fix(ai): complete plain-key self-hosting path (#1584)

* feat(ai): resolve the Claude backend from the environment Tier 1 of #1406: a self-hosted deployment can now run every AI feature on a plain ANTHROPIC_API_KEY, with no AWS account. Hosted behaviour is unchanged. lib/ai/provider.ts resolves the backend once, from the environment: AI_PROVIDER explicit override, bedrock|anthropic AWS static key pair Bedrock ANTHROPIC_API_KEY the direct Anthropic API nothing set Bedrock, so the AWS credential provider chain (instance profile, IRSA) still resolves Bedrock deliberately wins when both credential sets are present. EU residency in eu-north-1 is a BFL/GDPR posture rather than a default, so adding an Anthropic key for an experiment must not silently move production inference out of the region. AI_PROVIDER is the way to say you meant it. Model ids are written bare in code and prefixed to eu.anthropic.* only for Bedrock, which needs the cross-region inference profile for on-demand throughput. An operator override that already carries a prefix passes through untouched, so BEDROCK_MODEL_ID and friends keep working as written. Converted call sites: the agent composer, invoice-inbox extraction, the document-extraction model label, and both receipt-hunt clients. The last two are not named in the issue, which predates receipt-hunt landing in main. @anthropic-ai/sdk is declared at 0.95.0, the version @anthropic-ai/bedrock-sdk 0.29.1 already pulled in transitively, so the lockfile dedupes to one copy with no new download. scripts/smoke-bedrock.ts becomes scripts/smoke-ai.ts and grows two steps. Unit tests can only prove which provider and model id get resolved; they cannot prove the resulting request is one the backend accepts. The script now sends real traffic over all three shapes the app uses: a plain create, a streamed turn carrying adaptive thinking, an effort level, an hour-long cache breakpoint and a tool, and document extraction end to end when given a file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Bjorn Bergenheim <29535152+bjornbergenheim@users.noreply.github.com> * docs(self-hosting): document the AI smoke test The script added alongside the provider split is what closes the #1406 acceptance criterion ("document extraction and the assistant both work"), so a self-hoster needs to know it exists. Covers both invocations and states that it exits non-zero, which is what makes it usable as a post-deploy check. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Bjorn Bergenheim <29535152+bjornbergenheim@users.noreply.github.com> * test(ai): split the smoke test's thinking probe from its tool probe The combined probe could not falsify what it claimed to. It asked a question that needs a tool call, so the tool was used and adaptive thinking correctly declined to reason about it: the zero thinking-block count that came back was uninformative rather than a signal. 2a keeps the tool and drops thinking. 2b asks a question with several dependent steps (reverse charge, then a partial deduction, then the affected boxes) so that a model honouring the parameter must reason, and reports the thinking text length as well as the block count, since display:"summarized" can yield blocks with empty text. The cached system prompt is also padded past the 1024-token minimum cacheable prefix. Below that the API caches nothing and reports no error, so the old probe's cache counters read zero whether or not caching worked. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Bjorn Bergenheim <29535152+bjornbergenheim@users.noreply.github.com> * fix(document-extraction): stop requiring AWS_REGION in the manifest The extension now needs one of two credential sets, AWS static keys or ANTHROPIC_API_KEY, and the manifest schema cannot express "one of". Since requiredEnvVars only drives a build-time warning and never gates anything, listing AWS_REGION told every self-hoster running the direct API to set a variable that has no effect for them. The description was also still promising Sonnet 4.6 via Bedrock specifically, which is no longer what the extension does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Bjorn Bergenheim <29535152+bjornbergenheim@users.noreply.github.com> * fix(ai): read documentKind defensively in the smoke test The field arrived with the receipt-aware extraction work, so referencing it directly stops the script compiling against any checkout from before that landed. tsconfig includes **/*.ts and next.config does not disable type checking, so on such a checkout this failed the production build rather than just the script: caught while preparing a test branch for a self-hosted instance that had not synced yet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Bjorn Bergenheim <29535152+bjornbergenheim@users.noreply.github.com> * fix(deps): restore the nested @swc/helpers entry in the lockfile Declaring @anthropic-ai/sdk with `npm install --package-lock-only` also pruned node_modules/next-intl/node_modules/@swc/helpers@0.5.23, an optional peer entry the local npm 11 considers redundant and the image's npm 10.9.8 does not. The result passed every local check and failed `npm ci` inside the Docker build, which is the only place the lockfile is actually enforced. The lockfile is now the previous one plus the single root dependency line, verified with `npm ci --dry-run`. @anthropic-ai/sdk needed nothing else: it was already in the tree as a transitive dependency of @anthropic-ai/bedrock-sdk. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Bjorn Bergenheim <29535152+bjornbergenheim@users.noreply.github.com> * Update DECISIONS.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Docker documentation for AI provider credentials Clarify the role of credentials in AI provider selection and document extraction requirements. * Update SELF-HOSTING.md with smoke-ai script details Clarify usage of smoke-ai script for credential checks and document extraction. * Improve error handling and logging in smoke-ai script * fix(ai): complete plain-key self-hosting path Signed-off-by: Emil <emilmattsson14@gmail.com> --------- Signed-off-by: Bjorn Bergenheim <29535152+bjornbergenheim@users.noreply.github.com> Signed-off-by: Emil <emilmattsson14@gmail.com> Co-authored-by: Bjorn Bergenheim <29535152+bjornbergenheim@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2026-08-13 15:45:24 +02:00
parent 0c3864cae5
commit 3829b6add3
20 changed files with 755 additions and 149 deletions
@@ -1,75 +1,76 @@
-import AnthropicBedrock from '@anthropic-ai/bedrock-sdk'
+import {
+  createAiClient,
+  aiCredentialPrefix,
+  hasAiCredentials,
+  resolveAiProvider,
+  toProviderModelId,
+  type AiClient,
+} from '@/lib/ai/provider'
 import { createLogger } from '@/lib/logger'

-const log = createLogger('agent-bedrock-client')
+const log = createLogger('agent-ai-client')

-let cached: AnthropicBedrock | null = null
+let cached: AiClient | null = null

-// Single AnthropicBedrock client for the agent composer + chat loop. Matches
-// the credential surface the rest of the codebase already uses (see
-// extensions/general/invoice-inbox/lib/extract-invoice-fields.ts) so:
+// Single Claude client for the agent composer + chat loop. Which backend it
+// talks to is resolved from the environment by lib/ai/provider.ts:
 //
-//   1. There's no separate ANTHROPIC_API_KEY to provision and rotate.
-//   2. All Claude traffic stays in eu-north-1: important for Swedish
-//      accounting data under BFL retention.
-//   3. Failures and quotas show up in one AWS surface, not two.
+//   - Hosted runs on AWS Bedrock. All Claude traffic stays in eu-north-1,
+//     which matters for Swedish accounting data under BFL retention, and
+//     failures and quotas show up in one AWS surface rather than two.
+//   - Self-hosted deployments with no AWS account run against the direct
+//     Anthropic API with a plain ANTHROPIC_API_KEY.
 //
-// Trade-off vs. the direct Anthropic API: Bedrock's prompt-cache TTL is
-// 5 minutes (default) rather than the 1h the plan §10 specifies. We still
-// pass `cache_control: { type: 'ephemeral', ttl: '1h' }` in the system
-// prompt assembly: Bedrock currently ignores the explicit TTL and uses 5m.
-// Cache effectiveness drops on multi-minute gaps but the loop still works.
-// Revisit if/when Bedrock exposes longer TTLs or if cost forces the direct
-// API.
-export function getAnthropic(): AnthropicBedrock {
+// The two SDKs expose the same `messages.create` / `messages.stream` surface,
+// which is all this loop uses, so the split is confined to the factory.
+//
+// Prompt-cache TTL differs between them. We pass
+// `cache_control: { type: 'ephemeral', ttl: '1h' }` in the system prompt
+// assembly (plan §10); Bedrock ignores the explicit TTL and uses its 5 minute
+// default, while the direct API honours the hour. Cache effectiveness on
+// multi-minute gaps is therefore better on the direct path; the loop works
+// either way.
+export function getAnthropic(): AiClient {
  if (cached) return cached
-  const awsRegion = process.env.AWS_REGION || 'eu-north-1'
-  const awsAccessKey = process.env.AWS_ACCESS_KEY_ID
-  const awsSecretKey = process.env.AWS_SECRET_ACCESS_KEY

-  // Startup diagnostic: make a hosted misconfiguration visible in the logs
-  // instead of it surfacing only as an opaque "request ended without sending
-  // any chunks" at stream time. Runs once per cold start (the client is cached).
-  // Never logs a secret: only the region, presence booleans, and the 4-char
-  // access-key-id PREFIX (AKIA = long-term IAM user key; ASIA = STS/temporary
-  // role credential, i.e. a platform-injected one rather than ours).
-  if (!awsAccessKey || !awsSecretKey) {
-    log.error('agent Bedrock credentials not loaded from env', undefined, {
-      region: awsRegion,
-      hasAccessKeyId: !!awsAccessKey,
-      hasSecretAccessKey: !!awsSecretKey,
+  // Startup diagnostic: make a misconfiguration visible in the logs instead of
+  // it surfacing only as an opaque "request ended without sending any chunks"
+  // at stream time. Runs once per cold start (the client is cached). Never
+  // logs a secret: only the provider, a presence boolean, and the credential's
+  // non-secret prefix (see aiCredentialPrefix).
+  const provider = resolveAiProvider()
+  if (!hasAiCredentials()) {
+    log.error('agent AI credentials not loaded from env', undefined, {
+      provider,
+      hasCredentials: false,
      regionFromEnv: !!process.env.AWS_REGION,
    })
  } else {
-    log.info('agent Bedrock client init', {
-      region: awsRegion,
-      keyPrefix: awsAccessKey.slice(0, 4),
+    log.info('agent AI client init', {
+      provider,
+      keyPrefix: aiCredentialPrefix(),
      hasSessionToken: !!process.env.AWS_SESSION_TOKEN,
      regionFromEnv: !!process.env.AWS_REGION,
    })
  }

-  // When both static keys are present, pass them. Otherwise omit them so the
-  // SDK falls back to the AWS credential provider chain (instance profile,
-  // IRSA, EKS pod identity, ...). The two-overload SDK refuses a mix.
-  cached =
-    awsAccessKey && awsSecretKey
-      ? new AnthropicBedrock({ awsRegion, awsAccessKey, awsSecretKey })
-      : new AnthropicBedrock({ awsRegion })
+  cached = createAiClient()
  return cached
 }

-// Bedrock model IDs. Region prefix `eu.` keeps inference inside eu-north-1
-// (a bare `anthropic.claude-sonnet-5` is rejected: on-demand throughput needs
-// the cross-region inference profile). Both are env-overridable so ops can
-// swap models without a code deploy.
+// Model ids, written bare and adapted to the resolved provider: Bedrock needs
+// the `eu.` inference-profile prefix, the direct API needs it absent. Both stay
+// env-overridable so ops can swap models without a code deploy; an override is
+// used verbatim, in whichever form the provider it was written for expects.
 //
-// Both point at Sonnet 5, verified enabled on this Bedrock account. The two
-// names are kept because the intents split on them: OPUS_MODEL marks the
+// Both point at Sonnet 5, verified enabled on the hosted Bedrock account. The
+// two names are kept because the intents split on them: OPUS_MODEL marks the
 // heavy-reasoning intents (supplier-invoice review, VAT review, bokslut) so
 // that split survives if a genuinely larger model is enabled here later.
-export const OPUS_MODEL = process.env.BEDROCK_OPUS_MODEL_ID || 'eu.anthropic.claude-sonnet-5'
-export const SONNET_MODEL = process.env.BEDROCK_SONNET_MODEL_ID || 'eu.anthropic.claude-sonnet-5'
+export const OPUS_MODEL =
+  toProviderModelId(process.env.BEDROCK_OPUS_MODEL_ID || 'claude-sonnet-5')
+export const SONNET_MODEL =
+  toProviderModelId(process.env.BEDROCK_SONNET_MODEL_ID || 'claude-sonnet-5')

 // Reasoning depth for the chat intents.
 //
@@ -0,0 +1,183 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import Anthropic from '@anthropic-ai/sdk'
+import AnthropicBedrock from '@anthropic-ai/bedrock-sdk'
+import {
+  aiCredentialPrefix,
+  createAiClient,
+  hasAiCredentials,
+  resolveAiProvider,
+  toProviderModelId,
+} from '../provider'
+
+const AI_ENV_KEYS = [
+  'AI_PROVIDER',
+  'ANTHROPIC_API_KEY',
+  'AWS_ACCESS_KEY_ID',
+  'AWS_SECRET_ACCESS_KEY',
+  'AWS_REGION',
+] as const
+
+let saved: Partial<Record<(typeof AI_ENV_KEYS)[number], string | undefined>> = {}
+
+beforeEach(() => {
+  saved = {}
+  for (const key of AI_ENV_KEYS) {
+    saved[key] = process.env[key]
+    delete process.env[key]
+  }
+})
+
+afterEach(() => {
+  for (const key of AI_ENV_KEYS) {
+    if (saved[key] === undefined) delete process.env[key]
+    else process.env[key] = saved[key]
+  }
+})
+
+describe('resolveAiProvider', () => {
+  it('uses Bedrock when static AWS keys are set (hosted stays unchanged)', () => {
+    process.env.AWS_ACCESS_KEY_ID = 'AKIAEXAMPLE'
+    process.env.AWS_SECRET_ACCESS_KEY = 'secret'
+    expect(resolveAiProvider()).toBe('bedrock')
+  })
+
+  it('uses the direct API when only an Anthropic key is set (self-hosted)', () => {
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-api03-example'
+    expect(resolveAiProvider()).toBe('anthropic')
+  })
+
+  // The load-bearing precedence case: an operator who adds an Anthropic key
+  // for a side experiment must not silently move production inference out of
+  // eu-north-1, which is a deliberate BFL/GDPR posture rather than a default.
+  it('prefers Bedrock when both credential sets are present', () => {
+    process.env.AWS_ACCESS_KEY_ID = 'AKIAEXAMPLE'
+    process.env.AWS_SECRET_ACCESS_KEY = 'secret'
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-api03-example'
+    expect(resolveAiProvider()).toBe('bedrock')
+  })
+
+  it('lets AI_PROVIDER override the credential-based guess, both ways', () => {
+    process.env.AWS_ACCESS_KEY_ID = 'AKIAEXAMPLE'
+    process.env.AWS_SECRET_ACCESS_KEY = 'secret'
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-api03-example'
+
+    process.env.AI_PROVIDER = 'anthropic'
+    expect(resolveAiProvider()).toBe('anthropic')
+
+    process.env.AI_PROVIDER = 'bedrock'
+    expect(resolveAiProvider()).toBe('bedrock')
+  })
+
+  it('accepts AI_PROVIDER case-insensitively and trimmed', () => {
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-api03-example'
+    process.env.AI_PROVIDER = '  Bedrock '
+    expect(resolveAiProvider()).toBe('bedrock')
+  })
+
+  it('ignores an unrecognised AI_PROVIDER rather than failing closed', () => {
+    process.env.AI_PROVIDER = 'openai'
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-api03-example'
+    expect(resolveAiProvider()).toBe('anthropic')
+  })
+
+  // Hosted infrastructure that injects credentials via instance profile / IRSA
+  // sets no env vars at all: that must still resolve to Bedrock so the AWS
+  // credential provider chain gets its chance.
+  it('falls back to Bedrock when nothing is configured', () => {
+    expect(resolveAiProvider()).toBe('bedrock')
+  })
+})
+
+describe('hasAiCredentials', () => {
+  it('is true for a complete AWS static key pair', () => {
+    process.env.AWS_ACCESS_KEY_ID = 'AKIAEXAMPLE'
+    process.env.AWS_SECRET_ACCESS_KEY = 'secret'
+    expect(hasAiCredentials()).toBe(true)
+  })
+
+  it('is false for a half-configured AWS key pair', () => {
+    process.env.AWS_ACCESS_KEY_ID = 'AKIAEXAMPLE'
+    expect(hasAiCredentials()).toBe(false)
+  })
+
+  it('is true for an Anthropic key', () => {
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-api03-example'
+    expect(hasAiCredentials()).toBe(true)
+  })
+
+  it('is false when nothing is configured', () => {
+    expect(hasAiCredentials()).toBe(false)
+  })
+
+  // AI_PROVIDER names the backend but does not conjure a credential for it.
+  it('is false when AI_PROVIDER names a backend with no key', () => {
+    process.env.AI_PROVIDER = 'anthropic'
+    process.env.AWS_ACCESS_KEY_ID = 'AKIAEXAMPLE'
+    process.env.AWS_SECRET_ACCESS_KEY = 'secret'
+    expect(hasAiCredentials()).toBe(false)
+  })
+})
+
+describe('createAiClient', () => {
+  it('builds a Bedrock client when AWS keys are set', () => {
+    process.env.AWS_ACCESS_KEY_ID = 'AKIAEXAMPLE'
+    process.env.AWS_SECRET_ACCESS_KEY = 'secret'
+    expect(createAiClient()).toBeInstanceOf(AnthropicBedrock)
+  })
+
+  it('builds a direct Anthropic client when only an Anthropic key is set', () => {
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-api03-example'
+    expect(createAiClient()).toBeInstanceOf(Anthropic)
+  })
+
+  it('builds a Bedrock client for the AWS provider chain when nothing is set', () => {
+    expect(createAiClient()).toBeInstanceOf(AnthropicBedrock)
+  })
+})
+
+describe('toProviderModelId', () => {
+  it('passes the bare id through for the direct API', () => {
+    expect(toProviderModelId('claude-sonnet-5', 'anthropic')).toBe('claude-sonnet-5')
+  })
+
+  it('adds the eu inference-profile prefix for Bedrock', () => {
+    expect(toProviderModelId('claude-sonnet-5', 'bedrock')).toBe('eu.anthropic.claude-sonnet-5')
+  })
+
+  // An operator override may already be written in provider form; prefixing it
+  // again would produce eu.anthropic.eu.anthropic.… and 404 at call time.
+  it('leaves an already-prefixed id alone', () => {
+    expect(toProviderModelId('eu.anthropic.claude-sonnet-5', 'bedrock')).toBe(
+      'eu.anthropic.claude-sonnet-5'
+    )
+    expect(toProviderModelId('anthropic.claude-sonnet-5', 'bedrock')).toBe(
+      'anthropic.claude-sonnet-5'
+    )
+  })
+
+  it('defaults to the environment-resolved provider', () => {
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-api03-example'
+    expect(toProviderModelId('claude-sonnet-5')).toBe('claude-sonnet-5')
+  })
+})
+
+describe('aiCredentialPrefix', () => {
+  it('returns only the non-secret Anthropic key prefix', () => {
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-api03-SECRETSECRETSECRET'
+    const prefix = aiCredentialPrefix()
+    expect(prefix).toBe('sk-ant-api03')
+    expect(prefix).not.toContain('SECRET')
+  })
+
+  it('returns only the AWS access-key-id class prefix', () => {
+    process.env.AWS_ACCESS_KEY_ID = 'AKIASECRETSECRET'
+    process.env.AWS_SECRET_ACCESS_KEY = 'secret'
+    const prefix = aiCredentialPrefix()
+    expect(prefix).toBe('AKIA')
+    expect(prefix).not.toContain('SECRET')
+  })
+
+  it('returns null when nothing is configured', () => {
+    expect(aiCredentialPrefix()).toBeNull()
+  })
+})
@@ -0,0 +1,117 @@
+import Anthropic from '@anthropic-ai/sdk'
+import AnthropicBedrock from '@anthropic-ai/bedrock-sdk'
+
+/**
+ * Which backend Claude traffic goes to.
+ *
+ * Hosted runs on AWS Bedrock: keeping inference inside eu-north-1 is a
+ * deliberate BFL/GDPR posture for Swedish accounting data, not an
+ * implementation detail. Self-hosted deployments generally have no AWS
+ * account at all, so they get the direct Anthropic API with a plain
+ * ANTHROPIC_API_KEY.
+ *
+ * See https://github.com/erp-mafia/accounted/issues/1406.
+ */
+export type AiProvider = 'bedrock' | 'anthropic'
+
+export type AiClient = Anthropic | AnthropicBedrock
+
+/**
+ * Resolve the provider from the environment, or null when neither backend has
+ * usable credentials.
+ *
+ * Precedence is deliberate:
+ *
+ *   1. `AI_PROVIDER` wins when set. The escape hatch for a deployment that has
+ *      both credential sets and needs to say which one it means.
+ *   2. Static AWS keys mean Bedrock. This is what keeps hosted byte-identical:
+ *      an operator who adds an Anthropic key for a side experiment must not
+ *      silently move production inference out of eu-north-1.
+ *   3. Otherwise an Anthropic key means the direct API. This is the
+ *      self-hosted path.
+ *   4. Otherwise Bedrock without static keys, so the AWS credential provider
+ *      chain (instance profile, IRSA, EKS pod identity) still resolves on
+ *      hosted infrastructure that injects credentials rather than setting env
+ *      vars. `hasAiCredentials()` reports false here: we cannot see the chain
+ *      from this side, so callers that need a cheap pre-flight treat it as
+ *      unconfigured rather than paying a request to find out.
+ */
+export function resolveAiProvider(): AiProvider {
+  const explicit = (process.env.AI_PROVIDER ?? '').trim().toLowerCase()
+  if (explicit === 'bedrock' || explicit === 'anthropic') return explicit
+
+  if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) return 'bedrock'
+  if (process.env.ANTHROPIC_API_KEY) return 'anthropic'
+  return 'bedrock'
+}
+
+/**
+ * Whether this deployment has credentials we can see from the environment.
+ *
+ * Used by call sites that must degrade quietly rather than throw: document
+ * extraction returns an empty result instead of failing an upload. Returns
+ * false for the AWS provider chain (case 4 above) because it is not visible
+ * here; that path was already treated the same way before the direct-API
+ * option existed.
+ */
+export function hasAiCredentials(): boolean {
+  return resolveAiProvider() === 'anthropic'
+    ? !!process.env.ANTHROPIC_API_KEY
+    : !!(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY)
+}
+
+/**
+ * Build a client for the resolved provider. Both expose the same
+ * `messages.create` / `messages.stream` surface, which is all this codebase
+ * uses of either SDK.
+ */
+export function createAiClient(): AiClient {
+  if (resolveAiProvider() === 'anthropic') {
+    const apiKey = process.env.ANTHROPIC_API_KEY
+    // Omit the key when unset so the SDK resolves it itself and fails at call
+    // time: throwing here would take down every route that merely imports a
+    // module touching AI.
+    return apiKey ? new Anthropic({ apiKey }) : new Anthropic()
+  }
+
+  const awsRegion = process.env.AWS_REGION || 'eu-north-1'
+  const awsAccessKey = process.env.AWS_ACCESS_KEY_ID
+  const awsSecretKey = process.env.AWS_SECRET_ACCESS_KEY
+  // When both static keys are present, pass them. Otherwise omit them so the
+  // SDK falls back to the AWS credential provider chain. The two-overload SDK
+  // refuses a mix.
+  return awsAccessKey && awsSecretKey
+    ? new AnthropicBedrock({ awsRegion, awsAccessKey, awsSecretKey })
+    : new AnthropicBedrock({ awsRegion })
+}
+
+/**
+ * Map a bare Anthropic model id to the form the resolved provider expects.
+ *
+ * Bedrock needs the `eu.` inference-profile prefix: a bare
+ * `anthropic.claude-sonnet-5` is rejected because on-demand throughput
+ * requires the cross-region profile. The direct API takes the bare id and
+ * rejects both prefixes.
+ *
+ * Ids that already carry a provider prefix pass through untouched, so an
+ * operator-supplied override in either form keeps working.
+ */
+export function toProviderModelId(bareModelId: string, provider = resolveAiProvider()): string {
+  if (provider === 'anthropic') return bareModelId
+  if (bareModelId.startsWith('eu.') || bareModelId.startsWith('anthropic.')) return bareModelId
+  return `eu.anthropic.${bareModelId}`
+}
+
+/**
+ * Non-secret identification of the configured credential, for startup logs.
+ * Anthropic keys carry a public prefix (`sk-ant-api03` for a standard API key,
+ * `sk-ant-oat` for an OAuth token); AWS access key ids carry `AKIA` for a
+ * long-term IAM user key and `ASIA` for an STS/role credential. Never returns
+ * any part of a secret.
+ */
+export function aiCredentialPrefix(): string | null {
+  if (resolveAiProvider() === 'anthropic') {
+    return process.env.ANTHROPIC_API_KEY?.slice(0, 12) ?? null
+  }
+  return process.env.AWS_ACCESS_KEY_ID?.slice(0, 4) ?? null
+}
@@ -113,7 +113,7 @@ export const EXTENSION_DEFINITIONS: Record<string, ExtensionDefinition[]> = {
          "icon": "MessageCircle",
          "dataPattern": "both",
          "description": "Läser kvitton och fakturor med AI och fyller i leverantör, belopp, moms och datum automatiskt",
-          "longDescription": "Lyssnar på document.uploaded-händelser och kör Sonnet 4.6 via AWS Bedrock på varje uppladdat kvitto eller faktura (PDF eller bild). De extraherade fälten skrivs till document_attachments.extracted_data så att den specialiserade bokföringsassistenten kan föreslå rätt BAS-konto utan att fråga användaren om sådant som redan står på underlaget. Hoppar över dokument som redan extraherats av andra extensions (t.ex. invoice-inbox) för att undvika dubbla AI-anrop.",
+          "longDescription": "Lyssnar på document.uploaded-händelser och kör Claude på varje uppladdat kvitto eller faktura (PDF eller bild), via AWS Bedrock eller Anthropics API beroende på vilka nycklar som är satta. De extraherade fälten skrivs till document_attachments.extracted_data så att den specialiserade bokföringsassistenten kan föreslå rätt BAS-konto utan att fråga användaren om sådant som redan står på underlaget. Hoppar över dokument som redan extraherats av andra extensions (t.ex. invoice-inbox) för att undvika dubbla AI-anrop.",
          "readsCoreTables": [
                "document_attachments",
                "invoice_inbox_items"
@@ -9,10 +9,9 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'
 import type { UncertainPair } from '../adjudicate'

 const mockCreate = vi.fn()
-vi.mock('@anthropic-ai/bedrock-sdk', () => ({
-  default: class {
-    messages = { create: (...args: unknown[]) => mockCreate(...args) }
-  },
+vi.mock('@/lib/ai/provider', () => ({
+  createAiClient: () => ({ messages: { create: (...args: unknown[]) => mockCreate(...args) } }),
+  toProviderModelId: (id: string) => id,
 }))

 import { adjudicate } from '../adjudicate'
@@ -7,10 +7,9 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'

 const mockCreate = vi.fn()
-vi.mock('@anthropic-ai/bedrock-sdk', () => ({
-  default: class {
-    messages = { create: (...args: unknown[]) => mockCreate(...args) }
-  },
+vi.mock('@/lib/ai/provider', () => ({
+  createAiClient: () => ({ messages: { create: (...args: unknown[]) => mockCreate(...args) } }),
+  toProviderModelId: (id: string) => id,
 }))

 import { extractMailDocuments, type CandidateForReview } from '../mail-intelligence'
@@ -23,16 +23,17 @@
 * human approves, carrying the reason so the approval is checking an argument
 * rather than trusting a verdict.
 */
-import AnthropicBedrock from '@anthropic-ai/bedrock-sdk'
 import { z } from 'zod'
+import { createAiClient, toProviderModelId, type AiClient } from '@/lib/ai/provider'
 import { createLogger } from '@/lib/logger'

 const log = createLogger('receipt-hunt-adjudicate')

-const MODEL =
+const MODEL = toProviderModelId(
  process.env.RECEIPT_HUNT_MODEL_ID ||
-  process.env.BEDROCK_MODEL_ID ||
-  'eu.anthropic.claude-sonnet-5'
+    process.env.BEDROCK_MODEL_ID ||
+    'claude-sonnet-5'
+)

 export interface UncertainPair {
  /** Stable handle for this pair, opaque to the model beyond matching it back. */
@@ -134,8 +135,8 @@ kan väga.

 reason: en kort mening på svenska om varför paret hör ihop eller inte.`

-function client(): AnthropicBedrock {
-  return new AnthropicBedrock({ awsRegion: process.env.AWS_REGION })
+function client(): AiClient {
+  return createAiClient()
 }

 /**
@@ -21,8 +21,8 @@
 * afterwards by the same deterministic amount-and-merchant matcher that scores
 * every other underlag, so mail and Underlag get one matcher rather than two.
 */
-import AnthropicBedrock from '@anthropic-ai/bedrock-sdk'
 import { z } from 'zod'
+import { createAiClient, toProviderModelId, type AiClient } from '@/lib/ai/provider'
 import { createLogger } from '@/lib/logger'

 const log = createLogger('receipt-hunt-intelligence')
@@ -30,10 +30,11 @@ const log = createLogger('receipt-hunt-intelligence')
 /**
 * Overridable so ops can move the hunt off the default without a deploy.
 */
-const MODEL =
+const MODEL = toProviderModelId(
  process.env.RECEIPT_HUNT_MODEL_ID ||
-  process.env.BEDROCK_MODEL_ID ||
-  'eu.anthropic.claude-sonnet-5'
+    process.env.BEDROCK_MODEL_ID ||
+    'claude-sonnet-5'
+)

 export interface CandidateForReview {
  messageId: string
@@ -139,8 +140,8 @@ is_receipt=false och lämna resten null. Ta hellre med en osäker faktura än
 missa ett kvitto: en handling utan matchande belopp faller bort av sig själv
 senare.`

-function client(): AnthropicBedrock {
-  return new AnthropicBedrock({ awsRegion: process.env.AWS_REGION })
+function client(): AiClient {
+  return createAiClient()
 }

 async function ask(