@jambonz/llm 0.3.4 → 0.4.1

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { S as ServiceAccountJson, A as AuthSpec, P as PromptRequest, a as AdapterFactory, b as AdapterManifest, C as CreateLlmArgs, L as LlmAdapter } from './types-4d2QrlAe.cjs';
-export { c as ApiKeyAuth, d as AuthKind, e as AuthKindSchema, B as BedrockApiKeyAuth, f as BedrockIamAuth, g as ClientOptions, h as ContentBlock, F as FinishReason, i as FormField, j as FormFieldType, G as GoogleApiKeyAuth, k as GoogleServiceAccountAuth, J as JsonSchema, l as LlmEvent, M as Message, m as ModelCapabilities, n as ModelInfo, R as Role, T as Tool, o as ToolCallEvent, U as Usage, V as VertexServiceAccountAuth } from './types-4d2QrlAe.cjs';
+import { S as ServiceAccountJson, A as AuthSpec, a as AuthKindSchema, P as PromptRequest, b as AdapterFactory, c as AdapterManifest, C as CreateLlmArgs, L as LlmAdapter } from './types-DxknK0Rc.cjs';
+export { d as ApiKeyAuth, e as AuthKind, f as AzureOpenAIApiKeyAuth, B as BedrockApiKeyAuth, g as BedrockIamAuth, h as ClientOptions, i as ContentBlock, F as FinishReason, j as FormField, k as FormFieldType, G as GoogleApiKeyAuth, l as GoogleServiceAccountAuth, J as JsonSchema, m as LlmEvent, M as Message, n as ModelCapabilities, o as ModelInfo, R as Role, T as Tool, p as ToolCallEvent, U as Usage, V as VertexServiceAccountAuth } from './types-DxknK0Rc.cjs';
 
 /**
  * The loose "DB-shape" input accepted by `normalizeAuth`.
@@ -21,18 +21,46 @@ interface RawCredential {
     api_url?: string | null;
     project_id?: string | null;
     location?: string | null;
+    /** Azure OpenAI resource endpoint, e.g. `https://my-resource.openai.azure.com`. */
+    endpoint?: string | null;
+    /** Azure OpenAI deployment name (the user-created deployment, not the model id). */
+    deployment?: string | null;
+    /** Azure OpenAI data-plane api-version, e.g. `2024-10-21`. */
+    api_version?: string | null;
 }
 /**
  * Convert a vendor + raw credential into an `AuthSpec` discriminated union member.
  *
  * Supported vendors: openai, deepseek, anthropic, google, vertex (alias for
  * vertex-gemini + vertex-openai — both accept the same auth shape), vertex-gemini,
- * vertex-openai, bedrock.
+ * vertex-openai, bedrock, azure-openai.
  *
  * Throws with a clear message if the raw credential is missing required fields.
  */
 declare function normalizeAuth(vendor: string, raw: RawCredential): AuthSpec;
 
+/**
+ * Given a vendor id and a raw snake_case credential blob, return the
+ * `AuthKindSchema` from the vendor's manifest that matches the blob.
+ *
+ * Purpose: let credential-handling consumers (api-server's `encryptCredential`
+ * in particular) validate and serialize the *right* set of fields for a
+ * credential without carrying a per-vendor switch of their own. The
+ * discriminator logic that distinguishes e.g. `bedrockApiKey` from
+ * `bedrockIam` lives here, in the library, right next to `normalizeAuth`.
+ *
+ * Rules:
+ *   - Vendor with a single `authKind`: that kind is returned unconditionally.
+ *   - Bedrock: `access_key_id` + `secret_access_key` → `bedrockIam`; else `bedrockApiKey`.
+ *   - Google: `service_key` present → `googleServiceAccount`; `api_key` present → `googleApiKey`.
+ *
+ * Throws if the vendor is unknown or if no declared authKind matches the blob.
+ */
+interface RawCredentialLoose extends RawCredential {
+    [key: string]: unknown;
+}
+declare function pickAuthKind(vendor: string, raw: RawCredentialLoose): AuthKindSchema;
+
 /**
  * Validate a PromptRequest against the library's universal preconditions.
  *
@@ -92,9 +120,11 @@ declare function getManifest(): {
  *   - `createLlm({vendor, auth, client?})` to get a ready-to-stream adapter instance.
  *   - `getManifest()` to enumerate registered vendors (used by api-server).
  *   - `normalizeAuth(vendor, rawCred)` to convert DB-shape creds to AuthSpec.
+ *   - `pickAuthKind(vendor, rawCred)` to pick the right manifest authKind for
+ *     a raw credential (used by api-server's `encryptCredential`).
  *   - `registerAdapter(factory)` to add a custom adapter at runtime.
  */
 
 declare function createLlm<A extends AuthSpec = AuthSpec>(args: CreateLlmArgs<A>): Promise<LlmAdapter<A>>;
 
-export { AdapterFactory, AdapterManifest, AuthSpec, CreateLlmArgs, LlmAdapter, PromptRequest, type RawCredential, ServiceAccountJson, assertValidRequest, createLlm, getAdapterFactory, getManifest, listVendors, normalizeAuth, registerAdapter, replaceAdapter, unregisterAdapter };
+export { AdapterFactory, AdapterManifest, AuthKindSchema, AuthSpec, CreateLlmArgs, LlmAdapter, PromptRequest, type RawCredential, type RawCredentialLoose, ServiceAccountJson, assertValidRequest, createLlm, getAdapterFactory, getManifest, listVendors, normalizeAuth, pickAuthKind, registerAdapter, replaceAdapter, unregisterAdapter };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { S as ServiceAccountJson, A as AuthSpec, P as PromptRequest, a as AdapterFactory, b as AdapterManifest, C as CreateLlmArgs, L as LlmAdapter } from './types-4d2QrlAe.js';
-export { c as ApiKeyAuth, d as AuthKind, e as AuthKindSchema, B as BedrockApiKeyAuth, f as BedrockIamAuth, g as ClientOptions, h as ContentBlock, F as FinishReason, i as FormField, j as FormFieldType, G as GoogleApiKeyAuth, k as GoogleServiceAccountAuth, J as JsonSchema, l as LlmEvent, M as Message, m as ModelCapabilities, n as ModelInfo, R as Role, T as Tool, o as ToolCallEvent, U as Usage, V as VertexServiceAccountAuth } from './types-4d2QrlAe.js';
+import { S as ServiceAccountJson, A as AuthSpec, a as AuthKindSchema, P as PromptRequest, b as AdapterFactory, c as AdapterManifest, C as CreateLlmArgs, L as LlmAdapter } from './types-DxknK0Rc.js';
+export { d as ApiKeyAuth, e as AuthKind, f as AzureOpenAIApiKeyAuth, B as BedrockApiKeyAuth, g as BedrockIamAuth, h as ClientOptions, i as ContentBlock, F as FinishReason, j as FormField, k as FormFieldType, G as GoogleApiKeyAuth, l as GoogleServiceAccountAuth, J as JsonSchema, m as LlmEvent, M as Message, n as ModelCapabilities, o as ModelInfo, R as Role, T as Tool, p as ToolCallEvent, U as Usage, V as VertexServiceAccountAuth } from './types-DxknK0Rc.js';
 
 /**
  * The loose "DB-shape" input accepted by `normalizeAuth`.
@@ -21,18 +21,46 @@ interface RawCredential {
     api_url?: string | null;
     project_id?: string | null;
     location?: string | null;
+    /** Azure OpenAI resource endpoint, e.g. `https://my-resource.openai.azure.com`. */
+    endpoint?: string | null;
+    /** Azure OpenAI deployment name (the user-created deployment, not the model id). */
+    deployment?: string | null;
+    /** Azure OpenAI data-plane api-version, e.g. `2024-10-21`. */
+    api_version?: string | null;
 }
 /**
  * Convert a vendor + raw credential into an `AuthSpec` discriminated union member.
  *
  * Supported vendors: openai, deepseek, anthropic, google, vertex (alias for
  * vertex-gemini + vertex-openai — both accept the same auth shape), vertex-gemini,
- * vertex-openai, bedrock.
+ * vertex-openai, bedrock, azure-openai.
  *
  * Throws with a clear message if the raw credential is missing required fields.
  */
 declare function normalizeAuth(vendor: string, raw: RawCredential): AuthSpec;
 
+/**
+ * Given a vendor id and a raw snake_case credential blob, return the
+ * `AuthKindSchema` from the vendor's manifest that matches the blob.
+ *
+ * Purpose: let credential-handling consumers (api-server's `encryptCredential`
+ * in particular) validate and serialize the *right* set of fields for a
+ * credential without carrying a per-vendor switch of their own. The
+ * discriminator logic that distinguishes e.g. `bedrockApiKey` from
+ * `bedrockIam` lives here, in the library, right next to `normalizeAuth`.
+ *
+ * Rules:
+ *   - Vendor with a single `authKind`: that kind is returned unconditionally.
+ *   - Bedrock: `access_key_id` + `secret_access_key` → `bedrockIam`; else `bedrockApiKey`.
+ *   - Google: `service_key` present → `googleServiceAccount`; `api_key` present → `googleApiKey`.
+ *
+ * Throws if the vendor is unknown or if no declared authKind matches the blob.
+ */
+interface RawCredentialLoose extends RawCredential {
+    [key: string]: unknown;
+}
+declare function pickAuthKind(vendor: string, raw: RawCredentialLoose): AuthKindSchema;
+
 /**
  * Validate a PromptRequest against the library's universal preconditions.
  *
@@ -92,9 +120,11 @@ declare function getManifest(): {
  *   - `createLlm({vendor, auth, client?})` to get a ready-to-stream adapter instance.
  *   - `getManifest()` to enumerate registered vendors (used by api-server).
  *   - `normalizeAuth(vendor, rawCred)` to convert DB-shape creds to AuthSpec.
+ *   - `pickAuthKind(vendor, rawCred)` to pick the right manifest authKind for
+ *     a raw credential (used by api-server's `encryptCredential`).
  *   - `registerAdapter(factory)` to add a custom adapter at runtime.
  */
 
 declare function createLlm<A extends AuthSpec = AuthSpec>(args: CreateLlmArgs<A>): Promise<LlmAdapter<A>>;
 
-export { AdapterFactory, AdapterManifest, AuthSpec, CreateLlmArgs, LlmAdapter, PromptRequest, type RawCredential, ServiceAccountJson, assertValidRequest, createLlm, getAdapterFactory, getManifest, listVendors, normalizeAuth, registerAdapter, replaceAdapter, unregisterAdapter };
+export { AdapterFactory, AdapterManifest, AuthKindSchema, AuthSpec, CreateLlmArgs, LlmAdapter, PromptRequest, type RawCredential, type RawCredentialLoose, ServiceAccountJson, assertValidRequest, createLlm, getAdapterFactory, getManifest, listVendors, normalizeAuth, pickAuthKind, registerAdapter, replaceAdapter, unregisterAdapter };

package/dist/index.js

@@ -81,7 +81,10 @@ async function* streamFromOpenAI(client, req, options) {
   }
   if (req.temperature !== void 0) body.temperature = req.temperature;
   const effectiveMaxTokens = req.maxTokens ?? options.defaultMaxTokens;
-  if (effectiveMaxTokens !== void 0) body.max_tokens = effectiveMaxTokens;
+  if (effectiveMaxTokens !== void 0) {
+    const param = options.tokensParam ?? (needsMaxCompletionTokens(req.model) ? "max_completion_tokens" : "max_tokens");
+    body[param] = effectiveMaxTokens;
+  }
   let stream;
   try {
     stream = await client.chat.completions.create(body, { signal: req.signal });
@@ -264,6 +267,9 @@ function capabilitiesFor(modelId, knownModels) {
   if (known) return known.capabilities;
   return defaultCapabilitiesForUnknown(modelId);
 }
+function needsMaxCompletionTokens(modelId) {
+  return /^(o\d|gpt-5)/i.test(modelId);
+}
 function defaultCapabilitiesForUnknown(modelId) {
   const isReasoning = /^o[13]([-/]|$)/i.test(modelId);
   if (isReasoning) {
@@ -1641,7 +1647,12 @@ var VertexOpenAIAdapter = class {
   stream(req) {
     return streamFromOpenAI(this.ensureClient(), req, {
       knownModels: vertexOpenAIManifest.knownModels,
-      defaultMaxTokens: 4096
+      defaultMaxTokens: 4096,
+      // Pin legacy `max_tokens`: Vertex's OpenAI-compat partner-model
+      // endpoint predates `max_completion_tokens` and may not recognize it.
+      // The model-id heuristic wouldn't catch a partner model named in the
+      // OpenAI style (unlikely today, but defensive).
+      tokensParam: "max_tokens"
     });
   }
   appendAssistantToolCall(history, toolCalls) {
@@ -2232,6 +2243,211 @@ var bedrockFactory = {
   create: () => new BedrockAdapter()
 };
 
+// src/adapters/azure-openai/adapter.ts
+import { AzureOpenAI } from "openai";
+
+// src/adapters/azure-openai/manifest.ts
+var AZURE_OPENAI_KNOWN_MODELS = [
+  {
+    id: "gpt-4o",
+    displayName: "GPT-4o (on Azure)",
+    capabilities: {
+      streaming: true,
+      tools: true,
+      vision: true,
+      systemPrompt: true,
+      maxContextTokens: 128e3
+    }
+  },
+  {
+    id: "gpt-4o-mini",
+    displayName: "GPT-4o mini (on Azure)",
+    capabilities: {
+      streaming: true,
+      tools: true,
+      vision: true,
+      systemPrompt: true,
+      maxContextTokens: 128e3
+    }
+  },
+  {
+    id: "gpt-4-turbo",
+    displayName: "GPT-4 Turbo (on Azure)",
+    capabilities: {
+      streaming: true,
+      tools: true,
+      vision: true,
+      systemPrompt: true,
+      maxContextTokens: 128e3
+    }
+  },
+  {
+    // Azure spells it `gpt-35-turbo` (no dot). Keep their spelling for the id
+    // so capability lookups against deployment names that echo the Azure id
+    // hit.
+    id: "gpt-35-turbo",
+    displayName: "GPT-3.5 Turbo (on Azure)",
+    capabilities: {
+      streaming: true,
+      tools: true,
+      vision: false,
+      systemPrompt: true,
+      maxContextTokens: 16385
+    }
+  },
+  {
+    id: "o1-preview",
+    displayName: "o1 preview \u2014 reasoning (on Azure)",
+    capabilities: {
+      streaming: false,
+      tools: false,
+      vision: false,
+      systemPrompt: false,
+      maxContextTokens: 128e3
+    }
+  },
+  {
+    id: "o1-mini",
+    displayName: "o1 mini \u2014 reasoning (on Azure)",
+    capabilities: {
+      streaming: false,
+      tools: false,
+      vision: false,
+      systemPrompt: false,
+      maxContextTokens: 128e3
+    }
+  }
+];
+var azureOpenAIManifest = {
+  vendor: "azure-openai",
+  displayName: "Azure OpenAI",
+  authKinds: [
+    {
+      kind: "azureOpenAIApiKey",
+      displayName: "API Key",
+      fields: [
+        {
+          name: "apiKey",
+          label: "API Key",
+          type: "password",
+          required: true,
+          help: "Azure OpenAI resource key. Find it in the Azure portal under your OpenAI resource \u2192 Keys and Endpoint."
+        },
+        {
+          name: "endpoint",
+          label: "Endpoint",
+          type: "url",
+          required: true,
+          help: "Resource endpoint URL, e.g. https://my-resource.openai.azure.com. Shown in the Azure portal alongside the keys."
+        },
+        {
+          name: "deployment",
+          label: "Deployment Name",
+          type: "text",
+          required: true,
+          help: "The name you chose for the deployment in Azure AI Studio (NOT the underlying model id \u2014 deployments can be named anything)."
+        },
+        {
+          name: "apiVersion",
+          label: "API Version",
+          type: "text",
+          required: true,
+          default: "2024-10-21",
+          help: "Data-plane api-version, e.g. 2024-10-21. Microsoft rolls these frequently; see Azure OpenAI API reference docs for the current stable GA version."
+        }
+      ]
+    }
+  ],
+  knownModels: AZURE_OPENAI_KNOWN_MODELS,
+  // Azure's list-deployments endpoint is on the control plane (ARM) and
+  // requires AAD credentials the data-plane API key doesn't carry. Return
+  // the curated set from the manifest.
+  supportsModelListing: false,
+  docsUrl: "https://learn.microsoft.com/en-us/azure/ai-services/openai/reference"
+};
+
+// src/adapters/azure-openai/adapter.ts
+var AzureOpenAIAdapter = class {
+  vendor = azureOpenAIManifest.vendor;
+  acceptedAuth = ["azureOpenAIApiKey"];
+  client;
+  init(auth, client) {
+    if (auth.kind !== "azureOpenAIApiKey") {
+      throw new Error(
+        `AzureOpenAIAdapter: unsupported auth kind '${auth.kind}'`
+      );
+    }
+    if (!auth.apiKey) {
+      throw new Error("AzureOpenAIAdapter: apiKey is required");
+    }
+    if (!auth.endpoint) {
+      throw new Error("AzureOpenAIAdapter: endpoint is required");
+    }
+    if (!auth.deployment) {
+      throw new Error("AzureOpenAIAdapter: deployment is required");
+    }
+    if (!auth.apiVersion) {
+      throw new Error("AzureOpenAIAdapter: apiVersion is required");
+    }
+    this.client = new AzureOpenAI({
+      apiKey: auth.apiKey,
+      endpoint: auth.endpoint,
+      apiVersion: auth.apiVersion,
+      deployment: auth.deployment,
+      ...client?.timeout !== void 0 ? { timeout: client.timeout } : {},
+      ...client?.maxRetries !== void 0 ? { maxRetries: client.maxRetries } : {}
+    });
+  }
+  stream(req) {
+    return streamFromOpenAI(this.ensureClient(), req, {
+      knownModels: azureOpenAIManifest.knownModels,
+      tokensParam: "max_completion_tokens"
+    });
+  }
+  appendAssistantToolCall(history, toolCalls) {
+    return appendOpenAIAssistantToolCall(history, toolCalls);
+  }
+  appendToolResult(history, toolCallId, result) {
+    return appendOpenAIToolResult(history, toolCallId, result);
+  }
+  async listAvailableModels() {
+    return [...azureOpenAIManifest.knownModels];
+  }
+  async testCredential() {
+    const client = this.ensureClient();
+    await client.chat.completions.create({
+      // Azure ignores `model` when a deployment is in the URL, but the SDK
+      // still requires it as a parameter.
+      model: "probe",
+      messages: [{ role: "user", content: "ping" }],
+      // Use `max_completion_tokens` (not legacy `max_tokens`): gpt-5 family
+      // and o-series reasoning models return 400 on the legacy parameter.
+      // The newer name is a superset — also accepted by gpt-4o, gpt-4-turbo,
+      // and gpt-3.5-turbo deployments — so it's the safe choice for a probe
+      // that has to work regardless of the underlying deployment model.
+      max_completion_tokens: 1,
+      stream: false
+    });
+  }
+  async warmup() {
+  }
+  ensureClient() {
+    if (!this.client) {
+      throw new Error(
+        "AzureOpenAIAdapter: init() must be called before stream()/listAvailableModels()"
+      );
+    }
+    return this.client;
+  }
+};
+
+// src/adapters/azure-openai/factory.ts
+var azureOpenAIFactory = {
+  vendor: azureOpenAIManifest.vendor,
+  manifest: azureOpenAIManifest,
+  create: () => new AzureOpenAIAdapter()
+};
+
 // src/adapters/index.ts
 registerAdapter(openAIFactory);
 registerAdapter(deepseekFactory);
@@ -2240,6 +2456,7 @@ registerAdapter(googleFactory);
 registerAdapter(vertexGeminiFactory);
 registerAdapter(vertexOpenAIFactory);
 registerAdapter(bedrockFactory);
+registerAdapter(azureOpenAIFactory);
 
 // src/normalize-auth.ts
 function normalizeAuth(vendor, raw) {
@@ -2260,6 +2477,8 @@ function normalizeAuth(vendor, raw) {
       return normalizeVertex(vendor, raw);
     case "bedrock":
       return normalizeBedrock(raw);
+    case "azure-openai":
+      return normalizeAzureOpenAI(raw);
     default:
       throw new Error(
         `normalizeAuth: unknown vendor '${vendor}'. If this is a custom adapter, construct the AuthSpec directly.`
@@ -2339,6 +2558,27 @@ function normalizeBedrock(raw) {
     `normalizeAuth: vendor 'bedrock' requires either (access_key_id + secret_access_key) or api_key`
   );
 }
+function normalizeAzureOpenAI(raw) {
+  if (!raw.api_key) {
+    throw new Error(`normalizeAuth: vendor 'azure-openai' requires 'api_key'`);
+  }
+  if (!raw.endpoint) {
+    throw new Error(`normalizeAuth: vendor 'azure-openai' requires 'endpoint'`);
+  }
+  if (!raw.deployment) {
+    throw new Error(`normalizeAuth: vendor 'azure-openai' requires 'deployment'`);
+  }
+  if (!raw.api_version) {
+    throw new Error(`normalizeAuth: vendor 'azure-openai' requires 'api_version'`);
+  }
+  return {
+    kind: "azureOpenAIApiKey",
+    apiKey: raw.api_key,
+    endpoint: raw.endpoint,
+    deployment: raw.deployment,
+    apiVersion: raw.api_version
+  };
+}
 function parseServiceKey(value) {
   if (typeof value === "string") {
     try {
@@ -2350,6 +2590,51 @@ function parseServiceKey(value) {
   return value;
 }
 
+// src/pick-auth-kind.ts
+function pickAuthKind(vendor, raw) {
+  const factory = getAdapterFactory(vendor);
+  const { authKinds } = factory.manifest;
+  if (authKinds.length === 1) {
+    return authKinds[0];
+  }
+  switch (vendor) {
+    case "bedrock": {
+      const iam = authKinds.find((k) => k.kind === "bedrockIam");
+      const apiKey = authKinds.find((k) => k.kind === "bedrockApiKey");
+      if (raw.access_key_id && raw.secret_access_key) {
+        if (!iam) throw new Error(`pickAuthKind: bedrock manifest missing 'bedrockIam'`);
+        return iam;
+      }
+      if (raw.api_key) {
+        if (!apiKey) throw new Error(`pickAuthKind: bedrock manifest missing 'bedrockApiKey'`);
+        return apiKey;
+      }
+      throw new Error(
+        `pickAuthKind: bedrock credential missing both 'api_key' and ('access_key_id' + 'secret_access_key')`
+      );
+    }
+    case "google": {
+      const svc = authKinds.find((k) => k.kind === "googleServiceAccount");
+      const apiKey = authKinds.find((k) => k.kind === "googleApiKey");
+      if (raw.service_key) {
+        if (!svc) throw new Error(`pickAuthKind: google manifest missing 'googleServiceAccount'`);
+        return svc;
+      }
+      if (raw.api_key) {
+        if (!apiKey) throw new Error(`pickAuthKind: google manifest missing 'googleApiKey'`);
+        return apiKey;
+      }
+      throw new Error(
+        `pickAuthKind: google credential missing both 'api_key' and 'service_key'`
+      );
+    }
+    default:
+      throw new Error(
+        `pickAuthKind: vendor '${vendor}' declares ${authKinds.length} authKinds but has no discriminator rule. Add one in src/pick-auth-kind.ts.`
+      );
+  }
+}
+
 // src/index.ts
 async function createLlm(args) {
   const factory = getAdapterFactory(args.vendor);
@@ -2370,6 +2655,7 @@ export {
   getManifest,
   listVendors,
   normalizeAuth,
+  pickAuthKind,
   registerAdapter,
   replaceAdapter,
   unregisterAdapter