fix(ai): preserve ambient AWS auth for Bedrock

Do not treat Pi’s internal ambient-auth marker as a Bedrock bearer token. This preserves SigV4 signing for AWS profiles, IAM credentials, and roles while retaining bearer authentication for real Bedrock API keys.\n\nFixes #6531

Author: ribelo

packages/ai/src/api/bedrock-converse-stream.ts

@@ -101,6 +101,7 @@ export interface BedrockOptions extends StreamOptions {
 type Block = (TextContent | ThinkingContent | ToolCall) & { index?: number; partialJson?: string };
 
 const EMPTY_TEXT_PLACEHOLDER = "<empty>";
+const AMBIENT_AUTH_MARKER = "<authenticated>";
 
 export const stream: StreamFunction<"bedrock-converse-stream", BedrockOptions> = (
 	model: Model<"bedrock-converse-stream">,
@@ -153,7 +154,7 @@ export const stream: StreamFunction<"bedrock-converse-stream", BedrockOptions> =
 		const skipAuth = getProviderEnvValue("AWS_BEDROCK_SKIP_AUTH", options.env) === "1";
 		const bearerToken =
 			options.bearerToken ||
-			options.apiKey ||
+			(options.apiKey !== AMBIENT_AUTH_MARKER ? options.apiKey : undefined) ||
 			getProviderEnvValue("AWS_BEARER_TOKEN_BEDROCK", options.env) ||
 			undefined;
 		const useBearerToken = bearerToken !== undefined && !skipAuth;

packages/ai/test/bedrock-endpoint-resolution.test.ts

@@ -190,4 +190,13 @@ describe("bedrock endpoint resolution", () => {
 		expect(config.token).toEqual({ token: "bedrock-api-key" });
 		expect(config.authSchemePreference).toEqual(["httpBearerAuth"]);
 	});
+
+	it("does not use the ambient AWS auth marker as a bearer token", async () => {
+		const model = getModel("amazon-bedrock", "us.anthropic.claude-opus-4-8");
+
+		const config = await captureClientConfig(model, { apiKey: "<authenticated>" });
+
+		expect(config.token).toBeUndefined();
+		expect(config.authSchemePreference).toBeUndefined();
+	});
 });