@ai-sdk/amazon-bedrock 5.0.127 → 5.0.129

package/src/amazon-bedrock-sigv4-fetch.ts

@@ -1,5 +1,8 @@
+import { LoadAPIKeyError } from '@ai-sdk/provider';
 import {
   combineHeaders,
+  resolve,
+  type Resolvable,
   normalizeHeaders,
   withUserAgentSuffix,
   getRuntimeEnvironmentUserAgent,
@@ -124,7 +127,7 @@ function isAscii(value: string): boolean {
  * @returns A FetchFunction that adds Authorization header with Bearer token to requests.
  */
 export function createApiKeyFetchFunction(
-  apiKey: string,
+  apiKey: Resolvable<string>,
   fetch?: FetchFunction,
 ): FetchFunction {
   return async (
@@ -140,8 +143,18 @@ export function createApiKeyFetchFunction(
       getRuntimeEnvironmentUserAgent(),
     );
 
+    const resolvedApiKey = await resolve(apiKey);
+    if (
+      typeof apiKey !== 'string' &&
+      (typeof resolvedApiKey !== 'string' || !resolvedApiKey.trim())
+    ) {
+      throw new LoadAPIKeyError({
+        message: 'Amazon Bedrock API key must be a non-empty string.',
+      });
+    }
+
     const finalHeaders = combineHeaders(headersWithUserAgent, {
-      Authorization: `Bearer ${apiKey}`,
+      Authorization: `Bearer ${typeof apiKey === 'string' ? resolvedApiKey : resolvedApiKey.trim()}`,
     });
 
     return effectiveFetch(input, {

package/src/anthropic/amazon-bedrock-anthropic-provider.ts

@@ -88,10 +88,11 @@ export interface AmazonBedrockAnthropicProviderSettings {
 
   /**
    * API key for authenticating requests using Bearer token authentication.
+   * A callback is resolved before each request and must return a non-empty key.
    * When provided, this will be used instead of AWS SigV4 authentication.
    * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.
    */
-  apiKey?: string;
+  apiKey?: Resolvable<string>;
 
   /**
    * The AWS access key ID to use for the Bedrock provider. Defaults to the value of the
@@ -147,14 +148,17 @@ export function createAmazonBedrockAnthropic(
   options: AmazonBedrockAnthropicProviderSettings = {},
 ): AmazonBedrockAnthropicProvider {
   // Check for API key authentication first
-  const rawApiKey = loadOptionalSetting({
-    settingValue: options.apiKey,
-    environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
-  });
+  const rawApiKey =
+    typeof options.apiKey === 'string' || options.apiKey == null
+      ? loadOptionalSetting({
+          settingValue: options.apiKey,
+          environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
+        })
+      : options.apiKey;
 
   // Only use API key if it's a non-empty, non-whitespace string
   const apiKey =
-    rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : undefined;
+    typeof rawApiKey === 'string' ? rawApiKey.trim() || undefined : rawApiKey;
 
   // Use API key authentication if available, otherwise fall back to SigV4
   const baseFetchFunction = apiKey

package/src/mantle/bedrock-mantle-provider.ts

@@ -15,6 +15,7 @@ import {
   withoutTrailingSlash,
   withUserAgentSuffix,
   type FetchFunction,
+  type Resolvable,
 } from '@ai-sdk/provider-utils';
 import {
   createApiKeyFetchFunction,
@@ -66,10 +67,11 @@ export interface BedrockMantleProviderSettings {
 
   /**
    * API key for authenticating requests using Bearer token authentication.
+   * A callback is resolved before each request and must return a non-empty key.
    * When provided, this will be used instead of AWS SigV4 authentication.
    * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.
    */
-  apiKey?: string;
+  apiKey?: Resolvable<string>;
 
   /**
    * The AWS access key ID to use for SigV4 authentication. Defaults to the value of the
@@ -125,14 +127,17 @@ export function createBedrockMantle(
   options: BedrockMantleProviderSettings = {},
 ): BedrockMantleProvider {
   // Check for API key authentication first
-  const rawApiKey = loadOptionalSetting({
-    settingValue: options.apiKey,
-    environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
-  });
+  const rawApiKey =
+    typeof options.apiKey === 'string' || options.apiKey == null
+      ? loadOptionalSetting({
+          settingValue: options.apiKey,
+          environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
+        })
+      : options.apiKey;
 
   // Only use API key if it's a non-empty, non-whitespace string
   const apiKey =
-    rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : undefined;
+    typeof rawApiKey === 'string' ? rawApiKey.trim() || undefined : rawApiKey;
 
   // Use API key authentication if available, otherwise fall back to SigV4
   const fetchFunction = apiKey