@connexum/ai-governance 1.0.0-beta.11

package/dist/llm-adapters/gemma.d.ts

@@ -0,0 +1,200 @@
+/**
+ * Standalone Gemma adapter (F-NEW-GEMMA-ADAPTER, Tier 4.5).
+ *
+ * Gemma is Google's open-weight family. Unlike Gemini (proprietary, Google-
+ * hosted only), Gemma can be served from multiple deployment targets:
+ *
+ *   - `vertex-ai`           — Google Cloud Vertex AI Model Garden. Inherits
+ *                             Vertex BAA. Same auth as Gemini-on-Vertex.
+ *   - `generative-language` — Google AI Studio public endpoint. NO BAA.
+ *   - `huggingface`         — HuggingFace Inference API. Open-weight pull.
+ *                             BAA only if customer holds one with HF.
+ *   - `self-hosted-ollama`  — Customer-owned host (Ollama, vLLM, TGI, etc.).
+ *                             BAA is moot (customer owns the runtime).
+ *
+ * This adapter is a thin facade. It centralises the open-weight provenance
+ * fact + the deployment-target-aware BAA flag + the model-ID registry so
+ * the capability bundle + audit chain entry + dashboard surface all read
+ * Gemma usage from one source of truth instead of inferring it from
+ * `getGoogleModelFamily()` in twelve places.
+ *
+ * Wiring downstream:
+ *   - `vertex-ai` + `generative-language` requests delegate to
+ *     `src/llm-adapters/google.ts` (the Google adapter knows both targets).
+ *   - `huggingface` delegates to `src/llm-adapters/huggingface.ts`.
+ *   - `self-hosted-ollama` delegates to `src/llm-adapters/ollama.ts`.
+ *   The downstream wiring is the customer's existing adapter call —
+ *   `gemma.ts` itself does NOT make HTTP. It is metadata + validation.
+ *
+ * @connexum/ai-governance
+ */
+export type GemmaDeploymentTarget = 'vertex-ai' | 'generative-language' | 'huggingface' | 'self-hosted-ollama';
+export interface GemmaMetadata {
+    /** Always `'gemma'` — kept for shape-parity with other adapter metadata. */
+    family: 'gemma';
+    /** Always `true` for Gemma. Auditors care that the model is open-weight. */
+    isOpenWeight: true;
+    /**
+     * Whether the deployment target's BAA covers Gemma usage:
+     *   - vertex-ai            → true (Vertex BAA covers Model Garden models)
+     *   - generative-language  → false (Google AI Studio has no BAA)
+     *   - huggingface          → false (BAA is a separate HF contract)
+     *   - self-hosted-ollama   → false (BAA is customer-side; we cannot assert)
+     * If the customer holds a BAA with the host directly, they set the
+     * `baaOverride: true` flag on their capability-bundle entry — that path
+     * is NOT in this metadata function.
+     */
+    baaInherits: boolean;
+    /**
+     * Audit-chain display name combining modelId + deployment target so two
+     * audit entries for `gemma-2-9b-it` served from Vertex and HuggingFace
+     * are distinguishable in compliance reports.
+     */
+    displayName: string;
+    /** Echo of the input deployment target so consumers can pass-through. */
+    deploymentTarget: GemmaDeploymentTarget;
+    /**
+     * F-NEW-GEMMA-FINETUNE 2026-05-13: present when the customer is invoking
+     * a custom-finetuned Gemma variant. Adapter does NOT run finetuning; this
+     * struct records the customer-supplied provenance so the audit chain,
+     * capability bundle, and BAA enforcement all see one source of truth for
+     * "what was actually called". Absent for base-model calls.
+     */
+    finetune?: GemmaFinetuneProvenance;
+}
+/**
+ * F-NEW-GEMMA-FINETUNE 2026-05-13.
+ *
+ * Provenance bundle for a customer-finetuned Gemma model. We recognise
+ * three common finetune model-ID conventions in the wild:
+ *
+ *   1. HuggingFace org-namespaced:     `acme-health/gemma-2-9b-it-ft`
+ *   2. Vertex AI custom-suffix:        `gemma-2-9b-it@acme-2026-04-12`
+ *   3. Self-hosted custom slug:        `gemma-2-9b-it-customer-xyz`
+ *
+ * The adapter validates the SHAPE (must derive from a known base) but the
+ * customer attests the rest: training-data hash, finetune timestamp, host.
+ * `datasetHash` and `finetunedAt` are RECOMMENDED but optional — for
+ * SOC 2 / HIPAA workloads they're effectively required and the pack
+ * validators surface a HIGH severity when absent.
+ */
+export interface GemmaFinetuneProvenance {
+    /** Base Gemma model the finetune was derived from. Must validate. */
+    baseModelId: string;
+    /**
+     * Customer-supplied stable identifier for this finetune run. Used as
+     * the audit-chain join key when the same finetune is invoked from
+     * multiple SDK callsites or replays across testbed/prod.
+     */
+    finetuneId: string;
+    /**
+     * Where the finetuned weights live. Same enum as the base-model
+     * deployment target; finetune-on-Vertex-served-via-HuggingFace is
+     * disallowed because the BAA story collapses.
+     */
+    finetuneHost: GemmaDeploymentTarget;
+    /**
+     * Optional but recommended. SHA-256 of the training-dataset manifest
+     * (file list + per-file hashes). Surfaces in compliance reports as
+     * "training data provenance" — auditors can correlate against the
+     * customer's dataset retention pipeline.
+     */
+    datasetHash?: string;
+    /** ISO-8601 timestamp the finetune completed. */
+    finetunedAt?: string;
+    /**
+     * Whether the customer holds an executed BAA with the finetune host
+     * separate from the base-model deployment-target BAA story. When set,
+     * `baaInherits` on the parent metadata is OR'd with this flag.
+     */
+    baaOverride?: boolean;
+}
+/**
+ * Frozen re-export of the Gemma model IDs the platform recognises out of
+ * the box. The list lives in `google.ts` because that's where the actual
+ * Vertex / Generative-Language wire-handling sits. Re-exposed here so
+ * customers / dashboards / catalog endpoints only need to depend on
+ * `@connexum/ai-governance/adapters/gemma`, not the Google adapter.
+ */
+export declare const KNOWN_GEMMA_MODEL_IDS: readonly string[];
+/**
+ * Returns true if `modelId` is a recognised Gemma model ID. Recognition is
+ * either (a) exact match against `KNOWN_GEMMA_MODEL_IDS`, or (b) lowercase
+ * `gemma-` / `paligemma-` prefix. Future Gemma 3 / 4 IDs validate via the
+ * prefix path without requiring this file to change every release.
+ *
+ * Case-sensitive — "Gemma-2-9b-it" with a capital G is rejected. Defends
+ * against typo / copy-paste from marketing material that uses Title Case.
+ */
+export declare function validateGemmaModelId(modelId: string): boolean;
+/**
+ * Produce the metadata bundle for a Gemma call. Throws on unknown
+ * deployment target so a typo at the call site fails loudly instead of
+ * silently fabricating a BAA flag.
+ */
+export declare function getGemmaMetadata(modelId: string, deploymentTarget: GemmaDeploymentTarget): GemmaMetadata;
+/**
+ * Returns true if the model is multimodal (image+text in). Passthrough to
+ * `google.ts isGemmaMultimodal()` to keep one source of truth. Returns
+ * false for non-Gemma IDs.
+ */
+export declare function isGemmaMultimodal(modelId: string): boolean;
+/**
+ * Returns 'gemma' if the modelId belongs to the Gemma family per the
+ * shared Google adapter classifier, or null otherwise. Useful when a
+ * caller has an arbitrary modelId and wants to route to the standalone
+ * Gemma adapter only on a definite match.
+ */
+export declare function gemmaSubfamilyOf(modelId: string): 'gemma' | null;
+/**
+ * Validate a `GemmaFinetuneProvenance` payload. Returns `null` on success
+ * or a string error message describing the first problem. Validates:
+ *
+ *   - `baseModelId` is a recognised Gemma model ID per validateGemmaModelId
+ *   - `finetuneId` matches FINETUNE_ID_PATTERN (3-128 alphanumeric/._-)
+ *   - `finetuneHost` is an allowed deployment target
+ *   - `datasetHash` (when supplied) is a hex SHA-256 (64 chars)
+ *   - `finetunedAt` (when supplied) parses to a Date
+ *   - `baaOverride` is boolean when present
+ *
+ * Customers SHOULD supply `datasetHash` + `finetunedAt`; absence is
+ * surfaced by the pack validators downstream (HIGH severity), not here.
+ */
+export declare function validateGemmaFinetuneProvenance(p: GemmaFinetuneProvenance): string | null;
+/**
+ * Construct the metadata bundle for a finetuned Gemma call. The
+ * `effectiveModelId` is what the customer's runtime ACTUALLY invokes
+ * (could be a custom slug like `acme-health/gemma-2-9b-it-ft`); the
+ * `provenance.baseModelId` is the underlying recognised Gemma the
+ * finetune derived from.
+ *
+ * BAA semantics: the base-model deployment target sets `baaInherits`;
+ * the finetune host independently sets `provenance.baaOverride`. The
+ * returned metadata's `baaInherits` is the OR of both — auditors care
+ * about coverage, not which leg of the deployment provided it.
+ *
+ * Throws on invalid provenance via validateGemmaFinetuneProvenance —
+ * adapter callers MUST handle this (do not silently fabricate finetune
+ * metadata, which would let an unprovenanced finetune slip into the
+ * audit chain tagged as "compliant").
+ */
+export declare function getGemmaFinetuneMetadata(effectiveModelId: string, baseDeploymentTarget: GemmaDeploymentTarget, provenance: GemmaFinetuneProvenance): GemmaMetadata;
+/**
+ * Heuristic detector — returns true when `modelId` looks like a Gemma
+ * finetune (i.e. carries a customer suffix or org namespace beyond the
+ * base model ID). Used by callers that want to route a request to the
+ * finetune-aware path without needing the customer to flag it explicitly.
+ *
+ * Rules:
+ *   - HuggingFace `<org>/<base>-<anything>` where <base> validates
+ *   - Vertex `<base>@<custom>` per Vertex finetune-suffix convention
+ *   - Self-hosted `<base>-<3+chars>` where the trailing slug is NOT in
+ *     the recognised KNOWN_GEMMA_MODEL_IDS list (excludes things like
+ *     `gemma-2-9b` → `gemma-2-9b-it` which are base variants, not
+ *     finetunes).
+ *
+ * Returns false on non-Gemma inputs, on bare base-model IDs, and on
+ * anything outside the three recognised conventions.
+ */
+export declare function isGemmaFinetuneIdShape(modelId: string): boolean;
+//# sourceMappingURL=gemma.d.ts.map

package/dist/llm-adapters/gemma.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemma.d.ts","sourceRoot":"","sources":["../../src/llm-adapters/gemma.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAYH,MAAM,MAAM,qBAAqB,GAC7B,WAAW,GACX,qBAAqB,GACrB,aAAa,GACb,oBAAoB,CAAC;AAEzB,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,YAAY,EAAE,IAAI,CAAC;IACnB;;;;;;;;;OASG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,gBAAgB,EAAE,qBAAqB,CAAC;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,qBAAqB,CAAC;IACpC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAElD,CAAC;AAaF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAU7D;AAMD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,qBAAqB,GACtC,aAAa,CA8Bf;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK1D;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAEhE;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,CAAC,EAAE,uBAAuB,GACzB,MAAM,GAAG,IAAI,CAyBf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,gBAAgB,EAAE,MAAM,EACxB,oBAAoB,EAAE,qBAAqB,EAC3C,UAAU,EAAE,uBAAuB,GAClC,aAAa,CAkBf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAqB/D"}

package/dist/llm-adapters/gemma.js

@@ -0,0 +1,270 @@
+"use strict";
+/**
+ * Standalone Gemma adapter (F-NEW-GEMMA-ADAPTER, Tier 4.5).
+ *
+ * Gemma is Google's open-weight family. Unlike Gemini (proprietary, Google-
+ * hosted only), Gemma can be served from multiple deployment targets:
+ *
+ *   - `vertex-ai`           — Google Cloud Vertex AI Model Garden. Inherits
+ *                             Vertex BAA. Same auth as Gemini-on-Vertex.
+ *   - `generative-language` — Google AI Studio public endpoint. NO BAA.
+ *   - `huggingface`         — HuggingFace Inference API. Open-weight pull.
+ *                             BAA only if customer holds one with HF.
+ *   - `self-hosted-ollama`  — Customer-owned host (Ollama, vLLM, TGI, etc.).
+ *                             BAA is moot (customer owns the runtime).
+ *
+ * This adapter is a thin facade. It centralises the open-weight provenance
+ * fact + the deployment-target-aware BAA flag + the model-ID registry so
+ * the capability bundle + audit chain entry + dashboard surface all read
+ * Gemma usage from one source of truth instead of inferring it from
+ * `getGoogleModelFamily()` in twelve places.
+ *
+ * Wiring downstream:
+ *   - `vertex-ai` + `generative-language` requests delegate to
+ *     `src/llm-adapters/google.ts` (the Google adapter knows both targets).
+ *   - `huggingface` delegates to `src/llm-adapters/huggingface.ts`.
+ *   - `self-hosted-ollama` delegates to `src/llm-adapters/ollama.ts`.
+ *   The downstream wiring is the customer's existing adapter call —
+ *   `gemma.ts` itself does NOT make HTTP. It is metadata + validation.
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KNOWN_GEMMA_MODEL_IDS = void 0;
+exports.validateGemmaModelId = validateGemmaModelId;
+exports.getGemmaMetadata = getGemmaMetadata;
+exports.isGemmaMultimodal = isGemmaMultimodal;
+exports.gemmaSubfamilyOf = gemmaSubfamilyOf;
+exports.validateGemmaFinetuneProvenance = validateGemmaFinetuneProvenance;
+exports.getGemmaFinetuneMetadata = getGemmaFinetuneMetadata;
+exports.isGemmaFinetuneIdShape = isGemmaFinetuneIdShape;
+const google_1 = require("./google");
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/**
+ * Frozen re-export of the Gemma model IDs the platform recognises out of
+ * the box. The list lives in `google.ts` because that's where the actual
+ * Vertex / Generative-Language wire-handling sits. Re-exposed here so
+ * customers / dashboards / catalog endpoints only need to depend on
+ * `@connexum/ai-governance/adapters/gemma`, not the Google adapter.
+ */
+exports.KNOWN_GEMMA_MODEL_IDS = Object.freeze([...google_1.KNOWN_GEMMA_MODEL_IDS]);
+const ALLOWED_DEPLOYMENT_TARGETS = Object.freeze([
+    'vertex-ai',
+    'generative-language',
+    'huggingface',
+    'self-hosted-ollama',
+]);
+// ---------------------------------------------------------------------------
+// Validation
+// ---------------------------------------------------------------------------
+/**
+ * Returns true if `modelId` is a recognised Gemma model ID. Recognition is
+ * either (a) exact match against `KNOWN_GEMMA_MODEL_IDS`, or (b) lowercase
+ * `gemma-` / `paligemma-` prefix. Future Gemma 3 / 4 IDs validate via the
+ * prefix path without requiring this file to change every release.
+ *
+ * Case-sensitive — "Gemma-2-9b-it" with a capital G is rejected. Defends
+ * against typo / copy-paste from marketing material that uses Title Case.
+ */
+function validateGemmaModelId(modelId) {
+    if (typeof modelId !== 'string' || modelId.length === 0)
+        return false;
+    if (exports.KNOWN_GEMMA_MODEL_IDS.includes(modelId))
+        return true;
+    // Reuse Google adapter's lexical family detection — same prefix rules.
+    // Case-sensitive: getGoogleModelFamily lower-cases internally but we
+    // want strict matching here, so we check the prefix directly.
+    if (modelId.startsWith('gemma-') || modelId.startsWith('paligemma-')) {
+        return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Metadata
+// ---------------------------------------------------------------------------
+/**
+ * Produce the metadata bundle for a Gemma call. Throws on unknown
+ * deployment target so a typo at the call site fails loudly instead of
+ * silently fabricating a BAA flag.
+ */
+function getGemmaMetadata(modelId, deploymentTarget) {
+    if (!ALLOWED_DEPLOYMENT_TARGETS.includes(deploymentTarget)) {
+        throw new Error(`Unknown Gemma deployment target: ${JSON.stringify(deploymentTarget)}. ` +
+            `Expected one of: ${ALLOWED_DEPLOYMENT_TARGETS.join(', ')}.`);
+    }
+    // BAA inheritance: only Vertex AI carries an inherited BAA today. The
+    // other three either have no BAA (generative-language) or place the
+    // burden on the customer (huggingface, self-hosted-ollama).
+    const baaInherits = deploymentTarget === 'vertex-ai';
+    // displayName must carry BOTH modelId AND deployment target so audit
+    // consumers can distinguish the same model served by different hosters.
+    const targetLabel = {
+        'vertex-ai': 'Vertex AI',
+        'generative-language': 'Google AI Studio',
+        'huggingface': 'HuggingFace Inference',
+        'self-hosted-ollama': 'Self-hosted (Ollama)',
+    };
+    const displayName = `Google Gemma (open-weight): ${modelId} via ${targetLabel[deploymentTarget]}`;
+    return {
+        family: 'gemma',
+        isOpenWeight: true,
+        baaInherits,
+        displayName,
+        deploymentTarget,
+    };
+}
+// ---------------------------------------------------------------------------
+// Multimodal detection (passthrough)
+// ---------------------------------------------------------------------------
+/**
+ * Returns true if the model is multimodal (image+text in). Passthrough to
+ * `google.ts isGemmaMultimodal()` to keep one source of truth. Returns
+ * false for non-Gemma IDs.
+ */
+function isGemmaMultimodal(modelId) {
+    if (!validateGemmaModelId(modelId))
+        return false;
+    // For non-recognised-prefix IDs the Google helper will still answer
+    // false, so we don't need to short-circuit further.
+    return (0, google_1.isGemmaMultimodal)(modelId);
+}
+// ---------------------------------------------------------------------------
+// Family sanity check (compile-time helper for downstream wiring)
+// ---------------------------------------------------------------------------
+/**
+ * Returns 'gemma' if the modelId belongs to the Gemma family per the
+ * shared Google adapter classifier, or null otherwise. Useful when a
+ * caller has an arbitrary modelId and wants to route to the standalone
+ * Gemma adapter only on a definite match.
+ */
+function gemmaSubfamilyOf(modelId) {
+    return (0, google_1.getGoogleModelFamily)(modelId) === 'gemma' ? 'gemma' : null;
+}
+// ---------------------------------------------------------------------------
+// F-NEW-GEMMA-FINETUNE 2026-05-13
+// Customer-finetuned Gemma support.
+// ---------------------------------------------------------------------------
+const FINETUNE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{2,127}$/;
+/**
+ * Validate a `GemmaFinetuneProvenance` payload. Returns `null` on success
+ * or a string error message describing the first problem. Validates:
+ *
+ *   - `baseModelId` is a recognised Gemma model ID per validateGemmaModelId
+ *   - `finetuneId` matches FINETUNE_ID_PATTERN (3-128 alphanumeric/._-)
+ *   - `finetuneHost` is an allowed deployment target
+ *   - `datasetHash` (when supplied) is a hex SHA-256 (64 chars)
+ *   - `finetunedAt` (when supplied) parses to a Date
+ *   - `baaOverride` is boolean when present
+ *
+ * Customers SHOULD supply `datasetHash` + `finetunedAt`; absence is
+ * surfaced by the pack validators downstream (HIGH severity), not here.
+ */
+function validateGemmaFinetuneProvenance(p) {
+    if (!p || typeof p !== 'object')
+        return 'finetune provenance must be an object';
+    if (!validateGemmaModelId(p.baseModelId)) {
+        return `baseModelId is not a recognised Gemma model: ${JSON.stringify(p.baseModelId)}`;
+    }
+    if (typeof p.finetuneId !== 'string' || !FINETUNE_ID_PATTERN.test(p.finetuneId)) {
+        return `finetuneId must match ${FINETUNE_ID_PATTERN.source} (got ${JSON.stringify(p.finetuneId)})`;
+    }
+    if (!ALLOWED_DEPLOYMENT_TARGETS.includes(p.finetuneHost)) {
+        return `finetuneHost must be one of: ${ALLOWED_DEPLOYMENT_TARGETS.join(', ')} (got ${JSON.stringify(p.finetuneHost)})`;
+    }
+    if (p.datasetHash !== undefined) {
+        if (typeof p.datasetHash !== 'string' || !/^[0-9a-fA-F]{64}$/.test(p.datasetHash)) {
+            return `datasetHash must be a 64-char hex SHA-256 (got length ${p.datasetHash?.length ?? 0})`;
+        }
+    }
+    if (p.finetunedAt !== undefined) {
+        if (typeof p.finetunedAt !== 'string' || Number.isNaN(Date.parse(p.finetunedAt))) {
+            return `finetunedAt must be a parseable ISO-8601 timestamp (got ${JSON.stringify(p.finetunedAt)})`;
+        }
+    }
+    if (p.baaOverride !== undefined && typeof p.baaOverride !== 'boolean') {
+        return `baaOverride must be boolean when present`;
+    }
+    return null;
+}
+/**
+ * Construct the metadata bundle for a finetuned Gemma call. The
+ * `effectiveModelId` is what the customer's runtime ACTUALLY invokes
+ * (could be a custom slug like `acme-health/gemma-2-9b-it-ft`); the
+ * `provenance.baseModelId` is the underlying recognised Gemma the
+ * finetune derived from.
+ *
+ * BAA semantics: the base-model deployment target sets `baaInherits`;
+ * the finetune host independently sets `provenance.baaOverride`. The
+ * returned metadata's `baaInherits` is the OR of both — auditors care
+ * about coverage, not which leg of the deployment provided it.
+ *
+ * Throws on invalid provenance via validateGemmaFinetuneProvenance —
+ * adapter callers MUST handle this (do not silently fabricate finetune
+ * metadata, which would let an unprovenanced finetune slip into the
+ * audit chain tagged as "compliant").
+ */
+function getGemmaFinetuneMetadata(effectiveModelId, baseDeploymentTarget, provenance) {
+    const err = validateGemmaFinetuneProvenance(provenance);
+    if (err) {
+        throw new Error(`Invalid Gemma finetune provenance: ${err}`);
+    }
+    // Build the base metadata first, then graft the finetune block on top.
+    // The base call validates baseDeploymentTarget for us.
+    const base = getGemmaMetadata(provenance.baseModelId, baseDeploymentTarget);
+    const baaInherits = base.baaInherits || provenance.baaOverride === true;
+    const finetunedSuffix = provenance.datasetHash
+        ? ` (finetune ${provenance.finetuneId}, dataset ${provenance.datasetHash.slice(0, 8)}…)`
+        : ` (finetune ${provenance.finetuneId})`;
+    return {
+        ...base,
+        baaInherits,
+        displayName: `${base.displayName}${finetunedSuffix}`,
+        finetune: provenance,
+    };
+}
+/**
+ * Heuristic detector — returns true when `modelId` looks like a Gemma
+ * finetune (i.e. carries a customer suffix or org namespace beyond the
+ * base model ID). Used by callers that want to route a request to the
+ * finetune-aware path without needing the customer to flag it explicitly.
+ *
+ * Rules:
+ *   - HuggingFace `<org>/<base>-<anything>` where <base> validates
+ *   - Vertex `<base>@<custom>` per Vertex finetune-suffix convention
+ *   - Self-hosted `<base>-<3+chars>` where the trailing slug is NOT in
+ *     the recognised KNOWN_GEMMA_MODEL_IDS list (excludes things like
+ *     `gemma-2-9b` → `gemma-2-9b-it` which are base variants, not
+ *     finetunes).
+ *
+ * Returns false on non-Gemma inputs, on bare base-model IDs, and on
+ * anything outside the three recognised conventions.
+ */
+function isGemmaFinetuneIdShape(modelId) {
+    if (typeof modelId !== 'string' || modelId.length === 0)
+        return false;
+    // HuggingFace org-namespaced shape: <org>/<rest> where <rest> looks
+    // like a Gemma model (prefix match) but is NOT the bare known base.
+    // E.g. acme/gemma-2-9b-it-ft is a finetune; google/gemma-2-9b-it is
+    // just the base model on HF (still false here — bare base).
+    if (modelId.includes('/')) {
+        const tail = modelId.split('/').slice(-1)[0];
+        if (exports.KNOWN_GEMMA_MODEL_IDS.includes(tail))
+            return false;
+        return /^(gemma|paligemma)-/i.test(tail);
+    }
+    // Vertex custom-suffix shape: <base>@<custom>
+    if (modelId.includes('@')) {
+        const base = modelId.split('@')[0];
+        return validateGemmaModelId(base);
+    }
+    // Self-hosted slug shape: <base>-<suffix not in KNOWN list>
+    if (exports.KNOWN_GEMMA_MODEL_IDS.includes(modelId))
+        return false;
+    if (!(modelId.startsWith('gemma-') || modelId.startsWith('paligemma-')))
+        return false;
+    // Otherwise: it has the prefix but isn't in the known list — assume finetune.
+    return true;
+}
+//# sourceMappingURL=gemma.js.map

package/dist/llm-adapters/gemma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemma.js","sourceRoot":"","sources":["../../src/llm-adapters/gemma.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;AAuIH,oDAUC;AAWD,4CAiCC;AAWD,8CAKC;AAYD,4CAEC;AAuBD,0EA2BC;AAmBD,4DAsBC;AAmBD,wDAqBC;AA5VD,qCAIkB;AA8FlB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;GAMG;AACU,QAAA,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CACnE,CAAC,GAAG,8BAA4B,CAAC,CAClC,CAAC;AAEF,MAAM,0BAA0B,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,oBAAoB;CACrB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAAC,OAAe;IAClD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,6BAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,uEAAuE;IACvE,qEAAqE;IACrE,8DAA8D;IAC9D,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;GAIG;AACH,SAAgB,gBAAgB,CAC9B,OAAe,EACf,gBAAuC;IAEvC,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI;YACxE,oBAAoB,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7D,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,4DAA4D;IAC5D,MAAM,WAAW,GAAG,gBAAgB,KAAK,WAAW,CAAC;IAErD,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,WAAW,GAA0C;QACzD,WAAW,EAAE,WAAW;QACxB,qBAAqB,EAAE,kBAAkB;QACzC,aAAa,EAAE,uBAAuB;QACtC,oBAAoB,EAAE,sBAAsB;KAC7C,CAAC;IACF,MAAM,WAAW,GAAG,+BAA+B,OAAO,QAAQ,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;IAElG,OAAO;QACL,MAAM,EAAE,OAAO;QACf,YAAY,EAAE,IAAI;QAClB,WAAW;QACX,WAAW;QACX,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,oEAAoE;IACpE,oDAAoD;IACpD,OAAO,IAAA,0BAAuB,EAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAA,6BAAoB,EAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,SAAgB,+BAA+B,CAC7C,CAA0B;IAE1B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,uCAAuC,CAAC;IAChF,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,OAAO,gDAAgD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAChF,OAAO,yBAAyB,mBAAmB,CAAC,MAAM,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,OAAO,gCAAgC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,OAAO,yDAAyD,CAAC,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC;QAChG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,2DAA2D,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;QACrG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,wBAAwB,CACtC,gBAAwB,EACxB,oBAA2C,EAC3C,UAAmC;IAEnC,MAAM,GAAG,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC;IACxE,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW;QAC5C,CAAC,CAAC,cAAc,UAAU,CAAC,UAAU,aAAa,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;QACxF,CAAC,CAAC,cAAc,UAAU,CAAC,UAAU,GAAG,CAAC;IAC3C,OAAO;QACL,GAAG,IAAI;QACP,WAAW;QACX,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,eAAe,EAAE;QACpD,QAAQ,EAAE,UAAU;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,sBAAsB,CAAC,OAAe;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,6BAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,8CAA8C;IAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,4DAA4D;IAC5D,IAAI,6BAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,8EAA8E;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC"}