// Verifies StepFun standard and Step Plan catalog pairing across regions.

import { mkdtempSync } from "node:fs";

import { tmpdir } from "node:os";

import { join } from "node:path";

profileId?: string;

env?: NodeJS.ProcessEnv;

}): ModelProviderConfig | null {

// Region can be explicit, profile-tagged, or env-inferred; catalog ids stay paired.

if (!params.apiKey) {

return null;

}

}

function inferRegionFromProfileId(profileId: string | undefined): StepFunRegion | undefined {

// Auth profile suffixes are the lightweight region signal for paired providers.

if (!profileId) {

return undefined;

}

}),

};

const pairedStandard = buildStepFunCatalog({

// Paired surfaces should converge on the same regional host family.

surface: "standard",

apiKey: "test-stepfun-key",

explicitBaseUrl: resolveDefaultBaseUrl(

// Verifies Vercel AI Gateway auth marker resolution from env and profiles.

import { beforeAll, describe, expect, it, vi } from "vitest";

let NON_ENV_SECRETREF_MARKER: typeof import("./model-auth-markers.js").NON_ENV_SECRETREF_MARKER;

let createProviderAuthResolver: typeof import("./models-config.providers.secrets.js").createProviderAuthResolver;

async function loadModules() {

// This file needs the real auth resolver after other provider tests install mocks.

vi.doUnmock("../plugins/manifest-registry.js");

vi.doUnmock("../plugins/provider-runtime.js");

vi.doUnmock("../secrets/provider-env-vars.js");

});

const auth = resolveAuth("vercel-ai-gateway");

// Persist the env marker, not the resolved plaintext profile key.

expect(auth.apiKey).toBe("AI_GATEWAY_API_KEY");

expect(auth.mode).toBe("api_key");

expect(auth.source).toBe("profile");

// Verifies generated models.json preserves source secret markers from runtime snapshots.

import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";

import type { OpenClawConfig } from "../config/types.openclaw.js";

import { createFixtureSuite } from "../test-utils/fixture-suite.js";

}

function createOpenAiApiKeyRuntimeConfig(): OpenClawConfig {

// Runtime config simulates already-resolved secrets that must not be persisted.

return {

models: {

providers: {

config: OpenClawConfig;

sourceConfigForSecrets: OpenClawConfig;

}) {

// Planner assertions avoid filesystem noise for marker-projection cases.

const plan = await planOpenClawModelsJsonWithDeps(

{

cfg: params.config,

function expectOpenAiHeaderMarkers(

providers: Record<string, { headers?: Record<string, string> }>,

) {

// Env header refs keep their id; non-env refs collapse to the shared sentinel.

expect(providers.openai?.headers?.Authorization).toBe(

"secretref-env:OPENAI_HEADER_TOKEN", // pragma: allowlist secret

);

// Verifies models.json generation skips env-gated providers until auth exists.

import fs from "node:fs/promises";

import path from "node:path";

import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";

vi.mock("./models-config.providers.js", async () => {

function createImplicitProvider(baseUrl: string): ModelsProviderConfig {

// Shared implicit-provider fixture keeps generated-provider expectations compact.

return {

baseUrl,

api: "openai-completions",

async function readGeneratedProviders(

agentDir: string,

): Promise<Record<string, ParsedProviderConfig>> {

// Generated plugin catalogs are separate files but part of the effective provider set.

const raw = await fs.readFile(path.join(agentDir, "models.json"), "utf8");

const parsed = JSON.parse(raw) as { providers?: Record<string, ParsedProviderConfig> };

const providers = { ...parsed.providers };

providerKey: "minimax" | "synthetic";

expectedApiKeyRef: string;

}) {

// Mutate one env var at a time so auth-gated provider generation stays isolated.

const previousValue = process.env[params.envVar];

process.env[params.envVar] = params.envValue;

try {

// Verifies GitHub Copilot profile token fallback and implicit provider planning.

import { describe, expect, it, vi } from "vitest";

import {

planOpenClawModelsJson,

function createCopilotImplicitResolver(

provider: ProviderConfig,

): ResolveImplicitProvidersForModelsJson {

// Models planner receives implicit Copilot providers from the auth exchange layer.

return async () => ({ "github-copilot": provider });

}

function expectCopilotProviderFromPlan(

plan: Awaited<ReturnType<typeof planCopilotWithImplicitProvider>>,

) {

// Keep assertions on the emitted provider payload, not planner implementation details.

expect(plan.action).toBe("write");

const parsed =

plan.action === "write"

// Verifies models.json writes, plugin catalog writes, and ready-cache serialization.

import fs from "node:fs/promises";

import path from "node:path";

import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";

let setCurrentPluginMetadataSnapshot: typeof import("../plugins/current-plugin-metadata-snapshot.js").setCurrentPluginMetadataSnapshot;

function createPluginMetadataSnapshot(workspaceDir: string): PluginMetadataSnapshot {

// Minimal process snapshot used to prove when metadata may be reused.

const policyHash = resolveInstalledPluginIndexPolicyHash({});

return {

policyHash,

}

async function expectMissingPath(operation: Promise<unknown>) {

// Filesystem deletion assertions should fail on the errno, not path text.

let error: NodeJS.ErrnoException | undefined;

try {

await operation;

providerDiscoveryTimeoutMs?: number;

workspaceDir?: string;

} {

// Planner call shape is the contract between ensureOpenClawModelsJson and planning.

const call = planOpenClawModelsJsonMock.mock.calls[callIndex];

if (!call) {

throw new Error(`expected models planner call #${callIndex + 1}`);

let modelsWriteCount = 0;

writePrivateStoreTextWriteMock.mockImplementation(

async (params: { filePath: string; rootDir: string; content: string | Uint8Array }) => {

// Hold both writes at the store boundary to prove the outer serializer works.

const isModelsWrite = path.basename(params.filePath) === "models.json";

if (isModelsWrite) {

modelsWriteCount += 1;