tPj2 (UdZddlZddlZddlmZddlmZmZmZddl m Z ddl m Z ddl mZddlmZdd lmZdd lmZdd lmZerdd lmZd Zeed<dZeed<dZeed<dZeed<dZeed<dZeed<dZ eed<dZ!eed<dZ"eed<dZ#eed <d!Z$eed"<d#Z%eed$<d%Z&eed&<d'Z'eed(<d)Z(eed*<d+Z)eed,<e*e+zZ,ed-d-.Gd/d0Z-d1e*d2e*fd3Z.d4e-d2e/e*e,ffd5Z0d6ed7e*d8e+d9e*dzd2e/e*e,ff d:Z1d4e-d2efd;Z2Gd<d=Z3d2e+fd>Z4ed-d-.Gd?d@Z5dAe*d2e6fdBZ7dCe*dDe*dEe*d2e*fdFZ8dGe*dHe*dIe*dzd2e5fdJZ9dKedLdMe*d2e-dzfdNZ:GdOdPZ;e;Zy)Va Push-based OTLP metering for enterprise litellm deployments. Owns a dedicated OpenTelemetry meter provider and an OTLP/HTTP exporter authenticated to our global collector with a TLS client certificate. The collector front end terminates mutual TLS: the client certificate presented here is validated against our CA at the edge, and the verified subject is what identifies the deployment. It is intentionally isolated from the global meter provider so the customer's own OTEL metrics are untouched and ours never leak into their backend. The deployment's identity rides on the TLS client certificate, not on the payload; the secret license key is never sent as an attribute or header. N) dataclass) TYPE_CHECKINGFinalOptional)OTLPMetricExporter)Counter) MeterProvider)PeriodicExportingMetricReader)Resource)verbose_proxy_logger)BillableCategory)EnterpriseLicenseData LITELLM_BILLING_METRICS_ENDPOINT ENDPOINT_ENV#LITELLM_BILLING_METRICS_CLIENT_CERTCLIENT_CERT_ENV"LITELLM_BILLING_METRICS_CLIENT_KEYCLIENT_KEY_ENVLITELLM_BILLING_METRICS_CA_CERT CA_CERT_ENV*LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MSEXPORT_INTERVAL_ENVi`DEFAULT_EXPORT_INTERVAL_MSiSHUTDOWN_FLUSH_TIMEOUT_MSz /v1/metrics _METRICS_PATHz -----BEGIN _PEM_PREFIXzlitellm-billing-mtls-_PEM_DIR_PREFIXi_PEM_FILE_MODEz client.crt_CLIENT_CERT_FILENAMEz client.key_CLIENT_KEY_FILENAMEzca.crt_CA_CERT_FILENAMEz$litellm.enterprise.billable_requests METRIC_NAMEzlitellm.enterprise.billing METER_NAMET)frozenslotsc`eZdZUeed<eed<eed<edzed<eed<eed<edzed<y) BillingMetricsConfigendpointclient_cert_pathclient_key_pathN ca_cert_pathexport_interval_mslitellm_version license_id)__name__ __module__ __qualname__str__annotations__intu/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/enterprise_billing/billing_metrics.pyr'r';s3M*d r6r'r(returncf|jd}|jtr|S|tS)zKThe OTLP/HTTP metric exporter wants the full URL including the signal path./)rstripendswithr)r(trimmeds r7_metrics_endpointr>Fs1__S)G&&}57VgY}o;VVr6configcdd|jd}|jrd|jini}i||S)Nz litellm-proxy)z service.namezlitellm.versionzlitellm.license.id)r-r.)r?base license_attrs r7_resource_attributesrCLsE'!11.D\b[l[l/CVEVEV.WrtL #d #l ##r6categoryroute status_codemodel_idc>|j||d}|rd|ini}i||S)N)zlitellm.endpoint.categoryz http.routezhttp.response.status_codezlitellm.model_idvalue)rDrErFrGrA model_attrs r7_billable_attributesrLUs<&.^^%0.D V^4F3QceJ !d !j !!r6ctt|j|j|j|j }t ||j}t|gtjt|S)aYOTLP/HTTP exporter presenting a TLS client certificate. The collector's load balancer terminates mutual TLS and validates the client certificate against our CA. Server verification uses the system trust store (the collector presents a public web-PKI certificate); ca_cert_path overrides it only for private/test collectors. )r(certificate_fileclient_certificate_fileclient_key_file)export_interval_millis)metric_readersresource) rr>r(r+r)r*r r,r r createrC)r?exporterreaders r7build_mtls_meter_providerrWasi)"6??3,, & 7 7.. H2(SYSlSlmF 8??K_`fKg;h iir6c JeZdZdZdeddfdZdededed edzddf d Z d d Z y) BillingMetricsRecorderzcIncrements one OTLP counter per billable request. The meter provider is injected (see the factory).providerr8Ncr||_|jtjtdd|_y)Nz {request}z $ $[ 11r6 directoryfilenamepemctjj||}t|dd5}|j |j dr|n|ddddtj |t|S#1swY%xYw)Nwzutf-8)encoding )rppathjoinopenwriter<chmodr)r}r~rrhandles r7 _write_pemrso'',,y(3D dC' *@f CLL.Sse2J?@HHT>" K@@s (A;;B client_cert client_keyca_certc Ptd|||fD}|s t|||Stjt}tt |rt |t|n|t |rt |t|n||r!t |rt |t|S|S)a Accept either a filesystem path or inline PEM content for each credential. Secret stores that inject values as environment content rather than mounted files (ECS tasks reading AWS Secrets Manager, Cloud Run reading Secret Manager) can only deliver the certificate as a string. The OTLP exporter takes paths, so inline PEM is written to a private directory once, when the recorder is built. Raises OSError if that write fails; the caller disables metering rather than propagating. c3>K|]}|st|s|ywry)r|).0rJs r7 z,_resolve_credential_paths..stESX]lmr]s%ts  )prefix)r)r*r+) tuplerwtempfilemkdtemprr|rrr r!)rrrinliner}s r7_resolve_credential_pathsrstk:w-OttF  ZAA ''?I IXYdIeJy"7 EkvHWWaGbJy"6 ChrBI_]dMeJy"3W =  ls  r6 license_datarr-c tjt}tjt}tjt}tjt }t|ft|ft|ffDcgc] \}}|s| }}}|r|r|s&t jddj|y t|||} t| jft| jft | jffD cgc](\} } | r!tjj| s| *} } } | r+t jddj| t yt#|| j| j| jt%||xsij'dScc}}w#t$r } t jd| Yd} ~ yd} ~ wwxYwcc} } w)NzLEnterprise billing metrics disabled: licensed deployment missing config (%s)z, )rrrz[Enterprise billing metrics disabled: could not write inline certificate content to disk: %szEnterprise billing metrics disabled: %s did not resolve to a readable certificate file. Set each to a file path, or to inline PEM content beginning with '%s'.user_id)r(r)r*r+r,r-r.)rprqrrrrr rsrrOSErrorr)r*r+risfilerr'ruget)rr-r(rrrr\rJmissingpathsexcenv_namer unreadables r7load_billing_metrics_configrsii -H?3K .1JYY{+G 8 $ k * Z (  D%  G ;j$$ Z IIg  0[U_ipqe44 5 U22 3 %,, -  Hd t, J$$ U IIj !    //--''.0' &B++I6 [$ $$ ikn  s$?F+=F1-G1 G:GGc:eZdZdZddZdeddfdZdedzfdZy) _ActiveRecorderRegistryzOne-slot registry linking the factory-built recorder to the shutdown hook; the middleware instance holding the recorder is not reachable from proxy_shutdown_event.r8Ncd|_yry _recorderrls r7rdz _ActiveRecorderRegistry.__init__ s 8<r6recorderc||_yryrrcrs r7setz_ActiveRecorderRegistry.sets !r6c,|j}d|_|Sryrrs r7popz_ActiveRecorderRegistry.pops..r6rm)r/r0r1rnrdrYrrr5r6r7rrs2="2"t"+d2r6r_ACTIVE_RECORDERpremiumcX|stjdyt||}|y tt |}tj|tjd|j|j|S#t $r }tj d|Yd}~yd}~wwxYw)z\Build the recorder, or None when the deployment is not licensed or metering is unconfigured.z?Enterprise billing metrics disabled: deployment is not licensedN)rr-zFEnterprise billing metrics disabled: failed to initialize exporter: %sz?Enterprise billing metrics enabled: exporting to %s every %d ms) r debugrrYrW Exceptionrsrrinfor(r,)rrr-r?rrs r7build_billing_metrics_recorderrs  ""#de/\[jkF ~01J61RS"I!! O $$%morssB B) B$$B)ctj}|y |jy#t$r }t j d|Yd}~yd}~wwxYw)zEFlush and stop the active recorder, if any. Idempotent; never raises.Nz2Enterprise billing metrics: final flush failed: %s)rrrkrr rs)rrs r7!shutdown_billing_metrics_recorderr;sR&**,H` `$$%Y[^__`s* AAArm)?rnrpr dataclassesrtypingrrr6opentelemetry.exporter.otlp.proto.http.metric_exporterropentelemetry.metricsropentelemetry.sdk.metricsr opentelemetry.sdk.metrics.exportr opentelemetry.sdk.resourcesr litellm._loggingr dictrCrLrWrYrurwboolr|rrrrrrrr5r6r7rs  !11U)3J01:8 e8>><<6 U6IUI$*E*#(5($ u$" U!00+u+*e*#5#; U;0 E0s $d#$WWW $!5$$sN?R:S$ " "'* "9< "HKd  " #~  "j&:j}j&JJ( *S * $d#$ 23242#33csSSWZ\l`r6