Add Entra ID auth, misc improvements, bump to v0.7.0

- Add azureAdTokenProvider to both Azure model configs for Microsoft
  Entra ID (bearer token) auth alongside existing API key auth
- Constructor validates exactly one auth method provided
- Token provider called fresh on each request (no caching)
- 10 new auth unit tests
- Minor fixes to agent, builtin-tools, hosted-tool, model, run, types

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tylergibbs1

examples/test-battle.ts

@@ -1,6 +1,6 @@
 {
   "name": "stratus-sdk",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package.json

@@ -8,13 +8,14 @@ import type {
 	StreamEvent,
 	UsageInfo,
 } from "../core/model";
-import type { ChatMessage, ToolCall, ToolDefinition } from "../core/types";
+import type { ChatMessage, HostedToolDefinition, ToolCall, ToolDefinition } from "../core/types";
 import { resolveChatCompletionsUrl } from "./endpoint";
 import { parseSSE } from "./sse-parser";
 
 export interface AzureChatCompletionsModelConfig {
 	endpoint: string;
-	apiKey: string;
+	apiKey?: string;
+	azureAdTokenProvider?: () => Promise<string>;
 	deployment: string;
 	apiVersion?: string;
 }
@@ -23,11 +24,23 @@ const DEFAULT_API_VERSION = "2025-03-01-preview";
 
 export class AzureChatCompletionsModel implements Model {
 	private readonly url: string;
-	private readonly apiKey: string;
+	private readonly apiKey?: string;
+	private readonly tokenProvider?: () => Promise<string>;
 	private readonly deployment: string;
 
 	constructor(config: AzureChatCompletionsModelConfig) {
+		if (config.apiKey && config.azureAdTokenProvider) {
+			throw new StratusError(
+				"Provide either apiKey or azureAdTokenProvider, not both",
+			);
+		}
+		if (!config.apiKey && !config.azureAdTokenProvider) {
+			throw new StratusError(
+				"Provide either apiKey or azureAdTokenProvider",
+			);
+		}
 		this.apiKey = config.apiKey;
+		this.tokenProvider = config.azureAdTokenProvider;
 		this.deployment = config.deployment;
 		this.url = resolveChatCompletionsUrl(
 			config.endpoint,
@@ -36,6 +49,14 @@ export class AzureChatCompletionsModel implements Model {
 		);
 	}
 
+	private async getAuthHeaders(): Promise<Record<string, string>> {
+		if (this.tokenProvider) {
+			const token = await this.tokenProvider();
+			return { Authorization: `Bearer ${token}` };
+		}
+		return { "api-key": this.apiKey! };
+	}
+
 	async getResponse(
 		request: ModelRequest,
 		options?: ModelRequestOptions,
@@ -161,14 +182,8 @@ export class AzureChatCompletionsModel implements Model {
 		}
 
 		if (request.tools && request.tools.length > 0) {
-			for (const tool of request.tools) {
-				if (!("function" in tool)) {
-					throw new StratusError(
-						"Hosted tools (web_search, code_interpreter, mcp, image_generation) are not supported by the Chat Completions API. Use AzureResponsesModel instead.",
-					);
-				}
-			}
-			body.tools = request.tools as ToolDefinition[];
+			assertAllFunctionTools(request.tools);
+			body.tools = request.tools;
 		}
 
 		if (request.responseFormat) {
@@ -201,11 +216,12 @@ export class AzureChatCompletionsModel implements Model {
 	): Promise<Response> {
 		const maxRetries = 3;
 		for (let attempt = 0; attempt <= maxRetries; attempt++) {
+			const authHeaders = await this.getAuthHeaders();
 			const response = await fetch(this.url, {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json",
-					"api-key": this.apiKey,
+					...authHeaders,
 				},
 				body: JSON.stringify(body),
 				signal,
@@ -300,6 +316,18 @@ export class AzureChatCompletionsModel implements Model {
 	}
 }
 
+function assertAllFunctionTools(
+	tools: (ToolDefinition | HostedToolDefinition)[],
+): asserts tools is ToolDefinition[] {
+	for (const tool of tools) {
+		if (!("function" in tool)) {
+			throw new StratusError(
+				"Hosted tools (web_search, code_interpreter, mcp, image_generation) are not supported by the Chat Completions API. Use AzureResponsesModel instead.",
+			);
+		}
+	}
+}
+
 function serializeMessage(msg: ChatMessage): Record<string, unknown> {
 	switch (msg.role) {
 		case "system":

src/azure/chat-completions-model.ts

@@ -1,4 +1,4 @@
-import { ContentFilterError, ModelError } from "../core/errors";
+import { ContentFilterError, ModelError, StratusError } from "../core/errors";
 import type {
 	FinishReason,
 	Model,
@@ -11,6 +11,7 @@ import type {
 import type {
 	ChatMessage,
 	ContentPart,
+	HostedToolDefinition,
 	ResponseFormat,
 	ToolCall,
 	ToolChoice,
@@ -21,7 +22,8 @@ import { parseSSE } from "./sse-parser";
 
 export interface AzureResponsesModelConfig {
 	endpoint: string;
-	apiKey: string;
+	apiKey?: string;
+	azureAdTokenProvider?: () => Promise<string>;
 	deployment: string;
 	apiVersion?: string;
 	store?: boolean;
@@ -31,12 +33,24 @@ const DEFAULT_API_VERSION = "2025-04-01-preview";
 
 export class AzureResponsesModel implements Model {
 	private readonly url: string;
-	private readonly apiKey: string;
+	private readonly apiKey?: string;
+	private readonly tokenProvider?: () => Promise<string>;
 	private readonly deployment: string;
 	private readonly store: boolean;
 
 	constructor(config: AzureResponsesModelConfig) {
+		if (config.apiKey && config.azureAdTokenProvider) {
+			throw new StratusError(
+				"Provide either apiKey or azureAdTokenProvider, not both",
+			);
+		}
+		if (!config.apiKey && !config.azureAdTokenProvider) {
+			throw new StratusError(
+				"Provide either apiKey or azureAdTokenProvider",
+			);
+		}
 		this.apiKey = config.apiKey;
+		this.tokenProvider = config.azureAdTokenProvider;
 		this.deployment = config.deployment;
 		this.store = config.store ?? false;
 		this.url = resolveResponsesUrl(
@@ -45,6 +59,14 @@ export class AzureResponsesModel implements Model {
 		);
 	}
 
+	private async getAuthHeaders(): Promise<Record<string, string>> {
+		if (this.tokenProvider) {
+			const token = await this.tokenProvider();
+			return { Authorization: `Bearer ${token}` };
+		}
+		return { "api-key": this.apiKey! };
+	}
+
 	async getResponse(
 		request: ModelRequest,
 		options?: ModelRequestOptions,
@@ -233,11 +255,12 @@ export class AzureResponsesModel implements Model {
 	): Promise<Response> {
 		const maxRetries = 3;
 		for (let attempt = 0; attempt <= maxRetries; attempt++) {
+			const authHeaders = await this.getAuthHeaders();
 			const response = await fetch(this.url, {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json",
-					"api-key": this.apiKey,
+					...authHeaders,
 				},
 				body: JSON.stringify(body),
 				signal,
@@ -440,14 +463,18 @@ function convertUserContent(
 }
 
 function isFunctionToolDefinition(
-	def: ToolDefinition | Record<string, unknown>,
+	def: ToolDefinition | HostedToolDefinition,
 ): def is ToolDefinition {
-	return "function" in def && typeof (def as ToolDefinition).function === "object";
+	return "function" in def && (def as ToolDefinition).function != null && typeof (def as ToolDefinition).function === "object";
 }
 
-function convertToolChoice(
-	toolChoice: ToolChoice,
-): string | { type: string; name: string } {
+type ResponsesToolChoice =
+	| "auto"
+	| "none"
+	| "required"
+	| { type: "function"; name: string };
+
+function convertToolChoice(toolChoice: ToolChoice): ResponsesToolChoice {
 	if (typeof toolChoice === "string") return toolChoice;
 	// Chat Completions format: { type: "function", function: { name } }
 	// Responses API format: { type: "function", name }

src/azure/responses-model.ts

@@ -5,7 +5,6 @@ import type { AgentHooks } from "./hooks";
 import type { Model } from "./model";
 import type { SubAgent } from "./subagent";
 import type { AgentTool } from "./hosted-tool";
-import type { FunctionTool } from "./tool";
 import type { ModelSettings, ResponseFormat, ToolUseBehavior } from "./types";
 import { zodToJsonSchema } from "./utils/zod";
 

src/core/agent.ts

@@ -1,4 +1,5 @@
 import type { HostedTool } from "./hosted-tool";
+import type { HostedToolDefinition } from "./types";
 
 export interface WebSearchToolConfig {
 	userLocation?: {
@@ -12,7 +13,7 @@ export interface WebSearchToolConfig {
 }
 
 export function webSearchTool(config?: WebSearchToolConfig): HostedTool {
-	const definition: Record<string, unknown> = {
+	const definition: HostedToolDefinition = {
 		type: "web_search_preview",
 	};
 	if (config?.userLocation) {
@@ -53,7 +54,7 @@ export interface McpToolConfig {
 }
 
 export function mcpTool(config: McpToolConfig): HostedTool {
-	const definition: Record<string, unknown> = {
+	const definition: HostedToolDefinition = {
 		type: "mcp",
 		server_label: config.serverLabel,
 		server_url: config.serverUrl,

src/core/builtin-tools.ts

@@ -1,9 +1,10 @@
+import type { HostedToolDefinition } from "./types";
 import type { FunctionTool } from "./tool";
 
 export interface HostedTool {
 	type: "hosted";
 	name: string;
-	definition: Record<string, unknown>;
+	definition: HostedToolDefinition;
 }
 
 export type AgentTool = FunctionTool | HostedTool;

src/core/hosted-tool.ts

@@ -67,6 +67,7 @@ export type {
 	ToolMessage,
 	ToolCall,
 	ToolDefinition,
+	HostedToolDefinition,
 	ModelSettings,
 	ReasoningEffort,
 	ResponseFormat,

src/core/index.ts

@@ -1,8 +1,8 @@
-import type { ChatMessage, ModelSettings, ResponseFormat, ToolCall, ToolDefinition } from "./types";
+import type { ChatMessage, HostedToolDefinition, ModelSettings, ResponseFormat, ToolCall, ToolDefinition } from "./types";
 
 export interface ModelRequest {
 	messages: ChatMessage[];
-	tools?: (ToolDefinition | Record<string, unknown>)[];
+	tools?: (ToolDefinition | HostedToolDefinition)[];
 	modelSettings?: ModelSettings;
 	responseFormat?: ResponseFormat;
 	previousResponseId?: string;

src/core/model.ts

@@ -25,9 +25,9 @@ import { subagentToDefinition, subagentToTool } from "./subagent";
 import type { SubAgent } from "./subagent";
 import { RunResult } from "./result";
 import { toolToDefinition } from "./tool";
-import type { FunctionTool } from "./tool";
+
 import { getCurrentTrace } from "./tracing";
-import type { AssistantMessage, ChatMessage, ToolCall, ToolDefinition, ToolMessage } from "./types";
+import type { AssistantMessage, ChatMessage, HostedToolDefinition, ToolCall, ToolDefinition, ToolMessage } from "./types";
 
 const DEFAULT_MAX_TURNS = 10;
 
@@ -675,8 +675,8 @@ async function buildFinalResult<TContext, TOutput>(
 	return result;
 }
 
-function buildToolDefs(agent: Agent<any, any>): (ToolDefinition | Record<string, unknown>)[] {
-	const defs: (ToolDefinition | Record<string, unknown>)[] = [];
+function buildToolDefs(agent: Agent<any, any>): (ToolDefinition | HostedToolDefinition)[] {
+	const defs: (ToolDefinition | HostedToolDefinition)[] = [];
 	for (const t of agent.tools) {
 		if (isHostedTool(t)) {
 			defs.push(t.definition);
@@ -737,7 +737,7 @@ async function executeToolCallsWithHandoffs<TContext>(
 	// Build O(1) lookup maps
 	const handoffsByName = new Map(agent.handoffs.map((h) => [h.toolName, h]));
 	const subagentsByName = new Map(agent.subagents.map((sa) => [sa.toolName, sa]));
-	const functionTools = agent.tools.filter(isFunctionTool) as FunctionTool[];
+	const functionTools = agent.tools.filter(isFunctionTool);
 	const toolsByName = new Map(functionTools.map((t) => [t.name, t]));
 
 	const results = await Promise.all(