@crvouga/mockingbird-service-bedrock 3.7.0 → 3.8.0

package/CHANGELOG.md

@@ -1,6 +1,17 @@
 # Changelog — @crvouga/mockingbird-service-bedrock
 
-## 3.7.0 (2026-10-19)
+## 3.8.0 (2026-10-21)
+
+### Features
+
+- raise the serve and fleet body limit to the S3 maximum ([86b9e2b](https://github.com/crvouga/mockingbird/commit/86b9e2b80bcaaaef57f52edbac50b27da0b42f33))
+
+### Fixes and improvements
+
+- finish junction, notion and bedrock docs and tests ([f1b4ccb](https://github.com/crvouga/mockingbird/commit/f1b4ccb4441144b5151b536aaacc8519b2e86075))
+- reject unknown script match keys and add schema, document and cache validation ([af0c60d](https://github.com/crvouga/mockingbird/commit/af0c60d672ec6810fca1b9a69559f34181303499))
+
+## 3.7.0 (2026-10-18)
 
 ### Features
 

package/README.md

@@ -106,7 +106,7 @@ HTTP/1.1 only — fine for the AI SDK, not for the SDK v3 Bedrock client.)
 | --- | --- |
 | `POST /model/{modelId}/converse` | Converse JSON: `output.message.content[]` (`text`, `toolUse`, `reasoningContent`), `stopReason`, `usage` (with `cacheRead/WriteInputTokens` when a `cachePoint` is present), `metrics`, `trace.guardrail` (with `guardrailConfig.trace: "enabled"`), `x-amzn-RequestId`. |
 | `POST /model/{modelId}/converse-stream` | The same answer as event frames: `messageStart`, `contentBlockStart` (tool use), `contentBlockDelta` (`text`, `toolUse.input` partial JSON, `reasoningContent`), `contentBlockStop`, `messageStop`, `metadata`; exception frames mid-stream. |
-| `POST /model/{modelId}/invoke` | `amazon.titan-embed-text-*`: `{embedding, inputTextTokenCount}` — a deterministic unit vector from SHA-256(`inputText`) (1024-d by default; `dimensions` 256/512/1024). Claude models: an Anthropic Messages body in, a Messages response out. |
+| `POST /model/{modelId}/invoke` | `amazon.titan-embed-text-*`: `{embedding, inputTextTokenCount}` — a deterministic unit vector from SHA-256(`inputText`) (1024-d by default; `dimensions` 256/512/1024), or a lexical one with `embeddingMode: "lexical"` (see Settings). Claude models: an Anthropic Messages body in, a Messages response out. |
 | `POST /model/{modelId}/invoke-with-bidirectional-stream` | Nova Sonic (`*sonic*`), HTTP/2 duplex: reads `chunk` events as they arrive (SigV4 envelopes unwrapped), answers each user turn with `textOutput` + 24 kHz PCM tone `audioOutput` + `toolUse`, then `usageEvent`; `completionEnd` after `sessionEnd`. |
 | `POST /harnesses/invoke?harnessArn=` | AgentCore harness stream: `messageStart`, `contentBlockDelta` (`text` or `toolResult[]`), `contentBlockStop`, `messageStop`, `metadata`; `validationException` / `internalServerException` / `runtimeClientError` frames. |
 
@@ -114,7 +114,8 @@ HTTP/1.1 only — fine for the AI SDK, not for the SDK v3 Bedrock client.)
 accepted without verification. Request checks Bedrock makes and our code branches on are
 enforced: role alternation, first/last message is the user (assistant **prefill** is rejected
 for Claude 4.5+), tool-use/tool-result pairing, `toolConfig` required with tool blocks, a
-document needs a sibling text block, `temperature` + `top_p` together on Claude 4.5+. Errors are
+document needs a sibling text block, `temperature` + `top_p` together on Claude 4.5+, plus the
+best-guess checks listed under "Best guesses, not oracle-verified". Errors are
 `x-amzn-ErrorType: <Name>:http://internal.amazon.com/coral/com.amazon.bedrock/` + `{"message"}`.
 Output longer than `maxTokens` (≈4 chars/token) is cut with `stopReason: "max_tokens"`.
 
@@ -127,8 +128,16 @@ how many calls it answers.
 - **Match keys:** `modelId` (glob), `operation` (`Converse`, `ConverseStream`, `InvokeModel`,
   `InvokeModelWithBidirectionalStream`, `InvokeHarness`), `lastUserText` (string = contains, or
   `{contains, regex, flags}`), `systemHash` (SHA-256 hex of the system text blocks joined with
-  `\n`), `toolsInclude`, `toolChoice` (`auto` / `any` / a tool name), `hasDocument`, `hasImage`,
-  `callIndex` (0-based index of the call in the namespace).
+  `\n`), `systemText` (the same joined system text, `cachePoint` blocks skipped; string =
+  case-insensitive contains, or `{contains, regex, flags}`; a call with no system prompt never
+  matches; for `InvokeModel` the Claude `system` string or text blocks, never stored),
+  `jsonSchemaName` (`outputConfig.textFormat.structure.jsonSchema.name`; string =
+  case-insensitive equality, or `{contains, regex, flags}`; a call without a named `outputConfig`
+  schema never matches), `toolsInclude`, `toolChoice` (`auto` / `any` / a tool name), `hasDocument`, `hasImage`,
+  `callIndex` (0-based index of the call in the namespace). `match` is a closed set: an unknown
+  or misspelled key (`lastUserTxt`) or a malformed criterion makes `PUT`/`POST /__admin/scripts`
+  answer 400 (`scripts[0].match.lastUserTxt: unknown match field (one of ...)`) instead of
+  silently matching every call; the same goes for an unknown key inside a text match.
 - **Turn selection** reads the conversation, not server state: turn *n* answers the call that
   comes after *n* assistant messages since the member last said something. So turn 0 is the
   first call of a user turn, turn 1 is the call that resumes after a tool result, and every new
@@ -166,6 +175,7 @@ applies to every model and harness call in the calling namespace):
 | `latency` (`latencyMs`) | the response starts after 2 s on the emulator clock |
 | `truncated_frame` | the stream stops half-way through a frame (both decoders throw) |
 | `model_timeout`, `service_unavailable`, `access_denied`, `internal_server` | 408 / 503 / 403 / 500 with the matching `x-amzn-ErrorType` |
+| `resource_not_found` | 404 `ResourceNotFoundException` ("The specified resource ARN was not found. Check the ARN and try again.", per the Converse API reference), before any frame, on Converse, ConverseStream and InvokeModel |
 
 Chunk pacing and latency wait on the **emulator clock**: freeze it (`POST /__admin/clock
 {"freeze": true}`) and advance it to release each chunk, so time-to-first-token tests are exact.
@@ -179,12 +189,53 @@ Chunk pacing and latency wait on the **emulator clock**: freeze it (`POST /__adm
 | `GET /__admin/scripts` | Scripts plus `stats` (`calls`, `scripted`, `unscripted`, `byScript`, `byFallback`, `byOperation`). |
 | `DELETE /__admin/scripts[?id=]` | Remove one or all. |
 | `GET /__admin/model-metrics` | Just the stats. |
-| `GET/PUT /__admin/settings` | `defaultText`, `chunkSize` (16), `delayMsPerChunk` (0), `audioTurnChunks` (0: a Nova Sonic spoken turn ends at the audio `contentEnd`; n: after n audio frames). |
+| `GET/PUT /__admin/settings` | `defaultText`, `chunkSize` (16), `delayMsPerChunk` (0), `audioTurnChunks` (0: a Nova Sonic spoken turn ends at the audio `contentEnd`; n: after n audio frames), `embeddingMode` (`sha256` default, or `lexical`), `validatePromptCaching` (`true` default; `false` disables the model check on `cachePoint`). |
+
+`embeddingMode: "lexical"` (opt-in; the test-control request in #522, not a Bedrock behaviour)
+keeps Titan vectors deterministic and unit length but makes them similarity-preserving: each
+word (lowercased, accents and punctuation dropped) adds to a SHA-256-chosen signed dimension, so
+texts differing only in case, punctuation or spacing have cosine similarity 1, texts sharing most
+words score high, and texts with no word in common score near 0. It is bag-of-words, not a
+language model: synonyms ("evening" / "night") stay apart. Scripted per-text vectors are not
+implemented. `normalize: false` is ignored in both modes (vectors are always unit length).
 
 The request journal (`GET /__admin/requests`) records per call only `modelId`, `script` (or
 `unscripted:<default>`), tool names, flags (`cachePoint`, `guardrail`, `document`, `image`,
 `structured:<form>`), `stopReason` and token counts — never prompt or message text.
 
+### Best guesses, not oracle-verified
+
+These request checks come from the AWS documentation and what consumers reported about live
+Bedrock, not from observing the service; the exact message text of the ones marked "ours" is an
+emulator choice. All answer `400 ValidationException`.
+
+- **Structured-output schemas** (`outputConfig.textFormat.structure.jsonSchema.schema`, Converse
+  and ConverseStream, [docs](https://docs.aws.amazon.com/bedrock/latest/userguide/structured-output.html)):
+  `schema` that is not a JSON object (ours); `oneOf` (`Schema type 'oneOf' is not supported`);
+  `additionalProperties` set to anything other than `false` on any node, `true` or a sub-schema
+  (`For 'object' type, 'additionalProperties: <X>' is not supported. Please set
+  'additionalProperties' to false`); a string-only `enum` combined with a union `type` such as
+  `["string","null"]` (ours); `minimum`, `maximum`, `multipleOf`, `minLength`, `maxLength`,
+  `minItems` above 1, an external `$ref`, and a recursive `$ref` cycle (ours). An omitted
+  `additionalProperties` and `anyOf` / `allOf` / internal `$ref` / `$defs` pass. Only the
+  `outputConfig` form is checked, not `additionalModelRequestFields.output_config` nor
+  `InvokeModel` bodies.
+- **Document names** (`document.name`, [API reference](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_DocumentBlock.html)):
+  1 to 200 characters of ASCII letters, digits, whitespace, hyphens, parentheses and square
+  brackets, with no run of two whitespace characters. The message is the one a consumer recorded
+  from live Bedrock.
+- **`cachePoint`** ([docs](https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-caching.html)):
+  a `cachePoint` content block directly after a `document` block (consumer report; message ours);
+  and, on Converse / ConverseStream, a `cachePoint` in `system`, `messages` or `toolConfig.tools`
+  for a model outside the documented list (Claude 3.5 Haiku, 3.5 Sonnet v2, 3.7 Sonnet, Claude
+  4 and later Opus / Sonnet / Haiku, Fable and Mythos; Nova Micro / Lite / Pro / 2 Lite), matched
+  on the family inside plain, `us.` / `global.` and ARN forms. The list grows: turn the model
+  check off with `PUT /__admin/settings {"validatePromptCaching": false}`. The `ttl` field is
+  not checked.
+- **Unknown model ids** still answer normally (`modelId` is any id). A `knownModels` setting that
+  makes an unknown id fail was requested in #523 but not built: whether live Bedrock answers
+  `ResourceNotFoundException` or `ValidationException` for it has not been observed.
+
 ### Namespaces
 
 `x-mockingbird-namespace`, a `/__admin/ns/<name>` prefix on the endpoint URL, or by credential: the SDKs
@@ -213,6 +264,7 @@ cannot add headers, so map each worker's access key id:
 | `accessKeyCredential` | function | The SigV4 access key id of a request (how credentials map to namespaces). |
 | `clockSleep` | function | A sleep that waits on a (possibly frozen) emulator clock. |
 | `titanEmbedding` | function | The deterministic unit vector Titan answers with. |
+| `lexicalEmbedding`, `EMBEDDING_MODES` | function, array | The opt-in similarity-preserving embedding and the `embeddingMode` values. |
 | `sampleSchema` | function | The minimal instance of a JSON Schema (the unscripted structured output). |
 | `parseScript` | function | Validate one script (what `PUT /__admin/scripts` runs). |
 | `MODEL_OPERATIONS`, `STOP_REASONS`, `TURN_FAULTS` | arrays | The values `operation`, `stopReason` and `fault` accept. |

package/dist/{chunk-3H4ZVXWL.js → chunk-CL6K2ZUM.js}

@@ -1,7 +1,7 @@
 import {
   createRuntime,
   parseScript
-} from "./chunk-LG5SXNQW.js";
+} from "./chunk-PFSY7JLL.js";
 
 // src/h2c.ts
 import {
@@ -338,4 +338,4 @@ export {
   createServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-3H4ZVXWL.js.map
+//# sourceMappingURL=chunk-CL6K2ZUM.js.map

package/dist/{chunk-LG5SXNQW.js → chunk-PFSY7JLL.js}

@@ -4029,7 +4029,7 @@ var stateAdminRoutes = (routes) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "3.7.0" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "3.8.0" : UNRELEASED_VERSION;
 
 // ../core/dist/signing.js
 var encoder = new TextEncoder();
@@ -5327,6 +5327,9 @@ var ValidationProblem = class extends Error {
 };
 var NO_PREFILL = /claude-(?:sonnet|opus)-4-[5-9]|claude-opus-4-1|claude-(?:sonnet|opus|haiku)-[5-9]/i;
 var ONE_SAMPLING_PARAM = /claude-(?:sonnet|opus|haiku)-4-[5-9]|claude-opus-4-1|claude-(?:sonnet|opus|haiku)-[5-9]/i;
+var PROMPT_CACHING = /claude-3-5-haiku|claude-3-5-sonnet-20241022|claude-3-7-sonnet|claude-(?:opus|sonnet|haiku|fable|mythos)-[4-9]|nova-(?:micro|lite|pro|2-lite)/i;
+var DOCUMENT_NAME = /^[a-zA-Z0-9\s\-()[\]]{1,200}$/;
+var DOCUMENT_NAME_MESSAGE = "The document file name can only contain alphanumeric characters, whitespace characters, hyphens, parentheses, and square brackets. The name can't contain more than one consecutive whitespace character.";
 var parseSchema = (value) => {
   if (typeof value !== "string") return value;
   try {
@@ -5335,6 +5338,64 @@ var parseSchema = (value) => {
     return {};
   }
 };
+var UNSUPPORTED_KEYWORDS = ["minimum", "maximum", "multipleOf", "minLength", "maxLength"];
+var SCHEMA_SLOTS = ["items", "not", "if", "then", "else", "contains"];
+var SCHEMA_LISTS = ["anyOf", "allOf", "prefixItems"];
+var SCHEMA_MAPS = ["properties", "$defs", "definitions", "patternProperties"];
+var unsupportedSchemaReason = (root) => {
+  const resolve = (ref) => {
+    if (ref === "#") return root;
+    let node = root;
+    for (const part of ref.slice(2).split("/")) {
+      node = isRecord5(node) ? node[part.replaceAll("~1", "/").replaceAll("~0", "~")] : void 0;
+    }
+    return node;
+  };
+  const visit = (node, refs) => {
+    if (!isRecord5(node)) return void 0;
+    if (node.oneOf !== void 0) return "Schema type 'oneOf' is not supported";
+    for (const key of UNSUPPORTED_KEYWORDS) {
+      if (node[key] !== void 0) return `Schema keyword '${key}' is not supported`;
+    }
+    if (typeof node.minItems === "number" && node.minItems > 1) {
+      return `Schema keyword 'minItems' only supports the values 0 and 1 (got ${node.minItems})`;
+    }
+    if (node.additionalProperties !== void 0 && node.additionalProperties !== false) {
+      return `For 'object' type, 'additionalProperties: ${JSON.stringify(node.additionalProperties)}' is not supported. Please set 'additionalProperties' to false`;
+    }
+    if (Array.isArray(node.type) && Array.isArray(node.enum) && node.enum.length > 0 && node.enum.every((value) => typeof value === "string")) {
+      return `A string-only 'enum' cannot be combined with the union type ${JSON.stringify(node.type)}`;
+    }
+    if (typeof node.$ref === "string") {
+      if (!node.$ref.startsWith("#")) {
+        return `External $ref '${node.$ref}' is not supported; only internal references are`;
+      }
+      if (refs.includes(node.$ref)) return `Recursive schemas are not supported ('${node.$ref}')`;
+      const problem = visit(resolve(node.$ref), [...refs, node.$ref]);
+      if (problem) return problem;
+    }
+    for (const key of SCHEMA_SLOTS) {
+      const problem = visit(node[key], refs);
+      if (problem) return problem;
+    }
+    for (const key of SCHEMA_LISTS) {
+      for (const each of array(node[key])) {
+        const problem = visit(each, refs);
+        if (problem) return problem;
+      }
+    }
+    for (const key of SCHEMA_MAPS) {
+      const map = node[key];
+      if (!isRecord5(map)) continue;
+      for (const each of Object.values(map)) {
+        const problem = visit(each, refs);
+        if (problem) return problem;
+      }
+    }
+    return void 0;
+  };
+  return visit(root, []);
+};
 var textOf = (blocks) => blocks.map((block) => isRecord5(block) && typeof block.text === "string" ? block.text : "").filter((text2) => text2.length > 0).join("\n");
 var conversationFacts = (messages) => {
   let lastSaid = -1;
@@ -5432,11 +5493,15 @@ var converseMessage = (value, index) => {
     hasCachePoint: false,
     chars: 0
   };
-  for (const block of content) {
+  for (const [at, block] of content.entries()) {
     if (!isRecord5(block)) continue;
     out.chars += JSON.stringify(block).length;
     if (typeof block.text === "string") out.hasContent = true;
     if (isRecord5(block.document)) {
+      const name2 = block.document.name;
+      if (typeof name2 === "string" && (!DOCUMENT_NAME.test(name2) || /\s{2,}/.test(name2))) {
+        throw new ValidationProblem(DOCUMENT_NAME_MESSAGE);
+      }
       out.hasDocument = true;
       out.hasContent = true;
     }
@@ -5445,7 +5510,14 @@ var converseMessage = (value, index) => {
       out.hasContent = true;
     }
     if (isRecord5(block.video)) out.hasContent = true;
-    if (isRecord5(block.cachePoint)) out.hasCachePoint = true;
+    if (isRecord5(block.cachePoint)) {
+      if (isRecord5(content[at - 1]) && isRecord5(content[at - 1].document)) {
+        throw new ValidationProblem(
+          `The model returned the following errors: messages.${index}.content.${at}: a cachePoint cannot directly follow a document block.`
+        );
+      }
+      out.hasCachePoint = true;
+    }
     if (isRecord5(block.toolUse)) {
       out.toolUses.push({
         id: String(block.toolUse.toolUseId ?? ""),
@@ -5456,7 +5528,7 @@ var converseMessage = (value, index) => {
   }
   return out;
 };
-var analyzeConverse = (operation, modelId, body) => {
+var analyzeConverse = (operation, modelId, body, options = {}) => {
   if (!isRecord5(body))
     throw new ValidationProblem(
       "Malformed input request, please reformat your input and try again."
@@ -5505,9 +5577,22 @@ var analyzeConverse = (operation, modelId, body) => {
   const jsonSchema = textFormat && isRecord5(textFormat.structure) && isRecord5(textFormat.structure.jsonSchema) ? textFormat.structure.jsonSchema : void 0;
   const nativeFormat = isRecord5(additional.output_config) && isRecord5(additional.output_config.format) ? additional.output_config.format : void 0;
   if (jsonSchema) {
+    let schema = jsonSchema.schema;
+    if (typeof schema === "string") {
+      try {
+        schema = JSON.parse(schema);
+      } catch {
+        schema = void 0;
+      }
+      if (!isRecord5(schema)) {
+        throw new ValidationProblem("The structured output schema is not a valid JSON object.");
+      }
+    }
+    const reason = unsupportedSchemaReason(schema);
+    if (reason) throw new ValidationProblem(reason);
     structured = {
       form: "outputConfig",
-      schema: parseSchema(jsonSchema.schema),
+      schema,
       ...typeof jsonSchema.name === "string" ? { name: jsonSchema.name } : {}
     };
   } else if (nativeFormat && nativeFormat.type === "json_schema") {
@@ -5521,6 +5606,12 @@ var analyzeConverse = (operation, modelId, body) => {
   }
   const facts = conversationFacts(messages);
   const systemText = textOf(system);
+  const hasCachePoint = messages.some((m) => m.hasCachePoint) || system.some((b) => isRecord5(b) && isRecord5(b.cachePoint)) || array(toolConfig?.tools).some((t) => isRecord5(t) && isRecord5(t.cachePoint));
+  if (hasCachePoint && options.validatePromptCaching !== false && !PROMPT_CACHING.test(modelId)) {
+    throw new ValidationProblem(
+      "The model does not support prompt caching: remove the cachePoint block from the request."
+    );
+  }
   return {
     operation,
     modelId,
@@ -5531,7 +5622,7 @@ var analyzeConverse = (operation, modelId, body) => {
     toolChoice,
     hasDocument: messages.some((m) => m.hasDocument),
     hasImage: messages.some((m) => m.hasImage),
-    hasCachePoint: messages.some((m) => m.hasCachePoint) || system.some((b) => isRecord5(b) && isRecord5(b.cachePoint)) || array(toolConfig?.tools).some((t) => isRecord5(t) && isRecord5(t.cachePoint)),
+    hasCachePoint,
     hasGuardrail: isRecord5(body.guardrailConfig),
     toolResults: facts.toolResults,
     turnIndex: facts.turnIndex,
@@ -5833,6 +5924,7 @@ var TURN_FAULTS = [
   "model_timeout",
   "service_unavailable",
   "internal_server",
+  "resource_not_found",
   "mid_stream_exception",
   "max_tokens",
   "truncated_frame",
@@ -5866,6 +5958,16 @@ var matches2 = (match, call, context) => {
   if (match.systemHash !== void 0 && match.systemHash.toLowerCase() !== context.systemHash) {
     return false;
   }
+  if (match.systemText !== void 0) {
+    if (call.systemText === "" || !textMatches(match.systemText, call.systemText)) return false;
+  }
+  if (match.jsonSchemaName !== void 0) {
+    const name2 = call.structured?.form === "outputConfig" ? call.structured.name : void 0;
+    if (name2 === void 0) return false;
+    const rule = match.jsonSchemaName;
+    if (typeof rule === "string" ? rule.toLowerCase() !== name2.toLowerCase() : !textMatches(rule, name2))
+      return false;
+  }
   if (match.toolsInclude?.some((name2) => !call.tools.includes(name2))) return false;
   if (match.toolChoice !== void 0) {
     const want = ["auto", "any", "none"].includes(match.toolChoice) ? match.toolChoice : `tool:${match.toolChoice}`;
@@ -5938,6 +6040,75 @@ var checkTurn = (turn, path) => {
   }
   return void 0;
 };
+var MATCH_KEYS = [
+  "modelId",
+  "operation",
+  "lastUserText",
+  "systemHash",
+  "systemText",
+  "jsonSchemaName",
+  "toolsInclude",
+  "toolChoice",
+  "hasDocument",
+  "hasImage",
+  "callIndex"
+];
+var checkTextMatch = (rule, path) => {
+  if (typeof rule === "string") return void 0;
+  if (!isRecord6(rule)) return fail2(path, "a string or {contains, regex, flags}");
+  for (const key of Object.keys(rule)) {
+    if (!["contains", "regex", "flags"].includes(key)) {
+      return fail2(`${path}.${key}`, "unknown text match field (one of contains, regex, flags)");
+    }
+  }
+  for (const key of ["contains", "regex", "flags"]) {
+    if (rule[key] !== void 0 && typeof rule[key] !== "string")
+      return fail2(`${path}.${key}`, "string");
+  }
+  if (typeof rule.regex === "string") {
+    try {
+      new RegExp(rule.regex, typeof rule.flags === "string" ? rule.flags : "i");
+    } catch {
+      return fail2(`${path}.regex`, "not a valid regular expression (with these flags)");
+    }
+  }
+  return void 0;
+};
+var checkMatch = (match, path) => {
+  for (const key of Object.keys(match)) {
+    if (!MATCH_KEYS.includes(key)) {
+      return fail2(`${path}.${key}`, `unknown match field (one of ${MATCH_KEYS.join(", ")})`);
+    }
+  }
+  if (match.operation !== void 0) {
+    const ops = Array.isArray(match.operation) ? match.operation : [match.operation];
+    for (const op of ops) {
+      if (!MODEL_OPERATIONS.includes(op)) {
+        return fail2(`${path}.operation`, `one of ${MODEL_OPERATIONS.join(", ")}`);
+      }
+    }
+  }
+  for (const key of ["modelId", "systemHash", "toolChoice"]) {
+    if (match[key] !== void 0 && typeof match[key] !== "string")
+      return fail2(`${path}.${key}`, "string");
+  }
+  for (const key of ["lastUserText", "systemText", "jsonSchemaName"]) {
+    if (match[key] === void 0) continue;
+    const problem = checkTextMatch(match[key], `${path}.${key}`);
+    if (problem) return problem;
+  }
+  for (const key of ["hasDocument", "hasImage"]) {
+    if (match[key] !== void 0 && typeof match[key] !== "boolean")
+      return fail2(`${path}.${key}`, "boolean");
+  }
+  if (match.callIndex !== void 0 && !(typeof match.callIndex === "number" && Number.isInteger(match.callIndex) && match.callIndex >= 0)) {
+    return fail2(`${path}.callIndex`, "a non-negative integer");
+  }
+  if (match.toolsInclude !== void 0 && !(Array.isArray(match.toolsInclude) && match.toolsInclude.every((n) => typeof n === "string"))) {
+    return fail2(`${path}.toolsInclude`, "string[]");
+  }
+  return void 0;
+};
 var parseScript = (value, index) => {
   const path = `scripts[${index}]`;
   if (!isRecord6(value)) return fail2(path, "a script is an object");
@@ -5952,25 +6123,8 @@ var parseScript = (value, index) => {
   }
   if (value.match !== void 0) {
     if (!isRecord6(value.match)) return fail2(`${path}.match`, "an object");
-    const match = value.match;
-    if (match.operation !== void 0) {
-      const ops = Array.isArray(match.operation) ? match.operation : [match.operation];
-      for (const op of ops) {
-        if (!MODEL_OPERATIONS.includes(op)) {
-          return fail2(`${path}.match.operation`, `one of ${MODEL_OPERATIONS.join(", ")}`);
-        }
-      }
-    }
-    if (isRecord6(match.lastUserText) && typeof match.lastUserText.regex === "string") {
-      try {
-        new RegExp(match.lastUserText.regex);
-      } catch {
-        return fail2(`${path}.match.lastUserText.regex`, "not a valid regular expression");
-      }
-    }
-    if (match.toolsInclude !== void 0 && !Array.isArray(match.toolsInclude)) {
-      return fail2(`${path}.match.toolsInclude`, "string[]");
-    }
+    const problem = checkMatch(value.match, `${path}.match`);
+    if (problem) return problem;
   }
   if (value.times !== void 0 && (typeof value.times !== "number" || value.times < 1)) {
     return fail2(`${path}.times`, "a positive count");
@@ -7018,11 +7172,14 @@ var sonicSession = (request, modelId, host) => {
 };
 
 // src/state.ts
+var EMBEDDING_MODES = ["sha256", "lexical"];
 var DEFAULT_SETTINGS = {
   defaultText: "OK.",
   chunkSize: 16,
   delayMsPerChunk: 0,
-  audioTurnChunks: 0
+  audioTurnChunks: 0,
+  embeddingMode: "sha256",
+  validatePromptCaching: true
 };
 var EMPTY_STATS = {
   calls: 0,
@@ -7153,6 +7310,7 @@ var BEDROCK_PRESETS = {
     type: "service_unavailable"
   }),
   access_denied: everyCall("403 AccessDeniedException", { type: "access_denied" }),
+  resource_not_found: everyCall("404 ResourceNotFoundException", { type: "resource_not_found" }),
   internal_server: everyCall("500 InternalServerException", { type: "internal_server" })
 };
 var json5 = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
@@ -7175,7 +7333,9 @@ var SETTING_CHECKS = {
   defaultText: (value) => typeof value === "string",
   chunkSize: (value) => typeof value === "number" && value >= 1,
   delayMsPerChunk: (value) => typeof value === "number" && value >= 0,
-  audioTurnChunks: (value) => typeof value === "number" && value >= 0
+  audioTurnChunks: (value) => typeof value === "number" && value >= 0,
+  embeddingMode: (value) => EMBEDDING_MODES.includes(value),
+  validatePromptCaching: (value) => typeof value === "boolean"
 };
 var adminRoutes = (runtime) => {
   const store = (replace) => ({ body, namespace }) => {
@@ -7272,6 +7432,11 @@ var FAULT_ERRORS = {
     "ServiceUnavailableException",
     "Bedrock is unable to process your request."
   ],
+  resource_not_found: [
+    404,
+    "ResourceNotFoundException",
+    "The specified resource ARN was not found. Check the ARN and try again."
+  ],
   internal_server: [
     500,
     "InternalServerException",
@@ -7327,6 +7492,18 @@ var titanEmbedding = async (inputText, dims = 1024) => {
   const norm = Math.sqrt(values.reduce((sum, v) => sum + v * v, 0)) || 1;
   return values.map((v) => v / norm);
 };
+var lexicalEmbedding = async (inputText, dims = 1024) => {
+  const words = inputText.normalize("NFKD").replace(/\p{M}/gu, "").toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
+  if (words.length === 0) return titanEmbedding(inputText, dims);
+  const values = new Array(dims).fill(0);
+  for (const word of words) {
+    const digest = new DataView(await crypto.subtle.digest("SHA-256", utf84.encode(word)));
+    const at = digest.getUint32(0, false) % dims;
+    values[at] = values[at] + (digest.getUint8(4) & 1 ? 1 : -1);
+  }
+  const norm = Math.sqrt(values.reduce((sum, v) => sum + v * v, 0));
+  return norm === 0 ? titanEmbedding(inputText, dims) : values.map((v) => v / norm);
+};
 var BedrockAPI = class {
   app;
   sqlite;
@@ -7523,7 +7700,9 @@ var BedrockAPI = class {
     }
     let call;
     try {
-      call = analyzeConverse(operation, modelId, body);
+      call = analyzeConverse(operation, modelId, body, {
+        validatePromptCaching: this.state.current().validatePromptCaching
+      });
     } catch (error) {
       if (error instanceof ValidationProblem)
         return bedrockError(400, "ValidationException", error.message, requestId);
@@ -7627,7 +7806,8 @@ var BedrockAPI = class {
       ids: { modelId, script: "unscripted:titan", inputTokens: String(inputTextTokenCount) }
     });
     if (failed) return notes2(failed);
-    const embedding = await titanEmbedding(inputText, dimensions);
+    const embed = this.state.current().embeddingMode === "lexical" ? lexicalEmbedding : titanEmbedding;
+    const embedding = await embed(inputText, dimensions);
     return notes2(
       jsonRes(
         200,
@@ -7780,6 +7960,7 @@ export {
   eventFrame,
   exceptionFrame,
   readFrames,
+  EMBEDDING_MODES,
   DEFAULT_SETTINGS,
   BEDROCK_PRESETS,
   createRuntime2 as createRuntime,
@@ -7788,6 +7969,7 @@ export {
   accessKeyCredential,
   clockSleep,
   titanEmbedding,
+  lexicalEmbedding,
   BedrockAPI
 };
-//# sourceMappingURL=chunk-LG5SXNQW.js.map
+//# sourceMappingURL=chunk-PFSY7JLL.js.map