@juspay/neurolink 11.0.0 → 11.1.1

package/dist/utils/providerHealth.js

@@ -4,10 +4,11 @@
  */
 import { logger } from "./logger.js";
 import { AIProviderName, OpenAIModels, GoogleAIModels, AnthropicModels, BedrockModels, } from "../constants/enums.js";
-import { API_KEY_LENGTHS, PROJECT_ID_FORMAT } from "./providerConfig.js";
+import { PROJECT_ID_FORMAT, satisfiesFallbacks } from "./providerConfig.js";
 import { basename } from "path";
 import { createProxyFetch } from "../proxy/proxyFetch.js";
 import { DEFAULT_OLLAMA_MODEL } from "../providers/ollama/constants.js";
+import { ProviderFactory } from "../factories/providerFactory.js";
 export class ProviderHealthChecker {
     static healthCache = new Map();
     static DEFAULT_TIMEOUT = 5000; // 5 seconds
@@ -172,55 +173,36 @@ export class ProviderHealthChecker {
             logger.debug("Vertex AI authentication check starting", {
                 providerName,
             });
-            // Method 1: Check GOOGLE_APPLICATION_CREDENTIALS (file-based)
-            const credentialsFile = process.env.GOOGLE_APPLICATION_CREDENTIALS;
-            let fileBasedAuthValid = false;
-            if (credentialsFile) {
-                logger.debug("Checking GOOGLE_APPLICATION_CREDENTIALS file");
-                try {
-                    const { promises: fs } = await import("fs");
-                    try {
-                        await fs.access(credentialsFile);
-                        fileBasedAuthValid = true;
-                    }
-                    catch {
-                        fileBasedAuthValid = false;
-                    }
-                    logger.debug("File auth check result", {
-                        fileExists: fileBasedAuthValid,
-                    });
-                }
-                catch (error) {
-                    logger.debug("File auth check error", {
-                        error: String(error),
-                    });
-                    fileBasedAuthValid = false;
-                }
-            }
-            // Method 2: Check individual environment variables
-            const hasIndividualAuth = !!(process.env.GOOGLE_AUTH_CLIENT_EMAIL &&
-                process.env.GOOGLE_AUTH_PRIVATE_KEY);
-            logger.debug("Individual auth check", {
-                hasClientEmail: !!process.env.GOOGLE_AUTH_CLIENT_EMAIL,
-                hasPrivateKey: !!process.env.GOOGLE_AUTH_PRIVATE_KEY,
-                hasIndividualAuth,
-            });
-            // Vertex is valid if EITHER auth method works
-            const hasValidAuth = fileBasedAuthValid || hasIndividualAuth;
-            logger.debug("Vertex auth final result", {
-                fileBasedAuthValid,
-                hasIndividualAuth,
-                hasValidAuth,
-            });
+            // Derive auth-var acceptance from the vertex descriptor instead of a
+            // hand-maintained var list, so this stays in sync with the real
+            // gating logic (hasGoogleCredentials() in googleVertex/client.ts and
+            // googleVertex/utils.ts): extraRequired.every(...) ||
+            // extraRequiredFallbacks.some(...), the same pattern used by
+            // hasProviderEnvVars() (providerUtils.ts), setup.ts, and
+            // environmentManager.ts. The old two-method check here only
+            // recognized GOOGLE_APPLICATION_CREDENTIALS or the
+            // GOOGLE_AUTH_CLIENT_EMAIL + GOOGLE_AUTH_PRIVATE_KEY pair — missing
+            // GOOGLE_SERVICE_ACCOUNT_KEY and, most importantly,
+            // GOOGLE_APPLICATION_CREDENTIALS_NEUROLINK, the descriptor's
+            // documented first-priority fallback. A user configured via that
+            // var alone had a fully working Vertex provider but was reported
+            // unhealthy here. Note: this is a presence-only check — it no
+            // longer verifies the GOOGLE_APPLICATION_CREDENTIALS file actually
+            // exists on disk (the old file-based method did via fs.access),
+            // matching the presence-only semantics already used by the other
+            // three callers of this pattern.
+            const descriptor = ProviderFactory.getDescriptor(AIProviderName.VERTEX);
+            const { extraRequired, extraRequiredFallbacks } = descriptor?.envVars ?? {};
+            const hasValidAuth = (extraRequired ?? []).every((v) => !!process.env[v]) ||
+                satisfiesFallbacks(extraRequiredFallbacks, process.env);
+            logger.debug("Vertex auth final result", { hasValidAuth });
             if (hasValidAuth) {
                 healthStatus.hasApiKey = true;
-                logger.debug("Vertex auth SUCCESS", {
-                    authMethod: fileBasedAuthValid ? "file-based" : "individual-env-vars",
-                });
+                logger.debug("Vertex auth SUCCESS");
             }
             else {
                 healthStatus.hasApiKey = false;
-                healthStatus.configurationIssues.push(`Vertex AI authentication not found: neither GOOGLE_APPLICATION_CREDENTIALS file nor individual credentials (GOOGLE_AUTH_CLIENT_EMAIL + GOOGLE_AUTH_PRIVATE_KEY) are properly configured`);
+                healthStatus.configurationIssues.push("Vertex AI authentication not found: set GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_APPLICATION_CREDENTIALS_NEUROLINK, GOOGLE_SERVICE_ACCOUNT_KEY, or both GOOGLE_AUTH_CLIENT_EMAIL and GOOGLE_AUTH_PRIVATE_KEY");
                 logger.debug("Vertex auth FAILED", {
                     reason: "No valid auth method found",
                 });
@@ -360,103 +342,108 @@ export class ProviderHealthChecker {
         }
     }
     /**
-     * Get required environment variables for a provider
+     * Get required environment variables for a provider.
+     *
+     * Returns `[]` for providers with `descriptor.credentialsResolvedExternally
+     * === true` (Vertex, Bedrock, LiteLLM) — the check in
+     * checkEnvironmentConfiguration() below ANDs every entry in the returned
+     * list together, which can't express Vertex's file-OR-individual-creds-
+     * OR-service-account auth, Bedrock's AWS SDK default provider chain
+     * (profile / IAM role, no env vars at all), or LiteLLM's documented
+     * zero-config local proxy. Their real requirement is validated by
+     * checkProviderSpecificConfig()'s dedicated per-provider checks instead.
+     * Naively deriving [apiKey, ...extraRequired] from the descriptor for
+     * these three (as for the other 27 providers) would make
+     * checkEnvironmentConfiguration() push a false "missing environment
+     * variables" issue — and therefore isHealthy=false — for legitimate
+     * fallback-based Vertex auth, AWS_PROFILE/IAM-role Bedrock auth, and
+     * unauthenticated local LiteLLM proxies. See hasProviderEnvVars() in
+     * providerUtils.ts for the equivalent OR-aware check used for
+     * auto-select gating. See `ProviderDescriptor.credentialsResolvedExternally`
+     * (types/providers.ts) for the field's full documentation.
      */
     static getRequiredEnvironmentVariables(providerName) {
-        switch (providerName) {
-            case AIProviderName.ANTHROPIC:
-                return ["ANTHROPIC_API_KEY"];
-            case AIProviderName.OPENAI:
-                return ["OPENAI_API_KEY"];
-            case AIProviderName.VERTEX:
-                // Vertex AI requires authentication, but not via a single environment variable.
-                // Authentication can be provided via a credential file or individual credentials + project.
-                // The required authentication is checked in checkProviderSpecificConfig instead of here.
-                // Returning an empty array here does NOT mean authentication is not required.
-                return [];
-            case AIProviderName.GOOGLE_AI:
-                return ["GOOGLE_AI_API_KEY"];
-            case AIProviderName.BEDROCK:
-                // Bedrock credentials are resolved via AWS SDK default provider chain.
-                // Region/auth validated in provider-specific checks.
-                return [];
-            case AIProviderName.AZURE:
-                return ["AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT"];
-            case AIProviderName.LITELLM:
-                return [];
-            case AIProviderName.OLLAMA:
-                return []; // Ollama typically doesn't require API keys
-            default:
-                return [];
-        }
+        // Resolve the descriptor FIRST so the field check below is keyed on
+        // the canonical, alias-resolved `descriptor.credentialsResolvedExternally`
+        // — not the raw, possibly-aliased `providerName` argument. Checking the
+        // raw input here would let documented aliases (e.g. "googleVertex" for
+        // vertex, "aws" for bedrock) skip the delegation and fall through to
+        // the naive [apiKey, ...extraRequired] derivation below, reproducing
+        // the exact false "missing environment variables" regression this
+        // field exists to prevent.
+        const descriptor = ProviderFactory.getDescriptor(providerName);
+        if (!descriptor) {
+            return [];
+        }
+        if (descriptor.credentialsResolvedExternally) {
+            return [];
+        }
+        const { apiKey, extraRequired } = descriptor.envVars;
+        return [...(apiKey ? [apiKey] : []), ...(extraRequired ?? [])];
     }
     /**
-     * Get API key environment variable for a provider
+     * Get API key environment variable for a provider.
+     *
+     * Dead code at its sole call site today (checkApiKeyValidity() early-
+     * returns for VERTEX/OLLAMA/BEDROCK/LITELLM before reaching this), but
+     * now `static` (public) so a future direct caller is plausible — hence
+     * the two intentional diffs from the original hand-written switch are
+     * documented here rather than left silent:
+     *   - vertex: old switch returned "GOOGLE_APPLICATION_CREDENTIALS"
+     *     (one of several valid auth vars); the descriptor's `envVars.apiKey`
+     *     is "GOOGLE_CLOUD_PROJECT_ID" instead — the actual identity var for
+     *     the provider, not one specific credential-supply mechanism.
+     *   - ollama: old switch returned "OLLAMA_BASE_URL"; the descriptor has
+     *     no `envVars.apiKey` for ollama (it's a local, unauthenticated
+     *     runtime), so this now returns "".
+     * Both are kept deliberately (semantically truer identity vars) rather
+     * than reproduced byte-for-byte from the old switch.
      */
     static getApiKeyEnvironmentVariable(providerName) {
-        switch (providerName) {
-            case AIProviderName.ANTHROPIC:
-                return "ANTHROPIC_API_KEY";
-            case AIProviderName.OPENAI:
-                return "OPENAI_API_KEY";
-            case AIProviderName.VERTEX:
-                return "GOOGLE_APPLICATION_CREDENTIALS";
-            case AIProviderName.GOOGLE_AI:
-                return "GOOGLE_AI_API_KEY";
-            case AIProviderName.BEDROCK:
-                return "AWS_ACCESS_KEY_ID";
-            case AIProviderName.AZURE:
-                return "AZURE_OPENAI_API_KEY";
-            case AIProviderName.LITELLM:
-                return "LITELLM_API_KEY";
-            case AIProviderName.OLLAMA:
-                return "OLLAMA_BASE_URL";
-            default:
-                return "";
-        }
+        return ProviderFactory.getDescriptor(providerName)?.envVars.apiKey ?? "";
     }
     /**
      * Validate API key format for a provider
      */
     static validateApiKeyFormat(providerName, apiKey) {
-        switch (providerName) {
-            case AIProviderName.ANTHROPIC:
-                return (apiKey.startsWith("sk-ant-") &&
-                    apiKey.length >= API_KEY_LENGTHS.ANTHROPIC_MIN);
-            case AIProviderName.OPENAI:
-                return (apiKey.startsWith("sk-") &&
-                    apiKey.length >= API_KEY_LENGTHS.OPENAI_MIN);
-            case AIProviderName.GOOGLE_AI:
-                return apiKey.length >= API_KEY_LENGTHS.GOOGLE_AI_EXACT; // Basic length check
-            case AIProviderName.VERTEX:
-                return apiKey.endsWith(".json") || apiKey.includes("type"); // JSON key format
-            case AIProviderName.BEDROCK:
-                return apiKey.length >= API_KEY_LENGTHS.AWS_ACCESS_KEY; // AWS access key length
-            case AIProviderName.AZURE:
-                return apiKey.length >= API_KEY_LENGTHS.AZURE_MIN; // Azure OpenAI API key length
-            case AIProviderName.LITELLM:
-                return apiKey.length > 0;
-            case AIProviderName.OLLAMA:
-                return true; // Ollama usually doesn't require specific format
-            default:
-                return true; // Default to true for unknown providers
+        // Vertex's "API key" is really a credentials file path (or an inline
+        // JSON blob via GOOGLE_SERVICE_ACCOUNT_KEY) — never governed by the
+        // shared API_KEY_FORMATS regexes. Preserved exactly from the original
+        // switch even though checkApiKeyValidity() early-returns before ever
+        // reaching this call for Vertex today; kept correct for any other/
+        // future caller.
+        if (providerName === AIProviderName.VERTEX) {
+            return apiKey.endsWith(".json") || apiKey.includes("type");
+        }
+        const descriptor = ProviderFactory.getDescriptor(providerName);
+        if (!descriptor?.apiKeyFormatPattern) {
+            // Providers with no documented format (or local runtimes / providers
+            // usable with zero configuration) are accepted as-is — matches the
+            // old switch's per-provider `default: true`/no-format-check branches
+            // (ollama, litellm).
+            if (descriptor?.localRuntime || descriptor?.envVars.optional) {
+                return true;
+            }
+            return apiKey.length > 0;
         }
+        return descriptor.apiKeyFormatPattern.test(apiKey);
     }
     /**
      * Get health check endpoint for connectivity testing
      */
     static getProviderHealthEndpoint(providerName) {
-        switch (providerName) {
-            case AIProviderName.ANTHROPIC:
-                return null; // Anthropic doesn't have a public health endpoint
+        const descriptor = ProviderFactory.getDescriptor(providerName);
+        if (descriptor?.healthCheck !== "models-probe") {
+            return null;
+        }
+        // OpenAI/LiteLLM/Ollama each need a provider-specific URL builder that
+        // isn't pure descriptor data (LiteLLM/Ollama depend on the configured
+        // base URL) — keep the existing per-provider dispatch for the 3
+        // models-probe providers, now gated on the descriptor instead of a
+        // hardcoded name list.
+        switch (descriptor.name) {
             case AIProviderName.OPENAI:
                 return "https://api.openai.com/v1/models";
-            case AIProviderName.GOOGLE_AI:
-                return null; // No public health endpoint
-            case AIProviderName.VERTEX:
-                return null; // Complex authentication required
-            case AIProviderName.BEDROCK:
-                return null; // AWS endpoints vary by region
             case AIProviderName.LITELLM:
                 return this.getLiteLLMModelsUrl();
             case AIProviderName.OLLAMA:
@@ -525,11 +512,11 @@ export class ProviderHealthChecker {
             hasValidAuth = await this.checkGoogleApplicationCredentials(healthStatus);
         }
         if (!hasValidAuth) {
-            hasValidAuth = this.checkIndividualGoogleCredentials(healthStatus);
+            hasValidAuth = this.checkExtraRequiredFallbackCredentials(healthStatus);
         }
         if (!hasValidAuth) {
             healthStatus.configurationIssues.push("Google Cloud authentication not configured or credentials file missing");
-            healthStatus.recommendations.push("Set either GOOGLE_APPLICATION_CREDENTIALS (valid file path), GOOGLE_SERVICE_ACCOUNT_KEY (base64), or both GOOGLE_AUTH_CLIENT_EMAIL and GOOGLE_AUTH_PRIVATE_KEY");
+            healthStatus.recommendations.push("Set either GOOGLE_APPLICATION_CREDENTIALS (valid file path), GOOGLE_APPLICATION_CREDENTIALS_NEUROLINK, GOOGLE_SERVICE_ACCOUNT_KEY (base64), or both GOOGLE_AUTH_CLIENT_EMAIL and GOOGLE_AUTH_PRIVATE_KEY");
         }
         return hasValidAuth;
     }
@@ -561,13 +548,20 @@ export class ProviderHealthChecker {
         }
     }
     /**
-     * Check individual Google credentials
+     * Check Vertex's non-file auth fallbacks (GOOGLE_APPLICATION_CREDENTIALS_
+     * NEUROLINK, GOOGLE_SERVICE_ACCOUNT_KEY, or the GOOGLE_AUTH_CLIENT_EMAIL +
+     * GOOGLE_AUTH_PRIVATE_KEY pair) via the descriptor's extraRequiredFallbacks
+     * instead of a hand-maintained env-var list, so this stays in sync with
+     * the real gating logic (hasGoogleCredentials()) the same way
+     * checkApiKeyValidity()'s vertex branch does. The previous hand-rolled
+     * version only recognized GOOGLE_SERVICE_ACCOUNT_KEY or the email+key
+     * pair — missing GOOGLE_APPLICATION_CREDENTIALS_NEUROLINK, the
+     * descriptor's documented first-priority fallback.
      */
-    static checkIndividualGoogleCredentials(healthStatus) {
-        const hasServiceAccountKey = !!process.env.GOOGLE_SERVICE_ACCOUNT_KEY;
-        const hasIndividualCredentials = !!(process.env.GOOGLE_AUTH_CLIENT_EMAIL &&
-            process.env.GOOGLE_AUTH_PRIVATE_KEY);
-        if (hasServiceAccountKey || hasIndividualCredentials) {
+    static checkExtraRequiredFallbackCredentials(healthStatus) {
+        const descriptor = ProviderFactory.getDescriptor(AIProviderName.VERTEX);
+        const hasValidAuth = satisfiesFallbacks(descriptor?.envVars.extraRequiredFallbacks, process.env);
+        if (hasValidAuth) {
             healthStatus.hasApiKey = true;
             return true;
         }

package/dist/utils/providerUtils.js

@@ -6,8 +6,10 @@ import { AIProviderFactory } from "../core/factory.js";
 import { logger } from "./logger.js";
 import { AIProviderName } from "../constants/enums.js";
 import { ProviderHealthChecker } from "./providerHealth.js";
-import { API_KEY_FORMATS, API_KEY_LENGTHS, PROJECT_ID_FORMAT, } from "./providerConfig.js";
+import { API_KEY_FORMATS, API_KEY_LENGTHS, PROJECT_ID_FORMAT, satisfiesFallbacks, } from "./providerConfig.js";
 import { DEFAULT_OLLAMA_MODEL } from "../providers/ollama/constants.js";
+import { ProviderFactory } from "../factories/providerFactory.js";
+import { PROVIDER_DESCRIPTORS } from "../factories/providerDescriptors.js";
 /**
  * Get the best available provider based on real-time availability checks
  * Enhanced version consolidated from providerUtils-fixed.ts
@@ -60,18 +62,9 @@ export async function getBestProvider(requestedProvider) {
      * - Other providers are ordered based on a combination of reliability, feature set, and historical performance.
      * Please update this comment if the order is changed in the future, and document the rationale for maintainability.
      */
-    const providers = [
-        "litellm", // Prioritize self-hosted proxy deployments first
-        "ollama", // Local models when the configured runtime target is installed
-        "vertex", // Google Cloud AI (enterprise)
-        "google-ai", // Google AI ecosystem support
-        "openai", // Reliable with broad model support
-        "anthropic",
-        "bedrock",
-        "azure",
-        "mistral",
-        "huggingface",
-    ];
+    const providers = PROVIDER_DESCRIPTORS.filter((d) => d.autoSelectPriority !== undefined)
+        .sort((a, b) => (a.autoSelectPriority ?? 0) - (b.autoSelectPriority ?? 0))
+        .map((d) => d.name);
     for (const provider of providers) {
         if (await isProviderAvailable(provider)) {
             logger.debug(`[getBestProvider] Selected provider: ${provider}`);
@@ -332,64 +325,29 @@ function isValidUrl(url) {
  * @returns True if the provider has required environment variables
  */
 export function hasProviderEnvVars(provider) {
-    switch (provider.toLowerCase()) {
-        case "bedrock":
-        case "amazon":
-        case "aws":
-            return !!(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY);
-        case "vertex":
-        case "googlevertex":
-        case "google":
-        case "gemini":
-            return !!((process.env.GOOGLE_CLOUD_PROJECT_ID ||
-                process.env.VERTEX_PROJECT_ID ||
-                process.env.GOOGLE_VERTEX_PROJECT ||
-                process.env.GOOGLE_CLOUD_PROJECT) &&
-                (process.env.GOOGLE_APPLICATION_CREDENTIALS ||
-                    process.env.GOOGLE_SERVICE_ACCOUNT_KEY ||
-                    (process.env.GOOGLE_AUTH_CLIENT_EMAIL &&
-                        process.env.GOOGLE_AUTH_PRIVATE_KEY)));
-        case "openai":
-        case "gpt":
-            return !!process.env.OPENAI_API_KEY;
-        case "anthropic":
-        case "claude":
-            return !!process.env.ANTHROPIC_API_KEY;
-        case "azure":
-        case "azureopenai":
-            return !!process.env.AZURE_OPENAI_API_KEY;
-        case "google-ai":
-        case "google-studio":
-            return !!(process.env.GOOGLE_AI_API_KEY ||
-                process.env.GOOGLE_GENERATIVE_AI_API_KEY);
-        case "huggingface":
-        case "hugging-face":
-        case "hf":
-            return !!(process.env.HUGGINGFACE_API_KEY || process.env.HF_TOKEN);
-        case "ollama":
-        case "local":
-        case "local-ollama":
-            // For Ollama, we check if the service is potentially available
-            // This is a basic check - actual connectivity will be verified during usage
-            return true; // Ollama doesn't require environment variables, just local service
-        case "mistral":
-        case "mistral-ai":
-        case "mistralai":
-            return !!process.env.MISTRAL_API_KEY;
-        case "litellm":
-            // LiteLLM requires a proxy server, which can be checked for availability
-            // Default base URL is assumed, or can be configured via environment
-            return true; // LiteLLM proxy availability will be checked during usage
-        default:
-            return false;
+    const descriptor = ProviderFactory.getDescriptor(provider);
+    if (!descriptor) {
+        return false;
+    }
+    if (descriptor.envVars.optional || descriptor.localRuntime) {
+        // Ollama / LiteLLM / LM Studio / llama.cpp: usable with defaults.
+        return true;
+    }
+    const { apiKey, fallbacks, extraRequired, extraRequiredFallbacks } = descriptor.envVars;
+    const hasPrimary = !!apiKey &&
+        (!!process.env[apiKey] || (fallbacks ?? []).some((v) => !!process.env[v]));
+    if (!hasPrimary) {
+        return false;
     }
+    return ((extraRequired ?? []).every((v) => !!process.env[v]) ||
+        satisfiesFallbacks(extraRequiredFallbacks, process.env));
 }
 /**
  * Get available provider names
  * @returns Array of available provider names
  */
 export function getAvailableProviders() {
-    return Object.values(AIProviderName).filter((name) => name !== AIProviderName.AUTO);
+    return PROVIDER_DESCRIPTORS.map((d) => d.name);
 }
 /**
  * Validate provider name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "11.0.0",
+  "version": "11.1.1",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {
@@ -71,26 +71,19 @@
     "test": "npx tsx test/continuous-test-suite.ts",
     "test:client": "npx tsx test/continuous-test-suite-client.ts",
     "test:context": "npx tsx test/continuous-test-suite-context.ts",
-    "test:cache": "npx tsx test/continuous-test-suite-cache-breakpoints.ts",
     "test:evaluation": "npx tsx test/continuous-test-suite-evaluation.ts",
     "test:mcp": "npx tsx test/continuous-test-suite-mcp-infra.ts",
     "test:tool-resolution": "npx tsx test/continuous-test-suite-tool-resolution.ts",
     "test:mcp:http": "npx tsx test/continuous-test-suite-mcp-http.ts",
     "test:mcp:sdk": "npx tsx test/continuous-test-suite-mcp-sdk.ts",
     "test:mcp:cli": "npx tsx test/continuous-test-suite-mcp-cli.ts",
-    "test:mcp:full": "pnpm run test:mcp:infra && pnpm run test:mcp:bash && pnpm run test:mcp:limits && pnpm run test:mcp:spans && pnpm run test:mcp:sdk && pnpm run test:mcp:cli && pnpm run test:mcp:http",
+    "test:mcp:full": "pnpm run test:mcp:infra && pnpm run test:mcp:spans && pnpm run test:mcp:sdk && pnpm run test:mcp:cli && pnpm run test:mcp:http",
     "test:media": "npx tsx test/continuous-test-suite-media-gen.ts",
-    "test:litellm-parity": "npx tsx test/continuous-test-suite-litellm-parity.ts",
     "test:memory": "npx tsx test/continuous-test-suite-memory.ts",
-    "test:tool-pairing": "npx tsx test/continuous-test-suite-tool-pairing.ts",
-    "test:token-accounting": "npx tsx test/continuous-test-suite-token-accounting.ts",
-    "test:step-guard": "npx tsx test/continuous-test-suite-step-guard.ts",
-    "test:loop-guard-core": "npx tsx test/continuous-test-suite-loop-guard-core.ts",
-    "test:openai-compat-guard": "npx tsx test/continuous-test-suite-openai-compat-guard.ts",
-    "test:anthropic-guard": "npx tsx test/continuous-test-suite-anthropic-guard.ts",
-    "test:tool-storage-parity": "npx tsx test/continuous-test-suite-tool-storage-parity.ts",
-    "test:redis-append-only": "npx tsx test/continuous-test-suite-redis-append-only.ts",
-    "test:gemini-guard": "npx tsx test/continuous-test-suite-gemini-guard.ts",
+    "test:openai-compat-streaming-retry": "npx tsx test/continuous-test-suite-openai-compat-streaming-retry.ts",
+    "test:anthropic-streaming-retry": "npx tsx test/continuous-test-suite-anthropic-streaming-retry.ts",
+    "test:error-classification-e2e": "npx tsx test/continuous-test-suite-error-classification-e2e.ts",
+    "test:error-classifier-contract": "npx tsx test/continuous-test-suite-error-classifier-contract.ts",
     "test:middleware": "npx tsx test/continuous-test-suite-middleware.ts",
     "test:observability": "npx tsx test/continuous-test-suite-observability.ts",
     "test:ppt": "npx tsx test/continuous-test-suite-ppt.ts",
@@ -99,74 +92,40 @@
     "test:matrix": "npx tsx test/continuous-test-suite-provider-matrix.ts",
     "test:matrix:cli": "npx tsx test/continuous-test-suite-provider-matrix-cli.ts",
     "test:mcp:spans": "npx tsx test/continuous-test-suite-mcp-spans.ts",
-    "test:mcp:bash": "npx tsx test/continuous-test-suite-mcp-bash.ts",
-    "test:mcp:limits": "npx tsx test/continuous-test-suite-mcp-output-limits.ts",
     "test:mcp:infra": "npx tsx test/continuous-test-suite-mcp-infra.ts",
     "test:providers-mocked": "npx tsx test/continuous-test-suite-providers-mocked.ts",
+    "test:provider-descriptors": "npx tsx test/continuous-test-suite-provider-descriptors.ts",
     "test:provider-structure": "npx tsx test/continuous-test-suite-provider-structure.ts",
     "test:provider-fallback": "npx tsx test/continuous-test-suite-provider-fallback.ts",
     "test:provider-fallback-latency": "npx tsx test/continuous-test-suite-provider-fallback-latency.ts",
     "test:provider-wiring": "npx tsx test/continuous-test-suite-provider-wiring.ts",
     "test:rag": "npx tsx test/continuous-test-suite-rag.ts",
-    "test:vector-pinecone": "npx tsx test/continuous-test-suite-vector-pinecone.ts",
-    "test:vector-pgvector": "npx tsx test/continuous-test-suite-vector-pgvector.ts",
-    "test:vector-chroma": "npx tsx test/continuous-test-suite-vector-chroma.ts",
     "test:skills": "npx tsx test/continuous-test-suite-skills.ts",
     "test:servers": "npx tsx test/continuous-test-suite-servers.ts",
     "test:tool-reliability": "npx tsx test/continuous-test-suite-tool-reliability.ts",
-    "test:google-native": "npx tsx test/continuous-test-suite-google-native.ts",
-    "test:gemini-abort": "npx tsx test/continuous-test-suite-gemini-abort.ts",
-    "test:anthropic-cap": "npx tsx test/continuous-test-suite-anthropic-cap.ts",
-    "test:token-usage": "npx tsx test/continuous-test-suite-token-usage.ts",
     "test:tts": "npx tsx test/continuous-test-suite-tts.ts",
     "test:voice": "npx tsx test/continuous-test-suite-voice.ts",
-    "test:voice-server": "npx tsx test/continuous-test-suite-voice-server.ts",
     "test:avatar": "npx tsx test/continuous-test-suite-avatar.ts",
     "test:music": "npx tsx test/continuous-test-suite-music.ts",
     "test:image-gen": "npx tsx test/continuous-test-suite-image-gen-extras.ts",
-    "test:ssrf": "npx tsx test/continuous-test-suite-ssrf.ts",
-    "test:log-sanitize": "npx tsx test/continuous-test-suite-log-sanitize.ts",
-    "test:sse-client": "npx tsx test/continuous-test-suite-sse-client.ts",
-    "test:stream-span": "npx tsx test/continuous-test-suite-stream-span.ts",
-    "test:vertex-langfuse-spans": "npx tsx test/continuous-test-suite-vertex-langfuse-spans.ts",
     "test:credentials": "npx tsx test/continuous-test-suite-credentials.ts",
     "test:dynamic": "npx tsx test/continuous-test-suite-dynamic.ts",
     "test:proxy": "npx tsx test/continuous-test-suite-proxy.ts",
     "test:bugfixes": "npx tsx test/continuous-test-suite-bugfixes.ts",
-    "test:file-detector-extension": "npx tsx test/continuous-test-suite-file-detector-extension.ts",
-    "test:file-detector-magic-bytes": "npx tsx test/continuous-test-suite-file-detector-magic-bytes.ts",
-    "test:json": "npx tsx test/continuous-test-suite-json.ts",
     "test:json-e2e": "npx tsx test/continuous-test-suite-json-e2e.ts",
     "test:workflow": "npx tsx test/continuous-test-suite-workflow.ts",
     "test:hitl": "npx tsx test/continuous-test-suite-hitl.ts",
-    "test:analytics": "npx tsx test/continuous-test-suite-analytics.ts",
     "test:tasks": "npx tsx test/continuous-test-suite-tasks.ts",
     "test:auth": "npx tsx test/continuous-test-suite-auth.ts",
     "test:autoresearch": "npx tsx test/continuous-test-suite-autoresearch.ts",
-    "test:autoresearch:redis": "npx tsx test/continuous-test-suite-autoresearch-redis.ts",
-    "test:anthropic-tools-policy": "npx tsx test/continuous-test-suite-anthropic-tools-policy.ts",
-    "test:anthropic-structured": "npx tsx test/continuous-test-suite-anthropic-structured-tools.ts",
-    "test:sagemaker-tools": "npx tsx test/continuous-test-suite-sagemaker-tools.ts",
-    "test:anthropic-multimodal": "npx tsx test/continuous-test-suite-anthropic-multimodal.ts",
-    "test:unified-files-prompt-sync": "npx tsx test/continuous-test-suite-unified-files-prompt-sync.ts",
-    "test:excel-interop": "npx tsx test/continuous-test-suite-excel-interop.ts",
-    "test:envguard": "npx tsx test/helpers/envGuard.test.ts",
-    "test:tool-routing-cli": "npx tsx test/continuous-test-suite-tool-routing-flags.ts && npx tsx test/continuous-test-suite-tool-routing-cli.ts",
+    "test:tool-routing-cli": "npx tsx test/continuous-test-suite-tool-routing-cli.ts",
     "test:tool-dedup": "npx tsx test/continuous-test-suite-tool-dedup.ts",
-    "test:model-pool": "npx tsx test/continuous-test-suite-model-pool.ts",
     "test:model-not-found-retryable": "npx tsx test/continuous-test-suite-model-not-found-retryable.ts",
-    "test:model-capabilities": "npx tsx test/continuous-test-suite-model-capabilities.ts",
-    "test:agent-runtime:vitest": "pnpm exec vitest run test/agentRuntime.test.ts",
-    "test:retry-after:vitest": "pnpm exec vitest run test/retryAfter.test.ts",
-    "test:websearch-grounding": "npx tsx test/continuous-test-suite-websearch-grounding.ts",
     "test:ci": "pnpm run test && pnpm run test:client && pnpm run test:hitl",
     "// CI tier — fast, no live AI calls, safe for every commit (test:unit; also see the separate provider-safety-net CI job, which runs build + test:providers-mocked + test:provider-structure on every PR)": "",
     "test:tool-routing": "npx tsx test/continuous-test-suite-tool-routing.ts",
-    "test:classifier-router": "npx tsx test/continuous-test-suite-classifier-router.ts",
-    "test:system-messages": "npx tsx test/continuous-test-suite-system-messages.ts",
-    "test:test-stubs": "npx tsx test/continuous-test-suite-test-stubs.ts",
     "test:tool-routing-semantic": "npx tsx test/continuous-test-suite-tool-routing-semantic.ts",
-    "test:unit": "pnpm run test:envguard && pnpm run test:bugfixes && pnpm run test:file-detector-extension && pnpm run test:file-detector-magic-bytes && pnpm run test:mcp:infra && pnpm run test:mcp:bash && pnpm run test:mcp:limits && pnpm run test:mcp:spans && pnpm run test:autoresearch:redis && pnpm run test:tool-routing && pnpm run test:tool-routing-cli && pnpm run test:tool-dedup && pnpm run test:model-pool && pnpm run test:litellm-context && pnpm run test:dedup-execute-map && pnpm run test:step-budget-guard && pnpm run test:agent-plumbing && pnpm run test:tool-execution-recorder && pnpm run test:proxy-terminal-errors && pnpm run test:proxy-usage-refresh && pnpm run test:system-messages && pnpm run test:tool-routing-semantic && pnpm run test:anthropic-tools-policy && pnpm run test:anthropic-structured && pnpm run test:sagemaker-tools && pnpm run test:anthropic-multimodal && pnpm run test:unified-files-prompt-sync && pnpm run test:excel-interop && pnpm run test:model-capabilities && pnpm run test:agent-runtime:vitest && pnpm run test:agent-delegation && pnpm run test:retry-after:vitest && pnpm run test:sampling-params && pnpm run test:structured-recovery && pnpm run test:prompt-redaction && pnpm run test:mcp-result-cache && pnpm run test:test-stubs && pnpm run test:model-not-found-retryable && pnpm run test:websearch-grounding && pnpm run test:archive:security && pnpm run test:office:security && pnpm run test:proxy:vitest && pnpm run test:provider-wiring",
+    "test:unit": "pnpm run test:bugfixes && pnpm run test:mcp:infra && pnpm run test:mcp:spans && pnpm run test:tool-routing && pnpm run test:tool-routing-cli && pnpm run test:tool-dedup && pnpm run test:model-pool && pnpm run test:tool-routing-semantic && pnpm run test:mcp-result-cache && pnpm run test:model-not-found-retryable && pnpm run test:archive:security && pnpm run test:office:security && pnpm run test:vector-chroma && pnpm run test:vector-pgvector && pnpm run test:vector-pinecone && pnpm run test:provider-wiring",
     "// CI tier — live providers, runs only when API keys are present (test:credentials and test:dynamic make real provider calls when keys are set, so they live here, not in test:unit; test:matrix, a different suite covering the full provider capability matrix, runs nightly via .github/workflows/live-matrix.yml — test:providers itself is still only wired into test:live, not any GitHub Actions workflow)": "",
     "test:live": "pnpm run test:providers && pnpm run test:mcp:http && pnpm run test:mcp:sdk && pnpm run test:mcp:cli && pnpm run test:observability && pnpm run test:context && pnpm run test:memory && pnpm run test:tool-reliability && pnpm run test:evaluation && pnpm run test:autoresearch && pnpm run test:credentials && pnpm run test:dynamic",
     "// CI tier — product output (image/video/TTS/PPT) — costs $$ per run (not wired into any GitHub Actions workflow as of this comment; run manually or add to live-matrix.yml if nightly coverage is needed)": "",
@@ -228,30 +187,16 @@
     "pre-commit": "lint-staged",
     "pre-push": "pnpm run build && pnpm run test:providers-mocked && pnpm run test:provider-structure",
     "check:all": "pnpm run lint && pnpm run format --check && pnpm run validate && pnpm run validate:commit",
-    "test:litellm-context": "npx tsx test/continuous-test-suite-litellm-context-windows.ts",
-    "test:dedup-execute-map": "npx tsx test/continuous-test-suite-dedup-execute-map.ts",
-    "test:agent-delegation": "npx tsx test/continuous-test-suite-agent-delegation.ts",
-    "test:step-budget-guard": "npx tsx test/continuous-test-suite-step-budget-guard.ts",
-    "test:agent-plumbing": "npx tsx test/continuous-test-suite-agent-plumbing.ts",
-    "test:tool-execution-recorder": "npx tsx test/continuous-test-suite-tool-execution-recorder.ts",
-    "test:proxy-terminal-errors": "npx tsx test/continuous-test-suite-proxy-terminal-errors.ts",
-    "test:proxy-limit-headers": "npx tsx test/continuous-test-suite-proxy-limit-headers.ts",
-    "test:proxy-usage-refresh": "npx tsx test/continuous-test-suite-proxy-usage-refresh.ts",
-    "test:proxy:vitest": "pnpm exec vitest run test/proxyAnalysis.test.ts test/proxyConfigHotReload.test.ts test/proxyObservabilityFoundation.test.ts test/proxyReliabilityHardening.test.ts test/proxyReplay.test.ts test/proxyRollingWorkerHandoff.test.ts test/proxyTestIsolation.test.ts test/proxyUpdaterFallback.test.ts test/proxyUsageStatsPersistence.test.ts",
-    "test:anthropic-limit-capture": "npx tsx test/continuous-test-suite-anthropic-limit-capture.ts",
-    "test:audio": "npx tsx test/continuous-test-suite-audio.ts",
     "test:file-formats": "npx tsx test/continuous-test-suite-file-formats.ts",
-    "test:office": "npx tsx test/continuous-test-suite-office.ts",
-    "test:tts:unit": "npx tsx test/continuous-test-suite-tts-unit.ts",
-    "test:video": "npx tsx test/continuous-test-suite-video.ts",
-    "test:multimodal": "pnpm run test:file-formats && pnpm run test:audio && pnpm run test:video && pnpm run test:office && pnpm run test:tts:unit && pnpm run test:multimodal:sdk",
+    "test:multimodal": "pnpm run test:file-formats && pnpm run test:multimodal:sdk",
     "test:multimodal:sdk": "npx tsx test/continuous-test-suite-multimodal-sdk.ts",
-    "test:sampling-params": "npx tsx test/continuous-test-suite-sampling-params.ts",
-    "test:structured-recovery": "npx tsx test/continuous-test-suite-structured-recovery.ts",
-    "test:prompt-redaction": "npx tsx test/continuous-test-suite-prompt-redaction.ts",
     "test:mcp-result-cache": "npx tsx test/continuous-test-suite-mcp-result-cache.ts",
     "test:archive:security": "npx tsx test/continuous-test-suite-archive-security.ts",
-    "test:office:security": "npx tsx test/continuous-test-suite-office-security.ts"
+    "test:office:security": "npx tsx test/continuous-test-suite-office-security.ts",
+    "test:model-pool": "npx tsx test/continuous-test-suite-model-pool.ts",
+    "test:vector-chroma": "npx tsx test/continuous-test-suite-vector-chroma.ts",
+    "test:vector-pgvector": "npx tsx test/continuous-test-suite-vector-pgvector.ts",
+    "test:vector-pinecone": "npx tsx test/continuous-test-suite-vector-pinecone.ts"
   },
   "files": [
     "dist",