@yanlinglabs/winter-provider-runtime 0.0.2

package/dist/registry.d.ts

@@ -0,0 +1,136 @@
+import type { WinterCatalog, WinterModelDescriptor, WinterProviderDescriptor } from "@yanlinglabs/winter-provider-catalog";
+import type { ProviderAdapter } from "./types.js";
+export interface ResolvedModel {
+    providerId: string;
+    /** The catalog key, or `<providerId>/<id>` for an allowUnlisted passthrough. */
+    modelKey: string;
+    /** What actually goes on the wire. */
+    providerModelId: string;
+    adapterId: string;
+    adapter: ProviderAdapter;
+    /** `undefined` ONLY for an allowUnlisted passthrough on a non-authoritative provider. Absence is the honest signal that nothing is known — never read capabilities off it. */
+    descriptor: WinterModelDescriptor | undefined;
+    provider: WinterProviderDescriptor;
+    continuationDomain?: string;
+    catalogVersion: string;
+}
+export type ResolutionErrorCode = "unknown-provider" | "unknown-model" | "no-adapter" | "blocked" | "no-provider-for-bare-model"
+/** RULING R6-K: the model id is qualified for one provider while the session is configured for another. Never resolved either way — see `resolve`'s own header. */
+ | "provider-mismatch"
+/**
+ * WS-13b R6b-7: the row resolved, but the user has turned this provider OFF
+ * (`settings.providers.<id>.enabled === false`). A REFUSAL rather than a skip, on purpose: a skip
+ * is a substitution by another name, and WS-13 §9 forbids a session quietly running on something
+ * other than what it was asked for. Produced by the runtime's `selection.ts`, which is where the
+ * settings cascade is visible -- the registry itself has no settings and never will.
+ */
+ | "provider-disabled" | "capability"
+/**
+ * P6 fix wave, Ruling E-1: a provider built for a target on ANOTHER provider than the session's has
+ * no credential of its own -- no explicit `authRef` on the target's route and no keychain record for
+ * the target provider. The session's credential is NEVER substituted (`session-provider.ts`
+ * `describeTargetMaterial`); this code is what the deferred refusal carries instead.
+ */
+ | "no-credential-for-provider"
+/**
+ * WS-13c §4 step 5: a slot name resolved to a canonical model, and NOTHING can serve it — every
+ * candidate row is blocked/deprecated, its provider has no credential, its provider is disabled,
+ * or the slot's pinned provider is absent.
+ *
+ * A REFUSAL that names what would have served it, never a substitution and never another family
+ * (WS-13 §9). The Agent tool's `model` enum advertises a lineup, not an entitlement: a session may
+ * legitimately be offered `astra` and hold no OpenAI credential, and answering that by quietly
+ * running `sonnet` is the exact "false information" D25 forbids.
+ */
+ | "slot-unservable"
+/**
+ * WS-13c §3 acceptance (c): a slot name that is NOT in the session's active set and exists in two
+ * or more families — `pro` and `flash` live in `gemini`, `deepseek` and `glm`.
+ *
+ * Typed rather than resolved by a tie-break, because either choice would be a guess about which
+ * vendor the model meant, and a model copying a name it saw in older context is exactly the case
+ * acceptance (b) makes work when the name IS unique.
+ */
+ | "ambiguous-slot-name"
+/**
+ * P7a carry (Lane D): the row is a PER-TENANT provider (`requiresUserEndpoint`) and this session
+ * supplied no endpoint of its own, so there is nothing to send the request to.
+ *
+ * A REFUSAL, and it has to be one: such a row ships with no usable `defaultEndpoints.api` at all,
+ * so the alternatives are a request to a literal `<resource>` placeholder host (a confusing DNS
+ * failure) or a silent fall back to some other provider, which WS-13 §9 forbids. The message
+ * carries the row's `endpointTemplate` so the host can tell the user exactly what to paste.
+ *
+ * DECLARED AT P7a'S SPINE so producer and consumer can land in either order; nothing raises it
+ * until Lane D's `connectionForProvider` does.
+ */
+ | "endpoint-required";
+export declare class WinterProviderResolutionError extends Error {
+    readonly code: ResolutionErrorCode;
+    constructor(code: ResolutionErrorCode, message: string);
+}
+/** What `resolve` is asked. `provider` carries the session's selection; `allowUnlisted` is a selection-policy bit, deliberately NOT part of `ConnectionProfile`. */
+export interface ResolveRequest {
+    model: string;
+    provider?: {
+        providerId?: string;
+        allowUnlisted?: boolean;
+    };
+}
+/**
+ * The pinned `ModelInfo` shape (`sdk.d.ts:1261-1300`): three required fields, six optional.
+ *
+ * RE-EXPORTED from the sdk rather than declared here (T10), the same way `CredentialRef` already is:
+ * `Query.supportedModels()` puts this shape on the sdk's public surface, and two independent copies
+ * of a pinned wire type are how the producer and the consumer of one round trip start disagreeing
+ * about an optional field. One declaration; either import path gets it.
+ */
+import type { ModelInfo } from "@yanlinglabs/winter-agent-sdk";
+export type { ModelInfo };
+export interface RegistryListing {
+    catalogVersion: string;
+    adapters: Array<{
+        id: string;
+        version: string;
+        family: string;
+        protocol: string;
+    }>;
+    providers: Array<{
+        id: string;
+        displayName: string;
+        adapterId: string;
+        adapterRegistered: boolean;
+        modelCount: number;
+        riskClass: string;
+    }>;
+}
+export interface ProviderRegistry {
+    register(adapter: ProviderAdapter): void;
+    resolve(request: ResolveRequest): ResolvedModel | WinterProviderResolutionError;
+    list(): RegistryListing;
+    /** R6-I: pinned-shaped rows for one provider's models. Optional capability booleans are OMITTED when unknown, never `false`. */
+    listModelInfo(sessionProviderId: string): ModelInfo[];
+}
+export interface UsageForCost {
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+}
+/**
+ * R6-H: the descriptor's `pricing` evidence is the ONLY price source.
+ *
+ * An unpriced model — or one resolved with no descriptor at all — reports `0` with
+ * `costBasis: "unknown"`. That is a DELIBERATE, DISCLOSED DIVERGENCE from the pin: capture (K) shows
+ * the pinned runtime reporting a non-zero cost for a model no price table contains, guessing at the
+ * default model's rate. A number nobody can justify is worse than an honest zero next to a marker
+ * that says the basis is unknown, and `maxBudgetUsd` is correspondingly inert for such a model.
+ *
+ * Cache tokens with no cache rate are priced at the INPUT rate rather than free: pricing them at
+ * zero would silently under-report, and the basis stays `"list"` because a real list price was used.
+ */
+export declare function estimateCostUsd(usage: UsageForCost, descriptor: WinterModelDescriptor | undefined): {
+    costUsd: number;
+    costBasis: "list" | "unknown";
+};
+export declare function createRegistry(catalog: WinterCatalog): ProviderRegistry;

package/dist/retry.d.ts

@@ -0,0 +1,38 @@
+import type { ProviderEvent } from "./types.js";
+export declare const DEFAULT_MAX_RETRIES = 10;
+export declare const RETRY_BACKOFF_BASE_MS = 1000;
+export declare const RETRY_BACKOFF_CAP_MS = 30000;
+export declare const RETRY_AFTER_HONOUR_CEILING_MS = 60000;
+export interface RetryPolicyOptions {
+    maxRetries?: number;
+    /** Injected for deterministic tests. Full jitter multiplies the whole interval by this in [0, 1). */
+    random?: () => number;
+    /** Injected for deterministic tests — a real `withRetry` never sleeps in a unit test. */
+    sleep?: (ms: number) => Promise<void>;
+}
+export interface RetryPolicy {
+    readonly maxRetries: number;
+    /** True once `commit()` has been called: the stream has begun and no further retry is safe. */
+    readonly committed: boolean;
+    /** Called by the caller the moment the first response byte is consumed. Idempotent, one-way. */
+    commit(): void;
+    /** The delay before retry number `attempt` (1-based). `retryAfterMs`, when within the ceiling, replaces the schedule entirely. */
+    delayMs(attempt: number, retryAfterMs?: number): number;
+    /** Waits, ABORTABLY. A backoff can be 30 s (or a clamped 60 s of Retry-After), and an interrupt must not have to outlast it. */
+    sleep(ms: number, signal?: AbortSignal): Promise<void>;
+}
+export declare function createRetryPolicy(opts?: RetryPolicyOptions): RetryPolicy;
+/**
+ * Runs `attempt` under the policy, emitting one `retry` event per retry — announced BEFORE the delay
+ * is taken, which is the pinned ordering (capture (G): the frame's `retry_delay_ms` of 577 preceded
+ * a measured 586ms gap).
+ *
+ * `attempt` is the RETRY ORDINAL starting at 1, matching the pin: a single failure then success
+ * produced exactly one frame with `attempt: 1`. So the total number of invocations is
+ * `maxRetries + 1`.
+ */
+export declare function withRetry<T>(attempt: (n: number) => Promise<T>, policy: RetryPolicy, onRetry: (event: Extract<ProviderEvent, {
+    type: "retry";
+}>) => void, 
+/** Cancels the BACKOFF as well as the attempt. Optional so every existing call site is unchanged. */
+signal?: AbortSignal): Promise<T>;

package/dist/sse.d.ts

@@ -0,0 +1,12 @@
+export interface SseOptions {
+    /** Milliseconds of TOTAL SILENCE (no bytes at all) after which the stream is abandoned as stalled. */
+    stallTimeoutMs: number;
+    signal?: AbortSignal;
+    /** Called with every chunk's byte count — telemetry counts bytes, never content (Global Constraints). */
+    onBytes?: (n: number) => void;
+}
+export interface SseEvent {
+    event?: string;
+    data: string;
+}
+export declare function parseSse(body: ReadableStream<Uint8Array>, opts: SseOptions): AsyncGenerator<SseEvent>;

package/dist/testing.d.ts

@@ -0,0 +1,19 @@
+export { concatFrames, converseStreamEvent, converseStreamException, verifySigV4, encodeEventStreamMessage } from "./adapters/bedrock/testing.js";
+export type { EventStreamHeaderInput, SigV4Verdict, VerifySigV4Input } from "./adapters/bedrock/testing.js";
+export { parseAuthorization } from "./adapters/bedrock/sigv4.js";
+export { FAST_RETRY, descriptor, testContext, testDiscoveryContext } from "./adapters/openai/testing.js";
+export type { DescriptorOverrides, TestContextOptions } from "./adapters/openai/testing.js";
+export { BunRequiredError } from "./bun-required.js";
+export { startXaiChatFake, startXaiOauthFake } from "./adapters/openai/xai-oauth.testing.js";
+export type { XaiOauthFake, XaiOauthFakeOptions, XaiRecordedRequest } from "./adapters/openai/xai-oauth.testing.js";
+export { CODEX } from "./adapters/openai/codex-config.js";
+export { QuotaManager } from "./adapters/openai/quota.js";
+export { base64Url } from "./adapters/openai/pkce.js";
+export { AZURE_PREVIEW_API_VERSION } from "./adapters/openai/azure.js";
+export { hostHeaders } from "./adapters/privileged-headers.js";
+export { RS256, base64UrlEncode, importRs256PrivateKey, pkcs8DerFromPem, signRs256Jwt } from "./adapters/google/jwt-rs256.js";
+export { vertexModelPath } from "./adapters/google/index.js";
+export { GCP_CLOUD_PLATFORM_SCOPE, createServiceAccountTokenSource } from "./adapters/google/adc.js";
+export { googleCompletionMarker } from "./adapters/google/generate-content.js";
+export { THINKING_ENABLED_NEEDS_BUDGET } from "./adapters/refusals.js";
+export { fixtureCatalog, fixtureModel, fixtureProvider, fixtureReasoning, scriptedAdapter } from "./continuity/fixtures.js";

package/dist/testing.js

@@ -0,0 +1,432 @@
+import {
+  createMemoryCredentialStore2,
+  stampFamilyFields,
+  BunRequiredError2,
+  requireBunRuntime2,
+  hostHeaders2,
+  THINKING_ENABLED_NEEDS_BUDGET2,
+  base64Url2,
+  googleCompletionMarker2,
+  RS2562,
+  base64UrlEncode2,
+  pkcs8DerFromPem2,
+  importRs256PrivateKey2,
+  signRs256Jwt2,
+  GCP_CLOUD_PLATFORM_SCOPE2,
+  createServiceAccountTokenSource2,
+  vertexModelPath2,
+  crc32,
+  sha256Hex,
+  buildCanonicalRequest,
+  buildStringToSign,
+  computeSignature,
+  parseAuthorization2,
+  CODEX2,
+  QuotaManager2,
+  AZURE_PREVIEW_API_VERSION2,
+  readableStateOf2
+} from "./index-5z94gxhk.js";
+
+// src/adapters/bedrock/testing.ts
+function encodeHeader(header) {
+  const encoder = new TextEncoder;
+  const name = encoder.encode(header.name);
+  const value = encoder.encode(header.value);
+  const out = new Uint8Array(1 + name.length + 1 + 2 + value.length);
+  const view = new DataView(out.buffer);
+  let offset = 0;
+  view.setUint8(offset, name.length);
+  offset += 1;
+  out.set(name, offset);
+  offset += name.length;
+  view.setUint8(offset, 7);
+  offset += 1;
+  view.setUint16(offset, value.length);
+  offset += 2;
+  out.set(value, offset);
+  return out;
+}
+function encodeEventStreamMessage(headers, payload) {
+  const encodedHeaders = headers.map(encodeHeader);
+  const headersLength = encodedHeaders.reduce((sum, h) => sum + h.length, 0);
+  const totalLength = 16 + headersLength + payload.length;
+  const out = new Uint8Array(totalLength);
+  const view = new DataView(out.buffer);
+  view.setUint32(0, totalLength);
+  view.setUint32(4, headersLength);
+  view.setUint32(8, crc32(out.subarray(0, 8)));
+  let offset = 16 - 4;
+  for (const header of encodedHeaders) {
+    out.set(header, offset);
+    offset += header.length;
+  }
+  out.set(payload, offset);
+  view.setUint32(totalLength - 4, crc32(out.subarray(0, totalLength - 4)));
+  return out;
+}
+function converseStreamEvent(eventType, payload) {
+  return encodeEventStreamMessage([
+    { name: ":message-type", value: "event" },
+    { name: ":event-type", value: eventType },
+    { name: ":content-type", value: "application/json" }
+  ], new TextEncoder().encode(JSON.stringify(payload)));
+}
+function converseStreamException(exceptionType, payload = {}) {
+  return encodeEventStreamMessage([
+    { name: ":message-type", value: "exception" },
+    { name: ":exception-type", value: exceptionType },
+    { name: ":content-type", value: "application/json" }
+  ], new TextEncoder().encode(JSON.stringify(payload)));
+}
+function concatFrames(frames) {
+  const total = frames.reduce((sum, f) => sum + f.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const frame of frames) {
+    out.set(frame, offset);
+    offset += frame.length;
+  }
+  return out;
+}
+async function verifySigV4(input) {
+  const parsed = parseAuthorization2(input.headers.get("authorization"));
+  if (parsed === undefined)
+    return { ok: false, reason: "the request carried no parseable AWS4-HMAC-SHA256 Authorization header" };
+  if (input.expectedAccessKeyId !== undefined && parsed.accessKeyId !== input.expectedAccessKeyId) {
+    return { ok: false, reason: `the credential names access key "${parsed.accessKeyId}", which this fake does not know` };
+  }
+  const url = new URL(input.url);
+  const headers = {};
+  for (const name of parsed.signedHeaders) {
+    const value = name === "host" ? url.host : input.headers.get(name);
+    if (value === null || value === undefined)
+      return { ok: false, reason: `the signature covers header "${name}", which the request does not carry` };
+    headers[name] = value;
+  }
+  const payloadHash = await sha256Hex(input.body);
+  const declaredHash = input.headers.get("x-amz-content-sha256");
+  if (declaredHash !== null && declaredHash !== payloadHash) {
+    return { ok: false, reason: "x-amz-content-sha256 does not match the body the server received" };
+  }
+  const stamp = input.headers.get("x-amz-date");
+  if (stamp === null)
+    return { ok: false, reason: "the request carried no x-amz-date" };
+  const { canonicalRequest } = buildCanonicalRequest({ method: input.method, pathname: url.pathname, search: url.search, headers, payloadHash });
+  const scope = `${parsed.datestamp}/${parsed.region}/${parsed.service}/aws4_request`;
+  const stringToSign = await buildStringToSign(canonicalRequest, stamp, scope);
+  const expected = await computeSignature(input.secretAccessKey, parsed.datestamp, parsed.region, parsed.service, stringToSign);
+  if (expected !== parsed.signature)
+    return { ok: false, reason: "the request signature does not match the one this fake computes for it" };
+  return { ok: true, accessKeyId: parsed.accessKeyId };
+}
+// src/adapters/openai/testing.ts
+var TEST_API_KEY = "test-key-openai-0000";
+function evidence(value, confidence = "verified") {
+  return { value, source: "official-doc", confidence, observedAt: "2026-09-05T00:00:00Z" };
+}
+var stampRow = (row) => stampFamilyFields([row], [])[0];
+function descriptor(overrides = {}) {
+  const key = overrides.key ?? "openai/o4-mini";
+  return stampRow({
+    key,
+    providerId: overrides.providerId ?? key.split("/")[0],
+    upstreamId: overrides.upstreamId ?? key.slice(key.indexOf("/") + 1),
+    displayName: key,
+    aliases: [],
+    endpoints: ["responses"],
+    inputModalities: evidence(overrides.inputModalities ?? ["text", "image"]),
+    outputModalities: evidence(["text"]),
+    toolCalling: evidence(overrides.toolCalling ?? "native"),
+    nativeTools: evidence(true),
+    ...overrides.parallelTools !== undefined ? { parallelTools: evidence(overrides.parallelTools) } : {},
+    ...overrides.maxOutputTokens !== undefined ? { maxOutputTokens: evidence(overrides.maxOutputTokens) } : {},
+    ...overrides.noReasoning === true ? {} : {
+      reasoning: {
+        supported: evidence(true),
+        efforts: overrides.efforts ?? ["low", "medium", "high"],
+        ...overrides.defaultEffort !== undefined ? { defaultEffort: overrides.defaultEffort } : {},
+        continuation: overrides.continuation ?? "opaque-provider-state",
+        readableState: evidence(overrides.readableState ?? "summary"),
+        ...overrides.summaryValues !== undefined ? { summaryRequest: evidence({ field: "reasoning.summary", values: overrides.summaryValues }) } : {},
+        ...overrides.continuationDomain !== undefined ? { continuationDomain: evidence(overrides.continuationDomain) } : {}
+      }
+    },
+    unsupportedParameters: overrides.unsupportedParameters ?? [],
+    status: "candidate"
+  });
+}
+var KEYCHAIN_REF = { kind: "keychain", account: "openai:test" };
+function testContext(opts = {}) {
+  const key = opts.apiKey === undefined ? TEST_API_KEY : opts.apiKey;
+  const credentials = createMemoryCredentialStore2(key === null ? [] : [[KEYCHAIN_REF, { kind: "api-key", key }]]);
+  const connection = {
+    providerId: opts.providerId ?? "openai",
+    ...opts.baseUrl !== undefined ? { baseUrl: opts.baseUrl } : {},
+    ...opts.local !== undefined ? { local: opts.local } : {},
+    ...opts.headers !== undefined ? { headers: opts.headers } : {},
+    ...opts.deployment !== undefined ? { deployment: opts.deployment } : {},
+    ...opts.apiVersion !== undefined ? { apiVersion: opts.apiVersion } : {}
+  };
+  return {
+    connection,
+    credentials,
+    authRef: opts.authRef ?? (key === null ? { kind: "none" } : KEYCHAIN_REF),
+    stallTimeoutMs: opts.stallTimeoutMs ?? 2000,
+    log: (event) => opts.logs?.push(event)
+  };
+}
+function testDiscoveryContext(opts = {}) {
+  return {
+    ...testContext(opts),
+    ...opts.signal !== undefined ? { signal: opts.signal } : {},
+    limits: { maxBytes: opts.maxBytes ?? 1024 * 1024, maxItems: opts.maxItems ?? 100, timeoutMs: opts.timeoutMs ?? 5000 }
+  };
+}
+var FAST_RETRY = { maxRetries: 3, random: () => 0.5, sleep: (_ms) => new Promise((r) => setTimeout(r, 1)) };
+// src/adapters/openai/xai-oauth.testing.ts
+var ACCOUNT_ID = "acct-x";
+var REFRESHED_ACCESS_TOKEN = "test-token-xai-access-refreshed";
+function fakeIdToken(sub = ACCOUNT_ID) {
+  const b64 = (value) => btoa(JSON.stringify(value)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return `${b64({ alg: "ES256", typ: "JWT" })}.${b64({ sub, email: "someone@example.invalid" })}.c2ln`;
+}
+async function startXaiChatFake(opts = {}) {
+  requireBunRuntime2("startXaiChatFake", "Bun.serve", "It binds a loopback HTTP server on 127.0.0.1:0 to stand in for the vendor. Drive it from a Bun test process; a Node consumer has no fake to start.");
+  const requests = [];
+  const fresh = opts.freshBearer ?? REFRESHED_ACCESS_TOKEN;
+  let sawFreshBearer = false;
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch: async (req) => {
+      const url = new URL(req.url);
+      const body = await req.text();
+      const headers = {};
+      for (const [name, value] of req.headers) {
+        headers[name.toLowerCase()] = /^(authorization|x-api-key|api-key)$/i.test(name) ? `${value.split(" ")[0] ?? ""} ***`.trim() : value;
+      }
+      if (req.headers.get("authorization") === `Bearer ${fresh}`)
+        sawFreshBearer = true;
+      requests.push({ method: req.method, path: url.pathname, headers, body });
+      const frames = [
+        `data: ${JSON.stringify({ id: "cmpl-1", choices: [{ index: 0, delta: { content: "ok" } }] })}
+
+`,
+        `data: ${JSON.stringify({ id: "cmpl-1", choices: [{ index: 0, delta: {}, finish_reason: "stop" }] })}
+
+`,
+        `data: [DONE]
+
+`
+      ].join("");
+      return new Response(frames, { headers: { "content-type": "text/event-stream" } });
+    }
+  });
+  return {
+    url: `http://127.0.0.1:${server.port}`,
+    requests,
+    get sawFreshBearer() {
+      return sawFreshBearer;
+    },
+    close: async () => {
+      await server.stop(true);
+    }
+  };
+}
+async function startXaiOauthFake(opts = {}) {
+  requireBunRuntime2("startXaiOauthFake", "Bun.serve", "It binds a loopback HTTP server on 127.0.0.1:0 to stand in for the vendor. Drive it from a Bun test process; a Node consumer has no fake to start.");
+  const requests = [];
+  let polls = 0;
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch: async (req) => {
+      const url = new URL(req.url);
+      const body = await req.text();
+      const headers = {};
+      for (const [name, value] of req.headers) {
+        headers[name.toLowerCase()] = /^(authorization|x-api-key|api-key)$/i.test(name) ? `${value.split(" ")[0] ?? ""} ***`.trim() : value;
+      }
+      requests.push({ method: req.method, path: url.pathname, headers, body });
+      const form = new URLSearchParams(body);
+      const identity = form.get("referrer");
+      if (identity === null || identity.length === 0) {
+        return Response.json({ error: "invalid_request", error_description: "the client did not identify itself" }, { status: 400 });
+      }
+      if (url.pathname === "/oauth2/device/code") {
+        return Response.json({
+          device_code: "test-device-code-xai",
+          user_code: "WXYZ-1234",
+          verification_uri: "https://example.invalid/activate",
+          verification_uri_complete: "https://example.invalid/activate?user_code=WXYZ-1234",
+          interval: 0,
+          expires_in: 900
+        });
+      }
+      if (url.pathname === "/oauth2/token") {
+        if (form.get("grant_type") === "refresh_token") {
+          return Response.json({ access_token: REFRESHED_ACCESS_TOKEN, expires_in: 3600, token_type: "Bearer" });
+        }
+        if (opts.rejectIdentity !== undefined && identity === opts.rejectIdentity) {
+          return Response.json({ error: "access_denied", error_description: "client not allowed" }, { status: 400 });
+        }
+        if (opts.tokenError !== undefined) {
+          return Response.json({ error: opts.tokenError, error_description: "the fixture's ordinary failure" }, { status: 400 });
+        }
+        polls += 1;
+        if (polls <= (opts.pendingPolls ?? 0))
+          return Response.json({ error: "authorization_pending" }, { status: 400 });
+        return Response.json({
+          access_token: "test-token-xai-access",
+          refresh_token: "test-token-xai-refresh",
+          ...opts.omitIdToken === true ? {} : { id_token: fakeIdToken() },
+          expires_in: 3600,
+          token_type: "Bearer"
+        });
+      }
+      return Response.json({ error: "not_found" }, { status: 404 });
+    }
+  });
+  return {
+    deviceCodeUrl: `http://127.0.0.1:${server.port}/oauth2/device/code`,
+    tokenUrl: `http://127.0.0.1:${server.port}/oauth2/token`,
+    requests,
+    close: async () => {
+      await server.stop(true);
+    }
+  };
+}
+// src/continuity/fixtures.ts
+var evidence2 = (value, confidence = "verified") => ({
+  value,
+  source: "official-doc",
+  observedAt: "2026-09-05",
+  confidence
+});
+var stampRow2 = (row) => stampFamilyFields([row], [])[0];
+function fixtureModel(init) {
+  return stampRow2({
+    key: init.key,
+    providerId: init.providerId,
+    upstreamId: init.upstreamId ?? init.key.slice(init.key.indexOf("/") + 1),
+    displayName: init.key,
+    aliases: init.aliases ?? [],
+    endpoints: ["responses"],
+    ...init.contextWindow !== undefined ? { contextWindow: evidence2(init.contextWindow) } : {},
+    inputModalities: evidence2(["text"]),
+    outputModalities: evidence2(["text"]),
+    toolCalling: evidence2(init.toolCalling ?? "native"),
+    nativeTools: evidence2(true),
+    ...init.reasoning !== undefined ? { reasoning: init.reasoning } : {},
+    unsupportedParameters: [],
+    status: "supported"
+  });
+}
+function fixtureReasoning(init) {
+  return {
+    supported: evidence2(true),
+    efforts: init.efforts ?? [],
+    continuation: init.continuation ?? "opaque-provider-state",
+    readableState: evidence2(init.readableState, init.confidence),
+    ...init.summaryRequest !== undefined ? { summaryRequest: evidence2(init.summaryRequest, init.confidence) } : {},
+    ...init.domain !== undefined ? { continuationDomain: evidence2(init.domain, init.confidence) } : {}
+  };
+}
+function fixtureProvider(init) {
+  return {
+    id: init.id,
+    displayName: init.id,
+    protocols: ["openai-responses"],
+    authKinds: ["api-key"],
+    defaultEndpoints: { base: init.baseUrl ?? "https://example.invalid/v1/responses" },
+    modelDiscovery: "none",
+    liveCatalogAuthority: "partial",
+    adapterId: init.adapterId ?? `${init.id}-adapter`,
+    family: init.family ?? "openai",
+    upstream: { project: "winter", commit: "", sourcePaths: [] },
+    risk: { class: "approved", reasons: [] },
+    scope: "llm",
+    pricingBasis: "token",
+    admission: { basis: "api-key", citation: "fixture:continuity", tier: "local" }
+  };
+}
+function fixtureCatalog(providers, models) {
+  return {
+    schemaVersion: 2,
+    families: [],
+    catalogVersion: "0.0.0-continuity-fixture",
+    upstream: { tag: "", tagObject: "", commit: "", extractorVersion: "", overlayVersion: "" },
+    providers,
+    models
+  };
+}
+function scriptedAdapter(init) {
+  const requests = [];
+  return {
+    id: init.id,
+    version: "0.0.0-fixture",
+    family: init.family ?? "openai",
+    protocol: "openai-responses",
+    requests,
+    async validateCredential() {
+      return { ok: true };
+    },
+    async listModels() {
+      return { models: [], partial: false, cached: false, warnings: [] };
+    },
+    streamTurn(req) {
+      requests.push(req);
+      const events = init.events ?? [{ type: "done", stopReason: "end_turn" }];
+      return async function* () {
+        for (const event of events)
+          yield event;
+      }();
+    },
+    mapEffort() {
+      return { ok: true, value: undefined };
+    },
+    capabilities(model) {
+      const domain = model.reasoning?.continuationDomain?.value;
+      return {
+        toolCalling: model.toolCalling.value,
+        ...domain !== undefined && domain.length > 0 ? { continuationDomain: [...domain].sort()[0] } : {},
+        readableState: readableStateOf2(model)
+      };
+    }
+  };
+}
+export {
+  AZURE_PREVIEW_API_VERSION2 as AZURE_PREVIEW_API_VERSION,
+  BunRequiredError2 as BunRequiredError,
+  CODEX2 as CODEX,
+  FAST_RETRY,
+  GCP_CLOUD_PLATFORM_SCOPE2 as GCP_CLOUD_PLATFORM_SCOPE,
+  QuotaManager2 as QuotaManager,
+  RS2562 as RS256,
+  THINKING_ENABLED_NEEDS_BUDGET2 as THINKING_ENABLED_NEEDS_BUDGET,
+  base64Url2 as base64Url,
+  base64UrlEncode2 as base64UrlEncode,
+  concatFrames,
+  converseStreamEvent,
+  converseStreamException,
+  createServiceAccountTokenSource2 as createServiceAccountTokenSource,
+  descriptor,
+  encodeEventStreamMessage,
+  fixtureCatalog,
+  fixtureModel,
+  fixtureProvider,
+  fixtureReasoning,
+  googleCompletionMarker2 as googleCompletionMarker,
+  hostHeaders2 as hostHeaders,
+  importRs256PrivateKey2 as importRs256PrivateKey,
+  parseAuthorization2 as parseAuthorization,
+  pkcs8DerFromPem2 as pkcs8DerFromPem,
+  scriptedAdapter,
+  signRs256Jwt2 as signRs256Jwt,
+  startXaiChatFake,
+  startXaiOauthFake,
+  testContext,
+  testDiscoveryContext,
+  verifySigV4,
+  vertexModelPath2 as vertexModelPath
+};