cartethyia 2.7.8 → 2.8.0

package/src/providers/authentication/oauth-refresh-service.ts

@@ -26,7 +26,8 @@ import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import { sleep } from "../../shared/sleep";
 import { providerAccounts, providerOauthStates } from "../../persistence/schema";
 import { decryptCredentialToString, encryptCredential } from "../../security/crypto";
-import { invalidateCredentialCache } from "../operations/provider-credential-service";
+import { invalidateCredentialCache, loadAccountWithOauthState } from "../operations/provider-credential-service";
+import { applyAccountVerdict } from "../operations/account-health-service";
 import { resolveAccountDisabledRecoveryMs } from "../../config/cooldowns";
 import { asJsonbRecord } from "../../shared/coerce";
 import {
@@ -169,6 +170,22 @@ async function releaseLease(
     );
 }
 
+/**
+ * D21 invariant guard: a refresh is not a health verdict, so mutating the
+ * account's `status` here would silently re-enable an account a refresh was
+ * never meant to resurrect. The `.set()` calls in `persistRefreshed` accept
+ * `status` at the type level (it is a column on `provider_accounts`), so the
+ * guard is a runtime assertion that fails loudly in development instead of
+ * letting a future edit change health state from the refresh path.
+ */
+function assertRefreshNeverMutatesStatus(set: Record<string, unknown>): void {
+  if ("status" in set) {
+    throw new Error(
+      "persistRefreshed must never write `status`; a refresh is not a health verdict",
+    );
+  }
+}
+
 /** Persists a successful refresh and releases the lease, fenced on still holding it. */
 async function persistRefreshed(
   db: CartethyiaDatabase,
@@ -177,16 +194,21 @@ async function persistRefreshed(
   result: OAuthTokenRefreshResult,
 ): Promise<boolean> {
   return db.transaction(async (tx) => {
+    // This function must never write `status`; a refresh is not a health
+    // verdict. The guard below makes an accidental status write a loud dev
+    // failure rather than a silent re-enable.
+    const oauthSet = {
+      ...(result.refresh === undefined
+        ? {}
+        : { refreshCiphertext: encryptCredential(result.refresh) }),
+      expiresAt: result.expiresAt,
+      leaseOwner: null,
+      leaseExpiresAt: null,
+    };
+    assertRefreshNeverMutatesStatus(oauthSet);
     const leaseRows = await tx
       .update(providerOauthStates)
-      .set({
-        ...(result.refresh === undefined
-          ? {}
-          : { refreshCiphertext: encryptCredential(result.refresh) }),
-        expiresAt: result.expiresAt,
-        leaseOwner: null,
-        leaseExpiresAt: null,
-      })
+      .set(oauthSet)
       .where(
         and(
           eq(providerOauthStates.providerAccountId, accountId),
@@ -195,23 +217,27 @@ async function persistRefreshed(
       )
       .returning({ id: providerOauthStates.providerAccountId });
     if (leaseRows.length === 0) return false;
+    const accountSet = {
+      credentialCiphertext: encryptCredential(result.access),
+      // Only what the refresh reported: a refresher that learned nothing new
+      // leaves the stored configuration alone rather than blanking it.
+      // A learned identity only replaces a default label — an operator's
+      // custom rename is never overwritten. The CASE keeps the read and the
+      // write in one statement, so a concurrent rename cannot lose to the
+      // refresh's learned identity.
+      ...(result.accountLabel === undefined
+        ? {}
+        : {
+          label: sql`CASE WHEN lower(trim(${providerAccounts.label})) = lower(trim(${providerAccounts.providerId})) THEN ${result.accountLabel} ELSE ${providerAccounts.label} END`,
+        }),
+      ...(result.auth_state === undefined ? {} : { authState: result.auth_state }),
+    };
+    // The second half of the D21 invariant: the credential write must never
+    // touch the account's health state either.
+    assertRefreshNeverMutatesStatus(accountSet);
     await tx
       .update(providerAccounts)
-      .set({
-        credentialCiphertext: encryptCredential(result.access),
-        // Only what the refresh reported: a refresher that learned nothing new
-        // leaves the stored configuration alone rather than blanking it.
-        // A learned identity only replaces a default label — an operator's
-        // custom rename is never overwritten. The CASE keeps the read and the
-        // write in one statement, so a concurrent rename cannot lose to the
-        // refresh's learned identity.
-        ...(result.accountLabel === undefined
-          ? {}
-          : {
-            label: sql`CASE WHEN lower(trim(${providerAccounts.label})) = lower(trim(${providerAccounts.providerId})) THEN ${result.accountLabel} ELSE ${providerAccounts.label} END`,
-          }),
-        ...(result.auth_state === undefined ? {} : { authState: result.auth_state }),
-      })
+      .set(accountSet)
       .where(eq(providerAccounts.id, accountId));
     invalidateCredentialCache(accountId);
     return true;
@@ -240,12 +266,21 @@ function buildRefreshContext(row: AccountRow, includeAccessToken: boolean): OAut
 /**
  * Marks an account permanently unusable after a definitive refresh failure,
  * fenced on the lease.
+ *
+ * @param preserveOperatorDisable When true, an account that is already
+ *   `disabled` with no `cooldownUntil` — the operator's own disable — keeps its
+ *   lack of a recovery deadline (D23). A machine disable (this function being
+ *   the machine) always writes a deadline for itself, but it must not convert
+ *   an operator's terminal decision into a recoverable one: adding a deadline
+ *   to an operator-disabled row is what made the Recover button appear on an
+ *   account the operator disabled on purpose.
  */
 async function disableAccount(
   db: CartethyiaDatabase,
   accountId: string,
   owner: string,
   message: string,
+  options: { readonly preserveOperatorDisable?: boolean } = {},
 ): Promise<void> {
   await db.transaction(async (tx) => {
     const leaseRows = await tx
@@ -260,30 +295,32 @@ async function disableAccount(
       .returning({ id: providerOauthStates.providerAccountId });
     if (leaseRows.length === 0) return;
     const disabledRecoveryMs = resolveAccountDisabledRecoveryMs();
-    await tx
-      .update(providerAccounts)
-      .set({
-        status: "disabled",
-        lastError: message.slice(0, 500),
-        // `auth_invalidated` is the category the console reads to render the
-        // "Re-login required" pill, and the one the quota sweep excludes so it
-        // stops re-probing a credential that cannot repair itself. The refresh
-        // grant was definitively rejected and the stored access token could not
-        // be shown to still work, so this is exactly that state.
-        lastErrorCategory: "auth_invalidated",
-        lastErrorAt: new Date(),
-        // Carries a recovery deadline so `sweepExpiredCooldowns` can bring this
-        // account back once it elapses; without one, one definitive rejection
-        // parks the credential for good. The deadline is also what distinguishes
-        // this (machine-disabled) from an operator's own disable, which leaves
-        // `cooldownUntil` null and is therefore never swept. See
-        // `resolveAccountDisabledRecoveryMs`.
-        ...(disabledRecoveryMs > 0
-          ? { cooldownUntil: new Date(Date.now() + disabledRecoveryMs) }
-          : {}),
-      })
-      .where(eq(providerAccounts.id, accountId));
-    invalidateCredentialCache(accountId);
+    // Converge on the health application seam (proposal §3.5): a definitive
+    // OAuth refresh failure is a producer into `applyAccountVerdict`, not a
+    // separate state machine. The seam preserves D23 (operator-disable rows
+    // keep their `null` recovery deadline) via `preserveOperatorDisable`.
+    const applied = await applyAccountVerdict(tx, {
+      accountId,
+      status: "disabled",
+      // `auth_invalidated` is the category the console reads to render the
+      // "Re-login required" pill, and the one the quota sweep excludes so it
+      // stops re-probing a credential that cannot repair itself. The refresh
+      // grant was definitively rejected and the stored access token could not
+      // be shown to still work, so this is exactly that state.
+      reason: message,
+      category: "auth_invalidated",
+      // Carries a recovery deadline so `sweepExpiredCooldowns` can bring this
+      // account back once it elapses; without one, one definitive rejection
+      // parks the credential for good. The deadline is also what distinguishes
+      // this (machine-disabled) from an operator's own disable, which leaves
+      // `cooldownUntil` null and is therefore never swept (D23).
+      cooldownUntil:
+        disabledRecoveryMs > 0 ? new Date(Date.now() + disabledRecoveryMs) : null,
+      ...(options.preserveOperatorDisable === true
+        ? { preserveOperatorDisable: true }
+        : {}),
+    });
+    if (applied) invalidateCredentialCache(accountId);
   });
 }
 
@@ -299,20 +336,33 @@ async function disableAccount(
  * operator or an explicit recovery may re-enable it), while an `active` one
  * stays `active`. The static marker and the error clearing are orthogonal to
  * the account's health state.
+ *
+ * D24: for a `disabled` row the error fields are deliberately kept. Once the
+ * account is parked, `lastErrorCategory` is the only record of *why* (e.g.
+ * `auth_invalidated` → "Re-login required"); wiping it on the static
+ * annotation would leave a disabled account with no diagnosable reason. An
+ * `active` row still clears them — there the error is stale by definition.
  */
 async function markStaticToken(db: CartethyiaDatabase, accountId: string): Promise<void> {
+  const rows = await db
+    .select({ status: providerAccounts.status })
+    .from(providerAccounts)
+    .where(eq(providerAccounts.id, accountId))
+    .limit(1);
+  const isDisabled = rows[0]?.status === "disabled";
   await db
     .update(providerAccounts)
     .set({
       staticToken: true,
+      cooldownUntil: null,
       // A static token is a normal, usable credential, not an error state: any
       // error left by the failed refresh would otherwise keep the row reading
       // "Re-login required" while it is in fact serving. Mirrors the console's
-      // static-token toggle.
-      cooldownUntil: null,
-      lastError: null,
-      lastErrorCategory: null,
-      lastErrorAt: null,
+      // static-token toggle. For a `disabled` row the category is preserved
+      // (D24), because there it is the diagnosis, not a stale artifact.
+      ...(isDisabled
+        ? {}
+        : { lastError: null, lastErrorCategory: null, lastErrorAt: null }),
     })
     .where(eq(providerAccounts.id, accountId));
 }
@@ -362,7 +412,8 @@ function failureStatus(error: unknown): number | undefined {
  * still perfectly usable. This pass re-reads those rows once at startup and
  * moves each to where it now belongs:
  *
- *  - access token still usable ⇒ static token, back to `active`;
+ *  - access token still usable ⇒ static token; the account stays `disabled`;
+ *    only an operator can re-enable it;
  *  - otherwise ⇒ the `auth_invalidated` category the console renders as
  *    "Re-login required" and the quota sweep excludes.
  *
@@ -495,15 +546,20 @@ export class OAuthRefreshService {
    * that just refreshed cannot cause the caller to reuse a dead cached
    * secret. Returns the current decrypted access token, or `null` when the
    * account isn't OAuth, has no stored refresh token, or refresh failed.
+   *
+   * `opts.origin` labels who asked for the refresh (`ui`/`sweep`/`dispatch`)
+   * and is carried on the `token_refresh` log lines (D26). The origin is
+   * observational only — it never changes what a refresh does.
    */
   async ensureFreshAccessToken(
     accountId: string,
     refresher: OAuthTokenRefresher,
-    opts: { force?: boolean; skewMs?: number } = {},
+    opts: { force?: boolean; skewMs?: number; origin?: "ui" | "sweep" | "dispatch" } = {},
   ): Promise<string | null> {
     const force = opts.force === true;
     // No explicit skew: the per-provider lead is applied at load time.
     const skewMs = opts.skewMs;
+    const origin = opts.origin ?? "sweep";
     // Forced refreshes get their own in-flight slot so they don't merge with
     // a raced non-force call that would otherwise short-circuit.
     const key = force ? `${accountId}:force` : accountId;
@@ -518,7 +574,7 @@ export class OAuthRefreshService {
       const oldestKey = this.#inFlight.keys().next().value;
       if (oldestKey !== undefined) this.#inFlight.delete(oldestKey);
     }
-    const task = this.#refreshIfDue(accountId, refresher, skewMs, force).finally(() => {
+    const task = this.#refreshIfDue(accountId, refresher, skewMs, force, origin).finally(() => {
       this.#inFlight.delete(key);
     });
     this.#inFlight.set(key, task);
@@ -530,6 +586,7 @@ export class OAuthRefreshService {
     refresher: OAuthTokenRefresher,
     skewMs: number | undefined,
     force: boolean,
+    origin: "ui" | "sweep" | "dispatch",
   ): Promise<string | null> {
     const account = await loadAccountWithFreshness(this.#db, accountId, skewMs);
     if (!account || account.row.credentialKind !== "oauth") return null;
@@ -547,18 +604,24 @@ export class OAuthRefreshService {
         ? decryptCredentialToString(row.credentialCiphertext)
         : null;
     }
-    return this.#refreshNow(row, refresher, skewMs);
+    return this.#refreshNow(row, refresher, skewMs, origin);
   }
 
   async #refreshNow(
     row: AccountRow,
     refresher: OAuthTokenRefresher,
     skewMs: number | undefined,
+    origin: "ui" | "sweep" | "dispatch",
   ): Promise<string | null> {
+    // D26: statusBefore is read once up front (the row projection used by the
+    // refresh path does not carry status) and statusAfter is re-read after any
+    // mutation, so the log proves a refresh never flipped the account.
+    const statusBefore = await readAccountStatus(this.#db, row.id);
     pushStructuredConsoleLog("info", "OAuth token refresh started", {
       event: "token_refresh",
       accountId: row.id,
       providerId: row.providerId,
+      details: { origin, statusBefore },
     });
     const owner = randomUUID();
     const leased = await acquireLease(this.#db, row.id, owner);
@@ -583,6 +646,7 @@ export class OAuthRefreshService {
         accountId: row.id,
         providerId: row.providerId,
         errorCode: "static_token",
+        details: { origin },
       });
       return null;
     }
@@ -594,12 +658,20 @@ export class OAuthRefreshService {
         buildRefreshContext(row, refresher.requiresAccessToken === true),
       );
       const persisted = await persistRefreshed(this.#db, row.id, owner, result);
+      // D26: `statusAfter` is re-read from the DB rather than assumed — a
+      // successful refresh never changes `status`, and the log proves it.
+      const statusAfter = await readAccountStatus(this.#db, row.id);
       pushStructuredConsoleLog(persisted ? "info" : "warn", persisted ? "OAuth token refresh completed" : "OAuth token refresh lost lease", {
         event: "token_refresh",
         accountId: row.id,
         providerId: row.providerId,
         ...(persisted ? {} : { errorCode: "refresh_lease_lost" }),
-        details: { expiresAt: result.expiresAt.toISOString() },
+        details: {
+          expiresAt: result.expiresAt.toISOString(),
+          origin,
+          statusBefore,
+          statusAfter,
+        },
       });
       return persisted ? result.access : null;
     } catch (error) {
@@ -612,6 +684,7 @@ export class OAuthRefreshService {
         accountId: row.id,
         providerId: row.providerId,
         errorCode: classification,
+        details: { origin, statusBefore },
       });
       if (classification === "definitive") {
         // A definitive refresh failure means the refresh grant is dead — but
@@ -627,14 +700,29 @@ export class OAuthRefreshService {
         if (accessUsability === "usable") {
           await releaseLease(this.#db, row.id, owner);
           await markStaticToken(this.#db, row.id);
+          const statusAfter = await readAccountStatus(this.#db, row.id);
           pushStructuredConsoleLog("info", "OAuth refresh failed; access token still valid, marking static", {
             event: "token_refresh",
             accountId: row.id,
             providerId: row.providerId,
             errorCode: "static_token",
+            details: { origin, statusBefore, statusAfter },
           });
         } else {
-          await disableAccount(this.#db, row.id, owner, failureMessage(error));
+          await disableAccount(this.#db, row.id, owner, failureMessage(error), {
+            // D23: a definitive refresh failure must not turn an operator's
+            // disable into a machine-recoverable one. If the row is already
+            // `disabled` without a deadline, leave it that way.
+            preserveOperatorDisable: true,
+          });
+          const statusAfter = await readAccountStatus(this.#db, row.id);
+          pushStructuredConsoleLog("warn", "OAuth refresh failed definitively; account disabled for re-auth", {
+            event: "token_refresh",
+            accountId: row.id,
+            providerId: row.providerId,
+            errorCode: classification,
+            details: { origin, statusBefore, statusAfter },
+          });
         }
       } else {
         await releaseLease(this.#db, row.id, owner);
@@ -643,3 +731,9 @@ export class OAuthRefreshService {
     }
   }
 }
+
+/** Reads one account's status (used only for logging/observability, D26). */
+async function readAccountStatus(db: CartethyiaDatabase, accountId: string): Promise<string | undefined> {
+  const loaded = await loadAccountWithOauthState(db, accountId, { includeStatus: true });
+  return loaded?.status;
+}

package/src/providers/configured-provider.ts

@@ -3,6 +3,7 @@ import type { CanonicalRequest, WireFamily } from "../protocol/canonical-model";
 import { GatewayError } from "../protocol/gateway-error";
 import { OpenAICompatibleAdapter, withBearerAuthentication } from "./adapters/compatible-adapter";
 import { providerBaseUrl } from "./provider-metadata";
+import type { ProviderModule } from "./provider-registry";
 
 export function ensurePayloadModel(
   payload: Record<string, unknown>,
@@ -15,6 +16,7 @@ export function ensurePayloadModel(
   payload["model"] = model;
   return model;
 }
+
 /**
  * Declarative description of one bearer-authenticated OpenAI-compatible provider.
  *
@@ -98,3 +100,149 @@ export function createApiKeyAdapter(
     }),
   );
 }
+
+function apiKeySpec(
+  providerId: ProviderId,
+  paths: Readonly<Partial<Record<"chat" | "responses", string>>>,
+): ApiKeyProviderSpec {
+  return {
+    provider_id: providerId,
+    endpoint_paths_by_wire_family: paths,
+  };
+}
+
+const BEARER_PATHS = { chat: "/chat/completions", responses: "/responses" } as const;
+
+/**
+ * Builtin providers whose entire adapter contract is "bearer auth against the
+ * provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible chat +
+ * responses, with endpoint paths declared below the base's version root".
+ */
+export const GENERIC_API_KEY_SPECS = {
+  larprouter: apiKeySpec("larprouter", BEARER_PATHS),
+  mistral: apiKeySpec("mistral", BEARER_PATHS),
+  fireworks: apiKeySpec("fireworks", BEARER_PATHS),
+  nvidia: apiKeySpec("nvidia", BEARER_PATHS),
+  gmi: apiKeySpec("gmi", BEARER_PATHS),
+  ollamacloud: apiKeySpec("ollamacloud", BEARER_PATHS),
+  together: apiKeySpec("together", BEARER_PATHS),
+  siliconflow: apiKeySpec("siliconflow", BEARER_PATHS),
+  siliconflowcn: apiKeySpec("siliconflowcn", BEARER_PATHS),
+  nanogpt: apiKeySpec("nanogpt", BEARER_PATHS),
+  baseten: apiKeySpec("baseten", BEARER_PATHS),
+  synthetic: apiKeySpec("synthetic", BEARER_PATHS),
+  stepfun: apiKeySpec("stepfun", BEARER_PATHS),
+  sakana: apiKeySpec("sakana", BEARER_PATHS),
+  helmcode: apiKeySpec("helmcode", BEARER_PATHS),
+  coralbricks: apiKeySpec("coralbricks", BEARER_PATHS),
+  aiand: apiKeySpec("aiand", BEARER_PATHS),
+  wafer: apiKeySpec("wafer", BEARER_PATHS),
+  coreweave: apiKeySpec("coreweave", BEARER_PATHS),
+  dashscope: apiKeySpec("dashscope", BEARER_PATHS),
+  "qwen-portal": apiKeySpec("qwen-portal", BEARER_PATHS),
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+export type GenericApiKeyProviderId = keyof typeof GENERIC_API_KEY_SPECS;
+
+export const GENERIC_API_KEY_PROVIDER_IDS = Object.keys(
+  GENERIC_API_KEY_SPECS,
+) as readonly GenericApiKeyProviderId[];
+
+/**
+ * Ids whose base URL already ends at a version segment.
+ */
+export const VERSIONED_ROOT_API_KEY_SPECS = {
+  groq: apiKeySpec("groq", BEARER_PATHS),
+  deepinfra: apiKeySpec("deepinfra", BEARER_PATHS),
+  novita: apiKeySpec("novita", BEARER_PATHS),
+  venice: apiKeySpec("venice", BEARER_PATHS),
+  qianfan: apiKeySpec("qianfan", BEARER_PATHS),
+  zhipucoding: apiKeySpec("zhipucoding", BEARER_PATHS),
+  firepass: apiKeySpec("firepass", BEARER_PATHS),
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+export type VersionedRootApiKeyProviderId =
+  keyof typeof VERSIONED_ROOT_API_KEY_SPECS;
+
+export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = Object.keys(
+  VERSIONED_ROOT_API_KEY_SPECS,
+) as readonly VersionedRootApiKeyProviderId[];
+
+type DiscoveryBackedCapabilities = Pick<
+  ProviderModule,
+  "endpointPathsByWireFamily" | "loadAdapter" | "loadModelDiscovery"
+>;
+
+type ModelDiscoveryFactory = NonNullable<ProviderModule["loadModelDiscovery"]>;
+export type OpenAIModelDiscoveryFactory = (
+  providerId: string,
+  options?: {
+    readonly headers?: (credential: string) => Readonly<Record<string, string>>;
+  },
+) => ModelDiscoveryFactory;
+
+const DISCOVERY_BACKED_PROVIDER_SPECS = {
+  groq: VERSIONED_ROOT_API_KEY_SPECS.groq,
+  larprouter: GENERIC_API_KEY_SPECS.larprouter,
+  together: GENERIC_API_KEY_SPECS.together,
+  deepinfra: VERSIONED_ROOT_API_KEY_SPECS.deepinfra,
+  siliconflow: GENERIC_API_KEY_SPECS.siliconflow,
+  siliconflowcn: GENERIC_API_KEY_SPECS.siliconflowcn,
+  novita: VERSIONED_ROOT_API_KEY_SPECS.novita,
+  venice: VERSIONED_ROOT_API_KEY_SPECS.venice,
+  nanogpt: GENERIC_API_KEY_SPECS.nanogpt,
+  baseten: GENERIC_API_KEY_SPECS.baseten,
+  synthetic: GENERIC_API_KEY_SPECS.synthetic,
+  stepfun: GENERIC_API_KEY_SPECS.stepfun,
+  sakana: GENERIC_API_KEY_SPECS.sakana,
+  helmcode: GENERIC_API_KEY_SPECS.helmcode,
+  coralbricks: GENERIC_API_KEY_SPECS.coralbricks,
+  aiand: GENERIC_API_KEY_SPECS.aiand,
+  wafer: GENERIC_API_KEY_SPECS.wafer,
+  firepass: VERSIONED_ROOT_API_KEY_SPECS.firepass,
+  zhipucoding: VERSIONED_ROOT_API_KEY_SPECS.zhipucoding,
+  dashscope: GENERIC_API_KEY_SPECS.dashscope,
+  qianfan: VERSIONED_ROOT_API_KEY_SPECS.qianfan,
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+type DiscoveryBackedProviderId = keyof typeof DISCOVERY_BACKED_PROVIDER_SPECS;
+
+/** Canonical discovery-backed provider ids, in declaration order. */
+export const DISCOVERY_BACKED_PROVIDER_IDS = Object.keys(
+  DISCOVERY_BACKED_PROVIDER_SPECS,
+) as readonly DiscoveryBackedProviderId[];
+
+export function discoveryBackedCapabilities(
+  providerId: string,
+  spec: ApiKeyProviderSpec,
+  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
+): DiscoveryBackedCapabilities {
+  return {
+    ...(spec.endpoint_paths_by_wire_family === undefined
+      ? {}
+      : { endpointPathsByWireFamily: spec.endpoint_paths_by_wire_family }),
+    loadAdapter: async () => createApiKeyAdapter(spec),
+    loadModelDiscovery: openAIModelDiscovery(providerId, {
+      headers: (credential) => ({ authorization: `Bearer ${credential}` }),
+    }),
+  };
+}
+
+/**
+ * Creates the standard provider capability table using the registry's shared
+ * discovery loader, keeping its lazy import and authentication behavior intact.
+ */
+export function createDiscoveryBackedProviderCapabilities(
+  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
+): Readonly<Record<DiscoveryBackedProviderId, DiscoveryBackedCapabilities>> {
+  const capabilities = {} as Record<DiscoveryBackedProviderId, DiscoveryBackedCapabilities>;
+  for (const providerId of DISCOVERY_BACKED_PROVIDER_IDS) {
+    capabilities[providerId] = discoveryBackedCapabilities(
+      providerId,
+      DISCOVERY_BACKED_PROVIDER_SPECS[providerId],
+      openAIModelDiscovery,
+    );
+  }
+  return capabilities;
+}
+