tPj?YjUddlZddlZejjdejj dddlZddlZddlZddlZddlZddl Z ddl m Z m Z m Z ddlmZmZddlmZmZddlmZmZmZmZmZmZmZmZddlZddlmZddlm Z m!Z!ddl"Z"dd l#m$Z$dd l%m&Z&dd l'm(Z(dd l)m*Z*dd l+m,Z,ddl-m.Z.ddl/m0Z0ddl1m2Z2ddl3m4Z4ddl5m6Z6ddl7m8Z8m9Z9ddl:m;Z;ddlm?Z?ddl@mAZAmBZBmCZCmDZDmEZEddlFmGZGddlHmIZImJZJddlKmLZLmMZMddlNmOZOmPZPmQZQmRZRmSZSmTZTmUZUmVZVmWZWmXZXddlYmZZZerddl[m\Z\ddl]m^Z^ddl_m`Zadd lYmbZbmcZcmdZdmeZemfZfmgZgmhZhmiZimjZjmkZkd!Zleemd"<end#d$hZoeemd%<d&Zpeemd'<d(Zqeemd)<d*Zreemd+<ejd,Zteemd-<d.Zueemd/<d0Zveemd1<enhd2Zweemd3<d4Zxeemd5<d6d7d8Zyeeze{eTfemd9<end:d;hZ|eemd<<Gd=d>eZ}Gd?d@eZ~GdAdBeZGdCdDeZdEezdFezfdGZdHeezdFeezfdIZGdJdKe,e6Zy)LNz../..)AsyncGeneratorMappingSequence)datetimetimezone) accumulategroupby) TYPE_CHECKINGAnyClassVarFinalLiteral NamedTupleOptionalcast) HTTPException) TypeAdapterValidationError)verbose_proxy_logger) DualCache)*BEDROCK_APPLY_GUARDRAIL_CHUNK_BUDGET_CHARS)ModifyResponseException)CustomGuardrail)"redact_nested_match_and_regex_keys)bedrock_guardrail_cost)AnthropicMessagesHandler).effective_scan_only_tool_results_for_guardrail) BaseAWSLLM)get_async_httpx_clienthttpxSpecialProvider)UserAPIKeyAuth) _serialize_http_exception_detail)keepalive_ping_has_fired)"anthropic_sse_chunks_from_responseanthropic_sse_error_framesassemble_anthropic_sse_streamis_raw_sse_streammodel_response_text)get_secret_str)BedrockChecksConfigModelGuardrailEventHooks)AllMessageValuesChatCompletionUserMessage) BedrockChecksMessageBedrockChecksViolationBedrockContentItemBedrockGuardrailChecksResponseBedrockGuardrailOutputBedrockGuardrailQualifierBedrockGuardrailResponseBedrockGuardrailUsageBedrockRequestBedrockTextContent)GenericGuardrailAPIInputs)AWSPreparedRequest Credentials)Logging) CallTypesCallTypesLiteralChoicesGuardrailStatusGuardrailTracingDetailMessage ModelResponseModelResponseStreamStreamingChoices TextChoicesbedrockGUARDRAIL_NAMEcontentsource_BEDROCK_DYNAMIC_BODY_DENYLIST)z text unitzmaximum input sizez content sizeztoo longz too largezexceeds the maximum#_BEDROCK_TOO_LARGE_ERROR_SUBSTRINGS-_BEDROCK_APPLY_GUARDRAIL_MAX_THROTTLE_RETRIES?-_BEDROCK_APPLY_GUARDRAIL_BASE_BACKOFF_SECONDSz\s_BEDROCK_WHITESPACEz/guardrail-checks/invoke%_BEDROCK_INVOKE_GUARDRAIL_CHECKS_PATH "_BEDROCK_CHECKS_MAX_CONTENT_BLOCKS> promptAttack contentFiltersensitiveInformation_BEDROCK_CHECKS_KNOWN_KEYS) beginOffset endOffset messageIndex contentIndex!_BEDROCK_CHECKS_PII_LOCATION_KEYSgrounding_sourcequery)r^r__CONTENT_TYPE_TO_QUALIFIERsystem developer_GROUNDING_SOURCE_TRUSTED_ROLESc,eZdZUdZeed<edzed<y)QualifiedTextBlockzMA piece of message text paired with its Bedrock grounding qualifier (if any).textN qualifier)__name__ __module__ __qualname____doc__str__annotations__r3/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.pyreresW I(4//rorecPeZdZUeedzed<eedzed<eedzed<y)GuardrailMessageFilterResultNpayload_messagesoriginal_messagestarget_indices)rhrirjlistr,rmintrnrorprrrrs3+,t33,-44I$$rorrc:eZdZUdZeed<eedfed<eed<y)BedrockContentChunkResultaAOne chunk's ApplyGuardrail response, paired with enough bookkeeping to reconstruct global masked-output positions once every chunk is back. `content` is the exact content items this chunk was called with -- needed so an all-clear chunk (empty `outputs`) can still contribute one unmasked placeholder per item it covers, keeping every later chunk's masked text aligned to its original global position. `fragment_group_size` is 1 for an ordinary chunk, and otherwise the total number of consecutive chunk results that together make up ONE original content item's own text (split because a list of length 1 could not be bisected by list length). All of them must be concatenated back into that one item's masked output rather than treated as separate items. It is a count rather than a boolean because one item can be bisected more than once: two levels of splitting produce four fragments for a single item, not two, and grouping them in fixed pairs would emit two outputs for one message and shift every later message's masked text. response.rIfragment_group_sizeN) rhrirjrkr4rmtupler0rwrnrorpryrys&"'& %s* ++rorycZeZdZUdZeedzed<eeefdzed<e ed<dZ e ed<y)ApplyGuardrailMessageSelectionzDMessages selected for an apply_guardrail scan + write-back metadata.Nfiltered_messages scanned_slicescanned_role_subsetF skip_scan) rhrirjrkrvr,rmr|rwboolrrnrorpr~r~s;N,-44c?T))Itror~ response_jsonreturnc@t|}t|tr|S|S)z Redact match-like fields from a Bedrock ApplyGuardrail JSON payload. Delegates to :func:`redact_nested_match_and_regex_keys` (same rules as spend logging). Kept as a Bedrock-module entry point for existing unit tests. )r isinstancedict)rredacteds rp_redact_pii_matchesrs"9GH!(D18D}Dro assessmentsc@t|}t|tr|S|S)z Redact sensitive match-like fields from blocked assessment summaries. This is used for customer-visible error payloads (HTTPException.detail) where we want to preserve policy/type/action metadata without echoing raw matched content. )rrrv)rrs rp_redact_assessment_match_fieldsrs"9EH!(D18B{Broc eZdZUdZeeed<dddddddefdedzdedzdedzd e e ee fzdzd e dzd e dzd e dzd e ffd ZedeefdZed e e ee fzdzdeeefdzfdZdeedzdefdZ ddeezdeedzdefdZdeezdedeefdZ ddeddeedzdeezdzdefdZdedee dzfdZ!de defdZ"deedzdee fdZ#defd Z$deedzde%fd!Z&deed"ede dzfd#Z'edede fd$Z(d%eed&e d'eede)e e fdzfd(Z*d'eed)d*d+ed,ed-de+f d.Z,d/ed'ed0e)e e fdzd1edef d2Z-d3eedzd4eed5ee dzdeefd6Z.d7Z/ dd8ed9ed:ed;edzdZ0 ddeddeedzde1j4dzd+edzd?edzde2f d@Z3 ddeddeedzde1j4dzd+edzd?edzde2f dAZ4dBe5edCe eefdDdEd:ed;edzd+edzdFedGdHdIedJee6de)e7dKffdLZ8dBe5edCe eefdDdEd:ed;edzd+edzdFedGdHdJee6de2fdMZ9dBe5edCe eefdDdEd:ed;edzd+edzdFedGdHdJee6de2fdNZ:dOe;jxdPed+edzdFedGdHd:edzdJe5e6ddfdQZ=dRe2d+edzdFedGdHd:edzddf dSZ>dTe d+edzdFedGdHd:edzdJe5e6ddfdUZ?edBe5edefdVZ@edBe5edWe de)e)edKfdKffdXZAedBe5ede)e)edKfe)edKffdzfdYZBedZede fd[ZCedTe defd\ZDed]e5e7de2fd^ZEed]e5e7de6fd_ZFed`e5e6de6fdaZGed]e5e7de)e)e7dKfdKffdbZHedce)e7dKfde)e)eIdKfeffddZJ ddedfd+edzdFedGdHdgede;jxf dhZKediedjd'eedeeLfdkZM ddeddeedzde1j4dzdeeLfdlZN ddeddeedzde1j4dzd+edzd?edzde2f dmZOdePdzdeeQfdnZRedePdeeeffdoZSedpedeTfdqZUedreeQdeVfdsZW ddreeQd+edzdeXeYzfdtZZdefduZ[de;jxdeTfdvZ\de;jxde)e effdwZ]de2d:edzdeVfdxZ^de2deefdyZ_de2deefdzZ` dde2d+edzdeXeYzfd{Zade2defd|Zbd}ecd~edd8edeedefezezdzf dZgd8ed}ecdeefdZhd8ed}ecfdZideede2deefdZjd}ecded+edekeldffdZmde2deefdZndeed/eedeefdZodeed/eede de)eee ffdZpdeezde2ddfdZqde1j4d/eeddfdZrededfdZsde2defdZtd'eed)d*d+edeud*fdZv dd)d*d+ed,ed-deuddd*f dZwxZxS)BedrockGuardrailTuse_native_during_call_hookNFrOguardrailIdentifierguardrailVersiondisable_exception_on_blockcheckscontent_filter_thresholdprompt_attack_thresholdpii_confidence_thresholdchunk_budget_charsc dttj|_||_||_d|_||_t| jd|_ |j||_ ||_ ||_||_| |_|xsd|_ |j#|j |j t%d| j'dt)|j+t- |\d i| t1j.||j/t3|dds t3|ddrt5j6d t5j8d |j|j |jr(t)|jj;ydy) N) llm_providerrG)experimental_use_latest_role_message_onlyFzBedrock guardrail accepts either 'guardrailIdentifier'/'guardrailVersion' (ApplyGuardrail) or 'checks' (InvokeGuardrailChecks), not both.supported_event_hooksmask_request_contentmask_response_contentzBedrock Guardrail: mask_request_content/mask_response_content have no effect with 'checks' (InvokeGuardrailChecks is detect-only).z\Bedrock Guardrail initialized with guardrailIdentifier: %s, guardrailVersion: %s, checks: %srn)rr GuardrailCallback async_handlerrrguardrail_providerrrgetr_normalize_checksrrrroptional_paramsr ValueError setdefaultrvget_supported_event_hookssuper__init__rgetattrrwarningdebugkeys) selfrrrrrrrrkwargs __class__s rprzBedrockGuardrail.__init__s4AUAgAgh#6 0"+"49=fjjIt>u9v6.2-C-CF-K )A%'>$(@% &0J0Se' ;; "(@(@(LPTPePePqA  148V8V8X3YZ "6"D! ;; " D0% 8GDJach  rorctjtjtjtjtj gSN)r+pre_call post_call during_call pre_mcp_callduring_mcp_call)clss rprz*BedrockGuardrail.get_supported_event_hookss; ( (  ) )  + +  , ,  / /   roc|yt|tr|jdn t|}t |j t z }|r-tjdt|tt |jDcic]\}}|t vs|||}}}|s8|r6tdt|j dtt d|xsdScc}}w)zNormalize the configured `checks` into a plain dict for the API body. Accepts a pydantic ``BedrockChecksConfigModel`` or a raw dict; drops None / unknown keys. Returns None when no usable check is configured (=> ApplyGuardrail). NT) exclude_nonezBedrockGuardrail: unrecognized check key(s) %s will be ignored; recognized keys will still be used for InvokeGuardrailChecks. Known keys: %s.zKBedrockGuardrail: 'checks' block contained only unrecognized or empty keys z. Known keys: zS. Fix the guardrail config or remove the 'checks' block to use ApplyGuardrail mode.) rr* model_dumprsetrrXrrsorteditemsr)rraw unknown_keyskeyvaluecleaneds rprz"BedrockGuardrail._normalize_checks#s >6@Ia6bfT2hlmsht!#((*o0JJ  ( ("|$12  14 w*#usF`?`ejev3:ww3]^dehememeo^p]qr%&@ABCdd  $xsC/$C/'C/messagesc td}g}||S|D]M}|j|}||D]1}|jtt |j 3O||d<|S)zS Create a bedrock request for the input content - the LLM request. INPUTrJmessagerfrI)r6get_content_items_for_messageappendr0r7rf)rrbedrock_requestbedrock_request_contentrblocksblocks rp%_create_bedrock_input_content_requestz6BedrockGuardrail._create_bedrock_input_content_request?s2@w1OCE  " " mG777HF~ m (../AGY_d_i_iGj/kl  m m&= "rorzctd}|j|}|Dcgc]}|j|}}t|dkD}|j |j ||||d<|Scc}w)a Create a bedrock request for the output content - the LLM response. Contextual grounding grades the response against the reference source and the user query from the request. When the request tagged any ``grounding_source``/``query`` blocks, they are emitted first and the response is qualified as ``guard_content`` so Bedrock can score grounding. Without such tags the payload is the legacy single response block. OUTPUTrr) has_groundingrI)r6_collect_grounding_blocks_build_content_itemlenextend_build_response_content_items)rrzrrgrounding_blocksrrrs rp&_create_bedrock_output_content_requestz7BedrockGuardrail._create_bedrock_output_content_requestUs2@x1P"&"@"@"J9ID 05D $ $U +D D  ##:;a?  &&t'I'I(bo'I'pq%< "D sA3rcg}t|tjs|S|jD]}t|tjst|j j tsC|j j sZt|j j |rdnd}|j|j||S)zBuild content item(s) from the model response. When the request supplied grounding, the response is qualified ``guard_content`` so Bedrock can score it. guard_contentNrfrg) rlitellmrCchoicesr?rrIrlrerr)rrzrrchoicers rprz.BedrockGuardrail._build_response_content_itemsos 24(G$9$9:L&& >F67??3v~~55s;NN***//1>oD T55e<= > rorJ)rrct|}|dk(r|j|}|S|dk(r|j||}|S)a Convert the litellm messages/response to the bedrock request format. If source is "INPUT", then messages is required. If source is "OUTPUT", then response is required. Returns: BedrockRequest: The bedrock request object. rrrr)rzr)r6rr)rrJrrzrs rpconvert_to_bedrock_formatz*BedrockGuardrail.convert_to_bedrock_formatsY+9*G W "HHRZH[Ox "IIS[fnIoOrorc|jd}|yg}t|tr|jt |d|St|t r|D]}t|t rId|vrEtj|jdd}|jt |d|\t|tsm|jt |d|S)a' Flatten a message into text blocks, preserving any contextual-grounding qualifier carried by the content-block ``type`` (grounding_source / query). Untagged text keeps ``qualifier=None`` so the payload is unchanged for callers that do not use grounding. rINrrftype)rrrlrrervrr`)rrrIritemrgs rprz.BedrockGuardrail.get_content_items_for_messages!Y/ ?24 gs # MM,'TJ K  & QdD)fn : > >txxPR?S TIMM"4$v,R["\]c*MM"4$$"OP  Q  rorc~t|j}|j|jg|d<t|S)zEBuild a Bedrock content item, attaching qualifiers only when present.r qualifiers)r7rfrgr0)rr text_contents rprz$BedrockGuardrail._build_content_items60ejjA ?? &*///):L &!|44rocg}|xsgD]g}|jd}|j|xsgD];}|jdk(s|jdk(s"|tvs+|j |=i|S)a0Harvest grounding_source/query blocks from the request for an OUTPUT scan. ``grounding_source`` is honored only from app-authored roles (system / developer). A grounding_source tag on a ``user``, ``tool`` or ``function`` message is ignored, so neither a forwarded end-user message nor a tool/function result carrying externally-influenced content can supply fake evidence for the contextual-grounding check to grade the response against. ``query`` is accepted from any role (it is the user's question). rolerr_r^)rrrgrcr)rr groundingrrrs rprz*BedrockGuardrail._collect_grounding_blockss68 ~2 ,G;;v&D;;G;LRPR ,OOw.*<< ??$$U+  , ,roc|jduS)NT)r)rs rpsupports_scan_only_tool_resultsz0BedrockGuardrail.supports_scan_only_tool_resultss==TIIroc| tdddS|jdur t|ddS|j|d}| tdddSt|}||g}t|||gS)z#+L#9":+-/(>  rorcxtt|dz ddD]}||jdd|k(s|cSy)Nr)rangerr)rrrindexs rprz+BedrockGuardrail._find_latest_message_indexsF3x=1,b"5 E""640K?  roc|jd}t|tryt|trt d|DSy)zPCount the text segments the guardrail translation layer extracts from a message.rIrc3fK|])}t|ts|jd&d+yw)rfNrrrr.0rs rp z8BedrockGuardrail._count_message_texts..s(hT 40F488TZK[Kgqhs 111r)rrrlrvsum)rrIs rp_count_message_textsz%BedrockGuardrail._count_message_textss=!Y/ gs # gt $hWhh hrostructured_messages target_indextextscd}d}d}t|D]-\}}|j|} ||kr|| z }n||k(r| }|| z }/|t|k7s|dk(ry||fS)a& Map one message's text segments to their (offset, length) slice in the flat `texts` list built by the guardrail translation handler. Returns None when the reconstruction does not line up with `texts` (the caller must then avoid positional write-back). rN) enumeraterr) rrrroffsettotal target_countrrcounts rp_locate_message_texts_slicez,BedrockGuardrail._locate_message_texts_slices '(;< NE7--g6E|#%,&$ UNE   CJ ,!"3|##roinputsr8 request_data input_type)requestrzc|Dcgc]}td|}}|jdurt|ddSttt dz|j dxs|j d}|d k7s|s.|j| }t|jxs|ddS|j|d } | Dt|rtjd tjd tddddS|| } |j| dk(r$tjdtddddSt| g|j|| |dScc}w)a Decide which messages an apply_guardrail scan should cover. With ``experimental_use_latest_role_message_only`` enabled, request scans must select by the ORIGINAL message roles. The flat `texts` list has no role information, and wrapping it in role="user" mock messages makes the latest-user filter degenerate to "latest text of any role", leaking tool/assistant content to the INPUT scan (https://github.com/BerriAI/litellm/issues/23476). rrrITNF)rrrrrrrrzBedrock Guardrail: experimental_use_latest_role_message_only scans only the latest user message, so scan_only_tool_results leaves nothing to scan for this requestzGBedrock Guardrail: no user-role message in request, skipping INPUT scan)rrzOBedrock Guardrail: latest user message has no text content, skipping INPUT scan)rrr)r-rr~rrvr,rrrsrrrrrrr) rrrrrrf mock_messagesr filter_resultlatest_user_indexselected_messages rp$_select_messages_for_apply_guardrailz5BedrockGuardrail._select_messages_for_apply_guardrails"sx0xjn1JPV`d1e0x 0x  9 9 E1"/"$)  &* ! "T ) JJ, - M1A1A*1M&   "*=$(#L#LVc#L#dM1"/"@"@"QM"$)  $(#B#BCVdj#B#k  $=dC$,,f ! & &'p q1$ddS S"56G"H  $ $%5 6! ; & &a 2$ddS S-/0::$7.; !%  g1ysE masked_textsrrc|s|S|0|\}}t|}t|d|D] \}} | |||z<|S|rtjd|S|S)u! Reconcile the guardrail's masked output with the flat `texts` list. - No masked output: keep the originals (guardrail allowed content as-is). - A slice was scanned: write masked content back to those positions only, keeping the list aligned with the caller's message↔text mappings. - A role-selected subset was scanned but could not be mapped back to flat-text positions (scanned_slice is None): keep the originals rather than misapply masked content to the wrong message. Guarding on scanned_slice rather than a length comparison also covers the case where the masked subset happens to match len(texts) (e.g. both length 1). - Otherwise (whole list scanned): use the masked output as-is. Nz_Bedrock Guardrail: could not align masked texts with request texts, skipping masking write-back)rvr rr) rrrrrr length merged_texts masked_index masked_texts rp_merge_masked_textsz$BedrockGuardrail._merge_masked_textscs|*L  $*NFF"&u+L-6|GV7L-M B) k6A Vl23 B   ( (q Lrortupdated_target_messagesruc|s|S|sg}t|}|s t|}t||D]\}}|t|ks|||<|Sr)rvzipr)rrtr!rumerged_messagesreplacement_indexupdated_messages rp_merge_filtered_messagesz)BedrockGuardrail._merge_filtered_messagessn * * " 01"#:;O25nF]2^ E .  3#775D 12 Eroc  ddlm}|jj dd}|jj dd}|jj dd}|jj dd}|jj dd}|jj d d}|jj d d}|jj d d} |jj d d} |jj d d} |j |}|j |||||||| | |  } | |fS#t$r tdwxYw)Nrr:7Missing boto3 to call bedrock. Run 'pip install boto3'.aws_secret_access_keyaws_access_key_idaws_session_tokenaws_region_name aws_role_nameaws_session_nameaws_profile_nameaws_web_identity_tokenaws_sts_endpointaws_external_idr-) r+r*r,r-r/r0r.r1r2r3)botocore.credentialsr; ImportErrorrr)get_aws_region_name_for_non_llm_api_callsget_credentials) rr;r*r+r,r-r.r/r0r1r2r3 credentialss rp_load_credentialsz"BedrockGuardrail._load_credentialss Y 8(,';';'?'?@WY]'^#'#7#7#;#;*>/"7/+--'#9-++? + O++? YWX X Ys EE&datarr-api_key extra_headers request_pathcddi}|ddi|}|jjdd} |jd| |\} } |d|jd|jd}| |} t j |jd} ||} n td } | r d d l m }d | |d<|d| | |}nL d dl m }d d l m }||d|}|d| | |}|j||d|vr|d|jd<|j!}|S#t$r td wxYw#t$r td wxYw)Nz Content-Typezapplication/jsonaws_bedrock_runtime_endpoint)api_baser@r-z /guardrail/z /version/z/applyutf-8AWS_BEARER_TOKEN_BEDROCKr) AWSRequestr)zBearer AuthorizationPOST)methodurlr;headers) SigV4AuthrG)rrget_runtime_endpointrrjsondumpsencoder)botocore.awsrequestrDr6 botocore.authrJadd_authrIprepare)rr9r;rr-r<r=r>rIr@_proxy_endpoint_url encoded_dataaws_bearer_tokenrDrrJsigv4prepped_requests rp_prepare_requestz!BedrockGuardrail._prepare_requests"#56  $%'9K]KG.2.B.B.F.FGegk.l$ $ 9 9)E+!:!    ()A)A(B)DLaLaKbbhiL 23L>B"jj.55g>   +2 -.HI   ]:*11A0B'CGO $ &! G ]3:%[)_ME &! G NN7 #)o.N3@3Q0!(!2= ]!"[\\ ] ]!"[\\ ]sD8 D-D*-Elogging_event_typecK|j|j|||||d{S|j|||||d{S7"7w)azDispatch to the configured Bedrock guardrail API. ``checks`` selects the resource-less, detect-only InvokeGuardrailChecks API; otherwise the ApplyGuardrail API is used. Both return a ``BedrockGuardrailResponse`` (the checks path returns an empty one on a pass, which downstream masking treats as a no-op) and raise on a blocked request. N)rJrrzrrZ)r%_make_invoke_guardrail_checks_request_make_apply_guardrail_request)rrJrrzrrZs rpmake_bedrock_api_requestz)BedrockGuardrail.make_bedrock_api_request sx ;; "CC!!)#5 D 77%1 8    s!&AA AA A Ac Ktjtj}t |j |||}d}|rc|j |} |j| jD cic]\} } | tvr| | c} } |jd|d}||n$|dk(rtjntj} t|jdxsd} | s+tj d|j"|t%S|j'\}}|j)|  }g} |j+| |||||| ||| d{}|j5|}|j7||| || |Scc} } w73#t,$rA}t/|j0ts!|j3|j0|| ||| d}~wwxYww) aScan `messages`/`response` with ApplyGuardrail, chunking if it is too large. Content is bin-packed into budget-sized batches and each batch posted sequentially, every batch independently falling back to bisection if AWS rejects it. The per-batch responses are merged so callers cannot tell whether chunking happened. Content using contextual grounding opts out of chunking entirely: grounding is scored holistically against the whole reference source, so bisecting it would fragment that evaluation and yield misleading scores. Such a request keeps the old behavior of surfacing a too-large error rather than being split. `logging_event_type` drives what UI and spend logs report. It is distinct from Bedrock's `source`, which is INPUT vs OUTPUT for the API body and must not be confused with the proxy hook (pre_call / during_call / post_call); when omitted, the legacy source-derived mapping is kept for backward compatibility. A guardrail *block* is logged where it happens, in `_post_apply_guardrail_content`, because chunking stops immediately and there is no later merged response to log instead. Everything else that fails out of the chunking flow (an unrecoverable too-large error, a non-size validation error, exhausted throttle retries) is a genuine end-to-end failure of this one logical guardrail call and is logged exactly once here. rJrrzNrr<rrIrnzDBedrock Guardrail %s: no %s content to scan, skipping ApplyGuardrail rIbase_request_datar9r-r<r event_type start_timeallow_chunkingcompleted_chunk_usages)detailrrdrer-rg)merged_responserrdrer-)rnowrutcrr)get_guardrail_dynamic_request_body_paramsupdaterrKrr+rrr|rrguardrail_namer4r:"_content_uses_contextual_grounding&_apply_guardrail_content_with_chunkingrrrh_log_apply_guardrail_failure"_merge_bedrock_guardrail_responses_log_apply_guardrail_success)rrJrrzrrZrebedrock_request_datar<dynamic_request_body_paramsrrrdrIr9r-rfrg responsesexcris rpr]z.BedrockGuardrail._make_apply_guardrail_request*s/@%LL6 ,0  * *&8V^ * _- # *.*X*Xfr*X*s ' ' ''B&G&G&I"U"@@J  *6&y1"- 28G2C%..I\IfIf  :??S?W?WXa?b?hfh9i ! & &V##  ,- -'+'='='?$ _$($K$KG$T TEG %)%P%P"6' /)%%-'=&Q & I."&!H!H!S ))+%!!+ * {<  cjj$/11::!-))$3+A 2  sIA5G'7F B9G'F$F%F)/G'F G$#.s [GSZ [ [ [ztBedrock Guardrail: ApplyGuardrail rejected %d content item(s) as too large; splitting into %d + %d and retrying eachc3TK|]}|jt!yw))r{N)_replacer)rr}combined_resultss rprzJBedrockGuardrail._apply_guardrail_content_with_chunking..s'!W]C@P~AV*V , !aq!(' KE sG;A?AG;A G8 BG3 #C90C3 1C98G3G8G;A8G3F#G33F641G3%G8&G;+G3,G8-G;2G33G88G;c KttdzD]&} |j|||||||||  d{cStdd7#t$rf} | jdk7s$|j | j s | tk\rtjtd| zzd{7Yd} ~ d} ~ wwxYww) aPost one ApplyGuardrail call for `content`, retrying with exponential backoff on AWS ThrottlingException (HTTP 429). Chunking already trades one oversized call for several smaller ones, so retries here are capped low -- they must not multiply per-request latency by an order of magnitude when the account's per-second text-unit quota is the binding constraint rather than the per-request size quota. A too-large rejection is deliberately excluded from the retry. AWS reports it as a ThrottlingException (429), not only as a ValidationException, but unlike a genuine throttle it is not transient: re-posting the same oversized content can never succeed. Retrying it would burn every backoff sleep and every (billed) attempt before the caller's bisection gets a chance to split the content, at every level of the recursion. rryNiz,Bedrock guardrail throttle retries exhausted status_coderh) rrN_post_apply_guardrail_contentrrrrhasynciosleeprP) rrIrcr9r-r<rrdrergattemptrws rprz9BedrockGuardrail._post_apply_guardrail_content_with_retrys6JQNO bG b!??#&7 +$3#!-))+A@    b*4bcc' ! bOOs*55cjjA"OOmm$QUVX_U_$`aaa bsJB?A A A B? A  B<AB7,B/-B72B?7B<<B?c Ki|d|i} |j|| |j||} tjd| | j| j |j | |||dd{} | jdk(r| j} tjdt| tdi| }|j|r+|j| | ||||| |j|| |jd }t|t r| j#||S|j%| \}}tj&d | j| j(t+|| 7 w)aMake exactly one signed ApplyGuardrail HTTP call for `content` and parse the result. Raises HTTPException on a guardrail block or any non-200 response (including 429, handled by the retry wrapper above). AWS also reports some failures inside a 200 body, tagging ``Output.__type`` with an Exception marker. Those deliberately do NOT raise: the request proceeds, matching the behaviour of this code before chunking existed. The marker survives the merge, so the one consolidated log entry still records ``guardrail_failed_to_respond`` rather than a success. Making that path fail closed is a separate change, tracked apart from this PR, and belongs behind the existing ``unreachable_fallback`` setting rather than a hardcoded status. A block is logged here rather than by the caller: it ends the whole chunking flow immediately, with no further chunks attempted, so there is no later merged response for the caller to log instead. The logged usage still spans the whole logical request: chunks that passed before the block appended what AWS billed them to ``completed_chunk_usages``, and the attempt log sums those with the blocking call's own usage. rI)r9r;rr-r<z0Bedrock AI request body: %s, url %s, headers: %sF)prepared_requestrrdrelog_transport_failureNzBedrock AI response : %s)httpx_response json_responserrdrer-rgrausagez' ' w' #'"7"7#% 00+ #8#  "" >   $ $  '+&9&9-%!!"' ':' !   % % ,$2$7$7$9N & &*2>B *B)SN)S &==>XY11#1"0!-))$3+A2DD.\E%?$B$B7$KN.$/&--". -&*&R&RSa&b# ^"" J  & &     NKKU! sA.E=0E:1D E=rrc ,|jd}t|t|tr|fndz} |ri|d|j | in|} |j t di| |} |j|j| |xsi|j||jtjtjjtjtj|z j|| xsd y)a1Log the blocking ApplyGuardrail attempt, which ends the whole chunking flow immediately. Its status derives from its own response, but its usage (and so its cost) spans every billed call of the logical request: the chunks that passed before the block plus the blocking call itself.rrnr4rzN rguardrail_json_responserguardrail_statusreend_timedurationrdtracing_detail)rr|rr_sum_usage_counters_build_tracing_detailr4:add_standard_logging_guardrail_information_to_request_datar&_get_bedrock_guardrail_response_status timestamprrjrrk total_seconds) rrrrrdrer-rgblocking_usage billed_usageslogged_json_responsers rprz-BedrockGuardrail._log_apply_guardrail_attempts!. 1 1' :BGH^B_!+ND!A^ rC &   11-@   !% : : $ <'; .Hs:ueisDHHV$4$L8J8L#Q#QRX#Y#_]_`usAAcarriedrrc:|\}}||zkr|||zfS|dz|fS)Nrrn)rr batch_indexusedrzs rpassignz:BedrockGuardrail._bin_pack_bedrock_content..assignJs7 ' Kf}&"D6M11?F* *roc3&K|] \}}| ywrrn)rrrSs rprz=BedrockGuardrail._bin_pack_bedrock_content..Psm(%m)rrinitialrNc3FK|]\}}td|Dyw)c3&K|] \}}| ywrrn)rrSrs rprzGBedrockGuardrail._bin_pack_bedrock_content...Rs,71d$,rNr|)rrSgroups rprz=BedrockGuardrail._bin_pack_bedrock_content..Qs' 5 ,e, , !c |dS)Nrrn)pairs rpz.Ss RVWXRYror)r|rwrr r#)rIrzlengthsr batch_numberss ` rprz*BedrockGuardrail._bin_pack_bedrock_content%s@'N$ $umtuu +E#s(O +S +U38_ + neJwPV`f.fragments+IS"*EYkqvYw &51 1ro) rmaxr|rr7r_nearest_whitespace_split_indexrlr0)rImidpointrrfsplit_atrrs @rprz'BedrockGuardrail._split_bedrock_contentVsD w.sfUUYY[fsrN)defaultc3&K|] }|| ywrrn)rsplits rprzCBedrockGuardrail._nearest_whitespace_split_index..s juX]XiU jsc t|z Sr)abs)rrs rprzBBedrockGuardrail._nearest_whitespace_split_index..sc%("23rorc3RK|]}d|cxkrtksnn| ywrN)r)rrrfs rprzCBedrockGuardrail._nearest_whitespace_split_index..s!Lua%6K#d)6KULs' ')rrrQfinditersearchrrnext)rfbefore after_match candidatesrs` @rprz0BedrockGuardrail._nearest_whitespace_split_indexs6d)q.f6I6R6RSWYZ\d6efptu077hG " jk):t T j3 L LhWWrocvt|tsy|jtfdtDS)aaTrue if `detail` is an AWS error message for input exceeding the per-request text-unit quota. Matched on the message rather than the status code on purpose: AWS is not consistent about which error it raises for this. Observed against a live guardrail with an active content-filter policy, an oversized request comes back as a *ThrottlingException* (429) reading ``Input text size (3273 text units) exceeds the maximum allowed (1000 text units) for the content filter policy (Classic tier)``, while the documented failure mode is a ValidationException (400). Keying off the message covers both. A guardrail *block* is also raised as an HTTPException with status 400, but its ``detail`` is always a dict (built by ``_get_http_exception_for_blocked_guardrail``); a non-200 API error's ``detail`` is always the plain string returned by ``_parse_bedrock_guardrail_error_response``. Checking ``isinstance(detail, str)`` is therefore sufficient to never mistake a real block for a too-large error. Fc3&K|]}|v ywrrn)r substringlowereds rprz=BedrockGuardrail._is_input_too_large_error..s]I9']s)rrlloweranyrL)rhrs @rprz*BedrockGuardrail._is_input_too_large_errors/*&#&]9\]]]ro chunk_resultsc tj|}td|D}|Dcgc]\}}|D]}|}}}}td|D}td|D}d|vrdn|r|dnd} |D cgc](} | jj dxsgD]} | *} } } td|D} t t|D cic]'} | jjD]\}}|| )c}}} }| | |d <|r |r ||d <||d <| r| |d<| rtj||d <|Scc}}}wcc} } wcc}}} w) a Merge the per-chunk ApplyGuardrail responses of a chunked request into one, so a caller cannot tell whether chunking happened. Only ever called with responses that all passed (a block raises immediately from ``_apply_guardrail_content_with_chunking`` and is never added to this list). ``action`` is only set on the merged response when at least one chunk's raw response included it, and left absent otherwise -- mirroring a real single-call response and matching what ``_build_tracing_detail`` treats as "Bedrock didn't report an action". Fields this merge has no opinion on (``actionReason``, ``guardrailCoverage``, ``blockedResponse``, anything AWS adds later) are carried over from the chunk responses rather than dropped, so the response and the logged telemetry keep the shape a single unchunked call returned. The merged keys below win. Per AWS's documented ApplyGuardrail contract, a single call's ``outputs`` is positionally parallel to the ``content`` items *of that call*: an entry per item when anything in the call was masked, or an empty list when nothing in the whole call was masked. Downstream masking (``_apply_masking_to_messages``) walks the merged ``outputs`` by a single running index across the *original, unchunked* message list, so a later chunk's masked text must land at the same global position it would have if chunking had never happened. Naively concatenating each chunk's ``outputs`` breaks that whenever a chunk had nothing masked (its empty list would otherwise silently swallow its items' slots, shifting every later chunk's masked text left onto the wrong message). So every item -- masked or not -- always contributes exactly one entry here, falling back to that item's own original (unmasked) text when its chunk returned no output for it; a wholly-untouched result is then collapsed back to an empty ``outputs`` list to match a real single-call no-op response. A chunk that returns a nonzero output count not equal to its item count is passed through as-is instead of guessed at, since AWS's docs don't cover partial masking within one multi-item call. c3FK|]}tj|ywr)r_merge_logical_unit_outputs)runits rprzFBedrockGuardrail._merge_bedrock_guardrail_responses..s'u_c(8(T(TUY(Z'urc3&K|] \}}| ywrrn)rrSmaskeds rprzFBedrockGuardrail._merge_bedrock_guardrail_responses..sI91fIrc3K|]H}t|jjdtr|jjdJyw)actionN)rrzrrlr chunk_results rprzFBedrockGuardrail._merge_bedrock_guardrail_responses..sD ,//33H=sC  ! ! % %h / sAAGUARDRAIL_INTERVENEDrNrc3RK|]}|jjd!ywrNrzrrs rprzFBedrockGuardrail._merge_bedrock_guardrail_responses..s!'m| (=(=(A(A'(J'ms%'routputsoutputr) r_group_fragment_unitsr|rrzrrr4r_sum_bedrock_guardrail_usage)r logical_unitsper_unit_outputsr rSr merged_outputs any_maskedactions merged_actionr assessmentmerged_assessmentsany_usage_reportedrrmergeds rprrz3BedrockGuardrail._merge_bedrock_guardrail_responsessL 0EEmT "''ugt'u"u%5! ! !wG! :@F! ! !  I8HII  -   '=&G "]dgVXkjn  !.% +4488GM2%  % % % %('m_l'm$m26 $/<  +|OdOdOjOjOl AKeU   3   $,F8  j .F9 -F8  $6F= ! .KKMZF7O G! %  sD<=-E,E cLtjtd|DS)a-Sum each chunk's ``usage`` counters field-by-field into one totals dict. Keys are taken from the responses rather than from a fixed list, so a counter this code does not know about (AWS has added several) is still summed and reported instead of being silently dropped to zero.c3ZK|]#}|jjdxsi%ywrrrs rprz@BedrockGuardrail._sum_bedrock_guardrail_usage.. s1 %%))'28b8s)+)rrr|)rs rpr z-BedrockGuardrail._sum_bedrock_guardrail_usages, 33 $1   rousagesc tttjd|DDcic]t fd|Dc}Scc}w)Nc3.K|] }|D]}|ywrrnrrrs rprz7BedrockGuardrail._sum_usage_counters..,s(RE(RS(R(Rr~c3HK|]}|jxsdywrrrs rprz7BedrockGuardrail._sum_usage_counters..+s!A3,1,As")rr5rfromkeysr)rrs `rprz$BedrockGuardrail._sum_usage_counters&sO ! ==(R&(RR SA&AAA    sA c &dtttfdtdtttffd}tdt tt |ddd D}tfd t ||dd tfzDS) aGroup consecutive text-fragment chunk results back into the one content item each group came from, leaving every ordinary chunk result as a unit of one. The group size is read off the results themselves rather than assumed, because a single content item can be bisected repeatedly: two levels of splitting yield four fragments for one item, not two. Assuming a fixed pair here would emit two outputs for one message and shift every later message's masked text onto the wrong message.rr}rcZ|\}}|dk(rtd|jdz dfS|dz dfS)NrrTF)rr{)rr} remainingrSs rpadvancez7BedrockGuardrail._group_fragment_units..advance>s>"LIqA~1f889A=tCCq=%' 'roc30K|]\}\}}|r|ywrrn)rrrS starts_units rprz9BedrockGuardrail._group_fragment_units..Ds$ '';  s)rFrrNc3@K|]\}}t||ywrr)rstartrrs rprz9BedrockGuardrail._group_fragment_units..Is!wU=s34ws)r|rwrryr rr#r)rr"startss` rpr z&BedrockGuardrail._group_fragment_units0s (U39- (7P (UZ[^`d[dUe (  +4U:mU\fp;q5rstsu5v+w   ws6SYZ[Z\S]aderas`uSuGvwwwrorc:t|dkDrhdtdttdffddtdtffd dj fd|D}t fd |D}t| f|fS|\}|jjd xs|jjd xsd }t|t|jk(rt|t|fS|std|jDdfSt|dfS)aSReduce one logical unit (a fragment group of any size, or a single chunk result) to the ``BedrockGuardrailOutput`` entries it contributes to the merged response, plus whether any masking actually happened in it. Per AWS's documented ApplyGuardrail contract, a single call's ``outputs`` is positionally parallel to the ``content`` items *of that call*: an entry per item when anything in the call was masked, or an empty list when nothing in the whole call was masked. Downstream masking (``_apply_masking_to_messages``) walks the merged ``outputs`` by a single running index across the *original, unchunked* message list, so a later chunk's masked text must land at the same global position it would have if chunking had never happened. So every item -- masked or not -- always contributes exactly one entry here, falling back to that item's own original (unmasked) text when its chunk returned no output for it. A chunk that returns a nonzero output count not equal to its item count is passed through as-is instead of guessed at, since AWS's docs don't cover partial masking within one multi-item call. A unit holding more than one result is a fragment group: every result in it is one fragment of a single content item's text, so the group collapses to one entry built from each fragment's masked text (or that fragment's own original text where it came back unmasked), concatenated in order. This holds for any group size, not only two. rr}r.ct|jjdxs|jjdxsdS)Nr r rn)r|rzr)r}s rpfragment_outputszFBedrockGuardrail._merge_logical_unit_outputs..fragment_outputsjs7V__00;bv?R?RS[?\b`bccroc|jdjdxsijdxsd}|}|r|djdnd}||S|S)Nrrfr)rIr)r}rJr rr*s rp fragment_textzCBedrockGuardrail._merge_logical_unit_outputs..fragment_textmsl!'!2!6!6v!>!D" I I!!"2&!9:A v 6t!'!3v??rorc3.K|] }|ywrrn)rr}r,s rprz?BedrockGuardrail._merge_logical_unit_outputs..us(R6v)>(Rc3.K|] }|ywrrn)rr}r*s rprz?BedrockGuardrail._merge_logical_unit_outputs..vs#P$4V$<#Pr.rr r rnc3K|]6}t|jdxsijdxsd8yw)rfrrN)r2rrs rprz?BedrockGuardrail._merge_logical_unit_outputs..~sE'((6*0b55f=Cs<>FT) rryr|r2rljoinrrzrrIr)r merged_textrr chunk_outputsr*r,s @@rprz,BedrockGuardrail._merge_logical_unit_outputsKs+: t9q= d)B duMcehMhGi d @&? @C @"$(RT(R!RK ##P4#P PJ* <> J J+4488Cp|G\G\G`G`aiGjpnp } \%9%9!: :'m)<< <)00     ]#T))rorr9rc 4K |jj|j|j|jd{S7#t $rt $r}t|dd}t|tjr |j|\}} |r|j|jd| i|xsid|jtj t"j$jtj t"j$|z j'|t || |#t $rwxYwt)j*dt-||j|jdt-|i|xsid|jtj t"j$jtj t"j$|z j'|d}~wwxYww) aHPOST a signed Bedrock request, logging+raising on network/HTTP errors. Shared by both the ApplyGuardrail and InvokeGuardrailChecks paths so their transport-error handling cannot drift. Returns the raw ``httpx.Response`` on success (including non-2xx that httpx did not raise on); the 200-path logging, status and tracing stay with each caller because the two APIs report differently. ``log_transport_failure=False`` suppresses the ``guardrail_failed_to_respond`` entry for a non-200 that is re-raised as an ``HTTPException``, for callers that own consolidated per-request logging. The ApplyGuardrail path needs this: ``AsyncHTTPHandler.post`` calls ``raise_for_status()``, so every non-200 lands in this handler, and one logical request can legitimately produce several of them (a too-large probe, then each rejected bisection level) while still succeeding overall. Logging per attempt would report a recovered request as several failures plus a success. The connection-level branch below (timeout, endpoint down) still logs unconditionally: it re-raises the original exception rather than an ``HTTPException``, so no consolidating caller catches it, and suppressing it would drop the only record of the failure. )rHr;rINrzrrrrrrrerrrdrz0Bedrock AI: failed to make guardrail request: %s)rpostrHbodyrIrrrrhttpxResponserrrrrrjrrkrrrrl) rrrrdrere err_responserrs rprzBedrockGuardrail._sign_and_posts:/ ++00$((%**(001    & #*!Z">L,7DD\R#&,WW/3/F/F '5*6);-J'1';';'=%-\\(,,%?%I%I%K&.ll8<<&@:&M%\%\%^'1X (KW]^^$ ! & &'Y[^_`[a b  K K#'#:#:)0#a&(9)/R!>%//1!hll3==?",,x||4zAPPR% L  M& sNH?A AA HA H'HB!D"#RVRZRZ[aRbRhfhQmQmntQuIuIu#L#99+|T T$>r  "&"H"H)-)K)KG)T)ZXZi^c^h^hi#     #j  s)+CC=(C$%C7CC$C$c Ktjtj}|j |||}|s t S|j \}} ||jd} |r|jdnd} |j|| |j| | t} tjd| j|xs%|dk(rtj ntj"} |j%| || |d{}|j&d k7r|j)|\}}tj*d |j&||j-|j.d |i|xsid |j1tjtjj1tjtj|z j3| t5|| t7t8j;|j=}|jE|}|j-|j.|jG||xsi|jItK||j1tjtjj1tjtj|z j3| |r|jM|nd |r|jO||t S7#t>t@f$r}tj*dtC||j-|j.d tC|i|xsid |j1tjtjj1tjtj|z j3| t5dd di|d}~wwxYww)aMRun the resource-less InvokeGuardrailChecks API and enforce thresholds. Detect-only: the API returns scores, never rewritten content. We map scores to a block decision via the configured thresholds. On a pass we return an empty ``BedrockGuardrailResponse`` (downstream masking treats it as a no-op). r`)rrr<N)r9r;rr-r<r>z-Bedrock InvokeGuardrailChecks request url: %sr)rrrdrerz #8#  ""#RTdThThi. ,2g,=  ( (CVC`C` '+&9&9-%!! ':' !   % % ,*.*V*VWe*f 'K & &N**   K K#'#:#:)0.(A)/R!>%//1!hll3==?",,x||4zAPPR% L  KO O #./M#N#^#^_m_r_r_t#uM"!BB=Q  GG#66$($U$UVc$d%+!;;D%//1!hll3==?",,x||4zAPPR% L  !fg  s9DP LC-P 2,L"DP "P1CPPP ct|xsijdxsi}ddd|jfddd|jfddd|jfg}|j xsi}g}|D]\}}}} | ||vr|j|xsi} |dk(r%| jd r|j |d d | jdxsgD]} | j|} t| ttfs+t| | k\s:|dk(r|| jdt| d n|| jdt| d } |j | |S)aReturn the check results whose score meets/exceeds the configured threshold. Only checks present in the configured ``checks`` block are evaluated; a threshold of ``None`` makes that check detect-only (never contributes a violation). A truncated sensitiveInformation result counts as a violation (fail closed: omitted detections were never scored). Only the non-sensitive label (category/type) and the numeric score are kept -- never offsets or matched text. r|rV severityScorecategoryrUrWconfidenceScorer truncatedT)checkrR)rSrPrO)rSrrQ) rrrrrrrrrwfloat)rrzr| check_specsconfigured_checksrM check_key score_field label_field threshold check_resultentryscore violations rprGz2BedrockGuardrail._collect_invoke_checks_violationszs*.x~2.B.B9.M.SQS)T  --   _j$:V:V W&!--   $(;;#4":< >I 1 :I{K I5F$F";;y17RL22|7G7G 7T!!ID"IJ%)))4: 1 +.ec5\2uU|y7P'/9#,:9Nafglamn'0%))F:K`efk`lm %%i0 1  1roc"tjt|}|jdxsijdxsi}|jdxsgD]0}t |tst D]}|j |d2|S)zFStrip PII location offsets from a checks response before it is logged.r|rWN)copydeepcopyrrrr]pop)rz sanitized sensitiver\rs rprHz=BedrockGuardrail._sanitize_invoke_checks_response_for_loggings ,0==h+H %MM)4:??@VW][] ]]9-3 )E%&<)CIIc4() )roover_thresholdc|rdSdS)Nguardrail_intervenedrrn)res rprIz*BedrockGuardrail._get_invoke_checks_statuss)7%FYFrorMci}d|DDcgc]}t|tr|r|}}|r||d<|rdnd|d<|Scc}w)Nc3dK|](}|jdxs|jd*yw)rPrNr)rvs rprzGBedrockGuardrail._build_invoke_checks_tracing_detail..s)Q!%% +TU "K"4?013I +_4/0"s 5B/B/cg}|j|D]f}|jdgxsgD]K}|jdxs|jd}t|ts8|s;|j |Mh|S)u` Flatten the BLOCKED assessments into a list of human-readable category names suitable for queryable OTEL / standard-logging attributes. SECURITY: only emits the non-sensitive policy *label* (topic name, content-filter type, PII entity type, named-regex name). The raw ``match`` field is intentionally NOT used — it carries the user's original input that triggered the rule (e.g. a credit-card number that hit a regex, or the literal custom word). Surfacing it to telemetry would re-introduce the sensitive content the guardrail was supposed to keep out. Entries that only have a ``match`` (bare customWords, unnamed regexes) are therefore skipped — operators can still see the count in ``_extract_blocked_assessments`` which feeds the HTTP error detail. matchesnamer)_extract_blocked_assessmentsrrrlr)rrznamesrmatchrns rprz2BedrockGuardrail._extract_violation_category_namesWs #%66x@ (E9b17R ( &)>UYYv->eS)eLL'  ( ( roc Rg}|jdgxsg}|D]}|jd}|r~|jdxsgDcgc]J}|jddk(r4d|jd|jd|jddL}}|r|jd|d |jd }|r|jd xsgD cgc]Z} | jddk(rDd | jd| jd | jd | jdd\} } | r|jd | d |jd} | rg} | jdxsgD]J} | jddk(s| jd| jd| jddL| jdxsgD]Z}|jddk(s| jd|jd|jd|jdd\| r|jd| d |jd}|r g}|jdxsgD]Z}|jddk(s|jd|jd|jd|jdd\|jdxsgD]j}|jddk(s|jd|jd|jd|jd|jddl|r|jd|d |jd}|sj|jd xsgD cgc]Z} | jddk(rDd | jd| jd| jd| jdd\}} |s|jd|d |Scc}wcc} wcc} w)a Walk the Bedrock guardrail response and emit a structured list of BLOCKED assessment entries describing exactly which policies fired. Mirrors the iteration in `_should_raise_guardrail_blocked_exception()` but produces a list of `{policy, matches}` dicts instead of a bool. Each `match` carries the originating subcategory, type, action, and matched term where available, so the client can render a precise explanation of the violation. r topicPolicytopicsrBLOCKEDrr)rPrrr)policyr contentPolicyfilters confidencefilterStrength)rPrrrr wordPolicy customWordsr)rPrrmanagedWordLists)rPrrrsensitiveInformationPolicy piiEntitiesregexesregex)rPrrrrcontextualGroundingPolicyrZr])rPrrZr]r)rr)rrzblockedrr topic_policyt topic_matchescontent_policyfcontent_matches word_policy word_matcheswmwsensitive_info pii_matchespr contextualgrounding_matchess rprz-BedrockGuardrail._extract_blocked_assessmentsqs&(%\\-<B %q J%>>-8L+..x8>B !uuX)3 %- !f !f "#%%/  ! !!NNm #VW(^^O(*v)+*,&&*:   NNl|#TU(^^,HIN*, '++M:@b AuuX)3#**,9()f )*w*+%%/  (++I6<" AuuX)3#**,5()f )*w)*w*+%%/  NN&B'2$(CDJ)nnY7=2 %uuX)3%. !f %&UU;%7!"w"#%%/  %! %%NN&A'8Yq f_ ! #X %s APAPAP$cd}|jdgxsg}|r1|D],}|jds||jdxsdz }.|jdur/|xsi}t||jdd||jSd|d }|jr|j|d <|j r|j |d <|j |}|rt||d <td |S)zA Get the HTTP exception for a blocked guardrail. rr rfTrrrsrtrq)rrrrrrur) rrrrnrrrrr) rrzrbedrock_guardrail_output_textr r rwrhrs rprz:BedrockGuardrail._get_http_exception_for_blocked_guardrails .0%>Fll9VX>Y>_]_ ! N::f%1VZZ5G5M2M1 N  * *d 2#/#52M*5#''1DE*#22  1*G)   # #,0,D,DF( )  )-)>)>F% &!>>xH $CK$PF= !V<B %1 $J%>>-8L%))(39r#$Eyy*i7#$ (^^O#$ %/NN3O$P !$488GM2 &2( %>>(3y@#'(033I>D"!(( 99X.);#'( +5..9T*U '*$?$C$CI$N$TRT!(9$$'++H5B#$_1 $jrouser_api_key_dictcache call_typec|Ktjd|ddlm}tj }|j ||dur|S|jtt||}|tjd|S|j|}|j} | stjd |S|jd | |tj d{} |j| | } |j|jxs|| |j |d<|||j"|S7\w)Nz.Inside Bedrock Pre-Call Hook for call_type: %sr*add_guardrail_to_applied_guardrails_headerr;rdTrr;z3No messages found for call_type, skipping guardrailrz5No user-role messages available for guardrail payloadrrJrrrZrrrtr!rurrrn)rr)litellm.proxy.common_utils.callback_utilsrr+rshould_run_guardrail%get_guardrails_messages_for_call_typerr=rrsr^8_update_messages_with_updated_bedrock_guardrail_responser'rtrurn) rrrr;rrrd new_messagesrrrupdated_subsets rpasync_pre_call_hookz$BedrockGuardrail.async_pre_call_hookf sa ""#SU^_ 2E1M1M  $ $$: $ Fd RK"HH9i0I   & &'\ ]K#HHR^H_ #0#A#A & &'^ _K372O2O&2;; 3P3 - "!% ] ]&'A!^!  88+==M$2(779 Z 3UYUhUhi 3- sCD<D:AD<cKddlm}tj}|tj j k(rtj}|j||dury|jtt||}|tjdy|j|}|j}|stjdy|j!d ||| d{} |j#|| } |j%|j&xs|| |j( |d <|||j*|S7\w)NrrrTr6Bedrock AI: not running guardrail. No messages in datarz8Bedrock AI: not running guardrail. No user-role messagesrrrrrr)rrr+rr= call_mcp_toolrrrrrrrrrsrr^rr'rtrurn) rr;rrrrdrrrrrs rpasync_moderation_hookz&BedrockGuardrail.async_moderation_hook s_  +>*I*I  //55 5,<Bedrock guardrail provided masked output, applying to messages)rrzPMasking enabled but no masked output from guardrail, returning original messages)#_extract_masked_texts_from_responserr_apply_masking_to_messagesrr)rrrrs rprzIBedrockGuardrail._update_messages_with_updated_bedrock_guardrail_response: sk #FFGab   & &'g h22HS_2` `  $ $(B(B & &b roc Kddlm}ddlm}ddlm}t j}g}|23d{} |j| 76t|} | r t|dn||} t| trt| } | } |jd | |jd |t j" d{7}ns#t$$r}|j&}| xr!|j(d k(xrt|t*}t-t j|z t.j0}| r|s|st3|\}}t5|r|n|j(d |D]}| Yd}~yd}~wt6$r}| r\| j8xs |j8|_|j:| |_t=j?|dD]}| Yd}~ytA| dd}ttCdtEd|jFdg|j8} ||| _$d}Yd}~nd}~wwxYw||jK| || r&t| | k7r tM| n|D]}| y|| }|23d{7} | 6y| r#t5|jNdD]}| y|D]} |  yw)z Process streaming response chunks. Collect content from the stream and run the bedrock OUTPUT scan (post_call only validates the response). r)MockResponseIterator)stream_chunk_builder)TextCompletionResponseNT)restore_identity)chunksrrrruz: F)stream_startedrr<rcontent_filterrr finish_reason)rrrr)model_responsezD: streamed response could not be assembled for scanning, blocking it)()litellm.llms.base_llm.base_model_iteratorr litellm.mainrlitellm.types.utilsrtime monotonicrr'r&rrCr(r^rr+rrrhrrr#r#anthropic_sse_ping_interval_secondsr"r%rrrrrbuild_block_sse_chunksrr?rBrrrr$rn)rrrzrrrr started_at all_chunkschunkraw_sseassembled_model_responsepre_guardrail_text_pre_block_responseoutput_guardrail_response block_exc block_detailis_blockheaders_flushed block_messagerS error_framer: block_chunk_original_usage sse_chunk mock_responses rp'async_post_call_streaming_iterator_hookz8BedrockGuardrail.async_post_call_streaming_iterator_hook[ s! S5>!NN, 79 # % %%   e $ %8+:6 **t L%Z8 ! . >(;)4//5/H0++CDHZZ77OP#$I $O $ #7G_#`M -  e  -  :&&''kl  " "! " #   s+K A AA K A  AK  6C CC K  H;BE61K 6 H;AH6K  AH61K 6H;;A K J J  J;K cg}|jdgxsg}|stjdgS|D]'}|jd}||j|)|S)z Extract all masked text outputs from the guardrail response. Args: bedrock_guardrail_response: Response from Bedrock guardrail Returns: List of masked text strings r z-No masked outputs found in guardrail responserf)rrrr)rrmasked_output_textmasked_outputsr rs rprz4BedrockGuardrail._extract_masked_texts_from_response st02E_EcEcdmoqErExvx & &'V WI$ 8F'-zz&'9L'")),7 8 "!rocTg}d}|D]}|j}|jd}||j|8t|tr|t |kr8|||d<|dz }n*t|t r|j|||\|d<}|j||S)a  Apply masked texts to message content using index tracking. Args: messages: Original messages masked_texts: List of masked text strings from guardrail Returns: Updated messages with masked content rrIr) content_listr masking_index)r`rrrrlrrv_mask_content_list)rrrupdated_messagesrr new_messagerIs rprz+BedrockGuardrail._apply_masking_to_messages s#%  1G!,,.K!ooi0G '' 4'3' 3|#44-9--HK *!Q&MGT*8<8O8O!(!-"/9P95 I&  # #K 0- 10 rorrc8g}|D]}t|trAd|vr=|j}|t|kr |||d<|dz }|j |Tt|t se|t|kr ||}|dz }||j |||fS)a9 Apply masking to a list of content items. Args: content_list: List of content items masked_texts: List of masked text strings starting_index: Starting index in the masked_texts list Returns: Updated content list with masked items rfr)rrr`rrrl)rrrr new_contentrnew_items rprz#BedrockGuardrail._mask_content_list) s02  -D$%&D.99; 3|#44'3M'BHV$!Q&M""8,D#& 3|#44' 6D!Q&M#&&t, -M))roc,|j|}|stjdytjdt|t |t j r|j||ytjdt|y)z Apply masked content from bedrock guardrail to the response object. Args: response: The response object to modify bedrock_guardrail_response: Response from Bedrock guardrail containing masked content z2No masked outputs found, skipping response maskingNz1Applying masking to response with %d masked textsz)Unsupported response type for masking: %s) rrrrrrrC _apply_masking_to_model_responserr)rrzrrs rprz+BedrockGuardrail._apply_masking_to_responseH s|#FFGab  & &'[ \ ""#VX[\hXij h 5 5 6  1 1(L I ( ()TVZ[cVd eroc8d}|jD]}t|trz|jjs+t|jjt sP|t |ks_|||j_|dz }tjdt|tr{|jjst|jjt s|t |ks|||j_|dz }tjdt|ts+|js9t|jt sU|t |kse|||_ |dz }tjdy)z Apply masked texts to a ModelResponse object. Args: response: The ModelResponse object to modify in-place masked_texts: List of masked text strings from guardrail rrz)Applied masking to choice message contentz'Applied masking to choice delta contentz&Applied masking to choice text contentN) rrr?rrIrlrrrrEdeltarFrf)rrzrrrs rprz1BedrockGuardrail._apply_masking_to_model_responsec s4 && ]F&'*>>))j9O9OQT.U$s<'881=m1L.%* ,223^_F$45<<''Jv||7K7KS,Q$s<'88/;M/J ,%* ,223\]FK0;;:fkk3#?$s<'88&2=&A %* ,223[\+ ]rocrddlm} ddlm}||j j S|S#t$r|cYSwxYw)aResolve the cache used to remember which segments a session already scanned. Prefers the proxy's shared cache (``internal_usage_cache.dual_cache``), which is backed by Redis when the deployment configures it, so incremental state is shared across proxy instances. Falls back to a process-local ``DualCache`` singleton when the proxy is not running (e.g. unit tests), where sharing does not apply. r)dc)proxy_logging_obj)%litellm.integrations.custom_guardrailrlitellm.proxy.proxy_serverrrinternal_usage_cache dual_cache)fallback_cache_proxy_loggings rp_incremental_scan_cachez(BedrockGuardrail._incremental_scan_cache sG O " V  %!66AA A  "! ! "s ( 66cddD]+}|j|xsg}td|Ds+yy)zReturn True if the guardrail rewrote (masked/anonymized) any scanned text. Bedrock returns non-empty ``output``/``outputs`` text only when it changed the content; an ``action == "NONE"`` response leaves both empty. )r r c3bK|]'}t|txr|jd)yw)rfNrrs rprzGBedrockGuardrail._bedrock_response_has_masked_output.. s(Q4:dD)>dhhv.>>Qs-/TF)rr)rrzfieldrs rp#_bedrock_response_has_masked_outputz4BedrockGuardrail._bedrock_response_has_masked_output s< + ELL'-2EQ5QQ roc K|j}|j|||d{}|y|stjd|S|j d|Dcgc]}t d|c}|t jd{}|j|r!tjd|jy|j|||d{|S7cc}w7[7w) aScan only the text segments not already seen earlier in this session. Returns ``None`` when incremental scanning is inactive (feature off, no session id, masking enabled, or cache unavailable) or when the guardrail turns out to mask content, telling the caller to run the normal full scan. Otherwise scans only the new segments and skips the Bedrock call entirely when nothing is new. Incremental mode is for blocking/detection guardrails only: if the guardrail returns masked output it cannot be applied to the skipped context, so the scan falls back to the full path and no session state is recorded. )rrrNzNBedrock Guardrail: no new messages to scan for this session, skipping API callrrrrzBedrock Guardrail %s: guardrail returned masked/anonymized content; only_scan_new_messages cannot apply masking to skipped context, falling back to a full-context scan) r#filter_new_texts_for_sessionrrr^r-r+rr'rrnmark_texts_scanned)rrrrr new_textsrfbedrock_responses rp_apply_incremental_request_scanz0BedrockGuardrail._apply_incremental_request_scan s"335!%!B!B%"C"    & &'w xM(,(E(EW`at/VTJa%2;; )F) #   3 34D E ( (v##  %%%&    A b#  s@(C*C0C*C! /C* C& A C*C(C*!C*(C* logging_objLiteLLMLoggingObjc(K|jdxsg} tjdt||dk(r |j |||d{}||Sg}|j ||||}|j r|S|j} |j} |j} | r^|dk(rtjntj} |dk(rdnd } | dk(rytt| Dcgc]:\}}t|t!d t#|jd xsd  d<c}}}|j%d||| d{}n|j%d | || d{}|jd}|r8|D]2}|jd}|st#|}|j'|4nJ|jd}|r7|D]2}|jd}|st#|}|j'|4|j)||| | }tjd||d<|S7cc}}w77#t*t,f$rt.$r2}tj0dt#|t/d|d}~wwxYww)a Apply Bedrock guardrail to a batch of texts for testing purposes. This method allows users to test Bedrock guardrails without making actual LLM calls. It creates mock messages to test the guardrail functionality. Args: inputs: Dictionary containing texts and optional images request_data: Request data dictionary for logging metadata input_type: Whether this is a "request" or "response" logging_obj: Optional logging object Returns: GenericGuardrailAPIInputs - processed_texts may be masked, images unchanged Raises: Exception: If content is blocked by Bedrock guardrail rz3Bedrock Guardrail: Applying guardrail to %s text(s)r)rrrN)rrrrrzrrr<rIrrstopr)r)rJrzrrZrr rfr )rrrrz1Bedrock Guardrail: Successfully applied guardrailz0Bedrock Guardrail: Failed to apply guardrail: %szBedrock guardrail failed: )rrrrr-rrrrrr+rrrCr r?rBrlr^rr rrrr)rrrrr.rincremental_resultr selectionrrr _log_hookbedrock_source_idx_msgsynthetic_responser, output_list output_itemrr outputs_listr:s rpapply_guardrailz BedrockGuardrail.apply_guardrail s6zz'*0bn > & &'\^abg^h iY&262V2V!!-3W3-" &1--L#HH)% I I "" '0'B'B #,#:#:M)2)F)F !/88I.J !!+d$&*(/)4,/0C0Ir,J)"/5  ! 1&.2-J-J'!3%1+4 .K.($.2-J-J&!2%1+4 .K.($&6%9%9(%C '2= '2v'> '*-l*;K(// < = +;*>*>y*IL#+7AK+6??6+BL+.1,.? , 3 3K @ A 33)+$7 4L ! & &'Z [*F7OM}-J !((P67   > & &'Y[^_`[a b8<= = >sJ;IH8IJ$IJA-I/?H; .!III-I./IA I)AI7J8I;IIJ-J  JJr)NN)NNN)NNNN)T)yrhrirjrr rrmrrlr*robjectrTrwr classmethodrvr+r staticmethodrr rr,r6rrCrr0rrrrerrrrrrrrrr|rr~rr r'r:rYrr4r^r]rr5ryrprrr8r9rrsrqrorrrrrrr rr r2rrr.r?rDr\r1r/rGrHr@rIrArJrrrKrrrrrrrrr!rr>rrrrrrrDr rrrrrr#r'rr-r< __classcell__)rs@rprrs37$6+/'+27IM140314"LA  4ZA *A %)4K A )73;+??$F A #($, A "'A #($,A  A F $/B*C  ":WS&[=Q"QTX"X]abegjbj]knr]r6dCS>TW[>[`n237 %'(4/  4m+<@  !237/3 )*'(4/ %,   ,5E$OaJbeiJi,5);5@R5$7G2H42OTXYkTl,JJ '(4/  & 248H3IX[`cfj`j &63$!"23$$Cy $ sCx4  $6L CyL ,L  L 12 L ( L \"""S#X- " " "  "H 01D8"&&6!7S D(    2$,X#%)#'CC C  C t Cd{CDjCP3715$(9=  )* '(4/ ''$.  Tk  0$6   " D3715$(9= e)*e'(4/e''$. e Tk e 0$6 e "eNH,-H#38,H# H  H t HTkH(HHH!%%: ;H (#- .HT0d,-0d#38,0d# 0d  0d t 0dTk0d(0d0d!%%: ;0d "0dd[L,-[L#38,[L# [L  [L t [LTk[L([L[L!%%: ;[L "[Lz' ' ' Tk ' ( '  ' t' !))> ?'  ' R  1  Tk  (    t     D$ $ Tk$ ( $  $ t $ !))> ?$  $ LH=O4PUY. ,-. .  u',-s2 3. . `2J,-2J u',-u5G5L/MM NQU U2J2Jh!Xc!Xc!X!XF^&^T^^2J 9:J !JJX   9:       H-B$C H]  x 9:x u.34c9 :xx48*-s238* u+S0147 88*8*@'+ L.LTkL( L  L $ L L` 34 =A#Y " #  *3715 % )*% '(4/% ''$. % " # % T3715$(9= h*)*h*'(4/h*''$. h* Tk h* 0$6 h* "h*T06=0 $ %0d 0  c3h  G$G?GG /0    UY 56 FJTk 0 0 0JJB-u~~-Ra-2&&SXY\^aYaSb&40CF: >:RW[\_W`4A5MARVW[R\AHOS#=0#=@Dt #= 0 0#=JKBZK_cKZA)AA A $ A S4 $ & AFCC*C$ CJGjGj*GjX'(%=   BK)KK K +T1 2 KZ"Nf"kopskt".( -.( >B3i(  ( T* I*59#Y*OR* tCy#~ *>f#%f%=f  f6]9N9N]^bcf^g]lp]BY$ +J>J>12 J> 12 J> % J>ror)ossyspathinsertabspathrr`rLrercollections.abcrrrrr itertoolsrr typingr r r r rrrrr8fastapirpydanticrrrlitellm._loggingrlitellm.cachingrlitellm.constantsrlitellm.exceptionsrrr'litellm.litellm_core_utils.core_helpersr7litellm.litellm_core_utils.llm_cost_calc.guardrail_costr9litellm.llms.anthropic.chat.guardrail_translation.handlerr1litellm.llms.base_llm.guardrail_translation.utilsr!litellm.llms.bedrock.base_aws_llmr&litellm.llms.custom_httpx.http_handlerrr litellm.proxy._typesr!'litellm.proxy.common_request_processingr"(litellm.proxy.common_utils.sse_keepaliver#&litellm.proxy.guardrails.anthropic_sser$r%r&r'r(litellm.secret_managers.mainr)rr*r+litellm.types.llms.openair,r-Alitellm.types.proxy.guardrails.guardrail_hooks.bedrock_guardrailsr.r/r0r1r2r3r4r5r6r7rr8rOr9r5r;*litellm.litellm_core_utils.litellm_loggingr<r/r=r>r?r@rArBrCrDrErFrHrm frozensetrKrLrNrPcompilerQrRrTrXr]r`rrlrcrerrryr~rrvrrrnrorpr`s 277??7+, ==')[[[ !11%H6AVZ^90TM8RQ   :60W   "!(19h2G(HH.#U89-u87:-u:'RZZ.U./I%uI-/"E.$-.g$hEh,!5+ KE$s,E'E"FG*3Hk3J)KK00%:%  . Z EtEE Cd CT CQ.> Q.>ro