uPj*UdZddlZddlmZddlmZddlmZmZm Z m Z ddl m Z ddl mZdZeed <ej"d ej$Zeed <d edzd edzfdZdeeefd efdZGddZdedzded efdZdedzded efdZy)aShared auth, region resolution, and routing helpers for the Amazon Bedrock Mantle provider. Mantle authenticates with a Bearer token when one is available (litellm_params.api_key, BEDROCK_MANTLE_API_KEY, or the standard AWS_BEARER_TOKEN_BEDROCK); otherwise it falls back to AWS SigV4 (service "bedrock") over the standard credential chain (IAM role / access key / profile / web identity). The Chat Completions and Responses backends share this behaviour through BedrockMantleAuthMixin so the two paths can never drift apart. The two routing helpers (mantle_supports_responses, mantle_base_segment) are pure functions of (model, model_cost) so they can be unit-tested without patching global state. N)Mapping)Final)CredentialRetrievalErrorNoCredentialsErrorPartialCredentialsErrorProfileNotFound) BaseAWSLLMget_secret_strz us-east-1BEDROCK_MANTLE_DEFAULT_REGIONz,^https?://bedrock-mantle\.([^/.]+)\.api\.awsMANTLE_HOST_REapi_keyreturnc:|xstdxs tdS)NBEDROCK_MANTLE_API_KEYAWS_BEARER_TOKEN_BEDROCKr rs m/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/llms/bedrock_mantle/common_utils.pyresolve_mantle_bearer_tokenr#s  ln%=> l.QkBllparamsc|jd}t|tr|rtj||S|jd}t|tr|ndxs t d}|r7t j|jd}|r|jdSt dxs t dxst dxstS) Naws_region_nameapi_baseBEDROCK_MANTLE_API_BASE/BEDROCK_MANTLE_REGIONAWS_REGION_NAME AWS_REGION) get isinstancestrr _validate_aws_region_namer r matchrstripgroupr )rregionrbaser%s rresolve_mantle_regionr*'sJJ01F&#6,,V4 jj,H)(C88dp~VoGpD %++DKK,<= ;;q> !./ ) + , ) , ' ) ) rceZdZUeed<ededzdedzfdZededefdZ dded ed ed ededzd edzd e dzde dzde ee dzffdZ y)BedrockMantleAuthMixin _aws_signerrNrct|SN)rrs r_resolve_bearer_tokenz,BedrockMantleAuthMixin._resolve_bearer_token=s *733rrct|Sr/)r*)rs r_resolve_regionz&BedrockMantleAuthMixin._resolve_regionAs $V,,rheadersoptional_params request_datarmodelstream fake_streamc |j|} | stj|jd} i|d| r| j dn|j i|d|ii}|j D cic]\} } | jdk7s| | }} } |jjd||||| ||| Scc} } w#ttttf$r} td| d} ~ wwxYw) Nrrrr authorizationbedrock) service_namer3r4r5rrr6r7r8zBedrock Mantle auth failed: no Bearer token and no usable AWS credentials. Set BEDROCK_MANTLE_API_KEY (or AWS_BEARER_TOKEN_BEDROCK) or pass api_key for Bearer auth, or provide AWS credentials (IAM role / access key / profile / web identity) for SigV4.)r0r r%r&r'r2itemslowerr- _sign_requestrrrr ValueError)selfr3r4r5rrr6r7r8bearer host_matchkves r sign_requestz#BedrockMantleAuthMixin.sign_requestEs%227;!/ 4 4X__S5I JJ!!!$$Q'--.W.W*h.WX O)0 X11779;Wq!tXGX ##11& /)!'2  Y  #  $   N    s$;CC #C C4# C//C4)NNNN)__name__ __module__ __qualname__r __annotations__ staticmethodr#r0dictr2booltuplebytesrGrrr,r,:s4sTz4cDj44----# "#'111 1  1 t 1Tz1t 1D[1 tUT\! "1rr,r6 model_costc|jd|i}d|jdxsgvry|jddk(S)aWhether a Bedrock Mantle model can serve the native Responses API. Purely data-driven from the model's price-map capability signal -- either /v1/responses in supported_endpoints, or mode=responses -- both overridable via register_model and proxy model_info, so onboarding a model is a JSON change, never a code change. There is deliberately NO model-name match here: capability is per-model, not per-family (openai.gpt-oss-120b supports Responses while openai.gpt-oss-safeguard-120b does not, despite sharing the gpt-oss substring), so a substring gate would be wrong. A model absent from model_cost simply has no signal and returns False (chat-completions emulation). bedrock_mantle/z /v1/responsessupported_endpointsTmode responsesr!r6rRentrys rmantle_supports_responsesr[ysI>>OE7";R@E599%:;ArB 99V  ++rcZ|jd|i}|jddurdSdS)aReturn the base path segment for a Bedrock Mantle model's OpenAI surface. Data-driven from the model's price-map use_openai_responses_path flag (overridable via register_model / proxy model_info). Per the AWS model cards, gpt-5.x and the google gemma-4-* family carry that flag and are served on the /openai/v1 base (.../openai/v1/responses and .../openai/v1/chat/completions); every other model including gpt-oss uses the standard /v1 base. The segment is the base for the model's whole OpenAI-compatible surface, so both the chat and responses configs derive from it -- there is no separate model-name rule. rTuse_openai_responses_pathTz openai/v1v1rXrYs rmantle_base_segmentr_s7>>OE7";R@E))$?@DH;RdRr)__doc__recollections.abcrtypingrbotocore.exceptionsrrrr!litellm.llms.bedrock.base_aws_llmr litellm.secret_managers.mainr r rKcompile IGNORECASEr r#robjectr*r,rMrNr[r_rQrrrjs  #97'2u2# #RTVTaTabbmtmd m'#v+"63&<<~,S4Z,T,d,$ SsTz St S Sr