@yanlinglabs/winter-provider-conformance 0.0.2

package/dist/index-k4mhh1q5.js

@@ -0,0 +1,4377 @@
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/fakes/server.ts
+import { serve } from "bun";
+var CREDENTIAL_HEADERS = new Set(["authorization", "x-api-key", "api-key", "x-goog-api-key", "proxy-authorization", "x-amz-security-token"]);
+function redactHeaderValue(name, value) {
+  if (!CREDENTIAL_HEADERS.has(name.toLowerCase()))
+    return value;
+  const space = value.indexOf(" ");
+  return space > 0 ? `${value.slice(0, space)} ***` : "***";
+}
+async function startFake2(opts) {
+  const requests = [];
+  const closeDeadlineMs = opts.closeDeadlineMs ?? 2000;
+  const server = serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    async fetch(req) {
+      const url = new URL(req.url);
+      const headers = {};
+      req.headers.forEach((value, name) => {
+        headers[name.toLowerCase()] = redactHeaderValue(name, value);
+      });
+      const body = req.method === "GET" || req.method === "HEAD" ? "" : await req.text();
+      const recorded = { method: req.method, path: url.pathname, search: url.search, headers, body };
+      requests.push(recorded);
+      for (const route of opts.routes) {
+        if (route.method !== undefined && route.method !== req.method)
+          continue;
+        const matches = route.path.endsWith("*") ? url.pathname.startsWith(route.path.slice(0, -1)) : url.pathname === route.path;
+        if (matches)
+          return route.handler(req, recorded);
+      }
+      if (opts.fallback !== undefined)
+        return opts.fallback(req, recorded);
+      return new Response(`no fake route for ${req.method} ${url.pathname}`, { status: 404 });
+    }
+  });
+  return {
+    url: `http://127.0.0.1:${server.port}`,
+    requests,
+    async close() {
+      const stopped = Promise.resolve(server.stop(true));
+      const timeout = new Promise((resolve) => setTimeout(() => resolve("timeout"), closeDeadlineMs));
+      const result = await Promise.race([stopped.then(() => "stopped"), timeout]);
+      if (result === "timeout")
+        throw new Error(`fake server on port ${server.port} did not stop within ${closeDeadlineMs}ms`);
+    }
+  };
+}
+async function withFake2(opts, fn) {
+  const fake = await startFake2(opts);
+  try {
+    return await fn(fake);
+  } finally {
+    await fake.close();
+  }
+}
+function sseResponse2(frames, opts = {}) {
+  const encoder = new TextEncoder;
+  let written = 0;
+  const body = new ReadableStream({
+    async pull(controller) {
+      if (written >= frames.length) {
+        controller.close();
+        return;
+      }
+      if (opts.dropAfter !== undefined && written >= opts.dropAfter) {
+        controller.close();
+        return;
+      }
+      const frame = frames[written];
+      written++;
+      if (frame.delayMs !== undefined && frame.delayMs > 0)
+        await new Promise((r) => setTimeout(r, frame.delayMs));
+      const prefix = frame.event !== undefined ? `event: ${frame.event}
+` : "";
+      controller.enqueue(encoder.encode(`${prefix}data: ${frame.data}
+
+`));
+    }
+  });
+  return new Response(body, {
+    status: opts.status ?? 200,
+    headers: { "content-type": "text/event-stream", "cache-control": "no-cache", ...opts.headers ?? {} }
+  });
+}
+function jsonResponse2(value, status = 200, headers = {}) {
+  return new Response(JSON.stringify(value), { status, headers: { "content-type": "application/json", ...headers } });
+}
+function errorResponse2(status, body, headers = {}) {
+  return jsonResponse2(body, status, headers);
+}
+function redirectResponse2(location, status = 307) {
+  return new Response(null, { status, headers: { location } });
+}
+function stalledResponse2(holdMs = 1e4) {
+  let timer;
+  let done = false;
+  const body = new ReadableStream({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode(`: open
+
+`));
+      timer = setTimeout(() => {
+        if (done)
+          return;
+        done = true;
+        try {
+          controller.close();
+        } catch {}
+      }, holdMs);
+    },
+    cancel() {
+      done = true;
+      if (timer !== undefined)
+        clearTimeout(timer);
+    }
+  });
+  return new Response(body, { status: 200, headers: { "content-type": "text/event-stream" } });
+}
+function scenarioTable2(opts) {
+  const attempts = new Map;
+  return async (_req, recorded) => {
+    const model = opts.modelOf(recorded);
+    const attempt = (attempts.get(model ?? "") ?? 0) + 1;
+    attempts.set(model ?? "", attempt);
+    const entry = model !== undefined ? opts.scenarios[model] : undefined;
+    if (entry === undefined) {
+      if (opts.unknownModel !== undefined)
+        return opts.unknownModel(recorded, attempt);
+      return jsonResponse2({ error: { message: `fake: no scenario for model ${JSON.stringify(model)}` } }, 400);
+    }
+    if (Array.isArray(entry)) {
+      const index = Math.min(attempt - 1, entry.length - 1);
+      return entry[index].clone();
+    }
+    return entry(recorded, attempt);
+  };
+}
+function requestsTo2(fake, path) {
+  return fake.requests.filter((r) => r.path === path);
+}
+function noRequestContains2(fake, needle) {
+  return !fake.requests.some((r) => r.body.includes(needle) || Object.values(r.headers).some((v) => v.includes(needle)));
+}
+// src/fakes/anthropic-console-oauth.ts
+var exports_anthropic_console_oauth = {};
+__export(exports_anthropic_console_oauth, {
+  FAKE_CONSOLE_ACCESS_TOKEN: () => FAKE_CONSOLE_ACCESS_TOKEN,
+  FAKE_CONSOLE_ACCOUNT_ID: () => FAKE_CONSOLE_ACCOUNT_ID,
+  FAKE_CONSOLE_REFRESHED_ACCESS_TOKEN: () => FAKE_CONSOLE_REFRESHED_ACCESS_TOKEN,
+  FAKE_CONSOLE_REFRESH_TOKEN: () => FAKE_CONSOLE_REFRESH_TOKEN,
+  startAnthropicConsoleOauthFake: () => startAnthropicConsoleOauthFake
+});
+var FAKE_CONSOLE_ACCOUNT_ID = "acct-test-console-0001";
+var FAKE_CONSOLE_ACCESS_TOKEN = "test-token-anthropic-console-access";
+var FAKE_CONSOLE_REFRESHED_ACCESS_TOKEN = "test-token-anthropic-console-access-refreshed";
+var FAKE_CONSOLE_REFRESH_TOKEN = "test-token-anthropic-console-refresh";
+function base64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function startAnthropicConsoleOauthFake(opts = {}) {
+  const tokenRequests = [];
+  const profileRequests = [];
+  const accountId = opts.accountId ?? FAKE_CONSOLE_ACCOUNT_ID;
+  const challenges = new Set;
+  const fake = await startFake2({
+    routes: [
+      {
+        path: "/v1/oauth/token",
+        method: "POST",
+        handler: async (_req, recorded) => {
+          tokenRequests.push(recorded);
+          if (opts.failTokenWith !== undefined) {
+            return jsonResponse2({ error: "invalid_grant", error_description: "the fake refused this grant" }, opts.failTokenWith);
+          }
+          const contentType = (recorded.headers["content-type"] ?? "").split(";")[0].trim();
+          if (contentType !== "application/json") {
+            return jsonResponse2({ error: "invalid_request", error_description: `this endpoint accepts application/json only, not ${JSON.stringify(contentType)}` }, 400);
+          }
+          let body;
+          try {
+            const parsed = JSON.parse(recorded.body);
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+              throw new Error("not an object");
+            body = parsed;
+          } catch {
+            return jsonResponse2({ error: "invalid_request", error_description: "the grant body is not a JSON object" }, 400);
+          }
+          const grant = body["grant_type"];
+          if (grant === "authorization_code") {
+            if (typeof body["state"] !== "string" || body["state"].length === 0) {
+              return jsonResponse2({ error: "invalid_request", error_description: "the authorization_code grant carried no state" }, 400);
+            }
+            const verifier = typeof body["code_verifier"] === "string" ? body["code_verifier"] : "";
+            const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+            if (!challenges.has(base64Url(new Uint8Array(digest)))) {
+              return jsonResponse2({ error: "invalid_grant", error_description: "PKCE verifier does not match any challenge this fake saw" }, 400);
+            }
+          }
+          return jsonResponse2({
+            access_token: grant === "refresh_token" ? FAKE_CONSOLE_REFRESHED_ACCESS_TOKEN : FAKE_CONSOLE_ACCESS_TOKEN,
+            ...opts.omitRefreshToken === true ? {} : { refresh_token: FAKE_CONSOLE_REFRESH_TOKEN },
+            expires_in: opts.expiresIn ?? 3600,
+            scope: "user:inference user:profile",
+            token_type: "Bearer"
+          });
+        }
+      },
+      {
+        path: "/api/oauth/profile",
+        method: "GET",
+        handler: (req, recorded) => {
+          profileRequests.push(recorded);
+          if ((req.headers.get("authorization") ?? "") === "")
+            return jsonResponse2({ error: "unauthorized" }, 401);
+          return jsonResponse2({
+            ...opts.omitAccount === true ? {} : { account: { uuid: accountId, email: "person@example.test" } },
+            organization: { uuid: "org-test-console-0001" }
+          });
+        }
+      }
+    ]
+  });
+  return Object.assign(fake, {
+    authorizeUrl: `${fake.url}/oauth/authorize`,
+    tokenUrl: `${fake.url}/v1/oauth/token`,
+    profileUrl: `${fake.url}/api/oauth/profile`,
+    tokenRequests,
+    profileRequests,
+    async completeAuthorization(url, overrides = {}) {
+      const authorize = new URL(url);
+      const challenge = authorize.searchParams.get("code_challenge");
+      if (challenge !== null)
+        challenges.add(challenge);
+      const redirectUri = authorize.searchParams.get("redirect_uri");
+      if (redirectUri === null)
+        throw new Error("the authorize URL carried no redirect_uri");
+      const callback = new URL(redirectUri);
+      callback.searchParams.set("state", overrides.state ?? authorize.searchParams.get("state") ?? "");
+      if (overrides.code !== null)
+        callback.searchParams.set("code", overrides.code ?? "test-code-anthropic-console");
+      await fetch(callback.toString()).catch(() => {
+        return;
+      });
+    }
+  });
+}
+// src/fakes/anthropic-messages.ts
+var exports_anthropic_messages = {};
+__export(exports_anthropic_messages, {
+  anthropicBody: () => anthropicBody,
+  anthropicError: () => anthropicError,
+  anthropicFakeRoutes: () => anthropicFakeRoutes,
+  anthropicModelOf: () => anthropicModelOf,
+  anthropicSseFrames: () => anthropicSseFrames,
+  anthropicTurnResponse: () => anthropicTurnResponse,
+  assertAnthropicRequest: () => assertAnthropicRequest,
+  findToolResultOrderingViolation: () => findToolResultOrderingViolation,
+  flattenBlockTypes: () => flattenBlockTypes,
+  messageBlocks: () => messageBlocks
+});
+
+// src/fakes/redact-opaque.ts
+var OPAQUE_FIELD_NAMES2 = ["signature", "thoughtSignature", "data"];
+var MARKER = "[redacted: opaque provider state]";
+function walk(value) {
+  if (Array.isArray(value))
+    return value.map(walk);
+  if (value === null || typeof value !== "object")
+    return value;
+  const out = {};
+  for (const [key, inner] of Object.entries(value)) {
+    out[key] = OPAQUE_FIELD_NAMES2.includes(key) && typeof inner === "string" ? MARKER : walk(inner);
+  }
+  return out;
+}
+function redactOpaqueFields2(body) {
+  if (body.length === 0)
+    return body;
+  try {
+    return JSON.stringify(walk(JSON.parse(body)));
+  } catch {
+    return body.replace(new RegExp(`"(${OPAQUE_FIELD_NAMES2.join("|")})"\\s*:\\s*"(?:[^"\\\\]|\\\\.)*"`, "g"), (m) => `${m.slice(0, m.indexOf(":") + 1)}"${MARKER}"`);
+  }
+}
+
+// src/fakes/anthropic-messages.ts
+var frame = (event, data) => ({ event, data: JSON.stringify(data) });
+function anthropicSseFrames(script) {
+  const usage = script.usage ?? {};
+  const frames = [
+    frame("message_start", {
+      type: "message_start",
+      message: {
+        id: script.id ?? "msg_fake_1",
+        type: "message",
+        role: "assistant",
+        model: script.model ?? "fake-model",
+        content: [],
+        usage: {
+          input_tokens: usage.input_tokens ?? 0,
+          output_tokens: usage.output_tokens ?? 0,
+          ...usage.cache_creation_input_tokens !== undefined ? { cache_creation_input_tokens: usage.cache_creation_input_tokens } : {},
+          ...usage.cache_read_input_tokens !== undefined ? { cache_read_input_tokens: usage.cache_read_input_tokens } : {}
+        }
+      }
+    })
+  ];
+  script.blocks.forEach((block, index) => {
+    switch (block.type) {
+      case "text":
+        frames.push(frame("content_block_start", { type: "content_block_start", index, content_block: { type: "text", text: "" } }));
+        if (index === 0 && script.ping === true)
+          frames.push(frame("ping", { type: "ping" }));
+        for (const chunk of block.chunks) {
+          frames.push(frame("content_block_delta", { type: "content_block_delta", index, delta: { type: "text_delta", text: chunk } }));
+        }
+        break;
+      case "thinking":
+        frames.push(frame("content_block_start", { type: "content_block_start", index, content_block: { type: "thinking", thinking: "" } }));
+        if (index === 0 && script.ping === true)
+          frames.push(frame("ping", { type: "ping" }));
+        for (const chunk of block.chunks) {
+          frames.push(frame("content_block_delta", { type: "content_block_delta", index, delta: { type: "thinking_delta", thinking: chunk } }));
+        }
+        if (block.signature !== undefined) {
+          frames.push(frame("content_block_delta", { type: "content_block_delta", index, delta: { type: "signature_delta", signature: block.signature } }));
+        }
+        break;
+      case "redacted_thinking":
+        frames.push(frame("content_block_start", { type: "content_block_start", index, content_block: { type: "redacted_thinking", data: block.data } }));
+        if (index === 0 && script.ping === true)
+          frames.push(frame("ping", { type: "ping" }));
+        break;
+      case "tool_use":
+        frames.push(frame("content_block_start", { type: "content_block_start", index, content_block: { type: "tool_use", id: block.id, name: block.name, input: {} } }));
+        if (index === 0 && script.ping === true)
+          frames.push(frame("ping", { type: "ping" }));
+        for (const chunk of block.jsonChunks) {
+          frames.push(frame("content_block_delta", { type: "content_block_delta", index, delta: { type: "input_json_delta", partial_json: chunk } }));
+        }
+        break;
+    }
+    frames.push(frame("content_block_stop", { type: "content_block_stop", index }));
+  });
+  if (script.errorAfterBlocks !== undefined) {
+    frames.push(frame("error", { type: "error", error: script.errorAfterBlocks }));
+    return frames;
+  }
+  frames.push(frame("message_delta", {
+    type: "message_delta",
+    delta: { stop_reason: script.stopReason ?? "end_turn", stop_sequence: null },
+    usage: { output_tokens: usage.output_tokens ?? 0 }
+  }));
+  frames.push(frame("message_stop", { type: "message_stop" }));
+  return frames;
+}
+function anthropicTurnResponse(script, opts = {}) {
+  return sseResponse2(anthropicSseFrames(script), opts);
+}
+function anthropicModelOf(recorded) {
+  try {
+    const body = JSON.parse(recorded.body);
+    return typeof body.model === "string" ? body.model : undefined;
+  } catch {
+    return;
+  }
+}
+function anthropicBody(recorded) {
+  return JSON.parse(recorded.body);
+}
+function fail(message, recorded) {
+  throw new Error(`${message}
+  live request: ${recorded.method} ${recorded.path}${recorded.search}
+  headers: ${JSON.stringify(recorded.headers)}
+  body: ${redactOpaqueFields2(recorded.body)}`);
+}
+function assertAnthropicRequest(recorded, expected = {}) {
+  if (recorded.method !== "POST")
+    fail(`expected a POST, saw ${recorded.method}`, recorded);
+  if (recorded.headers["x-api-key"] !== "***")
+    fail(`expected a redacted x-api-key header, saw ${JSON.stringify(recorded.headers["x-api-key"])}`, recorded);
+  if (recorded.headers["authorization"] !== undefined)
+    fail("an Anthropic request must authenticate with x-api-key, never Authorization", recorded);
+  const version = expected.apiVersion ?? "2023-06-01";
+  if (recorded.headers["anthropic-version"] !== version)
+    fail(`expected anthropic-version ${version}, saw ${JSON.stringify(recorded.headers["anthropic-version"])}`, recorded);
+  if (!(recorded.headers["content-type"] ?? "").startsWith("application/json"))
+    fail(`expected a JSON content-type, saw ${JSON.stringify(recorded.headers["content-type"])}`, recorded);
+  if (expected.beta !== undefined && recorded.headers["anthropic-beta"] !== expected.beta) {
+    fail(`expected anthropic-beta ${expected.beta}, saw ${JSON.stringify(recorded.headers["anthropic-beta"])}`, recorded);
+  }
+  const body = anthropicBody(recorded);
+  if (expected.model !== undefined && body["model"] !== expected.model)
+    fail(`expected model ${expected.model}, saw ${JSON.stringify(body["model"])}`, recorded);
+  if (expected.stream !== undefined && body["stream"] !== expected.stream)
+    fail(`expected stream ${expected.stream}, saw ${JSON.stringify(body["stream"])}`, recorded);
+  if (expected.maxTokens !== undefined && body["max_tokens"] !== expected.maxTokens)
+    fail(`expected max_tokens ${expected.maxTokens}, saw ${JSON.stringify(body["max_tokens"])}`, recorded);
+  if (expected.system !== undefined && body["system"] !== expected.system)
+    fail(`expected system ${JSON.stringify(expected.system)}, saw ${JSON.stringify(body["system"])}`, recorded);
+  if (expected.thinking !== undefined && JSON.stringify(body["thinking"]) !== JSON.stringify(expected.thinking)) {
+    fail(`expected thinking ${JSON.stringify(expected.thinking)}, saw ${JSON.stringify(body["thinking"])}`, recorded);
+  }
+  if (expected.toolChoice !== undefined && JSON.stringify(body["tool_choice"]) !== JSON.stringify(expected.toolChoice)) {
+    fail(`expected tool_choice ${JSON.stringify(expected.toolChoice)}, saw ${JSON.stringify(body["tool_choice"])}`, recorded);
+  }
+  if (expected.toolNames !== undefined) {
+    const tools = Array.isArray(body["tools"]) ? body["tools"].map((t) => t.name) : [];
+    if (JSON.stringify(tools) !== JSON.stringify(expected.toolNames))
+      fail(`expected tools ${JSON.stringify(expected.toolNames)}, saw ${JSON.stringify(tools)}`, recorded);
+  }
+  const messages = Array.isArray(body["messages"]) ? body["messages"] : [];
+  if (expected.roles !== undefined) {
+    const roles = messages.map((m) => m.role);
+    if (JSON.stringify(roles) !== JSON.stringify(expected.roles))
+      fail(`expected roles ${JSON.stringify(expected.roles)}, saw ${JSON.stringify(roles)}`, recorded);
+  }
+  if (expected.blockTypes !== undefined) {
+    const types = flattenBlockTypes(messages);
+    if (JSON.stringify(types) !== JSON.stringify(expected.blockTypes))
+      fail(`expected block ordering ${JSON.stringify(expected.blockTypes)}, saw ${JSON.stringify(types)}`, recorded);
+  }
+}
+function flattenBlockTypes(messages) {
+  const out = [];
+  for (const message of messages) {
+    if (typeof message.content === "string") {
+      out.push("text");
+      continue;
+    }
+    if (!Array.isArray(message.content))
+      continue;
+    for (const block of message.content)
+      out.push(String(block.type));
+  }
+  return out;
+}
+function messageBlocks(recorded, index) {
+  const body = anthropicBody(recorded);
+  const messages = Array.isArray(body["messages"]) ? body["messages"] : [];
+  const message = messages[index];
+  if (message === undefined)
+    return [];
+  if (typeof message.content === "string")
+    return [{ type: "text", text: message.content }];
+  return Array.isArray(message.content) ? message.content : [];
+}
+function anthropicError(status, type, message = "fake error", headers = {}) {
+  return errorResponse2(status, { type: "error", error: { type, message } }, headers);
+}
+function findToolResultOrderingViolation(recorded) {
+  let body;
+  try {
+    body = JSON.parse(recorded.body);
+  } catch {
+    return;
+  }
+  const messages = Array.isArray(body.messages) ? body.messages : [];
+  for (const [index, message] of messages.entries()) {
+    if (!Array.isArray(message.content))
+      continue;
+    const blocks = message.content;
+    let sawOther = false;
+    for (const block of blocks) {
+      if (block.type === "tool_result") {
+        if (sawOther)
+          return index;
+      } else {
+        sawOther = true;
+      }
+    }
+  }
+  return;
+}
+function anthropicFakeRoutes(opts) {
+  const attempts = new Map;
+  return [
+    {
+      path: "/v1/messages/count_tokens",
+      method: "POST",
+      handler: (_req, recorded) => opts.countTokens?.(recorded) ?? new Response(JSON.stringify({ input_tokens: 42 }), { status: 200, headers: { "content-type": "application/json" } })
+    },
+    {
+      path: "/v1/messages",
+      method: "POST",
+      handler: async (_req, recorded) => {
+        const badTurn = findToolResultOrderingViolation(recorded);
+        if (badTurn !== undefined) {
+          return anthropicError(400, "invalid_request_error", `messages.${badTurn}: \`tool_result\` blocks must be at the beginning of a turn`);
+        }
+        const model = anthropicModelOf(recorded) ?? "";
+        const attempt = (attempts.get(model) ?? 0) + 1;
+        attempts.set(model, attempt);
+        const entry = opts.messages[model];
+        if (entry === undefined)
+          return anthropicError(400, "invalid_request_error", `fake: no scenario for model ${JSON.stringify(model)}`);
+        if (Array.isArray(entry))
+          return entry[Math.min(attempt - 1, entry.length - 1)];
+        return await entry(recorded, attempt);
+      }
+    },
+    {
+      path: "/v1/models",
+      method: "GET",
+      handler: async (_req, recorded) => await opts.models?.(recorded) ?? new Response(JSON.stringify({ data: [], has_more: false }), { status: 200, headers: { "content-type": "application/json" } })
+    }
+  ];
+}
+// src/fakes/azure-openai.ts
+var exports_azure_openai = {};
+__export(exports_azure_openai, {
+  FAKE_AZURE_KEY: () => FAKE_AZURE_KEY,
+  FAKE_ENTRA_TOKEN: () => FAKE_ENTRA_TOKEN,
+  apiVersionOf: () => apiVersionOf,
+  deploymentOf: () => deploymentOf,
+  startAzureFake: () => startAzureFake
+});
+
+// src/fakes/openai-chat.ts
+var exports_openai_chat = {};
+__export(exports_openai_chat, {
+  chatFrames: () => chatFrames,
+  chatModelOf: () => chatModelOf,
+  chatStream: () => chatStream,
+  deepSeekMissingReasoningError: () => deepSeekMissingReasoningError,
+  startOpenAiChatFake: () => startOpenAiChatFake,
+  toolAdjacencyRefusal: () => toolAdjacencyRefusal
+});
+function chunk(payload, delayMs) {
+  return { data: JSON.stringify(payload), ...delayMs !== undefined ? { delayMs } : {} };
+}
+function chatFrames(script) {
+  const delay = script.frameDelayMs;
+  const frames = [];
+  const id = script.id ?? "chatcmpl-fake-1";
+  const model = script.model ?? "fake-model";
+  const base = { id, object: "chat.completion.chunk", model };
+  frames.push(chunk({ ...base, choices: [{ index: 0, delta: { role: "assistant", content: "" } }] }, delay));
+  if (script.inlineError !== undefined) {
+    frames.push(chunk({ error: { message: script.inlineError.message, code: script.inlineError.code } }, delay));
+    return frames;
+  }
+  for (const text of script.reasoning ?? []) {
+    const field = script.reasoningFieldIsPlain === true ? "reasoning" : "reasoning_content";
+    frames.push(chunk({ ...base, choices: [{ index: 0, delta: { [field]: text } }] }, delay));
+  }
+  for (const call of script.toolCalls ?? []) {
+    frames.push(chunk({ ...base, choices: [{ index: 0, delta: { tool_calls: [{ index: call.index, id: call.id, type: "function", function: { name: call.name, arguments: "" } }] } }] }, delay));
+  }
+  const maxFragments = Math.max(0, ...(script.toolCalls ?? []).map((c) => c.argumentChunks.length));
+  for (let position = 0;position < maxFragments; position++) {
+    for (const call of script.toolCalls ?? []) {
+      const fragment = call.argumentChunks[position];
+      if (fragment === undefined)
+        continue;
+      frames.push(chunk({ ...base, choices: [{ index: 0, delta: { tool_calls: [{ index: call.index, function: { arguments: fragment } }] } }] }, delay));
+    }
+  }
+  if (script.anonymousToolCall === true) {
+    frames.push(chunk({ ...base, choices: [{ index: 0, delta: { tool_calls: [{ index: 7, function: { arguments: "{}" } }] } }] }, delay));
+  }
+  for (const text of script.text ?? [])
+    frames.push(chunk({ ...base, choices: [{ index: 0, delta: { content: text } }] }, delay));
+  if (script.omitFinish !== true) {
+    frames.push(chunk({ ...base, choices: [{ index: 0, delta: {}, finish_reason: script.finishReason ?? (script.toolCalls !== undefined && script.toolCalls.length > 0 ? "tool_calls" : "stop") }] }, delay));
+  }
+  if (script.usage !== undefined) {
+    frames.push(chunk({
+      ...base,
+      choices: [],
+      usage: {
+        prompt_tokens: script.usage.prompt,
+        completion_tokens: script.usage.completion,
+        total_tokens: script.usage.prompt + script.usage.completion,
+        ...script.usage.cachedPrompt !== undefined ? { prompt_tokens_details: { cached_tokens: script.usage.cachedPrompt } } : {}
+      }
+    }, delay));
+  }
+  if (script.omitDone !== true)
+    frames.push({ data: "[DONE]", ...delay !== undefined ? { delayMs: delay } : {} });
+  return frames;
+}
+function chatStream(script, opts = {}) {
+  return sseResponse2(chatFrames(script), opts.dropAfter !== undefined ? { dropAfter: opts.dropAfter } : {});
+}
+function chatModelOf(recorded) {
+  try {
+    const body = JSON.parse(recorded.body);
+    return typeof body.model === "string" ? body.model : undefined;
+  } catch {
+    return;
+  }
+}
+function toolAdjacencyRefusal(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return;
+  }
+  const messages = Array.isArray(parsed.messages) ? parsed.messages : [];
+  for (let i = 0;i < messages.length; i++) {
+    const message = messages[i];
+    if (message === null || typeof message !== "object" || message.role !== "tool")
+      continue;
+    const previous = i > 0 ? messages[i - 1] : undefined;
+    const previousRole = previous !== null && typeof previous === "object" ? previous.role : undefined;
+    const previousCalls = previous !== null && typeof previous === "object" ? previous.tool_calls : undefined;
+    const respondsToACall = previousRole === "assistant" && Array.isArray(previousCalls) && previousCalls.length > 0;
+    const followsAnotherResult = previousRole === "tool";
+    if (respondsToACall || followsAnotherResult)
+      continue;
+    return jsonResponse2({
+      error: {
+        message: `Invalid parameter: messages with role 'tool' must be a response to a preceeding message with 'tool_calls'.`,
+        type: "invalid_request_error",
+        param: `messages[${i}].role`,
+        code: null
+      }
+    }, 400);
+  }
+  return;
+}
+async function startOpenAiChatFake(opts) {
+  const dispatch = scenarioTable2({ modelOf: chatModelOf, scenarios: opts.scenarios, ...opts.unknownModel !== undefined ? { unknownModel: opts.unknownModel } : {} });
+  const handler = (req, recorded) => toolAdjacencyRefusal(recorded.body) ?? dispatch(req, recorded);
+  return startFake2({
+    routes: [
+      { path: "/chat/completions", method: "POST", handler },
+      { path: "/v1/chat/completions", method: "POST", handler },
+      { path: "/openai/deployments/*", method: "POST", handler },
+      ...opts.routes ?? []
+    ]
+  });
+}
+function deepSeekMissingReasoningError() {
+  return jsonResponse2({
+    error: {
+      message: "The last assistant message must contain reasoning_content when tools are used. Please pass back all preceding reasoning_content.",
+      type: "invalid_request_error",
+      param: "messages",
+      code: "invalid_request_error"
+    }
+  }, 400);
+}
+
+// src/fakes/openai-responses.ts
+var exports_openai_responses = {};
+__export(exports_openai_responses, {
+  callPairingRefusal: () => callPairingRefusal,
+  htmlErrorResponse: () => htmlErrorResponse,
+  notSseResponse: () => notSseResponse,
+  openAiErrorBody: () => openAiErrorBody,
+  recordedBody: () => recordedBody,
+  responsesFrames: () => responsesFrames,
+  responsesModelOf: () => responsesModelOf,
+  responsesStream: () => responsesStream,
+  startOpenAiResponsesFake: () => startOpenAiResponsesFake
+});
+function frame2(payload, delayMs) {
+  const event = typeof payload.type === "string" ? payload.type : "message";
+  return { event, data: JSON.stringify(payload), ...delayMs !== undefined ? { delayMs } : {} };
+}
+function responsesFrames(script) {
+  const delay = script.frameDelayMs;
+  const frames = [];
+  const responseId = script.id ?? "resp_fake_1";
+  frames.push(frame2({ type: "response.created", response: { id: responseId, ...script.model !== undefined ? { model: script.model } : {}, status: "in_progress" } }, delay));
+  for (const item of script.reasoningItems ?? []) {
+    frames.push(frame2({ type: "response.output_item.added", output_index: item.index, item: { id: `rs_${item.index}`, type: "reasoning", encrypted_content: `PARTIAL-${item.encrypted}`, status: "in_progress" } }, delay));
+  }
+  for (const text of script.summary ?? [])
+    frames.push(frame2({ type: "response.reasoning_summary_text.delta", delta: text }, delay));
+  for (const call of script.calls ?? []) {
+    frames.push(frame2({ type: "response.output_item.added", output_index: call.index, item: { id: call.itemId, type: "function_call", call_id: call.callId, name: call.name, arguments: "" } }, delay));
+    for (const chunk of call.argumentChunks ?? [])
+      frames.push(frame2({ type: "response.function_call_arguments.delta", item_id: call.itemId, output_index: call.index, delta: chunk }, delay));
+  }
+  for (const text of script.text ?? [])
+    frames.push(frame2({ type: "response.output_text.delta", delta: text }, delay));
+  if (script.unrepresentableCall !== undefined) {
+    frames.push(frame2({ type: "response.output_item.done", output_index: 99, item: { id: "unrep_1", type: script.unrepresentableCall, status: "completed" } }, delay));
+  }
+  for (const item of script.reasoningItems ?? []) {
+    frames.push(frame2({
+      type: "response.output_item.done",
+      output_index: item.index,
+      item: {
+        id: `rs_${item.index}`,
+        type: "reasoning",
+        ...item.summaryText !== undefined ? { summary: [{ type: "summary_text", text: item.summaryText }] } : {},
+        encrypted_content: item.encrypted,
+        status: "completed"
+      }
+    }, delay));
+  }
+  for (const call of script.calls ?? []) {
+    frames.push(frame2({
+      type: "response.output_item.done",
+      output_index: call.index,
+      item: { id: call.itemId, type: "function_call", call_id: call.callId, name: call.name, arguments: call.argumentsJson ?? (call.argumentChunks ?? []).join(""), status: "completed" }
+    }, delay));
+  }
+  if (script.failed !== undefined) {
+    frames.push(frame2({ type: "response.failed", response: { id: responseId, status: "failed", error: { code: "server_error", message: script.failed } } }, delay));
+    return frames;
+  }
+  if (script.omitCompleted === true)
+    return frames;
+  const output = [];
+  if (script.refusal === true)
+    output.push({ type: "message", role: "assistant", content: [{ type: "refusal", refusal: "I cannot help with that." }] });
+  frames.push(frame2({
+    type: "response.completed",
+    response: {
+      id: responseId,
+      status: script.incompleteReason !== undefined ? "incomplete" : "completed",
+      output,
+      ...script.incompleteReason !== undefined ? { incomplete_details: { reason: script.incompleteReason } } : {},
+      ...script.usage !== undefined ? {
+        usage: {
+          input_tokens: script.usage.input,
+          output_tokens: script.usage.output,
+          ...script.usage.cachedInput !== undefined ? { input_tokens_details: { cached_tokens: script.usage.cachedInput } } : {}
+        }
+      } : {}
+    }
+  }, delay));
+  return frames;
+}
+function responsesStream(script, opts = {}) {
+  return sseResponse2(responsesFrames(script), opts.dropAfter !== undefined ? { dropAfter: opts.dropAfter } : {});
+}
+function responsesModelOf(recorded) {
+  try {
+    const body = JSON.parse(recorded.body);
+    return typeof body.model === "string" ? body.model : undefined;
+  } catch {
+    return;
+  }
+}
+function recordedBody(recorded) {
+  return JSON.parse(recorded.body);
+}
+function callPairingRefusal(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return;
+  }
+  const input = Array.isArray(parsed.input) ? parsed.input : [];
+  const typeAt = (index) => {
+    const item = input[index];
+    return item !== null && typeof item === "object" ? item.type : undefined;
+  };
+  for (let i = 0;i < input.length; i++) {
+    if (typeAt(i) !== "function_call_output")
+      continue;
+    let previous = i - 1;
+    while (previous >= 0 && typeAt(previous) === "function_call_output")
+      previous--;
+    if (previous >= 0 && typeAt(previous) === "function_call")
+      continue;
+    return errorResponse2(400, openAiErrorBody(`Item ${i} of type 'function_call_output' must follow the 'function_call' it answers.`, "invalid_value"));
+  }
+  return;
+}
+async function startOpenAiResponsesFake(opts) {
+  const dispatch = scenarioTable2({ modelOf: responsesModelOf, scenarios: opts.scenarios, ...opts.unknownModel !== undefined ? { unknownModel: opts.unknownModel } : {} });
+  const handler = (req, recorded) => callPairingRefusal(recorded.body) ?? dispatch(req, recorded);
+  return startFake2({
+    routes: [
+      { path: "/responses", method: "POST", handler },
+      { path: "/v1/responses", method: "POST", handler },
+      { path: "/openai/v1/responses", method: "POST", handler },
+      ...opts.routes ?? []
+    ]
+  });
+}
+function openAiErrorBody(message, code, type = "invalid_request_error") {
+  return { error: { message, type, param: null, code } };
+}
+function htmlErrorResponse(status) {
+  return new Response("<html><body>gateway error</body></html>", { status, headers: { "content-type": "text/html" } });
+}
+function notSseResponse() {
+  return jsonResponse2({ definitely: "not a stream" }, 200);
+}
+
+// src/fakes/azure-openai.ts
+var FAKE_AZURE_KEY = "test-key-azure-0000";
+var FAKE_ENTRA_TOKEN = "test-token-entra-0000";
+function deploymentOf(recorded) {
+  const match = /^\/openai\/deployments\/([^/]+)\//.exec(recorded.path);
+  return match?.[1] === undefined ? undefined : decodeURIComponent(match[1]);
+}
+function apiVersionOf(recorded) {
+  return new URLSearchParams(recorded.search).get("api-version") ?? undefined;
+}
+function requireApiVersion(recorded) {
+  if (apiVersionOf(recorded) !== undefined)
+    return;
+  return jsonResponse2({ error: { code: "MissingApiVersionParameter", message: "The api-version query parameter is required." } }, 400);
+}
+function bodyRefusal(recorded) {
+  return toolAdjacencyRefusal(recorded.body) ?? callPairingRefusal(recorded.body);
+}
+function dispatch(scenarios, modelOf) {
+  const attempts = new Map;
+  return (_req, recorded) => {
+    const refusal = requireApiVersion(recorded) ?? bodyRefusal(recorded);
+    if (refusal !== undefined)
+      return refusal;
+    const model = modelOf(recorded) ?? deploymentOf(recorded);
+    const key = model ?? "";
+    const attempt = (attempts.get(key) ?? 0) + 1;
+    attempts.set(key, attempt);
+    const entry = model !== undefined ? scenarios?.[model] : undefined;
+    if (entry === undefined)
+      return jsonResponse2({ error: { code: "DeploymentNotFound", message: `fake: no scenario for ${JSON.stringify(model)}` } }, 404);
+    if (Array.isArray(entry))
+      return entry[Math.min(attempt - 1, entry.length - 1)];
+    return entry(recorded, attempt);
+  };
+}
+async function startAzureFake(opts) {
+  const models = (_req, recorded) => {
+    const refusal = requireApiVersion(recorded);
+    if (refusal !== undefined)
+      return refusal;
+    return jsonResponse2({ object: "list", data: opts.models ?? [] });
+  };
+  return startFake2({
+    routes: [
+      { path: "/openai/deployments/*", method: "POST", handler: dispatch(opts.chatScenarios, chatModelOf) },
+      { path: "/openai/v1/responses", method: "POST", handler: dispatch(opts.responsesScenarios, responsesModelOf) },
+      { path: "/openai/models", method: "GET", handler: models },
+      { path: "/openai/v1/models", method: "GET", handler: models },
+      ...opts.routes ?? []
+    ]
+  });
+}
+// src/fakes/bedrock.ts
+var exports_bedrock = {};
+__export(exports_bedrock, {
+  FAKE_ACCESS_KEY_ID: () => FAKE_ACCESS_KEY_ID,
+  FAKE_REGION: () => FAKE_REGION,
+  FAKE_SECRET_ACCESS_KEY: () => FAKE_SECRET_ACCESS_KEY,
+  bedrockError: () => bedrockError,
+  bedrockModelOf: () => bedrockModelOf,
+  concatFrames: () => concatFrames,
+  converseStreamEvent: () => converseStreamEvent,
+  converseStreamException: () => converseStreamException,
+  eventStreamResponse: () => eventStreamResponse,
+  isStreamingPath: () => isStreamingPath,
+  startBedrockFake: () => startBedrockFake,
+  textTurnFrames: () => textTurnFrames
+});
+
+// ../provider-runtime/src/adapters/bedrock/crc32.ts
+var POLYNOMIAL = 3988292384;
+var table;
+function crcTable() {
+  if (table !== undefined)
+    return table;
+  const built = new Uint32Array(256);
+  for (let n = 0;n < 256; n++) {
+    let c = n;
+    for (let k = 0;k < 8; k++) {
+      c = (c & 1) !== 0 ? POLYNOMIAL ^ c >>> 1 : c >>> 1;
+    }
+    built[n] = c >>> 0;
+  }
+  table = built;
+  return built;
+}
+function crc32(bytes, seed = 0) {
+  const t = crcTable();
+  let c = (seed ^ 4294967295) >>> 0;
+  for (let i = 0;i < bytes.length; i++) {
+    c = (t[(c ^ bytes[i]) & 255] ^ c >>> 8) >>> 0;
+  }
+  return (c ^ 4294967295) >>> 0;
+}
+
+// ../provider-runtime/src/adapters/bedrock/sigv4.ts
+var SIGV4_ALGORITHM = "AWS4-HMAC-SHA256";
+function awsUriEncode(value, encodeSlash) {
+  let out = "";
+  for (const byte of new TextEncoder().encode(value)) {
+    const char = String.fromCharCode(byte);
+    if (byte >= 65 && byte <= 90 || byte >= 97 && byte <= 122 || byte >= 48 && byte <= 57 || char === "-" || char === "_" || char === "." || char === "~") {
+      out += char;
+    } else if (char === "/" && !encodeSlash) {
+      out += "/";
+    } else {
+      out += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+  }
+  return out;
+}
+function canonicalUri(pathname) {
+  const segments = [];
+  for (const segment of pathname.split("/")) {
+    if (segment.length === 0 || segment === ".")
+      continue;
+    if (segment === "..")
+      segments.pop();
+    else
+      segments.push(segment);
+  }
+  const normalized = `${pathname.startsWith("/") ? "/" : ""}${segments.join("/")}${segments.length > 0 && pathname.endsWith("/") ? "/" : ""}`;
+  if (normalized.length === 0)
+    return "/";
+  return awsUriEncode(normalized, true).replace(/%2F/g, "/");
+}
+function canonicalQuery(search) {
+  const params = new URLSearchParams(search);
+  const pairs = [];
+  params.forEach((value, name) => {
+    pairs.push([awsUriEncode(name, true), awsUriEncode(value, true)]);
+  });
+  pairs.sort((a, b) => a[0] === b[0] ? a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0 : a[0] < b[0] ? -1 : 1);
+  return pairs.map(([name, value]) => `${name}=${value}`).join("&");
+}
+function canonicalHeaders(headers) {
+  const names = [...new Set(Object.keys(headers).map((n) => n.toLowerCase()))].sort();
+  const byLower = new Map(Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value]));
+  const canonical = names.map((name) => `${name}:${(byLower.get(name) ?? "").trim().replace(/\s+/g, " ")}
+`).join("");
+  return { canonical, signed: names.join(";") };
+}
+async function sha256Hex(bytes) {
+  const digest = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
+  return toHex(new Uint8Array(digest));
+}
+function toHex(bytes) {
+  let out = "";
+  for (const byte of bytes)
+    out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+async function hmac(key, message) {
+  const cryptoKey = await crypto.subtle.importKey("raw", key.slice().buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(message)));
+}
+async function signingKey(secretAccessKey, datestamp, region, service) {
+  let key = await hmac(new TextEncoder().encode(`AWS4${secretAccessKey}`), datestamp);
+  key = await hmac(key, region);
+  key = await hmac(key, service);
+  return await hmac(key, "aws4_request");
+}
+function buildCanonicalRequest(input) {
+  const { canonical, signed } = canonicalHeaders(input.headers);
+  const canonicalRequest = [input.method.toUpperCase(), canonicalUri(input.pathname), canonicalQuery(input.search), canonical, signed, input.payloadHash].join(`
+`);
+  return { canonicalRequest, signedHeaders: signed };
+}
+async function buildStringToSign(canonicalRequest, stamp, scope) {
+  return [SIGV4_ALGORITHM, stamp, scope, await sha256Hex(new TextEncoder().encode(canonicalRequest))].join(`
+`);
+}
+async function computeSignature(secretAccessKey, datestamp, region, service, stringToSign) {
+  return toHex(await hmac(await signingKey(secretAccessKey, datestamp, region, service), stringToSign));
+}
+function parseAuthorization(header) {
+  if (header === null || header === undefined)
+    return;
+  if (!header.startsWith(`${SIGV4_ALGORITHM} `))
+    return;
+  const parts = new Map;
+  for (const chunk of header.slice(SIGV4_ALGORITHM.length + 1).split(",")) {
+    const eq = chunk.indexOf("=");
+    if (eq < 0)
+      continue;
+    parts.set(chunk.slice(0, eq).trim(), chunk.slice(eq + 1).trim());
+  }
+  const credential = parts.get("Credential");
+  const signedHeaders = parts.get("SignedHeaders");
+  const signature = parts.get("Signature");
+  if (credential === undefined || signedHeaders === undefined || signature === undefined)
+    return;
+  const [accessKeyId, datestamp, region, service, terminator] = credential.split("/");
+  if (accessKeyId === undefined || datestamp === undefined || region === undefined || service === undefined || terminator !== "aws4_request")
+    return;
+  return { accessKeyId, datestamp, region, service, signedHeaders: signedHeaders.split(";"), signature };
+}
+
+// ../provider-runtime/src/adapters/bedrock/testing.ts
+function encodeHeader(header) {
+  const encoder = new TextEncoder;
+  const name = encoder.encode(header.name);
+  const value = encoder.encode(header.value);
+  const out = new Uint8Array(1 + name.length + 1 + 2 + value.length);
+  const view = new DataView(out.buffer);
+  let offset = 0;
+  view.setUint8(offset, name.length);
+  offset += 1;
+  out.set(name, offset);
+  offset += name.length;
+  view.setUint8(offset, 7);
+  offset += 1;
+  view.setUint16(offset, value.length);
+  offset += 2;
+  out.set(value, offset);
+  return out;
+}
+function encodeEventStreamMessage(headers, payload) {
+  const encodedHeaders = headers.map(encodeHeader);
+  const headersLength = encodedHeaders.reduce((sum, h) => sum + h.length, 0);
+  const totalLength = 16 + headersLength + payload.length;
+  const out = new Uint8Array(totalLength);
+  const view = new DataView(out.buffer);
+  view.setUint32(0, totalLength);
+  view.setUint32(4, headersLength);
+  view.setUint32(8, crc32(out.subarray(0, 8)));
+  let offset = 16 - 4;
+  for (const header of encodedHeaders) {
+    out.set(header, offset);
+    offset += header.length;
+  }
+  out.set(payload, offset);
+  view.setUint32(totalLength - 4, crc32(out.subarray(0, totalLength - 4)));
+  return out;
+}
+function converseStreamEvent(eventType, payload) {
+  return encodeEventStreamMessage([
+    { name: ":message-type", value: "event" },
+    { name: ":event-type", value: eventType },
+    { name: ":content-type", value: "application/json" }
+  ], new TextEncoder().encode(JSON.stringify(payload)));
+}
+function converseStreamException(exceptionType, payload = {}) {
+  return encodeEventStreamMessage([
+    { name: ":message-type", value: "exception" },
+    { name: ":exception-type", value: exceptionType },
+    { name: ":content-type", value: "application/json" }
+  ], new TextEncoder().encode(JSON.stringify(payload)));
+}
+function concatFrames(frames) {
+  const total = frames.reduce((sum, f) => sum + f.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const frame of frames) {
+    out.set(frame, offset);
+    offset += frame.length;
+  }
+  return out;
+}
+async function verifySigV4(input) {
+  const parsed = parseAuthorization(input.headers.get("authorization"));
+  if (parsed === undefined)
+    return { ok: false, reason: "the request carried no parseable AWS4-HMAC-SHA256 Authorization header" };
+  if (input.expectedAccessKeyId !== undefined && parsed.accessKeyId !== input.expectedAccessKeyId) {
+    return { ok: false, reason: `the credential names access key "${parsed.accessKeyId}", which this fake does not know` };
+  }
+  const url = new URL(input.url);
+  const headers = {};
+  for (const name of parsed.signedHeaders) {
+    const value = name === "host" ? url.host : input.headers.get(name);
+    if (value === null || value === undefined)
+      return { ok: false, reason: `the signature covers header "${name}", which the request does not carry` };
+    headers[name] = value;
+  }
+  const payloadHash = await sha256Hex(input.body);
+  const declaredHash = input.headers.get("x-amz-content-sha256");
+  if (declaredHash !== null && declaredHash !== payloadHash) {
+    return { ok: false, reason: "x-amz-content-sha256 does not match the body the server received" };
+  }
+  const stamp = input.headers.get("x-amz-date");
+  if (stamp === null)
+    return { ok: false, reason: "the request carried no x-amz-date" };
+  const { canonicalRequest } = buildCanonicalRequest({ method: input.method, pathname: url.pathname, search: url.search, headers, payloadHash });
+  const scope = `${parsed.datestamp}/${parsed.region}/${parsed.service}/aws4_request`;
+  const stringToSign = await buildStringToSign(canonicalRequest, stamp, scope);
+  const expected = await computeSignature(input.secretAccessKey, parsed.datestamp, parsed.region, parsed.service, stringToSign);
+  if (expected !== parsed.signature)
+    return { ok: false, reason: "the request signature does not match the one this fake computes for it" };
+  return { ok: true, accessKeyId: parsed.accessKeyId };
+}
+// ../provider-catalog/src/families.ts
+var OTHER_FAMILY_ID = "other";
+var NAMESPACE_PREFIXES = ["models/", "anthropic/", "openai/", "google/", "deepseek/", "deepseek-ai/", "meta-llama/", "meta/", "qwen/", "x-ai/", "xai/", "moonshot/", "moonshotai/", "zai-org/", "z-ai/", "minimax/", "mistralai/", "nvidia/", "cline-pass/", "hf:", "aphrodite/"];
+var BEDROCK_PREFIXES = ["us.", "eu.", "apac.", "global.", "anthropic.", "openai."];
+function canonicalModelIdOf(upstreamId) {
+  let id = upstreamId.trim().toLowerCase();
+  const account = /^accounts\/[^/]+\/models\/(.+)$/.exec(id);
+  if (account !== null)
+    id = account[1];
+  let namespaced = true;
+  while (namespaced) {
+    namespaced = false;
+    for (const prefix of NAMESPACE_PREFIXES) {
+      if (id.startsWith(prefix)) {
+        id = id.slice(prefix.length);
+        namespaced = true;
+        break;
+      }
+    }
+  }
+  let stripped = true;
+  while (stripped) {
+    stripped = false;
+    for (const prefix of BEDROCK_PREFIXES) {
+      if (id.startsWith(prefix)) {
+        id = id.slice(prefix.length);
+        stripped = true;
+      }
+    }
+  }
+  id = id.replace(/-(?:v)?\d+:\d+$/, "");
+  if (id.startsWith("zai-glm"))
+    id = id.slice("zai-".length);
+  id = id.replace(/-(\d)-(\d)(?=-|$)/g, "-$1.$2");
+  id = id.replace(/:(\d+[bB])$/, "-$1");
+  return id;
+}
+function familyIdOf(canonicalModelId, families) {
+  for (const family of families) {
+    for (const matcher of family.matchers) {
+      if (new RegExp(matcher.pattern).test(canonicalModelId))
+        return family.id;
+    }
+  }
+  return OTHER_FAMILY_ID;
+}
+function stampFamilyFields(rows, families) {
+  return rows.map((row) => {
+    const canonicalModelId = row.canonicalModelId ?? canonicalModelIdOf(row.upstreamId);
+    const modelFamily = row.modelFamily ?? familyIdOf(canonicalModelId, families);
+    return { ...row, canonicalModelId, modelFamily };
+  });
+}
+
+// ../provider-catalog/src/validate.ts
+var SECRET_FIELD_NAME_RE = /^(?:api[_-]?key|apikey|secret|secret[_-]?key|password|passwd|token|access[_-]?token|refresh[_-]?token|id[_-]?token|bearer|private[_-]?key|client[_-]?secret|session[_-]?token|credential|credentials|authorization|auth[_-]?token|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?access[_-]?key[_-]?id)$/i;
+var SECRET_VALUE_PATTERNS = [
+  { name: "PEM private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "OpenAI/Anthropic-style `sk-` key", re: /\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}/ },
+  { name: "AWS access key id", re: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA)[0-9A-Z]{16}\b/ },
+  { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35,}/ },
+  { name: "GitHub token", re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}|\bgithub_pat_[A-Za-z0-9_]{20,}/ },
+  { name: "Slack token", re: /\bxox[baprse]-[A-Za-z0-9-]{10,}/ },
+  { name: "JWT", re: /\bey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { name: "inline Bearer credential", re: /\bBearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/i },
+  { name: "OpenRouter-style `sk-or-` key", re: /\bsk-or-[A-Za-z0-9_-]{10,}/ }
+];
+function scanForSecrets(value, path = "", seen = new Set, depth = 0) {
+  const findings = [];
+  if (depth > 64)
+    return [`${path || "<root>"}: nesting deeper than 64 levels — refusing to scan further`];
+  if (typeof value === "string") {
+    for (const { name, re } of SECRET_VALUE_PATTERNS) {
+      if (re.test(value))
+        findings.push(`${path || "<root>"}: looks like a secret (${name})`);
+    }
+    return findings;
+  }
+  if (value === null || typeof value !== "object")
+    return findings;
+  if (seen.has(value))
+    return findings;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    for (let i = 0;i < value.length; i++)
+      findings.push(...scanForSecrets(value[i], `${path}[${i}]`, seen, depth + 1));
+    return findings;
+  }
+  for (const [k, v] of Object.entries(value)) {
+    const child = path ? `${path}.${k}` : k;
+    if (SECRET_FIELD_NAME_RE.test(k) && typeof v === "string" && v.length > 0) {
+      findings.push(`${child}: a descriptor must never carry a credential-shaped FIELD (\`${k}\`)`);
+    }
+    findings.push(...scanForSecrets(v, child, seen, depth + 1));
+  }
+  return findings;
+}
+// ../provider-runtime/src/credentials/types.ts
+class CredentialResolutionError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "CredentialResolutionError";
+    this.code = code;
+  }
+}
+function redactRef(ref) {
+  switch (ref.kind) {
+    case "keychain":
+      return `keychain:${ref.service ?? "<default service>"}/${ref.account}`;
+    case "env":
+      return `env:${ref.name}`;
+    case "file":
+      return `file:${ref.path} (${ref.format}${ref.profile === undefined ? "" : `, profile ${ref.profile}`})`;
+    case "inline":
+      return "inline:***";
+    case "aws-default-chain":
+      return "aws-default-chain";
+    case "none":
+      return "none";
+  }
+}
+function isNoCredential(ref) {
+  return ref.kind === "none";
+}
+function unsupported(storeName, ref) {
+  return new CredentialResolutionError("unsupported", `${storeName}: cannot resolve a credential reference of kind "${ref.kind}" (${redactRef(ref)})`);
+}
+
+// ../provider-runtime/src/credentials/memory.ts
+var NAME = "memory credential store";
+function recordKey(ref) {
+  return `${ref.service ?? ""} ${ref.account}`;
+}
+function createMemoryCredentialStore(seed) {
+  const records = new Map;
+  for (const [ref, material] of seed ?? [])
+    records.set(recordKey(ref), material);
+  return {
+    async get(ref) {
+      if (isNoCredential(ref))
+        return null;
+      if (ref.kind === "keychain")
+        return records.get(recordKey(ref)) ?? null;
+      if (ref.kind === "inline")
+        return ref.value.length > 0 ? { kind: "api-key", key: ref.value } : null;
+      throw unsupported(NAME, ref);
+    },
+    async set(ref, material) {
+      records.set(recordKey(ref), material);
+    },
+    async delete(ref) {
+      records.delete(recordKey(ref));
+    },
+    size() {
+      return records.size;
+    }
+  };
+}
+
+// ../provider-runtime/src/adapters/openai/testing.ts
+var TEST_API_KEY = "test-key-openai-0000";
+function evidence(value, confidence = "verified") {
+  return { value, source: "official-doc", confidence, observedAt: "2026-09-05T00:00:00Z" };
+}
+var stampRow = (row) => stampFamilyFields([row], [])[0];
+function descriptor(overrides = {}) {
+  const key = overrides.key ?? "openai/o4-mini";
+  return stampRow({
+    key,
+    providerId: overrides.providerId ?? key.split("/")[0],
+    upstreamId: overrides.upstreamId ?? key.slice(key.indexOf("/") + 1),
+    displayName: key,
+    aliases: [],
+    endpoints: ["responses"],
+    inputModalities: evidence(overrides.inputModalities ?? ["text", "image"]),
+    outputModalities: evidence(["text"]),
+    toolCalling: evidence(overrides.toolCalling ?? "native"),
+    nativeTools: evidence(true),
+    ...overrides.parallelTools !== undefined ? { parallelTools: evidence(overrides.parallelTools) } : {},
+    ...overrides.maxOutputTokens !== undefined ? { maxOutputTokens: evidence(overrides.maxOutputTokens) } : {},
+    ...overrides.noReasoning === true ? {} : {
+      reasoning: {
+        supported: evidence(true),
+        efforts: overrides.efforts ?? ["low", "medium", "high"],
+        ...overrides.defaultEffort !== undefined ? { defaultEffort: overrides.defaultEffort } : {},
+        continuation: overrides.continuation ?? "opaque-provider-state",
+        readableState: evidence(overrides.readableState ?? "summary"),
+        ...overrides.summaryValues !== undefined ? { summaryRequest: evidence({ field: "reasoning.summary", values: overrides.summaryValues }) } : {},
+        ...overrides.continuationDomain !== undefined ? { continuationDomain: evidence(overrides.continuationDomain) } : {}
+      }
+    },
+    unsupportedParameters: overrides.unsupportedParameters ?? [],
+    status: "candidate"
+  });
+}
+var KEYCHAIN_REF = { kind: "keychain", account: "openai:test" };
+function testContext(opts = {}) {
+  const key = opts.apiKey === undefined ? TEST_API_KEY : opts.apiKey;
+  const credentials = createMemoryCredentialStore(key === null ? [] : [[KEYCHAIN_REF, { kind: "api-key", key }]]);
+  const connection = {
+    providerId: opts.providerId ?? "openai",
+    ...opts.baseUrl !== undefined ? { baseUrl: opts.baseUrl } : {},
+    ...opts.local !== undefined ? { local: opts.local } : {},
+    ...opts.headers !== undefined ? { headers: opts.headers } : {},
+    ...opts.deployment !== undefined ? { deployment: opts.deployment } : {},
+    ...opts.apiVersion !== undefined ? { apiVersion: opts.apiVersion } : {}
+  };
+  return {
+    connection,
+    credentials,
+    authRef: opts.authRef ?? (key === null ? { kind: "none" } : KEYCHAIN_REF),
+    stallTimeoutMs: opts.stallTimeoutMs ?? 2000,
+    log: (event) => opts.logs?.push(event)
+  };
+}
+function testDiscoveryContext(opts = {}) {
+  return {
+    ...testContext(opts),
+    ...opts.signal !== undefined ? { signal: opts.signal } : {},
+    limits: { maxBytes: opts.maxBytes ?? 1024 * 1024, maxItems: opts.maxItems ?? 100, timeoutMs: opts.timeoutMs ?? 5000 }
+  };
+}
+var FAST_RETRY = { maxRetries: 3, random: () => 0.5, sleep: (_ms) => new Promise((r) => setTimeout(r, 1)) };
+// ../provider-runtime/src/bun-required.ts
+function brandedInstanceOf(brand) {
+  return (candidate) => typeof candidate === "object" && candidate !== null && (brand in candidate);
+}
+var BUN_REQUIRED_BRAND = Symbol.for("@yanlinglabs/winter-provider-runtime:BunRequiredError");
+
+class BunRequiredError extends Error {
+  name = "BunRequiredError";
+  [BUN_REQUIRED_BRAND] = true;
+  static [Symbol.hasInstance] = brandedInstanceOf(BUN_REQUIRED_BRAND);
+  functionName;
+  bunApi;
+  constructor(functionName, bunApi, detail) {
+    super(`${functionName}() requires the Bun runtime: it uses ${bunApi}, which has no Node equivalent this package implements. ${detail}`);
+    this.functionName = functionName;
+    this.bunApi = bunApi;
+  }
+}
+function hasBunRuntime() {
+  return typeof globalThis.Bun !== "undefined";
+}
+function requireBunRuntime(functionName, bunApi, detail) {
+  if (!hasBunRuntime())
+    throw new BunRequiredError(functionName, bunApi, detail);
+}
+// ../provider-runtime/src/adapters/openai/xai-oauth.testing.ts
+var ACCOUNT_ID = "acct-x";
+var REFRESHED_ACCESS_TOKEN = "test-token-xai-access-refreshed";
+function fakeIdToken(sub = ACCOUNT_ID) {
+  const b64 = (value) => btoa(JSON.stringify(value)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return `${b64({ alg: "ES256", typ: "JWT" })}.${b64({ sub, email: "someone@example.invalid" })}.c2ln`;
+}
+async function startXaiOauthFake(opts = {}) {
+  requireBunRuntime("startXaiOauthFake", "Bun.serve", "It binds a loopback HTTP server on 127.0.0.1:0 to stand in for the vendor. Drive it from a Bun test process; a Node consumer has no fake to start.");
+  const requests = [];
+  let polls = 0;
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch: async (req) => {
+      const url = new URL(req.url);
+      const body = await req.text();
+      const headers = {};
+      for (const [name, value] of req.headers) {
+        headers[name.toLowerCase()] = /^(authorization|x-api-key|api-key)$/i.test(name) ? `${value.split(" ")[0] ?? ""} ***`.trim() : value;
+      }
+      requests.push({ method: req.method, path: url.pathname, headers, body });
+      const form = new URLSearchParams(body);
+      const identity = form.get("referrer");
+      if (identity === null || identity.length === 0) {
+        return Response.json({ error: "invalid_request", error_description: "the client did not identify itself" }, { status: 400 });
+      }
+      if (url.pathname === "/oauth2/device/code") {
+        return Response.json({
+          device_code: "test-device-code-xai",
+          user_code: "WXYZ-1234",
+          verification_uri: "https://example.invalid/activate",
+          verification_uri_complete: "https://example.invalid/activate?user_code=WXYZ-1234",
+          interval: 0,
+          expires_in: 900
+        });
+      }
+      if (url.pathname === "/oauth2/token") {
+        if (form.get("grant_type") === "refresh_token") {
+          return Response.json({ access_token: REFRESHED_ACCESS_TOKEN, expires_in: 3600, token_type: "Bearer" });
+        }
+        if (opts.rejectIdentity !== undefined && identity === opts.rejectIdentity) {
+          return Response.json({ error: "access_denied", error_description: "client not allowed" }, { status: 400 });
+        }
+        if (opts.tokenError !== undefined) {
+          return Response.json({ error: opts.tokenError, error_description: "the fixture's ordinary failure" }, { status: 400 });
+        }
+        polls += 1;
+        if (polls <= (opts.pendingPolls ?? 0))
+          return Response.json({ error: "authorization_pending" }, { status: 400 });
+        return Response.json({
+          access_token: "test-token-xai-access",
+          refresh_token: "test-token-xai-refresh",
+          ...opts.omitIdToken === true ? {} : { id_token: fakeIdToken() },
+          expires_in: 3600,
+          token_type: "Bearer"
+        });
+      }
+      return Response.json({ error: "not_found" }, { status: 404 });
+    }
+  });
+  return {
+    deviceCodeUrl: `http://127.0.0.1:${server.port}/oauth2/device/code`,
+    tokenUrl: `http://127.0.0.1:${server.port}/oauth2/token`,
+    requests,
+    close: async () => {
+      await server.stop(true);
+    }
+  };
+}
+// ../sdk/src/brand.ts
+var WINTER_BRAND = Object.freeze({
+  productName: "Winter",
+  packageName: "winter-agent-sdk",
+  homeDirName: ".winter",
+  projectDirName: ".winter",
+  instructionsFile: "WINTER.md",
+  envPrefix: "WINTER_",
+  keychainService: "com.winter.core",
+  mcpServerName: "winter",
+  presetName: "winter_code",
+  processLabel: "winter",
+  codexOriginator: "winter",
+  tempRootName: "winter",
+  pluginManifestDir: ".winter-plugin",
+  contactUrl: "https://github.com/yanlingLabs/winter-agent-sdk"
+});
+
+// ../sdk/src/options.ts
+var DEFAULT_PLANS_DIRECTORY = `${WINTER_BRAND.projectDirName}/plans`;
+var DEFAULT_KEYCHAIN_SERVICE = WINTER_BRAND.keychainService;
+// ../sdk/src/messaging/outcomes.ts
+var DEFAULT_MESSAGE_TTL_MS = 24 * 60 * 60 * 1000;
+var DEFAULT_HOLD_EXPIRY_MS = 5 * 60 * 1000;
+var NOTIFY_IDLE_EXPIRY_MS = 12 * 60 * 60 * 1000;
+// ../sdk/src/messaging/inbound.ts
+var PROMPTING_MODES = new Set(["default", "acceptEdits", "dontAsk", "auto"]);
+// ../sdk/src/messaging/router.ts
+var SUCCESS_CLASS_STATUSES = new Set(["delivered", "queued", "resumed_and_delivered"]);
+// ../sdk/src/protocol/messaging.ts
+var MESSAGING_CONTROL_SUBTYPES = {
+  listReachable: "messaging.list_reachable",
+  deliver: "messaging.deliver",
+  steerChild: "messaging.steer_child",
+  resumeChild: "messaging.resume_child",
+  subscribeIdle: "messaging.subscribe_idle",
+  senderClass: "messaging.sender_class",
+  readNotifications: "messaging.read_notifications",
+  idleNotice: "messaging.idle_notice"
+};
+var MESSAGING_HOST_REQUEST_SUBTYPES = [
+  MESSAGING_CONTROL_SUBTYPES.listReachable,
+  MESSAGING_CONTROL_SUBTYPES.deliver,
+  MESSAGING_CONTROL_SUBTYPES.steerChild,
+  MESSAGING_CONTROL_SUBTYPES.resumeChild,
+  MESSAGING_CONTROL_SUBTYPES.subscribeIdle,
+  MESSAGING_CONTROL_SUBTYPES.senderClass,
+  MESSAGING_CONTROL_SUBTYPES.readNotifications
+];
+var MESSAGING_RUNTIME_REQUEST_SUBTYPES = [MESSAGING_CONTROL_SUBTYPES.idleNotice];
+var MESSAGING_CONTROL_SUBTYPE_LIST = Object.values(MESSAGING_CONTROL_SUBTYPES);
+
+// ../sdk/src/query.ts
+var DEFAULT_MAX_BUFFER_SIZE = 1024 * 1024;
+// ../sdk/src/store/session-store.ts
+import {
+  mkdirSync,
+  lstatSync,
+  chmodSync,
+  readdirSync,
+  readFileSync,
+  statSync,
+  openSync,
+  fsyncSync,
+  closeSync,
+  renameSync,
+  rmSync,
+  ftruncateSync,
+  constants as fsConstants
+} from "node:fs";
+var APPEND_FLAGS = fsConstants.O_WRONLY | fsConstants.O_APPEND | fsConstants.O_CREAT | fsConstants.O_NOFOLLOW;
+var RW_EXISTING_FLAGS = fsConstants.O_RDWR | fsConstants.O_NOFOLLOW;
+// ../sdk/src/settings/model-slots.ts
+import { CLAUDE_RESERVED_SLOT_NAMES as CLAUDE_RESERVED_SLOT_NAMES2, CURRENCY_RE as CURRENCY_RE2, SLOT_NAME_RE as SLOT_NAME_RE2 } from "@yanlinglabs/winter-provider-catalog/families";
+// ../provider-runtime/src/adapters/openai/codex-config.ts
+var CODEX = {
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  authorizeUrl: "https://auth.openai.com/oauth/authorize",
+  tokenUrl: "https://auth.openai.com/oauth/token",
+  callbackPort: 1455,
+  fallbackCallbackPort: 1457,
+  scope: "openid profile email offline_access api.connectors.read api.connectors.invoke",
+  backendUrl: "https://chatgpt.com/backend-api/codex",
+  headers: {
+    "OpenAI-Beta": "responses=experimental",
+    originator: WINTER_BRAND.codexOriginator
+  }
+};
+var CODEX_ORIGINATOR = WINTER_BRAND.codexOriginator;
+// ../provider-runtime/src/endpoint-policy.ts
+import { isIP } from "node:net";
+
+// ../provider-runtime/src/address-classifier.ts
+var LOCAL_CLASSES = new Set(["loopback", "private", "link-local", "unique-local"]);
+function isLocalAddressClass(cls) {
+  return LOCAL_CLASSES.has(cls);
+}
+function classifyIPv4(ip) {
+  const parts = ip.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255))
+    return "invalid";
+  const [a, b] = parts;
+  if (a === 0)
+    return "unspecified";
+  if (a === 127)
+    return "loopback";
+  if (a === 10)
+    return "private";
+  if (a === 172 && b >= 16 && b <= 31)
+    return "private";
+  if (a === 192 && b === 168)
+    return "private";
+  if (a === 169 && b === 254)
+    return "link-local";
+  if (a === 100 && b >= 64 && b <= 127)
+    return "cgnat";
+  if (a >= 224 && a <= 239)
+    return "multicast";
+  return "public";
+}
+function ipv4FromHexGroups(g1, g2) {
+  const h1 = parseInt(g1, 16);
+  const h2 = parseInt(g2, 16);
+  return `${h1 >> 8 & 255}.${h1 & 255}.${h2 >> 8 & 255}.${h2 & 255}`;
+}
+function classifyIPv6(ip) {
+  const lower = ip.toLowerCase();
+  const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(lower);
+  if (mappedDotted)
+    return classifyIPv4(mappedDotted[1]);
+  const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(lower);
+  if (mappedHex)
+    return classifyIPv4(ipv4FromHexGroups(mappedHex[1], mappedHex[2]));
+  if (lower === "::1")
+    return "loopback";
+  if (lower === "::")
+    return "unspecified";
+  const firstGroupText = lower.split(":")[0] ?? "";
+  const firstGroup = firstGroupText.length > 0 ? parseInt(firstGroupText, 16) : NaN;
+  if (!Number.isNaN(firstGroup)) {
+    if (firstGroup >= 65152 && firstGroup <= 65215)
+      return "link-local";
+    if (firstGroup >= 64512 && firstGroup <= 65023)
+      return "unique-local";
+  }
+  return "public";
+}
+function classifyAddress(address, family) {
+  return family === 6 ? classifyIPv6(address) : classifyIPv4(address);
+}
+
+// ../provider-runtime/src/endpoint-policy.ts
+function connectionEndpointOptions(connection) {
+  return {
+    generated: connection.endpointOrigin === "reviewed",
+    ...connection.local === true ? { local: true } : {}
+  };
+}
+var CREDENTIAL_HEADER_NAMES = [
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "cookie2",
+  "x-api-key",
+  "api-key",
+  "x-goog-api-key",
+  "x-amz-security-token",
+  "x-amz-date",
+  "x-amz-content-sha256",
+  "openai-organization",
+  "openai-project",
+  "x-goog-user-project"
+];
+function stripCredentialHeaders(headers) {
+  const out = new Headers(headers);
+  for (const name of CREDENTIAL_HEADER_NAMES)
+    out.delete(name);
+  return out;
+}
+function applyPrivilegedHeaders(policy, headers) {
+  return policy.generated ? { ...headers } : {};
+}
+function stripBrackets(hostname) {
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function classifyHost(hostname) {
+  const bare = stripBrackets(hostname);
+  const family = isIP(bare);
+  if (family !== 0)
+    return classifyAddress(bare, family);
+  return bare.toLowerCase() === "localhost" ? "loopback" : undefined;
+}
+function evaluateUrlShape(rawUrl, opts) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return { ok: false, reason: `endpoint "${rawUrl}" is not a parseable absolute URL` };
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    return { ok: false, reason: `endpoint "${rawUrl}" has an unsupported scheme "${url.protocol}" — only http and https are endpoints` };
+  }
+  if (url.username.length > 0 || url.password.length > 0) {
+    return { ok: false, reason: `endpoint "${url.origin}${url.pathname}" carries userinfo — a credential must never ride a URL` };
+  }
+  const cls = classifyHost(url.hostname);
+  if (cls === "invalid" || cls === "unspecified" || cls === "multicast" || cls === "cgnat") {
+    return { ok: false, reason: `endpoint "${url.origin}" resolves to a ${cls} address, which is never a provider endpoint` };
+  }
+  const literalLocal = cls !== undefined && isLocalAddressClass(cls);
+  const treatAsLocal = literalLocal && (opts.local === true || opts.generated);
+  if (literalLocal && !treatAsLocal) {
+    return {
+      ok: false,
+      reason: `endpoint "${url.origin}" points at a ${cls} address but the connection is not declared local — set \`connection.local: true\` to reach a local installation deliberately`
+    };
+  }
+  if (url.protocol === "http:" && !treatAsLocal) {
+    return {
+      ok: false,
+      reason: `endpoint "${url.origin}" uses plain http, which is permitted only for a literal loopback/private/link-local address on a connection declared local`
+    };
+  }
+  return { ok: true, origin: url.origin, local: treatAsLocal };
+}
+function evaluateEndpoint(baseUrl, opts) {
+  const shape = evaluateUrlShape(baseUrl, opts);
+  if (!shape.ok)
+    return shape;
+  const url = new URL(baseUrl);
+  if (url.search.length > 0) {
+    return { ok: false, reason: `endpoint "${url.origin}${url.pathname}" carries a query string — request parameters belong in the adapter's own request, never in a stored endpoint` };
+  }
+  if (url.hash.length > 0) {
+    return { ok: false, reason: `endpoint "${url.origin}${url.pathname}" carries a fragment, which is meaningless to a request` };
+  }
+  return shape;
+}
+function sameHost(a, b) {
+  try {
+    return new URL(a).hostname === new URL(b).hostname;
+  } catch {
+    return false;
+  }
+}
+function createEndpointPolicy(baseUrl, opts) {
+  const evaluated = evaluateEndpoint(baseUrl, opts);
+  if (!evaluated.ok)
+    return evaluated;
+  const { origin, local } = evaluated;
+  const generated = opts.generated;
+  return {
+    ok: true,
+    policy: {
+      origin,
+      local,
+      generated,
+      evaluateRedirect(target) {
+        const strict = evaluateUrlShape(target, { generated: false });
+        if (strict.ok)
+          return { ok: true, origin: strict.origin, sameOrigin: strict.origin === origin };
+        if (local) {
+          const lenient = evaluateUrlShape(target, { generated: false, local: true });
+          if (lenient.ok && sameHost(lenient.origin, origin)) {
+            return { ok: true, origin: lenient.origin, sameOrigin: lenient.origin === origin };
+          }
+        }
+        return { ok: false, reason: `redirect refused: ${strict.reason}` };
+      }
+    }
+  };
+}
+
+// ../provider-runtime/src/http.ts
+var DEFAULT_MAX_REDIRECTS = 5;
+
+class ProviderRequestError extends Error {
+  code;
+  retryable;
+  constructor(fields) {
+    super(fields.message);
+    this.name = "ProviderRequestError";
+    this.code = fields.code;
+    this.retryable = fields.retryable;
+    Object.assign(this, {
+      ...fields.status !== undefined ? { status: fields.status } : {},
+      ...fields.providerCode !== undefined ? { providerCode: fields.providerCode } : {},
+      ...fields.retryAfterMs !== undefined ? { retryAfterMs: fields.retryAfterMs } : {}
+    });
+  }
+}
+
+class ProviderBodyLimitError extends ProviderRequestError {
+  constructor(maxBodyBytes) {
+    super({ code: "capability", message: `provider response body exceeded the ${maxBodyBytes}-byte limit`, retryable: false });
+    this.name = "ProviderBodyLimitError";
+  }
+}
+function policyRefusal(reason) {
+  return new ProviderRequestError({ code: "capability", message: reason, retryable: false });
+}
+function capBody(body, maxBodyBytes, signal) {
+  const reader = body.getReader();
+  let seen = 0;
+  let onAbort;
+  const detach = () => {
+    if (signal !== undefined && onAbort !== undefined)
+      signal.removeEventListener("abort", onAbort);
+    onAbort = undefined;
+  };
+  return new ReadableStream({
+    start(controller) {
+      if (signal === undefined)
+        return;
+      const abortError = () => {
+        const err = new Error("provider response body aborted by the caller");
+        err.name = "AbortError";
+        return err;
+      };
+      if (signal.aborted) {
+        reader.cancel().catch(() => {});
+        controller.error(abortError());
+        return;
+      }
+      onAbort = () => {
+        reader.cancel().catch(() => {});
+        controller.error(abortError());
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+    },
+    async pull(controller) {
+      const { done, value } = await reader.read();
+      if (done) {
+        detach();
+        controller.close();
+        return;
+      }
+      seen += value.byteLength;
+      if (seen > maxBodyBytes) {
+        detach();
+        reader.cancel().catch(() => {});
+        controller.error(new ProviderBodyLimitError(maxBodyBytes));
+        return;
+      }
+      controller.enqueue(value);
+    },
+    cancel(reason) {
+      detach();
+      reader.cancel(reason).catch(() => {});
+    }
+  });
+}
+function isNonReplayableBody(body) {
+  if (body === undefined || body === null || typeof body !== "object")
+    return false;
+  const candidate = body;
+  return "getReader" in candidate || Symbol.asyncIterator in candidate;
+}
+function transportError(err, callerAborted, timedOut, timeoutMs) {
+  if (callerAborted)
+    return new ProviderRequestError({ code: "aborted", message: "provider request aborted by the caller", retryable: false });
+  if (timedOut)
+    return new ProviderRequestError({ code: "timeout", message: `provider did not send response headers within ${timeoutMs}ms`, retryable: true });
+  return new ProviderRequestError({ code: "network", message: err instanceof Error ? err.message : String(err), retryable: true });
+}
+async function boundedFetch(url, init) {
+  const maxRedirects = init.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+  const { timeoutMs, maxBodyBytes, policy, signal, maxRedirects: _ignored, body: initialBody, method: initialMethod, ...requestInit } = init;
+  const firstHop = policy.evaluateRedirect(url);
+  if (!firstHop.ok)
+    throw policyRefusal(firstHop.reason);
+  if (!firstHop.sameOrigin) {
+    throw policyRefusal(`request URL origin ${firstHop.origin} is not this connection's endpoint origin ${policy.origin}`);
+  }
+  let currentUrl = url;
+  let headers = new Headers(requestInit.headers ?? {});
+  let method = initialMethod ?? "GET";
+  let body = initialBody;
+  for (let hop = 0;; hop++) {
+    const controller = new AbortController;
+    let timedOut = false;
+    let callerAborted = signal?.aborted === true;
+    const onCallerAbort = () => {
+      callerAborted = true;
+      controller.abort();
+    };
+    if (callerAborted)
+      throw transportError(undefined, true, false, timeoutMs);
+    signal?.addEventListener("abort", onCallerAbort, { once: true });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+    let response;
+    try {
+      response = await fetch(currentUrl, { ...requestInit, method, ...body !== undefined && body !== null ? { body } : {}, headers, redirect: "manual", signal: controller.signal });
+    } catch (err) {
+      throw transportError(err, callerAborted, timedOut, timeoutMs);
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onCallerAbort);
+    }
+    const location = response.status >= 300 && response.status < 400 ? response.headers.get("location") : null;
+    if (location === null) {
+      if (response.body === null)
+        return response;
+      return new Response(capBody(response.body, maxBodyBytes, signal), {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    }
+    if (hop >= maxRedirects)
+      throw policyRefusal(`provider request exceeded ${maxRedirects} redirects — refusing to follow further`);
+    let target;
+    try {
+      target = new URL(location, currentUrl).toString();
+    } catch {
+      throw policyRefusal(`provider returned an unparseable Location header`);
+    }
+    const verdict = policy.evaluateRedirect(target);
+    if (!verdict.ok)
+      throw policyRefusal(verdict.reason);
+    response.body?.cancel().catch(() => {});
+    if (response.status === 303) {
+      method = "GET";
+      body = undefined;
+      headers.delete("content-type");
+      headers.delete("content-length");
+    } else if (isNonReplayableBody(body)) {
+      throw policyRefusal(`provider redirected a request whose body is a stream, which cannot be replayed — buffer the body or point the connection at the final URL`);
+    }
+    if (!verdict.sameOrigin) {
+      if (body !== undefined && body !== null) {
+        throw policyRefusal(`provider redirected a request WITH A BODY from ${policy.origin} to ${verdict.origin}; refusing to re-send the request payload (which may carry conversation content and opaque provider state) to another origin`);
+      }
+      headers = stripCredentialHeaders(headers);
+    }
+    currentUrl = target;
+  }
+}
+// ../provider-runtime/package.json
+var package_default = {
+  name: "@yanlinglabs/winter-provider-runtime",
+  version: "0.0.2",
+  license: "MIT",
+  type: "module",
+  engines: {
+    node: ">=18"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/yanlingLabs/winter-agent-sdk.git",
+    directory: "packages/provider-runtime"
+  },
+  homepage: "https://github.com/yanlingLabs/winter-agent-sdk",
+  bugs: {
+    url: "https://github.com/yanlingLabs/winter-agent-sdk/issues"
+  },
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      bun: "./src/index.ts",
+      default: "./dist/index.js"
+    },
+    "./testing": {
+      types: "./dist/testing.d.ts",
+      bun: "./src/testing.ts",
+      default: "./dist/testing.js"
+    }
+  },
+  files: [
+    "dist",
+    "NOTICE",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    prepack: `node -e "if(!/\\bpnpm\\//.test(process.env.npm_config_user_agent||''))throw new Error('pack/publish this package with pnpm. publishConfig.exports is a pnpm-only feature: under npm the override is ignored, so the packed manifest keeps a bun condition pointing at src/ -- which files does not ship -- and the tarball is broken for every Bun consumer while installing fine under Node. See RELEASING.md.')"`
+  },
+  publishConfig: {
+    access: "restricted",
+    exports: {
+      ".": {
+        types: "./dist/index.d.ts",
+        default: "./dist/index.js"
+      },
+      "./testing": {
+        types: "./dist/testing.d.ts",
+        default: "./dist/testing.js"
+      }
+    }
+  },
+  winter: {
+    publish: {
+      npm: true
+    }
+  },
+  dependencies: {
+    "@yanlinglabs/winter-agent-sdk": "workspace:*",
+    "@yanlinglabs/winter-provider-catalog": "workspace:*"
+  }
+};
+
+// ../provider-runtime/src/identity.ts
+var DEFAULT_IDENTITY = Object.freeze({ product: WINTER_BRAND.packageName, codexOriginator: WINTER_BRAND.codexOriginator, contactUrl: WINTER_BRAND.contactUrl });
+var activeIdentity = DEFAULT_IDENTITY;
+function winterUserAgent() {
+  return `${activeIdentity.product}/${package_default.version}`;
+}
+var VERSION_PLACEHOLDER = "<version>";
+var PRODUCT_PLACEHOLDER = "<product>";
+var CONTACT_PLACEHOLDER = "<contact>";
+function renderIdentityHeaders(declared, ctx) {
+  const out = {};
+  for (const [name, value] of Object.entries(declared)) {
+    out[name] = value.split(PRODUCT_PLACEHOLDER).join(ctx.product).split(VERSION_PLACEHOLDER).join(ctx.version).split(CONTACT_PLACEHOLDER).join(ctx.contact);
+  }
+  return out;
+}
+function winterIdentityHeaders(lookup, providerId) {
+  const declared = lookup?.(providerId);
+  if (declared === undefined)
+    return {};
+  return renderIdentityHeaders(declared, { version: package_default.version, product: activeIdentity.product, contact: activeIdentity.contactUrl });
+}
+// ../provider-runtime/src/errors.ts
+var BODY_SNIPPET_CHARS = 200;
+
+class ProviderStallError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProviderStallError";
+  }
+}
+function parseProviderErrorCode(body) {
+  if (!body)
+    return;
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return;
+  }
+  if (parsed === null || typeof parsed !== "object")
+    return;
+  const err = parsed.error;
+  if (err === null || typeof err !== "object")
+    return;
+  const envelope = err;
+  for (const candidate of [envelope.code, envelope.type, envelope.status]) {
+    if (typeof candidate === "string" && candidate.length > 0)
+      return candidate;
+  }
+  return;
+}
+function parseRetryAfterMs(value, now = Date.now()) {
+  if (value === null || value === undefined)
+    return;
+  const trimmed = value.trim();
+  if (trimmed.length === 0)
+    return;
+  if (/^\d+$/.test(trimmed)) {
+    const seconds = Number(trimmed);
+    return Number.isFinite(seconds) && seconds > 0 ? Math.round(seconds * 1000) : undefined;
+  }
+  const at = Date.parse(trimmed);
+  if (Number.isNaN(at))
+    return;
+  const delta = at - now;
+  return delta > 0 ? delta : undefined;
+}
+var BILLING_CODES = new Set(["insufficient_quota", "billing_hard_limit_reached", "billing_not_active", "credit_balance_too_low"]);
+var MODEL_NOT_FOUND_CODES = new Set(["model_not_found", "not_found_error", "NOT_FOUND", "model_not_supported"]);
+var MAX_OUTPUT_CODES = new Set(["max_tokens_exceeded", "max_output_tokens_exceeded", "string_above_max_length"]);
+var OVERLOADED_CODES = new Set(["overloaded_error", "overloaded", "server_overloaded", "UNAVAILABLE"]);
+function scrubbedSnippet(body) {
+  if (body.length === 0)
+    return "";
+  if (scanForSecrets(body).length > 0)
+    return "[redacted: the provider's error body contained a credential-shaped string]";
+  return body.slice(0, BODY_SNIPPET_CHARS);
+}
+function redactCredentialMaterial(text, secrets) {
+  let out = text;
+  for (const secret of secrets) {
+    if (secret.length < 8)
+      continue;
+    out = out.split(secret).join("***");
+  }
+  return out;
+}
+function normalizeHttpError(status, headers, body, secrets = []) {
+  const providerCode = parseProviderErrorCode(body);
+  const snippet = scrubbedSnippet(redactCredentialMaterial(body, secrets));
+  const message = `HTTP ${status}${snippet.length > 0 ? ` — ${snippet}` : ""}`;
+  const retryAfterMs = parseRetryAfterMs(headers.get("retry-after"));
+  const extra = {
+    ...providerCode !== undefined ? { providerCode } : {},
+    ...retryAfterMs !== undefined ? { retryAfterMs } : {}
+  };
+  if (status === 401 || status === 403)
+    return { code: "auth", message, status, retryable: false, ...extra };
+  if (status === 429) {
+    const billing = providerCode !== undefined && BILLING_CODES.has(providerCode);
+    return { code: "rate_limit", message, status, retryable: !billing, ...extra };
+  }
+  if (status === 408)
+    return { code: "timeout", message, status, retryable: true, ...extra };
+  if (status >= 500)
+    return { code: "server", message, status, retryable: true, ...extra };
+  if (status >= 400)
+    return { code: "bad_request", message, status, retryable: status === 409, ...extra };
+  return { code: "server", message: `${message} (unexpected non-error status)`, status, retryable: false, ...extra };
+}
+function isProviderError(value) {
+  if (value === null || typeof value !== "object")
+    return false;
+  const v = value;
+  return typeof v.code === "string" && typeof v.message === "string" && typeof v.retryable === "boolean";
+}
+function normalizeThrown(err) {
+  if (isProviderError(err))
+    return err;
+  if (err instanceof ProviderStallError)
+    return { code: "stall", message: err.message, retryable: false };
+  if (err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError")) {
+    return err.name === "AbortError" ? { code: "aborted", message: err.message, retryable: false } : { code: "timeout", message: err.message, retryable: true };
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  return { code: "network", message, retryable: true };
+}
+function toSdkAssistantMessageError(err) {
+  const code = err.providerCode;
+  switch (err.code) {
+    case "auth":
+      return "authentication_failed";
+    case "rate_limit":
+      return code !== undefined && BILLING_CODES.has(code) ? "billing_error" : "rate_limit";
+    case "server":
+      if (err.status === 529)
+        return "overloaded";
+      if (code !== undefined && OVERLOADED_CODES.has(code))
+        return "overloaded";
+      return "server_error";
+    case "bad_request":
+      if (err.status === 402)
+        return "billing_error";
+      if (code !== undefined && MODEL_NOT_FOUND_CODES.has(code))
+        return "model_not_found";
+      if (code !== undefined && MAX_OUTPUT_CODES.has(code))
+        return "max_output_tokens";
+      if (code !== undefined && BILLING_CODES.has(code))
+        return "billing_error";
+      return "invalid_request";
+    case "network":
+    case "timeout":
+    case "stall":
+    case "aborted":
+    case "capability":
+      return "unknown";
+  }
+}
+
+// ../provider-runtime/src/sse.ts
+function abortError() {
+  const err = new Error("provider stream aborted");
+  err.name = "AbortError";
+  return err;
+}
+var EVENT_BOUNDARY = /\r\n\r\n|\n\n|\r\r/;
+var LINE_SPLIT = /\r\n|\n|\r/;
+async function readWithStall(read, stallTimeoutMs, signal) {
+  let timer;
+  let onAbort;
+  try {
+    return await Promise.race([
+      read,
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new ProviderStallError(`provider stream produced no bytes for ${stallTimeoutMs}ms`)), stallTimeoutMs);
+        if (signal !== undefined) {
+          onAbort = () => reject(abortError());
+          signal.addEventListener("abort", onAbort, { once: true });
+        }
+      })
+    ]);
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+    if (signal !== undefined && onAbort !== undefined)
+      signal.removeEventListener("abort", onAbort);
+  }
+}
+function parseBlock(block) {
+  let eventName;
+  const dataLines = [];
+  for (const line of block.split(LINE_SPLIT)) {
+    if (line.length === 0)
+      continue;
+    if (line.startsWith(":"))
+      continue;
+    const colon = line.indexOf(":");
+    const field = colon < 0 ? line : line.slice(0, colon);
+    let value = colon < 0 ? "" : line.slice(colon + 1);
+    if (value.startsWith(" "))
+      value = value.slice(1);
+    if (field === "data")
+      dataLines.push(value);
+    else if (field === "event")
+      eventName = value;
+  }
+  if (dataLines.length === 0)
+    return;
+  return eventName === undefined ? { data: dataLines.join(`
+`) } : { event: eventName, data: dataLines.join(`
+`) };
+}
+async function* parseSse(body, opts) {
+  if (opts.signal?.aborted === true)
+    throw abortError();
+  const reader = body.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  try {
+    for (;; ) {
+      const chunk = await readWithStall(reader.read(), opts.stallTimeoutMs, opts.signal);
+      if (chunk.done)
+        break;
+      const bytes = chunk.value;
+      opts.onBytes?.(bytes.byteLength);
+      buffer += decoder.decode(bytes, { stream: true });
+      for (;; ) {
+        const match = EVENT_BOUNDARY.exec(buffer);
+        if (match === null)
+          break;
+        const block = buffer.slice(0, match.index);
+        buffer = buffer.slice(match.index + match[0].length);
+        const event = parseBlock(block);
+        if (event !== undefined)
+          yield event;
+      }
+    }
+    buffer += decoder.decode();
+    const trailing = parseBlock(buffer);
+    if (trailing !== undefined)
+      yield trailing;
+  } finally {
+    reader.cancel().catch(() => {});
+  }
+}
+
+// ../provider-runtime/src/adapters/privileged-headers.ts
+var PRIVILEGED_IDENTITY_HEADERS = ["x-goog-user-project", "x-goog-quota-project", "openai-organization", "openai-project"];
+var WINTER_IDENTITY_HEADERS = ["user-agent", "client-agent"];
+function hostHeaders(policy, headers, extraPrivileged = []) {
+  if (headers === undefined)
+    return {};
+  const blocked = new Set((policy.generated ? [...CREDENTIAL_HEADER_NAMES, ...WINTER_IDENTITY_HEADERS] : [...CREDENTIAL_HEADER_NAMES, ...PRIVILEGED_IDENTITY_HEADERS, ...extraPrivileged]).map((name) => name.toLowerCase()));
+  const out = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (blocked.has(name.toLowerCase()))
+      continue;
+    out[name] = value;
+  }
+  return out;
+}
+
+// ../provider-runtime/src/retry.ts
+var DEFAULT_MAX_RETRIES = 10;
+var RETRY_BACKOFF_BASE_MS = 1000;
+var RETRY_BACKOFF_CAP_MS = 30000;
+var RETRY_AFTER_HONOUR_CEILING_MS = 60000;
+var defaultSleep = (ms, signal) => new Promise((resolve, reject) => {
+  if (signal?.aborted === true) {
+    const err = new Error("retry backoff aborted");
+    err.name = "AbortError";
+    reject(err);
+    return;
+  }
+  const timer = setTimeout(() => {
+    signal?.removeEventListener("abort", onAbort);
+    resolve();
+  }, ms);
+  function onAbort() {
+    clearTimeout(timer);
+    const err = new Error("retry backoff aborted");
+    err.name = "AbortError";
+    reject(err);
+  }
+  signal?.addEventListener("abort", onAbort, { once: true });
+});
+function createRetryPolicy(opts = {}) {
+  const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES;
+  const random = opts.random ?? Math.random;
+  const sleep = opts.sleep ?? defaultSleep;
+  let committed = false;
+  return {
+    maxRetries,
+    get committed() {
+      return committed;
+    },
+    commit() {
+      committed = true;
+    },
+    delayMs(attempt, retryAfterMs) {
+      if (retryAfterMs !== undefined && retryAfterMs > 0)
+        return Math.min(retryAfterMs, RETRY_AFTER_HONOUR_CEILING_MS);
+      const ceiling = Math.min(RETRY_BACKOFF_CAP_MS, RETRY_BACKOFF_BASE_MS * 2 ** Math.max(0, attempt - 1));
+      return Math.round(random() * ceiling);
+    },
+    sleep
+  };
+}
+async function withRetry(attempt, policy, onRetry, signal) {
+  for (let n = 1;; n++) {
+    try {
+      return await attempt(n);
+    } catch (err) {
+      const normalized = normalizeThrown(err);
+      if (policy.committed || !normalized.retryable || n > policy.maxRetries)
+        throw err;
+      const delayMs = policy.delayMs(n, normalized.retryAfterMs);
+      onRetry({
+        type: "retry",
+        attempt: n,
+        maxRetries: policy.maxRetries,
+        retryDelayMs: delayMs,
+        ...normalized.status !== undefined ? { errorStatus: normalized.status } : {},
+        error: toSdkAssistantMessageError(normalized)
+      });
+      await policy.sleep(delayMs, signal);
+    }
+  }
+}
+
+// ../provider-runtime/src/adapters/openai/shared.ts
+var DEFAULT_STREAM_BODY_BYTES = 32 * 1024 * 1024;
+var DEFAULT_HEADER_TIMEOUT_MS = 60000;
+var MAX_DISCOVERY_PAGES = 20;
+function capabilityRefusal(reason) {
+  return new ProviderRequestError({ code: "capability", message: reason, retryable: false });
+}
+function badRequestRefusal(reason) {
+  return new ProviderRequestError({ code: "bad_request", message: reason, retryable: false });
+}
+function THINKING_ENABLED_NEEDS_EFFORT(model) {
+  return `thinking \`{ type: "enabled" }\` carries no effort, and model "${model}" declares no defaultEffort to fall back on. Pass \`effort\`, or select a model whose row records one.`;
+}
+function trimSlash(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+function resolveEndpoint(ctx, options, fallbackGeneratedBaseUrl) {
+  const userBase = ctx.connection.baseUrl;
+  const generatedBase = options.generatedBaseUrl ?? fallbackGeneratedBaseUrl;
+  if (userBase !== undefined && userBase.length > 0) {
+    const opts = connectionEndpointOptions(ctx.connection);
+    const built = createEndpointPolicy(userBase, opts);
+    if (!built.ok)
+      throw capabilityRefusal(built.reason);
+    return { baseUrl: trimSlash(userBase), policy: built.policy, generated: opts.generated };
+  }
+  if (generatedBase === undefined) {
+    throw capabilityRefusal(`provider "${ctx.connection.providerId}" has no endpoint: this adapter has no generated default, so \`connection.baseUrl\` must name the server (and \`connection.local: true\` for a local installation)`);
+  }
+  const built = createEndpointPolicy(generatedBase, { generated: true });
+  if (!built.ok)
+    throw capabilityRefusal(built.reason);
+  return { baseUrl: trimSlash(generatedBase), policy: built.policy, generated: true };
+}
+async function resolveAuth(ctx, style) {
+  const material = await ctx.credentials.get(ctx.authRef);
+  if (material === null)
+    return { headers: {}, material: null };
+  switch (material.kind) {
+    case "api-key":
+      return style === "azure-api-key" ? { headers: { "api-key": material.key }, material } : { headers: { authorization: `Bearer ${material.key}` }, material };
+    case "bearer":
+      return { headers: { authorization: `Bearer ${material.token}` }, material };
+    case "oauth":
+      return {
+        headers: { authorization: `Bearer ${material.accessToken}` },
+        material
+      };
+    default:
+      throw capabilityRefusal(`the OpenAI family cannot use a credential of kind "${material.kind}" — it speaks api-key, bearer and oauth only`);
+  }
+}
+function buildHeaders(plan) {
+  const out = { "user-agent": winterUserAgent(), ...plan.identity ?? {} };
+  Object.assign(out, hostHeaders(plan.policy, plan.userSupplied));
+  Object.assign(out, applyPrivilegedHeaders(plan.policy, plan.privileged ?? {}));
+  Object.assign(out, plan.protocol);
+  return out;
+}
+function identityFor(options, ctx) {
+  return winterIdentityHeaders(options.identityHeaders, ctx.connection.providerId);
+}
+var EFFORT_LADDER = ["low", "medium", "high", "xhigh", "max"];
+function snapNumericEffort(value, verified) {
+  const available = EFFORT_LADDER.map((tier, index) => ({ tier, index })).filter((t) => verified.includes(t.tier));
+  if (available.length === 0)
+    return;
+  const clamped = Math.min(EFFORT_LADDER.length, Math.max(1, Math.round(value)));
+  const wanted = clamped - 1;
+  let best = available[0];
+  for (const candidate of available) {
+    const better = Math.abs(candidate.index - wanted) < Math.abs(best.index - wanted);
+    if (better)
+      best = candidate;
+  }
+  return best.tier;
+}
+function mapEffortAgainst(effort, descriptor) {
+  if (effort === undefined)
+    return { ok: true, value: undefined };
+  if (descriptor === undefined) {
+    if (typeof effort === "number") {
+      return { ok: false, reason: `a numeric effort (${effort}) cannot be mapped for an unlisted model: snapping it to the nearest verified tier needs the model's own effort vocabulary, and this model has no catalog descriptor` };
+    }
+    return { ok: true, value: effort };
+  }
+  const verified = descriptor.reasoning?.efforts ?? [];
+  if (descriptor.reasoning === undefined || verified.length === 0) {
+    return {
+      ok: false,
+      reason: `model "${descriptor.key}" declares no reasoning effort vocabulary, so effort ${JSON.stringify(effort)} cannot be mapped onto it — Winter rejects the selection rather than silently sending the provider's default (WS-13 §8.2)`
+    };
+  }
+  if (typeof effort === "number") {
+    const snapped = snapNumericEffort(effort, verified);
+    if (snapped === undefined)
+      return { ok: false, reason: `model "${descriptor.key}" verifies no tier of the pinned effort ladder, so numeric effort ${effort} has nothing to snap to` };
+    return { ok: true, value: snapped };
+  }
+  if (!verified.includes(effort)) {
+    return { ok: false, reason: `effort "${effort}" is not in model "${descriptor.key}"'s verified vocabulary [${verified.join(", ")}] — rejected before the request (WS-13 §8.2)` };
+  }
+  return { ok: true, value: effort };
+}
+function resolveReasoning(req, descriptor) {
+  const thinking = req.thinking;
+  if (thinking?.type === "disabled") {
+    if (req.effort !== undefined) {
+      throw capabilityRefusal(`thinking is disabled for this turn but an effort (${JSON.stringify(req.effort)}) was also requested — the two contradict, and Winter refuses rather than picking one`);
+    }
+    return { wantsEncryptedContent: false, enabled: false };
+  }
+  if (thinking?.type === "enabled" && thinking.budgetTokens !== undefined) {
+    throw capabilityRefusal(`thinking { type: "enabled", budgetTokens: ${thinking.budgetTokens} } cannot be represented on an OpenAI-family surface: reasoning here is EFFORT-controlled and has no token-budget field, so honouring this would mean silently dropping the budget (WS-13 §8.2)`);
+  }
+  const reasoningEvidence = descriptor?.reasoning;
+  if (thinking !== undefined && descriptor !== undefined && reasoningEvidence === undefined) {
+    throw capabilityRefusal(`model "${descriptor.key}" declares no reasoning capability, so a \`thinking\` configuration cannot be honoured — rejected before the request`);
+  }
+  const mapped = mapEffortAgainst(req.effort, descriptor);
+  if (!mapped.ok)
+    throw capabilityRefusal(mapped.reason);
+  const effort = mapped.value ?? (thinking !== undefined ? reasoningEvidence?.defaultEffort : undefined);
+  const reasoningRequested = effort !== undefined || thinking?.type === "adaptive" || thinking?.type === "enabled";
+  if (reasoningRequested && effort === undefined) {
+    throw capabilityRefusal(THINKING_ENABLED_NEEDS_EFFORT(descriptor?.key ?? req.model));
+  }
+  const summaryEvidence = reasoningEvidence?.summaryRequest?.value;
+  const summary = req.requestSummary === true && reasoningRequested && summaryEvidence !== undefined && summaryEvidence.field === "reasoning.summary" && summaryEvidence.values.length > 0 ? summaryEvidence.values[0] : undefined;
+  return {
+    ...effort !== undefined ? { effort } : {},
+    ...summary !== undefined ? { summary } : {},
+    wantsEncryptedContent: reasoningRequested,
+    enabled: true
+  };
+}
+function assertWithinLimits(req, descriptor, parametersInPlay) {
+  if (descriptor === undefined)
+    return;
+  const maxOutput = descriptor.maxOutputTokens?.value;
+  if (req.maxOutputTokens !== undefined && maxOutput !== undefined && req.maxOutputTokens > maxOutput) {
+    throw capabilityRefusal(`requested ${req.maxOutputTokens} output tokens but model "${descriptor.key}" declares a maximum of ${maxOutput} — rejected before the request rather than failed upstream`);
+  }
+  const unsupported = descriptor.unsupportedParameters ?? [];
+  for (const parameter of parametersInPlay) {
+    if (unsupported.includes(parameter)) {
+      throw capabilityRefusal(`model "${descriptor.key}" lists "${parameter}" among its unsupported parameters, and this request would send it — rejected before the request (WS-13 §8.2)`);
+    }
+  }
+}
+function capabilitiesFrom(descriptor) {
+  const members = descriptor.reasoning?.continuationDomain?.value;
+  const domain = descriptor.reasoning === undefined || descriptor.reasoning.continuation === "none" ? undefined : members !== undefined && members.length > 0 ? [...members].sort()[0] : descriptor.key;
+  return {
+    toolCalling: descriptor.toolCalling.value,
+    ...domain !== undefined ? { continuationDomain: domain } : {},
+    readableState: descriptor.reasoning?.readableState?.value ?? "none"
+  };
+}
+function assertRepresentableTools(tools) {
+  for (const tool of tools ?? []) {
+    if (typeof tool.name !== "string" || tool.name.length === 0) {
+      throw badRequestRefusal(`a tool with no name cannot be represented on an OpenAI-family surface — Winter refuses the turn rather than dropping the tool silently (WS-13 §9)`);
+    }
+    if (tool.inputSchema === null || typeof tool.inputSchema !== "object" || Array.isArray(tool.inputSchema)) {
+      throw badRequestRefusal(`tool "${tool.name}" has an input schema that is not a JSON-Schema object, so its constraints cannot be represented — Winter refuses the turn rather than dropping the tool silently (WS-13 §9)`);
+    }
+  }
+}
+function asBlocks(content) {
+  return typeof content === "string" ? [{ type: "text", text: content }] : content;
+}
+function toolResultText(content) {
+  if (typeof content === "string")
+    return content;
+  return content.map((block) => block.type === "text" ? block.text : block.type === "image" ? "[image]" : "").filter((s) => s.length > 0).join(`
+`);
+}
+function decorationText(message) {
+  const decoration = message.decoration;
+  if (decoration === undefined || decoration.text.length === 0)
+    return;
+  return decoration.text;
+}
+function prefixToolResult(decoration, output) {
+  return decoration === undefined ? output : output.length > 0 ? `${decoration}
+${output}` : decoration;
+}
+function imageDataUrl(block) {
+  return `data:${block.source.media_type};base64,${block.source.data}`;
+}
+
+class EventQueue {
+  items = [];
+  waker;
+  push(event) {
+    this.items.push(event);
+    this.wake();
+  }
+  wake() {
+    const waker = this.waker;
+    this.waker = undefined;
+    waker?.();
+  }
+  drain() {
+    if (this.items.length === 0)
+      return [];
+    const out = this.items;
+    this.items = [];
+    return out;
+  }
+  wait() {
+    return new Promise((resolve) => {
+      this.waker = resolve;
+    });
+  }
+}
+async function* pumpEvents(queue, work) {
+  let finished = false;
+  const settled = work.then((value) => {
+    finished = true;
+    queue.wake();
+    return { ok: true, value };
+  }, (error) => {
+    finished = true;
+    queue.wake();
+    return { ok: false, error };
+  });
+  for (;; ) {
+    for (const event of queue.drain())
+      yield event;
+    if (finished)
+      break;
+    await Promise.race([queue.wait(), settled]);
+  }
+  for (const event of queue.drain())
+    yield event;
+  const result = await settled;
+  if (!result.ok)
+    throw result.error;
+  return result.value;
+}
+async function openStream(plan, policy, onEvent) {
+  const maxBodyBytes = plan.options.maxBodyBytes ?? DEFAULT_STREAM_BODY_BYTES;
+  const timeoutMs = plan.options.headerTimeoutMs ?? DEFAULT_HEADER_TIMEOUT_MS;
+  let headers = plan.headers;
+  return withRetry(async (attempt) => {
+    await plan.beforeAttempt?.(attempt);
+    let response = await boundedFetch(plan.url, {
+      method: "POST",
+      headers,
+      body: plan.body,
+      policy: plan.policy,
+      maxBodyBytes,
+      timeoutMs,
+      ...plan.signal !== undefined ? { signal: plan.signal } : {}
+    });
+    if (!response.ok && plan.recover !== undefined) {
+      const recovered = await plan.recover(response.status, attempt);
+      if (recovered !== undefined) {
+        response.body?.cancel().catch(() => {});
+        headers = recovered;
+        response = await boundedFetch(plan.url, {
+          method: "POST",
+          headers,
+          body: plan.body,
+          policy: plan.policy,
+          maxBodyBytes,
+          timeoutMs,
+          ...plan.signal !== undefined ? { signal: plan.signal } : {}
+        });
+      }
+    }
+    if (!response.ok) {
+      plan.onRefused?.(response);
+      throw await httpErrorFrom(response);
+    }
+    return response;
+  }, policy, onEvent, plan.signal);
+}
+async function httpErrorFrom(response) {
+  const body = await response.text().catch(() => "");
+  return new ProviderRequestError(normalizeHttpError(response.status, response.headers, body));
+}
+function errorEvent(err) {
+  return { type: "error", error: normalizeThrown(err) };
+}
+function makeRetryPolicy(options) {
+  return createRetryPolicy(options.retry ?? {});
+}
+async function fetchOpenAiModels(ctx, endpoint, headers, options, extraQuery = {}) {
+  const warnings = [];
+  const models = [];
+  let partial = false;
+  let after;
+  for (let page = 0;page < MAX_DISCOVERY_PAGES; page++) {
+    const url = new URL(`${endpoint.baseUrl}/models`);
+    for (const [name, value] of Object.entries(extraQuery))
+      url.searchParams.set(name, value);
+    if (after !== undefined)
+      url.searchParams.set("after", after);
+    const response = await boundedFetch(url.toString(), {
+      method: "GET",
+      headers,
+      policy: endpoint.policy,
+      maxBodyBytes: ctx.limits.maxBytes,
+      timeoutMs: options.headerTimeoutMs ?? DEFAULT_HEADER_TIMEOUT_MS,
+      ...ctx.signal !== undefined ? { signal: ctx.signal } : {}
+    });
+    if (!response.ok)
+      throw await httpErrorFrom(response);
+    const text = await response.text();
+    let payload;
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      throw new ProviderRequestError({ code: "bad_request", message: `model discovery for "${ctx.connection.providerId}" returned a body that is not JSON`, retryable: false });
+    }
+    const rows = Array.isArray(payload.data) ? payload.data : [];
+    if (!Array.isArray(payload.data))
+      warnings.push(`discovery page ${page + 1} had no \`data\` array; it contributed no models`);
+    for (const row of rows) {
+      if (models.length >= ctx.limits.maxItems) {
+        partial = true;
+        warnings.push(`discovery returned more than the ${ctx.limits.maxItems}-model limit; the list was truncated and is PARTIAL`);
+        break;
+      }
+      models.push(rowToModel(row));
+    }
+    const last = rows.at(-1);
+    const lastId = last !== null && typeof last === "object" ? last.id : undefined;
+    if (partial || payload.has_more !== true || rows.length === 0 || typeof lastId !== "string") {
+      if (payload.has_more === true && !partial) {
+        partial = true;
+        warnings.push(`discovery reported more pages but the last row carried no usable id to page from; the list is PARTIAL`);
+      }
+      return { models, partial, cached: false, warnings };
+    }
+    after = lastId;
+    if (page === MAX_DISCOVERY_PAGES - 1) {
+      partial = true;
+      warnings.push(`discovery stopped after ${MAX_DISCOVERY_PAGES} pages; the list is PARTIAL`);
+    }
+  }
+  return { models, partial, cached: false, warnings };
+}
+function rowToModel(row) {
+  if (row === null || typeof row !== "object")
+    return { id: "" };
+  const record = row;
+  const id = typeof record.id === "string" ? record.id : "";
+  const displayName = typeof record.display_name === "string" ? record.display_name : typeof record.name === "string" ? record.name : undefined;
+  const contextWindow = typeof record.context_window === "number" ? record.context_window : typeof record.context_length === "number" ? record.context_length : undefined;
+  return { id, ...displayName !== undefined ? { displayName } : {}, ...contextWindow !== undefined ? { contextWindow } : {} };
+}
+async function validateViaModels(ref, ctx, endpoint, headers, options, hasCredential, extraQuery = {}) {
+  if (ref.kind === "aws-default-chain" || ref.kind === "file") {
+    return { ok: false, code: "unsupported", message: `the OpenAI family cannot validate a credential reference of kind "${ref.kind}"` };
+  }
+  if (!hasCredential && !endpoint.policy.local) {
+    return { ok: false, code: "missing", message: `no credential is configured for provider "${ctx.connection.providerId}"` };
+  }
+  try {
+    const probeUrl = new URL(`${endpoint.baseUrl}/models`);
+    for (const [name, value] of Object.entries(extraQuery))
+      probeUrl.searchParams.set(name, value);
+    const response = await boundedFetch(probeUrl.toString(), {
+      method: "GET",
+      headers,
+      policy: endpoint.policy,
+      maxBodyBytes: 1024 * 1024,
+      timeoutMs: options.headerTimeoutMs ?? DEFAULT_HEADER_TIMEOUT_MS
+    });
+    const body = await response.text().catch(() => "");
+    if (response.ok)
+      return { ok: true };
+    const normalized = normalizeHttpError(response.status, response.headers, body);
+    if (normalized.code === "auth")
+      return { ok: false, code: "invalid", message: normalized.message };
+    return { ok: false, code: "network", message: normalized.message };
+  } catch (err) {
+    const normalized = normalizeThrown(err);
+    return { ok: false, code: normalized.code === "auth" ? "invalid" : "network", message: normalized.message };
+  }
+}
+function isStreamTerminator(data) {
+  return data.trim() === "[DONE]";
+}
+function parseSseJson(data) {
+  const trimmed = data.trim();
+  if (trimmed.length === 0 || isStreamTerminator(trimmed))
+    return;
+  try {
+    const parsed = JSON.parse(trimmed);
+    return parsed !== null && typeof parsed === "object" ? parsed : undefined;
+  } catch {
+    return;
+  }
+}
+
+// ../provider-runtime/src/adapters/openai/responses.ts
+function mapResponsesInput(messages) {
+  const out = [];
+  for (const message of messages) {
+    if (message.role === "assistant" && message.nativeState !== undefined) {
+      for (const item of message.nativeState.items)
+        out.push(item);
+    }
+    const wireRole = message.role === "tool" ? "user" : message.role;
+    const partType = wireRole === "assistant" ? "output_text" : "input_text";
+    const blocks = asBlocks(message.content);
+    const contentParts = [];
+    const decoration = decorationText(message);
+    const carriesToolResults = blocks.some((block) => block.type === "tool_result");
+    if (decoration !== undefined && !carriesToolResults)
+      contentParts.push({ type: partType, text: decoration });
+    let resultPrefix = carriesToolResults ? decoration : undefined;
+    for (const block of blocks) {
+      switch (block.type) {
+        case "text":
+          if (block.text.length > 0)
+            contentParts.push({ type: partType, text: block.text });
+          break;
+        case "image":
+          contentParts.push({ type: "input_image", image_url: imageDataUrl(block) });
+          break;
+        case "tool_use":
+          if (contentParts.length > 0) {
+            out.push({ type: "message", role: wireRole, content: [...contentParts] });
+            contentParts.length = 0;
+          }
+          out.push({ type: "function_call", call_id: block.id, name: block.name, arguments: typeof block.input === "string" ? block.input : JSON.stringify(block.input ?? {}) });
+          break;
+        case "tool_result":
+          out.push({ type: "function_call_output", call_id: block.tool_use_id, output: prefixToolResult(resultPrefix, toolResultText(block.content)) });
+          resultPrefix = undefined;
+          break;
+        default:
+          break;
+      }
+    }
+    if (contentParts.length > 0)
+      out.push({ type: "message", role: wireRole, content: contentParts });
+  }
+  return out;
+}
+function mapResponsesTools(tools) {
+  return (tools ?? []).map((tool) => ({ type: "function", name: tool.name, description: tool.description, parameters: tool.inputSchema, strict: false }));
+}
+function mapToolChoice(choice) {
+  if (choice === undefined)
+    return "auto";
+  if (choice.type === "auto")
+    return "auto";
+  if (choice.type === "any")
+    return "required";
+  return { type: "function", name: choice.name };
+}
+function buildResponsesBody(req, reasoning, descriptor) {
+  const reasoningObject = reasoning.enabled && (reasoning.effort !== undefined || reasoning.summary !== undefined) ? { ...reasoning.effort !== undefined ? { effort: reasoning.effort } : {}, ...reasoning.summary !== undefined ? { summary: reasoning.summary } : {} } : undefined;
+  return {
+    model: req.model,
+    ...req.system !== undefined && req.system.length > 0 ? { instructions: req.system } : {},
+    input: mapResponsesInput(req.messages),
+    tools: mapResponsesTools(req.tools),
+    tool_choice: mapToolChoice(req.toolChoice),
+    parallel_tool_calls: descriptor?.parallelTools?.value === false ? false : true,
+    store: false,
+    stream: true,
+    include: reasoning.wantsEncryptedContent ? ["reasoning.encrypted_content"] : [],
+    ...reasoningObject !== undefined ? { reasoning: reasoningObject } : {},
+    ...req.maxOutputTokens !== undefined ? { max_output_tokens: req.maxOutputTokens } : {}
+  };
+}
+function isUnrepresentableCall(itemType) {
+  return itemType !== "function_call" && (itemType.endsWith("_call") || itemType === "custom_tool_call");
+}
+function responsesCompletionEvent(descriptor) {
+  const declared = descriptor?.reasoning?.completionEvent?.value;
+  return typeof declared === "string" && declared.trim().length > 0 ? declared.trim() : "response.completed";
+}
+
+class ResponsesStreamMapper {
+  completionEvent;
+  constructor(completionEvent = "response.completed") {
+    this.completionEvent = completionEvent;
+  }
+  sawToolCall = false;
+  sawRefusal = false;
+  started = false;
+  reasoningItems = [];
+  arrivals = 0;
+  reportedUnrepresentable = new Set;
+  callIdByItem = new Map;
+  streamedArguments = new Set;
+  completed = false;
+  map(data) {
+    const payload = parseSseJson(data);
+    if (payload === undefined)
+      return [];
+    const type = typeof payload.type === "string" ? payload.type : "";
+    if (type === this.completionEvent)
+      return this.onCompleted(payload);
+    switch (type) {
+      case "response.created":
+        return this.onCreated(payload);
+      case "response.output_text.delta": {
+        const delta = typeof payload.delta === "string" ? payload.delta : "";
+        return delta.length > 0 ? [{ type: "text_delta", text: delta }] : [];
+      }
+      case "response.reasoning_summary_text.delta": {
+        const delta = typeof payload.delta === "string" ? payload.delta : "";
+        return delta.length > 0 ? [{ type: "thinking_summary_delta", text: delta }] : [];
+      }
+      case "response.output_item.added":
+        return this.onItemAdded(payload);
+      case "response.function_call_arguments.delta":
+        return this.onArgumentsDelta(payload);
+      case "response.output_item.done":
+        return this.onItemDone(payload);
+      case "response.incomplete":
+        return this.onCompleted(payload);
+      case "response.failed":
+        return [{ type: "error", error: { code: "server", message: this.failureMessage(payload), retryable: false } }];
+      case "error":
+        return [{ type: "error", error: { code: "server", message: this.failureMessage(payload), retryable: false } }];
+      default:
+        return [];
+    }
+  }
+  finish() {
+    if (this.completed)
+      return [];
+    return [{ type: "error", error: { code: "network", message: "the provider's stream ended before `response.completed` — the turn is incomplete", retryable: false } }];
+  }
+  onCreated(payload) {
+    if (this.started)
+      return [];
+    this.started = true;
+    const response = payload.response;
+    const record = response !== null && typeof response === "object" ? response : {};
+    return [
+      {
+        type: "message_start",
+        ...typeof record.id === "string" ? { id: record.id } : {},
+        ...typeof record.model === "string" ? { model: record.model } : {}
+      }
+    ];
+  }
+  onItemAdded(payload) {
+    const item = itemOf(payload);
+    if (item === undefined)
+      return [];
+    const itemType = typeof item.type === "string" ? item.type : "";
+    if (isUnrepresentableCall(itemType))
+      return this.unrepresentable(itemType, item);
+    if (itemType !== "function_call")
+      return [];
+    const callId = typeof item.call_id === "string" ? item.call_id : typeof item.id === "string" ? item.id : undefined;
+    const name = typeof item.name === "string" ? item.name : undefined;
+    if (callId === undefined || name === undefined) {
+      return [{ type: "error", error: { code: "bad_request", message: "the provider opened a function call with no call id or name, which cannot be represented as a tool call", retryable: false } }];
+    }
+    if (typeof item.id === "string")
+      this.callIdByItem.set(item.id, callId);
+    this.sawToolCall = true;
+    return [{ type: "tool_call_start", id: callId, name }];
+  }
+  onArgumentsDelta(payload) {
+    const delta = typeof payload.delta === "string" ? payload.delta : "";
+    if (delta.length === 0)
+      return [];
+    const itemId = typeof payload.item_id === "string" ? payload.item_id : undefined;
+    const callId = itemId !== undefined ? this.callIdByItem.get(itemId) : undefined;
+    if (callId === undefined)
+      return [];
+    this.streamedArguments.add(callId);
+    return [{ type: "tool_call_delta", id: callId, argumentsJsonDelta: delta }];
+  }
+  onItemDone(payload) {
+    const item = itemOf(payload);
+    if (item === undefined)
+      return [];
+    const itemType = typeof item.type === "string" ? item.type : "";
+    if (itemType === "reasoning") {
+      const encrypted = item.encrypted_content;
+      if (typeof encrypted === "string" && encrypted.length > 0) {
+        const { id: _id, status: _status, ...replayable } = item;
+        const index = typeof payload.output_index === "number" ? payload.output_index : Number.MAX_SAFE_INTEGER;
+        this.reasoningItems.push({ index, arrival: this.arrivals++, item: replayable });
+      }
+      return [];
+    }
+    if (isUnrepresentableCall(itemType))
+      return this.unrepresentable(itemType, item);
+    if (itemType === "function_call") {
+      const callId = typeof item.call_id === "string" ? item.call_id : undefined;
+      if (callId === undefined)
+        return [];
+      const events = [];
+      if (!this.streamedArguments.has(callId)) {
+        const args = typeof item.arguments === "string" ? item.arguments : JSON.stringify(item.arguments ?? {});
+        if (args.length > 0)
+          events.push({ type: "tool_call_delta", id: callId, argumentsJsonDelta: args });
+      }
+      events.push({ type: "tool_call_end", id: callId });
+      return events;
+    }
+    if (itemType === "message")
+      this.noteRefusal(item);
+    return [];
+  }
+  onCompleted(payload) {
+    if (this.completed)
+      return [];
+    this.completed = true;
+    const events = [];
+    const response = payload.response;
+    const record = response !== null && typeof response === "object" ? response : {};
+    if (this.reasoningItems.length > 0) {
+      const ordered = [...this.reasoningItems].sort((a, b) => a.index - b.index || a.arrival - b.arrival).map((entry) => entry.item);
+      events.push({ type: "native_state", items: ordered });
+    }
+    const usage = record.usage;
+    if (usage !== null && typeof usage === "object") {
+      const u = usage;
+      const cached = u.input_tokens_details !== null && typeof u.input_tokens_details === "object" ? u.input_tokens_details.cached_tokens : undefined;
+      events.push({
+        type: "usage",
+        inputTokens: typeof u.input_tokens === "number" ? u.input_tokens : 0,
+        outputTokens: typeof u.output_tokens === "number" ? u.output_tokens : 0,
+        ...typeof cached === "number" ? { cacheReadTokens: cached } : {}
+      });
+    }
+    const output = record.output;
+    if (Array.isArray(output)) {
+      for (const item of output)
+        if (item !== null && typeof item === "object")
+          this.noteRefusal(item);
+    }
+    const incomplete = record.incomplete_details;
+    const incompleteReason = incomplete !== null && typeof incomplete === "object" ? incomplete.reason : undefined;
+    const stopReason = this.sawRefusal ? "refusal" : incompleteReason === "max_output_tokens" ? "max_tokens" : this.sawToolCall ? "tool_use" : "end_turn";
+    events.push({ type: "done", stopReason });
+    return events;
+  }
+  noteRefusal(item) {
+    const content = item.content;
+    if (!Array.isArray(content))
+      return;
+    for (const part of content) {
+      if (part !== null && typeof part === "object" && part.type === "refusal")
+        this.sawRefusal = true;
+    }
+  }
+  unrepresentable(itemType, item) {
+    const id = typeof item.id === "string" ? item.id : itemType;
+    if (this.reportedUnrepresentable.has(id))
+      return [];
+    this.reportedUnrepresentable.add(id);
+    return [this.unrepresentableError(itemType)];
+  }
+  unrepresentableError(itemType) {
+    return {
+      type: "error",
+      error: {
+        code: "capability",
+        message: `the model invoked a "${itemType}", which this adapter cannot represent as a tool call — Winter fails the turn rather than dropping the call silently (WS-13 §9)`,
+        retryable: false
+      }
+    };
+  }
+  failureMessage(payload) {
+    const response = payload.response;
+    const error = response !== null && typeof response === "object" ? response.error : payload.error;
+    const message = error !== null && typeof error === "object" ? error.message : undefined;
+    return typeof message === "string" && message.length > 0 ? message : "the provider reported the response failed";
+  }
+}
+function itemOf(payload) {
+  const item = payload.item;
+  return item !== null && typeof item === "object" ? item : undefined;
+}
+async function* streamResponsesTurn(plan, signal) {
+  const queue = plan.queue ?? new EventQueue;
+  const policy = makeRetryPolicy(plan.options);
+  const mapper = new ResponsesStreamMapper(responsesCompletionEvent(plan.options.descriptors?.(plan.model)));
+  let response;
+  try {
+    response = yield* pumpEvents(queue, openStream({
+      url: plan.url,
+      headers: plan.headers,
+      body: plan.body,
+      policy: plan.endpoint.policy,
+      ctx: plan.ctx,
+      options: plan.options,
+      ...signal !== undefined ? { signal } : {},
+      ...plan.beforeAttempt !== undefined ? { beforeAttempt: plan.beforeAttempt } : {},
+      ...plan.recover !== undefined ? { recover: plan.recover } : {},
+      ...plan.onRefused !== undefined ? { onRefused: plan.onRefused } : {}
+    }, policy, (event) => {
+      if (event.type === "retry" && event.errorStatus === 429)
+        plan.onRateLimited?.(event, queue);
+      queue.push(event);
+    }));
+  } catch (err) {
+    yield errorEvent(err);
+    return;
+  }
+  if (response.body === null) {
+    yield { type: "error", error: { code: "network", message: "the provider returned no response body", retryable: false } };
+    return;
+  }
+  try {
+    for await (const sse of parseSse(response.body, {
+      stallTimeoutMs: plan.ctx.stallTimeoutMs,
+      ...signal !== undefined ? { signal } : {},
+      onBytes: (n) => plan.ctx.log({ kind: "provider.stream", providerId: plan.ctx.connection.providerId, bytes: n })
+    })) {
+      policy.commit();
+      for (const event of mapper.map(sse.data))
+        yield event;
+      for (const event of queue.drain())
+        yield event;
+    }
+    for (const event of mapper.finish())
+      yield event;
+    plan.onSuccess?.();
+    for (const event of queue.drain())
+      yield event;
+  } catch (err) {
+    yield errorEvent(err);
+  }
+}
+function privilegedHeaders(options) {
+  return {
+    ...options.organization !== undefined ? { "OpenAI-Organization": options.organization } : {},
+    ...options.project !== undefined ? { "OpenAI-Project": options.project } : {}
+  };
+}
+async function* responsesTurn(req, ctx, options, fallbackBaseUrl, urlFor, extraProtocolHeaders = {}) {
+  let plan;
+  try {
+    const descriptor = options.descriptors?.(req.model);
+    assertRepresentableTools(req.tools);
+    const reasoning = resolveReasoning(req, descriptor);
+    const parametersInPlay = [
+      ...reasoning.enabled && reasoning.effort !== undefined ? ["reasoning", "reasoning.effort"] : [],
+      ...reasoning.summary !== undefined ? ["reasoning.summary"] : [],
+      ...reasoning.wantsEncryptedContent ? ["include"] : [],
+      ...req.maxOutputTokens !== undefined ? ["max_output_tokens"] : [],
+      ...(req.tools?.length ?? 0) > 0 ? ["tools"] : []
+    ];
+    assertWithinLimits(req, descriptor, parametersInPlay);
+    const endpoint = resolveEndpoint(ctx, options, fallbackBaseUrl);
+    const auth = await resolveAuth(ctx, "bearer");
+    if (auth.material === null && !endpoint.policy.local) {
+      throw capabilityRefusal(`no credential is configured for provider "${ctx.connection.providerId}" — an OpenAI-family endpoint that is not a declared local installation needs one`);
+    }
+    const headers = buildHeaders({
+      policy: endpoint.policy,
+      protocol: { "content-type": "application/json", accept: "text/event-stream", ...extraProtocolHeaders, ...auth.headers },
+      privileged: privilegedHeaders(options),
+      identity: identityFor(options, ctx),
+      userSupplied: ctx.connection.headers
+    });
+    plan = { model: req.model, url: urlFor(endpoint.baseUrl), headers, endpoint, ctx, options, body: JSON.stringify(buildResponsesBody(req, reasoning, descriptor)) };
+  } catch (err) {
+    yield errorEvent(err);
+    return;
+  }
+  yield* streamResponsesTurn(plan, req.signal);
+}
+
+// ../provider-runtime/src/adapters/openai/chat-completions.ts
+function isExposedReasoningItem(item) {
+  return item !== null && typeof item === "object" && item.type === "winter.exposed_reasoning" && typeof item.text === "string";
+}
+function userContentParts(blocks, decoration) {
+  const parts = [];
+  let text = decoration ?? "";
+  let sawImage = false;
+  if (decoration !== undefined)
+    parts.push({ type: "text", text: decoration });
+  for (const block of blocks) {
+    if (block.type === "text") {
+      text += text.length > 0 ? `
+${block.text}` : block.text;
+      parts.push({ type: "text", text: block.text });
+    } else if (block.type === "image") {
+      sawImage = true;
+      parts.push({ type: "image_url", image_url: { url: imageDataUrl(block) } });
+    }
+  }
+  return sawImage ? { content: parts, hasParts: true } : { content: text, hasParts: false };
+}
+function mapChatMessages(messages, replayExposedReasoning) {
+  const out = [];
+  for (const message of messages) {
+    const blocks = asBlocks(message.content);
+    if (message.role === "tool") {
+      let toolPrefix = decorationText(message);
+      let rendered = false;
+      for (const block of blocks) {
+        if (block.type !== "tool_result")
+          continue;
+        out.push({ role: "tool", tool_call_id: block.tool_use_id, content: prefixToolResult(toolPrefix, toolResultText(block.content)) });
+        toolPrefix = undefined;
+        rendered = true;
+      }
+      if (!rendered)
+        out.push({ role: "user", content: userContentParts(blocks, toolPrefix).content });
+      continue;
+    }
+    if (message.role === "assistant") {
+      const toolCalls = [];
+      let text = decorationText(message) ?? "";
+      for (const block of blocks) {
+        if (block.type === "text")
+          text += text.length > 0 ? `
+${block.text}` : block.text;
+        else if (block.type === "tool_use") {
+          toolCalls.push({ id: block.id, type: "function", function: { name: block.name, arguments: typeof block.input === "string" ? block.input : JSON.stringify(block.input ?? {}) } });
+        }
+      }
+      const exposed = replayExposedReasoning ? (message.nativeState?.items ?? []).filter(isExposedReasoningItem).map((i) => i.text).join("") : "";
+      out.push({
+        role: "assistant",
+        content: text,
+        ...toolCalls.length > 0 ? { tool_calls: toolCalls } : {},
+        ...exposed.length > 0 ? { reasoning_content: exposed } : {}
+      });
+      continue;
+    }
+    const results = blocks.filter((b) => b.type === "tool_result");
+    if (results.length > 0) {
+      let resultPrefix = decorationText(message);
+      for (const block of results) {
+        if (block.type !== "tool_result")
+          continue;
+        out.push({ role: "tool", tool_call_id: block.tool_use_id, content: prefixToolResult(resultPrefix, toolResultText(block.content)) });
+        resultPrefix = undefined;
+      }
+      const rest = blocks.filter((b) => b.type !== "tool_result");
+      if (rest.length > 0)
+        out.push({ role: "user", content: userContentParts(rest).content });
+      continue;
+    }
+    out.push({ role: "user", content: userContentParts(blocks, decorationText(message)).content });
+  }
+  return out;
+}
+function mapChatTools(tools) {
+  return (tools ?? []).map((tool) => ({ type: "function", function: { name: tool.name, description: tool.description, parameters: tool.inputSchema } }));
+}
+function mapChatToolChoice(choice) {
+  if (choice === undefined)
+    return "auto";
+  if (choice.type === "auto")
+    return "auto";
+  if (choice.type === "any")
+    return "required";
+  return { type: "function", function: { name: choice.name } };
+}
+function buildChatBody(req, reasoning, descriptor, replayExposedReasoning) {
+  const messages = [];
+  if (req.system !== undefined && req.system.length > 0)
+    messages.push({ role: "system", content: req.system });
+  messages.push(...mapChatMessages(req.messages, replayExposedReasoning));
+  const tools = mapChatTools(req.tools);
+  const budgetField = descriptor?.reasoning !== undefined ? "max_completion_tokens" : "max_tokens";
+  return {
+    model: req.model,
+    messages,
+    stream: true,
+    stream_options: { include_usage: true },
+    ...tools.length > 0 ? { tools, tool_choice: mapChatToolChoice(req.toolChoice) } : {},
+    ...reasoning.enabled && reasoning.effort !== undefined ? { reasoning_effort: reasoning.effort } : {},
+    ...req.maxOutputTokens !== undefined ? { [budgetField]: req.maxOutputTokens } : {}
+  };
+}
+
+class ChatStreamMapper {
+  captureExposedReasoning;
+  started = false;
+  stopReason;
+  exposed = "";
+  completed = false;
+  callsByIndex = new Map;
+  order = [];
+  constructor(captureExposedReasoning) {
+    this.captureExposedReasoning = captureExposedReasoning;
+  }
+  map(data) {
+    if (isStreamTerminator(data))
+      return this.finalize();
+    const payload = parseSseJson(data);
+    if (payload === undefined)
+      return [];
+    const events = [];
+    const inlineError = payload.error;
+    if (inlineError !== null && typeof inlineError === "object") {
+      const message = inlineError.message;
+      const code = inlineError.code;
+      return [
+        {
+          type: "error",
+          error: { code: "server", message: typeof message === "string" ? message : "the provider reported an error mid-stream", retryable: false, ...typeof code === "string" ? { providerCode: code } : {} }
+        }
+      ];
+    }
+    if (!this.started) {
+      this.started = true;
+      events.push({
+        type: "message_start",
+        ...typeof payload.id === "string" ? { id: payload.id } : {},
+        ...typeof payload.model === "string" ? { model: payload.model } : {}
+      });
+    }
+    const usage = payload.usage;
+    if (usage !== null && typeof usage === "object") {
+      const u = usage;
+      const details = u.prompt_tokens_details !== null && typeof u.prompt_tokens_details === "object" ? u.prompt_tokens_details.cached_tokens : undefined;
+      const cached = typeof details === "number" ? details : typeof u.prompt_cache_hit_tokens === "number" ? u.prompt_cache_hit_tokens : undefined;
+      events.push({
+        type: "usage",
+        inputTokens: typeof u.prompt_tokens === "number" ? u.prompt_tokens : 0,
+        outputTokens: typeof u.completion_tokens === "number" ? u.completion_tokens : 0,
+        ...cached !== undefined ? { cacheReadTokens: cached } : {}
+      });
+    }
+    const choices = Array.isArray(payload.choices) ? payload.choices : [];
+    for (const choice of choices) {
+      if (choice === null || typeof choice !== "object")
+        continue;
+      const record = choice;
+      events.push(...this.mapDelta(record.delta));
+      const finish = record.finish_reason;
+      if (typeof finish === "string" && finish.length > 0) {
+        for (const index of this.order) {
+          const call = this.callsByIndex.get(index);
+          if (call !== undefined)
+            events.push({ type: "tool_call_end", id: call.id });
+        }
+        this.stopReason = finish === "tool_calls" ? "tool_use" : finish === "length" ? "max_tokens" : finish === "content_filter" ? "refusal" : "end_turn";
+      }
+    }
+    return events;
+  }
+  finish() {
+    if (this.completed)
+      return [];
+    if (this.stopReason !== undefined)
+      return this.finalize();
+    return [{ type: "error", error: { code: "network", message: "the provider's stream ended before any finish_reason — the turn is incomplete", retryable: false } }];
+  }
+  finalize() {
+    if (this.completed)
+      return [];
+    this.completed = true;
+    const events = [];
+    if (this.captureExposedReasoning && this.exposed.length > 0) {
+      events.push({ type: "native_state", items: [{ type: "winter.exposed_reasoning", text: this.exposed }] });
+    }
+    events.push({ type: "done", stopReason: this.stopReason ?? "end_turn" });
+    return events;
+  }
+  mapDelta(delta) {
+    if (delta === null || typeof delta !== "object")
+      return [];
+    const record = delta;
+    const events = [];
+    if (typeof record.content === "string" && record.content.length > 0)
+      events.push({ type: "text_delta", text: record.content });
+    const exposedDelta = typeof record.reasoning_content === "string" ? record.reasoning_content : typeof record.reasoning === "string" ? record.reasoning : undefined;
+    if (exposedDelta !== undefined && exposedDelta.length > 0) {
+      this.exposed += exposedDelta;
+      events.push({ type: "thinking_exposed_delta", text: exposedDelta });
+    }
+    const toolCalls = record.tool_calls;
+    if (Array.isArray(toolCalls)) {
+      for (const fragment of toolCalls) {
+        if (fragment === null || typeof fragment !== "object")
+          continue;
+        const f = fragment;
+        const index = typeof f.index === "number" ? f.index : 0;
+        const fn = f.function !== null && typeof f.function === "object" ? f.function : {};
+        const existing = this.callsByIndex.get(index);
+        if (existing === undefined) {
+          const id = typeof f.id === "string" && f.id.length > 0 ? f.id : undefined;
+          const name = typeof fn.name === "string" && fn.name.length > 0 ? fn.name : undefined;
+          if (id === undefined || name === undefined) {
+            events.push({
+              type: "error",
+              error: {
+                code: "capability",
+                message: `the provider opened tool call slot ${index} with no id or function name, so the call cannot be represented — Winter fails the turn rather than dropping it silently (WS-13 §9)`,
+                retryable: false
+              }
+            });
+            continue;
+          }
+          this.callsByIndex.set(index, { id, name });
+          this.order.push(index);
+          events.push({ type: "tool_call_start", id, name });
+        }
+        const call = this.callsByIndex.get(index);
+        if (call !== undefined && typeof fn.arguments === "string" && fn.arguments.length > 0) {
+          events.push({ type: "tool_call_delta", id: call.id, argumentsJsonDelta: fn.arguments });
+        }
+      }
+    }
+    return events;
+  }
+}
+async function* chatTurn(req, ctx, options, fallbackBaseUrl, urlFor, extraProtocolHeaders = {}) {
+  const queue = new EventQueue;
+  const policy = makeRetryPolicy(options);
+  let url;
+  let headers;
+  let endpoint;
+  let body;
+  let captureExposed;
+  try {
+    const descriptor = options.descriptors?.(req.model);
+    assertRepresentableTools(req.tools);
+    const reasoning = resolveReasoning(req, descriptor);
+    assertWithinLimits(req, descriptor, [
+      ...reasoning.effort !== undefined ? ["reasoning_effort"] : [],
+      ...req.maxOutputTokens !== undefined ? [descriptor?.reasoning !== undefined ? "max_completion_tokens" : "max_tokens"] : [],
+      ...(req.tools?.length ?? 0) > 0 ? ["tools"] : []
+    ]);
+    captureExposed = descriptor?.reasoning?.readableState?.value === "full-exposed";
+    endpoint = resolveEndpoint(ctx, options, fallbackBaseUrl);
+    const auth = await resolveAuth(ctx, options.authStyle ?? "bearer");
+    if (auth.material === null && !endpoint.policy.local) {
+      throw capabilityRefusal(`no credential is configured for provider "${ctx.connection.providerId}" — an OpenAI-compatible endpoint that is not a declared local installation needs one`);
+    }
+    headers = buildHeaders({
+      policy: endpoint.policy,
+      protocol: { "content-type": "application/json", accept: "text/event-stream", ...extraProtocolHeaders, ...auth.headers },
+      privileged: privilegedHeaders(options),
+      identity: identityFor(options, ctx),
+      userSupplied: ctx.connection.headers
+    });
+    url = urlFor(endpoint);
+    body = JSON.stringify(buildChatBody(req, reasoning, descriptor, captureExposed));
+  } catch (err) {
+    yield errorEvent(err);
+    return;
+  }
+  let response;
+  try {
+    response = yield* pumpEvents(queue, openStream({ url, headers, body, policy: endpoint.policy, ctx, options, ...req.signal !== undefined ? { signal: req.signal } : {} }, policy, (event) => queue.push(event)));
+  } catch (err) {
+    yield errorEvent(err);
+    return;
+  }
+  if (response.body === null) {
+    yield { type: "error", error: { code: "network", message: "the provider returned no response body", retryable: false } };
+    return;
+  }
+  const mapper = new ChatStreamMapper(captureExposed);
+  try {
+    for await (const sse of parseSse(response.body, {
+      stallTimeoutMs: ctx.stallTimeoutMs,
+      ...req.signal !== undefined ? { signal: req.signal } : {},
+      onBytes: (n) => ctx.log({ kind: "provider.stream", providerId: ctx.connection.providerId, bytes: n })
+    })) {
+      policy.commit();
+      for (const event of mapper.map(sse.data))
+        yield event;
+    }
+    for (const event of mapper.finish())
+      yield event;
+  } catch (err) {
+    yield errorEvent(err);
+  }
+}
+
+// ../provider-runtime/src/adapters/openai/azure.ts
+var AZURE_PREVIEW_API_VERSION = "preview";
+function azureRouting(ctx, options) {
+  const apiVersion = ctx.connection.apiVersion ?? options.defaultApiVersion;
+  if (apiVersion === undefined || apiVersion.length === 0) {
+    throw capabilityRefusal(`azure-openai needs \`connection.apiVersion\`: every Azure OpenAI call carries an \`api-version\` query parameter, and Winter will not guess which surface you meant`);
+  }
+  const preview = apiVersion === AZURE_PREVIEW_API_VERSION;
+  const deployment = ctx.connection.deployment;
+  if (!preview && (deployment === undefined || deployment.length === 0)) {
+    throw capabilityRefusal(`azure-openai needs \`connection.deployment\`: on the classic api-version surface the deployment name IS the address of the model`);
+  }
+  return { apiVersion, preview, ...deployment !== undefined ? { deployment } : {} };
+}
+function azureTurnUrl(baseUrl, routing) {
+  const url = routing.preview ? new URL(`${baseUrl}/openai/v1/responses`) : new URL(`${baseUrl}/openai/deployments/${encodeURIComponent(routing.deployment ?? "")}/chat/completions`);
+  url.searchParams.set("api-version", routing.apiVersion);
+  return url.toString();
+}
+function createAzureOpenAIAdapter(options) {
+  const withAuthStyle = { ...options, authStyle: options.authStyle ?? "azure-api-key" };
+  return {
+    id: "winter.azure-openai",
+    version: "1",
+    family: "openai",
+    protocol: "azure-openai",
+    async validateCredential(ref, ctx) {
+      const routing = azureRouting(ctx, withAuthStyle);
+      const endpoint = resolveEndpoint(ctx, withAuthStyle);
+      const auth = await resolveAuth(ctx, withAuthStyle.authStyle ?? "azure-api-key");
+      const headers = buildHeaders({ policy: endpoint.policy, protocol: { accept: "application/json", ...auth.headers }, identity: identityFor(options, ctx), userSupplied: ctx.connection.headers });
+      return validateViaModels(ref, ctx, { ...endpoint, baseUrl: azureModelsBase(endpoint.baseUrl, routing) }, headers, withAuthStyle, auth.material !== null, { "api-version": routing.apiVersion });
+    },
+    async listModels(ctx) {
+      const routing = azureRouting(ctx, withAuthStyle);
+      const endpoint = resolveEndpoint(ctx, withAuthStyle);
+      const auth = await resolveAuth(ctx, withAuthStyle.authStyle ?? "azure-api-key");
+      const headers = buildHeaders({ policy: endpoint.policy, protocol: { accept: "application/json", ...auth.headers }, identity: identityFor(options, ctx), userSupplied: ctx.connection.headers });
+      return fetchOpenAiModels(ctx, { ...endpoint, baseUrl: azureModelsBase(endpoint.baseUrl, routing) }, headers, withAuthStyle, { "api-version": routing.apiVersion });
+    },
+    streamTurn(req, ctx) {
+      return azureTurn(req, ctx, withAuthStyle);
+    },
+    mapEffort(effort, model) {
+      const mapped = mapEffortAgainst(effort, model);
+      return mapped.ok ? { ok: true, value: mapped.value } : mapped;
+    },
+    capabilities: capabilitiesFrom
+  };
+}
+function azureModelsBase(baseUrl, routing) {
+  return routing.preview ? `${baseUrl}/openai/v1` : `${baseUrl}/openai`;
+}
+async function* azureTurn(req, ctx, options) {
+  let routing;
+  try {
+    routing = azureRouting(ctx, options);
+    resolveEndpoint(ctx, options);
+  } catch (err) {
+    yield errorEvent(err);
+    return;
+  }
+  if (routing.preview) {
+    yield* responsesTurn(req, ctx, options, undefined, (baseUrl) => azureTurnUrl(baseUrl, routing));
+    return;
+  }
+  yield* chatTurn(req, ctx, options, undefined, (endpoint) => azureTurnUrl(endpoint.baseUrl, routing));
+}
+// ../provider-runtime/src/adapters/google/jwt-rs256.ts
+var RS256 = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (let i = 0;i < bytes.length; i++)
+    binary += String.fromCharCode(bytes[i]);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+// ../provider-runtime/src/adapters/google/generate-content.ts
+var DEFAULT_MAX_BODY_BYTES = 32 * 1024 * 1024;
+var ITEM_KINDS = new Set(["function-call", "text", "thought", "other"]);
+// ../provider-runtime/src/adapters/google/adc.ts
+var TOKEN_RESPONSE_MAX_BYTES = 64 * 1024;
+// ../provider-runtime/src/registry.ts
+class WinterProviderResolutionError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WinterProviderResolutionError";
+    this.code = code;
+  }
+}
+var PINNED_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
+function continuationDomainOf(descriptor) {
+  const reasoning = descriptor.reasoning;
+  if (reasoning === undefined || reasoning.continuation === "none")
+    return;
+  const members = reasoning.continuationDomain?.value;
+  if (members !== undefined && members.length > 0)
+    return [...members].sort()[0];
+  return descriptor.key;
+}
+function createRegistry(catalog) {
+  const adapters = new Map;
+  const providersById = new Map(catalog.providers.map((p) => [p.id, p]));
+  const modelsByKey = new Map(catalog.models.map((m) => [m.key, m]));
+  const namesByProvider = new Map;
+  for (const model of catalog.models) {
+    let names = namesByProvider.get(model.providerId);
+    if (names === undefined) {
+      names = new Map;
+      namesByProvider.set(model.providerId, names);
+    }
+    names.set(model.upstreamId, model);
+    for (const alias of model.aliases)
+      names.set(alias, model);
+  }
+  function build(provider, descriptor, providerModelId) {
+    if (provider.risk.class === "blocked") {
+      return new WinterProviderResolutionError("blocked", `provider "${provider.id}" is blocked: ${provider.risk.reasons.join("; ")}`);
+    }
+    if (descriptor !== undefined && descriptor.status === "blocked") {
+      return new WinterProviderResolutionError("blocked", `model "${descriptor.key}" is blocked in the catalog`);
+    }
+    const adapter = adapters.get(provider.adapterId);
+    if (adapter === undefined) {
+      return new WinterProviderResolutionError("no-adapter", `no adapter registered for "${provider.adapterId}" (provider "${provider.id}")`);
+    }
+    const domain = descriptor === undefined ? undefined : continuationDomainOf(descriptor);
+    return {
+      providerId: provider.id,
+      modelKey: descriptor?.key ?? `${provider.id}/${providerModelId}`,
+      providerModelId,
+      adapterId: provider.adapterId,
+      adapter,
+      descriptor,
+      provider,
+      ...domain !== undefined ? { continuationDomain: domain } : {},
+      catalogVersion: catalog.catalogVersion
+    };
+  }
+  function resolveWithin(provider, name, allowUnlisted) {
+    const descriptor = namesByProvider.get(provider.id)?.get(name);
+    if (descriptor !== undefined)
+      return build(provider, descriptor, descriptor.upstreamId);
+    if (allowUnlisted && provider.liveCatalogAuthority !== "authoritative")
+      return build(provider, undefined, name);
+    return new WinterProviderResolutionError("unknown-model", `model "${name}" is not in provider "${provider.id}"'s catalog${provider.liveCatalogAuthority === "authoritative" ? " (its live catalog is authoritative, so absence is definitive)" : " — set `provider.allowUnlisted: true` to pass an unlisted id through"}`);
+  }
+  return {
+    register(adapter) {
+      adapters.set(adapter.id, adapter);
+    },
+    resolve(request) {
+      const allowUnlisted = request.provider?.allowUnlisted === true;
+      const slash = request.model.indexOf("/");
+      const prefix = slash > 0 ? request.model.slice(0, slash) : undefined;
+      const rest = slash > 0 ? request.model.slice(slash + 1) : undefined;
+      const sessionProviderId = request.provider?.providerId;
+      if (sessionProviderId !== undefined) {
+        const sessionProvider = providersById.get(sessionProviderId);
+        if (sessionProvider === undefined) {
+          return new WinterProviderResolutionError("unknown-provider", `no provider "${sessionProviderId}" in catalog ${catalog.catalogVersion}`);
+        }
+        const sessionNames = namesByProvider.get(sessionProviderId);
+        const selfQualified = prefix === sessionProviderId && rest !== undefined;
+        const withinProvider = selfQualified ? rest : request.model;
+        const own = sessionNames?.get(request.model);
+        if (own !== undefined)
+          return build(sessionProvider, own, own.upstreamId);
+        if (selfQualified) {
+          const byKey = modelsByKey.get(request.model);
+          if (byKey !== undefined && byKey.providerId === sessionProviderId)
+            return build(sessionProvider, byKey, byKey.upstreamId);
+          const byName = sessionNames?.get(rest);
+          if (byName !== undefined)
+            return build(sessionProvider, byName, byName.upstreamId);
+        }
+        if (allowUnlisted && sessionProvider.liveCatalogAuthority !== "authoritative") {
+          return build(sessionProvider, undefined, withinProvider);
+        }
+        if (prefix !== undefined && rest !== undefined && prefix !== sessionProviderId && providersById.has(prefix)) {
+          return new WinterProviderResolutionError("provider-mismatch", `model "${request.model}" is qualified for provider "${prefix}" but this session's provider is "${sessionProviderId}" — Winter never substitutes one provider for another (WS-13 §9); pass an id in "${sessionProviderId}"'s own namespace, or change the session provider`);
+        }
+        return resolveWithin(sessionProvider, withinProvider, false);
+      }
+      if (prefix === undefined || rest === undefined) {
+        return new WinterProviderResolutionError("no-provider-for-bare-model", `bare model id "${request.model}" needs a provider — pass a qualified "<providerId>/<model>" key or set \`provider.providerId\``);
+      }
+      const provider = providersById.get(prefix);
+      if (provider === undefined) {
+        return new WinterProviderResolutionError("unknown-provider", `no provider "${prefix}" in catalog ${catalog.catalogVersion}`);
+      }
+      const byKey = modelsByKey.get(request.model);
+      if (byKey !== undefined)
+        return build(provider, byKey, byKey.upstreamId);
+      return resolveWithin(provider, rest, allowUnlisted);
+    },
+    list() {
+      return {
+        catalogVersion: catalog.catalogVersion,
+        adapters: [...adapters.values()].map((a) => ({ id: a.id, version: a.version, family: a.family, protocol: a.protocol })),
+        providers: catalog.providers.map((p) => ({
+          id: p.id,
+          displayName: p.displayName,
+          adapterId: p.adapterId,
+          adapterRegistered: adapters.has(p.adapterId),
+          modelCount: catalog.models.filter((m) => m.providerId === p.id).length,
+          riskClass: p.risk.class
+        }))
+      };
+    },
+    listModelInfo(sessionProviderId) {
+      const rows = [];
+      for (const model of catalog.models) {
+        if (model.providerId !== sessionProviderId)
+          continue;
+        const efforts = model.reasoning?.efforts ?? [];
+        const levels = PINNED_EFFORT_LEVELS.filter((l) => efforts.includes(l));
+        const capability = levels.length > 0 ? { supportsEffort: true, supportedEffortLevels: levels } : {};
+        const base = {
+          displayName: model.displayName,
+          description: `${model.displayName} — ${model.status}${model.reasoning !== undefined ? ", reasoning-capable" : ""} (catalog ${catalog.catalogVersion})`,
+          ...capability
+        };
+        rows.push({ value: model.key, resolvedModel: model.upstreamId, ...base });
+        for (const alias of model.aliases)
+          rows.push({ value: alias, resolvedModel: model.upstreamId, ...base });
+      }
+      return rows;
+    }
+  };
+}
+
+// ../provider-runtime/src/continuity/domains.ts
+function sameDomain(a, b) {
+  const left = a?.continuationDomain;
+  const right = b?.continuationDomain;
+  if (left === undefined || right === undefined)
+    return false;
+  return left === right;
+}
+var CERTIFIED_DOMAIN_CONFIDENCES = new Set(["verified", "declared"]);
+function readableStateOf(descriptor) {
+  return descriptor?.reasoning?.readableState?.value ?? "none";
+}
+function summaryRequestOf(descriptor) {
+  return descriptor?.reasoning?.summaryRequest?.value;
+}
+function shouldRequestSummary(descriptor) {
+  return summaryRequestOf(descriptor) !== undefined;
+}
+function createEndpointResolver(registry) {
+  const cache = new Map;
+  return (origin) => {
+    const cached = cache.get(origin.modelKey);
+    if (cached !== undefined)
+      return cached;
+    const facts = endpointFromRegistry(registry, origin);
+    cache.set(origin.modelKey, facts);
+    return facts;
+  };
+}
+function endpointFromRegistry(registry, origin) {
+  const resolved = registry.resolve({ model: origin.modelKey, provider: { providerId: origin.providerId } });
+  if (resolved instanceof WinterProviderResolutionError)
+    return endpointFromOrigin(origin);
+  const descriptor = resolved.descriptor;
+  const summaryRequest = summaryRequestOf(descriptor);
+  const domain = certifiedDomain(resolved.continuationDomain, descriptor);
+  return {
+    providerId: resolved.providerId,
+    modelKey: resolved.modelKey,
+    family: origin.family,
+    ...domain !== undefined ? { continuationDomain: domain } : resolved.continuationDomain === undefined && origin.continuationDomain !== undefined ? { continuationDomain: origin.continuationDomain } : {},
+    ...descriptor !== undefined ? { continuation: descriptor.reasoning?.continuation ?? "none" } : {},
+    readableState: readableStateOf(descriptor),
+    ...summaryRequest !== undefined ? { summaryRequest } : {}
+  };
+}
+function certifiedDomain(domain, descriptor) {
+  if (domain === undefined)
+    return;
+  const evidence = descriptor?.reasoning?.continuationDomain;
+  if (evidence === undefined)
+    return domain;
+  if (CERTIFIED_DOMAIN_CONFIDENCES.has(evidence.confidence))
+    return domain;
+  const key = descriptor?.key;
+  if (key !== undefined && evidence.value.length === 1 && evidence.value[0] === key)
+    return key;
+  return;
+}
+function endpointFromOrigin(origin) {
+  return {
+    providerId: origin.providerId,
+    modelKey: origin.modelKey,
+    family: typeof origin.family === "string" ? origin.family : String(origin.family),
+    ...origin.continuationDomain !== undefined ? { continuationDomain: origin.continuationDomain } : {},
+    readableState: "none"
+  };
+}
+
+// ../provider-runtime/src/continuity/fixtures.ts
+var evidence2 = (value, confidence = "verified") => ({
+  value,
+  source: "official-doc",
+  observedAt: "2026-09-05",
+  confidence
+});
+var stampRow2 = (row) => stampFamilyFields([row], [])[0];
+function fixtureModel(init) {
+  return stampRow2({
+    key: init.key,
+    providerId: init.providerId,
+    upstreamId: init.upstreamId ?? init.key.slice(init.key.indexOf("/") + 1),
+    displayName: init.key,
+    aliases: init.aliases ?? [],
+    endpoints: ["responses"],
+    ...init.contextWindow !== undefined ? { contextWindow: evidence2(init.contextWindow) } : {},
+    inputModalities: evidence2(["text"]),
+    outputModalities: evidence2(["text"]),
+    toolCalling: evidence2(init.toolCalling ?? "native"),
+    nativeTools: evidence2(true),
+    ...init.reasoning !== undefined ? { reasoning: init.reasoning } : {},
+    unsupportedParameters: [],
+    status: "supported"
+  });
+}
+function fixtureReasoning(init) {
+  return {
+    supported: evidence2(true),
+    efforts: init.efforts ?? [],
+    continuation: init.continuation ?? "opaque-provider-state",
+    readableState: evidence2(init.readableState, init.confidence),
+    ...init.summaryRequest !== undefined ? { summaryRequest: evidence2(init.summaryRequest, init.confidence) } : {},
+    ...init.domain !== undefined ? { continuationDomain: evidence2(init.domain, init.confidence) } : {}
+  };
+}
+function fixtureProvider(init) {
+  return {
+    id: init.id,
+    displayName: init.id,
+    protocols: ["openai-responses"],
+    authKinds: ["api-key"],
+    defaultEndpoints: { base: init.baseUrl ?? "https://example.invalid/v1/responses" },
+    modelDiscovery: "none",
+    liveCatalogAuthority: "partial",
+    adapterId: init.adapterId ?? `${init.id}-adapter`,
+    family: init.family ?? "openai",
+    upstream: { project: "winter", commit: "", sourcePaths: [] },
+    risk: { class: "approved", reasons: [] },
+    scope: "llm",
+    pricingBasis: "token",
+    admission: { basis: "api-key", citation: "fixture:continuity", tier: "local" }
+  };
+}
+function fixtureCatalog(providers, models) {
+  return {
+    schemaVersion: 2,
+    families: [],
+    catalogVersion: "0.0.0-continuity-fixture",
+    upstream: { tag: "", tagObject: "", commit: "", extractorVersion: "", overlayVersion: "" },
+    providers,
+    models
+  };
+}
+function scriptedAdapter(init) {
+  const requests = [];
+  return {
+    id: init.id,
+    version: "0.0.0-fixture",
+    family: init.family ?? "openai",
+    protocol: "openai-responses",
+    requests,
+    async validateCredential() {
+      return { ok: true };
+    },
+    async listModels() {
+      return { models: [], partial: false, cached: false, warnings: [] };
+    },
+    streamTurn(req) {
+      requests.push(req);
+      const events = init.events ?? [{ type: "done", stopReason: "end_turn" }];
+      return async function* () {
+        for (const event of events)
+          yield event;
+      }();
+    },
+    mapEffort() {
+      return { ok: true, value: undefined };
+    },
+    capabilities(model) {
+      const domain = model.reasoning?.continuationDomain?.value;
+      return {
+        toolCalling: model.toolCalling.value,
+        ...domain !== undefined && domain.length > 0 ? { continuationDomain: [...domain].sort()[0] } : {},
+        readableState: readableStateOf(model)
+      };
+    }
+  };
+}
+// src/fakes/bedrock.ts
+var FAKE_ACCESS_KEY_ID = "AKIDEXAMPLE";
+var FAKE_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY";
+var FAKE_REGION = "us-east-1";
+function bedrockModelOf(recorded) {
+  const match = /^\/model\/([^/]+)\/converse(?:-stream)?$/.exec(recorded.path);
+  if (match === null)
+    return;
+  try {
+    return decodeURIComponent(match[1]);
+  } catch {
+    return match[1];
+  }
+}
+function isStreamingPath(recorded) {
+  return recorded.path.endsWith("/converse-stream");
+}
+function eventStreamResponse(frames, opts = {}) {
+  const kept = opts.dropAfter !== undefined ? frames.slice(0, opts.dropAfter) : frames;
+  const pieces = [];
+  for (const frame of kept) {
+    if (opts.chunkSize === undefined) {
+      pieces.push({ bytes: frame, startsFrame: true });
+      continue;
+    }
+    for (let offset = 0;offset < frame.length; offset += opts.chunkSize) {
+      pieces.push({ bytes: frame.slice(offset, Math.min(offset + opts.chunkSize, frame.length)), startsFrame: offset === 0 });
+    }
+  }
+  let index = 0;
+  let holdTimer;
+  let releaseHold;
+  let closed = false;
+  const body = new ReadableStream({
+    async pull(controller) {
+      if (closed)
+        return;
+      if (index >= pieces.length) {
+        if (opts.holdOpenMs !== undefined) {
+          await new Promise((resolve) => {
+            releaseHold = resolve;
+            holdTimer = setTimeout(resolve, opts.holdOpenMs);
+          });
+          if (closed)
+            return;
+        }
+        closed = true;
+        controller.close();
+        return;
+      }
+      const piece = pieces[index];
+      index++;
+      if (index > 1 && piece.startsFrame && opts.delayMs !== undefined && opts.delayMs > 0)
+        await new Promise((r) => setTimeout(r, opts.delayMs));
+      if (closed)
+        return;
+      controller.enqueue(piece.bytes);
+    },
+    cancel() {
+      closed = true;
+      if (holdTimer !== undefined)
+        clearTimeout(holdTimer);
+      releaseHold?.();
+    }
+  });
+  return new Response(body, {
+    status: opts.status ?? 200,
+    headers: { "content-type": "application/vnd.amazon.eventstream" }
+  });
+}
+function bedrockError(status, errorType, message, headers = {}) {
+  return jsonResponse2({ message }, status, { "x-amzn-errortype": `${errorType}:http://internal.amazon.com/coral/com.amazon.bedrock/`, ...headers });
+}
+function textTurnFrames(text, usage = { inputTokens: 7, outputTokens: 3 }) {
+  return [
+    converseStreamEvent("messageStart", { role: "assistant" }),
+    converseStreamEvent("contentBlockDelta", { contentBlockIndex: 0, delta: { text } }),
+    converseStreamEvent("contentBlockStop", { contentBlockIndex: 0 }),
+    converseStreamEvent("messageStop", { stopReason: "end_turn" }),
+    converseStreamEvent("metadata", { usage: { ...usage, totalTokens: usage.inputTokens + usage.outputTokens }, metrics: { latencyMs: 12 } })
+  ];
+}
+function shapeRefusal(bodyText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(bodyText);
+  } catch {
+    return "the request body is not valid JSON";
+  }
+  const messages = parsed.messages;
+  if (!Array.isArray(messages))
+    return "messages is required";
+  let previous;
+  for (const message of messages) {
+    const role = message.role;
+    const content = message.content;
+    if (role !== "user" && role !== "assistant")
+      return `a message declares role ${JSON.stringify(role)}; only "user" and "assistant" are accepted`;
+    if (role === previous)
+      return `messages must alternate between user and assistant; two consecutive "${role}" messages were sent`;
+    previous = role;
+    if (!Array.isArray(content) || content.length === 0)
+      return "a message carries no content blocks";
+    for (const block of content) {
+      if (typeof block.text === "string" && block.text.length === 0)
+        return "a text content block is empty";
+    }
+  }
+  return;
+}
+async function startBedrockFake(opts) {
+  const secret = opts.secretAccessKey ?? FAKE_SECRET_ACCESS_KEY;
+  const table = scenarioTable2({ modelOf: bedrockModelOf, scenarios: opts.scenarios });
+  const signatures = [];
+  const checkSignature = async (req, recorded) => {
+    if (opts.skipSignatureCheck === true)
+      return;
+    const verdict = await verifySigV4({
+      method: recorded.method,
+      url: req.url,
+      headers: req.headers,
+      body: new TextEncoder().encode(recorded.body),
+      secretAccessKey: secret,
+      expectedAccessKeyId: FAKE_ACCESS_KEY_ID
+    });
+    const parsed = parseAuthorization(req.headers.get("authorization"));
+    if (parsed !== undefined) {
+      signatures.push({ path: recorded.path, signedHeaders: parsed.signedHeaders, accessKeyId: parsed.accessKeyId, region: parsed.region, service: parsed.service, verified: verdict.ok });
+    }
+    if (verdict.ok)
+      return;
+    return bedrockError(403, "InvalidSignatureException", `the request signature is invalid: ${verdict.reason}`);
+  };
+  const fake = await startFake2({
+    routes: [
+      {
+        path: "/model/*",
+        method: "POST",
+        handler: async (req, recorded) => {
+          const refusedSignature = await checkSignature(req, recorded);
+          if (refusedSignature !== undefined)
+            return refusedSignature;
+          if (opts.skipShapeCheck !== true) {
+            const refusal = shapeRefusal(recorded.body);
+            if (refusal !== undefined)
+              return bedrockError(400, "ValidationException", refusal);
+          }
+          return await table(req, recorded);
+        }
+      },
+      {
+        path: "/foundation-models",
+        method: "GET",
+        handler: async (req, recorded) => {
+          const refusedSignature = await checkSignature(req, recorded);
+          if (refusedSignature !== undefined)
+            return refusedSignature;
+          if (opts.discovery !== undefined)
+            return await opts.discovery(recorded, 1);
+          return jsonResponse2({
+            modelSummaries: [
+              { modelId: "anthropic.claude-3-5-sonnet-20241022-v2:0", modelName: "Claude 3.5 Sonnet v2", inputModalities: ["TEXT", "IMAGE"], responseStreamingSupported: true },
+              { modelId: "amazon.titan-text-express-v1", modelName: "Titan Text Express", inputModalities: ["TEXT"], responseStreamingSupported: false }
+            ]
+          });
+        }
+      }
+    ]
+  });
+  return Object.assign(fake, { signatures });
+}
+// src/fakes/codex-oauth.ts
+var exports_codex_oauth = {};
+__export(exports_codex_oauth, {
+  FAKE_ACCESS_TOKEN: () => FAKE_ACCESS_TOKEN,
+  FAKE_ACCOUNT_ID: () => FAKE_ACCOUNT_ID,
+  FAKE_REFRESHED_ACCESS_TOKEN: () => FAKE_REFRESHED_ACCESS_TOKEN,
+  FAKE_REFRESH_TOKEN: () => FAKE_REFRESH_TOKEN,
+  codexTokenRoute: () => codexTokenRoute,
+  fakeIdToken: () => fakeIdToken2,
+  startCodexFake: () => startCodexFake
+});
+var FAKE_ACCOUNT_ID = "acct-test-0001";
+var FAKE_ACCESS_TOKEN = "test-token-codex-access";
+var FAKE_REFRESHED_ACCESS_TOKEN = "test-token-codex-access-refreshed";
+var FAKE_REFRESH_TOKEN = "test-token-codex-refresh";
+function b64url(value) {
+  return btoa(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fakeIdToken2(accountId = FAKE_ACCOUNT_ID) {
+  const header = b64url(JSON.stringify({ alg: "none", typ: "JWT" }));
+  const payload = b64url(JSON.stringify({ sub: "user-test", "https://api.openai.com/auth": { chatgpt_account_id: accountId } }));
+  return `${header}.${payload}.`;
+}
+function codexTokenRoute(opts = {}) {
+  return {
+    path: "/oauth/token",
+    method: "POST",
+    handler: (_req, recorded) => {
+      if (opts.failWith !== undefined)
+        return jsonResponse2({ error: "invalid_grant", error_description: "the fake refused this grant" }, opts.failWith);
+      const form = new URLSearchParams(recorded.body);
+      const isRefresh = form.get("grant_type") === "refresh_token";
+      return jsonResponse2({
+        access_token: opts.accessToken ?? (isRefresh ? FAKE_REFRESHED_ACCESS_TOKEN : FAKE_ACCESS_TOKEN),
+        ...opts.omitRefreshToken === true ? {} : { refresh_token: FAKE_REFRESH_TOKEN },
+        ...opts.omitIdToken === true ? {} : { id_token: fakeIdToken2(opts.accountId ?? FAKE_ACCOUNT_ID) },
+        expires_in: opts.expiresIn ?? 3600,
+        token_type: "Bearer"
+      });
+    }
+  };
+}
+async function startCodexFake(opts) {
+  const bearers = [];
+  const attempts = new Map;
+  const needsRefresh = new Set(opts.requireRefreshFor ?? []);
+  const handler = (req, recorded) => {
+    const pairing = callPairingRefusal(recorded.body);
+    if (pairing !== undefined)
+      return pairing;
+    const authorization = req.headers.get("authorization") ?? "";
+    bearers.push(authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length) : authorization);
+    const model = responsesModelOf(recorded);
+    const key = model ?? "";
+    const attempt = (attempts.get(key) ?? 0) + 1;
+    attempts.set(key, attempt);
+    if (model !== undefined && needsRefresh.has(model) && attempt === 1) {
+      return jsonResponse2({ error: { message: "your credential is no longer valid", type: "invalid_request_error", code: "invalid_api_key" } }, 401);
+    }
+    const entry = model !== undefined ? opts.scenarios[model] : undefined;
+    if (entry === undefined) {
+      if (opts.unknownModel !== undefined)
+        return opts.unknownModel(recorded, attempt);
+      return jsonResponse2({ error: { message: `fake: no scenario for model ${JSON.stringify(model)}` } }, 400);
+    }
+    if (Array.isArray(entry)) {
+      const served = needsRefresh.has(key) ? attempt - 2 : attempt - 1;
+      return entry[Math.min(Math.max(0, served), entry.length - 1)];
+    }
+    return entry(recorded, attempt);
+  };
+  const fake = await startFake2({
+    routes: [
+      { path: "/responses", method: "POST", handler },
+      { path: "/backend-api/codex/responses", method: "POST", handler },
+      codexTokenRoute(opts.token ?? {}),
+      ...opts.routes ?? []
+    ]
+  });
+  return Object.assign(fake, { bearers });
+}
+// src/fakes/gemini.ts
+var exports_gemini = {};
+__export(exports_gemini, {
+  assertGeminiRequest: () => assertGeminiRequest,
+  findFunctionResponseOrderingViolation: () => findFunctionResponseOrderingViolation,
+  findRoleAlternationViolation: () => findRoleAlternationViolation,
+  geminiBody: () => geminiBody,
+  geminiContents: () => geminiContents,
+  geminiError: () => geminiError,
+  geminiFakeRoutes: () => geminiFakeRoutes,
+  geminiModelOf: () => geminiModelOf,
+  geminiSseFrames: () => geminiSseFrames,
+  geminiStreamResponse: () => geminiStreamResponse,
+  partKind: () => partKind
+});
+function geminiSseFrames(chunks) {
+  return chunks.map((chunk) => {
+    const payload = {};
+    if (chunk.promptFeedback !== undefined)
+      payload["promptFeedback"] = chunk.promptFeedback;
+    else {
+      payload["candidates"] = [
+        {
+          content: { role: "model", parts: chunk.parts ?? [] },
+          ...chunk.finishReason !== undefined ? { finishReason: chunk.finishReason } : {},
+          index: 0
+        }
+      ];
+    }
+    if (chunk.usageMetadata !== undefined)
+      payload["usageMetadata"] = chunk.usageMetadata;
+    if (chunk.modelVersion !== undefined)
+      payload["modelVersion"] = chunk.modelVersion;
+    return { data: JSON.stringify(payload), ...chunk.delayMs !== undefined ? { delayMs: chunk.delayMs } : {} };
+  });
+}
+function geminiStreamResponse(chunks, opts = {}) {
+  return sseResponse2(geminiSseFrames(chunks), opts);
+}
+function geminiError(status, googleStatus, message = "fake error", headers = {}) {
+  return errorResponse2(status, { error: { code: status, message, status: googleStatus } }, headers);
+}
+function geminiModelOf(recorded) {
+  const match = /\/models\/([^:/]+):/.exec(recorded.path);
+  return match?.[1];
+}
+function geminiBody(recorded) {
+  return JSON.parse(recorded.body);
+}
+function geminiContents(recorded) {
+  const contents = geminiBody(recorded)["contents"];
+  return Array.isArray(contents) ? contents : [];
+}
+function fail2(message, recorded) {
+  throw new Error(`${message}
+  live request: ${recorded.method} ${recorded.path}${recorded.search}
+  headers: ${JSON.stringify(recorded.headers)}
+  body: ${redactOpaqueFields2(recorded.body)}`);
+}
+function partKind(part) {
+  if ("functionCall" in part)
+    return "functionCall";
+  if ("functionResponse" in part)
+    return "functionResponse";
+  if ("inlineData" in part)
+    return "inlineData";
+  if ("thought" in part && part.thought === true)
+    return "thought";
+  return "text";
+}
+function assertGeminiRequest(recorded, expected = {}) {
+  if (recorded.method !== "POST")
+    fail2(`expected a POST, saw ${recorded.method}`, recorded);
+  if (recorded.headers["x-goog-api-key"] !== "***")
+    fail2(`expected a redacted x-goog-api-key header, saw ${JSON.stringify(recorded.headers["x-goog-api-key"])}`, recorded);
+  if (!(recorded.headers["content-type"] ?? "").startsWith("application/json"))
+    fail2(`expected a JSON content-type, saw ${JSON.stringify(recorded.headers["content-type"])}`, recorded);
+  if (expected.model !== undefined && geminiModelOf(recorded) !== expected.model)
+    fail2(`expected model ${expected.model} in the PATH, saw ${JSON.stringify(geminiModelOf(recorded))}`, recorded);
+  if (expected.search !== undefined && recorded.search !== expected.search)
+    fail2(`expected search ${expected.search}, saw ${recorded.search}`, recorded);
+  const body = geminiBody(recorded);
+  const generationConfig = body["generationConfig"] ?? {};
+  if (expected.maxOutputTokens !== undefined && generationConfig["maxOutputTokens"] !== expected.maxOutputTokens) {
+    fail2(`expected maxOutputTokens ${expected.maxOutputTokens}, saw ${JSON.stringify(generationConfig["maxOutputTokens"])}`, recorded);
+  }
+  if (expected.thinkingConfig !== undefined && JSON.stringify(generationConfig["thinkingConfig"]) !== JSON.stringify(expected.thinkingConfig)) {
+    fail2(`expected thinkingConfig ${JSON.stringify(expected.thinkingConfig)}, saw ${JSON.stringify(generationConfig["thinkingConfig"])}`, recorded);
+  }
+  if (expected.toolConfig !== undefined && JSON.stringify(body["toolConfig"]) !== JSON.stringify(expected.toolConfig)) {
+    fail2(`expected toolConfig ${JSON.stringify(expected.toolConfig)}, saw ${JSON.stringify(body["toolConfig"])}`, recorded);
+  }
+  if (expected.functionNames !== undefined) {
+    const tools = Array.isArray(body["tools"]) ? body["tools"] : [];
+    const names = tools.flatMap((t) => (t.functionDeclarations ?? []).map((d) => d.name));
+    if (JSON.stringify(names) !== JSON.stringify(expected.functionNames))
+      fail2(`expected functionDeclarations ${JSON.stringify(expected.functionNames)}, saw ${JSON.stringify(names)}`, recorded);
+  }
+  if (expected.systemInstruction !== undefined) {
+    const system = body["systemInstruction"];
+    const text = system?.parts?.map((p) => p.text).join("") ?? undefined;
+    if (text !== expected.systemInstruction)
+      fail2(`expected systemInstruction ${JSON.stringify(expected.systemInstruction)}, saw ${JSON.stringify(text)}`, recorded);
+  }
+  const contents = geminiContents(recorded);
+  if (expected.roles !== undefined) {
+    const roles = contents.map((c) => c.role);
+    if (JSON.stringify(roles) !== JSON.stringify(expected.roles))
+      fail2(`expected roles ${JSON.stringify(expected.roles)}, saw ${JSON.stringify(roles)}`, recorded);
+  }
+  if (expected.partKinds !== undefined) {
+    const kinds = contents.flatMap((c) => (c.parts ?? []).map(partKind));
+    if (JSON.stringify(kinds) !== JSON.stringify(expected.partKinds))
+      fail2(`expected part ordering ${JSON.stringify(expected.partKinds)}, saw ${JSON.stringify(kinds)}`, recorded);
+  }
+}
+function findFunctionResponseOrderingViolation(recorded) {
+  let body;
+  try {
+    body = JSON.parse(recorded.body);
+  } catch {
+    return;
+  }
+  const contents = Array.isArray(body.contents) ? body.contents : [];
+  for (const [index, entry] of contents.entries()) {
+    if (!Array.isArray(entry.parts))
+      continue;
+    let sawOther = false;
+    for (const part of entry.parts) {
+      const kind = partKind(part);
+      if (kind === "functionResponse") {
+        if (sawOther)
+          return index;
+      } else if (kind !== "inlineData") {
+        sawOther = true;
+      }
+    }
+  }
+  return;
+}
+function findRoleAlternationViolation(recorded) {
+  let body;
+  try {
+    body = JSON.parse(recorded.body);
+  } catch {
+    return;
+  }
+  const contents = Array.isArray(body.contents) ? body.contents : [];
+  for (let i = 1;i < contents.length; i++) {
+    if (contents[i]?.role === contents[i - 1]?.role)
+      return i;
+  }
+  return;
+}
+function geminiFakeRoutes(opts) {
+  const prefix = opts.prefix ?? "/v1beta";
+  const attempts = new Map;
+  return [
+    {
+      path: `${prefix}/models*`,
+      method: "POST",
+      handler: async (_req, recorded) => {
+        const badEntry = findFunctionResponseOrderingViolation(recorded);
+        if (badEntry !== undefined) {
+          return geminiError(400, "INVALID_ARGUMENT", `contents[${badEntry}]: functionResponse parts must precede any other content in their turn`);
+        }
+        const badRole = findRoleAlternationViolation(recorded);
+        if (badRole !== undefined) {
+          return geminiError(400, "INVALID_ARGUMENT", `contents[${badRole}]: consecutive entries must not share a role — a conversation alternates`);
+        }
+        const model = geminiModelOf(recorded) ?? "";
+        if (recorded.path.endsWith(":countTokens")) {
+          return opts.countTokens?.(recorded) ?? new Response(JSON.stringify({ totalTokens: 42 }), { status: 200, headers: { "content-type": "application/json" } });
+        }
+        const attempt = (attempts.get(model) ?? 0) + 1;
+        attempts.set(model, attempt);
+        const entry = opts.stream[model];
+        if (entry === undefined)
+          return geminiError(400, "INVALID_ARGUMENT", `fake: no scenario for model ${JSON.stringify(model)}`);
+        if (Array.isArray(entry))
+          return entry[Math.min(attempt - 1, entry.length - 1)];
+        return await entry(recorded, attempt);
+      }
+    },
+    {
+      path: `${prefix}/models`,
+      method: "GET",
+      handler: async (_req, recorded) => await opts.models?.(recorded) ?? new Response(JSON.stringify({ models: [] }), { status: 200, headers: { "content-type": "application/json" } })
+    }
+  ];
+}
+// src/fakes/openai-models.ts
+var exports_openai_models = {};
+__export(exports_openai_models, {
+  modelsNotFoundRoutes: () => modelsNotFoundRoutes,
+  ollamaTagsRoute: () => ollamaTagsRoute,
+  openAiModelsRoutes: () => openAiModelsRoutes
+});
+function openAiModelsRoutes(opts) {
+  let calls = 0;
+  const handler = (_req, recorded) => {
+    calls += 1;
+    if (opts.failOnCall !== undefined && calls >= opts.failOnCall.call) {
+      return jsonResponse2(opts.failOnCall.body ?? { error: { message: "discovery is unavailable", type: "server_error", code: "server_error" } }, opts.failOnCall.status);
+    }
+    if (opts.notJson === true)
+      return new Response("not json at all", { status: 200, headers: { "content-type": "application/json" } });
+    const after = new URLSearchParams(recorded.search).get("after");
+    let index = 0;
+    if (after !== null) {
+      const found = opts.pages.findIndex((page) => {
+        const last = page.rows.at(-1);
+        return last !== undefined && last.id === after;
+      });
+      index = found >= 0 ? found + 1 : 0;
+    }
+    const page = opts.pages[index] ?? { rows: [] };
+    return jsonResponse2({ object: "list", data: page.rows, has_more: page.hasMore === true });
+  };
+  const prefix = opts.pathPrefix ?? "";
+  return [
+    { path: `${prefix}/models`, method: "GET", handler },
+    { path: `${prefix}/v1/models`, method: "GET", handler }
+  ];
+}
+function ollamaTagsRoute(models) {
+  return {
+    path: "/api/tags",
+    method: "GET",
+    handler: () => jsonResponse2({ models: models.map((m) => ({ name: m.name, model: m.model ?? m.name, size: 1, details: { family: "llama" } })) })
+  };
+}
+function modelsNotFoundRoutes() {
+  const handler = () => jsonResponse2({ error: { message: "not found", code: "not_found" } }, 404);
+  return [
+    { path: "/models", method: "GET", handler },
+    { path: "/v1/models", method: "GET", handler }
+  ];
+}
+// src/fakes/vertex.ts
+var exports_vertex = {};
+__export(exports_vertex, {
+  VERTEX_TEST_ACCESS_TOKEN: () => VERTEX_TEST_ACCESS_TOKEN,
+  assertVertexRequest: () => assertVertexRequest,
+  generateTestKeyPair: () => generateTestKeyPair,
+  vertexFakeRoutes: () => vertexFakeRoutes,
+  vertexTokenUrl: () => vertexTokenUrl
+});
+
+// src/fakes/jwt-verify.ts
+function base64UrlDecodeText2(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return new TextDecoder().decode(bytes);
+}
+function base64UrlDecodeBytes2(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function verifyRs256Jwt2(jwt, publicKey) {
+  const parts = jwt.split(".");
+  if (parts.length !== 3)
+    return;
+  const [header, payload, signature] = parts;
+  let ok;
+  try {
+    ok = await crypto.subtle.verify(RS256.name, publicKey, base64UrlDecodeBytes2(signature).slice().buffer, new TextEncoder().encode(`${header}.${payload}`));
+  } catch {
+    return;
+  }
+  if (!ok)
+    return;
+  try {
+    return { header: JSON.parse(base64UrlDecodeText2(header)), claims: JSON.parse(base64UrlDecodeText2(payload)) };
+  } catch {
+    return;
+  }
+}
+
+// src/fakes/vertex.ts
+async function generateTestKeyPair() {
+  const pair = await crypto.subtle.generateKey({ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" }, true, ["sign", "verify"]);
+  const pkcs8 = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey));
+  const body = base64UrlEncode(pkcs8).replace(/-/g, "+").replace(/_/g, "/");
+  const padded = body + "=".repeat((4 - body.length % 4) % 4);
+  const lines = padded.match(/.{1,64}/g) ?? [];
+  return { privateKeyPem: `-----BEGIN PRIVATE KEY-----
+${lines.join(`
+`)}
+-----END PRIVATE KEY-----
+`, publicKey: pair.publicKey };
+}
+var VERTEX_TEST_ACCESS_TOKEN = "test-vertex-access-token-1";
+var REQUIRED_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+async function handleTokenExchange(recorded, opts) {
+  if (opts.rejectExchange === true)
+    return errorResponse2(401, { error: "invalid_grant", error_description: "fake: the exchange was scripted to fail" });
+  const form = new URLSearchParams(recorded.body);
+  if (form.get("grant_type") !== "urn:ietf:params:oauth:grant-type:jwt-bearer") {
+    return errorResponse2(400, { error: "unsupported_grant_type", error_description: `saw ${JSON.stringify(form.get("grant_type"))}` });
+  }
+  const assertion = form.get("assertion");
+  if (assertion === null)
+    return errorResponse2(400, { error: "invalid_request", error_description: "no assertion" });
+  const verified = await verifyRs256Jwt2(assertion, opts.publicKey);
+  if (verified === undefined)
+    return errorResponse2(401, { error: "invalid_grant", error_description: "the assertion's RS256 signature did not verify" });
+  if (verified.header["alg"] !== "RS256" || verified.header["typ"] !== "JWT") {
+    return errorResponse2(401, { error: "invalid_grant", error_description: `unexpected JOSE header ${JSON.stringify(verified.header)}` });
+  }
+  const { claims } = verified;
+  if (claims["aud"] !== opts.tokenUri)
+    return errorResponse2(401, { error: "invalid_grant", error_description: `wrong audience ${JSON.stringify(claims["aud"])}` });
+  if (claims["scope"] !== REQUIRED_SCOPE)
+    return errorResponse2(401, { error: "invalid_grant", error_description: `wrong scope ${JSON.stringify(claims["scope"])}` });
+  if (typeof claims["iss"] !== "string" || !claims["iss"].includes("@"))
+    return errorResponse2(401, { error: "invalid_grant", error_description: "iss is not a service-account email" });
+  const iat = claims["iat"];
+  const exp = claims["exp"];
+  if (typeof iat !== "number" || typeof exp !== "number" || exp <= iat)
+    return errorResponse2(401, { error: "invalid_grant", error_description: "iat/exp are missing or inverted" });
+  if (exp - iat > 3600)
+    return errorResponse2(401, { error: "invalid_grant", error_description: "the assertion lifetime exceeds one hour" });
+  opts.verified.push(verified);
+  return jsonResponse2({ access_token: opts.accessToken ?? VERTEX_TEST_ACCESS_TOKEN, token_type: "Bearer", expires_in: opts.expiresIn ?? 3600 });
+}
+function vertexTokenUrl(fakeUrl) {
+  return `${fakeUrl}/token`;
+}
+function vertexFakeRoutes(opts) {
+  const attempts = new Map;
+  return [
+    { path: "/token", method: "POST", handler: async (_req, recorded) => await handleTokenExchange(recorded, opts) },
+    {
+      path: `/v1/projects/${opts.project}/locations/${opts.location}/publishers/google/models*`,
+      method: "POST",
+      handler: async (_req, recorded) => {
+        const badEntry = findFunctionResponseOrderingViolation(recorded);
+        if (badEntry !== undefined) {
+          return geminiError(400, "INVALID_ARGUMENT", `contents[${badEntry}]: functionResponse parts must precede any other content in their turn`);
+        }
+        const badRole = findRoleAlternationViolation(recorded);
+        if (badRole !== undefined) {
+          return geminiError(400, "INVALID_ARGUMENT", `contents[${badRole}]: consecutive entries must not share a role — a conversation alternates`);
+        }
+        const model = geminiModelOf(recorded) ?? "";
+        if (recorded.path.endsWith(":countTokens")) {
+          return opts.countTokens?.(recorded) ?? jsonResponse2({ totalTokens: 42 });
+        }
+        const attempt = (attempts.get(model) ?? 0) + 1;
+        attempts.set(model, attempt);
+        const entry = opts.stream[model];
+        if (entry === undefined)
+          return geminiError(400, "INVALID_ARGUMENT", `fake: no scenario for model ${JSON.stringify(model)}`);
+        if (Array.isArray(entry))
+          return entry[Math.min(attempt - 1, entry.length - 1)];
+        return await entry(recorded, attempt);
+      }
+    }
+  ];
+}
+function assertVertexRequest(recorded, expected) {
+  const method = expected.method ?? "streamGenerateContent";
+  const path = `/v1/projects/${expected.project}/locations/${expected.location}/publishers/google/models/${expected.model}:${method}`;
+  const detail = `
+  live request: ${recorded.method} ${recorded.path}${recorded.search}
+  headers: ${JSON.stringify(recorded.headers)}`;
+  if (recorded.path !== path)
+    throw new Error(`expected the Vertex location path ${path}${detail}`);
+  if (expected.search !== undefined && recorded.search !== expected.search)
+    throw new Error(`expected search ${expected.search}${detail}`);
+  if (recorded.headers["authorization"] !== "Bearer ***")
+    throw new Error(`expected a redacted bearer token${detail}`);
+  if (recorded.headers["x-goog-api-key"] !== undefined)
+    throw new Error(`a Vertex request must not carry an api key${detail}`);
+}
+// src/fakes/xai-oauth.ts
+var exports_xai_oauth = {};
+__export(exports_xai_oauth, {
+  startXaiOauthFake: () => startXaiOauthFake
+});
+export { __export, ProviderRequestError, WINTER_BRAND, createRegistry, AZURE_PREVIEW_API_VERSION, createAzureOpenAIAdapter, sameDomain, summaryRequestOf, shouldRequestSummary, createEndpointResolver, descriptor, testContext, testDiscoveryContext, FAST_RETRY, fixtureModel, fixtureReasoning, fixtureProvider, fixtureCatalog, scriptedAdapter, startFake2, withFake2, sseResponse2, jsonResponse2, errorResponse2, redirectResponse2, stalledResponse2, scenarioTable2, requestsTo2, noRequestContains2, exports_openai_chat, exports_openai_responses, deploymentOf, apiVersionOf, exports_azure_openai, exports_anthropic_console_oauth, OPAQUE_FIELD_NAMES2, redactOpaqueFields2, exports_anthropic_messages, exports_bedrock, exports_codex_oauth, exports_gemini, exports_openai_models, base64UrlDecodeText2, base64UrlDecodeBytes2, verifyRs256Jwt2, exports_vertex, exports_xai_oauth };