Harden backend contracts and documentation

engine_test.go

@@ -755,6 +755,92 @@ func TestRunUsesDirectAPIKeyWithDefaultLLMClient(t *testing.T) {
 	}
 }
 
+func TestRunUsesResolvedBackendWithBuiltInLLMClient(t *testing.T) {
+	const (
+		backendID = "local-test"
+		envName   = "PROMPTKIT_BACKEND_TRANSPORT_KEY"
+		apiKey    = "synthetic-backend-key"
+	)
+	t.Setenv(envName, apiKey)
+
+	var (
+		gotAuth string
+		gotBody map[string]any
+	)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		if r.URL.Path != "/v1/chat/completions" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+		if err := json.NewDecoder(r.Body).Decode(&gotBody); err != nil {
+			t.Errorf("decode request body: %v", err)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{
+  "choices": [{"message": {"role": "assistant", "content": "# Summary\n\nDone."}}],
+  "usage": {"prompt_tokens": 3, "completion_tokens": 4, "total_tokens": 7}
+}`))
+	}))
+	defer server.Close()
+
+	engine, err := promptkit.NewEngine(promptkit.Config{
+		PromptDir: frameworkPromptDir,
+		SchemaDir: frameworkSchemaDir,
+	},
+		promptkit.WithBackend(promptkit.Backend{
+			ID:        backendID,
+			Endpoint:  server.URL + "/v1",
+			APIKeyEnv: envName,
+			ExtraParams: map[string]any{
+				"provider": "synthetic",
+			},
+		}),
+		promptkit.WithProfiles(promptkit.Profile{
+			ID:        "backend-transport",
+			BackendID: backendID,
+			Model:     "test-model",
+		}),
+	)
+	if err != nil {
+		t.Fatalf("construct engine: %v", err)
+	}
+
+	result, err := engine.Run(context.Background(), promptkit.RunRequest{
+		PromptID:  frameworkMarkdownSummaryPromptID,
+		ProfileID: "backend-transport",
+		Inputs: map[string]promptkit.ArtifactRef{
+			"transcript": promptkit.Inline("Rin opens the gate."),
+			"glossary":   promptkit.Inline("gate: A guarded passage."),
+		},
+	})
+	if err != nil {
+		t.Fatalf("run with resolved backend: %v", err)
+	}
+	if gotAuth != "Bearer "+apiKey {
+		t.Fatalf("unexpected Authorization header: %q", gotAuth)
+	}
+	if gotBody["model"] != "test-model" || gotBody["provider"] != "synthetic" {
+		t.Fatalf("backend defaults did not reach provider payload: %#v", gotBody)
+	}
+	for _, field := range []string{"backend_id", "api_key_env"} {
+		if _, ok := gotBody[field]; ok {
+			t.Fatalf("internal metadata field %q was serialized to provider payload: %#v", field, gotBody)
+		}
+	}
+	bodyJSON, err := json.Marshal(gotBody)
+	if err != nil {
+		t.Fatalf("marshal captured provider payload: %v", err)
+	}
+	if strings.Contains(string(bodyJSON), apiKey) {
+		t.Fatalf("credential value was serialized to provider payload: %s", bodyJSON)
+	}
+	if result.SelectedBackendID != backendID ||
+		result.EffectiveModelParams.Endpoint != server.URL+"/v1" ||
+		result.EffectiveModelParams.APIKeyEnv != envName {
+		t.Fatalf("unexpected resolved backend metadata: %+v", result)
+	}
+}
+
 func TestPrepareDirectAPIKeyBypassesMissingEnvWithoutLeakingOrHashing(t *testing.T) {
 	const missingEnv = "PROMPTKIT_PUBLIC_PREPARE_MISSING"
 	const firstKey = "first-direct-key"