// Exercises startup provider discovery scoping without loading real plugin manifests.

import { beforeEach, describe, expect, it, vi } from "vitest";

import type { PluginMetadataSnapshotOwnerMaps } from "../plugins/plugin-metadata-snapshot.js";

import type { ProviderPlugin } from "../plugins/types.js";

// Exercises startup provider discovery scoping without loading real plugin manifests.

const mocks = vi.hoisted(() => ({

resolveRuntimePluginDiscoveryProviders: vi.fn(),

runProviderCatalog: vi.fn(),

// Covers live-test provider filters before they reach runtime plugin discovery.

import { describe, expect, it } from "vitest";

import type { PluginMetadataSnapshotOwnerMaps } from "../plugins/plugin-metadata-snapshot.js";

import {

resolvePluginMetadataProviderOwnersForTest,

resolveProviderDiscoveryFilterForTest,

} from "./models-config.providers.implicit.js";

// Covers live-test provider filters before they reach runtime plugin discovery.

function liveFilterEnv(overrides: NodeJS.ProcessEnv): NodeJS.ProcessEnv {

// VITEST enables the live-filter parsing path without requiring real live creds.

return {

// Mirrors the implicit API-key and OAuth MiniMax catalogs that must stay in lockstep.

import { describe, expect, it } from "vitest";

// Mirrors the implicit API-key and OAuth MiniMax catalogs that must stay in lockstep.

function buildMinimaxCatalog() {

return [

{

// Isolates Moonshot implicit-provider auth and streaming compat decisions.

import { describe, expect, it, vi } from "vitest";

import type { ModelProviderConfig } from "../config/types.models.js";

import { applyProviderNativeStreamingUsageCompat } from "../plugin-sdk/provider-catalog-shared.js";

import { resolveMissingProviderApiKey } from "./models-config.providers.secret-helpers.js";

// Isolates Moonshot implicit-provider auth and streaming compat decisions.

vi.mock("../plugins/setup-registry.js", () => ({

resolvePluginSetupProvider: () => undefined,

}));

// Covers provider-key canonicalization plus secret marker persistence safeguards.

import fs from "node:fs/promises";

import os from "node:os";

import path from "node:path";

import { resolveApiKeyFromProfiles } from "./models-config.providers.secret-helpers.js";

import { enforceSourceManagedProviderSecrets } from "./models-config.providers.source-managed.js";

// Covers provider-key canonicalization plus secret marker persistence safeguards.

function normalizeLmstudioBaseUrl(baseUrl: string): string {

const trimmed = baseUrl.trim().replace(/\/+$/, "");

return trimmed.replace(/\/api\/v1$/, "").replace(/\/v1$/, "") + "/v1";

// Verifies implicit provider secret wiring for NVIDIA, MiniMax portal, and vLLM.

import { describe, expect, it, vi } from "vitest";

import type { ModelDefinitionConfig, ModelProviderConfig } from "../config/types.models.js";

import { resolveEnvApiKey } from "./model-auth-env.js";

resolveMissingProviderApiKey,

} from "./models-config.providers.secret-helpers.js";

// Verifies implicit provider secret wiring for NVIDIA, MiniMax portal, and vLLM.

vi.mock("../plugins/setup-registry.js", () => ({

resolvePluginSetupProvider: () => undefined,

}));

// Verifies custom providers route to the correct provider-policy plugin key.

import { describe, expect, it } from "vitest";

import { resolveProviderPluginLookupKey } from "./models-config.providers.policy.lookup.js";

});

it("falls through when runtime provider models is an object map", () => {

// Runtime object maps are not catalog arrays, so model-level API sniffing must not run.

expect(

resolveProviderPluginLookupKey("openrouter", {

baseUrl: "https://openrouter.ai/api/v1",

// Verifies provider policy hooks without loading real provider plugins.

import { describe, expect, it, vi } from "vitest";

vi.mock("../plugins/provider-runtime.js", () => ({

provider: string;

context: { providerConfig?: { baseUrl?: string } };

}) => {

// Google URL normalization is representative of plugin-owned policy hooks.

if (params.provider !== "google") {

return undefined;

}

provider: string;

context: { env: NodeJS.ProcessEnv };

}) => {

// API key markers can come from provider-specific non-key auth state.

if (params.provider === "amazon-bedrock") {

return params.context.env.AWS_PROFILE?.trim() ? "AWS_PROFILE" : undefined;

}

});

it("does not treat generic transport APIs as provider plugin ids", () => {

// Transport ids like openai-completions are not provider-policy namespaces.

const provider = {

api: "openai-completions" as const,

baseUrl: "https://example.invalid/v1",

// Covers Bedrock AWS SDK auth markers and marker-backed discovery secret guardrails.

import { describe, expect, it } from "vitest";

import { NON_ENV_SECRETREF_MARKER } from "./model-auth-markers.js";

import type { ProviderConfig } from "./models-config.providers.secret-helpers.js";

profileApiKey: undefined,

});

// Provider should be returned unchanged — no apiKey field added

// Provider stays unchanged; instance-role auth must not become a fake apiKey marker.

expect(result).toBe(baseProvider);

expect(result.apiKey).toBeUndefined();

});

profileApiKey: undefined,

});

// Should return unchanged — already has apiKey

// Existing apiKey config wins over inferred AWS environment markers.

expect(result).toBe(providerWithKey);

expect(result.apiKey).toBe("existing-key");

});