// Verifies models.json provider/model merge behavior and secret preservation.

import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";

import type { ExistingProviderConfig } from "./models-config.merge.js";

import type { ProviderConfig } from "./models-config.providers.secrets.js";

let mergeWithExistingProviderSecrets: typeof import("./models-config.merge.js").mergeWithExistingProviderSecrets;

async function loadMergeModules() {

// Merge helpers depend on real manifest registry behavior; undo previous

// mocks before importing the module under test.

vi.doUnmock("../plugins/manifest-registry.js");

({ NON_ENV_SECRETREF_MARKER } = await import("./model-auth-markers.js"));

({ mergeProviderModels, mergeProviders, mergeWithExistingProviderSecrets } =

});

it("preserves non-empty existing apiKey and baseUrl from models.json", () => {

// Existing local secrets win over regenerated provider config so planning

// does not overwrite operator-owned credentials.

const merged = mergeWithExistingProviderSecrets({

nextProviders: {

custom: createConfigProvider(),

// Verifies explicit model reasoning overrides survive provider catalog merges.

import { describe, expect, it } from "vitest";

import { mergeProviderModels, mergeProviders } from "./models-config.merge.js";

import type { ProviderConfig } from "./models-config.providers.secrets.js";

function mergedMinimaxModel(

explicitModel: NonNullable<ProviderConfig["models"]>[number],

): NonNullable<ProviderConfig["models"]>[number] | undefined {

// Built-in MiniMax metadata currently advertises reasoning, while user

// config may intentionally disable or omit it.

return mergeProviderModels(

createMinimaxProvider(createMinimaxModel({ reasoning: true })),

createMinimaxProvider(explicitModel),

// Verifies provider auth aliases share trusted env/profile credentials.

import { beforeEach, describe, expect, it, vi } from "vitest";

let createProviderAuthResolver: typeof import("./models-config.providers.secrets.js").createProviderAuthResolver;

profileId?: string;

},

) {

// Keep auth result assertions focused on persisted marker/source fields

// rather than the whole resolver result shape.

expect(value.apiKey).toBe(expected.apiKey);

expect(value.mode).toBe(expected.mode);

expect(value.source).toBe(expected.source);

});

it("ignores provider auth aliases from untrusted workspace plugins during runtime auth lookup", () => {

// Workspace plugins cannot alias themselves to bundled provider auth and

// inherit its credentials at runtime.

loadPluginManifestRegistry.mockReturnValue({

plugins: [

{

// Verifies persisted provider auth markers preserve credential provenance.

import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";

import { captureEnv } from "../test-utils/env.js";

beforeAll(loadProviderAuthModules);

function buildPairedApiKeyProviders(apiKey: string) {

// Several generated provider pairs should carry the same persisted key

// marker; this helper keeps those expectations identical.

return {

provider: { apiKey },

paired: { apiKey },

});

it("uses non-env marker for ref-managed profiles even when runtime plaintext is present", () => {

// Ref-managed secrets may be resolved in memory, but models.json should

// persist only a non-env marker so plaintext is not written back.

const byteplusApiKey = resolveApiKeyFromCredential({

type: "api_key",

provider: "byteplus",

});

it("resolves plugin-owned synthetic auth through the provider hook", () => {

// Plugin-owned synthetic auth can provide discovery keys while persisted

// config still records a non-secret marker.

mockedResolveProviderSyntheticAuthWithPlugin.mockReturnValue({

apiKey: "xai-plugin-key",

mode: "api-key",

// Covers Cloudflare AI Gateway profile provenance and generated provider config.

import { describe, expect, it } from "vitest";

import { captureEnv } from "../test-utils/env.js";

import type { ApiKeyCredential } from "./auth-profiles/types.js";

| undefined;

envApiKey?: string;

}) {

// Cloudflare gateway providers require both account/gateway metadata and an

// auth marker from the same profile/env source.

const apiKey = params.envApiKey?.trim() || resolveApiKeyFromCredential(params.credential)?.apiKey;

const accountId = params.credential?.metadata?.accountId?.trim();

const gatewayId = params.credential?.metadata?.gatewayId?.trim();

describe("cloudflare-ai-gateway profile provenance", () => {

it("prefers env keyRef marker over runtime plaintext for persistence", () => {

// Env-backed profile refs persist the env var name, not the runtime

// plaintext value.

const envSnapshot = captureEnv(["CLOUDFLARE_AI_GATEWAY_API_KEY"]);

delete process.env.CLOUDFLARE_AI_GATEWAY_API_KEY;

try {

// Verifies provider-owned Google Antigravity and Vertex model id normalization.

import { describe, expect, it, vi } from "vitest";

import { normalizeProviderSpecificConfig } from "./models-config.providers.policy.js";

import type { ProviderConfig } from "./models-config.providers.secrets.js";

vi.mock("../plugins/provider-runtime.js", () => {

function normalizeGoogleModelIdForProvider(provider: string, modelId: string): string {

// Mirrors the provider plugin normalization contract used by config

// planning without importing the bundled plugin runtime.

if (provider === "google-antigravity") {

return /^(gemini-3(?:[.-]1)?-pro)$/.test(modelId) ? `${modelId}-low` : modelId;

}

function normalizeProviderMap(

providers: Record<string, ProviderConfig>,

): Record<string, ProviderConfig> {

// Normalization should preserve object identity when no provider changed so

// callers can cheaply detect no-op config planning.

let changed = false;

const next: Record<string, ProviderConfig> = {};

for (const [providerKey, provider] of Object.entries(providers)) {