@averyyy/pi-ai 0.99.1-piclient.1 → 1.0.0-piclient.2

package/README.md

@@ -1653,10 +1653,10 @@ Browser compatibility notes:
 
 ## Bundling and Tree Shaking
 
-For small bundles, import only the providers you need:
+For small bundles and low-overhead unbundled scripts, import the model runtime and only the providers you need:
 
 ```typescript
-import { createModels } from '@earendil-works/pi-ai';
+import { createModels } from '@earendil-works/pi-ai/models';
 import { openaiProvider } from '@earendil-works/pi-ai/providers/openai';
 
 const models = createModels();
@@ -1665,7 +1665,8 @@ models.setProvider(openaiProvider());
 
 Rules:
 
-- `@earendil-works/pi-ai` is the core entrypoint and does not import built-in catalogs, provider factories, or SDK implementations.
+- `@earendil-works/pi-ai/models` exports the model runtime (`createModels`, `createProvider`, model helpers, and their types) without TypeBox, built-in catalogs, or SDK implementations. Other types can still use `import type` from the root.
+- `@earendil-works/pi-ai` is the core entrypoint and does not import built-in catalogs, real provider factories, or SDK implementations, but it eagerly imports TypeBox and schema validation. Unbundled Node scripts do not tree-shake its unused exports; prefer `./models`, `./providers/faux`, and specific `./utils/*` subpaths when those are all you need.
 - `@earendil-works/pi-ai/providers/<provider>` imports that provider's catalog and lazy API wrapper only.
 - `@earendil-works/pi-ai/providers/all` imports every built-in provider factory and all catalogs. Use it only when you want the full built-in set.
 - With code splitting, provider SDKs stay in lazy chunks and load on first request.

package/dist/api/anthropic-messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic-messages.d.ts","sourceRoot":"","sources":["../../src/api/anthropic-messages.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAa1C,OAAO,KAAK,EASX,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAMb,MAAM,aAAa,CAAC;AAiJrB,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,SAAS,CAAC;AA2ChE,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACnB;AAqOD,eAAO,MAAM,MAAM,EAAE,cAAc,CAAC,oBAAoB,EAAE,gBAAgB,CAwUzE,CAAC;AA2BF,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CA8ClF,CAAC"}
+{"version":3,"file":"anthropic-messages.d.ts","sourceRoot":"","sources":["../../src/api/anthropic-messages.ts"],"names":[],"mappings":"AAAA,OAAO,SAAiC,MAAM,mBAAmB,CAAC;AAoBlE,OAAO,KAAK,EASX,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAMb,MAAM,aAAa,CAAC;AAqJrB,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,SAAS,CAAC;AA2ChE,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACnB;AAwRD,eAAO,MAAM,MAAM,EAAE,cAAc,CAAC,oBAAoB,EAAE,gBAAgB,CA0UzE,CAAC;AA2BF,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CAgDlF,CAAC"}

package/dist/api/anthropic-messages.js

@@ -1,4 +1,5 @@
-import Anthropic from "@anthropic-ai/sdk";
+import Anthropic, {} from "@anthropic-ai/sdk";
+import { ANTHROPIC_FEDERATION_RULE_ID_ENV, ANTHROPIC_IDENTITY_TOKEN_FILE_ENV, ANTHROPIC_ORGANIZATION_ID_ENV, ANTHROPIC_SERVICE_ACCOUNT_ID_ENV, ANTHROPIC_WORKSPACE_ID_ENV, } from "../env-api-keys.js";
 import { calculateCost } from "../models.js";
 import { appendAssistantMessageDiagnostic } from "../utils/diagnostics.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
@@ -10,7 +11,7 @@ import { retryProviderRequest } from "../utils/provider-retry.js";
 import { sanitizeSurrogates } from "../utils/sanitize-unicode.js";
 import { getSystemMessageText, renderSystemMessageUpdate } from "../utils/text.js";
 import { getCurrentTools, getDeclaredTools, getInitialSystemMessage, hasToolRedefinitions, resolveTranscript, } from "../utils/transcript.js";
-import { getJsonSchemaToolParameters, resolveJsonSchemaStrictSampling } from "./constrained-sampling.js";
+import { getJsonSchemaToolParameters, resolveJsonSchemaStrictSampling, } from "./constrained-sampling.js";
 import { buildCopilotDynamicHeaders, hasCopilotVisionInput } from "./github-copilot-headers.js";
 import { adjustMaxTokensForThinking, buildBaseOptions, clampMaxTokensToContext } from "./simple-options.js";
 import { transformMessages } from "./transform-messages.js";
@@ -169,16 +170,58 @@ function hasHeader(headers, name) {
     }
     return false;
 }
-function assertRequestAuth(provider, apiKey, headers) {
-    if (apiKey)
-        return;
-    if (hasHeader(headers, "authorization") ||
+function hasRequestAuth(apiKey, headers) {
+    return (!!apiKey ||
+        hasHeader(headers, "authorization") ||
         hasHeader(headers, "x-api-key") ||
-        hasHeader(headers, "cf-aig-authorization")) {
-        return;
+        hasHeader(headers, "cf-aig-authorization"));
+}
+function assertRequestAuth(provider, apiKey, headers) {
+    if (!hasRequestAuth(apiKey, headers))
+        throw new Error(`No API key for provider: ${provider}`);
+}
+/**
+ * Anthropic SDK client that never runs the SDK's own credential chain
+ * (ANTHROPIC_PROFILE config files, federation env vars). Without this, every
+ * client built with `apiKey: null, authToken: null` for header-owned auth would
+ * also resolve and exchange SDK credentials behind pi's auth resolver.
+ */
+class PiAnthropic extends Anthropic {
+    _shouldResolveDefaultCredentials() {
+        return false;
     }
-    throw new Error(`No API key for provider: ${provider}`);
 }
+/**
+ * Workload identity federation config from the ANTHROPIC_* variables the
+ * Anthropic SDK documents; the SDK performs the token exchange and refresh.
+ * Only for the anthropic provider, since the exchange is an Anthropic API
+ * endpoint, and only when no key or auth header was resolved.
+ */
+function getAnthropicFederation(model, apiKey, headers, env) {
+    if (model.provider !== "anthropic" || hasRequestAuth(apiKey, headers))
+        return undefined;
+    const federationRuleId = getProviderEnvValue(ANTHROPIC_FEDERATION_RULE_ID_ENV, env);
+    const organizationId = getProviderEnvValue(ANTHROPIC_ORGANIZATION_ID_ENV, env);
+    const identityTokenFile = getProviderEnvValue(ANTHROPIC_IDENTITY_TOKEN_FILE_ENV, env);
+    if (!federationRuleId || !organizationId || !identityTokenFile)
+        return undefined;
+    return {
+        organization_id: organizationId,
+        workspace_id: getProviderEnvValue(ANTHROPIC_WORKSPACE_ID_ENV, env),
+        authentication: {
+            type: "oidc_federation",
+            federation_rule_id: federationRuleId,
+            service_account_id: getProviderEnvValue(ANTHROPIC_SERVICE_ACCOUNT_ID_ENV, env),
+            identity_token: { source: "file", path: identityTokenFile },
+        },
+    };
+}
+/**
+ * The SDK caches the federated access token per client, but pi creates a client
+ * per request. Keep one client for the current federation config and fetch, and
+ * clone it per request with `withOptions()`, which shares the token cache.
+ */
+let federationClient;
 const ANTHROPIC_MESSAGE_EVENTS = new Set([
     "message_start",
     "message_delta",
@@ -365,7 +408,9 @@ export const stream = (model, context, options) => {
             }
             else {
                 const apiKey = options?.apiKey;
-                assertRequestAuth(model.provider, apiKey, options?.headers);
+                const federation = getAnthropicFederation(model, apiKey, options?.headers, options?.env);
+                if (!federation)
+                    assertRequestAuth(model.provider, apiKey, options?.headers);
                 let copilotDynamicHeaders;
                 if (model.provider === "github-copilot") {
                     const hasImages = hasCopilotVisionInput(normalizedContext.messages);
@@ -376,7 +421,7 @@ export const stream = (model, context, options) => {
                 }
                 const cacheRetention = resolveCacheRetention(options?.cacheRetention, options?.env);
                 const cacheSessionId = cacheRetention === "none" ? undefined : options?.sessionId;
-                const created = createClient(model, apiKey, options?.headers, options?.fetch, copilotDynamicHeaders, cacheSessionId);
+                const created = createClient(model, apiKey, options?.headers, options?.fetch, copilotDynamicHeaders, cacheSessionId, federation);
                 client = created.client;
                 isOAuth = created.isOAuthToken;
             }
@@ -666,7 +711,9 @@ function mapThinkingLevelToEffort(model, level) {
     }
 }
 export const streamSimple = (model, context, options) => {
-    assertRequestAuth(model.provider, options?.apiKey, options?.headers);
+    if (!getAnthropicFederation(model, options?.apiKey, options?.headers, options?.env)) {
+        assertRequestAuth(model.provider, options?.apiKey, options?.headers);
+    }
     const base = {
         ...buildBaseOptions(model, context, options, options?.apiKey),
         toolChoice: options?.toolChoice,
@@ -701,10 +748,10 @@ export const streamSimple = (model, context, options) => {
 function isOAuthToken(apiKey) {
     return apiKey.includes("sk-ant-oat");
 }
-function createClient(model, apiKey, optionsHeaders, fetch, dynamicHeaders, sessionId) {
+function createClient(model, apiKey, optionsHeaders, fetch, dynamicHeaders, sessionId, federation) {
     // Copilot: Bearer auth.
     if (model.provider === "github-copilot") {
-        const client = new Anthropic({
+        const client = new PiAnthropic({
             apiKey: null,
             authToken: apiKey ?? null,
             baseURL: model.baseUrl,
@@ -719,7 +766,7 @@ function createClient(model, apiKey, optionsHeaders, fetch, dynamicHeaders, sess
     }
     // OAuth: Bearer auth, Claude Code identity headers
     if (apiKey && isOAuthToken(apiKey)) {
-        const client = new Anthropic({
+        const client = new PiAnthropic({
             apiKey: null,
             authToken: apiKey,
             baseURL: model.baseUrl,
@@ -734,7 +781,7 @@ function createClient(model, apiKey, optionsHeaders, fetch, dynamicHeaders, sess
         });
         return { client, isOAuthToken: true };
     }
-    // API key or header-owned auth.
+    // API key, header-owned auth, or workload identity federation.
     const compat = getAnthropicCompat(model);
     const sessionAffinityHeaders = {};
     if (sessionId && compat.sendSessionAffinityHeaders) {
@@ -745,7 +792,22 @@ function createClient(model, apiKey, optionsHeaders, fetch, dynamicHeaders, sess
         accept: "application/json",
         "anthropic-dangerous-direct-browser-access": "true",
     }, sessionAffinityHeaders, model.headers, optionsHeaders);
-    const client = new Anthropic({
+    if (federation) {
+        const key = JSON.stringify([model.baseUrl, federation]);
+        if (federationClient?.key !== key || federationClient.fetch !== fetch) {
+            const client = new PiAnthropic({
+                apiKey: null,
+                authToken: null,
+                config: federation,
+                baseURL: model.baseUrl,
+                dangerouslyAllowBrowser: true,
+                fetch,
+            });
+            federationClient = { key, fetch, client };
+        }
+        return { client: federationClient.client.withOptions({ defaultHeaders }), isOAuthToken: false };
+    }
+    const client = new PiAnthropic({
         apiKey: apiKey ?? null,
         authToken: null,
         baseURL: model.baseUrl,
@@ -1156,11 +1218,47 @@ function insertThinkingLevelMessages(converted, activeEffort) {
 function shouldUseFineGrainedToolStreamingBeta(model, context) {
     return getCurrentTools(context.messages).length > 0 && !getAnthropicCompat(model).supportsEagerToolInputStreaming;
 }
+// Keywords Anthropic strict tool use rejects with a 400 for the whole request.
+// https://platform.claude.com/docs/en/build-with-claude/structured-outputs#json-schema-limitations
+const ANTHROPIC_STRICT_UNSUPPORTED_KEYWORDS = new Set([
+    "minimum",
+    "maximum",
+    "exclusiveMinimum",
+    "exclusiveMaximum",
+    "multipleOf",
+    "maxItems",
+    "uniqueItems",
+    "minContains",
+    "maxContains",
+    "minProperties",
+    "maxProperties",
+]);
+const ANTHROPIC_STRICT_STRING_FORMATS = new Set([
+    "date-time",
+    "time",
+    "date",
+    "duration",
+    "email",
+    "hostname",
+    "uri",
+    "ipv4",
+    "ipv6",
+    "uuid",
+]);
+const isAnthropicStrictUnsupportedKeyword = (key, value) => {
+    if (ANTHROPIC_STRICT_UNSUPPORTED_KEYWORDS.has(key))
+        return true;
+    if (key === "minItems")
+        return value !== 0 && value !== 1;
+    if (key === "format")
+        return typeof value !== "string" || !ANTHROPIC_STRICT_STRING_FORMATS.has(value);
+    return false;
+};
 function convertTools(tools, isOAuthToken, supportsEagerToolInputStreaming, supportsStrictTools, cacheControl) {
     if (!tools)
         return [];
     return tools.map((tool, index) => {
-        const strict = resolveJsonSchemaStrictSampling(tool, supportsStrictTools);
+        const strict = resolveJsonSchemaStrictSampling(tool, supportsStrictTools, isAnthropicStrictUnsupportedKeyword);
         const parameters = getJsonSchemaToolParameters(tool, strict);
         const schema = parameters;
         const legacyInputSchema = {