@truefoundry/ai-gateway-sdk 0.0.0-stage → 0.0.2

package/dist/providers/aws-bedrock-mantle/responsesLite.js

@@ -0,0 +1,210 @@
+/**
+ * Normalizes Codex CLI requests for Bedrock Mantle's Responses API.
+ *
+ * Codex sends shapes api.openai.com accepts but Mantle's stricter validator rejects, usually
+ * with 400 "Invalid 'input': value did not match any expected variant". Two separate problems:
+ *
+ * 1. Tools. From 0.144 ("responses lite") Codex hides tool definitions inside `input` as
+ *    `{ type: 'additional_tools', tools: [...] }` rather than in the top-level `tools` param,
+ *    and from 0.147 nests them one level deeper inside a `functions` namespace
+ *    (openai/codex#37022). They are hoisted back into `tools`, that namespace is unwrapped,
+ *    and types the target surface rejects are filtered out. See `mergeTools`.
+ *
+ * 2. History items. Sub-agent and resumed sessions carry item types Mantle has no variant for
+ *    (`agent_message`, `context_compaction`, `local_shell_call`). Each is rewritten into the
+ *    nearest supported shape rather than dropped: dropping `agent_message` silently deletes a
+ *    sub-agent's task, which is why sub-agents replied NO_TASK. See `CODEX_ITEM_REWRITES`.
+ *
+ * Mantle serves Responses on two surfaces whose tool unions differ, chosen by the model's
+ * catalog path (`usesOpenAIResponsesPath`). `/openai` accepts tool namespaces; the plain one
+ * rejects them outright. Uncatalogued models resolve to plain, the stricter default.
+ */
+import { logger } from '../../logger.js';
+import { usesOpenAIResponsesPath } from './api.js';
+/** Stripped from `input`: the tools it carried have already been hoisted into `tools`. */
+const CODEX_LITE_INPUT_TYPES = new Set(['additional_tools']);
+/**
+ * Tool types both Mantle surfaces accept. Server-side built-ins have to be added as Bedrock
+ * ships them — `web_search` went GA in Aug 2026.
+ * https://docs.aws.amazon.com/bedrock/latest/userguide/web-search.html
+ */
+const STD_RESPONSES_TOOL_TYPES = new Set(['function', 'custom', 'web_search']);
+/**
+ * The namespace Codex puts its sub-agent tools in:
+ * `{ type: 'namespace', name: 'collaboration', tools: [spawn_agent, ...] }`. Dropping it makes
+ * Codex report `spawn_agent is unavailable in this session`.
+ */
+const SUB_AGENT_NAMESPACE = 'collaboration';
+/**
+ * `namespace` is forwarded only for `collaboration`, and only on `/openai`. The plain surface
+ * rejects the type outright (`openai.gpt-oss-*`: "unknown variant"), and other namespaces
+ * (`mcp__*`) have never been forwarded, so they keep being dropped rather than newly risking a
+ * 400 on a shape we have not verified.
+ */
+function isSupportedTool(tool, model) {
+    if (STD_RESPONSES_TOOL_TYPES.has(tool?.type))
+        return true;
+    return tool?.type === 'namespace' && tool?.name === SUB_AGENT_NAMESPACE && usesOpenAIResponsesPath(model);
+}
+/** Reserved upstream: forwarding it earns "namespace 'functions' collides with an existing tool namespace". */
+const DEFAULT_FUNCTION_NAMESPACE = 'functions';
+const LOCAL_SHELL_TOOL_NAME = 'local_shell';
+/** Unwraps the reserved "functions" namespace; its entries are valid top-level tools as-is. */
+function flattenFunctionsNamespace(tools) {
+    return tools.flatMap((tool) => tool?.type === 'namespace' && tool?.name === DEFAULT_FUNCTION_NAMESPACE && Array.isArray(tool.tools)
+        ? tool.tools
+        : [tool]);
+}
+function keepSupportedTools(tools, model) {
+    const kept = tools.filter((t) => isSupportedTool(t, model));
+    if (tools.length && !kept.length) {
+        logger.warn(`[aws-bedrock-mantle] Dropped all ${tools.length} codex tool(s) [${[
+            ...new Set(tools.map((t) => String(t?.type))),
+        ].join(', ')}]: none are valid top-level Responses tool types. The model will run without tools.`);
+    }
+    return kept;
+}
+/** Bedrock's Web Search defines only `type` and `external_web_access`; Codex adds a third field. */
+function stripUnsupportedWebSearchFields(tool) {
+    if (tool?.type !== 'web_search' || !('search_content_types' in tool)) {
+        return tool;
+    }
+    const { search_content_types: _dropped, ...rest } = tool;
+    return rest;
+}
+function normalizeTools(tools, model) {
+    return keepSupportedTools(flattenFunctionsNamespace(tools), model).map(stripUnsupportedWebSearchFields);
+}
+function modelOf(params) {
+    return String(params.model ?? '');
+}
+/** True if the request carries any `additional_tools` input item. */
+export function hasAdditionalTools(params) {
+    const input = params.input;
+    return Array.isArray(input) && input.some((it) => it?.type === 'additional_tools');
+}
+/** Hoistable tools pulled from additional_tools items (non-standard types filtered out). */
+export function extractAdditionalTools(params) {
+    const input = params.input;
+    if (!Array.isArray(input))
+        return [];
+    const tools = input
+        .filter((it) => it?.type === 'additional_tools' && Array.isArray(it.tools))
+        .flatMap((it) => it.tools);
+    return normalizeTools(tools, modelOf(params));
+}
+/**
+ * Joined into one string, not one part per source part: Codex splits a single sentence across
+ * parts (the header ends `Payload:\n`, the task follows), and the shape verified against
+ * Mantle rejoins them.
+ */
+function agentMessageText(content) {
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content))
+        return '';
+    return content
+        .map((part) => {
+        if (typeof part?.text === 'string')
+            return part.text;
+        return typeof part?.encrypted_content === 'string' ? part.encrypted_content : '';
+    })
+        .join('');
+}
+/**
+ * Rewritten rather than dropped: a sub-agent's task appears nowhere else in the request, so
+ * dropping it leaves the sub-agent idling with nothing to act on. Role `user` because the
+ * receiving agent reads it as incoming work.
+ *
+ * `encrypted_content` is a misnomer here — Codex fills it with the plaintext payload — so it
+ * is renamed to `input_text`. Mantle rejects the field inside a message under its own name.
+ */
+function rewriteAgentMessage(item) {
+    const text = agentMessageText(item?.content);
+    return text ? { type: 'message', role: 'user', content: [{ type: 'input_text', text }] } : null;
+}
+/** Mantle accepts the same ciphertext under `compaction`, the spelling its own endpoint returns. */
+function rewriteContextCompaction(item) {
+    const encryptedContent = item?.encrypted_content;
+    if (typeof encryptedContent !== 'string' || !encryptedContent)
+        return null;
+    return { type: 'compaction', encrypted_content: encryptedContent };
+}
+/**
+ * Codex pairs this with an ordinary `function_call_output` on the same call_id. Mantle knows
+ * the output item but not the call, so dropping it would orphan the output.
+ */
+function rewriteLocalShellCall(item) {
+    const callId = item?.call_id;
+    if (typeof callId !== 'string' || !callId)
+        return null;
+    return {
+        type: 'function_call',
+        call_id: callId,
+        name: LOCAL_SHELL_TOOL_NAME,
+        arguments: JSON.stringify(item?.action ?? {}),
+    };
+}
+/**
+ * Codex-only `input` item types Mantle rejects, mapped to shapes it accepts. A rewrite returns
+ * null when the item carries nothing worth forwarding, and it is dropped instead.
+ *
+ * `agent_message` appears in every multi-agent session; the other two only in resumed or
+ * migrated histories.
+ */
+const CODEX_ITEM_REWRITES = {
+    agent_message: rewriteAgentMessage,
+    context_compaction: rewriteContextCompaction,
+    local_shell_call: rewriteLocalShellCall,
+};
+function logInputChanges(rewritten, dropped) {
+    const types = (items) => [...new Set(items)].join(', ');
+    if (rewritten.length) {
+        logger.warn(`[aws-bedrock-mantle] Rewrote ${rewritten.length} codex-only input item(s) [${types(rewritten)}] into shapes Mantle's Responses validator accepts.`);
+    }
+    if (dropped.length) {
+        logger.warn(`[aws-bedrock-mantle] Dropped ${dropped.length} codex-only input item(s) [${types(dropped)}] that Mantle's Responses validator rejects.`);
+    }
+}
+/** `input` with codex-lite items stripped and codex-only history items rewritten. */
+export function normalizeCodexInput(params) {
+    const input = params.input;
+    if (!Array.isArray(input))
+        return input;
+    const rewritten = [];
+    const dropped = [];
+    const normalized = [];
+    for (const item of input) {
+        const itemType = item?.type;
+        if (CODEX_LITE_INPUT_TYPES.has(itemType)) {
+            dropped.push(itemType);
+            continue;
+        }
+        const rewrite = typeof itemType === 'string' ? CODEX_ITEM_REWRITES[itemType] : undefined;
+        if (!rewrite) {
+            normalized.push(item);
+            continue;
+        }
+        const result = rewrite(item);
+        if (result) {
+            normalized.push(result);
+            rewritten.push(itemType);
+        }
+        else {
+            dropped.push(itemType);
+        }
+    }
+    logInputChanges(rewritten, dropped);
+    return normalized;
+}
+/**
+ * Existing top-level tools + hoisted additional_tools (existing first). Both are normalized:
+ * Codex puts unsupported types in the top-level array too, so filtering only the hoisted list
+ * still 400s. The cost is that a non-Codex caller sending a type Mantle supports but
+ * STD_RESPONSES_TOOL_TYPES omits loses it silently.
+ */
+export function mergeTools(params) {
+    const existing = Array.isArray(params.tools) ? params.tools : [];
+    return [...normalizeTools(existing, modelOf(params)), ...extractAdditionalTools(params)];
+}
+//# sourceMappingURL=responsesLite.js.map

package/dist/providers/aws-bedrock-mantle/responsesLite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responsesLite.js","sourceRoot":"","sources":["../../../src/providers/aws-bedrock-mantle/responsesLite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,OAAO,CAAC;AAEhD,0FAA0F;AAC1F,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAE7D;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAE5C;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAS,EAAE,KAAa;IAC/C,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,IAAI,EAAE,IAAI,KAAK,WAAW,IAAI,IAAI,EAAE,IAAI,KAAK,mBAAmB,IAAI,uBAAuB,CAAC,KAAK,CAAC,CAAC;AAC5G,CAAC;AAED,+GAA+G;AAC/G,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAE/C,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAE5C,+FAA+F;AAC/F,SAAS,yBAAyB,CAAC,KAAY;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAS,EAAE,EAAE,CACjC,IAAI,EAAE,IAAI,KAAK,WAAW,IAAI,IAAI,EAAE,IAAI,KAAK,0BAA0B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAClG,CAAC,CAAC,IAAI,CAAC,KAAK;QACZ,CAAC,CAAC,CAAC,IAAI,CAAC,CACX,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAY,EAAE,KAAa;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CACT,oCAAoC,KAAK,CAAC,MAAM,mBAAmB;YACjE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;SACnD,CAAC,IAAI,CAAC,IAAI,CAAC,qFAAqF,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,SAAS,+BAA+B,CAAC,IAAS;IAChD,IAAI,IAAI,EAAE,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,sBAAsB,IAAI,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAY,EAAE,KAAa;IACjD,OAAO,kBAAkB,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,KAAK,GAAI,MAAc,CAAC,KAAK,CAAC;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,kBAAkB,CAAC,CAAC;AAC1F,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,MAAM,KAAK,GAAI,MAAc,CAAC,KAAK,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK;SAChB,MAAM,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,kBAAkB,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;SAC/E,OAAO,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAgB;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE;QACjB,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QACrD,OAAO,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,IAAS;IACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClG,CAAC;AAED,oGAAoG;AACpG,SAAS,wBAAwB,CAAC,IAAS;IACzC,MAAM,gBAAgB,GAAG,IAAI,EAAE,iBAAiB,CAAC;IACjD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAAS;IACtC,MAAM,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAA8C;IACrE,aAAa,EAAE,mBAAmB;IAClC,kBAAkB,EAAE,wBAAwB;IAC5C,gBAAgB,EAAE,qBAAqB;CACxC,CAAC;AAEF,SAAS,eAAe,CAAC,SAAmB,EAAE,OAAiB;IAC7D,MAAM,KAAK,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CACT,gCAAgC,SAAS,CAAC,MAAM,8BAA8B,KAAK,CAAC,SAAS,CAAC,qDAAqD,CACpJ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CACT,gCAAgC,OAAO,CAAC,MAAM,8BAA8B,KAAK,CAAC,OAAO,CAAC,8CAA8C,CACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,KAAK,GAAI,MAAc,CAAC,KAAK,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAU,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC;QAE5B,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,OAAO,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3F,CAAC"}

package/dist/providers/aws-claude-platform/api.d.ts

@@ -0,0 +1,3 @@
+import { ProviderAPIConfig } from '../types.js';
+declare const AWSClaudePlatformAPIConfig: ProviderAPIConfig;
+export default AWSClaudePlatformAPIConfig;

package/dist/providers/aws-claude-platform/api.js

@@ -0,0 +1,105 @@
+import { appendApnUserAgent, AWS_CLAUDE_PLATFORM } from '../../globals.js';
+import AnthropicAPIConfig, { resolveAnthropicBetaAndVersion } from '../anthropic/api.js';
+import { generateAWSHeaders, getCredentialsFromAssumedRole, getCredentialsFromRegion } from '../bedrock/utils.js';
+// SigV4 service name for Claude Platform on AWS (also the IAM namespace prefix).
+const AWS_CLAUDE_PLATFORM_SERVICE = 'aws-external-anthropic';
+// Anthropic endpoints reached via GET / DELETE (the rest are POST). SigV4 signs
+// the HTTP method, so the method derived here must match the method tryPost uses
+// for the actual request (which it also derives from `fn`).
+const GET_ENDPOINTS = ['listFiles', 'retrieveFile', 'retrieveFileContent'];
+const DELETE_ENDPOINTS = ['deleteFile'];
+const getRequestMethod = (fn) => {
+    if (GET_ENDPOINTS.includes(fn)) {
+        return 'GET';
+    }
+    if (DELETE_ENDPOINTS.includes(fn)) {
+        return 'DELETE';
+    }
+    return 'POST';
+};
+const getRegion = (account) => {
+    return account.region || 'us-east-1';
+};
+const AWSClaudePlatformAPIConfig = {
+    getBaseURL: ({ providerOptions }) => {
+        const account = providerOptions.providerAccount.manifest;
+        const baseUrl = account.base_url;
+        if (baseUrl) {
+            return baseUrl.replace(/\/$/, '');
+        }
+        const region = getRegion(account);
+        return `https://${AWS_CLAUDE_PLATFORM_SERVICE}.${region}.api.aws/v1`;
+    },
+    headers: async ({ session, endpoint, providerOptions, callConfig, headerOptions, request, transformedRequestBody, transformedRequestUrl, }) => {
+        const account = providerOptions.providerAccount.manifest;
+        const auth = account.auth_data;
+        const method = getRequestMethod(endpoint);
+        const hasRequestBody = method !== 'GET' && method !== 'DELETE';
+        const headers = {};
+        // Only body-carrying requests get a content-type (GET/DELETE send no body).
+        // file uploads send multipart/form-data
+        if (hasRequestBody) {
+            headers['content-type'] = request.headers['content-type'] ?? 'application/json';
+        }
+        // The workspace id header is required by Claude Platform on AWS.
+        // Example: https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#making-requests
+        if (account.workspace_id) {
+            headers['anthropic-workspace-id'] = account.workspace_id;
+        }
+        // Anthropic version + beta headers behave exactly like the direct Anthropic
+        // API, including the Files API beta header for file operations / file_id refs.
+        const body = request.body;
+        const { betaHeader, version } = resolveAnthropicBetaAndVersion({
+            endpoint,
+            providerOptions: {
+                anthropicBeta: headerOptions.anthropic?.anthropicBeta,
+                anthropicBetaOverride: headerOptions.anthropic?.anthropicBetaOverride,
+                anthropicBetaSuppressed: callConfig.anthropicBetaSuppressed,
+                anthropicVersion: headerOptions.anthropic?.anthropicVersion,
+            },
+            requestBody: body,
+        });
+        headers['anthropic-beta'] = betaHeader;
+        headers['anthropic-version'] = version;
+        // API key auth presents the key in the x-api-key header (identical to the
+        // first-party Claude API); no SigV4 signing is required. IAM authorizes the
+        // request through the aws-external-anthropic:CallWithBearerToken action.
+        if (auth?.type === 'api-key') {
+            if (auth.api_key) {
+                headers['X-API-Key'] = auth.api_key;
+            }
+            // API-key auth bypasses SigV4 signing, so add the APN user-agent here too.
+            appendApnUserAgent(headers);
+            return headers;
+        }
+        // Otherwise resolve AWS credentials and sign the request with SigV4.
+        const region = getRegion(account);
+        let accessKeyId = '';
+        let secretAccessKey = '';
+        let sessionToken;
+        if (auth?.type === 'assumed-role-based') {
+            const credentials = await getCredentialsFromAssumedRole(session, auth.assumed_role_arn || '', region, auth.external_id, AWS_CLAUDE_PLATFORM);
+            accessKeyId = credentials.accessKeyId;
+            secretAccessKey = credentials.secretAccessKey;
+            sessionToken = credentials.sessionToken;
+        }
+        else if (auth?.type === 'access-key-based') {
+            accessKeyId = auth.access_key_id || '';
+            secretAccessKey = auth.secret_access_key || '';
+        }
+        else {
+            // No explicit access key configured: fall back to the default AWS credential chain.
+            const credentials = await getCredentialsFromRegion(region);
+            accessKeyId = credentials.accessKeyId;
+            secretAccessKey = credentials.secretAccessKey;
+            sessionToken = credentials.sessionToken;
+        }
+        // Sign the same body that will actually be sent: none for GET/DELETE.
+        const bodyToSign = hasRequestBody ? transformedRequestBody : undefined;
+        return generateAWSHeaders(bodyToSign, headers, transformedRequestUrl || '', method, AWS_CLAUDE_PLATFORM_SERVICE, region, accessKeyId, secretAccessKey, sessionToken || '');
+    },
+    // Endpoints are identical to the direct Anthropic Messages API (/messages, etc.).
+    getEndpoint: AnthropicAPIConfig.getEndpoint,
+};
+export default AWSClaudePlatformAPIConfig;
+//# sourceMappingURL=api.js.map

package/dist/providers/aws-claude-platform/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/providers/aws-claude-platform/api.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,kBAAkB,EAAE,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAG/G,iFAAiF;AACjF,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAE7D,gFAAgF;AAChF,iFAAiF;AACjF,4DAA4D;AAC5D,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GAAG,CAAC,YAAY,CAAC,CAAC;AAExC,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAU,EAAE;IAC9C,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,OAAyC,EAAU,EAAE;IACtE,OAAO,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAsB;IACpD,UAAU,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,eAAe,CAAC,eAAe,CAAC,QAA4C,CAAC;QAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,WAAW,2BAA2B,IAAI,MAAM,aAAa,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EACd,OAAO,EACP,QAAQ,EACR,eAAe,EACf,UAAU,EACV,aAAa,EACb,OAAO,EACP,sBAAsB,EACtB,qBAAqB,GACtB,EAAE,EAAE;QACH,MAAM,OAAO,GAAG,eAAe,CAAC,eAAe,CAAC,QAA4C,CAAC;QAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,CAAC;QAE/D,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,4EAA4E;QAC5E,wCAAwC;QACxC,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC;QAClF,CAAC;QAED,iEAAiE;QACjE,wGAAwG;QACxG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;QAC3D,CAAC;QAED,4EAA4E;QAC5E,+EAA+E;QAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAA0B,CAAC;QAChD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,8BAA8B,CAAC;YAC7D,QAAQ;YACR,eAAe,EAAE;gBACf,aAAa,EAAE,aAAa,CAAC,SAAS,EAAE,aAAa;gBACrD,qBAAqB,EAAE,aAAa,CAAC,SAAS,EAAE,qBAAqB;gBACrE,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;gBAC3D,gBAAgB,EAAE,aAAa,CAAC,SAAS,EAAE,gBAAgB;aAC5D;YACD,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,CAAC,gBAAgB,CAAC,GAAG,UAAU,CAAC;QACvC,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC;QAEvC,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YACtC,CAAC;YACD,2EAA2E;YAC3E,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,qEAAqE;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,IAAI,YAAgC,CAAC;QAErC,IAAI,IAAI,EAAE,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,MAAM,6BAA6B,CACrD,OAAO,EACP,IAAI,CAAC,gBAAgB,IAAI,EAAE,EAC3B,MAAM,EACN,IAAI,CAAC,WAAW,EAChB,mBAAmB,CACpB,CAAC;YACF,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;YACtC,eAAe,GAAG,WAAW,CAAC,eAAe,CAAC;YAC9C,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;QAC1C,CAAC;aAAM,IAAI,IAAI,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC7C,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;YACvC,eAAe,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,oFAAoF;YACpF,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC3D,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;YACtC,eAAe,GAAG,WAAW,CAAC,eAAe,CAAC;YAC9C,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;QAC1C,CAAC;QAED,sEAAsE;QACtE,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvE,OAAO,kBAAkB,CACvB,UAAU,EACV,OAAO,EACP,qBAAqB,IAAI,EAAE,EAC3B,MAAM,EACN,2BAA2B,EAC3B,MAAM,EACN,WAAW,EACX,eAAe,EACf,YAAY,IAAI,EAAE,CACnB,CAAC;IACJ,CAAC;IACD,kFAAkF;IAClF,WAAW,EAAE,kBAAkB,CAAC,WAAW;CAC5C,CAAC;AAEF,eAAe,0BAA0B,CAAC"}

package/dist/providers/aws-claude-platform/index.d.ts

@@ -0,0 +1,3 @@
+import { ProviderConfigs } from '../types.js';
+declare const AWSClaudePlatformConfig: ProviderConfigs;
+export default AWSClaudePlatformConfig;

package/dist/providers/aws-claude-platform/index.js

@@ -0,0 +1,21 @@
+/**
+ * Claude Platform on AWS ("Anthropic on AWS").
+ *
+ * Identical to the direct Anthropic provider except for the API layer, which
+ * uses the regional AWS endpoint and AWS-based authentication.
+ */
+import AnthropicConfig from '../anthropic/index.js';
+import AWSClaudePlatformAPIConfig from './api.js';
+import { AWSClaudePlatformUploadFileRequestHandler } from './uploadFile.js';
+const AWSClaudePlatformConfig = {
+    ...AnthropicConfig,
+    api: AWSClaudePlatformAPIConfig,
+    // File uploads need the AWS endpoint + auth, so override the inherited
+    // anthropic upload handler with the AWS-bound one.
+    requestHandlers: {
+        ...AnthropicConfig.requestHandlers,
+        uploadFile: AWSClaudePlatformUploadFileRequestHandler,
+    },
+};
+export default AWSClaudePlatformConfig;
+//# sourceMappingURL=index.js.map

package/dist/providers/aws-claude-platform/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/providers/aws-claude-platform/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,eAAe,MAAM,cAAc,CAAC;AAE3C,OAAO,0BAA0B,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,yCAAyC,EAAE,MAAM,cAAc,CAAC;AAEzE,MAAM,uBAAuB,GAAoB;IAC/C,GAAG,eAAe;IAClB,GAAG,EAAE,0BAA0B;IAC/B,uEAAuE;IACvE,mDAAmD;IACnD,eAAe,EAAE;QACf,GAAG,eAAe,CAAC,eAAe;QAClC,UAAU,EAAE,yCAAyC;KACtD;CACF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/providers/aws-claude-platform/uploadFile.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Independent file upload handler for Claude Platform on AWS.
+ *
+ * The Files API wire format is identical to the direct Anthropic API, so
+ * response/error shaping are reused from the shared upload helpers.
+ * AWS SigV4 signs a hash of the payload, so for SigV4 auth the multipart body is
+ * buffered before signing; API-key auth needs no signing and keeps streaming.
+ */
+import type { AWSClaudePlatformProviderAccount } from '../../autogen/models.js';
+import type { RequestHandler } from '../types.js';
+/**
+ * AWS SigV4 signs a hash of the request body, so the exact bytes must be known
+ * before signing. Only an api-key account skips SigV4 in `headers()`; a header
+ * `x-tfy-aws-auth-type` does not, so it must not skip buffering either.
+ */
+export declare const requiresBodySigning: (account: AWSClaudePlatformProviderAccount) => boolean;
+/**
+ * Uploads a multipart file to the Claude Platform on AWS Files API.
+ */
+export declare const AWSClaudePlatformUploadFileRequestHandler: RequestHandler<ReadableStream>;
+export declare const AWSClaudePlatformUploadFileResponseTransform: (response: unknown) => unknown;

package/dist/providers/aws-claude-platform/uploadFile.js

@@ -0,0 +1,58 @@
+import { AWS_CLAUDE_PLATFORM } from '../../globals.js';
+import { safeFetch } from '../../http/index.js';
+import { buildUploadProviderErrorResponse, buildUploadSuccessResponse, buildUploadUnexpectedErrorResponse, buildUploadUrl, filePurposeFromHeaders, } from '../anthropic/uploadFileUtils.js';
+import { providerApiArgsFromHandler } from '../requestHandlerApiArgs.js';
+import AWSClaudePlatformAPIConfig from './api.js';
+/**
+ * AWS SigV4 signs a hash of the request body, so the exact bytes must be known
+ * before signing. Only an api-key account skips SigV4 in `headers()`; a header
+ * `x-tfy-aws-auth-type` does not, so it must not skip buffering either.
+ */
+export const requiresBodySigning = (account) => {
+    return account.auth_data?.type !== 'api-key';
+};
+/**
+ * Uploads a multipart file to the Claude Platform on AWS Files API.
+ */
+export const AWSClaudePlatformUploadFileRequestHandler = async (args) => {
+    const account = args.providerOptions.providerAccount.manifest;
+    const apiArgs = providerApiArgsFromHandler(args);
+    const url = await buildUploadUrl(apiArgs, AWSClaudePlatformAPIConfig);
+    const shouldSignBody = requiresBodySigning(account);
+    let body = args.request.body;
+    let bodyToSign = {};
+    if (shouldSignBody) {
+        const buffered = Buffer.from(await new Response(args.request.body).arrayBuffer());
+        body = buffered;
+        bodyToSign = buffered;
+    }
+    const headers = await AWSClaudePlatformAPIConfig.headers({
+        ...apiArgs,
+        transformedRequestBody: bodyToSign,
+        transformedRequestUrl: url,
+    });
+    const options = {
+        method: 'POST',
+        headers,
+        body,
+        signal: args.signal,
+    };
+    if (!shouldSignBody) {
+        options.duplex = 'half';
+    }
+    try {
+        const response = await safeFetch(url, { ssrf: 'guard', ...options });
+        if (!response.ok) {
+            return buildUploadProviderErrorResponse(response, AWS_CLAUDE_PLATFORM);
+        }
+        const anthropicResponse = (await response.json());
+        return buildUploadSuccessResponse(anthropicResponse, filePurposeFromHeaders(args.request.headers));
+    }
+    catch (error) {
+        return buildUploadUnexpectedErrorResponse(error, AWS_CLAUDE_PLATFORM);
+    }
+};
+export const AWSClaudePlatformUploadFileResponseTransform = (response) => {
+    return response;
+};
+//# sourceMappingURL=uploadFile.js.map

package/dist/providers/aws-claude-platform/uploadFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploadFile.js","sourceRoot":"","sources":["../../../src/providers/aws-claude-platform/uploadFile.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,kCAAkC,EAClC,cAAc,EACd,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,OAAO,0BAA0B,MAAM,OAAO,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAyC,EAAW,EAAE;IACxF,OAAO,OAAO,CAAC,SAAS,EAAE,IAAI,KAAK,SAAS,CAAC;AAC/C,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAmC,KAAK,EAAC,IAAI,EAAC,EAAE;IACpG,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,QAA4C,CAAC;IAClG,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEpD,IAAI,IAAI,GAA4B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IACtD,IAAI,UAAU,GAA4B,EAAE,CAAC;IAC7C,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClF,IAAI,GAAG,QAAQ,CAAC;QAChB,UAAU,GAAG,QAA8C,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC;QACvD,GAAG,OAAO;QACV,sBAAsB,EAAE,UAAU;QAClC,qBAAqB,EAAE,GAAG;KAC3B,CAAC,CAAC;IAEH,MAAM,OAAO,GAA4D;QACvE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,gCAAgC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,iBAAiB,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC3E,OAAO,0BAA0B,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,kCAAkC,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACxE,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,QAAiB,EAAE,EAAE;IAChF,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC"}

package/dist/providers/azure-ai-inference/api.d.ts

@@ -0,0 +1,4 @@
+import type { ProviderAPIConfig, ProviderApiBaseArgs } from '../types.js';
+export declare function resolveAzureFoundryUrl({ providerOptions, headerOptions, }: Pick<ProviderApiBaseArgs, 'providerOptions' | 'headerOptions'>): string | undefined;
+declare const AzureAIInferenceAPI: ProviderAPIConfig;
+export default AzureAIInferenceAPI;