@opencode/ai 0.0.0-beta-19275

package/dist/protocols/shared.js

@@ -0,0 +1,290 @@
+import { Buffer } from "node:buffer";
+import { Tool } from "@opencode/schema/tool";
+import { Effect, Schema, Stream } from "effect";
+import * as Sse from "effect/unstable/encoding/Sse";
+import { Headers, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
+import { InvalidProviderOutputError, InvalidRequestError, UnsupportedOperationError, AIError, HttpContext, LLMRequest, Message, ToolDefinition, } from "../schema/index.js";
+import { isRecord } from "../utils/record.js";
+export { isRecord };
+export const Json = Schema.fromJsonString(Schema.Unknown);
+export const decodeJson = Schema.decodeUnknownSync(Json);
+export const encodeJson = Schema.encodeSync(Json);
+const isJson = Schema.is(Schema.Json);
+export const JsonObject = Schema.Record(Schema.String, Schema.Unknown);
+export const optionalArray = (schema) => Schema.optional(Schema.Array(schema));
+export const optionalNull = (schema) => Schema.optional(Schema.NullOr(schema));
+export const OPENAI_PROMPT_CACHE_KEY_MAX_LENGTH = 64;
+// OpenAI limits `prompt_cache_key` to 64 chars; DeepSeek and Zai inherit the same
+// limit via their OpenAI-compatible APIs. Clamp with unicode-aware slicing.
+export const promptCacheKey = (request) => {
+    if (request.cache === "none" || request.promptCacheKey === undefined)
+        return undefined;
+    const chars = Array.from(request.promptCacheKey);
+    if (chars.length <= OPENAI_PROMPT_CACHE_KEY_MAX_LENGTH)
+        return request.promptCacheKey;
+    return chars.slice(0, OPENAI_PROMPT_CACHE_KEY_MAX_LENGTH).join("");
+};
+/**
+ * `Usage.totalTokens` policy shared by every route. Honors a provider-
+ * supplied total; otherwise falls back to `inputTokens + outputTokens` only
+ * when at least one is defined. Returns `undefined` when neither input nor
+ * output is known so routes don't publish a misleading `0`.
+ *
+ * Under the inclusive `AI.Usage` contract, `inputTokens` includes cached input
+ * and `outputTokens` includes reasoning. Protocol mappers normalize those
+ * inclusive values before calling this helper. The provider-supplied total is
+ * the source of truth when present; otherwise their sum is the canonical total.
+ */
+export const totalTokens = (inputTokens, outputTokens, total) => {
+    if (total !== undefined)
+        return total;
+    if (inputTokens === undefined && outputTokens === undefined)
+        return undefined;
+    return (inputTokens ?? 0) + (outputTokens ?? 0);
+};
+/**
+ * Subtract `subtrahend` from `total`, clamping to zero if the provider
+ * reports a non-sensical breakdown (e.g. `cached_tokens > prompt_tokens`).
+ * Used by protocol mappers when deriving a non-overlapping breakdown field
+ * from a provider's inclusive total — `nonCachedInputTokens` from
+ * `inputTokens - cacheReadInputTokens - cacheWriteInputTokens`.
+ *
+ * If `total` is `undefined`, returns `undefined` (we don't fabricate
+ * counts). If `subtrahend` is `undefined`, returns `total` unchanged. The
+ * provider-native breakdown stays available on `Usage.providerMetadata` for debugging.
+ */
+export const subtractTokens = (total, subtrahend) => {
+    if (total === undefined)
+        return undefined;
+    if (subtrahend === undefined)
+        return total;
+    return Math.max(0, total - subtrahend);
+};
+/**
+ * Sum a list of optional token counts, returning `undefined` only when
+ * every value is `undefined` (so we don't fabricate a `0`). Used by
+ * protocol mappers to derive the inclusive `inputTokens` total from a
+ * provider that natively reports a non-overlapping breakdown
+ * (e.g. Anthropic, whose `input_tokens` is already non-cached only).
+ */
+export const sumTokens = (...values) => {
+    if (values.every((value) => value === undefined))
+        return undefined;
+    return values.reduce((acc, value) => acc + (value ?? 0), 0);
+};
+export const eventError = (route, message, body, cause) => new AIError({
+    reason: new InvalidProviderOutputError({ route, message, body, cause }),
+});
+export const parseJson = (route, input, message) => Effect.try({
+    try: () => decodeJson(input),
+    catch: (cause) => eventError(route, message, input, cause),
+});
+/**
+ * Join the `text` field of a list of parts with newlines. Used by routes
+ * that flatten system / message content arrays into a single provider string
+ * (OpenAI Chat `system` content, OpenAI Responses `system` content, Gemini
+ * `systemInstruction.parts[].text`).
+ */
+export const joinText = (parts) => parts.map((part) => part.text).join("\n");
+const escapeSystemUpdateText = (text) => text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+/**
+ * Stable fallback representation for chronological `Message.system(...)`
+ * updates on routes that do not support that privileged role natively. The
+ * wrapper remains visibly lower-authority user text, preserves the original
+ * temporal position, and XML-escapes content so it cannot close the wrapper.
+ */
+export const wrapSystemUpdate = (parts) => `<system-update>\n${escapeSystemUpdateText(joinText(parts))}\n</system-update>`;
+/**
+ * Chronological system updates deliberately accept text only. Do not insert
+ * raw retrieved, tool, or web content into privileged updates: keep untrusted
+ * data in ordinary user/tool messages instead.
+ */
+export const systemUpdateText = Effect.fn("ProviderShared.systemUpdateText")(function* (route, message) {
+    const content = [];
+    for (const part of message.content) {
+        if (!supportsContent(part, ["text"]))
+            return yield* unsupportedContent(route, "system", ["text"]);
+        content.push(part);
+    }
+    return content;
+});
+/** Lower an unsupported privileged update into visible, in-order user text. */
+export const wrappedSystemUpdate = Effect.fn("ProviderShared.wrappedSystemUpdate")(function* (route, message) {
+    const content = yield* systemUpdateText(route, message);
+    return { type: "text", text: wrapSystemUpdate(content), cache: content.at(-1)?.cache };
+});
+/**
+ * Parse the streamed JSON input of a tool call. Treats an empty string as
+ * `"{}"` — providers occasionally finish a tool call without ever emitting
+ * input deltas (e.g. zero-arg tools). The error message is uniform across
+ * routes: `Invalid JSON input for <route> tool call <name>`.
+ */
+export const parseToolInput = (route, name, raw) => parseJson(route, raw || "{}", `Invalid JSON input for ${route} tool call ${name}`);
+export const normalizeMedia = (part) => {
+    const mime = part.mediaType.toLowerCase();
+    if (typeof part.data !== "string") {
+        const base64 = Buffer.from(part.data).toString("base64");
+        return { mime, base64, dataUrl: `data:${mime};base64,${base64}` };
+    }
+    if (!part.data.startsWith("data:"))
+        return { mime, base64: part.data, dataUrl: `data:${mime};base64,${part.data}` };
+    return { mime, base64: part.data.slice(part.data.indexOf(",") + 1), dataUrl: part.data };
+};
+export const normalizeToolFile = (part) => normalizeMedia({ type: "media", mediaType: part.mime, data: part.uri, filename: part.name });
+export const trimBaseUrl = (value) => value.replace(/\/+$/, "");
+export const toolResultText = (part) => {
+    if (part.result.type === "text")
+        return String(part.result.value);
+    if (part.result.type === "error") {
+        const value = part.result.value;
+        const prototype = typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value);
+        const structured = Array.isArray(value) || prototype === Object.prototype || prototype === null;
+        return structured && isJson(value) ? encodeJson(value) : String(value);
+    }
+    return encodeJson(part.result.value);
+};
+export const errorText = (error) => {
+    if (error instanceof Error)
+        return error.message;
+    if (typeof error === "string")
+        return error;
+    if (typeof error === "number" || typeof error === "boolean" || typeof error === "bigint")
+        return String(error);
+    if (error === null)
+        return "null";
+    if (error === undefined)
+        return "undefined";
+    return "Unknown stream error";
+};
+/**
+ * `framing` step for Server-Sent Events. Decodes UTF-8, runs the SSE channel
+ * decoder, optionally filters named events, and drops empty events. `[DONE]`
+ * is dropped by default or retained for protocols that use it as their stream
+ * boundary. Retry control events are ignored without interrupting the stream.
+ * Decoder failures become provider output errors so the public error channel
+ * stays `AIError`.
+ */
+export const sseFraming = (bytes, events, includeDone = false) => bytes.pipe(Stream.decodeText(), Stream.mapAccumEffect(() => {
+    const output = [];
+    return {
+        output,
+        parser: Sse.makeParser((event) => {
+            if (event._tag === "Event")
+                output.push(event);
+        }),
+    };
+}, (state, chunk) => Effect.gen(function* () {
+    const error = state.parser.feed(chunk);
+    if (error)
+        return yield* eventError("sse", error.message, chunk, error);
+    return [state, state.output.splice(0)];
+})), Stream.filter((event) => (events === undefined || events.has(event.event)) &&
+    event.data.length > 0 &&
+    (event.data !== "[DONE]" || includeDone || (events !== undefined && event.event !== "message"))), Stream.map((event) => event.data));
+/**
+ * Canonical invalid-request constructor shared by protocol lowering.
+ */
+export const invalidRequest = (message, cause) => new AIError({
+    reason: new InvalidRequestError({ message, cause }),
+});
+/**
+ * Canonical constructor for operations the selected route does not implement.
+ * Prefer this over `invalidRequest` when the failure is a missing route
+ * capability rather than a malformed caller input, so consumers can branch on
+ * `reason._tag` plus `reason.operation` instead of matching message text.
+ */
+export const unsupportedOperation = (input) => new AIError({
+    reason: new UnsupportedOperationError({
+        operation: input.operation,
+        message: input.message,
+        provider: input.provider,
+        route: input.route,
+        cause: input.cause,
+    }),
+});
+/**
+ * Lower namespaces to flat definitions for protocols without a native
+ * namespace construct. Leaf names join their namespace path with `_` because
+ * `.` is not broadly accepted in provider tool names.
+ */
+export const flattenTools = (tools, path = []) => {
+    const flat = tools.flatMap((tool) => {
+        if (tool.type === "namespace")
+            return flattenTools(tool.tools, [...path, tool.name]);
+        if (path.length === 0)
+            return [tool];
+        return [new ToolDefinition({ ...tool, name: [...path, tool.name].join("_") })];
+    });
+    return [...new Map(flat.map((tool) => [tool.name, tool])).values()];
+};
+export const flattenToolRequest = (request) => {
+    const messages = request.messages.map((message) => {
+        const content = message.content.map((part) => {
+            if ((part.type !== "tool-call" && part.type !== "tool-result") || part.namespace === undefined)
+                return part;
+            return { ...part, name: `${part.namespace}_${part.name}`, namespace: undefined };
+        });
+        return content.every((part, index) => part === message.content[index])
+            ? message
+            : new Message({ ...message, content });
+    });
+    return {
+        tools: flattenTools(request.tools),
+        request: messages.every((message, index) => message === request.messages[index])
+            ? request
+            : LLMRequest.update(request, { messages }),
+    };
+};
+export const imageResponse = Effect.fn("ProviderShared.imageResponse")(function* (route, name, response) {
+    const http = new HttpContext({ url: response.request.url, status: response.status, headers: response.headers });
+    const body = yield* response.text.pipe(Effect.mapError((cause) => new AIError({
+        reason: new InvalidProviderOutputError({
+            route,
+            message: `Failed to read the ${name} response`,
+            http,
+            cause,
+        }),
+    })));
+    return {
+        body,
+        invalid: (message, cause) => new AIError({
+            reason: new InvalidProviderOutputError({ route, message, body, http, cause }),
+        }),
+    };
+});
+export const matchToolChoice = (route, toolChoice, cases) => Effect.gen(function* () {
+    if (toolChoice.type === "auto")
+        return cases.auto();
+    if (toolChoice.type === "none")
+        return cases.none();
+    if (toolChoice.type === "required")
+        return cases.required();
+    if (!toolChoice.name)
+        return yield* invalidRequest(`${route} tool choice requires a tool name`);
+    return cases.tool(toolChoice.name);
+});
+const formatContentTypes = (types) => {
+    if (types.length <= 1)
+        return types[0] ?? "";
+    if (types.length === 2)
+        return `${types[0]} and ${types[1]}`;
+    return `${types.slice(0, -1).join(", ")}, and ${types.at(-1)}`;
+};
+export const supportsContent = (part, types) => types.includes(part.type);
+export const unsupportedContent = (route, role, types) => invalidRequest(`${route} ${role} messages only support ${formatContentTypes(types)} content for now`);
+/**
+ * Build a `validate` step from a Schema decoder. Replaces the per-route
+ * lambda body `(payload) => decode(payload).pipe(Effect.mapError((e) =>
+ * invalid(e.message)))`. Any decode error is translated into
+ * `AIError` carrying the original parse-error message.
+ */
+export const validateWith = (decode) => (payload) => decode(payload).pipe(Effect.mapError((error) => invalidRequest(error.message, error)));
+/**
+ * Build an HTTP POST with a JSON body. Sets `content-type: application/json`
+ * automatically after caller-supplied headers so routes cannot accidentally
+ * send JSON with a stale content type. The body is passed pre-encoded so
+ * routes can choose between
+ * `Schema.encodeSync(payload)` and `ProviderShared.encodeJson(payload)`.
+ */
+export const jsonPost = (input) => HttpClientRequest.post(input.url).pipe(HttpClientRequest.setHeaders(Headers.set(Headers.fromInput(input.headers), "content-type", "application/json")), HttpClientRequest.bodyText(input.body, "application/json"));
+export * as ProviderShared from "./shared.js";

package/dist/protocols/utils/bedrock-auth.d.ts

@@ -0,0 +1,60 @@
+import { Effect } from "effect";
+import { Auth } from "../../route/auth.js";
+import { AIError } from "../../schema/index.js";
+/**
+ * AWS credentials for SigV4 signing. Bedrock also supports Bearer API key auth,
+ * which provider facades configure as route auth instead of SigV4.
+ */
+export interface Credentials {
+    readonly region: string;
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly sessionToken?: string;
+}
+/** Static credentials or an effect resolved before every request. */
+export type CredentialSource = Credentials | Effect.Effect<Credentials, AIError>;
+export interface DefaultChainOptions {
+    readonly region: string;
+    /** Shared config profile passed to the AWS default chain. */
+    readonly profile?: string;
+}
+/**
+ * Resolve credentials through the AWS default provider chain: environment
+ * variables, shared config and SSO caches, web identity tokens, process
+ * credentials, and container or instance metadata. A fresh chain runs on every
+ * request so credentials rotated on disk without an expiration (for example
+ * shared-config keys rewritten by a corporate SSO tool) are always re-read;
+ * the SDK's own memoization would otherwise pin them for the process lifetime.
+ */
+export declare const defaultChain: (options: DefaultChainOptions) => Effect.Effect<Credentials, AIError>;
+/** Sign the exact JSON bytes with SigV4 using credentials configured on the route. */
+export declare const sigV4: (source: CredentialSource | undefined, options?: {
+    readonly service?: string;
+    readonly name?: string;
+}) => Auth.Definition;
+/** Bedrock route auth defaults to SigV4 and expects credentials from route configuration. */
+export declare const auth: Auth.Definition;
+export declare const resolveRegion: (input: {
+    readonly region?: string;
+    readonly credentials?: {
+        readonly region: string;
+    };
+}) => string;
+export interface ResolveAuthInput {
+    readonly apiKey?: string;
+    readonly credentials?: Credentials;
+    readonly profile?: string;
+}
+export interface ResolveAuthOptions {
+    readonly service?: string;
+    readonly name?: string;
+    /** `sigv4` ignores an ambient `AWS_BEARER_TOKEN_BEDROCK`; `bearer` is validated by the caller. */
+    readonly mode?: "bearer" | "sigv4";
+}
+/**
+ * Bearer wins over SigV4 and explicit static credentials win over the default
+ * chain, matching the AWS SDK's own precedence for `AWS_BEARER_TOKEN_BEDROCK`.
+ * The region is applied to the SigV4 scope so it always matches the endpoint host.
+ */
+export declare const resolveAuth: (input: ResolveAuthInput, region: string, options?: ResolveAuthOptions) => Auth.Definition;
+export * as BedrockAuth from "./bedrock-auth.js";

package/dist/protocols/utils/bedrock-auth.js

@@ -0,0 +1,85 @@
+import { AwsV4Signer } from "aws4fetch";
+import { Effect } from "effect";
+import { Headers } from "effect/unstable/http";
+import { Auth } from "../../route/auth.js";
+import { AIError, AuthenticationError } from "../../schema/index.js";
+import { ProviderShared } from "../shared.js";
+/**
+ * Resolve credentials through the AWS default provider chain: environment
+ * variables, shared config and SSO caches, web identity tokens, process
+ * credentials, and container or instance metadata. A fresh chain runs on every
+ * request so credentials rotated on disk without an expiration (for example
+ * shared-config keys rewritten by a corporate SSO tool) are always re-read;
+ * the SDK's own memoization would otherwise pin them for the process lifetime.
+ */
+export const defaultChain = (options) => Effect.tryPromise({
+    try: async () => {
+        const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
+        const identity = await fromNodeProviderChain(options.profile === undefined ? {} : { profile: options.profile })();
+        return {
+            region: options.region,
+            accessKeyId: identity.accessKeyId,
+            secretAccessKey: identity.secretAccessKey,
+            ...(identity.sessionToken === undefined ? {} : { sessionToken: identity.sessionToken }),
+        };
+    },
+    catch: (error) => new AIError({
+        reason: new AuthenticationError({
+            message: `AWS default credential chain failed: ${ProviderShared.errorText(error)}`,
+            cause: error,
+        }),
+    }),
+});
+const signRequest = (input) => Effect.tryPromise({
+    try: async () => {
+        const signed = await new AwsV4Signer({
+            url: input.url,
+            method: "POST",
+            headers: Object.entries(input.headers),
+            body: input.body,
+            region: input.credentials.region,
+            accessKeyId: input.credentials.accessKeyId,
+            secretAccessKey: input.credentials.secretAccessKey,
+            sessionToken: input.credentials.sessionToken,
+            service: input.service,
+        }).sign();
+        return Object.fromEntries(signed.headers.entries());
+    },
+    catch: (error) => ProviderShared.invalidRequest(`${input.name} SigV4 signing failed: ${error instanceof Error ? error.message : String(error)}`),
+});
+/** Sign the exact JSON bytes with SigV4 using credentials configured on the route. */
+export const sigV4 = (source, options = {}) => Auth.custom((input) => {
+    return Effect.gen(function* () {
+        if (!source) {
+            return yield* ProviderShared.invalidRequest(`${options.name ?? "Bedrock Converse"} requires either route bearer auth or AWS credentials configured on the route`);
+        }
+        const credentials = Effect.isEffect(source) ? yield* source : source;
+        const headersForSigning = Headers.set(input.headers, "content-type", "application/json");
+        const signed = yield* signRequest({
+            url: input.url,
+            body: input.body,
+            headers: headersForSigning,
+            credentials,
+            service: options.service ?? "bedrock",
+            name: options.name ?? "Bedrock Converse",
+        });
+        return Headers.setAll(headersForSigning, signed);
+    });
+});
+/** Bedrock route auth defaults to SigV4 and expects credentials from route configuration. */
+export const auth = sigV4(undefined);
+export const resolveRegion = (input) => input.region ?? input.credentials?.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-1";
+/**
+ * Bearer wins over SigV4 and explicit static credentials win over the default
+ * chain, matching the AWS SDK's own precedence for `AWS_BEARER_TOKEN_BEDROCK`.
+ * The region is applied to the SigV4 scope so it always matches the endpoint host.
+ */
+export const resolveAuth = (input, region, options = {}) => {
+    const apiKey = options.mode === "sigv4" ? undefined : (input.apiKey ?? process.env.AWS_BEARER_TOKEN_BEDROCK);
+    if (apiKey !== undefined)
+        return Auth.bearer(apiKey);
+    if (input.credentials !== undefined)
+        return sigV4({ ...input.credentials, region }, options);
+    return sigV4(defaultChain({ region, profile: input.profile }), options);
+};
+export * as BedrockAuth from "./bedrock-auth.js";

package/dist/protocols/utils/bedrock-cache.d.ts

@@ -0,0 +1,19 @@
+import { Schema } from "effect";
+import type { CacheHint } from "../../schema/index.js";
+export declare const CachePointBlock: Schema.Struct<{
+    readonly cachePoint: Schema.Struct<{
+        readonly type: Schema.tag<"default">;
+        readonly ttl: Schema.optional<Schema.Literals<readonly ["5m", "1h"]>>;
+    }>;
+}>;
+export type CachePointBlock = Schema.Schema.Type<typeof CachePointBlock>;
+export declare const BEDROCK_BREAKPOINT_CAP = 4;
+export declare const breakpoints: (modelID: string) => {
+    supported: boolean;
+    ttl1h: boolean;
+    remaining: number;
+    dropped: number;
+};
+export type Breakpoints = ReturnType<typeof breakpoints>;
+export declare const block: (breakpoints: Breakpoints, cache: CacheHint | undefined) => CachePointBlock | undefined;
+export * as BedrockCache from "./bedrock-cache.js";

package/dist/protocols/utils/bedrock-cache.js

@@ -0,0 +1,49 @@
+import { Schema } from "effect";
+import { newBreakpoints, ttlBucket } from "./cache.js";
+// Bedrock cache markers are positional: emit a `cachePoint` block immediately
+// after the content the caller wants treated as a cacheable prefix. Bedrock
+// accepts optional `ttl: "5m" | "1h"` on cachePoint.
+export const CachePointBlock = Schema.Struct({
+    cachePoint: Schema.Struct({
+        type: Schema.tag("default"),
+        ttl: Schema.optional(Schema.Literals(["5m", "1h"])),
+    }),
+});
+const LEGACY_CLAUDE = ["anthropic.claude-instant", "anthropic.claude-v1", "anthropic.claude-v2", "anthropic.claude-3-"];
+// These legacy Claude releases support explicit caching, but only for five minutes.
+const CLAUDE_5M = [
+    "anthropic.claude-3-5-sonnet-20241022-v2:0",
+    "anthropic.claude-3-5-haiku-20241022-v1:0",
+    "anthropic.claude-3-7-sonnet-20250219-v1:0",
+    "anthropic.claude-sonnet-4-20250514-v1:0",
+    "anthropic.claude-opus-4-20250514-v1:0",
+    "anthropic.claude-opus-4-1-20250805-v1:0",
+];
+// Callers share the four-breakpoint budget across system, messages, and tools.
+export const BEDROCK_BREAKPOINT_CAP = 4;
+export const breakpoints = (modelID) => {
+    // Substring matching also handles regional prefixes and model-bearing ARNs.
+    const short = CLAUDE_5M.some((id) => modelID.includes(id));
+    return {
+        ...newBreakpoints(BEDROCK_BREAKPOINT_CAP),
+        // Assume modern Claude releases retain caching support; older generations need an explicit exception.
+        // Other model families use implicit caching where available.
+        supported: modelID.includes("anthropic.claude-") && (short || !LEGACY_CLAUDE.some((id) => modelID.includes(id))),
+        ttl1h: !short,
+    };
+};
+const DEFAULT_5M = { cachePoint: { type: "default" } };
+const DEFAULT_1H = { cachePoint: { type: "default", ttl: "1h" } };
+export const block = (breakpoints, cache) => {
+    if (!breakpoints.supported)
+        return undefined;
+    if (cache?.type !== "ephemeral" && cache?.type !== "persistent")
+        return undefined;
+    if (breakpoints.remaining <= 0) {
+        breakpoints.dropped += 1;
+        return undefined;
+    }
+    breakpoints.remaining -= 1;
+    return breakpoints.ttl1h && ttlBucket(cache.ttlSeconds) === "1h" ? DEFAULT_1H : DEFAULT_5M;
+};
+export * as BedrockCache from "./bedrock-cache.js";

package/dist/protocols/utils/bedrock-media.d.ts

@@ -0,0 +1,55 @@
+import { Effect, Schema } from "effect";
+export declare const ImageFormat: Schema.Literals<readonly ["png", "jpeg", "gif", "webp"]>;
+export type ImageFormat = Schema.Schema.Type<typeof ImageFormat>;
+export declare const ImageBlock: Schema.Struct<{
+    readonly image: Schema.Struct<{
+        readonly format: Schema.Literals<readonly ["png", "jpeg", "gif", "webp"]>;
+        readonly source: Schema.Struct<{
+            readonly bytes: Schema.String;
+        }>;
+    }>;
+}>;
+export type ImageBlock = Schema.Schema.Type<typeof ImageBlock>;
+export declare const DocumentFormat: Schema.Literals<readonly ["pdf", "csv", "doc", "docx", "xls", "xlsx", "html", "txt", "md"]>;
+export type DocumentFormat = Schema.Schema.Type<typeof DocumentFormat>;
+export declare const DocumentBlock: Schema.Struct<{
+    readonly document: Schema.Struct<{
+        readonly format: Schema.Literals<readonly ["pdf", "csv", "doc", "docx", "xls", "xlsx", "html", "txt", "md"]>;
+        readonly name: Schema.String;
+        readonly source: Schema.Struct<{
+            readonly bytes: Schema.String;
+        }>;
+    }>;
+}>;
+export type DocumentBlock = Schema.Schema.Type<typeof DocumentBlock>;
+export declare const lower: (part: {
+    readonly data: string | Uint8Array<ArrayBufferLike>;
+    readonly type: "media";
+    readonly mediaType: string;
+    readonly metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    readonly cache?: import("../../schema/options.js").CacheHint | undefined;
+    readonly providerMetadata?: {
+        readonly [x: string]: {
+            readonly [x: string]: unknown;
+        };
+    } | undefined;
+    readonly filename?: string | undefined;
+}) => Effect.Effect<{
+    readonly document: {
+        readonly format: "pdf" | "csv" | "doc" | "docx" | "xls" | "xlsx" | "html" | "txt" | "md";
+        readonly name: string;
+        readonly source: {
+            readonly bytes: string;
+        };
+    };
+} | {
+    image: {
+        format: "png" | "jpeg" | "gif" | "webp";
+        source: {
+            bytes: string;
+        };
+    };
+}, import("../../schema/errors.js").AIError, never>;
+export * as BedrockMedia from "./bedrock-media.js";

package/dist/protocols/utils/bedrock-media.js

@@ -0,0 +1,73 @@
+import { Effect, Encoding, Schema } from "effect";
+import { ProviderShared } from "../shared.js";
+// Bedrock Converse accepts image `format` as the file extension and
+// `source.bytes` as base64 in the JSON wire format.
+export const ImageFormat = Schema.Literals(["png", "jpeg", "gif", "webp"]);
+export const ImageBlock = Schema.Struct({
+    image: Schema.Struct({
+        format: ImageFormat,
+        source: Schema.Struct({ bytes: Schema.String }),
+    }),
+});
+// Bedrock document blocks require a user-facing name so the model can refer to
+// the uploaded document.
+export const DocumentFormat = Schema.Literals(["pdf", "csv", "doc", "docx", "xls", "xlsx", "html", "txt", "md"]);
+export const DocumentBlock = Schema.Struct({
+    document: Schema.Struct({
+        format: DocumentFormat,
+        name: Schema.String,
+        source: Schema.Struct({ bytes: Schema.String }),
+    }),
+});
+const IMAGE_FORMATS = {
+    "image/png": "png",
+    "image/jpeg": "jpeg",
+    "image/jpg": "jpeg",
+    "image/gif": "gif",
+    "image/webp": "webp",
+};
+const DOCUMENT_FORMATS = {
+    "application/pdf": "pdf",
+    "text/csv": "csv",
+    "application/msword": "doc",
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document": "docx",
+    "application/vnd.ms-excel": "xls",
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": "xlsx",
+    "text/html": "html",
+    "text/plain": "txt",
+    "text/markdown": "md",
+};
+const documentBlock = (name, format, bytes) => ({
+    document: {
+        format,
+        name,
+        source: { bytes },
+    },
+});
+const mediaBase64 = Effect.fn("BedrockMedia.mediaBase64")(function* (part) {
+    const media = ProviderShared.normalizeMedia(part);
+    const bytes = yield* Effect.fromResult(Encoding.decodeBase64(media.base64)).pipe(Effect.mapError((cause) => ProviderShared.invalidRequest("Bedrock Converse media data must be valid base64", cause)));
+    return Encoding.encodeBase64(bytes);
+});
+// Route by MIME. Known image/document formats lower into a typed block; anything
+// else fails with a clear error instead of silently degrading to a malformed
+// document block. Image MIME types not in `IMAGE_FORMATS` (e.g. `image/svg+xml`)
+// get an image-specific error so the caller knows it's a format-support issue,
+// not a kind-detection issue.
+export const lower = Effect.fn("BedrockMedia.lower")(function* (part) {
+    const mime = part.mediaType.toLowerCase();
+    const imageFormat = IMAGE_FORMATS[mime];
+    if (imageFormat) {
+        return { image: { format: imageFormat, source: { bytes: yield* mediaBase64(part) } } };
+    }
+    if (mime.startsWith("image/"))
+        return yield* ProviderShared.invalidRequest(`Bedrock Converse does not support image media type ${part.mediaType}`);
+    const documentFormat = DOCUMENT_FORMATS[mime];
+    if (documentFormat) {
+        if (!part.filename)
+            return yield* ProviderShared.invalidRequest("Bedrock Converse document media requires a filename");
+        return documentBlock(part.filename, documentFormat, yield* mediaBase64(part));
+    }
+    return yield* ProviderShared.invalidRequest(`Bedrock Converse does not support media type ${part.mediaType}`);
+});
+export * as BedrockMedia from "./bedrock-media.js";

package/dist/protocols/utils/cache.d.ts

@@ -0,0 +1,6 @@
+export interface Breakpoints {
+    remaining: number;
+    dropped: number;
+}
+export declare const newBreakpoints: (cap: number) => Breakpoints;
+export declare const ttlBucket: (ttlSeconds: number | undefined) => "1h" | undefined;

package/dist/protocols/utils/cache.js

@@ -0,0 +1,5 @@
+// Shared counter and TTL mapping for provider cache-marker lowering.
+export const newBreakpoints = (cap) => ({ remaining: cap, dropped: 0 });
+// Requests of at least one hour use the explicit `"1h"` bucket; shorter
+// requests omit the wire TTL and use the provider default.
+export const ttlBucket = (ttlSeconds) => ttlSeconds !== undefined && ttlSeconds >= 3600 ? "1h" : undefined;

package/dist/protocols/utils/gemini-tool-schema.d.ts

@@ -0,0 +1,2 @@
+export declare const convert: (schema: unknown) => Record<string, unknown> | undefined;
+export * as GeminiToolSchema from "./gemini-tool-schema.js";