@velum-labs/routekit-daemon 1.3.2 → 1.5.0

package/dist/internal-providers/provider-bedrock/connection.js

@@ -0,0 +1,143 @@
+import { fromNodeProviderChain, fromTemporaryCredentials } from "@aws-sdk/credential-providers";
+import { createHash } from "node:crypto";
+import { Effect } from "effect";
+import { z } from "zod";
+import { ProviderEnrollmentError, connectionString, preparedProviderConnection } from "@velum-labs/routekit-provider-core";
+import { isBedrockRoleTemplateUrl } from "./connection-settings.js";
+import { bedrockMasterCredentialsFromResources } from "./workload-credentials.js";
+const regionSchema = z.string().max(64).regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/);
+const roleSchema = z
+    .string()
+    .max(2048)
+    .regex(/^arn:aws:iam::\d{12}:role\/[A-Za-z0-9+=,.@_-](?:[A-Za-z0-9+=,.@_/-]*[A-Za-z0-9+=,.@_-])?$/);
+const customerRoleSchema = z
+    .string()
+    .max(2048)
+    .regex(/^arn:aws:iam::\d{12}:role\/routekit-cloud\/[A-Za-z0-9+=,.@_-](?:[A-Za-z0-9+=,.@_/-]*[A-Za-z0-9+=,.@_-])?$/);
+const enrollmentExternalIdSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/);
+const roleBindingSchema = z.object({
+    roleArn: roleSchema, externalId: z.string().min(32).max(1224), region: regionSchema
+}).strict();
+const setupStateSchema = z.object({
+    region: regionSchema,
+    externalId: enrollmentExternalIdSchema
+}).strict();
+function enrollmentStackName(enrollmentId) {
+    const readable = enrollmentId
+        .replaceAll(/[^A-Za-z0-9-]/gu, "-")
+        .replaceAll(/-+/gu, "-")
+        .replaceAll(/^-|-$/gu, "")
+        .slice(0, 80) || "connection";
+    const digest = createHash("sha256").update(enrollmentId).digest("hex").slice(0, 24);
+    return `RouteKit-${readable}-${digest}`;
+}
+function setupSettings(settings) {
+    const principal = roleSchema.parse(settings.rolePrincipalArn);
+    const templateUrl = z.string().max(2048).url().parse(settings.roleTemplateUrl);
+    if (!isBedrockRoleTemplateUrl(templateUrl)) {
+        throw new Error("The role template must be hosted in Amazon S3.");
+    }
+    const template = new URL(templateUrl);
+    return { principal, template };
+}
+export const bedrockRoleEnrollment = {
+    available: (settings) => {
+        try {
+            setupSettings(settings);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    start: (context, values) => Effect.try({
+        try: () => {
+            const region = regionSchema.parse(connectionString(values, "region"));
+            const externalId = enrollmentExternalIdSchema.parse(context.nonce);
+            const { principal, template } = setupSettings(context.settings);
+            const url = new URL(`https://${region}.console.aws.amazon.com/cloudformation/home`);
+            url.searchParams.set("region", region);
+            const parameters = new URLSearchParams({
+                templateURL: template.href,
+                stackName: enrollmentStackName(context.enrollmentId),
+                param_RouteKitPrincipalArn: principal,
+                param_ExternalId: externalId
+            });
+            url.hash = "/stacks/create/review?" + parameters.toString();
+            return {
+                kind: "action",
+                action: {
+                    kind: "external", stepId: "setup", title: "Create the AWS connection role",
+                    url: url.href, completion: "continue",
+                    instructions: "Create the stack in your AWS account. Then copy RoleArn from the stack Outputs and continue."
+                },
+                state: { version: 1, data: { region, externalId } }
+            };
+        },
+        catch: () => new ProviderEnrollmentError("setup_incomplete", "Choose a valid AWS region. The Cloud administrator must configure AWS role onboarding.")
+    }),
+    resume: (_context, state, event) => Effect.try({
+        try: () => {
+            if (state.version !== 1 || event.kind !== "submit")
+                throw new Error("Invalid enrollment event.");
+            const setup = setupStateSchema.parse(state.data);
+            if (event.stepId === "setup")
+                return {
+                    kind: "action",
+                    action: { kind: "form", stepId: "role", title: "Connect the created AWS role", fields: [
+                            { id: "role-arn", label: "Role ARN", control: "text", required: true, placeholder: "arn:aws:iam::123456789012:role/routekit-cloud/…" }
+                        ] },
+                    state
+                };
+            if (event.stepId !== "role")
+                throw new Error("Invalid enrollment step.");
+            const roleArn = customerRoleSchema.parse(connectionString(event.values, "role-arn"));
+            return {
+                kind: "complete",
+                connection: preparedProviderConnection({
+                    config: { use: "bedrock", auth: { kind: "aws-sdk" } }, environment: {},
+                    credential: { version: 1, kind: "assume-role", payload: { ...setup, roleArn } }
+                })
+            };
+        },
+        catch: () => new ProviderEnrollmentError("setup_incomplete", "Enter the RoleArn from the completed CloudFormation stack.")
+    })
+};
+const defaultCredentialDependencies = {
+    nodeProviderChain: fromNodeProviderChain,
+    temporaryCredentials: fromTemporaryCredentials
+};
+export function makeBedrockRoleCredentials(dependencies = defaultCredentialDependencies) {
+    return {
+        resolve: (binding, context) => Effect.try({
+            try: () => {
+                if (binding.version !== 1 || binding.kind !== "assume-role") {
+                    throw new Error("Unsupported AWS credential.");
+                }
+                const role = roleBindingSchema.parse(binding.payload);
+                const injected = bedrockMasterCredentialsFromResources(context.resources, context.sourceId);
+                // The host workload identity is ONLY the STS caller. Every customer
+                // client receives its explicitly selected assumed role, never the
+                // platform or Node default chain directly.
+                const credentials = dependencies.temporaryCredentials({
+                    masterCredentials: injected ?? dependencies.nodeProviderChain(),
+                    clientConfig: { region: role.region, maxAttempts: 2 },
+                    params: {
+                        RoleArn: role.roleArn,
+                        ExternalId: role.externalId,
+                        RoleSessionName: "routekit-cloud"
+                    }
+                });
+                return {
+                    environment: {
+                        AWS_REGION: role.region,
+                        AWS_DEFAULT_REGION: role.region
+                    },
+                    resources: { bedrockCredentials: credentials }
+                };
+            },
+            catch: () => new ProviderEnrollmentError("invalid_state", "The stored AWS role connection is invalid.")
+        })
+    };
+}
+export const bedrockRoleCredentials = makeBedrockRoleCredentials();

package/dist/internal-providers/provider-bedrock/index.d.ts

@@ -0,0 +1,27 @@
+import { BedrockProviderSource } from "./source.js";
+import { Effect } from "effect";
+export declare const bedrock: {
+    readonly id: "bedrock";
+    readonly protocol: "bedrock";
+    readonly accountClass: "api-key";
+    readonly billingMode: "metered-api";
+    readonly connection: Readonly<{
+        validate?: (context: Readonly<{
+            sourceId: string;
+            config: import("@velum-labs/routekit-config-core").SourceConfig;
+            env: Readonly<Record<string, string | undefined>>;
+            resources?: Readonly<Record<string, unknown>>;
+        }>) => Effect.Effect<void, Error, import("@velum-labs/routekit-runtime/effect").RouteKitPlatform>;
+        credentialValidation?: "registry-key-probe" | "registry-key-probe-if-configured-models";
+        manifest: import("@velum-labs/routekit-provider-core").ProviderConnectionManifest;
+        prepare?: (input: import("@velum-labs/routekit-provider-core").PrepareProviderConnectionInput) => import("@velum-labs/routekit-provider-core").PreparedProviderConnection;
+        enrollment?: Readonly<Record<string, import("@velum-labs/routekit-provider-core").ProviderEnrollmentAdapter>>;
+        credentials?: import("@velum-labs/routekit-provider-core").ProviderCredentialAdapter;
+        subscriptionMode?: import("@velum-labs/routekit-registry").SubscriptionMode;
+    }>;
+    readonly createSource: (context: import("@velum-labs/routekit-provider-core").ProviderModuleContext) => Effect.Effect<BedrockProviderSource, never, never>;
+};
+export type { BedrockControlClient, BedrockMantleBackend, BedrockProviderSourceOptions, BedrockRuntime } from "./source.js";
+export { BEDROCK_OPENAI_ALLOWLIST, BedrockProviderSource, fromBedrockConverseOutput, isBedrockOpenAiModel, sanitizeBedrockMantleRequestBody, toBedrockConverseInput } from "./source.js";
+export { BEDROCK_MASTER_CREDENTIALS_DISABLED, BEDROCK_MASTER_CREDENTIALS_RESOURCE, bedrockMasterCredentialsFromResources, type BedrockMasterCredentialsProvider } from "./workload-credentials.js";
+export { isBedrockRoleTemplateUrl } from "./connection-settings.js";

package/dist/internal-providers/provider-bedrock/index.js

@@ -0,0 +1,47 @@
+import { BedrockProviderSource } from "./source.js";
+import { connectionString, defineProviderConnection, defineProvider, optionalConnectionString, optionalProviderModuleResource, preparedProviderConnection } from "@velum-labs/routekit-provider-core";
+import { Effect } from "effect";
+import { bedrockRoleCredentials, bedrockRoleEnrollment } from "./connection.js";
+export const bedrock = defineProvider({
+    id: "bedrock",
+    protocol: "bedrock",
+    accountClass: "api-key",
+    billingMode: "metered-api",
+    connection: defineProviderConnection({
+        enrollment: { "assume-role": bedrockRoleEnrollment },
+        credentials: bedrockRoleCredentials,
+        manifest: {
+            version: 1, id: "bedrock", displayName: "Amazon Bedrock", category: "cloud",
+            description: "Connect an AWS role or access keys for Bedrock.",
+            methods: [{ id: "access-key", kind: "form", label: "AWS access keys", schemaRevision: 1, fields: [
+                        { id: "access-key-id", label: "Access key ID", control: "secret", required: true },
+                        { id: "secret-access-key", label: "Secret access key", control: "secret", required: true },
+                        { id: "session-token", label: "Session token", control: "secret", required: false, advanced: true },
+                        { id: "region", label: "AWS region", control: "text", required: true, placeholder: "us-east-1" }
+                    ] }, { id: "assume-role", kind: "flow", label: "Connect AWS account", schemaRevision: 1, fields: [
+                        { id: "region", label: "AWS region", control: "text", required: true, defaultValue: "us-east-1" }
+                    ] }]
+        },
+        prepare: ({ values }) => {
+            const region = connectionString(values, "region");
+            const sessionToken = optionalConnectionString(values, "session-token");
+            return preparedProviderConnection({
+                config: { use: "bedrock", auth: { kind: "aws-sdk" } },
+                environment: {
+                    AWS_ACCESS_KEY_ID: connectionString(values, "access-key-id"),
+                    AWS_SECRET_ACCESS_KEY: connectionString(values, "secret-access-key"),
+                    ...(sessionToken === undefined ? {} : { AWS_SESSION_TOKEN: sessionToken }),
+                    AWS_REGION: region,
+                    AWS_DEFAULT_REGION: region
+                }
+            });
+        }
+    }),
+    createSource: (context) => Effect.sync(() => new BedrockProviderSource({
+        sourceId: context.sourceId, env: context.env,
+        credentials: optionalProviderModuleResource(context, "bedrockCredentials", (value) => typeof value === "function")
+    }))
+});
+export { BEDROCK_OPENAI_ALLOWLIST, BedrockProviderSource, fromBedrockConverseOutput, isBedrockOpenAiModel, sanitizeBedrockMantleRequestBody, toBedrockConverseInput } from "./source.js";
+export { BEDROCK_MASTER_CREDENTIALS_DISABLED, BEDROCK_MASTER_CREDENTIALS_RESOURCE, bedrockMasterCredentialsFromResources } from "./workload-credentials.js";
+export { isBedrockRoleTemplateUrl } from "./connection-settings.js";

package/dist/internal-providers/provider-bedrock/source.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Amazon Bedrock provider source. Anthropic models use Bedrock Converse;
+ * allowlisted OpenAI frontier models use the regional bedrock-mantle
+ * OpenAI-compatible API.
+ */
+import { BedrockClient, type BedrockClientConfig } from "@aws-sdk/client-bedrock";
+import { BedrockRuntimeClient } from "@aws-sdk/client-bedrock-runtime";
+import { fromBedrockConverseOutput, toBedrockConverseInput } from "./codec.js";
+import { OpenAiBackend } from "@velum-labs/routekit-provider-core";
+import type { ProviderSource } from "@velum-labs/routekit-provider-core";
+export type BedrockControlClient = Pick<BedrockClient, "send">;
+export type BedrockRuntime = Pick<BedrockRuntimeClient, "send">;
+export type BedrockMantleBackend = Pick<OpenAiBackend, "chat" | "responses">;
+export type BedrockProviderSourceOptions = {
+    sourceId?: string;
+    controlClient?: BedrockControlClient;
+    runtimeClient?: BedrockRuntime;
+    env?: Readonly<Record<string, string | undefined>>;
+    mantleBackend?: BedrockMantleBackend;
+    credentials?: BedrockClientConfig["credentials"];
+};
+export { fromBedrockConverseOutput, toBedrockConverseInput };
+export declare const BEDROCK_OPENAI_ALLOWLIST: readonly ["openai.gpt-5.6-sol", "openai.gpt-5.6-terra", "openai.gpt-5.6-luna"];
+export declare function isBedrockOpenAiModel(modelId: string): boolean;
+/**
+ * Remove OpenAI/Codex protocol fields that bedrock-mantle rejects while
+ * leaving native OpenAI egress unchanged.
+ */
+export declare function sanitizeBedrockMantleRequestBody(body: unknown): unknown;
+export declare class BedrockProviderSource implements ProviderSource {
+    #private;
+    readonly sourceId: string;
+    readonly discovery: ProviderSource["discovery"];
+    readonly requests: ProviderSource["requests"];
+    readonly responses: ProviderSource["responses"];
+    readonly capabilities: ProviderSource["capabilities"];
+    readonly resource: ProviderSource["resource"];
+    constructor(options?: BedrockProviderSourceOptions);
+}