Gateway adds Bedrock Mantle and Google Cloud upstreams and a per-upstream models list

What

The self-hosted model gateway sits between Claude Code and the model provider and forwards requests to one or more upstreams. An upstream is a provider endpoint the gateway sends requests to. The gateway config now accepts two new upstream providers, and upstreams can be limited to a list of models.

• mantle (AWS Bedrock Mantle):
  • Needs a region and at least one entry in models. The list holds the models your AWS account has on Mantle, named as clients send them, for example models: [claude-opus-4-7, claude-haiku-4-5]. Only those models go to this upstream.
  • Defaults to https://bedrock-mantle.<region>.api.aws/anthropic.
  • Signs in with an AWS bearer token, an access key and secret, or AWS's default credential chain. aws_access_key_id and aws_secret_access_key must be set together, and both are required with aws_session_token.
  • CLAUDE_CODE_SKIP_AWS_CRED_CACHE skips the cached credential lookup.
  • Validation rejects a mantle upstream placed beside a bedrock upstream that has a guardrail.
• anthropicGoogleCloud:
  • Needs project_id and workspace_id. location defaults to global.
  • Signs in with access_token or Google's own sign-in, optionally with service_account_json.
• Per-upstream models list: when choosing where to send a model, the gateway first checks the upstream's optional models list, matching without regard to capitals or by the model's canonical id. A model not on the list is skipped with an error such as "is not served by upstream". Before, there was no such filter.
• New config warnings cover Mantle model entries that route nowhere, mappings that never apply, and bedrock per-developer attribution not carrying over to Mantle.

Why

Gateway operators can now route to Bedrock Mantle and Google Cloud's Anthropic endpoint, and send each model only to the upstreams that serve it. A mantle upstream without a models list is a config error, so add one when you set it up.