@velum-labs/routekit-daemon 1.3.2 → 1.5.0

package/dist/eval-session-execution-store.js

@@ -0,0 +1,253 @@
+import { evalSessionExecutionEvidenceSchema } from "@velum-labs/routekit-control/protocol";
+import { HttpSubmissionError } from "@velum-labs/routekit-runtime/effect";
+import { writeFileAtomicEffect } from "@velum-labs/routekit-runtime/filesystem";
+import { acquireLifecycleLock } from "@velum-labs/routekit-runtime/service";
+import { Cause, Effect, FileSystem, Path } from "effect";
+import { z } from "zod";
+const MAX_DOCUMENT_BYTES = 32 * 1024 * 1024;
+const MAX_EXECUTIONS = 8192;
+const executionFile = /^[a-f0-9]{64}\.json$/u;
+function untouchedClosed(evidence) {
+    return (evidence.state === "sealed" &&
+        evidence.exposure === "closed" &&
+        !evidence.poisoned &&
+        evidence.ingresses.length === 0 &&
+        evidence.receipts.length === 0);
+}
+const storedExecutionSchema = z
+    .strictObject({
+    version: z.literal(1),
+    evidence: evalSessionExecutionEvidenceSchema,
+    readinessHistory: z.array(evalSessionExecutionEvidenceSchema).max(128),
+    readinessReopenAllowed: z.boolean()
+})
+    .superRefine((value, ctx) => {
+    const issuances = [...value.readinessHistory, value.evidence];
+    if ((value.readinessReopenAllowed && !untouchedClosed(value.evidence)) ||
+        value.readinessHistory.some((entry) => !untouchedClosed(entry) ||
+            entry.executionDigest !== value.evidence.executionDigest ||
+            entry.policy !== value.evidence.policy ||
+            entry.maximumProviderAttempts !== value.evidence.maximumProviderAttempts) ||
+        new Set(issuances.map((entry) => entry.sessionId)).size !== issuances.length ||
+        new Set(issuances.map((entry) => entry.grantId)).size !== issuances.length)
+        ctx.addIssue({
+            code: "custom",
+            message: "execution readiness issuance history is inconsistent"
+        });
+});
+function storeError(cause) {
+    return cause instanceof HttpSubmissionError
+        ? cause
+        : new HttpSubmissionError({
+            code: "execution-store",
+            message: "durable provider submission evidence could not be verified or persisted",
+            cause
+        });
+}
+/** Derive closure without ever converting a pending or unknown receipt to success. */
+export function normalizeExecutionEvidence(evidence) {
+    const pending = evidence.receipts.some((receipt) => receipt.state === "intent");
+    const unknown = evidence.poisoned || evidence.receipts.some((receipt) => receipt.state === "unknown");
+    return {
+        ...evidence,
+        state: evidence.state === "open" && !unknown ? "open" : pending ? "draining" : "sealed",
+        exposure: pending || unknown ? "unknown" : "closed"
+    };
+}
+/**
+ * Private payload-free authority store. Each operation reads current durable
+ * state under the existing process-identity lifecycle lock before an atomic
+ * replacement. A retiring worker therefore cannot overwrite a successor's
+ * revocation, recovered unknown receipt, or consumed execution identity.
+ *
+ * The lock is transaction-scoped, not another gateway/request resource owner.
+ * Atomic rename covers interruption and reported I/O faults, not power loss.
+ */
+export const makeEvalSessionExecutionStore = Effect.fn("EvalSessionExecutionStore.make")(function* (inputDirectory) {
+    const fs = yield* FileSystem.FileSystem;
+    const paths = yield* Path.Path;
+    const requested = paths.resolve(inputDirectory);
+    yield* fs
+        .makeDirectory(requested, { recursive: true, mode: 0o700 })
+        .pipe(Effect.mapError(storeError));
+    const parent = yield* fs.realPath(paths.dirname(requested)).pipe(Effect.mapError(storeError));
+    const directory = paths.join(parent, paths.basename(requested));
+    const canonical = yield* fs.realPath(directory).pipe(Effect.mapError(storeError));
+    const info = yield* fs.stat(directory).pipe(Effect.mapError(storeError));
+    if (canonical !== directory || info.type !== "Directory") {
+        return yield* Effect.fail(new HttpSubmissionError({
+            code: "execution-store",
+            message: "provider submission evidence requires a non-symlink private directory"
+        }));
+    }
+    yield* fs.chmod(directory, 0o700).pipe(Effect.mapError(storeError));
+    const lockPath = paths.join(directory, ".transaction.lock");
+    const parse = (value) => storedExecutionSchema.parse(value);
+    const filePath = (executionDigest) => {
+        if (!/^[a-f0-9]{64}$/u.test(executionDigest)) {
+            throw new HttpSubmissionError({
+                code: "execution-identity",
+                message: "provider submission execution digest is invalid"
+            });
+        }
+        return paths.join(directory, `${executionDigest}.json`);
+    };
+    const read = Effect.fnUntraced(function* (executionDigest) {
+        const path = yield* Effect.try({ try: () => filePath(executionDigest), catch: storeError });
+        const info = yield* fs.stat(path).pipe(Effect.catchIf((error) => error.reason._tag === "NotFound", () => Effect.succeed(undefined)), Effect.mapError(storeError));
+        if (info === undefined)
+            return undefined;
+        const canonical = yield* fs.realPath(path).pipe(Effect.mapError(storeError));
+        if (canonical !== path ||
+            info.type !== "File" ||
+            (info.mode & 0o077) !== 0 ||
+            info.size > BigInt(MAX_DOCUMENT_BYTES)) {
+            return yield* Effect.fail(new HttpSubmissionError({
+                code: "execution-store",
+                message: "provider submission evidence has unsafe storage metadata"
+            }));
+        }
+        const text = yield* fs.readFileString(path).pipe(Effect.mapError(storeError));
+        const value = yield* Effect.try({
+            try: () => {
+                if (Buffer.byteLength(text, "utf8") > MAX_DOCUMENT_BYTES) {
+                    throw new Error("provider submission evidence exceeds its bounded document size");
+                }
+                return parse(JSON.parse(text));
+            },
+            catch: storeError
+        });
+        if (value.evidence.executionDigest !== executionDigest) {
+            return yield* Effect.fail(new HttpSubmissionError({
+                code: "execution-store",
+                message: "provider submission evidence does not match its durable execution identity"
+            }));
+        }
+        return value;
+    });
+    const write = Effect.fnUntraced(function* (record) {
+        const value = yield* Effect.try({ try: () => parse(record), catch: storeError });
+        const text = JSON.stringify(value);
+        if (Buffer.byteLength(text, "utf8") > MAX_DOCUMENT_BYTES) {
+            return yield* Effect.fail(new HttpSubmissionError({
+                code: "execution-store",
+                message: "provider submission evidence exceeds its bounded document size"
+            }));
+        }
+        yield* writeFileAtomicEffect(filePath(value.evidence.executionDigest), `${text}\n`, {
+            mode: 0o600
+        }).pipe(Effect.provideService(FileSystem.FileSystem, fs), Effect.provideService(Path.Path, paths), Effect.mapError(storeError));
+        return value;
+    });
+    const transaction = (operation) => Effect.scoped(Effect.gen(function* () {
+        // No interrupt can strand a just-acquired native lock before its
+        // Effect finalizer is installed, or expose a partially settled write.
+        yield* Effect.acquireRelease(Effect.tryPromise({
+            try: () => acquireLifecycleLock(lockPath, { timeoutMs: 5_000, pollMs: 10 }),
+            catch: storeError
+        }), (lock) => Effect.try({ try: () => lock.release(), catch: storeError }).pipe(Effect.orDie));
+        return yield* operation;
+    })).pipe(Effect.uninterruptible, Effect.catchCause((cause) => Effect.fail(storeError(Cause.squash(cause)))));
+    const store = {
+        directory,
+        create: (evidence) => transaction(Effect.gen(function* () {
+            const previous = yield* read(evidence.executionDigest);
+            if (previous !== undefined &&
+                (!previous.readinessReopenAllowed ||
+                    !untouchedClosed(previous.evidence) ||
+                    previous.evidence.policy !== evidence.policy ||
+                    previous.evidence.maximumProviderAttempts !== evidence.maximumProviderAttempts)) {
+                return yield* Effect.fail(new HttpSubmissionError({
+                    code: "execution-consumed",
+                    message: "provider submission execution identity has already been granted"
+                }));
+            }
+            const files = yield* fs.readDirectory(directory).pipe(Effect.mapError(storeError));
+            if (previous === undefined &&
+                files.filter((file) => file.endsWith(".json")).length >= MAX_EXECUTIONS) {
+                return yield* Effect.fail(new HttpSubmissionError({
+                    code: "execution-store",
+                    message: "provider submission store has reached its bounded execution capacity"
+                }));
+            }
+            const saved = yield* write({
+                version: 1,
+                evidence: evalSessionExecutionEvidenceSchema.parse(evidence),
+                readinessHistory: previous === undefined ? [] : [...previous.readinessHistory, previous.evidence],
+                readinessReopenAllowed: false
+            });
+            return saved.evidence;
+        })),
+        read: (executionDigest, sessionId) => transaction(Effect.map(read(executionDigest), (record) => sessionId === undefined || record?.evidence.sessionId === sessionId
+            ? record?.evidence
+            : record?.readinessHistory.find((entry) => entry.sessionId === sessionId))),
+        update: (executionDigest, update, options) => transaction(Effect.gen(function* () {
+            const record = yield* read(executionDigest);
+            if (record === undefined) {
+                return yield* Effect.fail(new HttpSubmissionError({
+                    code: "execution-store",
+                    message: "previously granted provider submission evidence is missing"
+                }));
+            }
+            const current = record.evidence;
+            const next = yield* Effect.try({ try: () => update(current), catch: storeError });
+            if (next.executionDigest !== current.executionDigest ||
+                next.sessionId !== current.sessionId ||
+                next.grantId !== current.grantId ||
+                next.issuerIdentity !== current.issuerIdentity ||
+                next.maximumProviderAttempts !== current.maximumProviderAttempts ||
+                next.policy !== current.policy) {
+                return yield* Effect.fail(new HttpSubmissionError({
+                    code: "execution-store",
+                    message: "provider submission grant identity cannot change during a transaction"
+                }));
+            }
+            const saved = yield* write({
+                ...record,
+                evidence: evalSessionExecutionEvidenceSchema.parse(next),
+                readinessReopenAllowed: options?.allowReadinessReopen === true && untouchedClosed(next)
+            });
+            return saved.evidence;
+        })),
+        recover: (now) => transaction(Effect.gen(function* () {
+            const files = yield* fs.readDirectory(directory).pipe(Effect.mapError(storeError));
+            const records = files.filter((file) => file.endsWith(".json"));
+            if (records.length > MAX_EXECUTIONS ||
+                records.some((file) => !executionFile.test(file))) {
+                return yield* Effect.fail(new HttpSubmissionError({
+                    code: "execution-store",
+                    message: "provider submission store has invalid or excessive execution records"
+                }));
+            }
+            return yield* Effect.forEach(records, (file) => Effect.gen(function* () {
+                const previous = yield* read(file.slice(0, -".json".length));
+                if (previous === undefined) {
+                    return yield* Effect.fail(new HttpSubmissionError({
+                        code: "execution-store",
+                        message: "provider submission evidence disappeared during recovery"
+                    }));
+                }
+                if (previous.evidence.state === "sealed")
+                    return previous.evidence;
+                const recovered = yield* write({
+                    ...previous,
+                    readinessReopenAllowed: false,
+                    evidence: normalizeExecutionEvidence({
+                        ...previous.evidence,
+                        state: "draining",
+                        receipts: previous.evidence.receipts.map((receipt) => receipt.state === "intent"
+                            ? {
+                                ...receipt,
+                                state: "unknown",
+                                settledAt: now,
+                                outcome: { state: "unknown", reason: "daemon-restart" }
+                            }
+                            : receipt)
+                    })
+                });
+                return recovered.evidence;
+            }));
+        }))
+    };
+    return store;
+});

package/dist/host-protocol.d.ts

@@ -22,6 +22,7 @@ export type WorkerReady = WorkerSnapshot & {
     workerProcessIdentity?: string;
     workerStartedAt: string;
     packageVersion: string;
+    sourceBuildId?: string;
     controlUrl: string;
     controlPort: number;
     dataUrl: string;

package/dist/host.js

@@ -128,6 +128,9 @@ function daemonHostLive(options) {
                 port: controlPort,
                 startedAt: hostStartedAt,
                 version: ready.packageVersion,
+                ...(ready.sourceBuildId === undefined
+                    ? {}
+                    : { sourceBuildId: ready.sourceBuildId }),
                 protocolVersion: CONTROL_PROTOCOL_VERSION,
                 controlToken,
                 dataUrl,

package/dist/internal-providers/provider-anthropic/index.d.ts

@@ -0,0 +1,23 @@
+import { ApiProviderSource } from "@velum-labs/routekit-provider-core";
+import { Effect } from "effect";
+export declare const anthropic: {
+    readonly id: "anthropic";
+    readonly protocol: "anthropic";
+    readonly accountClass: "api-key";
+    readonly billingMode: "metered-api";
+    readonly connection: Readonly<{
+        validate?: (context: Readonly<{
+            sourceId: string;
+            config: import("@velum-labs/routekit-config-core").SourceConfig;
+            env: Readonly<Record<string, string | undefined>>;
+            resources?: Readonly<Record<string, unknown>>;
+        }>) => Effect.Effect<void, Error, import("@velum-labs/routekit-runtime/effect").RouteKitPlatform>;
+        credentialValidation?: "registry-key-probe" | "registry-key-probe-if-configured-models";
+        manifest: import("@velum-labs/routekit-provider-core").ProviderConnectionManifest;
+        prepare?: (input: import("@velum-labs/routekit-provider-core").PrepareProviderConnectionInput) => import("@velum-labs/routekit-provider-core").PreparedProviderConnection;
+        enrollment?: Readonly<Record<string, import("@velum-labs/routekit-provider-core").ProviderEnrollmentAdapter>>;
+        credentials?: import("@velum-labs/routekit-provider-core").ProviderCredentialAdapter;
+        subscriptionMode?: import("@velum-labs/routekit-registry").SubscriptionMode;
+    }>;
+    readonly createSource: (context: import("@velum-labs/routekit-provider-core").ProviderModuleContext) => Effect.Effect<ApiProviderSource, never, never>;
+};

package/dist/internal-providers/provider-anthropic/index.js

@@ -0,0 +1,42 @@
+import { ApiProviderSource, connectionString, connectionStringList, defineProviderConnection, defineProvider, optionalConnectionString, preparedProviderConnection, providerSourceTransportFromContext, routeTextToolModelMetadata } from "@velum-labs/routekit-provider-core";
+import { Effect } from "effect";
+function anthropicMessagesModelMetadata(model) {
+    return /(?:^|\/)claude(?:[-.]|$)/iu.test(model)
+        ? routeTextToolModelMetadata({ inputModalities: ["text", "image"] })
+        : undefined;
+}
+export const anthropic = defineProvider({
+    id: "anthropic",
+    protocol: "anthropic",
+    accountClass: "api-key",
+    billingMode: "metered-api",
+    connection: defineProviderConnection({
+        manifest: {
+            version: 1, id: "anthropic", displayName: "Anthropic API", category: "api",
+            description: "Connect an Anthropic Console API key.",
+            methods: [{ id: "api-key", kind: "form", label: "API key", schemaRevision: 1, fields: [
+                        { id: "api-key", label: "API key", control: "secret", required: true, placeholder: "sk-ant-…" },
+                        { id: "base-url", label: "Base URL", control: "url", required: false, advanced: true, placeholder: "https://api.anthropic.com", description: "With explicit models, custom endpoints must support authenticated GET /v1/models for key validation." },
+                        { id: "models", label: "Models", control: "string-list", required: false, advanced: true, description: "Optional comma- or line-separated IDs. Explicit models require read-only model-list access to validate the key." }
+                    ] }]
+        },
+        prepare: ({ values }) => {
+            const env = "ROUTEKIT_CLOUD_GRANT_ANTHROPIC_KEY";
+            const baseUrl = optionalConnectionString(values, "base-url");
+            const models = connectionStringList(values, "models");
+            return preparedProviderConnection({
+                config: { use: "anthropic", auth: { kind: "env-header", env, header: "x-api-key" }, ...(baseUrl === undefined ? {} : { baseUrl }), ...(models === undefined ? {} : { options: { models } }) },
+                environment: { [env]: connectionString(values, "api-key") }
+            });
+        },
+        credentialValidation: "registry-key-probe-if-configured-models"
+    }),
+    createSource: (context) => Effect.sync(() => new ApiProviderSource({
+        provider: "anthropic",
+        sourceId: context.sourceId,
+        config: context.config,
+        env: context.env,
+        transport: providerSourceTransportFromContext(context),
+        metadataForModel: anthropicMessagesModelMetadata
+    }))
+});

package/dist/internal-providers/provider-anthropic/test/provider.test.js

@@ -0,0 +1,33 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { Effect } from "effect";
+import { anthropic } from "../index.js";
+test("configured Anthropic catalogs qualify Claude routes and fail closed otherwise", async () => {
+    const prepared = anthropic.connection.prepare({
+        sourceId: "anthropic-production",
+        methodId: "api-key",
+        values: { "api-key": "anthropic-secret" }
+    });
+    const source = await Effect.runPromise(anthropic.createSource({
+        sourceId: "anthropic-production",
+        config: {
+            ...prepared.config,
+            options: {
+                models: ["claude-sonnet-4-6", "text-embedding-unknown", "future-anthropic-model"]
+            }
+        },
+        env: prepared.environment
+    }));
+    const [claude, embedding, unknown] = await Effect.runPromise(source.discovery.discoverModels());
+    assert.deepEqual(claude?.metadata, {
+        architecture: {
+            modality: "text+image->text",
+            inputModalities: ["text", "image"],
+            outputModalities: ["text"]
+        },
+        supportedParameters: ["tools", "tool_choice"],
+        provenance: "route"
+    });
+    assert.equal(embedding?.metadata, undefined);
+    assert.equal(unknown?.metadata, undefined);
+});

package/dist/internal-providers/provider-azure/index.d.ts

@@ -0,0 +1,25 @@
+import type { SourceConfig } from "@velum-labs/routekit-config-core";
+import type { ProviderSource, ProviderTransport } from "@velum-labs/routekit-provider-core";
+import { Effect } from "effect";
+export declare function createAzureSource(sourceId: string, config: SourceConfig, env: Readonly<Record<string, string | undefined>>, transport?: ProviderTransport): ProviderSource;
+export declare const azure: {
+    readonly id: "openai-azure";
+    readonly protocol: "openai";
+    readonly accountClass: "api-key";
+    readonly billingMode: "metered-api";
+    readonly connection: Readonly<{
+        validate?: (context: Readonly<{
+            sourceId: string;
+            config: SourceConfig;
+            env: Readonly<Record<string, string | undefined>>;
+            resources?: Readonly<Record<string, unknown>>;
+        }>) => Effect.Effect<void, Error, import("@velum-labs/routekit-runtime/effect").RouteKitPlatform>;
+        credentialValidation?: "registry-key-probe" | "registry-key-probe-if-configured-models";
+        manifest: import("@velum-labs/routekit-provider-core").ProviderConnectionManifest;
+        prepare?: (input: import("@velum-labs/routekit-provider-core").PrepareProviderConnectionInput) => import("@velum-labs/routekit-provider-core").PreparedProviderConnection;
+        enrollment?: Readonly<Record<string, import("@velum-labs/routekit-provider-core").ProviderEnrollmentAdapter>>;
+        credentials?: import("@velum-labs/routekit-provider-core").ProviderCredentialAdapter;
+        subscriptionMode?: import("@velum-labs/routekit-registry").SubscriptionMode;
+    }>;
+    readonly createSource: (context: import("@velum-labs/routekit-provider-core").ProviderModuleContext) => Effect.Effect<ProviderSource, never, never>;
+};

package/dist/internal-providers/provider-azure/index.js

@@ -0,0 +1,101 @@
+import { connectionString, connectionStringList, defineProviderConnection, defineProvider, OpenAiBackend, preparedProviderConnection, providerSourceTransportFromContext } from "@velum-labs/routekit-provider-core";
+import { Effect } from "effect";
+function requiredString(config, key) {
+    const value = config.options?.[key];
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`openai-azure requires options.${key}`);
+    }
+    return value;
+}
+function models(config) {
+    const configured = config.options?.models;
+    if (Array.isArray(configured) && configured.every((entry) => typeof entry === "string")) {
+        return configured.map((id) => ({ id }));
+    }
+    const id = requiredString(config, "deployment");
+    return [{ id }];
+}
+function apiKey(config, env) {
+    if (config.auth?.kind !== "env-header") {
+        throw new Error("openai-azure requires auth.kind env-header with header api-key");
+    }
+    if (config.auth.header.toLowerCase() !== "api-key") {
+        throw new Error("openai-azure authentication header must be api-key");
+    }
+    const value = env[config.auth.env];
+    if (value === undefined || value.length === 0)
+        throw new Error(`missing ${config.auth.env}`);
+    return value;
+}
+export function createAzureSource(sourceId, config, env, transport) {
+    if (config.baseUrl === undefined)
+        throw new Error("openai-azure requires baseUrl");
+    const deployment = requiredString(config, "deployment");
+    const backend = new OpenAiBackend({
+        baseUrl: `${config.baseUrl.replace(/\/$/, "")}/openai/deployments/${encodeURIComponent(deployment)}`,
+        apiKey: "",
+        bearerAuth: false,
+        headers: { "api-key": apiKey(config, env) },
+        query: { "api-version": requiredString(config, "apiVersion") },
+        transport
+    });
+    const nativeResponses = backend.ports.responses;
+    if (nativeResponses.kind !== "responses") {
+        throw new Error("OpenAI backend does not expose its native Responses port");
+    }
+    return {
+        sourceId,
+        discovery: { discoverModels: () => Effect.succeed(models(config)) },
+        requests: {
+            chat: (body, signal, options) => backend.chat(body, signal, options),
+            embeddings: (body, signal, options) => backend.embeddings(body, signal, options)
+        },
+        responses: {
+            kind: "responses",
+            supports: (model) => nativeResponses.supports(model),
+            execute: (body, signal, options) => nativeResponses.execute(body, signal, options)
+        },
+        capabilities: {
+            forModel: () => ({}),
+            reasoningForModel: () => undefined
+        },
+        resource: { kind: "borrowed" }
+    };
+}
+export const azure = defineProvider({
+    id: "openai-azure",
+    protocol: "openai",
+    accountClass: "api-key",
+    billingMode: "metered-api",
+    connection: defineProviderConnection({
+        manifest: {
+            version: 1, id: "openai-azure", displayName: "Azure OpenAI", category: "cloud",
+            description: "Connect an Azure OpenAI deployment with an API key.",
+            methods: [{ id: "api-key", kind: "form", label: "API key", schemaRevision: 1, fields: [
+                        { id: "api-key", label: "API key", control: "secret", required: true },
+                        { id: "base-url", label: "Endpoint", control: "url", required: true, placeholder: "https://example.openai.azure.com" },
+                        { id: "deployment", label: "Deployment", control: "text", required: true },
+                        { id: "api-version", label: "API version", control: "text", required: true, defaultValue: "2024-10-21" },
+                        { id: "models", label: "Models", control: "string-list", required: false, advanced: true, description: "Optional model IDs. The deployment name is used when empty." }
+                    ] }]
+        },
+        prepare: ({ values }) => {
+            const env = "ROUTEKIT_CLOUD_GRANT_AZURE_KEY";
+            const models = connectionStringList(values, "models");
+            return preparedProviderConnection({
+                config: {
+                    use: "openai-azure",
+                    auth: { kind: "env-header", env, header: "api-key" },
+                    baseUrl: connectionString(values, "base-url"),
+                    options: {
+                        deployment: connectionString(values, "deployment"),
+                        apiVersion: connectionString(values, "api-version"),
+                        ...(models === undefined ? {} : { models })
+                    }
+                },
+                environment: { [env]: connectionString(values, "api-key") }
+            });
+        }
+    }),
+    createSource: (context) => Effect.sync(() => createAzureSource(context.sourceId, context.config, context.env, providerSourceTransportFromContext(context)))
+});

package/dist/internal-providers/provider-azure/test/provider.test.js

@@ -0,0 +1,83 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { runRouteKitEffect } from "@velum-labs/routekit-runtime/effect";
+import { createAzureSource } from "../index.js";
+test("Azure sources use deployment URLs, api-version queries, and api-key auth", async () => {
+    const originalFetch = globalThis.fetch;
+    let request;
+    globalThis.fetch = async (input, init) => {
+        request = new Request(input, init);
+        return Response.json({
+            id: "chatcmpl-azure",
+            choices: [{ message: { role: "assistant", content: "azure" } }]
+        });
+    };
+    try {
+        const config = {
+            use: "openai-azure",
+            baseUrl: "https://example-resource.openai.azure.com/",
+            auth: { kind: "env-header", env: "AZURE_OPENAI_API_KEY", header: "api-key" },
+            options: {
+                deployment: "gpt-5 east",
+                apiVersion: "2026-08-01-preview",
+                models: ["gpt-5"]
+            }
+        };
+        const source = createAzureSource("azure-east", config, {
+            AZURE_OPENAI_API_KEY: "azure-secret"
+        });
+        const response = await runRouteKitEffect(source.requests.chat({
+            model: "gpt-5",
+            messages: [{ role: "user", content: "hello" }]
+        }));
+        assert.equal(source.sourceId, "azure-east");
+        assert.equal(response.status, 200);
+        assert.equal(request?.url, "https://example-resource.openai.azure.com/openai/deployments/gpt-5%20east/chat/completions?api-version=2026-08-01-preview");
+        assert.equal(request?.headers.get("api-key"), "azure-secret");
+        assert.equal(request?.headers.get("authorization"), null);
+        assert.deepEqual(await runRouteKitEffect(source.discovery.discoverModels()), [{ id: "gpt-5" }]);
+    }
+    finally {
+        globalThis.fetch = originalFetch;
+    }
+});
+test("Azure sources expose native Responses without guessing deployment capabilities", async () => {
+    const originalFetch = globalThis.fetch;
+    let request;
+    globalThis.fetch = async (input, init) => {
+        request = new Request(input, init);
+        return Response.json({
+            id: "resp_azure",
+            object: "response",
+            output: [],
+            status: "completed"
+        });
+    };
+    try {
+        const source = createAzureSource("azure-east", {
+            use: "openai-azure",
+            baseUrl: "https://example-resource.openai.azure.com/",
+            auth: { kind: "env-header", env: "AZURE_OPENAI_API_KEY", header: "api-key" },
+            options: {
+                deployment: "gpt-5 east",
+                apiVersion: "2026-08-01-preview",
+                models: ["gpt-5.6-sol"]
+            }
+        }, { AZURE_OPENAI_API_KEY: "azure-secret" });
+        assert.equal(source.responses.kind, "responses");
+        if (source.responses.kind !== "responses")
+            return;
+        const response = await runRouteKitEffect(source.responses.execute({ model: "gpt-5.6-sol", input: "hello" }));
+        assert.equal(response.status, 200);
+        assert.equal(request?.url, "https://example-resource.openai.azure.com/openai/deployments/gpt-5%20east/responses?api-version=2026-08-01-preview");
+        assert.equal(request?.headers.get("api-key"), "azure-secret");
+        assert.equal(request?.headers.get("authorization"), null);
+        assert.equal(source.capabilities.reasoningForModel("gpt-5.6-sol"), undefined);
+        assert.deepEqual(await runRouteKitEffect(source.discovery.discoverModels()), [
+            { id: "gpt-5.6-sol" }
+        ]);
+    }
+    finally {
+        globalThis.fetch = originalFetch;
+    }
+});

package/dist/internal-providers/provider-bedrock/codec.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Bedrock Converse codec. Pure request/response translation between OpenAI
+ * Chat Completions JSON and Amazon Bedrock Converse, including streaming SSE.
+ * Model discovery and transport live in `bedrock-source.ts`.
+ */
+import type { ConverseCommandInput, ConverseCommandOutput, ConverseStreamOutput } from "@aws-sdk/client-bedrock-runtime";
+export declare function isOpusFiveModel(modelId: string): boolean;
+export declare function toBedrockConverseInput(body: unknown): ConverseCommandInput;
+export declare function fromBedrockConverseOutput(output: ConverseCommandOutput, model: string): Record<string, unknown>;
+export declare function streamResponse(stream: AsyncIterable<ConverseStreamOutput>, model: string, signal?: AbortSignal): Response;
+export declare function errorResponse(error: unknown): Response;