{"version":3,"file":"amazon-bedrock.d.ts","sourceRoot":"","sources":["../../src/providers/amazon-bedrock.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AA+E7D,wBAAgB,qBAAqB,IAAI,QAAQ,CAAC,yBAAyB,CAAC,CAQ3E","sourcesContent":["import { bedrockConverseStreamApi } from \"../api/bedrock-converse-stream.lazy.ts\";\nimport type { ApiKeyAuth } from \"../auth/types.ts\";\nimport { createProvider, type Provider } from \"../models.ts\";\nimport { AMAZON_BEDROCK_MODELS } from \"./amazon-bedrock.models.ts\";\n\n/**\n * Bedrock accepts a bearer token or the AWS SDK's default credential chain.\n * The login flow can store a token/profile choice; resolve also detects ambient\n * AWS credentials without copying them into pi's credential store.\n */\nconst bedrockAuth: ApiKeyAuth = {\n\tname: \"AWS credentials or bearer token\",\n\tlogin: async (interaction) => {\n\t\tinteraction.signal.throwIfAborted();\n\t\tconst method = await interaction.prompt({\n\t\t\ttype: \"select\",\n\t\t\tmessage: \"Select Amazon Bedrock authentication method:\",\n\t\t\toptions: [\n\t\t\t\t{ id: \"bearer-token\", label: \"Bearer token\" },\n\t\t\t\t{ id: \"aws-profile\", label: \"AWS profile\" },\n\t\t\t\t{ id: \"credential-chain\", label: \"Existing AWS credential chain\" },\n\t\t\t],\n\t\t});\n\t\tinteraction.signal.throwIfAborted();\n\t\tif (method === \"bearer-token\") {\n\t\t\treturn {\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey: await interaction.prompt({ type: \"secret\", message: \"Enter Amazon Bedrock bearer token\" }),\n\t\t\t};\n\t\t}\n\t\tinteraction.notify({\n\t\t\ttype: \"info\",\n\t\t\tmessage: \"Amazon Bedrock supports AWS profiles, IAM credentials, and role-based credentials.\",\n\t\t\tlinks: [\n\t\t\t\t{\n\t\t\t\t\tlabel: \"AWS credential provider chain\",\n\t\t\t\t\turl: \"https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html\",\n\t\t\t\t},\n\t\t\t],\n\t\t});\n\t\tif (method === \"aws-profile\") {\n\t\t\treturn {\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tenv: { AWS_PROFILE: await interaction.prompt({ type: \"text\", message: \"Enter AWS profile name\" }) },\n\t\t\t};\n\t\t}\n\t\tif (method !== \"credential-chain\") throw new Error(`Unknown Amazon Bedrock auth method: ${method}`);\n\t\tawait interaction.prompt({\n\t\t\ttype: \"text\",\n\t\t\tmessage: \"Configure AWS credentials, then press Enter to continue\",\n\t\t});\n\t\treturn { type: \"api_key\" };\n\t},\n\tresolve: async ({ ctx, credential, signal }) => {\n\t\tconst env = async (name: string) => {\n\t\t\tsignal.throwIfAborted();\n\t\t\tconst value = await ctx.env(name);\n\t\t\tsignal.throwIfAborted();\n\t\t\treturn value;\n\t\t};\n\t\tif (credential?.key) {\n\t\t\treturn { auth: { apiKey: credential.key }, env: credential.env, source: \"stored credential\" };\n\t\t}\n\t\tif (await env(\"AWS_BEARER_TOKEN_BEDROCK\")) return { auth: {}, source: \"AWS_BEARER_TOKEN_BEDROCK\" };\n\t\tif (credential?.env?.AWS_PROFILE ?? (await env(\"AWS_PROFILE\"))) {\n\t\t\treturn {\n\t\t\t\tauth: {},\n\t\t\t\tenv: credential?.env,\n\t\t\t\tsource: credential?.env?.AWS_PROFILE ? \"stored credential\" : \"AWS_PROFILE\",\n\t\t\t};\n\t\t}\n\t\tif ((await env(\"AWS_ACCESS_KEY_ID\")) && (await env(\"AWS_SECRET_ACCESS_KEY\"))) {\n\t\t\treturn { auth: {}, source: \"AWS access keys\" };\n\t\t}\n\t\tif (await env(\"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\")) return { auth: {}, source: \"ECS task role\" };\n\t\tif (await env(\"AWS_CONTAINER_CREDENTIALS_FULL_URI\")) return { auth: {}, source: \"ECS task role\" };\n\t\tif (await env(\"AWS_WEB_IDENTITY_TOKEN_FILE\")) return { auth: {}, source: \"web identity token\" };\n\t\treturn undefined;\n\t},\n};\n\nexport function amazonBedrockProvider(): Provider<\"bedrock-converse-stream\"> {\n\treturn createProvider({\n\t\tid: \"amazon-bedrock\",\n\t\tname: \"Amazon Bedrock\",\n\t\tauth: { apiKey: bedrockAuth },\n\t\tmodels: Object.values(AMAZON_BEDROCK_MODELS),\n\t\tapi: bedrockConverseStreamApi(),\n\t});\n}\n"]}