@thebtf/dsh-cliproxyapi-provider 0.0.0-stage → 0.4.3

package/src/policy.js

@@ -0,0 +1,42 @@
+import { resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
+import { Config as NativePiAiConfig } from '@deepseek-ai/dsh-llm-pi-ai'
+import { ConnectionError } from './connection.js'
+import { credentialField } from './secrets.js'
+
+// The wire protocols this build can serve. The order is the presentation order:
+// the first entry is the default a fresh connection starts with.
+export const PROTOCOLS = ['openai-responses', 'openai-completions', 'anthropic-messages', 'google-generative-ai']
+export const DEFAULT_PROTOCOL = PROTOCOLS[0]
+
+const fields = new Set(['displayName', 'api', 'defaultContextWindow', 'defaultMaxTokens', 'defaultInput', 'headers', 'compat', 'retryPolicy', 'reasoning', 'thinkingBudgets', 'streamIdleTimeoutMs', 'maxRequestImageBytes', 'maxRequestImages', 'imageOffloadCountQuantum', 'requestImagePixelBudget', 'requestImageMaxBytes', 'cacheRetention', 'transport', 'timeoutMs', 'websocketConnectTimeoutMs'])
+const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v)
+const containsCredentials = (v) => object(v) && Object.entries(v).some(([k, x]) => credentialField(k) || containsCredentials(x)) || Array.isArray(v) && v.some(containsCredentials)
+export function protocolOf(policy) {
+  return PROTOCOLS.includes(policy?.api) ? policy.api : DEFAULT_PROTOCOL
+}
+export function validatePolicy(policy = {}) {
+  try {
+    if (!object(policy) || containsCredentials(policy) || Object.keys(policy).some((k) => !fields.has(k))) throw 0
+    for (const key of ['defaultContextWindow', 'defaultMaxTokens', 'maxRequestImageBytes', 'maxRequestImages', 'imageOffloadCountQuantum', 'requestImagePixelBudget', 'requestImageMaxBytes']) if (policy[key] !== undefined && (!Number.isSafeInteger(policy[key]) || policy[key] <= 0)) throw 0
+    for (const key of ['timeoutMs', 'websocketConnectTimeoutMs']) if (policy[key] !== undefined && (!Number.isSafeInteger(policy[key]) || policy[key] < 0)) throw 0
+    if (policy.streamIdleTimeoutMs !== undefined && (!Number.isFinite(policy.streamIdleTimeoutMs) || policy.streamIdleTimeoutMs <= 0 || policy.streamIdleTimeoutMs > 2147483647)) throw 0
+    if (policy.imageOffloadCountQuantum > (policy.maxRequestImages ?? 50)) throw 0
+    if (policy.defaultInput !== undefined && (!Array.isArray(policy.defaultInput) || !policy.defaultInput.length || policy.defaultInput.some((x) => !['text', 'image'].includes(x)))) throw 0
+    if (policy.headers !== undefined && (!object(policy.headers) || Object.values(policy.headers).some((x) => typeof x !== 'string'))) throw 0
+    if (policy.compat !== undefined && !object(policy.compat) || policy.thinkingBudgets !== undefined && (!object(policy.thinkingBudgets) || Object.values(policy.thinkingBudgets).some((x) => !Number.isSafeInteger(x) || x < 0))) throw 0
+    if (policy.cacheRetention !== undefined && !['none', 'short', 'long'].includes(policy.cacheRetention)) throw 0
+    if (policy.transport !== undefined && !['auto', 'sse', 'websocket', 'websocket-cached'].includes(policy.transport)) throw 0
+    if (policy.reasoning !== undefined && !['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'].includes(policy.reasoning)) throw 0
+    if (policy.displayName !== undefined && typeof policy.displayName !== 'string' || policy.api !== undefined && !PROTOCOLS.includes(policy.api)) throw 0
+    if (policy.retryPolicy !== undefined && (!object(policy.retryPolicy) || policy.retryPolicy.backoff !== undefined && !object(policy.retryPolicy.backoff) || policy.retryPolicy.retryableCodes !== undefined && !Array.isArray(policy.retryPolicy.retryableCodes))) throw 0
+    resolveRetryPolicy(policy.retryPolicy, 'CPA')
+    const checked = NativePiAiConfig['~standard'].validate({
+      providers: { 'cpa-policy-validation': { ...policy, api: protocolOf(policy), baseURL: 'https://policy.invalid/v1', models: [{ id: 'policy-validation' }] } },
+    })
+    if (!checked || typeof checked.then === 'function' || checked.issues) throw 0
+    const parsed = checked.value.providers.get()['cpa-policy-validation']
+    for (const [key, value] of Object.entries(policy.compat ?? {})) {
+      if (JSON.stringify(parsed.compat?.[key]) !== JSON.stringify(value)) throw 0
+    }
+  } catch { throw new ConnectionError('INVALID_POLICY', 'Invalid or unsupported public policy') }
+}

package/src/secrets.js

@@ -0,0 +1 @@
+export const credentialField = (name) => /^(?:(?:x[-_])?api[-_]?key|(?:[\w]+[-_])*authorization|cookie|set[-_]?cookie|password|secret|token|key|access[-_]?token|refresh[-_]?token|credential)$/i.test(name)

package/src/transport.js

@@ -0,0 +1,114 @@
+import { openAIResponsesApi } from '@earendil-works/pi-ai/api/openai-responses.lazy'
+import { openAICompletionsApi } from '@earendil-works/pi-ai/api/openai-completions.lazy'
+import { anthropicMessagesApi } from '@earendil-works/pi-ai/api/anthropic-messages.lazy'
+import { googleGenerativeAIApi } from '@earendil-works/pi-ai/api/google-generative-ai.lazy'
+import { PROTOCOLS } from './policy.js'
+
+const FACTORIES = {
+  'openai-responses': openAIResponsesApi,
+  'openai-completions': openAICompletionsApi,
+  'anthropic-messages': anthropicMessagesApi,
+  'google-generative-ai': googleGenerativeAIApi,
+}
+
+// Each wire protocol ends its SSE stream differently. The scanner only feeds the
+// diagnostics panel, so an unknown protocol degrades to "no terminal event seen"
+// instead of guessing.
+const TERMINALS = {
+  'openai-responses': (line) => {
+    const match = /^(?:event:\s*|data:\s*\{"type"\s*:\s*")(response\.(?:completed|failed|incomplete))/.exec(line)
+    return match ? match[1].replace('response.', 'sse-') : undefined
+  },
+  'openai-completions': (line) => {
+    if (/^data:\s*\[DONE\]/.test(line)) return 'sse-completed'
+    return /^data:\s*\{/.test(line) && /"error"\s*:/.test(line) ? 'sse-failed' : undefined
+  },
+  'anthropic-messages': (line) => {
+    const match = /^(?:event:\s*|data:\s*\{[^\n]*"type"\s*:\s*")(message_stop|error)/.exec(line)
+    if (!match) return undefined
+    return match[1] === 'error' ? 'sse-failed' : 'sse-completed'
+  },
+  'google-generative-ai': (line) => {
+    const match = /^(?:event:\s*|data:\s*\{[^\n]*"type"\s*:\s*")(result|error)/.exec(line)
+    if (!match) return undefined
+    return match[1] === 'error' ? 'sse-failed' : 'sse-completed'
+  },
+}
+
+export function resolveProtocol(protocol) {
+  return PROTOCOLS.includes(protocol) ? protocol : 'openai-responses'
+}
+
+export function terminalStage(protocol, line) {
+  return TERMINALS[resolveProtocol(protocol)](line)
+}
+
+export function createTransport(protocol, baseURL, diagnostics, fetchImpl = globalThis.fetch, keyless = false) {
+  const api = resolveProtocol(protocol)
+  const origin = new URL(baseURL).origin
+  const native = FACTORIES[api]()
+  const terminalOf = TERMINALS[api]
+  // Google streams carry no sentinel, so a clean flush is a completed stream.
+  const flushStage = api === 'google-generative-ai' ? 'sse-completed' : 'sse-incomplete'
+  const record = (entry) => {
+    diagnostics.push({ at: Date.now(), ...entry })
+    if (diagnostics.length > 50) diagnostics.splice(0, diagnostics.length - 50)
+  }
+  const scopedFetch = async (input, init = {}) => {
+    const url = input instanceof Request ? input.url : String(input)
+    if (new URL(url).origin !== origin) throw new Error('CPA request origin changed')
+    try {
+      const headers = new Headers(input instanceof Request ? input.headers : undefined)
+      if (init.headers) new Headers(init.headers).forEach((value, key) => headers.set(key, value))
+      if (keyless) headers.delete('authorization')
+      const response = await fetchImpl(input, { ...init, headers, redirect: 'error' })
+      const requestId = response.headers.get('x-request-id')
+      record({ stage: 'http', status: response.status, ...(/^[A-Za-z0-9._:-]{1,128}$/.test(requestId ?? '') ? { requestId } : {}) })
+      if (!response.body || !response.headers.get('content-type')?.toLowerCase().includes('text/event-stream')) return response
+      let pending = ''
+      let terminal = false
+      const signal = init.signal ?? (input instanceof Request ? input.signal : undefined)
+      const onAbort = () => { if (!terminal) { terminal = true; record({ stage: signal?.reason?.name === 'TimeoutError' ? 'timeout' : 'abort' }) } }
+      if (signal?.aborted) onAbort()
+      else signal?.addEventListener('abort', onAbort, { once: true })
+      const cleanup = () => signal?.removeEventListener('abort', onAbort)
+      const decoder = new TextDecoder()
+      const inspect = (text) => {
+        pending += text
+        const lines = pending.split(/\r?\n/)
+        pending = lines.pop().slice(-1024)
+        for (const line of lines) {
+          const stage = terminalOf(line)
+          if (stage && !terminal) { terminal = true; cleanup(); record({ stage }) }
+        }
+      }
+      const body = response.body.pipeThrough(new TransformStream({
+        transform(chunk, controller) { inspect(decoder.decode(chunk, { stream: true })); controller.enqueue(chunk) },
+        flush() { inspect(decoder.decode() + '\n'); cleanup(); if (!terminal) record({ stage: flushStage }) },
+      }))
+      return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers })
+    } catch (error) {
+      record({ stage: error?.name === 'TimeoutError' ? 'timeout' : error?.name === 'AbortError' ? 'abort' : 'before-http' })
+      throw error
+    }
+  }
+  const withPolicy = (options) => ({
+    ...options,
+    maxRetries: 0,
+    fetch: scopedFetch,
+    onPayload(payload, model) {
+      const applyPolicy = (value) => {
+        const updated = { ...value }
+        if (Array.isArray(value.tools)) updated.tools = value.tools.map((tool) => tool.type === 'function' ? { ...tool, strict: false } : tool)
+        record({ stage: 'payload', toolCount: Array.isArray(value.tools) ? value.tools.length : 0 })
+        return updated
+      }
+      const original = options?.onPayload?.(payload, model)
+      return original instanceof Promise ? original.then((value) => applyPolicy(value ?? payload)) : applyPolicy(original ?? payload)
+    },
+  })
+  return {
+    stream: (model, context, options) => native.stream(model, context, withPolicy(options)),
+    streamSimple: (model, context, options) => native.streamSimple(model, context, withPolicy(options)),
+  }
+}