Andy Dixon
f165adc5f2
Kind `bedrock` speaks the Converse API for chat roles and InvokeModel for Titan and Cohere embeddings. Requests are signed with AWS Signature Version 4 implemented with crypto/hmac and crypto/sha256 only; the signer is pinned by tests to signatures botocore produces for the same requests, with and without a session token, so drift fails the build. The credential is one secret reference, ACCESS_KEY_ID:SECRET_ACCESS_KEY [:SESSION_TOKEN], encrypted together like every other provider key. The region is read from the endpoint host, which must be a Bedrock runtime host over HTTPS unless private endpoints are explicitly allowed; other hosts are refused. Provider errors are scrubbed of the secret and token. Migration 0024 widens the provider kind constraint; existing rows are untouched and the down migration refuses while bedrock rows exist rather than dropping configuration. UI kind selects, docs/llm-providers.md, ADR-0010, ARCHITECTURE and the changelog are updated.
4 lines
305 B
SQL
4 lines
305 B
SQL
-- Fails if any bedrock provider rows exist; delete them first (deliberate: never silently drop configuration).
|
|
ALTER TABLE llm_providers DROP CONSTRAINT IF EXISTS llm_providers_kind_check;
|
|
ALTER TABLE llm_providers ADD CONSTRAINT llm_providers_kind_check CHECK (kind IN ('openai','anthropic','ollama'));
|