uPjO \UddlmZmZddlmZmZmZmZmZm Z ddl m Z m Z ddl mZddlmZddlmZmZddlmZerddlmZdd lmZdd lmZdd lmZed d hZ ee!d<dZ"ee!d<dZ#ee!d<de$de%fdZ&defdZ'e(ee$e)zfZ*de+de,e*ddfdZ-de.de,e*ddfdZ/de.de%de%de(e,e$e,e*ffd Z0d!ee+de(e,e$e,e*ffd"Z1d#e,e$de,e*ddfd$Z2e$e(e$e)fzZ3e e!d%<Gd&d'eZ4e(e3e4e$fZ5Gd(d)e Z6d*e7de)fd+Z8d,e+de,e5fd-Z9Gd.d/eZ:y)0)MappingSequence) TYPE_CHECKINGAnyFinalOptionalProtocol TypeAlias)ReadOnly TypedDict)verbose_proxy_logger)BaseTranslation)+effective_skip_system_message_for_guardrail)effective_skip_tool_message_for_guardrail)GenericGuardrailAPIInputs)CustomGuardrail)Logging)UserAPIKeyAuth) ProxyLoggingconversezconverse-stream_CONVERSE_ACTIONSzvnd.amazon.eventstream_EVENT_STREAM_CONTENT_TYPEz"application/vnd.amazon.eventstream_EVENT_STREAM_MEDIA_TYPEendpointreturncr|jdjd}t|xr |dtvS)N/)rstripsplitboolr)rpartss /home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/llms/bedrock/passthrough/guardrail_translation/handler.py_is_converse_endpointr$s4??3'--c2E ; 959(999cddlm}|S)z Fallback for non-Converse Bedrock routes (e.g. invoke). The generic handler scans the full request/response payload so blocking guardrails still run, matching how other passthrough providers are guarded. rPassThroughEndpointHandler)7litellm.llms.pass_through.guardrail_translation.handlerr(r's r#_generic_passthrough_handlerr*s  & ''r%nodeholdersNc|g}|r|j}t|trQ|jD]=\}}t|tr|s|j ||f-|j |?n[t|t rKt|D]=\}}t|tr|s|j ||f-|j |?|ryy)aX Record a (container, key) holder for every non-empty string value nested under an arbitrary JSON node, so prompt content a caller hides in fields like ``toolUse.input`` or ``toolResult.content[].json`` is still scanned and can be written back in place. Iterative to avoid unbounded recursion on deeply nested payloads. N)pop isinstancedictitemsstrappendlist enumerate)r+r,stackcurrentkeyvalueindexs r#_collect_stringsr;.s#'E ))+ gt $%mmo ( UeS)~6LL'  (  & )' 2 ( ueS)'78LL'  ( r%blockct|jd}t|tr|r|j|dfyyy)Ntext)getr/r2r3)r<r,r>s r#_collect_block_textr@Is4))F#D$v'"&r%body skip_system skip_toolcg}|s7|jdxsgD]}t|tst||!|jdxsgD]}t|ts|jdxsgD]}t|ts|r d|vsd|vrt|||jd}t|trt |jd||jd}t|ts|jdxsgD]:}t|tst||t |jd|< |jd} t| trt | jd |t |jd ||D cgc] \} } | |  } } } | |fScc} } w) a: Walk a Bedrock Converse request body and collect text content. Returns (texts, holders) where each holder is the (container, key) pair that owns the extracted string, so write-back mutates it in place. Besides top-level ``text`` blocks this scans the arbitrary-JSON fields a caller can hide prompt content in -- ``toolUse.input`` and ``toolResult.content[].json`` (alongside ``toolResult.content[].text``) -- as well as the request-level fields still forwarded to Bedrock that a caller can route blocked content through: ``toolConfig.tools`` (tool names, descriptions and input schemas) and ``additionalModelRequestFields``. Tool message blocks are skipped when tool messages are excluded, but tool definitions are always scanned to match the chat-completions guardrail path. systemmessagescontenttoolUse toolResultinputjson toolConfigtoolsadditionalModelRequestFields)r?r/r0r@r;) rArBrCr,r<messagetool_use tool_resultinner tool_config containerr8textss r#_extract_converse_textsrVOs&+-G XXh'-2 4E%&#E73 488J'-2E'4( [[+1r EEeT*i50LE4I w /yy+H(D) g!6@))L1K+t,(__Y7=2EE!%.+E7;(6):GDE EE&,/K+t$17;TXX<=wG9@A~y#IcNAEA '>Bs7G content_blockscZg}|D]}t|tst|||jd}t|trt |jd||jd}t|tr-|jd}t|tr t|||jd}t|ts|jdxsgD]}t|tst||!|D cgc] \}} ||  } }} | |fScc} }w)au Collect user-visible text from Bedrock Converse output content blocks. Covers ``text`` blocks plus the other content-bearing fields a model can emit -- ``toolUse.input``, ``reasoningContent.reasoningText.text`` and ``citationsContent.content[].text`` -- while leaving structural values such as reasoning signatures and citation sources untouched. rHrJreasoningContent reasoningTextcitationsContentrG)r/r0r@r?r;) rWr,r<rP reasoningreasoning_text citationscitedrTr8rUs r#_extract_converse_output_textsr`s +-G8%& E7+99Y' h % X\\'2G <II01 i &&]]?;N.$/#NG<II01 i &"y17R 8eT*'w7 88":AA~y#IcNAEA '>BsD'guardrailed_textsct|t|kr)tjdt|t|t|D] \}\}}|t|k\ry||||<"y)NzBedrockPassthroughGuardrailHandler: guardrail returned %d texts for %d extracted fields; the unreturned fields keep their original text)lenr warningr5)rar,idxrTr8s r#_write_back_textsrfsy G ,$$ O ! " L  "+7!30 i #'( ( *3/ #0r% _GroupKeyc4eZdZdZdedefdZdededdfdZy)_TextContainerzBJSON object whose ``key`` entry holds a guardrailable text string.r8rcyN)selfr8s r# __getitem__z_TextContainer.__getitem__r%r9Ncyrkrl)rmr8r9s r# __setitem__z_TextContainer.__setitem__ror%)__name__ __module__ __qualname____doc__r2rnrqrlr%r#riris$L2s2#2?s?3?d?r%ricBeZdZUdZeeed<eeee e fed<y) _StreamFramezCOne raw event-stream frame plus the guardrailable texts it carries.rawrUN) rrrsrtrur bytes__annotations__rtuplergr2rlr%r#rwrws(M % HU9c>23 44r%rwbufferc4ddl}|jd|dS)Nr!I)structunpack)r|rs r#_unpack_uint32rs ==v &q ))r%deltacg}t|ts|St|jdtr|j d|df|jd}t|tr3t|jdtr|j d|df|jd}t|tr3t|jdtr|j d|df|jd}t|trmt |jdxsgD]L\}}t|tst|jdts7|j d |f|dfN|S) aY Collect the user-visible text strings a Bedrock Converse ``contentBlockDelta`` can carry, matching the coverage of the non-streaming output handler. Each holder is ``(group_key, container, key)`` where ``container[key]`` is the text. ``group_key`` ties together fragments that belong to the same logical stream (e.g. a single mask token split across frames) so they are concatenated before guardrailing and redistributed afterwards. Structural values such as reasoning signatures, redacted reasoning and citation sources are left out so they are never rewritten. r>rHrJtoolrYr\r[rGcitation)r/r0r?r2r3r5)rr,rPr\r^r:r_s r#"_collect_stream_delta_text_holdersrs5*,G eT "%))F#S)v./ii *H(D!jg1F&L'23yy!34I)T"z)--2G'M Y78yy!34I)T"%immI&>&D"E ELE5%&:eii6G+MU 3UFCD E Nr%c eZdZededefdZedefdZededefdZede dd d d d e de f d Z dd e ddde dde eeffdZ ddeddde dd e d de dzdef dZy)"BedrockPassthroughGuardrailHandler content_typerct|vSrk)r)rs r#is_event_stream_content_typez?BedrockPassthroughGuardrailHandler.is_event_stream_content_types )\99r%ctSrk)rrlr%r#event_stream_media_typez:BedrockPassthroughGuardrailHandler.event_stream_media_types''r%rct|Srk)r$)rs r#(event_stream_endpoint_is_de_anonymizablezKBedrockPassthroughGuardrailHandler.event_stream_endpoint_is_de_anonymizables $X..r% body_bytesproxy_logging_objruser_api_key_dictrdatac Kddl}ddl}ddlm}ddlm}g}d} | dzt |krt|| | dz} | dks| | zt |kDrn|| | | z} | | z } |} | j| tt| } | jjd}| j}g}|d k(rF |j%|}t'|jd Dcgc] \}}}|||f}}}}|j#| |d| dzt |kr|| d}g}i}i}t)|D]g\}}t)|d D]Q\}\}}||vrg||<g||<|j#|||j#||f||j#|Si|Dcgc]}d j+||s|}}|s|Sdd|Dcgc]}dd j+||ic}didd} |j-||| d{}!t/|!t0s+tj dt3|!j4|S |!ddd}"t7t |D#cgc] }#|"|#d }$}#i}%t?||$D]\}}&||}'||}(tAd|(Dxsd})t |&}*d}+t)|'D]I\},}-|,t |'dz k(r |&|+d|%|-< |+tC|*t |(|,z|)z z}.|&|+|.|%|-<|.}+Kg}/t)|D]V\}}|d s|/j#|d!|d} t| dd}0t| dd}1| dd|1z}2 |j%| d|1z|0dz }t)t'|jd D]$\}\}3}}|%j||f}4|4 |4||<&|jE|djG}5d|1zt |5zdz}6|jId|6|1}7||7d z}8|jId!|8}9|9|2z|5z}:||:|8d z};|jId!|;}<|/j#|7|9z|2z|5z|)rolerGend_turn)output stopReason)rrresponsezgBedrockPassthroughGuardrailHandler: post_call_success_hook returned %s, leaving event stream unmodifiedrrGc32K|]}t|ywrk)rc).0ts r# zOBedrockPassthroughGuardrailHandler.de_anonymize_event_stream..js8SV8srx ),:) separatorsz!IIlr~r%)%rKrbinasciirbotocore.eventstreamrrcradd_datanextiterheadersr?payload Exceptionr debugr3loadsrr5joinpost_call_success_hookr/r0typerrrangeKeyError IndexError TypeErrorzipsumrounddumpsencodepack)=rrrr_jsonr esm_crc32rframesoffset total_length frame_rawbufmsg event_type payload_byteserU payload_dict group_keyrTr8trailing_bytes group_order group_members group_texts frame_idxframe local_idxr>gk active_groupssynthetic_response processedprocessed_blockside_anonymized_texts new_text_mapde_anonymized_textmembers orig_texts total_orig de_anon_lenposkmemberend result_parts orig_total orig_hdrs_len headers_bytes_new_text new_payload new_totalpreludeprelude_crc_val prelude_crc_bpart_for_msg_crc msg_crc_val msg_crc_bs= r#de_anonymize_event_streamz##E%L1e I' !A7J*9Qq>:M%b2 +=>M ${{9R-5G*WX.+YZ 6?6|7G7G7PQ722I29c ,//I0FGH+)1 # 2 $kk,:kNUUW ]*S-==AIkk%MBG'0:=O"KKo>M,}<{J #$4oFSK D+6I   - 7- G+ UXa a b? cB N+xx %%{ $**:  i"=> !(..U. V \  *j*i0   N ##I. sAU-"AR)5U-=/S1,S*>S1%U-(BU-,TT U-T#3 U-T(?U-!T05T+T0C1U-8AU (U =B,U-) S'2*S"U-"S''U-*S11 T:TU-TU-+T00U U-U  U- U*&U-)U**U-Nguardrail_to_applyrlitellm_logging_objLiteLLMLoggingObjc2K|jdd}|jd}t|s$tj|||d{St |t rt |jdt s|St|}t|}t|||\}} |s|St|} |jd} | r| | d<|j| |d| d{} | jd g} | r t| | |S77(w) Nrrr)rrrrFrUmodelrequestinputs request_data input_type logging_objrU) r?r$r*process_input_messagesr/r0r4rrrVrapply_guardrailrf)rmrrrrrArBrCrUr,rrguardrailed_inputsras r#rz9BedrockPassthroughGuardrailHandler.process_input_messagess+ ((:r2hhv&$X.57NN#5$7O  $%Z8Ld-SKHI[\ DEWX 0{INwK1>xx( #F7O*<*L*L + +M+ % $6#9#9'2#F  / 9 C,% s%ADDBD,D-'DDrrcK|xsijdd}|r1t|s&tj|||||d{St |t s|St |jdt r"|jdijdini}t |t r|jdnd}t |t s|St|\} } | s|S|xsi} d| vr||j|} | ri| d| i} t| } | r| jd nd}|r|| d <|j| | d | d{}|jd g}|r t|| |S7/7)w) Nrr)rrrrrrrOrGlitellm_metadatarrrrrU) r?r$r*process_output_responser/r0r4r`'transform_user_api_key_dict_to_metadatarrrf)rmrrrrrroutput_messagerWrUr,effective_request_data user_metadatarrrras r#rz:BedrockPassthroughGuardrailHandler.process_output_responses(-222:rB 1(;57OO!#5$7"3) P (D)O>H U]H^`d=eHLL2 & * *9b 9km BLN\`Aa 2 29 =gk.$/O7GwO!-!3 %; ;@Q@]#'#O#OPa#bM*,*& *& 2>>T-11':Z^ #F7O*<*L*L/!+ +M+ % $6#9#9'2#F  / 9cL% s%AE;E6DE;E9'E;9E;rk)NNN)rrrsrt staticmethodr2r!rrrryr0rrrobjectrrrlr%r#rrsE:3:4::(S((/3/4//Y&Y&)Y&,Y& Y&  Y&Y&~>B ++.+&&9: + f  +b>B8<$( ;;.;&&9: ; $$45 ; Tk ; ;r%r);collections.abcrrtypingrrrrr r typing_extensionsr r litellm._loggingr rs--KK11X:EW30$j2C%DE5E$<E<"F%F:C:D: (o (c39n% (6(D,?(D(6(t(d=.A(d( 4 444 49d=) )* 4nV$ 49d=) )*B0Cy0 - 0 0"U38_, 9,@X@Y34 595*5*S* fl9K>QQr%