@gajae-code/ai 0.1.1

package/src/providers/aws-sigv4.ts

@@ -0,0 +1,218 @@
+/**
+ * AWS Signature V4 signing for HTTP requests. WebCrypto-only — no node:crypto.
+ *
+ * Matches `@smithy/signature-v4` for our usage: header-based signing with a
+ * full SHA-256 payload hash (Bedrock requires `applyChecksum: true`).
+ *
+ * Returns the set of headers to attach to the request:
+ *  - `host`
+ *  - `x-amz-date`
+ *  - `x-amz-content-sha256`
+ *  - `x-amz-security-token` (only when credentials carry a sessionToken)
+ *  - `authorization`
+ */
+
+export interface AwsCredentials {
+	accessKeyId: string;
+	secretAccessKey: string;
+	sessionToken?: string;
+}
+
+export interface SignParams {
+	method: string;
+	/** Hostname only — used to build the `host` header and the canonical request. */
+	host: string;
+	/** URI path component, e.g. `/model/anthropic.Anthropic model/converse-stream`. */
+	path: string;
+	/** Optional pre-built query string (without leading `?`). */
+	query?: string;
+	/** Extra headers to sign in addition to `host`/`x-amz-*`. Names are case-insensitive. */
+	headers?: Record<string, string>;
+	body: Uint8Array;
+	region: string;
+	service: string;
+	credentials: AwsCredentials;
+	/** Override clock for deterministic tests. */
+	date?: Date;
+}
+
+const ALGORITHM = "AWS4-HMAC-SHA256";
+const KEY_TYPE = "aws4_request";
+// Headers the SDK never includes in the signature. Lowercased.
+const UNSIGNABLE: Record<string, true> = {
+	authorization: true,
+	"cache-control": true,
+	connection: true,
+	expect: true,
+	from: true,
+	"keep-alive": true,
+	"max-forwards": true,
+	pragma: true,
+	referer: true,
+	te: true,
+	trailer: true,
+	"transfer-encoding": true,
+	upgrade: true,
+	"user-agent": true,
+	"x-amzn-trace-id": true,
+};
+
+/** Coerce a possibly-ArrayBufferLike-backed `Uint8Array` into one over a fresh
+ * `ArrayBuffer`, which is what `crypto.subtle.{digest,sign,importKey}` requires
+ * under the strict TS DOM typings. No-op when already strict.
+ */
+function asStrict(bytes: Uint8Array): Uint8Array<ArrayBuffer> {
+	if (bytes.buffer instanceof ArrayBuffer && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength) {
+		return bytes as Uint8Array<ArrayBuffer>;
+	}
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	return copy;
+}
+const subtle = globalThis.crypto.subtle;
+
+const HEX = "0123456789abcdef";
+export function toHex(bytes: Uint8Array): string {
+	let out = "";
+	for (let i = 0; i < bytes.length; i++) {
+		const b = bytes[i];
+		out += HEX[b >> 4] + HEX[b & 15];
+	}
+	return out;
+}
+
+export async function sha256(data: Uint8Array | string): Promise<Uint8Array> {
+	const bytes = typeof data === "string" ? new TextEncoder().encode(data) : asStrict(data);
+	const digest = await subtle.digest("SHA-256", bytes);
+	return new Uint8Array(digest);
+}
+
+export async function sha256Hex(data: Uint8Array | string): Promise<string> {
+	return toHex(await sha256(data));
+}
+
+async function hmac(key: Uint8Array, data: string | Uint8Array): Promise<Uint8Array> {
+	const cryptoKey = await subtle.importKey("raw", asStrict(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+	const bytes = typeof data === "string" ? new TextEncoder().encode(data) : asStrict(data);
+	const sig = await subtle.sign("HMAC", cryptoKey, bytes);
+	return new Uint8Array(sig);
+}
+
+/**
+ * Derive a signing key: HMAC chain `kSecret → kDate → kRegion → kService → kSigning`.
+ */
+export async function getSigningKey(
+	secretAccessKey: string,
+	shortDate: string,
+	region: string,
+	service: string,
+): Promise<Uint8Array> {
+	const kDate = await hmac(new TextEncoder().encode(`AWS4${secretAccessKey}`), shortDate);
+	const kRegion = await hmac(kDate, region);
+	const kService = await hmac(kRegion, service);
+	return hmac(kService, KEY_TYPE);
+}
+
+/** `YYYYMMDDTHHMMSSZ` + 8-char `YYYYMMDD`. */
+export function formatAmzDate(d: Date): { longDate: string; shortDate: string } {
+	const iso = d.toISOString();
+	// `2025-05-17T12:34:56.789Z` -> `20250517T123456Z`
+	const longDate = `${iso.slice(0, 4)}${iso.slice(5, 7)}${iso.slice(8, 10)}T${iso.slice(11, 13)}${iso.slice(14, 16)}${iso.slice(17, 19)}Z`;
+	return { longDate, shortDate: longDate.slice(0, 8) };
+}
+
+/**
+ * Canonicalize a request path per RFC 3986: each segment is %-encoded but `/`
+ * stays literal. Matches the smithy default (`uriEscapePath: true`, then revert
+ * the double-encoding of `/`). Bedrock paths use no reserved characters in
+ * practice, but model IDs can include `:` and `.`.
+ */
+function canonicalPath(path: string): string {
+	const segments = path.split("/");
+	const escaped = segments.map(seg => (seg.length === 0 ? "" : encodeRfc3986(seg)));
+	return escaped.join("/");
+}
+
+function encodeRfc3986(str: string): string {
+	return encodeURIComponent(str).replace(/[!'()*]/g, c => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+
+function canonicalQuery(query: string | undefined): string {
+	if (!query) return "";
+	const pairs: Array<[string, string]> = [];
+	for (const part of query.split("&")) {
+		if (!part) continue;
+		const eq = part.indexOf("=");
+		const k = eq === -1 ? part : part.slice(0, eq);
+		const v = eq === -1 ? "" : part.slice(eq + 1);
+		pairs.push([decodeURIComponent(k), decodeURIComponent(v)]);
+	}
+	pairs.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0));
+	return pairs.map(([k, v]) => `${encodeRfc3986(k)}=${encodeRfc3986(v)}`).join("&");
+}
+
+export interface SignedHeaders {
+	host: string;
+	"x-amz-date": string;
+	"x-amz-content-sha256": string;
+	authorization: string;
+	"x-amz-security-token"?: string;
+}
+
+export async function signRequest(params: SignParams): Promise<SignedHeaders> {
+	const { method, host, path, query, body, region, service, credentials } = params;
+	const date = params.date ?? new Date();
+	const { longDate, shortDate } = formatAmzDate(date);
+	const payloadHash = await sha256Hex(body);
+
+	// Assemble the headers that will be signed. Always include host, x-amz-date,
+	// x-amz-content-sha256, plus x-amz-security-token when present, plus
+	// caller-provided signable headers (e.g. content-type, accept).
+	const signed: Record<string, string> = {
+		host,
+		"x-amz-date": longDate,
+		"x-amz-content-sha256": payloadHash,
+	};
+	if (credentials.sessionToken) signed["x-amz-security-token"] = credentials.sessionToken;
+	const extraHeaders = params.headers;
+	if (extraHeaders) {
+		for (const k in extraHeaders) {
+			const lk = k.toLowerCase();
+			if (UNSIGNABLE[lk]) continue;
+			if (lk.startsWith("proxy-") || lk.startsWith("sec-")) continue;
+			signed[lk] = extraHeaders[k].trim().replace(/\s+/g, " ");
+		}
+	}
+
+	const sortedNames = Object.keys(signed).sort();
+	const canonicalHeaders = `${sortedNames.map(n => `${n}:${signed[n]}`).join("\n")}\n`;
+	const signedHeadersStr = sortedNames.join(";");
+
+	const canonicalRequest = [
+		method.toUpperCase(),
+		canonicalPath(path),
+		canonicalQuery(query),
+		canonicalHeaders,
+		signedHeadersStr,
+		payloadHash,
+	].join("\n");
+
+	const scope = `${shortDate}/${region}/${service}/${KEY_TYPE}`;
+	const stringToSign = [ALGORITHM, longDate, scope, await sha256Hex(canonicalRequest)].join("\n");
+
+	const signingKey = await getSigningKey(credentials.secretAccessKey, shortDate, region, service);
+	const signature = toHex(await hmac(signingKey, stringToSign));
+
+	const authorization =
+		`${ALGORITHM} Credential=${credentials.accessKeyId}/${scope}, ` +
+		`SignedHeaders=${signedHeadersStr}, Signature=${signature}`;
+
+	const out: SignedHeaders = {
+		host,
+		"x-amz-date": longDate,
+		"x-amz-content-sha256": payloadHash,
+		authorization,
+	};
+	if (credentials.sessionToken) out["x-amz-security-token"] = credentials.sessionToken;
+	return out;
+}

package/src/providers/azure-openai-responses.ts

@@ -0,0 +1,337 @@
+import { $env, extractHttpStatusFromError } from "@gajae-code/utils";
+import { AzureOpenAI } from "openai";
+import type {
+	Tool as OpenAITool,
+	ResponseCreateParamsStreaming,
+	ResponseInput,
+} from "openai/resources/responses/responses";
+import { getEnvApiKey } from "../stream";
+import type {
+	AssistantMessage,
+	Context,
+	Model,
+	ServiceTier,
+	StreamFunction,
+	StreamOptions,
+	Tool,
+	ToolChoice,
+} from "../types";
+import { normalizeSystemPrompts } from "../utils";
+import { createAbortSourceTracker } from "../utils/abort";
+import { AssistantMessageEventStream } from "../utils/event-stream";
+import { finalizeErrorMessage, type RawHttpRequestDump } from "../utils/http-inspector";
+import {
+	createWatchdog,
+	getOpenAIStreamIdleTimeoutMs,
+	getStreamFirstEventTimeoutMs,
+	iterateWithIdleTimeout,
+} from "../utils/idle-iterator";
+import { sanitizeSchemaForOpenAIResponses, toolWireSchema } from "../utils/schema";
+import { wrapFetchForSseDebug } from "../utils/sse-debug";
+import { mapToOpenAIResponsesToolChoice } from "../utils/tool-choice";
+import { normalizeOpenAIResponsesPromptCacheKey, supportsDeveloperRole } from "./openai-responses";
+import {
+	appendResponsesToolResultMessages,
+	applyCommonResponsesSamplingParams,
+	applyResponsesReasoningParams,
+	convertResponsesAssistantMessage,
+	convertResponsesInputContent,
+	createInitialResponsesAssistantMessage,
+	normalizeResponsesToolCallIdForTransform,
+	processResponsesStream,
+} from "./openai-responses-shared";
+import { transformMessages } from "./transform-messages";
+
+const DEFAULT_AZURE_API_VERSION = "v1";
+const AZURE_OPENAI_RESPONSES_FIRST_EVENT_TIMEOUT_MESSAGE =
+	"Azure OpenAI responses stream timed out while waiting for the first event";
+
+function parseDeploymentNameMap(value: string | undefined): Map<string, string> {
+	const map = new Map<string, string>();
+	if (!value) return map;
+	for (const entry of value.split(",")) {
+		const trimmed = entry.trim();
+		if (!trimmed) continue;
+		const [modelId, deploymentName] = trimmed.split("=", 2);
+		if (!modelId || !deploymentName) continue;
+		map.set(modelId.trim(), deploymentName.trim());
+	}
+	return map;
+}
+
+function resolveDeploymentName(model: Model<"azure-openai-responses">, options?: AzureOpenAIResponsesOptions): string {
+	if (options?.azureDeploymentName) {
+		return options.azureDeploymentName;
+	}
+	const mappedDeployment = parseDeploymentNameMap($env.AZURE_OPENAI_DEPLOYMENT_NAME_MAP).get(model.id);
+	return mappedDeployment ?? model.id;
+}
+
+// Azure OpenAI Responses-specific options
+export interface AzureOpenAIResponsesOptions extends StreamOptions {
+	reasoning?: "minimal" | "low" | "medium" | "high" | "xhigh";
+	reasoningSummary?: "auto" | "detailed" | "concise" | null;
+	azureApiVersion?: string;
+	azureResourceName?: string;
+	azureBaseUrl?: string;
+	azureDeploymentName?: string;
+	toolChoice?: ToolChoice;
+	serviceTier?: ServiceTier;
+}
+
+type AzureOpenAIResponsesSamplingParams = ResponseCreateParamsStreaming & {
+	top_p?: number;
+	top_k?: number;
+	min_p?: number;
+	presence_penalty?: number;
+	repetition_penalty?: number;
+};
+
+/**
+ * Generate function for Azure OpenAI Responses API
+ */
+export const streamAzureOpenAIResponses: StreamFunction<"azure-openai-responses"> = (
+	model: Model<"azure-openai-responses">,
+	context: Context,
+	options?: AzureOpenAIResponsesOptions,
+): AssistantMessageEventStream => {
+	const stream = new AssistantMessageEventStream();
+
+	// Start async processing
+	(async () => {
+		const startTime = Date.now();
+		let firstTokenTime: number | undefined;
+		const deploymentName = resolveDeploymentName(model, options);
+
+		const output: AssistantMessage = createInitialResponsesAssistantMessage(
+			"azure-openai-responses",
+			model.provider,
+			model.id,
+		);
+		let rawRequestDump: RawHttpRequestDump | undefined;
+		const abortTracker = createAbortSourceTracker(options?.signal);
+		const firstEventTimeoutAbortError = new Error(AZURE_OPENAI_RESPONSES_FIRST_EVENT_TIMEOUT_MESSAGE);
+		const { requestAbortController, requestSignal } = abortTracker;
+
+		try {
+			// Create Azure OpenAI client
+			const apiKey = options?.apiKey || getEnvApiKey(model.provider) || "";
+			const client = createClient(model, apiKey, options);
+			const { baseUrl } = resolveAzureConfig(model, options);
+			const params = buildParams(model, context, options, deploymentName, baseUrl);
+			const idleTimeoutMs = getOpenAIStreamIdleTimeoutMs();
+			options?.onPayload?.(params);
+			rawRequestDump = {
+				provider: model.provider,
+				api: output.api,
+				model: model.id,
+				method: "POST",
+				url: `${baseUrl}/responses`,
+				body: params,
+			};
+			const openaiStream = await client.responses.create(params, { signal: requestSignal });
+			const firstEventWatchdog = createWatchdog(
+				options?.streamFirstEventTimeoutMs ?? getStreamFirstEventTimeoutMs(idleTimeoutMs),
+				() => abortTracker.abortLocally(firstEventTimeoutAbortError),
+			);
+			stream.push({ type: "start", partial: output });
+
+			await processResponsesStream(
+				iterateWithIdleTimeout(openaiStream, {
+					watchdog: firstEventWatchdog,
+					idleTimeoutMs,
+					errorMessage: "Azure OpenAI responses stream stalled while waiting for the next event",
+					onIdle: () => requestAbortController.abort(),
+				}),
+				output,
+				stream,
+				model,
+				{
+					onFirstToken: () => {
+						if (!firstTokenTime) firstTokenTime = Date.now();
+					},
+				},
+			);
+
+			const firstEventTimeoutError = abortTracker.getLocalAbortReason();
+			if (firstEventTimeoutError) {
+				throw firstEventTimeoutError;
+			}
+			if (abortTracker.wasCallerAbort()) {
+				throw new Error("Request was aborted");
+			}
+
+			if (output.stopReason === "aborted" || output.stopReason === "error") {
+				throw new Error(output.errorMessage ?? "An unknown error occurred");
+			}
+
+			output.duration = Date.now() - startTime;
+			if (firstTokenTime) output.ttft = firstTokenTime - startTime;
+			stream.push({ type: "done", reason: output.stopReason, message: output });
+			stream.end();
+		} catch (error) {
+			for (const block of output.content) delete (block as { index?: number }).index;
+			const firstEventTimeoutError = abortTracker.getLocalAbortReason();
+			output.stopReason = abortTracker.wasCallerAbort() ? "aborted" : "error";
+			output.errorStatus = extractHttpStatusFromError(error);
+			output.errorMessage = firstEventTimeoutError?.message ?? (await finalizeErrorMessage(error, rawRequestDump));
+			output.duration = Date.now() - startTime;
+			if (firstTokenTime) output.ttft = firstTokenTime - startTime;
+			stream.push({ type: "error", reason: output.stopReason, error: output });
+			stream.end();
+		}
+	})();
+
+	return stream;
+};
+
+function normalizeAzureBaseUrl(baseUrl: string): string {
+	return baseUrl.replace(/\/+$/, "");
+}
+
+function buildDefaultBaseUrl(resourceName: string): string {
+	return `https://${resourceName}.openai.azure.com/openai/v1`;
+}
+
+function resolveAzureConfig(
+	model: Model<"azure-openai-responses">,
+	options?: AzureOpenAIResponsesOptions,
+): { baseUrl: string; apiVersion: string } {
+	const apiVersion = options?.azureApiVersion || $env.AZURE_OPENAI_API_VERSION || DEFAULT_AZURE_API_VERSION;
+
+	const baseUrl = options?.azureBaseUrl?.trim() || $env.AZURE_OPENAI_BASE_URL?.trim() || undefined;
+	const resourceName = options?.azureResourceName || $env.AZURE_OPENAI_RESOURCE_NAME;
+
+	let resolvedBaseUrl = baseUrl;
+
+	if (!resolvedBaseUrl && resourceName) {
+		resolvedBaseUrl = buildDefaultBaseUrl(resourceName);
+	}
+
+	if (!resolvedBaseUrl && model.baseUrl) {
+		resolvedBaseUrl = model.baseUrl;
+	}
+
+	if (!resolvedBaseUrl) {
+		throw new Error(
+			"Azure OpenAI base URL is required. Set AZURE_OPENAI_BASE_URL or AZURE_OPENAI_RESOURCE_NAME, or pass azureBaseUrl, azureResourceName, or model.baseUrl.",
+		);
+	}
+
+	return {
+		baseUrl: normalizeAzureBaseUrl(resolvedBaseUrl),
+		apiVersion,
+	};
+}
+
+function createClient(model: Model<"azure-openai-responses">, apiKey: string, options?: AzureOpenAIResponsesOptions) {
+	if (!apiKey) {
+		const envKey = $env.AZURE_OPENAI_API_KEY;
+		if (!envKey) {
+			throw new Error(
+				"Azure OpenAI API key is required. Set AZURE_OPENAI_API_KEY environment variable or pass it as an argument.",
+			);
+		}
+		apiKey = envKey;
+	}
+
+	const headers = { ...(model.headers ?? {}) };
+
+	if (options?.headers) {
+		Object.assign(headers, options.headers);
+	}
+
+	const { baseUrl, apiVersion } = resolveAzureConfig(model, options);
+
+	const baseFetch = options?.fetch ?? fetch;
+	const onSseEvent = options?.onSseEvent;
+	return new AzureOpenAI({
+		apiKey,
+		apiVersion,
+		dangerouslyAllowBrowser: true,
+		maxRetries: 5,
+		defaultHeaders: headers,
+		baseURL: baseUrl,
+		fetch: onSseEvent ? wrapFetchForSseDebug(baseFetch, event => onSseEvent(event, model)) : baseFetch,
+	});
+}
+
+function buildParams(
+	model: Model<"azure-openai-responses">,
+	context: Context,
+	options: AzureOpenAIResponsesOptions | undefined,
+	deploymentName: string,
+	resolvedBaseUrl?: string,
+) {
+	const messages = convertMessages(model, context, true, resolvedBaseUrl);
+
+	const params: AzureOpenAIResponsesSamplingParams = {
+		model: deploymentName,
+		input: messages,
+		stream: true,
+		prompt_cache_key: normalizeOpenAIResponsesPromptCacheKey(options?.sessionId),
+	};
+
+	applyCommonResponsesSamplingParams(params, options, model.provider);
+
+	if (context.tools) {
+		params.tools = convertTools(context.tools);
+		if (options?.toolChoice) {
+			params.tool_choice = mapToOpenAIResponsesToolChoice(options.toolChoice);
+		}
+	}
+
+	applyResponsesReasoningParams(params, model, options, messages);
+
+	return params;
+}
+
+function convertMessages(
+	model: Model<"azure-openai-responses">,
+	context: Context,
+	strictResponsesPairing: boolean,
+	resolvedBaseUrl?: string,
+): ResponseInput {
+	const messages: ResponseInput = [];
+	const transformedMessages = transformMessages(context.messages, model, normalizeResponsesToolCallIdForTransform);
+	const knownCallIds = new Set<string>();
+
+	const systemPrompts = normalizeSystemPrompts(context.systemPrompt);
+	if (systemPrompts.length > 0) {
+		const role = model.reasoning && supportsDeveloperRole(resolvedBaseUrl ?? model) ? "developer" : "system";
+		for (const systemPrompt of systemPrompts) {
+			messages.push({ role, content: systemPrompt });
+		}
+	}
+
+	let msgIndex = 0;
+	for (const msg of transformedMessages) {
+		if (msg.role === "user" || msg.role === "developer") {
+			const content = convertResponsesInputContent(msg.content, model.input.includes("image"));
+			if (!content) continue;
+			messages.push({
+				role: "user",
+				content: msg.role === "developer" && typeof msg.content === "string" ? msg.content.toWellFormed() : content,
+			});
+		} else if (msg.role === "assistant") {
+			const outputItems = convertResponsesAssistantMessage(msg as AssistantMessage, model, msgIndex, knownCallIds);
+			if (outputItems.length === 0) continue;
+			messages.push(...outputItems);
+		} else if (msg.role === "toolResult") {
+			appendResponsesToolResultMessages(messages, msg, model, strictResponsesPairing, knownCallIds);
+		}
+		msgIndex++;
+	}
+
+	return messages;
+}
+
+function convertTools(tools: Tool[]): OpenAITool[] {
+	return tools.map(tool => ({
+		type: "function",
+		name: tool.name,
+		description: tool.description || "",
+		parameters: sanitizeSchemaForOpenAIResponses(toolWireSchema(tool)),
+		strict: false,
+	}));
+}