feat(bedrock): pass client logger to AWS credential provider chain (SDK-90) (#29)

Plumb the client's logger (via loggerFor, which honors logLevel) into
fromNodeProviderChain() and its clientConfig in the default provider
chain resolvers, so end users (e.g. Claude Code) can debug AWS auth
issues. Applied to AnthropicBedrock, AnthropicBedrockMantle, and
AnthropicAws (bedrock-sdk/src/core/aws-auth.ts is a symlink to
aws-sdk/src/core/auth.ts; both packages updated).

The constructor deprecation-warning tests now inject a per-test logger
instead of spying on console.warn: loggerFor() caches bound log
functions per logger object, so once any earlier test triggers a
request, a later console.warn spy is bypassed by the cached binding.

Linear: SDK-90

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

:house: Remote-Dev: homespace

Author: ant-kurt

packages/aws-sdk/src/client.ts

@@ -5,6 +5,7 @@ import { readEnv } from './internal/utils';
 import { Anthropic, APIRequest, ClientOptions } from '@anthropic-ai/sdk/client';
 export { BaseAnthropic } from '@anthropic-ai/sdk/client';
 import { AwsCredentialIdentityProvider } from '@smithy/types';
+import { loggerFor } from './internal/utils/log';
 import { loadConfig } from '@smithy/node-config-provider';
 import { NODE_REGION_CONFIG_OPTIONS, NODE_REGION_CONFIG_FILE_OPTIONS } from '@smithy/config-resolver';
 import { getAuthHeaders } from './core/auth';
@@ -293,6 +294,7 @@ export class AnthropicAws extends Anthropic {
       awsSessionToken: this.awsSessionToken,
       awsProfile: this.awsProfile,
       providerChainResolver: this.providerChainResolver,
+      logger: loggerFor(this),
     });
     // Signed headers take precedence: the signature must match what goes
     // over the wire, so it can't be overridden by other header sources.

packages/aws-sdk/src/core/auth.ts

@@ -7,6 +7,7 @@ import assert from 'assert';
 import { APIConnectionError } from './error';
 import { castToError } from '../internal/errors';
 import { MergedRequestInit } from '../internal/types';
+import { Logger } from '../internal/utils/log';
 
 export type AuthProps = {
   url: string;
@@ -18,14 +19,20 @@ export type AuthProps = {
   awsProfile?: string | null | undefined;
   fetchOptions?: MergedRequestInit | undefined;
   providerChainResolver?: (() => Promise<AwsCredentialIdentityProvider>) | null;
+  logger?: Logger | undefined;
 };
 
-const defaultProviderChainResolver = (profile?: string | null): Promise<AwsCredentialIdentityProvider> =>
+const defaultProviderChainResolver = (
+  profile?: string | null,
+  logger?: Logger | undefined,
+): Promise<AwsCredentialIdentityProvider> =>
   import('@aws-sdk/credential-providers')
     .then(({ fromNodeProviderChain }) =>
       fromNodeProviderChain({
         ...(profile != null ? { profile } : {}),
+        ...(logger != null ? { logger } : {}),
         clientConfig: {
+          ...(logger != null ? { logger } : {}),
           requestHandler: new FetchHttpHandler({
             requestInit: (httpRequest) => {
               return {
@@ -58,7 +65,7 @@ export const getAuthHeaders = async (req: RequestInit, props: AuthProps): Promis
   } else {
     const provider = await (props.providerChainResolver ?
       props.providerChainResolver()
-    : defaultProviderChainResolver(props.awsProfile));
+    : defaultProviderChainResolver(props.awsProfile, props.logger));
     try {
       credentials = await provider();
     } catch (err) {

packages/bedrock-sdk/src/client.ts

@@ -231,6 +231,7 @@ export class AnthropicBedrock extends BaseAnthropic {
         awsSessionToken: this.awsSessionToken,
         fetchOptions: this.fetchOptions,
         providerChainResolver: this.providerChainResolver,
+        logger: loggerFor(this),
       });
       // Signed headers take precedence: the signature must match what goes
       // over the wire, so it can't be overridden by other header sources.

packages/bedrock-sdk/src/core/auth.ts

@@ -7,6 +7,7 @@ import assert from 'assert';
 import { APIConnectionError } from './error';
 import { castToError } from '../internal/errors';
 import { MergedRequestInit } from '../internal/types';
+import { Logger } from '../internal/utils/log';
 
 type AuthProps = {
   url: string;
@@ -16,13 +17,18 @@ type AuthProps = {
   awsSessionToken: string | null | undefined;
   fetchOptions?: MergedRequestInit | undefined;
   providerChainResolver?: (() => Promise<AwsCredentialIdentityProvider>) | null;
+  logger?: Logger | undefined;
 };
 
-const DEFAULT_PROVIDER_CHAIN_RESOLVER: () => Promise<AwsCredentialIdentityProvider> = () =>
+const DEFAULT_PROVIDER_CHAIN_RESOLVER: (
+  logger?: Logger | undefined,
+) => Promise<AwsCredentialIdentityProvider> = (logger) =>
   import('@aws-sdk/credential-providers')
     .then(({ fromNodeProviderChain }) =>
       fromNodeProviderChain({
+        ...(logger != null ? { logger } : {}),
         clientConfig: {
+          ...(logger != null ? { logger } : {}),
           requestHandler: new FetchHttpHandler({
             requestInit: (httpRequest) => {
               return {
@@ -55,7 +61,7 @@ export const getAuthHeaders = async (req: RequestInit, props: AuthProps): Promis
   } else {
     const provider = await (props.providerChainResolver ?
       props.providerChainResolver()
-    : DEFAULT_PROVIDER_CHAIN_RESOLVER());
+    : DEFAULT_PROVIDER_CHAIN_RESOLVER(props.logger));
     try {
       credentials = await provider();
     } catch (err) {

packages/bedrock-sdk/src/mantle-client.ts

@@ -8,6 +8,7 @@ import { AwsCredentialIdentityProvider } from '@smithy/types';
 import { getAuthHeaders } from './core/aws-auth';
 import type { Middleware } from './core/middleware';
 import { FinalRequestOptions } from './internal/request-options';
+import { loggerFor } from './internal/utils/log';
 
 const DEFAULT_SERVICE_NAME = 'bedrock-mantle';
 
@@ -229,6 +230,7 @@ export class AnthropicBedrockMantle extends BaseAnthropic {
       awsSessionToken: this.awsSessionToken,
       awsProfile: this.awsProfile,
       providerChainResolver: this.providerChainResolver,
+      logger: loggerFor(this),
     });
     // Signed headers take precedence: the signature must match what goes
     // over the wire, so it can't be overridden by other header sources.

packages/bedrock-sdk/tests/client.test.ts

@@ -334,42 +334,47 @@ describe('middleware order (Bedrock adaptation runs inside user middleware)', ()
 });
 
 describe('AnthropicBedrock constructor deprecation warnings', () => {
-  let consoleWarnSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation();
-    jest.resetModules();
-  });
-
-  afterEach(() => {
-    consoleWarnSpy.mockRestore();
+  // Inject a fresh logger per test instead of spying on console.warn:
+  // loggerFor() caches bound log functions per logger object, so a
+  // console spy installed after the cache is populated is bypassed.
+  const makeLogger = () => ({
+    error: jest.fn(),
+    warn: jest.fn(),
+    info: jest.fn(),
+    debug: jest.fn(),
   });
 
   test('does not warn when both credentials are provided', () => {
+    const logger = makeLogger();
     new AnthropicBedrock({
       awsAccessKey: 'access-key',
       awsSecretKey: 'secret-key',
       awsRegion: 'us-east-1',
+      logger,
     });
 
-    expect(consoleWarnSpy).not.toHaveBeenCalled();
+    expect(logger.warn).not.toHaveBeenCalled();
   });
 
   test('does not warn when neither credential is provided', () => {
+    const logger = makeLogger();
     new AnthropicBedrock({
       awsRegion: 'us-east-1',
+      logger,
     });
 
-    expect(consoleWarnSpy).not.toHaveBeenCalled();
+    expect(logger.warn).not.toHaveBeenCalled();
   });
 
   test('warns when only one credential is provided', () => {
+    const logger = makeLogger();
     new AnthropicBedrock({
       awsAccessKey: 'access-key',
       awsRegion: 'us-east-1',
+      logger,
     });
 
-    expect(consoleWarnSpy).toHaveBeenCalledWith(
+    expect(logger.warn).toHaveBeenCalledWith(
       expect.stringContaining('Passing only one of `awsAccessKey` or `awsSecretKey` is deprecated'),
     );
   });