o
    ùT·jÒP  ã                   @  sÆ  d dl mZ d dlZd dlZd dlZd dlmZmZmZm	Z	 d dl
mZmZ d dlZddlmZmZ ddlmZ ddlmZmZ dd	lmZ dd
lmZmZmZ ddlmZ ddlmZm Z m!Z! eg df Z"ed Z#dZ$e %d¡Z&dXdd„Z'dYdd„Z(dZdd„Z)d[d"d#„Z*d\d%d&„Z+d]d)d*„Z,d^d+d,„Z-d_d0d1„Z.d`d5d6„Z/dad7d8„Z0dbd;d<„Z1G d=d>„ d>ƒZ2G d?d@„ d@ƒZ3eG dAdB„ dBeƒƒZ4edCdD�G dEdF„ dFƒƒZ5ddeedddddddGœ
dcdUdV„Z6g dW¢Z7dS )dé    )ÚannotationsN)ÚLiteralÚCallableÚ	AwaitableÚcast)ÚfieldÚ	dataclassé   )Ú	NOT_GIVENÚNotGiven)Úasyncify)Únormalize_httpx_urlÚrequest_not_read_exceptions)ÚFinalRequestOptions)Ú	_ProviderÚ_create_providerÚ_ProviderRuntime)ÚOpenAIError)ÚBedrockAwsAuthÚBedrockAwsAuthConfigÚAwsCredentialsProviderzstr | Awaitable[str])ÚmantleÚruntime)Úauthorizationzx-amz-content-sha256z
x-amz-datezx-amz-security-tokenz^[a-z]{2,8}(?:-[a-z0-9]+)+-\d+$Úvalueú
str | NoneÚreturnc                 C  s   | d u rd S |   ¡ }|pd S ©N)Ústrip)r   Ú
normalized© r    ú[/home/dinkstrade/pdmp-scanner/venv/lib/python3.10/site-packages/openai/providers/bedrock.pyÚ_normalize_optional_string   s   r"   Úbase_urlústr | httpx2.URLú
httpx2.URLc                 C  sH   t | ƒ}|j d¡}t d|¡}|d ur|d | ¡ … }|j|p!dd�S )Nú/z/responses(?:/.*)?$)Úpath)r   r'   ÚrstripÚreÚsearchÚstartÚ	copy_with)r#   Úurlr'   Úresponses_matchr    r    r!   Ú_normalize_base_url&   s   r/   ÚregionÚstrútuple[str, str]c                 C  sX   |   d¡rdS |   d¡rdS |   d¡rdS |   d¡rdS |   d	¡r#d
S |   d¡r*dS dS )Nzcn-)zamazonaws.com.cnzapi.amazonwebservices.com.cnzeusc-)zamazonaws.euzapi.amazonwebservices.euzus-iso-)z
c2s.ic.govzapi.aws.ic.govzus-isob-)zsc2s.sgov.govzapi.aws.scloudzeu-isoe-)zcloud.adc-e.ukzapi.cloud-aws.adc-e.ukzus-isof-)zcsp.hci.ic.govzapi.aws.hci.ic.gov)zamazonaws.comúapi.aws)Ú
startswith©r0   r    r    r!   Ú_runtime_dns_suffixes0   s   





r6   Úhostnameú"tuple[BedrockEndpoint, str] | Nonec                 C  s|   |   d¡ ¡  d¡\}}}| d¡\}}}|r |r t |¡d u r"d S |dkr.|dkr.d|fS |dv r<|t|ƒv r<d|fS d S )NÚ.úbedrock-mantler3   r   >   úbedrock-runtimeúbedrock-runtime-fipsr   )ÚremovesuffixÚlowerÚ	partitionÚ_AWS_REGIONÚ	fullmatchr6   )r7   ÚserviceÚ	separatorÚ	remainderr0   Úregion_separatorÚsuffixr    r    r!   Ú _parse_bedrock_endpoint_hostname@   s   rG   ÚNonec                 C  s&   | d urt  | ¡d u rtdƒ‚d S d S )NzSThe Bedrock AWS `region` is invalid. Use a standard AWS region such as `us-east-1`.)r@   rA   r   r5   r    r    r!   Ú_validate_bedrock_regionM   s   ÿrI   ÚendpointÚBedrockEndpointc                C  s‚   t | jƒ}|d u rd S |\}}| jdkrtdƒ‚||kr*td|› d|› d|› d�ƒ‚|d ur=||kr?td|› d|› d	�ƒ‚d S d S )
NÚhttpsz1Canonical Amazon Bedrock endpoints require HTTPS.úThe Bedrock ú' hostname does not match the selected `z` endpoint. Set `endpoint='z'` to use this hostname.úThe Bedrock endpoint region `z,` does not match the configured AWS region `ú`.)rG   ÚhostÚschemer   )r#   rJ   r0   Úcanonical_endpointÚcanonical_familyÚcanonical_regionr    r    r!   Ú$_validate_canonical_bedrock_endpointR   s"   

ÿÿÿÿrV   c                 C  s<   | dkrd|› dt |ƒd › �nd|› d�}td|› d�ƒS )	Nr   zbedrock-runtime.r9   r   zbedrock-mantle.z.api.awszhttps://z
/openai/v1)r6   r/   )rJ   r0   r7   r    r    r!   Ú_default_bedrock_base_urlg   s
   ÿ
ýrW   ÚleftÚrightÚboolc                 C  s    | j | j| jf|j |j|jfkS r   )rR   rQ   Úport)rX   rY   r    r    r!   Ú_same_originp   s    r\   Úrequestúhttpx2.RequestÚbytesc              
   C  s.   z| j W S  tƒ y } ztdƒ|‚d }~ww )Nz}Bedrock SigV4 authentication requires a replayable request body. Buffer the body before sending or use bearer authentication.)Úcontentr   r   )r]   Úexcr    r    r!   Ú_body_for_signingt   s   ÿý€ÿrb   c                 C  s   d| j v r	tdƒ‚d S )NÚAuthorizationzXBedrock provider authentication cannot be combined with a custom `Authorization` header.)Úheadersr   )r]   r    r    r!   Ú#_assert_provider_owns_authorization~   s   
ÿre   Úoptionsr   c                 C  s   | j rtdƒ‚d| _ | S )Nz‡Bedrock SigV4 authentication does not support automatic redirects. Send a new request to the redirect target so it can be signed again.F)Úfollow_redirectsr   )rf   r    r    r!   Ú_without_redirectsƒ   s   ÿrh   c                   @  sH   e Zd Zddd„Zddd„Zddd„Zddd„Zddd„Zddd„ZdS )Ú_BedrockBearerAuthÚtoken_providerÚBedrockTokenProviderr#   r%   r   rH   c                C  s   || _ || _d S r   )Ú_token_providerÚ	_base_url)Úselfrj   r#   r    r    r!   Ú__init__Ž   s   
z_BedrockBearerAuth.__init__r]   r^   c                 C  s"   t |ƒ t|j| jƒstdƒ‚d S )Nz`Refusing to authenticate a Bedrock request for an origin other than the configured provider URL.)re   r\   r-   rm   r   ©rn   r]   r    r    r!   Ú_validate_request’   s   ÿÿz$_BedrockBearerAuth._validate_requestr1   c              
   C  sŽ   z	t t|  ¡ ƒ}W n ty   ‚  ty! } ztdƒ|‚d }~ww t |¡r8t|dd ƒ}t|ƒr4|ƒ  tdƒ‚t	|t
ƒrA| ¡ sEtdƒ‚|S )Nú2Failed to resolve a bearer credential for Bedrock.Úclosez7An async Bedrock token provider requires `AsyncOpenAI`.úFThe Bedrock bearer credential provider must return a non-empty string.)r   Úobjectrl   r   Ú	ExceptionÚinspectÚisawaitableÚgetattrÚcallableÚ
isinstancer1   r   )rn   Útokenra   rs   r    r    r!   Ú_resolve_token™   s    
€ÿ
z!_BedrockBearerAuth._resolve_tokenc              
   Ã  sx   �zt t|  ¡ ƒ}t |¡r|I d H }W n ty   ‚  ty, } ztdƒ|‚d }~ww t|tƒr6| 	¡ s:tdƒ‚|S )Nrr   rt   )
r   ru   rl   rw   rx   r   rv   r{   r1   r   )rn   r|   ra   r    r    r!   Ú_resolve_token_asyncª   s   €

€
€ÿz'_BedrockBearerAuth._resolve_token_asyncc                 C  s"   |   |¡ d|  ¡ › �|jd< d S ©NzBearer rc   )rq   r}   rd   rp   r    r    r!   Úprepare_request¸   s   
z"_BedrockBearerAuth.prepare_requestc                 Ã  s*   �|   |¡ d|  ¡ I d H › �|jd< d S r   )rq   r~   rd   rp   r    r    r!   Úprepare_async_request¼   s   €
z(_BedrockBearerAuth.prepare_async_requestN)rj   rk   r#   r%   r   rH   ©r]   r^   r   rH   ©r   r1   )	Ú__name__Ú
__module__Ú__qualname__ro   rq   r}   r~   r€   r�   r    r    r    r!   ri   �   s    




ri   c                   @  sD   e Zd Zddœddd„Zddd„Zddd„Zddd„Zddd„ZdS )Ú_BedrockSigV4AuthN)ÚauthÚconfigr   r#   r%   rˆ   úBedrockAwsAuth | Noner   rH   c                C  s   || _ || _|| _d S r   )Ú_configrm   Ú_auth)rn   r‰   r#   rˆ   r    r    r!   ro   Â   s   
z_BedrockSigV4Auth.__init__r]   r^   r_   c                 C  sš   t |ƒ t|j| jƒstdƒ‚t|jjƒ}|d urI|\}}| jjdkr%dnd}||kr6td|› d|› d�ƒ‚|| jj	krItd|› d	| jj	› d
�ƒ‚t
|ƒS )NzXRefusing to sign a Bedrock request for an origin other than the configured provider URL.Úbedrockr   r   rM   rN   z` endpoint.rO   z#` does not match the SigV4 region `rP   )re   r\   r-   rm   r   rG   rQ   r‹   rB   r0   rb   )rn   r]   rS   rJ   r0   Úexpected_endpointr    r    r!   rq   Í   s$   ÿÿÿz#_BedrockSigV4Auth._validate_requestr   Úbodyc                C  sR   t D ]	}|j |d ¡ q|j|jt|jƒt|jƒ|d�}|j ¡  |j 	|¡ d S )N©Úmethodr-   rd   r�   )
Ú_AWS_SIGNING_HEADERSrd   ÚpopÚsignr‘   r1   r-   ÚdictÚclearÚupdate)rn   r]   rˆ   r�   ÚheaderÚsigned_headersr    r    r!   Ú_signã   s   ü
z_BedrockSigV4Auth._signc                 C  s6   |   |¡}| jd u rt| jƒ| _| j|| j|d� d S )N)rˆ   r�   )rq   rŒ   r   r‹   rš   )rn   r]   r�   r    r    r!   r€   ð   s   

z!_BedrockSigV4Auth.prepare_requestc                 Ã  s|   �|   |¡}| jd u rttƒ| jƒI d H | _t| jjƒ|jt|jƒdd„ |j	 
¡ D ƒ|d�I d H }|j	 ¡  |j	 |¡ d S )Nc                 S  s"   i | ]\}}|  ¡ tvr||“qS r    )r>   r’   )Ú.0Únamer   r    r    r!   Ú
<dictcomp>þ   s    z;_BedrockSigV4Auth.prepare_async_request.<locals>.<dictcomp>r�   )rq   rŒ   r   r   r‹   r”   r‘   r1   r-   rd   Úitemsr–   r—   )rn   r]   r�   r™   r    r    r!   r�   ö   s   €


ÿú
z'_BedrockSigV4Auth.prepare_async_request)r‰   r   r#   r%   rˆ   rŠ   r   rH   ©r]   r^   r   r_   )r]   r^   rˆ   r   r�   r_   r   rH   r‚   )r„   r…   r†   ro   rq   rš   r€   r�   r    r    r    r!   r‡   Á   s    û


r‡   c                   @  s   e Zd ZU dZded< dS )Ú_BedrockProviderRuntimeNr   r0   )r„   r…   r†   r0   Ú__annotations__r    r    r    r!   r      s   
 r    T)Úfrozenc                   @  sô   e Zd ZU ded< ded< ded< ded< ed	d
d�Zded< ed	d
d
d�Zded< d
Zded< d	Zded< ed	d
d�Z	ded< ed	d
d�Z
ded< ed	d
d�Zded< ed	d
d
d�Zded< edd
d�Zded< d&dd„Zd'd!d"„Zd(d$d%„Zd	S ))Ú_BedrockProviderDefinitionrK   rJ   r   Úconfigured_regionz)Literal['explicit', 'environment'] | NoneÚregion_sourcezhttpx2.URL | NoneÚconfigured_base_urlNF)ÚdefaultÚreprÚapi_key)r§   r¨   ÚcompareúBedrockTokenProvider | Nonerj   rZ   Úuse_environment_bearerÚprofileÚaccess_key_idÚsecret_access_keyÚsession_tokenúAwsCredentialsProvider | NoneÚcredential_providerr�   )r§   Úinitr1   rœ   r   ú3Literal['static', 'profile', 'provider', 'default']c                 C  s.   | j d urdS | jd urdS | jd urdS dS )NÚstaticr­   Úproviderr§   )r®   r­   r²   ©rn   r    r    r!   Ú_aws_source  s   


z&_BedrockProviderDefinition._aws_sourceú2tuple[BedrockAwsAuthConfig, BedrockAwsAuth | None]c                 C  s†   | j d ur&t| j |  ¡ | jdkrdnd| jpd| j| j| j| j| j	d�	d fS t
jd | j| j| j| j| j	| jdkr:dndd�}|j|fS )Nr   r�   r:   Úexplicit)	r0   ÚsourcerB   r¥   r­   r®   r¯   r°   Úcredentials_provider)r0   r­   r®   r¯   r°   r¼   rB   )r¤   r   r¸   rJ   r¥   r­   r®   r¯   r°   r²   r   Úresolver‰   )rn   rˆ   r    r    r!   Ú_resolve_aws_auth%  s0   
÷ôù
	z,_BedrockProviderDefinition._resolve_aws_authr   c                   s0  ddd„}d }d }ˆ j d ur‡ fdd„}ˆ j}n:ˆ jd ur$ˆ j}ˆ j}n.ˆ jr-|}ˆ j}n%ˆ  ¡ \}}|j}t|ƒ ˆ jpBtˆ j	|ƒ}t
|ˆ j	|d� t|||d�}ˆ jd ur[ˆ j}n|d urftˆ j	|ƒ}ntd	ƒ‚|d urtt||d
�}|d uszJ ‚t|tƒrŒtˆ j||t|j|jd�S tˆ j|||j|jd�S )Nr   r1   c                  S  s   t j d¡} | stdƒ‚| S )NÚAWS_BEARER_TOKEN_BEDROCKzµCould not find credentials for Bedrock. Pass a bearer credential or AWS credentials to `bedrock(...)`, set `AWS_BEARER_TOKEN_BEDROCK`, or configure the default AWS credential chain.)ÚosÚenvironÚgetr   )r|   r    r    r!   Úenvironment_tokenB  s   ÿz?_BedrockProviderDefinition.configure.<locals>.environment_tokenc                     s
   ˆ j pdS )NÚ )r©   r    r·   r    r!   Ú<lambda>N  s   
 z6_BedrockProviderDefinition.configure.<locals>.<lambda>©rJ   r0   )r‰   r#   rˆ   zmBedrock requires an AWS region. Pass `region` to `bedrock(...)`, or set `AWS_REGION` or `AWS_DEFAULT_REGION`.)r#   )rœ   r#   r0   Útransform_requestr€   r�   )rœ   r#   r0   r€   r�   rƒ   )r©   r¤   rj   r¬   r¾   r0   rI   r¦   rW   rJ   rV   r‡   r   ri   r{   r    rœ   rh   r€   r�   )rn   rÃ   rˆ   Úbearer_providerr0   Ú
aws_configÚaws_authr#   r    r·   r!   Ú	configureA  sX   
	


ÿ
ú	ûz$_BedrockProviderDefinition.configure)r   r´   )r   r¹   )r   r   )r„   r…   r†   r¡   r   r©   rj   r¬   r­   r®   r¯   r°   r²   rœ   r¸   r¾   rË   r    r    r    r!   r£     s"   
 

	r£   )
rJ   r0   r#   r©   rj   r®   r¯   r°   r­   r²   úBedrockEndpoint | Noneú"str | httpx2.URL | None | NotGivenr©   ústr | None | NotGivenrj   r«   r®   r¯   r°   r­   r²   r±   r   c        
         C  sÈ  | dur| dvrt dƒ‚t|ƒ}
|dur|
du rt dƒ‚t|
ƒ |
dur&dnd}t|tƒr>ttj d¡ƒ}|r;t|ƒnd}n|du rEd}nt|t	ƒrR| 
¡ sRt dƒ‚t|ƒ}|dur_t|jƒnd}| pl|durk|d nd	}t|ƒ}|dur}|du r}t d
ƒ‚|du |du ks�|dur‘|du r‘t dƒ‚|dur¤| 
¡ r tt	|ƒ 
¡ s¤t dƒ‚|dur°| 
¡ s°t dƒ‚t|tƒ o¹|du}|rÉt|t	ƒrÅ| 
¡ sÉt dƒ‚|rÓ|durÓt dƒ‚|pØ|du}t|du|du|	dufƒ}|dkrît dƒ‚|rö|röt dƒ‚t|tƒ oÿ|du }| �o| �o| �ottj d¡ƒ}|
du �r>|du �s$|�s>|�s>ttj d¡�p1tj d¡ƒ}
t|
ƒ |
du�r>d}|du�rJt|||
d� tt||
|||�rXtd|ƒnd|||||||	d�ƒS )zJConfigure the standard OpenAI client for Amazon Bedrock Mantle or Runtime.N>   r   r   z<The Bedrock `endpoint` must be either `mantle` or `runtime`.z+The Bedrock AWS `region` must not be empty.rº   ÚAWS_BEDROCK_BASE_URLz)The Bedrock `base_url` must not be empty.r   r   z,The Bedrock AWS `profile` must not be empty.zzStatic AWS credentials require both `access_key_id` and `secret_access_key`. A `session_token` may only be used with both.zXStatic AWS credentials require non-empty `access_key_id` and `secret_access_key` values.z=A static AWS `session_token` must not be empty when provided.z0The Bedrock bearer credential must not be empty.zVThe `api_key` and `token_provider` options are mutually exclusive. Configure only one.é   z‚Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, profile, or credential provider.z•Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, static AWS credentials, profile, or credential provider.r¿   Ú
AWS_REGIONÚAWS_DEFAULT_REGIONÚenvironmentrÆ   r   )rJ   r¤   r¥   r¦   r©   rj   r¬   r­   r®   r¯   r°   r²   )r   r"   rI   r{   r   rÀ   rÁ   rÂ   r/   r1   r   rG   rQ   r   ÚsumrZ   rV   r   r£   )rJ   r0   r#   r©   rj   r®   r¯   r°   r­   r²   Únormalized_regionr¥   Úenvironment_base_urlr¦   rS   Úresolved_endpointÚnormalized_profileÚexplicit_api_keyÚexplicit_bearerÚ	aws_modesÚskip_environment_bearerr¬   r    r    r!   r�     s¨   
ÿÿ ÿýÿÿÿÿþü ÿ

ôÿr�   )r�   rK   rk   r   )r   r   r   r   )r#   r$   r   r%   )r0   r1   r   r2   )r7   r1   r   r8   )r0   r   r   rH   )r#   r%   rJ   rK   r0   r   r   rH   )rJ   rK   r0   r1   r   r%   )rX   r%   rY   r%   r   rZ   rŸ   r‚   )rf   r   r   r   )rJ   rÌ   r0   r   r#   rÍ   r©   rÎ   rj   r«   r®   r   r¯   r   r°   r   r­   r   r²   r±   r   r   )8Ú
__future__r   rÀ   r)   rw   Útypingr   r   r   r   Údataclassesr   r   Úhttpx2Ú_typesr
   r   Ú_utilsr   Ú_httpx2r   r   Ú_modelsr   Ú	_providerr   r   r   Ú_exceptionsr   Úlib._bedrock_authr   r   r   rk   rK   r’   Úcompiler@   r"   r/   r6   rG   rI   rV   rW   r\   rb   re   rh   ri   r‡   r    r£   r�   Ú__all__r    r    r    r!   Ú<module>   s^    









	




4Ftõw