* Add AWS Bedrock session token support in API and worker
* Add Bedrock auth mode integration tests for AI agents
* Split Bedrock integration test env vars for IAM and session creds
* cleaning
* Add masked Bedrock bearer-token debug info logs
* Revert "Add masked Bedrock bearer-token debug info logs"
This reverts commit 6b2fc5e7c2d5b1c6db81f416a4439941a084108c.
* cleaning
* refactor: extract windmill-api into 4 subcrates (api-auth, store, api-sse, api-jobs)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: eliminate refresh_token OnceLock bridge in windmill-store
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: eliminate FromRequestParts OnceLock bridge in windmill-api-auth
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: wire subcrates into workspace and clean up unused re-exports
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve cargo check --all-features errors in subcrate wiring
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* sqlx
* all
* chore: update ee-repo-ref for warning fixes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract windmill-trigger crate and expand windmill-api-jobs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-kafka crate from windmill-api
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-postgres crate from windmill-api
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-websocket and windmill-trigger-mqtt crates
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-nats, sqs, gcp, and email crates
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-http crate from windmill-api
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: move token creation and permission helpers to windmill-api-auth
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-native-triggers crate from windmill-api
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* sqlx
* all
* refactor: extract windmill-api-embeddings crate and fix CI warnings
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: resolve type mismatch in oauth2_oss and remaining warnings
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use correct HTTP_CLIENT config in embeddings crate (30s timeout, cert override)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
* fix: gate oauth_refresh_ee on oauth2 feature to fix warnings
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* check endpoint
* use flag for cred check on worker
* use sdk for auth chat side
* cleaning
* cleaning
* also handle GET
* Add session token support in BedrockClient::from_credentials
Users with temporary STS credentials need session tokens for AWS
authentication. This adds the optional session_token parameter to
support these use cases.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Cache AWS SDK config loading to avoid repeated I/O
aws_config::load_defaults() performs environment variable lookups and
potentially file I/O on each call. Cache the result in a static OnceCell
to improve performance on high-frequency Bedrock requests.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add debouncing to Bedrock credential check button
Prevent rapid clicks from spawning multiple concurrent flow preview
jobs for the worker credential check.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Remove orphaned SigV4 signing comment
The manual SigV4 signing code was removed in favor of the AWS SDK,
but this documentation comment was left behind.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Remove verbose tracing info and change-related comments
- Remove per-request auth method info logs (too verbose for production)
- Simplify from_env log to single debug-level message
- Remove comments describing future changes rather than current behavior
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* cleaning
* Fix Bedrock feature flag compilation warnings
Gate AWS-specific imports, struct fields, and methods behind the bedrock
feature flag to eliminate dead code warnings when building without the
bedrock feature enabled.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* bedrock flag
* cleaning
* Move BedrockCredentialsCheck from edit drawer to add drawer
The component was incorrectly shown when editing resources instead of
when adding new ones. Moved it from ResourceEditor.svelte to
ApiConnectForm.svelte.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* cleaning
* cleaning
* make aws-config optional
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* backend draft
* fix for tool and streaming
* do frontend side
* working
* working tools
* rm
* handle list endpoint
* handle for ai agents
* fix for models requiring inference id
* cleaning
* fix desc issue
* fix tool usage
* fix structured output
* cleaning
* fix for api
* rm
* fix input images
* cleaning
* chore: use aws sdk (#7156)
* feat(ai): Add AWS SDK dependencies for Bedrock integration
- Add aws-sdk-bedrockruntime v1.113.0
- Add aws-credential-types for bearer token authentication
- Update rustls to v0.23.35 for compatibility
- Dependencies added to windmill-common for AI features
* feat(ai): Add bearer token provider for Bedrock authentication
- Implement BearerTokenProvider using aws_credential_types
- Simple token-based auth using API keys from Windmill resources
- Add basic unit tests for provider creation
- Export bedrock_auth module in lib.rs
* feat(ai): Add Bedrock client wrapper with region extraction
- Implement BedrockClient wrapper around AWS SDK client
- Bearer token authentication integration
- Extract AWS region from Bedrock base URL automatically
- Comprehensive unit tests for region extraction
- Make aws-config non-optional dependency for AI features
- Update feature flags to reflect new dependency structure
* cargo
* feat(ai): Implement non-streaming Bedrock via AWS SDK
Use official AWS SDK instead of manual HTTP requests for better type safety and maintainability. Implements the Bedrock converse() API for non-streaming requests with proper bearer token authentication and message format conversion between OpenAI and Bedrock formats.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(ai): Eliminate Simple* conversion types for Bedrock SDK
- Move AI types to windmill-common/src/ai_types.rs for shared access
- Update bedrock_converters to work directly with OpenAI types
- Remove ~200 lines of conversion boilerplate from ai_executor.rs and bedrock.rs
- Remove unused imports to clean compilation warnings
- Benefits: 50% fewer conversion steps, no information loss, easier maintenance
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(ai): Add streaming support for AWS Bedrock SDK
- Implement converse_stream() for Bedrock streaming responses
- Use EventReceiver.recv() to process stream events
- Extract text deltas using bedrock_stream_event_to_text()
- Send TokenDelta events to StreamEventProcessor for real-time updates
- Refactor request building to eliminate duplication between streaming and non-streaming
- Clean, minimal implementation following AWS SDK patterns
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* revert flake change
* fix
* feat(ai): Add tool calls and image support for Bedrock streaming
**Phase 1: Streaming Tool Call Support**
- Add stream event processing functions in bedrock_converters.rs:
- bedrock_stream_event_to_tool_start() - Extract tool use start from ContentBlockStart
- bedrock_stream_event_to_tool_delta() - Extract tool input deltas from ContentBlockDelta
- bedrock_stream_event_is_block_stop() - Detect ContentBlockStop events
- streaming_tool_calls_to_openai() - Convert accumulated tool calls to OpenAI format
- Update ai_executor.rs streaming loop with tool call accumulator (HashMap)
- Track current tool use ID during streaming
- Send ToolCallArguments events to StreamEventProcessor
- Return accumulated tool calls instead of empty vector
**Phase 2: Image Input Support**
- Add parse_image_data_url() to extract format and base64 data from data URLs
- Add content_part_to_block() to convert ContentPart to Bedrock ContentBlock
- Refactor convert_message() to handle multi-part content with images
- Support ImageUrl conversion to Bedrock ImageBlock with proper format (png/jpeg/gif/webp)
- Import AWS SDK image types: ImageBlock, ImageSource, ImageFormat
- Keep content_to_text() helper for system message text extraction
**Benefits**:
- ✅ Tool calling now works in both streaming and non-streaming modes
- ✅ Images are properly converted instead of being silently dropped
- ✅ Structured output works in streaming (uses tool calling)
- ✅ Full feature parity with manual HTTP implementation
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* cleaning
* fix(ai): Add S3 image support and structured output for Bedrock
**Fixes:**
1. **S3 Image Support**: Call prepare_messages_for_api() before Bedrock SDK path to convert S3Objects to ImageUrls
- Downloads images from S3 and encodes as base64 data URLs
- Ensures images are properly handled in both streaming and non-streaming modes
2. **Structured Output**: Add ToolChoice::Any when structured output tool is present
- Forces Bedrock to call the structured_output tool
- Ensures JSON schema compliance for structured output
- Works in both streaming and non-streaming modes
**Changes:**
- ai_executor.rs: Call prepare_messages_for_api() for Bedrock SDK path
- ai_executor.rs: Set tool_choice to Any when structured_output_tool_name is present
- aws_bedrock.rs: Remove unused ToolChoice imports (used via full path in worker)
**Testing:**
- ✅ S3 images are now downloaded and converted before API call
- ✅ Structured output now forces tool usage with ToolChoice::Any
- ✅ Both work in streaming and non-streaming modes
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* cleaning
* cleaning
* cleaning
* better error
* cleaning
* cleaning
* rm
* rename
* apply region
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix default
* no panic
* no print
* use utils file
* cleaning
---------
Co-authored-by: Claude <noreply@anthropic.com>
centdix
Ruben Fiszel