@openclaw/amazon-bedrock-mantle-provider 2026.5.12-beta.7

package/dist/api.js

@@ -0,0 +1,2 @@
+import { MANTLE_IAM_TOKEN_MARKER, discoverMantleModels, generateBearerTokenFromIam, getCachedIamToken, mergeImplicitMantleProvider, resetIamTokenCacheForTest, resetMantleDiscoveryCacheForTest, resolveImplicitMantleProvider, resolveMantleBearerToken, resolveMantleRuntimeBearerToken } from "./discovery.js";
+export { MANTLE_IAM_TOKEN_MARKER, discoverMantleModels, generateBearerTokenFromIam, getCachedIamToken, mergeImplicitMantleProvider, resetIamTokenCacheForTest, resetMantleDiscoveryCacheForTest, resolveImplicitMantleProvider, resolveMantleBearerToken, resolveMantleRuntimeBearerToken };

package/dist/discovery.js

@@ -0,0 +1,259 @@
+import { createSubsystemLogger } from "openclaw/plugin-sdk/core";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/amazon-bedrock-mantle/discovery.ts
+const log = createSubsystemLogger("bedrock-mantle-discovery");
+const DEFAULT_COST = {
+	input: 0,
+	output: 0,
+	cacheRead: 0,
+	cacheWrite: 0
+};
+const DEFAULT_CONTEXT_WINDOW = 32e3;
+const DEFAULT_MAX_TOKENS = 4096;
+const DEFAULT_REFRESH_INTERVAL_SECONDS = 3600;
+const MANTLE_IAM_TOKEN_MARKER = "__amazon_bedrock_mantle_iam__";
+const MANTLE_SUPPORTED_REGIONS = [
+	"us-east-1",
+	"us-east-2",
+	"us-west-2",
+	"ap-northeast-1",
+	"ap-south-1",
+	"ap-southeast-3",
+	"eu-central-1",
+	"eu-west-1",
+	"eu-west-2",
+	"eu-south-1",
+	"eu-north-1",
+	"sa-east-1"
+];
+function mantleEndpoint(region) {
+	return `https://bedrock-mantle.${region}.api.aws`;
+}
+function isSupportedRegion(region) {
+	return MANTLE_SUPPORTED_REGIONS.includes(region);
+}
+async function loadMantleBearerTokenProviderFactory() {
+	const { getTokenProvider } = await import("@aws/bedrock-token-generator");
+	return getTokenProvider;
+}
+/**
+* Resolve a bearer token for Mantle authentication.
+*
+* Returns the value of AWS_BEARER_TOKEN_BEDROCK if set, undefined otherwise.
+* When no explicit token is set, `resolveImplicitMantleProvider` will attempt
+* to generate one from IAM credentials via `@aws/bedrock-token-generator`.
+*/
+function resolveMantleBearerToken(env = process.env) {
+	const explicitToken = env.AWS_BEARER_TOKEN_BEDROCK?.trim();
+	if (explicitToken) return explicitToken;
+}
+/** Token cache for IAM-derived bearer tokens, keyed by region. */
+const iamTokenCache = /* @__PURE__ */ new Map();
+const IAM_TOKEN_TTL_MS = 72e5;
+function resolveMantleRegion(env) {
+	return env.AWS_REGION ?? env.AWS_DEFAULT_REGION ?? "us-east-1";
+}
+function getCachedIamTokenEntry(region, now = Date.now()) {
+	const cached = iamTokenCache.get(region);
+	if (cached && cached.expiresAt > now) return cached;
+}
+/**
+* Generate a bearer token from IAM credentials using `@aws/bedrock-token-generator`.
+*
+* Uses the AWS default credential chain (instance roles, SSO, access keys, EKS IRSA).
+* Returns undefined if the package is not installed or credentials are unavailable.
+*/
+async function generateBearerTokenFromIam(params) {
+	const now = params.now?.() ?? Date.now();
+	const cached = getCachedIamTokenEntry(params.region, now);
+	if (cached) return cached.token;
+	try {
+		const token = await (params.tokenProviderFactory ?? await loadMantleBearerTokenProviderFactory())({
+			region: params.region,
+			expiresInSeconds: 7200
+		})();
+		iamTokenCache.set(params.region, {
+			token,
+			expiresAt: now + IAM_TOKEN_TTL_MS
+		});
+		return token;
+	} catch (error) {
+		log.debug?.("Mantle IAM token generation unavailable", {
+			region: params.region,
+			error: formatErrorMessage(error)
+		});
+		return;
+	}
+}
+/**
+* Read a cached IAM bearer token for the given region (sync, no generation).
+*
+* Returns the token if it exists and has not expired, undefined otherwise.
+* Used by Mantle runtime auth and tests to inspect the current cache.
+*/
+function getCachedIamToken(region) {
+	return getCachedIamTokenEntry(region)?.token;
+}
+async function resolveMantleRuntimeBearerToken(params) {
+	if (params.apiKey !== "__amazon_bedrock_mantle_iam__") return { apiKey: params.apiKey };
+	const now = params.now?.() ?? Date.now();
+	const region = resolveMantleRegion(params.env ?? process.env);
+	const cached = getCachedIamTokenEntry(region, now);
+	if (cached) return {
+		apiKey: cached.token,
+		expiresAt: cached.expiresAt
+	};
+	const token = await generateBearerTokenFromIam({
+		region,
+		now: params.now,
+		tokenProviderFactory: params.tokenProviderFactory
+	});
+	if (!token) return;
+	const refreshed = getCachedIamTokenEntry(region, now);
+	return {
+		apiKey: refreshed?.token ?? token,
+		expiresAt: refreshed?.expiresAt ?? now + IAM_TOKEN_TTL_MS
+	};
+}
+/** Reset the IAM token cache (for testing). */
+function resetIamTokenCacheForTest() {
+	iamTokenCache.clear();
+}
+/** Model ID substrings that indicate reasoning/thinking support. */
+const REASONING_PATTERNS = [
+	"thinking",
+	"reasoner",
+	"reasoning",
+	"deepseek.r",
+	"gpt-oss-120b",
+	"gpt-oss-safeguard-120b"
+];
+function inferReasoningSupport(modelId) {
+	const lower = normalizeLowercaseStringOrEmpty(modelId);
+	return REASONING_PATTERNS.some((p) => lower.includes(p));
+}
+const discoveryCache = /* @__PURE__ */ new Map();
+/** Clear the discovery cache (for testing). */
+function resetMantleDiscoveryCacheForTest() {
+	discoveryCache.clear();
+}
+/**
+* Discover available models from the Mantle `/v1/models` endpoint.
+*
+* The response is in standard OpenAI format:
+* ```json
+* { "data": [{ "id": "anthropic.claude-sonnet-4-6", "object": "model", "owned_by": "anthropic" }] }
+* ```
+*
+* Results are cached per region for `DEFAULT_REFRESH_INTERVAL_SECONDS`.
+* Returns an empty array if the request fails (no permission, network error, etc.).
+*/
+async function discoverMantleModels(params) {
+	const { region, bearerToken, fetchFn = fetch, now = Date.now } = params;
+	const cacheKey = region;
+	const cached = discoveryCache.get(cacheKey);
+	if (cached && now() - cached.fetchedAt < DEFAULT_REFRESH_INTERVAL_SECONDS * 1e3) return cached.models;
+	const endpoint = `${mantleEndpoint(region)}/v1/models`;
+	try {
+		const response = await fetchFn(endpoint, {
+			method: "GET",
+			headers: {
+				Authorization: `Bearer ${bearerToken}`,
+				Accept: "application/json"
+			}
+		});
+		if (!response.ok) {
+			log.debug?.("Mantle model discovery failed", {
+				status: response.status,
+				statusText: response.statusText
+			});
+			return cached?.models ?? [];
+		}
+		const models = ((await response.json()).data ?? []).filter((m) => m.id?.trim()).map((m) => ({
+			id: m.id,
+			name: m.id,
+			reasoning: inferReasoningSupport(m.id),
+			input: ["text"],
+			cost: DEFAULT_COST,
+			contextWindow: DEFAULT_CONTEXT_WINDOW,
+			maxTokens: DEFAULT_MAX_TOKENS
+		})).toSorted((a, b) => a.id.localeCompare(b.id));
+		discoveryCache.set(cacheKey, {
+			models,
+			fetchedAt: now()
+		});
+		return models;
+	} catch (error) {
+		log.debug?.("Mantle model discovery error", { error: formatErrorMessage(error) });
+		return cached?.models ?? [];
+	}
+}
+/**
+* Resolve an implicit Bedrock Mantle provider if authentication is available.
+*
+* Detection priority:
+* 1. AWS_BEARER_TOKEN_BEDROCK env var → use directly
+* 2. IAM credentials → generate bearer token via `@aws/bedrock-token-generator`
+* - Region from AWS_REGION / AWS_DEFAULT_REGION / default us-east-1
+* - Models discovered from `/v1/models`
+*/
+async function resolveImplicitMantleProvider(params) {
+	const env = params.env ?? process.env;
+	if (params.pluginConfig?.discovery?.enabled === false) return null;
+	const region = resolveMantleRegion(env);
+	const explicitBearerToken = resolveMantleBearerToken(env);
+	if (!isSupportedRegion(region)) {
+		log.debug?.("Mantle not available in region", { region });
+		return null;
+	}
+	const bearerToken = explicitBearerToken ?? await generateBearerTokenFromIam({
+		region,
+		tokenProviderFactory: params.tokenProviderFactory
+	});
+	if (!bearerToken) return null;
+	const models = await discoverMantleModels({
+		region,
+		bearerToken,
+		fetchFn: params.fetchFn
+	});
+	if (models.length === 0) return null;
+	log.debug?.("Mantle provider resolved", {
+		region,
+		modelCount: models.length
+	});
+	const claudeModels = [{
+		id: "anthropic.claude-opus-4-7",
+		name: "Claude Opus 4.7",
+		api: "anthropic-messages",
+		reasoning: false,
+		input: ["text", "image"],
+		cost: {
+			input: 5,
+			output: 25,
+			cacheRead: .5,
+			cacheWrite: 6.25
+		},
+		contextWindow: 1e6,
+		maxTokens: 128e3
+	}];
+	const allModels = [...models, ...claudeModels];
+	return {
+		baseUrl: `${mantleEndpoint(region)}/v1`,
+		api: "openai-completions",
+		auth: "api-key",
+		apiKey: explicitBearerToken ? "env:AWS_BEARER_TOKEN_BEDROCK" : MANTLE_IAM_TOKEN_MARKER,
+		models: allModels
+	};
+}
+function mergeImplicitMantleProvider(params) {
+	const { existing, implicit } = params;
+	if (!existing) return implicit;
+	return {
+		...implicit,
+		...existing,
+		models: Array.isArray(existing.models) && existing.models.length > 0 ? existing.models : implicit.models
+	};
+}
+//#endregion
+export { MANTLE_IAM_TOKEN_MARKER, discoverMantleModels, generateBearerTokenFromIam, getCachedIamToken, mergeImplicitMantleProvider, resetIamTokenCacheForTest, resetMantleDiscoveryCacheForTest, resolveImplicitMantleProvider, resolveMantleBearerToken, resolveMantleRuntimeBearerToken };

package/dist/index.js

@@ -0,0 +1,13 @@
+import { registerBedrockMantlePlugin } from "./register.sync.runtime.js";
+import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+//#region extensions/amazon-bedrock-mantle/index.ts
+var amazon_bedrock_mantle_default = definePluginEntry({
+	id: "amazon-bedrock-mantle",
+	name: "Amazon Bedrock Mantle Provider",
+	description: "Bundled Amazon Bedrock Mantle (OpenAI-compatible) provider plugin",
+	register(api) {
+		registerBedrockMantlePlugin(api);
+	}
+});
+//#endregion
+export { amazon_bedrock_mantle_default as default };

package/dist/mantle-anthropic.runtime.js

@@ -0,0 +1,84 @@
+import Anthropic from "@anthropic-ai/sdk";
+import { streamAnthropic } from "@earendil-works/pi-ai/anthropic";
+//#region extensions/amazon-bedrock-mantle/mantle-anthropic.runtime.ts
+const MANTLE_ANTHROPIC_BETA = "fine-grained-tool-streaming-2025-05-14";
+function resolveMantleAnthropicBaseUrl(baseUrl) {
+	const trimmed = baseUrl.replace(/\/+$/, "");
+	if (trimmed.endsWith("/anthropic")) return trimmed;
+	if (trimmed.endsWith("/v1")) return `${trimmed.slice(0, -3)}/anthropic`;
+	return `${trimmed}/anthropic`;
+}
+function requiresDefaultSampling(modelId) {
+	return modelId.includes("claude-opus-4-7");
+}
+function mergeHeaders(...headerSources) {
+	const merged = {};
+	for (const headers of headerSources) if (headers) Object.assign(merged, headers);
+	return merged;
+}
+function buildMantleAnthropicBaseOptions(model, options, apiKey) {
+	return {
+		temperature: requiresDefaultSampling(model.id) ? void 0 : options?.temperature,
+		maxTokens: options?.maxTokens || Math.min(model.maxTokens, 32e3),
+		signal: options?.signal,
+		apiKey,
+		cacheRetention: options?.cacheRetention,
+		sessionId: options?.sessionId,
+		onPayload: options?.onPayload,
+		maxRetryDelayMs: options?.maxRetryDelayMs,
+		metadata: options?.metadata
+	};
+}
+function adjustMaxTokensForThinking(baseMaxTokens, modelMaxTokens, reasoningLevel, customBudgets) {
+	const budgets = {
+		minimal: 1024,
+		low: 2048,
+		medium: 8192,
+		high: 16384,
+		xhigh: 16384,
+		...customBudgets
+	};
+	const minOutputTokens = 1024;
+	let thinkingBudget = budgets[reasoningLevel];
+	const maxTokens = Math.min(baseMaxTokens + thinkingBudget, modelMaxTokens);
+	if (maxTokens <= thinkingBudget) thinkingBudget = Math.max(0, maxTokens - minOutputTokens);
+	return {
+		maxTokens,
+		thinkingBudget
+	};
+}
+function createMantleAnthropicStreamFn(deps) {
+	return (model, context, options) => {
+		const apiKey = options?.apiKey ?? "";
+		const createClient = deps?.createClient ?? ((clientOptions) => new Anthropic(clientOptions));
+		const stream = deps?.stream ?? streamAnthropic;
+		const client = createClient({
+			apiKey: null,
+			authToken: apiKey,
+			baseURL: resolveMantleAnthropicBaseUrl(model.baseUrl),
+			dangerouslyAllowBrowser: true,
+			defaultHeaders: mergeHeaders({
+				accept: "application/json",
+				"anthropic-dangerous-direct-browser-access": "true",
+				"anthropic-beta": MANTLE_ANTHROPIC_BETA
+			}, model.headers, options?.headers)
+		});
+		const base = buildMantleAnthropicBaseOptions(model, options, apiKey);
+		const streamClient = client;
+		if (!options?.reasoning || requiresDefaultSampling(model.id)) return stream(model, context, {
+			...base,
+			client: streamClient,
+			thinkingEnabled: false
+		});
+		const adjusted = adjustMaxTokensForThinking(base.maxTokens || 0, model.maxTokens, options.reasoning, options.thinkingBudgets);
+		return stream(model, context, {
+			...base,
+			client: streamClient,
+			maxTokens: adjusted.maxTokens,
+			thinkingEnabled: true,
+			thinkingBudgetTokens: adjusted.thinkingBudget
+		});
+	};
+}
+//#endregion
+export { createMantleAnthropicStreamFn, resolveMantleAnthropicBaseUrl };

package/dist/register.sync.runtime.js

@@ -0,0 +1,45 @@
+import { mergeImplicitMantleProvider, resolveImplicitMantleProvider, resolveMantleBearerToken, resolveMantleRuntimeBearerToken } from "./discovery.js";
+import { createMantleAnthropicStreamFn } from "./mantle-anthropic.runtime.js";
+import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
+//#region extensions/amazon-bedrock-mantle/register.sync.runtime.ts
+function registerBedrockMantlePlugin(api) {
+	const providerId = "amazon-bedrock-mantle";
+	const startupPluginConfig = api.pluginConfig ?? {};
+	function resolveCurrentPluginConfig(config) {
+		return resolvePluginConfigObject(config, providerId) ?? (config ? void 0 : startupPluginConfig);
+	}
+	api.registerProvider({
+		id: providerId,
+		label: "Amazon Bedrock Mantle (OpenAI-compatible)",
+		docsPath: "/providers/bedrock-mantle",
+		auth: [],
+		catalog: {
+			order: "simple",
+			run: async (ctx) => {
+				const currentPluginConfig = resolveCurrentPluginConfig(ctx.config);
+				const implicit = await resolveImplicitMantleProvider({
+					env: ctx.env,
+					pluginConfig: currentPluginConfig
+				});
+				if (!implicit) return null;
+				return { provider: mergeImplicitMantleProvider({
+					existing: ctx.config.models?.providers?.[providerId],
+					implicit
+				}) };
+			}
+		},
+		resolveConfigApiKey: ({ env }) => resolveMantleBearerToken(env) ? "env:AWS_BEARER_TOKEN_BEDROCK" : void 0,
+		prepareRuntimeAuth: async ({ apiKey, env }) => await resolveMantleRuntimeBearerToken({
+			apiKey,
+			env
+		}),
+		createStreamFn: ({ model }) => model.api === "anthropic-messages" ? createMantleAnthropicStreamFn() : void 0,
+		matchesContextOverflowError: ({ errorMessage }) => /context_length_exceeded|max.*tokens.*exceeded/i.test(errorMessage),
+		classifyFailoverReason: ({ errorMessage }) => {
+			if (/rate_limit|too many requests|429/i.test(errorMessage)) return "rate_limit";
+			if (/overloaded|503|service.*unavailable/i.test(errorMessage)) return "overloaded";
+		}
+	});
+}
+//#endregion
+export { registerBedrockMantlePlugin };

package/openclaw.plugin.json

@@ -0,0 +1,34 @@
+{
+  "id": "amazon-bedrock-mantle",
+  "activation": {
+    "onStartup": false
+  },
+  "enabledByDefault": true,
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "discovery": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "enabled": {
+            "type": "boolean",
+            "description": "When false, skip implicit Mantle model discovery."
+          }
+        }
+      }
+    }
+  },
+  "uiHints": {
+    "discovery": {
+      "label": "Model Discovery",
+      "help": "Plugin-owned controls for Amazon Bedrock Mantle model auto-discovery."
+    },
+    "discovery.enabled": {
+      "label": "Enable Discovery",
+      "help": "When false, OpenClaw keeps the Amazon Bedrock Mantle plugin available but skips implicit startup discovery. Leave unset for default auto-detect behavior."
+    }
+  },
+  "providers": ["amazon-bedrock-mantle"]
+}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@openclaw/amazon-bedrock-mantle-provider",
+  "version": "2026.5.12-beta.7",
+  "description": "OpenClaw Amazon Bedrock Mantle (OpenAI-compatible) provider plugin",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/openclaw/openclaw"
+  },
+  "type": "module",
+  "dependencies": {
+    "@anthropic-ai/sdk": "0.95.2",
+    "@aws/bedrock-token-generator": "1.1.0",
+    "@earendil-works/pi-ai": "0.74.0"
+  },
+  "devDependencies": {
+    "@openclaw/plugin-sdk": "workspace:*"
+  },
+  "openclaw": {
+    "extensions": [
+      "./index.ts"
+    ],
+    "install": {
+      "npmSpec": "@openclaw/amazon-bedrock-mantle-provider",
+      "defaultChoice": "npm",
+      "minHostVersion": ">=2026.5.12-beta.6"
+    },
+    "compat": {
+      "pluginApi": ">=2026.5.12-beta.7"
+    },
+    "build": {
+      "openclawVersion": "2026.5.12-beta.7",
+      "bundledDist": false
+    },
+    "release": {
+      "publishToNpm": true
+    },
+    "runtimeExtensions": [
+      "./dist/index.js"
+    ]
+  },
+  "files": [
+    "dist/**",
+    "openclaw.plugin.json"
+  ],
+  "peerDependencies": {
+    "openclaw": ">=2026.5.12-beta.7"
+  },
+  "peerDependenciesMeta": {
+    "openclaw": {
+      "optional": true
+    }
+  }
+}