@asterxsk/kiln 0.1.0

package/agent/extensions/pi-web-access/test/gemini-adc-auth.test.mjs

@@ -0,0 +1,257 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtemp, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+
+const geminiApiModuleUrl = new URL("../gemini-api.ts", import.meta.url).href;
+const geminiAdcModuleUrl = new URL("../gemini-adc.ts", import.meta.url).href;
+
+function runChild(script, env) {
+	const childEnv = { ...process.env };
+	for (const key of [
+		"PI_CODING_AGENT_DIR",
+		"XDG_CONFIG_HOME",
+		"GEMINI_API_KEY",
+		"GOOGLE_GEMINI_BASE_URL",
+		"CLOUDFLARE_API_KEY",
+		"GOOGLE_APPLICATION_CREDENTIALS",
+		"GOOGLE_CLOUD_PROJECT",
+		"GOOGLE_CLOUD_LOCATION",
+		"GCLOUD_PROJECT",
+	]) {
+		delete childEnv[key];
+	}
+	// macOS homedir() ignores HOME, so pin the ADC file explicitly so tests are hermetic.
+	Object.assign(childEnv, env);
+	return spawnSync(process.execPath, ["--input-type=module"], {
+		input: script,
+		encoding: "utf8",
+		env: childEnv,
+		maxBuffer: 2 * 1024 * 1024,
+	});
+}
+
+function writeAdc(root, extra = {}) {
+	return writeFile(
+		join(root, "adc.json"),
+		JSON.stringify({
+			client_id: "synthetic-client-id",
+			client_secret: "synthetic-client-secret",
+			refresh_token: "synthetic-refresh-token",
+			type: "authorized_user",
+			universe_domain: "googleapis.com",
+			...extra,
+		}) + "\n",
+		"utf8",
+	);
+}
+
+test("Gemini ADC availability requires geminiAuth adc, project, location, and an ADC file", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-adc-avail-"));
+	await writeFile(join(root, "web-search.json"), JSON.stringify({ geminiAuth: "adc", geminiProject: "p", geminiLocation: "l" }) + "\n", "utf8");
+
+	// ADC file does not exist yet -> not available.
+	const child = runChild(`
+		const { isGeminiApiAvailable } = await import(${JSON.stringify(geminiApiModuleUrl)});
+		const adc = await import(${JSON.stringify(geminiAdcModuleUrl)});
+		console.log(JSON.stringify({ adcAvail: adc.isGeminiAdcAvailable(), apiAvail: isGeminiApiAvailable() }));
+	`, { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: root, GOOGLE_APPLICATION_CREDENTIALS: join(root, "adc.json") });
+	assert.equal(child.status, 0, child.stderr);
+	assert.deepEqual(JSON.parse(child.stdout.trim()), { adcAvail: false, apiAvail: false });
+
+	// Now write an ADC file; availability should flip on.
+	await writeAdc(root);
+	const child2 = runChild(`
+		const { isGeminiApiAvailable } = await import(${JSON.stringify(geminiApiModuleUrl)});
+		const adc = await import(${JSON.stringify(geminiAdcModuleUrl)});
+		console.log(JSON.stringify({ adcAvail: adc.isGeminiAdcAvailable(), apiAvail: isGeminiApiAvailable(), missingProject: (await import(${JSON.stringify(geminiAdcModuleUrl)})).getAdcProject() }));
+	`, { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: root, GOOGLE_APPLICATION_CREDENTIALS: join(root, "adc.json") });
+	assert.equal(child2.status, 0, child2.stderr);
+	const avail = JSON.parse(child2.stdout.trim());
+	assert.equal(avail.adcAvail, true);
+	assert.equal(avail.apiAvail, true);
+});
+
+test("Gemini ADC config parse errors stay visible", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-adc-config-"));
+	await writeFile(join(root, "web-search.json"), "not valid JSON", "utf8");
+
+	const child = runChild(`
+		const adc = await import(${JSON.stringify(geminiAdcModuleUrl)});
+		let error = null;
+		try {
+			adc.isGeminiAdcAvailable();
+		} catch (err) {
+			error = err.message;
+		}
+		console.log(JSON.stringify({ error }));
+	`, { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: root, GOOGLE_APPLICATION_CREDENTIALS: join(root, "adc.json") });
+
+	assert.equal(child.status, 0, child.stderr);
+	const { error } = JSON.parse(child.stdout.trim());
+	assert.match(error, /Failed to parse .*web-search\.json/);
+});
+
+test("Gemini ADC credential parse errors include the file path", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-adc-file-"));
+	const adcPath = join(root, "adc.json");
+	await writeFile(adcPath, "not valid JSON", "utf8");
+
+	const child = runChild(`
+		const adc = await import(${JSON.stringify(geminiAdcModuleUrl)});
+		let error = null;
+		try {
+			await adc.getAdcAccessToken();
+		} catch (err) {
+			error = err.message;
+		}
+		console.log(JSON.stringify({ error }));
+	`, { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: root, GOOGLE_APPLICATION_CREDENTIALS: adcPath });
+
+	assert.equal(child.status, 0, child.stderr);
+	const { error } = JSON.parse(child.stdout.trim());
+	assert.match(error, /Failed to parse Google Application Default Credentials file at /);
+	assert.match(error, /adc\.json/);
+});
+
+test("Gemini ADC credential shape errors include the file path", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-adc-shape-"));
+	const adcPath = join(root, "adc.json");
+	await writeFile(adcPath, JSON.stringify({ type: "authorized_user", client_id: "id", client_secret: "secret" }) + "\n", "utf8");
+
+	const child = runChild(`
+		const adc = await import(${JSON.stringify(geminiAdcModuleUrl)});
+		let error = null;
+		try {
+			await adc.getAdcAccessToken();
+		} catch (err) {
+			error = err.message;
+		}
+		console.log(JSON.stringify({ error }));
+	`, { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: root, GOOGLE_APPLICATION_CREDENTIALS: adcPath });
+
+	assert.equal(child.status, 0, child.stderr);
+	const { error } = JSON.parse(child.stdout.trim());
+	assert.match(error, /Failed to parse Google Application Default Credentials file at /);
+	assert.match(error, /authorized_user file is missing refresh_token/);
+});
+
+test("Gemini ADC rejects malformed token success responses", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-adc-token-shape-"));
+	await writeAdc(root);
+	const env = { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: root, GOOGLE_APPLICATION_CREDENTIALS: join(root, "adc.json") };
+
+	const child = runChild(`
+		globalThis.fetch = async () => new Response(JSON.stringify({ access_token: true, expires_in: "bad" }), { status: 200 });
+		const adc = await import(${JSON.stringify(geminiAdcModuleUrl)});
+		let error = null;
+		try {
+			await adc.getAdcAccessToken();
+		} catch (err) {
+			error = err.message;
+		}
+		console.log(JSON.stringify({ error }));
+	`, env);
+
+	assert.equal(child.status, 0, child.stderr);
+	const { error } = JSON.parse(child.stdout.trim());
+	assert.match(error, /Gemini ADC token exchange returned no access_token/);
+
+	const expires = runChild(`
+		globalThis.fetch = async () => new Response(JSON.stringify({ access_token: "token", expires_in: "bad" }), { status: 200 });
+		const adc = await import(${JSON.stringify(geminiAdcModuleUrl)});
+		let error = null;
+		try {
+			await adc.getAdcAccessToken();
+		} catch (err) {
+			error = err.message;
+		}
+		console.log(JSON.stringify({ error }));
+	`, env);
+
+	assert.equal(expires.status, 0, expires.stderr);
+	assert.match(JSON.parse(expires.stdout.trim()).error, /Gemini ADC token exchange returned invalid expires_in/);
+});
+
+test("Gemini ADC classifies only credential rejections as CredentialResolutionError", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-adc-classify-"));
+	await writeAdc(root);
+	const env = { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: root, GOOGLE_APPLICATION_CREDENTIALS: join(root, "adc.json") };
+
+	const classify = (status, body) => runChild(`
+		globalThis.fetch = async () => new Response(${JSON.stringify(body)}, { status: ${status} });
+		const adc = await import(${JSON.stringify(geminiAdcModuleUrl)});
+		let threw = null;
+		try {
+			await adc.getAdcAccessToken();
+		} catch (err) {
+			threw = { name: err.name, category: err.category, message: err.message };
+		}
+		console.log(JSON.stringify({ threw }));
+	`, env);
+
+	// Credential rejections -> CredentialResolutionError.
+	for (const status of [400, 401, 403]) {
+		const out = classify(status, JSON.stringify({ error: "denied" }));
+		assert.equal(out.status, 0, out.stderr);
+		const { threw } = JSON.parse(out.stdout.trim());
+		assert.equal(threw.name, "CredentialResolutionError", `status ${status}`);
+		assert.equal(threw.category, "oauth-credential-rejected", `status ${status}`);
+		assert.match(threw.message, /OAuth token exchange rejected/, `status ${status}`);
+	}
+
+	// Transient failures stay plain Errors so fallbacks still run.
+	for (const status of [429, 404, 500, 502, 503]) {
+		const out = classify(status, "upstream boom");
+		assert.equal(out.status, 0, out.stderr);
+		const { threw } = JSON.parse(out.stdout.trim());
+		assert.equal(threw.name, "Error", `status ${status}`);
+		assert.equal(threw.category, undefined, `status ${status}`);
+		assert.match(threw.message, new RegExp(`token exchange failed \\(${status}\\)`), `status ${status}`);
+	}
+});
+
+test("Gemini ADC does not advertise the Files-API (YouTube/video) path", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-adc-video-"));
+	await writeAdc(root);
+	await writeFile(
+		join(root, "web-search.json"),
+		JSON.stringify({ geminiAuth: "adc", geminiProject: "p", geminiLocation: "l" }) + "\n",
+		"utf8",
+	);
+
+	// ADC only: generate-content paths are available, the Files-API path is not.
+	const adcOnly = runChild(`
+		const api = await import(${JSON.stringify(geminiApiModuleUrl)});
+		const adc = await import(${JSON.stringify(geminiAdcModuleUrl)});
+		console.log(JSON.stringify({
+			adcAvail: adc.isGeminiAdcAvailable(),
+			apiAvail: api.isGeminiApiAvailable(),
+			videoAvail: api.isGeminiApiAvailableWithVideo(),
+		}));
+	`, { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: root, GOOGLE_APPLICATION_CREDENTIALS: join(root, "adc.json") });
+	assert.equal(adcOnly.status, 0, adcOnly.stderr);
+	assert.deepEqual(JSON.parse(adcOnly.stdout.trim()), {
+		adcAvail: true,
+		apiAvail: true,
+		videoAvail: false,
+	});
+
+	// ADC + API key: the Files-API path becomes available again.
+	await writeFile(
+		join(root, "web-search.json"),
+		JSON.stringify({ geminiAuth: "adc", geminiProject: "p", geminiLocation: "l", geminiApiKey: "synthetic-key" }) + "\n",
+		"utf8",
+	);
+	const withKey = runChild(`
+		const api = await import(${JSON.stringify(geminiApiModuleUrl)});
+		console.log(JSON.stringify({
+			apiAvail: api.isGeminiApiAvailable(),
+			videoAvail: api.isGeminiApiAvailableWithVideo(),
+		}));
+	`, { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: root, GOOGLE_APPLICATION_CREDENTIALS: join(root, "adc.json") });
+	assert.equal(withKey.status, 0, withKey.stderr);
+	assert.deepEqual(JSON.parse(withKey.stdout.trim()), { apiAvail: true, videoAvail: true });
+});

package/agent/extensions/pi-web-access/test/gemini-api-transport.test.mjs

@@ -0,0 +1,170 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtemp, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+
+const videoModuleUrl = new URL("../video-extract.ts", import.meta.url).href;
+
+function runChild(script, env) {
+	const childEnv = { ...process.env };
+	for (const key of ["PI_CODING_AGENT_DIR", "XDG_CONFIG_HOME", "GEMINI_API_KEY", "GOOGLE_GEMINI_BASE_URL", "CLOUDFLARE_API_KEY"]) {
+		delete childEnv[key];
+	}
+	Object.assign(childEnv, env);
+	return spawnSync(process.execPath, ["--input-type=module"], {
+		input: script,
+		encoding: "utf8",
+		env: childEnv,
+		maxBuffer: 2 * 1024 * 1024,
+	});
+}
+
+test("Gemini generate, upload, status, and delete use only shared header auth", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-transport-"));
+	const mediaPath = join(root, "synthetic.webm");
+	await writeFile(mediaPath, "synthetic media", "utf8");
+	await writeFile(join(root, "web-search.json"), JSON.stringify({ geminiApiKey: "synthetic-gemini-key" }) + "\n", "utf8");
+
+	const child = runChild(`
+		const requests = [];
+		globalThis.fetch = async (url, init = {}) => {
+			const request = {
+				url: String(url),
+				method: init.method ?? "GET",
+				headers: Object.fromEntries(new Headers(init.headers)),
+			};
+			requests.push(request);
+			if (request.url.endsWith("/upload/v1beta/files")) {
+				return new Response("", {
+					status: 200,
+					headers: { "x-goog-upload-url": "https://generativelanguage.googleapis.com/upload/v1beta/files?upload_id=synthetic" },
+				});
+			}
+			if (request.url.includes("upload_id=synthetic")) {
+				return new Response(JSON.stringify({ file: { name: "files/synthetic", uri: "files/synthetic" } }), {
+					status: 200,
+					headers: { "content-type": "application/json" },
+				});
+			}
+			if (request.url.endsWith("/v1beta/files/synthetic") && request.method === "GET") {
+				return new Response(JSON.stringify({ state: "ACTIVE" }), {
+					status: 200,
+					headers: { "content-type": "application/json" },
+				});
+			}
+			if (request.url.includes(":generateContent")) {
+				return new Response(JSON.stringify({ candidates: [{ content: { parts: [{ text: "# Synthetic video" }] } }] }), {
+					status: 200,
+					headers: { "content-type": "application/json" },
+				});
+			}
+			if (request.url.endsWith("/v1beta/files/synthetic") && request.method === "DELETE") {
+				return new Response("", { status: 204 });
+			}
+			throw new Error("Unexpected fetch: " + request.url);
+		};
+
+		const { extractVideo } = await import(${JSON.stringify(videoModuleUrl)});
+		const result = await extractVideo({
+			absolutePath: ${JSON.stringify(mediaPath)},
+			mimeType: "video/webm",
+			sizeBytes: 15,
+			maxSizeBytes: 50 * 1024 * 1024,
+			withinUploadLimit: true,
+		});
+		await new Promise(resolve => setImmediate(resolve));
+		console.log(JSON.stringify({ result, requests }));
+	`, {
+		HOME: root,
+		USERPROFILE: root,
+		PI_CODING_AGENT_DIR: root,
+	});
+
+	assert.equal(child.status, 0, child.stderr);
+	const output = JSON.parse(child.stdout.trim());
+	assert.equal(output.result.content, "# Synthetic video");
+	assert.deepEqual(output.requests.map(request => request.method), ["POST", "PUT", "GET", "POST", "DELETE"]);
+	const generateRequest = output.requests.find(request => request.url.includes(":generateContent"));
+	assert.equal(generateRequest.url, "https://generativelanguage.googleapis.com/v1beta/models/gemini-3.6-flash:generateContent");
+	for (const request of output.requests) {
+		assert.equal(request.headers["x-goog-api-key"], "synthetic-gemini-key");
+		const url = new URL(request.url);
+		assert.equal(url.searchParams.has("key"), false);
+		assert.equal(url.searchParams.has("api_key"), false);
+		assert.equal(request.url.includes("synthetic-gemini-key"), false);
+	}
+});
+
+test("Gemini video upload, status, and delete respect a configured geminiBaseUrl relay", async () => {
+	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-relay-"));
+	const mediaPath = join(root, "synthetic.webm");
+	await writeFile(mediaPath, "synthetic media", "utf8");
+	await writeFile(join(root, "web-search.json"), JSON.stringify({ geminiApiKey: "synthetic-gemini-key", geminiBaseUrl: "https://relay.example.com" }) + "\n", "utf8");
+
+	const child = runChild(`
+		const requests = [];
+		globalThis.fetch = async (url, init = {}) => {
+			const request = {
+				url: String(url),
+				method: init.method ?? "GET",
+				headers: Object.fromEntries(new Headers(init.headers)),
+			};
+			requests.push(request);
+			if (request.url.endsWith("/upload/v1beta/files")) {
+				return new Response("", {
+					status: 200,
+					headers: { "x-goog-upload-url": "https://relay.example.com/upload/v1beta/files?upload_id=synthetic" },
+				});
+			}
+			if (request.url.includes("upload_id=synthetic")) {
+				return new Response(JSON.stringify({ file: { name: "files/synthetic", uri: "files/synthetic" } }), {
+					status: 200,
+					headers: { "content-type": "application/json" },
+				});
+			}
+			if (request.url.endsWith("/v1beta/files/synthetic") && request.method === "GET") {
+				return new Response(JSON.stringify({ state: "ACTIVE" }), {
+					status: 200,
+					headers: { "content-type": "application/json" },
+				});
+			}
+			if (request.url.includes(":generateContent")) {
+				return new Response(JSON.stringify({ candidates: [{ content: { parts: [{ text: "# Relay video" }] } }] }), {
+					status: 200,
+					headers: { "content-type": "application/json" },
+				});
+			}
+			if (request.url.endsWith("/v1beta/files/synthetic") && request.method === "DELETE") {
+				return new Response("", { status: 204 });
+			}
+			throw new Error("Unexpected fetch: " + request.url);
+		};
+
+		const { extractVideo } = await import(${JSON.stringify(videoModuleUrl)});
+		const result = await extractVideo({
+			absolutePath: ${JSON.stringify(mediaPath)},
+			mimeType: "video/webm",
+			sizeBytes: 15,
+			maxSizeBytes: 50 * 1024 * 1024,
+			withinUploadLimit: true,
+		});
+		await new Promise(resolve => setImmediate(resolve));
+		console.log(JSON.stringify({ result, requests }));
+	`, {
+		HOME: root,
+		USERPROFILE: root,
+		PI_CODING_AGENT_DIR: root,
+	});
+
+	assert.equal(child.status, 0, child.stderr);
+	const output = JSON.parse(child.stdout.trim());
+	assert.equal(output.result.content, "# Relay video");
+	assert.deepEqual(output.requests.map(request => request.method), ["POST", "PUT", "GET", "POST", "DELETE"]);
+	for (const request of output.requests) {
+		assert.equal(new URL(request.url).origin, "https://relay.example.com", request.url);
+		assert.equal(request.headers["x-goog-api-key"], "synthetic-gemini-key");
+		assert.equal(request.url.includes("generativelanguage.googleapis.com"), false);
+	}
+});

package/agent/extensions/pi-web-access/test/gemini-pdf-extract.test.mjs

@@ -0,0 +1,133 @@
+import assert from "node:assert/strict";
+import { after, test } from "node:test";
+
+const originalFetch = globalThis.fetch;
+const originalApiKey = process.env.GEMINI_API_KEY;
+process.env.GEMINI_API_KEY = "synthetic-gemini-key";
+
+const { extractPDFViaGemini } = await import("../gemini-pdf-extract.ts");
+
+after(() => {
+	globalThis.fetch = originalFetch;
+	if (originalApiKey === undefined) delete process.env.GEMINI_API_KEY;
+	else process.env.GEMINI_API_KEY = originalApiKey;
+});
+
+test("Gemini PDF conversion sends inline PDF data and normalizes valid Markdown", async () => {
+	let capturedUrl = "";
+	let capturedInit;
+	globalThis.fetch = async (url, init) => {
+		capturedUrl = String(url);
+		capturedInit = init;
+		return jsonResponse({
+			candidates: [{
+				finishReason: "STOP",
+				content: { parts: [{ text: "```markdown\n<!-- Page 1 -->\n# Sample Document\n\nFirst page.\n\n<!-- Page 2 -->\n\nSecond page.\n```" }] },
+			}],
+		});
+	};
+
+	const input = Uint8Array.from([1, 2, 3, 4]).buffer;
+	const markdown = await extractPDFViaGemini(input, {
+		pages: 5,
+		maxPages: 2,
+		title: "Sample Document",
+	});
+
+	assert.match(capturedUrl, /gemini-3\.6-flash:generateContent$/);
+	assert.equal(new Headers(capturedInit.headers).get("x-goog-api-key"), "synthetic-gemini-key");
+	const body = JSON.parse(capturedInit.body);
+	assert.equal(body.contents[0].role, "user");
+	assert.equal(body.contents[0].parts[0].inlineData.mimeType, "application/pdf");
+	assert.equal(body.contents[0].parts[0].inlineData.data, Buffer.from(input).toString("base64"));
+	assert.match(body.contents[0].parts[1].text, /pages 1 through 2/);
+	assert.match(markdown, /^<!-- Page 1 -->/);
+	assert.doesNotMatch(markdown, /^<!-- Page 1 -->\s*\n# Sample Document/m);
+	assert.match(markdown, /<!-- Page 2 -->/);
+});
+
+test("Gemini PDF conversion supports Cloudflare AI Gateway without a direct Gemini key", async () => {
+	const savedApiKey = process.env.GEMINI_API_KEY;
+	const savedBaseUrl = process.env.GOOGLE_GEMINI_BASE_URL;
+	const savedCloudflareKey = process.env.CLOUDFLARE_API_KEY;
+	delete process.env.GEMINI_API_KEY;
+	process.env.GOOGLE_GEMINI_BASE_URL = "https://gateway.ai.cloudflare.com/v1/example/gemini";
+	process.env.CLOUDFLARE_API_KEY = "synthetic-cloudflare-key";
+
+	try {
+		globalThis.fetch = async (url, init) => {
+			assert.match(String(url), /^https:\/\/gateway\.ai\.cloudflare\.com\//);
+			assert.equal(new Headers(init.headers).get("cf-aig-authorization"), "Bearer synthetic-cloudflare-key");
+			assert.equal(new Headers(init.headers).get("x-goog-api-key"), null);
+			return jsonResponse({
+				candidates: [{
+					finishReason: "STOP",
+					content: { parts: [{ text: "<!-- Page 1 -->\nGateway result" }] },
+				}],
+			});
+		};
+
+		const markdown = await extractPDFViaGemini(new ArrayBuffer(1), {
+			pages: 1,
+			maxPages: 1,
+			title: "Document",
+		});
+		assert.match(markdown, /Gateway result/);
+	} finally {
+		if (savedApiKey === undefined) delete process.env.GEMINI_API_KEY;
+		else process.env.GEMINI_API_KEY = savedApiKey;
+		if (savedBaseUrl === undefined) delete process.env.GOOGLE_GEMINI_BASE_URL;
+		else process.env.GOOGLE_GEMINI_BASE_URL = savedBaseUrl;
+		if (savedCloudflareKey === undefined) delete process.env.CLOUDFLARE_API_KEY;
+		else process.env.CLOUDFLARE_API_KEY = savedCloudflareKey;
+	}
+});
+
+test("Gemini PDF conversion rejects truncated output", async () => {
+	globalThis.fetch = async () => jsonResponse({
+		candidates: [{
+			finishReason: "MAX_TOKENS",
+			content: { parts: [{ text: "<!-- Page 1 -->\nPartial" }] },
+		}],
+	});
+
+	await assert.rejects(
+		extractPDFViaGemini(new ArrayBuffer(1), { pages: 1, maxPages: 1, title: "Document" }),
+		/MAX_TOKENS/,
+	);
+});
+
+test("Gemini PDF conversion rejects missing or out-of-sequence page markers", async () => {
+	globalThis.fetch = async () => jsonResponse({
+		candidates: [{
+			finishReason: "STOP",
+			content: { parts: [{ text: "<!-- Page 1 -->\nFirst\n\n<!-- Page 3 -->\nThird" }] },
+		}],
+	});
+
+	await assert.rejects(
+		extractPDFViaGemini(new ArrayBuffer(1), { pages: 2, maxPages: 2, title: "Document" }),
+		/out of sequence/,
+	);
+});
+
+test("Gemini PDF conversion surfaces safety blocks and empty responses", async () => {
+	globalThis.fetch = async () => jsonResponse({ promptFeedback: { blockReason: "SAFETY" } });
+	await assert.rejects(
+		extractPDFViaGemini(new ArrayBuffer(1), { pages: 1, maxPages: 1, title: "Document" }),
+		/blocked PDF extraction: SAFETY/,
+	);
+
+	globalThis.fetch = async () => jsonResponse({ candidates: [{ finishReason: "STOP", content: { parts: [] } }] });
+	await assert.rejects(
+		extractPDFViaGemini(new ArrayBuffer(1), { pages: 1, maxPages: 1, title: "Document" }),
+		/empty PDF extraction/,
+	);
+});
+
+function jsonResponse(value) {
+	return new Response(JSON.stringify(value), {
+		status: 200,
+		headers: { "content-type": "application/json" },
+	});
+}