feat: add provider-scoped environment overrides (#5807)

packages/ai/test/bedrock-endpoint-resolution.test.ts

@@ -45,7 +45,7 @@ vi.mock("@aws-sdk/client-bedrock-runtime", () => {
 });
 
 import { getModel } from "../src/models.ts";
-import { streamBedrock } from "../src/providers/amazon-bedrock.ts";
+import { type BedrockOptions, streamBedrock } from "../src/providers/amazon-bedrock.ts";
 import type { Context, Model } from "../src/types.ts";
 
 const context: Context = {
@@ -83,8 +83,12 @@ afterEach(() => {
 	}
 });
 
-async function captureClientConfig(model: Model<"bedrock-converse-stream">): Promise<Record<string, unknown>> {
-	await streamBedrock(model, context, { cacheRetention: "none" }).result();
+async function captureClientConfig(
+	model: Model<"bedrock-converse-stream">,
+	options: BedrockOptions = {},
+): Promise<Record<string, unknown>> {
+	bedrockMock.constructorCalls.length = 0;
+	await streamBedrock(model, context, { cacheRetention: "none", ...options }).result();
 	expect(bedrockMock.constructorCalls).toHaveLength(1);
 	return bedrockMock.constructorCalls[0];
 }
@@ -115,6 +119,29 @@ describe("bedrock endpoint resolution", () => {
 		expect(config.region).toBe("eu-central-1");
 	});
 
+	it("handles missing regions for explicit, scoped, and ambient profiles", async () => {
+		const model = getModel("amazon-bedrock", "eu.anthropic.claude-sonnet-4-5-20250929-v1:0");
+
+		let config = await captureClientConfig(model, { profile: "bedrock-profile" });
+
+		expect(config.profile).toBe("bedrock-profile");
+		expect(config.endpoint).toBe("https://bedrock-runtime.eu-central-1.amazonaws.com");
+		expect(config.region).toBe("eu-central-1");
+
+		config = await captureClientConfig(model, { env: { AWS_PROFILE: "scoped-bedrock-profile" } });
+
+		expect(config.profile).toBe("scoped-bedrock-profile");
+		expect(config.endpoint).toBe("https://bedrock-runtime.eu-central-1.amazonaws.com");
+		expect(config.region).toBe("eu-central-1");
+
+		process.env.AWS_PROFILE = "ambient-bedrock-profile";
+		config = await captureClientConfig(model);
+
+		expect(config.profile).toBe("ambient-bedrock-profile");
+		expect(config.endpoint).toBeUndefined();
+		expect(config.region).toBeUndefined();
+	});
+
 	it("still passes custom Bedrock endpoints through to the SDK client", async () => {
 		process.env.AWS_REGION = "us-west-2";
 		const baseModel = getModel("amazon-bedrock", "us.anthropic.claude-opus-4-8");

packages/ai/test/node-http-proxy.test.ts

@@ -54,6 +54,17 @@ describe("node HTTP proxy resolution", () => {
 		);
 	});
 
+	it("prefers scoped proxy env aliases before process env aliases", () => {
+		resetProxyEnv();
+		process.env.https_proxy = "http://process-proxy.example:8080";
+
+		expect(
+			resolveHttpProxyUrlForTarget("https://bedrock-runtime.us-east-1.amazonaws.com", {
+				HTTPS_PROXY: "http://scoped-proxy.example:8080",
+			})?.toString(),
+		).toBe("http://scoped-proxy.example:8080/");
+	});
+
 	it("rejects SOCKS and PAC proxy URLs explicitly", () => {
 		resetProxyEnv();
 		process.env.HTTPS_PROXY = "socks5://proxy.example:1080";

packages/ai/test/openai-completions-empty-tools.test.ts

@@ -163,6 +163,31 @@ describe("openai-completions empty tools handling", () => {
 		expect(clientOptions.defaultHeaders?.["cf-aig-authorization"]).toBe("Bearer test");
 	});
 
+	it("uses provider env before process.env for Cloudflare AI Gateway base URL", async () => {
+		process.env.CLOUDFLARE_ACCOUNT_ID = "process-account";
+		process.env.CLOUDFLARE_GATEWAY_ID = "process-gateway";
+		const model = getModel("cloudflare-ai-gateway", "workers-ai/@cf/moonshotai/kimi-k2.6")!;
+
+		await streamSimple(
+			model,
+			{
+				messages: [{ role: "user", content: "hi", timestamp: Date.now() }],
+			},
+			{
+				apiKey: "test",
+				env: {
+					CLOUDFLARE_ACCOUNT_ID: "provider-account",
+					CLOUDFLARE_GATEWAY_ID: "provider-gateway",
+				},
+			},
+		).result();
+
+		const clientOptions = mockState.lastClientOptions as { baseURL?: string };
+		expect(clientOptions.baseURL).toBe(
+			"https://gateway.ai.cloudflare.com/v1/provider-account/provider-gateway/compat",
+		);
+	});
+
 	it("preserves inline upstream Authorization for Cloudflare AI Gateway BYOK requests", async () => {
 		process.env.CLOUDFLARE_ACCOUNT_ID = "account-id";
 		process.env.CLOUDFLARE_GATEWAY_ID = "gateway-id";