* feat(bedrock): support aws_bedrock_project_id for bedrock-mantle project association
Adds a litellm_params field to associate bedrock-mantle requests with an
Amazon Bedrock project, sent as the OpenAI-Project header on the
OpenAI-compatible chat and responses paths and as the anthropic-workspace
header on the Anthropic messages paths. This lets a single model entry opt
into a project-scoped data retention mode (e.g. provider_data_share for
Claude Fable 5) while the account-wide setting stays on default.
The param is carried via litellm_params only and is explicitly excluded
from optional_params so it can never leak into a request body.
Fixes#30070
* chore(ui): regenerate schema.d.ts for aws_bedrock_project_id
Generated with npm run gen:api after adding the field to LiteLLM_Params
* fix(proxy): ban client-supplied aws_bedrock_project_id in request bodies
The deployment pins aws_bedrock_project_id so the project's data
retention policy applies to its requests. Without this guard an
authenticated caller could supply the field in the request body and,
since client kwargs win the router merge, run requests under any
project reachable with the deployment's shared AWS credentials.
Adds the field to _BANNED_REQUEST_BODY_PARAMS so it is rejected at the
auth boundary by default while remaining available through the existing
admin opt-ins (allow_client_side_credentials proxy-wide or
configurable_clientside_auth_params per deployment).
49ca04d8c3