Made of little things.

import assert from 'node:assert/strict';
import test from 'node:test';
import { callProvider, vendorBody } from '../bridge/provider.mjs';
const args = { provider:'deepseek',model:'deepseek-flash',apiKey:'dummy-secret-key',caseText:JSON.stringify({version:1,profile:{ageYears:30},concerns:[{id:1}]}) };
test('invalid model JSON retains actionable failure details and redacted output', async () => {
  const progress=[];
  await assert.rejects(callProvider(args,{analyze:true,onProgress:d=>progress.push(d),fetchImpl:async()=>new Response(JSON.stringify({model:'deepseek-flash',choices:[{finish_reason:'stop',message:{content:'not JSON dummy-secret-key'}}]}),{headers:{'content-type':'application/json'}})}),e=>{
    assert.equal(e.code,'invalid-report');
    assert.equal(e.diagnostics?.stage,'failed');
    assert.equal(e.diagnostics?.issue?.path,'$');
    assert.match(e.diagnostics?.output||'',/not JSON \[REDACTED\]/);
    assert.doesNotMatch(JSON.stringify(e.diagnostics),/dummy-secret-key/);
    return true;
  });
  assert.ok(progress.length);
});
import { detailedReport, noPhotoDisclaimer } from './report-fixture.mjs';
import { listModels } from '../bridge/provider.mjs';
import { diagnosticPacket, readDiagnostic, visibleDiagnostic } from '../src/ai-diagnostics.ts';
const reply = content => new Response(JSON.stringify({id:'test-response',model:args.model,choices:[{finish_reason:'stop',message:{content}}]}));
test('valid JSON reports identify the precise invalid field without accepting the report',async()=>{
  const report=detailedReport();report.plainLanguage.gist=null;
  await assert.rejects(callProvider(args,{analyze:true,fetchImpl:async()=>reply(JSON.stringify(report))}),e=>e.diagnostics.issue.path==='$.plainLanguage.gist'&&e.code==='invalid-report');
});
const event = (delta,finish_reason=null) => 'data: '+JSON.stringify({id:'stream-id',model:args.model,choices:[{index:0,delta,finish_reason}]})+'\r\n\r\n';
function streamResponse(text,width=11){const bytes=new TextEncoder().encode(text);let i=0;return new Response(new ReadableStream({pull(controller){if(i>=bytes.length){controller.close();return;}controller.enqueue(bytes.slice(i,i+width));i+=width;}}),{headers:{'content-type':'text/event-stream'}});}
test('SSE handles split UTF-8 and CRLF, reasoning deltas, usage-only chunks and key redaction before progress',async()=>{
  const report=detailedReport();report.summary='Synthetic café 👋';const content=JSON.stringify(report), snapshots=[];
  const wire=event({reasoning_content:'Synthetic '+args.apiKey.slice(0,6)})+event({reasoning_content:args.apiKey.slice(6)+' reasoning. '.repeat(20)})+event({content:content.slice(0,300)})+event({content:content.slice(300)},'stop')+'data: '+JSON.stringify({choices:[],usage:{prompt_tokens:12,completion_tokens:20,total_tokens:32,completion_tokens_details:{reasoning_tokens:5}}})+'\n\ndata: [DONE]\n\n';
  const result=await callProvider(args,{analyze:true,onProgress:d=>snapshots.push(d),fetchImpl:async(_,init)=>{assert.equal(JSON.parse(init.body).stream,true);return streamResponse(wire);}});
  assert.equal(result.report.summary,report.summary);assert.ok(snapshots.some(d=>d.stage==='receiving'&&d.reasoning.length));
  assert.doesNotMatch(JSON.stringify(snapshots),/dummy-secret-key/);assert.match(snapshots.at(-1).reasoning,/\[REDACTED\]/);assert.equal(snapshots.at(-1).usage.reasoning,5);assert.equal(snapshots.at(-1).finishReason,'stop');
});
test('an interrupted or token-limited stream never becomes an accepted report',async()=>{
  for(const wire of [event({content:JSON.stringify(detailedReport())},'stop'),event({content:'{"version":2'},'length')+'data: [DONE]\n\n']){
    await assert.rejects(callProvider(args,{analyze:true,fetchImpl:async()=>streamResponse(wire)}),e=>e.code==='incomplete'&&e.diagnostics.output.includes('version'));
  }
});
test('HTTP failures retain bounded redacted body and status; response limits are enforced',async()=>{
  await assert.rejects(callProvider(args,{analyze:true,fetchImpl:async()=>new Response(JSON.stringify({error:{message:'Bad option '+args.apiKey}}),{status:400,headers:{'x-request-id':'request-123'}})}),e=>e.code==='model-unavailable'&&e.diagnostics.httpStatus===400&&e.diagnostics.output.includes('[REDACTED]')&&!JSON.stringify(e.diagnostics).includes(args.apiKey));
  await assert.rejects(callProvider(args,{analyze:true,fetchImpl:async()=>reply('x'.repeat(49000))}),e=>e.diagnostics.truncated===true&&e.diagnostics.output.length<=48000);
});
test('diagnostic pagination preserves long output; client redaction is independent of wire cursors',()=>{
  const d={stage:'failed',elapsedMs:1,output:'x'.repeat(1996)+args.apiKey+'z'.repeat(4000),reasoning:'y'.repeat(6000),events:[]};let parsed,more;
  do{({diagnostic:parsed,more}=readDiagnostic(diagnosticPacket(d,parsed?.output.length||0,parsed?.reasoning.length||0),parsed,args.apiKey));assert.doesNotMatch(JSON.stringify(visibleDiagnostic({...parsed,stage:more?'receiving':'failed'},args.apiKey)),/dummy-secret-key/);}while(more);
  assert.equal(parsed.output,d.output);assert.equal(parsed.reasoning,d.reasoning);
  assert.throws(()=>readDiagnostic({...diagnosticPacket(d),outputOffset:9},undefined,args.apiKey),/cursor/);
});
test('model discovery uses only authenticated GET, validates IDs, deduplicates and preserves a bounded list',async()=>{
  let calls=0;const result=await listModels(args,{fetchImpl:async(url,init)=>{calls++;assert.equal(url,'https://api.deepseek.com/models');assert.equal(init.method,'GET');assert.equal(init.body,undefined);return new Response(JSON.stringify({data:[{id:'model-b'},{id:'model-a'},{id:'model-b'},{id:'<script>'}]}));}});
  assert.equal(calls,1);assert.deepEqual(result.models,['model-a','model-b']);
  await assert.rejects(listModels(args,{fetchImpl:async()=>new Response(args.apiKey,{status:401})}),e=>e.code==='authentication'&&!e.message.includes(args.apiKey));
});
test('reports request an enforced schema where supported and JSON mode for other calls',()=>{
  for(const provider of ['openai','kimi','deepseek'])for(const [analyze,vision] of [[true,false],[false,false],[false,true]]){
    const body=vendorBody({...args,provider,challenge:{image:'synthetic-image'}},analyze,vision);
    if(analyze && provider!=='deepseek'){
      assert.equal(body.response_format?.type,'json_schema');
      const format=body.response_format.json_schema;
      assert.equal(format.strict,true);assert.equal(format.schema.additionalProperties,false);
      assert.deepEqual([...format.schema.required].sort(),Object.keys(detailedReport()).sort());
      assert.deepEqual(format.schema.properties.evidence.required,['reported','visual','missing']);
      assert.equal(format.schema.properties.evidence.additionalProperties,false);
    }else assert.deepEqual(body.response_format,{type:'json_object'},`${provider}: JSON syntax must be constrained by the API, not just the prompt`);
    assert.match(JSON.stringify(body.messages),/json/i);
  }
});
test('the reported missing brace before assessments is recovered without changing content or making another request',async()=>{
  const report=detailedReport([1,2,3]);report.summary='Quoted text: "assessments": and braces } { stay unchanged.';
  const malformed=JSON.stringify(report).replace('},"assessments":',',"assessments":');
  assert.throws(()=>JSON.parse(malformed));
  for(const streamed of [false,true]){
    let calls=0,final;
    const result=await callProvider({...args,caseText:JSON.stringify({version:1,profile:{ageYears:58},concerns:[{id:1},{id:2},{id:3}]})},{analyze:true,onProgress:d=>final=d,fetchImpl:async()=>{
      calls++;return streamed?streamResponse(event({content:malformed},'stop')+'data: [DONE]\n\n'):reply(malformed);
    }});
    assert.deepEqual(result.report,report);assert.equal(calls,1);assert.equal(final.output,malformed);
    assert.match(final.formatRecovery,/closing brace.*assessments/);assert.equal(final.stage,'complete');
  }
});
test('format recovery rejects truncation, ambiguous duplicate keys, extra fields and invalid report content',async()=>{
  const good=JSON.stringify(detailedReport());
  for(const malformed of [
    good.slice(0,-1),
    good.replace('},"assessments":',',"assessments":').slice(0,-1),
    good.replace('},"assessments":',',"summary":"replacement","assessments":'),
    good.replace('},"assessments":',',"unexpected":true,"assessments":'),
    good.replace('},"assessments":',',"assessments":').replace('"concernId":1','"concernId":0'),
    good.replace('"summary":','"summary":null,"unused":').replace('},"assessments":',',"assessments":'),
  ])await assert.rejects(callProvider(args,{analyze:true,fetchImpl:async()=>reply(malformed)}),e=>e.code==='invalid-report'&&!e.diagnostics.formatRecovery);
});
test('completed malformed JSON retains the syntax position and original output without accepting or retrying',async()=>{
  const malformed='{"version":2,"summary":"Longstanding "always" symptoms"}';let calls=0;
  await assert.rejects(callProvider({...args,provider:'kimi',model:'kimi-k3'},{analyze:true,fetchImpl:async()=>{
    calls++;return streamResponse(event({content:malformed},'stop')+'data: [DONE]\n\n');
  }}),e=>{
    assert.equal(e.code,'invalid-report');assert.equal(e.diagnostics.output,malformed);
    assert.match(e.diagnostics.issue.message,/position 38|line 1 column 39/);
    return true;
  });
  assert.equal(calls,1);
});

const syntheticPhoto={kind:'patient-photo',dataUrl:'data:image/png;base64,AAAA',caption:'Synthetic image'};
test('visual evidence schema and instructions reflect actual photo attachments, not body maps or metadata',()=>{
  for(const provider of ['openai','kimi','deepseek'])for(const images of [undefined,[],[{...syntheticPhoto,kind:'body-map'}],[syntheticPhoto],[]]){
    const body=vendorBody({...args,provider,images,caseText:args.caseText.replace('"version":1','"version":1,"photosSent":true')},true);
    const hasPhotos=images?.some(i=>i.kind==='patient-photo');
    if(provider!=='deepseek')assert.equal(body.response_format.json_schema.schema.properties.evidence.properties.visual.maxItems,hasPhotos?12:0);
    assert.match(body.messages[0].content,hasPhotos?/1 patient photo/:/0 patient photos/);
    if(!hasPhotos)assert.match(body.messages[0].content,/evidence\.visual must be \[\]/);
    assert.match(body.messages[0].content,/limitations or evidence\.missing/);
  }
});
test('no-photo disclaimers are omitted from visual findings without rejecting the report or making another request',async()=>{
  for(const note of [noPhotoDisclaimer,'No patient photos were provided.','No patient photo was reviewed.'])for(const streamed of [false,true]){
    const report=detailedReport();report.evidence.visual=[note];const content=JSON.stringify(report);let final,calls=0;
    const result=await callProvider(args,{analyze:true,onProgress:d=>final=d,fetchImpl:async()=>{calls++;return streamed?streamResponse(event({content},'stop')+'data: [DONE]\n\n'):reply(content);}});
    assert.deepEqual(result.report,{...report,evidence:{...report.evidence,visual:[]}});
    assert.equal(final.output,content);assert.match(final.evidenceNotice,/no-photo disclaimer/i);assert.equal(final.stage,'complete');assert.equal(calls,1);
    const {diagnostic}=readDiagnostic(diagnosticPacket(final),undefined,args.apiKey);
    assert.equal(diagnostic.evidenceNotice,final.evidenceNotice);
  }
});
test('actual or ambiguous photo claims still fail without photos, including after an absence disclaimer',async()=>{
  for(const visual of [
    ['A red rash is visible.'],['No patient photographs were attached or reviewed; a red rash is visible.'],
    [noPhotoDisclaimer,'A swollen joint is visible.'],[noPhotoDisclaimer+'. A red rash is visible.'],
    ['No patient photographs were attached or reviewed; only schematic body-map annotations (a red rash is visible) were supplied, which indicate patient-marked location, not examination findings'],
    ['No obvious swelling or redness is seen.'],['Unable to assess the rash.'],
  ]){
    const report=detailedReport();report.evidence.visual=visual;
    await assert.rejects(callProvider({...args,images:[{...syntheticPhoto,kind:'body-map'}]},{analyze:true,fetchImpl:async()=>reply(JSON.stringify(report))}),e=>e.code==='invalid-report'&&e.diagnostics.issue.path==='$.evidence.visual'&&!e.diagnostics.evidenceNotice);
  }
});
test('photo findings are preserved when patient photo pixels were sent',async()=>{
  const report=detailedReport();report.evidence.visual=['Synthetic visible photo detail.'];let final;
  const result=await callProvider({...args,images:[syntheticPhoto]},{analyze:true,onProgress:d=>final=d,fetchImpl:async()=>reply(JSON.stringify(report))});
  assert.deepEqual(result.report,report);assert.equal(final.evidenceNotice,undefined);
});