@knowzai/cli 0.1.0

package/dist/lib/platform-provider-probe.js

@@ -0,0 +1,781 @@
+import { registerSecret, validateCloudAiKeyFormat } from '@knowzai/core';
+import { createSign } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { normalizeAzureOpenAiEndpoint } from './platform-runtime.js';
+import { KNOWZ_CLOUD_ENDPOINT } from './provider-presets.js';
+/** Bounded, secret-safe model discovery for the managed Knowz Cloud preset. */
+export async function discoverKnowzCloudModels(credential, deps = {}) {
+    const empty = (warning) => ({ chatModels: [], embeddingModels: [], warning });
+    if (!validateCloudAiKeyFormat(credential).ok)
+        return empty('A valid Knowz Cloud AI key is required for model discovery.');
+    registerSecret(credential);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), Math.min(15_000, Math.max(1, deps.timeoutMs ?? 5_000)));
+    try {
+        const response = await (deps.fetchFn ?? globalThis.fetch)(`${KNOWZ_CLOUD_ENDPOINT}/models`, {
+            method: 'GET', redirect: 'manual', signal: controller.signal,
+            headers: { authorization: `Bearer ${credential}`, accept: 'application/json' },
+        });
+        if (!response.ok) {
+            if (response.status === 402)
+                return empty('Knowz Cloud credits are exhausted; choose models manually after topping up.');
+            if (response.status === 404)
+                return empty('Knowz Cloud AI is not enabled or the model catalog is unavailable; enter model names manually.');
+            if (response.status === 401 || response.status === 403)
+                return empty('Knowz Cloud authentication failed; verify the AI key.');
+            return empty(`Knowz Cloud model discovery returned HTTP ${response.status}; enter model names manually.`);
+        }
+        const body = await readCappedJson(response, 64 * 1024, controller.signal);
+        const data = body && typeof body === 'object' && !Array.isArray(body)
+            ? body.data
+            : undefined;
+        if (!Array.isArray(data))
+            return empty('Knowz Cloud returned an invalid model catalog; enter model names manually.');
+        const chatModels = [];
+        const embeddingModels = [];
+        for (const item of data) {
+            if (!item || typeof item !== 'object' || Array.isArray(item))
+                continue;
+            const row = item;
+            let id;
+            try {
+                id = validateModelName(row.id);
+            }
+            catch {
+                continue;
+            }
+            const capabilities = Array.isArray(row.capabilities)
+                ? row.capabilities.filter((value) => typeof value === 'string')
+                : [];
+            if (capabilities.includes('embeddings'))
+                embeddingModels.push(id);
+            if (capabilities.includes('chat.completions'))
+                chatModels.push(id);
+        }
+        if (chatModels.length === 0 || embeddingModels.length === 0) {
+            return { chatModels, embeddingModels, warning: 'Knowz Cloud did not advertise both chat and embedding models; enter missing model names manually.' };
+        }
+        return { chatModels, embeddingModels };
+    }
+    catch {
+        return empty('Knowz Cloud model discovery could not reach the gateway; enter model names manually.');
+    }
+    finally {
+        clearTimeout(timeout);
+        controller.abort();
+    }
+}
+// Keep these in sync with Knowz.Shared AiModelDefaults.cs. They are deliberately server-owned:
+// the setup browser cannot submit an arbitrary Azure deployment name or prompt.
+export const AZURE_CHAT_DEPLOYMENTS = ['gpt-5.4-mini', 'gpt-5.4'];
+// Portable Azure is pinned to a 1536-native embedding model — text-embedding-3-large (3072) is
+// intentionally excluded (the transport does not truncate). See FEAT_PortableEmbeddingGuardrails.
+export const AZURE_EMBEDDING_DEPLOYMENTS = ['text-embedding-3-small'];
+export const AZURE_MODEL_API_VERSION = '2025-04-01-preview';
+// Keep these pinned to ConfigurationKeys.Vertex.DefaultChatModel and the portable runtime embedding default.
+export const VERTEX_CHAT_DEFAULT = 'gemini-2.5-flash';
+export const VERTEX_EMBEDDING_DEFAULT = 'gemini-embedding-001';
+// Re-exported from provider-presets (defined there to avoid a probe->presets->probe cycle) so the
+// setup page + prompt import all model defaults from one place.
+export { QWEN3_EMBEDDING_DEFAULT, QWEN3_EMBEDDING_DIMENSIONS } from './provider-presets.js';
+export const PROBE_VISION_PNG_BASE64 = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=';
+// `:` is Ollama's tag separator (llama3.2:1b). `/` stays REJECTED by contract —
+// model names reach URL paths and the path-unsafe fixtures pin that. (Vertex
+// publisher prefixes like google/gemini-… are stripped before validation;
+// namespaced Ollama models are a tracked follow-up.)
+const MODEL_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$/;
+const VERTEX_REGION_PATTERN = /^[a-z][a-z0-9-]{1,30}$/;
+const VERTEX_PROJECT_PATTERN = /^[a-z][a-z0-9-]{4,29}$/;
+// Must fit a full-dimension embedding response: gemini-embedding-001 returns
+// 3072 floats ≈ 100KB of JSON (observed 101,336 bytes live). Still a hard
+// bound on endpoint-controlled data — just one that legitimate embedding
+// probes cannot exceed.
+const MODEL_RESPONSE_LIMIT = 256 * 1024;
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const GOOGLE_CLOUD_SCOPE = 'https://www.googleapis.com/auth/cloud-platform';
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function base64UrlJson(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+function serviceAccountAssertion(adc) {
+    const clientEmail = typeof adc.client_email === 'string' ? adc.client_email : undefined;
+    const privateKey = typeof adc.private_key === 'string' ? adc.private_key : undefined;
+    if (!clientEmail || !privateKey)
+        return undefined;
+    registerSecret(privateKey);
+    const issuedAt = Math.floor(Date.now() / 1_000);
+    const header = base64UrlJson({ alg: 'RS256', typ: 'JWT' });
+    const payload = base64UrlJson({
+        iss: clientEmail,
+        scope: GOOGLE_CLOUD_SCOPE,
+        aud: GOOGLE_TOKEN_URL,
+        iat: issuedAt,
+        exp: issuedAt + 3_600,
+    });
+    const signer = createSign('RSA-SHA256');
+    signer.update(`${header}.${payload}`);
+    signer.end();
+    return `${header}.${payload}.${signer.sign(privateKey).toString('base64url')}`;
+}
+function tokenRequestBody(adc) {
+    if (adc.type === 'service_account') {
+        const assertion = serviceAccountAssertion(adc);
+        if (!assertion)
+            return undefined;
+        return new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion,
+        });
+    }
+    if (adc.type === 'authorized_user') {
+        const clientId = typeof adc.client_id === 'string' ? adc.client_id : undefined;
+        const clientSecret = typeof adc.client_secret === 'string' ? adc.client_secret : undefined;
+        const refreshToken = typeof adc.refresh_token === 'string' ? adc.refresh_token : undefined;
+        if (!clientId || !clientSecret || !refreshToken)
+            return undefined;
+        registerSecret(clientSecret);
+        registerSecret(refreshToken);
+        return new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: clientId,
+            client_secret: clientSecret,
+            refresh_token: refreshToken,
+        });
+    }
+    return undefined;
+}
+async function mintGoogleAccessToken(requestBody, fetchFn, controller) {
+    let response;
+    try {
+        response = await fetchFn(GOOGLE_TOKEN_URL, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: requestBody.toString(),
+            redirect: 'manual',
+            signal: controller.signal,
+        });
+    }
+    catch {
+        return { ok: false, warning: 'Vertex authentication service could not be reached.' };
+    }
+    let body;
+    try {
+        body = await readCappedJson(response, MODEL_RESPONSE_LIMIT, controller.signal);
+    }
+    catch {
+        return { ok: false, warning: 'Authentication failed — check the ADC credentials' };
+    }
+    if (!response.ok)
+        return { ok: false, warning: 'Authentication failed — check the ADC credentials' };
+    const accessToken = record(body)?.access_token;
+    if (typeof accessToken !== 'string' || !accessToken) {
+        return { ok: false, warning: 'Authentication failed — check the ADC credentials' };
+    }
+    registerSecret(accessToken);
+    return { ok: true, accessToken };
+}
+async function probeGcpProvider(selection, deps) {
+    const project = selection.gcp?.project?.trim();
+    const adcPath = selection.gcp?.adcPath?.trim();
+    if (!project || !adcPath) {
+        return { ok: false, warning: 'Add a Vertex project and ADC credentials path to test.' };
+    }
+    let adc;
+    try {
+        const readFileFn = deps.readFileFn ?? ((path) => readFileSync(path, 'utf8'));
+        adc = record(JSON.parse(readFileFn(adcPath)));
+    }
+    catch {
+        return { ok: false, warning: 'ADC credentials file could not be read or parsed.' };
+    }
+    if (!adc)
+        return { ok: false, warning: 'ADC credentials file could not be read or parsed.' };
+    if (adc.type !== 'service_account' && adc.type !== 'authorized_user') {
+        return { ok: false, warning: 'Unsupported ADC credential type.' };
+    }
+    let requestBody;
+    try {
+        requestBody = tokenRequestBody(adc);
+    }
+    catch {
+        return { ok: false, warning: 'ADC credentials file could not be read or parsed.' };
+    }
+    if (!requestBody)
+        return { ok: false, warning: 'ADC credentials file could not be read or parsed.' };
+    const controller = new AbortController();
+    const timeoutMs = Math.min(15_000, Math.max(1, deps.timeoutMs ?? 15_000));
+    const fetchFn = deps.fetchFn ?? globalThis.fetch;
+    let timeout;
+    const run = async () => {
+        const result = await mintGoogleAccessToken(requestBody, fetchFn, controller);
+        return result.ok ? { ok: true } : result;
+    };
+    try {
+        return await Promise.race([
+            run(),
+            new Promise((resolve) => {
+                timeout = setTimeout(() => {
+                    controller.abort();
+                    resolve({ ok: false, timedOut: true, warning: 'Vertex authentication timed out.' });
+                }, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+        controller.abort();
+    }
+}
+export function validateModelName(value) {
+    if (typeof value !== 'string' || !MODEL_NAME_PATTERN.test(value)) {
+        throw new Error('Configured model name contains unsupported characters.');
+    }
+    return value;
+}
+function openAiModelsUrl(endpoint) {
+    const url = new URL(endpoint);
+    const path = url.pathname.replace(/\/$/, '');
+    url.pathname = path.endsWith('/v1') ? `${path}/models` : `${path}/v1/models`;
+    url.search = '';
+    url.hash = '';
+    return url.toString();
+}
+/** Advisory, read-only provider reachability check. It never returns response bodies or raw errors. */
+/**
+ * Azure AI Foundry *project* endpoints (services.ai.azure.com / ai.azure.com) do
+ * not serve the /openai/deployments/... data plane the portable runtime uses —
+ * users must supply the Azure OpenAI *resource* endpoint instead. Detecting the
+ * host here converts a baffling 404 into an actionable message.
+ */
+export function foundryEndpointWarning(endpoint) {
+    if (typeof endpoint !== 'string' || !endpoint.trim())
+        return undefined;
+    try {
+        const host = new URL(endpoint).hostname.toLowerCase();
+        if (host.endsWith('.services.ai.azure.com') || host === 'ai.azure.com' || host.endsWith('.ai.azure.com')) {
+            return 'This looks like an AI Foundry project endpoint — use the Azure OpenAI resource endpoint instead (https://<resource>.openai.azure.com, shown under the resource’s Keys & Endpoint)';
+        }
+    }
+    catch { /* unparsable endpoints fall through to the normal probe error paths */ }
+    return undefined;
+}
+/**
+ * `host.docker.internal` (and `gateway.docker.internal`) name the host from
+ * INSIDE containers — the runtime env needs that spelling, but the setup
+ * probes run on the host itself where those names do not resolve. Rewrite to
+ * loopback for the probe request only; the stored endpoint is untouched.
+ */
+export function hostReachableEndpoint(endpoint) {
+    try {
+        const url = new URL(endpoint);
+        if (url.hostname === 'host.docker.internal' || url.hostname === 'gateway.docker.internal') {
+            url.hostname = '127.0.0.1';
+            return url.toString();
+        }
+    }
+    catch { /* invalid URLs fall through to the normal probe error paths */ }
+    return endpoint;
+}
+export async function probeProvider(selection, deps = {}) {
+    if (selection.provider === 'offline') {
+        return { ok: true, skipped: true };
+    }
+    if (selection.provider === 'gcp')
+        return probeGcpProvider(selection, deps);
+    if (selection.provider === 'azure') {
+        const foundry = foundryEndpointWarning(selection.azure?.endpoint);
+        if (foundry)
+            return { ok: false, warning: foundry, safeDetail: foundry };
+    }
+    const key = selection.provider === 'azure'
+        ? selection.azure?.apiKey
+        : selection.openAiCompatible?.apiKey;
+    if (key)
+        registerSecret(key);
+    const endpoint = selection.provider === 'azure'
+        ? selection.azure?.endpoint
+        : selection.openAiCompatible?.endpoint;
+    if (!endpoint) {
+        return { ok: false, warning: `Provider '${selection.provider}' has no endpoint to validate.` };
+    }
+    const headers = new Headers();
+    if (selection.provider === 'azure' && key)
+        headers.set('api-key', key);
+    if (selection.provider !== 'azure' && key)
+        headers.set('authorization', `Bearer ${key}`);
+    // A bare HEAD on the resource root 404s on healthy Azure OpenAI resources;
+    // the deployments list is the authoritative reachability + auth signal.
+    const url = selection.provider === 'azure'
+        ? azureModelsProbeUrl(normalizeAzureOpenAiEndpoint(endpoint))
+        : openAiModelsUrl(hostReachableEndpoint(endpoint));
+    const controller = new AbortController();
+    const timeoutMs = Math.min(15_000, Math.max(1, deps.timeoutMs ?? 5_000));
+    const fetchFn = deps.fetchFn ?? globalThis.fetch;
+    let timeout;
+    try {
+        const outcome = await Promise.race([
+            fetchFn(url, {
+                method: 'GET',
+                headers,
+                redirect: 'manual',
+                signal: controller.signal,
+            }).then((response) => ({ response })),
+            new Promise((resolve) => {
+                timeout = setTimeout(() => {
+                    controller.abort();
+                    resolve({ timedOut: true });
+                }, timeoutMs);
+            }),
+        ]);
+        if ('timedOut' in outcome) {
+            return {
+                ok: false,
+                timedOut: true,
+                warning: `Provider '${selection.provider}' validation timed out after ${timeoutMs}ms.`,
+            };
+        }
+        if (!outcome.response.ok) {
+            return {
+                ok: false,
+                warning: `Provider '${selection.provider}' validation returned HTTP ${outcome.response.status}.`,
+                // Status code only — no response text — so this may cross to the page.
+                safeDetail: `Provider returned HTTP ${outcome.response.status} at the configured endpoint`,
+            };
+        }
+        return { ok: true };
+    }
+    catch {
+        return { ok: false, warning: `Provider '${selection.provider}' could not be reached.` };
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+        controller.abort();
+    }
+}
+function compatModelUrl(endpoint, route) {
+    const url = new URL(endpoint);
+    const path = url.pathname.replace(/\/$/, '');
+    url.pathname = `${path.endsWith('/v1') ? path : `${path}/v1`}/${route}`;
+    url.search = '';
+    url.hash = '';
+    return url.toString();
+}
+const AZURE_MODELS_API_VERSION = '2024-10-21';
+// GET /openai/models is served by BOTH classic Azure OpenAI resources and the newer
+// Foundry-native resources; the legacy /openai/deployments list API 404s on the latter
+// (observed live 2026-07-18), so it must not be the connection probe.
+function azureModelsProbeUrl(endpoint) {
+    const url = new URL(endpoint);
+    const path = url.pathname.replace(/\/$/, '');
+    url.pathname = `${path}/openai/models`;
+    url.search = '';
+    url.hash = '';
+    url.searchParams.set('api-version', AZURE_MODELS_API_VERSION);
+    return url.toString();
+}
+function azureModelUrl(endpoint, deployment, route) {
+    const url = new URL(normalizeAzureOpenAiEndpoint(endpoint));
+    const path = url.pathname.replace(/\/$/, '');
+    url.pathname = `${path}/openai/deployments/${encodeURIComponent(deployment)}/${route}`;
+    url.search = '';
+    url.hash = '';
+    url.searchParams.set('api-version', AZURE_MODEL_API_VERSION);
+    return url.toString();
+}
+async function readCappedJson(response, limit, signal) {
+    if (!response.body)
+        return undefined;
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    let rejectAbort;
+    const aborted = new Promise((_resolve, reject) => { rejectAbort = reject; });
+    const onAbort = () => rejectAbort(new Error('MODEL_RESPONSE_ABORTED'));
+    signal.addEventListener('abort', onAbort, { once: true });
+    try {
+        while (true) {
+            const { value, done } = await Promise.race([reader.read(), aborted]);
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > limit)
+                throw new Error('MODEL_RESPONSE_TOO_LARGE');
+            chunks.push(value);
+        }
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+        if (total > limit || signal.aborted)
+            void reader.cancel().catch(() => undefined);
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        return undefined;
+    }
+}
+function responseErrorCode(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return undefined;
+    const error = body.error;
+    if (!error || typeof error !== 'object' || Array.isArray(error))
+        return undefined;
+    const code = error.code;
+    return typeof code === 'string' ? code.toLowerCase() : undefined;
+}
+function failureCategory(status, body) {
+    if (status === 401 || status === 403)
+        return 'auth';
+    if (status === 404)
+        return 'model';
+    if (status >= 300 && status < 400)
+        return 'endpoint';
+    const code = responseErrorCode(body);
+    if (code && ['invalid_api_key', 'unauthorized', 'authentication_error'].includes(code))
+        return 'auth';
+    if (code && ['model_not_found', 'deploymentnotfound', 'deployment_not_found'].includes(code))
+        return 'model';
+    if (code && ['invalid_endpoint', 'not_found'].includes(code))
+        return 'endpoint';
+    return 'unknown';
+}
+function failureMessage(category) {
+    if (category === 'auth')
+        return 'Authentication failed — check the provider credentials';
+    if (category === 'network')
+        return 'Provider could not be reached — check the URL/network';
+    if (category === 'endpoint')
+        return 'Provider endpoint is not configured or redirected unexpectedly';
+    if (category === 'model')
+        return 'Provider responded but the configured model is unavailable';
+    return 'Model test failed — check the provider configuration';
+}
+function responseHasExpectedShape(body, role) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return false;
+    const record = body;
+    return role === 'embedding'
+        ? Array.isArray(record.data) && record.data.length > 0
+        : Array.isArray(record.choices) && record.choices.length > 0;
+}
+function vertexModelName(value, fallback) {
+    const configured = typeof value === 'string' && value.trim() ? value.trim() : fallback;
+    const publisherStripped = configured.startsWith('google/') ? configured.slice('google/'.length) : configured;
+    return validateModelName(publisherStripped);
+}
+function vertexModelUrl(project, region, modelName, verb) {
+    return `https://${region}-aiplatform.googleapis.com/v1/projects/${encodeURIComponent(project)}` +
+        `/locations/${encodeURIComponent(region)}/publishers/google/models/${encodeURIComponent(modelName)}:${verb}`;
+}
+function vertexResponseHasExpectedShape(body, role) {
+    const value = record(body);
+    if (!value)
+        return false;
+    return role === 'embedding'
+        ? Array.isArray(value.predictions) && value.predictions.length > 0
+        : Array.isArray(value.candidates) && value.candidates.length > 0;
+}
+async function probeGcpModel(selection, deps) {
+    const project = typeof selection.providerFields.project === 'string'
+        ? selection.providerFields.project.trim()
+        : '';
+    const adcPath = typeof selection.providerFields.adcPath === 'string'
+        ? selection.providerFields.adcPath.trim()
+        : '';
+    if (!project || !adcPath) {
+        return {
+            ok: false,
+            category: 'endpoint',
+            message: 'Add a Vertex project and ADC credentials path to test.',
+        };
+    }
+    const region = typeof selection.providerFields.region === 'string' && selection.providerFields.region.trim()
+        ? selection.providerFields.region.trim()
+        : 'us-central1';
+    let modelName;
+    try {
+        if (!VERTEX_PROJECT_PATTERN.test(project) || !VERTEX_REGION_PATTERN.test(region))
+            throw new Error('invalid');
+        modelName = selection.modelRole === 'embedding'
+            ? vertexModelName(selection.providerFields.embeddingModel, VERTEX_EMBEDDING_DEFAULT)
+            : vertexModelName(selection.providerFields.chatModel, VERTEX_CHAT_DEFAULT);
+    }
+    catch {
+        return {
+            ok: false,
+            category: 'endpoint',
+            message: 'Vertex project, region, or model configuration is invalid',
+        };
+    }
+    let adc;
+    try {
+        const readFileFn = deps.readFileFn ?? ((path) => readFileSync(path, 'utf8'));
+        adc = record(JSON.parse(readFileFn(adcPath)));
+    }
+    catch {
+        return { ok: false, category: 'endpoint', message: 'ADC credentials file could not be read or parsed.' };
+    }
+    if (!adc)
+        return { ok: false, category: 'endpoint', message: 'ADC credentials file could not be read or parsed.' };
+    if (adc.type !== 'service_account' && adc.type !== 'authorized_user') {
+        return { ok: false, category: 'endpoint', message: 'Unsupported ADC credential type.' };
+    }
+    let requestBody;
+    try {
+        requestBody = tokenRequestBody(adc);
+    }
+    catch {
+        return { ok: false, category: 'endpoint', message: 'ADC credentials file could not be read or parsed.' };
+    }
+    if (!requestBody) {
+        return { ok: false, category: 'endpoint', message: 'ADC credentials file could not be read or parsed.' };
+    }
+    const fetchFn = deps.fetchFn ?? globalThis.fetch;
+    const timeoutMs = Math.min(15_000, Math.max(1, deps.timeoutMs ?? 15_000));
+    const bodyLimit = Math.min(MODEL_RESPONSE_LIMIT, Math.max(1, deps.responseBodyLimitBytes ?? MODEL_RESPONSE_LIMIT));
+    const now = deps.now ?? Date.now;
+    const startedAt = now();
+    const controller = new AbortController();
+    let timeout;
+    const run = async () => {
+        const token = await mintGoogleAccessToken(requestBody, fetchFn, controller);
+        if (!token.ok) {
+            const category = /could not be reached/i.test(token.warning) ? 'network' : 'auth';
+            return {
+                ok: false,
+                category,
+                message: category === 'auth' ? 'Authentication failed — check the ADC credentials' : failureMessage(category),
+            };
+        }
+        const verb = selection.modelRole === 'embedding' ? 'predict' : 'generateContent';
+        const url = vertexModelUrl(project, region, modelName, verb);
+        const payload = selection.modelRole === 'embedding'
+            ? { instances: [{ content: 'ok' }] }
+            : selection.modelRole === 'vision'
+                ? {
+                    contents: [{
+                            role: 'user',
+                            parts: [
+                                { text: 'Reply with OK.' },
+                                { inlineData: { mimeType: 'image/png', data: PROBE_VISION_PNG_BASE64 } },
+                            ],
+                        }],
+                    generationConfig: { maxOutputTokens: 8 },
+                }
+                : {
+                    contents: [{ role: 'user', parts: [{ text: 'Reply with OK.' }] }],
+                    generationConfig: { maxOutputTokens: 8 },
+                };
+        let response;
+        try {
+            response = await fetchFn(url, {
+                method: 'POST',
+                headers: {
+                    authorization: `Bearer ${token.accessToken}`,
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify(payload),
+                redirect: 'manual',
+                signal: controller.signal,
+            });
+        }
+        catch {
+            return { ok: false, category: 'network', message: failureMessage('network') };
+        }
+        let body;
+        try {
+            body = await readCappedJson(response, bodyLimit, controller.signal);
+        }
+        catch {
+            return { ok: false, category: 'unknown', message: failureMessage('unknown') };
+        }
+        if (response.ok && vertexResponseHasExpectedShape(body, selection.modelRole)) {
+            return {
+                ok: true,
+                latencyMs: Math.max(0, Math.round(now() - startedAt)),
+                modelName,
+                message: 'Responded',
+            };
+        }
+        const category = response.ok ? 'unknown' : failureCategory(response.status, body);
+        return { ok: false, category, message: failureMessage(category) };
+    };
+    try {
+        return await Promise.race([
+            run(),
+            new Promise((resolve) => {
+                timeout = setTimeout(() => {
+                    controller.abort();
+                    resolve({ ok: false, category: 'network', message: 'Timed out — check the URL/network' });
+                }, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+        controller.abort();
+    }
+}
+/**
+ * Sends one bounded, constant model request from the CLI process. Endpoint-controlled response text is
+ * shape-checked and discarded; only canned outcome copy crosses back to the setup browser.
+ */
+export async function probeModel(selection, deps = {}) {
+    if (selection.provider === 'offline') {
+        return { ok: true, message: 'Offline stub — no model to test' };
+    }
+    if (selection.provider === 'gcp')
+        return probeGcpModel(selection, deps);
+    const endpoint = selection.providerFields.endpoint;
+    const apiKey = selection.providerFields.apiKey;
+    if (typeof apiKey === 'string' && apiKey)
+        registerSecret(apiKey);
+    if (typeof endpoint !== 'string' || !endpoint.trim()) {
+        return { ok: false, category: 'endpoint', message: 'Add a provider endpoint before testing the model' };
+    }
+    if (selection.provider === 'azure') {
+        const foundry = foundryEndpointWarning(endpoint);
+        if (foundry)
+            return { ok: false, category: 'endpoint', message: foundry };
+    }
+    let candidates;
+    try {
+        if (selection.provider === 'azure') {
+            candidates = selection.modelRole === 'embedding' ? AZURE_EMBEDDING_DEPLOYMENTS : AZURE_CHAT_DEPLOYMENTS;
+        }
+        else {
+            const field = selection.modelRole === 'embedding' ? 'embeddingModel' : 'chatModel';
+            candidates = [validateModelName(selection.providerFields[field])];
+        }
+    }
+    catch {
+        return { ok: false, category: 'model', message: 'Configured model name is missing or invalid' };
+    }
+    const fetchFn = deps.fetchFn ?? globalThis.fetch;
+    const timeoutMs = Math.min(15_000, Math.max(1, deps.timeoutMs ?? 15_000));
+    const bodyLimit = Math.min(MODEL_RESPONSE_LIMIT, Math.max(1, deps.responseBodyLimitBytes ?? MODEL_RESPONSE_LIMIT));
+    const now = deps.now ?? Date.now;
+    const startedAt = now();
+    const controller = new AbortController();
+    let timeout;
+    const run = async () => {
+        for (const modelName of candidates) {
+            validateModelName(modelName);
+            const route = selection.modelRole === 'embedding' ? 'embeddings' : 'chat/completions';
+            const url = selection.provider === 'azure'
+                ? azureModelUrl(endpoint, modelName, route)
+                : compatModelUrl(hostReachableEndpoint(endpoint), route);
+            const headers = new Headers({ 'content-type': 'application/json' });
+            if (selection.provider === 'azure' && typeof apiKey === 'string')
+                headers.set('api-key', apiKey);
+            if (selection.provider !== 'azure' && typeof apiKey === 'string' && apiKey) {
+                headers.set('authorization', `Bearer ${apiKey}`);
+            }
+            const payload = selection.modelRole === 'embedding'
+                ? { model: modelName, input: 'ok' }
+                : selection.modelRole === 'vision'
+                    ? {
+                        model: modelName,
+                        messages: [{
+                                role: 'user',
+                                content: [
+                                    { type: 'text', text: 'Reply with OK.' },
+                                    {
+                                        type: 'image_url',
+                                        image_url: { url: `data:image/png;base64,${PROBE_VISION_PNG_BASE64}` },
+                                    },
+                                ],
+                            }],
+                        ...(selection.provider === 'azure' ? { max_completion_tokens: 16 } : { max_tokens: 8 }),
+                        stream: false,
+                    }
+                    : {
+                        model: modelName,
+                        messages: [{ role: 'user', content: 'Reply with OK.' }],
+                        // gpt-5.x-family models reject max_tokens ("use max_completion_tokens");
+                        // OpenAI-compatible servers (Ollama/vLLM) still speak max_tokens.
+                        ...(selection.provider === 'azure' ? { max_completion_tokens: 16 } : { max_tokens: 8 }),
+                        stream: false,
+                    };
+            let response;
+            try {
+                response = await fetchFn(url, {
+                    method: 'POST',
+                    headers,
+                    body: JSON.stringify(payload),
+                    redirect: 'manual',
+                    signal: controller.signal,
+                });
+            }
+            catch {
+                return { ok: false, category: 'network', message: failureMessage('network') };
+            }
+            let body;
+            try {
+                body = await readCappedJson(response, bodyLimit, controller.signal);
+            }
+            catch {
+                return { ok: false, category: 'unknown', message: failureMessage('unknown') };
+            }
+            if (response.ok && responseHasExpectedShape(body, selection.modelRole)) {
+                return {
+                    ok: true,
+                    latencyMs: Math.max(0, Math.round(now() - startedAt)),
+                    modelName,
+                    message: 'Responded',
+                };
+            }
+            if (selection.provider === 'azure' && response.status === 404)
+                continue;
+            const category = response.ok ? 'unknown' : failureCategory(response.status, body);
+            return { ok: false, category, message: failureMessage(category) };
+        }
+        return selection.modelRole !== 'embedding'
+            ? {
+                ok: false,
+                category: 'model',
+                message: `Endpoint reachable, but no deployment named ${AZURE_CHAT_DEPLOYMENTS.join(' or ')} exists on it — deploy the model with that exact deployment name (deployment names are not model names)`,
+            }
+            : {
+                ok: false,
+                category: 'model',
+                message: `Endpoint reachable, but no deployment named ${AZURE_EMBEDDING_DEPLOYMENTS.join(' or ')} exists on it — deploy the model with that exact deployment name (deployment names are not model names)`,
+            };
+    };
+    try {
+        return await Promise.race([
+            run(),
+            new Promise((resolve) => {
+                timeout = setTimeout(() => {
+                    resolve({ ok: false, category: 'network', message: 'Timed out — check the URL/network' });
+                    controller.abort();
+                }, timeoutMs);
+            }),
+        ]);
+    }
+    catch {
+        return { ok: false, category: 'unknown', message: failureMessage('unknown') };
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+        controller.abort();
+    }
+}
+//# sourceMappingURL=platform-provider-probe.js.map