@gakr-gakr/amazon-bedrock-provider 0.1.0

package/api.ts

@@ -0,0 +1,6 @@
+export { mergeImplicitBedrockProvider, resolveBedrockConfigApiKey } from "./discovery-shared.js";
+export {
+  discoverBedrockModels,
+  resetBedrockDiscoveryCacheForTest,
+  resolveImplicitBedrockProvider,
+} from "./discovery.js";

package/autobot.plugin.json

@@ -0,0 +1,80 @@
+{
+  "id": "amazon-bedrock",
+  "activation": {
+    "onStartup": false
+  },
+  "enabledByDefault": true,
+  "providers": ["amazon-bedrock"],
+  "contracts": {
+    "memoryEmbeddingProviders": ["bedrock"]
+  },
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "discovery": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "enabled": { "type": "boolean" },
+          "region": { "type": "string" },
+          "providerFilter": {
+            "type": "array",
+            "items": { "type": "string" }
+          },
+          "refreshInterval": { "type": "integer", "minimum": 0 },
+          "defaultContextWindow": { "type": "integer", "minimum": 1 },
+          "defaultMaxTokens": { "type": "integer", "minimum": 1 }
+        }
+      },
+      "guardrail": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "guardrailIdentifier": { "type": "string" },
+          "guardrailVersion": { "type": "string" },
+          "streamProcessingMode": { "type": "string", "enum": ["sync", "async"] },
+          "trace": { "type": "string", "enum": ["enabled", "disabled", "enabled_full"] }
+        },
+        "required": ["guardrailIdentifier", "guardrailVersion"]
+      }
+    }
+  },
+  "configContracts": {
+    "compatibilityMigrationPaths": ["models.bedrockDiscovery"]
+  },
+  "uiHints": {
+    "discovery": {
+      "label": "Model Discovery",
+      "help": "Plugin-owned controls for Amazon Bedrock model auto-discovery."
+    },
+    "discovery.enabled": {
+      "label": "Enable Discovery",
+      "help": "When false, AutoBot keeps the Amazon Bedrock plugin available but skips implicit startup discovery. When true, discovery can run even without AWS auth env markers."
+    },
+    "discovery.region": {
+      "label": "Discovery Region",
+      "help": "AWS region to use for Bedrock model discovery. Defaults to AWS_REGION, AWS_DEFAULT_REGION, then us-east-1."
+    },
+    "discovery.providerFilter": {
+      "label": "Provider Filter",
+      "help": "Optional Bedrock provider-name allowlist for discovery, such as anthropic or amazon."
+    },
+    "discovery.refreshInterval": {
+      "label": "Discovery Refresh Interval (s)",
+      "help": "How long to cache Bedrock discovery results in seconds. Set to 0 to disable caching."
+    },
+    "discovery.defaultContextWindow": {
+      "label": "Default Context Window",
+      "help": "Fallback context window to assign to discovered Bedrock models."
+    },
+    "discovery.defaultMaxTokens": {
+      "label": "Default Max Tokens",
+      "help": "Fallback max output tokens to assign to discovered Bedrock models."
+    },
+    "guardrail": {
+      "label": "Guardrail",
+      "help": "Amazon Bedrock Guardrails settings applied to Bedrock model invocations."
+    }
+  }
+}

package/aws-credential-refresh.ts

@@ -0,0 +1,42 @@
+type SharedIniFileLoader = {
+  loadSharedConfigFiles(init?: { ignoreCache?: boolean }): Promise<unknown>;
+};
+
+let sharedIniFileLoaderForTest: SharedIniFileLoader | null | undefined;
+
+function hasStaticAwsCredentialEnv(env: NodeJS.ProcessEnv): boolean {
+  return Boolean(env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY);
+}
+
+export function shouldRefreshAwsSharedConfigCacheForBedrock(env: NodeJS.ProcessEnv): boolean {
+  if (env.AWS_BEDROCK_SKIP_AUTH === "1" || env.AWS_BEARER_TOKEN_BEDROCK) {
+    return false;
+  }
+  return !hasStaticAwsCredentialEnv(env);
+}
+
+async function loadSharedIniFileLoader(): Promise<SharedIniFileLoader> {
+  if (sharedIniFileLoaderForTest !== undefined) {
+    if (!sharedIniFileLoaderForTest) {
+      throw new Error("AWS shared INI file loader unavailable");
+    }
+    return sharedIniFileLoaderForTest;
+  }
+  return (await import("@smithy/shared-ini-file-loader")) as SharedIniFileLoader;
+}
+
+export async function refreshAwsSharedConfigCacheForBedrock(
+  env: NodeJS.ProcessEnv = process.env,
+): Promise<void> {
+  if (!shouldRefreshAwsSharedConfigCacheForBedrock(env)) {
+    return;
+  }
+  const loader = await loadSharedIniFileLoader();
+  await loader.loadSharedConfigFiles({ ignoreCache: true });
+}
+
+export function setAwsSharedIniFileLoaderForTest(
+  loader: SharedIniFileLoader | null | undefined,
+): void {
+  sharedIniFileLoaderForTest = loader;
+}

package/config-api.ts

@@ -0,0 +1,4 @@
+// Narrow barrel for config compatibility helpers consumed outside the plugin.
+// Keep this separate from runtime exports so doctor/config code stays lightweight.
+
+export { migrateAmazonBedrockLegacyConfig } from "./config-compat.js";

package/config-compat.ts

@@ -0,0 +1,107 @@
+import { isRecord } from "autobot/plugin-sdk/string-coerce-runtime";
+
+type JsonRecord = Record<string, unknown>;
+
+const LEGACY_PATH = "models.bedrockDiscovery";
+const TARGET_PATH = "plugins.entries.amazon-bedrock.config.discovery";
+const BLOCKED_OBJECT_KEYS = new Set(["__proto__", "prototype", "constructor"]);
+
+function isBlockedObjectKey(key: string): boolean {
+  return BLOCKED_OBJECT_KEYS.has(key);
+}
+
+function getRecord(value: unknown): JsonRecord | null {
+  return isRecord(value) ? value : null;
+}
+
+function ensureRecord(root: JsonRecord, key: string): JsonRecord {
+  const existing = root[key];
+  if (isRecord(existing)) {
+    return existing;
+  }
+  const next: JsonRecord = {};
+  root[key] = next;
+  return next;
+}
+
+function mergeMissing(target: JsonRecord, source: JsonRecord): void {
+  for (const [key, value] of Object.entries(source)) {
+    if (value === undefined || isBlockedObjectKey(key)) {
+      continue;
+    }
+    const existing = target[key];
+    if (existing === undefined) {
+      target[key] = value;
+      continue;
+    }
+    if (isRecord(existing) && isRecord(value)) {
+      mergeMissing(existing, value);
+    }
+  }
+}
+
+function cloneRecord<T extends JsonRecord>(value: T | undefined): T {
+  return { ...value } as T;
+}
+
+function resolveLegacyBedrockDiscoveryConfig(raw: unknown): JsonRecord | undefined {
+  if (!isRecord(raw)) {
+    return undefined;
+  }
+  const models = getRecord(raw.models);
+  return getRecord(models?.bedrockDiscovery) ?? undefined;
+}
+
+function pruneEmptyModelsRoot(root: JsonRecord): void {
+  const models = getRecord(root.models);
+  if (models && Object.keys(models).length === 0) {
+    delete root.models;
+  }
+}
+
+export function migrateAmazonBedrockLegacyConfig<T>(raw: T): { config: T; changes: string[] } {
+  if (!isRecord(raw)) {
+    return { config: raw, changes: [] };
+  }
+
+  const legacy = resolveLegacyBedrockDiscoveryConfig(raw);
+  if (!legacy) {
+    return { config: raw, changes: [] };
+  }
+
+  const nextRoot = structuredClone(raw) as JsonRecord;
+  const models = ensureRecord(nextRoot, "models");
+  delete models.bedrockDiscovery;
+  pruneEmptyModelsRoot(nextRoot);
+
+  const changes: string[] = [];
+  if (Object.keys(legacy).length === 0) {
+    changes.push(`Removed empty ${LEGACY_PATH}.`);
+    return { config: nextRoot as T, changes };
+  }
+
+  const plugins = ensureRecord(nextRoot, "plugins");
+  const entries = ensureRecord(plugins, "entries");
+  const entry = ensureRecord(entries, "amazon-bedrock");
+  const config = ensureRecord(entry, "config");
+  const existing = getRecord(config.discovery) ?? undefined;
+
+  if (!existing) {
+    config.discovery = cloneRecord(legacy);
+    changes.push(`Moved ${LEGACY_PATH} → ${TARGET_PATH}.`);
+    return { config: nextRoot as T, changes };
+  }
+
+  const merged = cloneRecord(existing);
+  mergeMissing(merged, legacy);
+  config.discovery = merged;
+  if (JSON.stringify(merged) !== JSON.stringify(existing)) {
+    changes.push(
+      `Merged ${LEGACY_PATH} → ${TARGET_PATH} (filled missing fields from legacy; kept explicit plugin config values).`,
+    );
+    return { config: nextRoot as T, changes };
+  }
+
+  changes.push(`Removed ${LEGACY_PATH} (${TARGET_PATH} already set).`);
+  return { config: nextRoot as T, changes };
+}

package/discovery-shared.ts

@@ -0,0 +1,28 @@
+import { resolveAwsSdkEnvVarName } from "autobot/plugin-sdk/provider-auth-runtime";
+import type { ModelProviderConfig } from "autobot/plugin-sdk/provider-model-shared";
+
+export function resolveBedrockConfigApiKey(
+  env: NodeJS.ProcessEnv = process.env,
+): string | undefined {
+  // When no AWS auth env marker is present, Bedrock should fall back to the
+  // AWS SDK default credential chain instead of persisting a fake apiKey marker.
+  return resolveAwsSdkEnvVarName(env);
+}
+
+export function mergeImplicitBedrockProvider(params: {
+  existing: ModelProviderConfig | undefined;
+  implicit: ModelProviderConfig;
+}): ModelProviderConfig {
+  const { existing, implicit } = params;
+  if (!existing) {
+    return implicit;
+  }
+  return {
+    ...implicit,
+    ...existing,
+    models:
+      Array.isArray(existing.models) && existing.models.length > 0
+        ? existing.models
+        : implicit.models,
+  };
+}