021-python-clients 0.3.0__tar.gz → 0.5.0__tar.gz

{021_python_clients-0.3.0 → 021_python_clients-0.5.0}/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes are recorded here by release-please from Conventional Commits.
 
+## [0.5.0](https://github.com/from021-io/python-clients/compare/v0.4.0...v0.5.0) (2026-10-29)
+
+
+### Features
+
+* **compute:** create and delete Job-owned Secrets ([7f62939](https://github.com/from021-io/python-clients/commit/7f62939c08b5bc1672543e8819cb0781028320b7))
+* **compute:** create and delete Job-owned Secrets ([9507539](https://github.com/from021-io/python-clients/commit/9507539a84882b29a6f6baa63e1a9df17c08add8))
+* **featureflags:** add AppConfig feature flags client ([039c2b2](https://github.com/from021-io/python-clients/commit/039c2b2cc27f3cc3715a892032e369047bb108a3))
+* **featureflags:** add AppConfig feature flags client ([2c40ddb](https://github.com/from021-io/python-clients/commit/2c40ddbb493dca39d483406b28ffa7cfa883faba))
+
+
+### Bug fixes
+
+* **ci:** actualiza herramientas de instalación y publicación ([5c35e84](https://github.com/from021-io/python-clients/commit/5c35e844f679ce905335629ed7d3b4608b77c988))
+* **ci:** actualiza herramientas de instalación y publicación ([234a84a](https://github.com/from021-io/python-clients/commit/234a84af950a9e0d2f9460e807d124411b367953))
+* **deps:** support observability 0.4 ([#23](https://github.com/from021-io/python-clients/issues/23)) ([7363894](https://github.com/from021-io/python-clients/commit/7363894a8010abd345a60a54f29a55247e3307a3))
+
+## [0.4.0](https://github.com/from021-io/python-clients/compare/v0.3.0...v0.4.0) (2026-10-22)
+
+
+### Features
+
+* **compute:** add Kubernetes Jobs client over the HTTP client ([9b3c369](https://github.com/from021-io/python-clients/commit/9b3c36930f6a070d3fee9844e86c0d27f871346b))
+* **llm:** add observed Bedrock Runtime client for SDKs ([5216293](https://github.com/from021-io/python-clients/commit/52162939416f58c610f4f4e217d911f5e5efdea9))
+* **secrets:** add observed Secrets Manager client ([f14042f](https://github.com/from021-io/python-clients/commit/f14042f064ca61e8d267b338b033a12fd41690eb))
+
 ## [0.3.0](https://github.com/from021-io/python-clients/compare/v0.2.0...v0.3.0) (2026-10-21)
 
 

{021_python_clients-0.3.0 → 021_python_clients-0.5.0}/CONTRACT.md

@@ -15,8 +15,10 @@ The queue package groups providers by purpose. SQS owns polling, receipts and vi
 QStash owns HTTP delivery. Their public methods and observability contracts remain distinct.
 Shared email types and the interchangeable `EmailSender` protocol live in `clients_021.email`.
 
-Redis lives in `clients_021.cache.redis`, S3 in `clients_021.storage.s3` and KMS in
-`clients_021.crypto.kms`. The 0.1.0 root modules (`redis`, `s3`, `kms`) continue to re-export
+Redis lives in `clients_021.cache.redis`, S3 in `clients_021.storage.s3`, KMS in
+`clients_021.crypto.kms`, Secrets Manager in `clients_021.secrets.secrets_manager`, Bedrock
+in `clients_021.llm.bedrock` and Kubernetes Jobs in `clients_021.compute.kubernetes`, which
+needs no extra. The 0.1.0 root modules (`redis`, `s3`, `kms`) continue to re-export
 the same clients and result types (`ObjectInfo`, `DataKey`). Existing call signatures,
 metric/span names and error semantics are unchanged. Capability package imports do not
 load optional SDKs. HTTP implementations live in `clients_021.http.httpx` and
@@ -40,6 +42,15 @@ version, environment). Durations use 021-python-observability's buckets.
 | `storage.client.operation.duration` | Histogram / `s` | same | S3, Vercel Blob |
 | `crypto.client.operation.count` | Counter / `{operation}` | dependency, operation, status, error.type | KMS |
 | `crypto.client.operation.duration` | Histogram / `s` | same | KMS |
+| `secrets.client.operation.count` | Counter / `{operation}` | dependency, operation, status, error.type | Secrets Manager |
+| `secrets.client.operation.duration` | Histogram / `s` | same | Secrets Manager |
+| `llm.client.operation.count` | Counter / `{operation}` | dependency, operation, status, error.type | Bedrock |
+| `llm.client.operation.duration` | Histogram / `s` | same | Bedrock |
+| `llm.client.token.usage` | Counter / `{token}` | dependency, operation, token.type | Bedrock (Converse and ConverseStream) |
+| `compute.client.operation.count` | Counter / `{operation}` | dependency, operation, status, error.type | Kubernetes Jobs |
+| `compute.client.operation.duration` | Histogram / `s` | same | Kubernetes Jobs |
+| `config.client.operation.count` | Counter / `{operation}` | dependency, operation, status, error.type | Feature flags (AppConfig) |
+| `config.client.operation.duration` | Histogram / `s` | same | Feature flags (AppConfig) |
 | `http.client.request.count` | Counter / `{request}` | dependency, http.request.method, http.response.status_code, error.type, http.response.body.complete | HTTP, httpx2, QStash transport, Resend (its HTTP request) |
 | `http.client.request.duration` | Histogram / `s` | same | HTTP, httpx2, QStash transport, Resend (its HTTP request) |
 
@@ -49,8 +60,19 @@ version, environment). Durations use 021-python-observability's buckets.
   S3 and Vercel Blob: `put`, `get`, `head`, `delete`. QStash: `publish`.
   Email (Resend, SES): `send`. KMS:
   `encrypt`, `decrypt`, `generate_data_key`; `seal` and `unseal` record the KMS call they make
-  (`generate_data_key`, `decrypt`), not the local AES work.
-- Redis/SQS/S3/Vercel Blob/QStash/email/KMS `error.type`: `timeout`, `connection_error`, `throttled`,
+  (`generate_data_key`, `decrypt`), not the local AES work. Secrets Manager: `get`.
+  Feature flags: `start_session`, `get_configuration`; reading a flag from the snapshot
+  records nothing.
+  Bedrock: `converse`, `converse_stream`, `invoke_model`, `invoke_model_with_response_stream`,
+  `count_tokens`. A streaming operation ends when its event stream is exhausted, fails or is
+  closed, not when the call returns. Kubernetes Jobs: `create`, `get`, `delete`, `create_secret`,
+  `delete_secret`; each also records its HTTP request (`http.client.request.*`) under the same
+  `dependency`. A missing Job or Secret (`get`, `delete`, `delete_secret`) and an existing one
+  (`create`, `create_secret`) are `status=ok`.
+- `token.type`: `input`, `output`, `cache_read`, `cache_write`, as reported by Bedrock in
+  the Converse response or the ConverseStream `metadata` event. InvokeModel bodies are
+  model-specific and are not read.
+- Redis/SQS/S3/Vercel Blob/QStash/email/KMS/Secrets Manager/Bedrock/Kubernetes Jobs/feature flags `error.type`: `timeout`, `connection_error`, `throttled`,
   `status_<5xx>`, `cancelled`, or the exception class name for errors that are not outages
   (`EmailRejected` for every email rejection; botocore's class, such as `ClientError` or
   `NotFoundException`, for KMS).
@@ -70,7 +92,11 @@ version, environment). Durations use 021-python-observability's buckets.
 CLIENT spans named `<dependency> <operation>` (`HTTP <dependency>` for HTTP), with the
 metric labels plus `db.system.name=redis`, `messaging.system=aws_sqs`,
 `messaging.system=upstash_qstash`, `messaging.system=resend`, `messaging.system=aws_ses`, or
-`rpc.system=aws-api` + `rpc.service=S3` / `rpc.service=KMS`, or `rpc.system=vercel-blob`.
+`rpc.system=aws-api` + `rpc.service=S3` / `rpc.service=KMS` / `rpc.service=AppConfigData` / `rpc.service=SecretsManager` /
+`rpc.service=BedrockRuntime` (plus `gen_ai.system=aws.bedrock`), `rpc.system=vercel-blob`, or
+`rpc.system=kubernetes` + `rpc.service=Job` (`rpc.service=Secret` for `create_secret` and
+`delete_secret`). Kubernetes Jobs' `HTTP <dependency>` span is a child of its
+`<dependency> <operation>` span.
 Resend's `HTTP <dependency>` span is a child of its `<dependency> send` span. Status ERROR on failure (and on HTTP
 status ≥ 400).
 Cancellation propagates unchanged and records ERROR with `error.type=cancelled`.
@@ -97,7 +123,7 @@ Local input validation occurs before either operation is recorded.
 
 ## Logging and coverage limits
 
-Redis, SQS, QStash, S3, Vercel Blob, Resend, SES and KMS emit a structured
+Redis, SQS, QStash, S3, Vercel Blob, Resend, SES, KMS, Secrets Manager, Bedrock, Kubernetes Jobs and feature flags emit a structured
 `dependency.call_failed` warning when an observed remote operation raises an exception.
 Fields are `dependency`, `operation` and `error_type`; provider messages and exception
 chains are not logged. Successful calls and cancellation do not emit this warning;
@@ -112,7 +138,7 @@ attempts emit no log. Intentional partial close emits `dependency.stream_closed`
 with dependency and operation; it is not an outage.
 
 `log_failures=False` suppresses these HTTP attempt logs without disabling metrics or spans.
-QStash and Resend set this option because their logical operation already emits a failure
+QStash, Resend and Kubernetes Jobs set this option because their logical operation already emits a failure
 warning; they do not log the same failure at both levels. SDK retry loops can produce one
 warning per failed attempt. HTTP counters measure attempts, not logical API/SDK calls.
 
@@ -137,7 +163,7 @@ telemetry reaches an external backend.
   When enabled, both caller-supplied trace headers are replaced with the current context.
 - Resend: nothing is sent. The `traceparent`, `tracestate` and `x-request-id` headers that
   the HTTP transport adds are removed before the request leaves.
-- SES, KMS and Vercel Blob: nothing is sent by the default transports.
+- SES, KMS, Secrets Manager, Bedrock, feature flags and Vercel Blob: nothing is sent by the default transports.
 - SQS: `traceparent` and `tracestate` are message attributes; `ReceivedMessage.trace_context()`
   returns the producer's context. Caller-supplied values for both trace attributes are
   replaced with the current context.
@@ -180,6 +206,14 @@ it. Resend's request is sent once; `idempotency_key` becomes its `Idempotency-Ke
 (1–256 characters, kept by Resend for 24 hours). SES has no idempotency key: the argument is
 validated and ignored.
 
+Feature flags: throttling, 5xx, timeouts and connection failures are `DependencyUnavailable`,
+raised only while no snapshot exists; once one does, a failed refresh serves it stale and
+retries after `retry_seconds`. Access denied and missing application, environment or profile
+keep their botocore type. A configuration that is not feature flag JSON (an object of
+`{"enabled": bool, ...}` entries) raises `ValueError` on the first load and is ignored, with a
+`featureflags.invalid_configuration` warning, afterwards. An expired session token
+(`BadRequestException`) opens one new session.
+
 KMS: throttling, 5xx (`KMSInternalException`, `DependencyTimeoutException`,
 `KeyUnavailableException`), timeouts and connection failures are `DependencyUnavailable`.
 Access denied, disabled or missing keys, invalid key state, a wrong encryption context or a
@@ -188,6 +222,39 @@ tampered ciphertext (`InvalidCiphertextException`) and a ciphertext from another
 Every call requires a non-empty encryption context. `unseal` raises `ValueError` for a
 malformed envelope and `cryptography.exceptions.InvalidTag` when the payload was altered.
 
+Secrets Manager: throttling, 5xx (`InternalServiceError`), timeouts and connection failures
+are `DependencyUnavailable`. A missing secret (`ResourceNotFoundException`), access denied,
+a value KMS cannot decrypt (`DecryptionFailure`), a secret scheduled for deletion
+(`InvalidRequestException`) and invalid parameters keep their botocore type. `get` is a read:
+retrying it is safe. A version with neither `SecretString` nor `SecretBinary` raises
+`ValueError`.
+
+Bedrock: throttling (`ThrottlingException`, and `throttlingException` inside an event stream),
+5xx, `ModelNotReadyException` (`throttled`), the stream errors `serviceUnavailableException`,
+`internalServerException` and `modelStreamErrorException`, timeouts and connection failures
+are `DependencyUnavailable`. Access denied, validation errors, a missing model or profile and
+quota limits (`ServiceQuotaExceededException`) keep their botocore type. Leaving a stream
+early or calling its `close()` ends the operation as `ok` and logs `dependency.stream_closed`
+at INFO. A model call is not idempotent in cost: botocore's retries bill each attempt.
+
+Kubernetes Jobs: 429 is `throttled`, 5xx `status_<5xx>`, transport timeouts and connection
+failures `timeout` / `connection_error`, all `DependencyUnavailable`. A 409 whose reason is
+`AlreadyExists` on `create` or `create_secret` and a 404 on `get`, `delete` or `delete_secret`
+are results, not errors. Any other
+non-success status raises `KubernetesApiError(status_code, reason)`, where `reason` is the
+Status object's machine-readable reason (`Forbidden`, `Invalid`, `Conflict`, ...) or
+`Unknown`; a 201 whose name does not match raises it with `InvalidResponse`. POST is sent
+once; GET and DELETE retry 502/503/504 and network failures once. Local validation (DNS-label
+names and namespace, `metadata.name` required, `generateName` refused, `kind` must be Job)
+happens before any request. `JobCreated.uid` (on 201) and `JobStatus.uid` carry the Job's
+`metadata.uid`, or `None` when absent or when `create` found an existing Job.
+`create_secret(name, data, *, job, job_uid)` posts an `Opaque`, `immutable` Secret with base64
+`data` and one owner reference (`batch/v1` Job, name and uid, no `blockOwnerDeletion`); an
+existing Secret is kept unchanged (`SecretCreated(created=False)`). Its local validation
+(DNS-label Secret and Job names, non-empty `data`, keys of 1-253 letters, digits, `-`, `_`
+or `.`, `str` or `bytes` values, a uid of letters, digits and `-`) raises `ValueError`
+before any request, with a message that names neither keys nor values.
+
 Vercel Blob (`clients_021.storage.vercel_blob`): HTTP 429 maps to `throttled`; 5xx to
 `status_<code>`; HTTP timeouts and total deadlines to `timeout`; network/remote protocol
 failures to `connection_error`. Known transport causes wrapped by the SDK are classified
@@ -209,7 +276,8 @@ A new data key is generated for every envelope.
 
 ## Lifecycle and retry limits
 
-HTTP, Redis, SQS, QStash, S3, Vercel Blob, Resend, SES and KMS expose `aclose()`. Close them after
+HTTP, Redis, SQS, QStash, S3, Vercel Blob, Resend, SES, KMS, Secrets Manager, Bedrock, Kubernetes
+Jobs and feature flags expose `aclose()` (Bedrock also `close()`). Close them after
 in-flight calls complete; the wrapper owns the underlying client, including one supplied
 through the constructor.
 AWS factories configure three total attempts; injected clients retain their own policy.
@@ -261,9 +329,15 @@ these clients, or each request would be counted twice.
 
 ## Never recorded
 
-Keys, URLs, query strings, bodies, message ids, receipts, object names, bucket or queue
+Feature flags: application, environment and profile identifiers, flag names, attributes, values
+and session tokens. Keys, URLs, query strings, bodies, message ids, receipts, object names, bucket or queue
 names, provider error messages. Email: sender, recipient and reply-to addresses, subjects,
 text and HTML bodies, tags, idempotency keys, API keys, configuration set names. KMS: key
-ids, ARNs and aliases, encryption contexts, plaintext, ciphertext and data keys.
+ids, ARNs and aliases, encryption contexts, plaintext, ciphertext and data keys. Secrets
+Manager: secret ids, names and ARNs, version ids, version stages and secret values. Bedrock:
+model ids, inference profile ARNs, prompts, system prompts, outputs, tool arguments and
+results, request ids and guardrail details. Kubernetes Jobs: namespaces, Job names, labels,
+manifests, API server addresses, service account tokens and Status messages; Secret names,
+data keys and values (plain or base64), owner Job names and uids.
 
 Vercel Blob: read-write tokens, store IDs, pathnames, delivery URLs, content and ETags.

{021_python_clients-0.3.0 → 021_python_clients-0.5.0}/CONTRIBUTING.md

@@ -19,6 +19,9 @@ clients_021/
   cache/          # redis.py
   storage/        # s3.py, vercel_blob.py
   crypto/         # kms.py
+  secrets/        # secrets_manager.py
+  llm/            # bedrock.py
+  compute/        # kubernetes.py (over the shared HTTP client, no extra)
 ```
 
 The original `clients_021.redis`, `clients_021.s3` and `clients_021.kms` imports remain
@@ -62,7 +65,9 @@ Each implementation must make these decisions explicit in README.md and CONTRACT
 | Telemetry | Choose a metric family, fixed operations and system attribute. Never record URLs, credentials, bodies, object names or request-derived ids. |
 | Propagation | State the default and opt-out. Replace `traceparent` and `tracestate` together, including removing stale state. |
 
-Use `_observe.observed` for a logical cache, messaging, storage or crypto operation. HTTP-backed
+Use `_observe.observed` for a logical cache, messaging, storage or crypto operation, and
+`_observe.Call` for synchronous SDK calls or operations that end after the call returns
+(event streams). HTTP-backed
 clients may also emit the transport's HTTP span/metrics: one logical operation and one
 network request are different measurements. Do not sum those counters as distinct
 business operations. Disable nested HTTP attempt logs with `log_failures=False` when the

{021_python_clients-0.3.0 → 021_python_clients-0.5.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.5
 Name: 021-python-clients
-Version: 0.3.0
-Summary: Observed clients for Redis, SQS, QStash, S3, Vercel Blob, HTTP, email and KMS, built on 021-python-observability
+Version: 0.5.0
+Summary: Observed clients for Redis, SQS, QStash, S3, Vercel Blob, HTTP, email, KMS, Secrets Manager, Bedrock and Kubernetes Jobs and AppConfig feature flags, built on 021-python-observability
 Project-URL: Repository, https://github.com/from021-io/python-clients
 Project-URL: Changelog, https://github.com/from021-io/python-clients/blob/main/CHANGELOG.md
 Project-URL: Contract, https://github.com/from021-io/python-clients/blob/main/CONTRACT.md
 License-Expression: Apache-2.0
 License-File: LICENSE
-Keywords: email,httpx,kms,observability,opentelemetry,qstash,redis,resend,s3,ses,sqs
+Keywords: appconfig,bedrock,email,feature-flags,httpx,kms,kubernetes,observability,opentelemetry,qstash,redis,resend,s3,secrets-manager,ses,sqs
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
@@ -19,7 +19,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: System :: Monitoring
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: 021-python-observability<0.4,>=0.3
+Requires-Dist: 021-python-observability<0.5,>=0.3
 Requires-Dist: httpx<1,>=0.28
 Requires-Dist: opentelemetry-api<2,>=1.44
 Provides-Extra: aws
@@ -58,6 +58,11 @@ uv add "021-python-clients[redis,aws,httpx2,vercel-blob]"   # pick the extras yo
 | `clients_021.email` | none | `EmailMessage`, the `EmailSender` protocol, `ResendSender` (Resend's HTTP API) |
 | `clients_021.email.ses` | `aws` | `SesSender`: the same protocol over Amazon SES v2 |
 | `clients_021.crypto.kms` | `aws` | `KmsClient`: encrypt, decrypt and data keys bound to an encryption context; AES-256-GCM envelopes |
+| `clients_021.secrets.secrets_manager` | `aws` | `SecretsManagerClient`: read a secret by id, version id or stage; the value is never printed |
+| `clients_021.compute.kubernetes` | none | `KubernetesJobsClient`: create (idempotent by name), read and delete Jobs in a namespace, and the Secrets they own; in-cluster service account |
+| `clients_021.featureflags` | none | `Flag` and the `FeatureFlags` protocol services type against |
+| `clients_021.featureflags.appconfig` | `aws` | `AppConfigFlags`: AWS AppConfig feature flags, cached and refreshed on an interval |
+| `clients_021.llm.bedrock` | `aws` | `BedrockRuntime`: an observed `bedrock-runtime` client to pass to SDKs such as LangChain's `ChatBedrockConverse`; streams measured to the end, token usage counted |
 
 Every client takes the service's `Observability` (from `setup_observability`) and a
 `dependency` name, which becomes the `dependency` label of its metrics.
@@ -66,7 +71,7 @@ Every client takes the service's `Observability` (from `setup_observability`) an
 
 Providers with the same purpose live under one capability package: `email/` contains
 Resend and SES; `queue/` contains SQS and QStash; `storage/` contains S3 and Vercel Blob; `cache/`
-contains Redis; `crypto/` contains KMS. `http/` contains the httpx client and httpx2
+contains Redis; `crypto/` contains KMS; `secrets/` contains Secrets Manager; `llm/` contains Bedrock; `compute/` contains Kubernetes Jobs; `featureflags/` contains AppConfig. `http/` contains the httpx client and httpx2
 transport. Import providers explicitly:
 
 ```python
@@ -77,6 +82,9 @@ from clients_021.queue.qstash import QStashClient
 from clients_021.storage.s3 import S3Client
 from clients_021.cache.redis import RedisClient
 from clients_021.crypto.kms import KmsClient
+from clients_021.secrets.secrets_manager import SecretsManagerClient
+from clients_021.llm.bedrock import BedrockRuntime
+from clients_021.compute.kubernetes import KubernetesJobsClient
 ```
 
 SQS supports polling, receipts and visibility changes; QStash delivers to an HTTP endpoint.
@@ -95,12 +103,16 @@ published exports; `clients_021.httpx2.ObservedTransport` remains an alias for
 
 - A CLIENT span named `<dependency> <operation>` (`HTTP <dependency>` for HTTP), with the
   system attribute (`db.system.name=redis`, `messaging.system=aws_sqs|resend|aws_ses`,
-  `rpc.service=S3|KMS`, `rpc.system=vercel-blob`).
+  `rpc.service=S3|KMS|SecretsManager|BedrockRuntime|AppConfigData`, `rpc.system=vercel-blob`, `rpc.system=kubernetes`;
+  Bedrock also `gen_ai.system=aws.bedrock`).
 - A counter and a duration histogram: `db.client.operation.*` (Redis, shared with SQL),
   `messaging.client.operation.*` (SQS, QStash, email), `storage.client.operation.*` (S3, Vercel Blob),
-  `crypto.client.operation.*` (KMS), `http.client.request.*` (HTTP, and the HTTP request
+  `crypto.client.operation.*` (KMS), `secrets.client.operation.*` (Secrets Manager),
+  `llm.client.operation.*` and `llm.client.token.usage` (Bedrock), `compute.client.operation.*`
+  (Kubernetes Jobs), `config.client.operation.*` (feature flags),
+  `http.client.request.*` (HTTP, and the HTTP request
   under QStash and Resend). Labels are bounded; see [CONTRACT.md](CONTRACT.md).
-- Redis, SQS, QStash, S3, Vercel Blob, email and KMS emit a `dependency.call_failed` warning on failure,
+- Redis, SQS, QStash, S3, Vercel Blob, email, KMS, Secrets Manager, Bedrock and Kubernetes Jobs emit a `dependency.call_failed` warning on failure,
   with dependency, operation and error type only. HTTP/httpx2 also log failed attempts,
   including body failures and cancellation; QStash/Resend suppress the nested HTTP log.
 - `DependencyUnavailable(dependency, operation, reason)` when the service timed out,
@@ -109,7 +121,9 @@ published exports; `clients_021.httpx2.ObservedTransport` remains an alias for
   original type: they are bugs, not outages.
 
 Never in this library's spans, metrics or logs: keys, URLs, bodies, message ids or object
-names; email addresses, subjects, bodies or tags; KMS key ids, encryption contexts,
+names; email addresses, subjects, bodies or tags; secret ids, version ids, stages and
+values; model ids, prompts and outputs; namespaces, Job names, manifests and service
+account tokens; feature flag names, values and AppConfig identifiers; KMS key ids, encryption contexts,
 plaintext, ciphertext or data keys. Use static dependency names such as `identity-provider` or `uploads`; never derive
 them from a tenant, user or request. All clients apply observability's identifier rule
 (1–96 letters, digits, `_`, `.` or `-`, starting with a letter or digit).
@@ -272,6 +286,118 @@ except EmailRejected as rejected:  # the address, the domain or the credentials;
 SES has no idempotency key (the argument is ignored): deduplicate in the caller when a retry
 must not send twice. Tags are for provider analytics; never put personal data in them.
 
+### Kubernetes Jobs
+
+```python
+from clients_021.compute.kubernetes import KubernetesJobsClient
+
+jobs = KubernetesJobsClient.in_cluster(obs, namespace="agent-runs")
+created = await jobs.create({"metadata": {"name": "cmd-4821"}, "spec": job_spec})
+status = await jobs.get("cmd-4821")        # JobStatus(phase="running", ...) or None
+await jobs.delete("cmd-4821", propagation="Background")
+```
+
+No SDK: it calls the `batch/v1` REST API through `HttpClient`. `in_cluster` uses the pod's
+service account (CA bundle, namespace, and a token it re-reads at most once a minute because
+projected tokens rotate). `create` is idempotent by name: `generateName` is refused, and an
+existing Job returns `created=False`, so a caller can repeat it after a timeout. `get`
+returns `None` and `delete` returns `False` for a missing Job. POST is sent once; GET and
+DELETE retry 502, 503, 504 and network failures once. 429, 5xx, timeouts and connection
+failures raise `DependencyUnavailable`; other rejections raise `KubernetesApiError` with the
+status code and the API's reason, never its message.
+
+A value the pod needs but that must not be readable in the Job's spec (a run token, say) goes
+in a Secret the Job owns:
+
+```python
+created = await jobs.create(manifest)      # the container reads env from secretKeyRef
+uid = created.uid or (await jobs.get(name)).uid   # None in created when the Job existed
+await jobs.create_secret(f"{name}-token", {"token": run_token}, job=name, job_uid=uid)
+```
+
+```yaml
+env:
+  - name: RUN_TOKEN
+    valueFrom: { secretKeyRef: { name: cmd-4821-token, key: token } }
+```
+
+The Secret is `Opaque` and `immutable`, with an owner reference to the Job's name and uid, so
+the garbage collector deletes it with the Job (including through `ttlSecondsAfterFinished`).
+The Job is created first because the reference needs its uid; the kubelet keeps retrying a
+pod whose Secret does not exist yet. `create_secret` is idempotent by name like `create`: a
+409 `AlreadyExists` returns `created=False` and keeps the existing Secret without comparing or
+updating it, so a retry must reuse the same value (or `delete_secret` and create again).
+`delete_secret` returns `False` when there was none. `blockOwnerDeletion` is not set, so the
+caller needs only `create` and `delete` on `secrets` (no `get`, and nothing on
+`jobs/finalizers`). Secret names, data keys and values never reach telemetry, logs or error
+messages; the request body is still in the chained httpx exception's `request`, so do not log
+`__cause__` details.
+
+### Bedrock
+
+```python
+from clients_021.llm.bedrock import BedrockRuntime
+from langchain_aws import ChatBedrockConverse
+
+runtime = BedrockRuntime.create(obs, region="us-east-1")
+model = ChatBedrockConverse(model=settings.inference_profile, client=runtime)
+```
+
+`BedrockRuntime` keeps boto3's call signatures for `converse`, `converse_stream`,
+`invoke_model`, `invoke_model_with_response_stream` and `count_tokens`, and passes every
+other attribute (`meta`, `exceptions`) through to the boto3 client, so an SDK can take it
+where it expects one. Calls stay synchronous like boto3's. A streaming call is measured
+until its event stream ends; leaving the loop early or calling `close()` ends it as `ok`.
+Converse and ConverseStream add the reported input, output and cache tokens to
+`llm.client.token.usage`. Throttling (also mid-stream), 5xx, a model still loading and the
+stream errors Bedrock documents as retryable raise `DependencyUnavailable`; access denied,
+validation errors, a missing model and quota limits keep their botocore type. A retried
+model call is billed again.
+
+### Secrets Manager
+
+```python
+from clients_021.secrets.secrets_manager import SecretsManagerClient
+
+secrets = SecretsManagerClient.create(obs, region="us-east-1")
+secret = await secrets.get("connections/brain")
+token = secret.text()            # SecretString; secret.binary() for SecretBinary
+previous = await secrets.get("connections/brain", version_stage="AWSPREVIOUS")
+```
+
+`get` reads the current version unless a `version_id` or a `version_stage` is given (not
+both). The client does not cache: every call is a billed request, so keep a short-lived
+copy when the same secret is read often. A missing secret, access denied, a value KMS cannot
+decrypt or a secret scheduled for deletion keep their botocore type; throttling, 5xx and
+timeouts raise `DependencyUnavailable`. `repr(secret)` never shows the value.
+
+### Feature flags (AWS AppConfig)
+
+Reads [AppConfig feature flags](https://aws.amazon.com/blogs/mt/using-aws-appconfig-feature-flags/)
+through the AppConfig Data API and keeps a snapshot in memory; evaluating a flag is a lookup:
+
+```python
+from clients_021.featureflags import FeatureFlags          # the protocol, no extra needed
+from clients_021.featureflags.appconfig import AppConfigFlags
+
+flags: FeatureFlags = AppConfigFlags.create(
+    obs, settings.appconfig_app, settings.appconfig_env, settings.appconfig_profile,
+    region="us-east-1",
+)
+if await flags.is_enabled("new-checkout"):          # unknown flag -> default=False
+    ...
+limit = await flags.flag("rate-limit")              # Flag(enabled=True, attributes={"rps": 50})
+```
+
+The snapshot is refreshed by the first request after `refresh_seconds` (default 45, minimum
+15), one poll at a time. If a refresh fails while a snapshot exists, the stale one keeps
+serving and the next attempt is 15 seconds later; with no snapshot yet the outage raises
+`DependencyUnavailable`. A configuration that is not valid flag JSON raises `ValueError` on
+the first load and is ignored with a warning afterwards. Supports plain flags and their
+attributes; multi-variant flags and rules need the AppConfig Agent, which evaluates them.
+The IAM role needs `appconfig:StartConfigurationSession` and
+`appconfig:GetLatestConfiguration` on the configuration profile.
+
 ### KMS
 
 The encryption context is required on every call, so a ciphertext only decrypts for the
@@ -375,6 +501,8 @@ async with AsyncExitStack() as resources:
     resources.push_async_callback(email.aclose)
     keys = KmsClient.create(obs, settings.session_key_arn, region="us-east-1")
     resources.push_async_callback(keys.aclose)
+    secrets = SecretsManagerClient.create(obs, region="us-east-1")
+    resources.push_async_callback(secrets.aclose)
     # Run the service here. Stop its background workers before leaving this scope.
 ```
 
@@ -386,7 +514,7 @@ Retry policies are explicit:
   POST and PATCH run once. Invalid URLs/protocols and invalid request construction keep
   their original exception. HTTP status responses are returned for the caller to handle.
 - Resend sends each request once (POST); send an `idempotency_key` and retry in the caller.
-- AWS factories (SQS, S3, SES, KMS) use botocore standard retries with at most **three total
+- AWS factories (SQS, S3, SES, KMS, Secrets Manager, Bedrock, feature flags) use botocore standard retries with at most **three total
   attempts**.
   Injected SDK clients keep their configured policy. SQS consumers must tolerate duplicate
   messages; a timeout does not prove that a send or write was not applied.
@@ -409,7 +537,7 @@ any operation**. Map it at the service boundary and apply the operation's idempo
 Its message and structured fields are safe to log when dependency names are static. Its
 chained SDK exception may contain sensitive provider data; do not log exception chains.
 
-S3, SQS, SES and KMS run the synchronous AWS SDK in worker threads. Cancelling the await does not
+S3, SQS, SES, KMS, Secrets Manager and feature flags run the synchronous AWS SDK in worker threads. Cancelling the await does not
 stop an SDK request already running in its thread. Timeouts are per SDK/network attempt,
 not an overall deadline. Limit consumer concurrency and let in-flight work finish before
 closing the clients. Redis window counters require Redis server 7 or newer (`EXPIRE NX`).
@@ -433,6 +561,8 @@ deduplication, start the [official local server](https://upstash.com/docs/qstash
 set its `QSTASH_URL` and `QSTASH_TOKEN`, and run `uv run python tests/qstash_local.py`.
 That smoke test accepts only a loopback QStash server and binds its destination dynamically.
 
-SQS, S3, SES and KMS tests run against [moto](https://github.com/getmoto/moto) (plus
+Kubernetes Jobs tests use httpx's `MockTransport`. Bedrock tests use botocore's Stubber and
+fake event streams. SQS, S3, SES, KMS and Secrets
+Manager tests run against [moto](https://github.com/getmoto/moto) (plus
 botocore's Stubber where moto ignores a field or differs from AWS); Resend tests use httpx's
 `MockTransport`; Redis tests need a real Redis. Licensed under Apache-2.0.