@wmaurer/effect-ai-amazon-bedrock 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @wmaurer/effect-ai-amazon-bedrock
 
+## 0.3.0
+
+`generateObject` asks models outside Anthropic for the object through a tool. In 0.2.0 it sent them `outputConfig.textFormat`, which Nova, Mistral Large 2402, Pixtral Large, Llama, and Palmyra answered with a 400 in probes in `eu-west-1` and `us-east-1`, so `generateObject` on these models failed unless you set `structuredOutputs: false`.
+
+- Choose how `generateObject` asks for the object from the provider that the model ID names. Claude models keep the 0.2.0 behavior. Meta and Writer models get the object tool unforced, with a system prompt line that tells the model to call it, because Llama and Palmyra reject a forced `toolChoice`. Models of every other provider get the forced object tool. An ARN that does not name its model, such as an application inference profile, keeps the 0.2.0 behavior. `Config.structuredOutputs` and `Config.forcedToolChoice` still override the choice.
+- Models of other providers that accepted `outputConfig.textFormat` in the probes, such as gpt-5.x, Grok, Qwen, GLM, MiniMax, DeepSeek V3.2, and Mistral Large 3, also get the object tool now. The object tool replaces the tools that you pass to `generateObject`, and in 0.2.0 these models kept them. Set `structuredOutputs: true` to keep the 0.2.0 behavior.
+- Force the object tool with `toolChoice` `{ any: {} }` in place of `{ tool: { name } }`. The object tool is the only tool in its request, so both force it, and Mistral Large 2402 and Pixtral Large accept only `any`. A `toolChoice` that you pass with your own tools goes to Bedrock as before.
+- Fail `streamText` with an `AiError` whose reason is `InvalidOutputError` when Bedrock streams tool input that is not valid JSON. In 0.2.0 the stream died with a defect. Bedrock streamed such input for Qwen3 32B in each probe run.
+- Decode a stop reason outside the nine that the Converse API names, and give it the finish reason `"other"`. In 0.2.0 such a reason failed `generateText` and `streamText` with an `InvalidOutputError`, and the text before it was lost. The `StopReason` type now admits any string, so a `switch` over it that was exhaustive needs a `default` case, and a `Record` keyed by it no longer compiles. The new `KnownStopReason` schema holds the nine.
+
+## 0.2.0
+
+`AmazonBedrockClient.layer`, `layerConfig`, and `make` take one of three ways to authenticate: the fixed keys of 0.1.0, a `credentialProvider`, or a Bedrock `apiKey`. Options that mix two ways, or give none, do not compile. Every 0.1.0 call compiles and runs unchanged.
+
+- Add the `credentialProvider` option. It takes a function in the shape of the AWS SDK's credential providers, such as `fromNodeProviderChain()` from `@aws-sdk/credential-providers`, or an `Effect`. The package does not depend on the AWS SDK. The client runs the provider when a request needs credentials, runs it once for concurrent requests, and keeps the credentials until five minutes before their `expiration`, or for at least 10 seconds.
+- Keep the last credentials while the provider fails and they have not expired. Ask the provider again after 30 seconds, or when the last credentials expire if that is sooner.
+- Refresh credentials that Bedrock rejects. After an `AuthenticationError` of kind `ExpiredKey`, `InvalidKey`, or `MissingKey`, the next request gets new credentials, and a function provider gets `{ forceRefresh: true }`. The rejected request fails and is not sent again.
+- Fail a request with an `AuthenticationError` of kind `Unknown` when the promise of a function provider rejects, and of kind `MissingKey` when a provider returns an empty key.
+- An `Effect` provider fails with an `AiError`, which the request fails with unchanged, or with an `AiError` reason, which the client puts in an `AiError`. The services that it requires become requirements of the layer through a new type parameter. It runs with the services of the request first, and the services that the layer was built with fill in the rest, so a span that it opens is a child of the request's span.
+- Add the `apiKey` option for Bedrock API keys. The client sends the key as `Authorization: Bearer <key>` in place of a SigV4 signature, and an `AiError` shows the header as `<redacted>`.
+- AWS rejects an API key that it does not accept with `AccessDeniedException`, as it rejects a missing IAM permission, so the request fails with an `AuthenticationError` of kind `InsufficientPermissions`.
+- Add the `Credentials`, `CredentialProvider`, and `ConfigOptions` types. `Options`, `ConfigOptions`, `CredentialProvider`, `make`, `layer`, and `layerConfig` take a type parameter `R` for the services of an `Effect` provider. It defaults to `never`.
+- A retry policy in `transformClient` or `AmazonBedrockConfig.withClientTransform` signs each attempt again with the credentials of the request, and does not retry a provider that fails.
+
 ## 0.1.0
 
 The first release. It adds an Amazon Bedrock provider for `effect/ai`. The provider calls the Converse and ConverseStream APIs, signs requests with SigV4 through `aws4fetch`, and decodes the AWS event-stream framing without another dependency. `AmazonBedrockClient.layer` and `AmazonBedrockClient.layerConfig` take an access key and a secret key, and the optional `sessionToken`, `region`, `apiUrl`, and `transformClient`. The region defaults to `us-east-1`. `AmazonBedrockLanguageModel.Config` takes the Converse request fields other than `messages` and `system`.

package/README.md

@@ -138,20 +138,88 @@ To run the program, do these steps:
 
 `AmazonBedrockClient` needs an `HttpClient`. The example above uses `FetchHttpClient.layer` from `effect/http`.
 
-The client takes explicit credentials. It does not read `~/.aws`, the AWS profile variables, or instance metadata. Give the credentials in one of two ways:
+The client authenticates each request in one of three ways:
 
-- `AmazonBedrockClient.layerConfig` reads each option from a `Config`, as in the example above.
-- `AmazonBedrockClient.layer` takes plain values. Pass `secretAccessKey` and `sessionToken` as `Redacted` values.
+- Fixed keys. `accessKeyId`, `secretAccessKey`, and an optional `sessionToken`. The client signs each request with SigV4.
+- A credential provider. `credentialProvider` is a function or an `Effect` that returns credentials. The client signs each request with SigV4 and asks the provider for new credentials before the old ones expire.
+- A Bedrock API key. `apiKey` is sent as `Authorization: Bearer <key>` in place of a SigV4 signature.
 
-`sessionToken` is optional, but `layerConfig` fails with a `ConfigError` if a `Config` that you give it finds no value. For that reason the example above gives `AWS_SESSION_TOKEN` an empty default with `Config.withDefault`. The client sends no session token when the token is empty, so the same program runs with temporary and long-lived keys.
+Give exactly one of them. Options that mix two ways, or give none, do not compile. `AmazonBedrockClient.layerConfig` reads each value from a `Config`. `AmazonBedrockClient.layer` takes plain values, with the secrets as `Redacted` values. The client reads no environment variable and no file by itself.
 
-The client reads the credentials once, when the layer is built, and uses them for every request. Where you get them depends on where the program runs:
+### Use fixed keys
 
-- On a machine where the AWS CLI signs in through a profile or IAM Identity Center, run `eval "$(aws configure export-credentials --format env)"` in the shell before you start the program. The command needs AWS CLI version 2. It prints the profile's access key ID, secret access key, and session token, if the profile has one, as `export` lines. Add `--profile <name>` to choose a profile.
-- AWS Lambda sets `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` for the function's execution role, so the example above runs without changes.
-- On Amazon ECS, Amazon EKS, and Amazon EC2, the role's credentials are not in the environment. Get them yourself, for example with `fromNodeProviderChain()` from `@aws-sdk/credential-providers`, and pass them to `AmazonBedrockClient.layer`.
+The example above reads fixed keys from the environment. `sessionToken` is optional, but `layerConfig` fails with a `ConfigError` if a `Config` that you give it finds no value. For that reason the example gives `AWS_SESSION_TOKEN` an empty default with `Config.withDefault`. The client sends no session token when the token is empty, so the same program runs with temporary and long-lived keys. AWS Lambda sets `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` for the function's execution role, so the example runs there without changes.
 
-The client does not refresh temporary credentials. When the session ends, every request fails with an `AuthenticationError` of kind `ExpiredKey`. Restart the program with new credentials.
+The client reads fixed keys once, when the layer is built. When temporary keys expire, every request fails with an `AuthenticationError` of kind `ExpiredKey`. A program that runs longer than its session needs a credential provider.
+
+### Use a credential provider
+
+A function in the shape of the AWS SDK's credential providers fits `credentialProvider` without an adapter. `fromNodeProviderChain()` from `@aws-sdk/credential-providers` looks for credentials where the AWS CLI does, in the environment, in the profiles and IAM Identity Center sessions of `~/.aws`, and in the container credentials of Amazon ECS and Amazon EKS and the instance metadata of Amazon EC2. This package does not depend on the AWS SDK, so install `@aws-sdk/credential-providers` yourself.
+
+```ts
+import { fromNodeProviderChain } from "@aws-sdk/credential-providers"
+import { AmazonBedrockClient } from "@wmaurer/effect-ai-amazon-bedrock"
+import { Layer } from "effect"
+import { FetchHttpClient } from "effect/http"
+
+const BedrockClient = AmazonBedrockClient.layer({
+  region: "eu-west-1",
+  credentialProvider: fromNodeProviderChain()
+}).pipe(Layer.provide(FetchHttpClient.layer))
+```
+
+The client runs the provider when a request needs credentials, and runs it once for requests that need them at the same time:
+
+- It keeps the credentials until five minutes before their `expiration`. It keeps credentials that expire in less than five minutes for 10 seconds, and credentials without an `expiration` until Bedrock rejects them.
+- If the provider fails while the last credentials have not expired, the client signs with the last credentials. It asks the provider again after 30 seconds, or when the last credentials expire if that is sooner.
+- If Bedrock rejects the credentials with an `AuthenticationError` of kind `ExpiredKey`, `InvalidKey`, or `MissingKey`, the request fails, and the next request gets new credentials. The client calls a function provider with `{ forceRefresh: true }` for them. Kind `InsufficientPermissions` keeps the credentials, because new credentials for the same role have the same IAM policy.
+- If the promise of a function provider rejects, the request fails with an `AuthenticationError` of kind `Unknown`. If the provider returns an empty access key ID or secret access key, the request fails with an `AuthenticationError` of kind `MissingKey`.
+
+An `Effect` provider can load credentials from a service of your own. The layer then requires that service:
+
+```ts
+import { AmazonBedrockClient } from "@wmaurer/effect-ai-amazon-bedrock"
+import { Context, Effect } from "effect"
+import type { AiError } from "effect/ai"
+
+class Vault extends Context.Service<Vault, {
+  readonly bedrockCredentials: Effect.Effect<AmazonBedrockClient.Credentials, AiError.AiError>
+}>()("Vault") {}
+
+// Layer<AmazonBedrockClient, never, HttpClient | Vault>
+export const BedrockClient = AmazonBedrockClient.layer({
+  region: "eu-west-1",
+  credentialProvider: Effect.gen(function*() {
+    const vault = yield* Vault
+    return yield* vault.bedrockCredentials
+  })
+})
+```
+
+The provider runs with the services of the request first, and the services that the layer was built with fill in the rest. A span that the provider opens is a child of the span of the request that runs the provider.
+
+The `Effect` can fail with an `AiError`, which the request fails with unchanged, or with an `AiError` reason such as an `AuthenticationError`, which the client puts in an `AiError`.
+
+A retry policy in `transformClient` does not retry a failed provider, because the client gets the credentials before it sends the request. Each retry of a request signs again with the credentials of the first attempt.
+
+### Use a Bedrock API key
+
+```ts
+import { AmazonBedrockClient } from "@wmaurer/effect-ai-amazon-bedrock"
+import { Config, Layer } from "effect"
+import { FetchHttpClient } from "effect/http"
+
+const BedrockClient = AmazonBedrockClient.layerConfig({
+  region: Config.String("AWS_REGION"),
+  apiKey: Config.Redacted("AWS_BEARER_TOKEN_BEDROCK")
+}).pipe(Layer.provide(FetchHttpClient.layer))
+```
+
+`AWS_BEARER_TOKEN_BEDROCK` is the variable that the AWS SDK for JavaScript reads the key from. The client reads it only through the `Config` that you give it. An `AiError` and an HTTP span that records headers show the `authorization` header as `<redacted>`.
+
+AWS rejects an API key that it does not accept, such as an expired or revoked key, with `AccessDeniedException`, as it rejects a request that the IAM policy does not allow. The request then fails with an `AuthenticationError` of kind `InsufficientPermissions`, and the client cannot tell the two causes apart.
+
+### Set the other options
 
 The other options are these:
 
@@ -167,7 +235,7 @@ To set request defaults, give them as the second argument of `model` or as the `
 
 - `inferenceConfig`, `additionalModelRequestFields`, and `toolConfig`. The provider sends each one as the Converse request field of the same name.
 - `outputConfig`, which takes only `effort`. The provider sets `outputConfig.textFormat` itself. `effort` is `low`, `medium`, `high`, `xhigh`, or `max`, and a higher level lets the model reason longer before it answers. The Bedrock Runtime API model documents that the level is capped at `high` when extended thinking is off. Not every model takes `effort`. On 2026-10-17 Bedrock rejected it for Claude Sonnet 4.5 and Haiku 4.5 with `This model doesn't support the effort field`.
-- `structuredOutputs` and `forcedToolChoice`, which choose how `generateObject` asks for the object. The provider does not send them to Bedrock. [Get structured output](#get-structured-output) explains them.
+- `structuredOutputs` and `forcedToolChoice`, which override how `generateObject` asks for the object on the model you chose. The provider does not send them to Bedrock. [Get structured output](#get-structured-output) explains them.
 
 When `generateObject` asks for the object through a tool, that tool replaces your `toolConfig`. Any other request with tools replaces it with a `toolConfig` built from those tools, unless `toolChoice` is `"none"`. With no tools, or with `toolChoice` set to `"none"`, the provider sends your `toolConfig` unchanged.
 
@@ -216,22 +284,35 @@ export const adaptiveAnswer = LanguageModel.generateText({
 
 ## Get structured output
 
-`LanguageModel.generateText`, `LanguageModel.streamText`, and `LanguageModel.generateObject` all work with this provider. By default, `generateObject` sends the schema in the Converse `outputConfig.textFormat` field, and the tools you pass go with it. The provider converts the schema with the rules for Anthropic models.
+`LanguageModel.generateText`, `LanguageModel.streamText`, and `LanguageModel.generateObject` all work with this provider. `generateObject` asks for the object in one of three ways, and the provider that the model ID names decides which:
+
+- A Claude model gets the schema in the Converse `outputConfig.textFormat` field, and the tools you pass go with it.
+- A Meta or Writer model gets the schema as a tool that it is not forced to call, and the provider adds a system prompt line that tells the model to call it.
+- A model of any other provider, such as Amazon Nova, Mistral, OpenAI, or Qwen, gets the schema as a tool that `toolChoice` `{ any: {} }` forces it to call.
+
+The provider is the first part of the model ID, or the second part after a geo prefix: `anthropic` in `eu.anthropic.claude-opus-4-8`, `amazon` in `amazon.nova-pro-v1:0`. A foundation model ARN or an inference profile ARN names its model at the end. The tool replaces the tools you pass, and the tool's input becomes the object. If the model calls the tool more than once, the first call is the object. If the model answers in text instead of calling the tool, `effect/ai` decodes the text as the object. On every path, the provider converts the schema with the rules for Anthropic models.
+
+Probes on 2026-10-17 sent one Converse request per model and path through the `eu-west-1` and `us-east-1` endpoints. Of the models outside Anthropic:
+
+- The models that answered `outputConfig` with a 400 include Nova, Mistral Large 2402, Pixtral Large, Llama, and Palmyra. gpt-oss-120b accepted it, but wrote text before the JSON in 3 of 4 runs.
+- The tool forced with `any` returned the object on 13 of the 14 models in `eu-west-1`, and on every one of the 17 models in `us-east-1` that accept a forced tool. Mistral Large 2402 and Pixtral Large answer a named tool in `toolChoice` with a 400, and Gemma 3 27B ignores it, but all three accept `any`.
+- Llama 3.1, 3.3, and 4 and Palmyra X4 and X5 answered `any` with a 400. The unforced tool returned the object on Llama 3.1 8B, Llama 4 Scout, Llama 4 Maverick, and Palmyra X5, and a wrong object on Llama 3.1 70B and Llama 3.3 70B.
+- No path returned the object on Magistral Small. Llama 3 70B, Mistral 7B, Mixtral 8x7B, and DeepSeek R1 reject tool use and `outputConfig`, so `generateObject` does not work on them.
 
-A probe on 2026-10-17 sent one Converse request per path to 17 Claude inference profiles through the `eu-west-1` endpoint. Every profile that served the probe's requests, 12 of the 17, accepted `outputConfig.textFormat`: Claude Haiku 4.5 and 5.5, Opus 4.5, 4.6, 4.7, 4.8, 5, and 5.5, and Sonnet 4.5, 4.6, 5, and 5.5. On Opus 4.8, Opus 5.5, and Sonnet 5.5 it also accepted `outputConfig.textFormat` together with `effort`, with adaptive thinking, and next to a strict tool. Fable 5 and 5.1 rejected every request, with or without `outputConfig.textFormat`, with `data retention mode 'default' is not available for this model`, and the other three profiles have reached end of life.
+A probe on the same day sent one request per path to 17 Claude inference profiles through the `eu-west-1` endpoint. Every profile that served the probe's requests, 12 of the 17, accepted `outputConfig.textFormat`: Claude Haiku 4.5 and 5.5, Opus 4.5, 4.6, 4.7, 4.8, 5, and 5.5, and Sonnet 4.5, 4.6, 5, and 5.5. On Opus 4.8, Opus 5.5, and Sonnet 5.5 it also accepted `outputConfig.textFormat` together with `effort`, with adaptive thinking, and next to a strict tool. Fable 5 and 5.1 rejected every request, with or without `outputConfig.textFormat`, with `data retention mode 'default' is not available for this model`, and the other three profiles have reached end of life.
 
-The provider keeps a list of models that get the schema as a tool instead: the Claude 3 models and Claude Sonnet 4 and Opus 4. The list comes from Anthropic's table of models with structured output. The probe could not check it on Bedrock. Claude 3 Haiku, Claude 3 Sonnet, and Sonnet 4 have reached end of life in `eu-west-1`, and the probe did not try the other models on the list. The tool replaces the tools you pass, and the tool's input becomes the object. If the model calls the tool more than once, the first call is the object. If the model answers in text instead of calling the tool, `effect/ai` decodes the text as the object.
+The provider keeps a list of Claude models that get the forced tool instead: the Claude 3 models and Claude Sonnet 4 and Opus 4. The list comes from Anthropic's table of models with structured output. The probe could not check it on Bedrock. Claude 3 Haiku, Claude 3 Sonnet, and Sonnet 4 have reached end of life in `eu-west-1`, and the probe did not try the other models on the list.
 
-On the tool path the provider forces the model to call the tool. In the probe, Claude Opus 5.5 and Sonnet 5.5 rejected a forced `toolChoice` with `tool_choice: type "tool" and "any" are not supported for this model`. The provider also treats Fable 5.1 and Mythos 5.1 as rejecting it, which nobody has checked on Bedrock. For these four models the provider leaves the tool unforced and adds a system prompt line that tells the model to call it. They take the tool path only when `structuredOutputs` is `false`, or when the prompt holds tool calls and no tools go out.
+In the probe, Claude Opus 5.5 and Sonnet 5.5 rejected a forced `toolChoice` with `tool_choice: type "tool" and "any" are not supported for this model`. The provider also treats Fable 5.1 and Mythos 5.1 as rejecting it, which nobody has checked on Bedrock. For these four models the provider leaves the tool unforced and adds the system prompt line. They take the tool path only when `structuredOutputs` is `false`, or when the prompt holds tool calls and no tools go out.
 
 When the prompt holds tool calls or tool results and the request offers no tools, `generateObject` uses the tool on every model, even with `structuredOutputs: true`. Converse rejects such a request unless it carries a `toolConfig`, and the object tool is one.
 
-The provider matches the model ID against its lists. Two config fields override the match, and the provider sends neither to Bedrock:
+Two config fields override what the model ID decides, and the provider sends neither to Bedrock:
 
 - `structuredOutputs` set to `true` sends `outputConfig.textFormat` to any model, except when the prompt holds tool calls and no tools go out. Set to `false`, it sends the tool.
 - `forcedToolChoice` set to `true` forces the tool, and set to `false` leaves it unforced. It has an effect only on the tool path. It does not change a `toolChoice` you pass with your own tools: `"required"` and a named tool go to Bedrock as `any` and `tool`, and the probe's error from Opus 5.5 and Sonnet 5.5 names both as unsupported.
 
-A model ID that does not name the model, such as an application inference profile ARN, gets `outputConfig.textFormat`, or a forced tool when `structuredOutputs` is `false`. With tool history and no tools it also gets a forced tool by default. Behind an ARN that wraps Opus 5.5 or Sonnet 5.5, set `forcedToolChoice: false` for that case. To send the unforced tool through such an ARN in every case, set both fields:
+A model ID that does not name the model, such as an application inference profile ARN, gets what a Claude model gets: `outputConfig.textFormat`, or a forced tool when `structuredOutputs` is `false`. With tool history and no tools it also gets a forced tool by default. Behind an ARN that wraps Opus 5.5 or Sonnet 5.5, set `forcedToolChoice: false` for that case. Behind an ARN that wraps a model of another provider, set `structuredOutputs: false`, and also `forcedToolChoice: false` for a Meta or Writer model. To send the unforced tool through such an ARN in every case, set both fields:
 
 ```ts
 import { AmazonBedrockLanguageModel } from "@wmaurer/effect-ai-amazon-bedrock"

package/dist/AmazonBedrockClient.d.ts

@@ -1,10 +1,27 @@
+/**
+ * The `AmazonBedrockClient` module defines the low-level Effect service used to
+ * call Amazon Bedrock's Converse API. It wraps an `HttpClient` with SigV4
+ * request signing (via `aws4fetch`), request defaults, response decoding, and
+ * error mapping to the unified `AiError` type.
+ *
+ * **Mental model**
+ *
+ * `HttpClient.HttpClient` provides the transport. {@link make} turns explicit
+ * {@link Options} into an {@link AmazonBedrockClient} service, while
+ * {@link layer} and {@link layerConfig} provide that service as a layer. The
+ * service exposes handwritten helpers for the `converse` (non-streaming) and
+ * `converse-stream` (streaming) endpoints.
+ *
+ * @stability unstable
+ * @since 0.1.0
+ */
 import type * as AiError from "effect/ai/AiError";
 import type * as Config from "effect/Config";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as HttpClient from "effect/http/HttpClient";
 import * as Layer from "effect/Layer";
-import * as Redacted from "effect/Redacted";
+import type * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 import type { ConverseRequest } from "./AmazonBedrockSchema.ts";
 import { ConverseResponse, ConverseResponseStreamEvent } from "./AmazonBedrockSchema.ts";
@@ -14,7 +31,7 @@ import { ConverseResponse, ConverseResponseStreamEvent } from "./AmazonBedrockSc
  *
  * @stability unstable
  * @category models
- * @since 4.0.0
+ * @since 0.1.0
  */
 export interface Service {
     /**
@@ -38,18 +55,59 @@ declare const AmazonBedrockClient_base: Context.ServiceClass<AmazonBedrockClient
  *
  * @stability unstable
  * @category services
- * @since 4.0.0
+ * @since 0.1.0
  */
 export declare class AmazonBedrockClient extends AmazonBedrockClient_base {
 }
 /**
- * Configuration for creating an Amazon Bedrock client.
+ * SigV4 credentials as a {@link CredentialProvider} returns them. The shape is
+ * the AWS SDK's `AwsCredentialIdentity`, so the SDK's providers fit without an
+ * adapter.
  *
  * @stability unstable
  * @category options
- * @since 4.0.0
+ * @since 0.2.0
  */
-export type Options = {
+export interface Credentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    /** An empty token is sent as no token. */
+    readonly sessionToken?: string | undefined;
+    /** The client asks the provider for new credentials five minutes before this time. */
+    readonly expiration?: Date | undefined;
+}
+/**
+ * Supplies SigV4 credentials that can change while the program runs.
+ *
+ * **Details**
+ *
+ * A provider is one of these:
+ *
+ * - A function in the shape of the AWS SDK's credential providers, such as
+ *   `fromNodeProviderChain()` from `@aws-sdk/credential-providers`. A rejected
+ *   promise fails the request with an `AuthenticationError` of kind
+ *   `"Unknown"`. After Bedrock rejects the credentials, the client calls the
+ *   function with `{ forceRefresh: true }`.
+ * - An `Effect`. It can fail with an `AiError`, which the request fails with
+ *   unchanged, or with an `AiError` reason, such as an `AuthenticationError`,
+ *   which the client wraps in an `AiError`. The services that it requires
+ *   become requirements of the layer. It runs with the services of the
+ *   request first, and the services that the layer was built with fill in the
+ *   rest.
+ *
+ * The client runs the provider at most once at a time, and keeps the
+ * credentials until five minutes before their `expiration`. Credentials with
+ * no `expiration` are kept until Bedrock rejects them. Keys that are empty fail
+ * the request with an `AuthenticationError` of kind `"MissingKey"`.
+ *
+ * @stability unstable
+ * @category options
+ * @since 0.2.0
+ */
+export type CredentialProvider<R = never> = ((options?: {
+    readonly forceRefresh?: boolean;
+}) => PromiseLike<Credentials>) | Effect.Effect<Credentials, AiError.AiError | AiError.AiErrorReason, R>;
+interface CommonOptions {
     /**
      * The base URL for the Bedrock runtime API. Override to use a proxy or a
      * different endpoint.
@@ -57,9 +115,6 @@ export type Options = {
      * @default `https://bedrock-runtime.${region}.amazonaws.com`
      */
     readonly apiUrl?: string | undefined;
-    readonly accessKeyId: string;
-    readonly secretAccessKey: Redacted.Redacted<string>;
-    readonly sessionToken?: Redacted.Redacted<string> | undefined;
     /**
      * The AWS region.
      *
@@ -67,38 +122,95 @@ export type Options = {
      */
     readonly region?: string | undefined;
     readonly transformClient?: ((client: HttpClient.HttpClient) => HttpClient.HttpClient) | undefined;
-};
+}
+interface StaticKeys {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: Redacted.Redacted<string>;
+    readonly sessionToken?: Redacted.Redacted<string> | undefined;
+    readonly credentialProvider?: never;
+    readonly apiKey?: never;
+}
+interface ProvidedKeys<R> {
+    readonly credentialProvider: CredentialProvider<R>;
+    readonly accessKeyId?: never;
+    readonly secretAccessKey?: never;
+    readonly sessionToken?: never;
+    readonly apiKey?: never;
+}
+interface ApiKey {
+    /** A Bedrock API key, sent as `Authorization: Bearer <key>` in place of a SigV4 signature. */
+    readonly apiKey: Redacted.Redacted<string>;
+    readonly accessKeyId?: never;
+    readonly secretAccessKey?: never;
+    readonly sessionToken?: never;
+    readonly credentialProvider?: never;
+}
+/**
+ * Configuration for creating an Amazon Bedrock client.
+ *
+ * **Details**
+ *
+ * The options take exactly one way to authenticate:
+ *
+ * - `accessKeyId` and `secretAccessKey`, and an optional `sessionToken`.
+ * - `credentialProvider`, a {@link CredentialProvider}.
+ * - `apiKey`, a Bedrock API key.
+ *
+ * @stability unstable
+ * @category options
+ * @since 0.1.0
+ */
+export type Options<R = never> = CommonOptions & (StaticKeys | ProvidedKeys<R> | ApiKey);
+/**
+ * The {@link Options} of {@link layerConfig}, with a `Config` for each value.
+ * `credentialProvider` and `transformClient` are not configuration, so they
+ * take the same values as in {@link Options}.
+ *
+ * @stability unstable
+ * @category options
+ * @since 0.2.0
+ */
+export type ConfigOptions<R = never> = {
+    readonly apiUrl?: Config.Config<string> | undefined;
+    readonly region?: Config.Config<string> | undefined;
+    readonly transformClient?: ((client: HttpClient.HttpClient) => HttpClient.HttpClient) | undefined;
+} & ({
+    readonly accessKeyId: Config.Config<string>;
+    readonly secretAccessKey: Config.Config<Redacted.Redacted<string>>;
+    readonly sessionToken?: Config.Config<Redacted.Redacted<string>> | undefined;
+    readonly credentialProvider?: never;
+    readonly apiKey?: never;
+} | ProvidedKeys<R> | {
+    readonly apiKey: Config.Config<Redacted.Redacted<string>>;
+    readonly accessKeyId?: never;
+    readonly secretAccessKey?: never;
+    readonly sessionToken?: never;
+    readonly credentialProvider?: never;
+});
 /**
  * Creates an Amazon Bedrock client service with the given options.
  *
  * @stability unstable
  * @category constructors
- * @since 4.0.0
+ * @since 0.1.0
  */
-export declare const make: (options: Options) => Effect.Effect<Service, never, HttpClient.HttpClient>;
+export declare const make: <R = never>(options: Options<R>) => Effect.Effect<Service, never, HttpClient.HttpClient | R>;
 /**
  * Creates a layer for the Amazon Bedrock client with the given options.
  *
  * @stability unstable
  * @category layers
- * @since 4.0.0
+ * @since 0.1.0
  */
-export declare const layer: (options: Options) => Layer.Layer<AmazonBedrockClient, never, HttpClient.HttpClient>;
+export declare const layer: <R = never>(options: Options<R>) => Layer.Layer<AmazonBedrockClient, never, HttpClient.HttpClient | R>;
 /**
  * Creates a layer for the Amazon Bedrock client, loading credentials and other
  * settings via Effect's `Config` module.
  *
  * @stability unstable
  * @category layers
- * @since 4.0.0
+ * @since 0.1.0
  */
-export declare const layerConfig: (options: {
-    readonly apiUrl?: Config.Config<string> | undefined;
-    readonly accessKeyId: Config.Config<string>;
-    readonly secretAccessKey: Config.Config<Redacted.Redacted<string>>;
-    readonly sessionToken?: Config.Config<Redacted.Redacted<string>> | undefined;
-    readonly region?: Config.Config<string> | undefined;
-    readonly transformClient?: ((client: HttpClient.HttpClient) => HttpClient.HttpClient) | undefined;
-}) => Layer.Layer<AmazonBedrockClient, Config.ConfigError, HttpClient.HttpClient>;
+export declare const layerConfig: <R = never>(options: ConfigOptions<R>) => Layer.Layer<AmazonBedrockClient, Config.ConfigError, HttpClient.HttpClient | R>;
 export {};
 //# sourceMappingURL=AmazonBedrockClient.d.ts.map

package/dist/AmazonBedrockClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AmazonBedrockClient.d.ts","sourceRoot":"","sources":["../src/AmazonBedrockClient.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,KAAK,OAAO,MAAM,mBAAmB,CAAA;AAEjD,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAIvC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAA;AAGpD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAOxF;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE;QAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,eAAe,CAAC,OAAO,CAAA;KACjD,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,eAAe,CAAC,OAAO,CAAA;KACjD,KAAK,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;CAClE;;AAMD;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,wBAExC;CAAG;AAMJ;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,CAAA;CAClG,CAAA;AAcD;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,4EAiFhB,CAAA;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,YAAa,OAAO,KAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CACpD,CAAA;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,YAAa;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,CAAA;CAClG,KAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,CAwB3E,CAAA"}
+{"version":3,"file":"AmazonBedrockClient.d.ts","sourceRoot":"","sources":["../src/AmazonBedrockClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,OAAO,MAAM,mBAAmB,CAAA;AAEjD,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAIvC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAA;AAGpD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAQxF;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE;QAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,eAAe,CAAC,OAAO,CAAA;KACjD,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,eAAe,CAAC,OAAO,CAAA;KACjD,KAAK,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;CAClE;;AAMD;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,wBAExC;CAAG;AAMJ;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,kBAAkB,CAAC,CAAC,GAAG,KAAK,IAGpC,CAAC,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC,GAC7E,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;AAE1E,UAAU,aAAa;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,CAAA;CAClG;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IAC7D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CACxB;AAED,UAAU,YAAY,CAAC,CAAC;IACtB,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CACxB;AAED,UAAU,MAAM;IACd,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAA;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;CACpC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,OAAO,CAAC,CAAC,GAAG,KAAK,IAAI,aAAa,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;AAExF;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,KAAK,IAC/B;IACA,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,CAAA;CAClG,GACC,CACE;IACA,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CACxB,GACC,YAAY,CAAC,CAAC,CAAC,GACf;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAA;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;CACpC,CACF,CAAA;AAcH;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC,CACxF,CAAA;AA8FrB;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,KAAK,WACpB,OAAO,CAAC,CAAC,CAAC,KAClB,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC,CAClB,CAAA;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,GAAG,KAAK,WAC1B,aAAa,CAAC,CAAC,CAAC,KACxB,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC,CAe9E,CAAA"}

package/dist/AmazonBedrockClient.js

@@ -1,21 +1,3 @@
-/**
- * The `AmazonBedrockClient` module defines the low-level Effect service used to
- * call Amazon Bedrock's Converse API. It wraps an `HttpClient` with SigV4
- * request signing (via `aws4fetch`), request defaults, response decoding, and
- * error mapping to the unified `AiError` type.
- *
- * **Mental model**
- *
- * `HttpClient.HttpClient` provides the transport. {@link make} turns explicit
- * {@link Options} into an {@link AmazonBedrockClient} service, while
- * {@link layer} and {@link layerConfig} provide that service as a layer. The
- * service exposes handwritten helpers for the `converse` (non-streaming) and
- * `converse-stream` (streaming) endpoints.
- *
- * @stability unstable
- * @since 4.0.0
- */
-import { AwsV4Signer } from "aws4fetch";
 import * as Array from "effect/Array";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
@@ -26,12 +8,11 @@ import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import * as Layer from "effect/Layer";
-import * as Predicate from "effect/Predicate";
-import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 import { AmazonBedrockConfig } from "./AmazonBedrockConfig.js";
 import * as EventStream from "./AmazonBedrockEventStream.js";
 import { ConverseResponse, ConverseResponseStreamEvent } from "./AmazonBedrockSchema.js";
+import * as Authentication from "./internal/credentials.js";
 import * as Errors from "./internal/errors.js";
 // =============================================================================
 // Service Identifier
@@ -41,7 +22,7 @@ import * as Errors from "./internal/errors.js";
  *
  * @stability unstable
  * @category services
- * @since 4.0.0
+ * @since 0.1.0
  */
 export class AmazonBedrockClient extends /*#__PURE__*/Context.Service()("@wmaurer/effect-ai-amazon-bedrock/AmazonBedrockClient") {}
 // =============================================================================
@@ -57,48 +38,35 @@ const withRedactedHeaders = /*#__PURE__*/Effect.updateService(Headers.CurrentRed
  *
  * @stability unstable
  * @category constructors
- * @since 4.0.0
+ * @since 0.1.0
  */
-export const make = /*#__PURE__*/Effect.fnUntraced(function* (options) {
+export const make = options => makeUnsafe(options);
+// Takes each authentication field as optional, as `layerConfig` reads them.
+// `Authentication.make` dies on a mix of the ways to authenticate.
+const makeUnsafe = options => Effect.gen(function* () {
   const region = options.region ?? "us-east-1";
+  const authenticator = yield* Authentication.make(options);
   const baseClient = yield* HttpClient.HttpClient;
-  const httpClient = baseClient.pipe(HttpClient.mapRequest(request => request.pipe(HttpClientRequest.prependUrl(options.apiUrl ?? `https://bedrock-runtime.${region}.amazonaws.com`), HttpClientRequest.acceptJson)), HttpClient.mapRequestEffect(Effect.fnUntraced(function* (request) {
-    const originalHeaders = request.headers;
-    const signer = new AwsV4Signer({
-      service: "bedrock",
-      url: request.url,
-      method: request.method,
-      headers: Object.entries(originalHeaders),
-      body: prepareBody(request.body),
-      region,
-      accessKeyId: options.accessKeyId,
-      secretAccessKey: Redacted.value(options.secretAccessKey),
-      ...(options.sessionToken ? {
-        sessionToken: Redacted.value(options.sessionToken)
-      } : {})
-    });
-    const {
-      headers: signedHeaders
-    } = yield* Effect.promise(() => signer.sign());
-    const headers = Headers.merge(originalHeaders, Headers.fromInput(signedHeaders));
-    return HttpClientRequest.setHeaders(request, headers);
-  })), options.transformClient ? options.transformClient : identity);
+  const httpClient = baseClient.pipe(HttpClient.mapRequest(request => request.pipe(HttpClientRequest.prependUrl(options.apiUrl ?? `https://bedrock-runtime.${region}.amazonaws.com`), HttpClientRequest.acceptJson)), HttpClient.mapRequestEffect(Authentication.authenticateRequest(region)), options.transformClient ? options.transformClient : identity);
   const httpClientOk = HttpClient.filterStatusOk(httpClient);
   const withConfigClient = Effect.fnUntraced(function* () {
     const config = yield* AmazonBedrockConfig.getOrUndefined;
     return config?.transformClient ? config.transformClient(httpClientOk) : httpClientOk;
   });
+  const resolveCredentials = method => Effect.mapError(authenticator.resolve, Errors.mapCredentialProviderError(method));
   const converse = ({
     payload: {
       modelId,
       ...body
     }
-  }) => Effect.flatMap(withConfigClient(), client => {
+  }) => Effect.gen(function* () {
+    const client = yield* withConfigClient();
+    const credentials = yield* resolveCredentials("converse");
     const request = HttpClientRequest.post(`/model/${modelId}/converse`, {
       body: HttpBody.jsonUnsafe(body)
     });
-    return client.execute(request).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(ConverseResponse)), Effect.catchTags({
-      HttpClientError: error => Errors.mapHttpClientError(error, "converse"),
+    return yield* client.execute(request).pipe(Effect.provideService(Authentication.CurrentRequestCredentials, credentials), Effect.flatMap(HttpClientResponse.schemaBodyJson(ConverseResponse)), Effect.catchTags({
+      HttpClientError: error => Errors.mapHttpClientError(error, "converse").pipe(Effect.tapError(Authentication.invalidateIfRejected(authenticator, credentials))),
       SchemaError: error => Effect.fail(Errors.mapSchemaError(error, "converse"))
     }), withRedactedHeaders);
   });
@@ -111,17 +79,21 @@ export const make = /*#__PURE__*/Effect.fnUntraced(function* (options) {
     const request = HttpClientRequest.post(`/model/${modelId}/converse-stream`, {
       body: HttpBody.jsonUnsafe(body)
     });
-    return Stream.unwrap(Effect.map(withConfigClient(), client => client.execute(request).pipe(Effect.map(response => response.stream), Stream.unwrap, Stream.pipeThroughChannel(EventStream.makeChannel(ConverseResponseStreamEvent)), Stream.catchTags({
-      HttpClientError: error => Stream.fromEffect(Errors.mapHttpClientError(error, "converseStream")),
-      SchemaError: error => Stream.fail(Errors.mapSchemaError(error, "converseStream")),
-      EventStreamError: error => Stream.fail(Errors.mapEventStreamError(error, "converseStream"))
-    }), Stream.updateService(Headers.CurrentRedactedNames, appendRedactedHeaders))));
+    return Stream.unwrap(Effect.gen(function* () {
+      const client = yield* withConfigClient();
+      const credentials = yield* resolveCredentials("converseStream");
+      return client.execute(request).pipe(Effect.provideService(Authentication.CurrentRequestCredentials, credentials), Effect.map(response => response.stream), Stream.unwrap, Stream.pipeThroughChannel(EventStream.makeChannel(ConverseResponseStreamEvent)), Stream.catchTags({
+        HttpClientError: error => Stream.fromEffect(Errors.mapHttpClientError(error, "converseStream").pipe(Effect.tapError(Authentication.invalidateIfRejected(authenticator, credentials)))),
+        SchemaError: error => Stream.fail(Errors.mapSchemaError(error, "converseStream")),
+        EventStreamError: error => Stream.fail(Errors.mapEventStreamError(error, "converseStream"))
+      }), Stream.updateService(Headers.CurrentRedactedNames, appendRedactedHeaders));
+    }));
   };
   return AmazonBedrockClient.of({
     converse,
     converseStream
   });
-}, withRedactedHeaders);
+}).pipe(withRedactedHeaders);
 // =============================================================================
 // Layers
 // =============================================================================
@@ -130,7 +102,7 @@ export const make = /*#__PURE__*/Effect.fnUntraced(function* (options) {
  *
  * @stability unstable
  * @category layers
- * @since 4.0.0
+ * @since 0.1.0
  */
 export const layer = options => Layer.effect(AmazonBedrockClient, make(options));
 /**
@@ -139,47 +111,19 @@ export const layer = options => Layer.effect(AmazonBedrockClient, make(options))
  *
  * @stability unstable
  * @category layers
- * @since 4.0.0
+ * @since 0.1.0
  */
 export const layerConfig = options => Layer.effect(AmazonBedrockClient, Effect.gen(function* () {
-  const apiUrl = Predicate.isNotUndefined(options.apiUrl) ? yield* options.apiUrl : undefined;
-  const accessKeyId = yield* options.accessKeyId;
-  const secretAccessKey = yield* options.secretAccessKey;
-  const sessionToken = Predicate.isNotUndefined(options.sessionToken) ? yield* options.sessionToken : undefined;
-  const region = Predicate.isNotUndefined(options.region) ? yield* options.region : undefined;
-  return yield* make({
-    apiUrl,
-    accessKeyId,
-    secretAccessKey,
-    sessionToken,
-    region,
+  return yield* makeUnsafe({
+    apiUrl: yield* readOptional(options.apiUrl),
+    region: yield* readOptional(options.region),
+    accessKeyId: yield* readOptional(options.accessKeyId),
+    secretAccessKey: yield* readOptional(options.secretAccessKey),
+    sessionToken: yield* readOptional(options.sessionToken),
+    apiKey: yield* readOptional(options.apiKey),
+    credentialProvider: options.credentialProvider,
     transformClient: options.transformClient
   });
 }));
-// =============================================================================
-// Utilities
-// =============================================================================
-const prepareBody = body => {
-  switch (body._tag) {
-    case "Empty":
-      {
-        return "";
-      }
-    case "Raw":
-    case "Uint8Array":
-      {
-        if (typeof body.body === "string") {
-          return body.body;
-        }
-        if (body.body instanceof Uint8Array) {
-          return new TextDecoder().decode(body.body);
-        }
-        if (body.body instanceof ArrayBuffer) {
-          return new TextDecoder().decode(body.body);
-        }
-        return JSON.stringify(body.body);
-      }
-  }
-  throw new Error("Unsupported HttpBody: " + body._tag);
-};
+const readOptional = config => config === undefined ? Effect.undefined : config;
 //# sourceMappingURL=AmazonBedrockClient.js.map