@gajae-code/ai 0.1.1

package/dist/types/providers/aws-credentials.d.ts

@@ -0,0 +1,43 @@
+/**
+ * AWS credential resolution for the Bedrock provider.
+ *
+ * Chain (first hit wins):
+ *  1. Static credentials from the environment
+ *     (`AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` [+ `AWS_SESSION_TOKEN`]).
+ *  2. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO):
+ *      - static `aws_access_key_id` / `aws_secret_access_key` / `aws_session_token`
+ *      - SSO profile referencing a cached token in `~/.aws/sso/cache/*.json`,
+ *        which we exchange for short-lived role credentials via
+ *        `https://portal.sso.{region}.amazonaws.com/federation/credentials`.
+ *      - `credential_process` — an external command emitting the AWS SDK
+ *        `Version: 1` JSON envelope on stdout. Used by `aws-vault`, `granted`,
+ *        in-house brokers, etc.
+ *  3. EC2 IMDSv2 (only when `AWS_EC2_METADATA_DISABLED` is unset / falsey and
+ *     `169.254.169.254` is reachable within a 1 s timeout).
+ *
+ * Resolved credentials are cached process-wide per profile and refreshed
+ * 60 s before `Expiration` to absorb clock skew.
+ */
+import type { AwsCredentials } from "./aws-sigv4";
+export interface ResolvedCredentials extends AwsCredentials {
+    /** Absolute expiration timestamp in ms. `undefined` for non-expiring static creds. */
+    expiresAt?: number;
+}
+export interface CredentialResolveOptions {
+    /** Named profile from `~/.aws/credentials` / `~/.aws/config`. */
+    profile?: string;
+    /** Falls back to env (`AWS_REGION` / `AWS_DEFAULT_REGION`) and finally `us-east-1`. */
+    region?: string;
+    signal?: AbortSignal;
+}
+export declare function resolveAwsCredentials(opts?: CredentialResolveOptions): Promise<ResolvedCredentials>;
+/** POSIX-shell-style tokenizer used by the AWS CLI for `credential_process`.
+ *
+ * Outside quotes a backslash escapes the next character. Inside single quotes
+ * everything is literal (no escapes, cannot contain `'`). Inside double quotes
+ * a backslash only escapes `$`, `` ` ``, `"`, and `\` — every other backslash
+ * is preserved verbatim, which is what makes Windows paths like
+ * `"C:\Program Files\tool\auth.exe"` survive tokenization. */
+export declare function tokenizeCredentialProcessCommand(cmd: string): string[];
+/** Test/diagnostic helper — drops cached credentials. */
+export declare function clearAwsCredentialCache(): void;

package/dist/types/providers/aws-eventstream.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `application/vnd.amazon.eventstream` decoder.
+ *
+ * Wire format (all integers big-endian):
+ *
+ *   [total length     u32]
+ *   [headers length   u32]
+ *   [prelude CRC32    u32]   <- CRC over the first 8 bytes
+ *   [headers          headers_length]
+ *   [payload          total_length - headers_length - 16]
+ *   [message CRC32    u32]   <- CRC over the entire message minus the trailing 4 bytes
+ *
+ * Headers: a sequence of `[name_len u8][name utf8][value_type u8][value …]`.
+ * We only need the typed values Bedrock emits (boolean true/false, byte, short,
+ * integer, long, byte-array, string, timestamp, uuid). All are surfaced as
+ * strings for ease of consumption — Bedrock only sets string-valued headers in
+ * practice (`:event-type`, `:message-type`, `:content-type`, `:exception-type`).
+ */
+export interface EventStreamMessage {
+    /** Lower-cased copy is *not* applied — Bedrock uses casing like `:event-type` verbatim. */
+    headers: Record<string, string>;
+    payload: Uint8Array;
+}
+export declare function crc32(bytes: Uint8Array, seed?: number): number;
+/**
+ * Decode a single, fully buffered eventstream message. Throws if the framing is
+ * malformed or either CRC mismatches. Used by both `decodeEventStream` (the
+ * streaming entry point) and the unit tests, which exercise it with hand-built
+ * frames.
+ */
+export declare function decodeMessage(frame: Uint8Array): EventStreamMessage;
+/**
+ * Async generator that consumes a `ReadableStream<Uint8Array>` (e.g. a fetch
+ * response body) and yields fully-framed messages. Handles arbitrary chunk
+ * boundaries: messages may span multiple chunks, and a single chunk may carry
+ * many messages.
+ */
+export declare function decodeEventStream(source: ReadableStream<Uint8Array>): AsyncGenerator<EventStreamMessage>;

package/dist/types/providers/aws-sigv4.d.ts

@@ -0,0 +1,55 @@
+/**
+ * AWS Signature V4 signing for HTTP requests. WebCrypto-only — no node:crypto.
+ *
+ * Matches `@smithy/signature-v4` for our usage: header-based signing with a
+ * full SHA-256 payload hash (Bedrock requires `applyChecksum: true`).
+ *
+ * Returns the set of headers to attach to the request:
+ *  - `host`
+ *  - `x-amz-date`
+ *  - `x-amz-content-sha256`
+ *  - `x-amz-security-token` (only when credentials carry a sessionToken)
+ *  - `authorization`
+ */
+export interface AwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+export interface SignParams {
+    method: string;
+    /** Hostname only — used to build the `host` header and the canonical request. */
+    host: string;
+    /** URI path component, e.g. `/model/anthropic.Anthropic model/converse-stream`. */
+    path: string;
+    /** Optional pre-built query string (without leading `?`). */
+    query?: string;
+    /** Extra headers to sign in addition to `host`/`x-amz-*`. Names are case-insensitive. */
+    headers?: Record<string, string>;
+    body: Uint8Array;
+    region: string;
+    service: string;
+    credentials: AwsCredentials;
+    /** Override clock for deterministic tests. */
+    date?: Date;
+}
+export declare function toHex(bytes: Uint8Array): string;
+export declare function sha256(data: Uint8Array | string): Promise<Uint8Array>;
+export declare function sha256Hex(data: Uint8Array | string): Promise<string>;
+/**
+ * Derive a signing key: HMAC chain `kSecret → kDate → kRegion → kService → kSigning`.
+ */
+export declare function getSigningKey(secretAccessKey: string, shortDate: string, region: string, service: string): Promise<Uint8Array>;
+/** `YYYYMMDDTHHMMSSZ` + 8-char `YYYYMMDD`. */
+export declare function formatAmzDate(d: Date): {
+    longDate: string;
+    shortDate: string;
+};
+export interface SignedHeaders {
+    host: string;
+    "x-amz-date": string;
+    "x-amz-content-sha256": string;
+    authorization: string;
+    "x-amz-security-token"?: string;
+}
+export declare function signRequest(params: SignParams): Promise<SignedHeaders>;

package/dist/types/providers/azure-openai-responses.d.ts

@@ -0,0 +1,15 @@
+import type { ServiceTier, StreamFunction, StreamOptions, ToolChoice } from "../types";
+export interface AzureOpenAIResponsesOptions extends StreamOptions {
+    reasoning?: "minimal" | "low" | "medium" | "high" | "xhigh";
+    reasoningSummary?: "auto" | "detailed" | "concise" | null;
+    azureApiVersion?: string;
+    azureResourceName?: string;
+    azureBaseUrl?: string;
+    azureDeploymentName?: string;
+    toolChoice?: ToolChoice;
+    serviceTier?: ServiceTier;
+}
+/**
+ * Generate function for Azure OpenAI Responses API
+ */
+export declare const streamAzureOpenAIResponses: StreamFunction<"azure-openai-responses">;