const m of payload?.models ?? []) {
+    if (!m?.id) continue;
+    const efforts = m.reasoning_efforts ?? [];
+    const entry: ConfigModel = {
+      name: m.cost ? m.name : `${m.name}${UNPRICED_SUFFIX}`,
+      limit: { context: m.context_window, output: m.max_output_tokens },
+      ...(m.cost ? { cost: m.cost } : {}),
+    };
+    if (m.reasoning) {
+      entry.reasoning = true;
+      const variants: Record<string, { reasoningEffort: string }> = {};
+      for (const e of efforts) variants[e] = { reasoningEffort: e };
+      if (Object.keys(variants).length > 0) entry.variants = variants;
+      if (defaultEffort && efforts.includes(defaultEffort)) {
+        // Seeding at model level makes the effort the default unless a
+        // variant or agent override replaces it.
+        (entry as ConfigModel & { options?: Record<string, unknown> }).options =
+          { reasoningEffort: defaultEffort };
+      }
+    }
+    out[m.id] = entry;
+  }
+  return out;
+}
+
+/**
+ * Accept only TLS gateway origins, plus plain-HTTP loopback for local
+ * gateway development. Keeps a malformed or hostile config from redirecting
+ * model discovery and the credential that goes with it.
+ */
+export function isAllowedGatewayUrl(raw: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.protocol === "https:") return true;
+  const loopback =
+    url.hostname === "localhost" ||
+    url.hostname === "127.0.0.1" ||
+    url.hostname === "::1";
+  return url.protocol === "http:" && loopback;
+}
+
+export default BifrostGateway;