Keep the API key out of %#v for redacted LLM errors

The OpenAI adapter's redactedError had no GoString, so %#v printed its
fields, including the raw API key. Add GoString returning the redacted
text, matching the Anthropic adapter; redactedJoin inherits it.

Add TestRedactedErrorsFormatWithoutKey to both adapters, formatting
redactedError, redactedJoin and transportFailure with %v, %+v and %#v.
llm.ProviderError and llm.RateLimitedError keep no secret and are
already covered by TestTypedErrorsDoNotKeepSecret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/ai/llm/anthropic/anthropic.go

@@ -0,0 +1,534 @@
+// Package anthropic is the llm.Provider adapter for Anthropic's Messages
+// API. It calls POST {base}/v1/messages and GET {base}/v1/models over plain
+// net/http.
+//
+// The adapter never logs, and no error it returns contains the API key:
+// errors do not quote caller- or vendor-supplied text, and every exported
+// method passes its error through redact as a backstop.
+package anthropic
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
+)
+
+// APIVersion is the Messages API version sent as the anthropic-version
+// header.
+const APIVersion = "2023-06-01"
+
+// Config configures a Provider.
+type Config struct {
+	// BaseURL is the API root the /v1 endpoint paths are appended to, e.g.
+	// "https://api.anthropic.com".
+	BaseURL string
+	// APIKey is sent as the x-api-key header. It must not be empty.
+	APIKey string
+	// Model is the model Generate requests. ListModels and Verify do not
+	// need it.
+	Model string
+	// MaxTokens is the max_tokens Generate sends when a Request sets none:
+	// the Messages API requires one. It must be positive.
+	MaxTokens int
+}
+
+// Provider is an Anthropic Messages API llm.Provider.
+type Provider struct {
+	base      string
+	apiKey    string
+	model     string
+	maxTokens int
+	client    *http.Client
+}
+
+var _ llm.Provider = (*Provider)(nil)
+
+// New validates cfg and returns a Provider.
+func New(cfg Config) (*Provider, error) {
+	p, err := newFromConfig(cfg)
+	if err != nil {
+		return nil, redact(err, cfg.APIKey)
+	}
+	return p, nil
+}
+
+func newFromConfig(cfg Config) (*Provider, error) {
+	// No error from New quotes caller-supplied text: any of it may equal or
+	// contain the API key. Base URL errors never echo the URL.
+	u, err := url.Parse(cfg.BaseURL)
+	if err != nil {
+		return nil, errors.New("anthropic: base URL does not parse")
+	}
+	if (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
+		return nil, errors.New("anthropic: base URL must be an absolute http or https URL")
+	}
+	// A trailing "?" or "#" parses to an empty query or fragment, yet the
+	// endpoint path appended to it would land in the query or fragment.
+	if u.User != nil || strings.ContainsAny(cfg.BaseURL, "?#") {
+		return nil, errors.New("anthropic: base URL must not carry credentials, a query or a fragment")
+	}
+	if cfg.APIKey == "" {
+		return nil, errors.New("anthropic: no API key configured")
+	}
+	if !validHeaderValue(cfg.APIKey) {
+		return nil, errors.New("anthropic: API key has a control character")
+	}
+	if cfg.MaxTokens <= 0 {
+		return nil, errors.New("anthropic: max tokens must be positive")
+	}
+	return &Provider{
+		base:      strings.TrimRight(cfg.BaseURL, "/"),
+		apiKey:    cfg.APIKey,
+		model:     cfg.Model,
+		maxTokens: cfg.MaxTokens,
+		client:    &http.Client{},
+	}, nil
+}
+
+// validHeaderValue reports whether value is an RFC 9110 field-value: no
+// control characters other than horizontal tab, so no CR, LF or DEL.
+func validHeaderValue(value string) bool {
+	for i := 0; i < len(value); i++ {
+		if c := value[i]; (c < 0x20 && c != '\t') || c == 0x7f {
+			return false
+		}
+	}
+	return true
+}
+
+// toolName is the pattern the Messages API requires of a tool name.
+var toolName = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,64}$`)
+
+// maxResponseBody caps a successful response body; a larger one is an error.
+const maxResponseBody = 16 << 20
+
+// maxErrorBody caps how much of an error response body is read. It is far
+// above llm.MaxBodyExcerpt, so redaction still sees every secret that could
+// reach the excerpt.
+const maxErrorBody = 64 << 10
+
+type message struct {
+	Role    string `json:"role"`
+	Content string `json:"content"`
+}
+
+type tool struct {
+	Name        string          `json:"name"`
+	InputSchema json.RawMessage `json:"input_schema"`
+}
+
+type toolChoice struct {
+	Type string `json:"type"`
+	Name string `json:"name"`
+}
+
+type messagesRequest struct {
+	Model       string      `json:"model"`
+	MaxTokens   int         `json:"max_tokens"`
+	System      string      `json:"system,omitempty"`
+	Messages    []message   `json:"messages"`
+	Temperature *float64    `json:"temperature,omitempty"`
+	Tools       []tool      `json:"tools,omitempty"`
+	ToolChoice  *toolChoice `json:"tool_choice,omitempty"`
+}
+
+type messagesResponse struct {
+	Type    string `json:"type"`
+	Model   string `json:"model"`
+	Content []struct {
+		Type  string          `json:"type"`
+		Text  string          `json:"text"`
+		Name  string          `json:"name"`
+		Input json.RawMessage `json:"input"`
+	} `json:"content"`
+	StopReason string `json:"stop_reason"`
+	Usage      struct {
+		InputTokens  int `json:"input_tokens"`
+		OutputTokens int `json:"output_tokens"`
+	} `json:"usage"`
+}
+
+// Generate sends req to {base}/v1/messages. A Request with a Schema is sent
+// as one tool whose input_schema is the schema, with tool_choice forcing
+// it; Response.JSON is then that tool's input.
+func (p *Provider) Generate(ctx context.Context, req llm.Request) (llm.Response, error) {
+	resp, err := p.generate(ctx, req)
+	return resp, redact(err, p.apiKey)
+}
+
+func (p *Provider) generate(ctx context.Context, req llm.Request) (llm.Response, error) {
+	if err := req.Validate(); err != nil {
+		return llm.Response{}, fmt.Errorf("anthropic: generate: %w", err)
+	}
+	if p.model == "" {
+		return llm.Response{}, errors.New("anthropic: generate: no model configured")
+	}
+	body := messagesRequest{
+		Model:       p.model,
+		MaxTokens:   p.maxTokens,
+		System:      req.System,
+		Temperature: req.Temperature,
+	}
+	if req.MaxTokens > 0 {
+		body.MaxTokens = req.MaxTokens
+	}
+	if req.Schema != nil {
+		if !toolName.MatchString(req.Schema.Name) {
+			return llm.Response{}, errors.New("anthropic: generate: schema name is not a valid tool name")
+		}
+		body.Tools = []tool{{Name: req.Schema.Name, InputSchema: req.Schema.Schema}}
+		body.ToolChoice = &toolChoice{Type: "tool", Name: req.Schema.Name}
+	}
+	for _, m := range req.Messages {
+		body.Messages = append(body.Messages, message{Role: string(m.Role), Content: m.Content})
+	}
+	payload, err := json.Marshal(body)
+	if err != nil {
+		return llm.Response{}, fmt.Errorf("anthropic: generate: encode request: %w", err)
+	}
+
+	if req.Timeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, req.Timeout)
+		defer cancel()
+	}
+	raw, err := p.do(ctx, http.MethodPost, "/v1/messages", payload)
+	if err != nil {
+		return llm.Response{}, fmt.Errorf("anthropic: generate: %w", err)
+	}
+
+	var mr messagesResponse
+	if err := json.Unmarshal(raw, &mr); err != nil {
+		return llm.Response{}, fmt.Errorf("anthropic: generate: decode response: %w", err)
+	}
+	if mr.Type != "message" {
+		return llm.Response{}, errors.New("anthropic: generate: response is not a message")
+	}
+	resp := llm.Response{
+		Usage:        llm.Usage{InputTokens: mr.Usage.InputTokens, OutputTokens: mr.Usage.OutputTokens},
+		Model:        mr.Model,
+		FinishReason: mr.StopReason,
+	}
+	var text strings.Builder
+	for _, block := range mr.Content {
+		switch block.Type {
+		case "text":
+			text.WriteString(block.Text)
+		case "tool_use":
+			if req.Schema != nil && block.Name == req.Schema.Name && resp.JSON == nil {
+				resp.JSON = block.Input
+			}
+		}
+	}
+	resp.Text = text.String()
+	if req.Schema == nil {
+		return resp, nil
+	}
+	if !isJSONObject(resp.JSON) {
+		resp.JSON = nil
+		return resp, fmt.Errorf("anthropic: generate: reply holds no input for the forced tool: %w", llm.ErrBadOutput)
+	}
+	return resp, nil
+}
+
+// isJSONObject reports whether raw is exactly one JSON object.
+func isJSONObject(raw json.RawMessage) bool {
+	s := bytes.TrimSpace(raw)
+	return bytes.HasPrefix(s, []byte("{")) && json.Valid(s)
+}
+
+type modelsResponse struct {
+	Data []struct {
+		ID          string `json:"id"`
+		DisplayName string `json:"display_name"`
+	} `json:"data"`
+	HasMore bool   `json:"has_more"`
+	LastID  string `json:"last_id"`
+}
+
+// modelsPageLimit is the largest page GET /v1/models serves.
+const modelsPageLimit = 1000
+
+// ListModels returns every model {base}/v1/models lists, following pages.
+func (p *Provider) ListModels(ctx context.Context) ([]llm.Model, error) {
+	models, err := p.listModels(ctx)
+	return models, redact(err, p.apiKey)
+}
+
+func (p *Provider) listModels(ctx context.Context) ([]llm.Model, error) {
+	models := []llm.Model{}
+	after := ""
+	for {
+		page, err := p.modelsPage(ctx, modelsPageLimit, after)
+		if err != nil {
+			return nil, fmt.Errorf("anthropic: list models: %w", err)
+		}
+		for _, m := range page.Data {
+			if m.ID == "" {
+				return nil, fmt.Errorf("anthropic: list models: model %d has no id", len(models))
+			}
+			name := m.DisplayName
+			if name == "" {
+				name = m.ID
+			}
+			models = append(models, llm.Model{ID: m.ID, DisplayName: name})
+		}
+		if !page.HasMore {
+			return models, nil
+		}
+		if page.LastID == "" || page.LastID == after {
+			return nil, errors.New("anthropic: list models: response has more pages but no new cursor")
+		}
+		after = page.LastID
+	}
+}
+
+// modelsPage fetches one page of GET {base}/v1/models.
+func (p *Provider) modelsPage(ctx context.Context, limit int, after string) (modelsResponse, error) {
+	q := url.Values{"limit": {strconv.Itoa(limit)}}
+	if after != "" {
+		q.Set("after_id", after)
+	}
+	raw, err := p.do(ctx, http.MethodGet, "/v1/models?"+q.Encode(), nil)
+	if err != nil {
+		return modelsResponse{}, err
+	}
+	var mr modelsResponse
+	if err := json.Unmarshal(raw, &mr); err != nil {
+		return modelsResponse{}, fmt.Errorf("decode response: %w", err)
+	}
+	if mr.Data == nil {
+		return modelsResponse{}, errors.New("response has no data list")
+	}
+	return mr, nil
+}
+
+// Verify checks the credentials with the cheapest authenticated call: one
+// page of GET {base}/v1/models holding at most one model.
+func (p *Provider) Verify(ctx context.Context) error {
+	_, err := p.modelsPage(ctx, 1, "")
+	if err != nil {
+		err = fmt.Errorf("anthropic: verify: %w", err)
+	}
+	return redact(err, p.apiKey)
+}
+
+// do sends one request and returns the body of a 2xx response. Any other
+// status becomes the matching llm typed error.
+func (p *Provider) do(ctx context.Context, method, path string, payload []byte) ([]byte, error) {
+	var reqBody io.Reader
+	if payload != nil {
+		reqBody = bytes.NewReader(payload)
+	}
+	httpReq, err := http.NewRequestWithContext(ctx, method, p.base+path, reqBody)
+	if err != nil {
+		// The parse error names the URL, whose path may hold the API key.
+		return nil, errors.New("build request: request URL is invalid")
+	}
+	httpReq.Header.Set("x-api-key", p.apiKey)
+	httpReq.Header.Set("anthropic-version", APIVersion)
+	httpReq.Header.Set("Accept", "application/json")
+	if payload != nil {
+		httpReq.Header.Set("Content-Type", "application/json")
+	}
+
+	httpResp, err := p.client.Do(httpReq)
+	if err != nil {
+		return nil, p.transportError(err)
+	}
+	defer httpResp.Body.Close()
+
+	if httpResp.StatusCode < 200 || httpResp.StatusCode > 299 {
+		body, err := io.ReadAll(io.LimitReader(httpResp.Body, maxErrorBody))
+		if err != nil {
+			return nil, p.transportError(err)
+		}
+		return nil, p.statusError(httpResp, body)
+	}
+	body, err := io.ReadAll(io.LimitReader(httpResp.Body, maxResponseBody+1))
+	if err != nil {
+		return nil, p.transportError(err)
+	}
+	if len(body) > maxResponseBody {
+		return nil, fmt.Errorf("response body exceeds %d bytes", maxResponseBody)
+	}
+	return body, nil
+}
+
+// statusOverloaded is the status the Messages API returns when it is
+// temporarily overloaded.
+const statusOverloaded = 529
+
+// statusError maps a non-2xx response to an llm typed error.
+func (p *Provider) statusError(resp *http.Response, body []byte) error {
+	switch resp.StatusCode {
+	case http.StatusUnauthorized, http.StatusForbidden:
+		return fmt.Errorf("HTTP %d: %w", resp.StatusCode, llm.ErrAuth)
+	case http.StatusTooManyRequests, statusOverloaded:
+		return llm.NewRateLimitedError(retryAfter(resp.Header.Get("Retry-After"), time.Now()), p.apiKey)
+	case http.StatusRequestTimeout:
+		return fmt.Errorf("HTTP %d: %w", resp.StatusCode, llm.ErrTimeout)
+	default:
+		return llm.NewProviderError(resp.StatusCode, body, p.apiKey)
+	}
+}
+
+// retryAfter parses a Retry-After header, in delay-seconds or HTTP-date
+// form. A missing, malformed or past value means the vendor gave no usable
+// wait, reported as 0.
+func retryAfter(value string, now time.Time) time.Duration {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return 0
+	}
+	if secs, err := strconv.Atoi(value); err == nil {
+		if secs < 0 {
+			return 0
+		}
+		return time.Duration(secs) * time.Second
+	}
+	if at, err := http.ParseTime(value); err == nil && at.After(now) {
+		return at.Sub(now).Round(time.Second)
+	}
+	return 0
+}
+
+func isTimeout(err error) bool {
+	var ne net.Error
+	return errors.Is(err, context.DeadlineExceeded) || (errors.As(err, &ne) && ne.Timeout())
+}
+
+// transportFailure is a failed HTTP exchange. It carries the cause's text
+// with the request URL removed and the API key redacted, and unwraps only to
+// the cause's category: llm.ErrTimeout, context.Canceled or nothing.
+type transportFailure struct {
+	detail string
+	kind   error
+}
+
+func (e *transportFailure) Error() string {
+	if e.kind == llm.ErrTimeout {
+		return fmt.Sprintf("%s: transport: %s", llm.ErrTimeout, e.detail)
+	}
+	return "transport: " + e.detail
+}
+
+func (e *transportFailure) Unwrap() error { return e.kind }
+
+// transportError reports a failure to complete the HTTP exchange. A
+// *url.Error names the request URL, and a base URL path may hold the API
+// key, so only the wrapped cause is kept, rendered with the key redacted.
+func (p *Provider) transportError(err error) error {
+	var kind error
+	switch {
+	case isTimeout(err):
+		kind = llm.ErrTimeout
+	case errors.Is(err, context.Canceled):
+		kind = context.Canceled
+	}
+	var ue *url.Error
+	if errors.As(err, &ue) {
+		err = ue.Err
+	}
+	return &transportFailure{detail: llm.Redact(err.Error(), p.apiKey), kind: kind}
+}
+
+// redactedError stands in for one layer of an error chain that holds the
+// API key. Its text is the layer's text with the key redacted, and Unwrap
+// returns the layer's causes passed through redact, so no error reached by
+// unwrapping has text holding the key. Is consults the original layer and
+// its chain, so sentinels still match. As does too. The llm typed errors
+// remove the key from their own complete text, fixed words included, so
+// they always match; As refuses only a match from outside llm whose text
+// holds the key, so it never hands back an unredacted error.
+type redactedError struct {
+	text string
+	err  error
+	key  string
+}
+
+func (e *redactedError) Error() string { return e.text }
+
+// GoString keeps %#v from printing the fields, which hold the key.
+func (e *redactedError) GoString() string { return e.text }
+
+func (e *redactedError) Unwrap() error { return redact(errors.Unwrap(e.err), e.key) }
+
+func (e *redactedError) Is(target error) bool { return errors.Is(e.err, target) }
+
+func (e *redactedError) As(target any) bool {
+	if !errors.As(e.err, target) {
+		return false
+	}
+	found := reflect.ValueOf(target).Elem()
+	if matched, ok := found.Interface().(error); ok && holdsKey(matched, e.key) {
+		found.SetZero()
+		return false
+	}
+	return true
+}
+
+// redactedJoin is redactedError for a layer with several causes, such as
+// one built by errors.Join or by fmt.Errorf with more than one %w.
+type redactedJoin struct {
+	redactedError
+}
+
+func (e *redactedJoin) Unwrap() []error {
+	causes := e.err.(interface{ Unwrap() []error }).Unwrap()
+	safe := make([]error, len(causes))
+	for i, c := range causes {
+		safe[i] = redact(c, e.key)
+	}
+	return safe
+}
+
+// redact is the backstop every exported method applies to its error: when
+// the text of err or of any error in its chain holds a non-empty key, it
+// returns a stand-in whose text, and the text of every error it unwraps
+// to, has the key redacted. Any other err is returned unchanged.
+func redact(err error, key string) error {
+	if err == nil || key == "" || !holdsKey(err, key) {
+		return err
+	}
+	re := redactedError{text: llm.Redact(err.Error(), key), err: err, key: key}
+	if _, ok := err.(interface{ Unwrap() []error }); ok {
+		return &redactedJoin{re}
+	}
+	return &re
+}
+
+// holdsKey reports whether the text of err or of any error in its chain
+// contains key.
+func holdsKey(err error, key string) bool {
+	if err == nil {
+		return false
+	}
+	if strings.Contains(err.Error(), key) {
+		return true
+	}
+	switch u := err.(type) {
+	case interface{ Unwrap() error }:
+		return holdsKey(u.Unwrap(), key)
+	case interface{ Unwrap() []error }:
+		for _, c := range u.Unwrap() {
+			if holdsKey(c, key) {
+				return true
+			}
+		}
+	}
+	return false
+}

internal/ai/llm/anthropic/anthropic_test.go

@@ -0,0 +1,912 @@
+package anthropic
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
+)
+
+const testKey = "sk-ant-test-9f8e7d6c5b4a39281706f5e4d3c2b1a0"
+
+// recorded is one request the test server received.
+type recorded struct {
+	method string
+	path   string
+	query  url.Values
+	header http.Header
+	body   []byte
+}
+
+// reply is a response the test server replays.
+type reply struct {
+	status  int
+	header  map[string]string
+	fixture string // testdata file; {{KEY}} is replaced with the key
+	body    string // used when fixture is empty
+	delay   time.Duration
+}
+
+// vendorServer replays its replies in order, repeating the last, and
+// records every request.
+type vendorServer struct {
+	*httptest.Server
+	mu  sync.Mutex
+	got []recorded
+}
+
+func newVendorServer(t *testing.T, replies ...reply) *vendorServer {
+	return newVendorServerWithKey(t, testKey, replies...)
+}
+
+func newVendorServerWithKey(t *testing.T, key string, replies ...reply) *vendorServer {
+	t.Helper()
+	payloads := make([][]byte, len(replies))
+	for i, r := range replies {
+		payloads[i] = []byte(r.body)
+		if r.fixture != "" {
+			raw, err := os.ReadFile(filepath.Join("testdata", r.fixture))
+			if err != nil {
+				t.Fatal(err)
+			}
+			payloads[i] = bytes.ReplaceAll(raw, []byte("{{KEY}}"), []byte(key))
+		}
+	}
+	vs := &vendorServer{}
+	vs.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		body, _ := io.ReadAll(req.Body)
+		vs.mu.Lock()
+		n := len(vs.got)
+		vs.got = append(vs.got, recorded{req.Method, req.URL.Path, req.URL.Query(), req.Header.Clone(), body})
+		vs.mu.Unlock()
+		i := min(n, len(replies)-1)
+		r := replies[i]
+		if r.delay > 0 {
+			select {
+			case <-time.After(r.delay):
+			case <-req.Context().Done():
+				return
+			}
+		}
+		for k, v := range r.header {
+			w.Header().Set(k, v)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(r.status)
+		w.Write(payloads[i])
+	}))
+	t.Cleanup(vs.Close)
+	return vs
+}
+
+func (vs *vendorServer) requests() []recorded {
+	vs.mu.Lock()
+	defer vs.mu.Unlock()
+	return append([]recorded(nil), vs.got...)
+}
+
+func (vs *vendorServer) only(t *testing.T) recorded {
+	t.Helper()
+	got := vs.requests()
+	if len(got) != 1 {
+		t.Fatalf("server got %d requests, want 1", len(got))
+	}
+	return got[0]
+}
+
+func newProvider(t *testing.T, base string) *Provider {
+	return newProviderWithKey(t, base, testKey)
+}
+
+func newProviderWithKey(t *testing.T, base, key string) *Provider {
+	t.Helper()
+	p, err := New(Config{BaseURL: base, APIKey: key, Model: "test-model", MaxTokens: 1024})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+var dinnersSchema = json.RawMessage(`{"type":"object","properties":{"dinners":{"type":"array"}},"required":["dinners"]}`)
+
+func schemaRequest() llm.Request {
+	temp := 0.0
+	return llm.Request{
+		System: "You plan dinners for Our kitchen.",
+		Messages: []llm.Message{
+			{Role: llm.RoleUser, Content: "Suggest a Side quest."},
+			{Role: llm.RoleAssistant, Content: "Something quick?"},
+			{Role: llm.RoleUser, Content: "Yes, a Quick dinner."},
+		},
+		Temperature: &temp,
+		MaxTokens:   400,
+		Schema:      &llm.JSONSchema{Name: "side_quests", Schema: dinnersSchema},
+	}
+}
+
+func textRequest() llm.Request {
+	return llm.Request{Messages: []llm.Message{{Role: llm.RoleUser, Content: "What should we cook tonight?"}}}
+}
+
+// sentBody decodes a request body into a generic map.
+func sentBody(t *testing.T, r recorded) map[string]any {
+	t.Helper()
+	var m map[string]any
+	if err := json.Unmarshal(r.body, &m); err != nil {
+		t.Fatalf("request body %q: %v", r.body, err)
+	}
+	return m
+}
+
+// canonical re-encodes JSON so two encodings of one value compare equal.
+func canonical(t *testing.T, raw []byte) string {
+	t.Helper()
+	var v any
+	if err := json.Unmarshal(raw, &v); err != nil {
+		t.Fatalf("JSON %q: %v", raw, err)
+	}
+	out, _ := json.Marshal(v)
+	return string(out)
+}
+
+func assertHeaders(t *testing.T, r recorded, key string) {
+	t.Helper()
+	if got := r.header.Values("X-Api-Key"); len(got) != 1 || got[0] != key {
+		t.Errorf("x-api-key = %q", got)
+	}
+	if got := r.header.Values("Anthropic-Version"); len(got) != 1 || got[0] != "2023-06-01" {
+		t.Errorf("anthropic-version = %q", got)
+	}
+	if got := r.header.Get("Authorization"); got != "" {
+		t.Errorf("Authorization = %q, want none", got)
+	}
+}
+
+func TestGenerateToolForcedJSON(t *testing.T) {
+	vs := newVendorServer(t, reply{status: 200, fixture: "messages_tool_use.json"})
+	p := newProvider(t, vs.URL+"/")
+
+	resp, err := p.Generate(context.Background(), schemaRequest())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := canonical(t, resp.JSON), `{"dinners":[{"name":"Sheet-pan gnocchi","why":"Like your Regular tray bake, but quicker."}]}`; got != want {
+		t.Errorf("Response.JSON = %s, want %s", got, want)
+	}
+	if resp.Text != "" {
+		t.Errorf("Text = %q, want none", resp.Text)
+	}
+	if resp.Usage != (llm.Usage{InputTokens: 472, OutputTokens: 61}) || resp.Model != "claude-sonnet-5" || resp.FinishReason != "tool_use" {
+		t.Errorf("Usage, Model, FinishReason = %+v, %q, %q", resp.Usage, resp.Model, resp.FinishReason)
+	}
+
+	got := vs.only(t)
+	if got.method != http.MethodPost || got.path != "/v1/messages" || len(got.query) != 0 {
+		t.Errorf("request = %s %s?%s", got.method, got.path, got.query.Encode())
+	}
+	assertHeaders(t, got, testKey)
+	if h := got.header.Get("Content-Type"); h != "application/json" {
+		t.Errorf("Content-Type = %q", h)
+	}
+	body := sentBody(t, got)
+	if body["model"] != "test-model" || body["temperature"] != 0.0 || body["max_tokens"] != 400.0 {
+		t.Errorf("model, temperature, max_tokens = %v, %v, %v", body["model"], body["temperature"], body["max_tokens"])
+	}
+	if body["system"] != "You plan dinners for Our kitchen." {
+		t.Errorf("system = %v", body["system"])
+	}
+	msgs := body["messages"].([]any)
+	wantMsgs := []string{"user:Suggest a Side quest.", "assistant:Something quick?", "user:Yes, a Quick dinner."}
+	if len(msgs) != len(wantMsgs) {
+		t.Fatalf("messages = %v", msgs)
+	}
+	for i, m := range msgs {
+		mm := m.(map[string]any)
+		if got := fmt.Sprintf("%v:%v", mm["role"], mm["content"]); got != wantMsgs[i] {
+			t.Errorf("message %d = %s, want %s", i, got, wantMsgs[i])
+		}
+	}
+	tools := body["tools"].([]any)
+	if len(tools) != 1 {
+		t.Fatalf("tools = %v", tools)
+	}
+	tool := tools[0].(map[string]any)
+	schema, _ := json.Marshal(tool["input_schema"])
+	if tool["name"] != "side_quests" || string(schema) != canonical(t, dinnersSchema) {
+		t.Errorf("tool = %v", tool)
+	}
+	choice := body["tool_choice"].(map[string]any)
+	if len(choice) != 2 || choice["type"] != "tool" || choice["name"] != "side_quests" {
+		t.Errorf("tool_choice = %v", choice)
+	}
+}
+
+func TestGenerateText(t *testing.T) {
+	vs := newVendorServer(t, reply{status: 200, fixture: "messages_text.json"})
+	p := newProvider(t, vs.URL)
+
+	resp, err := p.Generate(context.Background(), textRequest())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.Text != "Try a crock pot chili: it is a Quick dinner." || resp.JSON != nil {
+		t.Errorf("Text, JSON = %q, %s", resp.Text, resp.JSON)
+	}
+	if resp.Usage != (llm.Usage{InputTokens: 2095, OutputTokens: 503}) || resp.Model != "claude-sonnet-5" || resp.FinishReason != "end_turn" {
+		t.Errorf("Usage, Model, FinishReason = %+v, %q, %q", resp.Usage, resp.Model, resp.FinishReason)
+	}
+
+	got := vs.only(t)
+	if got.path != "/v1/messages" {
+		t.Errorf("path = %s", got.path)
+	}
+	assertHeaders(t, got, testKey)
+	body := sentBody(t, got)
+	if body["max_tokens"] != 1024.0 {
+		t.Errorf("max_tokens = %v, want the configured 1024", body["max_tokens"])
+	}
+	for _, field := range []string{"system", "temperature", "tools", "tool_choice"} {
+		if v, ok := body[field]; ok {
+			t.Errorf("%s = %v, want it omitted", field, v)
+		}
+	}
+}
+
+func TestGenerateTextKeepsStopReason(t *testing.T) {
+	vs := newVendorServer(t, reply{status: 200, fixture: "messages_max_tokens.json"})
+	resp, err := newProvider(t, vs.URL).Generate(context.Background(), textRequest())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.FinishReason != "max_tokens" || resp.Usage.OutputTokens != 400 {
+		t.Errorf("FinishReason, Usage = %q, %+v", resp.FinishReason, resp.Usage)
+	}
+}
+
+func TestGenerateBadOutput(t *testing.T) {
+	cases := map[string]string{
+		"text instead of tool": `{"type":"message","model":"m","content":[{"type":"text","text":"Sure!"}],"stop_reason":"end_turn","usage":{"input_tokens":1,"output_tokens":2}}`,
+		"other tool":           `{"type":"message","model":"m","content":[{"type":"tool_use","id":"t","name":"other","input":{"a":1}}],"stop_reason":"tool_use","usage":{}}`,
+		"input not an object":  `{"type":"message","model":"m","content":[{"type":"tool_use","id":"t","name":"side_quests","input":[1]}],"stop_reason":"tool_use","usage":{}}`,
+		"no content":           `{"type":"message","model":"m","content":[],"stop_reason":"max_tokens","usage":{}}`,
+	}
+	for name, body := range cases {
+		t.Run(name, func(t *testing.T) {
+			vs := newVendorServer(t, reply{status: 200, body: body})
+			resp, err := newProvider(t, vs.URL).Generate(context.Background(), schemaRequest())
+			if !errors.Is(err, llm.ErrBadOutput) {
+				t.Fatalf("err = %v, want ErrBadOutput", err)
+			}
+			if resp.JSON != nil || resp.Model != "m" {
+				t.Fatalf("Response = %+v, want no JSON and the model kept", resp)
+			}
+		})
+	}
+	vs := newVendorServer(t, reply{status: 200, fixture: "messages_max_tokens.json"})
+	resp, err := newProvider(t, vs.URL).Generate(context.Background(), schemaRequest())
+	if !errors.Is(err, llm.ErrBadOutput) || resp.FinishReason != "max_tokens" {
+		t.Fatalf("truncated: resp, err = %+v, %v", resp, err)
+	}
+}
+
+func TestGenerateRejectsNonMessage(t *testing.T) {
+	vs := newVendorServer(t, reply{status: 200, fixture: "error_overloaded.json"})
+	_, err := newProvider(t, vs.URL).Generate(context.Background(), textRequest())
+	if err == nil || errors.Is(err, llm.ErrBadOutput) {
+		t.Fatalf("err = %v, want an untyped malformed-response error", err)
+	}
+}
+
+func TestGenerateRejectsInvalidRequests(t *testing.T) {
+	vs := newVendorServer(t, reply{status: 200, fixture: "messages_text.json"})
+	p := newProvider(t, vs.URL)
+	if _, err := p.Generate(context.Background(), llm.Request{}); err == nil {
+		t.Error("Generate accepted a request with no messages")
+	}
+	for _, name := range []string{"side quests", "", strings.Repeat("a", 65), "plan.v2"} {
+		req := schemaRequest()
+		req.Schema.Name = name
+		if _, err := p.Generate(context.Background(), req); err == nil {
+			t.Errorf("Generate accepted tool name %q", name)
+		}
+	}
+	noModel, err := New(Config{BaseURL: vs.URL, APIKey: testKey, MaxTokens: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := noModel.Generate(context.Background(), textRequest()); err == nil {
+		t.Error("Generate succeeded with no model configured")
+	}
+	if n := len(vs.requests()); n != 0 {
+		t.Errorf("invalid requests reached the vendor %d times", n)
+	}
+}
+
+func TestListModelsFollowsPages(t *testing.T) {
+	vs := newVendorServer(t,
+		reply{status: 200, fixture: "models_page1.json"},
+		reply{status: 200, fixture: "models_page2.json"},
+	)
+	models, err := newProvider(t, vs.URL).ListModels(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []llm.Model{
+		{ID: "claude-sonnet-5", DisplayName: "Claude Sonnet 5"},
+		{ID: "claude-haiku-4-5-20251001", DisplayName: "Claude Haiku 4.5"},
+		{ID: "claude-opus-5-5", DisplayName: "claude-opus-5-5"},
+	}
+	if len(models) != len(want) {
+		t.Fatalf("models = %+v", models)
+	}
+	for i := range want {
+		if models[i] != want[i] {
+			t.Errorf("model %d = %+v, want %+v", i, models[i], want[i])
+		}
+	}
+	got := vs.requests()
+	if len(got) != 2 {
+		t.Fatalf("server got %d requests, want 2", len(got))
+	}
+	for i, wantAfter := range []string{"", "claude-sonnet-5"} {
+		r := got[i]
+		if r.method != http.MethodGet || r.path != "/v1/models" || r.query.Get("limit") != "1000" || r.query.Get("after_id") != wantAfter {
+			t.Errorf("request %d = %s %s?%s", i, r.method, r.path, r.query.Encode())
+		}
+		assertHeaders(t, r, testKey)
+		if len(r.body) != 0 || r.header.Get("Content-Type") != "" {
+			t.Errorf("request %d sent a body", i)
+		}
+	}
+}
+
+func TestListModelsRejectsBadPages(t *testing.T) {
+	cases := map[string]string{
+		"no data":      `{"has_more":false}`,
+		"no id":        `{"data":[{"type":"model","display_name":"x"}],"has_more":false}`,
+		"no cursor":    `{"data":[{"id":"a"}],"has_more":true}`,
+		"stuck cursor": `{"data":[{"id":"a"}],"has_more":true,"last_id":"a"}`,
+		"invalid":      `{"data":`,
+	}
+	for name, body := range cases {
+		vs := newVendorServer(t, reply{status: 200, body: body})
+		if models, err := newProvider(t, vs.URL).ListModels(context.Background()); err == nil {
+			t.Errorf("%s: ListModels() = %+v, nil error", name, models)
+		}
+	}
+}
+
+func TestListModelsEmpty(t *testing.T) {
+	vs := newVendorServer(t, reply{status: 200, body: `{"data":[],"has_more":false}`})
+	models, err := newProvider(t, vs.URL).ListModels(context.Background())
+	if err != nil || models == nil || len(models) != 0 {
+		t.Fatalf("ListModels() = %#v, %v", models, err)
+	}
+}
+
+func TestVerify(t *testing.T) {
+	ok := newVendorServer(t, reply{status: 200, fixture: "models_page1.json"})
+	if err := newProvider(t, ok.URL).Verify(context.Background()); err != nil {
+		t.Fatalf("Verify() = %v", err)
+	}
+	got := ok.only(t)
+	if got.method != http.MethodGet || got.path != "/v1/models" || got.query.Get("limit") != "1" || got.query.Has("after_id") {
+		t.Errorf("Verify called %s %s?%s", got.method, got.path, got.query.Encode())
+	}
+	assertHeaders(t, got, testKey)
+
+	for status, want := range map[int]error{401: llm.ErrAuth, 403: llm.ErrAuth, 529: llm.ErrRateLimited, 500: llm.ErrProvider} {
+		bad := newVendorServer(t, reply{status: status, fixture: "error_api.json"})
+		err := newProvider(t, bad.URL).Verify(context.Background())
+		if !errors.Is(err, want) {
+			t.Errorf("HTTP %d: Verify() = %v, want %v", status, err, want)
+		}
+		assertNoSecret(t, err)
+	}
+	malformed := newVendorServer(t, reply{status: 200, body: `{}`})
+	if err := newProvider(t, malformed.URL).Verify(context.Background()); err == nil {
+		t.Error("Verify accepted a body with no data list")
+	}
+}
+
+// assertNoSecret fails if err's text holds the key or a prefix of it.
+func assertNoSecret(t *testing.T, err error) {
+	t.Helper()
+	for _, secret := range []string{testKey, testKey[:16]} {
+		if strings.Contains(strings.ToLower(err.Error()), strings.ToLower(secret)) {
+			t.Fatalf("error leaks %q: %v", secret, err)
+		}
+	}
+}
+
+func TestErrorMapping(t *testing.T) {
+	rateLimited := func(want time.Duration) func(*testing.T, error) {
+		return func(t *testing.T, err error) {
+			var rl *llm.RateLimitedError
+			if !errors.As(err, &rl) || rl.RetryAfter != want {
+				t.Fatalf("RetryAfter from %v, want %v", err, want)
+			}
+		}
+	}
+	providerError := func(status int, excerpt string) func(*testing.T, error) {
+		return func(t *testing.T, err error) {
+			var pe *llm.ProviderError
+			if !errors.As(err, &pe) || pe.Status() != status || !strings.Contains(pe.Body(), excerpt) {
+				t.Fatalf("ProviderError from %v, want HTTP %d with %q", err, status, excerpt)
+			}
+			if !strings.Contains(err.Error(), pe.Body()) {
+				t.Fatalf("Error() = %q, want it to carry the excerpt", err)
+			}
+		}
+	}
+	cases := []struct {
+		name  string
+		reply reply
+		want  error
+		check func(*testing.T, error)
+	}{
+		{name: "401", reply: reply{status: 401, fixture: "error_authentication.json"}, want: llm.ErrAuth},
+		{name: "403", reply: reply{status: 403, fixture: "error_permission.json"}, want: llm.ErrAuth},
+		{name: "429 seconds", reply: reply{status: 429, header: map[string]string{"Retry-After": "17"}, fixture: "error_rate_limit.json"}, want: llm.ErrRateLimited, check: rateLimited(17 * time.Second)},
+		{name: "429 no Retry-After", reply: reply{status: 429, fixture: "error_rate_limit.json"}, want: llm.ErrRateLimited, check: rateLimited(0)},
+		{name: "429 HTTP-date", reply: reply{status: 429, header: map[string]string{"Retry-After": time.Now().Add(90 * time.Second).UTC().Format(http.TimeFormat)}, fixture: "error_rate_limit.json"}, want: llm.ErrRateLimited,
+			check: func(t *testing.T, err error) {
+				var rl *llm.RateLimitedError
+				if !errors.As(err, &rl) || rl.RetryAfter < 85*time.Second || rl.RetryAfter > 91*time.Second {
+					t.Fatalf("RetryAfter from %v", err)
+				}
+			}},
+		{name: "529 seconds", reply: reply{status: 529, header: map[string]string{"Retry-After": "4"}, fixture: "error_overloaded.json"}, want: llm.ErrRateLimited, check: rateLimited(4 * time.Second)},
+		{name: "529 no Retry-After", reply: reply{status: 529, fixture: "error_overloaded.json"}, want: llm.ErrRateLimited, check: rateLimited(0)},
+		{name: "408", reply: reply{status: 408}, want: llm.ErrTimeout},
+		{name: "400", reply: reply{status: 400, fixture: "error_invalid_request.json"}, want: llm.ErrProvider, check: providerError(400, "max_tokens: Field required")},
+		{name: "404", reply: reply{status: 404, fixture: "error_not_found.json"}, want: llm.ErrProvider, check: providerError(404, "not_found_error")},
+		{name: "500 echoing the key", reply: reply{status: 500, fixture: "error_api.json"}, want: llm.ErrProvider, check: providerError(500, "x-api-key: [REDACTED]")},
+		{name: "503", reply: reply{status: 503, body: "upstream connect error"}, want: llm.ErrProvider, check: providerError(503, "upstream connect error")},
+	}
+	all := []error{llm.ErrAuth, llm.ErrRateLimited, llm.ErrTimeout, llm.ErrBadOutput, llm.ErrProvider}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			vs := newVendorServer(t, c.reply)
+			p := newProvider(t, vs.URL)
+			_, genErr := p.Generate(context.Background(), schemaRequest())
+			_, listErr := p.ListModels(context.Background())
+			for _, err := range []error{genErr, listErr} {
+				for _, sentinel := range all {
+					if errors.Is(err, sentinel) != (sentinel == c.want) {
+						t.Fatalf("errors.Is(%v, %v) = %v", err, sentinel, sentinel != c.want)
+					}
+				}
+				assertNoSecret(t, err)
+				assertChainNoExactKey(t, err, testKey)
+				if c.check != nil {
+					c.check(t, err)
+				}
+			}
+		})
+	}
+}
+
+func TestTimeouts(t *testing.T) {
+	vs := newVendorServer(t, reply{status: 200, fixture: "messages_tool_use.json", delay: 5 * time.Second})
+	p := newProvider(t, vs.URL)
+
+	req := schemaRequest()
+	req.Timeout = 50 * time.Millisecond
+	start := time.Now()
+	_, err := p.Generate(context.Background(), req)
+	if !errors.Is(err, llm.ErrTimeout) {
+		t.Fatalf("Request.Timeout: err = %v, want ErrTimeout", err)
+	}
+	if elapsed := time.Since(start); elapsed > 2*time.Second {
+		t.Fatalf("Request.Timeout not honoured: took %v", elapsed)
+	}
+	assertNoSecret(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	if _, err := p.ListModels(ctx); !errors.Is(err, llm.ErrTimeout) {
+		t.Fatalf("context deadline: err = %v, want ErrTimeout", err)
+	}
+	ctx, cancel = context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	if err := p.Verify(ctx); !errors.Is(err, llm.ErrTimeout) {
+		t.Fatalf("Verify context deadline: err = %v, want ErrTimeout", err)
+	}
+
+	ctx, cancel = context.WithCancel(context.Background())
+	cancel()
+	if _, err := p.Generate(ctx, schemaRequest()); !errors.Is(err, context.Canceled) || errors.Is(err, llm.ErrTimeout) {
+		t.Fatalf("cancelled context: err = %v, want context.Canceled only", err)
+	}
+}
+
+// TestTransportErrorWithKeyInBaseURLPath fails the exchange against a base
+// URL whose path holds the key, which New accepts; net/http names the full
+// request URL in its transport errors.
+func TestTransportErrorWithKeyInBaseURLPath(t *testing.T) {
+	refused := newVendorServer(t, reply{status: 200})
+	refusedBase := refused.URL
+	refused.Close()
+
+	dropped := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		conn, _, err := w.(http.Hijacker).Hijack()
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		conn.Close()
+	}))
+	t.Cleanup(dropped.Close)
+
+	for name, base := range map[string]string{
+		"connection refused": refusedBase + "/" + testKey,
+		"connection dropped": dropped.URL + "/" + testKey,
+	} {
+		p := newProvider(t, base)
+		_, genErr := p.Generate(context.Background(), schemaRequest())
+		_, listErr := p.ListModels(context.Background())
+		verifyErr := p.Verify(context.Background())
+		for _, err := range []error{genErr, listErr, verifyErr} {
+			if err == nil {
+				t.Fatalf("%s: nil error", name)
+			}
+			assertNoSecret(t, err)
+			assertChainNoExactKey(t, err, testKey)
+			var ue *url.Error
+			if errors.As(err, &ue) {
+				t.Fatalf("%s: error chain exposes the request URL: %v", name, ue)
+			}
+			if errors.Is(err, llm.ErrTimeout) || errors.Is(err, llm.ErrProvider) {
+				t.Fatalf("%s: err = %v, want an untyped transport failure", name, err)
+			}
+		}
+	}
+
+	// The request URL escapes a key with spaces, so redacting the key
+	// itself would miss that copy.
+	const spacedKey = "sk ant key"
+	p := newProviderWithKey(t, refusedBase+"/"+spacedKey, spacedKey)
+	_, genErr := p.Generate(context.Background(), textRequest())
+	_, listErr := p.ListModels(context.Background())
+	verifyErr := p.Verify(context.Background())
+	for _, err := range []error{genErr, listErr, verifyErr} {
+		if err == nil {
+			t.Fatal("escaped key: nil error")
+		}
+		assertChainNoExactKey(t, err, spacedKey)
+		assertChainNoExactKey(t, err, url.PathEscape(spacedKey))
+	}
+}
+
+func TestNewRejectsBadConfig(t *testing.T) {
+	cases := map[string]Config{
+		"empty base":         {},
+		"relative base":      {BaseURL: "api.anthropic.com"},
+		"ftp base":           {BaseURL: "ftp://example.com"},
+		"credentials in URL": {BaseURL: "https://user:" + testKey + "@example.com"},
+		"key in query":       {BaseURL: "https://example.com/?key=" + testKey},
+		"key in fragment":    {BaseURL: "https://example.com/#" + testKey},
+		"key, relative base": {BaseURL: "example.com?key=" + testKey},
+		"key, ftp base":      {BaseURL: "ftp://example.com/?key=" + testKey},
+		"key, unparseable":   {BaseURL: "https://example.com/%zz?key=" + testKey},
+		"empty query":        {BaseURL: "https://example.com?"},
+		"empty fragment":     {BaseURL: "https://example.com#"},
+		"empty both":         {BaseURL: "https://example.com/?#"},
+		"empty key":          {BaseURL: "https://example.com", APIKey: "-"},
+		"key with newline":   {BaseURL: "https://example.com", APIKey: testKey + "\n"},
+		"zero max tokens":    {BaseURL: "https://example.com", MaxTokens: -1},
+		"negative max":       {BaseURL: "https://example.com", MaxTokens: -5},
+	}
+	for name, cfg := range cases {
+		switch cfg.APIKey {
+		case "":
+			cfg.APIKey = testKey
+		case "-":
+			cfg.APIKey = ""
+		}
+		switch cfg.MaxTokens {
+		case 0:
+			cfg.MaxTokens = 1024
+		case -1:
+			cfg.MaxTokens = 0
+		}
+		_, err := New(cfg)
+		if err == nil {
+			t.Errorf("%s: New() = nil error", name)
+			continue
+		}
+		assertNoSecret(t, err)
+		assertChainNoExactKey(t, err, testKey)
+	}
+	if _, err := New(Config{BaseURL: "http://anthropic:8080/proxy/", APIKey: testKey, MaxTokens: 1}); err != nil {
+		t.Errorf("New() rejected a valid config: %v", err)
+	}
+}
+
+func TestRetryAfter(t *testing.T) {
+	now := time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)
+	cases := map[string]time.Duration{
+		"":                              0,
+		"30":                            30 * time.Second,
+		" 5 ":                           5 * time.Second,
+		"-3":                            0,
+		"soon":                          0,
+		"Sat, 03 Oct 2026 12:02:00 GMT": 2 * time.Minute,
+		"Sat, 03 Oct 2026 11:59:00 GMT": 0,
+	}
+	for in, want := range cases {
+		if got := retryAfter(in, now); got != want {
+			t.Errorf("retryAfter(%q) = %v, want %v", in, got, want)
+		}
+	}
+}
+
+// assertChainNoExactKey fails if key appears, case-sensitively, in the text
+// of err, of any error reached from it by unwrapping, or of a typed error
+// errors.As finds in it, including a ProviderError's Body.
+func assertChainNoExactKey(t *testing.T, err error, key string) {
+	t.Helper()
+	var walk func(error)
+	walk = func(e error) {
+		if e == nil {
+			return
+		}
+		if strings.Contains(e.Error(), key) {
+			t.Fatalf("layer leaks %q: %q", key, e.Error())
+		}
+		switch u := e.(type) {
+		case interface{ Unwrap() error }:
+			walk(u.Unwrap())
+		case interface{ Unwrap() []error }:
+			for _, c := range u.Unwrap() {
+				walk(c)
+			}
+		}
+	}
+	walk(err)
+	for layer := err; layer != nil; layer = errors.Unwrap(layer) {
+		if strings.Contains(layer.Error(), key) {
+			t.Fatalf("errors.Unwrap layer leaks %q: %q", key, layer.Error())
+		}
+	}
+	var pe *llm.ProviderError
+	if errors.As(err, &pe) && (strings.Contains(pe.Body(), key) || strings.Contains(pe.Error(), key)) {
+		t.Fatalf("ProviderError leaks %q: Error %q, Body %q", key, pe.Error(), pe.Body())
+	}
+	var rl *llm.RateLimitedError
+	if errors.As(err, &rl) && strings.Contains(rl.Error(), key) {
+		t.Fatalf("RateLimitedError leaks %q: %q", key, rl.Error())
+	}
+	var syntax *json.SyntaxError
+	if errors.As(err, &syntax) && strings.Contains(syntax.Error(), key) {
+		t.Fatalf("errors.As reached a *json.SyntaxError leaking %q: %q", key, syntax.Error())
+	}
+	if got := fmt.Sprintf("%v %+v %#v", err, err, err); strings.Contains(got, key) {
+		t.Fatalf("formatting leaks %q: %q", key, got)
+	}
+}
+
+// TestHeaderNameKeyNeverLeaks uses the header name "x-api-key" as the API
+// key, a word an error naming the header would print, and drives every
+// construction and request error path with it.
+func TestHeaderNameKeyNeverLeaks(t *testing.T) {
+	const key = "x-api-key"
+	construction := map[string]Config{
+		"unparseable base": {BaseURL: "https://example.com/%zz/" + key, APIKey: key, MaxTokens: 1},
+		"relative base":    {BaseURL: key, APIKey: key, MaxTokens: 1},
+		"query in base":    {BaseURL: "https://example.com/?" + key, APIKey: key, MaxTokens: 1},
+		"userinfo in base": {BaseURL: "https://" + key + "@example.com", APIKey: key, MaxTokens: 1},
+		"no max tokens":    {BaseURL: "https://example.com", APIKey: key},
+		"key with newline": {BaseURL: "https://example.com", APIKey: key + "\r\n", MaxTokens: 1},
+	}
+	for name, cfg := range construction {
+		_, err := New(cfg)
+		if err == nil {
+			t.Fatalf("%s: New() = nil error", name)
+		}
+		assertChainNoExactKey(t, err, key)
+	}
+
+	body := `{"type":"error","error":{"type":"x","message":"bad x-api-key header: x-api-key"}}`
+	statuses := []int{400, 401, 403, 404, 408, 429, 500, 529}
+	for _, status := range statuses {
+		vs := newVendorServerWithKey(t, key, reply{status: status, body: body, header: map[string]string{"Retry-After": "3"}})
+		p := newProviderWithKey(t, vs.URL, key)
+		_, genErr := p.Generate(context.Background(), schemaRequest())
+		_, listErr := p.ListModels(context.Background())
+		verifyErr := p.Verify(context.Background())
+		for _, err := range []error{genErr, listErr, verifyErr} {
+			if err == nil {
+				t.Fatalf("HTTP %d: nil error", status)
+			}
+			assertChainNoExactKey(t, err, key)
+		}
+	}
+
+	ok := newVendorServerWithKey(t, key, reply{status: 200, fixture: "messages_text.json"})
+	p := newProviderWithKey(t, ok.URL, key)
+	requests := map[string]llm.Request{
+		"unknown role":  {Messages: []llm.Message{{Role: llm.Role(key), Content: "hi"}}},
+		"bad tool name": {Messages: textRequest().Messages, Schema: &llm.JSONSchema{Name: key + "!", Schema: dinnersSchema}},
+		"schema array":  {Messages: textRequest().Messages, Schema: &llm.JSONSchema{Name: key, Schema: json.RawMessage(`[]`)}},
+		"bad output":    {Messages: textRequest().Messages, Schema: &llm.JSONSchema{Name: key, Schema: dinnersSchema}},
+	}
+	for name, req := range requests {
+		_, err := p.Generate(context.Background(), req)
+		if err == nil {
+			t.Fatalf("%s: nil error", name)
+		}
+		assertChainNoExactKey(t, err, key)
+	}
+	noModel, err := New(Config{BaseURL: ok.URL, APIKey: key, MaxTokens: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = noModel.Generate(context.Background(), textRequest())
+	if err == nil {
+		t.Fatal("Generate succeeded with no model")
+	}
+	assertChainNoExactKey(t, err, key)
+
+	refused := newVendorServer(t, reply{status: 200})
+	refusedBase := refused.URL
+	refused.Close()
+	_, err = newProviderWithKey(t, refusedBase+"/"+key, key).Generate(context.Background(), textRequest())
+	if err == nil {
+		t.Fatal("Generate against a closed server succeeded")
+	}
+	assertChainNoExactKey(t, err, key)
+}
+
+// TestAdapterNameKeyOn401 uses the adapter's own error prefix "anthropic" as
+// the API key.
+func TestAdapterNameKeyOn401(t *testing.T) {
+	const key = "anthropic"
+	vs := newVendorServerWithKey(t, key, reply{status: 401, fixture: "error_authentication.json"})
+	p := newProviderWithKey(t, vs.URL, key)
+	_, genErr := p.Generate(context.Background(), schemaRequest())
+	_, listErr := p.ListModels(context.Background())
+	verifyErr := p.Verify(context.Background())
+	for _, err := range []error{genErr, listErr, verifyErr} {
+		if !errors.Is(err, llm.ErrAuth) {
+			t.Fatalf("err = %v, want ErrAuth", err)
+		}
+		assertChainNoExactKey(t, err, key)
+	}
+}
+
+// TestFixedWordKeyOn500 uses the fixed word "HTTP" of ProviderError's text
+// as the API key: errors.As must still reach the ProviderError, whose Body
+// and Error must drop it.
+func TestFixedWordKeyOn500(t *testing.T) {
+	const key = "HTTP"
+	vs := newVendorServerWithKey(t, key, reply{status: 500, body: `{"type":"error","error":{"type":"api_error","message":"HTTP backend down"}}`})
+	_, err := newProviderWithKey(t, vs.URL, key).Generate(context.Background(), schemaRequest())
+	var pe *llm.ProviderError
+	if !errors.Is(err, llm.ErrProvider) || !errors.As(err, &pe) || pe.Status() != 500 {
+		t.Fatalf("err = %v, want a 500 ProviderError", err)
+	}
+	if strings.Contains(pe.Error(), key) || strings.Contains(pe.Body(), key) {
+		t.Fatalf("ProviderError leaks the key: Error %q, Body %q", pe.Error(), pe.Body())
+	}
+	if !strings.Contains(pe.Body(), "backend down") {
+		t.Fatalf("Body() = %q, want the redacted excerpt", pe.Body())
+	}
+	assertChainNoExactKey(t, err, key)
+}
+
+// TestRateLimitedFixedWordKey uses the fixed word "rate" of
+// RateLimitedError's text as the API key, on both rate-limit statuses.
+func TestRateLimitedFixedWordKey(t *testing.T) {
+	const key = "rate"
+	for _, status := range []int{429, 529} {
+		vs := newVendorServerWithKey(t, key, reply{status: status, header: map[string]string{"Retry-After": "17"}, fixture: "error_rate_limit.json"})
+		_, err := newProviderWithKey(t, vs.URL, key).Generate(context.Background(), schemaRequest())
+		var rl *llm.RateLimitedError
+		if !errors.Is(err, llm.ErrRateLimited) || !errors.As(err, &rl) || rl.RetryAfter != 17*time.Second {
+			t.Fatalf("HTTP %d: err = %v, want a RateLimitedError with RetryAfter 17s", status, err)
+		}
+		assertChainNoExactKey(t, err, key)
+	}
+}
+
+// TestResponseBodyWithKeyNeverLeaks has the vendor echo the key in error
+// and success bodies, including ones that fail to decode, and checks
+// Error(), every errors.Unwrap layer and every errors.As target.
+func TestResponseBodyWithKeyNeverLeaks(t *testing.T) {
+	bodies := []reply{
+		{status: 500, fixture: "error_api.json"},
+		{status: 400, body: `{"type":"error","error":{"type":"invalid_request_error","message":"key ` + testKey + ` rejected"}}`},
+		{status: 401, fixture: "error_authentication.json"},
+		{status: 429, fixture: "error_rate_limit.json"},
+		{status: 200, body: `{"type": ` + testKey + `}`},
+		{status: 200, body: testKey},
+		{status: 200, body: `{"type":"message","content":[{"type":"text","text":"` + testKey + `"}],"stop_reason":"` + testKey + `"}`},
+		{status: 200, body: `{"data": [` + testKey + `]}`},
+	}
+	for i, r := range bodies {
+		vs := newVendorServer(t, r)
+		p := newProvider(t, vs.URL)
+		_, genErr := p.Generate(context.Background(), schemaRequest())
+		_, listErr := p.ListModels(context.Background())
+		verifyErr := p.Verify(context.Background())
+		for _, err := range []error{genErr, listErr, verifyErr} {
+			if err == nil {
+				t.Fatalf("body %d: nil error", i)
+			}
+			assertNoSecret(t, err)
+			assertChainNoExactKey(t, err, testKey)
+		}
+	}
+	// A short key that decode errors quote from a malformed body.
+	const key = "Z"
+	vs := newVendorServerWithKey(t, key, reply{status: 200, body: `{"type": Z}`})
+	_, err := newProviderWithKey(t, vs.URL, key).Generate(context.Background(), textRequest())
+	var syntax *json.SyntaxError
+	if err == nil || errors.As(err, &syntax) {
+		t.Fatalf("err = %v, want no reachable *json.SyntaxError quoting the key", err)
+	}
+	assertChainNoExactKey(t, err, key)
+}
+
+// TestRedactKeepsChainMatches checks that the redaction backstop keeps
+// errors.Is and errors.As working through a chain that holds the key.
+func TestRedactKeepsChainMatches(t *testing.T) {
+	pe := llm.NewProviderError(500, []byte(`{"error":"down"}`), testKey)
+	rl := llm.NewRateLimitedError(time.Second, testKey)
+	inner := fmt.Errorf("decode %s: %w", testKey, llm.ErrBadOutput)
+	joined := errors.Join(inner, pe, rl, context.Canceled, &transportFailure{detail: "slow", kind: llm.ErrTimeout}, fmt.Errorf("HTTP 401: %w", llm.ErrAuth))
+	err := redact(fmt.Errorf("anthropic %s: %w", testKey, joined), testKey)
+	assertChainNoExactKey(t, err, testKey)
+	for _, target := range []error{llm.ErrBadOutput, llm.ErrProvider, llm.ErrRateLimited, llm.ErrTimeout, llm.ErrAuth, context.Canceled} {
+		if !errors.Is(err, target) {
+			t.Fatalf("errors.Is(%v, %v) = false", err, target)
+		}
+	}
+	var gotPE *llm.ProviderError
+	var gotRL *llm.RateLimitedError
+	if !errors.As(err, &gotPE) || gotPE != pe || !errors.As(err, &gotRL) || gotRL != rl {
+		t.Fatalf("errors.As lost a typed error in %v", err)
+	}
+	clean := errors.New("anthropic: generate: no model configured")
+	if redact(clean, testKey) != clean {
+		t.Fatal("redact wrapped an error that holds no key")
+	}
+}
+
+// TestRedactedErrorsFormatWithoutKey formats every error type that holds the
+// key, or a cause holding it, with %v, %+v and %#v; %#v prints GoString.
+func TestRedactedErrorsFormatWithoutKey(t *testing.T) {
+	const key = "sk-distinctive-anthropic-format-7c1e"
+	single := redact(fmt.Errorf("anthropic %s: %w", key, llm.ErrBadOutput), key)
+	joined := redact(errors.Join(fmt.Errorf("decode %s: %w", key, llm.ErrAuth), llm.NewProviderError(500, []byte("down "+key), key)), key)
+	if _, ok := single.(*redactedError); !ok {
+		t.Fatalf("single = %T, want *redactedError", single)
+	}
+	if _, ok := joined.(*redactedJoin); !ok {
+		t.Fatalf("joined = %T, want *redactedJoin", joined)
+	}
+	p := &Provider{apiKey: key}
+	transport := p.transportError(fmt.Errorf("dial %s: %w", key, context.DeadlineExceeded))
+	for _, err := range []error{single, joined, transport} {
+		for _, verb := range []string{"%v", "%+v", "%#v"} {
+			if got := fmt.Sprintf(verb, err); strings.Contains(got, key) {
+				t.Fatalf("%s of %T leaks the key: %q", verb, err, got)
+			}
+		}
+	}
+}

internal/ai/llm/anthropic/testdata/README.md

@@ -0,0 +1,41 @@
+# Anthropic adapter fixtures
+
+These are the Messages API response bodies the contract tests in
+`anthropic_test.go` replay. They are **not live captures**. Product AI is
+tested with fakes, and live vendor calls are opt-in and never use
+credentials, so no request was sent to Anthropic to make them. Each fixture
+is a sanitized adaptation of the response shapes in Anthropic's public API
+documentation:
+
+- Messages: <https://docs.anthropic.com/en/api/messages>
+- Tool use, including `tool_choice` `{type: tool}`:
+  <https://docs.anthropic.com/en/docs/build-with-claude/tool-use>
+- List models: <https://docs.anthropic.com/en/api/models-list>
+- Errors: <https://docs.anthropic.com/en/api/errors>
+
+Sanitizing:
+
+- IDs, request IDs, timestamps and token counts are illustrative values in
+  the documented format, not values from a real account.
+- Message content and tool input are replaced with MealQuest dinner text.
+- No real credential appears anywhere. `{{KEY}}` is a placeholder the tests
+  replace with a fake key, to prove the adapter redacts a key echoed back in
+  a vendor body.
+
+Below, *not in the public example* marks fields or values that were added
+for a test case and do not come from the documented example.
+
+| Fixture | Shape | Not in the public example |
+| --- | --- | --- |
+| `messages_tool_use.json` | Message with one `tool_use` block, `stop_reason: tool_use`, `usage` with cache fields. | The tool name and input. |
+| `messages_text.json` | Message with `text` blocks, `stop_reason: end_turn`. | A second text block, to test joining. |
+| `messages_max_tokens.json` | Message with a `text` block, `stop_reason: max_tokens`. | — |
+| `models_page1.json` | Models list page: `data`, `has_more: true`, `first_id`, `last_id`. | — |
+| `models_page2.json` | Last models list page, `has_more: false`. | The second model has no `display_name`, to test the fallback to `id`. |
+| `error_authentication.json` | Error, `authentication_error` (401). | The `{{KEY}}` text; added to test redaction. |
+| `error_permission.json` | Error, `permission_error` (403). | — |
+| `error_rate_limit.json` | Error, `rate_limit_error` (429). | The `{{KEY}}` text; added to test redaction. |
+| `error_overloaded.json` | Error, `overloaded_error` (529). | — |
+| `error_not_found.json` | Error, `not_found_error` (404). | — |
+| `error_invalid_request.json` | Error, `invalid_request_error` (400). | — |
+| `error_api.json` | Error, `api_error` (500). | The `x-api-key: {{KEY}}` text; added to test redaction. |

internal/ai/llm/anthropic/testdata/error_api.json

@@ -0,0 +1 @@
+{"type": "error", "error": {"type": "api_error", "message": "An unexpected error has occurred internal to Anthropic's systems. x-api-key: {{KEY}}"}, "request_id": "req_011CSHoEeqs5C35K2UUqR7G4"}

internal/ai/llm/anthropic/testdata/error_authentication.json

@@ -0,0 +1 @@
+{"type": "error", "error": {"type": "authentication_error", "message": "invalid x-api-key: {{KEY}}"}, "request_id": "req_011CSHoEeqs5C35K2UUqR7Fy"}

internal/ai/llm/anthropic/testdata/error_invalid_request.json

@@ -0,0 +1 @@
+{"type": "error", "error": {"type": "invalid_request_error", "message": "max_tokens: Field required"}, "request_id": "req_011CSHoEeqs5C35K2UUqR7G3"}

internal/ai/llm/anthropic/testdata/error_not_found.json

@@ -0,0 +1 @@
+{"type": "error", "error": {"type": "not_found_error", "message": "model: claude-nonexistent"}, "request_id": "req_011CSHoEeqs5C35K2UUqR7G2"}

internal/ai/llm/anthropic/testdata/error_overloaded.json

@@ -0,0 +1 @@
+{"type": "error", "error": {"type": "overloaded_error", "message": "Overloaded"}, "request_id": "req_011CSHoEeqs5C35K2UUqR7G1"}

internal/ai/llm/anthropic/testdata/error_permission.json

@@ -0,0 +1 @@
+{"type": "error", "error": {"type": "permission_error", "message": "Your API key does not have permission to use the specified resource."}, "request_id": "req_011CSHoEeqs5C35K2UUqR7Fz"}

internal/ai/llm/anthropic/testdata/error_rate_limit.json

@@ -0,0 +1 @@
+{"type": "error", "error": {"type": "rate_limit_error", "message": "Number of request tokens has exceeded your per-minute rate limit for key {{KEY}}"}, "request_id": "req_011CSHoEeqs5C35K2UUqR7G0"}

internal/ai/llm/anthropic/testdata/messages_max_tokens.json

@@ -0,0 +1,12 @@
+{
+  "id": "msg_01XFDUDYJgAACzvnptvVoYEL",
+  "type": "message",
+  "role": "assistant",
+  "model": "claude-sonnet-5",
+  "content": [
+    {"type": "text", "text": "Here are some Side quests for Our kitchen"}
+  ],
+  "stop_reason": "max_tokens",
+  "stop_sequence": null,
+  "usage": {"input_tokens": 472, "output_tokens": 400}
+}

internal/ai/llm/anthropic/testdata/messages_text.json

@@ -0,0 +1,18 @@
+{
+  "id": "msg_013Zva2CMHLNnXjNJJKqJ2EF",
+  "type": "message",
+  "role": "assistant",
+  "model": "claude-sonnet-5",
+  "content": [
+    {"type": "text", "text": "Try a crock pot chili: "},
+    {"type": "text", "text": "it is a Quick dinner."}
+  ],
+  "stop_reason": "end_turn",
+  "stop_sequence": null,
+  "usage": {
+    "input_tokens": 2095,
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 0,
+    "output_tokens": 503
+  }
+}

internal/ai/llm/anthropic/testdata/messages_tool_use.json

@@ -0,0 +1,22 @@
+{
+  "id": "msg_01Aq9w938a90dw8q",
+  "type": "message",
+  "role": "assistant",
+  "model": "claude-sonnet-5",
+  "content": [
+    {
+      "type": "tool_use",
+      "id": "toolu_01A09q90qw90lq917835lq9",
+      "name": "side_quests",
+      "input": {"dinners": [{"name": "Sheet-pan gnocchi", "why": "Like your Regular tray bake, but quicker."}]}
+    }
+  ],
+  "stop_reason": "tool_use",
+  "stop_sequence": null,
+  "usage": {
+    "input_tokens": 472,
+    "cache_creation_input_tokens": 0,
+    "cache_read_input_tokens": 0,
+    "output_tokens": 61
+  }
+}

internal/ai/llm/anthropic/testdata/models_page1.json

@@ -0,0 +1,13 @@
+{
+  "data": [
+    {
+      "type": "model",
+      "id": "claude-sonnet-5",
+      "display_name": "Claude Sonnet 5",
+      "created_at": "2026-02-24T00:00:00Z"
+    }
+  ],
+  "has_more": true,
+  "first_id": "claude-sonnet-5",
+  "last_id": "claude-sonnet-5"
+}

internal/ai/llm/anthropic/testdata/models_page2.json

@@ -0,0 +1,18 @@
+{
+  "data": [
+    {
+      "type": "model",
+      "id": "claude-haiku-4-5-20251001",
+      "display_name": "Claude Haiku 4.5",
+      "created_at": "2025-10-01T00:00:00Z"
+    },
+    {
+      "type": "model",
+      "id": "claude-opus-5-5",
+      "created_at": "2026-05-01T00:00:00Z"
+    }
+  ],
+  "has_more": false,
+  "first_id": "claude-haiku-4-5-20251001",
+  "last_id": "claude-opus-5-5"
+}

internal/ai/llm/errors.go

@@ -0,0 +1,132 @@
+package llm
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+var (
+	// ErrAuth means the vendor rejected the credentials.
+	ErrAuth = errors.New("llm: authentication failed")
+	// ErrRateLimited means the vendor throttled the request. The concrete
+	// error is a *RateLimitedError carrying the requested wait.
+	ErrRateLimited = errors.New("llm: rate limited")
+	// ErrTimeout means the request did not finish within its timeout.
+	ErrTimeout = errors.New("llm: request timed out")
+	// ErrBadOutput means the model replied but the reply is unusable, e.g.
+	// structured output that does not parse.
+	ErrBadOutput = errors.New("llm: unusable model output")
+	// ErrProvider means the vendor returned an unexpected HTTP status. The
+	// concrete error is a *ProviderError carrying the status and a redacted
+	// body excerpt.
+	ErrProvider = errors.New("llm: provider error")
+)
+
+// RateLimitedError is a throttled request. It matches ErrRateLimited.
+// Adapters build it with NewRateLimitedError so its text never holds their
+// credential.
+type RateLimitedError struct {
+	// RetryAfter is how long the vendor asked callers to wait; 0 means it
+	// did not say.
+	RetryAfter time.Duration
+	// text is the redacted Error text set by NewRateLimitedError; "" means
+	// the error was built without a credential.
+	text string
+}
+
+// NewRateLimitedError returns the error for a throttled request. secret is
+// the credential sent with the request, or "" when the request sent none.
+// Every occurrence of a non-empty secret is removed from the error text
+// when it is built, even where the fixed text happens to spell it, and the
+// secret itself is not kept.
+func NewRateLimitedError(retryAfter time.Duration, secret string) *RateLimitedError {
+	e := &RateLimitedError{RetryAfter: retryAfter}
+	e.text = Redact(e.Error(), secret)
+	return e
+}
+
+func (e *RateLimitedError) Error() string {
+	if e.text != "" {
+		return e.text
+	}
+	if e.RetryAfter == 0 {
+		return ErrRateLimited.Error()
+	}
+	return fmt.Sprintf("%s: retry after %v", ErrRateLimited, e.RetryAfter)
+}
+
+// Is reports whether target is ErrRateLimited.
+func (e *RateLimitedError) Is(target error) bool { return target == ErrRateLimited }
+
+// MaxBodyExcerpt is the longest response-body excerpt, in bytes, a
+// ProviderError keeps.
+const MaxBodyExcerpt = 512
+
+// redactionMarker replaces each secret in redacted text, unless the marker
+// would itself hold the secret.
+const redactionMarker = "[REDACTED]"
+
+// Redact returns s with every occurrence of a non-empty secret removed. Each
+// occurrence becomes "[REDACTED]" when the result then holds no secret;
+// otherwise, because the marker contains the secret or joins with its
+// neighbours to form it, occurrences are deleted until none remains. The
+// result never contains secret.
+func Redact(s, secret string) string {
+	if secret == "" {
+		return s
+	}
+	if out := strings.ReplaceAll(s, secret, redactionMarker); !strings.Contains(out, secret) {
+		return out
+	}
+	for strings.Contains(s, secret) {
+		s = strings.ReplaceAll(s, secret, "")
+	}
+	return s
+}
+
+// ProviderError is an unexpected HTTP status from the vendor. It matches
+// ErrProvider. Build it with NewProviderError, which redacts the body.
+type ProviderError struct {
+	status int
+	body   string
+	text   string
+}
+
+// NewProviderError returns the error for an unexpected HTTP status. It
+// always keeps a body excerpt of at most MaxBodyExcerpt bytes. secret is the
+// credential sent with the request, or "" when the request sent none; every
+// occurrence of a non-empty secret in body is removed by Redact before the
+// body is cut, so no part of it survives, and again after the cut, so the
+// truncation mark cannot complete it. It is removed from the complete error
+// text too, even where the fixed text happens to spell it, and the secret
+// itself is not kept.
+func NewProviderError(status int, body []byte, secret string) *ProviderError {
+	s := strings.TrimSpace(Redact(string(body), secret))
+	if len(s) > MaxBodyExcerpt {
+		cut := MaxBodyExcerpt
+		for cut > 0 && !utf8.RuneStart(s[cut]) {
+			cut--
+		}
+		s = Redact(s[:cut]+"…", secret)
+	}
+	text := fmt.Sprintf("%s: HTTP %d", ErrProvider, status)
+	if s != "" {
+		text += ": " + s
+	}
+	return &ProviderError{status: status, body: s, text: Redact(text, secret)}
+}
+
+// Status returns the HTTP status code.
+func (e *ProviderError) Status() int { return e.status }
+
+// Body returns the redacted, truncated response-body excerpt; it is empty
+// when the vendor sent no body.
+func (e *ProviderError) Body() string { return e.body }
+
+func (e *ProviderError) Error() string { return e.text }
+
+// Is reports whether target is ErrProvider.
+func (e *ProviderError) Is(target error) bool { return target == ErrProvider }

internal/ai/llm/errors_test.go

@@ -0,0 +1,198 @@
+package llm
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestSentinelErrorsMatchWhenWrapped(t *testing.T) {
+	for _, sentinel := range []error{ErrAuth, ErrTimeout, ErrBadOutput} {
+		wrapped := fmt.Errorf("openai: generate: %w", sentinel)
+		if !errors.Is(wrapped, sentinel) {
+			t.Errorf("errors.Is(%v, %v) = false", wrapped, sentinel)
+		}
+		for _, other := range []error{ErrAuth, ErrTimeout, ErrBadOutput, ErrRateLimited, ErrProvider} {
+			if other != sentinel && errors.Is(wrapped, other) {
+				t.Errorf("errors.Is(%v, %v) = true", wrapped, other)
+			}
+		}
+	}
+}
+
+func TestRateLimitedError(t *testing.T) {
+	err := fmt.Errorf("anthropic: %w", &RateLimitedError{RetryAfter: 30 * time.Second})
+	if !errors.Is(err, ErrRateLimited) {
+		t.Fatal("errors.Is(err, ErrRateLimited) = false")
+	}
+	if errors.Is(err, ErrProvider) || errors.Is(err, ErrAuth) {
+		t.Fatal("rate-limited error matches an unrelated sentinel")
+	}
+	var rl *RateLimitedError
+	if !errors.As(err, &rl) {
+		t.Fatal("errors.As(err, *RateLimitedError) = false")
+	}
+	if rl.RetryAfter != 30*time.Second {
+		t.Fatalf("RetryAfter = %v, want 30s", rl.RetryAfter)
+	}
+	if got := err.Error(); got != "anthropic: llm: rate limited: retry after 30s" {
+		t.Fatalf("Error() = %q", got)
+	}
+	if got := (&RateLimitedError{}).Error(); got != "llm: rate limited" {
+		t.Fatalf("Error() without RetryAfter = %q", got)
+	}
+}
+
+func TestProviderError(t *testing.T) {
+	err := fmt.Errorf("gemini: %w", NewProviderError(503, []byte(` {"error":"overloaded"} `), "sk-test"))
+	if !errors.Is(err, ErrProvider) {
+		t.Fatal("errors.Is(err, ErrProvider) = false")
+	}
+	if errors.Is(err, ErrRateLimited) || errors.Is(err, ErrAuth) {
+		t.Fatal("provider error matches an unrelated sentinel")
+	}
+	var pe *ProviderError
+	if !errors.As(err, &pe) {
+		t.Fatal("errors.As(err, *ProviderError) = false")
+	}
+	if pe.Status() != 503 || pe.Body() != `{"error":"overloaded"}` {
+		t.Fatalf("Status, Body = %d, %q", pe.Status(), pe.Body())
+	}
+	if got := err.Error(); got != `gemini: llm: provider error: HTTP 503: {"error":"overloaded"}` {
+		t.Fatalf("Error() = %q", got)
+	}
+	if got := NewProviderError(500, nil, "sk-test").Error(); got != "llm: provider error: HTTP 500" {
+		t.Fatalf("Error() without body = %q", got)
+	}
+}
+
+func TestProviderErrorRedactsSecrets(t *testing.T) {
+	const key = "sk-live-0123456789abcdef"
+	body := []byte(`{"error":"invalid key sk-live-0123456789abcdef","echo":"Bearer sk-live-0123456789abcdef"}`)
+	pe := NewProviderError(400, body, key)
+	for _, s := range []string{pe.Error(), pe.Body()} {
+		if strings.Contains(s, key) {
+			t.Fatalf("secret leaked: %q", s)
+		}
+	}
+	want := `{"error":"invalid key [REDACTED]","echo":"Bearer [REDACTED]"}`
+	if pe.Body() != want {
+		t.Fatalf("Body() = %q, want %q", pe.Body(), want)
+	}
+}
+
+func TestProviderErrorRedactsBeforeTruncating(t *testing.T) {
+	const key = "sk-secret-straddling-the-cut"
+	// The key starts just before the excerpt limit, so truncating first
+	// would leave its prefix in the excerpt.
+	body := strings.Repeat("x", MaxBodyExcerpt-5) + key
+	pe := NewProviderError(500, []byte(body), key)
+	if strings.Contains(pe.Body(), "sk-se") {
+		t.Fatalf("secret prefix leaked: %q", pe.Body())
+	}
+}
+
+func TestProviderErrorTruncatesOnRuneBoundary(t *testing.T) {
+	body := strings.Repeat("a", MaxBodyExcerpt-1) + "é" + strings.Repeat("b", 100)
+	pe := NewProviderError(500, []byte(body), "sk-test")
+	want := strings.Repeat("a", MaxBodyExcerpt-1) + "…"
+	if pe.Body() != want {
+		t.Fatalf("Body() has %d bytes, want %d", len(pe.Body()), len(want))
+	}
+}
+
+func TestProviderErrorKeepsBoundedBodyWithoutSecret(t *testing.T) {
+	body := []byte(` {"error":"model \"llama9\" not found"} `)
+	pe := NewProviderError(404, body, "")
+	if pe.Body() != `{"error":"model \"llama9\" not found"}` {
+		t.Fatalf("Body() = %q", pe.Body())
+	}
+	if got := pe.Error(); got != `llm: provider error: HTTP 404: {"error":"model \"llama9\" not found"}` {
+		t.Fatalf("Error() = %q", got)
+	}
+	long := NewProviderError(500, []byte(strings.Repeat("x", 4*MaxBodyExcerpt)), "")
+	if want := strings.Repeat("x", MaxBodyExcerpt) + "…"; long.Body() != want {
+		t.Fatalf("Body() has %d bytes, want %d", len(long.Body()), len(want))
+	}
+}
+
+func TestRedactNeverLeavesSecret(t *testing.T) {
+	cases := []struct{ s, secret, want string }{
+		{"key sk-1 and Bearer sk-1", "sk-1", "key [REDACTED] and Bearer [REDACTED]"},
+		{"no secret here", "sk-1", "no secret here"},
+		{"x", "", "x"},
+		// The marker holds the secret, so occurrences are deleted.
+		{"rejected REDACTED", "REDACTED", "rejected "},
+		{"A then A", "A", " then "},
+		// The marker joins with a neighbour to form the secret.
+		{"]]aa", "]a", ""},
+		// The marker holds the secret and deleting once leaves a new one.
+		{"DDAA", "DA", ""},
+		{"aabb", "ab", "a[REDACTED]b"},
+	}
+	for _, c := range cases {
+		if got := Redact(c.s, c.secret); got != c.want {
+			t.Errorf("Redact(%q, %q) = %q, want %q", c.s, c.secret, got, c.want)
+		}
+	}
+}
+
+func TestProviderErrorWithMarkerSecretNeverLeaksSecret(t *testing.T) {
+	const key = "REDACTED"
+	pe := NewProviderError(500, []byte(`{"error":"bad key REDACTED","echo":"Bearer REDACTED"}`), key)
+	for _, s := range []string{pe.Error(), pe.Body()} {
+		if strings.Contains(s, key) {
+			t.Fatalf("secret leaked: %q", s)
+		}
+	}
+	if want := `{"error":"bad key ","echo":"Bearer "}`; pe.Body() != want {
+		t.Fatalf("Body() = %q, want %q", pe.Body(), want)
+	}
+}
+
+func TestProviderErrorTruncationMarkCannotCompleteSecret(t *testing.T) {
+	const key = "z…"
+	body := strings.Repeat("a", MaxBodyExcerpt-1) + "z" + strings.Repeat("b", 10)
+	if pe := NewProviderError(500, []byte(body), key); strings.Contains(pe.Body(), key) {
+		t.Fatalf("secret leaked: %q", pe.Body())
+	}
+}
+
+func TestProviderErrorWithFixedWordSecretNeverLeaksSecret(t *testing.T) {
+	const secret = "HTTP"
+	pe := NewProviderError(500, []byte(`{"error":"HTTP down"}`), secret)
+	if strings.Contains(pe.Error(), secret) || strings.Contains(pe.Body(), secret) {
+		t.Fatalf("secret leaked: Error %q, Body %q", pe.Error(), pe.Body())
+	}
+	if got := NewProviderError(500, nil, secret).Error(); got != "llm: provider error: [REDACTED] 500" {
+		t.Fatalf("Error() without body = %q", got)
+	}
+}
+
+func TestRateLimitedErrorWithFixedWordSecretNeverLeaksSecret(t *testing.T) {
+	for _, secret := range []string{"rate", "retry after"} {
+		for _, wait := range []time.Duration{0, 30 * time.Second} {
+			rl := NewRateLimitedError(wait, secret)
+			if strings.Contains(rl.Error(), secret) {
+				t.Fatalf("secret %q leaked: %q", secret, rl.Error())
+			}
+			if rl.RetryAfter != wait || !errors.Is(rl, ErrRateLimited) {
+				t.Fatalf("NewRateLimitedError(%v) = %+v", wait, rl)
+			}
+		}
+	}
+}
+
+func TestTypedErrorsDoNotKeepSecret(t *testing.T) {
+	const secret = "sk-live-0123456789abcdef"
+	for _, err := range []error{
+		NewProviderError(500, []byte("down "+secret), secret),
+		NewRateLimitedError(30*time.Second, secret),
+	} {
+		if got := fmt.Sprintf("%#v %+v", err, err); strings.Contains(got, secret) {
+			t.Fatalf("formatting %T leaks the secret: %q", err, got)
+		}
+	}
+}

internal/ai/llm/fake.go

@@ -0,0 +1,127 @@
+package llm
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"slices"
+	"sync"
+)
+
+// Fake is a scripted Provider for tests. Each method returns its queued
+// results in order, one per call, and records every Request Generate
+// receives. A call with nothing left in its queue fails, so an unexpected
+// call is never silently answered. It is safe for concurrent use.
+type Fake struct {
+	mu       sync.Mutex
+	generate []GenerateResult
+	models   []ListModelsResult
+	verify   []error
+	requests []Request
+}
+
+var _ Provider = (*Fake)(nil)
+
+// GenerateResult is one scripted Generate outcome.
+type GenerateResult struct {
+	Response Response
+	Err      error
+}
+
+// ListModelsResult is one scripted ListModels outcome.
+type ListModelsResult struct {
+	Models []Model
+	Err    error
+}
+
+// QueueGenerate appends results to the Generate script.
+func (f *Fake) QueueGenerate(results ...GenerateResult) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.generate = append(f.generate, results...)
+}
+
+// QueueListModels appends results to the ListModels script.
+func (f *Fake) QueueListModels(results ...ListModelsResult) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.models = append(f.models, results...)
+}
+
+// QueueVerify appends results to the Verify script; a nil entry is success.
+func (f *Fake) QueueVerify(results ...error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.verify = append(f.verify, results...)
+}
+
+// Generate records req and returns the next scripted result.
+func (f *Fake) Generate(_ context.Context, req Request) (Response, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.requests = append(f.requests, cloneRequest(req))
+	if len(f.generate) == 0 {
+		return Response{}, fmt.Errorf("llm: fake: unscripted Generate call %d", len(f.requests))
+	}
+	r := f.generate[0]
+	f.generate = f.generate[1:]
+	return r.Response, r.Err
+}
+
+// ListModels returns the next scripted result.
+func (f *Fake) ListModels(context.Context) ([]Model, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(f.models) == 0 {
+		return nil, fmt.Errorf("llm: fake: unscripted ListModels call")
+	}
+	r := f.models[0]
+	f.models = f.models[1:]
+	return slices.Clone(r.Models), r.Err
+}
+
+// Verify returns the next scripted result.
+func (f *Fake) Verify(context.Context) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(f.verify) == 0 {
+		return fmt.Errorf("llm: fake: unscripted Verify call")
+	}
+	err := f.verify[0]
+	f.verify = f.verify[1:]
+	return err
+}
+
+// Requests returns a copy of every Request Generate received, in order.
+func (f *Fake) Requests() []Request {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := make([]Request, len(f.requests))
+	for i, r := range f.requests {
+		out[i] = cloneRequest(r)
+	}
+	return out
+}
+
+// Remaining reports how many scripted results of each kind are unused, so a
+// test can assert its script was consumed.
+func (f *Fake) Remaining() (generate, listModels, verify int) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.generate), len(f.models), len(f.verify)
+}
+
+// cloneRequest deep-copies r so a recorded Request is unaffected by later
+// changes the caller makes to its slices and pointers.
+func cloneRequest(r Request) Request {
+	r.Messages = slices.Clone(r.Messages)
+	if r.Temperature != nil {
+		t := *r.Temperature
+		r.Temperature = &t
+	}
+	if r.Schema != nil {
+		s := JSONSchema{Name: r.Schema.Name, Schema: json.RawMessage(slices.Clone([]byte(r.Schema.Schema)))}
+		r.Schema = &s
+	}
+	return r
+}

internal/ai/llm/fake_test.go

@@ -0,0 +1,138 @@
+package llm
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestFakeGenerateReturnsScriptInOrder(t *testing.T) {
+	ctx := context.Background()
+	var f Fake
+	f.QueueGenerate(
+		GenerateResult{Response: Response{Text: "first", Model: "m1"}},
+		GenerateResult{Err: &RateLimitedError{RetryAfter: time.Second}},
+	)
+	f.QueueGenerate(GenerateResult{Response: Response{JSON: json.RawMessage(`{"ok":true}`), FinishReason: "stop"}})
+
+	req := Request{Messages: []Message{{Role: RoleUser, Content: "one"}}}
+	resp, err := f.Generate(ctx, req)
+	if err != nil || resp.Text != "first" || resp.Model != "m1" {
+		t.Fatalf("call 1 = %+v, %v", resp, err)
+	}
+	if _, err := f.Generate(ctx, req); !errors.Is(err, ErrRateLimited) {
+		t.Fatalf("call 2 err = %v, want ErrRateLimited", err)
+	}
+	resp, err = f.Generate(ctx, req)
+	if err != nil || string(resp.JSON) != `{"ok":true}` || resp.FinishReason != "stop" {
+		t.Fatalf("call 3 = %+v, %v", resp, err)
+	}
+	if _, err := f.Generate(ctx, req); err == nil {
+		t.Fatal("unscripted call 4 succeeded")
+	}
+	if g, l, v := f.Remaining(); g != 0 || l != 0 || v != 0 {
+		t.Fatalf("Remaining() = %d, %d, %d", g, l, v)
+	}
+	if n := len(f.Requests()); n != 4 {
+		t.Fatalf("recorded %d requests, want 4 (unscripted calls are recorded too)", n)
+	}
+}
+
+func TestFakeRecordsRequests(t *testing.T) {
+	var f Fake
+	f.QueueGenerate(GenerateResult{}, GenerateResult{})
+	temp := 0.2
+	first := Request{
+		System:      "be brief",
+		Messages:    []Message{{Role: RoleUser, Content: "plan dinners"}},
+		Temperature: &temp,
+		MaxTokens:   100,
+		Schema:      &JSONSchema{Name: "plan", Schema: json.RawMessage(`{"type":"object"}`)},
+		Timeout:     5 * time.Second,
+	}
+	if _, err := f.Generate(context.Background(), first); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := f.Generate(context.Background(), Request{System: "second"}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Later changes by the caller must not alter what was recorded.
+	first.Messages[0].Content = "changed"
+	temp = 1
+	first.Schema.Schema[2] = 'X'
+
+	got := f.Requests()
+	if len(got) != 2 || got[1].System != "second" {
+		t.Fatalf("Requests() = %+v", got)
+	}
+	r := got[0]
+	if r.System != "be brief" || r.Messages[0].Content != "plan dinners" || *r.Temperature != 0.2 ||
+		r.MaxTokens != 100 || r.Schema.Name != "plan" || string(r.Schema.Schema) != `{"type":"object"}` ||
+		r.Timeout != 5*time.Second {
+		t.Fatalf("recorded request = %+v", r)
+	}
+
+	// Changing a returned copy must not alter the record either.
+	got[0].Messages[0].Content = "mutated"
+	if f.Requests()[0].Messages[0].Content != "plan dinners" {
+		t.Fatal("Requests() returned shared state")
+	}
+}
+
+func TestFakeListModelsAndVerify(t *testing.T) {
+	ctx := context.Background()
+	var f Fake
+	f.QueueListModels(
+		ListModelsResult{Models: []Model{{ID: "a", DisplayName: "A"}, {ID: "b", DisplayName: "b"}}},
+		ListModelsResult{Err: ErrAuth},
+	)
+	f.QueueVerify(nil, fmt.Errorf("wrapped: %w", ErrAuth))
+
+	models, err := f.ListModels(ctx)
+	if err != nil || len(models) != 2 || models[0].ID != "a" {
+		t.Fatalf("ListModels 1 = %+v, %v", models, err)
+	}
+	if _, err := f.ListModels(ctx); !errors.Is(err, ErrAuth) {
+		t.Fatalf("ListModels 2 err = %v, want ErrAuth", err)
+	}
+	if _, err := f.ListModels(ctx); err == nil {
+		t.Fatal("unscripted ListModels succeeded")
+	}
+	if err := f.Verify(ctx); err != nil {
+		t.Fatalf("Verify 1 = %v", err)
+	}
+	if err := f.Verify(ctx); !errors.Is(err, ErrAuth) {
+		t.Fatalf("Verify 2 = %v, want ErrAuth", err)
+	}
+	if err := f.Verify(ctx); err == nil {
+		t.Fatal("unscripted Verify succeeded")
+	}
+}
+
+func TestFakeConcurrentUse(t *testing.T) {
+	const n = 50
+	var f Fake
+	for i := range n {
+		f.QueueGenerate(GenerateResult{Response: Response{Text: fmt.Sprint(i)}})
+	}
+	var wg sync.WaitGroup
+	for range n {
+		wg.Go(func() {
+			if _, err := f.Generate(context.Background(), Request{}); err != nil {
+				t.Error(err)
+			}
+		})
+	}
+	wg.Wait()
+	if len(f.Requests()) != n {
+		t.Fatalf("recorded %d requests, want %d", len(f.Requests()), n)
+	}
+	if g, _, _ := f.Remaining(); g != 0 {
+		t.Fatalf("%d Generate results unused", g)
+	}
+}

internal/ai/llm/llm.go

@@ -0,0 +1,133 @@
+// Package llm is the single interface MealQuest uses to talk to a language
+// model. Every vendor adapter implements Provider over plain net/http (no
+// vendor SDKs) and reports failures with this package's typed errors, so
+// callers decide what to do from errors.Is and errors.As alone.
+//
+// Errors from this package and its adapters never contain an API key.
+package llm
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+)
+
+// Provider is a language-model vendor.
+type Provider interface {
+	// Generate sends one request and returns the model's reply.
+	Generate(ctx context.Context, req Request) (Response, error)
+	// ListModels returns the models the configured credentials can use.
+	ListModels(ctx context.Context) ([]Model, error)
+	// Verify checks that the configured credentials are accepted.
+	Verify(ctx context.Context) error
+}
+
+// Role is the author of a Message.
+type Role string
+
+// The roles a Message may have. The system prompt is Request.System, not a
+// message.
+const (
+	RoleUser      Role = "user"
+	RoleAssistant Role = "assistant"
+)
+
+// Message is one turn of a conversation.
+type Message struct {
+	Role    Role
+	Content string
+}
+
+// JSONSchema is a named structured-output contract: when a Request carries
+// one, the model must reply with JSON matching Schema.
+type JSONSchema struct {
+	// Name identifies the contract to the vendor, e.g. "side_quests".
+	Name string
+	// Schema is a JSON Schema object.
+	Schema json.RawMessage
+}
+
+// Request is one generation request.
+type Request struct {
+	// System is the system prompt; empty means none.
+	System string
+	// Messages is the conversation, oldest first. It must not be empty.
+	Messages []Message
+	// Temperature is the sampling temperature; nil means the vendor default.
+	Temperature *float64
+	// MaxTokens caps the reply length; 0 means the vendor default.
+	MaxTokens int
+	// Schema, when set, requests structured output; the reply is then in
+	// Response.JSON.
+	Schema *JSONSchema
+	// Timeout bounds the request; 0 means only ctx bounds it.
+	Timeout time.Duration
+}
+
+// Validate reports whether r is well formed. Adapters call it before
+// contacting the vendor. Its errors never quote the request's text, such as
+// a role or schema name: any of it may equal the API key.
+func (r Request) Validate() error {
+	if len(r.Messages) == 0 {
+		return errors.New("llm: request has no messages")
+	}
+	for i, m := range r.Messages {
+		if m.Role != RoleUser && m.Role != RoleAssistant {
+			return fmt.Errorf("llm: message %d has an unknown role", i)
+		}
+	}
+	if r.Temperature != nil && *r.Temperature < 0 {
+		return fmt.Errorf("llm: temperature %v is negative", *r.Temperature)
+	}
+	if r.MaxTokens < 0 {
+		return fmt.Errorf("llm: max tokens %d is negative", r.MaxTokens)
+	}
+	if r.Timeout < 0 {
+		return fmt.Errorf("llm: timeout %v is negative", r.Timeout)
+	}
+	if r.Schema != nil {
+		if r.Schema.Name == "" {
+			return errors.New("llm: schema has no name")
+		}
+		var obj map[string]json.RawMessage
+		if err := json.Unmarshal(r.Schema.Schema, &obj); err != nil || obj == nil {
+			return errors.New("llm: schema is not a JSON object")
+		}
+	}
+	return nil
+}
+
+// Usage is the token count of one Generate call.
+type Usage struct {
+	InputTokens  int
+	OutputTokens int
+}
+
+// Total returns InputTokens + OutputTokens.
+func (u Usage) Total() int { return u.InputTokens + u.OutputTokens }
+
+// Response is the model's reply to a Request.
+type Response struct {
+	// Text is the reply text.
+	Text string
+	// JSON is the structured reply when the Request carried a Schema, and
+	// nil otherwise.
+	JSON json.RawMessage
+	// Usage is the tokens the call consumed.
+	Usage Usage
+	// Model is the model that answered, as the vendor reports it.
+	Model string
+	// FinishReason is why generation stopped, as the vendor reports it.
+	FinishReason string
+}
+
+// Model is a model a Provider offers.
+type Model struct {
+	// ID is the vendor's model identifier, used in requests.
+	ID string
+	// DisplayName is a human-readable name; it equals ID when the vendor
+	// gives none.
+	DisplayName string
+}

internal/ai/llm/llm_test.go

@@ -0,0 +1,44 @@
+package llm
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestRequestValidate(t *testing.T) {
+	neg := -0.1
+	valid := func() Request {
+		return Request{
+			Messages: []Message{{Role: RoleUser, Content: "hi"}, {Role: RoleAssistant, Content: "hello"}},
+			Schema:   &JSONSchema{Name: "plan", Schema: json.RawMessage(`{"type":"object"}`)},
+		}
+	}
+	if err := valid().Validate(); err != nil {
+		t.Fatalf("valid request: %v", err)
+	}
+	cases := map[string]func(*Request){
+		"no messages":    func(r *Request) { r.Messages = nil },
+		"unknown role":   func(r *Request) { r.Messages[0].Role = "system" },
+		"negative temp":  func(r *Request) { r.Temperature = &neg },
+		"negative max":   func(r *Request) { r.MaxTokens = -1 },
+		"negative time":  func(r *Request) { r.Timeout = -1 },
+		"unnamed schema": func(r *Request) { r.Schema.Name = "" },
+		"schema array":   func(r *Request) { r.Schema.Schema = json.RawMessage(`[]`) },
+		"schema null":    func(r *Request) { r.Schema.Schema = json.RawMessage(`null`) },
+		"schema invalid": func(r *Request) { r.Schema.Schema = json.RawMessage(`{`) },
+		"schema empty":   func(r *Request) { r.Schema.Schema = nil },
+	}
+	for name, mutate := range cases {
+		r := valid()
+		mutate(&r)
+		if err := r.Validate(); err == nil {
+			t.Errorf("%s: Validate() = nil", name)
+		}
+	}
+}
+
+func TestUsageTotal(t *testing.T) {
+	if got := (Usage{InputTokens: 12, OutputTokens: 30}).Total(); got != 42 {
+		t.Fatalf("Total() = %d, want 42", got)
+	}
+}

internal/ai/llm/openai/openai.go

@@ -0,0 +1,602 @@
+// Package openai is the llm.Provider adapter for OpenAI-compatible chat
+// APIs: OpenAI itself, OpenRouter and Ollama's /v1 endpoint. It calls
+// POST {base}/chat/completions and GET {base}/models over plain net/http.
+//
+// The adapter never logs, and no error it returns contains the API key or
+// the Authorization header value: errors do not quote caller- or
+// vendor-supplied text, and every exported method passes its error through
+// redact as a backstop.
+package openai
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"reflect"
+	"strconv"
+	"strings"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
+)
+
+// StructuredOutput is how the adapter asks the vendor for JSON when a
+// Request carries a Schema. Which mode a vendor and model support comes
+// from its preset.
+type StructuredOutput string
+
+const (
+	// JSONSchema sends response_format {type: json_schema, strict: true}
+	// with the Request's schema.
+	JSONSchema StructuredOutput = "json_schema"
+	// JSONObject sends response_format {type: json_object} and puts the
+	// schema in the system prompt.
+	JSONObject StructuredOutput = "json_object"
+	// PromptOnly sends no response_format, puts the schema in the system
+	// prompt and takes the first JSON object found in the reply.
+	PromptOnly StructuredOutput = "prompt_only"
+)
+
+// Config configures a Provider.
+type Config struct {
+	// BaseURL is the API root the endpoint paths are appended to, e.g.
+	// "https://api.openai.com/v1", "https://openrouter.ai/api/v1" or
+	// "http://ollama:11434/v1".
+	BaseURL string
+	// APIKey is sent as "Authorization: Bearer <APIKey>". Empty sends no
+	// Authorization header, for endpoints such as Ollama that need none.
+	APIKey string
+	// Model is the model Generate requests. ListModels and Verify do not
+	// need it.
+	Model string
+	// Headers are extra request headers, e.g. OpenRouter's HTTP-Referer and
+	// X-Title. An Accept header replaces the default "application/json".
+	// Headers the adapter or net/http set themselves (see managedHeaders)
+	// are rejected.
+	Headers map[string]string
+	// StructuredOutput is how JSON is requested when a Request has a Schema.
+	StructuredOutput StructuredOutput
+}
+
+// Provider is an OpenAI-compatible llm.Provider.
+type Provider struct {
+	base    string
+	apiKey  string
+	model   string
+	headers http.Header
+	mode    StructuredOutput
+	client  *http.Client
+}
+
+var _ llm.Provider = (*Provider)(nil)
+
+// New validates cfg and returns a Provider.
+func New(cfg Config) (*Provider, error) {
+	p, err := newFromConfig(cfg)
+	if err != nil {
+		return nil, redact(err, cfg.APIKey)
+	}
+	return p, nil
+}
+
+func newFromConfig(cfg Config) (*Provider, error) {
+	// Base URL errors never echo the URL: a rejected one may carry a
+	// credential.
+	u, err := url.Parse(cfg.BaseURL)
+	if err != nil {
+		return nil, errors.New("openai: base URL does not parse")
+	}
+	if (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
+		return nil, errors.New("openai: base URL must be an absolute http or https URL")
+	}
+	// A trailing "?" or "#" parses to an empty query or fragment, yet the
+	// endpoint path appended to it would land in the query or fragment.
+	if u.User != nil || strings.ContainsAny(cfg.BaseURL, "?#") {
+		return nil, errors.New("openai: base URL must not carry credentials, a query or a fragment")
+	}
+	// No error from New quotes caller-supplied text or a name derived from
+	// it: any such text may equal or contain the API key, and redaction
+	// cannot catch a fragment or a case-changed copy of it.
+	switch cfg.StructuredOutput {
+	case JSONSchema, JSONObject, PromptOnly:
+	default:
+		return nil, errors.New("openai: unknown structured output mode")
+	}
+	headers := make(http.Header, len(cfg.Headers)+1)
+	for name, value := range cfg.Headers {
+		if !validHeaderName(name) {
+			return nil, errors.New("openai: an extra header name is not a valid HTTP token")
+		}
+		canonical := textproto.CanonicalMIMEHeaderKey(name)
+		if managedHeaders[canonical] {
+			return nil, errors.New("openai: an extra header is set by the adapter")
+		}
+		if !validHeaderValue(value) {
+			return nil, errors.New("openai: an extra header value has a control character")
+		}
+		headers.Set(canonical, value)
+	}
+	if headers.Get("Accept") == "" {
+		headers.Set("Accept", "application/json")
+	}
+	return &Provider{
+		base:    strings.TrimRight(cfg.BaseURL, "/"),
+		apiKey:  cfg.APIKey,
+		model:   cfg.Model,
+		headers: headers,
+		mode:    cfg.StructuredOutput,
+		client:  &http.Client{},
+	}, nil
+}
+
+// managedHeaders are the request headers the adapter or net/http set; a
+// configured value for one would be overwritten or ignored.
+var managedHeaders = map[string]bool{
+	"Authorization":     true,
+	"Content-Type":      true,
+	"Content-Length":    true,
+	"Transfer-Encoding": true,
+	"Host":              true,
+	"Connection":        true,
+}
+
+// validHeaderName reports whether name is an RFC 9110 field-name: a
+// non-empty token of letters, digits and !#$%&'*+-.^_`|~.
+func validHeaderName(name string) bool {
+	if name == "" {
+		return false
+	}
+	for i := 0; i < len(name); i++ {
+		c := name[i]
+		switch {
+		case 'a' <= c && c <= 'z', 'A' <= c && c <= 'Z', '0' <= c && c <= '9':
+		case strings.IndexByte("!#$%&'*+-.^_`|~", c) >= 0:
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+// validHeaderValue reports whether value is an RFC 9110 field-value: no
+// control characters other than horizontal tab, so no CR, LF or DEL.
+func validHeaderValue(value string) bool {
+	for i := 0; i < len(value); i++ {
+		if c := value[i]; (c < 0x20 && c != '\t') || c == 0x7f {
+			return false
+		}
+	}
+	return true
+}
+
+// maxResponseBody caps a successful response body; a larger one is an error.
+const maxResponseBody = 16 << 20
+
+// maxErrorBody caps how much of an error response body is read. It is far
+// above llm.MaxBodyExcerpt, so redaction still sees every secret that could
+// reach the excerpt.
+const maxErrorBody = 64 << 10
+
+type chatMessage struct {
+	Role    string `json:"role"`
+	Content string `json:"content"`
+}
+
+type jsonSchemaFormat struct {
+	Name   string          `json:"name"`
+	Schema json.RawMessage `json:"schema"`
+	Strict bool            `json:"strict"`
+}
+
+type responseFormat struct {
+	Type       string            `json:"type"`
+	JSONSchema *jsonSchemaFormat `json:"json_schema,omitempty"`
+}
+
+type chatRequest struct {
+	Model          string          `json:"model"`
+	Messages       []chatMessage   `json:"messages"`
+	Temperature    *float64        `json:"temperature,omitempty"`
+	MaxTokens      int             `json:"max_tokens,omitempty"`
+	ResponseFormat *responseFormat `json:"response_format,omitempty"`
+}
+
+type chatResponse struct {
+	Model   string `json:"model"`
+	Choices []struct {
+		Message struct {
+			Content *string `json:"content"`
+			Refusal *string `json:"refusal"`
+		} `json:"message"`
+		FinishReason string `json:"finish_reason"`
+	} `json:"choices"`
+	Usage struct {
+		PromptTokens     int `json:"prompt_tokens"`
+		CompletionTokens int `json:"completion_tokens"`
+	} `json:"usage"`
+	Error json.RawMessage `json:"error"`
+}
+
+// schemaInstruction is appended to the system prompt in the json_object and
+// prompt_only modes, where the schema is not sent in response_format.
+const schemaInstruction = "Reply with only a JSON object, and no other text, that matches this JSON Schema:\n"
+
+// Generate sends req to {base}/chat/completions.
+func (p *Provider) Generate(ctx context.Context, req llm.Request) (llm.Response, error) {
+	resp, err := p.generate(ctx, req)
+	return resp, redact(err, p.apiKey)
+}
+
+func (p *Provider) generate(ctx context.Context, req llm.Request) (llm.Response, error) {
+	if err := req.Validate(); err != nil {
+		return llm.Response{}, fmt.Errorf("openai: generate: %w", err)
+	}
+	if p.model == "" {
+		return llm.Response{}, errors.New("openai: generate: no model configured")
+	}
+	body := chatRequest{
+		Model:       p.model,
+		Temperature: req.Temperature,
+		MaxTokens:   req.MaxTokens,
+	}
+	system := req.System
+	if req.Schema != nil {
+		switch p.mode {
+		case JSONSchema:
+			body.ResponseFormat = &responseFormat{
+				Type:       "json_schema",
+				JSONSchema: &jsonSchemaFormat{Name: req.Schema.Name, Schema: req.Schema.Schema, Strict: true},
+			}
+		case JSONObject:
+			body.ResponseFormat = &responseFormat{Type: "json_object"}
+			system = appendInstruction(system, req.Schema.Schema)
+		case PromptOnly:
+			system = appendInstruction(system, req.Schema.Schema)
+		}
+	}
+	if system != "" {
+		body.Messages = append(body.Messages, chatMessage{Role: "system", Content: system})
+	}
+	for _, m := range req.Messages {
+		body.Messages = append(body.Messages, chatMessage{Role: string(m.Role), Content: m.Content})
+	}
+	payload, err := json.Marshal(body)
+	if err != nil {
+		return llm.Response{}, fmt.Errorf("openai: generate: encode request: %w", err)
+	}
+
+	if req.Timeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, req.Timeout)
+		defer cancel()
+	}
+	raw, status, err := p.do(ctx, http.MethodPost, "/chat/completions", payload)
+	if err != nil {
+		return llm.Response{}, fmt.Errorf("openai: generate: %w", err)
+	}
+
+	var cr chatResponse
+	if err := json.Unmarshal(raw, &cr); err != nil {
+		return llm.Response{}, fmt.Errorf("openai: generate: decode response: %w", err)
+	}
+	if len(cr.Error) > 0 && string(cr.Error) != "null" {
+		// OpenRouter can report an upstream failure in a 2xx body.
+		return llm.Response{}, fmt.Errorf("openai: generate: %w", llm.NewProviderError(status, raw, p.apiKey))
+	}
+	if len(cr.Choices) == 0 {
+		return llm.Response{}, errors.New("openai: generate: response has no choices")
+	}
+	choice := cr.Choices[0]
+	resp := llm.Response{
+		Usage:        llm.Usage{InputTokens: cr.Usage.PromptTokens, OutputTokens: cr.Usage.CompletionTokens},
+		Model:        cr.Model,
+		FinishReason: choice.FinishReason,
+	}
+	if choice.Message.Content != nil {
+		resp.Text = *choice.Message.Content
+	}
+	if req.Schema == nil {
+		return resp, nil
+	}
+	if choice.Message.Refusal != nil && *choice.Message.Refusal != "" {
+		return resp, fmt.Errorf("openai: generate: model refused the structured request: %w", llm.ErrBadOutput)
+	}
+	if p.mode == PromptOnly {
+		resp.JSON = firstJSONObject(resp.Text)
+	} else if text := strings.TrimSpace(resp.Text); isJSONObject(text) {
+		resp.JSON = json.RawMessage(text)
+	}
+	if resp.JSON == nil {
+		return resp, fmt.Errorf("openai: generate: reply holds no JSON object: %w", llm.ErrBadOutput)
+	}
+	return resp, nil
+}
+
+func appendInstruction(system string, schema json.RawMessage) string {
+	instruction := schemaInstruction + string(schema)
+	if system == "" {
+		return instruction
+	}
+	return system + "\n\n" + instruction
+}
+
+// isJSONObject reports whether s is exactly one JSON object.
+func isJSONObject(s string) bool {
+	return strings.HasPrefix(s, "{") && json.Valid([]byte(s))
+}
+
+// firstJSONObject returns the first complete JSON object in s, trying each
+// "{" in order, or nil when there is none. Text around it, such as prose or
+// a Markdown code fence, is ignored.
+func firstJSONObject(s string) json.RawMessage {
+	for i := strings.IndexByte(s, '{'); i >= 0; {
+		var obj json.RawMessage
+		if err := json.NewDecoder(strings.NewReader(s[i:])).Decode(&obj); err == nil {
+			return obj
+		}
+		next := strings.IndexByte(s[i+1:], '{')
+		if next < 0 {
+			break
+		}
+		i += 1 + next
+	}
+	return nil
+}
+
+type modelsResponse struct {
+	Data []struct {
+		ID   string `json:"id"`
+		Name string `json:"name"`
+	} `json:"data"`
+}
+
+// ListModels returns the models {base}/models lists.
+func (p *Provider) ListModels(ctx context.Context) ([]llm.Model, error) {
+	models, err := p.listModels(ctx)
+	return models, redact(err, p.apiKey)
+}
+
+func (p *Provider) listModels(ctx context.Context) ([]llm.Model, error) {
+	raw, _, err := p.do(ctx, http.MethodGet, "/models", nil)
+	if err != nil {
+		return nil, fmt.Errorf("openai: list models: %w", err)
+	}
+	var mr modelsResponse
+	if err := json.Unmarshal(raw, &mr); err != nil {
+		return nil, fmt.Errorf("openai: list models: decode response: %w", err)
+	}
+	if mr.Data == nil {
+		return nil, errors.New("openai: list models: response has no data list")
+	}
+	models := make([]llm.Model, 0, len(mr.Data))
+	for i, m := range mr.Data {
+		if m.ID == "" {
+			return nil, fmt.Errorf("openai: list models: model %d has no id", i)
+		}
+		name := m.Name
+		if name == "" {
+			name = m.ID
+		}
+		models = append(models, llm.Model{ID: m.ID, DisplayName: name})
+	}
+	return models, nil
+}
+
+// Verify checks the credentials with an authenticated ListModels call.
+func (p *Provider) Verify(ctx context.Context) error {
+	_, err := p.listModels(ctx)
+	return redact(err, p.apiKey)
+}
+
+// do sends one request and returns the body and status of a 2xx response.
+// Any other status becomes the matching llm typed error.
+func (p *Provider) do(ctx context.Context, method, path string, payload []byte) ([]byte, int, error) {
+	var reqBody io.Reader
+	if payload != nil {
+		reqBody = bytes.NewReader(payload)
+	}
+	httpReq, err := http.NewRequestWithContext(ctx, method, p.base+path, reqBody)
+	if err != nil {
+		// The parse error names the URL, whose path may hold the API key.
+		return nil, 0, errors.New("build request: request URL is invalid")
+	}
+	for name, values := range p.headers {
+		httpReq.Header[name] = values
+	}
+	if payload != nil {
+		httpReq.Header.Set("Content-Type", "application/json")
+	}
+	if p.apiKey != "" {
+		httpReq.Header.Set("Authorization", "Bearer "+p.apiKey)
+	}
+
+	httpResp, err := p.client.Do(httpReq)
+	if err != nil {
+		return nil, 0, p.transportError(err)
+	}
+	defer httpResp.Body.Close()
+
+	if httpResp.StatusCode < 200 || httpResp.StatusCode > 299 {
+		body, err := io.ReadAll(io.LimitReader(httpResp.Body, maxErrorBody))
+		if err != nil {
+			return nil, httpResp.StatusCode, p.transportError(err)
+		}
+		return nil, httpResp.StatusCode, p.statusError(httpResp, body)
+	}
+	body, err := io.ReadAll(io.LimitReader(httpResp.Body, maxResponseBody+1))
+	if err != nil {
+		return nil, httpResp.StatusCode, p.transportError(err)
+	}
+	if len(body) > maxResponseBody {
+		return nil, httpResp.StatusCode, fmt.Errorf("response body exceeds %d bytes", maxResponseBody)
+	}
+	return body, httpResp.StatusCode, nil
+}
+
+// statusError maps a non-2xx response to an llm typed error.
+func (p *Provider) statusError(resp *http.Response, body []byte) error {
+	switch resp.StatusCode {
+	case http.StatusUnauthorized, http.StatusForbidden:
+		return fmt.Errorf("HTTP %d: %w", resp.StatusCode, llm.ErrAuth)
+	case http.StatusTooManyRequests:
+		return llm.NewRateLimitedError(retryAfter(resp.Header.Get("Retry-After"), time.Now()), p.apiKey)
+	case http.StatusRequestTimeout:
+		return fmt.Errorf("HTTP %d: %w", resp.StatusCode, llm.ErrTimeout)
+	default:
+		return llm.NewProviderError(resp.StatusCode, body, p.apiKey)
+	}
+}
+
+// retryAfter parses a Retry-After header, in delay-seconds or HTTP-date
+// form. A missing, malformed or past value means the vendor gave no usable
+// wait, reported as 0.
+func retryAfter(value string, now time.Time) time.Duration {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return 0
+	}
+	if secs, err := strconv.Atoi(value); err == nil {
+		if secs < 0 {
+			return 0
+		}
+		return time.Duration(secs) * time.Second
+	}
+	if at, err := http.ParseTime(value); err == nil && at.After(now) {
+		return at.Sub(now).Round(time.Second)
+	}
+	return 0
+}
+
+func isTimeout(err error) bool {
+	var ne net.Error
+	return errors.Is(err, context.DeadlineExceeded) || (errors.As(err, &ne) && ne.Timeout())
+}
+
+// transportFailure is a failed HTTP exchange. It carries the cause's text
+// with the request URL removed and the API key redacted, and unwraps only to
+// the cause's category: llm.ErrTimeout, context.Canceled or nothing.
+type transportFailure struct {
+	detail string
+	kind   error
+}
+
+func (e *transportFailure) Error() string {
+	if e.kind == llm.ErrTimeout {
+		return fmt.Sprintf("%s: transport: %s", llm.ErrTimeout, e.detail)
+	}
+	return "transport: " + e.detail
+}
+
+func (e *transportFailure) Unwrap() error { return e.kind }
+
+// transportError reports a failure to complete the HTTP exchange. A
+// *url.Error names the request URL, and a base URL path may hold the API
+// key, so only the wrapped cause is kept, rendered with the key redacted.
+func (p *Provider) transportError(err error) error {
+	var kind error
+	switch {
+	case isTimeout(err):
+		kind = llm.ErrTimeout
+	case errors.Is(err, context.Canceled):
+		kind = context.Canceled
+	}
+	var ue *url.Error
+	if errors.As(err, &ue) {
+		err = ue.Err
+	}
+	return &transportFailure{detail: llm.Redact(err.Error(), p.apiKey), kind: kind}
+}
+
+// redactedError stands in for one layer of an error chain that holds the
+// API key. Its text is the layer's text with the key redacted, and Unwrap
+// returns the layer's causes passed through redact, so no error reached by
+// unwrapping has text holding the key. Is consults the original layer and
+// its chain, so sentinels still match. As does too. The llm typed errors
+// remove the key from their own complete text, fixed words included, so
+// they always match; As refuses only a match from outside llm whose text
+// holds the key, so it never hands back an unredacted error.
+type redactedError struct {
+	text string
+	err  error
+	key  string
+}
+
+func (e *redactedError) Error() string { return e.text }
+
+// GoString keeps %#v from printing the fields, which hold the key.
+func (e *redactedError) GoString() string { return e.text }
+
+func (e *redactedError) Unwrap() error { return redact(errors.Unwrap(e.err), e.key) }
+
+func (e *redactedError) Is(target error) bool { return errors.Is(e.err, target) }
+
+func (e *redactedError) As(target any) bool {
+	if !errors.As(e.err, target) {
+		return false
+	}
+	found := reflect.ValueOf(target).Elem()
+	if matched, ok := found.Interface().(error); ok && holdsKey(matched, e.key) {
+		found.SetZero()
+		return false
+	}
+	return true
+}
+
+// redactedJoin is redactedError for a layer with several causes, such as
+// one built by errors.Join or by fmt.Errorf with more than one %w.
+type redactedJoin struct {
+	redactedError
+}
+
+func (e *redactedJoin) Unwrap() []error {
+	causes := e.err.(interface{ Unwrap() []error }).Unwrap()
+	safe := make([]error, len(causes))
+	for i, c := range causes {
+		safe[i] = redact(c, e.key)
+	}
+	return safe
+}
+
+// redact is the backstop every exported method applies to its error: when
+// the text of err or of any error in its chain holds a non-empty key, it
+// returns a stand-in whose text, and the text of every error it unwraps
+// to, has the key redacted. Any other err is returned unchanged.
+func redact(err error, key string) error {
+	if err == nil || key == "" || !holdsKey(err, key) {
+		return err
+	}
+	re := redactedError{text: llm.Redact(err.Error(), key), err: err, key: key}
+	if _, ok := err.(interface{ Unwrap() []error }); ok {
+		return &redactedJoin{re}
+	}
+	return &re
+}
+
+// holdsKey reports whether the text of err or of any error in its chain
+// contains key.
+func holdsKey(err error, key string) bool {
+	if err == nil {
+		return false
+	}
+	if strings.Contains(err.Error(), key) {
+		return true
+	}
+	switch u := err.(type) {
+	case interface{ Unwrap() error }:
+		return holdsKey(u.Unwrap(), key)
+	case interface{ Unwrap() []error }:
+		for _, c := range u.Unwrap() {
+			if holdsKey(c, key) {
+				return true
+			}
+		}
+	}
+	return false
+}

internal/ai/llm/openai/testdata/README.md

@@ -0,0 +1,71 @@
+# OpenAI-compatible adapter fixtures
+
+These are the vendor response bodies the contract tests in `openai_test.go`
+replay. They are **not live captures**. Product AI is tested with fakes, and
+live vendor calls are opt-in and never use credentials, so no request was
+sent to a vendor to make them. Each fixture is adapted from the response
+shape in that vendor's public API documentation or open source, then
+sanitized:
+
+- IDs, timestamps, fingerprints and token counts are illustrative values in
+  the documented format, not values from a real account.
+- Message content is replaced with MealQuest dinner text.
+- No real credential appears anywhere. `{{KEY}}` is a placeholder the tests
+  replace with a fake key, to prove the adapter redacts a key echoed back in
+  a vendor body.
+
+The tests check the adapter against these bodies with independent
+assertions on both the request sent (path, headers, `response_format`,
+messages) and the response decoded. The request side does not depend on the
+fixtures.
+
+Below, *not in the public example* marks fields or values that were added
+for a test case and do not come from the vendor's documented example.
+
+## OpenAI
+
+Sources: API reference, "The chat completion object" and "List models"
+(<https://platform.openai.com/docs/api-reference/chat/object>,
+<https://platform.openai.com/docs/api-reference/models/list>); the
+Structured Outputs guide, for `refusal`
+(<https://platform.openai.com/docs/guides/structured-outputs>); and the error
+codes guide (<https://platform.openai.com/docs/guides/error-codes>).
+
+| Fixture | Shape | Not in the public example |
+| --- | --- | --- |
+| `openai_chat_json_schema.json` | Chat completion object with `usage` details, `service_tier`, `system_fingerprint`. | The JSON reply content. |
+| `openai_chat_refusal.json` | Structured Outputs refusal: `content: null`, `refusal` set. | — |
+| `openai_models.json` | `{object: list, data: [model]}`. | — |
+| `openai_error_invalid_key.json` | Error object, `code: invalid_api_key`, message echoing the key. | The full key in the message; OpenAI masks most of it. Kept whole to test redaction. |
+| `openai_error_server.json` | Error object, `type: server_error`. | The `Authorization: Bearer {{KEY}}` text; added to test redaction. |
+
+## OpenRouter
+
+Sources: API reference, chat completion response and errors
+(<https://openrouter.ai/docs/api-reference/overview>,
+<https://openrouter.ai/docs/api-reference/errors>), and "List available
+models" (<https://openrouter.ai/docs/api-reference/list-available-models>).
+
+| Fixture | Shape | Not in the public example |
+| --- | --- | --- |
+| `openrouter_chat_json_object.json` | Chat completion with `provider`, `native_finish_reason` and `message.reasoning`. | The JSON reply content. |
+| `openrouter_chat_upstream_error.json` | An `error` object (`code`, `message`, `metadata.provider_name`, `metadata.raw`) in an HTTP 200 body, which OpenRouter documents for upstream failures. | `user_id`. |
+| `openrouter_error_rate_limited.json` | Error object, `code: 429`, rate-limit `metadata`. | The `Key {{KEY}}` text; added to test redaction. |
+| `openrouter_models.json` | `{data: [model]}` with `name`, `context_length`, `architecture`, `pricing`, `supported_parameters`. | The second model is a minimal entry, to test optional fields. |
+
+## Ollama
+
+Ollama's OpenAI compatibility page
+(<https://github.com/ollama/ollama/blob/main/docs/openai.md>) documents
+requests but shows no response bodies. The shapes come from its `openai`
+middleware source (<https://github.com/ollama/ollama/blob/main/openai/openai.go>):
+`chatcmpl-<n>` IDs, `system_fingerprint: fp_ollama`, `owned_by: library` on
+models, and errors as `{error: {message, type: api_error, param, code}}`.
+
+| Fixture | Shape | Not in the public example |
+| --- | --- | --- |
+| `ollama_chat_text.json` | Plain chat completion. | — |
+| `ollama_chat_prompt_only.json` | Chat completion. | The reply text: prose and stray braces around a fenced JSON object, to test prompt-only extraction. |
+| `ollama_chat_truncated.json` | Chat completion with `finish_reason: length`. | The cut-off JSON reply. |
+| `ollama_models.json` | `{object: list, data: [model]}`. | — |
+| `ollama_error_not_found.json` | Middleware error object for a missing model. | — |

internal/ai/llm/openai/testdata/ollama_chat_prompt_only.json

@@ -0,0 +1,18 @@
+{
+  "id": "chatcmpl-417",
+  "object": "chat.completion",
+  "created": 1741570322,
+  "model": "llama3.2",
+  "system_fingerprint": "fp_ollama",
+  "choices": [
+    {
+      "index": 0,
+      "message": {
+        "role": "assistant",
+        "content": "Sure! Here is a dinner {idea} for you:\n```json\n{\"dinners\": [{\"name\": \"Crock pot chili\", \"why\": \"A Quick dinner like your {Regular} stew.\"}]}\n```\nEnjoy {\"not\": \"this one\"}!"
+      },
+      "finish_reason": "stop"
+    }
+  ],
+  "usage": {"prompt_tokens": 512, "completion_tokens": 58, "total_tokens": 570}
+}

internal/ai/llm/openai/testdata/ollama_chat_text.json

@@ -0,0 +1,11 @@
+{
+  "id": "chatcmpl-419",
+  "object": "chat.completion",
+  "created": 1741570340,
+  "model": "llama3.2",
+  "system_fingerprint": "fp_ollama",
+  "choices": [
+    {"index": 0, "message": {"role": "assistant", "content": "Try a lemon orzo bake tonight."}, "finish_reason": "stop"}
+  ],
+  "usage": {"prompt_tokens": 40, "completion_tokens": 9, "total_tokens": 49}
+}

internal/ai/llm/openai/testdata/ollama_chat_truncated.json

@@ -0,0 +1,15 @@
+{
+  "id": "chatcmpl-418",
+  "object": "chat.completion",
+  "created": 1741570330,
+  "model": "llama3.2",
+  "system_fingerprint": "fp_ollama",
+  "choices": [
+    {
+      "index": 0,
+      "message": {"role": "assistant", "content": "{\"dinners\": [{\"name\": \"Crock pot ch"},
+      "finish_reason": "length"
+    }
+  ],
+  "usage": {"prompt_tokens": 512, "completion_tokens": 16, "total_tokens": 528}
+}

internal/ai/llm/openai/testdata/ollama_error_not_found.json

@@ -0,0 +1 @@
+{"error": {"message": "model \"llama9\" not found, try pulling it first", "type": "api_error", "param": null, "code": null}}

internal/ai/llm/openai/testdata/ollama_models.json

@@ -0,0 +1,7 @@
+{
+  "object": "list",
+  "data": [
+    {"id": "llama3.2:latest", "object": "model", "created": 1741000000, "owned_by": "library"},
+    {"id": "qwen2.5:7b", "object": "model", "created": 1740000000, "owned_by": "library"}
+  ]
+}

internal/ai/llm/openai/testdata/openai_chat_json_schema.json

@@ -0,0 +1,28 @@
+{
+  "id": "chatcmpl-B9MHDbslfkBeAs8l4bebGdFOJ6PeG",
+  "object": "chat.completion",
+  "created": 1741570283,
+  "model": "gpt-4o-2024-08-06",
+  "choices": [
+    {
+      "index": 0,
+      "message": {
+        "role": "assistant",
+        "content": "{\"dinners\":[{\"name\":\"Sheet-pan gnocchi\",\"why\":\"Like your Regular tray bake, but quicker.\"}]}",
+        "refusal": null,
+        "annotations": []
+      },
+      "logprobs": null,
+      "finish_reason": "stop"
+    }
+  ],
+  "usage": {
+    "prompt_tokens": 1117,
+    "completion_tokens": 46,
+    "total_tokens": 1163,
+    "prompt_tokens_details": {"cached_tokens": 0, "audio_tokens": 0},
+    "completion_tokens_details": {"reasoning_tokens": 0, "audio_tokens": 0, "accepted_prediction_tokens": 0, "rejected_prediction_tokens": 0}
+  },
+  "service_tier": "default",
+  "system_fingerprint": "fp_fc9f1d7035"
+}

internal/ai/llm/openai/testdata/openai_chat_refusal.json

@@ -0,0 +1,16 @@
+{
+  "id": "chatcmpl-B9MHDbslfkBeAs8l4bebGdFOJ6PeH",
+  "object": "chat.completion",
+  "created": 1741570290,
+  "model": "gpt-4o-2024-08-06",
+  "choices": [
+    {
+      "index": 0,
+      "message": {"role": "assistant", "content": null, "refusal": "I'm sorry, I can't help with that request.", "annotations": []},
+      "logprobs": null,
+      "finish_reason": "stop"
+    }
+  ],
+  "usage": {"prompt_tokens": 210, "completion_tokens": 11, "total_tokens": 221},
+  "system_fingerprint": "fp_fc9f1d7035"
+}

internal/ai/llm/openai/testdata/openai_error_invalid_key.json

@@ -0,0 +1,8 @@
+{
+  "error": {
+    "message": "Incorrect API key provided: {{KEY}}. You can find your API key at https://platform.openai.com/account/api-keys.",
+    "type": "invalid_request_error",
+    "param": null,
+    "code": "invalid_api_key"
+  }
+}

internal/ai/llm/openai/testdata/openai_error_server.json

@@ -0,0 +1 @@
+{"error": {"message": "The server had an error while processing your request. Authorization: Bearer {{KEY}}", "type": "server_error", "param": null, "code": null}}

internal/ai/llm/openai/testdata/openai_models.json

@@ -0,0 +1,7 @@
+{
+  "object": "list",
+  "data": [
+    {"id": "gpt-4o-2024-08-06", "object": "model", "created": 1722814719, "owned_by": "system"},
+    {"id": "gpt-4o-mini", "object": "model", "created": 1721172741, "owned_by": "system"}
+  ]
+}

internal/ai/llm/openai/testdata/openrouter_chat_json_object.json

@@ -0,0 +1,22 @@
+{
+  "id": "gen-1741570300-xQmT9vWb4kR2nP7sL3aE",
+  "provider": "OpenAI",
+  "model": "openai/gpt-4o-mini",
+  "object": "chat.completion",
+  "created": 1741570300,
+  "choices": [
+    {
+      "logprobs": null,
+      "finish_reason": "stop",
+      "native_finish_reason": "stop",
+      "index": 0,
+      "message": {
+        "role": "assistant",
+        "content": "{\n  \"dinners\": [{\"name\": \"Chicken tinga tacos\", \"why\": \"Close to your taco-night Regular.\"}]\n}",
+        "refusal": null,
+        "reasoning": null
+      }
+    }
+  ],
+  "usage": {"prompt_tokens": 842, "completion_tokens": 31, "total_tokens": 873}
+}

internal/ai/llm/openai/testdata/openrouter_chat_upstream_error.json

@@ -0,0 +1,5 @@
+{
+  "id": "gen-1741570311-aB3dE5fG7hJ9kL1mN2pQ",
+  "error": {"code": 502, "message": "Upstream error from provider", "metadata": {"provider_name": "Lambda", "raw": "upstream returned 502"}},
+  "user_id": "user_2abcDEF"
+}

internal/ai/llm/openai/testdata/openrouter_error_rate_limited.json

@@ -0,0 +1 @@
+{"error": {"code": 429, "message": "Rate limit exceeded: free-models-per-min. Key {{KEY}}", "metadata": {"headers": {"X-RateLimit-Limit": "20", "X-RateLimit-Remaining": "0"}}}}

internal/ai/llm/openai/testdata/openrouter_models.json

@@ -0,0 +1,22 @@
+{
+  "data": [
+    {
+      "id": "openai/gpt-4o-mini",
+      "canonical_slug": "openai/gpt-4o-mini",
+      "name": "OpenAI: GPT-4o-mini",
+      "created": 1721260800,
+      "description": "GPT-4o mini is OpenAI's newest model after GPT-4 Omni.",
+      "context_length": 128000,
+      "architecture": {"modality": "text+image->text", "input_modalities": ["text", "image"], "output_modalities": ["text"], "tokenizer": "GPT"},
+      "pricing": {"prompt": "0.00000015", "completion": "0.0000006"},
+      "supported_parameters": ["max_tokens", "temperature", "response_format", "structured_outputs"]
+    },
+    {
+      "id": "anthropic/claude-sonnet-5",
+      "name": "Anthropic: Claude Sonnet 5",
+      "created": 1767225600,
+      "context_length": 200000,
+      "supported_parameters": ["max_tokens", "temperature"]
+    }
+  ]
+}

web/package.json

@@ -5,12 +5,10 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "tsc --noEmit && vite build && npm run check:dist-fonts",
+    "build": "tsc --noEmit && vite build",
     "preview": "vite preview",
     "typecheck": "tsc --noEmit",
-    "test": "npm run lint:colors && vitest run",
-    "lint:colors": "node scripts/lint-colors.mjs",
-    "check:dist-fonts": "node scripts/check-dist-fonts.mjs"
+    "test": "vitest run"
   },
   "dependencies": {
     "@tanstack/react-query": "^5.104.1",

web/scripts/check-dist-fonts.mjs

@@ -1,32 +0,0 @@
-// Fails when the production build references Google Fonts: fonts are
-// self-hosted, so dist must never point at fonts.googleapis.com or
-// fonts.gstatic.com.
-import { readFileSync, readdirSync } from 'node:fs'
-import { join, relative } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const distDir = fileURLToPath(new URL('../dist', import.meta.url))
-const hosts = ['fonts.googleapis.com', 'fonts.gstatic.com']
-
-function* files(dir) {
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const path = join(dir, entry.name)
-    if (entry.isDirectory()) yield* files(path)
-    else yield path
-  }
-}
-
-const violations = []
-for (const path of files(distDir)) {
-  const content = readFileSync(path, 'latin1')
-  for (const host of hosts) {
-    if (content.includes(host)) violations.push(`${relative(distDir, path)}: ${host}`)
-  }
-}
-
-if (violations.length > 0) {
-  console.error('Production build references Google Fonts; fonts must be self-hosted:')
-  for (const v of violations) console.error(`  ${v}`)
-  process.exit(1)
-}
-console.log('check:dist-fonts: dist makes no Google Fonts requests')

web/scripts/lint-colors.mjs

@@ -1,42 +0,0 @@
-// Fails when a hex colour literal appears in any CSS or TypeScript file under
-// web/ outside the design tokens: every colour must come from a custom
-// property in tokens.css. Dependencies, build output and hidden directories
-// (tool caches) are not source and are skipped.
-import { readFileSync, readdirSync } from 'node:fs'
-import { extname, join, relative } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const webRoot = fileURLToPath(new URL('..', import.meta.url))
-const allowed = new Set(['src/styles/tokens.css'])
-const skippedDirs = new Set([join(webRoot, 'node_modules'), join(webRoot, 'dist')])
-const extensions = new Set(['.css', '.ts', '.tsx'])
-const hexColour = /#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]{6}|[0-9a-fA-F]{3,4})\b/g
-
-function* sourceFiles(dir) {
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const path = join(dir, entry.name)
-    if (entry.isDirectory()) {
-      if (!skippedDirs.has(path) && !entry.name.startsWith('.')) yield* sourceFiles(path)
-    } else if (extensions.has(extname(entry.name))) yield path
-  }
-}
-
-const violations = []
-for (const path of sourceFiles(webRoot)) {
-  const name = relative(webRoot, path).split('\\').join('/')
-  if (allowed.has(name)) continue
-  readFileSync(path, 'utf8')
-    .split('\n')
-    .forEach((line, i) => {
-      for (const match of line.matchAll(hexColour)) {
-        violations.push(`${name}:${i + 1}: ${match[0]}`)
-      }
-    })
-}
-
-if (violations.length > 0) {
-  console.error('Hex colour literals found; use a token from src/styles/tokens.css:')
-  for (const v of violations) console.error(`  ${v}`)
-  process.exit(1)
-}
-console.log('lint:colors: no hex colour literals outside src/styles/tokens.css')

web/src/assets/fonts/BagelFatOne-OFL.txt

@@ -1,93 +0,0 @@
-Copyright 2022 The Bagel Fat Project Authors (https://github.com/JAMO-TYPEFACE/BagelFat)
-
-This Font Software is licensed under the SIL Open Font License, Version 1.1.
-This license is copied below, and is also available with a FAQ at:
-http://scripts.sil.org/OFL
-
-
------------------------------------------------------------
-SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
------------------------------------------------------------
-
-PREAMBLE
-The goals of the Open Font License (OFL) are to stimulate worldwide
-development of collaborative font projects, to support the font creation
-efforts of academic and linguistic communities, and to provide a free and
-open framework in which fonts may be shared and improved in partnership
-with others.
-
-The OFL allows the licensed fonts to be used, studied, modified and
-redistributed freely as long as they are not sold by themselves. The
-fonts, including any derivative works, can be bundled, embedded, 
-redistributed and/or sold with any software provided that any reserved
-names are not used by derivative works. The fonts and derivatives,
-however, cannot be released under any other type of license. The
-requirement for fonts to remain under this license does not apply
-to any document created using the fonts or their derivatives.
-
-DEFINITIONS
-"Font Software" refers to the set of files released by the Copyright
-Holder(s) under this license and clearly marked as such. This may
-include source files, build scripts and documentation.
-
-"Reserved Font Name" refers to any names specified as such after the
-copyright statement(s).
-
-"Original Version" refers to the collection of Font Software components as
-distributed by the Copyright Holder(s).
-
-"Modified Version" refers to any derivative made by adding to, deleting,
-or substituting -- in part or in whole -- any of the components of the
-Original Version, by changing formats or by porting the Font Software to a
-new environment.
-
-"Author" refers to any designer, engineer, programmer, technical
-writer or other person who contributed to the Font Software.
-
-PERMISSION & CONDITIONS
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Font Software, to use, study, copy, merge, embed, modify,
-redistribute, and sell modified and unmodified copies of the Font
-Software, subject to the following conditions:
-
-1) Neither the Font Software nor any of its individual components,
-in Original or Modified Versions, may be sold by itself.
-
-2) Original or Modified Versions of the Font Software may be bundled,
-redistributed and/or sold with any software, provided that each copy
-contains the above copyright notice and this license. These can be
-included either as stand-alone text files, human-readable headers or
-in the appropriate machine-readable metadata fields within text or
-binary files as long as those fields can be easily viewed by the user.
-
-3) No Modified Version of the Font Software may use the Reserved Font
-Name(s) unless explicit written permission is granted by the corresponding
-Copyright Holder. This restriction only applies to the primary font name as
-presented to the users.
-
-4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-Software shall not be used to promote, endorse or advertise any
-Modified Version, except to acknowledge the contribution(s) of the
-Copyright Holder(s) and the Author(s) or with their explicit written
-permission.
-
-5) The Font Software, modified or unmodified, in part or in whole,
-must be distributed entirely under this license, and must not be
-distributed under any other license. The requirement for fonts to
-remain under this license does not apply to any document created
-using the Font Software.
-
-TERMINATION
-This license becomes null and void if any of the above conditions are
-not met.
-
-DISCLAIMER
-THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
-OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
-DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
-OTHER DEALINGS IN THE FONT SOFTWARE.

web/src/assets/fonts/Figtree-OFL.txt

@@ -1,93 +0,0 @@
-Copyright 2022 The Figtree Project Authors (https://github.com/erikdkennedy/figtree)
-
-This Font Software is licensed under the SIL Open Font License, Version 1.1.
-This license is copied below, and is also available with a FAQ at:
-http://scripts.sil.org/OFL
-
-
------------------------------------------------------------
-SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
------------------------------------------------------------
-
-PREAMBLE
-The goals of the Open Font License (OFL) are to stimulate worldwide
-development of collaborative font projects, to support the font creation
-efforts of academic and linguistic communities, and to provide a free and
-open framework in which fonts may be shared and improved in partnership
-with others.
-
-The OFL allows the licensed fonts to be used, studied, modified and
-redistributed freely as long as they are not sold by themselves. The
-fonts, including any derivative works, can be bundled, embedded, 
-redistributed and/or sold with any software provided that any reserved
-names are not used by derivative works. The fonts and derivatives,
-however, cannot be released under any other type of license. The
-requirement for fonts to remain under this license does not apply
-to any document created using the fonts or their derivatives.
-
-DEFINITIONS
-"Font Software" refers to the set of files released by the Copyright
-Holder(s) under this license and clearly marked as such. This may
-include source files, build scripts and documentation.
-
-"Reserved Font Name" refers to any names specified as such after the
-copyright statement(s).
-
-"Original Version" refers to the collection of Font Software components as
-distributed by the Copyright Holder(s).
-
-"Modified Version" refers to any derivative made by adding to, deleting,
-or substituting -- in part or in whole -- any of the components of the
-Original Version, by changing formats or by porting the Font Software to a
-new environment.
-
-"Author" refers to any designer, engineer, programmer, technical
-writer or other person who contributed to the Font Software.
-
-PERMISSION & CONDITIONS
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Font Software, to use, study, copy, merge, embed, modify,
-redistribute, and sell modified and unmodified copies of the Font
-Software, subject to the following conditions:
-
-1) Neither the Font Software nor any of its individual components,
-in Original or Modified Versions, may be sold by itself.
-
-2) Original or Modified Versions of the Font Software may be bundled,
-redistributed and/or sold with any software, provided that each copy
-contains the above copyright notice and this license. These can be
-included either as stand-alone text files, human-readable headers or
-in the appropriate machine-readable metadata fields within text or
-binary files as long as those fields can be easily viewed by the user.
-
-3) No Modified Version of the Font Software may use the Reserved Font
-Name(s) unless explicit written permission is granted by the corresponding
-Copyright Holder. This restriction only applies to the primary font name as
-presented to the users.
-
-4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-Software shall not be used to promote, endorse or advertise any
-Modified Version, except to acknowledge the contribution(s) of the
-Copyright Holder(s) and the Author(s) or with their explicit written
-permission.
-
-5) The Font Software, modified or unmodified, in part or in whole,
-must be distributed entirely under this license, and must not be
-distributed under any other license. The requirement for fonts to
-remain under this license does not apply to any document created
-using the Font Software.
-
-TERMINATION
-This license becomes null and void if any of the above conditions are
-not met.
-
-DISCLAIMER
-THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
-OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
-DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
-OTHER DEALINGS IN THE FONT SOFTWARE.

web/src/main.tsx

@@ -1,8 +1,6 @@
 import { StrictMode } from 'react'
 import { createRoot } from 'react-dom/client'
 import { BrowserRouter } from 'react-router'
-import './styles/tokens.css'
-import './styles/base.css'
 import App from './App.tsx'
 
 const root = document.getElementById('root')

web/src/styles/base.css

@@ -1,11 +0,0 @@
-/* App-wide base styles. Values come only from tokens.css. */
-body {
-  background: var(--color-bg);
-  color: var(--color-text);
-  font-family: var(--font-body);
-}
-
-:focus-visible {
-  outline: 2px solid var(--color-accent);
-  outline-offset: 2px;
-}

web/src/styles/tokens.css

@@ -1,116 +0,0 @@
-/* MealQuest design tokens — final palette "B4: Grape + teal blue on off-white".
-   Built on the Organic design system (styles.css in this bundle); these values OVERRIDE its defaults. */
-/* Fonts are self-hosted from web/src/assets/fonts (OFL; licence texts alongside)
-   in place of the handoff's Google Fonts @import, so the app never calls Google.
-   Bagel Fat One: Google Fonts latin and latin-ext woff2 subsets.
-   Figtree: upstream static woff2 (github.com/erikdkennedy/figtree). */
-@font-face {
-  font-family: "Bagel Fat One";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url("../assets/fonts/BagelFatOne-LatinExt.woff2") format("woff2");
-  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-@font-face {
-  font-family: "Bagel Fat One";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url("../assets/fonts/BagelFatOne-Latin.woff2") format("woff2");
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-@font-face {
-  font-family: "Figtree";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url("../assets/fonts/Figtree-Regular.woff2") format("woff2");
-}
-@font-face {
-  font-family: "Figtree";
-  font-style: normal;
-  font-weight: 600;
-  font-display: swap;
-  src: url("../assets/fonts/Figtree-SemiBold.woff2") format("woff2");
-}
-@font-face {
-  font-family: "Figtree";
-  font-style: normal;
-  font-weight: 700;
-  font-display: swap;
-  src: url("../assets/fonts/Figtree-Bold.woff2") format("woff2");
-}
-
-:root {
-  /* Ground + ink */
-  --color-bg: #f9f6f1;          /* oklch(0.975 0.008 85) — page / phone background */
-  --color-surface: #eee9de;     /* oklch(0.935 0.016 85) — cards, rows, inputs */
-  --color-text: #201e1d;
-  --color-divider: color-mix(in srgb, #201e1d 16%, transparent);
-  --on-accent: #f9f6f1;         /* text/icons on --color-accent fills (never dark text on grape) */
-
-  /* Primary accent — Grape (hue 300) */
-  --color-accent: #5a358c;      /* oklch(0.42 0.14 300) */
-  --color-accent-100: #f8f1ff;
-  --color-accent-200: #eedfff;
-  --color-accent-300: #dac3ff;
-  --color-accent-400: #c1a1f9;
-  --color-accent-500: #a47ee1;
-  --color-accent-600: #865fc0;
-  --color-accent-700: #68449b;  /* accent-colored small text on light grounds */
-  --color-accent-800: #4a2d73;
-  --color-accent-900: #2d1a49;
-
-  /* Second accent — Teal blue (hue 215) */
-  --color-accent-2: #29889c;    /* oklch(0.58 0.09 215) */
-  --color-accent-2-100: #e0fbff;
-  --color-accent-2-200: #bbf3ff;
-  --color-accent-2-300: #88e0f6;
-  --color-accent-2-400: #3fc7e4;
-  --color-accent-2-500: #00a9ca;
-  --color-accent-2-600: #008aaa; /* toggles ON, "Try it" button, + buttons */
-  --color-accent-2-700: #006b88;
-  --color-accent-2-800: #004c63; /* teal text on teal-100/200 fills */
-  --color-accent-2-900: #002f3e;
-
-  /* Neutrals (unchanged from Organic) */
-  --color-neutral-100: #f9f4ed;
-  --color-neutral-200: #eee7db;
-  --color-neutral-300: #dcd3c4;
-  --color-neutral-400: #c0b6a5;
-  --color-neutral-500: #a19786;
-  --color-neutral-600: #82796a;
-  --color-neutral-700: #645c50;
-  --color-neutral-800: #474238;
-  --color-neutral-900: #2e2b25;
-
-  /* Type */
-  --font-heading: "Bagel Fat One", system-ui, sans-serif; /* weight 400 only */
-  --font-body: "Figtree", system-ui, sans-serif;          /* 400 / 600 / 700 */
-  --font-mono: ui-monospace, Menlo, monospace;
-
-  /* Radii */
-  --radius-sm: 8px;
-  --radius-md: 16px;
-  --radius-lg: 28px;
-  --radius-card: 32px;   /* mobile hero cards */
-  --radius-pill: 999px;  /* buttons, inputs, tags, nav */
-
-  /* Spacing (Organic, density 1.1) */
-  --space-1: 4.4px; --space-2: 8.8px; --space-3: 13.2px; --space-4: 17.6px; --space-6: 26.4px; --space-8: 35.2px;
-
-  /* Elevation */
-  --shadow-sm: 0 1px 2px color-mix(in srgb, #2e2b25 14%, transparent);
-  --shadow-md: 0 3px 10px color-mix(in srgb, #2e2b25 16%, transparent);
-  --shadow-lg: 0 12px 32px color-mix(in srgb, #2e2b25 22%, transparent);
-
-  /* Motion */
-  --ease-spring: cubic-bezier(.34, 1.4, .64, 1);   /* nav pill, snap-back, bumps */
-  --ease-out-soft: cubic-bezier(.2, .8, .2, 1);    /* card promotion */
-  --ease-throw: cubic-bezier(.55, 0, .8, .4);      /* fly-off right */
-}
-
-@media (prefers-reduced-motion: reduce) {
-  :root { --motion-scale: 0; }
-}

web/src/test/cssRules.ts

@@ -1,50 +0,0 @@
-// Reads the CSS Modules' rules straight from the stylesheets Vitest injects
-// (css: true). jsdom's getComputedStyle cannot answer two things these
-// primitives need checked: it resolves var() colours to transparent, and it
-// evaluates only "all" and "screen" media queries, so styles inside
-// @media (prefers-reduced-motion: reduce) never apply.
-
-function cssRules(): CSSRule[] {
-  return Array.from(document.styleSheets).flatMap((sheet) => Array.from(sheet.cssRules))
-}
-
-function collect(element: Element, rules: CSSRule[], style: CSSStyleDeclaration) {
-  for (const rule of rules) {
-    if (!(rule instanceof CSSStyleRule) || !element.matches(rule.selectorText)) continue
-    for (const property of Array.from(rule.style)) {
-      style.setProperty(property, rule.style.getPropertyValue(property))
-    }
-  }
-}
-
-// The declarations the stylesheets give the element, as written. Read the
-// shorthands the CSS uses (background, animation): jsdom does not expand
-// animation, nor any shorthand holding a var(). Later rules win; specificity
-// is not considered.
-export function declaredStyle(element: Element): CSSStyleDeclaration {
-  const style = document.createElement('div').style
-  collect(element, cssRules(), style)
-  return style
-}
-
-// Only the declarations @media (prefers-reduced-motion: reduce) gives the element.
-export function reducedMotionStyle(element: Element): CSSStyleDeclaration {
-  const style = document.createElement('div').style
-  for (const rule of cssRules()) {
-    if (rule instanceof CSSMediaRule && rule.conditionText.includes('prefers-reduced-motion: reduce')) {
-      collect(element, Array.from(rule.cssRules), style)
-    }
-  }
-  return style
-}
-
-// The @keyframes the element's animation runs. CSS Modules hash keyframe
-// names, so this follows the element's own animation-name.
-export function animationKeyframes(element: Element): CSSKeyframesRule {
-  const [name] = declaredStyle(element).animation.split(' ')
-  const keyframes = cssRules().find(
-    (rule): rule is CSSKeyframesRule => rule instanceof CSSKeyframesRule && rule.name === name,
-  )
-  if (!keyframes) throw new Error(`no @keyframes named ${JSON.stringify(name)}`)
-  return keyframes
-}

web/src/test/hitArea.ts

@@ -1,26 +0,0 @@
-import { expect } from 'vitest'
-
-// Minimum tap target from the handoff's accessibility rules.
-export const MIN_HIT_AREA = 44
-
-function px(value: string): number {
-  return value.endsWith('px') ? Number.parseFloat(value) : 0
-}
-
-// The tap target an element's stylesheet guarantees: the larger of its
-// declared size and declared minimum size, per axis. jsdom does no layout, so
-// this reads the CSS Modules' computed values (Vitest runs with css: true).
-// A dimension the CSS leaves unsized counts as 0 and fails the check.
-export function hitArea(element: Element): { width: number; height: number } {
-  const style = getComputedStyle(element)
-  return {
-    width: Math.max(px(style.width), px(style.minWidth)),
-    height: Math.max(px(style.height), px(style.minHeight)),
-  }
-}
-
-export function expectMinHitArea(element: Element) {
-  const { width, height } = hitArea(element)
-  expect(width, 'hit area width').toBeGreaterThanOrEqual(MIN_HIT_AREA)
-  expect(height, 'hit area height').toBeGreaterThanOrEqual(MIN_HIT_AREA)
-}

web/src/ui/Button.module.css

@@ -1,63 +0,0 @@
-.button {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  gap: var(--space-2);
-  min-width: 44px;
-  min-height: 48px;
-  padding: 0 22px;
-  border: 1.5px solid transparent;
-  border-radius: var(--radius-pill);
-  font-family: var(--font-heading);
-  font-size: 15px;
-  font-weight: 400;
-  line-height: 1;
-  cursor: pointer;
-  transition: transform 100ms var(--ease-out-soft), background-color 100ms var(--ease-out-soft);
-}
-
-.button:active:not(:disabled) {
-  transform: scale(0.97);
-}
-
-.button:disabled {
-  opacity: 0.45;
-  cursor: not-allowed;
-}
-
-.primary {
-  background: var(--color-accent);
-  color: var(--on-accent);
-}
-
-.primary:hover:not(:disabled),
-.primary:active:not(:disabled) {
-  background: var(--color-accent-800);
-}
-
-.outline {
-  background: transparent;
-  border-color: var(--color-neutral-300);
-  color: var(--color-text);
-}
-
-.outline:hover:not(:disabled),
-.outline:active:not(:disabled) {
-  background: var(--color-neutral-200);
-}
-
-.dark {
-  background: var(--color-text);
-  color: var(--color-bg);
-}
-
-.dark:hover:not(:disabled),
-.dark:active:not(:disabled) {
-  background: var(--color-neutral-800);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .button {
-    transition: none;
-  }
-}

web/src/ui/Button.test.tsx

@@ -1,53 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { createRef } from 'react'
-import { describe, expect, it, vi } from 'vitest'
-import { expectMinHitArea } from '../test/hitArea.ts'
-import { Button } from './Button.tsx'
-import styles from './Button.module.css'
-
-describe('Button', () => {
-  it('is a button that defaults to type="button" and the primary variant', () => {
-    render(<Button>Save changes</Button>)
-    const button = screen.getByRole('button', { name: 'Save changes' })
-    expect(button).toHaveAttribute('type', 'button')
-    expect(button).toHaveClass(styles.button!, styles.primary!)
-  })
-
-  it.each(['primary', 'outline', 'dark'] as const)('renders the %s variant with a ≥ 44 px hit area', (variant) => {
-    render(<Button variant={variant}>Go</Button>)
-    const button = screen.getByRole('button', { name: 'Go' })
-    expect(button).toHaveClass(styles[variant]!)
-    expectMinHitArea(button)
-  })
-
-  it('declares the 100 ms pressed scale transition', () => {
-    render(<Button>Go</Button>)
-    expect(getComputedStyle(screen.getByRole('button')).transition).toContain('transform 100ms')
-  })
-
-  it('does not fire onClick when disabled', () => {
-    const onClick = vi.fn()
-    render(
-      <Button disabled onClick={onClick}>
-        Go
-      </Button>,
-    )
-    const button = screen.getByRole('button', { name: 'Go' })
-    expect(button).toBeDisabled()
-    fireEvent.click(button)
-    expect(onClick).not.toHaveBeenCalled()
-  })
-
-  it('forwards the ref, rest props and an explicit type', () => {
-    const ref = createRef<HTMLButtonElement>()
-    render(
-      <Button ref={ref} type="submit" aria-describedby="hint">
-        Send
-      </Button>,
-    )
-    const button = screen.getByRole('button', { name: 'Send' })
-    expect(ref.current).toBe(button)
-    expect(button).toHaveAttribute('type', 'submit')
-    expect(button).toHaveAttribute('aria-describedby', 'hint')
-  })
-})

web/src/ui/Button.tsx

@@ -1,16 +0,0 @@
-import type { ComponentPropsWithRef } from 'react'
-import styles from './Button.module.css'
-
-export type ButtonVariant = 'primary' | 'outline' | 'dark'
-
-export type ButtonProps = ComponentPropsWithRef<'button'> & {
-  variant?: ButtonVariant
-}
-
-// Pill button. Primary is grape with --on-accent text; outline and dark are the
-// secondary treatments from the handoff. `type` defaults to "button" so a
-// Button inside a form never submits by accident.
-export function Button({ variant = 'primary', type = 'button', className, ...rest }: ButtonProps) {
-  const classes = [styles.button, styles[variant], className].filter(Boolean).join(' ')
-  return <button type={type} className={classes} {...rest} />
-}

web/src/ui/Card.module.css

@@ -1,13 +0,0 @@
-.card {
-  padding: var(--space-4);
-  border-radius: var(--radius-lg);
-  color: var(--color-text);
-}
-
-.surface {
-  background: var(--color-surface);
-}
-
-.muted {
-  background: var(--color-neutral-100);
-}

web/src/ui/Card.test.tsx

@@ -1,18 +0,0 @@
-import { render, screen } from '@testing-library/react'
-import { describe, expect, it } from 'vitest'
-import { Card } from './Card.tsx'
-import styles from './Card.module.css'
-
-describe('Card', () => {
-  it('renders its children on the surface fill by default', () => {
-    render(<Card aria-label="Tonight">Tacos</Card>)
-    const card = screen.getByLabelText('Tonight')
-    expect(card).toHaveTextContent('Tacos')
-    expect(card).toHaveClass(styles.card!, styles.surface!)
-  })
-
-  it('supports the muted tone', () => {
-    render(<Card data-testid="card" tone="muted" />)
-    expect(screen.getByTestId('card')).toHaveClass(styles.muted!)
-  })
-})

web/src/ui/Card.tsx

@@ -1,14 +0,0 @@
-import type { ComponentPropsWithRef } from 'react'
-import styles from './Card.module.css'
-
-export type CardTone = 'surface' | 'muted'
-
-export type CardProps = ComponentPropsWithRef<'div'> & {
-  // surface = --color-surface; muted = the secondary neutral-100 fill.
-  tone?: CardTone
-}
-
-export function Card({ tone = 'surface', className, ...rest }: CardProps) {
-  const classes = [styles.card, styles[tone], className].filter(Boolean).join(' ')
-  return <div className={classes} {...rest} />
-}

web/src/ui/Checkbox.module.css

@@ -1,63 +0,0 @@
-.root {
-  display: inline-flex;
-  align-items: center;
-  gap: var(--space-3);
-  min-width: 44px;
-  min-height: 44px;
-  cursor: pointer;
-}
-
-.input {
-  appearance: none;
-  display: grid;
-  place-content: center;
-  flex: none;
-  width: 22px;
-  height: 22px;
-  margin: 0;
-  border: 2px solid var(--color-neutral-400);
-  border-radius: var(--radius-sm);
-  background: transparent;
-  cursor: pointer;
-}
-
-/* The check mark. */
-.input::before {
-  content: "";
-  width: 12px;
-  height: 12px;
-  background: var(--on-accent);
-  clip-path: polygon(14% 44%, 0 59%, 40% 100%, 100% 21%, 85% 7%, 39% 69%);
-  opacity: 0;
-  transform: scale(0.8);
-  transition: transform 160ms var(--ease-spring), opacity 160ms var(--ease-out-soft);
-}
-
-.input:checked {
-  border-color: var(--color-accent);
-  background: var(--color-accent);
-}
-
-.input:checked::before {
-  opacity: 1;
-  transform: scale(1);
-}
-
-.input:disabled,
-.input:disabled + .label {
-  opacity: 0.45;
-  cursor: not-allowed;
-}
-
-.label {
-  font-family: var(--font-body);
-  font-size: 15px;
-  font-weight: 600;
-  color: var(--color-text);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .input::before {
-    transition: none;
-  }
-}

web/src/ui/Checkbox.test.tsx

@@ -1,36 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { describe, expect, it } from 'vitest'
-import { expectMinHitArea } from '../test/hitArea.ts'
-import { Checkbox } from './Checkbox.tsx'
-
-describe('Checkbox', () => {
-  it('is a native checkbox named by its label', () => {
-    render(<Checkbox label="Chicken thighs" />)
-    const box = screen.getByRole('checkbox', { name: 'Chicken thighs' })
-    expect(box.tagName).toBe('INPUT')
-    expect(box).toHaveAttribute('type', 'checkbox')
-    expect(box).not.toBeChecked()
-  })
-
-  it('toggles when the input or its label text is clicked', () => {
-    render(<Checkbox label="Limes" />)
-    const box = screen.getByRole('checkbox', { name: 'Limes' })
-    fireEvent.click(box)
-    expect(box).toBeChecked()
-    fireEvent.click(screen.getByText('Limes'))
-    expect(box).not.toBeChecked()
-  })
-
-  it('reflects a controlled checked state and disabled', () => {
-    render(<Checkbox label="Rice" checked disabled readOnly />)
-    const box = screen.getByRole('checkbox', { name: 'Rice' })
-    expect(box).toBeChecked()
-    expect(box).toBeDisabled()
-  })
-
-  it('has a ≥ 44 px hit area (the wrapping label)', () => {
-    render(<Checkbox label="Rice" />)
-    const hit = screen.getByRole('checkbox', { name: 'Rice' }).closest('label')!
-    expectMinHitArea(hit)
-  })
-})

web/src/ui/Checkbox.tsx

@@ -1,17 +0,0 @@
-import type { ComponentPropsWithRef, ReactNode } from 'react'
-import styles from './Checkbox.module.css'
-
-export type CheckboxProps = Omit<ComponentPropsWithRef<'input'>, 'type'> & {
-  label: ReactNode
-}
-
-// Native checkbox, styled. The wrapping label is the hit area (at least
-// 44×44), so tapping the text toggles it too.
-export function Checkbox({ label, className, ...rest }: CheckboxProps) {
-  return (
-    <label className={[styles.root, className].filter(Boolean).join(' ')}>
-      <input type="checkbox" className={styles.input} {...rest} />
-      <span className={styles.label}>{label}</span>
-    </label>
-  )
-}

web/src/ui/Chip.module.css

@@ -1,35 +0,0 @@
-.chip {
-  display: inline-flex;
-  align-items: center;
-  min-height: 36px;
-  padding: 0 14px;
-  border-radius: var(--radius-pill);
-  background: var(--color-accent-2-200);
-  color: var(--color-accent-2-900);
-  font-family: var(--font-body);
-  font-size: 14px;
-  font-weight: 700;
-  white-space: nowrap;
-}
-
-.removable {
-  padding-right: 0;
-}
-
-/* 44 px hit box around a small cross; negative margins keep the chip 36 px
-   tall and the cross close to the label. */
-.remove {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  flex: none;
-  width: 44px;
-  height: 44px;
-  margin: -4px 0 -4px -14px;
-  padding: 0;
-  border: 0;
-  border-radius: var(--radius-pill);
-  background: transparent;
-  color: inherit;
-  cursor: pointer;
-}

web/src/ui/Chip.test.tsx

@@ -1,26 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { describe, expect, it, vi } from 'vitest'
-import { expectMinHitArea } from '../test/hitArea.ts'
-import { Chip } from './Chip.tsx'
-
-describe('Chip', () => {
-  it('has no remove button unless onRemove is given', () => {
-    render(<Chip label="Beef tacos" />)
-    expect(screen.getByText('Beef tacos')).toBeInTheDocument()
-    expect(screen.queryByRole('button')).not.toBeInTheDocument()
-  })
-
-  it('exposes an accessible "Remove {label}" button that calls onRemove', () => {
-    const onRemove = vi.fn()
-    render(<Chip label="Beef tacos" onRemove={onRemove} />)
-    const remove = screen.getByRole('button', { name: 'Remove Beef tacos' })
-    expect(remove).toHaveAttribute('type', 'button')
-    fireEvent.click(remove)
-    expect(onRemove).toHaveBeenCalledOnce()
-  })
-
-  it('gives the remove button a ≥ 44 px hit area', () => {
-    render(<Chip label="Pizza night" onRemove={() => {}} />)
-    expectMinHitArea(screen.getByRole('button', { name: 'Remove Pizza night' }))
-  })
-})

web/src/ui/Chip.tsx

@@ -1,24 +0,0 @@
-import type { ComponentPropsWithRef } from 'react'
-import styles from './Chip.module.css'
-
-export type ChipProps = Omit<ComponentPropsWithRef<'span'>, 'children'> & {
-  label: string
-  // When set, the chip shows a "Remove {label}" button that calls it.
-  onRemove?: () => void
-}
-
-export function Chip({ label, onRemove, className, ...rest }: ChipProps) {
-  const classes = [styles.chip, onRemove && styles.removable, className].filter(Boolean).join(' ')
-  return (
-    <span className={classes} {...rest}>
-      {label}
-      {onRemove && (
-        <button type="button" className={styles.remove} aria-label={`Remove ${label}`} onClick={onRemove}>
-          <svg viewBox="0 0 12 12" width="10" height="10" aria-hidden="true">
-            <path d="M2 2l8 8M10 2l-8 8" stroke="currentColor" strokeWidth="2.75" strokeLinecap="round" />
-          </svg>
-        </button>
-      )}
-    </span>
-  )
-}

web/src/ui/EmptyState.module.css

@@ -1,30 +0,0 @@
-.empty {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: var(--space-3);
-  padding: var(--space-8) var(--space-4);
-  color: var(--color-text);
-  text-align: center;
-}
-
-.title {
-  margin: 0;
-  font-family: var(--font-heading);
-  font-size: 24px;
-  font-weight: 400;
-  line-height: 1.15;
-}
-
-.body {
-  margin: 0;
-  max-width: 32ch;
-  font-family: var(--font-body);
-  font-size: 15px;
-  line-height: 1.45;
-  color: var(--color-neutral-700);
-}
-
-.action {
-  margin-top: var(--space-2);
-}

web/src/ui/EmptyState.test.tsx

@@ -1,27 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { describe, expect, it, vi } from 'vitest'
-import { expectMinHitArea } from '../test/hitArea.ts'
-import { EmptyState } from './EmptyState.tsx'
-
-describe('EmptyState', () => {
-  it('shows a Bagel title and body without an action by default', () => {
-    render(<EmptyState title="Quest log is empty">Swipe Try it on a Side quest to save it here.</EmptyState>)
-    const title = screen.getByRole('heading', { name: 'Quest log is empty' })
-    expect(getComputedStyle(title).fontFamily).toBe('var(--font-heading)')
-    expect(screen.getByText('Swipe Try it on a Side quest to save it here.')).toBeInTheDocument()
-    expect(screen.queryByRole('button')).not.toBeInTheDocument()
-  })
-
-  it('renders the optional primary action and calls its handler', () => {
-    const onClick = vi.fn()
-    render(
-      <EmptyState title="No Regulars yet" action={{ label: 'Add a dinner', onClick }}>
-        Add the dinners you make most.
-      </EmptyState>,
-    )
-    const action = screen.getByRole('button', { name: 'Add a dinner' })
-    expectMinHitArea(action)
-    fireEvent.click(action)
-    expect(onClick).toHaveBeenCalledTimes(1)
-  })
-})

web/src/ui/EmptyState.tsx

@@ -1,30 +0,0 @@
-import type { ReactNode } from 'react'
-import { Button } from './Button.tsx'
-import styles from './EmptyState.module.css'
-
-export type EmptyStateAction = {
-  label: string
-  onClick: () => void
-}
-
-export type EmptyStateProps = {
-  title: string
-  children: ReactNode
-  // Optional primary action, rendered as a primary Button.
-  action?: EmptyStateAction
-}
-
-// Bagel title, body text and an optional primary action.
-export function EmptyState({ title, children, action }: EmptyStateProps) {
-  return (
-    <section className={styles.empty}>
-      <h2 className={styles.title}>{title}</h2>
-      <p className={styles.body}>{children}</p>
-      {action && (
-        <Button className={styles.action} onClick={action.onClick}>
-          {action.label}
-        </Button>
-      )}
-    </section>
-  )
-}

web/src/ui/ErrorBanner.module.css

@@ -1,16 +0,0 @@
-.banner {
-  display: flex;
-  align-items: center;
-  gap: var(--space-3);
-  background: var(--color-neutral-100);
-}
-
-.message {
-  flex: 1;
-  margin: 0;
-  color: var(--color-accent-700);
-  font-family: var(--font-body);
-  font-size: 15px;
-  font-weight: 600;
-  line-height: 1.35;
-}

web/src/ui/ErrorBanner.test.tsx

@@ -1,32 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { describe, expect, it, vi } from 'vitest'
-import { declaredStyle } from '../test/cssRules.ts'
-import { expectMinHitArea } from '../test/hitArea.ts'
-import { ErrorBanner } from './ErrorBanner.tsx'
-
-describe('ErrorBanner', () => {
-  it('announces the message and calls onRetry from the Retry button', () => {
-    const onRetry = vi.fn()
-    render(<ErrorBanner onRetry={onRetry}>Couldn't load the Supply run.</ErrorBanner>)
-    expect(screen.getByRole('alert')).toHaveTextContent("Couldn't load the Supply run.")
-    const retry = screen.getByRole('button', { name: 'Retry' })
-    expectMinHitArea(retry)
-    fireEvent.click(retry)
-    expect(onRetry).toHaveBeenCalledTimes(1)
-  })
-
-  it('uses a caller-supplied retry label', () => {
-    render(
-      <ErrorBanner onRetry={() => {}} retryLabel="Rebuild week">
-        The plan didn't save.
-      </ErrorBanner>,
-    )
-    expect(screen.getByRole('button', { name: 'Rebuild week' })).toBeInTheDocument()
-  })
-
-  it('is a neutral-100 card with grape-700 text', () => {
-    render(<ErrorBanner onRetry={() => {}}>Offline</ErrorBanner>)
-    expect(declaredStyle(screen.getByRole('alert')).background).toBe('var(--color-neutral-100)')
-    expect(declaredStyle(screen.getByText('Offline')).color).toBe('var(--color-accent-700)')
-  })
-})

web/src/ui/ErrorBanner.tsx

@@ -1,21 +0,0 @@
-import type { ReactNode } from 'react'
-import { Button } from './Button.tsx'
-import { Card } from './Card.tsx'
-import styles from './ErrorBanner.module.css'
-
-export type ErrorBannerProps = {
-  // What went wrong, in the caller's words.
-  children: ReactNode
-  onRetry: () => void
-  retryLabel?: string
-}
-
-// Muted neutral-100 card with grape-700 text and a Retry button.
-export function ErrorBanner({ children, onRetry, retryLabel = 'Retry' }: ErrorBannerProps) {
-  return (
-    <Card tone="muted" role="alert" className={styles.banner}>
-      <p className={styles.message}>{children}</p>
-      <Button onClick={onRetry}>{retryLabel}</Button>
-    </Card>
-  )
-}

web/src/ui/IconButton.module.css

@@ -1,74 +0,0 @@
-/* The button is the hit box; .face is the visible circle. A 40 px face sits in
-   a 44 px hit box whose negative margin keeps the 40 px layout footprint. */
-.button {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  flex: none;
-  padding: 0;
-  border: 0;
-  border-radius: var(--radius-pill);
-  background: transparent;
-  color: inherit;
-  cursor: pointer;
-}
-
-.button:disabled {
-  opacity: 0.45;
-  cursor: not-allowed;
-}
-
-.size40 {
-  width: 44px;
-  height: 44px;
-  margin: -2px;
-}
-
-.size62 {
-  width: 62px;
-  height: 62px;
-}
-
-.face {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  border-radius: var(--radius-pill);
-  transition: transform 100ms var(--ease-out-soft);
-}
-
-.size40 .face {
-  width: 40px;
-  height: 40px;
-}
-
-.size62 .face {
-  width: 62px;
-  height: 62px;
-  box-shadow: var(--shadow-md);
-}
-
-.button:active:not(:disabled) .face {
-  transform: scale(0.97);
-}
-
-.surface {
-  background: var(--color-surface);
-  color: var(--color-text);
-}
-
-.accent {
-  background: var(--color-accent);
-  color: var(--on-accent);
-}
-
-.teal {
-  background: var(--color-accent-2-600);
-  color: var(--on-accent);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .face {
-    transition: none;
-  }
-}

web/src/ui/IconButton.test.tsx

@@ -1,34 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { describe, expect, it, vi } from 'vitest'
-import { hitArea, expectMinHitArea } from '../test/hitArea.ts'
-import { IconButton } from './IconButton.tsx'
-
-describe('IconButton', () => {
-  it('is named by its label, not its icon', () => {
-    const onClick = vi.fn()
-    render(
-      <IconButton label="Notifications" onClick={onClick}>
-        <svg />
-      </IconButton>,
-    )
-    const button = screen.getByRole('button', { name: 'Notifications' })
-    expect(button).toHaveAttribute('type', 'button')
-    fireEvent.click(button)
-    expect(onClick).toHaveBeenCalledOnce()
-  })
-
-  it('keeps a 44 px hit area around the 40 px circle', () => {
-    render(<IconButton label="Back" size={40} />)
-    const button = screen.getByRole('button', { name: 'Back' })
-    expectMinHitArea(button)
-    const face = button.firstElementChild!
-    expect(hitArea(face)).toEqual({ width: 40, height: 40 })
-  })
-
-  it('is 62 px at the large size', () => {
-    render(<IconButton label="Try it" size={62} tone="teal" />)
-    const button = screen.getByRole('button', { name: 'Try it' })
-    expectMinHitArea(button)
-    expect(hitArea(button)).toEqual({ width: 62, height: 62 })
-  })
-})

web/src/ui/IconButton.tsx

@@ -1,33 +0,0 @@
-import type { ComponentPropsWithRef } from 'react'
-import styles from './IconButton.module.css'
-
-export type IconButtonSize = 40 | 62
-export type IconButtonTone = 'surface' | 'accent' | 'teal'
-
-export type IconButtonProps = Omit<ComponentPropsWithRef<'button'>, 'aria-label'> & {
-  // Accessible name; an icon alone never names a button.
-  label: string
-  size?: IconButtonSize
-  tone?: IconButtonTone
-}
-
-// Round icon-only button. The 40 px size keeps a 44 px hit box (see the CSS);
-// the 62 px size is the round action button with --shadow-md.
-export function IconButton({
-  label,
-  size = 40,
-  tone = 'surface',
-  type = 'button',
-  className,
-  children,
-  ...rest
-}: IconButtonProps) {
-  const classes = [styles.button, styles[`size${size}`], className].filter(Boolean).join(' ')
-  return (
-    <button type={type} aria-label={label} className={classes} {...rest}>
-      <span className={[styles.face, styles[tone]].join(' ')} aria-hidden="true">
-        {children}
-      </span>
-    </button>
-  )
-}

web/src/ui/ListRow.module.css

@@ -1,69 +0,0 @@
-.row {
-  box-sizing: border-box;
-  display: flex;
-  align-items: center;
-  gap: var(--space-3);
-  width: 100%;
-  min-height: 44px;
-  padding: 14px 16px;
-  color: var(--color-text);
-  text-align: left;
-}
-
-.interactive {
-  padding: 0;
-  border-radius: var(--radius-md);
-}
-
-.interactive:hover {
-  background: var(--color-neutral-200);
-}
-
-.main {
-  box-sizing: border-box;
-  display: flex;
-  align-items: center;
-  gap: var(--space-3);
-  flex: 1 1 auto;
-  min-width: 44px;
-  min-height: 44px;
-  padding: 14px 16px;
-  border: 0;
-  border-radius: var(--radius-md);
-  background: transparent;
-  color: inherit;
-  font: inherit;
-  text-align: left;
-  cursor: pointer;
-}
-
-.interactive > .trailing {
-  padding-right: 16px;
-}
-
-.leading,
-.trailing {
-  display: inline-flex;
-  align-items: center;
-  flex: none;
-}
-
-.body {
-  display: flex;
-  flex-direction: column;
-  flex: 1 1 auto;
-  min-width: 0;
-}
-
-.title {
-  font-family: var(--font-body);
-  font-size: 15px;
-  font-weight: 700;
-}
-
-.meta {
-  font-family: var(--font-body);
-  font-size: 12px;
-  font-weight: 600;
-  color: var(--color-neutral-700);
-}

web/src/ui/ListRow.test.tsx

@@ -1,57 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { describe, expect, it, vi } from 'vitest'
-import { expectMinHitArea } from '../test/hitArea.ts'
-import { ListRow } from './ListRow.tsx'
-import { Toggle } from './Toggle.tsx'
-
-describe('ListRow', () => {
-  it('renders leading, title, meta and trailing slots without being interactive', () => {
-    render(
-      <ListRow
-        leading={<span>icon</span>}
-        title="Notifications"
-        meta="Push and Google Chat"
-        trailing={<span>chevron</span>}
-      />,
-    )
-    for (const text of ['icon', 'Notifications', 'Push and Google Chat', 'chevron']) {
-      expect(screen.getByText(text)).toBeInTheDocument()
-    }
-    expect(screen.queryByRole('button')).not.toBeInTheDocument()
-  })
-
-  it('is a single button with a ≥ 44 px hit area when it has onClick', () => {
-    const onClick = vi.fn()
-    render(<ListRow title="10 new side quests to swipe" onClick={onClick} />)
-    const row = screen.getByRole('button', { name: '10 new side quests to swipe' })
-    expect(row).toHaveAttribute('type', 'button')
-    expectMinHitArea(row)
-    fireEvent.click(row)
-    expect(onClick).toHaveBeenCalledOnce()
-  })
-
-  it('keeps a trailing toggle outside the row button so each control fires only its own action', () => {
-    const onClick = vi.fn()
-    const onCheckedChange = vi.fn()
-    render(
-      <ListRow
-        title="Dinner reminders"
-        meta="Push at 4 pm"
-        trailing={<Toggle aria-label="Dinner reminders" checked={false} onCheckedChange={onCheckedChange} />}
-        onClick={onClick}
-      />,
-    )
-    const row = screen.getByRole('button', { name: /^Dinner reminders/ })
-    const toggle = screen.getByRole('switch', { name: 'Dinner reminders' })
-    expect(row).not.toContainElement(toggle)
-    expect(row.querySelector('button')).toBeNull()
-
-    fireEvent.click(toggle)
-    expect(onCheckedChange).toHaveBeenCalledExactlyOnceWith(true)
-    expect(onClick).not.toHaveBeenCalled()
-
-    fireEvent.click(row)
-    expect(onClick).toHaveBeenCalledOnce()
-    expect(onCheckedChange).toHaveBeenCalledOnce()
-  })
-})

web/src/ui/ListRow.tsx

@@ -1,45 +0,0 @@
-import type { ReactNode } from 'react'
-import styles from './ListRow.module.css'
-
-export type ListRowProps = {
-  title: ReactNode
-  meta?: ReactNode
-  // Leading slot: icon, photo or avatar.
-  leading?: ReactNode
-  // Trailing slot: chevron, toggle, count or action.
-  trailing?: ReactNode
-  // When set, the leading slot, title and meta form one button. The trailing
-  // slot stays a sibling outside it, so a trailing toggle or action is never
-  // nested in the row's button and never triggers the row's action.
-  onClick?: () => void
-  className?: string
-}
-
-export function ListRow({ title, meta, leading, trailing, onClick, className }: ListRowProps) {
-  const main = (
-    <>
-      {leading && <span className={styles.leading}>{leading}</span>}
-      <span className={styles.body}>
-        <span className={styles.title}>{title}</span>
-        {meta && <span className={styles.meta}>{meta}</span>}
-      </span>
-    </>
-  )
-  const trailingSlot = trailing && <span className={styles.trailing}>{trailing}</span>
-  if (onClick) {
-    return (
-      <div className={[styles.row, styles.interactive, className].filter(Boolean).join(' ')}>
-        <button type="button" className={styles.main} onClick={onClick}>
-          {main}
-        </button>
-        {trailingSlot}
-      </div>
-    )
-  }
-  return (
-    <div className={[styles.row, className].filter(Boolean).join(' ')}>
-      {main}
-      {trailingSlot}
-    </div>
-  )
-}

web/src/ui/Segmented.module.css

@@ -1,35 +0,0 @@
-.track {
-  display: flex;
-  gap: 4px;
-  padding: 4px;
-  border-radius: var(--radius-pill);
-  background: var(--color-surface);
-}
-
-.option {
-  flex: 1 1 0;
-  min-width: 44px;
-  min-height: 44px;
-  padding: 0 var(--space-4);
-  border: 0;
-  border-radius: var(--radius-pill);
-  background: transparent;
-  color: var(--color-neutral-700);
-  font-family: var(--font-body);
-  font-size: 14px;
-  font-weight: 700;
-  cursor: pointer;
-  transition: background-color 150ms var(--ease-out-soft), box-shadow 150ms var(--ease-out-soft);
-}
-
-.selected {
-  background: var(--color-bg);
-  color: var(--color-text);
-  box-shadow: var(--shadow-sm);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .option {
-    transition: none;
-  }
-}

web/src/ui/Segmented.test.tsx

@@ -1,91 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { useState } from 'react'
-import { describe, expect, it } from 'vitest'
-import { expectMinHitArea } from '../test/hitArea.ts'
-import { Segmented } from './Segmented.tsx'
-import styles from './Segmented.module.css'
-
-const options = [
-  { value: 'week', label: 'Week' },
-  { value: 'month', label: 'Month' },
-  { value: 'year', label: 'Year' },
-] as const
-
-type Period = (typeof options)[number]['value']
-
-function Harness({ initial = 'week' }: { initial?: Period }) {
-  const [value, setValue] = useState<Period>(initial)
-  return <Segmented label="Archive period" options={options} value={value} onValueChange={setValue} />
-}
-
-function radio(name: string) {
-  return screen.getByRole('radio', { name })
-}
-
-describe('Segmented', () => {
-  it('is a named radiogroup of radios with one checked', () => {
-    render(<Harness />)
-    expect(screen.getByRole('radiogroup', { name: 'Archive period' })).toBeInTheDocument()
-    expect(screen.getAllByRole('radio')).toHaveLength(3)
-    expect(radio('Week')).toHaveAttribute('aria-checked', 'true')
-    expect(radio('Month')).toHaveAttribute('aria-checked', 'false')
-    expect(radio('Week')).toHaveClass(styles.selected!)
-  })
-
-  it('has a single tab stop on the selected option', () => {
-    render(<Harness initial="month" />)
-    expect(radio('Month')).toHaveAttribute('tabindex', '0')
-    expect(radio('Week')).toHaveAttribute('tabindex', '-1')
-    expect(radio('Year')).toHaveAttribute('tabindex', '-1')
-  })
-
-  it('moves selection and focus with the arrow keys, wrapping at the ends', () => {
-    render(<Harness />)
-    radio('Week').focus()
-
-    fireEvent.keyDown(radio('Week'), { key: 'ArrowRight' })
-    expect(radio('Month')).toHaveAttribute('aria-checked', 'true')
-    expect(radio('Month')).toHaveFocus()
-
-    fireEvent.keyDown(radio('Month'), { key: 'ArrowDown' })
-    expect(radio('Year')).toHaveAttribute('aria-checked', 'true')
-
-    fireEvent.keyDown(radio('Year'), { key: 'ArrowRight' })
-    expect(radio('Week')).toHaveAttribute('aria-checked', 'true')
-    expect(radio('Week')).toHaveFocus()
-
-    fireEvent.keyDown(radio('Week'), { key: 'ArrowLeft' })
-    expect(radio('Year')).toHaveAttribute('aria-checked', 'true')
-
-    fireEvent.keyDown(radio('Year'), { key: 'ArrowUp' })
-    expect(radio('Month')).toHaveAttribute('aria-checked', 'true')
-    expect(radio('Month')).toHaveFocus()
-    expect(radio('Year')).toHaveAttribute('aria-checked', 'false')
-  })
-
-  it('jumps to the first and last option with Home and End', () => {
-    render(<Harness initial="month" />)
-    fireEvent.keyDown(radio('Month'), { key: 'End' })
-    expect(radio('Year')).toHaveAttribute('aria-checked', 'true')
-    fireEvent.keyDown(radio('Year'), { key: 'Home' })
-    expect(radio('Week')).toHaveAttribute('aria-checked', 'true')
-  })
-
-  it('selects an option on click', () => {
-    render(<Harness />)
-    fireEvent.click(radio('Year'))
-    expect(radio('Year')).toHaveAttribute('aria-checked', 'true')
-    expect(radio('Week')).toHaveAttribute('aria-checked', 'false')
-  })
-
-  it('gives every option a ≥ 44 px hit area', () => {
-    render(<Harness />)
-    for (const option of screen.getAllByRole('radio')) expectMinHitArea(option)
-  })
-
-  it('fails fast when the value is not one of the options', () => {
-    expect(() =>
-      render(<Segmented label="Archive period" options={options} value={'decade' as Period} onValueChange={() => {}} />),
-    ).toThrow('value "decade" is not one of its options')
-  })
-})

web/src/ui/Segmented.tsx

@@ -1,76 +0,0 @@
-import { useRef, type KeyboardEvent } from 'react'
-import styles from './Segmented.module.css'
-
-export type SegmentedOption<T extends string> = {
-  value: T
-  label: string
-}
-
-export type SegmentedProps<T extends string> = {
-  // Accessible name of the radiogroup.
-  label: string
-  options: readonly SegmentedOption<T>[]
-  value: T
-  onValueChange: (value: T) => void
-  className?: string
-}
-
-const step: Record<string, number> = { ArrowRight: 1, ArrowDown: 1, ArrowLeft: -1, ArrowUp: -1 }
-
-// Segmented control with radiogroup semantics: one tab stop (the selected
-// option); arrow keys move the selection and focus, wrapping at the ends;
-// Home and End jump to the first and last option.
-export function Segmented<T extends string>({ label, options, value, onValueChange, className }: SegmentedProps<T>) {
-  const refs = useRef<(HTMLButtonElement | null)[]>([])
-  const selected = options.findIndex((option) => option.value === value)
-  if (selected === -1) {
-    throw new Error(`Segmented "${label}": value "${value}" is not one of its options`)
-  }
-
-  function select(index: number) {
-    const option = options[index]
-    if (!option) throw new Error(`Segmented "${label}": no option at index ${index}`)
-    onValueChange(option.value)
-    refs.current[index]?.focus()
-  }
-
-  function onKeyDown(event: KeyboardEvent<HTMLDivElement>) {
-    const delta = step[event.key]
-    let next: number
-    if (delta !== undefined) next = (selected + delta + options.length) % options.length
-    else if (event.key === 'Home') next = 0
-    else if (event.key === 'End') next = options.length - 1
-    else return
-    event.preventDefault()
-    select(next)
-  }
-
-  return (
-    <div
-      role="radiogroup"
-      aria-label={label}
-      className={[styles.track, className].filter(Boolean).join(' ')}
-      onKeyDown={onKeyDown}
-    >
-      {options.map((option, index) => {
-        const checked = index === selected
-        return (
-          <button
-            key={option.value}
-            ref={(el) => {
-              refs.current[index] = el
-            }}
-            type="button"
-            role="radio"
-            aria-checked={checked}
-            tabIndex={checked ? 0 : -1}
-            className={checked ? `${styles.option} ${styles.selected}` : styles.option}
-            onClick={() => select(index)}
-          >
-            {option.label}
-          </button>
-        )
-      })}
-    </div>
-  )
-}

web/src/ui/Sheet.module.css

@@ -1,57 +0,0 @@
-.root {
-  position: fixed;
-  inset: 0;
-  z-index: 100;
-}
-
-.scrim {
-  position: absolute;
-  inset: 0;
-  background: color-mix(in srgb, var(--color-neutral-900) 50%, transparent);
-  animation: fade 320ms var(--ease-out-soft);
-}
-
-.panel {
-  position: absolute;
-  right: 0;
-  bottom: 0;
-  left: 0;
-  max-height: 90dvh;
-  overflow-y: auto;
-  padding: var(--space-6) var(--space-4) calc(var(--space-6) + env(safe-area-inset-bottom));
-  border-radius: var(--radius-lg) var(--radius-lg) 0 0;
-  background: var(--color-bg);
-  color: var(--color-text);
-  box-shadow: var(--shadow-lg);
-  transform: translateY(0);
-  animation: rise 320ms var(--ease-out-soft);
-}
-
-.panel:focus {
-  outline: none;
-}
-
-@keyframes rise {
-  from {
-    transform: translateY(100%);
-  }
-  to {
-    transform: translateY(0);
-  }
-}
-
-@keyframes fade {
-  from {
-    opacity: 0;
-  }
-  to {
-    opacity: 1;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .scrim,
-  .panel {
-    animation: none;
-  }
-}

web/src/ui/Sheet.test.tsx

@@ -1,267 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { useState } from 'react'
-import { describe, expect, it, vi } from 'vitest'
-import '../styles/tokens.css'
-import { animationKeyframes, declaredStyle, reducedMotionStyle } from '../test/cssRules.ts'
-import { Sheet } from './Sheet.tsx'
-import styles from './Sheet.module.css'
-
-function Harness({ withControls = true }: { withControls?: boolean }) {
-  const [open, setOpen] = useState(false)
-  return (
-    <>
-      <button type="button" onClick={() => setOpen(true)}>
-        Open Supply run
-      </button>
-      <Sheet aria-label="Supply run" open={open} onClose={() => setOpen(false)}>
-        <p>Grouped by dinner</p>
-        {withControls && (
-          <>
-            <button type="button">Try it</button>
-            <button type="button">Pass</button>
-          </>
-        )}
-      </Sheet>
-    </>
-  )
-}
-
-function openSheet() {
-  const opener = screen.getByRole('button', { name: 'Open Supply run' })
-  opener.focus()
-  fireEvent.click(opener)
-  return { opener, dialog: screen.getByRole('dialog', { name: 'Supply run' }) }
-}
-
-function scrim() {
-  const element = document.querySelector(`.${styles.scrim}`)
-  if (!element) throw new Error('scrim not rendered')
-  return element
-}
-
-describe('Sheet', () => {
-  it('renders nothing while closed', () => {
-    render(<Harness />)
-    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
-  })
-
-  it('is a labelled modal dialog', () => {
-    render(<Harness />)
-    const { dialog } = openSheet()
-    expect(dialog).toHaveAttribute('aria-modal', 'true')
-  })
-
-  it('accepts aria-labelledby as its accessible name', () => {
-    render(
-      <>
-        <h2 id="sheet-title">Quest log</h2>
-        <Sheet aria-labelledby="sheet-title" open onClose={() => {}}>
-          <p>Nothing yet</p>
-        </Sheet>
-      </>,
-    )
-    expect(screen.getByRole('dialog', { name: 'Quest log' })).toBeInTheDocument()
-  })
-
-  it('moves focus to the first control and restores it to the opener on close', () => {
-    render(<Harness />)
-    const { opener } = openSheet()
-    expect(screen.getByRole('button', { name: 'Try it' })).toHaveFocus()
-    fireEvent.keyDown(document.activeElement!, { key: 'Escape' })
-    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
-    expect(opener).toHaveFocus()
-  })
-
-  it('focuses the dialog itself when it has no focusable control', () => {
-    render(<Harness withControls={false} />)
-    const { dialog } = openSheet()
-    expect(dialog).toHaveFocus()
-  })
-
-  it('skips controls that cannot take keyboard focus when moving focus in', () => {
-    render(
-      <Sheet aria-label="Quest log" open onClose={() => {}}>
-        <button type="button" hidden>
-          Hidden
-        </button>
-        <button type="button" style={{ display: 'none' }}>
-          Not displayed
-        </button>
-        <button type="button" style={{ visibility: 'hidden' }}>
-          Invisible
-        </button>
-        <button type="button" tabIndex={-1}>
-          Not tabbable
-        </button>
-        <div aria-hidden="true">
-          <button type="button">Aria hidden</button>
-        </div>
-        <button type="button">Try it</button>
-      </Sheet>,
-    )
-    expect(screen.getByRole('button', { name: 'Try it' })).toHaveFocus()
-  })
-
-  it('focuses the dialog itself when every control is hidden', () => {
-    render(
-      <Sheet aria-label="Quest log" open onClose={() => {}}>
-        <button type="button" hidden>
-          Hidden
-        </button>
-      </Sheet>,
-    )
-    expect(screen.getByRole('dialog', { name: 'Quest log' })).toHaveFocus()
-  })
-
-  it('does not stop the Tab trap on a hidden control', () => {
-    render(
-      <Sheet aria-label="Quest log" open onClose={() => {}}>
-        <button type="button" hidden>
-          Hidden first
-        </button>
-        <button type="button">Try it</button>
-        <button type="button">Pass</button>
-        <button type="button" hidden>
-          Hidden last
-        </button>
-      </Sheet>,
-    )
-    const first = screen.getByRole('button', { name: 'Try it' })
-    const last = screen.getByRole('button', { name: 'Pass' })
-
-    last.focus()
-    fireEvent.keyDown(last, { key: 'Tab' })
-    expect(first).toHaveFocus()
-
-    fireEvent.keyDown(first, { key: 'Tab', shiftKey: true })
-    expect(last).toHaveFocus()
-  })
-
-  it('does not stop the Tab trap on a control disabled by its fieldset', () => {
-    render(
-      <Sheet aria-label="Quest log" open onClose={() => {}}>
-        <fieldset disabled>
-          <button type="button">Disabled first</button>
-        </fieldset>
-        <button type="button">Try it</button>
-        <button type="button">Pass</button>
-        <fieldset disabled>
-          <button type="button">Disabled last</button>
-        </fieldset>
-      </Sheet>,
-    )
-    const first = screen.getByRole('button', { name: 'Try it' })
-    const last = screen.getByRole('button', { name: 'Pass' })
-    expect(first).toHaveFocus()
-
-    last.focus()
-    fireEvent.keyDown(last, { key: 'Tab' })
-    expect(first).toHaveFocus()
-
-    fireEvent.keyDown(first, { key: 'Tab', shiftKey: true })
-    expect(last).toHaveFocus()
-  })
-
-  it('wraps Tab and Shift+Tab inside the sheet', () => {
-    render(<Harness />)
-    openSheet()
-    const first = screen.getByRole('button', { name: 'Try it' })
-    const last = screen.getByRole('button', { name: 'Pass' })
-
-    last.focus()
-    fireEvent.keyDown(last, { key: 'Tab' })
-    expect(first).toHaveFocus()
-
-    fireEvent.keyDown(first, { key: 'Tab', shiftKey: true })
-    expect(last).toHaveFocus()
-  })
-
-  it('keeps focus on the dialog when Tab has nowhere to go', () => {
-    render(<Harness withControls={false} />)
-    const { dialog } = openSheet()
-    const tab = fireEvent.keyDown(dialog, { key: 'Tab' })
-    expect(tab).toBe(false) // default prevented
-    expect(dialog).toHaveFocus()
-  })
-
-  it('closes on Escape', () => {
-    const onClose = vi.fn()
-    render(
-      <Sheet aria-label="Supply run" open onClose={onClose}>
-        <button type="button">Try it</button>
-      </Sheet>,
-    )
-    fireEvent.keyDown(screen.getByRole('button', { name: 'Try it' }), { key: 'Escape' })
-    expect(onClose).toHaveBeenCalledTimes(1)
-  })
-
-  it('closes on a scrim click but not on a panel click', () => {
-    const onClose = vi.fn()
-    render(
-      <Sheet aria-label="Supply run" open onClose={onClose}>
-        <p>Grouped by dinner</p>
-      </Sheet>,
-    )
-    fireEvent.click(screen.getByRole('dialog'))
-    fireEvent.click(screen.getByText('Grouped by dinner'))
-    expect(onClose).not.toHaveBeenCalled()
-    fireEvent.click(scrim())
-    expect(onClose).toHaveBeenCalledTimes(1)
-  })
-
-  it('makes the background inert while open and restores it on close', () => {
-    const { container } = render(<Harness />)
-    openSheet()
-    const root = screen.getByRole('dialog').parentElement!
-    expect(root.parentElement).toBe(document.body)
-    expect(container).toHaveAttribute('inert')
-    expect(root).not.toHaveAttribute('inert')
-
-    fireEvent.click(scrim())
-    expect(container).not.toHaveAttribute('inert')
-  })
-
-  it('leaves an already-inert background element inert after close', () => {
-    const other = document.createElement('div')
-    other.setAttribute('inert', '')
-    document.body.append(other)
-    try {
-      render(<Harness />)
-      openSheet()
-      fireEvent.click(scrim())
-      expect(other).toHaveAttribute('inert')
-    } finally {
-      other.remove()
-    }
-  })
-
-  it('rises from 100% to 0 over 320 ms with the soft ease-out', () => {
-    render(<Harness />)
-    const { dialog } = openSheet()
-    expect(declaredStyle(dialog).animation.split(' ').slice(1)).toEqual(['320ms', 'var(--ease-out-soft)'])
-    const easing = getComputedStyle(document.documentElement).getPropertyValue('--ease-out-soft')
-    expect(easing.replace(/\s/g, '')).toBe('cubic-bezier(.2,.8,.2,1)')
-    const rise = animationKeyframes(dialog)
-    expect(rise.findRule('from')?.style.transform).toBe('translateY(100%)')
-    expect(rise.findRule('to')?.style.transform).toBe('translateY(0)')
-  })
-
-  it('fades the scrim in to 50% neutral-900', () => {
-    render(<Harness />)
-    openSheet()
-    const style = declaredStyle(scrim())
-    expect(style.background).toBe('color-mix(in srgb, var(--color-neutral-900) 50%, transparent)')
-    expect(style.animation.split(' ').slice(1)).toEqual(['320ms', 'var(--ease-out-soft)'])
-    const fade = animationKeyframes(scrim())
-    expect(fade.findRule('from')?.style.opacity).toBe('0')
-    expect(fade.findRule('to')?.style.opacity).toBe('1')
-  })
-
-  it('opens in place with no rise or fade under reduced motion', () => {
-    render(<Harness />)
-    const { dialog } = openSheet()
-    expect(reducedMotionStyle(dialog).animation).toBe('none')
-    expect(reducedMotionStyle(scrim()).animation).toBe('none')
-    expect(declaredStyle(dialog).transform).toBe('translateY(0)')
-  })
-})

web/src/ui/Sheet.tsx

@@ -1,123 +0,0 @@
-import { useEffect, useRef, type KeyboardEvent, type ReactNode } from 'react'
-import { createPortal } from 'react-dom'
-import styles from './Sheet.module.css'
-
-// The dialog's accessible name: exactly one of a label or a labelling element.
-type SheetName =
-  | { 'aria-label': string; 'aria-labelledby'?: never }
-  | { 'aria-labelledby': string; 'aria-label'?: never }
-
-export type SheetProps = SheetName & {
-  open: boolean
-  onClose: () => void
-  children: ReactNode
-}
-
-const focusableSelector = [
-  'a[href]',
-  'button',
-  'input',
-  'select',
-  'textarea',
-  '[tabindex]',
-].join(',')
-
-// Whether an element can take keyboard focus: being disabled (by its own
-// attribute or a disabled fieldset), a negative tabIndex, a hidden, aria-hidden
-// or inert ancestor (or self), display: none on the way up to the panel, or
-// visibility: hidden all rule it out.
-function isKeyboardFocusable(element: HTMLElement, panel: HTMLElement): boolean {
-  if (element.matches(':disabled')) return false
-  if (element.tabIndex < 0) return false
-  if (element.closest('[hidden], [aria-hidden="true"], [inert]')) return false
-  if (getComputedStyle(element).visibility === 'hidden') return false
-  for (let node: HTMLElement | null = element; node && node !== panel; node = node.parentElement) {
-    if (getComputedStyle(node).display === 'none') return false
-  }
-  return true
-}
-
-function focusables(panel: HTMLElement): HTMLElement[] {
-  return Array.from(panel.querySelectorAll<HTMLElement>(focusableSelector)).filter((element) =>
-    isKeyboardFocusable(element, panel),
-  )
-}
-
-// Focuses the first control that actually takes focus, or the panel if none does.
-function focusFirst(panel: HTMLElement) {
-  for (const element of focusables(panel)) {
-    element.focus()
-    if (document.activeElement === element) return
-  }
-  panel.focus()
-}
-
-// Modal bottom sheet. Portalled to <body> so everything else there can be made
-// inert while it is open. Focus moves in on open, Tab is trapped inside, and
-// focus returns to the opener on close. Escape and a scrim click call onClose.
-export function Sheet({ open, onClose, children, ...name }: SheetProps) {
-  const rootRef = useRef<HTMLDivElement>(null)
-  const panelRef = useRef<HTMLDivElement>(null)
-
-  useEffect(() => {
-    const root = rootRef.current
-    const panel = panelRef.current
-    if (!open || !root || !panel) return
-
-    const opener = document.activeElement instanceof HTMLElement ? document.activeElement : null
-    const background = Array.from(document.body.children).filter(
-      (element) => element !== root && !element.hasAttribute('inert'),
-    )
-    for (const element of background) element.setAttribute('inert', '')
-    focusFirst(panel)
-
-    return () => {
-      for (const element of background) element.removeAttribute('inert')
-      opener?.focus()
-    }
-  }, [open])
-
-  if (!open) return null
-
-  function onKeyDown(event: KeyboardEvent<HTMLDivElement>) {
-    if (event.key === 'Escape') {
-      event.stopPropagation()
-      onClose()
-      return
-    }
-    if (event.key !== 'Tab' || !panelRef.current) return
-    const items = focusables(panelRef.current)
-    const first = items[0]
-    const last = items[items.length - 1]
-    if (!first || !last) {
-      event.preventDefault()
-      return
-    }
-    const active = document.activeElement
-    if (event.shiftKey && (active === first || active === panelRef.current)) {
-      event.preventDefault()
-      last.focus()
-    } else if (!event.shiftKey && active === last) {
-      event.preventDefault()
-      first.focus()
-    }
-  }
-
-  return createPortal(
-    <div ref={rootRef} className={styles.root}>
-      <div className={styles.scrim} aria-hidden="true" onClick={onClose} />
-      <div
-        ref={panelRef}
-        role="dialog"
-        aria-modal="true"
-        tabIndex={-1}
-        className={styles.panel}
-        onKeyDown={onKeyDown}
-        {...name}
-      >
-        {children}
-      </div>
-    </div>,
-    document.body,
-  )
-}

web/src/ui/Skeleton.module.css

@@ -1,24 +0,0 @@
-.skeleton {
-  display: block;
-  width: 100%;
-  height: 16px;
-  border-radius: var(--radius-pill);
-  background: var(--color-surface);
-  animation: pulse 1.2s ease-in-out infinite;
-}
-
-@keyframes pulse {
-  0%,
-  100% {
-    opacity: 1;
-  }
-  50% {
-    opacity: 0.45;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .skeleton {
-    animation: none;
-  }
-}

web/src/ui/Skeleton.test.tsx

@@ -1,36 +0,0 @@
-import { render } from '@testing-library/react'
-import { describe, expect, it } from 'vitest'
-import { animationKeyframes, declaredStyle, reducedMotionStyle } from '../test/cssRules.ts'
-import { Skeleton } from './Skeleton.tsx'
-
-function skeleton(container: HTMLElement) {
-  return container.firstElementChild as HTMLElement
-}
-
-describe('Skeleton', () => {
-  it('is a hidden pill in --color-surface', () => {
-    const { container } = render(<Skeleton />)
-    const element = skeleton(container)
-    expect(element).toHaveAttribute('aria-hidden', 'true')
-    const style = declaredStyle(element)
-    expect(style.borderRadius).toBe('var(--radius-pill)')
-    expect(style.background).toBe('var(--color-surface)')
-  })
-
-  it('pulses its opacity over 1.2 s', () => {
-    const { container } = render(<Skeleton />)
-    expect(declaredStyle(skeleton(container)).animation.split(' ').slice(1)).toEqual(['1.2s', 'ease-in-out', 'infinite'])
-    expect(animationKeyframes(skeleton(container)).findRule('50%')?.style.opacity).toBe('0.45')
-  })
-
-  it('does not pulse under reduced motion', () => {
-    const { container } = render(<Skeleton />)
-    expect(reducedMotionStyle(skeleton(container)).animation).toBe('none')
-  })
-
-  it('merges a caller className and forwards style', () => {
-    const { container } = render(<Skeleton className="line" style={{ width: '60%' }} />)
-    expect(skeleton(container)).toHaveClass('line')
-    expect(skeleton(container).style.width).toBe('60%')
-  })
-})

web/src/ui/Skeleton.tsx

@@ -1,12 +0,0 @@
-import type { ComponentPropsWithRef } from 'react'
-import styles from './Skeleton.module.css'
-
-export type SkeletonProps = Omit<ComponentPropsWithRef<'div'>, 'children'>
-
-// Loading placeholder: a pill in --color-surface with a 1.2 s opacity pulse.
-// Full width and 16 px tall by default; size it with className or style.
-// Hidden from assistive technology — announce loading on the container.
-export function Skeleton({ className, ...rest }: SkeletonProps) {
-  const classes = [styles.skeleton, className].filter(Boolean).join(' ')
-  return <div aria-hidden="true" className={classes} {...rest} />
-}

web/src/ui/Slider.module.css

@@ -1,61 +0,0 @@
-/* The input is the 44 px tall hit area; the track and knob are drawn by the
-   vendor pseudo-elements. --slider-fill is set inline from the value. */
-.slider {
-  appearance: none;
-  display: block;
-  width: 100%;
-  min-width: 44px;
-  height: 44px;
-  margin: 0;
-  background: transparent;
-  cursor: pointer;
-}
-
-.slider:disabled {
-  opacity: 0.45;
-  cursor: not-allowed;
-}
-
-.slider::-webkit-slider-runnable-track {
-  height: 8px;
-  border-radius: var(--radius-pill);
-  background: linear-gradient(
-    to right,
-    var(--color-accent) var(--slider-fill),
-    var(--color-neutral-300) var(--slider-fill)
-  );
-}
-
-.slider::-webkit-slider-thumb {
-  appearance: none;
-  box-sizing: border-box;
-  width: 24px;
-  height: 24px;
-  margin-top: -8px;
-  border: 3px solid var(--color-accent);
-  border-radius: var(--radius-pill);
-  background: var(--color-bg);
-  box-shadow: var(--shadow-sm);
-}
-
-.slider::-moz-range-track {
-  height: 8px;
-  border-radius: var(--radius-pill);
-  background: var(--color-neutral-300);
-}
-
-.slider::-moz-range-progress {
-  height: 8px;
-  border-radius: var(--radius-pill);
-  background: var(--color-accent);
-}
-
-.slider::-moz-range-thumb {
-  box-sizing: border-box;
-  width: 24px;
-  height: 24px;
-  border: 3px solid var(--color-accent);
-  border-radius: var(--radius-pill);
-  background: var(--color-bg);
-  box-shadow: var(--shadow-sm);
-}

web/src/ui/Slider.test.tsx

@@ -1,69 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { useState } from 'react'
-import { describe, expect, it } from 'vitest'
-import { expectMinHitArea } from '../test/hitArea.ts'
-import { Slider } from './Slider.tsx'
-
-function Harness() {
-  const [value, setValue] = useState(0.7)
-  return (
-    <Slider
-      aria-label="Creativity (temperature)"
-      min={0}
-      max={1}
-      step={0.1}
-      value={value}
-      onChange={(event) => setValue(Number(event.target.value))}
-    />
-  )
-}
-
-describe('Slider', () => {
-  it('is a native slider exposing its range and value', () => {
-    render(<Harness />)
-    const slider = screen.getByRole('slider', { name: 'Creativity (temperature)' })
-    expect(slider).toHaveAttribute('type', 'range')
-    expect(slider).toHaveAttribute('min', '0')
-    expect(slider).toHaveAttribute('max', '1')
-    expect(slider).toHaveValue('0.7')
-  })
-
-  it('updates the grape fill with the value', () => {
-    render(<Harness />)
-    const slider = screen.getByRole('slider')
-    expect(slider.style.getPropertyValue('--slider-fill')).toBe('70%')
-    fireEvent.change(slider, { target: { value: '0.2' } })
-    expect(slider).toHaveValue('0.2')
-    expect(slider.style.getPropertyValue('--slider-fill')).toBe('20%')
-  })
-
-  it('has a ≥ 44 px hit area', () => {
-    render(<Harness />)
-    expectMinHitArea(screen.getByRole('slider'))
-  })
-
-  it('fails fast on an empty range', () => {
-    expect(() => render(<Slider aria-label="Bad" min={1} max={1} value={1} readOnly />)).toThrow(
-      'max (1) must be greater than min (1)',
-    )
-  })
-
-  it('accepts values at both ends of the range', () => {
-    render(
-      <>
-        <Slider aria-label="At min" min={0} max={1} value={0} readOnly />
-        <Slider aria-label="At max" min={0} max={1} value={1} readOnly />
-      </>,
-    )
-    expect(screen.getByRole('slider', { name: 'At min' }).style.getPropertyValue('--slider-fill')).toBe('0%')
-    expect(screen.getByRole('slider', { name: 'At max' }).style.getPropertyValue('--slider-fill')).toBe('100%')
-  })
-
-  it.each([
-    [2, 'value (2) must be within [0, 1]'],
-    [-0.1, 'value (-0.1) must be within [0, 1]'],
-    [Number.NaN, 'value (NaN) must be within [0, 1]'],
-  ])('fails fast when the value %s is outside the range', (value, message) => {
-    expect(() => render(<Slider aria-label="Bad" min={0} max={1} value={value} readOnly />)).toThrow(message)
-  })
-})

web/src/ui/Slider.tsx

@@ -1,30 +0,0 @@
-import type { CSSProperties, ComponentPropsWithRef } from 'react'
-import styles from './Slider.module.css'
-
-export type SliderProps = Omit<ComponentPropsWithRef<'input'>, 'type' | 'value' | 'min' | 'max'> & {
-  value: number
-  min: number
-  max: number
-}
-
-// Native range input, styled: 8 px track, grape fill up to the value, 24 px
-// knob with a 3 px grape ring. Controlled, because the fill follows `value`.
-// Name it with aria-label or aria-labelledby.
-export function Slider({ value, min, max, className, style, ...rest }: SliderProps) {
-  if (!(max > min)) throw new Error(`Slider: max (${max}) must be greater than min (${min})`)
-  if (!(value >= min && value <= max)) {
-    throw new Error(`Slider: value (${value}) must be within [${min}, ${max}]`)
-  }
-  const fill = `${((value - min) / (max - min)) * 100}%`
-  return (
-    <input
-      type="range"
-      value={value}
-      min={min}
-      max={max}
-      className={[styles.slider, className].filter(Boolean).join(' ')}
-      style={{ ...style, '--slider-fill': fill } as CSSProperties}
-      {...rest}
-    />
-  )
-}

web/src/ui/Tag.module.css

@@ -1,21 +0,0 @@
-.tag {
-  display: inline-flex;
-  align-items: center;
-  padding: 4px 10px;
-  border-radius: var(--radius-pill);
-  font-family: var(--font-body);
-  font-size: 11px;
-  font-weight: 700;
-  line-height: 1.2;
-  white-space: nowrap;
-}
-
-.grape {
-  background: var(--color-accent-100);
-  color: var(--color-accent-800);
-}
-
-.teal {
-  background: var(--color-accent-2-200);
-  color: var(--color-accent-2-800);
-}

web/src/ui/Tag.test.tsx

@@ -1,18 +0,0 @@
-import { render, screen } from '@testing-library/react'
-import { describe, expect, it } from 'vitest'
-import { Tag } from './Tag.tsx'
-import styles from './Tag.module.css'
-
-describe('Tag', () => {
-  it('renders a static, non-interactive label', () => {
-    render(<Tag>Draft</Tag>)
-    const tag = screen.getByText('Draft')
-    expect(tag).toHaveClass(styles.grape!)
-    expect(screen.queryByRole('button')).not.toBeInTheDocument()
-  })
-
-  it('supports the teal tone', () => {
-    render(<Tag tone="teal">Synced</Tag>)
-    expect(screen.getByText('Synced')).toHaveClass(styles.teal!)
-  })
-})

web/src/ui/Tag.tsx

@@ -1,14 +0,0 @@
-import type { ComponentPropsWithRef } from 'react'
-import styles from './Tag.module.css'
-
-export type TagTone = 'grape' | 'teal'
-
-export type TagProps = ComponentPropsWithRef<'span'> & {
-  tone?: TagTone
-}
-
-// Static label such as "Draft", "Side quest" or "Synced". Not interactive.
-export function Tag({ tone = 'grape', className, ...rest }: TagProps) {
-  const classes = [styles.tag, styles[tone], className].filter(Boolean).join(' ')
-  return <span className={classes} {...rest} />
-}

web/src/ui/TextInput.module.css

@@ -1,46 +0,0 @@
-.field {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-2);
-}
-
-.label {
-  font-family: var(--font-body);
-  font-size: 14px;
-  font-weight: 700;
-  color: var(--color-neutral-700);
-}
-
-.hiddenLabel {
-  position: absolute;
-  width: 1px;
-  height: 1px;
-  margin: -1px;
-  padding: 0;
-  overflow: hidden;
-  clip-path: inset(50%);
-  white-space: nowrap;
-  border: 0;
-}
-
-.input {
-  box-sizing: border-box;
-  min-width: 44px;
-  height: 48px;
-  padding: 0 20px;
-  border: 1px solid var(--color-neutral-300);
-  border-radius: var(--radius-pill);
-  background: var(--color-surface);
-  color: var(--color-text);
-  font-family: var(--font-body);
-  font-size: 16px;
-}
-
-.input::placeholder {
-  color: var(--color-neutral-700);
-}
-
-.input:disabled {
-  opacity: 0.45;
-  cursor: not-allowed;
-}

web/src/ui/TextInput.test.tsx

@@ -1,34 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { createRef } from 'react'
-import { describe, expect, it, vi } from 'vitest'
-import { hitArea, expectMinHitArea } from '../test/hitArea.ts'
-import { TextInput } from './TextInput.tsx'
-
-describe('TextInput', () => {
-  it('is a textbox named by its label', () => {
-    const onChange = vi.fn()
-    render(<TextInput label="Dinner name" placeholder="e.g. Chicken enchiladas" onChange={onChange} />)
-    const input = screen.getByRole('textbox', { name: 'Dinner name' })
-    fireEvent.change(input, { target: { value: 'Chili' } })
-    expect(onChange).toHaveBeenCalledOnce()
-    expect(input).toHaveValue('Chili')
-  })
-
-  it('keeps the accessible name when the label is visually hidden', () => {
-    render(<TextInput label="Add a regular" labelHidden />)
-    expect(screen.getByRole('textbox', { name: 'Add a regular' })).toBeInTheDocument()
-  })
-
-  it('is a 48 px pill with a ≥ 44 px hit area', () => {
-    render(<TextInput label="Dinner name" />)
-    const input = screen.getByRole('textbox', { name: 'Dinner name' })
-    expectMinHitArea(input)
-    expect(hitArea(input).height).toBe(48)
-  })
-
-  it('forwards the ref', () => {
-    const ref = createRef<HTMLInputElement>()
-    render(<TextInput label="Dinner name" ref={ref} />)
-    expect(ref.current).toBe(screen.getByRole('textbox', { name: 'Dinner name' }))
-  })
-})

web/src/ui/TextInput.tsx

@@ -1,21 +0,0 @@
-import { useId, type ComponentPropsWithRef } from 'react'
-import styles from './TextInput.module.css'
-
-export type TextInputProps = Omit<ComponentPropsWithRef<'input'>, 'id'> & {
-  label: string
-  // Hide the label visually; it stays the input's accessible name.
-  labelHidden?: boolean
-}
-
-// 48 px pill input on the surface fill, always associated with its label.
-export function TextInput({ label, labelHidden = false, type = 'text', className, ...rest }: TextInputProps) {
-  const id = useId()
-  return (
-    <div className={styles.field}>
-      <label htmlFor={id} className={labelHidden ? styles.hiddenLabel : styles.label}>
-        {label}
-      </label>
-      <input id={id} type={type} className={[styles.input, className].filter(Boolean).join(' ')} {...rest} />
-    </div>
-  )
-}

web/src/ui/Toggle.module.css

@@ -1,57 +0,0 @@
-/* The button is a 44 px hit box around the 40×24 track; negative margins keep
-   the 40×24 layout footprint. */
-.toggle {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  flex: none;
-  width: 44px;
-  height: 44px;
-  margin: -10px -2px;
-  padding: 0;
-  border: 0;
-  border-radius: var(--radius-pill);
-  background: transparent;
-  cursor: pointer;
-}
-
-.toggle:disabled {
-  opacity: 0.45;
-  cursor: not-allowed;
-}
-
-.track {
-  position: relative;
-  width: 40px;
-  height: 24px;
-  border-radius: var(--radius-pill);
-  background: var(--color-neutral-300);
-  transition: background-color 150ms var(--ease-out-soft);
-}
-
-.knob {
-  position: absolute;
-  top: 3px;
-  left: 3px;
-  width: 18px;
-  height: 18px;
-  border-radius: var(--radius-pill);
-  background: var(--color-bg);
-  box-shadow: var(--shadow-sm);
-  transition: transform 180ms var(--ease-spring);
-}
-
-.toggle[aria-checked='true'] .track {
-  background: var(--color-accent-2-600);
-}
-
-.toggle[aria-checked='true'] .knob {
-  transform: translateX(16px);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .track,
-  .knob {
-    transition: none;
-  }
-}

web/src/ui/Toggle.test.tsx

@@ -1,63 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { useState } from 'react'
-import { describe, expect, it, vi } from 'vitest'
-import { hitArea, expectMinHitArea } from '../test/hitArea.ts'
-import { Toggle } from './Toggle.tsx'
-
-function Harness() {
-  const [checked, setChecked] = useState(false)
-  return <Toggle aria-label="Push: New weekly plan ready" checked={checked} onCheckedChange={setChecked} />
-}
-
-function toggle() {
-  return screen.getByRole('switch', { name: 'Push: New weekly plan ready' })
-}
-
-describe('Toggle', () => {
-  it('is a switch reflecting its state in aria-checked', () => {
-    render(<Harness />)
-    expect(toggle()).toHaveAttribute('aria-checked', 'false')
-    fireEvent.click(toggle())
-    expect(toggle()).toHaveAttribute('aria-checked', 'true')
-    fireEvent.click(toggle())
-    expect(toggle()).toHaveAttribute('aria-checked', 'false')
-  })
-
-  it.each([' ', 'Enter'])('toggles with the %j key', (key) => {
-    render(<Harness />)
-    fireEvent.keyDown(toggle(), { key })
-    expect(toggle()).toHaveAttribute('aria-checked', 'true')
-    fireEvent.keyDown(toggle(), { key })
-    expect(toggle()).toHaveAttribute('aria-checked', 'false')
-  })
-
-  it('suppresses native activation for Space and Enter so a key press toggles once', () => {
-    render(<Harness />)
-    expect(fireEvent.keyDown(toggle(), { key: ' ' })).toBe(false)
-    expect(fireEvent.keyUp(toggle(), { key: ' ' })).toBe(false)
-    expect(fireEvent.keyDown(toggle(), { key: 'Enter' })).toBe(false)
-    expect(fireEvent.keyDown(toggle(), { key: 'a' })).toBe(true)
-  })
-
-  it('ignores other keys', () => {
-    const onCheckedChange = vi.fn()
-    render(<Toggle aria-label="Chat" checked={false} onCheckedChange={onCheckedChange} />)
-    fireEvent.keyDown(screen.getByRole('switch', { name: 'Chat' }), { key: 'a' })
-    expect(onCheckedChange).not.toHaveBeenCalled()
-  })
-
-  it('is disabled when asked', () => {
-    const onCheckedChange = vi.fn()
-    render(<Toggle aria-label="Chat" checked={false} disabled onCheckedChange={onCheckedChange} />)
-    const sw = screen.getByRole('switch', { name: 'Chat' })
-    expect(sw).toBeDisabled()
-    fireEvent.click(sw)
-    expect(onCheckedChange).not.toHaveBeenCalled()
-  })
-
-  it('draws a 40×24 track inside a ≥ 44 px hit area', () => {
-    render(<Harness />)
-    expectMinHitArea(toggle())
-    expect(hitArea(toggle().firstElementChild!)).toEqual({ width: 40, height: 24 })
-  })
-})

web/src/ui/Toggle.tsx

@@ -1,42 +0,0 @@
-import type { ComponentPropsWithRef, KeyboardEvent } from 'react'
-import styles from './Toggle.module.css'
-
-export type ToggleProps = Omit<
-  ComponentPropsWithRef<'button'>,
-  'type' | 'role' | 'aria-checked' | 'onChange' | 'onClick' | 'onKeyDown' | 'onKeyUp' | 'children'
-> & {
-  checked: boolean
-  onCheckedChange: (checked: boolean) => void
-}
-
-// 40×24 pill switch (role="switch"). Name it with aria-label or
-// aria-labelledby. Space and Enter are handled here and their native button
-// activation is suppressed, so each key press toggles exactly once.
-export function Toggle({ checked, onCheckedChange, className, ...rest }: ToggleProps) {
-  function onKeyDown(event: KeyboardEvent<HTMLButtonElement>) {
-    if (event.key !== ' ' && event.key !== 'Enter') return
-    event.preventDefault()
-    onCheckedChange(!checked)
-  }
-
-  function onKeyUp(event: KeyboardEvent<HTMLButtonElement>) {
-    if (event.key === ' ') event.preventDefault()
-  }
-
-  return (
-    <button
-      type="button"
-      role="switch"
-      aria-checked={checked}
-      className={[styles.toggle, className].filter(Boolean).join(' ')}
-      onClick={() => onCheckedChange(!checked)}
-      onKeyDown={onKeyDown}
-      onKeyUp={onKeyUp}
-      {...rest}
-    >
-      <span className={styles.track} aria-hidden="true">
-        <span className={styles.knob} />
-      </span>
-    </button>
-  )
-}

web/src/ui/index.ts

@@ -1,15 +0,0 @@
-export { Button, type ButtonProps, type ButtonVariant } from './Button.tsx'
-export { Card, type CardProps, type CardTone } from './Card.tsx'
-export { Checkbox, type CheckboxProps } from './Checkbox.tsx'
-export { Chip, type ChipProps } from './Chip.tsx'
-export { EmptyState, type EmptyStateAction, type EmptyStateProps } from './EmptyState.tsx'
-export { ErrorBanner, type ErrorBannerProps } from './ErrorBanner.tsx'
-export { IconButton, type IconButtonProps, type IconButtonSize, type IconButtonTone } from './IconButton.tsx'
-export { ListRow, type ListRowProps } from './ListRow.tsx'
-export { Segmented, type SegmentedOption, type SegmentedProps } from './Segmented.tsx'
-export { Sheet, type SheetProps } from './Sheet.tsx'
-export { Skeleton, type SkeletonProps } from './Skeleton.tsx'
-export { Slider, type SliderProps } from './Slider.tsx'
-export { Tag, type TagProps, type TagTone } from './Tag.tsx'
-export { TextInput, type TextInputProps } from './TextInput.tsx'
-export { Toggle, type ToggleProps } from './Toggle.tsx'

web/vite.config.ts

@@ -14,9 +14,6 @@ export default defineConfig({
   },
   test: {
     environment: 'jsdom',
-    // Inject CSS Modules into jsdom so tests can assert the sizes the
-    // stylesheets actually declare (for example 44 px hit areas).
-    css: true,
     setupFiles: ['./src/test/setup.ts'],
   },
 })