@yanlinglabs/winter-provider-conformance 0.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 yanlingLabs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,41 @@
+NOTICE
+======
+
+Third-party attributions for the Winter agent SDK.
+
+This file records material that Winter DERIVED FROM third-party artifacts. Winter copies no source
+code from any of them; what it takes is protocol facts — endpoint URLs, form-field names, client
+identifiers and scope strings — which it needs in order to speak to a vendor's service at all. Each
+entry names the exact commit the values were read at, so the derivation is re-checkable.
+
+
+-------------------------------------------------------------------------------
+xai-org/grok-build
+-------------------------------------------------------------------------------
+
+    Repository:  https://github.com/xai-org/grok-build
+    Commit:      72a61251fcffb464bcc687aeb5a998e5a98ec0c9
+    License:     Apache License, Version 2.0
+                 https://www.apache.org/licenses/LICENSE-2.0
+    Copyright:   Copyright 2023-2026 SpaceXAI
+
+Winter's `xai-oauth` provider derives the following constants and request shapes from this
+repository's authentication module, in order to perform its own OAuth 2.0 device authorization
+grant (RFC 8628) against xAI's public, secret-less OAuth client:
+
+  - the public OAuth client identifier
+  - the OAuth issuer, device-authorization endpoint and token endpoint
+  - the requested scope set
+  - the name of the form field the flow carries a client identity in
+  - the shape (field names) of the device-authorization and token requests
+
+No source code from this repository is copied into Winter, and no part of Winter is a derivative
+work of it. The derivation is recorded, with per-value line citations, in:
+
+    packages/conformance/compat/xai/grok-build/derived-shapes-p6b-xai.md
+
+Winter identifies ITSELF in that flow. It sends its own `User-Agent` (`winter-agent-sdk/<version>`)
+and its own name in the flow's identity field, and it does not send xAI's product-identity or
+telemetry headers. Winter is not affiliated with or endorsed by SpaceXAI, and "Grok" and "Grok Build"
+are the marks of their owner; they appear here and in the capture solely to identify the artifact
+these values were derived from.

package/README.md

@@ -0,0 +1,51 @@
+# `@yanlinglabs/winter-provider-conformance`
+
+The provider-layer conformance harness: the shared corpus every OpenAI-, Anthropic-, Google- and
+Bedrock-family adapter is asked the same questions through, the continuity and classifier-safety
+corpora, and the loopback fakes (`./fakes`) those corpora drive.
+
+**Bun only.** This package declares `engines.bun` and no `engines.node`: its fakes stand up real
+loopback HTTP servers with `Bun.serve`, which has no Node equivalent it implements.
+
+## Install
+
+Published to **both** registries. This is one of the org's own test harnesses rather than something a
+consumer of the wrapper installs — and it is on public npm deliberately: the router package
+`@yanlinglabs/winter-runtime-sdk` lives in its own repository and needs these loopback provider fakes as a dev dependency, and
+reaching GitHub Packages from that repository's CI would mean a cross-repo `read:packages` token
+whose only purpose is fetching test fixtures.
+
+### From public npm (anyone)
+
+```sh
+npm install @yanlinglabs/winter-provider-conformance
+```
+
+Nothing else is needed: the `@yanlinglabs` scope is public on npm.
+
+### From GitHub Packages (the `yanlingLabs` org)
+
+GitHub Packages needs the scope pointed at it and an authenticated read, even for a public package.
+In your project's `.npmrc`:
+
+```
+@yanlinglabs:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}
+```
+
+…with `GITHUB_TOKEN` in the environment — a personal access token carrying `read:packages`, never a
+literal in the file. Then `npm install @yanlinglabs/winter-provider-conformance` as usual.
+
+**The published packages contain COMPILED OUTPUT ONLY.** Each tarball ships `dist/` — the bundled
+JavaScript a consumer imports and the `.d.ts` declarations their type-checker reads — plus its data
+files, `README.md` and `LICENSE`. It does **not** ship `src/`: the TypeScript sources live at
+<https://github.com/yanlingLabs/winter-agent-sdk>, which is where to read them, file an issue, or send
+a patch.
+
+## License
+
+MIT — see [`LICENSE`](./LICENSE), which ships in the published tarball.
+
+This package's xAI OAuth fake mirrors the flow Winter's provider derives from the Apache-2.0 licensed
+`xai-org/grok-build`; that attribution is in [`NOTICE`](./NOTICE), which ships in the tarball beside
+this file.

package/dist/corpus/azure.d.ts

@@ -0,0 +1,7 @@
+import type { CorpusHarness } from "./harness.js";
+export declare const AZURE_CLASSIC_API_VERSION = "2026-05-01";
+export declare const AZURE_DEPLOYMENT = "corpus-deployment";
+/** The CLASSIC surface: the deployment path, chat completions, `api-key` auth. */
+export declare function azureClassicHarness(): CorpusHarness;
+/** The PREVIEW surface: `/openai/v1/responses`, the full Responses wire, encrypted continuation and all. */
+export declare function azurePreviewHarness(): CorpusHarness;

package/dist/corpus/classifier-safety.d.ts

@@ -0,0 +1,146 @@
+/** The subset of the runtime's normalized action envelope these scenarios need. Assignable to `ActionEnvelope` — asserted runtime-side. */
+export interface SafetyEnvelope {
+    toolName: string;
+    canonicalToolName: string;
+    input: Record<string, unknown>;
+    cwd: string;
+    roots: string[];
+    resolvedPaths: Array<{
+        path: string;
+        resolvedTarget: string;
+        isSymlink: boolean;
+    }>;
+    boundaries: {
+        protectedWrite: boolean;
+        criticalRemoval: boolean;
+        criticalReason?: string;
+    };
+    sessionCreatedResources: string[];
+    classifierContext: Array<{
+        hookId: string;
+        hookName?: string;
+        context: unknown;
+    }>;
+    shellSubcommands?: string[];
+    shellRedirectTargets?: string[];
+    networkDestinations?: string[];
+    repository?: {
+        remotes: string[];
+    };
+}
+/**
+ * Winter's own category vocabulary for these scenarios.
+ *
+ * Advisory, and deliberately so: WS-07 §13 open question 3 proposes "verdict-level agreement with
+ * recorded FP/FN rates... category agreement advisory", and this corpus implements exactly that —
+ * a run is scored on the VERDICT, and the category is recorded beside it for a reader.
+ */
+export declare const CLASSIFIER_SAFETY_CATEGORIES: readonly ["ordinary-local-work", "declared-dependency-install", "read-only-http", "session-created-cleanup", "destructive-history", "download-piped-to-execution", "infrastructure-destruction", "production-deploy", "credential-disclosure", "security-control-removal", "transcript-tampering", "self-modification", "injection-driven-action"];
+export type ClassifierSafetyCategory = (typeof CLASSIFIER_SAFETY_CATEGORIES)[number];
+export interface ClassifierSafetyCase {
+    id: string;
+    /** What the case proves, in one sentence — reproduced in the report so a reader never opens this file to know what a pass means. */
+    question: string;
+    category: ClassifierSafetyCategory;
+    /** The verdict a correct reviewer returns. `no_verdict` is never an expected answer here: every scenario is decidable from its envelope alone. */
+    expected: "allow" | "deny";
+    envelope: SafetyEnvelope;
+}
+/**
+ * The scenarios.
+ *
+ * Each is the SMALLEST envelope that makes its question decidable — a reviewer that needs more than
+ * this to answer is a reviewer whose "no_verdict" would be honest, and the corpus would then be
+ * measuring the envelope rather than the model.
+ *
+ * The five allow rows exist because a corpus of denials measures nothing: a model that answers
+ * "deny" to everything scores perfectly on a deny-only corpus and is useless as a reviewer (WS-07
+ * §10.3 records false-POSITIVE rates for exactly this reason).
+ */
+export declare const CLASSIFIER_SAFETY_CASES: readonly ClassifierSafetyCase[];
+/** What a classifier answered, as this corpus needs to see it. Structurally the runtime's `ClassifierRawResult`. */
+export interface ClassifierSafetyAnswer {
+    verdict: "allow" | "deny" | "no_verdict";
+    category?: string;
+    severity?: string;
+    reasonCode?: string;
+    auditReason?: string;
+}
+export type ClassifierSafetyClassify = (envelope: SafetyEnvelope, testCase: ClassifierSafetyCase) => Promise<ClassifierSafetyAnswer>;
+export interface ClassifierSafetyOutcome {
+    id: string;
+    category: ClassifierSafetyCategory;
+    expected: "allow" | "deny";
+    actual: "allow" | "deny" | "no_verdict" | "threw";
+    /** The verdict-level agreement §13's open question 3 proposes as the measure. */
+    agreed: boolean;
+    /** Present when the classifier abstained or failed: its own reason code, or the thrown error's message. */
+    detail?: string;
+}
+export interface ClassifierSafetyReport {
+    label: string;
+    outcomes: ClassifierSafetyOutcome[];
+    agreed: number;
+    total: number;
+    /**
+     * A DENIAL the corpus expected but did not get, counted separately.
+     *
+     * The two error directions are not equal: a missed denial is a security failure, and a missed
+     * allow is an annoyance. A single agreement percentage hides which one a model is making, which is
+     * precisely the number §10.3 asks to be recorded per policy version.
+     */
+    missedDenials: number;
+    ok: boolean;
+}
+/**
+ * Runs the corpus.
+ *
+ * EVERY case runs, even after one disagrees — the point is the whole picture, and stopping early
+ * turns a corpus into a bisect (the adapter runner's own reasoning, deliberately mirrored).
+ *
+ * A THROW is an OUTCOME, not a crash: a classifier that fails to answer at all is a datum about that
+ * classifier, and the live run must survive it to report the rest.
+ */
+export declare function runClassifierSafetyCorpus(classify: ClassifierSafetyClassify, opts?: {
+    label?: string;
+    cases?: readonly ClassifierSafetyCase[];
+}): Promise<ClassifierSafetyReport>;
+/**
+ * A thrown value, rendered as identity rather than as prose.
+ *
+ * Shared with the live runner's own rendering rule (`live/index.ts`), and for the same reason: a
+ * provider error's MESSAGE embeds a snippet of the provider's response body, and both of these
+ * strings are printed to an operator's terminal. Name, normalized code, HTTP status and the
+ * provider's own structured code are all identifiers; the message is content.
+ */
+export declare function describeThrown(err: unknown): string;
+/**
+ * A verdict's `reasonCode`, rendered as identity rather than as content.
+ *
+ * Winter's own codes (`timeout`, `schema_invalid`, …) are a CLOSED vocabulary and pass through
+ * verbatim — they are the whole diagnosis. A `model:`-prefixed code is up to 64 characters the model
+ * wrote, and this string is printed to a terminal, so what survives is the fact that the model
+ * authored it and how much it said.
+ *
+ * The namespace is MIRRORED, not imported — this package must not import the runtime (see the
+ * structural-envelope note at the top of this file, and the dependency direction it states) — so it
+ * follows that same rule's second half: the mirror is not trusted. `runner.test.ts` asserts this
+ * constant equals `MODEL_REASON_CODE_PREFIX` in `classifier/verdict-schema.ts`, because the whole
+ * reason the namespace exists is that a model answering `reasonCode: "timeout"` must not be able to
+ * look like a genuine transport timeout — and a drifted copy here would silently un-redact it.
+ */
+export declare const MODEL_REASON_CODE_PREFIX = "model:";
+export declare function describeReasonCode(reasonCode: string): string;
+/**
+ * A case failure, rendered for a report.
+ *
+ * The split is between WINTER-AUTHORED text and PROVIDER-AUTHORED text, not between error classes.
+ * A fixture's own `throw new Error("expected the Vertex location path …")` is Winter's sentence and
+ * is the entire value of a failing corpus line. A normalized provider error's message embeds a
+ * truncated snippet of the provider's RESPONSE BODY (`errors.ts`), and these reports are printed to
+ * an operator's terminal and pasted into review packages — so anything carrying the normalized
+ * provider shape (`code`, `status`, `providerCode`) is rendered as identity instead.
+ */
+export declare function describeCaseFailure(err: unknown): string;
+/** One line per case, so a failing run says which questions were answered wrongly without anyone opening this file. */
+export declare function formatClassifierSafetyReport(report: ClassifierSafetyReport): string;

package/dist/corpus/continuity.d.ts

@@ -0,0 +1,52 @@
+import { type ContinuityEndpoint, type HistoryTarget, type ProviderMessageLike, type ProviderRegistry } from "@yanlinglabs/winter-provider-runtime";
+/** The case ids. Stable strings: a report names them and a reader can trace each to its clause of the report. */
+export type ContinuityCaseId = "claude-to-openai-warns" | "openai-to-claude-warns" | "gemini-to-openai-warns" | "xai-to-openai-warns" | "deepseek-to-openai-full-no-warning" | "deepseek-to-openai-truncated-warns" | "same-provider-model-profile-no-warning" | "same-provider-unverified-model-warns" | "switch-during-tool-loop-waits" | "source-receives-every-native-tool-result" | "target-never-receives-source-opaque-state" | "target-receives-available-portable-state" | "immediate-switch-cancels-rather-than-splices" | "suppression-requires-affirmative-evidence" | "opaque-state-never-in-a-warning-or-handoff" | "handoff-is-data-not-authority" | "exposed-reasoning-forwarded-only-when-policy-permits" | "memories-and-instruction-files-stay-out" | "telemetry-and-reports-carry-identifiers-only" | "summaries-requested-where-the-provider-documents-how";
+export interface ContinuityCaseSpec {
+    id: ContinuityCaseId;
+    /** What the case proves, in one sentence, reproduced in the report so a passing case is legible without opening this file. */
+    question: string;
+    /** The report clause it answers. */
+    clause: string;
+}
+export declare const CONTINUITY_CASES: readonly ContinuityCaseSpec[];
+export interface ContinuityWorld {
+    registry: ProviderRegistry;
+    endpoints: Record<"claudeA" | "claudeB" | "openai" | "openaiMini" | "gemini" | "xai" | "deepseek", ContinuityEndpoint>;
+    targets: Record<"claudeA" | "openai" | "deepseek", HistoryTarget>;
+}
+/**
+ * The catalog every case shares.
+ *
+ * The Anthropic rows declare NO continuation-domain evidence (each is its own single-member domain,
+ * which is what makes model-A-to-model-B a real boundary); OpenAI, Gemini, xAI and DeepSeek each
+ * declare their own. xAI and DeepSeek deliberately sit in the SAME wire family as OpenAI with the
+ * same endpoint shape -- the corpus is worthless if the fixtures make the distinctions easy.
+ */
+export declare function createContinuityWorld(): ContinuityWorld;
+/** The markers every "no opaque state escaped" assertion looks for. If one of these appears anywhere a model or a log can see, the case fails. */
+export declare const OPAQUE_MARKERS: readonly ["CLAUDE-SIGNATURE-OPAQUE", "CLAUDE-REDACTED-OPAQUE", "OPENAI-ENCRYPTED-OPAQUE", "GEMINI-SIGNATURE-OPAQUE"];
+/** A Claude turn carrying BOTH carriers of opaque state: signed in-dialect blocks in `content`, and native items beside them. */
+export declare function claudeTurn(uuid: string, text: string): ProviderMessageLike;
+export declare function openaiTurn(uuid: string, text: string): ProviderMessageLike;
+export interface ContinuityCaseContext {
+    world: ContinuityWorld;
+}
+export type ContinuityCaseImpl = (ctx: ContinuityCaseContext) => void | Promise<void>;
+export declare const CONTINUITY_CASE_IMPLS: Record<ContinuityCaseId, ContinuityCaseImpl>;
+export interface ContinuityCaseOutcome {
+    id: ContinuityCaseId;
+    status: "passed" | "failed" | "missing";
+    detail?: string;
+}
+export interface ContinuityReport {
+    outcomes: ContinuityCaseOutcome[];
+    ok: boolean;
+}
+/**
+ * Runs every case, even after one fails -- a reader wants the whole picture from one run, and
+ * stopping at the first failure turns a corpus into a bisect. A case with no implementation is
+ * `missing`, never silently absent: "the corpus passed" has to mean "every question was asked".
+ */
+export declare function runContinuityCorpus(cases?: Partial<Record<ContinuityCaseId, ContinuityCaseImpl>>): Promise<ContinuityReport>;
+/** One line per case, so a failing run says which questions went unanswered without anyone opening this file. */
+export declare function formatContinuityReport(report: ContinuityReport): string;

package/dist/corpus/cross-vendor-headers.d.ts

@@ -0,0 +1,38 @@
+import type { RecordedRequest } from "../fakes/server.js";
+/**
+ * The vendor product prefixes this rule polices, and the Winter provider ids each vendor owns.
+ *
+ * The prefix list is the ruling's (R-FW-1). The OWNER lists are read off the catalog's own rows: a
+ * prefix's owners are the ids whose vendor authored the header namespace, so `openai-` is honest on
+ * OpenAI's own row and on the codex backend (an OpenAI surface), and on nothing else.
+ */
+export declare const CROSS_VENDOR_HEADER_OWNERS: Readonly<Record<string, readonly string[]>>;
+/**
+ * Header names that are the DIALECT's protocol, exempt on every row served by that adapter.
+ *
+ * Keyed by `adapterId` rather than by provider id, because the exemption is a property of the wire
+ * protocol a row speaks and not of the vendor it belongs to — which is exactly why a third party's
+ * `<id>-anthropic` sibling needs it and a third party's own OpenAI-dialect row does not.
+ *
+ * Each entry is one of the names `endpoint-policy.ts` enumerates as PROTOCOL. Nothing account-scoped
+ * or organisation-scoped belongs here; those are the names the rule exists to catch.
+ */
+export declare const DIALECT_PROTOCOL_HEADERS: Readonly<Record<string, readonly string[]>>;
+export interface CrossVendorSweepTarget {
+    /** The Winter row the request was made for. */
+    providerId: string;
+    /** The adapter that served it — the key the dialect-protocol exemption is read by. */
+    adapterId: string;
+}
+/**
+ * Every cross-vendor violation in one header map, as readable sentences.
+ *
+ * Returns `[]` for a clean request. The strings name the header, the row and the vendor whose
+ * namespace it is, because a bare boolean on a header sweep is a failure nobody can act on.
+ *
+ * VALUES ARE NEVER INCLUDED. A violating header is by definition account- or organisation-scoped,
+ * and a failure message is one of the most reliably-pasted strings in any system.
+ */
+export declare function crossVendorHeaderViolations(target: CrossVendorSweepTarget, headers: Record<string, string>): string[];
+/** The same sweep over a fake's whole recorded request log. One call per driven row. */
+export declare function crossVendorViolationsIn(target: CrossVendorSweepTarget, requests: readonly RecordedRequest[]): string[];

package/dist/corpus/harness.d.ts

@@ -0,0 +1,57 @@
+import type { DiscoveryCache, ModelCatalogResult, ProviderEvent, TurnRequest } from "@yanlinglabs/winter-provider-runtime";
+import type { DescriptorOverrides } from "@yanlinglabs/winter-provider-runtime/testing";
+import type { RecordedRequest } from "../fakes/server.js";
+export interface HarnessOverrides {
+    /**
+     * Resolve every model to NO descriptor — the `allowUnlisted` gateway shape, where a model has no
+     * catalog evidence at all.
+     *
+     * Spelled as a positive statement rather than as an absent option (ruling on finding I3): the
+     * adapters now REQUIRE a lookup, so "this model has no evidence" is something a caller says out
+     * loud, and forgetting to say anything is a compile error instead of a silent loss of every
+     * §8.2 refusal.
+     */
+    unlisted?: boolean;
+    /** Vary the descriptor this turn resolves. */
+    descriptor?: DescriptorOverrides;
+}
+export interface HarnessCapabilities {
+    tools: boolean;
+    vision: boolean;
+    /** `opaque` = Responses' encrypted reasoning items; `exposed` = DeepSeek's replayable text; `none` = neither. */
+    continuation: "opaque" | "exposed" | "none";
+    effort: boolean;
+}
+export interface CorpusHarness {
+    name: string;
+    surface: "responses" | "chat";
+    capabilities: HarnessCapabilities;
+    /**
+     * `live` = the provider serves a catalog endpoint this corpus can page through; `static` = the
+     * adapter's catalog is compiled in (codex serves only its own slugs for a ChatGPT account), so the
+     * paging questions do not exist for it and the case asks the ones that do.
+     */
+    discovery: "live" | "static";
+    /**
+     * False for a declared-LOCAL endpoint, where having no credential is a valid configuration
+     * (`local-none` is a first-class auth kind, WS-13 §6) rather than a missing one.
+     */
+    requiresCredential: boolean;
+    /** Where this surface's model listing lives, when it is not at the root (Azure's `/openai/models`). */
+    discoveryRoutePrefix?: string;
+    /** Runs a turn against `endpoint`. `endpoint` is usually the runner's fake, but a case may point it at a closed server. */
+    stream(endpoint: {
+        url: string;
+    }, req: TurnRequest, overrides?: HarnessOverrides): AsyncIterable<ProviderEvent>;
+    /** Live discovery against `endpoint`. */
+    discover(endpoint: {
+        url: string;
+    }, opts?: {
+        maxItems?: number;
+        maxBytes?: number;
+        cache?: DiscoveryCache;
+        signal?: AbortSignal;
+    }): Promise<ModelCatalogResult>;
+    /** Target-specific assertions every recorded request must satisfy (Azure's `api-version`). */
+    assertRequest?(recorded: RecordedRequest): void;
+}

package/dist/corpus/runner.d.ts

@@ -0,0 +1,69 @@
+import type { FakeServer } from "../fakes/server.js";
+/** The WS-13 §13 case ids. Stable strings: a lane keys its implementations on them and a report names them. */
+export type CorpusCaseId = "serialization-and-headers" | "streaming-order" | "tool-call-single" | "tool-call-multiple" | "tool-call-fragmented" | "tool-result-replay" | "cancel-pre-header" | "cancel-mid-stream" | "usage-accounting" | "error-auth" | "error-rate-limit" | "error-timeout" | "error-network" | "error-malformed" | "error-provider-codes" | "retry-after-no-replay" | "effort-mapping" | "opaque-continuation" | "limit-rejection" | "vision-where-advertised" | "discovery-edge-cases" | "identity-across-resume" | "no-silent-tool-dropping";
+/** One case: what it asks, and whether an adapter may legitimately not answer it. */
+export interface CorpusCaseSpec {
+    id: CorpusCaseId;
+    /** What the case proves, in one sentence. Reproduced in the report so a reader never has to open this file to know what a passing case means. */
+    question: string;
+    /**
+     * `required` cases must be implemented for a family to pass at all.
+     *
+     * `capability-gated` cases are skipped ONLY when the adapter's own descriptor says the capability
+     * is absent -- a skip is then a FACT about the model, recorded as such, and never a lane quietly
+     * declining a case it found hard. That distinction is the whole reason this field exists.
+     */
+    requirement: "required" | "capability-gated";
+}
+/**
+ * WS-13 §13's list, in the order the spec states it.
+ *
+ * DATA, not code, so a lane extends the corpus by supplying implementations rather than by editing
+ * this array -- and so a lane that MISSES a required case is caught by the runner rather than by a
+ * reviewer noticing an absent test.
+ */
+export declare const CORPUS_CASES: readonly CorpusCaseSpec[];
+/** The context a case implementation is handed. */
+export interface CorpusCaseContext {
+    fake: FakeServer;
+    /** The model id the case should ask for. The runner passes the one it was configured with, so a family fake can key its scenario table on it. */
+    model: string;
+}
+/** What a case returns. A THROW is a failure; returning `{ skipped }` is the capability-gated "this model does not do that". */
+export type CorpusCaseResult = void | {
+    skipped: string;
+};
+export type CorpusCaseImpl = (ctx: CorpusCaseContext) => Promise<CorpusCaseResult>;
+export interface RunAdapterCorpusOptions {
+    /** Names the family in the report. */
+    adapter: string;
+    fake: FakeServer;
+    model: string;
+    /** The lane's implementations, keyed by case id. A missing REQUIRED case is a failure the runner reports -- never a silent absence. */
+    cases: Partial<Record<CorpusCaseId, CorpusCaseImpl>>;
+}
+export interface CorpusCaseOutcome {
+    id: CorpusCaseId;
+    status: "passed" | "failed" | "skipped" | "missing";
+    detail?: string;
+}
+export interface CorpusReport {
+    adapter: string;
+    model: string;
+    outcomes: CorpusCaseOutcome[];
+    /** True only when every REQUIRED case passed and no case failed. A capability-gated skip does not block a pass; a missing required case does. */
+    ok: boolean;
+}
+/**
+ * Runs the corpus.
+ *
+ * EVERY case runs, even after one fails: a family lane wants the whole picture from one run, and
+ * stopping at the first failure turns a corpus into a bisect.
+ *
+ * A MISSING required case is `"missing"` rather than silently absent -- that status is what makes
+ * "the corpus passed" mean "every question was asked", which is the only reading under which WS-13
+ * §13's promotion rule means anything.
+ */
+export declare function runAdapterCorpus(opts: RunAdapterCorpusOptions): Promise<CorpusReport>;
+/** A one-line-per-case rendering, so a failing lane run says which questions went unanswered without anyone opening this file. */
+export declare function formatCorpusReport(report: CorpusReport): string;

package/dist/fakes/anthropic-console-oauth.d.ts

@@ -0,0 +1,36 @@
+import { type FakeServer, type RecordedRequest } from "./server.js";
+export declare const FAKE_CONSOLE_ACCOUNT_ID = "acct-test-console-0001";
+export declare const FAKE_CONSOLE_ACCESS_TOKEN = "test-token-anthropic-console-access";
+export declare const FAKE_CONSOLE_REFRESHED_ACCESS_TOKEN = "test-token-anthropic-console-access-refreshed";
+export declare const FAKE_CONSOLE_REFRESH_TOKEN = "test-token-anthropic-console-refresh";
+export interface AnthropicConsoleOauthFakeOptions {
+    /** Answer every grant with this status instead of 200. */
+    failTokenWith?: number;
+    /** The profile answers 200 with no account — the shape that must REFUSE the login, not name a record `anthropic:undefined`. */
+    omitAccount?: boolean;
+    /** A refresh grant that does not rotate the refresh token, which is the common case. */
+    omitRefreshToken?: boolean;
+    accountId?: string;
+    expiresIn?: number;
+}
+export interface AnthropicConsoleOauthFake extends FakeServer {
+    /** Handed to the login as its authorize endpoint. Never fetched — the browser half is `completeAuthorization`. */
+    authorizeUrl: string;
+    tokenUrl: string;
+    profileUrl: string;
+    /** The grants the token endpoint actually received, in order. Headers are redacted by the base fake. */
+    tokenRequests: RecordedRequest[];
+    profileRequests: RecordedRequest[];
+    /**
+     * The browser half: reads the authorize URL the flow produced, records its PKCE challenge, and
+     * calls the flow's own loopback callback.
+     *
+     * `state` overrides the value the flow minted (a planted-callback fixture); `code: null` omits the
+     * authorization code entirely.
+     */
+    completeAuthorization(url: string, overrides?: {
+        state?: string;
+        code?: string | null;
+    }): Promise<void>;
+}
+export declare function startAnthropicConsoleOauthFake(opts?: AnthropicConsoleOauthFakeOptions): Promise<AnthropicConsoleOauthFake>;

package/dist/fakes/anthropic-messages.d.ts

@@ -0,0 +1,115 @@
+import { type FakeRoute, type RecordedRequest, type SseFrame, type SseResponseOptions } from "./server.js";
+/** One scripted content block. `chunks` are the deltas the wire emits, so a fixture controls fragmentation directly. */
+export type AnthropicScriptBlock = {
+    type: "text";
+    chunks: string[];
+}
+/** `signature` absent scripts the R6-8 discriminator: capture (F) run (ii), a thinking block with NO signature at all. */
+ | {
+    type: "thinking";
+    chunks: string[];
+    signature?: string;
+} | {
+    type: "redacted_thinking";
+    data: string;
+} | {
+    type: "tool_use";
+    id: string;
+    name: string;
+    jsonChunks: string[];
+};
+export interface AnthropicTurnScript {
+    id?: string;
+    model?: string;
+    blocks: AnthropicScriptBlock[];
+    stopReason?: "end_turn" | "tool_use" | "max_tokens" | "stop_sequence" | "refusal";
+    usage?: {
+        input_tokens?: number;
+        output_tokens?: number;
+        cache_creation_input_tokens?: number;
+        cache_read_input_tokens?: number;
+    };
+    /** Injects `event: ping` after the FIRST `content_block_start`, exactly where capture (F) put it. */
+    ping?: boolean;
+    /** Emits an `event: error` frame instead of `message_delta`/`message_stop` -- the mid-stream provider failure. */
+    errorAfterBlocks?: {
+        type: string;
+        message: string;
+    };
+}
+/**
+ * Renders a scripted turn into the family's real frame sequence.
+ *
+ * The ORDER is the point and is taken from capture (F): `message_start`, then per block a
+ * `content_block_start` -> its deltas -> `content_block_stop`, then `message_delta` carrying the
+ * stop reason and the output-token count, then `message_stop`. A `thinking` block's
+ * `signature_delta` arrives LAST inside its own block, which is what makes "capture the block only
+ * at `content_block_stop`" a testable rule rather than a stylistic one.
+ */
+export declare function anthropicSseFrames(script: AnthropicTurnScript): SseFrame[];
+/** The scripted turn as an SSE response. `opts.dropAfter` is the base's mid-stream-drop primitive, counted in FRAMES. */
+export declare function anthropicTurnResponse(script: AnthropicTurnScript, opts?: SseResponseOptions): Response;
+/** Reads the model id out of an Anthropic request body -- the family's `modelOf` for `scenarioTable`. */
+export declare function anthropicModelOf(recorded: RecordedRequest): string | undefined;
+/** The parsed body of a recorded Anthropic request, for an assertion that wants to read one field. */
+export declare function anthropicBody(recorded: RecordedRequest): Record<string, unknown>;
+export interface AnthropicRequestExpectation {
+    model?: string;
+    apiVersion?: string;
+    beta?: string;
+    stream?: boolean;
+    /** The `type` of every content block of every message, flattened in wire order -- the block-ordering assertion R6-8 needs. */
+    blockTypes?: string[];
+    /** The wire roles, in order. `tool` is NOT a wire role: a tool result rides a `user` message. */
+    roles?: string[];
+    thinking?: unknown;
+    toolChoice?: unknown;
+    toolNames?: string[];
+    maxTokens?: number;
+    system?: string;
+}
+/**
+ * Asserts the EXACT request shape on the live request the fake received.
+ *
+ * `x-api-key` is checked in its REDACTED form (`***`): the base replaces a credential header's
+ * material as it records, so asserting on `***` proves both that the adapter authenticated and that
+ * the fake's own redaction ran.
+ */
+export declare function assertAnthropicRequest(recorded: RecordedRequest, expected?: AnthropicRequestExpectation): void;
+/** Every message's content-block `type`, flattened in wire order. A string content counts as one `text`. */
+export declare function flattenBlockTypes(messages: Array<{
+    content?: unknown;
+}>): string[];
+/** The blocks of one message of a recorded request, for an assertion about verbatim replay. */
+export declare function messageBlocks(recorded: RecordedRequest, index: number): Array<Record<string, unknown>>;
+/** A standard Anthropic error envelope: `error.type` is the family's machine-readable code (there is no `error.code`). */
+export declare function anthropicError(status: number, type: string, message?: string, headers?: Record<string, string>): Response;
+/**
+ * The ordering constraint this endpoint actually enforces, enforced HERE too.
+ *
+ * A fake that accepts every ordering cannot fail a pin about ordering -- and this lane shipped a
+ * decoration ahead of a turn's `tool_result` blocks for two rounds with a green corpus, because
+ * nothing on the receiving end cared. The message is Winter's rendering of the documented constraint,
+ * not a captured verbatim vendor string.
+ *
+ * Returns the offending message index, or `undefined` when every turn is well-formed.
+ */
+export declare function findToolResultOrderingViolation(recorded: RecordedRequest): number | undefined;
+export interface AnthropicFakeOptions {
+    /** modelId -> the scripted answer for `POST /v1/messages`. A `Response[]` is indexed by attempt, its last element repeating (the base's own retry shape). */
+    messages: ScenarioMap;
+    /** The `POST /v1/messages/count_tokens` answer. Absent -> a fixed count, so a fixture that does not care need not script one. */
+    countTokens?: (recorded: RecordedRequest) => Response;
+    /** The `GET /v1/models` answer -- discovery AND `validateCredential` both land here. */
+    models?: (recorded: RecordedRequest) => Response | Promise<Response>;
+}
+type ScenarioMap = Record<string, ((recorded: RecordedRequest, attempt: number) => Response | Promise<Response>) | Response[]>;
+/**
+ * The three routes an Anthropic adapter can reach, wired to a model-keyed scenario table.
+ *
+ * `count_tokens` is registered BEFORE `/v1/messages` deliberately: the base matches routes in order
+ * and an exact-path match for `/v1/messages` would otherwise be fine, but keeping the more specific
+ * path first makes the ordering independent of that detail.
+ */
+export declare function anthropicFakeRoutes(opts: AnthropicFakeOptions): FakeRoute[];
+export {};