feat(alien): add finetune example

.github/workflows/ci-fast.yml

@@ -280,9 +280,15 @@ jobs:
         run: pnpm validate:package-layout
 
       - name: TypeScript unit tests
+        # The per-package vitest suites (commands receiver twins, bindings
+        # loader/error mapping, core schemas, ai-gateway client/gateway) —
+        # `test:ts` above is typecheck-only, so without this step they never
+        # ran in CI. Must run after the dev-addon build: the bindings
+        # kv/queue/storage/vault suites load the native addon. The ai-gateway
+        # suites inject a mock addon, so they need no built .node here.
         env:
           NODE_OPTIONS: "--max-old-space-size=8192"
-        run: pnpm --filter @alienplatform/core --filter @alienplatform/bindings --filter @alienplatform/commands test
+        run: pnpm --filter @alienplatform/core --filter @alienplatform/bindings --filter @alienplatform/commands --filter @alienplatform/ai-gateway test
 
       - name: Build all CLIs
         if: steps.changes.outcome != 'success' || steps.changes.outputs.examples == 'true' || github.event_name == 'workflow_dispatch'

.github/workflows/release.yml

@@ -217,7 +217,10 @@ jobs:
             client-sdks/platform/typescript client-sdks/manager/typescript \
             packages/bindings crates/alien-bindings-node \
             packages/bindings/npm/darwin-arm64 packages/bindings/npm/darwin-x64 \
-            packages/bindings/npm/linux-x64-gnu packages/bindings/npm/linux-arm64-gnu; do
+            packages/bindings/npm/linux-x64-gnu packages/bindings/npm/linux-arm64-gnu \
+            packages/ai-gateway crates/alien-ai-gateway-node \
+            packages/ai-gateway/npm/darwin-arm64 packages/ai-gateway/npm/darwin-x64 \
+            packages/ai-gateway/npm/linux-x64-gnu packages/ai-gateway/npm/linux-arm64-gnu; do
             node -e "
               const fs = require('fs');
               const path = '${pkg}/package.json';
@@ -274,7 +277,10 @@ jobs:
             client-sdks/platform/typescript/package.json client-sdks/manager/typescript/package.json \
             packages/bindings/package.json crates/alien-bindings-node/package.json \
             packages/bindings/npm/darwin-arm64/package.json packages/bindings/npm/darwin-x64/package.json \
-            packages/bindings/npm/linux-x64-gnu/package.json packages/bindings/npm/linux-arm64-gnu/package.json
+            packages/bindings/npm/linux-x64-gnu/package.json packages/bindings/npm/linux-arm64-gnu/package.json \
+            packages/ai-gateway/package.json crates/alien-ai-gateway-node/package.json \
+            packages/ai-gateway/npm/darwin-arm64/package.json packages/ai-gateway/npm/darwin-x64/package.json \
+            packages/ai-gateway/npm/linux-x64-gnu/package.json packages/ai-gateway/npm/linux-arm64-gnu/package.json
           git commit -m "chore: release v${VERSION}"
           BRANCH="$RELEASE_BRANCH"
           if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
@@ -887,6 +893,11 @@ jobs:
           VERSION: ${{ needs.prepare.outputs.version }}
         run: node packages/bindings/scripts/validate-release-version.mjs "$VERSION"
 
+      - name: Validate ai-gateway release version lockstep
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: node packages/ai-gateway/scripts/validate-release-version.mjs "$VERSION"
+
       # Rust toolchain: Linux via the shared composite; macOS uses dtolnay +
       # brew protoc directly (plain `napi build`, not `depot cargo`, so no
       # Depot/sccache setup here). The addon depends on alien-bindings, whose
@@ -950,6 +961,31 @@ jobs:
           retention-days: 30
           path: packages/bindings/npm/${{ matrix.triple }}/alien-bindings-node.${{ matrix.triple }}.node
 
+      # The AI gateway addon reuses this matrix (same runners/toolchain) — it also
+      # depends on alien-bindings' credential resolver, so protoc is already set up.
+      - name: Build ai-gateway addon (${{ matrix.triple }})
+        env:
+          CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+        run: |
+          pnpm --filter @alienplatform/ai-gateway exec napi build \
+            --platform --release --target ${{ matrix.target }} \
+            --cwd "$GITHUB_WORKSPACE/crates/alien-ai-gateway-node"
+
+      - name: Stage ai-gateway addon into platform package
+        run: |
+          cp "crates/alien-ai-gateway-node/alien-ai-gateway-node.${{ matrix.triple }}.node" \
+            "packages/ai-gateway/npm/${{ matrix.triple }}/alien-ai-gateway-node.${{ matrix.triple }}.node"
+
+      - name: Assert staged ai-gateway binary architecture
+        run: file "packages/ai-gateway/npm/${{ matrix.triple }}/alien-ai-gateway-node.${{ matrix.triple }}.node" | grep -q "${{ matrix.expect_arch }}"
+
+      - name: Upload ai-gateway addon artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ai-gateway-addon-${{ matrix.triple }}
+          retention-days: 1
+          path: packages/ai-gateway/npm/${{ matrix.triple }}/alien-ai-gateway-node.${{ matrix.triple }}.node
+
   # This job deliberately has no Rust compiler or protoc setup. It
   # starts from the already-built artifacts and proves that a consumer whose
   # only direct dependency is @alienplatform/bindings gets the right optional
@@ -993,6 +1029,11 @@ jobs:
           VERSION: ${{ needs.prepare.outputs.version }}
         run: node packages/bindings/scripts/validate-release-version.mjs "$VERSION"
 
+      - name: Validate ai-gateway release version lockstep
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: node packages/ai-gateway/scripts/validate-release-version.mjs "$VERSION"
+
       - uses: pnpm/action-setup@v6
         with:
           version: 10.11.0
@@ -1048,6 +1089,11 @@ jobs:
           VERSION: ${{ needs.prepare.outputs.version }}
         run: node packages/bindings/scripts/validate-release-version.mjs "$VERSION"
 
+      - name: Validate ai-gateway release version lockstep
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: node packages/ai-gateway/scripts/validate-release-version.mjs "$VERSION"
+
       - uses: pnpm/action-setup@v6
         with:
           version: 10.11.0
@@ -1156,6 +1202,76 @@ jobs:
             "qualified/bindings/alienplatform-bindings-${VERSION}.tgz" \
             "@alienplatform/bindings"
 
+  publish-ai-gateway:
+    needs: [prepare, build-addon, publish-npm]
+    # Same ordering rules as publish-bindings: the wrapper pins
+    # `@alienplatform/core: ^<release>`, so it publishes only after core, and
+    # its per-platform prebuilds publish before the wrapper that pins them.
+    if: always() && needs.build-addon.result == 'success' && (inputs.dry_run || needs.publish-npm.result == 'success')
+    runs-on: depot-ubuntu-24.04-arm-4
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.dry_run && github.sha || format('v{0}', needs.prepare.outputs.version) }}
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.11.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - name: Validate npm auth
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm whoami
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Download ai-gateway addon artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: ai-gateway-addon-*
+          path: ./addons
+          merge-multiple: false
+
+      - name: Stage addons into platform packages
+        run: |
+          for triple in darwin-arm64 darwin-x64 linux-x64-gnu linux-arm64-gnu; do
+            cp "./addons/ai-gateway-addon-${triple}/alien-ai-gateway-node.${triple}.node" \
+              "packages/ai-gateway/npm/${triple}/alien-ai-gateway-node.${triple}.node"
+          done
+
+      - name: Build wrapper
+        run: pnpm --filter @alienplatform/ai-gateway build
+
+      - name: Publish platform prebuild packages (first)
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          DRY=""
+          if [ "${{ inputs.dry_run }}" = "true" ]; then DRY="--dry-run"; fi
+          for triple in darwin-arm64 darwin-x64 linux-x64-gnu linux-arm64-gnu; do
+            echo "Publishing @alienplatform/ai-gateway-${triple}..."
+            ( cd "packages/ai-gateway/npm/${triple}" && npm publish --access public $DRY )
+          done
+
+      - name: Inject optionalDependencies into the wrapper
+        run: node packages/ai-gateway/scripts/inject-optional-deps.mjs
+
+      - name: Publish wrapper (last)
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          DRY=""
+          if [ "${{ inputs.dry_run }}" = "true" ]; then DRY="--dry-run"; fi
+          pnpm --filter @alienplatform/ai-gateway publish --access public --no-git-checks $DRY
+
   # ─── Binary builds (4 targets, all parallel) ───────────────────────
 
   build-binaries-linux-x86_64: