little_ghost 0.1.0 → 0.2.0

data/lib/little_ghost/providers/base.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module LittleGhost
+  module Providers
+    # Reports a bounded HTTP or network failure from a provider connection.
+    class HTTPError < ProviderError
+      # HTTP status, when a response was received, and the bounded response body.
+      attr_reader :status, :body
+
+      # Captures a provider failure without retaining an unbounded response.
+      def initialize(message, status: nil, body: nil)
+        @status = status
+        @body = body
+        super(message)
+      end
+
+      # Whether retrying the same provider request may succeed.
+      def retryable?
+        status.nil? || status == 408 || status == 409 || status == 429 || status >= 500
+      end
+    end
+
+    # Shared provider contract. Provider adapters implement #stream and may
+    # override capability-sensitive request preparation.
+    class Base
+      # Returns the trusted per-profile request options this adapter accepts.
+      # Connection options remain authoritative and are configured separately.
+      def self.request_options = [].freeze
+
+      # Streams normalized events for +request+.
+      def stream(_request)
+        raise AbstractMethodError, "#{self.class} must implement #stream"
+      end
+
+      # Applies provider-specific capability constraints before streaming.
+      def prepare_request(request, capabilities:)
+        request
+      end
+
+      # Returns provider capabilities derived from normalized metadata.
+      def capabilities(metadata: {})
+        ModelCapabilities.unknown
+      end
+    end
+  end
+end

data/lib/little_ghost/providers/bedrock/aws_protocol.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require "digest"
+require "openssl"
+require "time"
+require "zlib"
+
+module LittleGhost
+  module Providers
+    class Bedrock < Base
+      # Signs AWS HTTP requests with Signature Version 4.
+      class AwsSigV4 # :nodoc:
+        def initialize(service:, region:, credentials:, clock: -> { Time.now.utc })
+          @service = service
+          @region = region
+          @credentials = credentials
+          @clock = clock
+        end
+
+        def headers(method:, uri:, headers:, body:)
+          time = @clock.call.utc
+          timestamp = time.strftime("%Y%m%dT%H%M%SZ")
+          date = time.strftime("%Y%m%d")
+          normalized = headers.to_h.transform_keys { |key| key.to_s.downcase }
+            .merge("host" => host_header(uri), "x-amz-date" => timestamp)
+          normalized["x-amz-security-token"] = @credentials.session_token if @credentials.session_token
+          canonical_headers = normalized.sort.map { |key, value| "#{key}:#{value.to_s.strip.gsub(/\s+/, " ")}\n" }.join
+          signed_headers = normalized.keys.sort.join(";")
+          canonical_request = [method.to_s.upcase, canonical_path(uri), canonical_query(uri), canonical_headers,
+            signed_headers, Digest::SHA256.hexdigest(body)].join("\n")
+          scope = "#{date}/#{@region}/#{@service}/aws4_request"
+          string_to_sign = ["AWS4-HMAC-SHA256", timestamp, scope, Digest::SHA256.hexdigest(canonical_request)].join("\n")
+          signature = OpenSSL::HMAC.hexdigest("SHA256", signing_key(date), string_to_sign)
+          normalized.merge("authorization" => "AWS4-HMAC-SHA256 Credential=#{@credentials.access_key_id}/#{scope}, SignedHeaders=#{signed_headers}, Signature=#{signature}")
+        end
+
+        private
+
+        def signing_key(date)
+          date_key = OpenSSL::HMAC.digest("SHA256", "AWS4#{@credentials.secret_access_key}", date)
+          region_key = OpenSSL::HMAC.digest("SHA256", date_key, @region)
+          service_key = OpenSSL::HMAC.digest("SHA256", region_key, @service)
+          OpenSSL::HMAC.digest("SHA256", service_key, "aws4_request")
+        end
+
+        def canonical_path(uri)
+          path = uri.path.empty? ? "/" : uri.path
+          path.split("/", -1).map { |part| URI.encode_www_form_component(URI.decode_www_form_component(part)).gsub("+", "%20") }.join("/")
+        end
+
+        def canonical_query(uri)
+          URI.decode_www_form(uri.query.to_s).sort.map { |key, value| "#{escape(key)}=#{escape(value)}" }.join("&")
+        end
+
+        def escape(value) = URI.encode_www_form_component(value).gsub("+", "%20")
+        def host_header(uri) = (uri.default_port == uri.port) ? uri.host : "#{uri.host}:#{uri.port}"
+      end
+
+      # Incrementally decodes the AWS EventStream binary framing protocol.
+      class EventStreamDecoder # :nodoc:
+        DEFAULT_MAX_FRAME_BYTES = 16 * 1024 * 1024
+        DEFAULT_MAX_HEADERS_BYTES = 128 * 1024
+
+        def initialize(max_frame_bytes: DEFAULT_MAX_FRAME_BYTES, max_headers_bytes: DEFAULT_MAX_HEADERS_BYTES)
+          @buffer = String.new(encoding: Encoding::BINARY)
+          @max_frame_bytes = Integer(max_frame_bytes)
+          @max_headers_bytes = Integer(max_headers_bytes)
+        end
+
+        def <<(chunk)
+          @buffer << chunk.b
+          events = []
+          loop do
+            break if @buffer.bytesize < 12
+
+            total_length, headers_length, prelude_crc = @buffer.unpack("NNN")
+            raise ProtocolError, "AWS EventStream frame length is invalid" if total_length < 16 || headers_length > total_length - 16
+            raise ProtocolError, "AWS EventStream frame exceeds the configured limit" if total_length > @max_frame_bytes
+            raise ProtocolError, "AWS EventStream headers exceed the configured limit" if headers_length > @max_headers_bytes
+            break if @buffer.bytesize < total_length
+
+            frame = @buffer.slice!(0, total_length)
+            raise ProtocolError, "AWS EventStream prelude checksum is invalid" unless Zlib.crc32(frame.byteslice(0, 8)) == prelude_crc
+            expected_crc = frame.byteslice(total_length - 4, 4).unpack1("N")
+            raise ProtocolError, "AWS EventStream message checksum is invalid" unless Zlib.crc32(frame.byteslice(0, total_length - 4)) == expected_crc
+
+            headers = decode_headers(frame.byteslice(12, headers_length))
+            payload = frame.byteslice(12 + headers_length, total_length - headers_length - 16)
+            events << [headers, payload]
+          end
+          events
+        end
+
+        def finish
+          raise ProtocolError, "AWS EventStream ended with an incomplete frame" unless @buffer.empty?
+        end
+
+        private
+
+        def decode_headers(bytes)
+          offset = 0
+          headers = {}
+          while offset < bytes.bytesize
+            name_length = bytes.getbyte(offset)
+            offset += 1
+            name = bytes.byteslice(offset, name_length)
+            offset += name_length
+            type = bytes.getbyte(offset)
+            offset += 1
+            case type
+            when 0 then value = true
+            when 1 then value = false
+            when 2 then value = bytes.getbyte(offset).then {
+              offset += 1
+              _1
+            }
+            when 6, 7
+              length = bytes.byteslice(offset, 2).unpack1("n")
+              offset += 2
+              value = bytes.byteslice(offset, length)
+              offset += length
+            else
+              raise ProtocolError, "Unsupported AWS EventStream header type #{type}"
+            end
+            headers[name] = value
+          end
+          headers
+        end
+      end
+    end
+  end
+end

data/lib/little_ghost/providers/bedrock/catalog_source.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+module LittleGhost
+  module Providers
+    class Bedrock < Base
+      # Enriches Bedrock availability and on-demand pricing using bounded,
+      # SigV4-signed AWS APIs.
+      class CatalogSource < Models::Catalog::Source
+        PRICING_ENDPOINT = URI("https://api.pricing.us-east-1.amazonaws.com") # :nodoc:
+        PRICING_REGION = "us-east-1" # :nodoc:
+        MAX_PRICING_PAGES = 10 # :nodoc:
+        MAX_RESULTS = 100 # :nodoc:
+        FOUNDATION_MODEL_OFFER = "AmazonBedrockFoundationModels" # :nodoc:
+        BEDROCK_OFFER = "AmazonBedrock" # :nodoc:
+        ATTRIBUTE_MERGE_STRATEGIES = {input_modalities: :union}.freeze # :nodoc:
+
+        # Creates a source for one Bedrock provider connection and AWS region.
+        def initialize(provider:, region:, credential_resolver: nil, clock: -> { Time.now.utc }, http_client: nil)
+          super(name: "bedrock")
+          @provider = provider
+          @region = region
+          @credential_resolver = credential_resolver || CredentialResolver.new
+          @clock = clock
+          @http_client = http_client || Support::HTTPClient.new(
+            open_timeout: 5,
+            read_timeout: 30,
+            max_response_bytes: 25 * 1024 * 1024
+          )
+        end
+
+        # AWS reports a coarse subset of Converse input capabilities, so live
+        # modalities augment richer facts supplied by another catalog source.
+        def attribute_merge_strategies = ATTRIBUTE_MERGE_STRATEGIES
+
+        def refresh(target: nil)
+          credentials = @credential_resolver.call
+          models = foundation_models(credentials, target:)
+          products = (target && models.one?) ? pricing_products(credentials, models.first) : []
+          records(models, products, target:)
+        rescue JSON::ParserError, KeyError, TypeError, ArgumentError => error
+          raise ProviderError, "Bedrock returned an invalid catalog: #{error.message}"
+        end
+
+        private
+
+        def foundation_models(credentials, target:)
+          uri = URI("https://bedrock.#{@region}.amazonaws.com/foundation-models")
+          values = JSON.parse(request(uri:, service: "bedrock", region: @region, credentials:))
+            .fetch("modelSummaries")
+          model_id = base_model_id(target.model_id) if target
+          values.select! { |value| value["modelId"] == model_id } if model_id
+          values
+        end
+
+        def pricing_products(credentials, model)
+          products = pricing_products_for(
+            credentials,
+            service_code: FOUNDATION_MODEL_OFFER,
+            filters: pricing_filters("servicename", "#{model.fetch("modelName")} (Amazon Bedrock Edition)")
+          )
+          return products unless products.empty?
+
+          pricing_products_for(
+            credentials,
+            service_code: BEDROCK_OFFER,
+            filters: pricing_filters("model", model.fetch("modelName"))
+          )
+        end
+
+        def pricing_products_for(credentials, service_code:, filters:)
+          products = []
+          next_token = nil
+          seen_tokens = {}
+
+          MAX_PRICING_PAGES.times do
+            body = pricing_request(service_code:, filters:, next_token:)
+            uri = URI.join(PRICING_ENDPOINT.to_s, "/")
+            response = JSON.parse(request(
+              uri:,
+              method: :post,
+              service: "pricing",
+              region: PRICING_REGION,
+              credentials:,
+              headers: {
+                "content-type" => "application/x-amz-json-1.1",
+                "x-amz-target" => "AWSPriceListService.GetProducts"
+              },
+              body:
+            ))
+            products.concat(response.fetch("PriceList").map { |value| JSON.parse(value) })
+            next_token = response["NextToken"]
+            break if next_token.to_s.empty?
+            raise ProviderError, "AWS pricing pagination repeated a token" if seen_tokens[next_token]
+
+            seen_tokens[next_token] = true
+          end
+          raise ProviderError, "AWS pricing exceeded #{MAX_PRICING_PAGES} pages" unless next_token.to_s.empty?
+
+          products
+        rescue HTTPError => error
+          raise unless error.status == 400 && error.body.to_s.include?("InvalidParameter")
+
+          []
+        end
+
+        def pricing_filters(field, value)
+          [
+            {"Type" => "TERM_MATCH", "Field" => "regionCode", "Value" => @region},
+            {"Type" => "TERM_MATCH", "Field" => field, "Value" => value}
+          ]
+        end
+
+        def pricing_request(service_code:, filters:, next_token:)
+          request = {
+            "ServiceCode" => service_code,
+            "FormatVersion" => "aws_v1",
+            "MaxResults" => MAX_RESULTS,
+            "Filters" => filters
+          }
+          request["NextToken"] = next_token if next_token
+          JSON.generate(request)
+        end
+
+        def request(uri:, service:, region:, credentials:, method: :get, headers: {}, body: "")
+          signed_headers = AwsSigV4.new(service:, region:, credentials:, clock: @clock)
+            .headers(method:, uri:, headers:, body:)
+          @http_client.request(uri:, method:, headers: signed_headers, body: (body unless body.empty?))
+        end
+
+        def records(models, products, target:)
+          models.to_h do |model|
+            model_id = model.fetch("modelId")
+            selected_id = target&.model_id || model_id
+            pricing = normalized_prices(products, selected_id)
+            attributes = {
+              available: true,
+              input_modalities: model["inputModalities"]&.map(&:downcase),
+              output_modalities: model["outputModalities"]&.map(&:downcase),
+              pricing:
+            }.compact
+            provenance = attributes.keys.to_h { |key| [key, (key == :pricing) ? "aws_pricing" : name] }
+            ["#{@provider}:#{selected_id}", attributes.merge(provenance:)]
+          end
+        end
+
+        def normalized_prices(products, model_id)
+          global_pricing = model_id.to_s.match?(/\A(?:global|us|eu|apac)\./)
+          prices = products.each_with_object({}) do |product, result|
+            attributes = product.fetch("product").fetch("attributes")
+            kind = price_kind(attributes, global_pricing:)
+            next unless kind
+
+            dimensions = product.fetch("terms").fetch("OnDemand", {}).values.flat_map do |term|
+              term.fetch("priceDimensions", {}).values
+            end
+            result[kind] ||= normalized_price(dimensions.first) if dimensions.first
+          end
+          prices if prices.key?(:input) && prices.key?(:output)
+        end
+
+        def price_kind(attributes, global_pricing:)
+          value = "#{attributes["usagetype"]} #{attributes["inferenceType"]}".downcase
+          return if value.match?(/batch|priority|flex|reserved|tpm/) || !value.include?("token")
+
+          global = value.match?(/global|cross-region/)
+          return if global_pricing != global
+
+          if value.include?("cache") && value.include?("read")
+            :cache_read
+          elsif value.include?("cache") && value.include?("write")
+            :cache_write
+          elsif value.match?(/(?:\b|_)output(?:token| tokens)/)
+            :output
+          elsif value.match?(/(?:\b|_)input(?:token| tokens)/) && !value.match?(/image|audio|video/)
+            :input
+          end
+        end
+
+        def normalized_price(dimension)
+          amount = Float(dimension.fetch("pricePerUnit").fetch("USD"))
+          unit = dimension.fetch("unit").downcase
+          description = dimension["description"].to_s.downcase
+          if unit.match?(/1m|million/) || description.match?(/(?:1,000,000|million)\s+tokens/)
+            amount
+          elsif unit.match?(/1k|thousand/) || description.match?(/(?:1,000|thousand)\s+tokens/)
+            amount * 1_000
+          elsif unit.include?("token")
+            amount * 1_000_000
+          else
+            raise ArgumentError, "unsupported Bedrock pricing unit #{dimension.fetch("unit")}"
+          end
+        end
+
+        def base_model_id(model_id)
+          model_id.to_s.sub(/\A(?:global|us|eu|apac)\./, "")
+        end
+      end
+    end
+  end
+end

data/lib/little_ghost/providers/bedrock/credential_resolver.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "uri"
+
+module LittleGhost
+  module Providers
+    class Bedrock < Base
+      Credentials = Data.define(:access_key_id, :secret_access_key, :session_token, :expiration) do # :nodoc:
+        def initialize(access_key_id:, secret_access_key:, session_token: nil, expiration: nil)
+          raise CredentialError, "AWS access key ID and secret access key are required" if access_key_id.to_s.empty? || secret_access_key.to_s.empty?
+
+          super(access_key_id: access_key_id.to_s, secret_access_key: secret_access_key.to_s,
+                session_token: session_token&.to_s, expiration: expiration && Time.parse(expiration.to_s))
+        end
+      end
+
+      # Resolves common AWS credentials without depending on an AWS SDK.
+      class CredentialResolver
+        # Uses +environment+ and the selected shared-credentials +profile+.
+        def initialize(environment: ENV, profile: nil, credentials_file: nil)
+          @environment = environment
+          @profile = profile || environment["AWS_PROFILE"] || "default"
+          @credentials_file = credentials_file || environment["AWS_SHARED_CREDENTIALS_FILE"] || File.expand_path("~/.aws/credentials")
+        end
+
+        # Returns the first complete credential set from the environment,
+        # shared credentials, container metadata, or IMDSv2.
+        def call
+          from_environment || from_profile || from_container || from_instance_metadata ||
+            raise(CredentialError, "No AWS credentials were found in the environment, selected shared profile, container credentials, or IMDSv2")
+        end
+
+        # Returns the configured AWS region, when one can be resolved.
+        def region
+          @environment["AWS_REGION"] || @environment["AWS_DEFAULT_REGION"] || profile_values(config_file)["region"]
+        end
+
+        private
+
+        def from_environment
+          key = @environment["AWS_ACCESS_KEY_ID"]
+          secret = @environment["AWS_SECRET_ACCESS_KEY"]
+          return unless key && secret
+
+          Credentials.new(access_key_id: key, secret_access_key: secret, session_token: @environment["AWS_SESSION_TOKEN"])
+        end
+
+        def from_profile
+          values = profile_values(@credentials_file)
+          return unless values["aws_access_key_id"] && values["aws_secret_access_key"]
+
+          Credentials.new(access_key_id: values["aws_access_key_id"], secret_access_key: values["aws_secret_access_key"],
+            session_token: values["aws_session_token"])
+        end
+
+        def from_container
+          relative = @environment["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"]
+          full = @environment["AWS_CONTAINER_CREDENTIALS_FULL_URI"]
+          return unless relative || full
+
+          uri = relative ? URI("http://169.254.170.2#{relative}") : URI(full)
+          allowed = uri.host == "169.254.170.2" || %w[127.0.0.1 ::1 localhost].include?(uri.host)
+          raise CredentialError, "AWS container credential endpoint is not an allowed local address" unless allowed && uri.scheme == "http"
+
+          headers = {}
+          token = @environment["AWS_CONTAINER_AUTHORIZATION_TOKEN"]
+          token_file = @environment["AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE"]
+          token ||= File.read(token_file).strip if token_file && File.file?(token_file)
+          headers["Authorization"] = token if token
+          credential_json(http_client.request(uri:, headers:, allow_insecure_http: true))
+        end
+
+        def from_instance_metadata
+          return if @environment["AWS_EC2_METADATA_DISABLED"].to_s.casecmp?("true")
+
+          base = URI("http://169.254.169.254/latest/")
+          token = http_client.request(uri: URI.join(base, "api/token"), method: :put,
+            headers: {"X-aws-ec2-metadata-token-ttl-seconds" => "21600"}, allow_insecure_http: true)
+          headers = {"X-aws-ec2-metadata-token" => token}
+          role = http_client.request(uri: URI.join(base, "meta-data/iam/security-credentials/"), headers:,
+            allow_insecure_http: true).strip
+          return if role.empty?
+
+          credential_json(http_client.request(
+            uri: URI.join(base, "meta-data/iam/security-credentials/#{URI.encode_www_form_component(role)}"),
+            headers:,
+            allow_insecure_http: true
+          ))
+        rescue HTTPError
+          nil
+        end
+
+        def credential_json(body)
+          value = JSON.parse(body)
+          Credentials.new(access_key_id: value.fetch("AccessKeyId"), secret_access_key: value.fetch("SecretAccessKey"),
+            session_token: value["Token"], expiration: value["Expiration"])
+        rescue JSON::ParserError, KeyError => error
+          raise CredentialError, "AWS credential endpoint returned an invalid response: #{error.message}"
+        end
+
+        def profile_values(path)
+          return {} unless path && File.file?(path)
+
+          section = nil
+          File.foreach(path).each_with_object({}) do |line, result|
+            stripped = line.strip
+            if (match = stripped.match(/\A\[([^\]]+)\]\z/))
+              section = match[1].sub(/\Aprofile\s+/, "")
+            elsif section == @profile && (match = stripped.match(/\A([^#;=]+?)\s*=\s*(.*?)\s*\z/))
+              result[match[1].strip] = match[2]
+            end
+          end
+        end
+
+        def config_file = @environment["AWS_CONFIG_FILE"] || File.expand_path("~/.aws/config")
+
+        def http_client = Support::HTTPClient.new(open_timeout: 1, read_timeout: 1, max_response_bytes: 1024 * 1024)
+      end
+    end
+  end
+end

data/lib/little_ghost/providers/bedrock/http_client.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+
+module LittleGhost
+  module Providers
+    class Bedrock < Base
+      # Stdlib Bedrock Runtime client with the small ConverseStream surface used by
+      # the adapter.
+      class HTTPClient # :nodoc:
+        Response = Data.define(:stream)
+        DEFAULT_MAX_RESPONSE_BYTES = 256 * 1024 * 1024
+
+        def initialize(region:, credentials: nil, credential_resolver: nil, endpoint: nil,
+          open_timeout: 10, read_timeout: 120, max_response_bytes: DEFAULT_MAX_RESPONSE_BYTES,
+          max_frame_bytes: EventStreamDecoder::DEFAULT_MAX_FRAME_BYTES, clock: -> { Time.now.utc })
+          @region = region.to_s
+          raise ConfigurationError, "Bedrock region is required" if @region.empty?
+
+          @credential_resolver = credential_resolver || -> { credentials || CredentialResolver.new.call }
+          @endpoint = URI(endpoint || "https://bedrock-runtime.#{@region}.amazonaws.com")
+          raise ConfigurationError, "Bedrock endpoint must use HTTPS" unless @endpoint.scheme == "https"
+
+          @max_frame_bytes = Integer(max_frame_bytes)
+          @clock = clock
+          @http_client = Support::HTTPClient.new(open_timeout:, read_timeout:, max_response_bytes:)
+        end
+
+        def converse_stream(**parameters)
+          model_id = parameters.delete(:model_id)
+          body = JSON.generate(camelize(parameters))
+          uri = URI.join(@endpoint.to_s, "/model/#{escape_path(model_id)}/converse-stream")
+          credentials = @credential_resolver.call
+          signer = AwsSigV4.new(service: "bedrock", region: @region, credentials:, clock: @clock)
+          headers = signer.headers(method: :post, uri:, headers: {"content-type" => "application/json"}, body:)
+          stream = Enumerator.new do |events|
+            decoder = EventStreamDecoder.new(max_frame_bytes: @max_frame_bytes)
+            @http_client.each_chunk(uri:, method: :post, headers:, body:, label: "Bedrock request") do |chunk|
+              decoder.<<(chunk).each { |event_headers, payload| events << event(event_headers, payload) }
+            end
+            decoder.finish
+          end
+          Response.new(stream:)
+        end
+
+        private
+
+        def event(headers, payload)
+          value = payload.empty? ? {} : JSON.parse(payload)
+          type = headers[":event-type"] || headers[":exception-type"]
+          {type.to_s.gsub(/([a-z])([A-Z])/, "\\1_\\2").downcase.to_sym => symbolize(value)}
+        rescue JSON::ParserError => error
+          raise ProtocolError, "Bedrock returned invalid event JSON: #{error.message}"
+        end
+
+        def camelize(value)
+          case value
+          when Hash
+            value.to_h { |key, child| [key.to_s.gsub(/_([a-z])/) { Regexp.last_match(1).upcase }, camelize(child)] }
+          when Array then value.map { |child| camelize(child) }
+          else value
+          end
+        end
+
+        def symbolize(value)
+          case value
+          when Hash then value.to_h { |key, child| [key.to_sym, symbolize(child)] }
+          when Array then value.map { |child| symbolize(child) }
+          else value
+          end
+        end
+
+        def escape_path(value) = URI.encode_www_form_component(value.to_s).gsub("+", "%20")
+      end
+    end
+  end
+end

data/lib/little_ghost/providers/bedrock.rb

@@ -1,10 +1,14 @@
 # frozen_string_literal: true
 
 require "json"
+require_relative "bedrock/credential_resolver"
+require_relative "bedrock/aws_protocol"
+require_relative "bedrock/http_client"
+require_relative "bedrock/catalog_source"
 
 module LittleGhost
   # Provider adapters translate model APIs into LittleGhost's shared streaming
-  # request and response types. Agents select them through a ModelRegistry rather
+  # request and response types. Agents select them through model configuration rather
   # than depending on a provider class directly.
   module Providers
     # Bedrock lets LittleGhost agents use models available through Amazon Bedrock
@@ -16,14 +20,18 @@ module LittleGhost
     #     region: ENV.fetch("AWS_REGION")
     #   )
     #
-    # The default client requires the optional +aws-sdk-bedrockruntime+ gem and
-    # uses the AWS SDK credential chain. Applications may inject +client+
-    # instead.
+    # The default client uses LittleGhost's standard-library SigV4 and AWS
+    # EventStream implementations. Applications may inject +client+ instead.
     #
     # Transient service and stream failures retry with exponential backoff. Each
     # retry emits +:model_retry+ and reports whether partial text was already
     # emitted, allowing stream consumers to handle repeated output deliberately.
-    class Bedrock
+    class Bedrock < Base
+      # Request policy supported by Bedrock retries and its built-in HTTP client.
+      def self.request_options
+        %i[max_response_bytes max_retries open_timeout read_timeout].freeze
+      end
+
       INITIAL_RETRY_DELAY = 1 # :nodoc:
       MAX_RETRY_DELAY = 16 # :nodoc:
       TRANSIENT_STREAM_ERRORS = %w[
@@ -54,9 +62,9 @@ module LittleGhost
 
       # Configures Bedrock for +model+.
       #
-      # +region+ and remaining +client_options+ configure the default AWS client.
+      # +region+ and remaining +client_options+ configure the built-in HTTP client.
       # +max_retries+, +sleeper+, and +on_retry+ control retry behavior. Injecting
-      # +client+ bypasses creation of the optional SDK client.
+      # +client+ bypasses creation of the built-in HTTP client.
       def initialize(model:, region: nil, client: nil, max_retries: 2, sleeper: nil,
         on_retry: ->(*) {}, **client_options)
         @model = model
@@ -142,11 +150,10 @@ module LittleGhost
       private
 
       def build_client(region:, **options)
-        require "aws-sdk-bedrockruntime"
-        Aws::BedrockRuntime::Client.new(**options, **({region:} if region))
-      rescue LoadError
-        raise ConfigurationError,
-          "Bedrock requires the optional aws-sdk-bedrockruntime gem; add it to your application's Gemfile"
+        resolver = options.delete(:credential_resolver)
+        resolver ||= CredentialResolver.new
+        region ||= resolver.region if resolver.is_a?(CredentialResolver)
+        HTTPClient.new(region:, credential_resolver: resolver, **options)
       end
 
       def request_parameters(request)
@@ -234,7 +241,9 @@ module LittleGhost
           {
             tool_result: {
               tool_use_id: block.tool_use_id,
-              content: Array(block.content).map { |content| {text: content.respond_to?(:text) ? content.text : content.to_s} },
+              content: Array(block.content).map do |content|
+                {text: content.is_a?(Content::Text) ? content.text : content.to_s}
+              end,
               status: block.status.to_s
             }
           }
@@ -301,8 +310,7 @@ module LittleGhost
       end
 
       def event_hash(event)
-        value = event.respond_to?(:to_h) ? event.to_h : event
-        deep_stringify(value)
+        deep_stringify(event.to_h)
       end
 
       def deep_stringify(value)