first pass of merging in warp (doesn't build)

crates/managed_secrets_wasm/src/lib.rs

@@ -53,3 +53,66 @@ pub fn encrypt_anthropic_api_key_secret(
         &ManagedSecretValue::anthropic_api_key(api_key),
     )
 }
+
+/// Encrypt an Anthropic Bedrock API key secret.
+#[wasm_bindgen]
+pub fn encrypt_anthropic_bedrock_api_key_secret(
+    public_key_base64: &str,
+    actor_uid: &str,
+    secret_name: &str,
+    aws_bearer_token_bedrock: &str,
+    aws_region: &str,
+) -> Result<String, JsValue> {
+    do_encrypt(
+        public_key_base64,
+        actor_uid,
+        secret_name,
+        &ManagedSecretValue::anthropic_bedrock_api_key(aws_bearer_token_bedrock, aws_region),
+    )
+}
+
+/// Encrypt an Anthropic Bedrock access key secret.
+///
+/// `aws_session_token` is optional and may be `None` for persistent IAM credentials
+/// that do not require a session token.
+#[wasm_bindgen]
+pub fn encrypt_anthropic_bedrock_access_key_secret(
+    public_key_base64: &str,
+    actor_uid: &str,
+    secret_name: &str,
+    aws_access_key_id: &str,
+    aws_secret_access_key: &str,
+    aws_session_token: Option<String>,
+    aws_region: &str,
+) -> Result<String, JsValue> {
+    do_encrypt(
+        public_key_base64,
+        actor_uid,
+        secret_name,
+        &ManagedSecretValue::anthropic_bedrock_access_key(
+            aws_access_key_id,
+            aws_secret_access_key,
+            aws_session_token,
+            aws_region,
+        ),
+    )
+}
+
+/// Encrypt an OpenAI API key secret.
+///
+/// `base_url` is optional; when `None`, the harness uses the provider's default endpoint.
+#[wasm_bindgen]
+pub fn encrypt_openai_api_key_secret(
+    public_key_base64: &str,
+    actor_uid: &str,
+    secret_name: &str,
+    api_key: &str,
+    base_url: Option<String>,
+) -> Result<String, JsValue> {
+    do_encrypt(
+        public_key_base64,
+        actor_uid,
+        secret_name,
+        &ManagedSecretValue::openai_api_key(api_key, base_url),
+    )
+}