env.ts

// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.

import { deleteUndefinedValues, isAzureOpenAIV1Base, normalizeFloat, trimTrailingSlash } from "./cleaners.js";
import {
  ANTHROPIC_API_BASE,
  GITHUB_MODELS_BASE,
  LITELLM_API_BASE,
  LLAMAFILE_API_BASE,
  LOCALAI_API_BASE,
  MODEL_PROVIDER_ANTHROPIC,
  MODEL_PROVIDER_AZURE_OPENAI,
  MODEL_PROVIDER_AZURE_SERVERLESS_MODELS,
  MODEL_PROVIDER_GITHUB_COPILOT_CHAT,
  MODEL_PROVIDER_GITHUB,
  MODEL_PROVIDER_LITELLM,
  MODEL_PROVIDER_LLAMAFILE,
  MODEL_PROVIDER_OLLAMA,
  MODEL_PROVIDER_OPENAI,
  OPENAI_API_BASE,
  PLACEHOLDER_API_BASE,
  PLACEHOLDER_API_KEY,
  MODEL_PROVIDER_AZURE_SERVERLESS_OPENAI,
  MODEL_PROVIDER_HUGGINGFACE,
  HUGGINGFACE_API_BASE,
  OLLAMA_API_BASE,
  OLLAMA_DEFAULT_PORT,
  MODEL_PROVIDER_GOOGLE,
  GOOGLE_API_BASE,
  MODEL_PROVIDER_ALIBABA,
  ALIBABA_BASE,
  MODEL_PROVIDER_MISTRAL,
  MISTRAL_API_BASE,
  MODEL_PROVIDER_LMSTUDIO,
  LMSTUDIO_API_BASE,
  MODEL_PROVIDER_JAN,
  JAN_API_BASE,
  MODEL_PROVIDER_ANTHROPIC_BEDROCK,
  MODEL_PROVIDER_DEEPSEEK,
  DEEPSEEK_API_BASE,
  MODEL_PROVIDER_WHISPERASR,
  WHISPERASR_API_BASE,
  MODEL_PROVIDER_ECHO,
  MODEL_PROVIDER_NONE,
  MODEL_PROVIDER_AZURE_AI_INFERENCE,
  MODEL_PROVIDER_WINDOWS_AI,
  WINDOWS_AI_API_BASE,
  MODEL_PROVIDER_SGLANG,
  SGLANG_API_BASE,
  MODEL_PROVIDER_VLLM,
  VLLM_API_BASE,
  GITHUB_TOKENS,
  MODEL_PROVIDER_DOCKER_MODEL_RUNNER,
  DOCKER_MODEL_RUNNER_API_BASE,
  MODEL_PROVIDER_MCP,
  DEFAULT_ALLOWED_DOMAINS,
} from "./constants.js";
import { resolveRuntimeHost } from "./host.js";
import { parseModelIdentifier } from "./models.js";
import type {
  AzureCredentialsType,
  LanguageModelConfiguration,
  OpenAIAPIType,
} from "./server/messages.js";
import { arrayify } from "./cleaners.js";
import { URL } from "node:url";
import { uriTryParse } from "./url.js";
import type { TraceOptions } from "./trace.js";
import type { CancellationOptions } from "./cancellation.js";
import { genaiscriptDebug } from "./debug.js";
import { YAMLTryParse } from "./yaml.js";
import { JSON5TryParse } from "./json5.js";
import type { PromptArgs, PromptScript } from "./types.js";
const dbg = genaiscriptDebug("config:env");

/**
 * Parses the OLLAMA host environment variable and returns a standardized URL.
 *
 * @param env - The environment variables object to extract OLLAMA-related settings.
 * @returns The resolved OLLAMA host URL.
 *
 * The function prioritizes the following environment variables to determine the host:
 * - OLLAMA_HOST
 * - OLLAMA_API_BASE
 * - Fallback to the constant OLLAMA_API_BASE.
 *
 * If the resolved value matches an IP address or "localhost" with an optional port,
 * it constructs a URL with the default port if not provided. Otherwise, it validates
 * and returns a complete URL. Throws an error if the URL is invalid.
 */
export function ollamaParseHostVariable(env: Record<string, string>) {
  dbg(`ollamaParseHostVariable called with env: ${JSON.stringify(env)}`);
  const s = (env.OLLAMA_HOST || env.OLLAMA_API_BASE || OLLAMA_API_BASE)?.trim();
  const ipm = /^(?<address>(localhost|\d+\.\d+\.\d+\.\d+))(:(?<port>\d+))?$/i.exec(s);
  if (ipm) {
    return `http://${ipm.groups.address}:${ipm.groups.port || OLLAMA_DEFAULT_PORT}`;
  }
  const url = new URL(s);
  return url.href;
}

/**
 * Finds an environment variable based on provided prefixes and names.
 *
 * @param env - The environment variables as key-value pairs.
 * @param prefixes - A string or array of strings representing the possible prefixes for the variable name.
 * @param names - An array of variable names to match against the prefixes.
 * @returns An object containing the matched variable name and its value, or undefined if no match is found.
 */
export function findEnvVar(
  env: Record<string, string>,
  prefixes: string | string[],
  names: string[],
): { name: string; value: string } {
  for (const prefix of arrayify(prefixes)) {
    for (const name of names) {
      const pname = prefix + name;
      const value = env[pname] || env[pname.toLowerCase()] || env[pname.toUpperCase()];
      if (value !== undefined) {
        return { name: pname, value };
      }
    }
  }
  return undefined;
}

/**
 * Parses default script metadata from GENAISCRIPT_DEFAULT_SCRIPT_META environment variable.
 * The environment variable should contain a JSON payload of PromptScript metadata.
 * This metadata gets merged last into the main script metadata object.
 *
 * @param env - The environment variables as key-value pairs.
 * @returns A PromptArgs object containing the parsed metadata, or undefined if no valid metadata found.
 */
export function parseDefaultMetaFromEnv(env: Record<string, string>): Partial<PromptArgs> | undefined {
  const envValue = env.GENAISCRIPT_DEFAULT_SCRIPT_META;
  if (!envValue) {
    dbg("GENAISCRIPT_DEFAULT_SCRIPT_META not found in environment variables");
    return undefined;
  }

  dbg(`found GENAISCRIPT_DEFAULT_SCRIPT_META: ${envValue}`);
  
  try {
    const parsed = JSON5TryParse(envValue);
    if (!parsed || typeof parsed !== "object") {
      dbg("GENAISCRIPT_DEFAULT_SCRIPT_META could not be parsed as valid JSON object");
      return undefined;
    }

    dbg(`parsed GENAISCRIPT_DEFAULT_SCRIPT_META: %O`, parsed);
    
    // Filter to only include valid PromptArgs fields (exclude text, id, jsSource, defTools, resolvedSystem)
    const excludedFields = new Set(['text', 'id', 'jsSource', 'defTools', 'resolvedSystem']);
    const filtered: Partial<PromptArgs> = {};
    
    for (const [key, value] of Object.entries(parsed)) {
      if (!excludedFields.has(key)) {
        (filtered as any)[key] = value;
      }
    }
    
    dbg(`filtered GENAISCRIPT_DEFAULT_SCRIPT_META: %O`, filtered);
    return filtered;
  } catch (error) {
    dbg(`failed to parse GENAISCRIPT_DEFAULT_SCRIPT_META: ${error}`);
    return undefined;
  }
}

/**
 * Parses default configuration values from the provided environment variables.
 *
 * This function extracts default model configurations and temperature settings
 * based on environment variable values and sets them as runtime model aliases.
 * Legacy and new configurations are supported.
 *
 * @param env - An object representing environment variables with keys and values.
 *   - GENAISCRIPT_DEFAULT_MODEL: Specifies the default model for the "large" alias.
 *   - GENAISCRIPT_DEFAULT_TEMPERATURE: Sets the default temperature for the model, if defined.
 *   - GENAISCRIPT_DEFAULT_[ID]_MODEL or GENAISCRIPT_MODEL_[ID]: Configures aliases for specific model IDs.
 */
export async function parseDefaultsFromEnv(env: Record<string, string>) {
  const runtimeHost = resolveRuntimeHost();
  dbg(`parsing process.env`);
  // legacy
  if (env.GENAISCRIPT_DEFAULT_MODEL) {
    dbg(`found GENAISCRIPT_DEFAULT_MODEL: ${env.GENAISCRIPT_DEFAULT_MODEL}`);
    runtimeHost.setModelAlias("env", "large", env.GENAISCRIPT_DEFAULT_MODEL);
  }
  // action
  if (env.INPUT_MODEL) {
    dbg(`found INPUT_MODEL = ${env.INPUT_MODEL}`);
    runtimeHost.setModelAlias("env", "large", env.INPUT_MODEL);
  }

  const rx = /^(GENAISCRIPT(_DEFAULT)?|INPUT)_MODEL_(?<id>[A-Z0-9_-]+)$/i;
  const entries = Object.entries(env);
  dbg(`envs: %O`, Object.keys(env));
  for (const kv of entries) {
    const [k, v] = kv;
    const m = rx.exec(k);
    if (!m) {
      continue;
    }
    const id = m.groups.id.toLowerCase();
    dbg(`found %s -> %s = %s`, k, id, v);
    if (id === "alias") {
      // special handling for alias, try to parse as YAML, INI
      const aliases = YAMLTryParse(v.trim());
      dbg(`parsed aliases: ${JSON.stringify(aliases)}`);
      if (aliases && typeof aliases === "object") {
        for (const [alias, model] of Object.entries(aliases)) {
          if (typeof model === "string") runtimeHost.setModelAlias("env", alias, model);
        }
      }
    } else runtimeHost.setModelAlias("env", id, v);
  }

  const t = normalizeFloat(env.GENAISCRIPT_DEFAULT_TEMPERATURE);
  if (!isNaN(t)) {
    dbg(`parsed GENAISCRIPT_DEFAULT_TEMPERATURE = ${t}`);
    runtimeHost.setModelAlias("env", "large", { temperature: t });
  }
}

function parseModelApiVersion(provider: string, model: string): string | undefined {
  const name = `GENAISCRIPT_API_VERSION_${provider.toUpperCase()}_${model.toUpperCase()}`;
  const inputName = `INPUT_API_VERSION_${provider.toUpperCase()}_${model.toUpperCase()}`;
  return process.env[name] ?? process.env[inputName];
}

/**
 * Parses the environment variables to retrieve the necessary token, base URL, and configuration details
 * for a specified model identifier based on its provider.
 *
 * @param env - A record of environment variables, serving as the source for token and API configuration.
 * @param modelId - The identifier of the model for which the token and configuration details are to be parsed.
 * @param options - Additional options for tracing, cancellation, and token resolution.
 *
 * @returns A promise that resolves to a configuration object containing the provider, model, token, base URL,
 *          type, version, and source, or undefined if no matching configuration is found.
 *
 * Notes:
 * - Handles several model providers, including OpenAI, Azure OpenAI, Azure Serverless OpenAI, Azure AI Inference, Azure Serverless Models, Anthropic, Google, HuggingFace, and more.
 * - Throws errors if mandatory variables like API keys or bases are not configured.
 * - Includes validation checks for URL formats and supported provider types.
 */
export async function parseTokenFromEnv(
  env: Record<string, string>,
  modelId: string,
  options: TraceOptions & CancellationOptions & { resolveToken?: boolean },
): Promise<LanguageModelConfiguration> {
  const { resolveToken } = options || {};
  const runtimeHost = resolveRuntimeHost();
  const { provider, model, tag } = parseModelIdentifier(
    modelId ?? runtimeHost.modelAliases.large.model,
  );
  dbg(`parsing token for '%s:%s:%s'`, provider, model, tag || "");
  const TOKEN_SUFFIX = ["_API_KEY", "_API_TOKEN", "_TOKEN", "_KEY"];
  const BASE_SUFFIX = ["_API_BASE", "_API_ENDPOINT", "_BASE", "_ENDPOINT"];

  if (provider === MODEL_PROVIDER_OPENAI) {
    dbg(`processing ${MODEL_PROVIDER_OPENAI}`);
    const token = env.OPENAI_API_KEY ?? "";
    let base = env.OPENAI_API_BASE;
    const type = (env.OPENAI_API_TYPE as OpenAIAPIType) || "openai";
    const version =
      parseModelApiVersion(provider, model) ||
      env.OPENAI_API_VERSION ||
      parseAzureVersionFromUrl(base);
    if (
      type !== "azure" &&
      type !== "openai" &&
      type !== "localai" &&
      type !== "azure_serverless" &&
      type !== "azure_serverless_models" &&
      type !== "responses"
    ) {
      throw new Error(
        "OPENAI_API_TYPE must be 'azure', 'azure_serverless', 'azure_serverless_models', 'openai', 'localai', or 'responses'",
      );
    }
    if (type === "openai" && !base) {
      dbg(`setting default base for OPENAI_API_TYPE openai`);
      base = OPENAI_API_BASE;
    }
    if (type === "responses" && !base) {
      dbg(`setting default base for OPENAI_API_TYPE responses`);
      base = OPENAI_API_BASE;
    }
    if (type === "localai" && !base) {
      base = LOCALAI_API_BASE;
    }
    if ((type === "azure" || type === "azure_serverless") && !base) {
      throw new Error("OPENAI_API_BASE must be set when type is 'azure'");
    }
    if (type === "azure") {
      base = cleanAzureBase(base);
    }
    if (!token && !/^http:\/\//i.test(base)) {
      // localhost typically requires no key
      throw new Error("OPENAI_API_KEY missing");
    }
    if (token === PLACEHOLDER_API_KEY) {
      throw new Error("OPENAI_API_KEY not configured");
    }
    if (base === PLACEHOLDER_API_BASE) {
      throw new Error("OPENAI_API_BASE not configured");
    }
    if (base && !URL.canParse(base)) {
      throw new Error("OPENAI_API_BASE must be a valid URL");
    }
    return {
      provider,
      model,
      modelId,
      base,
      type,
      token,
      source: "env: OPENAI_API_...",
      version,
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_GITHUB) {
    dbg(`processing ${MODEL_PROVIDER_GITHUB}`);
    const res = findEnvVar(env, "", ["GITHUB_MODELS_TOKEN", ...GITHUB_TOKENS]) || {
      name: undefined,
      value: undefined,
    };
    if (!res?.value) {
      if (resolveToken) {
        const { exitCode, stdout, stderr } = await runtimeHost.exec(
          undefined,
          "gh",
          ["auth", "token"],
          options,
        );
        if (exitCode !== 0) {
          dbg(`gh auth token: %s`, stderr);
        } else {
          res.name = "gh auth token";
          res.value = stdout.trim();
        }
      }
      if (!res?.value)
        throw new Error(
          "GitHub authentication required. Please set GITHUB_MODELS_TOKEN, GITHUB_TOKEN, or GH_TOKEN environment variable, or run 'gh auth login' to authenticate with GitHub CLI.",
        );
    }
    const org = findEnvVar(env, "", ["GITHUB_MODELS_ORG"]);
    const type = "github";
    const base = org ? `https://models.github.ai/orgs/${org}/inference/` : GITHUB_MODELS_BASE;
    dbg(`base: %s`, base);
    return {
      provider,
      model,
      modelId,
      base,
      token: res.value,
      type,
      source: `env: ${res.name}`,
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_AZURE_OPENAI) {
    dbg(`processing ${MODEL_PROVIDER_AZURE_OPENAI}`);
    const tokenVar = env.AZURE_OPENAI_API_KEY ? "AZURE_OPENAI_API_KEY" : "AZURE_API_KEY";
    const token = env[tokenVar];
    let base = trimTrailingSlash(
      env.AZURE_OPENAI_ENDPOINT ||
        env.AZURE_OPENAI_API_BASE ||
        env.AZURE_API_BASE ||
        env.AZURE_OPENAI_API_ENDPOINT,
    );
    if (!token && !base) {
      return undefined;
    }
    if (token === PLACEHOLDER_API_KEY) {
      throw new Error("AZURE_OPENAI_API_KEY not configured");
    }
    if (!base) {
      throw new Error("AZURE_OPENAI_ENDPOINT, AZURE_OPENAI_API_BASE or AZURE_API_BASE missing");
    }
    if (base === PLACEHOLDER_API_BASE) {
      throw new Error("AZURE_OPENAI_API_ENDPOINT not configured");
    }
    const version =
      parseModelApiVersion(provider, model) ||
      env[`AZURE_OPENAI_API_VERSION_${model.toLocaleUpperCase()}`] ||
      env.AZURE_OPENAI_API_VERSION ||
      env.AZURE_API_VERSION ||
      parseAzureVersionFromUrl(base);
    if (!isAzureOpenAIV1Base(base)) {
      base = cleanAzureBase(base);
    } else {
      base = trimTrailingSlash(base);
    }
    if (!URL.canParse(base)) {
      throw new Error("AZURE_OPENAI_API_ENDPOINT must be a valid URL");
    }
    const azureCredentialsType =
      env.AZURE_OPENAI_API_CREDENTIALS?.toLowerCase().trim() as AzureCredentialsType;
    return {
      provider,
      model,
      modelId,
      base,
      token,
      type: "azure",
      source: token ? "env: AZURE_OPENAI_API_..." : "env: AZURE_OPENAI_API_... + Entra ID",
      version,
      azureCredentialsType,
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_AZURE_SERVERLESS_OPENAI) {
    dbg(`processing ${MODEL_PROVIDER_AZURE_SERVERLESS_OPENAI}`);
    const tokenVar = "AZURE_SERVERLESS_OPENAI_API_KEY";
    dbg(`retrieved AZURE_SERVERLESS_OPENAI_API_KEY: ${env.AZURE_SERVERLESS_OPENAI_API_KEY}`);
    const token = env[tokenVar];
    let base = trimTrailingSlash(
      env.AZURE_SERVERLESS_OPENAI_ENDPOINT || env.AZURE_SERVERLESS_OPENAI_API_ENDPOINT,
    );
    if (!token && !base) {
      return undefined;
    }
    if (token === PLACEHOLDER_API_KEY) {
      throw new Error("AZURE_SERVERLESS_OPENAI_API_KEY not configured");
    }
    if (!base) {
      throw new Error("AZURE_SERVERLESS_OPENAI_API_ENDPOINT missing");
    }
    if (base === PLACEHOLDER_API_BASE) {
      throw new Error("AZURE_SERVERLESS_OPENAI_API_ENDPOINT not configured");
    }
    base = cleanAzureBase(base);
    if (!URL.canParse(base)) {
      throw new Error("AZURE_SERVERLESS_OPENAI_API_ENDPOINT must be a valid URL");
    }
    const version = env.AZURE_SERVERLESS_OPENAI_API_VERSION || env.AZURE_SERVERLESS_OPENAI_VERSION;
    const azureCredentialsType =
      env.AZURE_SERVERLESS_OPENAI_API_CREDENTIALS?.toLowerCase().trim() as AzureCredentialsType;
    return {
      provider,
      model,
      modelId,
      base,
      token,
      type: "azure_serverless",
      source: token
        ? "env: AZURE_SERVERLESS_OPENAI_API_..."
        : "env: AZURE_SERVERLESS_OPENAI_API_... + Entra ID",
      version,
      azureCredentialsType,
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_AZURE_AI_INFERENCE) {
    dbg(`processing ${MODEL_PROVIDER_AZURE_AI_INFERENCE}`);
    // https://github.com/Azure/azure-sdk-for-js/tree/@azure-rest/ai-inference_1.0.0-beta.2/sdk/ai/ai-inference-rest
    dbg(`retrieved AZURE_AI_INFERENCE_API_KEY: ${env.AZURE_AI_INFERENCE_API_KEY}`);
    const tokenVar = "AZURE_AI_INFERENCE_API_KEY";
    const token = env[tokenVar]?.trim();
    let base = trimTrailingSlash(
      env.AZURE_AI_INFERENCE_ENDPOINT || env.AZURE_AI_INFERENCE_API_ENDPOINT,
    );
    if (!token && !base) {
      return undefined;
    }
    if (token === PLACEHOLDER_API_KEY) {
      throw new Error("AZURE_AI_INFERENCE_API_KEY not configured");
    }
    if (!base) {
      throw new Error("AZURE_AI_INFERENCE_API_ENDPOINT missing");
    }
    if (base === PLACEHOLDER_API_BASE) {
      throw new Error("AZURE_AI_INFERENCE_API_ENDPOINT not configured");
    }
    base = trimTrailingSlash(base);
    if (!URL.canParse(base)) {
      throw new Error("AZURE_AI_INFERENCE_API_ENDPOINT must be a valid URL");
    }
    const version = env.AZURE_AI_INFERENCE_API_VERSION || env.AZURE_AI_INFERENCE_VERSION;
    return {
      provider,
      model,
      modelId,
      base,
      token,
      type: "azure_ai_inference",
      source: token
        ? "env: AZURE_AI_INFERENCE_API_..."
        : "env: AZURE_AI_INFERENCE_API_... + Entra ID",
      version,
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_AZURE_SERVERLESS_MODELS) {
    dbg(`processing ${MODEL_PROVIDER_AZURE_SERVERLESS_MODELS}`);
    // https://github.com/Azure/azure-sdk-for-js/tree/@azure-rest/ai-inference_1.0.0-beta.2/sdk/ai/ai-inference-rest
    const tokenVar = "AZURE_SERVERLESS_MODELS_API_KEY";
    const token = env[tokenVar]?.trim();
    let base = trimTrailingSlash(
      env.AZURE_SERVERLESS_MODELS_ENDPOINT || env.AZURE_SERVERLESS_MODELS_API_ENDPOINT,
    );
    if (!token && !base) {
      return undefined;
    }
    if (token === PLACEHOLDER_API_KEY) {
      throw new Error("AZURE_SERVERLESS_MODELS_API_KEY not configured");
    }
    if (!base) {
      throw new Error("AZURE_SERVERLESS_MODELS_API_ENDPOINT missing");
    }
    if (base === PLACEHOLDER_API_BASE) {
      throw new Error("AZURE_SERVERLESS_MODELS_API_ENDPOINT not configured");
    }
    base = trimTrailingSlash(base);
    if (!URL.canParse(base)) {
      throw new Error("AZURE_SERVERLESS_MODELS_API_ENDPOINT must be a valid URL");
    }
    const version = env.AZURE_SERVERLESS_MODELS_API_VERSION || env.AZURE_SERVERLESS_MODELS_VERSION;
    return {
      provider,
      model,
      modelId,
      base,
      token,
      type: "azure_serverless_models",
      source: token
        ? "env: AZURE_SERVERLESS_MODELS_API_..."
        : "env: AZURE_SERVERLESS_MODELS_API_... + Entra ID",
      version,
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_GOOGLE) {
    dbg(`processing ${MODEL_PROVIDER_GOOGLE}`);
    const token = env.GEMINI_API_KEY || env.GOOGLE_API_KEY;
    if (!token) {
      return undefined;
    }
    if (token === PLACEHOLDER_API_KEY) {
      throw new Error("GEMINI_API_KEY/GOOGLE_API_BASE not configured");
    }
    const base = env.GEMINI_API_BASE || env.GOOGLE_API_BASE || GOOGLE_API_BASE;
    if (base === PLACEHOLDER_API_BASE) {
      throw new Error("GEMINI_API_KEY/GOOGLE_API_BASE not configured");
    }
    return {
      provider,
      model,
      modelId,
      base,
      token,
      type: "openai",
      source: "env: GEMINI_API_...",
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_ANTHROPIC) {
    dbg(`processing ${MODEL_PROVIDER_ANTHROPIC}`);
    const modelKey = "ANTHROPIC_API_KEY";
    dbg(`retrieved ANTHROPIC_API_KEY: ${env.ANTHROPIC_API_KEY}`);
    const token = env[modelKey]?.trim();
    if (token === undefined || token === PLACEHOLDER_API_KEY) {
      throw new Error("ANTHROPIC_API_KEY not configured");
    }
    const base = trimTrailingSlash(env.ANTHROPIC_API_BASE) || ANTHROPIC_API_BASE;
    const version = env.ANTHROPIC_API_VERSION || undefined;
    const source = "env: ANTHROPIC_API_...";

    return {
      provider,
      model,
      modelId,
      token,
      base,
      version,
      source,
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_ANTHROPIC_BEDROCK) {
    dbg(`processing ${MODEL_PROVIDER_ANTHROPIC_BEDROCK}`);

    // AWS region is required for Bedrock
    const region = env.AWS_REGION;
    if (!region) {
      throw new Error("AWS_REGION is required for Anthropic Bedrock");
    }

    // Check for AWS credentials or Bedrock API key
    const hasAwsCredentials = env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY;
    const hasBedrockApiKey = env.AWS_BEARER_TOKEN_BEDROCK;
    const hasAwsProfile = env.AWS_PROFILE;

    if (!hasAwsCredentials && !hasBedrockApiKey && !hasAwsProfile) {
      throw new Error(
        "AWS credentials are required for Anthropic Bedrock. Set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, AWS_BEARER_TOKEN_BEDROCK, or AWS_PROFILE",
      );
    }

    dbg(`AWS region: ${region}`);
    if (hasAwsCredentials) {
      dbg("using AWS access key credentials");
      if (env.AWS_SESSION_TOKEN) dbg("with session token (temporary credentials)");
    }
    if (hasBedrockApiKey) dbg("using AWS Bedrock API key");
    if (hasAwsProfile) dbg(`using AWS profile: ${env.AWS_PROFILE}`);

    // Log optional configurations
    if (env.ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION) {
      dbg(`small/fast model region override: ${env.ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION}`);
    }
    if (env.DISABLE_PROMPT_CACHING) {
      dbg(`prompt caching disabled: ${env.DISABLE_PROMPT_CACHING}`);
    }
    if (env.ANTHROPIC_MODEL) {
      dbg(`model override: ${env.ANTHROPIC_MODEL}`);
    }

    return {
      provider,
      model,
      modelId,
      source: "AWS SDK",
      base: undefined,
      token: MODEL_PROVIDER_ANTHROPIC_BEDROCK,
      // Store AWS-specific configuration for reference
      version: region,
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_MISTRAL) {
    dbg(`processing ${MODEL_PROVIDER_MISTRAL}`);
    const base = env.MISTRAL_API_BASE || MISTRAL_API_BASE;
    const token = env.MISTRAL_API_KEY;
    if (!token) {
      throw new Error("MISTRAL_API_KEY not configured");
    }
    return {
      provider,
      model,
      modelId,
      token,
      base,
      source: "env: MISTRAL_API_...",
      type: "openai",
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_ALIBABA) {
    dbg(`processing ${MODEL_PROVIDER_ALIBABA}`);
    const base =
      env.ALIBABA_API_BASE || env.DASHSCOPE_API_BASE || env.DASHSCOPE_HTTP_BASE_URL || ALIBABA_BASE;
    if (base === PLACEHOLDER_API_BASE) {
      throw new Error("ALIBABA_API_BASE not configured");
    }
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    const token = env.ALIBABA_API_KEY || env.DASHSCOPE_API_KEY;
    if (token === undefined || token === PLACEHOLDER_API_KEY) {
      throw new Error("ALIBABA_API_KEY not configured");
    }
    return {
      provider,
      model,
      modelId,
      base,
      token,
      type: "alibaba",
      source: "env: ALIBABA_API_...",
    };
  }

  if (provider === MODEL_PROVIDER_OLLAMA) {
    dbg(`processing ${MODEL_PROVIDER_OLLAMA}`);
    const host = ollamaParseHostVariable(env);
    const base = cleanApiBase(host);
    return {
      provider,
      model,
      modelId,
      base,
      token: MODEL_PROVIDER_OLLAMA,
      type: "openai",
      source: "env: OLLAMA_HOST",
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_DOCKER_MODEL_RUNNER) {
    dbg(`processing ${MODEL_PROVIDER_DOCKER_MODEL_RUNNER}`);
    const base = env.DOCKER_MODEL_RUNNER_API_BASE || DOCKER_MODEL_RUNNER_API_BASE;
    if (base === PLACEHOLDER_API_BASE) {
      throw new Error("DOCKER_MODEL_RUNNER_API_BASE not configured");
    }
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    return {
      provider,
      model,
      modelId,
      base,
      token: MODEL_PROVIDER_DOCKER_MODEL_RUNNER,
      type: "openai",
      source: "env: DOCKER_MODEL_RUNNER",
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_HUGGINGFACE) {
    dbg(`processing ${MODEL_PROVIDER_HUGGINGFACE}`);
    const prefixes = ["HUGGINGFACE", "HF"];
    const token = findEnvVar(env, prefixes, TOKEN_SUFFIX);
    const base = findEnvVar(env, prefixes, BASE_SUFFIX)?.value || HUGGINGFACE_API_BASE;
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    if (!token?.value) {
      throw new Error("HuggingFace token missing");
    }
    return {
      base,
      modelId,
      token: token?.value,
      provider,
      model,
      type: "huggingface",
      source: "env: HUGGINGFACE_API_...",
    } satisfies LanguageModelConfiguration;
  }

  if (provider === MODEL_PROVIDER_DEEPSEEK) {
    dbg(`processing ${MODEL_PROVIDER_DEEPSEEK}`);
    const base = findEnvVar(env, "DEEPSEEK", BASE_SUFFIX)?.value || DEEPSEEK_API_BASE;
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    const token = env.DEEPSEEK_API_KEY;
    if (!token) {
      throw new Error("DEEPSEEK_API_KEY not configured");
    }
    return {
      provider,
      model,
      modelId,
      base,
      token,
      type: "openai",
      source: "env: DEEPSEEK_API_...",
    };
  }

  if (provider === MODEL_PROVIDER_WHISPERASR) {
    dbg(`processing ${MODEL_PROVIDER_WHISPERASR}`);
    const base = findEnvVar(env, "WHISPERASR", BASE_SUFFIX)?.value || WHISPERASR_API_BASE;
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    return {
      provider,
      model,
      modelId,
      base,
      token: undefined,
      source: "env: WHISPERASR_API_...",
    };
  }

  if (provider === MODEL_PROVIDER_WINDOWS_AI) {
    dbg(`processing ${MODEL_PROVIDER_WINDOWS_AI}`);
    return {
      provider,
      model,
      modelId,
      base: WINDOWS_AI_API_BASE,
      token: MODEL_PROVIDER_WINDOWS_AI,
      type: "openai",
      source: "env",
    };
  }

  if (provider === MODEL_PROVIDER_SGLANG) {
    dbg(`processing MODEL_PROVIDER_SGLANG`);
    const base = findEnvVar(env, "SGLANG", BASE_SUFFIX)?.value || SGLANG_API_BASE;
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    return {
      provider,
      model,
      modelId,
      base,
      token: MODEL_PROVIDER_SGLANG,
      type: "openai",
      source: "default",
    };
  }

  if (provider === MODEL_PROVIDER_VLLM) {
    dbg(`processing MODEL_PROVIDER_VLLM`);
    const base = findEnvVar(env, "VLLM", BASE_SUFFIX)?.value || VLLM_API_BASE;
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    return {
      provider,
      model,
      modelId,
      base,
      token: MODEL_PROVIDER_VLLM,
      type: "openai",
      source: "default",
    };
  }

  if (provider === MODEL_PROVIDER_LLAMAFILE) {
    dbg(`processing MODEL_PROVIDER_LLAMAFILE`);
    const base = findEnvVar(env, "LLAMAFILE", BASE_SUFFIX)?.value || LLAMAFILE_API_BASE;
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    return {
      provider,
      model,
      modelId,
      base,
      token: MODEL_PROVIDER_LLAMAFILE,
      type: "openai",
      source: "env: LLAMAFILE_API_...",
    };
  }

  if (provider === MODEL_PROVIDER_LITELLM) {
    dbg(`processing MODEL_PROVIDER_LITELLM`);
    const base = findEnvVar(env, "LITELLM", BASE_SUFFIX)?.value || LITELLM_API_BASE;
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    const token = env.LITELLM_API_KEY;
    return {
      provider,
      model,
      modelId,
      base,
      token,
      type: "openai",
      source: "env: LITELLM_API_...",
    };
  }

  if (provider === MODEL_PROVIDER_LMSTUDIO) {
    dbg(`processing MODEL_PROVIDER_LMSTUDIO`);
    const base = findEnvVar(env, "LMSTUDIO", BASE_SUFFIX)?.value || LMSTUDIO_API_BASE;
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    return {
      provider,
      model,
      modelId,
      base,
      token: MODEL_PROVIDER_LMSTUDIO,
      type: "openai",
      source: "env: LMSTUDIO_API_...",
    };
  }

  if (provider === MODEL_PROVIDER_JAN) {
    dbg(`processing MODEL_PROVIDER_JAN`);
    const base = findEnvVar(env, "JAN", BASE_SUFFIX)?.value || JAN_API_BASE;
    if (!URL.canParse(base)) {
      throw new Error(`${base} must be a valid URL`);
    }
    return {
      provider,
      model,
      modelId,
      base,
      token: MODEL_PROVIDER_JAN,
      type: "openai",
      source: "env: JAN_API_...",
    };
  }

  if (provider === MODEL_PROVIDER_GITHUB_COPILOT_CHAT) {
    dbg(`processing MODEL_PROVIDER_GITHUB_COPILOT_CHAT`);
    if (!runtimeHost.clientLanguageModel) {
      throw new Error(
        `${MODEL_PROVIDER_GITHUB_COPILOT_CHAT} requires Visual Studio Code and GitHub Copilot Chat`,
      );
    }
    return {
      provider,
      model,
      modelId,
      base: undefined,
      token: MODEL_PROVIDER_GITHUB_COPILOT_CHAT,
    };
  }

  if (provider === MODEL_PROVIDER_MCP) {
    dbg(`processing MODEL_PROVIDER_MCP`);
    if (!runtimeHost.clientLanguageModel) {
      throw new Error(`${MODEL_PROVIDER_MCP} requires MCP Client with Sampling.`);
    }
    return {
      provider,
      model,
      modelId,
      base: undefined,
      token: MODEL_PROVIDER_MCP,
    };
  }

  if (provider === MODEL_PROVIDER_ECHO || provider === MODEL_PROVIDER_NONE) {
    dbg(`processing MODEL_PROVIDER_ECHO or MODEL_PROVIDER_NONE`);
    return {
      provider,
      model,
      modelId,
      base: undefined,
      token: provider,
    };
  }

  // generic
  const prefixes = [
    tag ? `${provider}_${model}_${tag}` : undefined,
    provider ? `${provider}_${model}` : undefined,
    provider ? provider : undefined,
    model,
  ]
    .filter((p) => p)
    .map((p) => p.toUpperCase().replace(/[^a-z0-9]+/gi, "_"));
  for (const prefix of prefixes) {
    dbg(`looking for %s_...`, prefix);
    const modelKey = findEnvVar(env, prefix, TOKEN_SUFFIX);
    const modelBase = findEnvVar(env, prefix, BASE_SUFFIX);
    if (modelKey || modelBase) {
      const token = modelKey?.value || "";
      const version = env[prefix + "_API_VERSION"];
      let type: OpenAIAPIType = env[prefix + "_API_TYPE"] as OpenAIAPIType;
      const azureCredentialsType = env[prefix + `_API_CREDENTIALS`]
        ?.toLowerCase()
        .trim() as AzureCredentialsType;
      const customProvider = env[prefix + "_API_PROVIDER"] || provider;
      const source = `env: ${prefix}_API_...`;
      let base = trimTrailingSlash(modelBase?.value);
      if (customProvider === MODEL_PROVIDER_AZURE_OPENAI) {
        if (!isAzureOpenAIV1Base(base)) {
          base = cleanAzureBase(base);
        }
        type = "azure";
      }
      if (base && !URL.canParse(base)) {
        throw new Error(`${modelBase} must be a valid URL`);
      }
      dbg(`custom provider: %O`, {
        provider: customProvider,
        base,
        type,
        azureCredentialsType,
        version,
      });
      return deleteUndefinedValues({
        provider: customProvider,
        model,
        modelId,
        token,
        base,
        type,
        azureCredentialsType,
        version,
        source,
      }) satisfies LanguageModelConfiguration;
    }
  }

  dbg(`no matching provider found, returning undefined`);
  return undefined;

  function cleanAzureBase(b: string) {
    if (!b) {
      return b;
    }
    const res =
      trimTrailingSlash(b.replace(/\/openai\/deployments.*$/, "")) + `/openai/deployments`;
    return res;
  }

  function parseAzureVersionFromUrl(url: string) {
    const uri = uriTryParse(url);
    const v = uri?.searchParams.get("api-version") || undefined;
    // azure:gpt-4o_2024-11-20
    // {api-version}
    if (v?.startsWith("{")) return undefined;

    return v;
  }

  function cleanApiBase(b: string) {
    if (!b) {
      return b;
    }
    let res = trimTrailingSlash(b);
    if (!/\/v1$/.test(res)) {
      res += "/v1";
    }
    return res;
  }
}

/**
 * Parses allowed domains from environment variable.
 * Supports comma-separated list or YAML array format.
 * Returns default ["github.com"] if not specified.
 */
export function parseAllowedDomains(env: Record<string, string>): string[] {
  const envValue = env.GENAISCRIPT_ALLOWED_DOMAINS || env.ALLOWED_DOMAINS;
  if (!envValue) {
    return DEFAULT_ALLOWED_DOMAINS;
  }

  // Try to parse as YAML array first
  try {
    const parsed = YAMLTryParse(envValue);
    if (Array.isArray(parsed)) {
      return parsed.filter((domain) => typeof domain === "string" && domain.trim());
    }
  } catch {
    // Fall through to comma-separated parsing
  }

  // Parse as comma-separated list
  return envValue
    .split(",")
    .map((domain) => domain.trim())
    .filter((domain) => domain.length > 0);
}

/**
 * Logs the current state of Azure OpenAI configuration
 * @param options - Optional trace and cancellation options
 */
export async function logAzureOpenAIConfiguration(options?: CancellationOptions): Promise<void> {
  // Environment variables related to Azure OpenAI
  const azureOpenAIEnvVars = deleteUndefinedValues({
    AZURE_OPENAI_API_ENDPOINT: process.env.AZURE_OPENAI_API_ENDPOINT,
    AZURE_OPENAI_ENDPOINT: process.env.AZURE_OPENAI_ENDPOINT,
    AZURE_OPENAI_API_BASE: process.env.AZURE_OPENAI_API_BASE,
    AZURE_API_BASE: process.env.AZURE_API_BASE,
    AZURE_OPENAI_API_KEY: process.env.AZURE_OPENAI_API_KEY ? "***" : undefined,
    AZURE_API_KEY: process.env.AZURE_API_KEY ? "***" : undefined,
    AZURE_OPENAI_API_VERSION: process.env.AZURE_OPENAI_API_VERSION,
    AZURE_API_VERSION: process.env.AZURE_API_VERSION,
    AZURE_OPENAI_API_CREDENTIALS: process.env.AZURE_OPENAI_API_CREDENTIALS,
    AZURE_OPENAI_SUBSCRIPTION_ID: process.env.AZURE_OPENAI_SUBSCRIPTION_ID ? "***" : undefined,
    AZURE_OPENAI_TOKEN_SCOPES: process.env.AZURE_OPENAI_TOKEN_SCOPES,
    AZURE_OPENAI_API_MODELS_TYPE: process.env.AZURE_OPENAI_API_MODELS_TYPE,
    NODE_ENV: process.env.NODE_ENV,
  });
  dbg(`azure env vars: %O`, azureOpenAIEnvVars);
}