@akagilnc/pi-workflow-roles 0.1.5365 → 0.1.5375

package/src/public-cli/analyst-run.ts

@@ -41,6 +41,8 @@ import type {
 } from "./invocation.ts";
 import { presentControlledFailure, presentStructuralRejection } from "./settlement.ts";
 
+import { errorText } from "../unknown-value.ts";
+
 export type AnalystRunEnv = {
   readonly home: string;
 };
@@ -97,7 +99,7 @@ export async function buildAnalystIssueModeInputFromPublicArgv(
 
 /**
  * Attachment JSON → library AnalystSweepModeInput via the sole schema (#337).
- * No parallel hand shape; rejects missing/extra/wrong-type fields only.
+ * No parallel hand shape; rejects missing or wrong-type fields only.
  */
 export function parseAnalystSweepModeInputFromJsonValue(
   value: unknown,
@@ -141,7 +143,7 @@ export async function buildAnalystSweepModeInputFromAttachmentPaths(
   try {
     text = exactUtf8(bytes, "analyst sweep attachment");
   } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
+    const detail = errorText(error);
     throw new CliUsageError(detail, { cause: error });
   }
 

package/src/public-cli/auto-resume.ts

@@ -42,6 +42,8 @@ import {
 import type { CliIo } from "./cli-io.ts";
 import { serializeThrownValue } from "../serialize-thrown-value.ts";
 
+import { errorText, isEnoent } from "../unknown-value.ts";
+
 const dummyIo: CliIo = { stdout: () => {}, stderr: () => {} };
 
 /**
@@ -132,7 +134,7 @@ export class TurnDispatchedFailure extends Error {
   constructor(cause: unknown) {
     super(
       `settlement failed after the host turn genuinely started: ${
-        cause instanceof Error ? cause.message : String(cause)
+        errorText(cause)
       }`,
       { cause },
     );
@@ -164,7 +166,7 @@ export async function ensureRealArtifactsDirectory(runDirectory: string): Promis
       throw new Error("run artifact retention: artifacts path is not a real directory");
     }
   } catch (error) {
-    if (!isMissingPathError(error)) throw error;
+    if (!isEnoent(error)) throw error;
     await mkdir(artifactsDir, { recursive: true });
     const created = await lstat(artifactsDir);
     if (created.isSymbolicLink() || !created.isDirectory()) {
@@ -174,15 +176,6 @@ export async function ensureRealArtifactsDirectory(runDirectory: string): Promis
   return artifactsDir;
 }
 
-/** ENOENT identity shared with settlement.ts's hardened audit-artifact path. */
-function isMissingPathError(error: unknown): boolean {
-  return (
-    error instanceof Error &&
-    "code" in error &&
-    (error as { code?: unknown }).code === "ENOENT"
-  );
-}
-
 /** Cycle- and bigint-safe JSON replacer so serialization itself cannot drop data. */
 function jsonSafeReplacer(): (key: string, value: unknown) => unknown {
   const seen = new WeakSet<object>();
@@ -210,7 +203,7 @@ function jsonSafeReplacer(): (key: string, value: unknown) => unknown {
  * + O_NOFOLLOW where the platform provides it (a planted symlink is never
  * followed) — mirrors settlement.ts's own hardened artifact writers.
  */
-async function writeHardenedArtifactFile(
+export async function writeHardenedArtifactFile(
   artifactsDir: string,
   namePrefix: string,
   payload: Record<string, unknown>,

package/src/public-cli/cli.ts

@@ -4,7 +4,6 @@ import { piDurablePrincipalAuthority } from "../pi/durable-principal.ts";
  * Public ak-role CLI dispatcher (roles / config / layered help / Judge run).
  */
 import { realpath } from "node:fs/promises";
-import { join } from "node:path";
 
 import { packageMachineHome } from "../activation-ledger-topology.ts";
 import {
@@ -26,13 +25,13 @@ import {
   missingResolvedSeatModelMessage,
   parseModelSpec,
   resolveEffectiveSeat,
-  resolvedSeatWithModel,
   savePublicCliConfig,
   setAutoResumeLimit,
   setPersistentSeatConfig,
   setPersistentSeatEngine,
   setPersistentSeatEngineModel,
   setPersistentSeatHost,
+  resolvePublicAgentDir,
   validatePublicCliConfigAxes,
   type CredentialProviders,
   type EffectiveSeat,
@@ -41,7 +40,6 @@ import {
 } from "./config.ts";
 import {
   loadHostProvidersTable,
-  projectHostFacingProvider,
   renderHostProvidersTable,
 } from "./host-providers.ts";
 import { packagedModelParent } from "../packaged-role-registry.ts";
@@ -54,11 +52,10 @@ import {
   type PostAdmissionEnv,
 } from "./post-admission.ts";
 import { appendPiSessionCustomEntry } from "../pi/role-turn-host.ts";
+import { openRoleSeatRuntime } from "./role-seat-runtime.ts";
 import {
-  composeRoleTurnHostAdapters,
   formatHostSelectionFailure,
   HostSelectionError,
-  selectRoleTurnHost,
   type HostSelectionFailure,
   type NamedRoleTurnHostAdapter,
 } from "./role-turn-host-resolution.ts";
@@ -108,6 +105,8 @@ import {
 } from "./settlement.ts";
 import type { TerminalResult } from "./terminal.ts";
 
+import { errorText } from "../unknown-value.ts";
+
 export {
   buildExplicitInternalActivationArgs,
   resolveInternalRoleEntrypoint,
@@ -240,8 +239,6 @@ export type CliEnv = {
   signal?: AbortSignal;
 };
 
-
-
 type RoleEnvironmentOptions = {
   role: PublicCallableRole;
   home: string;
@@ -258,54 +255,43 @@ function createRoleEnvironment(
   /** #178: after host selection, before missing-model — structural argv parse once. */
   afterHost?: () => void,
 ) {
-  const role = options.role;
   const extraPiArgs = env.extraPiArgs;
   const timeoutMs = env.timeoutMs;
-
-  // #617/#178/#788/#840: host first, then model; nested child seat selects own host.
-  const hostAdapters = composeRoleTurnHostAdapters(
-    {
+  const opened = openRoleSeatRuntime({
+    resolution: {
       packageRoot: env.packageRoot,
       ...(env.roleTurnHost === undefined ? {} : { roleTurnHost: env.roleTurnHost }),
       ...(env.hostAdapters === undefined ? {} : { hostAdapters: env.hostAdapters }),
       ...(extraPiArgs === undefined ? {} : { extraPiArgs }),
       ...(timeoutMs === undefined ? {} : { timeoutMs }),
     },
-    env.principalAuthority!,
-  );
-  const roleTurnHost = selectRoleTurnHost(hostAdapters, {
-    role,
+    principalAuthority: env.principalAuthority!,
+    role: options.role,
     seat: options.seat,
+    home: options.home,
+    ...(afterHost === undefined ? {} : { afterHost }),
   });
-  // #178: host → argv (afterHost) → missing-model → provider projection.
-  afterHost?.();
-  const seatWithModel = resolvedSeatWithModel(options.seat);
-  if (seatWithModel === undefined) {
+  if (!opened.ok) {
     // Direct CLI has --model; dual remediation is intentional here (#178 / #916).
     throw new CliUsageError(
       missingResolvedSeatModelMessage(options.seat.seat, "invocation-or-config"),
     );
   }
-  const hostFacingSelection = projectHostFacingProvider(
-    seatWithModel.selection,
-    seatWithModel.host,
-    loadHostProvidersTable(options.home),
-    options.home,
-  );
   return {
     home: options.home,
     principalAuthority: env.principalAuthority!,
     agentDir: options.agentDir,
     sessionAppender: appendPiSessionCustomEntry,
     packageRoot: env.packageRoot,
-    roleTurnHost,
-    hostAdapters,
+    roleTurnHost: opened.roleTurnHost,
+    hostAdapters: opened.hostAdapters,
     cwd: options.cwd,
     ...(options.credentials === undefined ? {} : { credentials: options.credentials }),
     ...(env.correlationId === undefined ? {} : { correlationId: env.correlationId }),
-    ...(hostFacingSelection === undefined ? {} : { model: hostFacingSelection }),
-    ...projectSeatEngine(options.seat),
-    ...projectSeatHost(options.seat),
+    ...(opened.model === undefined ? {} : { model: opened.model }),
+    ...(opened.engine === undefined ? {} : { engine: opened.engine }),
+    ...(opened.engineModel === undefined ? {} : { engineModel: opened.engineModel }),
+    host: opened.host,
     ...(timeoutMs === undefined ? {} : { timeoutMs }),
     ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
     ...(options.config?.autoResumeLimit === undefined
@@ -319,6 +305,25 @@ function createRoleEnvironment(
   };
 }
 
+type PublicRoleDispatchParts = {
+  readonly agentDir: string;
+  readonly cwd: string;
+  readonly config: PublicCliConfig;
+  readonly credentials: CredentialProviders;
+};
+
+/** Shared preamble for a new public role command and an explicit resume. */
+async function loadPublicRoleDispatchParts(
+  env: CliEnv,
+  home: string,
+): Promise<PublicRoleDispatchParts> {
+  const agentDir = resolvePublicAgentDir(env.agentDir, home);
+  const cwd = env.cwd ?? process.cwd();
+  const config = await loadAndValidateConfig(home, env.packageRoot);
+  const credentials = env.credentials ?? (await loadCredentialProviders(agentDir));
+  return { agentDir, cwd, config, credentials };
+}
+
 /**
  * #178 single spine: resolve seat → host select → argv parse once → missing-model → run.
  * Keeps host-unregistered ahead of bad argv and missing-model.
@@ -336,15 +341,11 @@ async function dispatchPublicRoleCommand<TParsed>(
     parseOnce: () => TParsed,
   ) => Promise<{ exitCode: number; terminal?: TerminalResult }>,
 ): Promise<CliResult> {
-  const agentDir = resolveAgentDir(env, home);
-  const cwd = env.cwd ?? process.cwd();
-  const config = await loadAndValidateConfig(home, env.packageRoot);
-  const credentials =
-    env.credentials ?? (await loadCredentialProviders(agentDir));
+  const parts = await loadPublicRoleDispatchParts(env, home);
   const seat = resolveEffectiveSeat(
-    config,
+    parts.config,
     role,
-    credentials,
+    parts.credentials,
     invocationFromParsed(parsed),
   );
   let parsedRoleArgv!: TParsed;
@@ -352,7 +353,15 @@ async function dispatchPublicRoleCommand<TParsed>(
     parsed.args,
     createRoleEnvironment(
       env,
-      { role, home, agentDir, cwd, credentials, seat, config },
+      {
+        role,
+        home,
+        agentDir: parts.agentDir,
+        cwd: parts.cwd,
+        credentials: parts.credentials,
+        seat,
+        config: parts.config,
+      },
       () => {
         parsedRoleArgv = parse(parsed.args);
       },
@@ -397,14 +406,6 @@ function resolveHome(env: CliEnv): string {
   return env.home ?? packageMachineHome();
 }
 
-function resolveAgentDir(env: CliEnv, home: string): string {
-  return (
-    env.agentDir ??
-    process.env.PI_CODING_AGENT_DIR ??
-    join(home, ".pi", "agent")
-  );
-}
-
 type ParsedGlobal = {
   command?: string;
   args: string[];
@@ -541,7 +542,7 @@ function requireLegalEngineModel(model: string): string {
     return assertLegalEngineModel(model);
   } catch (error) {
     throw new CliUsageError(
-      error instanceof Error ? error.message : String(error),
+      errorText(error),
       { cause: error },
     );
   }
@@ -552,7 +553,7 @@ function requireLegalEngineName(name: string): string {
     return assertLegalEngineName(name);
   } catch (error) {
     throw new CliUsageError(
-      error instanceof Error ? error.message : String(error),
+      errorText(error),
       { cause: error },
     );
   }
@@ -575,20 +576,6 @@ function requireCallableSeat(
   }
 }
 
-/** Single seat engine axis → run-options projection (#391 E2 / #883). */
-function projectSeatEngine(
-  seat: Readonly<{ engine?: string; engineModel?: string }>,
-): { engine?: string; engineModel?: string } {
-  return pickEngineAxis(seat);
-}
-
-/** Single seat.host → run-options projection (#595 / #617). */
-function projectSeatHost(
-  seat: Readonly<{ host: string }>,
-): { host: string } {
-  return { host: seat.host };
-}
-
 function loadAndValidateConfig(
   home: string,
   packageRoot: string,
@@ -598,7 +585,7 @@ function loadAndValidateConfig(
       validatePublicCliConfigAxes(config, packageRoot);
     } catch (error) {
       throw new CliUsageError(
-        error instanceof Error ? error.message : String(error),
+        errorText(error),
         { cause: error },
       );
     }
@@ -930,7 +917,7 @@ async function runConfigCommand(
     try {
       config = setPersistentSeatHost(config, seat, unset ? undefined : args[2]!);
     } catch (error) {
-      throw new CliUsageError(error instanceof Error ? error.message : String(error), { cause: error });
+      throw new CliUsageError(errorText(error), { cause: error });
     }
     await savePublicCliConfig(config, home);
     io.stdout(renderConfig(config, home));
@@ -954,7 +941,7 @@ async function runConfigCommand(
       config = setPersistentSeatEngine(config, seat, name, engineModel);
     } catch (error) {
       throw new CliUsageError(
-        error instanceof Error ? error.message : String(error),
+        errorText(error),
         { cause: error },
       );
     }
@@ -976,7 +963,7 @@ async function runConfigCommand(
       config = setPersistentSeatEngine(config, seat, undefined);
     } catch (error) {
       throw new CliUsageError(
-        error instanceof Error ? error.message : String(error),
+        errorText(error),
         { cause: error },
       );
     }
@@ -1000,7 +987,7 @@ async function runConfigCommand(
       config = setPersistentSeatEngineModel(config, seat, model);
     } catch (error) {
       throw new CliUsageError(
-        error instanceof Error ? error.message : String(error),
+        errorText(error),
         { cause: error },
       );
     }
@@ -1022,7 +1009,7 @@ async function runConfigCommand(
       config = setPersistentSeatEngineModel(config, seat, undefined);
     } catch (error) {
       throw new CliUsageError(
-        error instanceof Error ? error.message : String(error),
+        errorText(error),
         { cause: error },
       );
     }
@@ -1170,7 +1157,7 @@ export async function runAkRole(
       const config = await loadAndValidateConfig(home, env.packageRoot);
       const credentials =
         env.credentials ??
-        (await loadCredentialProviders(resolveAgentDir(env, home)));
+        (await loadCredentialProviders(resolvePublicAgentDir(env.agentDir, home)));
       const seats = effectiveSeatConfigurations(
         config,
         credentials,
@@ -1219,19 +1206,15 @@ export async function runAkRole(
         runId: resumeRequest.runId,
         authority: env.principalAuthority ?? piDurablePrincipalAuthority,
       };
-      const agentDir = resolveAgentDir(env, home);
-      const cwd = env.cwd ?? process.cwd();
-      const config = await loadAndValidateConfig(home, env.packageRoot);
-      const credentials =
-        env.credentials ?? (await loadCredentialProviders(agentDir));
+      const parts = await loadPublicRoleDispatchParts(env, home);
       const resumeRole = await peekRoleRunRole(home, resumeRequest.runId);
       // Missing durable role keeps the judge seat table. The resume entry
       // itself is one function; it reads the stored run.
       const seatRole = resumeRole ?? "judge";
       const seat = resolveEffectiveSeat(
-        config,
+        parts.config,
         seatRole,
-        credentials,
+        parts.credentials,
         invocationFromParsed(parsed),
       );
       const result = await runPublicInstructionSeatResume(
@@ -1239,11 +1222,11 @@ export async function runAkRole(
         createRoleEnvironment(env, {
           role: seatRole,
           home,
-          agentDir,
-          cwd,
-          credentials,
+          agentDir: parts.agentDir,
+          cwd: parts.cwd,
+          credentials: parts.credentials,
           seat,
-          config,
+          config: parts.config,
         }),
         io,
       );
@@ -1261,9 +1244,20 @@ export async function runAkRole(
         };
         const parentRole = await peekRoleRunRole(home, parentRunId);
         if (parentRole === undefined) break;
-        const parentSeat = resolveEffectiveSeat(config, parentRole, credentials, invocationFromParsed(parsed));
+        const parentSeat = resolveEffectiveSeat(
+          parts.config,
+          parentRole,
+          parts.credentials,
+          invocationFromParsed(parsed),
+        );
         const parentEnv = createRoleEnvironment(env, {
-          role: parentRole, home, agentDir, cwd, credentials, seat: parentSeat, config,
+          role: parentRole,
+          home,
+          agentDir: parts.agentDir,
+          cwd: parts.cwd,
+          credentials: parts.credentials,
+          seat: parentSeat,
+          config: parts.config,
         });
         current = await continueParentAfterChild(parentRunId, current.admitted, parentEnv, io);
       }

package/src/public-cli/config.ts

@@ -27,6 +27,7 @@ import {
   type PublicConfigurableSeat,
   type PublicThinkingLevel,
 } from "./registry.ts";
+import { isEnoent, isRecord } from "../unknown-value.ts";
 
 /** Province officers that may carry a persistent model override (#453). Registry order. */
 type ProvinceConfigRole = Extract<
@@ -134,13 +135,7 @@ export async function loadPublicCliConfig(
     const raw = await readFile(path, "utf8");
     return parsePublicCliConfig(JSON.parse(raw));
   } catch (error) {
-    if (
-      error instanceof Error &&
-      "code" in error &&
-      (error as NodeJS.ErrnoException).code === "ENOENT"
-    ) {
-      return { seats: {} };
-    }
+    if (isEnoent(error)) return { seats: {} };
     throw error;
   }
 }
@@ -481,7 +476,7 @@ function serializePublicCliConfig(config: PublicCliConfig): {
 }
 
 function parsePublicCliConfig(value: unknown): PublicCliConfig {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+  if (!isRecord(value)) {
     throw new Error("public CLI config must be an object");
   }
   const record = value as {
@@ -500,11 +495,7 @@ function parsePublicCliConfig(value: unknown): PublicCliConfig {
   // disk-shaped seats map and a memory-shaped bucket both survive.
   const unknownSeats: Record<string, unknown> = {};
   if (record.unknownSeats !== undefined) {
-    if (
-      record.unknownSeats === null ||
-      typeof record.unknownSeats !== "object" ||
-      Array.isArray(record.unknownSeats)
-    ) {
+    if (!isRecord(record.unknownSeats)) {
       throw new Error("public CLI config.unknownSeats must be an object");
     }
     Object.assign(unknownSeats, record.unknownSeats as Record<string, unknown>);
@@ -517,11 +508,7 @@ function parsePublicCliConfig(value: unknown): PublicCliConfig {
   if (record.seats === undefined) {
     return withOpaque({});
   }
-  if (
-    record.seats === null ||
-    typeof record.seats !== "object" ||
-    Array.isArray(record.seats)
-  ) {
+  if (!isRecord(record.seats)) {
     throw new Error("public CLI config.seats must be an object");
   }
   const seats: PublicCliConfig["seats"] = {};
@@ -542,7 +529,7 @@ function parsePublicCliConfig(value: unknown): PublicCliConfig {
 }
 
 function parseSeatModelConfig(value: unknown, seat: string): PersistentSeatConfig {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+  if (!isRecord(value)) {
     throw new Error(`config seat ${seat} must be an object`);
   }
   const raw = value as Record<string, unknown>;
@@ -825,7 +812,7 @@ export function listRolesForDisplay(
 export function credentialProvidersFromAuthData(
   data: unknown,
 ): CredentialProviders {
-  if (data === null || typeof data !== "object" || Array.isArray(data)) {
+  if (!isRecord(data)) {
     return { "openai-codex": false, xai: false };
   }
   const record = data as Record<string, unknown>;
@@ -835,6 +822,14 @@ export function credentialProvidersFromAuthData(
   };
 }
 
+/**
+ * Public entry agent directory: explicit value, else PI_CODING_AGENT_DIR,
+ * else `<home>/.pi/agent`. CLI and nested summons share this rule.
+ */
+export function resolvePublicAgentDir(explicit: string | undefined, home: string): string {
+  return explicit ?? process.env.PI_CODING_AGENT_DIR ?? join(home, ".pi", "agent");
+}
+
 export async function loadCredentialProviders(
   agentDir: string,
 ): Promise<CredentialProviders> {
@@ -842,13 +837,7 @@ export async function loadCredentialProviders(
     const raw = await readFile(join(agentDir, "auth.json"), "utf8");
     return credentialProvidersFromAuthData(JSON.parse(raw));
   } catch (error) {
-    if (
-      error instanceof Error &&
-      "code" in error &&
-      (error as NodeJS.ErrnoException).code === "ENOENT"
-    ) {
-      return { "openai-codex": false, xai: false };
-    }
+    if (isEnoent(error)) return { "openai-codex": false, xai: false };
     throw error;
   }
 }

package/src/public-cli/countersign-run.ts

@@ -9,6 +9,8 @@ import type { PostAdmissionEnv } from "./post-admission.ts";
 import type { CliIo } from "./cli-io.ts";
 import type { TerminalRoleOutcome } from "./terminal.ts";
 
+import { isRecord } from "../unknown-value.ts";
+
 export type CountersignRunEnv = PostAdmissionEnv & {
   principalAuthority: DurablePrincipalAuthority;
   createRunId?: () => string;
@@ -51,10 +53,6 @@ export type CourtDiaristInvocationResult = {
   readonly failedWithoutEscalate?: { readonly diagnostic: string };
 };
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 function isEscalatePayload(payload: unknown): boolean {
   if (!isRecord(payload)) return false;
   return (

package/src/public-cli/host-providers.ts

@@ -12,6 +12,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import type { SeatModelConfig } from "./config.ts";
+import { isEnoent, isRecord } from "../unknown-value.ts";
 
 /** host → seat-provider → host-facing provider. */
 export type HostProvidersTable = Readonly<
@@ -31,25 +32,19 @@ export function hermesProviderModelsCachePath(home: string): string {
 }
 
 export function parseHostProvidersTable(value: unknown): HostProvidersTable {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+  if (!isRecord(value)) {
     throw new Error("host-providers.json must be an object");
   }
   const out: Record<string, Record<string, string>> = {};
-  for (const [host, byProvider] of Object.entries(value as Record<string, unknown>)) {
+  for (const [host, byProvider] of Object.entries(value)) {
     if (host.trim() === "") {
       throw new Error("host-providers.json host key must be non-empty");
     }
-    if (
-      byProvider === null ||
-      typeof byProvider !== "object" ||
-      Array.isArray(byProvider)
-    ) {
+    if (!isRecord(byProvider)) {
       throw new Error(`host-providers.json[${host}] must be an object`);
     }
     const providers: Record<string, string> = {};
-    for (const [seatProvider, hostProvider] of Object.entries(
-      byProvider as Record<string, unknown>,
-    )) {
+    for (const [seatProvider, hostProvider] of Object.entries(byProvider)) {
       if (seatProvider.trim() === "") {
         throw new Error(
           `host-providers.json[${host}] seat-provider key must be non-empty`,
@@ -79,13 +74,7 @@ export function loadHostProvidersTable(home: string): HostProvidersTable {
     const raw = readFileSync(path, "utf8");
     return parseHostProvidersTable(JSON.parse(raw) as unknown);
   } catch (error) {
-    if (
-      error instanceof Error &&
-      "code" in error &&
-      (error as NodeJS.ErrnoException).code === "ENOENT"
-    ) {
-      return {};
-    }
+    if (isEnoent(error)) return {};
     throw error;
   }
 }
@@ -115,24 +104,18 @@ export function listHermesProvidersForModel(
   try {
     text = readFileSync(path, "utf8");
   } catch (error) {
-    if (
-      error instanceof Error &&
-      "code" in error &&
-      (error as NodeJS.ErrnoException).code === "ENOENT"
-    ) {
-      return [];
-    }
+    if (isEnoent(error)) return [];
     throw error;
   }
   const raw: unknown = JSON.parse(text);
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+  if (!isRecord(raw)) {
     throw new Error(
       `hermes provider_models_cache.json must be an object: ${path}`,
     );
   }
   const found: string[] = [];
-  for (const [provider, entry] of Object.entries(raw as Record<string, unknown>)) {
-    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+  for (const [provider, entry] of Object.entries(raw)) {
+    if (!isRecord(entry)) {
       continue;
     }
     const models = (entry as { models?: unknown }).models;