@kindgi/adapter-model-bedrock 0.0.0-bootstrap.0 → 0.1.7-rc.0

package/dist/entry.js

@@ -0,0 +1,210 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The Amazon Bedrock adapter: a registration's models (model or inference-profile ids, such as
+ * `us.amazon.nova-pro-v1:0`) on Bedrock's Converse API, through `@kindgi/adapter-model-shared`
+ * (retries, typed errors, the reasoning state across a pause, usage and cost).
+ *
+ * Pinned, each with a test:
+ *   - It signs in before each attempt (`beforeAttempt`), with the call's abort signal, and the
+ *     attempt's request reads what it got (`attemptPrepared()`): calls at once never share one,
+ *     and a failure is typed there (the library would report a credential failure as a plain
+ *     error, and retry it).
+ *   - `auth: aws-identity` (the default): requests signed with SigV4, with credentials from the
+ *     runtime's AWS identity (`AdapterFactoryInput.identities.aws`), asked for every attempt (it
+ *     refreshes them itself), within 10 seconds. `apiKey: ''` keeps a stray
+ *     `AWS_BEARER_TOKEN_BEDROCK` from switching the provider to a bearer key. Only Bedrock's
+ *     runtime in the region gets them (`isBedrockRuntimeHost`): any other host is refused.
+ *   - `auth: api-key`: the key `secret_ref` names, read for every attempt and sent as the
+ *     bearer token, so a rotated key takes effect on the next call. No SigV4, so no AWS
+ *     credentials are looked for.
+ *   - A failed sign-in (no credentials, no key, a blank one) is an `auth` error, never retried.
+ *   - No request follows a redirect: the credential goes to the endpoint, nowhere else.
+ *   - Prompt caching: cache points after the system prompt and, when the call will be sent
+ *     again, the last message, for Claude and Nova models whose registration prices cache reads
+ *     (`cachesPrompts`); none for any other model.
+ *   - The region is the registration's (`metadata.region`), never `AWS_REGION`, and the endpoint
+ *     is always given (the region's own, or `adapter_config.baseURL`), so
+ *     `AWS_ENDPOINT_URL_BEDROCK_RUNTIME` and `AWS_ENDPOINT_URL` are never read.
+ */
+import { createAmazonBedrock } from '@ai-sdk/amazon-bedrock';
+import { ModelProviderError, tokenCostUsd } from '@kindgi/adapter-model-shared';
+import { attemptPrepared, createAiSdkModelProvider } from '@kindgi/adapter-model-shared/ai-sdk';
+import { adapterConfigError, identitiesPresent, } from '@kindgi/capabilities';
+import { bearerValueProblem } from '@kindgi/types';
+import { BEDROCK_ADAPTER_ID, readBedrockConfig } from './config.js';
+import { isNovaModel, withoutLeadingThinking } from './nova-thinking.js';
+/**
+ * What the provider is built with in `api-key` mode, so it sends a bearer token: never sent,
+ * since the current key replaces it on every request.
+ */
+const KEY_SET_PER_REQUEST = 'set-per-request';
+/** How long the runtime's AWS identity may take before the call fails as `auth`. */
+export const IDENTITY_TIMEOUT_MS = 10_000;
+/** What's wrong with a registration, for `POST /v1/providers` and `GET …/check`. */
+export function bedrockCheckConfig(input) {
+    const read = readBedrockConfig(input);
+    return read.kind === 'ok' ? [] : read.problems;
+}
+export const bedrockAdapterFactory = (input) => {
+    const { metadata } = input;
+    const read = readBedrockConfig({
+        metadata,
+        ...(input.config !== undefined && { config: input.config }),
+        hasSecretRef: input.resolveApiKey !== undefined,
+        identities: identitiesPresent(input.identities),
+    });
+    if (read.kind === 'err') {
+        throw adapterConfigError(BEDROCK_ADAPTER_ID, metadata.id, read.problems[0]);
+    }
+    const { region, baseURL, auth } = read.config;
+    const identity = input.identities?.aws;
+    const resolveApiKey = input.resolveApiKey;
+    const provider = createAiSdkModelProvider({
+        metadata,
+        ...(input.fetch !== undefined && { fetch: input.fetch }),
+        beforeAttempt: (signal) => auth === 'aws-identity'
+            ? awsCredentials(identity, signal).then((credentials) => ({
+                credentials,
+            }))
+            : bedrockKey(resolveApiKey).then((key) => ({ key })),
+        languageModel: (name, fetch) => {
+            const send = withoutRedirects(fetch);
+            return createAmazonBedrock({
+                region,
+                baseURL,
+                ...(auth === 'aws-identity'
+                    ? {
+                        apiKey: '',
+                        // This attempt's, asked for in `beforeAttempt`: the library's own ask never fails.
+                        credentialProvider: async () => signedIn().credentials,
+                        fetch: send,
+                    }
+                    : { apiKey: KEY_SET_PER_REQUEST, fetch: withBearerKey(send) }),
+            })(name);
+        },
+        cost: (model, usage) => tokenCostUsd(model, usage),
+        cacheMark: (model) => (cachesPrompts(model) ? BEDROCK_CACHE_POINT : undefined),
+        explain: (error) => (error.status === 403 ? accessHint(auth, region) : undefined),
+    });
+    // Nova's chain of thought, written into its answer, is taken out (`nova-thinking.ts`).
+    return {
+        ...provider,
+        invoke: async (call) => {
+            const result = await provider.invoke(call);
+            return isNovaModel(call.model) ? withoutLeadingThinking(result) : result;
+        },
+    };
+};
+/**
+ * Bedrock caches only the prompt prefixes a request marks with a cache point (5-minute TTL).
+ * Where the marks go: `withCacheMarks` in `@kindgi/adapter-model-shared`.
+ */
+const BEDROCK_CACHE_POINT = { bedrock: { cachePoint: { type: 'default' } } };
+/** Anthropic's Claude and Amazon Nova, by model or inference-profile id (`us.`, `global.`, …). */
+const CACHING_FAMILY = /^(?:[a-z-]+\.)?(?:anthropic\.claude|amazon\.nova)-/;
+/**
+ * Whether the adapter marks a model's prompts for Bedrock's cache: the registration prices
+ * cache reads (a positive `cachedPromptMultiplier` or `promptCacheReadMultiplier`), and the
+ * model is Claude or Nova, the families whose caching was seen live on Bedrock (2026-10-10).
+ * Others, OpenAI's models on Bedrock or an application inference profile's ARN among them, stay
+ * unmarked until they are.
+ */
+export function cachesPrompts(model) {
+    const cost = model.cost;
+    const read = cost.cachedPromptMultiplier ?? cost.promptCacheReadMultiplier;
+    return typeof read === 'number' && read > 0 && CACHING_FAMILY.test(model.name);
+}
+/** The entry a runtime registers: the factory, and its static check. */
+export const bedrockAdapterEntry = {
+    adapterId: BEDROCK_ADAPTER_ID,
+    capabilityKind: 'llm-inference',
+    factory: bedrockAdapterFactory,
+    checkConfig: bedrockCheckConfig,
+};
+/** What a 403 from Bedrock can mean, beyond its own words, for how the adapter signed in. */
+function accessHint(auth, region) {
+    const noAccess = `when the account has no access to the model in ${region} (model access, or a Marketplace agreement still being made: retry in 15 minutes)`;
+    return auth === 'aws-identity'
+        ? `Bedrock refuses when the runtime's identity's policy lacks bedrock:InvokeModel on the model (for an inference profile, on the profile and on the foundation model in each of its Regions), ${noAccess}, or when the credentials have expired.`
+        : `Bedrock refuses when the IAM user the API key belongs to lacks bedrock:InvokeModel on the model (for an inference profile, on the profile and on the foundation model in each of its Regions), ${noAccess}, or when the key has expired or been revoked.`;
+}
+/** This attempt's sign-in, read by its request. */
+function signedIn() {
+    const signed = attemptPrepared();
+    if (signed === undefined) {
+        throw new ModelProviderError('auth', undefined, 'The request has no sign-in of its own.');
+    }
+    return signed;
+}
+/** The runtime's AWS credentials for an attempt: bounded, stopped with the call, `auth` when none. */
+async function awsCredentials(identity, signal) {
+    let credentials;
+    try {
+        credentials = await bounded(identity(), IDENTITY_TIMEOUT_MS, signal);
+    }
+    catch (error) {
+        // (A call stopped meanwhile ends with its own reason: the retries check the signal first.)
+        throw new ModelProviderError('auth', undefined, `The runtime's AWS identity gave no credentials: ${messageOf(error)}. KINDGI_AWS_IDENTITY says where they come from.`, { cause: error });
+    }
+    if (credentials?.accessKeyId === undefined || credentials.accessKeyId === '') {
+        throw new ModelProviderError('auth', undefined, "The runtime's AWS identity returned no credentials. KINDGI_AWS_IDENTITY says where they come from.");
+    }
+    return credentials;
+}
+/** The current key `secret_ref` names, for an attempt; `auth` when there's none. */
+async function bedrockKey(resolveApiKey) {
+    let key;
+    try {
+        key = await resolveApiKey();
+    }
+    catch (error) {
+        throw new ModelProviderError('auth', undefined, `The Bedrock API key secret_ref names couldn't be read: ${messageOf(error)}.`, { cause: error });
+    }
+    // Whitespace around a key (a stored file's newline) is never the key's.
+    const trimmed = key.trim();
+    if (trimmed === '') {
+        throw new ModelProviderError('auth', undefined, 'The Bedrock API key secret_ref names is empty.');
+    }
+    // Sent as `Bearer <key>`, so checked as sent, before the request: fetch's own error would
+    // quote it.
+    const problem = bearerValueProblem(trimmed);
+    if (problem !== undefined) {
+        throw new ModelProviderError('auth', undefined, `The Bedrock API key secret_ref names has ${problem}, which a header can't carry: store the secret without it.`);
+    }
+    return trimmed;
+}
+/** The bearer token on the request, from this attempt's key. */
+function withBearerKey(fetch) {
+    return async (url, init) => {
+        const headers = new Headers(init?.headers);
+        headers.set('authorization', `Bearer ${signedIn().key}`);
+        return fetch(url, { ...init, headers });
+    };
+}
+/** No request follows a redirect, so its credential reaches the endpoint and nothing else. */
+function withoutRedirects(fetch) {
+    return (url, init) => fetch(url, { ...init, redirect: 'error' });
+}
+/** The promise, or a failure after `ms`, or the signal's reason when the call stops first. */
+function bounded(promise, ms, signal) {
+    // An abort that has already happened fires no event.
+    if (signal?.aborted === true)
+        return Promise.reject(signal.reason);
+    let timer;
+    let onAbort;
+    const stop = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`no answer in ${ms / 1000} s`)), ms);
+        if (signal !== undefined) {
+            onAbort = () => reject(signal.reason);
+            signal.addEventListener('abort', onAbort, { once: true });
+        }
+    });
+    return Promise.race([Promise.resolve(promise), stop]).finally(() => {
+        clearTimeout(timer);
+        if (onAbort !== undefined)
+            signal?.removeEventListener('abort', onAbort);
+    });
+}
+const messageOf = (error) => error instanceof Error ? error.message : String(error);
+//# sourceMappingURL=entry.js.map

package/dist/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../src/entry.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAQL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEzE;;;GAGG;AACH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAChC,KAA8B;IAE9B,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,KAAK,EAAE,EAAE;IAC7D,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAG,iBAAiB,CAAC;QAC7B,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3D,YAAY,EAAE,KAAK,CAAC,aAAa,KAAK,SAAS;QAC/C,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,kBAAkB,CACtB,kBAAkB,EAClB,QAAQ,CAAC,EAAE,EACX,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAyB,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC;IACvC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAE1C,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,aAAa,EAAE,CAAC,MAAM,EAAqB,EAAE,CAC3C,IAAI,KAAK,cAAc;YACrB,CAAC,CAAC,cAAc,CAAC,QAA+B,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBAC7E,WAAW;aACZ,CAAC,CAAC;YACL,CAAC,CAAC,UAAU,CAAC,aAAsC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,mBAAmB,CAAC;gBACzB,MAAM;gBACN,OAAO;gBACP,GAAG,CAAC,IAAI,KAAK,cAAc;oBACzB,CAAC,CAAC;wBACE,MAAM,EAAE,EAAE;wBACV,mFAAmF;wBACnF,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAA6B;wBACxE,KAAK,EAAE,IAAI;qBACZ;oBACH,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;aACjE,CAAC,CAAC,IAAI,CAAC,CAAC;QACX,CAAC;QACD,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC;QAClD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;KAClF,CAAC,CAAC;IACH,uFAAuF;IACvF,OAAO;QACL,GAAG,QAAQ;QACX,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAG,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAE7E,kGAAkG;AAClG,MAAM,cAAc,GAAG,oDAAoD,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAwC,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC,yBAAyB,CAAC;IAC3E,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAwB;IACtD,SAAS,EAAE,kBAAkB;IAC7B,cAAc,EAAE,eAAe;IAC/B,OAAO,EAAE,qBAAqB;IAC9B,WAAW,EAAE,kBAAkB;CAChC,CAAC;AAEF,6FAA6F;AAC7F,SAAS,UAAU,CAAC,IAAgC,EAAE,MAAc;IAClE,MAAM,QAAQ,GAAG,kDAAkD,MAAM,mFAAmF,CAAC;IAC7J,OAAO,IAAI,KAAK,cAAc;QAC5B,CAAC,CAAC,8LAA8L,QAAQ,yCAAyC;QACjP,CAAC,CAAC,kMAAkM,QAAQ,gDAAgD,CAAC;AACjQ,CAAC;AAQD,mDAAmD;AACnD,SAAS,QAAQ;IACf,MAAM,MAAM,GAAG,eAAe,EAAY,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,cAAc,CAC3B,QAA6B,EAC7B,MAA+B;IAE/B,IAAI,WAA2B,CAAC;IAChC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2FAA2F;QAC3F,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,mDAAmD,SAAS,CAAC,KAAK,CAAC,kDAAkD,EACrH,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QAC7E,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,UAAU,CAAC,aAAoC;IAC5D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,0DAA0D,SAAS,CAAC,KAAK,CAAC,GAAG,EAC7E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,0FAA0F;IAC1F,YAAY;IACZ,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,MAAM,EACN,SAAS,EACT,4CAA4C,OAAO,4DAA4D,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAA8B;IACnD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,GAAa,EAAE,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,gBAAgB,CAAC,KAA8B;IACtD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAI,OAAuB,EAAE,EAAU,EAAE,MAAoB;IAC3E,qDAAqD;IACrD,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,KAAgD,CAAC;IACrD,IAAI,OAAiC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC5C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACjE,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAc,EAAU,EAAE,CAC3C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { BEDROCK_ADAPTER_ID, BEDROCK_AUTHS, type BedrockAuth, type BedrockConfig, bedrockRuntimeEndpoint, isBedrockRuntimeHost, partitionDnsSuffix, readBedrockConfig, } from './config.js';
+export { IDENTITY_TIMEOUT_MS, bedrockAdapterEntry, bedrockAdapterFactory, bedrockCheckConfig, } from './entry.js';
+export { NOVA_THINKING_REMOVED, isNovaModel, withoutLeadingThinking } from './nova-thinking.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export { BEDROCK_ADAPTER_ID, BEDROCK_AUTHS, bedrockRuntimeEndpoint, isBedrockRuntimeHost, partitionDnsSuffix, readBedrockConfig, } from './config.js';
+export { IDENTITY_TIMEOUT_MS, bedrockAdapterEntry, bedrockAdapterFactory, bedrockCheckConfig, } from './entry.js';
+export { NOVA_THINKING_REMOVED, isNovaModel, withoutLeadingThinking } from './nova-thinking.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EACL,kBAAkB,EAClB,aAAa,EAGb,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/nova-thinking.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Amazon Nova writes its chain of thought into the answer text when tools are in play:
+ * `<thinking>…</thinking>` before the reply. Other vendors keep reasoning apart, and a
+ * `ModelCallResult` has no slot for reasoning text, so for a Nova model one leading block is
+ * removed from the answer, with a warning saying so (the model-call record keeps the warning).
+ * Only an exact leading pair is touched: a block elsewhere in the text, or one that isn't
+ * closed, is left as it came.
+ */
+import type { ModelCallResult } from '@kindgi/capabilities';
+/** The warning code a removed `<thinking>` block leaves on the result. */
+export declare const NOVA_THINKING_REMOVED = "reasoning-text-removed";
+export declare const isNovaModel: (name: string) => boolean;
+/** The result with one leading `<thinking>…</thinking>` block taken out of its answer. */
+export declare function withoutLeadingThinking(result: ModelCallResult): ModelCallResult;
+//# sourceMappingURL=nova-thinking.d.ts.map

package/dist/nova-thinking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nova-thinking.d.ts","sourceRoot":"","sources":["../src/nova-thinking.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAO9D,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,OAA0B,CAAC;AAEtE,0FAA0F;AAC1F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAe/E"}

package/dist/nova-thinking.js

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/** The warning code a removed `<thinking>` block leaves on the result. */
+export const NOVA_THINKING_REMOVED = 'reasoning-text-removed';
+/** A Nova model id or inference profile (`us.amazon.nova-pro-v1:0`, or an ARN naming one). */
+const NOVA = /(^|[.:/])amazon\.nova-/;
+/** One block at the very start of the text (whitespace aside), closed. */
+const LEADING_THINKING = /^\s*<thinking>[\s\S]*?<\/thinking>\s*/;
+export const isNovaModel = (name) => NOVA.test(name);
+/** The result with one leading `<thinking>…</thinking>` block taken out of its answer. */
+export function withoutLeadingThinking(result) {
+    const content = result.message.content;
+    const found = LEADING_THINKING.exec(content);
+    if (found === null)
+        return result;
+    return {
+        ...result,
+        message: { ...result.message, content: content.slice(found[0].length) },
+        warnings: [
+            ...(result.warnings ?? []),
+            {
+                code: NOVA_THINKING_REMOVED,
+                message: `${result.provider.model} wrote its reasoning into the answer: the leading <thinking> block (${found[0].trim().length} characters) was removed.`,
+            },
+        ],
+    };
+}
+//# sourceMappingURL=nova-thinking.js.map

package/dist/nova-thinking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nova-thinking.js","sourceRoot":"","sources":["../src/nova-thinking.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAajC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,8FAA8F;AAC9F,MAAM,IAAI,GAAG,wBAAwB,CAAC;AACtC,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AAEjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEtE,0FAA0F;AAC1F,MAAM,UAAU,sBAAsB,CAAC,MAAuB;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;QACvE,QAAQ,EAAE;YACR,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC1B;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,uEAAuE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,2BAA2B;aAC1J;SACF;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,54 @@
 {
   "name": "@kindgi/adapter-model-bedrock",
-  "version": "0.0.0-bootstrap.0",
-  "description": "Placeholder so a trusted publisher can be attached. Releases are published from https://github.com/kindgi/kindgi-sdk with provenance; use 0.1.0 or later.",
+  "version": "0.1.7-rc.0",
+  "description": "Amazon Bedrock ModelProvider for @kindgi/capabilities: Claude, Nova, Llama, Mistral and OpenAI's models on Bedrock's Converse API, by the runtime's AWS identity or a Bedrock API key.",
   "license": "Apache-2.0",
-  "repository": { "type": "git", "url": "git+https://github.com/kindgi/kindgi-sdk.git" }
-}
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kindgi/kindgi-sdk.git",
+    "directory": "packages/adapters/model-bedrock"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "dependencies": {
+    "@ai-sdk/amazon-bedrock": "5.0.111",
+    "@kindgi/adapter-model-shared": "0.1.7-rc.0",
+    "@kindgi/capabilities": "0.1.7-rc.0",
+    "@kindgi/types": "0.1.7-rc.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "homepage": "https://github.com/kindgi/kindgi-sdk/tree/main/packages/adapters/model-bedrock#readme",
+  "bugs": {
+    "url": "https://github.com/kindgi/kindgi-sdk/issues"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  }
+}

package/src/config.ts

@@ -0,0 +1,201 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * An Amazon Bedrock registration, read and checked: the region (`metadata.region`), how to sign
+ * in, and the endpoint. Static: no network, no secret read (`checkConfig` runs it at
+ * registration, the factory again when it builds).
+ */
+
+import type { AdapterConfigCheckInput, AdapterConfigProblem } from '@kindgi/capabilities';
+
+export const BEDROCK_ADAPTER_ID = '@kindgi/adapter-model-bedrock';
+
+/**
+ * The runtime's AWS identity, requests signed with SigV4 (the default), or a Bedrock API key
+ * (`secret_ref`, sent as a bearer token), which AWS recommends for exploration only.
+ */
+export const BEDROCK_AUTHS = ['aws-identity', 'api-key'] as const;
+export type BedrockAuth = (typeof BEDROCK_AUTHS)[number];
+
+export interface BedrockConfig {
+  /** The AWS region the requests go to and are signed for. */
+  readonly region: string;
+  /** The `bedrock-runtime` endpoint: the region's own, or the registration's `baseURL`. */
+  readonly baseURL: string;
+  readonly auth: BedrockAuth;
+}
+
+const KEYS = ['auth', 'baseURL'] as const;
+/** An AWS region name: `us-east-2`, `us-gov-west-1`, `eusc-de-east-1`. */
+const REGION = /^[a-z]{2,4}(?:-[a-z]+)+-\d{1,2}$/;
+/**
+ * The DNS suffix of each AWS partition other than `aws` (`amazonaws.com`), by region prefix:
+ * the same table `@ai-sdk/amazon-bedrock` builds its default endpoint from. The runtime's AWS
+ * identity keeps a copy for its STS endpoint, until both read one shared module.
+ */
+const PARTITION_DNS_SUFFIXES: readonly (readonly [prefix: string, suffix: string])[] = [
+  ['cn-', 'amazonaws.com.cn'],
+  ['us-iso-', 'c2s.ic.gov'],
+  ['us-isob-', 'sc2s.sgov.gov'],
+  ['eu-isoe-', 'cloud.adc-e.uk'],
+  ['us-isof-', 'csp.hci.ic.gov'],
+  ['eusc-', 'amazonaws.eu'],
+];
+
+const at = (key: string) => `/adapter_config/${key}`;
+
+/** The DNS suffix of a region's partition: `amazonaws.com`, `amazonaws.com.cn`, … */
+export function partitionDnsSuffix(region: string): string {
+  return (
+    PARTITION_DNS_SUFFIXES.find(([prefix]) => region.startsWith(prefix))?.[1] ?? 'amazonaws.com'
+  );
+}
+
+/** The region's own `bedrock-runtime` endpoint. */
+export function bedrockRuntimeEndpoint(region: string): string {
+  return `https://bedrock-runtime.${region}.${partitionDnsSuffix(region)}`;
+}
+
+/**
+ * Whether a host is Bedrock's runtime in this region: its own endpoint, its FIPS endpoint, or
+ * an interface VPC endpoint's own name. Only these get requests signed with the runtime's AWS
+ * credentials: a registration naming another host would receive the session token and a
+ * signature. Sources (read 2026-10-09): https://docs.aws.amazon.com/general/latest/gr/bedrock.html
+ * (the endpoints and FIPS endpoints) and
+ * https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html
+ * (`vpce-id.bedrock-runtime.region.vpce.amazonaws.com`).
+ */
+export function isBedrockRuntimeHost(hostname: string, region: string): boolean {
+  const host = hostname.toLowerCase();
+  const tail = `${region}.${partitionDnsSuffix(region)}`;
+  if (host === `bedrock-runtime.${tail}` || host === `bedrock-runtime-fips.${tail}`) return true;
+  const vpce = `.bedrock-runtime.${region}.vpce.${partitionDnsSuffix(region)}`;
+  return host.endsWith(vpce) && /^vpce-[a-z0-9-]+$/.test(host.slice(0, -vpce.length));
+}
+
+/** The registration read, or every problem with it. */
+export function readBedrockConfig(
+  input: AdapterConfigCheckInput,
+):
+  | { readonly kind: 'ok'; readonly config: BedrockConfig }
+  | { readonly kind: 'err'; readonly problems: readonly AdapterConfigProblem[] } {
+  const config = input.config ?? {};
+  const problems: AdapterConfigProblem[] = [];
+
+  for (const key of Object.keys(config)) {
+    if (!(KEYS as readonly string[]).includes(key)) {
+      problems.push({
+        path: at(key),
+        message: `adapter_config.${key} isn't an Amazon Bedrock setting: it takes auth and baseURL (the region is metadata.region).`,
+      });
+    }
+  }
+
+  const region = input.metadata.region;
+  const regionOk = typeof region === 'string' && REGION.test(region);
+  if (!regionOk) {
+    problems.push({
+      path: '/metadata/region',
+      message: `metadata.region must be the AWS region Bedrock runs in (e.g. us-east-2): the requests go to it and are signed for it. Got "${String(region)}".`,
+    });
+  }
+
+  const auth = config.auth ?? 'aws-identity';
+  const baseURL = config.baseURL;
+  if (baseURL !== undefined) {
+    readBaseURL(baseURL, auth, regionOk ? (region as string) : undefined, problems);
+  }
+
+  if (!(BEDROCK_AUTHS as readonly unknown[]).includes(auth)) {
+    problems.push({
+      path: at('auth'),
+      message: `adapter_config.auth must be one of ${BEDROCK_AUTHS.join(', ')}.`,
+    });
+  } else if (auth === 'api-key' && !input.hasSecretRef) {
+    problems.push({
+      path: '/secret_ref',
+      message:
+        "adapter_config.auth = api-key needs secret_ref: the Bedrock API key (or leave auth unset, to sign in as the runtime's AWS identity).",
+    });
+  } else if (auth === 'aws-identity' && input.hasSecretRef) {
+    problems.push({
+      path: '/secret_ref',
+      message:
+        "adapter_config.auth = aws-identity (the default) signs in as the runtime's AWS identity: remove secret_ref, or set auth = api-key for a Bedrock API key.",
+    });
+  }
+  if (auth === 'aws-identity' && input.identities?.aws === false) {
+    problems.push({
+      path: at('auth'),
+      message:
+        "adapter_config.auth = aws-identity (the default) needs the runtime's AWS identity (KINDGI_AWS_IDENTITY says where it comes from), and this runtime has none. Or set auth = api-key for a Bedrock API key.",
+    });
+  }
+
+  if (problems.length > 0) return { kind: 'err', problems };
+  return {
+    kind: 'ok',
+    config: {
+      region,
+      baseURL: (baseURL as string | undefined) ?? bedrockRuntimeEndpoint(region),
+      auth: auth as BedrockAuth,
+    },
+  };
+}
+
+/**
+ * A custom endpoint: https, with no credentials, query or fragment (they'd sit in the stored
+ * settings); Bedrock's own host at its root; with `auth: aws-identity`, Bedrock's runtime in
+ * the region only. A gateway (with `auth: api-key`) is any host and path.
+ */
+function readBaseURL(
+  value: unknown,
+  auth: unknown,
+  region: string | undefined,
+  problems: AdapterConfigProblem[],
+): void {
+  const path = at('baseURL');
+  const url = typeof value === 'string' ? parseUrl(value) : undefined;
+  if (url === undefined || url.protocol !== 'https:') {
+    problems.push({
+      path,
+      message:
+        'adapter_config.baseURL must be an https URL: a bedrock-runtime endpoint of your own, such as a VPC endpoint or a FIPS endpoint.',
+    });
+    return;
+  }
+  const raw = value as string;
+  if (url.username !== '' || url.password !== '') {
+    problems.push({
+      path,
+      message:
+        "adapter_config.baseURL can't hold credentials: a key goes in secret_ref, never in the URL.",
+    });
+  }
+  if (url.search !== '' || raw.includes('?') || url.hash !== '' || raw.includes('#')) {
+    problems.push({ path, message: "adapter_config.baseURL can't hold a query or a fragment." });
+  }
+  const bedrockHost = region !== undefined && isBedrockRuntimeHost(url.hostname, region);
+  if (bedrockHost && url.pathname !== '/' && url.pathname !== '') {
+    problems.push({
+      path,
+      message: `adapter_config.baseURL is an endpoint's root (https://${url.host}), with no path: the adapter adds the API's.`,
+    });
+  }
+  if (auth === 'aws-identity' && region !== undefined && !bedrockHost) {
+    const suffix = partitionDnsSuffix(region);
+    problems.push({
+      path,
+      message: `adapter_config.auth = aws-identity signs requests with the runtime's AWS credentials, which go only to Bedrock's runtime in ${region} (bedrock-runtime.${region}.${suffix}, bedrock-runtime-fips.${region}.${suffix}, or a VPC endpoint's vpce-….bedrock-runtime.${region}.vpce.${suffix}); ${url.hostname} isn't one. A VPC endpoint with private DNS needs no baseURL; another endpoint takes auth = api-key.`,
+    });
+  }
+}
+
+function parseUrl(value: string): URL | undefined {
+  try {
+    return new URL(value);
+  } catch {
+    return undefined;
+  }
+}