[STG-1573] Add providerOptions for extensible model auth (#1822)

## Summary

- Add `providerOptions` bag to model config schema for provider-specific
auth (Bedrock, Vertex, future providers) without polluting the shared
schema with vendor-specific fields
- Make `modelApiKey` optional so providers with non-API-key auth (e.g.
AWS SigV4) can work without it
- Server stores `modelClientOptions` from session start and reuses them
on subsequent act/observe/extract/execute calls — SDKs don't need to
reimplement this logic
- Send `modelClientOptions` (including `providerOptions`) in the session
start request body; server merges stored + per-request config

## What this enables

- **Bedrock**: pass `region`, `accessKeyId`, `secretAccessKey`,
`sessionToken` via `providerOptions`
- **Vertex**: pass `project`, `location`, `googleAuthOptions` via
`providerOptions`
- **Future providers**: any provider with non-standard auth just adds
fields to `providerOptions` — zero schema or server changes needed

## Architecture

```
SDK                          Server                       AI SDK
─────────────────────────    ─────────────────────────    ──────────────
modelClientOptions: {        Stores in session,           createAmazonBedrock({
  apiKey?,                   merges on each request,        apiKey,
  providerOptions: {    ──►  passes to V3 constructor ──►   region,
    region,                                                 accessKeyId,
    accessKeyId,             Server is vendor-agnostic:     secretAccessKey,
    ...                      just passes providerOptions    ...
  }                          through unchanged            })
}
```

## Linked PRs

- core: browserbase/core#8004

## Testing

<img width="694" height="945" alt="image"
src="https://github.com/user-attachments/assets/39dc4bd2-4008-4776-bcdb-cf3b5eefc726"
/>

<img width="748" height="641" alt="image"
src="https://github.com/user-attachments/assets/ab1c6bcf-322b-4e78-9a96-9dbc5045ba02"
/>

---------

Co-authored-by: Shrey Pandya <shrey@browserbase.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: ci-test <ci-test@example.com>
Co-authored-by: monadoid <sam.finton@gmail.com>

Author: 5 people

.changeset/green-mugs-explain.md

@@ -0,0 +1,5 @@
+---
+"@browserbasehq/stagehand": patch
+---
+
+Restore public variable schema support and align Bedrock provider config validation coverage after the main-branch rebase.

packages/core/examples/bedrock_api_key.ts

@@ -0,0 +1,77 @@
+/**
+ * This example shows how to run Stagehand with Amazon Bedrock using
+ * a short-term Bedrock API key.
+ *
+ * Required env vars:
+ * - AWS_REGION
+ * - BEDROCK_API_KEY
+ *
+ * Optional env vars:
+ * - BEDROCK_MODEL_ID (defaults to amazon.nova-pro-v1:0)
+ *
+ * Example command:
+ * AWS_REGION=us-east-1 BEDROCK_API_KEY=... pnpm --filter @browserbasehq/stagehand example -- bedrock_api_key
+ */
+import { Stagehand } from "../lib/v3/index.js";
+import { z } from "zod";
+
+const region = process.env.AWS_REGION;
+const apiKey = process.env.BEDROCK_API_KEY;
+const modelId = process.env.BEDROCK_MODEL_ID ?? "amazon.nova-pro-v1:0";
+const modelName = `bedrock/${modelId}`;
+
+if (!region) {
+  throw new Error("Set AWS_REGION before running the Bedrock API key example.");
+}
+
+if (!apiKey) {
+  throw new Error(
+    "Set BEDROCK_API_KEY before running the Bedrock API key example.",
+  );
+}
+
+async function main() {
+  const stagehand = new Stagehand({
+    env: "LOCAL",
+    verbose: 2,
+    model: {
+      modelName,
+      apiKey,
+      providerOptions: {
+        region,
+      },
+    },
+  });
+
+  try {
+    await stagehand.init();
+
+    const page = stagehand.context.pages()[0];
+    await page.goto("https://example.com");
+
+    const extraction = await stagehand.extract(
+      "Extract the page heading and the visible link text.",
+      z.object({
+        heading: z.string(),
+        linkText: z.string(),
+      }),
+    );
+
+    console.log(
+      JSON.stringify(
+        {
+          authMode: "bedrock-api-key",
+          modelName,
+          region,
+          extraction,
+        },
+        null,
+        2,
+      ),
+    );
+  } finally {
+    await stagehand.close();
+  }
+}
+
+void main();

packages/core/examples/bedrock_aws_credentials.ts

@@ -0,0 +1,85 @@
+/**
+ * This example shows how to run Stagehand with Amazon Bedrock using
+ * AWS credentials.
+ *
+ * Required env vars:
+ * - AWS_REGION
+ * - AWS_ACCESS_KEY_ID
+ * - AWS_SECRET_ACCESS_KEY
+ *
+ * Optional env vars:
+ * - AWS_SESSION_TOKEN
+ * - BEDROCK_MODEL_ID (defaults to amazon.nova-pro-v1:0)
+ *
+ * Example command:
+ * AWS_REGION=us-east-1 AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... pnpm --filter @browserbasehq/stagehand example -- bedrock_aws_credentials
+ */
+import { Stagehand } from "../lib/v3/index.js";
+import { z } from "zod";
+
+const region = process.env.AWS_REGION;
+const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+const sessionToken = process.env.AWS_SESSION_TOKEN;
+const modelId = process.env.BEDROCK_MODEL_ID ?? "amazon.nova-pro-v1:0";
+const modelName = `bedrock/${modelId}`;
+
+if (!region) {
+  throw new Error(
+    "Set AWS_REGION before running the Bedrock AWS credentials example.",
+  );
+}
+
+if (!accessKeyId || !secretAccessKey) {
+  throw new Error(
+    "Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY before running the Bedrock AWS credentials example.",
+  );
+}
+
+async function main() {
+  const stagehand = new Stagehand({
+    env: "LOCAL",
+    verbose: 2,
+    model: {
+      modelName,
+      providerOptions: {
+        region,
+        accessKeyId,
+        secretAccessKey,
+        ...(sessionToken ? { sessionToken } : {}),
+      },
+    },
+  });
+
+  try {
+    await stagehand.init();
+
+    const page = stagehand.context.pages()[0];
+    await page.goto("https://example.com");
+
+    const extraction = await stagehand.extract(
+      "Extract the page heading and the visible link text.",
+      z.object({
+        heading: z.string(),
+        linkText: z.string(),
+      }),
+    );
+
+    console.log(
+      JSON.stringify(
+        {
+          authMode: "aws-credentials",
+          modelName,
+          region,
+          extraction,
+        },
+        null,
+        2,
+      ),
+    );
+  } finally {
+    await stagehand.close();
+  }
+}
+
+void main();