tdfs4ds.utils.llm_provider¶

tdfs4ds.utils.llm_provider ¶

Which way does an LLM call travel, and does it need an API key?

One module answers those two questions so that no call site re-derives them. Before it existed the answer lived in ~100 scattered provider == 'bedrock' comparisons and three inline not INSTRUCT_MODEL_API_KEY gates, which is why a role-based AWS setup (no key, by design) could not be expressed.

Routes. llm_route(provider, url) returns the provider unchanged for everything that existed before, except Bedrock, which has two doors:

'bedrock-converse' -- ChatBedrockConverse (the Converse API, boto3 credential chain). This is what bedrock has always meant. The URL, if any, is ignored, exactly as before.
'bedrock-openai' -- Bedrock's OpenAI-compatible endpoint, https://bedrock-runtime.<region>.amazonaws.com/openai/v1, spoken to with the OpenAI wire protocol. Chosen only when the URL ends in /openai/v1, so a configuration without such a URL is untouched.

aws is accepted as a spelling of bedrock.

Auth on the OpenAI door. A key is sent as the bearer token (the Bedrock API key). With *_CLIENT_MODE=ambient, or with no key at all, every request is SigV4-signed with the ambient AWS credential chain (instance/task role, SSO, environment, profile) -- no secret is held by tdfs4ds.

Nothing here runs at import time and nothing needs boto3/httpx until a signed client is actually built.

logger `module-attribute` ¶

logger = getLogger(__name__)

NO_API_KEY `module-attribute` ¶

NO_API_KEY = 'EMPTY'

_BEDROCK_OPENAI_PATH `module-attribute` ¶

_BEDROCK_OPENAI_PATH = compile('/openai/v1/?$', I)

_BEDROCK_HOST `module-attribute` ¶

_BEDROCK_HOST = compile('bedrock-runtime(?:-fips)?\\.([a-z0-9-]+)\\.amazonaws\\.com(?:\\.cn)?', I)

_KEYLESS_PROVIDERS `module-attribute` ¶

_KEYLESS_PROVIDERS = ('bedrock', 'gcp')

_CLIENT_MODES `module-attribute` ¶

_CLIENT_MODES = ('ambient',)

canonical_provider ¶

canonical_provider(provider)

Lower-case provider with its aliases resolved (aws -> bedrock).

bedrock_openai_url ¶

bedrock_openai_url(url)

True when url is Bedrock's OpenAI-compatible endpoint (.../openai/v1).

llm_route ¶

llm_route(provider, url)

The door a call goes through: see the module docstring.

effective_provider ¶

effective_provider(provider, url)

Provider name as the OpenAI-family code paths understand it.

The Bedrock OpenAI door is an OpenAI-compatible server, so every OpenAI-family decision (structured-output mechanism, probes) treats it as openai-compatible. Any other input is returned canonicalised only.

key_required ¶

key_required(provider, url=None)

Is an API key mandatory for this provider/route?

False where the credential comes from the environment: Bedrock (both doors -- a key or an ambient role) and Vertex. True for every provider that existed before and was never keyless.

client_mode ¶

client_mode(*, for_embedding=False)

'ambient' or None. An unknown value is reported and ignored.

region_for ¶

region_for(url=None)

AWS region: from a bedrock-runtime.<region>.amazonaws.com host, else the explicit setting, else the standard environment variables.

_sigv4_auth_class ¶

_sigv4_auth_class()

sigv4_auth ¶

sigv4_auth(url=None, service='bedrock')

An httpx.Auth that SigV4-signs requests for url's region.

bedrock_openai_credentials ¶

bedrock_openai_credentials(url, *, for_embedding=False)

(api_key, httpx_auth_or_None) for the Bedrock OpenAI door.

A key without ambient mode is the bearer token and nothing is signed. Otherwise the SDK gets the placeholder key and the signer does the work.

describe_auth ¶

describe_auth(provider, url, *, for_embedding=False)

How this configuration authenticates -- words only, never a value.

build_bedrock_openai_chat ¶

build_bedrock_openai_chat(*, model, url, temperature=0.0, timeout=60, max_retries=3, max_tokens=None, callbacks=None)

ChatOpenAI aimed at Bedrock's OpenAI-compatible endpoint.

Goes through embedding._build_http_client like every OpenAI-family client, so the proxy and TLS settings compose with the signer. No seed: it is an OpenAI-only parameter that other OpenAI-compatible servers reject.

list_bedrock_openai_models ¶

list_bedrock_openai_models(url, *, timeout=30.0)

Model ids from <url>/models on the Bedrock OpenAI door.

Raises on any failure; the caller decides the fallback (boto3 listing, then typing the name).

tdfs4ds.utils.llm_provider¶