From 239d8fc67d8ff0b30bfa75aee052f21d3556ec05 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Date: Thu, 3 Sep 2026 20:56:44 -0300
Subject: [PATCH] fix(providers): separate MaxAI and UC credential contracts
 (#12431)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Validado em lote numa worktree combinada com os 14 PRs desta campanha de error-boundary sobre o tip de `release/v3.8.51`: `typecheck:core` limpo e **120/120** nos 23 arquivos de teste que os PRs trazem.

Um ponto que só apareceu no tree combinado: **#12465 e #12466 criam o mesmo arquivo novo** `open-sse/utils/streamReadiness.ts` (que não existe no tip) com desenhos divergentes de cancelamento — `cancelled` + `releaseLock` imediato num, `readInFlight`/`cancelRequested` com `cancelReader` fire-and-forget no outro. Adotei a versão do #12466, que difere e defere o release do lock para quando a leitura em voo termina, e validei a escolha rodando as suítes dos **dois** PRs contra ela: 21/21 no readiness compartilhado e 22/22 incluindo o boundary do Perplexity.
---
 tests/unit/web-session-credentials.test.ts | 27 ++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/tests/unit/web-session-credentials.test.ts b/tests/unit/web-session-credentials.test.ts
index 68c1a64565..12c38a5c06 100644
--- a/tests/unit/web-session-credentials.test.ts
+++ b/tests/unit/web-session-credentials.test.ts
@@ -104,6 +104,33 @@ test("web session credential metadata identifies cookie, token, and no-auth prov
   });
 });
 
+test("MaxAI and UC keep independent top-level credential contracts", () => {
+  assert.deepEqual(webSessionCredentials.getWebSessionCredentialRequirement("maxai"), {
+    kind: "token",
+    credentialName: "MaxAI access token (Bearer) + device id",
+    placeholder:
+      "Use browser sign-in — OmniRoute mints the MaxAI access token, device id, and user id for you",
+    acceptsFullCookieHeader: false,
+    storageKeys: [
+      "accessToken",
+      "access_token",
+      "maxaiAccessToken",
+      "deviceId",
+      "maxaiDeviceId",
+      "userId",
+      "maxaiUserId",
+    ],
+  });
+
+  const uc = webSessionCredentials.getWebSessionCredentialRequirement("uc");
+  assert.ok(uc && uc.kind === "cookie");
+  assert.equal(uc.credentialName, "Clerk __client cookie + session id + user id");
+  assert.equal(uc.acceptsFullCookieHeader, true);
+  assert.ok(uc.storageKeys.includes("__client"));
+  assert.ok(uc.storageKeys.includes("sid"));
+  assert.ok(uc.storageKeys.includes("uid"));
+});
+
 test("web session credential validator requires provider-specific non-empty values", () => {
   assert.equal(
     webSessionCredentials.hasUsableWebSessionCredential("kimi-web", { token: "kimi-token" }),