@premai/api-extension-pi

A Pi extension that registers the Prem API inference provider. By default models route through @premai/api-sdk's createRvencClient, which encrypts payloads end-to-end before they reach the gateway. Set ENABLE_ZDR=true to route through the plain OpenAI-compatible ZDR path instead.

Documentation | API keys | npm

Modes

| ENABLE_ZDR | Transport | Model catalog | | --- | --- | --- | | false (unset) | Encrypted rvenc (/rvenc/chat/completions) | /rvenc/models (confidential) | | true | Plain OpenAI (/openai/chat/completions) | /openai/models (standard) |

Models are fetched from the gateway at runtime.

Install

Add to your Pi settings.json:

{
  "packages": ["npm:@premai/api-extension-pi@^0.1.0"]
}

or point extensions at a local checkout:

{
  "extensions": ["/path/to/api-extension-pi"]
}

Configuration

Create a Prem API key, then set the environment variables the extension reads:

export PREM_API_KEY="your-api-key"
export PROXY_URL="https://gateway.prem.io"
export ENCLAVE_URL="https://conf-engine.prem.io"

| Variable | Required | Default | Purpose | | --- | --- | --- | --- | | PREM_API_KEY | yes | — | Gateway API key | | ENABLE_ZDR | no | false | true routes through the plain OpenAI ZDR path | | PROXY_URL | no | https://gateway.prem.io | Gateway proxy endpoint | | ENCLAVE_URL | no | https://conf-engine.prem.io | Confidential enclave endpoint (confidential mode only) | | CLIENT_KEK | no | ephemeral | 32-byte key (64 hex) for persistent DEK caching across runs (confidential mode only) |

Without CLIENT_KEK, an ephemeral key-encryption key is generated per process. Keep the API key and KEK in a secret manager; never commit them.

Usage

Set defaultProvider in settings.json:

{
  "defaultProvider": "prem-api"
}

Pi picks a default model from the fetched catalog; set defaultModel to pin one:

{
  "defaultProvider": "prem-api",
  "defaultModel": "deepseek-v4-flash"
}

Security

• Inference payloads are encrypted inside the Pi process before they leave the machine. The Prem gateway receives ciphertext plus operational metadata only.
• Pi's repository access, shell commands, MCP servers, hooks, and tool results stay on the local machine or in their own external systems — the confidential boundary covers supported model traffic only.