ruby_llm 1.15.0 → 2.0.0.rc1

data/lib/ruby_llm/providers/bedrock/auth.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'digest'
+require 'json'
 require 'openssl'
 
 module RubyLLM
@@ -8,38 +9,10 @@ module RubyLLM
     class Bedrock
       # SigV4 authentication helpers for Bedrock.
       module Auth
-        private
-
-        def signed_post(connection, url, payload, additional_headers = {})
-          request_payload = api_payload(payload)
-          body = JSON.generate(request_payload)
-          signed_headers = sign_headers('POST', url, body)
-
-          response = connection.post(url, request_payload) do |req|
-            req.headers.merge!(signed_headers)
-            req.headers.merge!(additional_headers) unless additional_headers.empty?
-            yield req if block_given?
-          end
-
-          parse_completion_response(response)
-        end
-
-        def signed_get(base_url, url)
-          conn = Connection.basic do |f|
-            f.request :json
-            f.response :json
-            f.adapter :net_http
-            f.use :llm_errors, provider: self
-          end
-
-          conn.url_prefix = base_url
-
-          conn.get(url) do |req|
-            req.headers.merge!(sign_headers('GET', url, '', base_url: base_url))
-          end
-        end
+        Credentials = Struct.new(:access_key_id, :secret_access_key, :session_token, keyword_init: true)
 
-        def sign_headers(method, path, body, base_url: api_base)
+        def sign_headers(method, path, body, base_url: api_base, service: 'bedrock')
+          credentials = bedrock_credentials
           now = Time.now.utc
           amz_date = now.strftime('%Y%m%dT%H%M%SZ')
           date_stamp = now.strftime('%Y%m%d')
@@ -54,7 +27,7 @@ module RubyLLM
             'x-amz-content-sha256' => payload_hash,
             'x-amz-date' => amz_date
           }
-          headers['x-amz-security-token'] = @config.bedrock_session_token if @config.bedrock_session_token
+          headers['x-amz-security-token'] = credentials.session_token if credentials.session_token
 
           signed_headers = headers.keys.sort.join(';')
           canonical_headers = headers.keys.sort.map { |key| "#{key}:#{headers[key].to_s.strip}\n" }.join
@@ -68,7 +41,7 @@ module RubyLLM
             payload_hash
           ].join("\n")
 
-          credential_scope = "#{date_stamp}/#{bedrock_region}/bedrock/aws4_request"
+          credential_scope = "#{date_stamp}/#{bedrock_region}/#{service}/aws4_request"
           string_to_sign = [
             'AWS4-HMAC-SHA256',
             amz_date,
@@ -76,25 +49,55 @@ module RubyLLM
             Digest::SHA256.hexdigest(canonical_request)
           ].join("\n")
 
-          signing_key = signing_key(date_stamp)
+          signing_key = signing_key(date_stamp, credentials.secret_access_key, service)
           signature = OpenSSL::HMAC.hexdigest('sha256', signing_key, string_to_sign)
 
           {
             'X-Amz-Date' => amz_date,
             'X-Amz-Content-Sha256' => payload_hash,
-            'X-Amz-Security-Token' => @config.bedrock_session_token,
-            'Authorization' => "AWS4-HMAC-SHA256 Credential=#{@config.bedrock_api_key}/#{credential_scope}, " \
+            'X-Amz-Security-Token' => credentials.session_token,
+            'Authorization' => "AWS4-HMAC-SHA256 Credential=#{credentials.access_key_id}/#{credential_scope}, " \
                                "SignedHeaders=#{signed_headers}, Signature=#{signature}",
             'Content-Type' => 'application/json'
           }.compact
         end
 
+        def signed_get(base_url, url, service: 'bedrock')
+          signed_request(:get, base_url, url, service:)
+        end
+
+        def signed_post(base_url, url, payload)
+          body = JSON.generate(payload)
+          signed_request(:post, base_url, url, body:, payload:)
+        end
+
+        private
+
+        def signed_request(method, base_url, url, **options)
+          body = options.fetch(:body, '')
+          payload = options[:payload]
+          service = options.fetch(:service, 'bedrock')
+          conn = Transport::Connection.basic(@config) do |f|
+            f.request :json
+            f.response :json
+            f.adapter :net_http
+            f.use :llm_errors, provider: self
+          end
+
+          conn.url_prefix = base_url
+
+          conn.public_send(method, url, payload) do |req|
+            req.headers.merge!(sign_headers(method.to_s.upcase, url, body, base_url:, service:))
+          end
+        end
+
         def canonical_query_string(raw_query)
           return '' if raw_query.nil? || raw_query.empty?
 
           URI.decode_www_form(raw_query)
-             .sort_by(&:first)
-             .map { |k, v| "#{uri_encode(k)}=#{uri_encode(v)}" }
+             .map { |key, value| [uri_encode(key), uri_encode(value)] }
+             .sort
+             .map { |key, value| "#{key}=#{value}" }
              .join('&')
         end
 
@@ -110,10 +113,27 @@ module RubyLLM
           URI.encode_www_form_component(text.to_s).gsub('+', '%20').gsub('%7E', '~')
         end
 
-        def signing_key(date_stamp)
-          k_date = OpenSSL::HMAC.digest('sha256', "AWS4#{@config.bedrock_secret_key}", date_stamp)
+        def bedrock_credentials
+          provider = @config.bedrock_credential_provider
+          if provider
+            unless provider.respond_to?(:credentials)
+              raise ConfigurationError, 'bedrock_credential_provider must respond to #credentials'
+            end
+
+            return provider.credentials
+          end
+
+          Credentials.new(
+            access_key_id: @config.bedrock_api_key,
+            secret_access_key: @config.bedrock_secret_key,
+            session_token: @config.bedrock_session_token
+          )
+        end
+
+        def signing_key(date_stamp, secret_access_key, service = 'bedrock')
+          k_date = OpenSSL::HMAC.digest('sha256', "AWS4#{secret_access_key}", date_stamp)
           k_region = OpenSSL::HMAC.digest('sha256', k_date, bedrock_region)
-          k_service = OpenSSL::HMAC.digest('sha256', k_region, 'bedrock')
+          k_service = OpenSSL::HMAC.digest('sha256', k_region, service)
           OpenSSL::HMAC.digest('sha256', k_service, 'aws4_request')
         end
       end

data/lib/ruby_llm/providers/bedrock/capabilities.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module RubyLLM
+  module Providers
+    class Bedrock
+      # Feature capability gaps not represented in upstream model catalogs.
+      module Capabilities
+        TOOL_CHOICE_MODELS = %w[amazon.nova-2-lite-v1:0 us.amazon.nova-2-lite-v1:0].freeze
+
+        def self.augment(capabilities, model_id:, **)
+          return capabilities unless TOOL_CHOICE_MODELS.include?(model_id)
+
+          capabilities | ['tool_choice']
+        end
+      end
+    end
+  end
+end

data/lib/ruby_llm/providers/bedrock/mantle/anthropic.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module RubyLLM
+  module Providers
+    class Bedrock
+      module Mantle
+        # The Anthropic Messages API on the bedrock-mantle endpoint, which
+        # serves Claude generations from Opus 4.7 onward.
+        class Anthropic < Protocols::Anthropic
+          include Mantle
+
+          ANTHROPIC_VERSION = '2023-06-01'
+
+          def completion_url
+            'anthropic/v1/messages'
+          end
+
+          def count_tokens_url
+            'anthropic/v1/messages/count_tokens'
+          end
+
+          def supports_provider_file_references?
+            false
+          end
+
+          private
+
+          def post_count_tokens(payload)
+            signed_post(count_tokens_url, payload)
+          end
+
+          def mantle_headers(url, body)
+            super.merge('anthropic-version' => ANTHROPIC_VERSION)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ruby_llm/providers/bedrock/mantle/chat_completions.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module RubyLLM
+  module Providers
+    class Bedrock
+      module Mantle
+        # The OpenAI Chat Completions API on the bedrock-mantle endpoint,
+        # which serves most of mantle's non-Claude catalog.
+        class ChatCompletions < Protocols::ChatCompletions
+          include Mantle
+
+          def completion_url
+            'v1/chat/completions'
+          end
+
+          def supports_provider_file_references?
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ruby_llm/providers/bedrock/mantle/responses.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module RubyLLM
+  module Providers
+    class Bedrock
+      module Mantle
+        # The OpenAI Responses API on the bedrock-mantle endpoint, which
+        # serves every non-Claude model mantle hosts: OpenAI, Qwen, Mistral,
+        # DeepSeek, and the rest.
+        class Responses < Protocols::Responses
+          include Mantle
+
+          def completion_url
+            'v1/responses'
+          end
+
+          def supports_provider_file_references?
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ruby_llm/providers/bedrock/mantle/voxtral.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+module RubyLLM
+  module Providers
+    class Bedrock
+      module Mantle
+        # Voxtral transcription through Mantle's audio-capable Chat Completions API.
+        class Voxtral < ChatCompletions
+          def transcribe(audio_file, model:, language:, format: nil, speaker_names: nil,
+                         speaker_references: nil, provider_options: {}, prompt: nil, temperature: nil, &block)
+            validate_transcription_options(format:, speaker_names:, speaker_references:)
+
+            track_usage(:transcription) do
+              payload = render_transcription_payload(audio_file, model:, language:, prompt:, temperature:,
+                                                                 provider_options:)
+              next stream_transcription(payload, model:, &block) if block
+
+              parse_transcription_response(signed_post(completion_url, payload), model:)
+            end
+          end
+
+          def render_transcription_options(timestamps:, **)
+            return {} if timestamps.nil?
+
+            raise ArgumentError, 'Bedrock Voxtral does not return timestamps'
+          end
+
+          private
+
+          def stream_transcription(payload, model:)
+            payload = Support::Utils.deep_merge(payload, stream: true, stream_options: { include_usage: true })
+            message = stream_response(payload) do |chunk|
+              @usage_tracker.observe(chunk) if chunk.tokens.input || chunk.tokens.output
+              next if chunk.content.to_s.empty?
+
+              yield RubyLLM::TranscriptionChunk.new(type: RubyLLM::TranscriptionChunk::DELTA, delta: chunk.content)
+            end
+            unless message.finish_reason == :stop
+              raise Error.new('Bedrock Voxtral did not complete the transcript', response: message.raw)
+            end
+
+            result = RubyLLM::Transcription.new(text: message.content.to_s, model: message.model || model)
+            yield RubyLLM::TranscriptionChunk.new(type: RubyLLM::TranscriptionChunk::DONE, text: result.text)
+            tokens = message.tokens
+            tokens = Tokens.new if tokens.input.nil? && tokens.output.nil?
+            @usage_tracker.succeed_attempts(tokens: [tokens])
+            result
+          end
+
+          def validate_transcription_options(format:, speaker_names:, speaker_references:)
+            unless format.nil? || %w[text text/plain].include?(format)
+              raise ArgumentError, 'Bedrock Voxtral returns plain text transcripts'
+            end
+            return unless speaker_names || speaker_references
+
+            raise ArgumentError, 'Bedrock Voxtral does not return speaker labels or timestamps'
+          end
+
+          def render_transcription_payload(audio_file, model:, language:, prompt:, temperature:, provider_options:)
+            attachments = Attachment.wrap(audio_file, config: @config)
+            raise ArgumentError, 'Transcription requires exactly one audio file' unless attachments.one?
+
+            attachment = attachments.first
+            unless attachment.audio? && %w[mp3 wav].include?(attachment.format)
+              raise UnsupportedAttachmentError, attachment.mime_type
+            end
+
+            content = [
+              Protocols::ChatCompletions::Media.format_audio(attachment),
+              { type: 'text', text: transcription_prompt(prompt, language) }
+            ]
+            payload = { model:, messages: [{ role: 'user', content: }], temperature: temperature || 0 }
+            Support::Utils.deep_merge(payload, provider_options)
+          end
+
+          def transcription_prompt(prompt, language)
+            [
+              'Transcribe the audio verbatim. Return only the transcript text.',
+              ("The audio language is #{language}." if language),
+              prompt
+            ].compact.join(' ')
+          end
+
+          def parse_transcription_response(response, model:)
+            data = response.body
+            text = data.dig('choices', 0, 'message', 'content')
+            raise Error.new('Bedrock returned no transcript', response:) unless text.is_a?(String)
+
+            RubyLLM::Transcription.new(text:, model: data['model'] || model,
+                                       **transcription_tokens(data['usage'] || {}))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ruby_llm/providers/bedrock/mantle.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module RubyLLM
+  module Providers
+    class Bedrock
+      # Shared plumbing for protocols served by the bedrock-mantle endpoint.
+      # Mantle speaks the vendors' own wire formats rather than Converse, so
+      # each protocol subclasses its family and mixes this in to borrow the
+      # provider's mantle connection and SigV4-sign every request for the
+      # bedrock-mantle service.
+      module Mantle
+        SIGNING_SERVICE = 'bedrock-mantle'
+
+        # Mantle serves Claude on the Anthropic Messages API and everything
+        # else on one of the two OpenAI surfaces. Only these models answer on
+        # v1/responses; the rest of the non-Claude catalog answers on
+        # v1/chat/completions and rejects v1/responses outright.
+        RESPONSES_MODELS = %w[
+          google.gemma-4-26b-a4b
+          google.gemma-4-31b
+          google.gemma-4-e2b
+          openai.gpt-oss-20b
+          openai.gpt-oss-120b
+        ].freeze
+
+        def initialize(provider, model = nil)
+          super
+          @connection = provider.mantle_connection
+        end
+
+        private
+
+        def sync_response(payload, additional_headers = {})
+          parse_completion_response signed_post(completion_url, payload, additional_headers)
+        end
+
+        def signed_post(url, payload, additional_headers = {})
+          body = JSON.generate(payload)
+
+          @connection.post(url, payload, usage: @usage_tracker) do |req|
+            req.headers.merge!(mantle_headers(url, body))
+            req.headers.merge!(additional_headers) unless additional_headers.empty?
+          end
+        end
+
+        def stream_response(payload, additional_headers = {}, &)
+          body = JSON.generate(payload)
+          super(payload, mantle_headers(stream_url, body).merge(additional_headers), &)
+        end
+
+        def mantle_headers(url, body)
+          @provider.sign_headers('POST', url, body, base_url: @provider.mantle_api_base, service: SIGNING_SERVICE)
+        end
+      end
+    end
+  end
+end