@wmaurer/effect-ai-amazon-bedrock 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @wmaurer/effect-ai-amazon-bedrock
 
+## 0.2.0
+
+`AmazonBedrockClient.layer`, `layerConfig`, and `make` take one of three ways to authenticate: the fixed keys of 0.1.0, a `credentialProvider`, or a Bedrock `apiKey`. Options that mix two ways, or give none, do not compile. Every 0.1.0 call compiles and runs unchanged.
+
+- Add the `credentialProvider` option. It takes a function in the shape of the AWS SDK's credential providers, such as `fromNodeProviderChain()` from `@aws-sdk/credential-providers`, or an `Effect`. The package does not depend on the AWS SDK. The client runs the provider when a request needs credentials, runs it once for concurrent requests, and keeps the credentials until five minutes before their `expiration`, or for at least 10 seconds.
+- Keep the last credentials while the provider fails and they have not expired. Ask the provider again after 30 seconds, or when the last credentials expire if that is sooner.
+- Refresh credentials that Bedrock rejects. After an `AuthenticationError` of kind `ExpiredKey`, `InvalidKey`, or `MissingKey`, the next request gets new credentials, and a function provider gets `{ forceRefresh: true }`. The rejected request fails and is not sent again.
+- Fail a request with an `AuthenticationError` of kind `Unknown` when the promise of a function provider rejects, and of kind `MissingKey` when a provider returns an empty key.
+- An `Effect` provider fails with an `AiError`, which the request fails with unchanged, or with an `AiError` reason, which the client puts in an `AiError`. The services that it requires become requirements of the layer through a new type parameter. It runs with the services of the request first, and the services that the layer was built with fill in the rest, so a span that it opens is a child of the request's span.
+- Add the `apiKey` option for Bedrock API keys. The client sends the key as `Authorization: Bearer <key>` in place of a SigV4 signature, and an `AiError` shows the header as `<redacted>`.
+- AWS rejects an API key that it does not accept with `AccessDeniedException`, as it rejects a missing IAM permission, so the request fails with an `AuthenticationError` of kind `InsufficientPermissions`.
+- Add the `Credentials`, `CredentialProvider`, and `ConfigOptions` types. `Options`, `ConfigOptions`, `CredentialProvider`, `make`, `layer`, and `layerConfig` take a type parameter `R` for the services of an `Effect` provider. It defaults to `never`.
+- A retry policy in `transformClient` or `AmazonBedrockConfig.withClientTransform` signs each attempt again with the credentials of the request, and does not retry a provider that fails.
+
 ## 0.1.0
 
 The first release. It adds an Amazon Bedrock provider for `effect/ai`. The provider calls the Converse and ConverseStream APIs, signs requests with SigV4 through `aws4fetch`, and decodes the AWS event-stream framing without another dependency. `AmazonBedrockClient.layer` and `AmazonBedrockClient.layerConfig` take an access key and a secret key, and the optional `sessionToken`, `region`, `apiUrl`, and `transformClient`. The region defaults to `us-east-1`. `AmazonBedrockLanguageModel.Config` takes the Converse request fields other than `messages` and `system`.

package/README.md

@@ -138,20 +138,88 @@ To run the program, do these steps:
 
 `AmazonBedrockClient` needs an `HttpClient`. The example above uses `FetchHttpClient.layer` from `effect/http`.
 
-The client takes explicit credentials. It does not read `~/.aws`, the AWS profile variables, or instance metadata. Give the credentials in one of two ways:
+The client authenticates each request in one of three ways:
 
-- `AmazonBedrockClient.layerConfig` reads each option from a `Config`, as in the example above.
-- `AmazonBedrockClient.layer` takes plain values. Pass `secretAccessKey` and `sessionToken` as `Redacted` values.
+- Fixed keys. `accessKeyId`, `secretAccessKey`, and an optional `sessionToken`. The client signs each request with SigV4.
+- A credential provider. `credentialProvider` is a function or an `Effect` that returns credentials. The client signs each request with SigV4 and asks the provider for new credentials before the old ones expire.
+- A Bedrock API key. `apiKey` is sent as `Authorization: Bearer <key>` in place of a SigV4 signature.
 
-`sessionToken` is optional, but `layerConfig` fails with a `ConfigError` if a `Config` that you give it finds no value. For that reason the example above gives `AWS_SESSION_TOKEN` an empty default with `Config.withDefault`. The client sends no session token when the token is empty, so the same program runs with temporary and long-lived keys.
+Give exactly one of them. Options that mix two ways, or give none, do not compile. `AmazonBedrockClient.layerConfig` reads each value from a `Config`. `AmazonBedrockClient.layer` takes plain values, with the secrets as `Redacted` values. The client reads no environment variable and no file by itself.
 
-The client reads the credentials once, when the layer is built, and uses them for every request. Where you get them depends on where the program runs:
+### Use fixed keys
 
-- On a machine where the AWS CLI signs in through a profile or IAM Identity Center, run `eval "$(aws configure export-credentials --format env)"` in the shell before you start the program. The command needs AWS CLI version 2. It prints the profile's access key ID, secret access key, and session token, if the profile has one, as `export` lines. Add `--profile <name>` to choose a profile.
-- AWS Lambda sets `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` for the function's execution role, so the example above runs without changes.
-- On Amazon ECS, Amazon EKS, and Amazon EC2, the role's credentials are not in the environment. Get them yourself, for example with `fromNodeProviderChain()` from `@aws-sdk/credential-providers`, and pass them to `AmazonBedrockClient.layer`.
+The example above reads fixed keys from the environment. `sessionToken` is optional, but `layerConfig` fails with a `ConfigError` if a `Config` that you give it finds no value. For that reason the example gives `AWS_SESSION_TOKEN` an empty default with `Config.withDefault`. The client sends no session token when the token is empty, so the same program runs with temporary and long-lived keys. AWS Lambda sets `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` for the function's execution role, so the example runs there without changes.
 
-The client does not refresh temporary credentials. When the session ends, every request fails with an `AuthenticationError` of kind `ExpiredKey`. Restart the program with new credentials.
+The client reads fixed keys once, when the layer is built. When temporary keys expire, every request fails with an `AuthenticationError` of kind `ExpiredKey`. A program that runs longer than its session needs a credential provider.
+
+### Use a credential provider
+
+A function in the shape of the AWS SDK's credential providers fits `credentialProvider` without an adapter. `fromNodeProviderChain()` from `@aws-sdk/credential-providers` looks for credentials where the AWS CLI does, in the environment, in the profiles and IAM Identity Center sessions of `~/.aws`, and in the container credentials of Amazon ECS and Amazon EKS and the instance metadata of Amazon EC2. This package does not depend on the AWS SDK, so install `@aws-sdk/credential-providers` yourself.
+
+```ts
+import { fromNodeProviderChain } from "@aws-sdk/credential-providers"
+import { AmazonBedrockClient } from "@wmaurer/effect-ai-amazon-bedrock"
+import { Layer } from "effect"
+import { FetchHttpClient } from "effect/http"
+
+const BedrockClient = AmazonBedrockClient.layer({
+  region: "eu-west-1",
+  credentialProvider: fromNodeProviderChain()
+}).pipe(Layer.provide(FetchHttpClient.layer))
+```
+
+The client runs the provider when a request needs credentials, and runs it once for requests that need them at the same time:
+
+- It keeps the credentials until five minutes before their `expiration`. It keeps credentials that expire in less than five minutes for 10 seconds, and credentials without an `expiration` until Bedrock rejects them.
+- If the provider fails while the last credentials have not expired, the client signs with the last credentials. It asks the provider again after 30 seconds, or when the last credentials expire if that is sooner.
+- If Bedrock rejects the credentials with an `AuthenticationError` of kind `ExpiredKey`, `InvalidKey`, or `MissingKey`, the request fails, and the next request gets new credentials. The client calls a function provider with `{ forceRefresh: true }` for them. Kind `InsufficientPermissions` keeps the credentials, because new credentials for the same role have the same IAM policy.
+- If the promise of a function provider rejects, the request fails with an `AuthenticationError` of kind `Unknown`. If the provider returns an empty access key ID or secret access key, the request fails with an `AuthenticationError` of kind `MissingKey`.
+
+An `Effect` provider can load credentials from a service of your own. The layer then requires that service:
+
+```ts
+import { AmazonBedrockClient } from "@wmaurer/effect-ai-amazon-bedrock"
+import { Context, Effect } from "effect"
+import type { AiError } from "effect/ai"
+
+class Vault extends Context.Service<Vault, {
+  readonly bedrockCredentials: Effect.Effect<AmazonBedrockClient.Credentials, AiError.AiError>
+}>()("Vault") {}
+
+// Layer<AmazonBedrockClient, never, HttpClient | Vault>
+export const BedrockClient = AmazonBedrockClient.layer({
+  region: "eu-west-1",
+  credentialProvider: Effect.gen(function*() {
+    const vault = yield* Vault
+    return yield* vault.bedrockCredentials
+  })
+})
+```
+
+The provider runs with the services of the request first, and the services that the layer was built with fill in the rest. A span that the provider opens is a child of the span of the request that runs the provider.
+
+The `Effect` can fail with an `AiError`, which the request fails with unchanged, or with an `AiError` reason such as an `AuthenticationError`, which the client puts in an `AiError`.
+
+A retry policy in `transformClient` does not retry a failed provider, because the client gets the credentials before it sends the request. Each retry of a request signs again with the credentials of the first attempt.
+
+### Use a Bedrock API key
+
+```ts
+import { AmazonBedrockClient } from "@wmaurer/effect-ai-amazon-bedrock"
+import { Config, Layer } from "effect"
+import { FetchHttpClient } from "effect/http"
+
+const BedrockClient = AmazonBedrockClient.layerConfig({
+  region: Config.String("AWS_REGION"),
+  apiKey: Config.Redacted("AWS_BEARER_TOKEN_BEDROCK")
+}).pipe(Layer.provide(FetchHttpClient.layer))
+```
+
+`AWS_BEARER_TOKEN_BEDROCK` is the variable that the AWS SDK for JavaScript reads the key from. The client reads it only through the `Config` that you give it. An `AiError` and an HTTP span that records headers show the `authorization` header as `<redacted>`.
+
+AWS rejects an API key that it does not accept, such as an expired or revoked key, with `AccessDeniedException`, as it rejects a request that the IAM policy does not allow. The request then fails with an `AuthenticationError` of kind `InsufficientPermissions`, and the client cannot tell the two causes apart.
+
+### Set the other options
 
 The other options are these:
 

package/dist/AmazonBedrockClient.d.ts

@@ -1,10 +1,27 @@
+/**
+ * The `AmazonBedrockClient` module defines the low-level Effect service used to
+ * call Amazon Bedrock's Converse API. It wraps an `HttpClient` with SigV4
+ * request signing (via `aws4fetch`), request defaults, response decoding, and
+ * error mapping to the unified `AiError` type.
+ *
+ * **Mental model**
+ *
+ * `HttpClient.HttpClient` provides the transport. {@link make} turns explicit
+ * {@link Options} into an {@link AmazonBedrockClient} service, while
+ * {@link layer} and {@link layerConfig} provide that service as a layer. The
+ * service exposes handwritten helpers for the `converse` (non-streaming) and
+ * `converse-stream` (streaming) endpoints.
+ *
+ * @stability unstable
+ * @since 0.1.0
+ */
 import type * as AiError from "effect/ai/AiError";
 import type * as Config from "effect/Config";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as HttpClient from "effect/http/HttpClient";
 import * as Layer from "effect/Layer";
-import * as Redacted from "effect/Redacted";
+import type * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 import type { ConverseRequest } from "./AmazonBedrockSchema.ts";
 import { ConverseResponse, ConverseResponseStreamEvent } from "./AmazonBedrockSchema.ts";
@@ -14,7 +31,7 @@ import { ConverseResponse, ConverseResponseStreamEvent } from "./AmazonBedrockSc
  *
  * @stability unstable
  * @category models
- * @since 4.0.0
+ * @since 0.1.0
  */
 export interface Service {
     /**
@@ -38,18 +55,59 @@ declare const AmazonBedrockClient_base: Context.ServiceClass<AmazonBedrockClient
  *
  * @stability unstable
  * @category services
- * @since 4.0.0
+ * @since 0.1.0
  */
 export declare class AmazonBedrockClient extends AmazonBedrockClient_base {
 }
 /**
- * Configuration for creating an Amazon Bedrock client.
+ * SigV4 credentials as a {@link CredentialProvider} returns them. The shape is
+ * the AWS SDK's `AwsCredentialIdentity`, so the SDK's providers fit without an
+ * adapter.
  *
  * @stability unstable
  * @category options
- * @since 4.0.0
+ * @since 0.2.0
  */
-export type Options = {
+export interface Credentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    /** An empty token is sent as no token. */
+    readonly sessionToken?: string | undefined;
+    /** The client asks the provider for new credentials five minutes before this time. */
+    readonly expiration?: Date | undefined;
+}
+/**
+ * Supplies SigV4 credentials that can change while the program runs.
+ *
+ * **Details**
+ *
+ * A provider is one of these:
+ *
+ * - A function in the shape of the AWS SDK's credential providers, such as
+ *   `fromNodeProviderChain()` from `@aws-sdk/credential-providers`. A rejected
+ *   promise fails the request with an `AuthenticationError` of kind
+ *   `"Unknown"`. After Bedrock rejects the credentials, the client calls the
+ *   function with `{ forceRefresh: true }`.
+ * - An `Effect`. It can fail with an `AiError`, which the request fails with
+ *   unchanged, or with an `AiError` reason, such as an `AuthenticationError`,
+ *   which the client wraps in an `AiError`. The services that it requires
+ *   become requirements of the layer. It runs with the services of the
+ *   request first, and the services that the layer was built with fill in the
+ *   rest.
+ *
+ * The client runs the provider at most once at a time, and keeps the
+ * credentials until five minutes before their `expiration`. Credentials with
+ * no `expiration` are kept until Bedrock rejects them. Keys that are empty fail
+ * the request with an `AuthenticationError` of kind `"MissingKey"`.
+ *
+ * @stability unstable
+ * @category options
+ * @since 0.2.0
+ */
+export type CredentialProvider<R = never> = ((options?: {
+    readonly forceRefresh?: boolean;
+}) => PromiseLike<Credentials>) | Effect.Effect<Credentials, AiError.AiError | AiError.AiErrorReason, R>;
+interface CommonOptions {
     /**
      * The base URL for the Bedrock runtime API. Override to use a proxy or a
      * different endpoint.
@@ -57,9 +115,6 @@ export type Options = {
      * @default `https://bedrock-runtime.${region}.amazonaws.com`
      */
     readonly apiUrl?: string | undefined;
-    readonly accessKeyId: string;
-    readonly secretAccessKey: Redacted.Redacted<string>;
-    readonly sessionToken?: Redacted.Redacted<string> | undefined;
     /**
      * The AWS region.
      *
@@ -67,38 +122,95 @@ export type Options = {
      */
     readonly region?: string | undefined;
     readonly transformClient?: ((client: HttpClient.HttpClient) => HttpClient.HttpClient) | undefined;
-};
+}
+interface StaticKeys {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: Redacted.Redacted<string>;
+    readonly sessionToken?: Redacted.Redacted<string> | undefined;
+    readonly credentialProvider?: never;
+    readonly apiKey?: never;
+}
+interface ProvidedKeys<R> {
+    readonly credentialProvider: CredentialProvider<R>;
+    readonly accessKeyId?: never;
+    readonly secretAccessKey?: never;
+    readonly sessionToken?: never;
+    readonly apiKey?: never;
+}
+interface ApiKey {
+    /** A Bedrock API key, sent as `Authorization: Bearer <key>` in place of a SigV4 signature. */
+    readonly apiKey: Redacted.Redacted<string>;
+    readonly accessKeyId?: never;
+    readonly secretAccessKey?: never;
+    readonly sessionToken?: never;
+    readonly credentialProvider?: never;
+}
+/**
+ * Configuration for creating an Amazon Bedrock client.
+ *
+ * **Details**
+ *
+ * The options take exactly one way to authenticate:
+ *
+ * - `accessKeyId` and `secretAccessKey`, and an optional `sessionToken`.
+ * - `credentialProvider`, a {@link CredentialProvider}.
+ * - `apiKey`, a Bedrock API key.
+ *
+ * @stability unstable
+ * @category options
+ * @since 0.1.0
+ */
+export type Options<R = never> = CommonOptions & (StaticKeys | ProvidedKeys<R> | ApiKey);
+/**
+ * The {@link Options} of {@link layerConfig}, with a `Config` for each value.
+ * `credentialProvider` and `transformClient` are not configuration, so they
+ * take the same values as in {@link Options}.
+ *
+ * @stability unstable
+ * @category options
+ * @since 0.2.0
+ */
+export type ConfigOptions<R = never> = {
+    readonly apiUrl?: Config.Config<string> | undefined;
+    readonly region?: Config.Config<string> | undefined;
+    readonly transformClient?: ((client: HttpClient.HttpClient) => HttpClient.HttpClient) | undefined;
+} & ({
+    readonly accessKeyId: Config.Config<string>;
+    readonly secretAccessKey: Config.Config<Redacted.Redacted<string>>;
+    readonly sessionToken?: Config.Config<Redacted.Redacted<string>> | undefined;
+    readonly credentialProvider?: never;
+    readonly apiKey?: never;
+} | ProvidedKeys<R> | {
+    readonly apiKey: Config.Config<Redacted.Redacted<string>>;
+    readonly accessKeyId?: never;
+    readonly secretAccessKey?: never;
+    readonly sessionToken?: never;
+    readonly credentialProvider?: never;
+});
 /**
  * Creates an Amazon Bedrock client service with the given options.
  *
  * @stability unstable
  * @category constructors
- * @since 4.0.0
+ * @since 0.1.0
  */
-export declare const make: (options: Options) => Effect.Effect<Service, never, HttpClient.HttpClient>;
+export declare const make: <R = never>(options: Options<R>) => Effect.Effect<Service, never, HttpClient.HttpClient | R>;
 /**
  * Creates a layer for the Amazon Bedrock client with the given options.
  *
  * @stability unstable
  * @category layers
- * @since 4.0.0
+ * @since 0.1.0
  */
-export declare const layer: (options: Options) => Layer.Layer<AmazonBedrockClient, never, HttpClient.HttpClient>;
+export declare const layer: <R = never>(options: Options<R>) => Layer.Layer<AmazonBedrockClient, never, HttpClient.HttpClient | R>;
 /**
  * Creates a layer for the Amazon Bedrock client, loading credentials and other
  * settings via Effect's `Config` module.
  *
  * @stability unstable
  * @category layers
- * @since 4.0.0
+ * @since 0.1.0
  */
-export declare const layerConfig: (options: {
-    readonly apiUrl?: Config.Config<string> | undefined;
-    readonly accessKeyId: Config.Config<string>;
-    readonly secretAccessKey: Config.Config<Redacted.Redacted<string>>;
-    readonly sessionToken?: Config.Config<Redacted.Redacted<string>> | undefined;
-    readonly region?: Config.Config<string> | undefined;
-    readonly transformClient?: ((client: HttpClient.HttpClient) => HttpClient.HttpClient) | undefined;
-}) => Layer.Layer<AmazonBedrockClient, Config.ConfigError, HttpClient.HttpClient>;
+export declare const layerConfig: <R = never>(options: ConfigOptions<R>) => Layer.Layer<AmazonBedrockClient, Config.ConfigError, HttpClient.HttpClient | R>;
 export {};
 //# sourceMappingURL=AmazonBedrockClient.d.ts.map

package/dist/AmazonBedrockClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AmazonBedrockClient.d.ts","sourceRoot":"","sources":["../src/AmazonBedrockClient.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,KAAK,OAAO,MAAM,mBAAmB,CAAA;AAEjD,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAIvC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAA;AAGpD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAOxF;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE;QAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,eAAe,CAAC,OAAO,CAAA;KACjD,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,eAAe,CAAC,OAAO,CAAA;KACjD,KAAK,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;CAClE;;AAMD;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,wBAExC;CAAG;AAMJ;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,CAAA;CAClG,CAAA;AAcD;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,4EAiFhB,CAAA;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,YAAa,OAAO,KAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CACpD,CAAA;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,YAAa;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,CAAA;CAClG,KAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,CAwB3E,CAAA"}
+{"version":3,"file":"AmazonBedrockClient.d.ts","sourceRoot":"","sources":["../src/AmazonBedrockClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,OAAO,MAAM,mBAAmB,CAAA;AAEjD,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAIvC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAA;AAGpD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAQxF;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE;QAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,eAAe,CAAC,OAAO,CAAA;KACjD,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,eAAe,CAAC,OAAO,CAAA;KACjD,KAAK,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;CAClE;;AAMD;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,wBAExC;CAAG;AAMJ;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,kBAAkB,CAAC,CAAC,GAAG,KAAK,IAGpC,CAAC,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC,GAC7E,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;AAE1E,UAAU,aAAa;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,CAAA;CAClG;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IAC7D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CACxB;AAED,UAAU,YAAY,CAAC,CAAC;IACtB,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CACxB;AAED,UAAU,MAAM;IACd,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAA;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;CACpC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,OAAO,CAAC,CAAC,GAAG,KAAK,IAAI,aAAa,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;AAExF;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,KAAK,IAC/B;IACA,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,CAAA;CAClG,GACC,CACE;IACA,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CACxB,GACC,YAAY,CAAC,CAAC,CAAC,GACf;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAA;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;CACpC,CACF,CAAA;AAcH;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC,CACxF,CAAA;AA8FrB;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,KAAK,WACpB,OAAO,CAAC,CAAC,CAAC,KAClB,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC,CAClB,CAAA;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,GAAG,KAAK,WAC1B,aAAa,CAAC,CAAC,CAAC,KACxB,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC,CAe9E,CAAA"}

package/dist/AmazonBedrockClient.js

@@ -1,21 +1,3 @@
-/**
- * The `AmazonBedrockClient` module defines the low-level Effect service used to
- * call Amazon Bedrock's Converse API. It wraps an `HttpClient` with SigV4
- * request signing (via `aws4fetch`), request defaults, response decoding, and
- * error mapping to the unified `AiError` type.
- *
- * **Mental model**
- *
- * `HttpClient.HttpClient` provides the transport. {@link make} turns explicit
- * {@link Options} into an {@link AmazonBedrockClient} service, while
- * {@link layer} and {@link layerConfig} provide that service as a layer. The
- * service exposes handwritten helpers for the `converse` (non-streaming) and
- * `converse-stream` (streaming) endpoints.
- *
- * @stability unstable
- * @since 4.0.0
- */
-import { AwsV4Signer } from "aws4fetch";
 import * as Array from "effect/Array";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
@@ -26,12 +8,11 @@ import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import * as Layer from "effect/Layer";
-import * as Predicate from "effect/Predicate";
-import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 import { AmazonBedrockConfig } from "./AmazonBedrockConfig.js";
 import * as EventStream from "./AmazonBedrockEventStream.js";
 import { ConverseResponse, ConverseResponseStreamEvent } from "./AmazonBedrockSchema.js";
+import * as Authentication from "./internal/credentials.js";
 import * as Errors from "./internal/errors.js";
 // =============================================================================
 // Service Identifier
@@ -41,7 +22,7 @@ import * as Errors from "./internal/errors.js";
  *
  * @stability unstable
  * @category services
- * @since 4.0.0
+ * @since 0.1.0
  */
 export class AmazonBedrockClient extends /*#__PURE__*/Context.Service()("@wmaurer/effect-ai-amazon-bedrock/AmazonBedrockClient") {}
 // =============================================================================
@@ -57,48 +38,35 @@ const withRedactedHeaders = /*#__PURE__*/Effect.updateService(Headers.CurrentRed
  *
  * @stability unstable
  * @category constructors
- * @since 4.0.0
+ * @since 0.1.0
  */
-export const make = /*#__PURE__*/Effect.fnUntraced(function* (options) {
+export const make = options => makeUnsafe(options);
+// Takes each authentication field as optional, as `layerConfig` reads them.
+// `Authentication.make` dies on a mix of the ways to authenticate.
+const makeUnsafe = options => Effect.gen(function* () {
   const region = options.region ?? "us-east-1";
+  const authenticator = yield* Authentication.make(options);
   const baseClient = yield* HttpClient.HttpClient;
-  const httpClient = baseClient.pipe(HttpClient.mapRequest(request => request.pipe(HttpClientRequest.prependUrl(options.apiUrl ?? `https://bedrock-runtime.${region}.amazonaws.com`), HttpClientRequest.acceptJson)), HttpClient.mapRequestEffect(Effect.fnUntraced(function* (request) {
-    const originalHeaders = request.headers;
-    const signer = new AwsV4Signer({
-      service: "bedrock",
-      url: request.url,
-      method: request.method,
-      headers: Object.entries(originalHeaders),
-      body: prepareBody(request.body),
-      region,
-      accessKeyId: options.accessKeyId,
-      secretAccessKey: Redacted.value(options.secretAccessKey),
-      ...(options.sessionToken ? {
-        sessionToken: Redacted.value(options.sessionToken)
-      } : {})
-    });
-    const {
-      headers: signedHeaders
-    } = yield* Effect.promise(() => signer.sign());
-    const headers = Headers.merge(originalHeaders, Headers.fromInput(signedHeaders));
-    return HttpClientRequest.setHeaders(request, headers);
-  })), options.transformClient ? options.transformClient : identity);
+  const httpClient = baseClient.pipe(HttpClient.mapRequest(request => request.pipe(HttpClientRequest.prependUrl(options.apiUrl ?? `https://bedrock-runtime.${region}.amazonaws.com`), HttpClientRequest.acceptJson)), HttpClient.mapRequestEffect(Authentication.authenticateRequest(region)), options.transformClient ? options.transformClient : identity);
   const httpClientOk = HttpClient.filterStatusOk(httpClient);
   const withConfigClient = Effect.fnUntraced(function* () {
     const config = yield* AmazonBedrockConfig.getOrUndefined;
     return config?.transformClient ? config.transformClient(httpClientOk) : httpClientOk;
   });
+  const resolveCredentials = method => Effect.mapError(authenticator.resolve, Errors.mapCredentialProviderError(method));
   const converse = ({
     payload: {
       modelId,
       ...body
     }
-  }) => Effect.flatMap(withConfigClient(), client => {
+  }) => Effect.gen(function* () {
+    const client = yield* withConfigClient();
+    const credentials = yield* resolveCredentials("converse");
     const request = HttpClientRequest.post(`/model/${modelId}/converse`, {
       body: HttpBody.jsonUnsafe(body)
     });
-    return client.execute(request).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(ConverseResponse)), Effect.catchTags({
-      HttpClientError: error => Errors.mapHttpClientError(error, "converse"),
+    return yield* client.execute(request).pipe(Effect.provideService(Authentication.CurrentRequestCredentials, credentials), Effect.flatMap(HttpClientResponse.schemaBodyJson(ConverseResponse)), Effect.catchTags({
+      HttpClientError: error => Errors.mapHttpClientError(error, "converse").pipe(Effect.tapError(Authentication.invalidateIfRejected(authenticator, credentials))),
       SchemaError: error => Effect.fail(Errors.mapSchemaError(error, "converse"))
     }), withRedactedHeaders);
   });
@@ -111,17 +79,21 @@ export const make = /*#__PURE__*/Effect.fnUntraced(function* (options) {
     const request = HttpClientRequest.post(`/model/${modelId}/converse-stream`, {
       body: HttpBody.jsonUnsafe(body)
     });
-    return Stream.unwrap(Effect.map(withConfigClient(), client => client.execute(request).pipe(Effect.map(response => response.stream), Stream.unwrap, Stream.pipeThroughChannel(EventStream.makeChannel(ConverseResponseStreamEvent)), Stream.catchTags({
-      HttpClientError: error => Stream.fromEffect(Errors.mapHttpClientError(error, "converseStream")),
-      SchemaError: error => Stream.fail(Errors.mapSchemaError(error, "converseStream")),
-      EventStreamError: error => Stream.fail(Errors.mapEventStreamError(error, "converseStream"))
-    }), Stream.updateService(Headers.CurrentRedactedNames, appendRedactedHeaders))));
+    return Stream.unwrap(Effect.gen(function* () {
+      const client = yield* withConfigClient();
+      const credentials = yield* resolveCredentials("converseStream");
+      return client.execute(request).pipe(Effect.provideService(Authentication.CurrentRequestCredentials, credentials), Effect.map(response => response.stream), Stream.unwrap, Stream.pipeThroughChannel(EventStream.makeChannel(ConverseResponseStreamEvent)), Stream.catchTags({
+        HttpClientError: error => Stream.fromEffect(Errors.mapHttpClientError(error, "converseStream").pipe(Effect.tapError(Authentication.invalidateIfRejected(authenticator, credentials)))),
+        SchemaError: error => Stream.fail(Errors.mapSchemaError(error, "converseStream")),
+        EventStreamError: error => Stream.fail(Errors.mapEventStreamError(error, "converseStream"))
+      }), Stream.updateService(Headers.CurrentRedactedNames, appendRedactedHeaders));
+    }));
   };
   return AmazonBedrockClient.of({
     converse,
     converseStream
   });
-}, withRedactedHeaders);
+}).pipe(withRedactedHeaders);
 // =============================================================================
 // Layers
 // =============================================================================
@@ -130,7 +102,7 @@ export const make = /*#__PURE__*/Effect.fnUntraced(function* (options) {
  *
  * @stability unstable
  * @category layers
- * @since 4.0.0
+ * @since 0.1.0
  */
 export const layer = options => Layer.effect(AmazonBedrockClient, make(options));
 /**
@@ -139,47 +111,19 @@ export const layer = options => Layer.effect(AmazonBedrockClient, make(options))
  *
  * @stability unstable
  * @category layers
- * @since 4.0.0
+ * @since 0.1.0
  */
 export const layerConfig = options => Layer.effect(AmazonBedrockClient, Effect.gen(function* () {
-  const apiUrl = Predicate.isNotUndefined(options.apiUrl) ? yield* options.apiUrl : undefined;
-  const accessKeyId = yield* options.accessKeyId;
-  const secretAccessKey = yield* options.secretAccessKey;
-  const sessionToken = Predicate.isNotUndefined(options.sessionToken) ? yield* options.sessionToken : undefined;
-  const region = Predicate.isNotUndefined(options.region) ? yield* options.region : undefined;
-  return yield* make({
-    apiUrl,
-    accessKeyId,
-    secretAccessKey,
-    sessionToken,
-    region,
+  return yield* makeUnsafe({
+    apiUrl: yield* readOptional(options.apiUrl),
+    region: yield* readOptional(options.region),
+    accessKeyId: yield* readOptional(options.accessKeyId),
+    secretAccessKey: yield* readOptional(options.secretAccessKey),
+    sessionToken: yield* readOptional(options.sessionToken),
+    apiKey: yield* readOptional(options.apiKey),
+    credentialProvider: options.credentialProvider,
     transformClient: options.transformClient
   });
 }));
-// =============================================================================
-// Utilities
-// =============================================================================
-const prepareBody = body => {
-  switch (body._tag) {
-    case "Empty":
-      {
-        return "";
-      }
-    case "Raw":
-    case "Uint8Array":
-      {
-        if (typeof body.body === "string") {
-          return body.body;
-        }
-        if (body.body instanceof Uint8Array) {
-          return new TextDecoder().decode(body.body);
-        }
-        if (body.body instanceof ArrayBuffer) {
-          return new TextDecoder().decode(body.body);
-        }
-        return JSON.stringify(body.body);
-      }
-  }
-  throw new Error("Unsupported HttpBody: " + body._tag);
-};
+const readOptional = config => config === undefined ? Effect.undefined : config;
 //# sourceMappingURL=AmazonBedrockClient.js.map

package/dist/AmazonBedrockClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"AmazonBedrockClient.js","names":[],"sources":["../src/AmazonBedrockClient.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;AAiBA,SAAS,WAAW,QAAQ,WAAW;AAEvC,OAAO,KAAK,KAAK,MAAM,cAAc;AAErC,OAAO,KAAK,OAAO,MAAM,gBAAgB;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe;AACvC,SAAS,QAAQ,QAAQ,iBAAiB;AAC1C,OAAO,KAAK,OAAO,MAAM,qBAAqB;AAC9C,OAAO,KAAK,QAAQ,MAAM,sBAAsB;AAChD,OAAO,KAAK,UAAU,MAAM,wBAAwB;AACpD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B;AAClE,OAAO,KAAK,kBAAkB,MAAM,gCAAgC;AACpE,OAAO,KAAK,KAAK,MAAM,cAAc;AACrC,OAAO,KAAK,SAAS,MAAM,kBAAkB;AAC7C,OAAO,KAAK,QAAQ,MAAM,iBAAiB;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe;AACvC,SAAS,mBAAmB,QAAQ,0BAA0B;AAC9D,OAAO,KAAK,WAAW,MAAM,+BAA+B;AAE5D,SAAS,gBAAgB,EAAE,2BAA2B,QAAQ,0BAA0B;AACxF,OAAO,KAAK,MAAM,MAAM,sBAAsB;AAgC9C;AACA;AACA;AAEA;;;;;;;AAOA,OAAM,MAAO,mBAAoB,sBAAQ,OAAO,CAAC,OAAO,EAAgC,CACtF,uDAAuD,CACxD;AAiCD;AACA;AACA;AAEA,MAAM,4BAA4B,GAAG;EACnC,gBAAgB,EAAE;CACnB;AAED,MAAM,qBAAqB,gBAAG,KAAK,CAAC,SAAS,cAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE1F,MAAM,mBAAmB,gBAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;AAErG;;;;;;;AAOA,OAAO,MAAM,IAAI,gBAAG,MAAM,CAAC,UAAU,CACnC,WAAU,OAAgB;EACxB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW;EAE5C,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,UAAU;EAE/C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,UAAU,CAAC,UAAU,CAAE,OAAO,IAC5B,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,IAAI,2BAA2B,MAAM,gBAAgB,CAAC,EACjG,iBAAiB,CAAC,UAAU,CAC7B,CACF,EACD,UAAU,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,WAAU,OAAO;IAC7D,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO;IACvC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;MAC7B,OAAO,EAAE,SAAS;MAClB,GAAG,EAAE,OAAO,CAAC,GAAG;MAChB,MAAM,EAAE,OAAO,CAAC,MAAM;MACtB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;MACxC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;MAC/B,MAAM;MACN,WAAW,EAAE,OAAO,CAAC,WAAW;MAChC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;MACxD,IAAI,OAAO,CAAC,YAAY,GAAG;QAAE,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY;MAAC,CAAE,GAAG,EAAE;KACvF,CAAC;IACF,MAAM;MAAE,OAAO,EAAE;IAAa,CAAE,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAChF,OAAO,iBAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;EACvD,CAAC,CAAC,CAAC,EACH,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,GAAG,QAAQ,CAC7D;EAED,MAAM,YAAY,GAAG,UAAU,CAAC,cAAc,CAAC,UAAU,CAAC;EAE1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,aAAS;IAClD,MAAM,MAAM,GAAG,OAAO,mBAAmB,CAAC,cAAc;IACxD,OAAO,MAAM,EAAE,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,YAAY;EACtF,CAAC,CAAC;EAEF,MAAM,QAAQ,GAAwB,CAAC;IAAE,OAAO,EAAE;MAAE,OAAO;MAAE,GAAG;IAAI;EAAE,CAAE,KACtE,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAG,MAAM,IAAI;IAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,OAAO,WAAW,EAAE;MACnE,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;KAC/B,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,EACnE,MAAM,CAAC,SAAS,CAAC;MACf,eAAe,EAAG,KAAK,IAAK,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC;MACxE,WAAW,EAAG,KAAK,IAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;KAC7E,CAAC,EACF,mBAAmB,CACpB;EACH,CAAC,CAAC;EAEJ,MAAM,cAAc,GAA8B,CAAC;IAAE,OAAO,EAAE;MAAE,OAAO;MAAE,GAAG;IAAI;EAAE,CAAE,KAAI;IACtF,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,OAAO,kBAAkB,EAAE;MAC1E,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;KAC/B,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAG,MAAM,IACpC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,GAAG,CAAE,QAAQ,IAAK,QAAQ,CAAC,MAAM,CAAC,EACzC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC,EAC/E,MAAM,CAAC,SAAS,CAAC;MACf,eAAe,EAAG,KAAK,IAAK,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;MACjG,WAAW,EAAG,KAAK,IAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;MACnF,gBAAgB,EAAG,KAAK,IAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC;KAC7F,CAAC,EACF,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAC1E,CAAC,CACL;EACH,CAAC;EAED,OAAO,mBAAmB,CAAC,EAAE,CAAC;IAC5B,QAAQ;IACR;GACD,CAAC;AACJ,CAAC,EACD,mBAAmB,CACpB;AAED;AACA;AACA;AAEA;;;;;;;AAOA,OAAO,MAAM,KAAK,GAAI,OAAgB,IACpC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AAElD;;;;;;;;AAQA,OAAO,MAAM,WAAW,GAAI,OAO3B,IACC,KAAK,CAAC,MAAM,CACV,mBAAmB,EACnB,MAAM,CAAC,GAAG,CAAC,aAAS;EAClB,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,GACnD,OAAO,OAAO,CAAC,MAAM,GACvB,SAAS;EACX,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,WAAW;EAC9C,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,eAAe;EACtD,MAAM,YAAY,GAAG,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC,GAC/D,OAAO,OAAO,CAAC,YAAY,GAC7B,SAAS;EACX,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,GACnD,OAAO,OAAO,CAAC,MAAM,GACvB,SAAS;EACX,OAAO,OAAO,IAAI,CAAC;IACjB,MAAM;IACN,WAAW;IACX,eAAe;IACf,YAAY;IACZ,MAAM;IACN,eAAe,EAAE,OAAO,CAAC;GAC1B,CAAC;AACJ,CAAC,CAAC,CACH;AAEH;AACA;AACA;AAEA,MAAM,WAAW,GAAI,IAAuB,IAAY;EACtD,QAAQ,IAAI,CAAC,IAAI;IACf,KAAK,OAAO;MAAE;QACZ,OAAO,EAAE;MACX;IACA,KAAK,KAAK;IACV,KAAK,YAAY;MAAE;QACjB,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE;UACjC,OAAO,IAAI,CAAC,IAAI;QAClB;QACA,IAAI,IAAI,CAAC,IAAI,YAAY,UAAU,EAAE;UACnC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5C;QACA,IAAI,IAAI,CAAC,IAAI,YAAY,WAAW,EAAE;UACpC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5C;QACA,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;MAClC;EACF;EACA,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC;AACvD,CAAC","ignoreList":[]}
+{"version":3,"file":"AmazonBedrockClient.js","names":[],"sources":["../src/AmazonBedrockClient.ts"],"sourcesContent":[null],"mappings":"AAkBA,OAAO,KAAK,KAAK,MAAM,cAAc;AAErC,OAAO,KAAK,OAAO,MAAM,gBAAgB;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe;AACvC,SAAS,QAAQ,QAAQ,iBAAiB;AAC1C,OAAO,KAAK,OAAO,MAAM,qBAAqB;AAC9C,OAAO,KAAK,QAAQ,MAAM,sBAAsB;AAChD,OAAO,KAAK,UAAU,MAAM,wBAAwB;AACpD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B;AAClE,OAAO,KAAK,kBAAkB,MAAM,gCAAgC;AACpE,OAAO,KAAK,KAAK,MAAM,cAAc;AAErC,OAAO,KAAK,MAAM,MAAM,eAAe;AACvC,SAAS,mBAAmB,QAAQ,0BAA0B;AAC9D,OAAO,KAAK,WAAW,MAAM,+BAA+B;AAE5D,SAAS,gBAAgB,EAAE,2BAA2B,QAAQ,0BAA0B;AACxF,OAAO,KAAK,cAAc,MAAM,2BAA2B;AAC3D,OAAO,KAAK,MAAM,MAAM,sBAAsB;AAgC9C;AACA;AACA;AAEA;;;;;;;AAOA,OAAM,MAAO,mBAAoB,sBAAQ,OAAO,CAAC,OAAO,EAAgC,CACtF,uDAAuD,CACxD;AAsJD;AACA;AACA;AAEA,MAAM,4BAA4B,GAAG;EACnC,gBAAgB,EAAE;CACnB;AAED,MAAM,qBAAqB,gBAAG,KAAK,CAAC,SAAS,cAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE1F,MAAM,mBAAmB,gBAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;AAErG;;;;;;;AAOA,OAAO,MAAM,IAAI,GAAe,OAAmB,IACjD,UAAU,CAAC,OAAO,CAAC;AAErB;AACA;AACA,MAAM,UAAU,GACd,OAAgE,IAEhE,MAAM,CAAC,GAAG,CAAC,aAAS;EAClB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW;EAC5C,MAAM,aAAa,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;EAEzD,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,UAAU;EAE/C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,UAAU,CAAC,UAAU,CAAE,OAAO,IAC5B,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,IAAI,2BAA2B,MAAM,gBAAgB,CAAC,EACjG,iBAAiB,CAAC,UAAU,CAC7B,CACF,EACD,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,EACvE,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,GAAG,QAAQ,CAC7D;EAED,MAAM,YAAY,GAAG,UAAU,CAAC,cAAc,CAAC,UAAU,CAAC;EAE1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,aAAS;IAClD,MAAM,MAAM,GAAG,OAAO,mBAAmB,CAAC,cAAc;IACxD,OAAO,MAAM,EAAE,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,YAAY;EACtF,CAAC,CAAC;EAEF,MAAM,kBAAkB,GAAI,MAAc,IACxC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;EAEnF,MAAM,QAAQ,GAAwB,CAAC;IAAE,OAAO,EAAE;MAAE,OAAO;MAAE,GAAG;IAAI;EAAE,CAAE,KACtE,MAAM,CAAC,GAAG,CAAC,aAAS;IAClB,MAAM,MAAM,GAAG,OAAO,gBAAgB,EAAE;IACxC,MAAM,WAAW,GAAG,OAAO,kBAAkB,CAAC,UAAU,CAAC;IACzD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,OAAO,WAAW,EAAE;MACnE,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;KAC/B,CAAC;IACF,OAAO,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,yBAAyB,EAAE,WAAW,CAAC,EAC5E,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,EACnE,MAAM,CAAC,SAAS,CAAC;MACf,eAAe,EAAG,KAAK,IACrB,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CACjF;MACH,WAAW,EAAG,KAAK,IAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;KAC7E,CAAC,EACF,mBAAmB,CACpB;EACH,CAAC,CAAC;EAEJ,MAAM,cAAc,GAA8B,CAAC;IAAE,OAAO,EAAE;MAAE,OAAO;MAAE,GAAG;IAAI;EAAE,CAAE,KAAI;IACtF,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,OAAO,kBAAkB,EAAE;MAC1E,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;KAC/B,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,GAAG,CAAC,aAAS;MAClB,MAAM,MAAM,GAAG,OAAO,gBAAgB,EAAE;MACxC,MAAM,WAAW,GAAG,OAAO,kBAAkB,CAAC,gBAAgB,CAAC;MAC/D,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,yBAAyB,EAAE,WAAW,CAAC,EAC5E,MAAM,CAAC,GAAG,CAAE,QAAQ,IAAK,QAAQ,CAAC,MAAM,CAAC,EACzC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC,EAC/E,MAAM,CAAC,SAAS,CAAC;QACf,eAAe,EAAG,KAAK,IACrB,MAAM,CAAC,UAAU,CACf,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CACjF,CACF;QACH,WAAW,EAAG,KAAK,IAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACnF,gBAAgB,EAAG,KAAK,IAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC;OAC7F,CAAC,EACF,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAC1E;IACH,CAAC,CAAC,CACH;EACH,CAAC;EAED,OAAO,mBAAmB,CAAC,EAAE,CAAC;IAC5B,QAAQ;IACR;GACD,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;AAE9B;AACA;AACA;AAEA;;;;;;;AAOA,OAAO,MAAM,KAAK,GAChB,OAAmB,IAEnB,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AAElD;;;;;;;;AAQA,OAAO,MAAM,WAAW,GACtB,OAAyB,IAEzB,KAAK,CAAC,MAAM,CACV,mBAAmB,EACnB,MAAM,CAAC,GAAG,CAAC,aAAS;EAClB,OAAO,OAAO,UAAU,CAAC;IACvB,MAAM,EAAE,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC;IACrD,eAAe,EAAE,OAAO,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC;IAC7D,YAAY,EAAE,OAAO,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC;IACvD,MAAM,EAAE,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IAC3C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;IAC9C,eAAe,EAAE,OAAO,CAAC;GAC1B,CAAC;AACJ,CAAC,CAAC,CACH;AAEH,MAAM,YAAY,GAAO,MAAoC,IAC3D,MAAM,KAAK,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM","ignoreList":[]}