021-python-clients 0.3.0__tar.gz → 0.4.0__tar.gz

{021_python_clients-0.3.0 → 021_python_clients-0.4.0}/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes are recorded here by release-please from Conventional Commits.
 
+## [0.4.0](https://github.com/from021-io/python-clients/compare/v0.3.0...v0.4.0) (2026-10-22)
+
+
+### Features
+
+* **compute:** add Kubernetes Jobs client over the HTTP client ([9b3c369](https://github.com/from021-io/python-clients/commit/9b3c36930f6a070d3fee9844e86c0d27f871346b))
+* **llm:** add observed Bedrock Runtime client for SDKs ([5216293](https://github.com/from021-io/python-clients/commit/52162939416f58c610f4f4e217d911f5e5efdea9))
+* **secrets:** add observed Secrets Manager client ([f14042f](https://github.com/from021-io/python-clients/commit/f14042f064ca61e8d267b338b033a12fd41690eb))
+
 ## [0.3.0](https://github.com/from021-io/python-clients/compare/v0.2.0...v0.3.0) (2026-10-21)
 
 

{021_python_clients-0.3.0 → 021_python_clients-0.4.0}/CONTRACT.md

@@ -15,8 +15,10 @@ The queue package groups providers by purpose. SQS owns polling, receipts and vi
 QStash owns HTTP delivery. Their public methods and observability contracts remain distinct.
 Shared email types and the interchangeable `EmailSender` protocol live in `clients_021.email`.
 
-Redis lives in `clients_021.cache.redis`, S3 in `clients_021.storage.s3` and KMS in
-`clients_021.crypto.kms`. The 0.1.0 root modules (`redis`, `s3`, `kms`) continue to re-export
+Redis lives in `clients_021.cache.redis`, S3 in `clients_021.storage.s3`, KMS in
+`clients_021.crypto.kms`, Secrets Manager in `clients_021.secrets.secrets_manager`, Bedrock
+in `clients_021.llm.bedrock` and Kubernetes Jobs in `clients_021.compute.kubernetes`, which
+needs no extra. The 0.1.0 root modules (`redis`, `s3`, `kms`) continue to re-export
 the same clients and result types (`ObjectInfo`, `DataKey`). Existing call signatures,
 metric/span names and error semantics are unchanged. Capability package imports do not
 load optional SDKs. HTTP implementations live in `clients_021.http.httpx` and
@@ -40,6 +42,13 @@ version, environment). Durations use 021-python-observability's buckets.
 | `storage.client.operation.duration` | Histogram / `s` | same | S3, Vercel Blob |
 | `crypto.client.operation.count` | Counter / `{operation}` | dependency, operation, status, error.type | KMS |
 | `crypto.client.operation.duration` | Histogram / `s` | same | KMS |
+| `secrets.client.operation.count` | Counter / `{operation}` | dependency, operation, status, error.type | Secrets Manager |
+| `secrets.client.operation.duration` | Histogram / `s` | same | Secrets Manager |
+| `llm.client.operation.count` | Counter / `{operation}` | dependency, operation, status, error.type | Bedrock |
+| `llm.client.operation.duration` | Histogram / `s` | same | Bedrock |
+| `llm.client.token.usage` | Counter / `{token}` | dependency, operation, token.type | Bedrock (Converse and ConverseStream) |
+| `compute.client.operation.count` | Counter / `{operation}` | dependency, operation, status, error.type | Kubernetes Jobs |
+| `compute.client.operation.duration` | Histogram / `s` | same | Kubernetes Jobs |
 | `http.client.request.count` | Counter / `{request}` | dependency, http.request.method, http.response.status_code, error.type, http.response.body.complete | HTTP, httpx2, QStash transport, Resend (its HTTP request) |
 | `http.client.request.duration` | Histogram / `s` | same | HTTP, httpx2, QStash transport, Resend (its HTTP request) |
 
@@ -49,8 +58,16 @@ version, environment). Durations use 021-python-observability's buckets.
   S3 and Vercel Blob: `put`, `get`, `head`, `delete`. QStash: `publish`.
   Email (Resend, SES): `send`. KMS:
   `encrypt`, `decrypt`, `generate_data_key`; `seal` and `unseal` record the KMS call they make
-  (`generate_data_key`, `decrypt`), not the local AES work.
-- Redis/SQS/S3/Vercel Blob/QStash/email/KMS `error.type`: `timeout`, `connection_error`, `throttled`,
+  (`generate_data_key`, `decrypt`), not the local AES work. Secrets Manager: `get`.
+  Bedrock: `converse`, `converse_stream`, `invoke_model`, `invoke_model_with_response_stream`,
+  `count_tokens`. A streaming operation ends when its event stream is exhausted, fails or is
+  closed, not when the call returns. Kubernetes Jobs: `create`, `get`, `delete`; each also
+  records its HTTP request (`http.client.request.*`) under the same `dependency`. A missing
+  Job (`get`, `delete`) and an existing one (`create`) are `status=ok`.
+- `token.type`: `input`, `output`, `cache_read`, `cache_write`, as reported by Bedrock in
+  the Converse response or the ConverseStream `metadata` event. InvokeModel bodies are
+  model-specific and are not read.
+- Redis/SQS/S3/Vercel Blob/QStash/email/KMS/Secrets Manager/Bedrock/Kubernetes Jobs `error.type`: `timeout`, `connection_error`, `throttled`,
   `status_<5xx>`, `cancelled`, or the exception class name for errors that are not outages
   (`EmailRejected` for every email rejection; botocore's class, such as `ClientError` or
   `NotFoundException`, for KMS).
@@ -70,7 +87,10 @@ version, environment). Durations use 021-python-observability's buckets.
 CLIENT spans named `<dependency> <operation>` (`HTTP <dependency>` for HTTP), with the
 metric labels plus `db.system.name=redis`, `messaging.system=aws_sqs`,
 `messaging.system=upstash_qstash`, `messaging.system=resend`, `messaging.system=aws_ses`, or
-`rpc.system=aws-api` + `rpc.service=S3` / `rpc.service=KMS`, or `rpc.system=vercel-blob`.
+`rpc.system=aws-api` + `rpc.service=S3` / `rpc.service=KMS` / `rpc.service=SecretsManager` /
+`rpc.service=BedrockRuntime` (plus `gen_ai.system=aws.bedrock`), `rpc.system=vercel-blob`, or
+`rpc.system=kubernetes` + `rpc.service=Job`. Kubernetes Jobs' `HTTP <dependency>` span is a
+child of its `<dependency> <operation>` span.
 Resend's `HTTP <dependency>` span is a child of its `<dependency> send` span. Status ERROR on failure (and on HTTP
 status ≥ 400).
 Cancellation propagates unchanged and records ERROR with `error.type=cancelled`.
@@ -97,7 +117,7 @@ Local input validation occurs before either operation is recorded.
 
 ## Logging and coverage limits
 
-Redis, SQS, QStash, S3, Vercel Blob, Resend, SES and KMS emit a structured
+Redis, SQS, QStash, S3, Vercel Blob, Resend, SES, KMS, Secrets Manager, Bedrock and Kubernetes Jobs emit a structured
 `dependency.call_failed` warning when an observed remote operation raises an exception.
 Fields are `dependency`, `operation` and `error_type`; provider messages and exception
 chains are not logged. Successful calls and cancellation do not emit this warning;
@@ -112,7 +132,7 @@ attempts emit no log. Intentional partial close emits `dependency.stream_closed`
 with dependency and operation; it is not an outage.
 
 `log_failures=False` suppresses these HTTP attempt logs without disabling metrics or spans.
-QStash and Resend set this option because their logical operation already emits a failure
+QStash, Resend and Kubernetes Jobs set this option because their logical operation already emits a failure
 warning; they do not log the same failure at both levels. SDK retry loops can produce one
 warning per failed attempt. HTTP counters measure attempts, not logical API/SDK calls.
 
@@ -137,7 +157,7 @@ telemetry reaches an external backend.
   When enabled, both caller-supplied trace headers are replaced with the current context.
 - Resend: nothing is sent. The `traceparent`, `tracestate` and `x-request-id` headers that
   the HTTP transport adds are removed before the request leaves.
-- SES, KMS and Vercel Blob: nothing is sent by the default transports.
+- SES, KMS, Secrets Manager, Bedrock and Vercel Blob: nothing is sent by the default transports.
 - SQS: `traceparent` and `tracestate` are message attributes; `ReceivedMessage.trace_context()`
   returns the producer's context. Caller-supplied values for both trace attributes are
   replaced with the current context.
@@ -188,6 +208,31 @@ tampered ciphertext (`InvalidCiphertextException`) and a ciphertext from another
 Every call requires a non-empty encryption context. `unseal` raises `ValueError` for a
 malformed envelope and `cryptography.exceptions.InvalidTag` when the payload was altered.
 
+Secrets Manager: throttling, 5xx (`InternalServiceError`), timeouts and connection failures
+are `DependencyUnavailable`. A missing secret (`ResourceNotFoundException`), access denied,
+a value KMS cannot decrypt (`DecryptionFailure`), a secret scheduled for deletion
+(`InvalidRequestException`) and invalid parameters keep their botocore type. `get` is a read:
+retrying it is safe. A version with neither `SecretString` nor `SecretBinary` raises
+`ValueError`.
+
+Bedrock: throttling (`ThrottlingException`, and `throttlingException` inside an event stream),
+5xx, `ModelNotReadyException` (`throttled`), the stream errors `serviceUnavailableException`,
+`internalServerException` and `modelStreamErrorException`, timeouts and connection failures
+are `DependencyUnavailable`. Access denied, validation errors, a missing model or profile and
+quota limits (`ServiceQuotaExceededException`) keep their botocore type. Leaving a stream
+early or calling its `close()` ends the operation as `ok` and logs `dependency.stream_closed`
+at INFO. A model call is not idempotent in cost: botocore's retries bill each attempt.
+
+Kubernetes Jobs: 429 is `throttled`, 5xx `status_<5xx>`, transport timeouts and connection
+failures `timeout` / `connection_error`, all `DependencyUnavailable`. A 409 whose reason is
+`AlreadyExists` on `create` and a 404 on `get` or `delete` are results, not errors. Any other
+non-success status raises `KubernetesApiError(status_code, reason)`, where `reason` is the
+Status object's machine-readable reason (`Forbidden`, `Invalid`, `Conflict`, ...) or
+`Unknown`; a 201 whose name does not match raises it with `InvalidResponse`. POST is sent
+once; GET and DELETE retry 502/503/504 and network failures once. Local validation (DNS-label
+names and namespace, `metadata.name` required, `generateName` refused, `kind` must be Job)
+happens before any request.
+
 Vercel Blob (`clients_021.storage.vercel_blob`): HTTP 429 maps to `throttled`; 5xx to
 `status_<code>`; HTTP timeouts and total deadlines to `timeout`; network/remote protocol
 failures to `connection_error`. Known transport causes wrapped by the SDK are classified
@@ -209,7 +254,8 @@ A new data key is generated for every envelope.
 
 ## Lifecycle and retry limits
 
-HTTP, Redis, SQS, QStash, S3, Vercel Blob, Resend, SES and KMS expose `aclose()`. Close them after
+HTTP, Redis, SQS, QStash, S3, Vercel Blob, Resend, SES, KMS, Secrets Manager, Bedrock and Kubernetes
+Jobs expose `aclose()` (Bedrock also `close()`). Close them after
 in-flight calls complete; the wrapper owns the underlying client, including one supplied
 through the constructor.
 AWS factories configure three total attempts; injected clients retain their own policy.
@@ -264,6 +310,10 @@ these clients, or each request would be counted twice.
 Keys, URLs, query strings, bodies, message ids, receipts, object names, bucket or queue
 names, provider error messages. Email: sender, recipient and reply-to addresses, subjects,
 text and HTML bodies, tags, idempotency keys, API keys, configuration set names. KMS: key
-ids, ARNs and aliases, encryption contexts, plaintext, ciphertext and data keys.
+ids, ARNs and aliases, encryption contexts, plaintext, ciphertext and data keys. Secrets
+Manager: secret ids, names and ARNs, version ids, version stages and secret values. Bedrock:
+model ids, inference profile ARNs, prompts, system prompts, outputs, tool arguments and
+results, request ids and guardrail details. Kubernetes Jobs: namespaces, Job names, labels,
+manifests, API server addresses, service account tokens and Status messages.
 
 Vercel Blob: read-write tokens, store IDs, pathnames, delivery URLs, content and ETags.

{021_python_clients-0.3.0 → 021_python_clients-0.4.0}/CONTRIBUTING.md

@@ -19,6 +19,9 @@ clients_021/
   cache/          # redis.py
   storage/        # s3.py, vercel_blob.py
   crypto/         # kms.py
+  secrets/        # secrets_manager.py
+  llm/            # bedrock.py
+  compute/        # kubernetes.py (over the shared HTTP client, no extra)
 ```
 
 The original `clients_021.redis`, `clients_021.s3` and `clients_021.kms` imports remain
@@ -62,7 +65,9 @@ Each implementation must make these decisions explicit in README.md and CONTRACT
 | Telemetry | Choose a metric family, fixed operations and system attribute. Never record URLs, credentials, bodies, object names or request-derived ids. |
 | Propagation | State the default and opt-out. Replace `traceparent` and `tracestate` together, including removing stale state. |
 
-Use `_observe.observed` for a logical cache, messaging, storage or crypto operation. HTTP-backed
+Use `_observe.observed` for a logical cache, messaging, storage or crypto operation, and
+`_observe.Call` for synchronous SDK calls or operations that end after the call returns
+(event streams). HTTP-backed
 clients may also emit the transport's HTTP span/metrics: one logical operation and one
 network request are different measurements. Do not sum those counters as distinct
 business operations. Disable nested HTTP attempt logs with `log_failures=False` when the

{021_python_clients-0.3.0 → 021_python_clients-0.4.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.5
 Name: 021-python-clients
-Version: 0.3.0
-Summary: Observed clients for Redis, SQS, QStash, S3, Vercel Blob, HTTP, email and KMS, built on 021-python-observability
+Version: 0.4.0
+Summary: Observed clients for Redis, SQS, QStash, S3, Vercel Blob, HTTP, email, KMS, Secrets Manager, Bedrock and Kubernetes Jobs, built on 021-python-observability
 Project-URL: Repository, https://github.com/from021-io/python-clients
 Project-URL: Changelog, https://github.com/from021-io/python-clients/blob/main/CHANGELOG.md
 Project-URL: Contract, https://github.com/from021-io/python-clients/blob/main/CONTRACT.md
 License-Expression: Apache-2.0
 License-File: LICENSE
-Keywords: email,httpx,kms,observability,opentelemetry,qstash,redis,resend,s3,ses,sqs
+Keywords: bedrock,email,httpx,kms,kubernetes,observability,opentelemetry,qstash,redis,resend,s3,secrets-manager,ses,sqs
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
@@ -58,6 +58,9 @@ uv add "021-python-clients[redis,aws,httpx2,vercel-blob]"   # pick the extras yo
 | `clients_021.email` | none | `EmailMessage`, the `EmailSender` protocol, `ResendSender` (Resend's HTTP API) |
 | `clients_021.email.ses` | `aws` | `SesSender`: the same protocol over Amazon SES v2 |
 | `clients_021.crypto.kms` | `aws` | `KmsClient`: encrypt, decrypt and data keys bound to an encryption context; AES-256-GCM envelopes |
+| `clients_021.secrets.secrets_manager` | `aws` | `SecretsManagerClient`: read a secret by id, version id or stage; the value is never printed |
+| `clients_021.compute.kubernetes` | none | `KubernetesJobsClient`: create (idempotent by name), read and delete Jobs in a namespace, in-cluster service account |
+| `clients_021.llm.bedrock` | `aws` | `BedrockRuntime`: an observed `bedrock-runtime` client to pass to SDKs such as LangChain's `ChatBedrockConverse`; streams measured to the end, token usage counted |
 
 Every client takes the service's `Observability` (from `setup_observability`) and a
 `dependency` name, which becomes the `dependency` label of its metrics.
@@ -66,7 +69,7 @@ Every client takes the service's `Observability` (from `setup_observability`) an
 
 Providers with the same purpose live under one capability package: `email/` contains
 Resend and SES; `queue/` contains SQS and QStash; `storage/` contains S3 and Vercel Blob; `cache/`
-contains Redis; `crypto/` contains KMS. `http/` contains the httpx client and httpx2
+contains Redis; `crypto/` contains KMS; `secrets/` contains Secrets Manager; `llm/` contains Bedrock; `compute/` contains Kubernetes Jobs. `http/` contains the httpx client and httpx2
 transport. Import providers explicitly:
 
 ```python
@@ -77,6 +80,9 @@ from clients_021.queue.qstash import QStashClient
 from clients_021.storage.s3 import S3Client
 from clients_021.cache.redis import RedisClient
 from clients_021.crypto.kms import KmsClient
+from clients_021.secrets.secrets_manager import SecretsManagerClient
+from clients_021.llm.bedrock import BedrockRuntime
+from clients_021.compute.kubernetes import KubernetesJobsClient
 ```
 
 SQS supports polling, receipts and visibility changes; QStash delivers to an HTTP endpoint.
@@ -95,12 +101,16 @@ published exports; `clients_021.httpx2.ObservedTransport` remains an alias for
 
 - A CLIENT span named `<dependency> <operation>` (`HTTP <dependency>` for HTTP), with the
   system attribute (`db.system.name=redis`, `messaging.system=aws_sqs|resend|aws_ses`,
-  `rpc.service=S3|KMS`, `rpc.system=vercel-blob`).
+  `rpc.service=S3|KMS|SecretsManager|BedrockRuntime`, `rpc.system=vercel-blob`, `rpc.system=kubernetes`;
+  Bedrock also `gen_ai.system=aws.bedrock`).
 - A counter and a duration histogram: `db.client.operation.*` (Redis, shared with SQL),
   `messaging.client.operation.*` (SQS, QStash, email), `storage.client.operation.*` (S3, Vercel Blob),
-  `crypto.client.operation.*` (KMS), `http.client.request.*` (HTTP, and the HTTP request
+  `crypto.client.operation.*` (KMS), `secrets.client.operation.*` (Secrets Manager),
+  `llm.client.operation.*` and `llm.client.token.usage` (Bedrock), `compute.client.operation.*`
+  (Kubernetes Jobs),
+  `http.client.request.*` (HTTP, and the HTTP request
   under QStash and Resend). Labels are bounded; see [CONTRACT.md](CONTRACT.md).
-- Redis, SQS, QStash, S3, Vercel Blob, email and KMS emit a `dependency.call_failed` warning on failure,
+- Redis, SQS, QStash, S3, Vercel Blob, email, KMS, Secrets Manager, Bedrock and Kubernetes Jobs emit a `dependency.call_failed` warning on failure,
   with dependency, operation and error type only. HTTP/httpx2 also log failed attempts,
   including body failures and cancellation; QStash/Resend suppress the nested HTTP log.
 - `DependencyUnavailable(dependency, operation, reason)` when the service timed out,
@@ -109,7 +119,9 @@ published exports; `clients_021.httpx2.ObservedTransport` remains an alias for
   original type: they are bugs, not outages.
 
 Never in this library's spans, metrics or logs: keys, URLs, bodies, message ids or object
-names; email addresses, subjects, bodies or tags; KMS key ids, encryption contexts,
+names; email addresses, subjects, bodies or tags; secret ids, version ids, stages and
+values; model ids, prompts and outputs; namespaces, Job names, manifests and service
+account tokens; KMS key ids, encryption contexts,
 plaintext, ciphertext or data keys. Use static dependency names such as `identity-provider` or `uploads`; never derive
 them from a tenant, user or request. All clients apply observability's identifier rule
 (1–96 letters, digits, `_`, `.` or `-`, starting with a letter or digit).
@@ -272,6 +284,64 @@ except EmailRejected as rejected:  # the address, the domain or the credentials;
 SES has no idempotency key (the argument is ignored): deduplicate in the caller when a retry
 must not send twice. Tags are for provider analytics; never put personal data in them.
 
+### Kubernetes Jobs
+
+```python
+from clients_021.compute.kubernetes import KubernetesJobsClient
+
+jobs = KubernetesJobsClient.in_cluster(obs, namespace="agent-runs")
+created = await jobs.create({"metadata": {"name": "cmd-4821"}, "spec": job_spec})
+status = await jobs.get("cmd-4821")        # JobStatus(phase="running", ...) or None
+await jobs.delete("cmd-4821", propagation="Background")
+```
+
+No SDK: it calls the `batch/v1` REST API through `HttpClient`. `in_cluster` uses the pod's
+service account (CA bundle, namespace, and a token it re-reads at most once a minute because
+projected tokens rotate). `create` is idempotent by name: `generateName` is refused, and an
+existing Job returns `created=False`, so a caller can repeat it after a timeout. `get`
+returns `None` and `delete` returns `False` for a missing Job. POST is sent once; GET and
+DELETE retry 502, 503, 504 and network failures once. 429, 5xx, timeouts and connection
+failures raise `DependencyUnavailable`; other rejections raise `KubernetesApiError` with the
+status code and the API's reason, never its message.
+
+### Bedrock
+
+```python
+from clients_021.llm.bedrock import BedrockRuntime
+from langchain_aws import ChatBedrockConverse
+
+runtime = BedrockRuntime.create(obs, region="us-east-1")
+model = ChatBedrockConverse(model=settings.inference_profile, client=runtime)
+```
+
+`BedrockRuntime` keeps boto3's call signatures for `converse`, `converse_stream`,
+`invoke_model`, `invoke_model_with_response_stream` and `count_tokens`, and passes every
+other attribute (`meta`, `exceptions`) through to the boto3 client, so an SDK can take it
+where it expects one. Calls stay synchronous like boto3's. A streaming call is measured
+until its event stream ends; leaving the loop early or calling `close()` ends it as `ok`.
+Converse and ConverseStream add the reported input, output and cache tokens to
+`llm.client.token.usage`. Throttling (also mid-stream), 5xx, a model still loading and the
+stream errors Bedrock documents as retryable raise `DependencyUnavailable`; access denied,
+validation errors, a missing model and quota limits keep their botocore type. A retried
+model call is billed again.
+
+### Secrets Manager
+
+```python
+from clients_021.secrets.secrets_manager import SecretsManagerClient
+
+secrets = SecretsManagerClient.create(obs, region="us-east-1")
+secret = await secrets.get("connections/brain")
+token = secret.text()            # SecretString; secret.binary() for SecretBinary
+previous = await secrets.get("connections/brain", version_stage="AWSPREVIOUS")
+```
+
+`get` reads the current version unless a `version_id` or a `version_stage` is given (not
+both). The client does not cache: every call is a billed request, so keep a short-lived
+copy when the same secret is read often. A missing secret, access denied, a value KMS cannot
+decrypt or a secret scheduled for deletion keep their botocore type; throttling, 5xx and
+timeouts raise `DependencyUnavailable`. `repr(secret)` never shows the value.
+
 ### KMS
 
 The encryption context is required on every call, so a ciphertext only decrypts for the
@@ -375,6 +445,8 @@ async with AsyncExitStack() as resources:
     resources.push_async_callback(email.aclose)
     keys = KmsClient.create(obs, settings.session_key_arn, region="us-east-1")
     resources.push_async_callback(keys.aclose)
+    secrets = SecretsManagerClient.create(obs, region="us-east-1")
+    resources.push_async_callback(secrets.aclose)
     # Run the service here. Stop its background workers before leaving this scope.
 ```
 
@@ -386,7 +458,7 @@ Retry policies are explicit:
   POST and PATCH run once. Invalid URLs/protocols and invalid request construction keep
   their original exception. HTTP status responses are returned for the caller to handle.
 - Resend sends each request once (POST); send an `idempotency_key` and retry in the caller.
-- AWS factories (SQS, S3, SES, KMS) use botocore standard retries with at most **three total
+- AWS factories (SQS, S3, SES, KMS, Secrets Manager, Bedrock) use botocore standard retries with at most **three total
   attempts**.
   Injected SDK clients keep their configured policy. SQS consumers must tolerate duplicate
   messages; a timeout does not prove that a send or write was not applied.
@@ -409,7 +481,7 @@ any operation**. Map it at the service boundary and apply the operation's idempo
 Its message and structured fields are safe to log when dependency names are static. Its
 chained SDK exception may contain sensitive provider data; do not log exception chains.
 
-S3, SQS, SES and KMS run the synchronous AWS SDK in worker threads. Cancelling the await does not
+S3, SQS, SES, KMS and Secrets Manager run the synchronous AWS SDK in worker threads. Cancelling the await does not
 stop an SDK request already running in its thread. Timeouts are per SDK/network attempt,
 not an overall deadline. Limit consumer concurrency and let in-flight work finish before
 closing the clients. Redis window counters require Redis server 7 or newer (`EXPIRE NX`).
@@ -433,6 +505,8 @@ deduplication, start the [official local server](https://upstash.com/docs/qstash
 set its `QSTASH_URL` and `QSTASH_TOKEN`, and run `uv run python tests/qstash_local.py`.
 That smoke test accepts only a loopback QStash server and binds its destination dynamically.
 
-SQS, S3, SES and KMS tests run against [moto](https://github.com/getmoto/moto) (plus
+Kubernetes Jobs tests use httpx's `MockTransport`. Bedrock tests use botocore's Stubber and
+fake event streams. SQS, S3, SES, KMS and Secrets
+Manager tests run against [moto](https://github.com/getmoto/moto) (plus
 botocore's Stubber where moto ignores a field or differs from AWS); Resend tests use httpx's
 `MockTransport`; Redis tests need a real Redis. Licensed under Apache-2.0.

{021_python_clients-0.3.0 → 021_python_clients-0.4.0}/README.md

@@ -22,6 +22,9 @@ uv add "021-python-clients[redis,aws,httpx2,vercel-blob]"   # pick the extras yo
 | `clients_021.email` | none | `EmailMessage`, the `EmailSender` protocol, `ResendSender` (Resend's HTTP API) |
 | `clients_021.email.ses` | `aws` | `SesSender`: the same protocol over Amazon SES v2 |
 | `clients_021.crypto.kms` | `aws` | `KmsClient`: encrypt, decrypt and data keys bound to an encryption context; AES-256-GCM envelopes |
+| `clients_021.secrets.secrets_manager` | `aws` | `SecretsManagerClient`: read a secret by id, version id or stage; the value is never printed |
+| `clients_021.compute.kubernetes` | none | `KubernetesJobsClient`: create (idempotent by name), read and delete Jobs in a namespace, in-cluster service account |
+| `clients_021.llm.bedrock` | `aws` | `BedrockRuntime`: an observed `bedrock-runtime` client to pass to SDKs such as LangChain's `ChatBedrockConverse`; streams measured to the end, token usage counted |
 
 Every client takes the service's `Observability` (from `setup_observability`) and a
 `dependency` name, which becomes the `dependency` label of its metrics.
@@ -30,7 +33,7 @@ Every client takes the service's `Observability` (from `setup_observability`) an
 
 Providers with the same purpose live under one capability package: `email/` contains
 Resend and SES; `queue/` contains SQS and QStash; `storage/` contains S3 and Vercel Blob; `cache/`
-contains Redis; `crypto/` contains KMS. `http/` contains the httpx client and httpx2
+contains Redis; `crypto/` contains KMS; `secrets/` contains Secrets Manager; `llm/` contains Bedrock; `compute/` contains Kubernetes Jobs. `http/` contains the httpx client and httpx2
 transport. Import providers explicitly:
 
 ```python
@@ -41,6 +44,9 @@ from clients_021.queue.qstash import QStashClient
 from clients_021.storage.s3 import S3Client
 from clients_021.cache.redis import RedisClient
 from clients_021.crypto.kms import KmsClient
+from clients_021.secrets.secrets_manager import SecretsManagerClient
+from clients_021.llm.bedrock import BedrockRuntime
+from clients_021.compute.kubernetes import KubernetesJobsClient
 ```
 
 SQS supports polling, receipts and visibility changes; QStash delivers to an HTTP endpoint.
@@ -59,12 +65,16 @@ published exports; `clients_021.httpx2.ObservedTransport` remains an alias for
 
 - A CLIENT span named `<dependency> <operation>` (`HTTP <dependency>` for HTTP), with the
   system attribute (`db.system.name=redis`, `messaging.system=aws_sqs|resend|aws_ses`,
-  `rpc.service=S3|KMS`, `rpc.system=vercel-blob`).
+  `rpc.service=S3|KMS|SecretsManager|BedrockRuntime`, `rpc.system=vercel-blob`, `rpc.system=kubernetes`;
+  Bedrock also `gen_ai.system=aws.bedrock`).
 - A counter and a duration histogram: `db.client.operation.*` (Redis, shared with SQL),
   `messaging.client.operation.*` (SQS, QStash, email), `storage.client.operation.*` (S3, Vercel Blob),
-  `crypto.client.operation.*` (KMS), `http.client.request.*` (HTTP, and the HTTP request
+  `crypto.client.operation.*` (KMS), `secrets.client.operation.*` (Secrets Manager),
+  `llm.client.operation.*` and `llm.client.token.usage` (Bedrock), `compute.client.operation.*`
+  (Kubernetes Jobs),
+  `http.client.request.*` (HTTP, and the HTTP request
   under QStash and Resend). Labels are bounded; see [CONTRACT.md](CONTRACT.md).
-- Redis, SQS, QStash, S3, Vercel Blob, email and KMS emit a `dependency.call_failed` warning on failure,
+- Redis, SQS, QStash, S3, Vercel Blob, email, KMS, Secrets Manager, Bedrock and Kubernetes Jobs emit a `dependency.call_failed` warning on failure,
   with dependency, operation and error type only. HTTP/httpx2 also log failed attempts,
   including body failures and cancellation; QStash/Resend suppress the nested HTTP log.
 - `DependencyUnavailable(dependency, operation, reason)` when the service timed out,
@@ -73,7 +83,9 @@ published exports; `clients_021.httpx2.ObservedTransport` remains an alias for
   original type: they are bugs, not outages.
 
 Never in this library's spans, metrics or logs: keys, URLs, bodies, message ids or object
-names; email addresses, subjects, bodies or tags; KMS key ids, encryption contexts,
+names; email addresses, subjects, bodies or tags; secret ids, version ids, stages and
+values; model ids, prompts and outputs; namespaces, Job names, manifests and service
+account tokens; KMS key ids, encryption contexts,
 plaintext, ciphertext or data keys. Use static dependency names such as `identity-provider` or `uploads`; never derive
 them from a tenant, user or request. All clients apply observability's identifier rule
 (1–96 letters, digits, `_`, `.` or `-`, starting with a letter or digit).
@@ -236,6 +248,64 @@ except EmailRejected as rejected:  # the address, the domain or the credentials;
 SES has no idempotency key (the argument is ignored): deduplicate in the caller when a retry
 must not send twice. Tags are for provider analytics; never put personal data in them.
 
+### Kubernetes Jobs
+
+```python
+from clients_021.compute.kubernetes import KubernetesJobsClient
+
+jobs = KubernetesJobsClient.in_cluster(obs, namespace="agent-runs")
+created = await jobs.create({"metadata": {"name": "cmd-4821"}, "spec": job_spec})
+status = await jobs.get("cmd-4821")        # JobStatus(phase="running", ...) or None
+await jobs.delete("cmd-4821", propagation="Background")
+```
+
+No SDK: it calls the `batch/v1` REST API through `HttpClient`. `in_cluster` uses the pod's
+service account (CA bundle, namespace, and a token it re-reads at most once a minute because
+projected tokens rotate). `create` is idempotent by name: `generateName` is refused, and an
+existing Job returns `created=False`, so a caller can repeat it after a timeout. `get`
+returns `None` and `delete` returns `False` for a missing Job. POST is sent once; GET and
+DELETE retry 502, 503, 504 and network failures once. 429, 5xx, timeouts and connection
+failures raise `DependencyUnavailable`; other rejections raise `KubernetesApiError` with the
+status code and the API's reason, never its message.
+
+### Bedrock
+
+```python
+from clients_021.llm.bedrock import BedrockRuntime
+from langchain_aws import ChatBedrockConverse
+
+runtime = BedrockRuntime.create(obs, region="us-east-1")
+model = ChatBedrockConverse(model=settings.inference_profile, client=runtime)
+```
+
+`BedrockRuntime` keeps boto3's call signatures for `converse`, `converse_stream`,
+`invoke_model`, `invoke_model_with_response_stream` and `count_tokens`, and passes every
+other attribute (`meta`, `exceptions`) through to the boto3 client, so an SDK can take it
+where it expects one. Calls stay synchronous like boto3's. A streaming call is measured
+until its event stream ends; leaving the loop early or calling `close()` ends it as `ok`.
+Converse and ConverseStream add the reported input, output and cache tokens to
+`llm.client.token.usage`. Throttling (also mid-stream), 5xx, a model still loading and the
+stream errors Bedrock documents as retryable raise `DependencyUnavailable`; access denied,
+validation errors, a missing model and quota limits keep their botocore type. A retried
+model call is billed again.
+
+### Secrets Manager
+
+```python
+from clients_021.secrets.secrets_manager import SecretsManagerClient
+
+secrets = SecretsManagerClient.create(obs, region="us-east-1")
+secret = await secrets.get("connections/brain")
+token = secret.text()            # SecretString; secret.binary() for SecretBinary
+previous = await secrets.get("connections/brain", version_stage="AWSPREVIOUS")
+```
+
+`get` reads the current version unless a `version_id` or a `version_stage` is given (not
+both). The client does not cache: every call is a billed request, so keep a short-lived
+copy when the same secret is read often. A missing secret, access denied, a value KMS cannot
+decrypt or a secret scheduled for deletion keep their botocore type; throttling, 5xx and
+timeouts raise `DependencyUnavailable`. `repr(secret)` never shows the value.
+
 ### KMS
 
 The encryption context is required on every call, so a ciphertext only decrypts for the
@@ -339,6 +409,8 @@ async with AsyncExitStack() as resources:
     resources.push_async_callback(email.aclose)
     keys = KmsClient.create(obs, settings.session_key_arn, region="us-east-1")
     resources.push_async_callback(keys.aclose)
+    secrets = SecretsManagerClient.create(obs, region="us-east-1")
+    resources.push_async_callback(secrets.aclose)
     # Run the service here. Stop its background workers before leaving this scope.
 ```
 
@@ -350,7 +422,7 @@ Retry policies are explicit:
   POST and PATCH run once. Invalid URLs/protocols and invalid request construction keep
   their original exception. HTTP status responses are returned for the caller to handle.
 - Resend sends each request once (POST); send an `idempotency_key` and retry in the caller.
-- AWS factories (SQS, S3, SES, KMS) use botocore standard retries with at most **three total
+- AWS factories (SQS, S3, SES, KMS, Secrets Manager, Bedrock) use botocore standard retries with at most **three total
   attempts**.
   Injected SDK clients keep their configured policy. SQS consumers must tolerate duplicate
   messages; a timeout does not prove that a send or write was not applied.
@@ -373,7 +445,7 @@ any operation**. Map it at the service boundary and apply the operation's idempo
 Its message and structured fields are safe to log when dependency names are static. Its
 chained SDK exception may contain sensitive provider data; do not log exception chains.
 
-S3, SQS, SES and KMS run the synchronous AWS SDK in worker threads. Cancelling the await does not
+S3, SQS, SES, KMS and Secrets Manager run the synchronous AWS SDK in worker threads. Cancelling the await does not
 stop an SDK request already running in its thread. Timeouts are per SDK/network attempt,
 not an overall deadline. Limit consumer concurrency and let in-flight work finish before
 closing the clients. Redis window counters require Redis server 7 or newer (`EXPIRE NX`).
@@ -397,6 +469,8 @@ deduplication, start the [official local server](https://upstash.com/docs/qstash
 set its `QSTASH_URL` and `QSTASH_TOKEN`, and run `uv run python tests/qstash_local.py`.
 That smoke test accepts only a loopback QStash server and binds its destination dynamically.
 
-SQS, S3, SES and KMS tests run against [moto](https://github.com/getmoto/moto) (plus
+Kubernetes Jobs tests use httpx's `MockTransport`. Bedrock tests use botocore's Stubber and
+fake event streams. SQS, S3, SES, KMS and Secrets
+Manager tests run against [moto](https://github.com/getmoto/moto) (plus
 botocore's Stubber where moto ignores a field or differs from AWS); Resend tests use httpx's
 `MockTransport`; Redis tests need a real Redis. Licensed under Apache-2.0.

{021_python_clients-0.3.0 → 021_python_clients-0.4.0}/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "hatchling.build"
 
 [project]
 name = "021-python-clients"
-version = "0.3.0"
-description = "Observed clients for Redis, SQS, QStash, S3, Vercel Blob, HTTP, email and KMS, built on 021-python-observability"
+version = "0.4.0"
+description = "Observed clients for Redis, SQS, QStash, S3, Vercel Blob, HTTP, email, KMS, Secrets Manager, Bedrock and Kubernetes Jobs, built on 021-python-observability"
 readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE"]
 requires-python = ">=3.12"
-keywords = ["redis", "sqs", "qstash", "s3", "httpx", "email", "ses", "resend", "kms", "opentelemetry", "observability"]
+keywords = ["redis", "sqs", "qstash", "s3", "httpx", "email", "ses", "resend", "kms", "secrets-manager", "bedrock", "kubernetes", "opentelemetry", "observability"]
 classifiers = [
   "Development Status :: 3 - Alpha",
   "Intended Audience :: Developers",
@@ -50,8 +50,8 @@ dev = [
   "pytest-asyncio>=1.3",
   "ruff>=0.16,<0.17",
   "pyright>=1.1.405",
-  "moto[sqs,s3,ses,kms]>=5.2,<6",
-  "boto3-stubs[sqs,s3,sesv2,kms]>=1.40,<2",
+  "moto[sqs,s3,ses,kms,secretsmanager]>=5.2,<6",
+  "boto3-stubs[sqs,s3,sesv2,kms,secretsmanager,bedrock-runtime]>=1.40,<2",
 ]
 
 [tool.hatch.build.targets.wheel]

{021_python_clients-0.3.0 → 021_python_clients-0.4.0}/src/clients_021/__init__.py

@@ -1,8 +1,10 @@
 """Observed clients for the external services Python services call.
 
-`clients_021.http`, `clients_021.queue.qstash` and `clients_021.email` (Resend) need no extras;
+`clients_021.http`, `clients_021.queue.qstash`, `clients_021.email` (Resend) and
+`clients_021.compute.kubernetes` need no extras;
 `clients_021.cache.redis` needs the `redis` extra; `clients_021.queue.sqs`,
-`clients_021.storage.s3`, `clients_021.email.ses` and `clients_021.crypto.kms` the `aws` extra;
+`clients_021.storage.s3`, `clients_021.email.ses`, `clients_021.crypto.kms`,
+`clients_021.secrets.secrets_manager` and `clients_021.llm.bedrock` the `aws` extra;
 `clients_021.http.httpx2` the `httpx2` extra.
 `clients_021.storage.vercel_blob` needs the `vercel-blob` extra.
 """