Mario Zechner
fec0c3d12f
Auth helpers in src/auth/helpers.ts: envApiKeyAuth() (stored key wins, then env vars in order, with secret-prompt login) and lazyOAuth() (flow loads on first use through bundler-opaque dynamic imports in utils/oauth/load.ts; the OAuthAuth flow exports land in phase 4). There is no OAuth factory toggle: providers that support OAuth always attach it, advertising costs nothing until login/refresh runs. createProvider() in models.ts builds providers from parts: single API implementation or a map dispatched on model.api (mixed-API providers like opencode and github-copilot); unknown api yields a stream error. generate-models.ts now emits one providers/<id>.models.ts catalog per provider (35 files, biome-excluded like models.generated.ts) and models.generated.ts becomes a generated aggregator, so importing one provider factory pulls one catalog. Typed getModel globals unchanged. One factory per built-in provider under src/providers/: envApiKeyAuth for standard providers, OAuth for anthropic/openai-codex/github-copilot, ambient ApiKeyAuth for amazon-bedrock (AWS env/profile/IAM) and google-vertex (explicit key or ADC+project+location). providers/all.ts: builtinProviders(), builtinModels(), getBuiltin* re-exports. fauxProvider() factory returns a real Provider for tests; legacy registerFauxProvider() unchanged.
36 lines
1.6 KiB
TypeScript
36 lines
1.6 KiB
TypeScript
import { bedrockConverseStreamApi } from "../api/bedrock-converse-stream.lazy.ts";
|
|
import type { ApiKeyAuth } from "../auth/types.ts";
|
|
import { createProvider, type Provider } from "../models.ts";
|
|
import { AMAZON_BEDROCK_MODELS } from "./amazon-bedrock.models.ts";
|
|
|
|
/**
|
|
* Bedrock auth is ambient: the AWS SDK's default credential chain handles the
|
|
* actual signing, so `resolve` only reports whether the provider is
|
|
* configured. A stored credential key is surfaced as the bearer token.
|
|
*/
|
|
const bedrockAuth: ApiKeyAuth = {
|
|
name: "AWS credentials",
|
|
resolve: async ({ ctx, credential }) => {
|
|
if (credential?.key) return { auth: { apiKey: credential.key }, source: "stored credential" };
|
|
if (await ctx.env("AWS_BEARER_TOKEN_BEDROCK")) return { auth: {}, source: "AWS_BEARER_TOKEN_BEDROCK" };
|
|
if (await ctx.env("AWS_PROFILE")) return { auth: {}, source: "AWS_PROFILE" };
|
|
if ((await ctx.env("AWS_ACCESS_KEY_ID")) && (await ctx.env("AWS_SECRET_ACCESS_KEY"))) {
|
|
return { auth: {}, source: "AWS access keys" };
|
|
}
|
|
if (await ctx.env("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI")) return { auth: {}, source: "ECS task role" };
|
|
if (await ctx.env("AWS_CONTAINER_CREDENTIALS_FULL_URI")) return { auth: {}, source: "ECS task role" };
|
|
if (await ctx.env("AWS_WEB_IDENTITY_TOKEN_FILE")) return { auth: {}, source: "web identity token" };
|
|
return undefined;
|
|
},
|
|
};
|
|
|
|
export function amazonBedrockProvider(): Provider<"bedrock-converse-stream"> {
|
|
return createProvider({
|
|
id: "amazon-bedrock",
|
|
name: "Amazon Bedrock",
|
|
auth: { apiKey: bedrockAuth },
|
|
models: Object.values(AMAZON_BEDROCK_MODELS),
|
|
api: bedrockConverseStreamApi(),
|
|
});
|
|
}
|