@openclaw/amazon-bedrock-provider 2026.7.2-beta.7 → 2026.8.1-beta.2

package/dist/embedding-provider.js

@@ -118,7 +118,7 @@ function loadDefaultCredentialProvider() {
 	return credentialProviderPromise ??= import("@aws-sdk/credential-provider-node").then(({ defaultProvider }) => defaultProvider).catch(() => null);
 }
 const MODEL_PREFIX_RE = /^(?:bedrock|amazon-bedrock|aws)\//;
-const REGION_RE = /bedrock-runtime\.([a-z0-9-]+)\./;
+const REGION_RE = /bedrock-runtime(?:-fips)?\.([a-z0-9-]+)\./;
 function normalizeBedrockEmbeddingModel(model) {
 	const trimmed = model.trim();
 	return trimmed ? trimmed.replace(MODEL_PREFIX_RE, "") : DEFAULT_BEDROCK_EMBEDDING_MODEL;
@@ -211,15 +211,9 @@ function parseCohereBatch(family, raw) {
 	}
 	return asNumberArrayBatch(embeddings);
 }
-const testing = {
-	parseCohereBatch,
-	parseSingle,
-	stripInferenceProfilePrefix
-};
-if (process.env.VITEST === "true") Reflect.set(globalThis, Symbol.for("openclaw.amazonBedrockEmbeddingTestApi"), testing);
 async function createBedrockEmbeddingProvider(options) {
-	const client = resolveBedrockEmbeddingClient(options);
 	const { BedrockRuntimeClient, InvokeModelCommand } = await loadSdk();
+	const client = resolveBedrockEmbeddingClient(options, BedrockRuntimeClient);
 	const spec = resolveSpec(client.model);
 	const family = spec?.family ?? inferFamily(client.model);
 	debugEmbeddingsLog("memory embeddings: bedrock client", {
@@ -230,7 +224,12 @@ async function createBedrockEmbeddingProvider(options) {
 	});
 	const invoke = async (body, signal) => {
 		await refreshAwsSharedConfigCacheForBedrock();
-		const sdk = new BedrockRuntimeClient({ region: client.region });
+		const sdk = new BedrockRuntimeClient({
+			region: client.region,
+			endpoint: client.endpoint,
+			useFipsEndpoint: client.useFipsEndpoint,
+			useDualstackEndpoint: client.useDualstackEndpoint
+		});
 		try {
 			const res = await sdk.send(new InvokeModelCommand({
 				modelId: client.model,
@@ -273,11 +272,41 @@ async function createBedrockEmbeddingProvider(options) {
 		client
 	};
 }
-function resolveBedrockEmbeddingClient(options) {
+function resolveBedrockEmbeddingClient(options, BedrockRuntimeClient) {
 	const model = normalizeBedrockEmbeddingModel(options.model);
 	const spec = resolveSpec(model);
 	const providerConfig = options.config.models?.providers?.["amazon-bedrock"];
+	let endpoint = normalizeOptionalString(options.remote?.baseUrl) ?? normalizeOptionalString(providerConfig?.baseUrl);
+	let useFipsEndpoint;
+	let useDualstackEndpoint;
 	const region = regionFromUrl(options.remote?.baseUrl) ?? regionFromUrl(providerConfig?.baseUrl) ?? normalizeOptionalString(process.env.AWS_REGION) ?? normalizeOptionalString(process.env.AWS_DEFAULT_REGION) ?? "us-east-1";
+	if (endpoint) {
+		const sdk = new BedrockRuntimeClient({ region });
+		try {
+			const normalizedEndpoint = new URL(endpoint).href;
+			for (const fips of [false, true]) {
+				for (const dualstack of [false, true]) {
+					const endpointModes = {
+						Region: region,
+						UseFIPS: fips,
+						UseDualStack: dualstack
+					};
+					try {
+						if (sdk.config.endpointProvider(endpointModes).url.href !== normalizedEndpoint) continue;
+					} catch {
+						continue;
+					}
+					endpoint = void 0;
+					useFipsEndpoint = fips || void 0;
+					useDualstackEndpoint = dualstack || void 0;
+					break;
+				}
+				if (!endpoint) break;
+			}
+		} finally {
+			sdk.destroy();
+		}
+	}
 	let dimensions;
 	if (options.outputDimensionality != null) {
 		if (spec?.validDims && !spec.validDims.includes(options.outputDimensionality)) throw new Error(`Invalid dimensions ${options.outputDimensionality} for ${model}. Valid values: ${spec.validDims.join(", ")}`);
@@ -286,7 +315,10 @@ function resolveBedrockEmbeddingClient(options) {
 	return {
 		region,
 		model,
-		dimensions
+		dimensions,
+		...endpoint ? { endpoint } : {},
+		...useFipsEndpoint ? { useFipsEndpoint } : {},
+		...useDualstackEndpoint ? { useDualstackEndpoint } : {}
 	};
 }
 async function hasAwsCredentials(env = process.env, loadCredentialProvider = loadDefaultCredentialProvider) {

package/dist/memory-embedding-adapter.js

@@ -29,7 +29,8 @@ const bedrockMemoryEmbeddingProviderAdapter = {
 					provider: "bedrock",
 					region: client.region,
 					model: client.model,
-					dimensions: client.dimensions
+					dimensions: client.dimensions,
+					...client.endpoint ? { endpoint: client.endpoint } : {}
 				}
 			}
 		};

package/dist/register.sync.runtime.js

@@ -7,7 +7,7 @@ import { isLatestAdaptiveBedrockModelRef, isOpus47OrNewerBedrockModelRef, resolv
 import { streamSimpleBedrock } from "./stream.runtime.js";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { buildProviderReplayFamilyHooks, normalizeProviderId, resolveClaudeFable5ModelIdentity, resolveClaudeModelIdentity, resolveClaudeMythos5ModelIdentity, resolveClaudeOpus5ModelIdentity, resolveClaudeSonnet5ModelIdentity } from "openclaw/plugin-sdk/provider-model-shared";
-import { streamWithPayloadPatch } from "openclaw/plugin-sdk/provider-stream-shared";
+import { createPayloadPatchStreamWrapper } from "openclaw/plugin-sdk/provider-stream-shared";
 //#region extensions/amazon-bedrock/register.sync.runtime.ts
 function normalizeBedrockResolvedModel({ modelId, model }) {
 	const thinkingLevelMap = resolveBedrockNativeThinkingLevelMap(modelId, model.params);
@@ -68,28 +68,23 @@ function resolveBedrockServiceTier(extraParams, warn) {
 	warn(`ignoring invalid Bedrock service_tier param: ${raw}`);
 }
 function createBedrockServiceTierWrapper(underlying, serviceTier) {
-	return (model, context, options) => {
-		if (model.api !== "bedrock-converse-stream") return underlying(model, context, options);
-		return streamWithPayloadPatch(underlying, model, context, options, (payloadObj) => {
-			payloadObj.serviceTier ??= { type: serviceTier };
-		});
-	};
+	return createPayloadPatchStreamWrapper(underlying, ({ payload }) => {
+		payload.serviceTier ??= { type: serviceTier };
+	}, { shouldPatch: ({ model }) => model.api === "bedrock-converse-stream" });
 }
 function createGuardrailWrapStreamFn(innerWrapStreamFn, guardrailConfig) {
 	return (ctx) => {
 		const inner = innerWrapStreamFn(ctx);
 		if (!inner) return inner;
-		return (model, context, options) => {
-			return streamWithPayloadPatch(inner, model, context, options, (payload) => {
-				const gc = {
-					guardrailIdentifier: guardrailConfig.guardrailIdentifier,
-					guardrailVersion: guardrailConfig.guardrailVersion
-				};
-				if (guardrailConfig.streamProcessingMode) gc.streamProcessingMode = guardrailConfig.streamProcessingMode;
-				if (guardrailConfig.trace) gc.trace = guardrailConfig.trace;
-				payload.guardrailConfig = gc;
-			});
-		};
+		return createPayloadPatchStreamWrapper(inner, ({ payload }) => {
+			const gc = {
+				guardrailIdentifier: guardrailConfig.guardrailIdentifier,
+				guardrailVersion: guardrailConfig.guardrailVersion
+			};
+			if (guardrailConfig.streamProcessingMode) gc.streamProcessingMode = guardrailConfig.streamProcessingMode;
+			if (guardrailConfig.trace) gc.trace = guardrailConfig.trace;
+			payload.guardrailConfig = gc;
+		});
 	};
 }
 function sharedRuntimeWouldInjectCachePoints(modelId) {

package/dist/stream.runtime.js

@@ -72,6 +72,7 @@ const streamBedrock = (model, context, options = {}) => {
 			timestamp: Date.now()
 		};
 		const blocks = output.content;
+		const redactedReasoningChunks = /* @__PURE__ */ new Map();
 		const fable5 = usesClaudeFable5BedrockContract(model);
 		const refusalBuffer = usesClaudeStreamingRefusalBedrockContract(model) ? createDeferredEventBuffer(stream, () => notifyLlmRequestActivity(options.signal)) : void 0;
 		const eventSink = refusalBuffer ?? stream;
@@ -100,8 +101,9 @@ const streamBedrock = (model, context, options = {}) => {
 			config.token = { token: bearerToken };
 			config.authSchemePreference = ["httpBearerAuth"];
 		}
+		let client;
 		try {
-			const client = new BedrockRuntimeClient(config);
+			client = new BedrockRuntimeClient(config);
 			const cacheRetention = resolveCacheRetention(options.cacheRetention);
 			const additionalModelRequestFields = buildAdditionalModelRequestFields(model, options);
 			const thinking = additionalModelRequestFields?.thinking;
@@ -139,8 +141,8 @@ const streamBedrock = (model, context, options = {}) => {
 					partial: output
 				});
 			} else if (item.contentBlockStart) handleContentBlockStart(item.contentBlockStart, blocks, output, eventSink);
-			else if (item.contentBlockDelta) handleContentBlockDelta(item.contentBlockDelta, blocks, output, eventSink);
-			else if (item.contentBlockStop) handleContentBlockStop(item.contentBlockStop, blocks, output, eventSink);
+			else if (item.contentBlockDelta) handleContentBlockDelta(item.contentBlockDelta, blocks, output, eventSink, redactedReasoningChunks);
+			else if (item.contentBlockStop) handleContentBlockStop(item.contentBlockStop, blocks, output, eventSink, redactedReasoningChunks);
 			else if (item.messageStop) {
 				sawMessageStop = true;
 				if (item.messageStop.stopReason === "refusal") applyAnthropicRefusal(output, readBedrockStopDetails(item.messageStop.additionalModelResponseFields), model.provider);
@@ -155,9 +157,10 @@ const streamBedrock = (model, context, options = {}) => {
 			else if (item.validationException) throw item.validationException;
 			else if (item.throttlingException) throw item.throttlingException;
 			else if (item.serviceUnavailableException) throw item.serviceUnavailableException;
-			if (refusalBuffer && !sawMessageStop) throw new Error("Bedrock stream ended before messageStop");
+			if (!sawMessageStop) throw new Error("Bedrock stream ended before messageStop");
 			if (options.signal?.aborted) throw new Error("Request was aborted");
 			if (output.stopReason === "error" || output.stopReason === "aborted") throw new Error(output.errorMessage ?? "An unknown error occurred");
+			for (const block of blocks) if (block.index !== void 0) handleContentBlockStop({ contentBlockIndex: block.index }, blocks, output, eventSink, redactedReasoningChunks);
 			refusalBuffer?.flush();
 			stream.push({
 				type: "done",
@@ -182,6 +185,8 @@ const streamBedrock = (model, context, options = {}) => {
 				error: output
 			});
 			stream.end();
+		} finally {
+			client?.destroy();
 		}
 	})();
 	return stream;
@@ -285,7 +290,7 @@ function handleContentBlockStart(event, blocks, output, stream) {
 		});
 	}
 }
-function handleContentBlockDelta(event, blocks, output, stream) {
+function handleContentBlockDelta(event, blocks, output, stream, redactedReasoningChunks) {
 	const contentBlockIndex = event.contentBlockIndex;
 	const delta = event.delta;
 	let index = blocks.findIndex((b) => b.index === contentBlockIndex);
@@ -354,6 +359,13 @@ function handleContentBlockDelta(event, blocks, output, stream) {
 				});
 			}
 			if (delta.reasoningContent.signature) thinkingBlock.thinkingSignature = (thinkingBlock.thinkingSignature || "") + delta.reasoningContent.signature;
+			if (delta.reasoningContent.redactedContent) {
+				const chunks = redactedReasoningChunks.get(contentBlockIndex);
+				if (chunks) chunks.push(delta.reasoningContent.redactedContent);
+				else redactedReasoningChunks.set(contentBlockIndex, [delta.reasoningContent.redactedContent]);
+				thinkingBlock.thinking = "[Reasoning redacted]";
+				thinkingBlock.redacted = true;
+			}
 		}
 	}
 }
@@ -363,11 +375,19 @@ function handleMetadata(event, model, output) {
 		output.usage.output = event.usage.outputTokens || 0;
 		output.usage.cacheRead = event.usage.cacheReadInputTokens || 0;
 		output.usage.cacheWrite = event.usage.cacheWriteInputTokens || 0;
-		output.usage.totalTokens = event.usage.totalTokens || output.usage.input + output.usage.output;
+		const promptTokens = output.usage.input + output.usage.cacheRead + output.usage.cacheWrite;
+		output.usage.totalTokens = Math.max(event.usage.totalTokens || 0, promptTokens + output.usage.output);
+		output.usage.contextUsage = {
+			state: "available",
+			promptTokens,
+			totalTokens: promptTokens + output.usage.output
+		};
+		const cacheWrite1h = event.usage.cacheDetails?.reduce((total, detail) => detail.ttl === CacheTTL.ONE_HOUR ? total + (detail.inputTokens ?? 0) : total, 0);
+		if (cacheWrite1h) output.usage.cacheWrite1h = cacheWrite1h;
 		calculateCost(model, output.usage);
 	}
 }
-function handleContentBlockStop(event, blocks, output, stream) {
+function handleContentBlockStop(event, blocks, output, stream, redactedReasoningChunks) {
 	const index = blocks.findIndex((b) => b.index === event.contentBlockIndex);
 	const block = blocks[index];
 	if (!block) return;
@@ -382,6 +402,15 @@ function handleContentBlockStop(event, blocks, output, stream) {
 			});
 			break;
 		case "thinking":
+			if (block.redacted) {
+				const chunks = redactedReasoningChunks.get(event.contentBlockIndex);
+				if (chunks) {
+					let opaqueReasoning = "";
+					for (const chunk of chunks) for (const byte of chunk) opaqueReasoning += String.fromCharCode(byte);
+					block.thinkingSignature = btoa(opaqueReasoning);
+					redactedReasoningChunks.delete(event.contentBlockIndex);
+				}
+			}
 			stream.push({
 				type: "thinking_end",
 				contentIndex: index,
@@ -495,16 +524,17 @@ function createBedrockToolResult(message) {
 			content.push({ text: sanitizeSurrogates(block.text) });
 			continue;
 		}
-		if (describeToolResultMediaPlaceholder([block])) content.push({ image: createImageBlock(block.mimeType, block.data) });
+		if (block.type === "image" && describeToolResultMediaPlaceholder([block])) content.push({ image: createImageBlock(block.mimeType, block.data) });
 	}
 	return { toolResult: {
 		toolUseId: message.toolCallId,
-		content: content.length > 0 ? content : [{ text: "(no output)" }],
+		content: content.length > 0 ? content : [{ text: describeToolResultMediaPlaceholder(message.content) ?? "(no output)" }],
 		status: message.isError ? ToolResultStatus.ERROR : ToolResultStatus.SUCCESS
 	} };
 }
 function convertMessages(context, model, cacheRetention) {
 	const result = [];
+	let firstVolatileMessageIndex;
 	const transformedMessages = transformMessages(context.messages, model, normalizeToolCallId);
 	for (let i = 0; i < transformedMessages.length; i++) {
 		const m = expectDefined(transformedMessages[i], "message conversion index is in bounds");
@@ -522,6 +552,7 @@ function convertMessages(context, model, cacheRetention) {
 					default: continue;
 				}
 				if (content.length === 0) continue;
+				if (m.runtimeContextCarrier === true && firstVolatileMessageIndex === void 0) firstVolatileMessageIndex = result.length;
 				result.push({
 					role: ConversationRole.USER,
 					content
@@ -544,6 +575,12 @@ function convertMessages(context, model, cacheRetention) {
 						} });
 						break;
 					case "thinking": {
+						if (c.redacted) {
+							if (!supportsThinkingSignature(model)) continue;
+							if (!c.thinkingSignature) throw new Error("Bedrock redacted reasoning block is missing its opaque signature");
+							contentBlocks.push({ reasoningContent: { redactedContent: decodeBedrockBase64(c.thinkingSignature, "Bedrock redacted reasoning block has a malformed opaque signature") } });
+							break;
+						}
 						const thinkingSignature = c.thinkingSignature;
 						const normalizedThinkingSignature = thinkingSignature?.trim();
 						const supportsSignature = supportsThinkingSignature(model);
@@ -588,9 +625,9 @@ function convertMessages(context, model, cacheRetention) {
 			default: continue;
 		}
 	}
-	if (cacheRetention !== "none" && supportsPromptCaching(model) && result.length > 0) {
-		const lastMessage = expectDefined(result.at(-1), "non-empty converted message list");
-		if (lastMessage.role === ConversationRole.USER && lastMessage.content) lastMessage.content.push({ cachePoint: {
+	if (cacheRetention !== "none" && supportsPromptCaching(model) && result.at(-1)?.role === ConversationRole.USER) {
+		const cacheAnchor = result.findLast((message, index) => message.role === ConversationRole.USER && (firstVolatileMessageIndex === void 0 || index < firstVolatileMessageIndex));
+		if (cacheAnchor?.content) cacheAnchor.content.push({ cachePoint: {
 			type: CachePointType.DEFAULT,
 			...cacheRetention === "long" ? { ttl: CacheTTL.ONE_HOUR } : {}
 		} });
@@ -720,26 +757,18 @@ function createImageBlock(mimeType, data) {
 			break;
 		default: throw new Error(`Unknown image type: ${mimeType}`);
 	}
+	return {
+		source: { bytes: decodeBedrockBase64(data, "Amazon Bedrock image content has malformed base64") },
+		format
+	};
+}
+function decodeBedrockBase64(data, errorMessage) {
 	const canonicalBase64 = canonicalizeBase64(data);
-	if (!canonicalBase64) throw new Error("Amazon Bedrock image content has malformed base64");
+	if (!canonicalBase64) throw new Error(errorMessage);
 	const binaryString = atob(canonicalBase64);
 	const bytes = new Uint8Array(binaryString.length);
 	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
-	return {
-		source: { bytes },
-		format
-	};
+	return bytes;
 }
-/** Test-only hooks for Bedrock runtime conversion and endpoint policy. */
-const testing = {
-	buildAdditionalModelRequestFields,
-	convertMessages,
-	getConfiguredBedrockRegion,
-	hasConfiguredBedrockProfile,
-	mapThinkingLevelToEffort,
-	resolveSimpleBedrockOptions,
-	shouldUseExplicitBedrockEndpoint
-};
-if (process.env.VITEST === "true") Reflect.set(globalThis, Symbol.for("openclaw.amazonBedrockStreamTestApi"), testing);
 //#endregion
 export { streamSimpleBedrock };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/amazon-bedrock-provider",
-  "version": "2026.7.2-beta.7",
+  "version": "2026.8.1-beta.2",
   "description": "OpenClaw Amazon Bedrock provider plugin with model discovery, embeddings, and guardrail support.",
   "repository": {
     "type": "git",
@@ -25,10 +25,10 @@
       "minHostVersion": ">=2026.5.12-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.7.2-beta.7"
+      "pluginApi": ">=2026.8.1-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.7.2-beta.7",
+      "openclawVersion": "2026.8.1-beta.2",
       "bundledDist": false
     },
     "release": {
@@ -45,7 +45,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.2-beta.7"
+    "openclaw": ">=2026.8.1-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {