@intx/inference 0.2.2 → 0.4.0

package/dist/providers/google-genai.js

@@ -1,4 +1,5 @@
 import { type } from "arktype";
+import { formatSafetyRatingText } from "@intx/types/runtime";
 import { CREDENTIAL_SENTINEL } from "../auth.js";
 import { ProtocolMismatchError } from "../errors.js";
 import { decodeToolName, encodeToolName, } from "../tool-name.js";
@@ -9,6 +10,19 @@ const GOOGLE_TOOL_NAME_LIMIT = {
     provider: "google-genai",
     maxLength: 64,
 };
+// Models that reject thinkingConfig.thinkingBudget: 0 with HTTP 400.
+// Keep aligned with the discovery plug-in's THINKING_MANDATORY_MODELS.
+const THINKING_MANDATORY_MODELS = new Set([
+    "gemini-2.5-pro",
+    "gemini-3.6-flash",
+]);
+// Dynamic thinking budget sentinel: the model decides how much to
+// think. Used when suppressing thought parts on thinking-mandatory
+// models that reject a zero budget.
+const DYNAMIC_THINKING_BUDGET = -1;
+function minimalThinkingBudget(model) {
+    return THINKING_MANDATORY_MODELS.has(model) ? DYNAMIC_THINKING_BUDGET : 0;
+}
 // Runtime validator for "parsed JSON value is a plain object." Used
 // by `tryParseJSONObject` to narrow `JSON.parse(string)` from its
 // declared `unknown` return into a `Record<string, unknown>` without a
@@ -22,10 +36,6 @@ const ParsedJSONObject = type("Record<string, unknown>");
 // Translates the internal ConversationTurn[] format into Gemini's
 // `generateContent` / `streamGenerateContent` request body. The harness
 // always streams, so the URL pins `:streamGenerateContent?alt=sse`.
-//
-// `parseResponse` throws unconditionally: a live call surfaces the
-// missing parser via the harness's standard inference.error path
-// rather than silently dropping events.
 // ---------------------------------------------------------------------------
 function buildRequest(messages, model, options) {
     const systemMessages = messages.filter((m) => m.role === "system");
@@ -55,7 +65,18 @@ function buildRequest(messages, model, options) {
     // produced the matching `tool_call`. Built once because a per-block
     // walk would be O(N^2) in turn count.
     const callIdToFunctionName = buildCallIdToFunctionName(messages);
-    const contents = conversationMessages.map((msg) => toGeminiContent(msg, callIdToFunctionName));
+    // safety_rating is output-only. Rewrite to text so multi-turn history
+    // keeps role alternation and a model-visible block reason (same
+    // policy as Anthropic/OpenAI/transform).
+    const contents = conversationMessages.map((msg) => {
+        const rewritten = {
+            ...msg,
+            content: msg.content.map((b) => b.type === "safety_rating"
+                ? { type: "text", text: formatSafetyRatingText(b) }
+                : b),
+        };
+        return toGeminiContent(rewritten, callIdToFunctionName);
+    });
     const body = { contents };
     if (effectiveSystem !== undefined) {
         body["systemInstruction"] = { parts: [{ text: effectiveSystem }] };
@@ -71,7 +92,7 @@ function buildRequest(messages, model, options) {
             },
         ];
     }
-    const generationConfig = buildGenerationConfig(options);
+    const generationConfig = buildGenerationConfig(model, options);
     if (generationConfig !== undefined) {
         body["generationConfig"] = generationConfig;
     }
@@ -136,63 +157,32 @@ function toGeminiContent(msg, callIdToFunctionName) {
                 `found one on a ${JSON.stringify(msg.role)} turn (callId ${JSON.stringify(block.callId)}).`);
         }
     }
-    // Positional signature pairing: a `ThinkingBlock` with a signature
-    // contributes both a `{text, thought: true}` part (no signature on
-    // it) and a stashed signature that attaches to the NEXT
-    // non-thinking part in the turn. The wire convention from the
-    // captured fixtures places `thoughtSignature` on the follow-on
-    // part (typically `functionCall`), not on the thinking text. Two
-    // pending signatures in a row, or a turn ending with a signature
-    // still pending, are encoded as errors: the corpus contains no
-    // fixture for those shapes and a silent drop would corrupt the
-    // signed-thinking round-trip Gemini requires.
-    const parts = [];
-    let pendingSignature = null;
-    for (const block of msg.content) {
-        const part = toGeminiPart(block, callIdToFunctionName);
-        const isThinkingPart = "text" in part && part.thought === true;
-        if (isThinkingPart) {
-            if (pendingSignature !== null) {
-                throw new Error(`Google GenAI adapter: encountered a second thinking block on ` +
-                    `assistant turn while a prior thinking-block signature is ` +
-                    `still awaiting a carrier part; the wire convention pairs ` +
-                    `each signed thinking block 1:1 with the next non-thinking ` +
-                    `part.`);
-            }
-            // Stash the signature off the thinking block (if any) for the
-            // next non-thinking part to claim. `toGeminiPart` already
-            // produced a thinking part WITHOUT the signature on it, per
-            // the wire shape.
-            if (block.type === "thinking" && block.signature !== undefined) {
-                pendingSignature = block.signature;
-            }
-            parts.push(part);
-            continue;
-        }
-        if (pendingSignature !== null) {
-            // Attach the stashed signature to this non-thinking part. The
-            // mutation matches Gemini's wire shape exactly: the part keeps
-            // its existing payload and grows a `thoughtSignature` field.
-            part.thoughtSignature =
-                pendingSignature;
-            pendingSignature = null;
-        }
-        parts.push(part);
-    }
-    if (pendingSignature !== null) {
-        throw new Error(`Google GenAI adapter: assistant turn ends with a thinking-block ` +
-            `signature awaiting a carrier part. Gemini's wire convention ` +
-            `requires the signature to ride on a follow-on non-thinking part ` +
-            `(typically a functionCall); a signed thinking block with no ` +
-            `follow-on part has no defined wire shape.`);
-    }
+    // Each block carries its own signature; `toGeminiPart` rides it back
+    // onto that block's own part as a `thoughtSignature`. The captured
+    // wire places the signature on whichever part the model signed (for a
+    // signed thinking turn, that is the follow-on functionCall part, which
+    // reverse-parsing attributed to the tool_call block), so a per-block
+    // round-trip reproduces the wire without any cross-part pairing.
+    const parts = msg.content.map((block) => toGeminiPart(block, callIdToFunctionName));
     return { role, parts };
 }
 function toGeminiPart(block, callIdToFunctionName) {
     switch (block.type) {
         case "text":
-            return { text: block.text };
-        case "image":
+            return {
+                text: block.text,
+                ...(block.signature !== undefined
+                    ? { thoughtSignature: block.signature }
+                    : {}),
+            };
+        case "image": {
+            // Only ImageBlock among the media kinds carries a signature; the
+            // others have no signature field to ride back.
+            const part = toGeminiMediaPart(block.source);
+            return block.signature !== undefined
+                ? { ...part, thoughtSignature: block.signature }
+                : part;
+        }
         case "document":
         case "audio":
         case "video":
@@ -203,25 +193,35 @@ function toGeminiPart(block, callIdToFunctionName) {
                     name: encodeToolName(block.name, GOOGLE_TOOL_NAME_LIMIT),
                     args: block.arguments,
                 },
+                ...(block.signature !== undefined
+                    ? { thoughtSignature: block.signature }
+                    : {}),
             };
         case "tool_result":
             return toGeminiFunctionResponse(block, callIdToFunctionName);
         case "thinking":
-            // Thinking text is translated WITHOUT the signature on this
-            // part. `toGeminiContent`'s positional pairing logic stashes
-            // the signature off the block and attaches it to the next
-            // non-thinking part in the same turn (which is where Gemini's
-            // wire format expects to see `thoughtSignature`). If the
-            // signature were attached here, both this part and the
-            // following part would carry it, producing a malformed
-            // request.
-            return { text: block.thinking, thought: true };
+            // A thinking block rides its own signature on its part, the same
+            // as any other block. Gemini most often signs the follow-on
+            // functionCall part instead, which reverse-parsing attributes to
+            // the tool_call block, so a signed thinking part here is the rare
+            // case where Gemini signed the thought itself.
+            return {
+                text: block.thinking,
+                thought: true,
+                ...(block.signature !== undefined
+                    ? { thoughtSignature: block.signature }
+                    : {}),
+            };
         case "redacted_thinking":
             // Gemini does not emit redacted-thinking blocks; a caller
             // passing one in is mixing wire formats. Surface the mismatch
             // loudly rather than dropping it silently.
             throw new Error("Google GenAI adapter does not handle redacted_thinking blocks; " +
                 "they are Anthropic-specific.");
+        case "safety_rating":
+            // Rewritten to text in buildRequest before toGeminiPart is called.
+            throw new Error("Google GenAI adapter: safety_rating blocks must be rewritten " +
+                "to text before toGeminiPart.");
         case "citation":
             // Citations are output-only blocks: the model produces them as
             // grounding/source references for its own text. Echoing one
@@ -360,7 +360,7 @@ function tryParseJSONObject(text) {
 // ---------------------------------------------------------------------------
 // generationConfig
 // ---------------------------------------------------------------------------
-function buildGenerationConfig(options) {
+function buildGenerationConfig(model, options) {
     const config = {};
     if (options.maxTokens !== undefined) {
         config["maxOutputTokens"] = options.maxTokens;
@@ -370,10 +370,10 @@ function buildGenerationConfig(options) {
     }
     // thinking.enabled === true  -> include a budget (default 1024) and
     //                                ask Gemini to surface thought parts
-    // thinking.enabled === false -> set the budget to 0 to disable
-    //                                thinking; Gemini's 2.5-series default
-    //                                is NOT zero, so "thinking off" needs
-    //                                an explicit signal
+    // thinking.enabled === false -> suppress thoughts: budget 0 when the
+    //                                model allows it, or dynamic (-1) for
+    //                                thinking-mandatory models that reject
+    //                                a zero budget with HTTP 400
     // thinking absent            -> omit thinkingConfig entirely; Gemini
     //                                uses the model's default
     if (options.thinking !== undefined) {
@@ -385,7 +385,9 @@ function buildGenerationConfig(options) {
             };
         }
         else {
-            config["thinkingConfig"] = { thinkingBudget: 0 };
+            config["thinkingConfig"] = {
+                thinkingBudget: minimalThinkingBudget(model),
+            };
         }
     }
     if (options.responseModalities !== undefined &&
@@ -574,9 +576,16 @@ const GeminiUsageMetadata = type({
     "thoughtsTokenCount?": "number",
     "cachedContentTokenCount?": "number",
 });
+// Prompt-level safety signal. Captured 2026-07-28 on
+// safety-classification fixtures: `{ blockReason: "PROHIBITED_CONTENT" }`
+// with no candidates. Only fields we consume are validated.
+const GeminiPromptFeedback = type({
+    "blockReason?": "string > 0",
+});
 const GeminiSSEEvent = type({
     "candidates?": GeminiCandidate.array(),
     "usageMetadata?": GeminiUsageMetadata,
+    "promptFeedback?": GeminiPromptFeedback,
     // `modelVersion` and `responseId` are dropped at this layer. The
     // harness's `AssistantTurn.model` is set from the requested model
     // string, not from the served `modelVersion` -- which can differ
@@ -590,44 +599,38 @@ function createParserState() {
     return {
         nextBlockIndex: 0,
         currentBlock: null,
-        pendingSignatureAnchor: null,
         pendingExecutionRequestId: null,
     };
 }
+// A `thoughtSignature` authenticates the block whose part carries it.
+// Emit an `inference.block.signature` against that block's own index;
+// providers that do not sign this part leave `signature` undefined and
+// this emits nothing.
+function emitBlockSignature(signature, index, seq, out) {
+    if (signature === undefined)
+        return;
+    out.push({
+        type: "inference.block.signature",
+        seq,
+        data: { signature, index },
+    });
+}
 // Open or extend a text/thinking block, returning the block index.
 // A part of the same kind as the current block extends it; a part of
-// a different kind closes the current block and allocates a new
-// index. Closing a thinking block stashes its index in
-// `pendingSignatureAnchor` so a subsequent non-thinking part's
-// `thoughtSignature` can attach to it.
-function openOrExtendBlock(state, kind, rawForError) {
+// a different kind closes the current block and allocates a new index.
+function openOrExtendBlock(state, kind) {
     if (state.currentBlock !== null && state.currentBlock.kind === kind) {
         return state.currentBlock.index;
     }
-    closeCurrentBlock(state, rawForError);
+    closeCurrentBlock(state);
     const index = state.nextBlockIndex++;
     state.currentBlock = { kind, index };
     return index;
 }
-// Close the current text/thinking block. A thinking block being
-// closed sets `pendingSignatureAnchor` so the next non-thinking part
-// can claim it for its `thoughtSignature`. If two thinking blocks
-// close in a row without an intervening signature consumer, surface
-// it loudly -- the corpus has no fixture exercising that shape and
-// silently overwriting the anchor would route a signature to the
-// wrong block.
-function closeCurrentBlock(state, rawForError) {
-    if (state.currentBlock?.kind === "thinking") {
-        if (state.pendingSignatureAnchor !== null) {
-            throw new ProtocolMismatchError(`google-genai parseResponse: second thinking block closed with a ` +
-                `prior signature anchor still pending (anchor block index ` +
-                `${String(state.pendingSignatureAnchor)}); the wire convention ` +
-                `pairs each thinking block 1:1 with the next non-thinking ` +
-                `carrier and the corpus contains no fixture for the unpaired ` +
-                `case.`, rawForError);
-        }
-        state.pendingSignatureAnchor = state.currentBlock.index;
-    }
+// Close the current text/thinking block so the next part of any kind
+// starts a fresh block. A signature rides on its own part and attaches
+// to that part's block, so closing carries no signature state.
+function closeCurrentBlock(state) {
     state.currentBlock = null;
 }
 // Enforce mutual exclusivity of payload-bearing fields and correct
@@ -637,9 +640,10 @@ function closeCurrentBlock(state, rawForError) {
 // semantics would otherwise admit a part with more than one set,
 // or with `thought: true` on a non-text part. Both are wire
 // violations and surface as `ProtocolMismatchError` here. A part
-// with zero payload fields is only legal when a `thoughtSignature`
-// is present (signature-carrier-only part, not seen in the current
-// corpus but spec-permitted).
+// with zero payload fields passes this structural check only when a
+// `thoughtSignature` is present; `emitPart` then rejects that
+// signature-only part separately, since a signature with no payload
+// has no block to authenticate.
 function assertSinglePayload(part, raw) {
     const payloads = [];
     if (part.text !== undefined)
@@ -676,7 +680,7 @@ function emitPart(part, state, seq, out, raw) {
     assertSinglePayload(part, raw);
     // text part with `thought: true` -- belongs to a thinking block.
     if (part.text !== undefined && part.thought === true) {
-        const index = openOrExtendBlock(state, "thinking", raw);
+        const index = openOrExtendBlock(state, "thinking");
         // Anchor the block in the harness's per-index map. An empty
         // text part with only a `thoughtSignature` would otherwise route
         // the signature to an index the harness has never seen. The
@@ -691,43 +695,21 @@ function emitPart(part, state, seq, out, raw) {
                 index,
             },
         });
-        // A thinking part may itself carry a signature (signature on the
-        // thinking part rather than on a follow-on functionCall). Attach
-        // it directly to this thinking block's index; it consumes any
-        // pending anchor too because the signature on `this` thinking
-        // part takes precedence.
-        if (part.thoughtSignature !== undefined) {
-            out.push({
-                type: "inference.thinking.signature",
-                seq,
-                data: { signature: part.thoughtSignature, index },
-            });
-            state.pendingSignatureAnchor = null;
-        }
+        // A thinking part may carry its own signature; attach it to this
+        // thinking block's index.
+        emitBlockSignature(part.thoughtSignature, index, seq, out);
         return;
     }
-    // text part without `thought` -- belongs to a text block.
+    // text part without `thought` -- belongs to a text block. An empty
+    // text part with no signature is a true no-op: it neither opens nor
+    // closes a block, so a follow-on same-kind part extends what was
+    // open. An empty text part that carries a signature still opens (or
+    // extends) a text block so the signature has its own block to sign.
     if (part.text !== undefined) {
-        if (part.text === "") {
-            // Empty text parts emit no delta. A signature-bearing
-            // empty-text part is still the carrier opportunity for any
-            // open thinking block: close the current block first so the
-            // thinking-block index lands in `pendingSignatureAnchor`,
-            // then consume the signature against it. Without that claim
-            // path, the signature would silently evaporate (the payload
-            // has nowhere else to surface) -- the empty payload is the
-            // ONLY signal Gemini sends for an authenticated empty-text
-            // carrier. An empty-text part without a signature is a true
-            // no-op -- it neither closes the current block nor consumes
-            // the carrier opportunity, so a follow-on same-kind part
-            // extends what was open.
-            if (part.thoughtSignature !== undefined) {
-                closeCurrentBlock(state, raw);
-                consumeSignature(state, part.thoughtSignature, seq, out, raw);
-            }
+        if (part.text === "" && part.thoughtSignature === undefined) {
             return;
         }
-        const index = openOrExtendBlock(state, "text", raw);
+        const index = openOrExtendBlock(state, "text");
         out.push({
             type: "inference.text.delta",
             seq,
@@ -737,22 +719,14 @@ function emitPart(part, state, seq, out, raw) {
                 index,
             },
         });
-        // Settle the carrier opportunity. A `thoughtSignature` on the
-        // part consumes the pending anchor (the signature
-        // authenticates the preceding thinking, not the text block);
-        // a signature-less part still ends the carrier opportunity by
-        // discarding the anchor. The wire convention is that the FIRST
-        // non-thinking part after a thinking block is the only carrier
-        // chance -- a later thinking block cannot retroactively claim
-        // a stale anchor.
-        settleCarrierOpportunity(state, part.thoughtSignature, seq, out, raw);
+        emitBlockSignature(part.thoughtSignature, index, seq, out);
         return;
     }
     // functionCall part -- atomic block, allocates a fresh index and
     // does not become the `currentBlock` (a follow-on text or thinking
     // part starts a new block of that kind).
     if (part.functionCall !== undefined) {
-        closeCurrentBlock(state, raw);
+        closeCurrentBlock(state);
         const fc = part.functionCall;
         const index = state.nextBlockIndex++;
         // Synthetic callId: Gemini's `functionCall` has no wire-level id
@@ -761,17 +735,6 @@ function emitPart(part, state, seq, out, raw) {
         // adapter's fallback when its wire id is absent. Block indices
         // are unique within a request by construction.
         const callId = String(index);
-        // Settle the carrier opportunity BEFORE the tool_call.start/delta
-        // pair. The signature event carries the thinking block's explicit
-        // index in its data, so the harness routes it correctly regardless
-        // of arrival order; the ordering here is for positional consumers
-        // of the event stream (snapshot tests, debuggers, anything reading
-        // the sequence by position rather than by index). The same settle
-        // call also discards a stale anchor when no signature is present,
-        // so a later thinking block does not trip the "two thinking
-        // blocks closed" guard on an anchor the current carrier already
-        // declined to claim.
-        settleCarrierOpportunity(state, part.thoughtSignature, seq, out, raw);
         out.push({
             type: "inference.tool_call.start",
             seq,
@@ -799,15 +762,16 @@ function emitPart(part, state, seq, out, raw) {
                 index,
             },
         });
+        // A `thoughtSignature` on the functionCall part authenticates the
+        // tool_call block; emit it after the block is open at this index.
+        emitBlockSignature(part.thoughtSignature, index, seq, out);
         return;
     }
     // inlineData part -- atomic image-output block. The image arrives
     // complete in a single SSE event (no streaming chunks of base64),
     // so a new block index is allocated and the ImageBlock is emitted
-    // in one `inference.image_output` event. The signature carrier
-    // semantics mirror the functionCall path: any pending thinking
-    // signature is settled BEFORE the image_output event so it
-    // attaches to the preceding thinking block, not the image block.
+    // in one `inference.image_output` event. A `thoughtSignature` on the
+    // part authenticates the image block and is emitted against its index.
     if (part.inlineData !== undefined) {
         // The parser wraps inlineData as an `ImageBlock`, so a non-
         // image MIME (e.g. audio/wav, application/pdf) would silently
@@ -819,9 +783,8 @@ function emitPart(part, state, seq, out, raw) {
                 `parser wraps inlineData as an ImageBlock and does not ` +
                 `handle other modalities on this code path.`, raw);
         }
-        closeCurrentBlock(state, raw);
+        closeCurrentBlock(state);
         const index = state.nextBlockIndex++;
-        settleCarrierOpportunity(state, part.thoughtSignature, seq, out, raw);
         out.push({
             type: "inference.image_output",
             seq,
@@ -837,6 +800,7 @@ function emitPart(part, state, seq, out, raw) {
                 index,
             },
         });
+        emitBlockSignature(part.thoughtSignature, index, seq, out);
         return;
     }
     // executableCode part -- atomic code-execution request block.
@@ -866,9 +830,8 @@ function emitPart(part, state, seq, out, raw) {
                 `unmatched. The wire convention is strict LIFO with depth 1 ` +
                 `(request, then result); no fixture exercises depth > 1.`, raw);
         }
-        closeCurrentBlock(state, raw);
+        closeCurrentBlock(state);
         const index = state.nextBlockIndex++;
-        settleCarrierOpportunity(state, part.thoughtSignature, seq, out, raw);
         const requestId = `gemini-exec-${String(index)}`;
         state.pendingExecutionRequestId = requestId;
         const ec = part.executableCode;
@@ -888,6 +851,9 @@ function emitPart(part, state, seq, out, raw) {
             seq,
             data: { request, index },
         });
+        // A `thoughtSignature` on the executableCode part authenticates the
+        // code-execution-request block; emit it against its index.
+        emitBlockSignature(part.thoughtSignature, index, seq, out);
         return;
     }
     // codeExecutionResult part -- atomic result block. Pairs against
@@ -912,9 +878,15 @@ function emitPart(part, state, seq, out, raw) {
         // part without partial side effects.
         const cer = part.codeExecutionResult;
         const status = outcomeToStatus(cer.outcome, raw);
-        closeCurrentBlock(state, raw);
+        // A code_execution_result block carries no signature field, and the
+        // corpus never signs a result part; a signature here is an
+        // unmodeled wire shape. Reject before mutating state.
+        if (part.thoughtSignature !== undefined) {
+            throw new ProtocolMismatchError(`google-genai parseResponse: codeExecutionResult part carries a ` +
+                `thoughtSignature; the code_execution_result block is not signable.`, raw);
+        }
+        closeCurrentBlock(state);
         const index = state.nextBlockIndex++;
-        settleCarrierOpportunity(state, part.thoughtSignature, seq, out, raw);
         state.pendingExecutionRequestId = null;
         const result = {
             type: "code_execution_result",
@@ -934,15 +906,12 @@ function emitPart(part, state, seq, out, raw) {
         });
         return;
     }
-    // Signature-only part (no payload, signature set). A still-open
-    // thinking block is closed first so its index lands in
-    // `pendingSignatureAnchor` before `consumeSignature` claims it --
-    // same shape as the empty-text-with-signature branch above. No
-    // new block is opened.
+    // Signature-only part (no payload, signature set). A signature
+    // authenticates a block; a part with no payload has no block to own
+    // it, so this is an unmodeled wire shape the corpus never exercises.
     if (part.thoughtSignature !== undefined) {
-        closeCurrentBlock(state, raw);
-        consumeSignature(state, part.thoughtSignature, seq, out, raw);
-        return;
+        throw new ProtocolMismatchError(`google-genai parseResponse: part carries a thoughtSignature but no ` +
+            `payload; there is no block for the signature to authenticate.`, raw);
     }
     // `assertSinglePayload` above rules out the no-payload-no-signature
     // case, so a part that lands here had a payload that no earlier
@@ -1058,42 +1027,6 @@ function outcomeToStatus(outcome, raw) {
                 `silent fallback.`, raw);
     }
 }
-// Settle the carrier-opportunity lifecycle for a non-thinking part
-// that has just been processed. If the part carries a signature, it
-// is consumed against the pending anchor (which must exist, or the
-// request is in a corrupt state). If it does not, the anchor is
-// discarded: the FIRST non-thinking part after a thinking block is
-// the only chance to claim that thinking block's signature, and a
-// part that passes without claiming ends the opportunity. A later
-// thinking block cannot retroactively re-open the claim, and the
-// discard prevents a stale anchor from tripping the
-// `closeCurrentBlock` guard when another thinking block closes.
-function settleCarrierOpportunity(state, signature, seq, out, raw) {
-    if (signature !== undefined) {
-        consumeSignature(state, signature, seq, out, raw);
-        return;
-    }
-    state.pendingSignatureAnchor = null;
-}
-// Emit `inference.thinking.signature` against the pending anchor and
-// clear it. A signature with no pending anchor is a state-corruption
-// case: Gemini placed a thoughtSignature on a part with no preceding
-// thinking block in this request. Surface as a protocol mismatch.
-function consumeSignature(state, signature, seq, out, raw) {
-    if (state.pendingSignatureAnchor === null) {
-        throw new ProtocolMismatchError(`google-genai parseResponse: thoughtSignature present but no ` +
-            `preceding thinking block exists in this request to anchor it.`, raw);
-    }
-    out.push({
-        type: "inference.thinking.signature",
-        seq,
-        data: {
-            signature,
-            index: state.pendingSignatureAnchor,
-        },
-    });
-    state.pendingSignatureAnchor = null;
-}
 function parseResponse(sseData, state, source) {
     let parsed;
     try {
@@ -1136,6 +1069,45 @@ function parseResponse(sseData, state, source) {
     if (candidate?.groundingMetadata !== undefined) {
         emitGroundingCitations(candidate.groundingMetadata, state, seq, out, parsed);
     }
+    // Prompt-level structured safety signal. Observed capture shape
+    // (safety-classification fixtures, 2026-07-28): HTTP 200 with
+    // `promptFeedback.blockReason` and zero candidates. Treat as a
+    // terminal parse path: emit the safety event, then usage from
+    // `usageMetadata` (which is present on the capture). This is not
+    // an `inference.error` — the transport succeeded and the wire
+    // carries a structured signal.
+    const blockReason = event.promptFeedback?.blockReason;
+    if (blockReason !== undefined) {
+        out.push({
+            type: "inference.safety_rating",
+            seq,
+            data: {
+                safetyRating: {
+                    type: "safety_rating",
+                    blockReason,
+                },
+            },
+        });
+        const usage = event.usageMetadata;
+        if (usage === undefined) {
+            throw new ProtocolMismatchError(`google-genai parseResponse: promptFeedback.blockReason terminal event missing usageMetadata.`, parsed);
+        }
+        out.push({
+            type: "inference.usage",
+            seq,
+            data: {
+                usage: {
+                    input: usage.promptTokenCount ?? 0,
+                    output: usage.candidatesTokenCount ?? 0,
+                    cacheRead: usage.cachedContentTokenCount ?? 0,
+                    cacheWrite: 0,
+                    thinking: usage.thoughtsTokenCount ?? 0,
+                },
+                source,
+            },
+        });
+        return out;
+    }
     // `finishReason` arrives only on the terminal event. Emit usage at
     // exactly that point: Gemini's `usageMetadata` is cumulative in
     // every event, so the terminal-event snapshot is the final count
@@ -1145,7 +1117,9 @@ function parseResponse(sseData, state, source) {
     // `MAX_TOKENS`, `SAFETY`, `RECITATION`, and `OTHER` reach this
     // layer but do not yet surface as `inference.error` -- emitting
     // those needs fixtures showing the full error envelope shape,
-    // which the plain-text path does not exercise.
+    // which the plain-text path does not exercise. Candidate-level
+    // `safetyRatings` arrays have also not been observed on the
+    // discovery corpus; extend emission when a capture carries them.
     if (candidate?.finishReason !== undefined) {
         const usage = event.usageMetadata;
         if (usage === undefined) {
@@ -1184,13 +1158,48 @@ function parseResponse(sseData, state, source) {
     }
     return out;
 }
-export function createGoogleGenAIAdapter(source) {
-    // Per-request state lives in the closure: block-index allocation
-    // and signature-anchor pairing both need to span SSE events.
-    // `buildRequest` does not touch state; only `parseResponse` does.
+// A non-streaming generateContent response is shaped exactly like a single
+// terminal streaming SSE event: one GeminiSSEEvent carrying the full parts
+// array and a terminal finishReason (or a promptFeedback.blockReason). Decode
+// it through the same parser with a fresh per-call state, so a replayed
+// non-streaming capture feeds the harness accumulator identically to its
+// streaming sibling — parity by construction, since the parser's state machine
+// is boundary-agnostic (nothing in it branches on SSE-event boundaries). The
+// "malformed JSON in SSE data payload" message parseResponse throws on a bad
+// body is path-neutral in substance (the body is JSON either way), so it is
+// left shared rather than forking the streaming parser's signature.
+function parseJSONResponse(body, source) {
+    const events = parseResponse(body, createParserState(), source);
+    // A complete non-streaming body MUST be terminal. The shared parser
+    // tolerates non-terminal events (correct mid-stream, where an intermediate
+    // event legitimately carries no finishReason), but here a body with no
+    // finishReason and no promptFeedback.blockReason is a truncated or malformed
+    // capture, not a silent empty decode. Both terminal paths emit
+    // inference.usage, so its absence is the faithful terminality signal.
+    if (!events.some((e) => e.type === "inference.usage")) {
+        throw new ProtocolMismatchError(`google-genai parseJSONResponse: non-streaming body carried no terminal ` +
+            `finishReason or promptFeedback.blockReason; a complete ` +
+            `generateContent response must be terminal and emit usage.`, body);
+    }
+    return events;
+}
+// The google-genai adapter carries no per-source accommodations today, so its
+// quirks shape is empty. A quirks bag is deployment configuration crossing
+// into the system at this boundary; rejecting unknown keys makes a
+// misconfigured bag fail loudly here rather than run silently ignored.
+export const GoogleGenAIQuirks = type({ "+": "reject" });
+export function createGoogleGenAIAdapter(source, quirks) {
+    const parsedQuirks = GoogleGenAIQuirks(quirks ?? {});
+    if (parsedQuirks instanceof type.errors) {
+        throw new Error(`google-genai adapter: invalid quirks: ${parsedQuirks.summary}`);
+    }
+    // Per-request state lives in the closure: block-index allocation and
+    // the code-execution request/result pairing both need to span SSE
+    // events. `buildRequest` does not touch state; only `parseResponse` does.
     const state = createParserState();
     return {
         buildRequest,
         parseResponse: (sseData) => parseResponse(sseData, state, source),
+        parseJSONResponse: (body) => parseJSONResponse(body, source),
     };
 }