@ai-sdk/amazon-bedrock 5.0.128 → 5.0.129

package/dist/mantle/index.cjs

@@ -4,7 +4,7 @@ let _ai_sdk_provider = require("@ai-sdk/provider");
 let _ai_sdk_provider_utils = require("@ai-sdk/provider-utils");
 let aws4fetch = require("aws4fetch");
 //#region src/version.ts
-const VERSION = "5.0.128";
+const VERSION = "5.0.129";
 //#endregion
 //#region src/amazon-bedrock-sigv4-fetch.ts
 /**
@@ -73,7 +73,9 @@ function createApiKeyFetchFunction(apiKey, fetch) {
 		const effectiveFetch = fetch ?? globalThis.fetch;
 		const originalHeaders = (0, _ai_sdk_provider_utils.normalizeHeaders)(init?.headers);
 		const headersWithUserAgent = (0, _ai_sdk_provider_utils.withUserAgentSuffix)(originalHeaders, `ai-sdk-amazon-bedrock/${VERSION}`, (0, _ai_sdk_provider_utils.getRuntimeEnvironmentUserAgent)());
-		const finalHeaders = (0, _ai_sdk_provider_utils.combineHeaders)(headersWithUserAgent, { Authorization: `Bearer ${apiKey}` });
+		const resolvedApiKey = await (0, _ai_sdk_provider_utils.resolve)(apiKey);
+		if (typeof apiKey !== "string" && (typeof resolvedApiKey !== "string" || !resolvedApiKey.trim())) throw new _ai_sdk_provider.LoadAPIKeyError({ message: "Amazon Bedrock API key must be a non-empty string." });
+		const finalHeaders = (0, _ai_sdk_provider_utils.combineHeaders)(headersWithUserAgent, { Authorization: `Bearer ${typeof apiKey === "string" ? resolvedApiKey : resolvedApiKey.trim()}` });
 		return effectiveFetch(input, {
 			...init,
 			headers: finalHeaders
@@ -88,11 +90,11 @@ function createApiKeyFetchFunction(apiKey, fetch) {
 * only available through the Mantle endpoint (e.g. openai.gpt-oss-20b).
 */
 function createBedrockMantle(options = {}) {
-	const rawApiKey = (0, _ai_sdk_provider_utils.loadOptionalSetting)({
+	const rawApiKey = typeof options.apiKey === "string" || options.apiKey == null ? (0, _ai_sdk_provider_utils.loadOptionalSetting)({
 		settingValue: options.apiKey,
 		environmentVariableName: "AWS_BEARER_TOKEN_BEDROCK"
-	});
-	const apiKey = rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : void 0;
+	}) : options.apiKey;
+	const apiKey = typeof rawApiKey === "string" ? rawApiKey.trim() || void 0 : rawApiKey;
 	const fetchFunction = apiKey ? createApiKeyFetchFunction(apiKey, options.fetch) : createSigV4FetchFunction(async () => {
 		const region = (0, _ai_sdk_provider_utils.loadSetting)({
 			settingValue: options.region,

package/dist/mantle/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["combineHeaders","normalizeHeaders","withUserAgentSuffix","getRuntimeEnvironmentUserAgent","AwsV4Signer","loadOptionalSetting","loadSetting","withoutTrailingSlash","isValidHostnamePart","InvalidArgumentError","withUserAgentSuffix","OpenAIChatLanguageModel","OpenAIResponsesLanguageModel","NoSuchModelError"],"sources":["../../src/version.ts","../../src/amazon-bedrock-sigv4-fetch.ts","../../src/mantle/bedrock-mantle-provider.ts"],"sourcesContent":["// Version string of this package injected at build time.\ndeclare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import {\n  combineHeaders,\n  normalizeHeaders,\n  withUserAgentSuffix,\n  getRuntimeEnvironmentUserAgent,\n  type FetchFunction,\n} from '@ai-sdk/provider-utils';\nimport { AwsV4Signer } from 'aws4fetch';\nimport { VERSION } from './version';\n\nexport interface AmazonBedrockCredentials {\n  region: string;\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string;\n}\n\n/**\n * Creates a fetch function that applies AWS Signature Version 4 signing.\n *\n * @param getCredentials - Function that returns the AWS credentials to use when signing.\n * @param fetch - Optional original fetch implementation to wrap. Defaults to global fetch.\n * @param service - The AWS service name to use for SigV4 signing scope. Defaults to 'bedrock'.\n * @returns A FetchFunction that signs requests before passing them to the underlying fetch.\n */\nexport function createSigV4FetchFunction(\n  getCredentials: () =>\n    | AmazonBedrockCredentials\n    | PromiseLike<AmazonBedrockCredentials>,\n  fetch?: FetchFunction,\n  service: string = 'bedrock',\n): FetchFunction {\n  return async (\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> => {\n    // avoid caching globalThis.fetch in case it is patched by other libraries\n    const effectiveFetch = fetch ?? globalThis.fetch;\n    const request = input instanceof Request ? input : undefined;\n    const originalHeaders = combineHeaders(\n      normalizeHeaders(request?.headers),\n      normalizeHeaders(init?.headers),\n    );\n    const headersWithUserAgent = withUserAgentSuffix(\n      originalHeaders,\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n      getRuntimeEnvironmentUserAgent(),\n    );\n\n    let effectiveBody: BodyInit | undefined = init?.body ?? undefined;\n    if (effectiveBody === undefined && request && request.body !== null) {\n      try {\n        effectiveBody = await request.clone().text();\n      } catch {}\n    }\n\n    const effectiveMethod = init?.method ?? request?.method;\n\n    if (effectiveMethod?.toUpperCase() !== 'POST' || !effectiveBody) {\n      return effectiveFetch(input, {\n        ...init,\n        headers: headersWithUserAgent as HeadersInit,\n      });\n    }\n\n    const url =\n      typeof input === 'string'\n        ? input\n        : input instanceof URL\n          ? input.href\n          : input.url;\n\n    const body = prepareBodyString(effectiveBody);\n    const credentials = await getCredentials();\n    const signer = new AwsV4Signer({\n      url,\n      method: 'POST',\n      headers: Object.entries(headersWithUserAgent).filter(([, value]) =>\n        isAscii(value),\n      ),\n      body,\n      region: credentials.region,\n      accessKeyId: credentials.accessKeyId,\n      secretAccessKey: credentials.secretAccessKey,\n      sessionToken: credentials.sessionToken,\n      service,\n    });\n\n    const signingResult = await signer.sign();\n    const signedHeaders = normalizeHeaders(signingResult.headers);\n\n    // Use the combined headers directly as HeadersInit\n    const combinedHeaders = combineHeaders(headersWithUserAgent, signedHeaders);\n\n    return effectiveFetch(input, {\n      ...init,\n      body,\n      headers: combinedHeaders as HeadersInit,\n    });\n  };\n}\n\nfunction prepareBodyString(body: BodyInit | undefined): string {\n  if (typeof body === 'string') {\n    return body;\n  } else if (body instanceof Uint8Array) {\n    return new TextDecoder().decode(body);\n  } else if (body instanceof ArrayBuffer) {\n    return new TextDecoder().decode(new Uint8Array(body));\n  } else {\n    return JSON.stringify(body);\n  }\n}\n\nfunction isAscii(value: string): boolean {\n  return !/[\\u0080-\\uffff]/.test(value);\n}\n\n/**\n * Creates a fetch function that applies Bearer token authentication.\n *\n * @param apiKey - The API key to use for Bearer token authentication.\n * @param fetch - Optional original fetch implementation to wrap. Defaults to global fetch.\n * @returns A FetchFunction that adds Authorization header with Bearer token to requests.\n */\nexport function createApiKeyFetchFunction(\n  apiKey: string,\n  fetch?: FetchFunction,\n): FetchFunction {\n  return async (\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> => {\n    // avoid caching globalThis.fetch in case it is patched by other libraries\n    const effectiveFetch = fetch ?? globalThis.fetch;\n    const originalHeaders = normalizeHeaders(init?.headers);\n    const headersWithUserAgent = withUserAgentSuffix(\n      originalHeaders,\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n      getRuntimeEnvironmentUserAgent(),\n    );\n\n    const finalHeaders = combineHeaders(headersWithUserAgent, {\n      Authorization: `Bearer ${apiKey}`,\n    });\n\n    return effectiveFetch(input, {\n      ...init,\n      headers: finalHeaders as HeadersInit,\n    });\n  };\n}\n","import {\n  OpenAIChatLanguageModel,\n  OpenAIResponsesLanguageModel,\n} from '@ai-sdk/openai/internal';\nimport {\n  InvalidArgumentError,\n  NoSuchModelError,\n  type LanguageModelV4,\n  type ProviderV4,\n} from '@ai-sdk/provider';\nimport {\n  isValidHostnamePart,\n  loadOptionalSetting,\n  loadSetting,\n  withoutTrailingSlash,\n  withUserAgentSuffix,\n  type FetchFunction,\n} from '@ai-sdk/provider-utils';\nimport {\n  createApiKeyFetchFunction,\n  createSigV4FetchFunction,\n  type AmazonBedrockCredentials,\n} from '../amazon-bedrock-sigv4-fetch';\nimport type {\n  BedrockMantleChatModelId,\n  BedrockMantleResponsesModelId,\n} from './bedrock-mantle-options';\nimport { VERSION } from '../version';\n\nexport interface BedrockMantleProvider extends ProviderV4 {\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   * Chat Completions has the broadest model support on Mantle.\n   */\n  (modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   */\n  languageModel(modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   */\n  chat(modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Responses API.\n   * Not all Mantle models support this API. Notably, gpt-oss-safeguard models\n   * are Chat-only.\n   */\n  responses(modelId: BedrockMantleResponsesModelId): LanguageModelV4;\n\n  /**\n   * @deprecated Mantle does not support embedding models.\n   */\n  textEmbeddingModel(modelId: string): never;\n}\n\nexport interface BedrockMantleProviderSettings {\n  /**\n   * The AWS region to use for the Bedrock Mantle endpoint. Defaults to the value of the\n   * `AWS_REGION` environment variable.\n   */\n  region?: string;\n\n  /**\n   * API key for authenticating requests using Bearer token authentication.\n   * When provided, this will be used instead of AWS SigV4 authentication.\n   * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.\n   */\n  apiKey?: string;\n\n  /**\n   * The AWS access key ID to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_ACCESS_KEY_ID` environment variable.\n   */\n  accessKeyId?: string;\n\n  /**\n   * The AWS secret access key to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_SECRET_ACCESS_KEY` environment variable.\n   */\n  secretAccessKey?: string;\n\n  /**\n   * The AWS session token to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_SESSION_TOKEN` environment variable.\n   */\n  sessionToken?: string;\n\n  /**\n   * Base URL for the Bedrock Mantle API calls.\n   */\n  baseURL?: string;\n\n  /**\n   * Custom headers to include in the requests.\n   */\n  headers?: Record<string, string | undefined>;\n\n  /**\n   * Custom fetch implementation. You can use it as a middleware to intercept requests,\n   * or to provide a custom fetch implementation for e.g. testing.\n   */\n  fetch?: FetchFunction;\n\n  /**\n   * The AWS credential provider to use for SigV4 authentication to get dynamic\n   * credentials similar to the AWS SDK. Setting a provider here will cause its\n   * credential values to be used instead of the `accessKeyId`, `secretAccessKey`,\n   * and `sessionToken` settings.\n   */\n  credentialProvider?: () => PromiseLike<\n    Omit<AmazonBedrockCredentials, 'region'>\n  >;\n}\n\n/**\n * Create an Amazon Bedrock Mantle provider instance.\n * This provider uses the OpenAI-compatible Mantle API for models that are\n * only available through the Mantle endpoint (e.g. openai.gpt-oss-20b).\n */\nexport function createBedrockMantle(\n  options: BedrockMantleProviderSettings = {},\n): BedrockMantleProvider {\n  // Check for API key authentication first\n  const rawApiKey = loadOptionalSetting({\n    settingValue: options.apiKey,\n    environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',\n  });\n\n  // Only use API key if it's a non-empty, non-whitespace string\n  const apiKey =\n    rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : undefined;\n\n  // Use API key authentication if available, otherwise fall back to SigV4\n  const fetchFunction = apiKey\n    ? createApiKeyFetchFunction(apiKey, options.fetch)\n    : createSigV4FetchFunction(\n        async () => {\n          const region = loadSetting({\n            settingValue: options.region,\n            settingName: 'region',\n            environmentVariableName: 'AWS_REGION',\n            description: 'AWS region',\n          });\n\n          // If a credential provider is provided, use it to get the credentials.\n          if (options.credentialProvider) {\n            try {\n              return {\n                ...(await options.credentialProvider()),\n                region,\n              };\n            } catch (error) {\n              const errorMessage =\n                error instanceof Error ? error.message : String(error);\n              throw new Error(\n                `AWS credential provider failed: ${errorMessage}. ` +\n                  'Please ensure your credential provider returns valid AWS credentials ' +\n                  'with accessKeyId and secretAccessKey properties.',\n              );\n            }\n          }\n\n          try {\n            return {\n              region,\n              accessKeyId: loadSetting({\n                settingValue: options.accessKeyId,\n                settingName: 'accessKeyId',\n                environmentVariableName: 'AWS_ACCESS_KEY_ID',\n                description: 'AWS access key ID',\n              }),\n              secretAccessKey: loadSetting({\n                settingValue: options.secretAccessKey,\n                settingName: 'secretAccessKey',\n                environmentVariableName: 'AWS_SECRET_ACCESS_KEY',\n                description: 'AWS secret access key',\n              }),\n              sessionToken: loadOptionalSetting({\n                settingValue: options.sessionToken,\n                environmentVariableName: 'AWS_SESSION_TOKEN',\n              }),\n            };\n          } catch (error) {\n            const errorMessage =\n              error instanceof Error ? error.message : String(error);\n            if (\n              errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n              errorMessage.includes('accessKeyId')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                  '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                  '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                  '3. Use a credentialProvider function\\n' +\n                  '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            if (\n              errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n              errorMessage.includes('secretAccessKey')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                  'Please ensure both credentials are provided.\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            throw error;\n          }\n        },\n        options.fetch,\n        'bedrock-mantle',\n      );\n\n  const getBaseURL = (modelId: string): string => {\n    const baseURL = withoutTrailingSlash(options.baseURL);\n    if (baseURL != null) {\n      return baseURL;\n    }\n\n    const region = loadSetting({\n      settingValue: options.region,\n      settingName: 'region',\n      environmentVariableName: 'AWS_REGION',\n      description: 'AWS region',\n    });\n    if (!isValidHostnamePart(region)) {\n      throw new InvalidArgumentError({\n        argument: 'region',\n        message:\n          'Invalid AWS region. Expected a single DNS label (letters, digits, and hyphens). Use `baseURL` for custom endpoints.',\n      });\n    }\n\n    return `https://bedrock-mantle.${region}.api.aws/${\n      // Mantle serves these models under its separate OpenAI route.\n      /^(?:openai\\.gpt-(?!oss-)|google\\.gemma-4|xai\\.)/.test(modelId)\n        ? 'openai/v1'\n        : 'v1'\n    }`;\n  };\n\n  const getHeaders = (): Record<string, string | undefined> =>\n    withUserAgentSuffix(\n      options.headers ?? {},\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n    );\n\n  const url = ({ path, modelId }: { path: string; modelId: string }): string =>\n    `${getBaseURL(modelId)}${path}`;\n\n  const createChatModel = (modelId: BedrockMantleChatModelId) =>\n    new OpenAIChatLanguageModel(modelId, {\n      provider: 'bedrock-mantle.chat',\n      url,\n      headers: getHeaders,\n      fetch: fetchFunction,\n    });\n\n  const createResponsesModel = (modelId: BedrockMantleResponsesModelId) =>\n    new OpenAIResponsesLanguageModel(modelId, {\n      provider: 'bedrock-mantle.responses',\n      url,\n      headers: getHeaders,\n      fetch: fetchFunction,\n      supportsWebSearchSourcesInclude: false,\n    });\n\n  const provider = function (modelId: BedrockMantleChatModelId) {\n    if (new.target) {\n      throw new Error(\n        'The Bedrock Mantle model function cannot be called with the new keyword.',\n      );\n    }\n\n    return createChatModel(modelId);\n  };\n\n  provider.specificationVersion = 'v4' as const;\n  provider.languageModel = createChatModel;\n  provider.chat = createChatModel;\n  provider.responses = createResponsesModel;\n\n  provider.embeddingModel = (modelId: string) => {\n    throw new NoSuchModelError({ modelId, modelType: 'embeddingModel' });\n  };\n  provider.textEmbeddingModel = provider.embeddingModel;\n  provider.imageModel = (modelId: string) => {\n    throw new NoSuchModelError({ modelId, modelType: 'imageModel' });\n  };\n\n  return provider as BedrockMantleProvider;\n}\n\n/**\n * Default Bedrock Mantle provider instance.\n */\nexport const bedrockMantle = createBedrockMantle();\n"],"mappings":";;;;;;AAEA,MAAa,UAAA;;;;;;;;;;;ACuBb,SAAgB,yBACd,gBAGA,OACA,UAAkB,WACH;CACf,OAAO,OACL,OACA,SACsB;EAEtB,MAAM,iBAAiB,SAAS,WAAW;EAC3C,MAAM,UAAU,iBAAiB,UAAU,QAAQ,KAAA;EACnD,MAAM,mBAAA,GAAkBA,uBAAAA,eAAAA,EAAAA,GACtBC,uBAAAA,iBAAAA,CAAiB,SAAS,OAAO,IAAA,GACjCA,uBAAAA,iBAAAA,CAAiB,MAAM,OAAO,CAChC;EACA,MAAM,wBAAA,GAAuBC,uBAAAA,oBAAAA,CAC3B,iBACA,yBAAyB,YAAA,GACzBC,uBAAAA,+BAAAA,CAA+B,CACjC;EAEA,IAAI,gBAAsC,MAAM,QAAQ,KAAA;EACxD,IAAI,kBAAkB,KAAA,KAAa,WAAW,QAAQ,SAAS,MAC7D,IAAI;GACF,gBAAgB,MAAM,QAAQ,MAAM,CAAC,CAAC,KAAK;EAC7C,QAAQ,CAAC;EAKX,KAFwB,MAAM,UAAU,SAAS,OAAA,EAE5B,YAAY,MAAM,UAAU,CAAC,eAChD,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH,SAAS;EACX,CAAC;EAGH,MAAM,MACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,OACN,MAAM;EAEd,MAAM,OAAO,kBAAkB,aAAa;EAC5C,MAAM,cAAc,MAAM,eAAe;EAezC,MAAM,gBAAgB,MAAM,IAdTC,UAAAA,YAAY;GAC7B;GACA,QAAQ;GACR,SAAS,OAAO,QAAQ,oBAAoB,CAAC,CAAC,QAAQ,GAAG,WACvD,QAAQ,KAAK,CACf;GACA;GACA,QAAQ,YAAY;GACpB,aAAa,YAAY;GACzB,iBAAiB,YAAY;GAC7B,cAAc,YAAY;GAC1B;EACF,CAEiC,CAAC,CAAC,KAAK;EACxC,MAAM,iBAAA,GAAgBH,uBAAAA,iBAAAA,CAAiB,cAAc,OAAO;EAG5D,MAAM,mBAAA,GAAkBD,uBAAAA,eAAAA,CAAe,sBAAsB,aAAa;EAE1E,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH;GACA,SAAS;EACX,CAAC;CACH;AACF;AAEA,SAAS,kBAAkB,MAAoC;CAC7D,IAAI,OAAO,SAAS,UAClB,OAAO;MACF,IAAI,gBAAgB,YACzB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;MAC/B,IAAI,gBAAgB,aACzB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,WAAW,IAAI,CAAC;MAEpD,OAAO,KAAK,UAAU,IAAI;AAE9B;AAEA,SAAS,QAAQ,OAAwB;CACvC,OAAO,CAAC,kBAAkB,KAAK,KAAK;AACtC;;;;;;;;AASA,SAAgB,0BACd,QACA,OACe;CACf,OAAO,OACL,OACA,SACsB;EAEtB,MAAM,iBAAiB,SAAS,WAAW;EAC3C,MAAM,mBAAA,GAAkBC,uBAAAA,iBAAAA,CAAiB,MAAM,OAAO;EACtD,MAAM,wBAAA,GAAuBC,uBAAAA,oBAAAA,CAC3B,iBACA,yBAAyB,YAAA,GACzBC,uBAAAA,+BAAAA,CAA+B,CACjC;EAEA,MAAM,gBAAA,GAAeH,uBAAAA,eAAAA,CAAe,sBAAsB,EACxD,eAAe,UAAU,SAC3B,CAAC;EAED,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH,SAAS;EACX,CAAC;CACH;AACF;;;;;;;;AC5BA,SAAgB,oBACd,UAAyC,CAAC,GACnB;CAEvB,MAAM,aAAA,GAAYK,uBAAAA,oBAAAA,CAAoB;EACpC,cAAc,QAAQ;EACtB,yBAAyB;CAC3B,CAAC;CAGD,MAAM,SACJ,aAAa,UAAU,KAAK,CAAC,CAAC,SAAS,IAAI,UAAU,KAAK,IAAI,KAAA;CAGhE,MAAM,gBAAgB,SAClB,0BAA0B,QAAQ,QAAQ,KAAK,IAC/C,yBACE,YAAY;EACV,MAAM,UAAA,GAASC,uBAAAA,YAAAA,CAAY;GACzB,cAAc,QAAQ;GACtB,aAAa;GACb,yBAAyB;GACzB,aAAa;EACf,CAAC;EAGD,IAAI,QAAQ,oBACV,IAAI;GACF,OAAO;IACL,GAAI,MAAM,QAAQ,mBAAmB;IACrC;GACF;EACF,SAAS,OAAO;GACd,MAAM,eACJ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvD,MAAM,IAAI,MACR,mCAAmC,aAAa,wHAGlD;EACF;EAGF,IAAI;GACF,OAAO;IACL;IACA,cAAA,GAAaA,uBAAAA,YAAAA,CAAY;KACvB,cAAc,QAAQ;KACtB,aAAa;KACb,yBAAyB;KACzB,aAAa;IACf,CAAC;IACD,kBAAA,GAAiBA,uBAAAA,YAAAA,CAAY;KAC3B,cAAc,QAAQ;KACtB,aAAa;KACb,yBAAyB;KACzB,aAAa;IACf,CAAC;IACD,eAAA,GAAcD,uBAAAA,oBAAAA,CAAoB;KAChC,cAAc,QAAQ;KACtB,yBAAyB;IAC3B,CAAC;GACH;EACF,SAAS,OAAO;GACd,MAAM,eACJ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvD,IACE,aAAa,SAAS,mBAAmB,KACzC,aAAa,SAAS,aAAa,GAEnC,MAAM,IAAI,MACR;;;;;kBAKqB,cACvB;GAEF,IACE,aAAa,SAAS,uBAAuB,KAC7C,aAAa,SAAS,iBAAiB,GAEvC,MAAM,IAAI,MACR;kBAEqB,cACvB;GAEF,MAAM;EACR;CACF,GACA,QAAQ,OACR,gBACF;CAEJ,MAAM,cAAc,YAA4B;EAC9C,MAAM,WAAA,GAAUE,uBAAAA,qBAAAA,CAAqB,QAAQ,OAAO;EACpD,IAAI,WAAW,MACb,OAAO;EAGT,MAAM,UAAA,GAASD,uBAAAA,YAAAA,CAAY;GACzB,cAAc,QAAQ;GACtB,aAAa;GACb,yBAAyB;GACzB,aAAa;EACf,CAAC;EACD,IAAI,EAAA,GAACE,uBAAAA,oBAAAA,CAAoB,MAAM,GAC7B,MAAM,IAAIC,iBAAAA,qBAAqB;GAC7B,UAAU;GACV,SACE;EACJ,CAAC;EAGH,OAAO,0BAA0B,OAAO,WAEtC,kDAAkD,KAAK,OAAO,IAC1D,cACA;CAER;CAEA,MAAM,oBAAA,GACJC,uBAAAA,oBAAAA,CACE,QAAQ,WAAW,CAAC,GACpB,yBAAyB,SAC3B;CAEF,MAAM,OAAO,EAAE,MAAM,cACnB,GAAG,WAAW,OAAO,IAAI;CAE3B,MAAM,mBAAmB,YACvB,IAAIC,wBAAAA,wBAAwB,SAAS;EACnC,UAAU;EACV;EACA,SAAS;EACT,OAAO;CACT,CAAC;CAEH,MAAM,wBAAwB,YAC5B,IAAIC,wBAAAA,6BAA6B,SAAS;EACxC,UAAU;EACV;EACA,SAAS;EACT,OAAO;EACP,iCAAiC;CACnC,CAAC;CAEH,MAAM,WAAW,SAAU,SAAmC;EAC5D,IAAI,YACF,MAAM,IAAI,MACR,0EACF;EAGF,OAAO,gBAAgB,OAAO;CAChC;CAEA,SAAS,uBAAuB;CAChC,SAAS,gBAAgB;CACzB,SAAS,OAAO;CAChB,SAAS,YAAY;CAErB,SAAS,kBAAkB,YAAoB;EAC7C,MAAM,IAAIC,iBAAAA,iBAAiB;GAAE;GAAS,WAAW;EAAiB,CAAC;CACrE;CACA,SAAS,qBAAqB,SAAS;CACvC,SAAS,cAAc,YAAoB;EACzC,MAAM,IAAIA,iBAAAA,iBAAiB;GAAE;GAAS,WAAW;EAAa,CAAC;CACjE;CAEA,OAAO;AACT;;;;AAKA,MAAa,gBAAgB,oBAAoB"}
+{"version":3,"file":"index.cjs","names":["combineHeaders","normalizeHeaders","withUserAgentSuffix","getRuntimeEnvironmentUserAgent","AwsV4Signer","resolve","LoadAPIKeyError","loadOptionalSetting","loadSetting","withoutTrailingSlash","isValidHostnamePart","InvalidArgumentError","withUserAgentSuffix","OpenAIChatLanguageModel","OpenAIResponsesLanguageModel","NoSuchModelError"],"sources":["../../src/version.ts","../../src/amazon-bedrock-sigv4-fetch.ts","../../src/mantle/bedrock-mantle-provider.ts"],"sourcesContent":["// Version string of this package injected at build time.\ndeclare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import { LoadAPIKeyError } from '@ai-sdk/provider';\nimport {\n  combineHeaders,\n  resolve,\n  type Resolvable,\n  normalizeHeaders,\n  withUserAgentSuffix,\n  getRuntimeEnvironmentUserAgent,\n  type FetchFunction,\n} from '@ai-sdk/provider-utils';\nimport { AwsV4Signer } from 'aws4fetch';\nimport { VERSION } from './version';\n\nexport interface AmazonBedrockCredentials {\n  region: string;\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string;\n}\n\n/**\n * Creates a fetch function that applies AWS Signature Version 4 signing.\n *\n * @param getCredentials - Function that returns the AWS credentials to use when signing.\n * @param fetch - Optional original fetch implementation to wrap. Defaults to global fetch.\n * @param service - The AWS service name to use for SigV4 signing scope. Defaults to 'bedrock'.\n * @returns A FetchFunction that signs requests before passing them to the underlying fetch.\n */\nexport function createSigV4FetchFunction(\n  getCredentials: () =>\n    | AmazonBedrockCredentials\n    | PromiseLike<AmazonBedrockCredentials>,\n  fetch?: FetchFunction,\n  service: string = 'bedrock',\n): FetchFunction {\n  return async (\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> => {\n    // avoid caching globalThis.fetch in case it is patched by other libraries\n    const effectiveFetch = fetch ?? globalThis.fetch;\n    const request = input instanceof Request ? input : undefined;\n    const originalHeaders = combineHeaders(\n      normalizeHeaders(request?.headers),\n      normalizeHeaders(init?.headers),\n    );\n    const headersWithUserAgent = withUserAgentSuffix(\n      originalHeaders,\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n      getRuntimeEnvironmentUserAgent(),\n    );\n\n    let effectiveBody: BodyInit | undefined = init?.body ?? undefined;\n    if (effectiveBody === undefined && request && request.body !== null) {\n      try {\n        effectiveBody = await request.clone().text();\n      } catch {}\n    }\n\n    const effectiveMethod = init?.method ?? request?.method;\n\n    if (effectiveMethod?.toUpperCase() !== 'POST' || !effectiveBody) {\n      return effectiveFetch(input, {\n        ...init,\n        headers: headersWithUserAgent as HeadersInit,\n      });\n    }\n\n    const url =\n      typeof input === 'string'\n        ? input\n        : input instanceof URL\n          ? input.href\n          : input.url;\n\n    const body = prepareBodyString(effectiveBody);\n    const credentials = await getCredentials();\n    const signer = new AwsV4Signer({\n      url,\n      method: 'POST',\n      headers: Object.entries(headersWithUserAgent).filter(([, value]) =>\n        isAscii(value),\n      ),\n      body,\n      region: credentials.region,\n      accessKeyId: credentials.accessKeyId,\n      secretAccessKey: credentials.secretAccessKey,\n      sessionToken: credentials.sessionToken,\n      service,\n    });\n\n    const signingResult = await signer.sign();\n    const signedHeaders = normalizeHeaders(signingResult.headers);\n\n    // Use the combined headers directly as HeadersInit\n    const combinedHeaders = combineHeaders(headersWithUserAgent, signedHeaders);\n\n    return effectiveFetch(input, {\n      ...init,\n      body,\n      headers: combinedHeaders as HeadersInit,\n    });\n  };\n}\n\nfunction prepareBodyString(body: BodyInit | undefined): string {\n  if (typeof body === 'string') {\n    return body;\n  } else if (body instanceof Uint8Array) {\n    return new TextDecoder().decode(body);\n  } else if (body instanceof ArrayBuffer) {\n    return new TextDecoder().decode(new Uint8Array(body));\n  } else {\n    return JSON.stringify(body);\n  }\n}\n\nfunction isAscii(value: string): boolean {\n  return !/[\\u0080-\\uffff]/.test(value);\n}\n\n/**\n * Creates a fetch function that applies Bearer token authentication.\n *\n * @param apiKey - The API key to use for Bearer token authentication.\n * @param fetch - Optional original fetch implementation to wrap. Defaults to global fetch.\n * @returns A FetchFunction that adds Authorization header with Bearer token to requests.\n */\nexport function createApiKeyFetchFunction(\n  apiKey: Resolvable<string>,\n  fetch?: FetchFunction,\n): FetchFunction {\n  return async (\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> => {\n    // avoid caching globalThis.fetch in case it is patched by other libraries\n    const effectiveFetch = fetch ?? globalThis.fetch;\n    const originalHeaders = normalizeHeaders(init?.headers);\n    const headersWithUserAgent = withUserAgentSuffix(\n      originalHeaders,\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n      getRuntimeEnvironmentUserAgent(),\n    );\n\n    const resolvedApiKey = await resolve(apiKey);\n    if (\n      typeof apiKey !== 'string' &&\n      (typeof resolvedApiKey !== 'string' || !resolvedApiKey.trim())\n    ) {\n      throw new LoadAPIKeyError({\n        message: 'Amazon Bedrock API key must be a non-empty string.',\n      });\n    }\n\n    const finalHeaders = combineHeaders(headersWithUserAgent, {\n      Authorization: `Bearer ${typeof apiKey === 'string' ? resolvedApiKey : resolvedApiKey.trim()}`,\n    });\n\n    return effectiveFetch(input, {\n      ...init,\n      headers: finalHeaders as HeadersInit,\n    });\n  };\n}\n","import {\n  OpenAIChatLanguageModel,\n  OpenAIResponsesLanguageModel,\n} from '@ai-sdk/openai/internal';\nimport {\n  InvalidArgumentError,\n  NoSuchModelError,\n  type LanguageModelV4,\n  type ProviderV4,\n} from '@ai-sdk/provider';\nimport {\n  isValidHostnamePart,\n  loadOptionalSetting,\n  loadSetting,\n  withoutTrailingSlash,\n  withUserAgentSuffix,\n  type FetchFunction,\n  type Resolvable,\n} from '@ai-sdk/provider-utils';\nimport {\n  createApiKeyFetchFunction,\n  createSigV4FetchFunction,\n  type AmazonBedrockCredentials,\n} from '../amazon-bedrock-sigv4-fetch';\nimport type {\n  BedrockMantleChatModelId,\n  BedrockMantleResponsesModelId,\n} from './bedrock-mantle-options';\nimport { VERSION } from '../version';\n\nexport interface BedrockMantleProvider extends ProviderV4 {\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   * Chat Completions has the broadest model support on Mantle.\n   */\n  (modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   */\n  languageModel(modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   */\n  chat(modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Responses API.\n   * Not all Mantle models support this API. Notably, gpt-oss-safeguard models\n   * are Chat-only.\n   */\n  responses(modelId: BedrockMantleResponsesModelId): LanguageModelV4;\n\n  /**\n   * @deprecated Mantle does not support embedding models.\n   */\n  textEmbeddingModel(modelId: string): never;\n}\n\nexport interface BedrockMantleProviderSettings {\n  /**\n   * The AWS region to use for the Bedrock Mantle endpoint. Defaults to the value of the\n   * `AWS_REGION` environment variable.\n   */\n  region?: string;\n\n  /**\n   * API key for authenticating requests using Bearer token authentication.\n   * A callback is resolved before each request and must return a non-empty key.\n   * When provided, this will be used instead of AWS SigV4 authentication.\n   * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.\n   */\n  apiKey?: Resolvable<string>;\n\n  /**\n   * The AWS access key ID to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_ACCESS_KEY_ID` environment variable.\n   */\n  accessKeyId?: string;\n\n  /**\n   * The AWS secret access key to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_SECRET_ACCESS_KEY` environment variable.\n   */\n  secretAccessKey?: string;\n\n  /**\n   * The AWS session token to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_SESSION_TOKEN` environment variable.\n   */\n  sessionToken?: string;\n\n  /**\n   * Base URL for the Bedrock Mantle API calls.\n   */\n  baseURL?: string;\n\n  /**\n   * Custom headers to include in the requests.\n   */\n  headers?: Record<string, string | undefined>;\n\n  /**\n   * Custom fetch implementation. You can use it as a middleware to intercept requests,\n   * or to provide a custom fetch implementation for e.g. testing.\n   */\n  fetch?: FetchFunction;\n\n  /**\n   * The AWS credential provider to use for SigV4 authentication to get dynamic\n   * credentials similar to the AWS SDK. Setting a provider here will cause its\n   * credential values to be used instead of the `accessKeyId`, `secretAccessKey`,\n   * and `sessionToken` settings.\n   */\n  credentialProvider?: () => PromiseLike<\n    Omit<AmazonBedrockCredentials, 'region'>\n  >;\n}\n\n/**\n * Create an Amazon Bedrock Mantle provider instance.\n * This provider uses the OpenAI-compatible Mantle API for models that are\n * only available through the Mantle endpoint (e.g. openai.gpt-oss-20b).\n */\nexport function createBedrockMantle(\n  options: BedrockMantleProviderSettings = {},\n): BedrockMantleProvider {\n  // Check for API key authentication first\n  const rawApiKey =\n    typeof options.apiKey === 'string' || options.apiKey == null\n      ? loadOptionalSetting({\n          settingValue: options.apiKey,\n          environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',\n        })\n      : options.apiKey;\n\n  // Only use API key if it's a non-empty, non-whitespace string\n  const apiKey =\n    typeof rawApiKey === 'string' ? rawApiKey.trim() || undefined : rawApiKey;\n\n  // Use API key authentication if available, otherwise fall back to SigV4\n  const fetchFunction = apiKey\n    ? createApiKeyFetchFunction(apiKey, options.fetch)\n    : createSigV4FetchFunction(\n        async () => {\n          const region = loadSetting({\n            settingValue: options.region,\n            settingName: 'region',\n            environmentVariableName: 'AWS_REGION',\n            description: 'AWS region',\n          });\n\n          // If a credential provider is provided, use it to get the credentials.\n          if (options.credentialProvider) {\n            try {\n              return {\n                ...(await options.credentialProvider()),\n                region,\n              };\n            } catch (error) {\n              const errorMessage =\n                error instanceof Error ? error.message : String(error);\n              throw new Error(\n                `AWS credential provider failed: ${errorMessage}. ` +\n                  'Please ensure your credential provider returns valid AWS credentials ' +\n                  'with accessKeyId and secretAccessKey properties.',\n              );\n            }\n          }\n\n          try {\n            return {\n              region,\n              accessKeyId: loadSetting({\n                settingValue: options.accessKeyId,\n                settingName: 'accessKeyId',\n                environmentVariableName: 'AWS_ACCESS_KEY_ID',\n                description: 'AWS access key ID',\n              }),\n              secretAccessKey: loadSetting({\n                settingValue: options.secretAccessKey,\n                settingName: 'secretAccessKey',\n                environmentVariableName: 'AWS_SECRET_ACCESS_KEY',\n                description: 'AWS secret access key',\n              }),\n              sessionToken: loadOptionalSetting({\n                settingValue: options.sessionToken,\n                environmentVariableName: 'AWS_SESSION_TOKEN',\n              }),\n            };\n          } catch (error) {\n            const errorMessage =\n              error instanceof Error ? error.message : String(error);\n            if (\n              errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n              errorMessage.includes('accessKeyId')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                  '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                  '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                  '3. Use a credentialProvider function\\n' +\n                  '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            if (\n              errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n              errorMessage.includes('secretAccessKey')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                  'Please ensure both credentials are provided.\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            throw error;\n          }\n        },\n        options.fetch,\n        'bedrock-mantle',\n      );\n\n  const getBaseURL = (modelId: string): string => {\n    const baseURL = withoutTrailingSlash(options.baseURL);\n    if (baseURL != null) {\n      return baseURL;\n    }\n\n    const region = loadSetting({\n      settingValue: options.region,\n      settingName: 'region',\n      environmentVariableName: 'AWS_REGION',\n      description: 'AWS region',\n    });\n    if (!isValidHostnamePart(region)) {\n      throw new InvalidArgumentError({\n        argument: 'region',\n        message:\n          'Invalid AWS region. Expected a single DNS label (letters, digits, and hyphens). Use `baseURL` for custom endpoints.',\n      });\n    }\n\n    return `https://bedrock-mantle.${region}.api.aws/${\n      // Mantle serves these models under its separate OpenAI route.\n      /^(?:openai\\.gpt-(?!oss-)|google\\.gemma-4|xai\\.)/.test(modelId)\n        ? 'openai/v1'\n        : 'v1'\n    }`;\n  };\n\n  const getHeaders = (): Record<string, string | undefined> =>\n    withUserAgentSuffix(\n      options.headers ?? {},\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n    );\n\n  const url = ({ path, modelId }: { path: string; modelId: string }): string =>\n    `${getBaseURL(modelId)}${path}`;\n\n  const createChatModel = (modelId: BedrockMantleChatModelId) =>\n    new OpenAIChatLanguageModel(modelId, {\n      provider: 'bedrock-mantle.chat',\n      url,\n      headers: getHeaders,\n      fetch: fetchFunction,\n    });\n\n  const createResponsesModel = (modelId: BedrockMantleResponsesModelId) =>\n    new OpenAIResponsesLanguageModel(modelId, {\n      provider: 'bedrock-mantle.responses',\n      url,\n      headers: getHeaders,\n      fetch: fetchFunction,\n      supportsWebSearchSourcesInclude: false,\n    });\n\n  const provider = function (modelId: BedrockMantleChatModelId) {\n    if (new.target) {\n      throw new Error(\n        'The Bedrock Mantle model function cannot be called with the new keyword.',\n      );\n    }\n\n    return createChatModel(modelId);\n  };\n\n  provider.specificationVersion = 'v4' as const;\n  provider.languageModel = createChatModel;\n  provider.chat = createChatModel;\n  provider.responses = createResponsesModel;\n\n  provider.embeddingModel = (modelId: string) => {\n    throw new NoSuchModelError({ modelId, modelType: 'embeddingModel' });\n  };\n  provider.textEmbeddingModel = provider.embeddingModel;\n  provider.imageModel = (modelId: string) => {\n    throw new NoSuchModelError({ modelId, modelType: 'imageModel' });\n  };\n\n  return provider as BedrockMantleProvider;\n}\n\n/**\n * Default Bedrock Mantle provider instance.\n */\nexport const bedrockMantle = createBedrockMantle();\n"],"mappings":";;;;;;AAEA,MAAa,UAAA;;;;;;;;;;;AC0Bb,SAAgB,yBACd,gBAGA,OACA,UAAkB,WACH;CACf,OAAO,OACL,OACA,SACsB;EAEtB,MAAM,iBAAiB,SAAS,WAAW;EAC3C,MAAM,UAAU,iBAAiB,UAAU,QAAQ,KAAA;EACnD,MAAM,mBAAA,GAAkBA,uBAAAA,eAAAA,EAAAA,GACtBC,uBAAAA,iBAAAA,CAAiB,SAAS,OAAO,IAAA,GACjCA,uBAAAA,iBAAAA,CAAiB,MAAM,OAAO,CAChC;EACA,MAAM,wBAAA,GAAuBC,uBAAAA,oBAAAA,CAC3B,iBACA,yBAAyB,YAAA,GACzBC,uBAAAA,+BAAAA,CAA+B,CACjC;EAEA,IAAI,gBAAsC,MAAM,QAAQ,KAAA;EACxD,IAAI,kBAAkB,KAAA,KAAa,WAAW,QAAQ,SAAS,MAC7D,IAAI;GACF,gBAAgB,MAAM,QAAQ,MAAM,CAAC,CAAC,KAAK;EAC7C,QAAQ,CAAC;EAKX,KAFwB,MAAM,UAAU,SAAS,OAAA,EAE5B,YAAY,MAAM,UAAU,CAAC,eAChD,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH,SAAS;EACX,CAAC;EAGH,MAAM,MACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,OACN,MAAM;EAEd,MAAM,OAAO,kBAAkB,aAAa;EAC5C,MAAM,cAAc,MAAM,eAAe;EAezC,MAAM,gBAAgB,MAAM,IAdTC,UAAAA,YAAY;GAC7B;GACA,QAAQ;GACR,SAAS,OAAO,QAAQ,oBAAoB,CAAC,CAAC,QAAQ,GAAG,WACvD,QAAQ,KAAK,CACf;GACA;GACA,QAAQ,YAAY;GACpB,aAAa,YAAY;GACzB,iBAAiB,YAAY;GAC7B,cAAc,YAAY;GAC1B;EACF,CAEiC,CAAC,CAAC,KAAK;EACxC,MAAM,iBAAA,GAAgBH,uBAAAA,iBAAAA,CAAiB,cAAc,OAAO;EAG5D,MAAM,mBAAA,GAAkBD,uBAAAA,eAAAA,CAAe,sBAAsB,aAAa;EAE1E,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH;GACA,SAAS;EACX,CAAC;CACH;AACF;AAEA,SAAS,kBAAkB,MAAoC;CAC7D,IAAI,OAAO,SAAS,UAClB,OAAO;MACF,IAAI,gBAAgB,YACzB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;MAC/B,IAAI,gBAAgB,aACzB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,WAAW,IAAI,CAAC;MAEpD,OAAO,KAAK,UAAU,IAAI;AAE9B;AAEA,SAAS,QAAQ,OAAwB;CACvC,OAAO,CAAC,kBAAkB,KAAK,KAAK;AACtC;;;;;;;;AASA,SAAgB,0BACd,QACA,OACe;CACf,OAAO,OACL,OACA,SACsB;EAEtB,MAAM,iBAAiB,SAAS,WAAW;EAC3C,MAAM,mBAAA,GAAkBC,uBAAAA,iBAAAA,CAAiB,MAAM,OAAO;EACtD,MAAM,wBAAA,GAAuBC,uBAAAA,oBAAAA,CAC3B,iBACA,yBAAyB,YAAA,GACzBC,uBAAAA,+BAAAA,CAA+B,CACjC;EAEA,MAAM,iBAAiB,OAAA,GAAME,uBAAAA,QAAAA,CAAQ,MAAM;EAC3C,IACE,OAAO,WAAW,aACjB,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,IAE5D,MAAM,IAAIC,iBAAAA,gBAAgB,EACxB,SAAS,qDACX,CAAC;EAGH,MAAM,gBAAA,GAAeN,uBAAAA,eAAAA,CAAe,sBAAsB,EACxD,eAAe,UAAU,OAAO,WAAW,WAAW,iBAAiB,eAAe,KAAK,IAC7F,CAAC;EAED,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH,SAAS;EACX,CAAC;CACH;AACF;;;;;;;;ACvCA,SAAgB,oBACd,UAAyC,CAAC,GACnB;CAEvB,MAAM,YACJ,OAAO,QAAQ,WAAW,YAAY,QAAQ,UAAU,QAAA,GACpDO,uBAAAA,oBAAAA,CAAoB;EAClB,cAAc,QAAQ;EACtB,yBAAyB;CAC3B,CAAC,IACD,QAAQ;CAGd,MAAM,SACJ,OAAO,cAAc,WAAW,UAAU,KAAK,KAAK,KAAA,IAAY;CAGlE,MAAM,gBAAgB,SAClB,0BAA0B,QAAQ,QAAQ,KAAK,IAC/C,yBACE,YAAY;EACV,MAAM,UAAA,GAASC,uBAAAA,YAAAA,CAAY;GACzB,cAAc,QAAQ;GACtB,aAAa;GACb,yBAAyB;GACzB,aAAa;EACf,CAAC;EAGD,IAAI,QAAQ,oBACV,IAAI;GACF,OAAO;IACL,GAAI,MAAM,QAAQ,mBAAmB;IACrC;GACF;EACF,SAAS,OAAO;GACd,MAAM,eACJ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvD,MAAM,IAAI,MACR,mCAAmC,aAAa,wHAGlD;EACF;EAGF,IAAI;GACF,OAAO;IACL;IACA,cAAA,GAAaA,uBAAAA,YAAAA,CAAY;KACvB,cAAc,QAAQ;KACtB,aAAa;KACb,yBAAyB;KACzB,aAAa;IACf,CAAC;IACD,kBAAA,GAAiBA,uBAAAA,YAAAA,CAAY;KAC3B,cAAc,QAAQ;KACtB,aAAa;KACb,yBAAyB;KACzB,aAAa;IACf,CAAC;IACD,eAAA,GAAcD,uBAAAA,oBAAAA,CAAoB;KAChC,cAAc,QAAQ;KACtB,yBAAyB;IAC3B,CAAC;GACH;EACF,SAAS,OAAO;GACd,MAAM,eACJ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvD,IACE,aAAa,SAAS,mBAAmB,KACzC,aAAa,SAAS,aAAa,GAEnC,MAAM,IAAI,MACR;;;;;kBAKqB,cACvB;GAEF,IACE,aAAa,SAAS,uBAAuB,KAC7C,aAAa,SAAS,iBAAiB,GAEvC,MAAM,IAAI,MACR;kBAEqB,cACvB;GAEF,MAAM;EACR;CACF,GACA,QAAQ,OACR,gBACF;CAEJ,MAAM,cAAc,YAA4B;EAC9C,MAAM,WAAA,GAAUE,uBAAAA,qBAAAA,CAAqB,QAAQ,OAAO;EACpD,IAAI,WAAW,MACb,OAAO;EAGT,MAAM,UAAA,GAASD,uBAAAA,YAAAA,CAAY;GACzB,cAAc,QAAQ;GACtB,aAAa;GACb,yBAAyB;GACzB,aAAa;EACf,CAAC;EACD,IAAI,EAAA,GAACE,uBAAAA,oBAAAA,CAAoB,MAAM,GAC7B,MAAM,IAAIC,iBAAAA,qBAAqB;GAC7B,UAAU;GACV,SACE;EACJ,CAAC;EAGH,OAAO,0BAA0B,OAAO,WAEtC,kDAAkD,KAAK,OAAO,IAC1D,cACA;CAER;CAEA,MAAM,oBAAA,GACJC,uBAAAA,oBAAAA,CACE,QAAQ,WAAW,CAAC,GACpB,yBAAyB,SAC3B;CAEF,MAAM,OAAO,EAAE,MAAM,cACnB,GAAG,WAAW,OAAO,IAAI;CAE3B,MAAM,mBAAmB,YACvB,IAAIC,wBAAAA,wBAAwB,SAAS;EACnC,UAAU;EACV;EACA,SAAS;EACT,OAAO;CACT,CAAC;CAEH,MAAM,wBAAwB,YAC5B,IAAIC,wBAAAA,6BAA6B,SAAS;EACxC,UAAU;EACV;EACA,SAAS;EACT,OAAO;EACP,iCAAiC;CACnC,CAAC;CAEH,MAAM,WAAW,SAAU,SAAmC;EAC5D,IAAI,YACF,MAAM,IAAI,MACR,0EACF;EAGF,OAAO,gBAAgB,OAAO;CAChC;CAEA,SAAS,uBAAuB;CAChC,SAAS,gBAAgB;CACzB,SAAS,OAAO;CAChB,SAAS,YAAY;CAErB,SAAS,kBAAkB,YAAoB;EAC7C,MAAM,IAAIC,iBAAAA,iBAAiB;GAAE;GAAS,WAAW;EAAiB,CAAC;CACrE;CACA,SAAS,qBAAqB,SAAS;CACvC,SAAS,cAAc,YAAoB;EACzC,MAAM,IAAIA,iBAAAA,iBAAiB;GAAE;GAAS,WAAW;EAAa,CAAC;CACjE;CAEA,OAAO;AACT;;;;AAKA,MAAa,gBAAgB,oBAAoB"}

package/dist/mantle/index.d.cts

@@ -1,5 +1,5 @@
 import { LanguageModelV4, ProviderV4 } from "@ai-sdk/provider";
-import { FetchFunction } from "@ai-sdk/provider-utils";
+import { FetchFunction, Resolvable } from "@ai-sdk/provider-utils";
 //#region src/amazon-bedrock-sigv4-fetch.d.ts
 interface AmazonBedrockCredentials {
   region: string;
@@ -47,10 +47,11 @@ interface BedrockMantleProviderSettings {
   region?: string;
   /**
    * API key for authenticating requests using Bearer token authentication.
+   * A callback is resolved before each request and must return a non-empty key.
    * When provided, this will be used instead of AWS SigV4 authentication.
    * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.
    */
-  apiKey?: string;
+  apiKey?: Resolvable<string>;
   /**
    * The AWS access key ID to use for SigV4 authentication. Defaults to the value of the
    * `AWS_ACCESS_KEY_ID` environment variable.

package/dist/mantle/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/amazon-bedrock-sigv4-fetch.ts","../../src/mantle/bedrock-mantle-options.ts","../../src/mantle/bedrock-mantle-provider.ts"],"mappings":";;;UAUiB;EACf;EACA;EACA;EACA;;;;KCdU;KAOA;KAKA,uBACR,2BACA;;;UCea,8BAA8B;;;;;GAK5C,SAAS,2BAA2B;;;;EAKrC,cAAc,SAAS,2BAA2B;;;;EAKlD,KAAK,SAAS,2BAA2B;;;;;;EAOzC,UAAU,SAAS,gCAAgC;;;;EAKnD,mBAAmB;;UAGJ;;;;;EAKf;;;;;;EAOA;;;;;EAMA;;;;;EAMA;;;;;EAMA;;;;EAKA;;;;EAKA,UAAU;;;;;EAMV,QAAQ;;;;;;;EAQR,2BAA2B,YACzB,KAAK;;;;;;;wBASO,oBACd,UAAS,gCACR;;;;qBAiLU,eAAa"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/amazon-bedrock-sigv4-fetch.ts","../../src/mantle/bedrock-mantle-options.ts","../../src/mantle/bedrock-mantle-provider.ts"],"mappings":";;;UAaiB;EACf;EACA;EACA;EACA;;;;KCjBU;KAOA;KAKA,uBACR,2BACA;;;UCgBa,8BAA8B;;;;;GAK5C,SAAS,2BAA2B;;;;EAKrC,cAAc,SAAS,2BAA2B;;;;EAKlD,KAAK,SAAS,2BAA2B;;;;;;EAOzC,UAAU,SAAS,gCAAgC;;;;EAKnD,mBAAmB;;UAGJ;;;;;EAKf;;;;;;;EAQA,SAAS;;;;;EAMT;;;;;EAMA;;;;;EAMA;;;;EAKA;;;;EAKA,UAAU;;;;;EAMV,QAAQ;;;;;;;EAQR,2BAA2B,YACzB,KAAK;;;;;;;wBASO,oBACd,UAAS,gCACR;;;;qBAoLU,eAAa"}

package/dist/mantle/index.d.ts

@@ -1,5 +1,5 @@
 import { LanguageModelV4, ProviderV4 } from "@ai-sdk/provider";
-import { FetchFunction } from "@ai-sdk/provider-utils";
+import { FetchFunction, Resolvable } from "@ai-sdk/provider-utils";
 //#region src/amazon-bedrock-sigv4-fetch.d.ts
 interface AmazonBedrockCredentials {
   region: string;
@@ -47,10 +47,11 @@ interface BedrockMantleProviderSettings {
   region?: string;
   /**
    * API key for authenticating requests using Bearer token authentication.
+   * A callback is resolved before each request and must return a non-empty key.
    * When provided, this will be used instead of AWS SigV4 authentication.
    * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.
    */
-  apiKey?: string;
+  apiKey?: Resolvable<string>;
   /**
    * The AWS access key ID to use for SigV4 authentication. Defaults to the value of the
    * `AWS_ACCESS_KEY_ID` environment variable.

package/dist/mantle/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/amazon-bedrock-sigv4-fetch.ts","../../src/mantle/bedrock-mantle-options.ts","../../src/mantle/bedrock-mantle-provider.ts"],"mappings":";;;UAUiB;EACf;EACA;EACA;EACA;;;;KCdU;KAOA;KAKA,uBACR,2BACA;;;UCea,8BAA8B;;;;;GAK5C,SAAS,2BAA2B;;;;EAKrC,cAAc,SAAS,2BAA2B;;;;EAKlD,KAAK,SAAS,2BAA2B;;;;;;EAOzC,UAAU,SAAS,gCAAgC;;;;EAKnD,mBAAmB;;UAGJ;;;;;EAKf;;;;;;EAOA;;;;;EAMA;;;;;EAMA;;;;;EAMA;;;;EAKA;;;;EAKA,UAAU;;;;;EAMV,QAAQ;;;;;;;EAQR,2BAA2B,YACzB,KAAK;;;;;;;wBASO,oBACd,UAAS,gCACR;;;;qBAiLU,eAAa"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/amazon-bedrock-sigv4-fetch.ts","../../src/mantle/bedrock-mantle-options.ts","../../src/mantle/bedrock-mantle-provider.ts"],"mappings":";;;UAaiB;EACf;EACA;EACA;EACA;;;;KCjBU;KAOA;KAKA,uBACR,2BACA;;;UCgBa,8BAA8B;;;;;GAK5C,SAAS,2BAA2B;;;;EAKrC,cAAc,SAAS,2BAA2B;;;;EAKlD,KAAK,SAAS,2BAA2B;;;;;;EAOzC,UAAU,SAAS,gCAAgC;;;;EAKnD,mBAAmB;;UAGJ;;;;;EAKf;;;;;;;EAQA,SAAS;;;;;EAMT;;;;;EAMA;;;;;EAMA;;;;EAKA;;;;EAKA,UAAU;;;;;EAMV,QAAQ;;;;;;;EAQR,2BAA2B,YACzB,KAAK;;;;;;;wBASO,oBACd,UAAS,gCACR;;;;qBAoLU,eAAa"}

package/dist/mantle/index.js

@@ -1,9 +1,9 @@
 import { OpenAIChatLanguageModel, OpenAIResponsesLanguageModel } from "@ai-sdk/openai/internal";
-import { InvalidArgumentError, NoSuchModelError } from "@ai-sdk/provider";
-import { combineHeaders, getRuntimeEnvironmentUserAgent, isValidHostnamePart, loadOptionalSetting, loadSetting, normalizeHeaders, withUserAgentSuffix, withoutTrailingSlash } from "@ai-sdk/provider-utils";
+import { InvalidArgumentError, LoadAPIKeyError, NoSuchModelError } from "@ai-sdk/provider";
+import { combineHeaders, getRuntimeEnvironmentUserAgent, isValidHostnamePart, loadOptionalSetting, loadSetting, normalizeHeaders, resolve, withUserAgentSuffix, withoutTrailingSlash } from "@ai-sdk/provider-utils";
 import { AwsV4Signer } from "aws4fetch";
 //#region src/version.ts
-const VERSION = "5.0.128";
+const VERSION = "5.0.129";
 //#endregion
 //#region src/amazon-bedrock-sigv4-fetch.ts
 /**
@@ -72,7 +72,9 @@ function createApiKeyFetchFunction(apiKey, fetch) {
 		const effectiveFetch = fetch ?? globalThis.fetch;
 		const originalHeaders = normalizeHeaders(init?.headers);
 		const headersWithUserAgent = withUserAgentSuffix(originalHeaders, `ai-sdk-amazon-bedrock/${VERSION}`, getRuntimeEnvironmentUserAgent());
-		const finalHeaders = combineHeaders(headersWithUserAgent, { Authorization: `Bearer ${apiKey}` });
+		const resolvedApiKey = await resolve(apiKey);
+		if (typeof apiKey !== "string" && (typeof resolvedApiKey !== "string" || !resolvedApiKey.trim())) throw new LoadAPIKeyError({ message: "Amazon Bedrock API key must be a non-empty string." });
+		const finalHeaders = combineHeaders(headersWithUserAgent, { Authorization: `Bearer ${typeof apiKey === "string" ? resolvedApiKey : resolvedApiKey.trim()}` });
 		return effectiveFetch(input, {
 			...init,
 			headers: finalHeaders
@@ -87,11 +89,11 @@ function createApiKeyFetchFunction(apiKey, fetch) {
 * only available through the Mantle endpoint (e.g. openai.gpt-oss-20b).
 */
 function createBedrockMantle(options = {}) {
-	const rawApiKey = loadOptionalSetting({
+	const rawApiKey = typeof options.apiKey === "string" || options.apiKey == null ? loadOptionalSetting({
 		settingValue: options.apiKey,
 		environmentVariableName: "AWS_BEARER_TOKEN_BEDROCK"
-	});
-	const apiKey = rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : void 0;
+	}) : options.apiKey;
+	const apiKey = typeof rawApiKey === "string" ? rawApiKey.trim() || void 0 : rawApiKey;
 	const fetchFunction = apiKey ? createApiKeyFetchFunction(apiKey, options.fetch) : createSigV4FetchFunction(async () => {
 		const region = loadSetting({
 			settingValue: options.region,

package/dist/mantle/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/version.ts","../../src/amazon-bedrock-sigv4-fetch.ts","../../src/mantle/bedrock-mantle-provider.ts"],"sourcesContent":["// Version string of this package injected at build time.\ndeclare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import {\n  combineHeaders,\n  normalizeHeaders,\n  withUserAgentSuffix,\n  getRuntimeEnvironmentUserAgent,\n  type FetchFunction,\n} from '@ai-sdk/provider-utils';\nimport { AwsV4Signer } from 'aws4fetch';\nimport { VERSION } from './version';\n\nexport interface AmazonBedrockCredentials {\n  region: string;\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string;\n}\n\n/**\n * Creates a fetch function that applies AWS Signature Version 4 signing.\n *\n * @param getCredentials - Function that returns the AWS credentials to use when signing.\n * @param fetch - Optional original fetch implementation to wrap. Defaults to global fetch.\n * @param service - The AWS service name to use for SigV4 signing scope. Defaults to 'bedrock'.\n * @returns A FetchFunction that signs requests before passing them to the underlying fetch.\n */\nexport function createSigV4FetchFunction(\n  getCredentials: () =>\n    | AmazonBedrockCredentials\n    | PromiseLike<AmazonBedrockCredentials>,\n  fetch?: FetchFunction,\n  service: string = 'bedrock',\n): FetchFunction {\n  return async (\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> => {\n    // avoid caching globalThis.fetch in case it is patched by other libraries\n    const effectiveFetch = fetch ?? globalThis.fetch;\n    const request = input instanceof Request ? input : undefined;\n    const originalHeaders = combineHeaders(\n      normalizeHeaders(request?.headers),\n      normalizeHeaders(init?.headers),\n    );\n    const headersWithUserAgent = withUserAgentSuffix(\n      originalHeaders,\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n      getRuntimeEnvironmentUserAgent(),\n    );\n\n    let effectiveBody: BodyInit | undefined = init?.body ?? undefined;\n    if (effectiveBody === undefined && request && request.body !== null) {\n      try {\n        effectiveBody = await request.clone().text();\n      } catch {}\n    }\n\n    const effectiveMethod = init?.method ?? request?.method;\n\n    if (effectiveMethod?.toUpperCase() !== 'POST' || !effectiveBody) {\n      return effectiveFetch(input, {\n        ...init,\n        headers: headersWithUserAgent as HeadersInit,\n      });\n    }\n\n    const url =\n      typeof input === 'string'\n        ? input\n        : input instanceof URL\n          ? input.href\n          : input.url;\n\n    const body = prepareBodyString(effectiveBody);\n    const credentials = await getCredentials();\n    const signer = new AwsV4Signer({\n      url,\n      method: 'POST',\n      headers: Object.entries(headersWithUserAgent).filter(([, value]) =>\n        isAscii(value),\n      ),\n      body,\n      region: credentials.region,\n      accessKeyId: credentials.accessKeyId,\n      secretAccessKey: credentials.secretAccessKey,\n      sessionToken: credentials.sessionToken,\n      service,\n    });\n\n    const signingResult = await signer.sign();\n    const signedHeaders = normalizeHeaders(signingResult.headers);\n\n    // Use the combined headers directly as HeadersInit\n    const combinedHeaders = combineHeaders(headersWithUserAgent, signedHeaders);\n\n    return effectiveFetch(input, {\n      ...init,\n      body,\n      headers: combinedHeaders as HeadersInit,\n    });\n  };\n}\n\nfunction prepareBodyString(body: BodyInit | undefined): string {\n  if (typeof body === 'string') {\n    return body;\n  } else if (body instanceof Uint8Array) {\n    return new TextDecoder().decode(body);\n  } else if (body instanceof ArrayBuffer) {\n    return new TextDecoder().decode(new Uint8Array(body));\n  } else {\n    return JSON.stringify(body);\n  }\n}\n\nfunction isAscii(value: string): boolean {\n  return !/[\\u0080-\\uffff]/.test(value);\n}\n\n/**\n * Creates a fetch function that applies Bearer token authentication.\n *\n * @param apiKey - The API key to use for Bearer token authentication.\n * @param fetch - Optional original fetch implementation to wrap. Defaults to global fetch.\n * @returns A FetchFunction that adds Authorization header with Bearer token to requests.\n */\nexport function createApiKeyFetchFunction(\n  apiKey: string,\n  fetch?: FetchFunction,\n): FetchFunction {\n  return async (\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> => {\n    // avoid caching globalThis.fetch in case it is patched by other libraries\n    const effectiveFetch = fetch ?? globalThis.fetch;\n    const originalHeaders = normalizeHeaders(init?.headers);\n    const headersWithUserAgent = withUserAgentSuffix(\n      originalHeaders,\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n      getRuntimeEnvironmentUserAgent(),\n    );\n\n    const finalHeaders = combineHeaders(headersWithUserAgent, {\n      Authorization: `Bearer ${apiKey}`,\n    });\n\n    return effectiveFetch(input, {\n      ...init,\n      headers: finalHeaders as HeadersInit,\n    });\n  };\n}\n","import {\n  OpenAIChatLanguageModel,\n  OpenAIResponsesLanguageModel,\n} from '@ai-sdk/openai/internal';\nimport {\n  InvalidArgumentError,\n  NoSuchModelError,\n  type LanguageModelV4,\n  type ProviderV4,\n} from '@ai-sdk/provider';\nimport {\n  isValidHostnamePart,\n  loadOptionalSetting,\n  loadSetting,\n  withoutTrailingSlash,\n  withUserAgentSuffix,\n  type FetchFunction,\n} from '@ai-sdk/provider-utils';\nimport {\n  createApiKeyFetchFunction,\n  createSigV4FetchFunction,\n  type AmazonBedrockCredentials,\n} from '../amazon-bedrock-sigv4-fetch';\nimport type {\n  BedrockMantleChatModelId,\n  BedrockMantleResponsesModelId,\n} from './bedrock-mantle-options';\nimport { VERSION } from '../version';\n\nexport interface BedrockMantleProvider extends ProviderV4 {\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   * Chat Completions has the broadest model support on Mantle.\n   */\n  (modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   */\n  languageModel(modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   */\n  chat(modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Responses API.\n   * Not all Mantle models support this API. Notably, gpt-oss-safeguard models\n   * are Chat-only.\n   */\n  responses(modelId: BedrockMantleResponsesModelId): LanguageModelV4;\n\n  /**\n   * @deprecated Mantle does not support embedding models.\n   */\n  textEmbeddingModel(modelId: string): never;\n}\n\nexport interface BedrockMantleProviderSettings {\n  /**\n   * The AWS region to use for the Bedrock Mantle endpoint. Defaults to the value of the\n   * `AWS_REGION` environment variable.\n   */\n  region?: string;\n\n  /**\n   * API key for authenticating requests using Bearer token authentication.\n   * When provided, this will be used instead of AWS SigV4 authentication.\n   * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.\n   */\n  apiKey?: string;\n\n  /**\n   * The AWS access key ID to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_ACCESS_KEY_ID` environment variable.\n   */\n  accessKeyId?: string;\n\n  /**\n   * The AWS secret access key to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_SECRET_ACCESS_KEY` environment variable.\n   */\n  secretAccessKey?: string;\n\n  /**\n   * The AWS session token to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_SESSION_TOKEN` environment variable.\n   */\n  sessionToken?: string;\n\n  /**\n   * Base URL for the Bedrock Mantle API calls.\n   */\n  baseURL?: string;\n\n  /**\n   * Custom headers to include in the requests.\n   */\n  headers?: Record<string, string | undefined>;\n\n  /**\n   * Custom fetch implementation. You can use it as a middleware to intercept requests,\n   * or to provide a custom fetch implementation for e.g. testing.\n   */\n  fetch?: FetchFunction;\n\n  /**\n   * The AWS credential provider to use for SigV4 authentication to get dynamic\n   * credentials similar to the AWS SDK. Setting a provider here will cause its\n   * credential values to be used instead of the `accessKeyId`, `secretAccessKey`,\n   * and `sessionToken` settings.\n   */\n  credentialProvider?: () => PromiseLike<\n    Omit<AmazonBedrockCredentials, 'region'>\n  >;\n}\n\n/**\n * Create an Amazon Bedrock Mantle provider instance.\n * This provider uses the OpenAI-compatible Mantle API for models that are\n * only available through the Mantle endpoint (e.g. openai.gpt-oss-20b).\n */\nexport function createBedrockMantle(\n  options: BedrockMantleProviderSettings = {},\n): BedrockMantleProvider {\n  // Check for API key authentication first\n  const rawApiKey = loadOptionalSetting({\n    settingValue: options.apiKey,\n    environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',\n  });\n\n  // Only use API key if it's a non-empty, non-whitespace string\n  const apiKey =\n    rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : undefined;\n\n  // Use API key authentication if available, otherwise fall back to SigV4\n  const fetchFunction = apiKey\n    ? createApiKeyFetchFunction(apiKey, options.fetch)\n    : createSigV4FetchFunction(\n        async () => {\n          const region = loadSetting({\n            settingValue: options.region,\n            settingName: 'region',\n            environmentVariableName: 'AWS_REGION',\n            description: 'AWS region',\n          });\n\n          // If a credential provider is provided, use it to get the credentials.\n          if (options.credentialProvider) {\n            try {\n              return {\n                ...(await options.credentialProvider()),\n                region,\n              };\n            } catch (error) {\n              const errorMessage =\n                error instanceof Error ? error.message : String(error);\n              throw new Error(\n                `AWS credential provider failed: ${errorMessage}. ` +\n                  'Please ensure your credential provider returns valid AWS credentials ' +\n                  'with accessKeyId and secretAccessKey properties.',\n              );\n            }\n          }\n\n          try {\n            return {\n              region,\n              accessKeyId: loadSetting({\n                settingValue: options.accessKeyId,\n                settingName: 'accessKeyId',\n                environmentVariableName: 'AWS_ACCESS_KEY_ID',\n                description: 'AWS access key ID',\n              }),\n              secretAccessKey: loadSetting({\n                settingValue: options.secretAccessKey,\n                settingName: 'secretAccessKey',\n                environmentVariableName: 'AWS_SECRET_ACCESS_KEY',\n                description: 'AWS secret access key',\n              }),\n              sessionToken: loadOptionalSetting({\n                settingValue: options.sessionToken,\n                environmentVariableName: 'AWS_SESSION_TOKEN',\n              }),\n            };\n          } catch (error) {\n            const errorMessage =\n              error instanceof Error ? error.message : String(error);\n            if (\n              errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n              errorMessage.includes('accessKeyId')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                  '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                  '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                  '3. Use a credentialProvider function\\n' +\n                  '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            if (\n              errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n              errorMessage.includes('secretAccessKey')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                  'Please ensure both credentials are provided.\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            throw error;\n          }\n        },\n        options.fetch,\n        'bedrock-mantle',\n      );\n\n  const getBaseURL = (modelId: string): string => {\n    const baseURL = withoutTrailingSlash(options.baseURL);\n    if (baseURL != null) {\n      return baseURL;\n    }\n\n    const region = loadSetting({\n      settingValue: options.region,\n      settingName: 'region',\n      environmentVariableName: 'AWS_REGION',\n      description: 'AWS region',\n    });\n    if (!isValidHostnamePart(region)) {\n      throw new InvalidArgumentError({\n        argument: 'region',\n        message:\n          'Invalid AWS region. Expected a single DNS label (letters, digits, and hyphens). Use `baseURL` for custom endpoints.',\n      });\n    }\n\n    return `https://bedrock-mantle.${region}.api.aws/${\n      // Mantle serves these models under its separate OpenAI route.\n      /^(?:openai\\.gpt-(?!oss-)|google\\.gemma-4|xai\\.)/.test(modelId)\n        ? 'openai/v1'\n        : 'v1'\n    }`;\n  };\n\n  const getHeaders = (): Record<string, string | undefined> =>\n    withUserAgentSuffix(\n      options.headers ?? {},\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n    );\n\n  const url = ({ path, modelId }: { path: string; modelId: string }): string =>\n    `${getBaseURL(modelId)}${path}`;\n\n  const createChatModel = (modelId: BedrockMantleChatModelId) =>\n    new OpenAIChatLanguageModel(modelId, {\n      provider: 'bedrock-mantle.chat',\n      url,\n      headers: getHeaders,\n      fetch: fetchFunction,\n    });\n\n  const createResponsesModel = (modelId: BedrockMantleResponsesModelId) =>\n    new OpenAIResponsesLanguageModel(modelId, {\n      provider: 'bedrock-mantle.responses',\n      url,\n      headers: getHeaders,\n      fetch: fetchFunction,\n      supportsWebSearchSourcesInclude: false,\n    });\n\n  const provider = function (modelId: BedrockMantleChatModelId) {\n    if (new.target) {\n      throw new Error(\n        'The Bedrock Mantle model function cannot be called with the new keyword.',\n      );\n    }\n\n    return createChatModel(modelId);\n  };\n\n  provider.specificationVersion = 'v4' as const;\n  provider.languageModel = createChatModel;\n  provider.chat = createChatModel;\n  provider.responses = createResponsesModel;\n\n  provider.embeddingModel = (modelId: string) => {\n    throw new NoSuchModelError({ modelId, modelType: 'embeddingModel' });\n  };\n  provider.textEmbeddingModel = provider.embeddingModel;\n  provider.imageModel = (modelId: string) => {\n    throw new NoSuchModelError({ modelId, modelType: 'imageModel' });\n  };\n\n  return provider as BedrockMantleProvider;\n}\n\n/**\n * Default Bedrock Mantle provider instance.\n */\nexport const bedrockMantle = createBedrockMantle();\n"],"mappings":";;;;;AAEA,MAAa,UAAA;;;;;;;;;;;ACuBb,SAAgB,yBACd,gBAGA,OACA,UAAkB,WACH;CACf,OAAO,OACL,OACA,SACsB;EAEtB,MAAM,iBAAiB,SAAS,WAAW;EAC3C,MAAM,UAAU,iBAAiB,UAAU,QAAQ,KAAA;EACnD,MAAM,kBAAkB,eACtB,iBAAiB,SAAS,OAAO,GACjC,iBAAiB,MAAM,OAAO,CAChC;EACA,MAAM,uBAAuB,oBAC3B,iBACA,yBAAyB,WACzB,+BAA+B,CACjC;EAEA,IAAI,gBAAsC,MAAM,QAAQ,KAAA;EACxD,IAAI,kBAAkB,KAAA,KAAa,WAAW,QAAQ,SAAS,MAC7D,IAAI;GACF,gBAAgB,MAAM,QAAQ,MAAM,CAAC,CAAC,KAAK;EAC7C,QAAQ,CAAC;EAKX,KAFwB,MAAM,UAAU,SAAS,OAAA,EAE5B,YAAY,MAAM,UAAU,CAAC,eAChD,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH,SAAS;EACX,CAAC;EAGH,MAAM,MACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,OACN,MAAM;EAEd,MAAM,OAAO,kBAAkB,aAAa;EAC5C,MAAM,cAAc,MAAM,eAAe;EAezC,MAAM,gBAAgB,MAAM,IAdT,YAAY;GAC7B;GACA,QAAQ;GACR,SAAS,OAAO,QAAQ,oBAAoB,CAAC,CAAC,QAAQ,GAAG,WACvD,QAAQ,KAAK,CACf;GACA;GACA,QAAQ,YAAY;GACpB,aAAa,YAAY;GACzB,iBAAiB,YAAY;GAC7B,cAAc,YAAY;GAC1B;EACF,CAEiC,CAAC,CAAC,KAAK;EACxC,MAAM,gBAAgB,iBAAiB,cAAc,OAAO;EAG5D,MAAM,kBAAkB,eAAe,sBAAsB,aAAa;EAE1E,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH;GACA,SAAS;EACX,CAAC;CACH;AACF;AAEA,SAAS,kBAAkB,MAAoC;CAC7D,IAAI,OAAO,SAAS,UAClB,OAAO;MACF,IAAI,gBAAgB,YACzB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;MAC/B,IAAI,gBAAgB,aACzB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,WAAW,IAAI,CAAC;MAEpD,OAAO,KAAK,UAAU,IAAI;AAE9B;AAEA,SAAS,QAAQ,OAAwB;CACvC,OAAO,CAAC,kBAAkB,KAAK,KAAK;AACtC;;;;;;;;AASA,SAAgB,0BACd,QACA,OACe;CACf,OAAO,OACL,OACA,SACsB;EAEtB,MAAM,iBAAiB,SAAS,WAAW;EAC3C,MAAM,kBAAkB,iBAAiB,MAAM,OAAO;EACtD,MAAM,uBAAuB,oBAC3B,iBACA,yBAAyB,WACzB,+BAA+B,CACjC;EAEA,MAAM,eAAe,eAAe,sBAAsB,EACxD,eAAe,UAAU,SAC3B,CAAC;EAED,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH,SAAS;EACX,CAAC;CACH;AACF;;;;;;;;AC5BA,SAAgB,oBACd,UAAyC,CAAC,GACnB;CAEvB,MAAM,YAAY,oBAAoB;EACpC,cAAc,QAAQ;EACtB,yBAAyB;CAC3B,CAAC;CAGD,MAAM,SACJ,aAAa,UAAU,KAAK,CAAC,CAAC,SAAS,IAAI,UAAU,KAAK,IAAI,KAAA;CAGhE,MAAM,gBAAgB,SAClB,0BAA0B,QAAQ,QAAQ,KAAK,IAC/C,yBACE,YAAY;EACV,MAAM,SAAS,YAAY;GACzB,cAAc,QAAQ;GACtB,aAAa;GACb,yBAAyB;GACzB,aAAa;EACf,CAAC;EAGD,IAAI,QAAQ,oBACV,IAAI;GACF,OAAO;IACL,GAAI,MAAM,QAAQ,mBAAmB;IACrC;GACF;EACF,SAAS,OAAO;GACd,MAAM,eACJ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvD,MAAM,IAAI,MACR,mCAAmC,aAAa,wHAGlD;EACF;EAGF,IAAI;GACF,OAAO;IACL;IACA,aAAa,YAAY;KACvB,cAAc,QAAQ;KACtB,aAAa;KACb,yBAAyB;KACzB,aAAa;IACf,CAAC;IACD,iBAAiB,YAAY;KAC3B,cAAc,QAAQ;KACtB,aAAa;KACb,yBAAyB;KACzB,aAAa;IACf,CAAC;IACD,cAAc,oBAAoB;KAChC,cAAc,QAAQ;KACtB,yBAAyB;IAC3B,CAAC;GACH;EACF,SAAS,OAAO;GACd,MAAM,eACJ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvD,IACE,aAAa,SAAS,mBAAmB,KACzC,aAAa,SAAS,aAAa,GAEnC,MAAM,IAAI,MACR;;;;;kBAKqB,cACvB;GAEF,IACE,aAAa,SAAS,uBAAuB,KAC7C,aAAa,SAAS,iBAAiB,GAEvC,MAAM,IAAI,MACR;kBAEqB,cACvB;GAEF,MAAM;EACR;CACF,GACA,QAAQ,OACR,gBACF;CAEJ,MAAM,cAAc,YAA4B;EAC9C,MAAM,UAAU,qBAAqB,QAAQ,OAAO;EACpD,IAAI,WAAW,MACb,OAAO;EAGT,MAAM,SAAS,YAAY;GACzB,cAAc,QAAQ;GACtB,aAAa;GACb,yBAAyB;GACzB,aAAa;EACf,CAAC;EACD,IAAI,CAAC,oBAAoB,MAAM,GAC7B,MAAM,IAAI,qBAAqB;GAC7B,UAAU;GACV,SACE;EACJ,CAAC;EAGH,OAAO,0BAA0B,OAAO,WAEtC,kDAAkD,KAAK,OAAO,IAC1D,cACA;CAER;CAEA,MAAM,mBACJ,oBACE,QAAQ,WAAW,CAAC,GACpB,yBAAyB,SAC3B;CAEF,MAAM,OAAO,EAAE,MAAM,cACnB,GAAG,WAAW,OAAO,IAAI;CAE3B,MAAM,mBAAmB,YACvB,IAAI,wBAAwB,SAAS;EACnC,UAAU;EACV;EACA,SAAS;EACT,OAAO;CACT,CAAC;CAEH,MAAM,wBAAwB,YAC5B,IAAI,6BAA6B,SAAS;EACxC,UAAU;EACV;EACA,SAAS;EACT,OAAO;EACP,iCAAiC;CACnC,CAAC;CAEH,MAAM,WAAW,SAAU,SAAmC;EAC5D,IAAI,YACF,MAAM,IAAI,MACR,0EACF;EAGF,OAAO,gBAAgB,OAAO;CAChC;CAEA,SAAS,uBAAuB;CAChC,SAAS,gBAAgB;CACzB,SAAS,OAAO;CAChB,SAAS,YAAY;CAErB,SAAS,kBAAkB,YAAoB;EAC7C,MAAM,IAAI,iBAAiB;GAAE;GAAS,WAAW;EAAiB,CAAC;CACrE;CACA,SAAS,qBAAqB,SAAS;CACvC,SAAS,cAAc,YAAoB;EACzC,MAAM,IAAI,iBAAiB;GAAE;GAAS,WAAW;EAAa,CAAC;CACjE;CAEA,OAAO;AACT;;;;AAKA,MAAa,gBAAgB,oBAAoB"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/version.ts","../../src/amazon-bedrock-sigv4-fetch.ts","../../src/mantle/bedrock-mantle-provider.ts"],"sourcesContent":["// Version string of this package injected at build time.\ndeclare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import { LoadAPIKeyError } from '@ai-sdk/provider';\nimport {\n  combineHeaders,\n  resolve,\n  type Resolvable,\n  normalizeHeaders,\n  withUserAgentSuffix,\n  getRuntimeEnvironmentUserAgent,\n  type FetchFunction,\n} from '@ai-sdk/provider-utils';\nimport { AwsV4Signer } from 'aws4fetch';\nimport { VERSION } from './version';\n\nexport interface AmazonBedrockCredentials {\n  region: string;\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string;\n}\n\n/**\n * Creates a fetch function that applies AWS Signature Version 4 signing.\n *\n * @param getCredentials - Function that returns the AWS credentials to use when signing.\n * @param fetch - Optional original fetch implementation to wrap. Defaults to global fetch.\n * @param service - The AWS service name to use for SigV4 signing scope. Defaults to 'bedrock'.\n * @returns A FetchFunction that signs requests before passing them to the underlying fetch.\n */\nexport function createSigV4FetchFunction(\n  getCredentials: () =>\n    | AmazonBedrockCredentials\n    | PromiseLike<AmazonBedrockCredentials>,\n  fetch?: FetchFunction,\n  service: string = 'bedrock',\n): FetchFunction {\n  return async (\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> => {\n    // avoid caching globalThis.fetch in case it is patched by other libraries\n    const effectiveFetch = fetch ?? globalThis.fetch;\n    const request = input instanceof Request ? input : undefined;\n    const originalHeaders = combineHeaders(\n      normalizeHeaders(request?.headers),\n      normalizeHeaders(init?.headers),\n    );\n    const headersWithUserAgent = withUserAgentSuffix(\n      originalHeaders,\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n      getRuntimeEnvironmentUserAgent(),\n    );\n\n    let effectiveBody: BodyInit | undefined = init?.body ?? undefined;\n    if (effectiveBody === undefined && request && request.body !== null) {\n      try {\n        effectiveBody = await request.clone().text();\n      } catch {}\n    }\n\n    const effectiveMethod = init?.method ?? request?.method;\n\n    if (effectiveMethod?.toUpperCase() !== 'POST' || !effectiveBody) {\n      return effectiveFetch(input, {\n        ...init,\n        headers: headersWithUserAgent as HeadersInit,\n      });\n    }\n\n    const url =\n      typeof input === 'string'\n        ? input\n        : input instanceof URL\n          ? input.href\n          : input.url;\n\n    const body = prepareBodyString(effectiveBody);\n    const credentials = await getCredentials();\n    const signer = new AwsV4Signer({\n      url,\n      method: 'POST',\n      headers: Object.entries(headersWithUserAgent).filter(([, value]) =>\n        isAscii(value),\n      ),\n      body,\n      region: credentials.region,\n      accessKeyId: credentials.accessKeyId,\n      secretAccessKey: credentials.secretAccessKey,\n      sessionToken: credentials.sessionToken,\n      service,\n    });\n\n    const signingResult = await signer.sign();\n    const signedHeaders = normalizeHeaders(signingResult.headers);\n\n    // Use the combined headers directly as HeadersInit\n    const combinedHeaders = combineHeaders(headersWithUserAgent, signedHeaders);\n\n    return effectiveFetch(input, {\n      ...init,\n      body,\n      headers: combinedHeaders as HeadersInit,\n    });\n  };\n}\n\nfunction prepareBodyString(body: BodyInit | undefined): string {\n  if (typeof body === 'string') {\n    return body;\n  } else if (body instanceof Uint8Array) {\n    return new TextDecoder().decode(body);\n  } else if (body instanceof ArrayBuffer) {\n    return new TextDecoder().decode(new Uint8Array(body));\n  } else {\n    return JSON.stringify(body);\n  }\n}\n\nfunction isAscii(value: string): boolean {\n  return !/[\\u0080-\\uffff]/.test(value);\n}\n\n/**\n * Creates a fetch function that applies Bearer token authentication.\n *\n * @param apiKey - The API key to use for Bearer token authentication.\n * @param fetch - Optional original fetch implementation to wrap. Defaults to global fetch.\n * @returns A FetchFunction that adds Authorization header with Bearer token to requests.\n */\nexport function createApiKeyFetchFunction(\n  apiKey: Resolvable<string>,\n  fetch?: FetchFunction,\n): FetchFunction {\n  return async (\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> => {\n    // avoid caching globalThis.fetch in case it is patched by other libraries\n    const effectiveFetch = fetch ?? globalThis.fetch;\n    const originalHeaders = normalizeHeaders(init?.headers);\n    const headersWithUserAgent = withUserAgentSuffix(\n      originalHeaders,\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n      getRuntimeEnvironmentUserAgent(),\n    );\n\n    const resolvedApiKey = await resolve(apiKey);\n    if (\n      typeof apiKey !== 'string' &&\n      (typeof resolvedApiKey !== 'string' || !resolvedApiKey.trim())\n    ) {\n      throw new LoadAPIKeyError({\n        message: 'Amazon Bedrock API key must be a non-empty string.',\n      });\n    }\n\n    const finalHeaders = combineHeaders(headersWithUserAgent, {\n      Authorization: `Bearer ${typeof apiKey === 'string' ? resolvedApiKey : resolvedApiKey.trim()}`,\n    });\n\n    return effectiveFetch(input, {\n      ...init,\n      headers: finalHeaders as HeadersInit,\n    });\n  };\n}\n","import {\n  OpenAIChatLanguageModel,\n  OpenAIResponsesLanguageModel,\n} from '@ai-sdk/openai/internal';\nimport {\n  InvalidArgumentError,\n  NoSuchModelError,\n  type LanguageModelV4,\n  type ProviderV4,\n} from '@ai-sdk/provider';\nimport {\n  isValidHostnamePart,\n  loadOptionalSetting,\n  loadSetting,\n  withoutTrailingSlash,\n  withUserAgentSuffix,\n  type FetchFunction,\n  type Resolvable,\n} from '@ai-sdk/provider-utils';\nimport {\n  createApiKeyFetchFunction,\n  createSigV4FetchFunction,\n  type AmazonBedrockCredentials,\n} from '../amazon-bedrock-sigv4-fetch';\nimport type {\n  BedrockMantleChatModelId,\n  BedrockMantleResponsesModelId,\n} from './bedrock-mantle-options';\nimport { VERSION } from '../version';\n\nexport interface BedrockMantleProvider extends ProviderV4 {\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   * Chat Completions has the broadest model support on Mantle.\n   */\n  (modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   */\n  languageModel(modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Chat Completions API.\n   */\n  chat(modelId: BedrockMantleChatModelId): LanguageModelV4;\n\n  /**\n   * Creates a model for text generation using the Responses API.\n   * Not all Mantle models support this API. Notably, gpt-oss-safeguard models\n   * are Chat-only.\n   */\n  responses(modelId: BedrockMantleResponsesModelId): LanguageModelV4;\n\n  /**\n   * @deprecated Mantle does not support embedding models.\n   */\n  textEmbeddingModel(modelId: string): never;\n}\n\nexport interface BedrockMantleProviderSettings {\n  /**\n   * The AWS region to use for the Bedrock Mantle endpoint. Defaults to the value of the\n   * `AWS_REGION` environment variable.\n   */\n  region?: string;\n\n  /**\n   * API key for authenticating requests using Bearer token authentication.\n   * A callback is resolved before each request and must return a non-empty key.\n   * When provided, this will be used instead of AWS SigV4 authentication.\n   * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.\n   */\n  apiKey?: Resolvable<string>;\n\n  /**\n   * The AWS access key ID to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_ACCESS_KEY_ID` environment variable.\n   */\n  accessKeyId?: string;\n\n  /**\n   * The AWS secret access key to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_SECRET_ACCESS_KEY` environment variable.\n   */\n  secretAccessKey?: string;\n\n  /**\n   * The AWS session token to use for SigV4 authentication. Defaults to the value of the\n   * `AWS_SESSION_TOKEN` environment variable.\n   */\n  sessionToken?: string;\n\n  /**\n   * Base URL for the Bedrock Mantle API calls.\n   */\n  baseURL?: string;\n\n  /**\n   * Custom headers to include in the requests.\n   */\n  headers?: Record<string, string | undefined>;\n\n  /**\n   * Custom fetch implementation. You can use it as a middleware to intercept requests,\n   * or to provide a custom fetch implementation for e.g. testing.\n   */\n  fetch?: FetchFunction;\n\n  /**\n   * The AWS credential provider to use for SigV4 authentication to get dynamic\n   * credentials similar to the AWS SDK. Setting a provider here will cause its\n   * credential values to be used instead of the `accessKeyId`, `secretAccessKey`,\n   * and `sessionToken` settings.\n   */\n  credentialProvider?: () => PromiseLike<\n    Omit<AmazonBedrockCredentials, 'region'>\n  >;\n}\n\n/**\n * Create an Amazon Bedrock Mantle provider instance.\n * This provider uses the OpenAI-compatible Mantle API for models that are\n * only available through the Mantle endpoint (e.g. openai.gpt-oss-20b).\n */\nexport function createBedrockMantle(\n  options: BedrockMantleProviderSettings = {},\n): BedrockMantleProvider {\n  // Check for API key authentication first\n  const rawApiKey =\n    typeof options.apiKey === 'string' || options.apiKey == null\n      ? loadOptionalSetting({\n          settingValue: options.apiKey,\n          environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',\n        })\n      : options.apiKey;\n\n  // Only use API key if it's a non-empty, non-whitespace string\n  const apiKey =\n    typeof rawApiKey === 'string' ? rawApiKey.trim() || undefined : rawApiKey;\n\n  // Use API key authentication if available, otherwise fall back to SigV4\n  const fetchFunction = apiKey\n    ? createApiKeyFetchFunction(apiKey, options.fetch)\n    : createSigV4FetchFunction(\n        async () => {\n          const region = loadSetting({\n            settingValue: options.region,\n            settingName: 'region',\n            environmentVariableName: 'AWS_REGION',\n            description: 'AWS region',\n          });\n\n          // If a credential provider is provided, use it to get the credentials.\n          if (options.credentialProvider) {\n            try {\n              return {\n                ...(await options.credentialProvider()),\n                region,\n              };\n            } catch (error) {\n              const errorMessage =\n                error instanceof Error ? error.message : String(error);\n              throw new Error(\n                `AWS credential provider failed: ${errorMessage}. ` +\n                  'Please ensure your credential provider returns valid AWS credentials ' +\n                  'with accessKeyId and secretAccessKey properties.',\n              );\n            }\n          }\n\n          try {\n            return {\n              region,\n              accessKeyId: loadSetting({\n                settingValue: options.accessKeyId,\n                settingName: 'accessKeyId',\n                environmentVariableName: 'AWS_ACCESS_KEY_ID',\n                description: 'AWS access key ID',\n              }),\n              secretAccessKey: loadSetting({\n                settingValue: options.secretAccessKey,\n                settingName: 'secretAccessKey',\n                environmentVariableName: 'AWS_SECRET_ACCESS_KEY',\n                description: 'AWS secret access key',\n              }),\n              sessionToken: loadOptionalSetting({\n                settingValue: options.sessionToken,\n                environmentVariableName: 'AWS_SESSION_TOKEN',\n              }),\n            };\n          } catch (error) {\n            const errorMessage =\n              error instanceof Error ? error.message : String(error);\n            if (\n              errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n              errorMessage.includes('accessKeyId')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                  '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                  '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                  '3. Use a credentialProvider function\\n' +\n                  '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            if (\n              errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n              errorMessage.includes('secretAccessKey')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                  'Please ensure both credentials are provided.\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            throw error;\n          }\n        },\n        options.fetch,\n        'bedrock-mantle',\n      );\n\n  const getBaseURL = (modelId: string): string => {\n    const baseURL = withoutTrailingSlash(options.baseURL);\n    if (baseURL != null) {\n      return baseURL;\n    }\n\n    const region = loadSetting({\n      settingValue: options.region,\n      settingName: 'region',\n      environmentVariableName: 'AWS_REGION',\n      description: 'AWS region',\n    });\n    if (!isValidHostnamePart(region)) {\n      throw new InvalidArgumentError({\n        argument: 'region',\n        message:\n          'Invalid AWS region. Expected a single DNS label (letters, digits, and hyphens). Use `baseURL` for custom endpoints.',\n      });\n    }\n\n    return `https://bedrock-mantle.${region}.api.aws/${\n      // Mantle serves these models under its separate OpenAI route.\n      /^(?:openai\\.gpt-(?!oss-)|google\\.gemma-4|xai\\.)/.test(modelId)\n        ? 'openai/v1'\n        : 'v1'\n    }`;\n  };\n\n  const getHeaders = (): Record<string, string | undefined> =>\n    withUserAgentSuffix(\n      options.headers ?? {},\n      `ai-sdk-amazon-bedrock/${VERSION}`,\n    );\n\n  const url = ({ path, modelId }: { path: string; modelId: string }): string =>\n    `${getBaseURL(modelId)}${path}`;\n\n  const createChatModel = (modelId: BedrockMantleChatModelId) =>\n    new OpenAIChatLanguageModel(modelId, {\n      provider: 'bedrock-mantle.chat',\n      url,\n      headers: getHeaders,\n      fetch: fetchFunction,\n    });\n\n  const createResponsesModel = (modelId: BedrockMantleResponsesModelId) =>\n    new OpenAIResponsesLanguageModel(modelId, {\n      provider: 'bedrock-mantle.responses',\n      url,\n      headers: getHeaders,\n      fetch: fetchFunction,\n      supportsWebSearchSourcesInclude: false,\n    });\n\n  const provider = function (modelId: BedrockMantleChatModelId) {\n    if (new.target) {\n      throw new Error(\n        'The Bedrock Mantle model function cannot be called with the new keyword.',\n      );\n    }\n\n    return createChatModel(modelId);\n  };\n\n  provider.specificationVersion = 'v4' as const;\n  provider.languageModel = createChatModel;\n  provider.chat = createChatModel;\n  provider.responses = createResponsesModel;\n\n  provider.embeddingModel = (modelId: string) => {\n    throw new NoSuchModelError({ modelId, modelType: 'embeddingModel' });\n  };\n  provider.textEmbeddingModel = provider.embeddingModel;\n  provider.imageModel = (modelId: string) => {\n    throw new NoSuchModelError({ modelId, modelType: 'imageModel' });\n  };\n\n  return provider as BedrockMantleProvider;\n}\n\n/**\n * Default Bedrock Mantle provider instance.\n */\nexport const bedrockMantle = createBedrockMantle();\n"],"mappings":";;;;;AAEA,MAAa,UAAA;;;;;;;;;;;AC0Bb,SAAgB,yBACd,gBAGA,OACA,UAAkB,WACH;CACf,OAAO,OACL,OACA,SACsB;EAEtB,MAAM,iBAAiB,SAAS,WAAW;EAC3C,MAAM,UAAU,iBAAiB,UAAU,QAAQ,KAAA;EACnD,MAAM,kBAAkB,eACtB,iBAAiB,SAAS,OAAO,GACjC,iBAAiB,MAAM,OAAO,CAChC;EACA,MAAM,uBAAuB,oBAC3B,iBACA,yBAAyB,WACzB,+BAA+B,CACjC;EAEA,IAAI,gBAAsC,MAAM,QAAQ,KAAA;EACxD,IAAI,kBAAkB,KAAA,KAAa,WAAW,QAAQ,SAAS,MAC7D,IAAI;GACF,gBAAgB,MAAM,QAAQ,MAAM,CAAC,CAAC,KAAK;EAC7C,QAAQ,CAAC;EAKX,KAFwB,MAAM,UAAU,SAAS,OAAA,EAE5B,YAAY,MAAM,UAAU,CAAC,eAChD,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH,SAAS;EACX,CAAC;EAGH,MAAM,MACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,OACN,MAAM;EAEd,MAAM,OAAO,kBAAkB,aAAa;EAC5C,MAAM,cAAc,MAAM,eAAe;EAezC,MAAM,gBAAgB,MAAM,IAdT,YAAY;GAC7B;GACA,QAAQ;GACR,SAAS,OAAO,QAAQ,oBAAoB,CAAC,CAAC,QAAQ,GAAG,WACvD,QAAQ,KAAK,CACf;GACA;GACA,QAAQ,YAAY;GACpB,aAAa,YAAY;GACzB,iBAAiB,YAAY;GAC7B,cAAc,YAAY;GAC1B;EACF,CAEiC,CAAC,CAAC,KAAK;EACxC,MAAM,gBAAgB,iBAAiB,cAAc,OAAO;EAG5D,MAAM,kBAAkB,eAAe,sBAAsB,aAAa;EAE1E,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH;GACA,SAAS;EACX,CAAC;CACH;AACF;AAEA,SAAS,kBAAkB,MAAoC;CAC7D,IAAI,OAAO,SAAS,UAClB,OAAO;MACF,IAAI,gBAAgB,YACzB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;MAC/B,IAAI,gBAAgB,aACzB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,WAAW,IAAI,CAAC;MAEpD,OAAO,KAAK,UAAU,IAAI;AAE9B;AAEA,SAAS,QAAQ,OAAwB;CACvC,OAAO,CAAC,kBAAkB,KAAK,KAAK;AACtC;;;;;;;;AASA,SAAgB,0BACd,QACA,OACe;CACf,OAAO,OACL,OACA,SACsB;EAEtB,MAAM,iBAAiB,SAAS,WAAW;EAC3C,MAAM,kBAAkB,iBAAiB,MAAM,OAAO;EACtD,MAAM,uBAAuB,oBAC3B,iBACA,yBAAyB,WACzB,+BAA+B,CACjC;EAEA,MAAM,iBAAiB,MAAM,QAAQ,MAAM;EAC3C,IACE,OAAO,WAAW,aACjB,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,IAE5D,MAAM,IAAI,gBAAgB,EACxB,SAAS,qDACX,CAAC;EAGH,MAAM,eAAe,eAAe,sBAAsB,EACxD,eAAe,UAAU,OAAO,WAAW,WAAW,iBAAiB,eAAe,KAAK,IAC7F,CAAC;EAED,OAAO,eAAe,OAAO;GAC3B,GAAG;GACH,SAAS;EACX,CAAC;CACH;AACF;;;;;;;;ACvCA,SAAgB,oBACd,UAAyC,CAAC,GACnB;CAEvB,MAAM,YACJ,OAAO,QAAQ,WAAW,YAAY,QAAQ,UAAU,OACpD,oBAAoB;EAClB,cAAc,QAAQ;EACtB,yBAAyB;CAC3B,CAAC,IACD,QAAQ;CAGd,MAAM,SACJ,OAAO,cAAc,WAAW,UAAU,KAAK,KAAK,KAAA,IAAY;CAGlE,MAAM,gBAAgB,SAClB,0BAA0B,QAAQ,QAAQ,KAAK,IAC/C,yBACE,YAAY;EACV,MAAM,SAAS,YAAY;GACzB,cAAc,QAAQ;GACtB,aAAa;GACb,yBAAyB;GACzB,aAAa;EACf,CAAC;EAGD,IAAI,QAAQ,oBACV,IAAI;GACF,OAAO;IACL,GAAI,MAAM,QAAQ,mBAAmB;IACrC;GACF;EACF,SAAS,OAAO;GACd,MAAM,eACJ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvD,MAAM,IAAI,MACR,mCAAmC,aAAa,wHAGlD;EACF;EAGF,IAAI;GACF,OAAO;IACL;IACA,aAAa,YAAY;KACvB,cAAc,QAAQ;KACtB,aAAa;KACb,yBAAyB;KACzB,aAAa;IACf,CAAC;IACD,iBAAiB,YAAY;KAC3B,cAAc,QAAQ;KACtB,aAAa;KACb,yBAAyB;KACzB,aAAa;IACf,CAAC;IACD,cAAc,oBAAoB;KAChC,cAAc,QAAQ;KACtB,yBAAyB;IAC3B,CAAC;GACH;EACF,SAAS,OAAO;GACd,MAAM,eACJ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvD,IACE,aAAa,SAAS,mBAAmB,KACzC,aAAa,SAAS,aAAa,GAEnC,MAAM,IAAI,MACR;;;;;kBAKqB,cACvB;GAEF,IACE,aAAa,SAAS,uBAAuB,KAC7C,aAAa,SAAS,iBAAiB,GAEvC,MAAM,IAAI,MACR;kBAEqB,cACvB;GAEF,MAAM;EACR;CACF,GACA,QAAQ,OACR,gBACF;CAEJ,MAAM,cAAc,YAA4B;EAC9C,MAAM,UAAU,qBAAqB,QAAQ,OAAO;EACpD,IAAI,WAAW,MACb,OAAO;EAGT,MAAM,SAAS,YAAY;GACzB,cAAc,QAAQ;GACtB,aAAa;GACb,yBAAyB;GACzB,aAAa;EACf,CAAC;EACD,IAAI,CAAC,oBAAoB,MAAM,GAC7B,MAAM,IAAI,qBAAqB;GAC7B,UAAU;GACV,SACE;EACJ,CAAC;EAGH,OAAO,0BAA0B,OAAO,WAEtC,kDAAkD,KAAK,OAAO,IAC1D,cACA;CAER;CAEA,MAAM,mBACJ,oBACE,QAAQ,WAAW,CAAC,GACpB,yBAAyB,SAC3B;CAEF,MAAM,OAAO,EAAE,MAAM,cACnB,GAAG,WAAW,OAAO,IAAI;CAE3B,MAAM,mBAAmB,YACvB,IAAI,wBAAwB,SAAS;EACnC,UAAU;EACV;EACA,SAAS;EACT,OAAO;CACT,CAAC;CAEH,MAAM,wBAAwB,YAC5B,IAAI,6BAA6B,SAAS;EACxC,UAAU;EACV;EACA,SAAS;EACT,OAAO;EACP,iCAAiC;CACnC,CAAC;CAEH,MAAM,WAAW,SAAU,SAAmC;EAC5D,IAAI,YACF,MAAM,IAAI,MACR,0EACF;EAGF,OAAO,gBAAgB,OAAO;CAChC;CAEA,SAAS,uBAAuB;CAChC,SAAS,gBAAgB;CACzB,SAAS,OAAO;CAChB,SAAS,YAAY;CAErB,SAAS,kBAAkB,YAAoB;EAC7C,MAAM,IAAI,iBAAiB;GAAE;GAAS,WAAW;EAAiB,CAAC;CACrE;CACA,SAAS,qBAAqB,SAAS;CACvC,SAAS,cAAc,YAAoB;EACzC,MAAM,IAAI,iBAAiB;GAAE;GAAS,WAAW;EAAa,CAAC;CACjE;CAEA,OAAO;AACT;;;;AAKA,MAAa,gBAAgB,oBAAoB"}

package/docs/08-amazon-bedrock.mdx

@@ -213,7 +213,12 @@ You can use the following optional settings to customize the Amazon Bedrock prov
   Optional. The AWS credential provider chain that you want to use for the API calls.
   It uses the specified credentials by default.
 
-- **apiKey** _string_
+- **apiKey** _string | PromiseLike<string> | (() => string | PromiseLike<string>)_
+
+  Pass a callback to resolve the API key before each request. The callback can
+  return a string or a promise; token caching and renewal are handled by the caller.
+  A callback or promise selects API key authentication and must resolve to a
+  non-empty string; lookup failures do not switch authentication methods.
 
   Optional. API key for authenticating requests using Bearer token authentication.
   When provided, this will be used instead of AWS SigV4 authentication.
@@ -1634,7 +1639,12 @@ You can use the following optional settings to customize the Bedrock Anthropic p
   used. If either key is taken from the environment, omitting `sessionToken`
   allows `AWS_SESSION_TOKEN`.
 
-- **apiKey** _string_
+- **apiKey** _string | PromiseLike<string> | (() => string | PromiseLike<string>)_
+
+  Pass a callback to resolve the API key before each request. The callback can
+  return a string or a promise; token caching and renewal are handled by the caller.
+  A callback or promise selects API key authentication and must resolve to a
+  non-empty string; lookup failures do not switch authentication methods.
 
   API key for authenticating requests using Bearer token authentication.
   When provided, this will be used instead of AWS SigV4 authentication.
@@ -1951,7 +1961,12 @@ You can use the following optional settings to customize the Bedrock Mantle prov
   Optional. The AWS session token that you want to use for the API calls.
   It uses the `AWS_SESSION_TOKEN` environment variable by default.
 
-- **apiKey** _string_
+- **apiKey** _string | PromiseLike<string> | (() => string | PromiseLike<string>)_
+
+  Pass a callback to resolve the API key before each request. The callback can
+  return a string or a promise; token caching and renewal are handled by the caller.
+  A callback or promise selects API key authentication and must resolve to a
+  non-empty string; lookup failures do not switch authentication methods.
 
   API key for authenticating requests using Bearer token authentication.
   When provided, this will be used instead of AWS SigV4 authentication.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/amazon-bedrock",
-  "version": "5.0.128",
+  "version": "5.0.129",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -41,10 +41,10 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/anthropic": "4.0.92",
-    "@ai-sdk/openai": "4.0.105",
-    "@ai-sdk/provider": "4.0.34",
-    "@ai-sdk/provider-utils": "5.0.71",
+    "@ai-sdk/anthropic": "4.0.93",
+    "@ai-sdk/openai": "4.0.106",
+    "@ai-sdk/provider": "4.0.35",
+    "@ai-sdk/provider-utils": "5.0.72",
     "@smithy/eventstream-codec": "^4.3.3",
     "@smithy/util-utf8": "^4.3.3",
     "aws4fetch": "^1.0.20"

package/src/amazon-bedrock-provider.ts

@@ -12,6 +12,7 @@ import {
   loadSetting,
   withUserAgentSuffix,
   type FetchFunction,
+  type Resolvable,
 } from '@ai-sdk/provider-utils';
 import { AmazonBedrockChatLanguageModel } from './amazon-bedrock-chat-language-model';
 import type {
@@ -44,6 +45,7 @@ export interface AmazonBedrockProviderSettings {
 
   /**
    * API key for authenticating requests using Bearer token authentication.
+   * A callback is resolved before each request and must return a non-empty key.
    * When provided, this will be used instead of AWS SigV4 authentication.
    * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.
    *
@@ -65,7 +67,7 @@ export interface AmazonBedrockProviderSettings {
    * If neither `apiKey` nor `AWS_BEARER_TOKEN_BEDROCK` environment variable is set,
    * the provider will fall back to AWS SigV4 authentication using AWS credentials.
    */
-  apiKey?: string;
+  apiKey?: Resolvable<string>;
 
   /**
    * The AWS access key ID to use for the Bedrock provider. Defaults to the value of the
@@ -193,15 +195,18 @@ export function createAmazonBedrock(
   options: AmazonBedrockProviderSettings = {},
 ): AmazonBedrockProvider {
   // Check for API key authentication first
-  const rawApiKey = loadOptionalSetting({
-    settingValue: options.apiKey,
-    environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
-  });
+  const rawApiKey =
+    typeof options.apiKey === 'string' || options.apiKey == null
+      ? loadOptionalSetting({
+          settingValue: options.apiKey,
+          environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
+        })
+      : options.apiKey;
 
   // FIX 1: Validate API key to ensure proper fallback to SigV4
   // Only use API key if it's a non-empty, non-whitespace string
   const apiKey =
-    rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : undefined;
+    typeof rawApiKey === 'string' ? rawApiKey.trim() || undefined : rawApiKey;
 
   // Use API key authentication if available, otherwise fall back to SigV4
   const fetchFunction = apiKey

package/src/amazon-bedrock-sigv4-fetch.ts

@@ -1,5 +1,8 @@
+import { LoadAPIKeyError } from '@ai-sdk/provider';
 import {
   combineHeaders,
+  resolve,
+  type Resolvable,
   normalizeHeaders,
   withUserAgentSuffix,
   getRuntimeEnvironmentUserAgent,
@@ -124,7 +127,7 @@ function isAscii(value: string): boolean {
  * @returns A FetchFunction that adds Authorization header with Bearer token to requests.
  */
 export function createApiKeyFetchFunction(
-  apiKey: string,
+  apiKey: Resolvable<string>,
   fetch?: FetchFunction,
 ): FetchFunction {
   return async (
@@ -140,8 +143,18 @@ export function createApiKeyFetchFunction(
       getRuntimeEnvironmentUserAgent(),
     );
 
+    const resolvedApiKey = await resolve(apiKey);
+    if (
+      typeof apiKey !== 'string' &&
+      (typeof resolvedApiKey !== 'string' || !resolvedApiKey.trim())
+    ) {
+      throw new LoadAPIKeyError({
+        message: 'Amazon Bedrock API key must be a non-empty string.',
+      });
+    }
+
     const finalHeaders = combineHeaders(headersWithUserAgent, {
-      Authorization: `Bearer ${apiKey}`,
+      Authorization: `Bearer ${typeof apiKey === 'string' ? resolvedApiKey : resolvedApiKey.trim()}`,
     });
 
     return effectiveFetch(input, {

package/src/anthropic/amazon-bedrock-anthropic-provider.ts

@@ -88,10 +88,11 @@ export interface AmazonBedrockAnthropicProviderSettings {
 
   /**
    * API key for authenticating requests using Bearer token authentication.
+   * A callback is resolved before each request and must return a non-empty key.
    * When provided, this will be used instead of AWS SigV4 authentication.
    * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.
    */
-  apiKey?: string;
+  apiKey?: Resolvable<string>;
 
   /**
    * The AWS access key ID to use for the Bedrock provider. Defaults to the value of the
@@ -147,14 +148,17 @@ export function createAmazonBedrockAnthropic(
   options: AmazonBedrockAnthropicProviderSettings = {},
 ): AmazonBedrockAnthropicProvider {
   // Check for API key authentication first
-  const rawApiKey = loadOptionalSetting({
-    settingValue: options.apiKey,
-    environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
-  });
+  const rawApiKey =
+    typeof options.apiKey === 'string' || options.apiKey == null
+      ? loadOptionalSetting({
+          settingValue: options.apiKey,
+          environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
+        })
+      : options.apiKey;
 
   // Only use API key if it's a non-empty, non-whitespace string
   const apiKey =
-    rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : undefined;
+    typeof rawApiKey === 'string' ? rawApiKey.trim() || undefined : rawApiKey;
 
   // Use API key authentication if available, otherwise fall back to SigV4
   const baseFetchFunction = apiKey

package/src/mantle/bedrock-mantle-provider.ts

@@ -15,6 +15,7 @@ import {
   withoutTrailingSlash,
   withUserAgentSuffix,
   type FetchFunction,
+  type Resolvable,
 } from '@ai-sdk/provider-utils';
 import {
   createApiKeyFetchFunction,
@@ -66,10 +67,11 @@ export interface BedrockMantleProviderSettings {
 
   /**
    * API key for authenticating requests using Bearer token authentication.
+   * A callback is resolved before each request and must return a non-empty key.
    * When provided, this will be used instead of AWS SigV4 authentication.
    * Defaults to the value of the `AWS_BEARER_TOKEN_BEDROCK` environment variable.
    */
-  apiKey?: string;
+  apiKey?: Resolvable<string>;
 
   /**
    * The AWS access key ID to use for SigV4 authentication. Defaults to the value of the
@@ -125,14 +127,17 @@ export function createBedrockMantle(
   options: BedrockMantleProviderSettings = {},
 ): BedrockMantleProvider {
   // Check for API key authentication first
-  const rawApiKey = loadOptionalSetting({
-    settingValue: options.apiKey,
-    environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
-  });
+  const rawApiKey =
+    typeof options.apiKey === 'string' || options.apiKey == null
+      ? loadOptionalSetting({
+          settingValue: options.apiKey,
+          environmentVariableName: 'AWS_BEARER_TOKEN_BEDROCK',
+        })
+      : options.apiKey;
 
   // Only use API key if it's a non-empty, non-whitespace string
   const apiKey =
-    rawApiKey && rawApiKey.trim().length > 0 ? rawApiKey.trim() : undefined;
+    typeof rawApiKey === 'string' ? rawApiKey.trim() || undefined : rawApiKey;
 
   // Use API key authentication if available, otherwise fall back to SigV4
   const fetchFunction = apiKey