@wrenai/genbi 0.0.4 → 0.0.5

package/dist-server/harness/providers/adapters/pi-ai.js

@@ -0,0 +1,518 @@
+export const PI_AI_ADAPTER_ID = "pi-ai";
+const PI_AI_PACKAGE = "@earendil-works/pi-ai";
+const METADATA_KEY = "pi-ai";
+let runtime;
+/**
+ * Loads pi-ai on first use. It is an optional dependency (it needs Node
+ * >= 22.19 and pulls several vendor SDKs), so nothing imports it until a
+ * gateway-bound model is actually called.
+ */
+function loadPiAi() {
+    runtime ??= Promise.all([
+        import("@earendil-works/pi-ai"),
+        import("@earendil-works/pi-ai/providers/all"),
+        import("@earendil-works/pi-ai/api/openai-completions.lazy"),
+    ]).then(([core, builtins, completions]) => ({ core, builtins, completions }), (error) => {
+        runtime = undefined;
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`The pi-ai adapter (gateway mode) needs the optional dependency ${PI_AI_PACKAGE}, which could not be loaded: ${reason}. ` +
+            `Install it alongside this package on Node.js >= 22.19, or choose a different runtime mode.`);
+    });
+    return runtime;
+}
+// No environment variables and no files: credentials only ever arrive as the
+// per-request `apiKey`.
+const SEALED_AUTH_CONTEXT = {
+    env: async () => undefined,
+    fileExists: async () => false,
+};
+/** An API-key auth that only accepts the key passed with the request. */
+function explicitKeyAuth(name) {
+    return {
+        name,
+        resolve: async ({ credential }) => ({ auth: credential?.key ? { apiKey: credential.key } : {} }),
+    };
+}
+const ZERO_COST = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+async function resolveTarget(config) {
+    const { core, builtins, completions } = await loadPiAi();
+    // An empty in-memory credential store: nothing stored, so pi-ai never
+    // resolves a stored or OAuth credential.
+    const models = core.createModels({ credentials: new core.InMemoryCredentialStore(), authContext: SEALED_AUTH_CONTEXT });
+    if (config.baseUrl !== undefined) {
+        const model = {
+            id: config.model,
+            name: config.model,
+            api: "openai-completions",
+            provider: config.provider,
+            baseUrl: config.baseUrl,
+            reasoning: false,
+            input: ["text", "image"],
+            cost: ZERO_COST,
+            contextWindow: 128_000,
+            maxTokens: 16_384,
+        };
+        models.setProvider(core.createProvider({
+            id: config.provider,
+            name: config.provider,
+            baseUrl: config.baseUrl,
+            auth: { apiKey: explicitKeyAuth(config.provider) },
+            models: [model],
+            api: completions.openAICompletionsApi(),
+        }));
+        return { models, model };
+    }
+    const builtin = builtins.builtinProviders().find((candidate) => candidate.id === config.provider);
+    if (builtin === undefined) {
+        throw new Error(`pi-ai has no built-in provider "${config.provider}"; set a base URL to use it as a custom OpenAI-compatible endpoint. ` +
+            `Known providers: ${builtins.builtinProviders().map((candidate) => candidate.id).join(", ")}`);
+    }
+    if (builtin.auth.apiKey === undefined) {
+        throw new Error(`pi-ai provider "${config.provider}" only supports OAuth sign-in, which gateway mode does not use.`);
+    }
+    // Register the provider with its API-key auth only: OAuth sign-in is never offered.
+    const apiKeyOnly = { ...builtin, auth: { apiKey: builtin.auth.apiKey } };
+    models.setProvider(apiKeyOnly);
+    const model = models.getModel(config.provider, config.model);
+    if (model === undefined) {
+        // A provider may mix wire APIs across its models, so an uncatalogued id
+        // cannot safely borrow another model's API. Fail instead of guessing.
+        throw new Error(`pi-ai's catalog has no model "${config.model}" for provider "${config.provider}"; ` +
+            `pick a catalogued model id, or set a base URL to call it as a custom OpenAI-compatible endpoint.`);
+    }
+    return { models, model };
+}
+function unsupported(warnings, feature, details) {
+    warnings.push(details === undefined ? { type: "unsupported", feature } : { type: "unsupported", feature, details });
+}
+function piOptions(options) {
+    return options?.[METADATA_KEY];
+}
+function stringOption(options, key) {
+    const value = piOptions(options)?.[key];
+    return typeof value === "string" ? value : undefined;
+}
+function toBase64(data) {
+    return typeof data === "string" ? data : Buffer.from(data).toString("base64");
+}
+function parseToolInput(input) {
+    if (typeof input === "string") {
+        try {
+            const parsed = JSON.parse(input);
+            return isJsonObject(parsed) ? parsed : {};
+        }
+        catch {
+            return {};
+        }
+    }
+    return isJsonObject(input) ? input : {};
+}
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toolResultContent(output) {
+    switch (output.type) {
+        case "text":
+            return { content: [{ type: "text", text: output.value }], isError: false };
+        case "json":
+            return { content: [{ type: "text", text: JSON.stringify(output.value) }], isError: false };
+        case "error-text":
+            return { content: [{ type: "text", text: output.value }], isError: true };
+        case "error-json":
+            return { content: [{ type: "text", text: JSON.stringify(output.value) }], isError: true };
+        case "execution-denied":
+            return { content: [{ type: "text", text: output.reason ?? "Tool execution was denied." }], isError: true };
+        case "content": {
+            const content = [];
+            for (const part of output.value) {
+                if (part.type === "text")
+                    content.push({ type: "text", text: part.text });
+                else if (part.type === "file" && part.mediaType.startsWith("image/") && part.data.type === "data") {
+                    content.push({ type: "image", data: toBase64(part.data.data), mimeType: part.mediaType });
+                }
+            }
+            return { content, isError: false };
+        }
+    }
+}
+const ZERO_USAGE = {
+    input: 0,
+    output: 0,
+    cacheRead: 0,
+    cacheWrite: 0,
+    totalTokens: 0,
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+};
+/** Maps the AI SDK prompt and tools onto a pi-ai `Context`. */
+export function toPiContext(prompt, options, model, warnings) {
+    const system = [];
+    const messages = [];
+    const timestamp = Date.now();
+    for (const message of prompt) {
+        switch (message.role) {
+            case "system":
+                system.push(message.content);
+                break;
+            case "user": {
+                const content = [];
+                for (const part of message.content) {
+                    if (part.type === "text")
+                        content.push({ type: "text", text: part.text });
+                    else if (part.data.type === "text")
+                        content.push({ type: "text", text: part.data.text });
+                    else if (part.mediaType.startsWith("image/") && part.data.type === "data") {
+                        content.push({ type: "image", data: toBase64(part.data.data), mimeType: part.mediaType });
+                    }
+                    else
+                        unsupported(warnings, "file part", `${part.mediaType} (${part.data.type})`);
+                }
+                messages.push({ role: "user", content, timestamp });
+                break;
+            }
+            case "assistant": {
+                const content = [];
+                for (const part of message.content) {
+                    if (part.type === "text")
+                        content.push({ type: "text", text: part.text });
+                    else if (part.type === "reasoning") {
+                        const signature = stringOption(part.providerOptions, "signature");
+                        content.push({ type: "thinking", thinking: part.text, ...(signature !== undefined ? { thinkingSignature: signature } : {}) });
+                    }
+                    else if (part.type === "tool-call") {
+                        const thoughtSignature = stringOption(part.providerOptions, "thoughtSignature");
+                        content.push({
+                            type: "toolCall",
+                            id: part.toolCallId,
+                            name: part.toolName,
+                            arguments: parseToolInput(part.input),
+                            ...(thoughtSignature !== undefined ? { thoughtSignature } : {}),
+                        });
+                    }
+                    else if (part.type !== "tool-result")
+                        unsupported(warnings, `assistant ${part.type} part`);
+                }
+                const assistant = {
+                    role: "assistant",
+                    content,
+                    api: model.api,
+                    provider: model.provider,
+                    model: model.id,
+                    usage: ZERO_USAGE,
+                    stopReason: content.some((part) => part.type === "toolCall") ? "toolUse" : "stop",
+                    timestamp,
+                };
+                messages.push(assistant);
+                break;
+            }
+            case "tool":
+                for (const part of message.content) {
+                    if (part.type !== "tool-result")
+                        continue;
+                    const result = {
+                        role: "toolResult",
+                        toolCallId: part.toolCallId,
+                        toolName: part.toolName,
+                        ...toolResultContent(part.output),
+                        timestamp,
+                    };
+                    messages.push(result);
+                }
+                break;
+        }
+    }
+    const responseFormat = options.responseFormat;
+    if (responseFormat?.type === "json") {
+        // pi-ai has no provider-neutral structured-output switch; ask for JSON in
+        // the instructions and let the caller validate the text as usual.
+        warnings.push({ type: "compatibility", feature: "responseFormat", details: "requested through the system prompt" });
+        system.push(responseFormat.schema !== undefined
+            ? `Respond with only a JSON value that matches this JSON schema:\n${JSON.stringify(responseFormat.schema)}`
+            : "Respond with only a JSON value.");
+    }
+    const tools = [];
+    const toolChoice = options.toolChoice?.type ?? "auto";
+    if (toolChoice === "required" || toolChoice === "tool")
+        unsupported(warnings, `toolChoice ${toolChoice}`, "sent as auto");
+    if (toolChoice !== "none") {
+        for (const tool of options.tools ?? []) {
+            if (tool.type !== "function") {
+                unsupported(warnings, "provider tool", tool.name);
+                continue;
+            }
+            // pi-ai's TypeBox schemas are plain JSON Schema objects at runtime.
+            tools.push({ name: tool.name, description: tool.description ?? "", parameters: tool.inputSchema });
+        }
+    }
+    return {
+        ...(system.length > 0 ? { systemPrompt: system.join("\n\n") } : {}),
+        messages,
+        ...(tools.length > 0 ? { tools } : {}),
+    };
+}
+/** Maps pi-ai's stop reason onto the AI SDK's unified finish reason. */
+export function toFinishReason(stopReason) {
+    switch (stopReason) {
+        case "stop":
+            return { unified: "stop", raw: stopReason };
+        case "toolUse":
+            return { unified: "tool-calls", raw: stopReason };
+        case "length":
+            return { unified: "length", raw: stopReason };
+        case "error":
+            return { unified: "error", raw: stopReason };
+        default:
+            return { unified: "other", raw: stopReason };
+    }
+}
+/** Maps pi-ai usage (where `input` excludes cached tokens) onto AI SDK usage. */
+export function toUsage(usage) {
+    const reasoning = usage.reasoning;
+    return {
+        inputTokens: {
+            total: usage.input + usage.cacheRead + usage.cacheWrite,
+            noCache: usage.input,
+            cacheRead: usage.cacheRead,
+            cacheWrite: usage.cacheWrite,
+        },
+        outputTokens: {
+            total: usage.output,
+            text: reasoning !== undefined ? Math.max(0, usage.output - reasoning) : usage.output,
+            reasoning,
+        },
+    };
+}
+function providerMetadata(message) {
+    const metadata = {
+        provider: message.provider,
+        api: message.api,
+        cost: { ...message.usage.cost },
+    };
+    if (message.responseModel !== undefined)
+        metadata["responseModel"] = message.responseModel;
+    return { [METADATA_KEY]: metadata };
+}
+function signatureMetadata(key, value) {
+    return value !== undefined ? { [METADATA_KEY]: { [key]: value } } : undefined;
+}
+function toContent(message) {
+    const content = [];
+    for (const part of message.content) {
+        if (part.type === "text")
+            content.push({ type: "text", text: part.text });
+        else if (part.type === "thinking") {
+            const metadata = signatureMetadata("signature", part.thinkingSignature);
+            content.push({ type: "reasoning", text: part.thinking, ...(metadata ? { providerMetadata: metadata } : {}) });
+        }
+        else {
+            const metadata = signatureMetadata("thoughtSignature", part.thoughtSignature);
+            content.push({
+                type: "tool-call",
+                toolCallId: part.id,
+                toolName: part.name,
+                input: JSON.stringify(part.arguments),
+                ...(metadata ? { providerMetadata: metadata } : {}),
+            });
+        }
+    }
+    return content;
+}
+class PiAiLanguageModel {
+    config;
+    specificationVersion = "v4";
+    provider;
+    modelId;
+    supportedUrls = {};
+    target;
+    constructor(config) {
+        this.config = config;
+        this.provider = `${PI_AI_ADAPTER_ID}.${config.provider}`;
+        this.modelId = config.model;
+    }
+    resolve() {
+        this.target ??= resolveTarget(this.config).catch((error) => {
+            this.target = undefined;
+            throw error;
+        });
+        return this.target;
+    }
+    /** Removes the configured key from any text that may surface in an error or log. */
+    redact(text) {
+        const key = this.config.apiKey;
+        return key !== undefined && key.length > 0 ? text.split(key).join("[redacted]") : text;
+    }
+    failure(message) {
+        const detail = message.errorMessage ?? message.stopReason;
+        return new Error(this.redact(`pi-ai ${this.config.provider}/${this.config.model} request failed: ${detail}`));
+    }
+    async start(options) {
+        const { models, model } = await this.resolve();
+        const warnings = [];
+        const context = toPiContext(options.prompt, options, model, warnings);
+        for (const [feature, value] of [
+            ["topP", options.topP],
+            ["topK", options.topK],
+            ["presencePenalty", options.presencePenalty],
+            ["frequencyPenalty", options.frequencyPenalty],
+            ["seed", options.seed],
+            ["stopSequences", options.stopSequences],
+        ]) {
+            if (value !== undefined)
+                unsupported(warnings, feature);
+        }
+        if (options.reasoning !== undefined && options.reasoning !== "provider-default")
+            unsupported(warnings, "reasoning");
+        const headers = { ...this.config.headers };
+        for (const [name, value] of Object.entries(options.headers ?? {}))
+            if (value !== undefined)
+                headers[name] = value;
+        const streamOptions = {
+            ...(this.config.apiKey !== undefined ? { apiKey: this.config.apiKey } : {}),
+            ...(Object.keys(headers).length > 0 ? { headers } : {}),
+            ...(this.config.fetch !== undefined ? { fetch: this.config.fetch } : {}),
+            ...(options.abortSignal !== undefined ? { signal: options.abortSignal } : {}),
+            ...(options.maxOutputTokens !== undefined ? { maxTokens: options.maxOutputTokens } : {}),
+            ...(options.temperature !== undefined ? { temperature: options.temperature } : {}),
+        };
+        return { events: models.stream(model, context, streamOptions), warnings };
+    }
+    async doGenerate(options) {
+        const { events, warnings } = await this.start(options);
+        let final;
+        for await (const event of events) {
+            if (event.type === "done")
+                final = event.message;
+            else if (event.type === "error")
+                throw this.failure(event.error);
+        }
+        if (final === undefined)
+            throw new Error(`pi-ai ${this.config.provider}/${this.config.model} stream ended without a result`);
+        return {
+            content: toContent(final),
+            finishReason: toFinishReason(final.stopReason),
+            usage: toUsage(final.usage),
+            providerMetadata: providerMetadata(final),
+            response: {
+                ...(final.responseId !== undefined ? { id: final.responseId } : {}),
+                modelId: final.responseModel ?? final.model,
+                timestamp: new Date(final.timestamp),
+            },
+            warnings,
+        };
+    }
+    async doStream(options) {
+        const { events, warnings } = await this.start(options);
+        const failure = (message) => this.failure(message);
+        const stream = new ReadableStream({
+            async start(controller) {
+                controller.enqueue({ type: "stream-start", warnings });
+                const toolInputIds = new Map();
+                try {
+                    for await (const event of events) {
+                        for (const part of toStreamParts(event, toolInputIds, failure))
+                            controller.enqueue(part);
+                    }
+                }
+                catch (error) {
+                    controller.enqueue({ type: "error", error });
+                }
+                controller.close();
+            },
+        });
+        return { stream };
+    }
+}
+/** Maps one pi-ai stream event onto zero or more AI SDK stream parts. */
+export function toStreamParts(event, toolInputIds, failure) {
+    switch (event.type) {
+        case "start":
+            return [];
+        case "text_start":
+            return [{ type: "text-start", id: `text-${event.contentIndex}` }];
+        case "text_delta":
+            return [{ type: "text-delta", id: `text-${event.contentIndex}`, delta: event.delta }];
+        case "text_end":
+            return [{ type: "text-end", id: `text-${event.contentIndex}` }];
+        case "thinking_start":
+            return [{ type: "reasoning-start", id: `reasoning-${event.contentIndex}` }];
+        case "thinking_delta":
+            return [{ type: "reasoning-delta", id: `reasoning-${event.contentIndex}`, delta: event.delta }];
+        case "thinking_end": {
+            const block = event.partial.content[event.contentIndex];
+            const metadata = signatureMetadata("signature", block?.type === "thinking" ? block.thinkingSignature : undefined);
+            return [{ type: "reasoning-end", id: `reasoning-${event.contentIndex}`, ...(metadata ? { providerMetadata: metadata } : {}) }];
+        }
+        case "toolcall_start": {
+            const block = event.partial.content[event.contentIndex];
+            const call = block?.type === "toolCall" ? block : undefined;
+            const id = call?.id || `tool-${event.contentIndex}`;
+            toolInputIds.set(event.contentIndex, id);
+            return [{ type: "tool-input-start", id, toolName: call?.name ?? "" }];
+        }
+        case "toolcall_delta": {
+            const id = toolInputIds.get(event.contentIndex) ?? `tool-${event.contentIndex}`;
+            return [{ type: "tool-input-delta", id, delta: event.delta }];
+        }
+        case "toolcall_end": {
+            const id = toolInputIds.get(event.contentIndex) ?? `tool-${event.contentIndex}`;
+            const metadata = signatureMetadata("thoughtSignature", event.toolCall.thoughtSignature);
+            return [
+                { type: "tool-input-end", id },
+                {
+                    type: "tool-call",
+                    toolCallId: event.toolCall.id || id,
+                    toolName: event.toolCall.name,
+                    input: JSON.stringify(event.toolCall.arguments),
+                    ...(metadata ? { providerMetadata: metadata } : {}),
+                },
+            ];
+        }
+        case "done":
+            return [
+                {
+                    type: "response-metadata",
+                    ...(event.message.responseId !== undefined ? { id: event.message.responseId } : {}),
+                    modelId: event.message.responseModel ?? event.message.model,
+                    timestamp: new Date(event.message.timestamp),
+                },
+                {
+                    type: "finish",
+                    finishReason: toFinishReason(event.message.stopReason),
+                    usage: toUsage(event.message.usage),
+                    providerMetadata: providerMetadata(event.message),
+                },
+            ];
+        case "error":
+            return [
+                { type: "error", error: failure(event.error) },
+                {
+                    type: "finish",
+                    finishReason: toFinishReason(event.error.stopReason),
+                    usage: toUsage(event.error.usage),
+                    providerMetadata: providerMetadata(event.error),
+                },
+            ];
+    }
+}
+/**
+ * Lists the catalog that ships inside pi-ai — no network, no credentials.
+ * OAuth-only providers are left out because gateway mode cannot use them.
+ */
+export async function listPiAiCatalog(provider) {
+    const { builtins } = await loadPiAi();
+    const providers = builtins.builtinProviders().filter((candidate) => candidate.auth.apiKey !== undefined).map((candidate) => candidate.id);
+    if (provider === undefined || !providers.includes(provider))
+        return { providers, models: [] };
+    const catalogued = builtins.getBuiltinModels(provider);
+    return { providers, models: catalogued.map((model) => ({ id: model.id, name: model.name })) };
+}
+function requireNonEmpty(value, field) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new Error(`pi-ai adapter config requires a non-empty "${field}"`);
+    }
+    return value;
+}
+export function createPiAiAdapter(config) {
+    requireNonEmpty(config.provider, "provider");
+    requireNonEmpty(config.model, "model");
+    return new PiAiLanguageModel(config);
+}

package/dist-server/harness/providers/binding.d.ts

@@ -1,9 +1,17 @@
 import type { LanguageModel } from "ai";
 import type { ProviderRegistry } from "./registry.js";
-/** Names an adapter id + the config to realize it with. */
+import type { DisclosurePolicy, Zone, ZoneRoles } from "./zone.js";
+/**
+ * Names an adapter id + the config to realize it with, plus the deployment
+ * zone the realized model runs in. `zone` is a fact about where the endpoint
+ * is deployed and who may see private data through it; it is declared by the
+ * operator on the binding and never inferred from the endpoint URL, the model
+ * id or the adapter kind.
+ */
 export interface AdapterSpec<Config = unknown> {
     readonly adapter: string;
     readonly config: Config;
+    readonly zone?: Zone;
 }
 /**
  * Runtime-injected tier -> adapter binding. This is a plain object supplied
@@ -11,13 +19,46 @@ export interface AdapterSpec<Config = unknown> {
  * be committed to a bundle fixture. `tier` names are open strings owned by
  * the bundle's steps; the binding only needs to cover the tiers a given run
  * actually uses.
+ *
+ * Keys are either a bare tier name (`strong`), shared by every mount that
+ * names that tier, or a mount-qualified `<mount>/<tier>` key
+ * (`answer_query/strong`) that wins for that one mount. Resolution is keyed on
+ * (mount, tier): the exact mount-qualified key first, then the bare tier. A
+ * flat map with no `/` keys is therefore still a complete, valid binding.
  */
 export interface TierBinding {
     readonly tiers: Readonly<Record<string, AdapterSpec>>;
+    /** The egress disclosure policy the verification step enforces (hybrid split only). */
+    readonly disclosurePolicy?: DisclosurePolicy;
+    /** Named non-step tiers (judge, render) the zone gate must also check. */
+    readonly roles?: ZoneRoles;
 }
-/** Resolve an open-string tier name to a concrete language model instance. */
-export declare function resolveTierModel(binding: TierBinding, tier: string, registry: ProviderRegistry): LanguageModel;
+/** The binding key a `(mount, tier)` pair is looked up under before falling back to the bare tier. */
+export declare function tierBindingKey(mount: string, tier: string): string;
+/** Splits a binding key into its mount (when qualified) and tier. */
+export declare function parseTierBindingKey(key: string): {
+    readonly mount?: string;
+    readonly tier: string;
+};
+/**
+ * Resolves the `AdapterSpec` for a tier as seen from one mount: the exact
+ * `<mount>/<tier>` key wins, otherwise the bare tier key. Returns the key that
+ * matched so callers (the zone gate, the dry-run) can report which entry
+ * actually bound the step.
+ */
+export declare function resolveTierSpec(binding: TierBinding, tier: string, mount?: string): {
+    readonly key: string;
+    readonly spec: AdapterSpec;
+} | undefined;
+/** Resolve an open-string tier name to a concrete language model instance, keyed on (mount, tier). */
+export declare function resolveTierModel(binding: TierBinding, tier: string, registry: ProviderRegistry, mount?: string): LanguageModel;
 /** Convenience: resolve the model for a bundle step via its `tier` field. */
 export declare function resolveStepModel(step: {
     readonly tier: string;
-}, binding: TierBinding, registry: ProviderRegistry): LanguageModel;
+}, binding: TierBinding, registry: ProviderRegistry, mount?: string): LanguageModel;
+/**
+ * Whether a binding carries any zone information at all. A binding with no
+ * `zone` on any spec, no disclosure policy and no roles is the pre-existing
+ * single-zone binding; the zone gate is armed only for zone-aware bindings.
+ */
+export declare function isZoneAwareBinding(binding: TierBinding): boolean;

package/dist-server/harness/providers/binding.js

@@ -1,13 +1,49 @@
 import { UnknownTierError } from "./errors.js";
-/** Resolve an open-string tier name to a concrete language model instance. */
-export function resolveTierModel(binding, tier, registry) {
-    const spec = binding.tiers[tier];
-    if (!spec) {
-        throw new UnknownTierError(tier);
+/** The binding key a `(mount, tier)` pair is looked up under before falling back to the bare tier. */
+export function tierBindingKey(mount, tier) {
+    return `${mount}/${tier}`;
+}
+/** Splits a binding key into its mount (when qualified) and tier. */
+export function parseTierBindingKey(key) {
+    const slash = key.indexOf("/");
+    if (slash <= 0 || slash === key.length - 1)
+        return { tier: key };
+    return { mount: key.slice(0, slash), tier: key.slice(slash + 1) };
+}
+/**
+ * Resolves the `AdapterSpec` for a tier as seen from one mount: the exact
+ * `<mount>/<tier>` key wins, otherwise the bare tier key. Returns the key that
+ * matched so callers (the zone gate, the dry-run) can report which entry
+ * actually bound the step.
+ */
+export function resolveTierSpec(binding, tier, mount) {
+    if (mount !== undefined) {
+        const qualified = tierBindingKey(mount, tier);
+        const exact = binding.tiers[qualified];
+        if (exact)
+            return { key: qualified, spec: exact };
     }
-    return registry.create(spec.adapter, spec.config);
+    const shared = binding.tiers[tier];
+    return shared ? { key: tier, spec: shared } : undefined;
+}
+/** Resolve an open-string tier name to a concrete language model instance, keyed on (mount, tier). */
+export function resolveTierModel(binding, tier, registry, mount) {
+    const resolved = resolveTierSpec(binding, tier, mount);
+    if (!resolved) {
+        throw new UnknownTierError(mount !== undefined ? tierBindingKey(mount, tier) : tier);
+    }
+    return registry.create(resolved.spec.adapter, resolved.spec.config);
 }
 /** Convenience: resolve the model for a bundle step via its `tier` field. */
-export function resolveStepModel(step, binding, registry) {
-    return resolveTierModel(binding, step.tier, registry);
+export function resolveStepModel(step, binding, registry, mount) {
+    return resolveTierModel(binding, step.tier, registry, mount);
+}
+/**
+ * Whether a binding carries any zone information at all. A binding with no
+ * `zone` on any spec, no disclosure policy and no roles is the pre-existing
+ * single-zone binding; the zone gate is armed only for zone-aware bindings.
+ */
+export function isZoneAwareBinding(binding) {
+    return binding.disclosurePolicy !== undefined || binding.roles !== undefined
+        || Object.values(binding.tiers).some((spec) => spec.zone !== undefined);
 }

package/dist-server/harness/providers/index.d.ts

@@ -1,18 +1,24 @@
 export { UnknownAdapterError, UnknownTierError } from "./errors.js";
 export { createProviderRegistry } from "./registry.js";
 export type { AdapterFactory, ProviderRegistry } from "./registry.js";
-export { resolveStepModel, resolveTierModel } from "./binding.js";
+export { isZoneAwareBinding, parseTierBindingKey, resolveStepModel, resolveTierModel, resolveTierSpec, tierBindingKey, } from "./binding.js";
 export type { AdapterSpec, TierBinding } from "./binding.js";
+export { ANSWER_SHAPES, ZONES, answerShapeSchema, disclosurePolicySchema, parseDisclosurePolicy, parseTierBindingDocument, readTierBindingFile, TierBindingParseError, tierBindingDocumentSchema, zoneRolesSchema, zoneSchema, } from "./zone.js";
+export type { AnswerShape, DisclosurePolicy, TierBindingDocument, Zone, ZoneRoles } from "./zone.js";
 export { createMockAdapter, MOCK_ADAPTER_ID } from "./adapters/mock.js";
 export type { MockAdapterConfig } from "./adapters/mock.js";
-export { createOpenAICompatibleAdapter, OPENAI_COMPATIBLE_ADAPTER_ID, } from "./adapters/openai-compatible.js";
+export { createOpenAICompatibleAdapter, mergeRequestBody, OPENAI_COMPATIBLE_ADAPTER_ID, } from "./adapters/openai-compatible.js";
 export type { OpenAICompatibleAdapterConfig } from "./adapters/openai-compatible.js";
 export { ANTHROPIC_ADAPTER_ID, createAnthropicAdapter } from "./adapters/anthropic.js";
 export type { AnthropicAdapterConfig } from "./adapters/anthropic.js";
+export { createOpenAIAdapter, OPENAI_ADAPTER_ID } from "./adapters/openai.js";
+export type { OpenAIAdapterConfig } from "./adapters/openai.js";
+export { createPiAiAdapter, listPiAiCatalog, PI_AI_ADAPTER_ID } from "./adapters/pi-ai.js";
+export type { PiAiAdapterConfig, PiAiCatalog } from "./adapters/pi-ai.js";
 import { type ProviderRegistry } from "./registry.js";
 /**
  * A provider registry pre-populated with the built-in adapters
- * (`mock`, `openai-compatible`, `anthropic`). Callers can still
+ * (`mock`, `openai-compatible`, `anthropic`, `openai`, `pi-ai`). Callers can still
  * `register()` additional adapter ids onto the returned registry.
  */
 export declare function createDefaultProviderRegistry(): ProviderRegistry;