modelrig 0.9.0 → 0.11.0

package/dist/run/raw.d.ts

@@ -40,12 +40,20 @@
  *    providers + gemini (anthropic fails closed). The provider×knob support set
  *    is ONE table (`run/raw-support.ts`) the guard AND the published docs matrix
  *    both read — they can never disagree (R5).
+ *  - R2 (issue #6): `responseSchema` — a JSON Schema forwarded as the
+ *    provider's NATIVE structured-output directive AND checked client-side with
+ *    the shared Ajv; a miss is a billed, terminal `content_invalid` (never
+ *    repaired, never retried). Fail-closed on providers without a native
+ *    schema path (the same matrix). `meta.schema_sha` on the row = sha256 of
+ *    the canonical schema, so declared-vs-served drift is queryable.
  */
-import { type RigManifest } from "../routes/manifest";
-import type { AdapterRequest, CandidateRef, ProviderId, ReasoningParams, ServiceTier, ToolChoice, ToolDefinition } from "../types/provider";
+import type { RigManifest } from "../routes/manifest";
+import type { ProviderId, ReasoningParams, ServiceTier, ToolChoice, ToolDefinition } from "../types/provider";
 import type { RunResult, RunTags } from "../types/route";
 import type { RunStreamHandle } from "./stream";
 import type { TelemetryStore } from "../types/telemetry";
+export { assertRawKnobsSupported } from "./raw-knobs";
+export { buildRawRequest } from "./raw-request";
 /** Raw-lane request. `systemPrompt`/`userPrompt` are already flattened from the
  * OpenAI `messages[]` by the caller; `tags` carries the caller's dimensions
  * (the server stamps `key_ownership` here). `lane: "raw"` is stamped by this
@@ -121,6 +129,21 @@ export interface RawRunInput {
      * appears nowhere in the prompt — is the CALLER's prompt responsibility on the
      * raw lane (documented in the R5 matrix, never injected here). */
     readonly responseFormat?: "json_object";
+    /** R2 (issue #6) — a JSON Schema for the response, on the raw lane. Forwarded
+     * as the provider's NATIVE structured-output directive (gemini
+     * `responseJsonSchema` + JSON mime; openai/grok `response_format: json_schema`
+     * strict; anthropic a forced tool call) via the adapters' existing
+     * `outputSchema` path, and the returned text is validated client-side by the
+     * SAME Ajv the routed lane uses: a miss is a billed, terminal `content_invalid`
+     * row + thrown `RigFailureError` (the raw lane never repairs/retries —
+     * `meta.validated` stays false; graduate the step to a route for a ladder).
+     * GUARDED: deepseek and the OpenAI-compat hosts (deepinfra/fireworks/zai) have
+     * no native schema path on this lane and are rejected pre-dispatch
+     * (`assertRawKnobsSupported`), as is a schema that is not a plain object, does
+     * not compile, or is declared alongside `responseFormat`. The row's
+     * `meta.schema_sha` is `sha256:` of the canonical (sorted-key) schema JSON.
+     * Absent ⇒ byte-identical (outputSchema stays null). */
+    readonly responseSchema?: object;
 }
 export interface RawRunDeps {
     readonly telemetry: TelemetryStore;
@@ -133,30 +156,6 @@ export interface RawRunDeps {
      * `routesDir: null` runRaw-only rig) ⇒ the warning is a no-op. */
     readonly manifest?: RigManifest | null;
 }
-/**
- * CE-2/CE-9 fail-closed guard (spec §3 F1/F3, CE-9 R1/R2/R4). A DECLARED
- * directive is NEVER silently dropped: a `grounding`/`responseFormat` on a
- * provider that cannot honor it, a `reasoning` on a provider with NO effort
- * control (deepseek/anthropic), or a `grounding.mode` other than the
- * v1-supported `"native"` throws `RigFailureError` `invariant_violation` (the
- * existing TERMINAL class; no new FailureClass member) BEFORE any adapter is
- * built, any provider call is made, or any telemetry row is written.
- *
- * The support facts come from `RAW_KNOB_SUPPORT` (run/raw-support.ts) — the ONE
- * table the published docs matrix also reads, so the guard and the docs can
- * never disagree (R5). What the guard does NOT reject (and why):
- *  - reasoning on openai/deepinfra/fireworks is FORWARDED verbatim
- *    (`kind: "forward"`) and the provider enforces — a rejection is classified
- *    teachably by the adapter (no per-model allowlist, R1).
- *  - reasoning on grok is a DISCLOSED coarsening (`kind: "coarsen"`).
- *  - reasoning on gemini is model-gated (`kind: "model-gated"`) — the adapter
- *    rejects a non-thinking model (`geminiReasoningUnsupported`).
- * Exported so the guard is unit-testable without a network. Idempotent and
- * side-effect-free.
- */
-export declare function assertRawKnobsSupported(input: RawRunInput): void;
-/** Pure raw-lane request shaping — exported for unit tests (no network). */
-export declare function buildRawRequest(candidate: CandidateRef, input: RawRunInput): AdapterRequest;
 /** Buffered raw dispatch (spec §4.2). Records telemetry, returns the RunResult,
  * or throws `RigFailureError` on an adapter failure. */
 export declare function runRaw(deps: RawRunDeps, input: RawRunInput): Promise<RunResult>;

package/dist/run/raw.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"raw.d.ts","sourceRoot":"","sources":["../../src/run/raw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAwBH,OAAO,EAAiC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EACV,cAAc,EAGd,YAAY,EAGZ,UAAU,EACV,eAAe,EACf,WAAW,EACX,UAAU,EACV,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAW,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGlE,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,KAAK,EAA+B,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEtF;;;sCAGsC;AACtC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;iFAC6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;iFAK6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;6EAGyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;0BAOsB;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;;;;iDAO6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IACjD;;;;mFAI+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;qFAIiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;;;;;sEAQkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;CACzC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;+EAE2E;IAC3E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;sEAEkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACxC;AAiED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAiDhE;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,GAAG,cAAc,CAsC3F;AAgQD;wDACwD;AACxD,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAYrF;AAcD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,eAAe,CAiDlF"}
+{"version":3,"file":"raw.d.ts","sourceRoot":"","sources":["../../src/run/raw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAgBH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAIV,UAAU,EACV,eAAe,EACf,WAAW,EACX,UAAU,EACV,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD;;;sCAGsC;AACtC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;iFAC6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;iFAK6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;6EAGyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;0BAOsB;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;;;;iDAO6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IACjD;;;;mFAI+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;qFAIiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;;;;;sEAQkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IACxC;;;;;;;;;;;;;4DAawD;IACxD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;+EAE2E;IAC3E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;sEAEkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACxC;AAsCD;wDACwD;AACxD,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAYrF;AAcD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,eAAe,CAiDlF"}

package/dist/run/raw.js

@@ -41,61 +41,43 @@
  *    providers + gemini (anthropic fails closed). The provider×knob support set
  *    is ONE table (`run/raw-support.ts`) the guard AND the published docs matrix
  *    both read — they can never disagree (R5).
+ *  - R2 (issue #6): `responseSchema` — a JSON Schema forwarded as the
+ *    provider's NATIVE structured-output directive AND checked client-side with
+ *    the shared Ajv; a miss is a billed, terminal `content_invalid` (never
+ *    repaired, never retried). Fail-closed on providers without a native
+ *    schema path (the same matrix). `meta.schema_sha` on the row = sha256 of
+ *    the canonical schema, so declared-vs-served drift is queryable.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.assertRawKnobsSupported = assertRawKnobsSupported;
-exports.buildRawRequest = buildRawRequest;
+exports.buildRawRequest = exports.assertRawKnobsSupported = void 0;
 exports.runRaw = runRaw;
 exports.runRawStream = runRawStream;
-const node_crypto_1 = require("node:crypto");
 const anthropic_1 = require("../adapters/anthropic");
 const deepseek_1 = require("../adapters/deepseek");
 const gemini_1 = require("../adapters/gemini");
 const grok_1 = require("../adapters/grok");
 const openai_1 = require("../adapters/openai");
 const openai_compat_1 = require("../adapters/openai-compat");
-const cost_1 = require("./cost");
-const raw_defaults_1 = require("./raw-defaults");
 const resolve_1 = require("./resolve");
-const raw_support_1 = require("./raw-support");
-const failures_1 = require("../types/failures");
-const run_context_1 = require("../artifacts/run-context");
-const manifest_1 = require("../routes/manifest");
-const attempt_meta_1 = require("../telemetry/attempt-meta");
-/**
- * R1 — resolve the effective raw-lane timeout. An explicit `timeoutMs` always
- * wins; absent, the fallback is TIER-AWARE (`RAW_TIMEOUT_DEFAULT_MS`), because a
- * passthrough should not be shorter-fused than the tier it advertises (a flex
- * grounded prompt needs minutes, not the old 120 s). No pre-dispatch rejection —
- * a short explicit timeout is a choice, and the teaching arrives on the first
- * `timeout` failure (`rawTimeoutFixHint`), which is when the caller is looking.
- */
-function resolveRawTimeoutMs(input) {
-    return input.timeoutMs ?? raw_defaults_1.RAW_TIMEOUT_DEFAULT_MS[input.serviceTier ?? "standard"];
-}
-/** R1 — the teaching `fixHint` attached to a `timeout` failure on the raw lane:
- * it names the elapsed budget, the tier, that tier's advertised target, and the
- * two fixes (raise `timeoutMs`, or drop to `standard`). Built from
- * `RAW_TIMEOUT_DEFAULT_MS` so the default it quotes can never drift. */
-function rawTimeoutFixHint(input, tier) {
-    const deadlineSec = resolveRawTimeoutMs(input) / 1000;
-    const budgetMin = raw_defaults_1.RAW_TIMEOUT_DEFAULT_MS[tier] / 60000;
-    const defaultSec = raw_defaults_1.RAW_TIMEOUT_DEFAULT_MS[tier] / 1000;
-    // Only flex has a cheaper-latency tier to drop to; at standard/priority the
-    // only fix is a longer deadline (never tell a caller to switch to the tier
-    // they are already on).
-    const tail = tier === "flex" ? ' or use serviceTier: "standard"' : "";
-    return `timed out at the ${deadlineSec}s deadline at tier ${tier} — ${tier} targets up to ${budgetMin} min; raise timeoutMs (default ${defaultSec}s)${tail}`;
-}
+// U4 extractions (behavior-preserving) — the knob guard, request shaper, and
+// finalize/telemetry live in their own modules to keep raw.ts under the LOC cap.
+// buildRawRequest / assertRawKnobsSupported are re-exported below so existing
+// importers (`import { … } from "./raw"`) are unchanged.
+const raw_knobs_1 = require("./raw-knobs");
+const raw_request_1 = require("./raw-request");
+const raw_finalize_1 = require("./raw-finalize");
+var raw_knobs_2 = require("./raw-knobs");
+Object.defineProperty(exports, "assertRawKnobsSupported", { enumerable: true, get: function () { return raw_knobs_2.assertRawKnobsSupported; } });
+var raw_request_2 = require("./raw-request");
+Object.defineProperty(exports, "buildRawRequest", { enumerable: true, get: function () { return raw_request_2.buildRawRequest; } });
 /** Conservative compat-host capability baseline — parity with createRig's
  * COMPAT_STATIC. Inconsequential for raw calls (outputSchema is always null, so
  * no JSON shaping fires), kept aligned so a raw and a routed compat call shape
  * identically if a schema is ever added. */
 const RAW_COMPAT_PROFILE = new Set(["json_mode"]);
 /** Construct a THROWAWAY adapter bound to the caller's BYOK key for one call.
- * Each adapter builds its provider client fresh inside `call()`/`stream()`, so
- * a per-call instance carries no shared state and leaks no key. Exhaustive over
- * ProviderId — a new provider forces a compile error here. */
+ * Each builds its provider client fresh inside `call()`/`stream()` (no shared
+ * state, no key leak). Exhaustive over ProviderId — a new provider fails here. */
 function buildRawAdapter(provider, apiKey) {
     switch (provider) {
         case "openai":
@@ -109,7 +91,8 @@ function buildRawAdapter(provider, apiKey) {
         case "deepseek":
             return (0, deepseek_1.createDeepSeekAdapter)({ apiKey });
         case "deepinfra":
-        case "fireworks": {
+        case "fireworks":
+        case "zai": { // B4a: Z.ai joins the OpenAI-compat host family (verbatim model id)
             const host = openai_compat_1.OPENAI_COMPAT_HOSTS[provider];
             return (0, openai_compat_1.createOpenAICompatAdapter)({
                 providerId: provider,
@@ -121,324 +104,20 @@ function buildRawAdapter(provider, apiKey) {
         }
     }
 }
-/**
- * CE-2/CE-9 fail-closed guard (spec §3 F1/F3, CE-9 R1/R2/R4). A DECLARED
- * directive is NEVER silently dropped: a `grounding`/`responseFormat` on a
- * provider that cannot honor it, a `reasoning` on a provider with NO effort
- * control (deepseek/anthropic), or a `grounding.mode` other than the
- * v1-supported `"native"` throws `RigFailureError` `invariant_violation` (the
- * existing TERMINAL class; no new FailureClass member) BEFORE any adapter is
- * built, any provider call is made, or any telemetry row is written.
- *
- * The support facts come from `RAW_KNOB_SUPPORT` (run/raw-support.ts) — the ONE
- * table the published docs matrix also reads, so the guard and the docs can
- * never disagree (R5). What the guard does NOT reject (and why):
- *  - reasoning on openai/deepinfra/fireworks is FORWARDED verbatim
- *    (`kind: "forward"`) and the provider enforces — a rejection is classified
- *    teachably by the adapter (no per-model allowlist, R1).
- *  - reasoning on grok is a DISCLOSED coarsening (`kind: "coarsen"`).
- *  - reasoning on gemini is model-gated (`kind: "model-gated"`) — the adapter
- *    rejects a non-thinking model (`geminiReasoningUnsupported`).
- * Exported so the guard is unit-testable without a network. Idempotent and
- * side-effect-free.
- */
-function assertRawKnobsSupported(input) {
-    const support = raw_support_1.RAW_KNOB_SUPPORT[input.provider];
-    const groundingMode = input.grounding?.mode;
-    if (groundingMode !== undefined) {
-        if (groundingMode !== "native") {
-            throw new failures_1.RigFailureError({
-                class: "invariant_violation",
-                message: `unsupported raw-lane grounding mode "${groundingMode}"`,
-                provider: input.provider,
-                model: input.model,
-                fixHint: 'only { mode: "native" } grounding is supported on the raw lane in v1',
-            });
-        }
-        if (!support.grounding.supported) {
-            throw new failures_1.RigFailureError({
-                class: "invariant_violation",
-                message: `native grounding on the raw lane is not supported for provider "${input.provider}"`,
-                provider: input.provider,
-                model: input.model,
-                fixHint: `native grounding on the raw lane is supported on ${(0, raw_support_1.groundingSupportedProviders)().join(", ")} only; remove grounding or switch provider`,
-            });
-        }
-    }
-    if (input.reasoning !== undefined && support.reasoning.kind === "fail-closed") {
-        throw new failures_1.RigFailureError({
-            class: "invariant_violation",
-            message: `reasoning control on the raw lane is not supported for provider "${input.provider}"`,
-            provider: input.provider,
-            model: input.model,
-            // Provider-specific teaching straight from the matrix (deepseek →
-            // deepseek-reasoner; anthropic → extended thinking unwired).
-            fixHint: support.reasoning.fixHint ??
-                "reasoning control is not available for this provider on the raw lane; remove reasoning",
-        });
-    }
-    if (input.responseFormat !== undefined && !support.responseFormat.supported) {
-        throw new failures_1.RigFailureError({
-            class: "invariant_violation",
-            message: `responseFormat on the raw lane is not supported for provider "${input.provider}"`,
-            provider: input.provider,
-            model: input.model,
-            fixHint: `responseFormat: "json_object" on the raw lane is supported on ${(0, raw_support_1.responseFormatSupportedProviders)().join(", ")} only; remove responseFormat or switch provider`,
-        });
-    }
-}
-/** Pure raw-lane request shaping — exported for unit tests (no network). */
-function buildRawRequest(candidate, input) {
-    // CE-6: forward temperature/topP through AdapterRequest.sampling ONLY when the
-    // caller declared at least one — absent, no `sampling` key is added and the
-    // request is byte-identical to pre-CE-6. maxOutputTokens keeps its top-level
-    // channel (the adapter resolves sampling.maxOutputTokens ?? maxOutputTokens).
-    const sampling = input.temperature !== undefined || input.topP !== undefined
-        ? {
-            ...(input.temperature !== undefined ? { temperature: input.temperature } : {}),
-            ...(input.topP !== undefined ? { topP: input.topP } : {}),
-        }
-        : undefined;
-    return {
-        candidate,
-        systemPrompt: input.systemPrompt,
-        userPrompt: input.userPrompt,
-        outputSchema: null, // raw lane never validates — the product distinction
-        // CE-2 F2: forward the DECLARED tier (default "standard"); the meta/row
-        // honesty fix in finalizeRaw reports this same value, never a hardcode.
-        requestedTier: input.serviceTier ?? "standard",
-        // R1: tier-aware default (RAW_TIMEOUT_DEFAULT_MS); explicit timeoutMs wins.
-        timeoutMs: resolveRawTimeoutMs(input),
-        ...(input.maxOutputTokens !== undefined ? { maxOutputTokens: input.maxOutputTokens } : {}),
-        ...(sampling !== undefined ? { sampling } : {}),
-        // CE-2 F1: `{ mode: "native" }` → the adapter's native-grounding directive.
-        // Any other mode / unsupported provider never reaches here — the guard
-        // (assertRawKnobsSupported) rejects it pre-dispatch. Absent ⇒ no key added.
-        ...(input.grounding?.mode === "native" ? { grounding: true } : {}),
-        // CE-2 F3: forward reasoning verbatim; absent ⇒ no key added (byte-identical).
-        ...(input.reasoning !== undefined ? { reasoning: input.reasoning } : {}),
-        // CE-9 R4: forward the json_object directive verbatim; absent ⇒ no key added
-        // (byte-identical). An unsupported provider (anthropic) never reaches here —
-        // the guard (assertRawKnobsSupported) rejects it pre-dispatch.
-        ...(input.responseFormat !== undefined ? { responseFormat: input.responseFormat } : {}),
-        ...(input.tools !== undefined ? { tools: input.tools } : {}),
-        ...(input.toolChoice !== undefined ? { toolChoice: input.toolChoice } : {}),
-        ...(input.cache !== undefined ? { cache: input.cache } : {}),
-    };
-}
-/** Write the metered raw-lane telemetry row. Mirrors the run loop's minimal
- * `recordSearchCostRow` shape: only load-bearing fields set, route = the
- * `provider/model` handle the caller used, lane + key_ownership riding in
- * `tags_json`. The exporter mirrors it on its normal cadence — no lane column,
- * no schema change (telemetry map, 2026-08-10). */
-function recordRawRow(telemetry, p) {
-    const row = {
-        id: p.id,
-        ts: new Date().toISOString(),
-        route: p.rawModelId,
-        routeVersion: 0,
-        provider: p.provider,
-        model: p.model,
-        requestedTier: p.requestedTier,
-        servedTier: p.usage?.servedTier ?? "standard",
-        tokensIn: p.usage?.tokensIn ?? 0,
-        tokensOut: p.usage?.tokensOut ?? 0,
-        tokensCached: p.usage?.tokensCached ?? 0,
-        tokensCacheWrite: p.usage?.tokensCacheWrite ?? 0,
-        tokensCacheWrite1h: p.usage?.tokensCacheWrite1h ?? 0,
-        costEstimateUsd: p.costUsd,
-        latencyMs: p.latencyMs,
-        ttfbMs: p.usage?.ttfbMs ?? null,
-        failureClass: p.failureClass,
-        attemptsJson: "{}",
-        // Rung tag (R1 review, F1): the raw lane is a single primary dispatch. Raw
-        // rows carry `lane: "raw"` and are excluded from route rollups, but every row
-        // gets a rung for a uniform contract.
-        tagsJson: JSON.stringify({ ...p.tags, rung: "primary" }),
-        fingerprintCell: null,
-        servedVariant: null,
-        repairedBy: null,
-        pricingMissing: p.pricingMissing,
-        // CE-1: a customer cache handle (if supplied) stamps `cache_key`; the raw
-        // lane runs no WS-C stamping, so `prefix_fingerprint` is always null and the
-        // provenance rule reads any non-null key here as `customer`.
-        cacheKey: p.cacheKey ?? null,
-        prefixFingerprint: null,
-        // Ladder key (spec §2.1 R0): raw lane = one row per call, seq 1, index 0.
-        callId: p.callId,
-        attemptSeq: 1,
-        candidateIndex: 0,
-        meta: p.meta,
-    };
-    telemetry.record(row);
-}
-/**
- * Read the ambient run context at the ENTRY of a raw call (spec §4) and, if
- * present, resolve the step key `input.stepKey ?? tags.step ?? provider/model#n`
- * (validated) — so `finalizeRaw` records a ground-truth step exactly like the
- * routed lane. Also runs the required-dimension hygiene warning (spec §4),
- * unconditionally, as the routed lane does. Fail-open: no context ⇒ null and no
- * step is ever recorded; the dispatch is byte-identical to pre-G1.
- */
-function prepareRawStep(deps, input) {
-    const runCtx = (0, run_context_1.getActiveRunContext)();
-    // Warn on the EFFECTIVE tags: an auto-stamped run_id (RC-1) is not missing.
-    (0, manifest_1.warnMissingRequiredDimensions)(deps.manifest ?? null, (0, run_context_1.withRunIdTag)(input.tags ?? {}, runCtx));
-    if (runCtx === null)
-        return null;
-    const rawModelId = `${input.provider}/${input.model}`;
-    const stepKey = (0, run_context_1.resolveStepKey)(input.stepKey, input.tags?.step, () => runCtx.nextStepKey(rawModelId));
-    return { runCtx, stepKey, startedAtIso: new Date().toISOString() };
-}
-/**
- * Turn an `AdapterResult` into a RunResult, recording exactly one telemetry row.
- * Shared by the buffered and streaming paths so cost/telemetry are byte-identical.
- * On a failure result: record the (possibly billed) row, then throw
- * `RigFailureError` — the server maps it to a status exactly like the slug lane.
- *
- * G1: when a run context was captured at entry (`step`), a ground-truth step is
- * emitted after the telemetry row on BOTH branches (success and failure) —
- * fail-open, so a buffer error there never affects the returned result. No
- * artifact CONTENT is written on the raw lane (spec F3): steps are metadata.
- */
-function finalizeRaw(deps, input, result, latencyMs, step) {
-    const unpricedRatePerTok = (deps.unpricedRateUsdPerMTok ?? cost_1.DEFAULT_UNPRICED_RATE_USD_PER_MTOK) / 1000000;
-    const rawModelId = `${input.provider}/${input.model}`;
-    // One call_id for this raw invocation — shared by the (single) recorded row and
-    // the returned meta (spec §2.1 R0).
-    const callId = (0, node_crypto_1.randomUUID)();
-    // CE-2 F2: the declared tier is reported truthfully on the row AND the meta.
-    const requestedTier = input.serviceTier ?? "standard";
-    // RC-1: `run_id` from the ambient run (caller's value wins); lane is SDK-owned
-    // and cannot be overridden by a caller-supplied tag.
-    // GS-1: `tags.step` from the ambient step key (step.stepKey = caller's stepKey
-    // ?? tags.step ?? the auto provider/model#n key) when a run is active and the
-    // caller set none — spread FIRST so a caller value wins, and omitted entirely
-    // outside a run context so the row stays byte-identical (parity with RC-1).
-    const stepTag = step !== null ? { step: step.stepKey } : {};
-    const tags = { ...stepTag, ...(0, run_context_1.withRunIdTag)(input.tags ?? {}, step?.runCtx ?? null), lane: "raw" };
-    // WI-1 (spec §2, §6.3 lane parity): the attempt envelope, built by the SAME
-    // producer + rendered-request canonicalization the routed lane uses. The raw
-    // lane never sends an output schema (unvalidated by design), so schema = null.
-    const declaredToolNames = input.tools?.map((t) => t.function.name);
-    const rawMeta = (usage) => (0, attempt_meta_1.summarizeAttemptMeta)({
-        ...(result.meta !== undefined ? { adapterMeta: result.meta } : {}),
-        renderedRequest: (0, attempt_meta_1.renderRequestForHash)({ system: input.systemPrompt, user: input.userPrompt, schema: null }),
-        outputText: result.ok ? result.text : null,
-        ...(declaredToolNames !== undefined ? { declaredToolNames } : {}),
-        provider: input.provider,
-        model: input.model,
-        ...(usage !== undefined ? { usage } : {}),
-    });
-    // G1: mirror this raw inference into a ground-truth step (parity with the
-    // routed lane's record-attempt). task = tags.step ?? provider/model (spec F1).
-    // Fail-open is handled inside emitGroundTruthStep (buffer errors are swallowed).
-    const emitStep = (inferenceId, failureClass) => {
-        if (step === null)
-            return;
-        step.runCtx.emitGroundTruthStep({
-            stepKey: step.stepKey,
-            task: input.tags?.step ?? rawModelId,
-            inferenceId,
-            startedAt: step.startedAtIso,
-            endedAt: new Date().toISOString(),
-            failureClass,
-        });
-    };
-    if (!result.ok) {
-        let costUsd = 0;
-        let pricingMissing = false;
-        if (result.usage !== undefined) {
-            const settled = (0, cost_1.attemptCost)(input.provider, input.model, result.usage, unpricedRatePerTok);
-            costUsd = settled.costUsd;
-            pricingMissing = settled.pricingMissing;
-        }
-        const failId = (0, node_crypto_1.randomUUID)();
-        recordRawRow(deps.telemetry, {
-            id: failId,
-            rawModelId,
-            provider: input.provider,
-            model: input.model,
-            ...(result.usage !== undefined ? { usage: result.usage } : {}),
-            costUsd,
-            latencyMs,
-            requestedTier,
-            failureClass: result.failure.class,
-            tags,
-            pricingMissing,
-            callId,
-            meta: rawMeta(result.usage),
-            ...(input.cache !== undefined ? { cacheKey: input.cache.key } : {}),
-        });
-        emitStep(failId, result.failure.class);
-        // R1: a raw-lane timeout is the #245 footgun — attach the tier-aware teaching
-        // hint (the customer is looking at THIS error). Any other failure surfaces
-        // unchanged. Overrides any adapter-set hint: the tier + budget is the fix.
-        if (result.failure.class === "timeout") {
-            throw new failures_1.RigFailureError({
-                ...result.failure,
-                fixHint: rawTimeoutFixHint(input, requestedTier),
-            });
-        }
-        throw new failures_1.RigFailureError(result.failure);
-    }
-    const { costUsd, pricingMissing } = (0, cost_1.attemptCost)(input.provider, input.model, result.usage, unpricedRatePerTok);
-    const id = (0, node_crypto_1.randomUUID)();
-    recordRawRow(deps.telemetry, {
-        id,
-        rawModelId,
-        provider: input.provider,
-        model: input.model,
-        usage: result.usage,
-        costUsd,
-        latencyMs,
-        requestedTier,
-        failureClass: null,
-        tags,
-        pricingMissing,
-        callId,
-        meta: rawMeta(result.usage),
-        ...(input.cache !== undefined ? { cacheKey: input.cache.key } : {}),
-    });
-    emitStep(id, null);
-    const toolCalls = result.toolCalls;
-    const isToolTurn = toolCalls !== undefined && toolCalls.length > 0;
-    const meta = {
-        inferenceId: id,
-        route: rawModelId,
-        routeVersion: 0,
-        provider: input.provider,
-        model: input.model,
-        requestedTier,
-        servedTier: result.usage.servedTier,
-        tokensIn: result.usage.tokensIn,
-        tokensOut: result.usage.tokensOut,
-        tokensCached: result.usage.tokensCached,
-        costEstimateUsd: costUsd,
-        latencyMs,
-        validated: false, // raw is NEVER validated — the central product claim
-        attemptsByClass: {},
-        servedVariant: null,
-        repairedBy: null,
-        callId,
-        ...(isToolTurn ? { toolCalls } : {}),
-    };
-    return { output: isToolTurn ? null : result.text, meta };
-}
 /** Buffered raw dispatch (spec §4.2). Records telemetry, returns the RunResult,
  * or throws `RigFailureError` on an adapter failure. */
 async function runRaw(deps, input) {
     // CE-2 F1/F3: fail closed on an unsupported declared directive BEFORE building
     // an adapter — no meter, no provider call, no telemetry row.
-    assertRawKnobsSupported(input);
+    (0, raw_knobs_1.assertRawKnobsSupported)(input);
     // G1: bind the ambient run context at ENTRY (ALS boundary) so a raw call inside
     // a run.start records a ground-truth step (spec §4). Null ⇒ uninstrumented.
-    const step = prepareRawStep(deps, input);
+    const step = (0, raw_finalize_1.prepareRawStep)(deps, input);
     const adapter = buildRawAdapter(input.provider, input.apiKey);
     const candidate = (0, resolve_1.mintRawCandidate)(input.provider, input.model);
     const started = Date.now();
-    const result = await adapter.call(buildRawRequest(candidate, input));
-    return finalizeRaw(deps, input, result, Date.now() - started, step);
+    const result = await adapter.call((0, raw_request_1.buildRawRequest)(candidate, input));
+    return (0, raw_finalize_1.finalizeRaw)(deps, input, result, Date.now() - started, step);
 }
 function streamEndedFailure(input) {
     return {
@@ -463,7 +142,7 @@ function runRawStream(deps, input) {
     // G1: read the ambient run context HERE — at the synchronous entry, the ALS
     // boundary — NOT inside the async generator below (which defers to drain time,
     // possibly on a different async context, where getActiveRunContext would miss).
-    const step = prepareRawStep(deps, input);
+    const step = (0, raw_finalize_1.prepareRawStep)(deps, input);
     let settle;
     let fail;
     const result = new Promise((res, rej) => {
@@ -478,10 +157,10 @@ function runRawStream(deps, input) {
             // CE-2 F1/F3: fail closed on an unsupported declared directive BEFORE any
             // adapter/dispatch — surfaced through the handle (result rejects, the
             // events iterator throws), so no meter, no provider call, no telemetry row.
-            assertRawKnobsSupported(input);
+            (0, raw_knobs_1.assertRawKnobsSupported)(input);
             const adapter = buildRawAdapter(input.provider, input.apiKey);
             const candidate = (0, resolve_1.mintRawCandidate)(input.provider, input.model);
-            const req = buildRawRequest(candidate, input);
+            const req = (0, raw_request_1.buildRawRequest)(candidate, input);
             const started = Date.now();
             let adapterResult;
             if (adapter.stream !== undefined) {
@@ -500,7 +179,7 @@ function runRawStream(deps, input) {
             else {
                 adapterResult = await adapter.call(req);
             }
-            const runResult = finalizeRaw(deps, input, adapterResult, Date.now() - started, step);
+            const runResult = (0, raw_finalize_1.finalizeRaw)(deps, input, adapterResult, Date.now() - started, step);
             settle(runResult);
             yield { type: "final", result: runResult };
         }

package/dist/run/record-attempt.d.ts

@@ -10,6 +10,7 @@
  * in-flight E4 / capture-write work (plan coordination note).
  */
 import type { AttemptTelemetry } from "./dispatch";
+import type { Destination } from "./destination";
 import type { ActiveRunContext } from "../artifacts/run-context";
 import type { RetryLedger } from "./retry";
 import type { RouteBundle, RunOptions, RunTags } from "../types/route";
@@ -42,6 +43,13 @@ export interface RecordAttemptDeps {
      * `meta.arm` so the A/B readout groups `inferences` by arm. Absent ⇒ no `arm`
      * key on `meta` (byte-identical to a non-experiment run). */
     readonly arm?: string;
+    /** Unified Route U3 (ruling D-2) — the run's RESOLVED serving destination. The
+     * row's `tagsJson` stamps `destination` through the shared `destinationTag`
+     * helper ONLY for a NON-default value: `direct` (the default, absent ⇒
+     * byte-identical) adds NO tag, so every `direct` routed row stays byte-identical
+     * to pre-U2; a `modelrig-served` row carries `destination:"modelrig-served"`
+     * (legible managed-served attribution). Absent ⇒ `direct`. */
+    readonly destination?: Destination;
 }
 /**
  * Classify a recorded row's ladder rung (R1 review, F1). `primaryDispatched`

package/dist/run/record-attempt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-attempt.d.ts","sourceRoot":"","sources":["../../src/run/record-attempt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EAAgB,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;gDAG4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;qFAEiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC;;;wEAGoE;IACpE,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjD;;iEAE6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,OAAO,EACpB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,aAAa,CAUf;AAED;;yCAEyC;AACzC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAkIlG"}
+{"version":3,"file":"record-attempt.d.ts","sourceRoot":"","sources":["../../src/run/record-attempt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EAAgB,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAIpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;gDAG4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;qFAEiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC;;;wEAGoE;IACpE,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjD;;iEAE6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;kEAK8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,OAAO,EACpB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,aAAa,CAUf;AAED;;yCAEyC;AACzC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CA6IlG"}