@kindgi/adapter-model-azure-openai 0.0.0-stage → 0.1.7

package/dist/entry.js

@@ -0,0 +1,195 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The Azure OpenAI adapter: a registration's models served by its Azure OpenAI deployments,
+ * through `@kindgi/adapter-model-shared` (retries, typed errors, the reasoning state across a
+ * pause, usage and cost).
+ *
+ * How it signs in, pinned (each has a test):
+ *   - Before each attempt (`beforeAttempt`), with the call's abort signal; the attempt's
+ *     request reads what it got (`attemptPrepared()`), so calls at once never share one.
+ *   - `auth: entra`: a bearer token from the runtime's own Azure identity
+ *     (`AdapterFactoryInput.identities.azure`), asked for every attempt (bounded), for the
+ *     endpoint's cloud's scope; no `api-key` header. Only an Azure OpenAI host gets it
+ *     (`AZURE_OPENAI_CLOUDS`): any other is refused at registration.
+ *   - `auth: api-key`: the key `secret_ref` names, read for every attempt, so a rotated key
+ *     takes effect on the next call.
+ *   - A failed sign-in (no token, no key, a blank one) is an `auth` error, never retried. So
+ *     is a key or a token a header can't carry (a line break inside it): fetch's own error
+ *     would quote it into the call's failure and the logs, so it's refused first, unquoted.
+ *   - No request follows a redirect: the credential goes to the endpoint, nowhere else.
+ *   - Never `AZURE_API_KEY` or `AZURE_RESOURCE_NAME` from the environment: the provider is
+ *     always given its endpoint and its credential.
+ */
+import { createAzure } from '@ai-sdk/azure';
+import { ModelProviderError, tokenCostUsd } from '@kindgi/adapter-model-shared';
+import { attemptPrepared, createAiSdkModelProvider } from '@kindgi/adapter-model-shared/ai-sdk';
+import { adapterConfigError, identitiesPresent, } from '@kindgi/capabilities';
+import { bearerValueProblem, headerValueProblem } from '@kindgi/types';
+import { AZURE_OPENAI_ADAPTER_ID, AZURE_OPENAI_CLOUDS, readAzureOpenAIConfig } from './config.js';
+/** The Entra scope Azure OpenAI takes in Azure's public cloud. */
+export const AZURE_OPENAI_SCOPE = AZURE_OPENAI_CLOUDS[0].scope;
+/** How long a token from the runtime's identity may take before the call fails as `auth`. */
+export const IDENTITY_TIMEOUT_MS = 10_000;
+/** What's wrong with a registration, for `POST /v1/providers` and `GET …/check`. */
+export function azureOpenAICheckConfig(input) {
+    const read = readAzureOpenAIConfig(input);
+    return read.kind === 'ok' ? [] : read.problems;
+}
+export const azureOpenAIAdapterFactory = (input) => {
+    const { metadata } = input;
+    const read = readAzureOpenAIConfig({
+        metadata,
+        ...(input.config !== undefined && { config: input.config }),
+        hasSecretRef: input.resolveApiKey !== undefined,
+        identities: identitiesPresent(input.identities),
+    });
+    if (read.kind === 'err') {
+        throw adapterConfigError(AZURE_OPENAI_ADAPTER_ID, metadata.id, read.problems[0]);
+    }
+    const { endpoint, api, auth, scope, deployments } = read.config;
+    const tokens = input.identities?.azure;
+    const resolveApiKey = input.resolveApiKey;
+    return createAiSdkModelProvider({
+        metadata,
+        ...(input.fetch !== undefined && { fetch: input.fetch }),
+        beforeAttempt: (signal) => auth === 'entra'
+            ? entraToken(tokens, scope, signal).then((token) => ({
+                token,
+            }))
+            : apiKey(resolveApiKey).then((key) => ({ key })),
+        languageModel: (name, fetch) => {
+            const send = withoutRedirects(fetch);
+            const azure = createAzure({
+                ...endpoint,
+                ...(auth === 'entra'
+                    ? { tokenProvider: async () => signedIn().token, fetch: send }
+                    : // An explicit (empty) key keeps the provider from reading AZURE_API_KEY; the real
+                        // one, this attempt's, is set on its request.
+                        { apiKey: '', fetch: withApiKey(send) }),
+            });
+            const deployment = deployments.get(name);
+            return api === 'chat-completions' ? azure.chat(deployment) : azure.responses(deployment);
+        },
+        // Responses keeps nothing on Azure's side: our journal is the record. Whether a model
+        // reasons is the registration's to say where it says (the deployment's name, which the
+        // library reads as the model's, can say nothing); where it doesn't, the library decides.
+        // Responses reads it under `azure`, Chat under `openai`.
+        providerOptions: (model) => {
+            const forced = reasons(model);
+            const reasoning = forced === undefined ? {} : { forceReasoning: forced };
+            return api === 'responses'
+                ? { azure: { store: false, ...reasoning } }
+                : forced === undefined
+                    ? undefined
+                    : { openai: reasoning };
+        },
+        cost: (model, usage) => tokenCostUsd(model, usage),
+    });
+};
+/** The entry a runtime registers: the factory, and its static check. */
+export const azureOpenAIAdapterEntry = {
+    adapterId: AZURE_OPENAI_ADAPTER_ID,
+    capabilityKind: 'llm-inference',
+    factory: azureOpenAIAdapterFactory,
+    checkConfig: azureOpenAICheckConfig,
+};
+/**
+ * Whether the registration says a model reasons: yes when it thinks or takes no sampling (GPT-5
+ * and later, o-series), no when it takes sampling, said; undefined when it says neither.
+ */
+function reasons(model) {
+    if (model.thinking !== undefined || model.sampling === false)
+        return true;
+    return model.sampling === true ? false : undefined;
+}
+/** This attempt's sign-in, read by its request. */
+function signedIn() {
+    const signed = attemptPrepared();
+    if (signed === undefined) {
+        throw new ModelProviderError('auth', undefined, 'The request has no sign-in of its own.');
+    }
+    return signed;
+}
+const SIGN_IN_HINT = 'It signs in as its managed identity (KINDGI_AZURE_CLIENT_ID names a user-assigned one), which needs the Cognitive Services OpenAI User role on the resource.';
+/**
+ * A bearer for an attempt, from the runtime's Azure identity: bounded, stopped with the call,
+ * and `auth` when it fails.
+ */
+async function entraToken(tokens, scope, signal) {
+    let token;
+    try {
+        const asked = signal !== undefined
+            ? tokens.getToken(scope, { abortSignal: signal })
+            : tokens.getToken(scope);
+        token = (await bounded(asked, IDENTITY_TIMEOUT_MS, signal))?.token;
+    }
+    catch (error) {
+        // (A call stopped meanwhile ends with its own reason: the retries check the signal first.)
+        throw new ModelProviderError('auth', undefined, `The runtime's Azure identity gave no token for ${scope}: ${messageOf(error)}. ${SIGN_IN_HINT}`, { cause: error });
+    }
+    if (token === undefined || token === '') {
+        throw new ModelProviderError('auth', undefined, `The runtime's Azure identity returned no token for ${scope}. ${SIGN_IN_HINT}`);
+    }
+    // Sent as `Bearer <token>`, so checked as sent, before the request: never quoted.
+    const problem = bearerValueProblem(token);
+    if (problem !== undefined) {
+        throw new ModelProviderError('auth', undefined, `The runtime's Azure identity returned a token for ${scope} with ${problem}, which a header can't carry.`);
+    }
+    return token;
+}
+/** The current key `secret_ref` names, for an attempt; `auth` when there's none. */
+async function apiKey(resolveApiKey) {
+    let key;
+    try {
+        key = await resolveApiKey();
+    }
+    catch (error) {
+        throw new ModelProviderError('auth', undefined, `The key secret_ref names couldn't be read: ${messageOf(error)}.`, { cause: error });
+    }
+    // Whitespace around a key (a stored file's newline) is never the key's.
+    const trimmed = key.trim();
+    if (trimmed === '') {
+        throw new ModelProviderError('auth', undefined, 'The key secret_ref names is empty.');
+    }
+    // Sent as is in `api-key`, so checked before its request: never quoted.
+    const problem = headerValueProblem(trimmed);
+    if (problem !== undefined) {
+        throw new ModelProviderError('auth', undefined, `The key secret_ref names has ${problem}, which a header can't carry: store the secret without it.`);
+    }
+    return trimmed;
+}
+/** The `api-key` header on the request, from this attempt's key. */
+function withApiKey(fetch) {
+    return async (url, init) => {
+        const headers = new Headers(init?.headers);
+        headers.set('api-key', signedIn().key);
+        return fetch(url, { ...init, headers });
+    };
+}
+/** No request follows a redirect, so its credential reaches the endpoint and nothing else. */
+function withoutRedirects(fetch) {
+    return (url, init) => fetch(url, { ...init, redirect: 'error' });
+}
+/** The promise, or a failure after `ms`, or the signal's reason when the call stops first. */
+function bounded(promise, ms, signal) {
+    // An abort that has already happened fires no event.
+    if (signal?.aborted === true)
+        return Promise.reject(signal.reason);
+    let timer;
+    let onAbort;
+    const stop = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`no answer in ${ms / 1000} s`)), ms);
+        if (signal !== undefined) {
+            onAbort = () => reject(signal.reason);
+            signal.addEventListener('abort', onAbort, { once: true });
+        }
+    });
+    return Promise.race([Promise.resolve(promise), stop]).finally(() => {
+        clearTimeout(timer);
+        if (onAbort !== undefined)
+            signal?.removeEventListener('abort', onAbort);
+    });
+}
+const messageOf = (error) => error instanceof Error ? error.message : String(error);
+//# sourceMappingURL=entry.js.map

package/dist/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../src/entry.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAOL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAElG,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAE/D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CACpC,KAA8B;IAE9B,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAmB,CAAC,KAAK,EAAE,EAAE;IACjE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAG,qBAAqB,CAAC;QACjC,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3D,YAAY,EAAE,KAAK,CAAC,aAAa,KAAK,SAAS;QAC/C,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,kBAAkB,CACtB,uBAAuB,EACvB,QAAQ,CAAC,EAAE,EACX,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAyB,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC;IACvC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAE1C,OAAO,wBAAwB,CAAC;QAC9B,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,aAAa,EAAE,CAAC,MAAM,EAAqB,EAAE,CAC3C,IAAI,KAAK,OAAO;YACd,CAAC,CAAC,UAAU,CAAC,MAA0B,EAAE,KAAe,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC/E,KAAK;aACN,CAAC,CAAC;YACL,CAAC,CAAC,MAAM,CAAC,aAAsC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,WAAW,CAAC;gBACxB,GAAG,QAAQ;gBACX,GAAG,CAAC,IAAI,KAAK,OAAO;oBAClB,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAe,EAAE,KAAK,EAAE,IAAI,EAAE;oBACxE,CAAC,CAAC,kFAAkF;wBAClF,8CAA8C;wBAC9C,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC;YACnD,OAAO,GAAG,KAAK,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3F,CAAC;QACD,sFAAsF;QACtF,uFAAuF;QACvF,yFAAyF;QACzF,yDAAyD;QACzD,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;YACzE,OAAO,GAAG,KAAK,WAAW;gBACxB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,SAAS,EAAE,EAAE;gBAC3C,CAAC,CAAC,MAAM,KAAK,SAAS;oBACpB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC;KACnD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAwB;IAC1D,SAAS,EAAE,uBAAuB;IAClC,cAAc,EAAE,eAAe;IAC/B,OAAO,EAAE,yBAAyB;IAClC,WAAW,EAAE,sBAAsB;CACpC,CAAC;AAEF;;;GAGG;AACH,SAAS,OAAO,CAAC,KAAgB;IAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAQD,mDAAmD;AACnD,SAAS,QAAQ;IACf,MAAM,MAAM,GAAG,eAAe,EAAY,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAChB,8JAA8J,CAAC;AAEjK;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,MAAwB,EACxB,KAAa,EACb,MAA+B;IAE/B,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GACT,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;YACjD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2FAA2F;QAC3F,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,kDAAkD,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,YAAY,EAAE,EAC/F,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,sDAAsD,KAAK,KAAK,YAAY,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,kFAAkF;IAClF,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,qDAAqD,KAAK,SAAS,OAAO,+BAA+B,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,MAAM,CAAC,aAAoC;IACxD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,8CAA8C,SAAS,CAAC,KAAK,CAAC,GAAG,EACjE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,oCAAoC,CAAC,CAAC;IACxF,CAAC;IACD,wEAAwE;IACxE,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,gCAAgC,OAAO,4DAA4D,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,KAA8B;IAChD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAa,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,gBAAgB,CAAC,KAA8B;IACtD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAI,OAAuB,EAAE,EAAU,EAAE,MAAoB;IAC3E,qDAAqD;IACrD,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,KAAgD,CAAC;IACrD,IAAI,OAAiC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC5C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACjE,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAc,EAAU,EAAE,CAC3C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { AZURE_OPENAI_ADAPTER_ID, AZURE_OPENAI_APIS, AZURE_OPENAI_AUTHS, AZURE_OPENAI_CLOUDS, type AzureOpenAIApi, type AzureOpenAIAuth, type AzureOpenAIConfig, azureCloudOf, readAzureOpenAIConfig, } from './config.js';
+export { AZURE_OPENAI_SCOPE, IDENTITY_TIMEOUT_MS, azureOpenAIAdapterEntry, azureOpenAIAdapterFactory, azureOpenAICheckConfig, } from './entry.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,YAAY,EACZ,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export { AZURE_OPENAI_ADAPTER_ID, AZURE_OPENAI_APIS, AZURE_OPENAI_AUTHS, AZURE_OPENAI_CLOUDS, azureCloudOf, readAzureOpenAIConfig, } from './config.js';
+export { AZURE_OPENAI_SCOPE, IDENTITY_TIMEOUT_MS, azureOpenAIAdapterEntry, azureOpenAIAdapterFactory, azureOpenAICheckConfig, } from './entry.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAInB,YAAY,EACZ,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@kindgi/adapter-model-azure-openai",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.7",
+  "description": "Azure OpenAI ModelProvider for @kindgi/capabilities: your Azure OpenAI deployments (Responses or Chat Completions) by API key or the runtime's Entra identity.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kindgi/kindgi-sdk.git",
+    "directory": "packages/adapters/model-azure-openai"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "dependencies": {
+    "@ai-sdk/azure": "4.0.97",
+    "@kindgi/adapter-model-shared": "0.1.7",
+    "@kindgi/capabilities": "0.1.7",
+    "@kindgi/types": "0.1.7"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "homepage": "https://github.com/kindgi/kindgi-sdk/tree/main/packages/adapters/model-azure-openai#readme",
+  "bugs": {
+    "url": "https://github.com/kindgi/kindgi-sdk/issues"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  }
 }

package/src/config.ts

@@ -0,0 +1,319 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * An Azure OpenAI registration's `adapter_config`, read and checked: where the resource is,
+ * which API, how to sign in, and which deployment serves each model. Static: no network, no
+ * secret read (`checkConfig` runs it at registration, the factory again when it builds).
+ */
+
+import type {
+  AdapterConfigCheckInput,
+  AdapterConfigProblem,
+  ProviderMetadata,
+} from '@kindgi/capabilities';
+
+export const AZURE_OPENAI_ADAPTER_ID = '@kindgi/adapter-model-azure-openai';
+
+/** The v1 API's Responses (the default), or Chat Completions. */
+export const AZURE_OPENAI_APIS = ['responses', 'chat-completions'] as const;
+export type AzureOpenAIApi = (typeof AZURE_OPENAI_APIS)[number];
+
+/** A key (`secret_ref`, sent as `api-key`), or the runtime's Entra identity (a bearer token). */
+export const AZURE_OPENAI_AUTHS = ['api-key', 'entra'] as const;
+export type AzureOpenAIAuth = (typeof AZURE_OPENAI_AUTHS)[number];
+
+export interface AzureOpenAIConfig {
+  readonly endpoint: { readonly resourceName: string } | { readonly baseURL: string };
+  readonly api: AzureOpenAIApi;
+  readonly auth: AzureOpenAIAuth;
+  /** With `auth: entra`: the scope the runtime's token is for, the endpoint's cloud's. */
+  readonly scope?: string;
+  /** The deployment for each registered model. */
+  readonly deployments: ReadonlyMap<string, string>;
+}
+
+/**
+ * The hosts the runtime's Entra token may go to, by cloud, each with the scope its tokens are
+ * for. Nothing else gets the token: a registration naming another host could replay it against
+ * every Azure OpenAI resource the runtime's identity holds a role on. A custom endpoint (a
+ * gateway) takes `auth: api-key`.
+ *
+ * Sources (read 2026-10-09): the endpoints by cloud,
+ * https://learn.microsoft.com/en-us/azure/azure-government/compare-azure-government-global-azure;
+ * Azure Government's scope, https://learn.microsoft.com/en-us/dotnet/api/overview/azure/ai.openai-readme
+ * (its Azure Government example). Microsoft's newer pages name the public
+ * scope `https://ai.azure.com/.default`; `cognitiveservices.azure.com` is the one proven live
+ * (2026-10-09), so it stays until a live run proves the other.
+ */
+export const AZURE_OPENAI_CLOUDS = [
+  {
+    cloud: 'Azure',
+    hostSuffixes: ['.openai.azure.com', '.cognitiveservices.azure.com', '.services.ai.azure.com'],
+    scope: 'https://cognitiveservices.azure.com/.default',
+  },
+  {
+    cloud: 'Azure Government',
+    hostSuffixes: ['.openai.azure.us', '.cognitiveservices.azure.us'],
+    scope: 'https://cognitiveservices.azure.us/.default',
+  },
+] as const;
+
+type AzureCloud = (typeof AZURE_OPENAI_CLOUDS)[number];
+
+/** The cloud an Azure OpenAI host belongs to; undefined for any other host. */
+export function azureCloudOf(hostname: string): AzureCloud | undefined {
+  const host = hostname.toLowerCase();
+  return AZURE_OPENAI_CLOUDS.find((c) =>
+    c.hostSuffixes.some((suffix) => host.endsWith(suffix) && host.length > suffix.length),
+  );
+}
+
+/** The v1 API's path on an Azure OpenAI host. */
+const V1_PATH = '/openai/v1';
+const AZURE_HOSTS = AZURE_OPENAI_CLOUDS.flatMap((c) => c.hostSuffixes.map((s) => `*${s}`)).join(
+  ', ',
+);
+
+const KEYS = ['resourceName', 'baseURL', 'deployments', 'api', 'auth'] as const;
+/** A single DNS label, as Azure's resource names are. */
+const RESOURCE_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+/**
+ * A deployment name as it can sit in this setting and in the request path: Azure sets no
+ * character rule of its own (its ARM reference says only "string"; `gpt-6.1-sol` is a real
+ * one), so only what would break the setting (`,`, `=`) or the path (`/`, whitespace) is refused,
+ * and Azure answers for the rest.
+ */
+const DEPLOYMENT_NAME = /^[^\s,=/]+$/;
+
+const at = (key: string) => `/adapter_config/${key}`;
+
+/** The registration read, or every problem with it. */
+export function readAzureOpenAIConfig(
+  input: AdapterConfigCheckInput,
+):
+  | { readonly kind: 'ok'; readonly config: AzureOpenAIConfig }
+  | { readonly kind: 'err'; readonly problems: readonly AdapterConfigProblem[] } {
+  const config = input.config ?? {};
+  const problems: AdapterConfigProblem[] = [];
+
+  for (const key of Object.keys(config)) {
+    if (!(KEYS as readonly string[]).includes(key)) {
+      problems.push({
+        path: at(key),
+        message: `adapter_config.${key} isn't an Azure OpenAI setting: it takes resourceName or baseURL, deployments, api and auth.`,
+      });
+    }
+  }
+
+  const auth = config.auth ?? 'api-key';
+  const resourceName = config.resourceName;
+  const baseURL = config.baseURL;
+  let endpoint: AzureOpenAIConfig['endpoint'] | undefined;
+  let cloud: AzureCloud | undefined;
+  if (resourceName !== undefined && baseURL !== undefined) {
+    problems.push({
+      path: at('baseURL'),
+      message:
+        'adapter_config.resourceName and adapter_config.baseURL exclude each other: the resource, or a custom endpoint.',
+    });
+  } else if (resourceName !== undefined) {
+    if (typeof resourceName !== 'string' || !RESOURCE_NAME.test(resourceName)) {
+      problems.push({
+        path: at('resourceName'),
+        message:
+          'adapter_config.resourceName must be the Azure OpenAI resource name, as in <name>.openai.azure.com (letters, digits, hyphens).',
+      });
+    } else {
+      endpoint = { resourceName };
+      cloud = AZURE_OPENAI_CLOUDS[0];
+    }
+  } else if (baseURL !== undefined) {
+    const read = readBaseURL(baseURL, auth, problems);
+    if (read !== undefined) {
+      endpoint = { baseURL: read.baseURL };
+      cloud = read.cloud;
+    }
+  } else {
+    problems.push({
+      path: at('resourceName'),
+      message:
+        'needs adapter_config.resourceName, the Azure OpenAI resource (as in <name>.openai.azure.com), or adapter_config.baseURL for a custom endpoint.',
+    });
+  }
+
+  const api = config.api ?? 'responses';
+  if (!(AZURE_OPENAI_APIS as readonly unknown[]).includes(api)) {
+    problems.push({
+      path: at('api'),
+      message: `adapter_config.api must be one of ${AZURE_OPENAI_APIS.join(', ')}.`,
+    });
+  }
+
+  if (!(AZURE_OPENAI_AUTHS as readonly unknown[]).includes(auth)) {
+    problems.push({
+      path: at('auth'),
+      message: `adapter_config.auth must be one of ${AZURE_OPENAI_AUTHS.join(', ')}.`,
+    });
+  } else if (auth === 'api-key' && !input.hasSecretRef) {
+    problems.push({
+      path: '/secret_ref',
+      message:
+        "needs secret_ref: the resource's API key (or adapter_config.auth = entra, to sign in as the runtime's Azure identity).",
+    });
+  } else if (auth === 'entra' && input.hasSecretRef) {
+    problems.push({
+      path: '/secret_ref',
+      message:
+        "adapter_config.auth = entra signs in as the runtime's Azure identity: remove secret_ref.",
+    });
+  }
+  if (auth === 'entra' && input.identities?.azure === false) {
+    problems.push({
+      path: at('auth'),
+      message:
+        "adapter_config.auth = entra needs the runtime's Azure identity (its managed identity; KINDGI_AZURE_CLIENT_ID names a user-assigned one), and this runtime has none.",
+    });
+  }
+
+  const deployments = readDeployments(config.deployments, input.metadata, problems);
+
+  if (problems.length > 0 || endpoint === undefined || deployments === undefined) {
+    return { kind: 'err', problems };
+  }
+  return {
+    kind: 'ok',
+    config: {
+      endpoint,
+      api: api as AzureOpenAIApi,
+      auth: auth as AzureOpenAIAuth,
+      ...(auth === 'entra' && cloud !== undefined && { scope: cloud.scope }),
+      deployments,
+    },
+  };
+}
+
+/**
+ * A custom endpoint: https, with no credentials, query or fragment (they'd sit in the stored
+ * settings); on an Azure OpenAI host, the v1 path (the portal's endpoint lacks it, and would
+ * 404); and with `auth: entra`, an Azure OpenAI host only.
+ */
+function readBaseURL(
+  value: unknown,
+  auth: unknown,
+  problems: AdapterConfigProblem[],
+): { readonly baseURL: string; readonly cloud: AzureCloud | undefined } | undefined {
+  const path = at('baseURL');
+  const url = typeof value === 'string' ? parseUrl(value) : undefined;
+  if (url === undefined || url.protocol !== 'https:') {
+    problems.push({
+      path,
+      message: `adapter_config.baseURL must be an https URL (e.g. https://<name>.openai.azure.com${V1_PATH}).`,
+    });
+    return undefined;
+  }
+  const before = problems.length;
+  const raw = value as string;
+  if (url.username !== '' || url.password !== '') {
+    problems.push({
+      path,
+      message:
+        "adapter_config.baseURL can't hold credentials: a key goes in secret_ref, never in the URL.",
+    });
+  }
+  if (url.search !== '' || raw.includes('?') || url.hash !== '' || raw.includes('#')) {
+    problems.push({
+      path,
+      message:
+        "adapter_config.baseURL can't hold a query or a fragment: a key goes in secret_ref, and the API version is the adapter's.",
+    });
+  }
+  if (/\/\/+$/.test(url.pathname)) {
+    problems.push({
+      path,
+      message:
+        "adapter_config.baseURL can't end in more than one /: the adapter adds the API's path.",
+    });
+  }
+  const cloud = azureCloudOf(url.hostname);
+  if (cloud !== undefined && url.pathname.replace(/\/+$/, '') !== V1_PATH) {
+    problems.push({
+      path,
+      message: `adapter_config.baseURL on an Azure OpenAI host must end in ${V1_PATH} (https://${url.hostname}${V1_PATH}), the v1 API.`,
+    });
+  }
+  if (auth === 'entra' && cloud === undefined) {
+    problems.push({
+      path,
+      message: `adapter_config.auth = entra sends the runtime's Azure token, which goes only to an Azure OpenAI host (${AZURE_HOSTS}); ${url.hostname} isn't one. A custom endpoint takes auth = api-key.`,
+    });
+  }
+  return problems.length === before ? { baseURL: raw, cloud } : undefined;
+}
+
+/** `"model=deployment,model=deployment"`: every registered model, each a deployment Azure takes. */
+function readDeployments(
+  value: unknown,
+  metadata: ProviderMetadata,
+  problems: AdapterConfigProblem[],
+): ReadonlyMap<string, string> | undefined {
+  const path = at('deployments');
+  if (typeof value !== 'string' || value.trim() === '') {
+    problems.push({
+      path,
+      message:
+        'needs adapter_config.deployments, the deployment for each model: "model=deployment,…" (e.g. "gpt-6.1-sol=gpt-6-1-sol").',
+    });
+    return undefined;
+  }
+  const models = new Set(metadata.models.map((m) => m.name));
+  const map = new Map<string, string>();
+  const before = problems.length;
+  for (const pair of value.split(',')) {
+    const [model, deployment, extra] = pair.split('=').map((part) => part.trim());
+    if (
+      model === undefined ||
+      model === '' ||
+      deployment === undefined ||
+      deployment === '' ||
+      extra !== undefined
+    ) {
+      problems.push({
+        path,
+        message: `adapter_config.deployments has "${pair.trim()}": each entry is model=deployment.`,
+      });
+    } else if (map.has(model)) {
+      problems.push({
+        path,
+        message: `adapter_config.deployments names ${model} twice: one deployment each.`,
+      });
+    } else if (!models.has(model)) {
+      problems.push({
+        path,
+        message: `adapter_config.deployments names ${model}, which this registration doesn't list in metadata.models.`,
+      });
+    } else if (!DEPLOYMENT_NAME.test(deployment)) {
+      problems.push({
+        path,
+        message: `adapter_config.deployments gives ${model} the deployment "${deployment}": a deployment name can't hold spaces, ",", "=" or "/".`,
+      });
+    } else map.set(model, deployment);
+  }
+  for (const model of models) {
+    if (!map.has(model) && problems.length === before) {
+      problems.push({
+        path,
+        message: `adapter_config.deployments has no deployment for ${model}.`,
+      });
+    }
+  }
+  return problems.length === before ? map : undefined;
+}
+
+function parseUrl(value: string): URL | undefined {
+  try {
+    return new URL(value);
+  } catch {
+    return undefined;
+  }
+}