hanzoai/python-sdk
2
0
Fork 0
mirror of https://github.com/hanzoai/python-sdk.git synced 2026-10-23 20:23:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

regenerate from cloud 939b09d4

Browse Source 
The rebase folded the fleet-wide projection into the newer v8.5.151 already on
main, and two files did not survive it: git_api and websearch_api still
described the previous emission. .spec-lock came back conflicted from the same
rebase and is set to the document these were generated from.

`generate.py python --check` is clean after.
This commit is contained in:
zeekay
2026-08-24 23:38:24 -07:00
parent c32cd7e962
commit 9f6663482d
28 changed files with 755 additions and 227 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.generated
+4
View File
@@ -176,6 +176,7 @@ pkg/hanzoai/cloud/models/app_view.py
pkg/hanzoai/cloud/models/appearance.py
pkg/hanzoai/cloud/models/application.py
pkg/hanzoai/cloud/models/application_list.py
pkg/hanzoai/cloud/models/applied_resource.py
pkg/hanzoai/cloud/models/apply_request.py
pkg/hanzoai/cloud/models/approve_pairing_in.py
pkg/hanzoai/cloud/models/argo_app.py
@@ -1997,6 +1998,8 @@ pkg/hanzoai/cloud/models/readme_json.py
pkg/hanzoai/cloud/models/receipt.py
pkg/hanzoai/cloud/models/recharge.py
pkg/hanzoai/cloud/models/recharged.py
pkg/hanzoai/cloud/models/reconcile_report.py
pkg/hanzoai/cloud/models/reconcile_source.py
pkg/hanzoai/cloud/models/record.py
pkg/hanzoai/cloud/models/record_in.py
pkg/hanzoai/cloud/models/record_list.py
@@ -2216,6 +2219,7 @@ pkg/hanzoai/cloud/models/sequences.py
pkg/hanzoai/cloud/models/series_line.py
pkg/hanzoai/cloud/models/series_point.py
pkg/hanzoai/cloud/models/session_detail.py
pkg/hanzoai/cloud/models/session_ended.py
pkg/hanzoai/cloud/models/session_list.py
pkg/hanzoai/cloud/models/session_user.py
pkg/hanzoai/cloud/models/session_view.py
.spec-lock
+2 -2
View File
@@ -1,4 +1,4 @@
ref=6437e8bbdca9645714e5fc986b3d3c7473a95ed8
sha256=2f9f0b55b7e3f09a88a82279489bed503886171956c7a830ce566ffe890d969a
ref=939b09d4ad32c9be3c018abae25dda0569a3bb85
sha256=087024f65af714e61e7c2327fda49b3e8494972c40d2babd3b14ff6dcdd2712a
repo=hanzo-inc/cloud
path=openapi.yaml
examples/hello/__main__.py
+1 -1
View File
@@ -14,7 +14,7 @@ worse than no check because it reads as proof.
``/v1/keys`` answers 403 ``{"code":"forbidden","error":"sign in to manage API
keys"}`` with no key and with a bogus one, while the nonsense sibling
``/v1/keys-zzq9`` answers 404 — so the 403 is this route refusing, not a
wildcard door swallowing the address.
wildcard route swallowing the address.
This replaces ``bot_authMe`` (``GET /v1/bot/auth/me``), which no longer
resolves: cloud relays all of ``/v1/bot`` through one ``app.All("/v1/bot/*")``,
examples/tools/__main__.py
+1 -1
View File
@@ -3,7 +3,7 @@
``GET /v1/tools`` (operationId ``get_tools``), the catalog behind the
MCP surface: each entry is a tool name, its description and its input schema.
A note on the MCP door, because it is easy to pick the wrong one. There is a
A note on the MCP endpoints, because it is easy to pick the wrong one. There is a
JSON-RPC endpoint at ``POST /v1/mcp`` that answers ``tools/list`` with the same
catalog — but it is NOT in the document, so the generator emits no method for it
and an example would have to bypass the SDK to call it, which defeats the point
pkg/hanzoai/cloud/__init__.py
+8
View File
@@ -198,6 +198,7 @@ __all__ = [
"Appearance",
"Application",
"ApplicationList",
"AppliedResource",
"ApplyRequest",
"ApprovePairingIn",
"ArgoApp",
@@ -2019,6 +2020,8 @@ __all__ = [
"Receipt",
"Recharge",
"Recharged",
"ReconcileReport",
"ReconcileSource",
"Record",
"RecordIn",
"RecordList",
@@ -2239,6 +2242,7 @@ __all__ = [
"SeriesLine",
"SeriesPoint",
"SessionDetail",
"SessionEnded",
"SessionList",
"SessionUser",
"SessionView",
@@ -2652,6 +2656,7 @@ from hanzoai.cloud.models.app_view import AppView as AppView
from hanzoai.cloud.models.appearance import Appearance as Appearance
from hanzoai.cloud.models.application import Application as Application
from hanzoai.cloud.models.application_list import ApplicationList as ApplicationList
from hanzoai.cloud.models.applied_resource import AppliedResource as AppliedResource
from hanzoai.cloud.models.apply_request import ApplyRequest as ApplyRequest
from hanzoai.cloud.models.approve_pairing_in import ApprovePairingIn as ApprovePairingIn
from hanzoai.cloud.models.argo_app import ArgoApp as ArgoApp
@@ -4473,6 +4478,8 @@ from hanzoai.cloud.models.readme_json import ReadmeJSON as ReadmeJSON
from hanzoai.cloud.models.receipt import Receipt as Receipt
from hanzoai.cloud.models.recharge import Recharge as Recharge
from hanzoai.cloud.models.recharged import Recharged as Recharged
from hanzoai.cloud.models.reconcile_report import ReconcileReport as ReconcileReport
from hanzoai.cloud.models.reconcile_source import ReconcileSource as ReconcileSource
from hanzoai.cloud.models.record import Record as Record
from hanzoai.cloud.models.record_in import RecordIn as RecordIn
from hanzoai.cloud.models.record_list import RecordList as RecordList
@@ -4693,6 +4700,7 @@ from hanzoai.cloud.models.sequences import Sequences as Sequences
from hanzoai.cloud.models.series_line import SeriesLine as SeriesLine
from hanzoai.cloud.models.series_point import SeriesPoint as SeriesPoint
from hanzoai.cloud.models.session_detail import SessionDetail as SessionDetail
from hanzoai.cloud.models.session_ended import SessionEnded as SessionEnded
from hanzoai.cloud.models.session_list import SessionList as SessionList
from hanzoai.cloud.models.session_user import SessionUser as SessionUser
from hanzoai.cloud.models.session_view import SessionView as SessionView
pkg/hanzoai/cloud/api/bot_api.py
+17 -13
View File
@@ -16,7 +16,8 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
from typing import Any, Dict, List, Optional, Tuple, Union
from typing_extensions import Annotated
from pydantic import StrictStr
from pydantic import Field, StrictStr
from typing_extensions import Annotated
from hanzoai.cloud.models.bot_runs import BotRuns
from hanzoai.cloud.models.bot_stopped import BotStopped
@@ -300,9 +301,9 @@ class BotApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
"""Reserved address for launching a bot run — not implemented, always 501
"""Answers 501 to every call: launching a bot run is not implemented.
Answers 501 to every call. The bot runtime exposes no launch operation, so nothing here can start a sandbox, and this address is published rather than dropped because it is the collection every run is created in: GET lists them, POST would launch one. The refusal is total and takes no input. The handler never reads the body, so any bytes at all — malformed JSON included — get the same 501; no run id is minted, no session URL is handed back, and no per-run fee is charged. That is the point: the earlier version minted an id the runtime had never heard of, pointed it at a VNC node that did not exist, and took real money for it. Listing and stopping runs are live and org-scoped. Only the launch is missing, and it returns in the same change that can prove a bot boots.
Answers 501 to every call: launching a bot run is not implemented. The bot runtime exposes no launch operation, so nothing here can start a sandbox. This address is published rather than dropped because it is the collection every run is created in: GET lists them, POST would launch one. The refusal is total and takes no input. No run id is minted, no session URL is handed back, and no per-run fee is charged. That is the point: the earlier version minted an id the runtime had never heard of, pointed it at a VNC node that did not exist, and took real money for it. 501 is the truth, and the truth is cheaper than a plausible lie. Listing and stopping runs are live and org-scoped. Only the launch is missing, and it returns in the same change that can prove a bot boots — a runtime-side launch operation first (TS, cross-repo), with the entitlement gate and the meter beside it.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -334,6 +335,7 @@ class BotApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'501': None,
}
response_data = self.api_client.call_api(
*_param,
@@ -362,9 +364,9 @@ class BotApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
"""Reserved address for launching a bot run — not implemented, always 501
"""Answers 501 to every call: launching a bot run is not implemented.
Answers 501 to every call. The bot runtime exposes no launch operation, so nothing here can start a sandbox, and this address is published rather than dropped because it is the collection every run is created in: GET lists them, POST would launch one. The refusal is total and takes no input. The handler never reads the body, so any bytes at all — malformed JSON included — get the same 501; no run id is minted, no session URL is handed back, and no per-run fee is charged. That is the point: the earlier version minted an id the runtime had never heard of, pointed it at a VNC node that did not exist, and took real money for it. Listing and stopping runs are live and org-scoped. Only the launch is missing, and it returns in the same change that can prove a bot boots.
Answers 501 to every call: launching a bot run is not implemented. The bot runtime exposes no launch operation, so nothing here can start a sandbox. This address is published rather than dropped because it is the collection every run is created in: GET lists them, POST would launch one. The refusal is total and takes no input. No run id is minted, no session URL is handed back, and no per-run fee is charged. That is the point: the earlier version minted an id the runtime had never heard of, pointed it at a VNC node that did not exist, and took real money for it. 501 is the truth, and the truth is cheaper than a plausible lie. Listing and stopping runs are live and org-scoped. Only the launch is missing, and it returns in the same change that can prove a bot boots — a runtime-side launch operation first (TS, cross-repo), with the entitlement gate and the meter beside it.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -396,6 +398,7 @@ class BotApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'501': None,
}
response_data = self.api_client.call_api(
*_param,
@@ -424,9 +427,9 @@ class BotApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> RESTResponseType:
"""Reserved address for launching a bot run — not implemented, always 501
"""Answers 501 to every call: launching a bot run is not implemented.
Answers 501 to every call. The bot runtime exposes no launch operation, so nothing here can start a sandbox, and this address is published rather than dropped because it is the collection every run is created in: GET lists them, POST would launch one. The refusal is total and takes no input. The handler never reads the body, so any bytes at all — malformed JSON included — get the same 501; no run id is minted, no session URL is handed back, and no per-run fee is charged. That is the point: the earlier version minted an id the runtime had never heard of, pointed it at a VNC node that did not exist, and took real money for it. Listing and stopping runs are live and org-scoped. Only the launch is missing, and it returns in the same change that can prove a bot boots.
Answers 501 to every call: launching a bot run is not implemented. The bot runtime exposes no launch operation, so nothing here can start a sandbox. This address is published rather than dropped because it is the collection every run is created in: GET lists them, POST would launch one. The refusal is total and takes no input. No run id is minted, no session URL is handed back, and no per-run fee is charged. That is the point: the earlier version minted an id the runtime had never heard of, pointed it at a VNC node that did not exist, and took real money for it. 501 is the truth, and the truth is cheaper than a plausible lie. Listing and stopping runs are live and org-scoped. Only the launch is missing, and it returns in the same change that can prove a bot boots — a runtime-side launch operation first (TS, cross-repo), with the entitlement gate and the meter beside it.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -458,6 +461,7 @@ class BotApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'501': None,
}
response_data = self.api_client.call_api(
*_param,
@@ -523,7 +527,7 @@ class BotApi:
@validate_call
def post_bot_runs_by_runid_stop(
self,
run_id: StrictStr,
run_id: Annotated[StrictStr, Field(description="RunID is the run to stop, as the bot runtime named it. It is read from the URL — the `{runId}` segment the router matched on — and a body carrying a different id cannot redirect the stop.")],
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -541,7 +545,7 @@ class BotApi:
Stop terminates one of the caller org's own bot runs and reports its terminal state. The own-key guard is the org: it is the caller's validated org, never theirs to choose, and the runtime resolves the run id UNDER it. A run belonging to another tenant is not among this org's runs, so it answers absent — the same 404 a nonexistent id gets, which is what keeps this from being an oracle. Absence is honoured ONLY when the runtime answers it. A runtime that does not serve stop reports nothing about the run, and reporting \"stopped\" on that basis would be a stop that cannot fail — so it is a 502.
:param run_id: (required)
:param run_id: RunID is the run to stop, as the bot runtime named it. It is read from the URL — the `{runId}` segment the router matched on — and a body carrying a different id cannot redirect the stop. (required)
:type run_id: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -590,7 +594,7 @@ class BotApi:
@validate_call
def post_bot_runs_by_runid_stop_with_http_info(
self,
run_id: StrictStr,
run_id: Annotated[StrictStr, Field(description="RunID is the run to stop, as the bot runtime named it. It is read from the URL — the `{runId}` segment the router matched on — and a body carrying a different id cannot redirect the stop.")],
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -608,7 +612,7 @@ class BotApi:
Stop terminates one of the caller org's own bot runs and reports its terminal state. The own-key guard is the org: it is the caller's validated org, never theirs to choose, and the runtime resolves the run id UNDER it. A run belonging to another tenant is not among this org's runs, so it answers absent — the same 404 a nonexistent id gets, which is what keeps this from being an oracle. Absence is honoured ONLY when the runtime answers it. A runtime that does not serve stop reports nothing about the run, and reporting \"stopped\" on that basis would be a stop that cannot fail — so it is a 502.
:param run_id: (required)
:param run_id: RunID is the run to stop, as the bot runtime named it. It is read from the URL — the `{runId}` segment the router matched on — and a body carrying a different id cannot redirect the stop. (required)
:type run_id: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -657,7 +661,7 @@ class BotApi:
@validate_call
def post_bot_runs_by_runid_stop_without_preload_content(
self,
run_id: StrictStr,
run_id: Annotated[StrictStr, Field(description="RunID is the run to stop, as the bot runtime named it. It is read from the URL — the `{runId}` segment the router matched on — and a body carrying a different id cannot redirect the stop.")],
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -675,7 +679,7 @@ class BotApi:
Stop terminates one of the caller org's own bot runs and reports its terminal state. The own-key guard is the org: it is the caller's validated org, never theirs to choose, and the runtime resolves the run id UNDER it. A run belonging to another tenant is not among this org's runs, so it answers absent — the same 404 a nonexistent id gets, which is what keeps this from being an oracle. Absence is honoured ONLY when the runtime answers it. A runtime that does not serve stop reports nothing about the run, and reporting \"stopped\" on that basis would be a stop that cannot fail — so it is a 502.
:param run_id: (required)
:param run_id: RunID is the run to stop, as the bot runtime named it. It is read from the URL — the `{runId}` segment the router matched on — and a body carrying a different id cannot redirect the stop. (required)
:type run_id: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
pkg/hanzoai/cloud/api/cloudflare_api.py
+36 -36
View File
@@ -5849,7 +5849,7 @@ class CloudflareApi:
def post_cloudflare_d1_databases_by_database_query(
self,
database: StrictStr,
d1_query: Optional[D1Query] = None,
d1_query: D1Query,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -5863,13 +5863,13 @@ class CloudflareApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> object:
"""Run a SQL statement against a D1 database
"""Runs one SQL statement against a D1 database.
Executes a statement on one D1 database on the org's OWN Cloudflare account and relays D1's result set. `sql` is required and `params` carries the bound values in placeholder order — use them rather than interpolating values into the statement. The body is checked for a non-empty `sql` and then forwarded VERBATIM, so every field D1 accepts reaches D1 even though only two are named here; the declared schema is open for that reason. That verbatim forward is why this is not a typed op — decoding and re-encoding the body would drop `params`, where the query's bound values live. Requires ORG ADMIN (403 otherwise); a malformed body or missing `sql` is 400; 503 if the org has never connected a Cloudflare token.
Runs one SQL statement against a D1 database. It executes on the org's OWN Cloudflare account and relays D1's result set. The body is checked for a non-empty `sql` and then forwarded VERBATIM, so every field D1 accepts reaches D1 even though only two are named here. Requires ORG ADMIN — a statement may INSERT, UPDATE or DROP, so a query takes the write gate rather than the read one — and a caller who is only an org member is refused 403. A missing `sql` is 400; 503 if the org has never connected a Cloudflare token.
:param database: (required)
:type database: str
:param d1_query:
:param d1_query: (required)
:type d1_query: D1Query
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -5903,7 +5903,7 @@ class CloudflareApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "object",
'200': "object",
}
response_data = self.api_client.call_api(
*_param,
@@ -5920,7 +5920,7 @@ class CloudflareApi:
def post_cloudflare_d1_databases_by_database_query_with_http_info(
self,
database: StrictStr,
d1_query: Optional[D1Query] = None,
d1_query: D1Query,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -5934,13 +5934,13 @@ class CloudflareApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[object]:
"""Run a SQL statement against a D1 database
"""Runs one SQL statement against a D1 database.
Executes a statement on one D1 database on the org's OWN Cloudflare account and relays D1's result set. `sql` is required and `params` carries the bound values in placeholder order — use them rather than interpolating values into the statement. The body is checked for a non-empty `sql` and then forwarded VERBATIM, so every field D1 accepts reaches D1 even though only two are named here; the declared schema is open for that reason. That verbatim forward is why this is not a typed op — decoding and re-encoding the body would drop `params`, where the query's bound values live. Requires ORG ADMIN (403 otherwise); a malformed body or missing `sql` is 400; 503 if the org has never connected a Cloudflare token.
Runs one SQL statement against a D1 database. It executes on the org's OWN Cloudflare account and relays D1's result set. The body is checked for a non-empty `sql` and then forwarded VERBATIM, so every field D1 accepts reaches D1 even though only two are named here. Requires ORG ADMIN — a statement may INSERT, UPDATE or DROP, so a query takes the write gate rather than the read one — and a caller who is only an org member is refused 403. A missing `sql` is 400; 503 if the org has never connected a Cloudflare token.
:param database: (required)
:type database: str
:param d1_query:
:param d1_query: (required)
:type d1_query: D1Query
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -5974,7 +5974,7 @@ class CloudflareApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "object",
'200': "object",
}
response_data = self.api_client.call_api(
*_param,
@@ -5991,7 +5991,7 @@ class CloudflareApi:
def post_cloudflare_d1_databases_by_database_query_without_preload_content(
self,
database: StrictStr,
d1_query: Optional[D1Query] = None,
d1_query: D1Query,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -6005,13 +6005,13 @@ class CloudflareApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> RESTResponseType:
"""Run a SQL statement against a D1 database
"""Runs one SQL statement against a D1 database.
Executes a statement on one D1 database on the org's OWN Cloudflare account and relays D1's result set. `sql` is required and `params` carries the bound values in placeholder order — use them rather than interpolating values into the statement. The body is checked for a non-empty `sql` and then forwarded VERBATIM, so every field D1 accepts reaches D1 even though only two are named here; the declared schema is open for that reason. That verbatim forward is why this is not a typed op — decoding and re-encoding the body would drop `params`, where the query's bound values live. Requires ORG ADMIN (403 otherwise); a malformed body or missing `sql` is 400; 503 if the org has never connected a Cloudflare token.
Runs one SQL statement against a D1 database. It executes on the org's OWN Cloudflare account and relays D1's result set. The body is checked for a non-empty `sql` and then forwarded VERBATIM, so every field D1 accepts reaches D1 even though only two are named here. Requires ORG ADMIN — a statement may INSERT, UPDATE or DROP, so a query takes the write gate rather than the read one — and a caller who is only an org member is refused 403. A missing `sql` is 400; 503 if the org has never connected a Cloudflare token.
:param database: (required)
:type database: str
:param d1_query:
:param d1_query: (required)
:type d1_query: D1Query
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -6045,7 +6045,7 @@ class CloudflareApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "object",
'200': "object",
}
response_data = self.api_client.call_api(
*_param,
@@ -8670,8 +8670,8 @@ class CloudflareApi:
@validate_call
def put_cloudflare_workers_scripts_by_script(
self,
script: StrictStr,
worker_script_put: Optional[WorkerScriptPut] = None,
script: Annotated[StrictStr, Field(description="Script means two things on this route, and the document says so in both places it appears: the PATH segment names the Worker to publish, and the BODY field carries that Worker's ES-module source — the code itself, never a name or a URL. A blank or absent source is refused; there is no empty Worker.")],
worker_script_put: WorkerScriptPut,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -8685,13 +8685,13 @@ class CloudflareApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> object:
"""Upload or replace a module Worker script
"""Uploads or replaces a module Worker script.
Publishes a module Worker to the org's OWN Cloudflare account under the name in the path, replacing whatever was there, and relays Cloudflare's result. `script` carries the module SOURCE; the optional compatibility date, compatibility flags and bindings are packed into the multipart upload Cloudflare expects. The path names the script and the body field named `script` is its source — two different things that share a name, which is exactly why this cannot be a typed op: a binder that gives the URL the last word would overwrite the source with the script's name. Requires ORG ADMIN (403 otherwise); an unparseable body or empty source is 400; 503 if the org has never connected a Cloudflare token.
Uploads or replaces a module Worker script. It publishes to the org's OWN Cloudflare account under the name in the path, replacing whatever was there, and relays Cloudflare's result. The compatibility date, compatibility flags and bindings are packed into the multipart upload Cloudflare expects, beside the module source. Requires ORG ADMIN — a Worker is arbitrary code on the org's own account and domains — so a caller who is only an org member is refused 403. An empty source is 400, as is a `mainModule` that is not a plain file name; 503 if the org has never connected a Cloudflare token.
:param script: (required)
:param script: Script means two things on this route, and the document says so in both places it appears: the PATH segment names the Worker to publish, and the BODY field carries that Worker's ES-module source — the code itself, never a name or a URL. A blank or absent source is refused; there is no empty Worker. (required)
:type script: str
:param worker_script_put:
:param worker_script_put: (required)
:type worker_script_put: WorkerScriptPut
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -8725,7 +8725,7 @@ class CloudflareApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "object",
'200': "object",
}
response_data = self.api_client.call_api(
*_param,
@@ -8741,8 +8741,8 @@ class CloudflareApi:
@validate_call
def put_cloudflare_workers_scripts_by_script_with_http_info(
self,
script: StrictStr,
worker_script_put: Optional[WorkerScriptPut] = None,
script: Annotated[StrictStr, Field(description="Script means two things on this route, and the document says so in both places it appears: the PATH segment names the Worker to publish, and the BODY field carries that Worker's ES-module source — the code itself, never a name or a URL. A blank or absent source is refused; there is no empty Worker.")],
worker_script_put: WorkerScriptPut,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -8756,13 +8756,13 @@ class CloudflareApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[object]:
"""Upload or replace a module Worker script
"""Uploads or replaces a module Worker script.
Publishes a module Worker to the org's OWN Cloudflare account under the name in the path, replacing whatever was there, and relays Cloudflare's result. `script` carries the module SOURCE; the optional compatibility date, compatibility flags and bindings are packed into the multipart upload Cloudflare expects. The path names the script and the body field named `script` is its source — two different things that share a name, which is exactly why this cannot be a typed op: a binder that gives the URL the last word would overwrite the source with the script's name. Requires ORG ADMIN (403 otherwise); an unparseable body or empty source is 400; 503 if the org has never connected a Cloudflare token.
Uploads or replaces a module Worker script. It publishes to the org's OWN Cloudflare account under the name in the path, replacing whatever was there, and relays Cloudflare's result. The compatibility date, compatibility flags and bindings are packed into the multipart upload Cloudflare expects, beside the module source. Requires ORG ADMIN — a Worker is arbitrary code on the org's own account and domains — so a caller who is only an org member is refused 403. An empty source is 400, as is a `mainModule` that is not a plain file name; 503 if the org has never connected a Cloudflare token.
:param script: (required)
:param script: Script means two things on this route, and the document says so in both places it appears: the PATH segment names the Worker to publish, and the BODY field carries that Worker's ES-module source — the code itself, never a name or a URL. A blank or absent source is refused; there is no empty Worker. (required)
:type script: str
:param worker_script_put:
:param worker_script_put: (required)
:type worker_script_put: WorkerScriptPut
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -8796,7 +8796,7 @@ class CloudflareApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "object",
'200': "object",
}
response_data = self.api_client.call_api(
*_param,
@@ -8812,8 +8812,8 @@ class CloudflareApi:
@validate_call
def put_cloudflare_workers_scripts_by_script_without_preload_content(
self,
script: StrictStr,
worker_script_put: Optional[WorkerScriptPut] = None,
script: Annotated[StrictStr, Field(description="Script means two things on this route, and the document says so in both places it appears: the PATH segment names the Worker to publish, and the BODY field carries that Worker's ES-module source — the code itself, never a name or a URL. A blank or absent source is refused; there is no empty Worker.")],
worker_script_put: WorkerScriptPut,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -8827,13 +8827,13 @@ class CloudflareApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> RESTResponseType:
"""Upload or replace a module Worker script
"""Uploads or replaces a module Worker script.
Publishes a module Worker to the org's OWN Cloudflare account under the name in the path, replacing whatever was there, and relays Cloudflare's result. `script` carries the module SOURCE; the optional compatibility date, compatibility flags and bindings are packed into the multipart upload Cloudflare expects. The path names the script and the body field named `script` is its source — two different things that share a name, which is exactly why this cannot be a typed op: a binder that gives the URL the last word would overwrite the source with the script's name. Requires ORG ADMIN (403 otherwise); an unparseable body or empty source is 400; 503 if the org has never connected a Cloudflare token.
Uploads or replaces a module Worker script. It publishes to the org's OWN Cloudflare account under the name in the path, replacing whatever was there, and relays Cloudflare's result. The compatibility date, compatibility flags and bindings are packed into the multipart upload Cloudflare expects, beside the module source. Requires ORG ADMIN — a Worker is arbitrary code on the org's own account and domains — so a caller who is only an org member is refused 403. An empty source is 400, as is a `mainModule` that is not a plain file name; 503 if the org has never connected a Cloudflare token.
:param script: (required)
:param script: Script means two things on this route, and the document says so in both places it appears: the PATH segment names the Worker to publish, and the BODY field carries that Worker's ES-module source — the code itself, never a name or a URL. A blank or absent source is refused; there is no empty Worker. (required)
:type script: str
:param worker_script_put:
:param worker_script_put: (required)
:type worker_script_put: WorkerScriptPut
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -8867,7 +8867,7 @@ class CloudflareApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "object",
'200': "object",
}
response_data = self.api_client.call_api(
*_param,
pkg/hanzoai/cloud/api/dataroom_api.py
+12 -12
View File
@@ -1617,7 +1617,7 @@ class DataroomApi:
) -> None:
"""Download a document's bytes as its owner
Streams the stored file back under its recorded content type, falling back to application/octet-stream when none was recorded. Requires a validated principal; 403 without one, and the document is resolved in the caller's own tenant store, so another org's id is a 404. This is the OWNER's path and applies no link gate at all — the per-link password, email and download controls live on the viewer surface, not here. Bytes that cannot be fetched from object storage are 502, never a truncated or empty file.
Streams the stored file back under the type read from its BYTES — a raster image or a PDF renders in place, and anything else is served as application/octet-stream with an attachment disposition, so a stored file never executes as markup in this origin. Every response carries nosniff, which keeps the declared type binding. Requires a validated principal; 403 without one, and the document is resolved in the caller's own tenant store, so another org's id is a 404. This is the OWNER's path and applies no link gate at all — the per-link password, email and download controls live on the viewer surface, not here. Bytes that cannot be fetched from object storage are 502, never a truncated or empty file.
:param id: (required)
:type id: str
@@ -1683,7 +1683,7 @@ class DataroomApi:
) -> ApiResponse[None]:
"""Download a document's bytes as its owner
Streams the stored file back under its recorded content type, falling back to application/octet-stream when none was recorded. Requires a validated principal; 403 without one, and the document is resolved in the caller's own tenant store, so another org's id is a 404. This is the OWNER's path and applies no link gate at all — the per-link password, email and download controls live on the viewer surface, not here. Bytes that cannot be fetched from object storage are 502, never a truncated or empty file.
Streams the stored file back under the type read from its BYTES — a raster image or a PDF renders in place, and anything else is served as application/octet-stream with an attachment disposition, so a stored file never executes as markup in this origin. Every response carries nosniff, which keeps the declared type binding. Requires a validated principal; 403 without one, and the document is resolved in the caller's own tenant store, so another org's id is a 404. This is the OWNER's path and applies no link gate at all — the per-link password, email and download controls live on the viewer surface, not here. Bytes that cannot be fetched from object storage are 502, never a truncated or empty file.
:param id: (required)
:type id: str
@@ -1749,7 +1749,7 @@ class DataroomApi:
) -> RESTResponseType:
"""Download a document's bytes as its owner
Streams the stored file back under its recorded content type, falling back to application/octet-stream when none was recorded. Requires a validated principal; 403 without one, and the document is resolved in the caller's own tenant store, so another org's id is a 404. This is the OWNER's path and applies no link gate at all — the per-link password, email and download controls live on the viewer surface, not here. Bytes that cannot be fetched from object storage are 502, never a truncated or empty file.
Streams the stored file back under the type read from its BYTES — a raster image or a PDF renders in place, and anything else is served as application/octet-stream with an attachment disposition, so a stored file never executes as markup in this origin. Every response carries nosniff, which keeps the declared type binding. Requires a validated principal; 403 without one, and the document is resolved in the caller's own tenant store, so another org's id is a 404. This is the OWNER's path and applies no link gate at all — the per-link password, email and download controls live on the viewer surface, not here. Bytes that cannot be fetched from object storage are 502, never a truncated or empty file.
:param id: (required)
:type id: str
@@ -2868,7 +2868,7 @@ class DataroomApi:
) -> None:
"""Read a public trust-centre item's bytes
Streams the file behind an item a trust centre publishes openly — a policy, a filled questionnaire, a knowledge-base attachment — under its recorded content type. No principal and no link: these are the things an org states about itself, so they are served to anyone who asks. The narrowing is in the lookup rather than in a check: the item must be public, must not be retired, and must belong to a centre its owner has published, so an item released only on request is NOT FOUND here rather than refused — the same answer an id that never existed gets, which is what stops this reporting what the released-on-request tier holds. Bytes that cannot be fetched from object storage are 502, never a truncated file.
Streams the file behind an item a trust centre publishes openly — a policy, a filled questionnaire, a knowledge-base attachment — under the type read from its bytes: a picture or a PDF renders in place, anything else downloads inert. No principal and no link: these are the things an org states about itself, so they are served to anyone who asks. The narrowing is in the lookup rather than in a check: the item must be public, must not be retired, and must belong to a centre its owner has published, so an item released only on request is NOT FOUND here rather than refused — the same answer an id that never existed gets, which is what stops this reporting what the released-on-request tier holds. Bytes that cannot be fetched from object storage are 502, never a truncated file.
:param slug: (required)
:type slug: str
@@ -2938,7 +2938,7 @@ class DataroomApi:
) -> ApiResponse[None]:
"""Read a public trust-centre item's bytes
Streams the file behind an item a trust centre publishes openly — a policy, a filled questionnaire, a knowledge-base attachment — under its recorded content type. No principal and no link: these are the things an org states about itself, so they are served to anyone who asks. The narrowing is in the lookup rather than in a check: the item must be public, must not be retired, and must belong to a centre its owner has published, so an item released only on request is NOT FOUND here rather than refused — the same answer an id that never existed gets, which is what stops this reporting what the released-on-request tier holds. Bytes that cannot be fetched from object storage are 502, never a truncated file.
Streams the file behind an item a trust centre publishes openly — a policy, a filled questionnaire, a knowledge-base attachment — under the type read from its bytes: a picture or a PDF renders in place, anything else downloads inert. No principal and no link: these are the things an org states about itself, so they are served to anyone who asks. The narrowing is in the lookup rather than in a check: the item must be public, must not be retired, and must belong to a centre its owner has published, so an item released only on request is NOT FOUND here rather than refused — the same answer an id that never existed gets, which is what stops this reporting what the released-on-request tier holds. Bytes that cannot be fetched from object storage are 502, never a truncated file.
:param slug: (required)
:type slug: str
@@ -3008,7 +3008,7 @@ class DataroomApi:
) -> RESTResponseType:
"""Read a public trust-centre item's bytes
Streams the file behind an item a trust centre publishes openly — a policy, a filled questionnaire, a knowledge-base attachment — under its recorded content type. No principal and no link: these are the things an org states about itself, so they are served to anyone who asks. The narrowing is in the lookup rather than in a check: the item must be public, must not be retired, and must belong to a centre its owner has published, so an item released only on request is NOT FOUND here rather than refused — the same answer an id that never existed gets, which is what stops this reporting what the released-on-request tier holds. Bytes that cannot be fetched from object storage are 502, never a truncated file.
Streams the file behind an item a trust centre publishes openly — a policy, a filled questionnaire, a knowledge-base attachment — under the type read from its bytes: a picture or a PDF renders in place, anything else downloads inert. No principal and no link: these are the things an org states about itself, so they are served to anyone who asks. The narrowing is in the lookup rather than in a check: the item must be public, must not be retired, and must belong to a centre its owner has published, so an item released only on request is NOT FOUND here rather than refused — the same answer an id that never existed gets, which is what stops this reporting what the released-on-request tier holds. Bytes that cannot be fetched from object storage are 502, never a truncated file.
:param slug: (required)
:type slug: str
@@ -3385,7 +3385,7 @@ class DataroomApi:
) -> None:
"""Read a document's bytes as an authorised link visitor
Streams a document's bytes under its recorded content type to a visitor holding an open viewing session. No principal: `?viewId=` from the authenticate step is the authorisation and must belong to this link, or the call is 403 — holding the link id alone gets no bytes. The document must be reachable THROUGH this link (a member of the room the link opens, or the single document the link names), so a visitor cannot walk to an unrelated document by guessing an id; anything else is a 404, as is an unknown or archived link. Bytes that cannot be fetched from object storage are 502. `?download=1` additionally requires the link's `allowDownload` and is 403 when the owner did not permit it. Read that flag precisely: it gates the DOWNLOAD intent, not access to the bytes — without the parameter an authorised visitor is served the file for in-place viewing whether or not downloads are allowed.
Streams a document's bytes to a visitor holding an open viewing session, under the type read from those bytes: a picture or a PDF renders in place, anything else downloads inert. No principal: `?viewId=` from the authenticate step is the authorisation and must belong to this link, or the call is 403 — holding the link id alone gets no bytes. The document must be reachable THROUGH this link (a member of the room the link opens, or the single document the link names), so a visitor cannot walk to an unrelated document by guessing an id; anything else is a 404, as is an unknown or archived link. Bytes that cannot be fetched from object storage are 502. `?download=1` additionally requires the link's `allowDownload` and is 403 when the owner did not permit it. Read that flag precisely: it gates the DOWNLOAD intent, not access to the bytes — without the parameter an authorised visitor is served the file for in-place viewing whether or not downloads are allowed.
:param link_id: (required)
:type link_id: str
@@ -3455,7 +3455,7 @@ class DataroomApi:
) -> ApiResponse[None]:
"""Read a document's bytes as an authorised link visitor
Streams a document's bytes under its recorded content type to a visitor holding an open viewing session. No principal: `?viewId=` from the authenticate step is the authorisation and must belong to this link, or the call is 403 — holding the link id alone gets no bytes. The document must be reachable THROUGH this link (a member of the room the link opens, or the single document the link names), so a visitor cannot walk to an unrelated document by guessing an id; anything else is a 404, as is an unknown or archived link. Bytes that cannot be fetched from object storage are 502. `?download=1` additionally requires the link's `allowDownload` and is 403 when the owner did not permit it. Read that flag precisely: it gates the DOWNLOAD intent, not access to the bytes — without the parameter an authorised visitor is served the file for in-place viewing whether or not downloads are allowed.
Streams a document's bytes to a visitor holding an open viewing session, under the type read from those bytes: a picture or a PDF renders in place, anything else downloads inert. No principal: `?viewId=` from the authenticate step is the authorisation and must belong to this link, or the call is 403 — holding the link id alone gets no bytes. The document must be reachable THROUGH this link (a member of the room the link opens, or the single document the link names), so a visitor cannot walk to an unrelated document by guessing an id; anything else is a 404, as is an unknown or archived link. Bytes that cannot be fetched from object storage are 502. `?download=1` additionally requires the link's `allowDownload` and is 403 when the owner did not permit it. Read that flag precisely: it gates the DOWNLOAD intent, not access to the bytes — without the parameter an authorised visitor is served the file for in-place viewing whether or not downloads are allowed.
:param link_id: (required)
:type link_id: str
@@ -3525,7 +3525,7 @@ class DataroomApi:
) -> RESTResponseType:
"""Read a document's bytes as an authorised link visitor
Streams a document's bytes under its recorded content type to a visitor holding an open viewing session. No principal: `?viewId=` from the authenticate step is the authorisation and must belong to this link, or the call is 403 — holding the link id alone gets no bytes. The document must be reachable THROUGH this link (a member of the room the link opens, or the single document the link names), so a visitor cannot walk to an unrelated document by guessing an id; anything else is a 404, as is an unknown or archived link. Bytes that cannot be fetched from object storage are 502. `?download=1` additionally requires the link's `allowDownload` and is 403 when the owner did not permit it. Read that flag precisely: it gates the DOWNLOAD intent, not access to the bytes — without the parameter an authorised visitor is served the file for in-place viewing whether or not downloads are allowed.
Streams a document's bytes to a visitor holding an open viewing session, under the type read from those bytes: a picture or a PDF renders in place, anything else downloads inert. No principal: `?viewId=` from the authenticate step is the authorisation and must belong to this link, or the call is 403 — holding the link id alone gets no bytes. The document must be reachable THROUGH this link (a member of the room the link opens, or the single document the link names), so a visitor cannot walk to an unrelated document by guessing an id; anything else is a 404, as is an unknown or archived link. Bytes that cannot be fetched from object storage are 502. `?download=1` additionally requires the link's `allowDownload` and is 403 when the owner did not permit it. Read that flag precisely: it gates the DOWNLOAD intent, not access to the bytes — without the parameter an authorised visitor is served the file for in-place viewing whether or not downloads are allowed.
:param link_id: (required)
:type link_id: str
@@ -4501,7 +4501,7 @@ class DataroomApi:
) -> None:
"""Upload a document's bytes and record it
Takes the file ITSELF as the raw request body — not a JSON envelope, not multipart — stores it on the object-storage client, and records the metadata row, answering with the new document. `?name=` names it (default \"document\"), the request's Content-Type becomes the recorded mime type, and `?numPages=` is optional. Requires a validated principal; 403 without one. An empty body is 400 and anything over 64 MiB is 413 — a data room holds decks and PDFs, not a media library. The storage key is 128 random bits under the tenant's own key prefix, minted before the bytes are written: if the system's randomness is unavailable the upload fails 500 rather than fall back to a predictable key that could overwrite another document's bytes. A storage write that fails is 502 and no metadata row is recorded, so a document never exists without its file.
Takes the file ITSELF as the raw request body — not a JSON envelope, not multipart — stores it on the object-storage client, and records the metadata row, answering with the new document. `?name=` names it (default \"document\"), the request's Content-Type is recorded as the document's mime type, and `?numPages=` is optional. That recorded type is metadata the owner sees; what the file is later SERVED as is read from the bytes. Requires a validated principal; 403 without one. An empty body is 400 and anything over 64 MiB is 413 — a data room holds decks and PDFs, not a media library. The storage key is 128 random bits under the tenant's own key prefix, minted before the bytes are written: if the system's randomness is unavailable the upload fails 500 rather than fall back to a predictable key that could overwrite another document's bytes. A storage write that fails is 502 and no metadata row is recorded, so a document never exists without its file.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4563,7 +4563,7 @@ class DataroomApi:
) -> ApiResponse[None]:
"""Upload a document's bytes and record it
Takes the file ITSELF as the raw request body — not a JSON envelope, not multipart — stores it on the object-storage client, and records the metadata row, answering with the new document. `?name=` names it (default \"document\"), the request's Content-Type becomes the recorded mime type, and `?numPages=` is optional. Requires a validated principal; 403 without one. An empty body is 400 and anything over 64 MiB is 413 — a data room holds decks and PDFs, not a media library. The storage key is 128 random bits under the tenant's own key prefix, minted before the bytes are written: if the system's randomness is unavailable the upload fails 500 rather than fall back to a predictable key that could overwrite another document's bytes. A storage write that fails is 502 and no metadata row is recorded, so a document never exists without its file.
Takes the file ITSELF as the raw request body — not a JSON envelope, not multipart — stores it on the object-storage client, and records the metadata row, answering with the new document. `?name=` names it (default \"document\"), the request's Content-Type is recorded as the document's mime type, and `?numPages=` is optional. That recorded type is metadata the owner sees; what the file is later SERVED as is read from the bytes. Requires a validated principal; 403 without one. An empty body is 400 and anything over 64 MiB is 413 — a data room holds decks and PDFs, not a media library. The storage key is 128 random bits under the tenant's own key prefix, minted before the bytes are written: if the system's randomness is unavailable the upload fails 500 rather than fall back to a predictable key that could overwrite another document's bytes. A storage write that fails is 502 and no metadata row is recorded, so a document never exists without its file.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4625,7 +4625,7 @@ class DataroomApi:
) -> RESTResponseType:
"""Upload a document's bytes and record it
Takes the file ITSELF as the raw request body — not a JSON envelope, not multipart — stores it on the object-storage client, and records the metadata row, answering with the new document. `?name=` names it (default \"document\"), the request's Content-Type becomes the recorded mime type, and `?numPages=` is optional. Requires a validated principal; 403 without one. An empty body is 400 and anything over 64 MiB is 413 — a data room holds decks and PDFs, not a media library. The storage key is 128 random bits under the tenant's own key prefix, minted before the bytes are written: if the system's randomness is unavailable the upload fails 500 rather than fall back to a predictable key that could overwrite another document's bytes. A storage write that fails is 502 and no metadata row is recorded, so a document never exists without its file.
Takes the file ITSELF as the raw request body — not a JSON envelope, not multipart — stores it on the object-storage client, and records the metadata row, answering with the new document. `?name=` names it (default \"document\"), the request's Content-Type is recorded as the document's mime type, and `?numPages=` is optional. That recorded type is metadata the owner sees; what the file is later SERVED as is read from the bytes. Requires a validated principal; 403 without one. An empty body is 400 and anything over 64 MiB is 413 — a data room holds decks and PDFs, not a media library. The storage key is 128 random bits under the tenant's own key prefix, minted before the bytes are written: if the system's randomness is unavailable the upload fails 500 rather than fall back to a predictable key that could overwrite another document's bytes. A storage write that fails is 502 and no metadata row is recorded, so a document never exists without its file.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
pkg/hanzoai/cloud/api/deploy_api.py
+86 -44
View File
@@ -28,6 +28,8 @@ from hanzoai.cloud.models.argo_tree import ArgoTree
from hanzoai.cloud.models.console_settings import ConsoleSettings
from hanzoai.cloud.models.deploy_health import DeployHealth
from hanzoai.cloud.models.git_ops_plane import GitOpsPlane
from hanzoai.cloud.models.reconcile_report import ReconcileReport
from hanzoai.cloud.models.session_ended import SessionEnded
from hanzoai.cloud.models.session_user import SessionUser
from hanzoai.cloud.models.version_message import VersionMessage
@@ -4041,7 +4043,7 @@ class DeployApi:
@validate_call
def post_deploy_applications_by_name_rollback(
self,
name: StrictStr,
name: Annotated[StrictStr, Field(description="Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup.")],
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -4054,12 +4056,12 @@ class DeployApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
"""The console's rollback control — today it requests a reconcile, nothing more
) -> ArgoApp:
"""Serves the console's rollback control, and today it requests a reconcile and nothing more.
Performs exactly what the sync action performs: it stamps the sync-requested timestamp onto the application's App CR and answers the application re-projected. It does NOT select, pin or revert to a prior image tag, and that is the one thing to know before wiring anything to it — the name is the console's, the behaviour is the sync. Pinning a previous release rides the release client, which this address does not call yet. SuperAdmin-only and fail-closed, reading no request body, with an unknown application name a 404 and no cluster client a 503 — the same gate and the same failures as the sync it shares a handler with.
Serves the console's rollback control, and today it requests a reconcile and nothing more. The opening verb is not style. zipdoc drops a leading CamelCase symbol only when a plain verb follows it and never before a copula (internal/zipdoc/ extract.go:811-824, \"CompleteDeployment IS the CI completion hook\" would otherwise become \"Is the CI completion hook\") — so \"RollbackDeployApplication is …\" would publish a Go symbol no caller can see into the summary an SDK docstring, an MCP tool list and a CLI help line all show. It performs exactly what the sync action performs — the same stamp on the same App CR, the same application re-projected — and it does NOT select, pin or revert to a prior image tag. That is the one thing to know before wiring anything to it: the name is the console's, the behaviour is the sync. Pinning a previous release rides the release client, which this address does not call yet. Same gate, same refusals and the same absent request body as the sync it shares a core with.
:param name: (required)
:param name: Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup. (required)
:type name: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4092,6 +4094,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "ArgoApp",
}
response_data = self.api_client.call_api(
*_param,
@@ -4107,7 +4110,7 @@ class DeployApi:
@validate_call
def post_deploy_applications_by_name_rollback_with_http_info(
self,
name: StrictStr,
name: Annotated[StrictStr, Field(description="Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup.")],
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -4120,12 +4123,12 @@ class DeployApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
"""The console's rollback control — today it requests a reconcile, nothing more
) -> ApiResponse[ArgoApp]:
"""Serves the console's rollback control, and today it requests a reconcile and nothing more.
Performs exactly what the sync action performs: it stamps the sync-requested timestamp onto the application's App CR and answers the application re-projected. It does NOT select, pin or revert to a prior image tag, and that is the one thing to know before wiring anything to it — the name is the console's, the behaviour is the sync. Pinning a previous release rides the release client, which this address does not call yet. SuperAdmin-only and fail-closed, reading no request body, with an unknown application name a 404 and no cluster client a 503 — the same gate and the same failures as the sync it shares a handler with.
Serves the console's rollback control, and today it requests a reconcile and nothing more. The opening verb is not style. zipdoc drops a leading CamelCase symbol only when a plain verb follows it and never before a copula (internal/zipdoc/ extract.go:811-824, \"CompleteDeployment IS the CI completion hook\" would otherwise become \"Is the CI completion hook\") — so \"RollbackDeployApplication is …\" would publish a Go symbol no caller can see into the summary an SDK docstring, an MCP tool list and a CLI help line all show. It performs exactly what the sync action performs — the same stamp on the same App CR, the same application re-projected — and it does NOT select, pin or revert to a prior image tag. That is the one thing to know before wiring anything to it: the name is the console's, the behaviour is the sync. Pinning a previous release rides the release client, which this address does not call yet. Same gate, same refusals and the same absent request body as the sync it shares a core with.
:param name: (required)
:param name: Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup. (required)
:type name: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4158,6 +4161,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "ArgoApp",
}
response_data = self.api_client.call_api(
*_param,
@@ -4173,7 +4177,7 @@ class DeployApi:
@validate_call
def post_deploy_applications_by_name_rollback_without_preload_content(
self,
name: StrictStr,
name: Annotated[StrictStr, Field(description="Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup.")],
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -4187,11 +4191,11 @@ class DeployApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> RESTResponseType:
"""The console's rollback control — today it requests a reconcile, nothing more
"""Serves the console's rollback control, and today it requests a reconcile and nothing more.
Performs exactly what the sync action performs: it stamps the sync-requested timestamp onto the application's App CR and answers the application re-projected. It does NOT select, pin or revert to a prior image tag, and that is the one thing to know before wiring anything to it — the name is the console's, the behaviour is the sync. Pinning a previous release rides the release client, which this address does not call yet. SuperAdmin-only and fail-closed, reading no request body, with an unknown application name a 404 and no cluster client a 503 — the same gate and the same failures as the sync it shares a handler with.
Serves the console's rollback control, and today it requests a reconcile and nothing more. The opening verb is not style. zipdoc drops a leading CamelCase symbol only when a plain verb follows it and never before a copula (internal/zipdoc/ extract.go:811-824, \"CompleteDeployment IS the CI completion hook\" would otherwise become \"Is the CI completion hook\") — so \"RollbackDeployApplication is …\" would publish a Go symbol no caller can see into the summary an SDK docstring, an MCP tool list and a CLI help line all show. It performs exactly what the sync action performs — the same stamp on the same App CR, the same application re-projected — and it does NOT select, pin or revert to a prior image tag. That is the one thing to know before wiring anything to it: the name is the console's, the behaviour is the sync. Pinning a previous release rides the release client, which this address does not call yet. Same gate, same refusals and the same absent request body as the sync it shares a core with.
:param name: (required)
:param name: Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup. (required)
:type name: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4224,6 +4228,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "ArgoApp",
}
response_data = self.api_client.call_api(
*_param,
@@ -4264,6 +4269,13 @@ class DeployApi:
# process the body parameter
# set the HTTP header `Accept`
if 'Accept' not in _header_params:
_header_params['Accept'] = self.api_client.select_header_accept(
[
'application/json'
]
)
# authentication setting
@@ -4292,7 +4304,7 @@ class DeployApi:
@validate_call
def post_deploy_applications_by_name_sync(
self,
name: StrictStr,
name: Annotated[StrictStr, Field(description="Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup.")],
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -4305,12 +4317,12 @@ class DeployApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
"""Ask the operator to reconcile one application now
) -> ArgoApp:
"""Asks the operator to reconcile ONE application now.
Requests an immediate reconcile of one application by stamping a sync-requested timestamp onto its App CR, which the operator's watch observes, and answers the application re-projected. It ASKS, it does not apply: the operator performs the reconcile on its own clock, so a 200 means the request landed, not that the rollout finished — the returned row's running version still lags until it does. The CR is the desired source today, so this is a nudge; when git becomes the source the same address becomes apply-from-git. SuperAdmin-only and fail-closed — a non-SuperAdmin is refused before any cluster object is read or patched, and the write surface stays admin-only while the tenant surface is read-only reflection. It reads no request body. An unknown application name is a 404; no cluster client configured is a 503.
Asks the operator to reconcile ONE application now. It stamps a sync-requested timestamp onto the application's App CR, which the operator's watch observes, and answers the application re-projected. It ASKS, it does not apply: the operator reconciles on its own clock, so a 200 means the request landed, not that the rollout finished — the returned row's running version still lags until it does. SuperAdmin-only and fail-closed, and the gate is INSIDE the op rather than in middleware wrapped around the route. That is a correctness requirement, not a preference: this op is also reached by POST /mcp and by the by-name call plane, neither of which runs route middleware, so a gate that only the REST projection runs would publish an unguarded alias of a fleet-mutating write. It reads no request body — the URL names the application and nothing else does. An unknown name is a 404 (never a 403, which would confirm the application exists), a name that is not a DNS-1123 label is a 400, and no cluster client is a 503.
:param name: (required)
:param name: Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup. (required)
:type name: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4343,6 +4355,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "ArgoApp",
}
response_data = self.api_client.call_api(
*_param,
@@ -4358,7 +4371,7 @@ class DeployApi:
@validate_call
def post_deploy_applications_by_name_sync_with_http_info(
self,
name: StrictStr,
name: Annotated[StrictStr, Field(description="Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup.")],
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -4371,12 +4384,12 @@ class DeployApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
"""Ask the operator to reconcile one application now
) -> ApiResponse[ArgoApp]:
"""Asks the operator to reconcile ONE application now.
Requests an immediate reconcile of one application by stamping a sync-requested timestamp onto its App CR, which the operator's watch observes, and answers the application re-projected. It ASKS, it does not apply: the operator performs the reconcile on its own clock, so a 200 means the request landed, not that the rollout finished — the returned row's running version still lags until it does. The CR is the desired source today, so this is a nudge; when git becomes the source the same address becomes apply-from-git. SuperAdmin-only and fail-closed — a non-SuperAdmin is refused before any cluster object is read or patched, and the write surface stays admin-only while the tenant surface is read-only reflection. It reads no request body. An unknown application name is a 404; no cluster client configured is a 503.
Asks the operator to reconcile ONE application now. It stamps a sync-requested timestamp onto the application's App CR, which the operator's watch observes, and answers the application re-projected. It ASKS, it does not apply: the operator reconciles on its own clock, so a 200 means the request landed, not that the rollout finished — the returned row's running version still lags until it does. SuperAdmin-only and fail-closed, and the gate is INSIDE the op rather than in middleware wrapped around the route. That is a correctness requirement, not a preference: this op is also reached by POST /mcp and by the by-name call plane, neither of which runs route middleware, so a gate that only the REST projection runs would publish an unguarded alias of a fleet-mutating write. It reads no request body — the URL names the application and nothing else does. An unknown name is a 404 (never a 403, which would confirm the application exists), a name that is not a DNS-1123 label is a 400, and no cluster client is a 503.
:param name: (required)
:param name: Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup. (required)
:type name: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4409,6 +4422,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "ArgoApp",
}
response_data = self.api_client.call_api(
*_param,
@@ -4424,7 +4438,7 @@ class DeployApi:
@validate_call
def post_deploy_applications_by_name_sync_without_preload_content(
self,
name: StrictStr,
name: Annotated[StrictStr, Field(description="Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup.")],
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -4438,11 +4452,11 @@ class DeployApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> RESTResponseType:
"""Ask the operator to reconcile one application now
"""Asks the operator to reconcile ONE application now.
Requests an immediate reconcile of one application by stamping a sync-requested timestamp onto its App CR, which the operator's watch observes, and answers the application re-projected. It ASKS, it does not apply: the operator performs the reconcile on its own clock, so a 200 means the request landed, not that the rollout finished — the returned row's running version still lags until it does. The CR is the desired source today, so this is a nudge; when git becomes the source the same address becomes apply-from-git. SuperAdmin-only and fail-closed — a non-SuperAdmin is refused before any cluster object is read or patched, and the write surface stays admin-only while the tenant surface is read-only reflection. It reads no request body. An unknown application name is a 404; no cluster client configured is a 503.
Asks the operator to reconcile ONE application now. It stamps a sync-requested timestamp onto the application's App CR, which the operator's watch observes, and answers the application re-projected. It ASKS, it does not apply: the operator reconciles on its own clock, so a 200 means the request landed, not that the rollout finished — the returned row's running version still lags until it does. SuperAdmin-only and fail-closed, and the gate is INSIDE the op rather than in middleware wrapped around the route. That is a correctness requirement, not a preference: this op is also reached by POST /mcp and by the by-name call plane, neither of which runs route middleware, so a gate that only the REST projection runs would publish an unguarded alias of a fleet-mutating write. It reads no request body — the URL names the application and nothing else does. An unknown name is a 404 (never a 403, which would confirm the application exists), a name that is not a DNS-1123 label is a 400, and no cluster client is a 503.
:param name: (required)
:param name: Name is the application to read, from the path. It must be a DNS-1123 label (lowercase alphanumerics and hyphens, starting and ending alphanumeric) — every operator App CR's metadata.name satisfies that, and anything else is a 400 rather than a lookup. (required)
:type name: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4475,6 +4489,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "ArgoApp",
}
response_data = self.api_client.call_api(
*_param,
@@ -4515,6 +4530,13 @@ class DeployApi:
# process the body parameter
# set the HTTP header `Accept`
if 'Accept' not in _header_params:
_header_params['Accept'] = self.api_client.select_header_accept(
[
'application/json'
]
)
# authentication setting
@@ -4555,10 +4577,10 @@ class DeployApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
"""End the console session on this host
) -> SessionEnded:
"""Ends the console session on this host.
Clears this console's session cookie and answers the signed-out state with the sign-in URL to start again. IAM's own session is untouched — this ends the console session only, so signing back in may not prompt for credentials. It is a POST because it changes state. As a GET it was reachable by a cross-site top-level navigation, which a SameSite=Lax cookie still rides, so any page could sign a SuperAdmin out; a POST is not carried cross-site by that cookie.
Ends the console session on this host. It clears this console's session cookie and answers the signed-out state with the sign-in URL to start again. IAM's own session is untouched — this ends the console session only, so signing back in may not prompt for credentials. It is a POST because it CHANGES STATE. As a GET it was reachable by a cross-site top-level navigation, which a SameSite=Lax cookie still rides, so any page could sign a SuperAdmin out; a POST is not carried cross-site by that cookie. It reads no request body and takes no argument: the session it ends is the one the request already carries.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4590,6 +4612,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "SessionEnded",
}
response_data = self.api_client.call_api(
*_param,
@@ -4617,10 +4640,10 @@ class DeployApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
"""End the console session on this host
) -> ApiResponse[SessionEnded]:
"""Ends the console session on this host.
Clears this console's session cookie and answers the signed-out state with the sign-in URL to start again. IAM's own session is untouched — this ends the console session only, so signing back in may not prompt for credentials. It is a POST because it changes state. As a GET it was reachable by a cross-site top-level navigation, which a SameSite=Lax cookie still rides, so any page could sign a SuperAdmin out; a POST is not carried cross-site by that cookie.
Ends the console session on this host. It clears this console's session cookie and answers the signed-out state with the sign-in URL to start again. IAM's own session is untouched — this ends the console session only, so signing back in may not prompt for credentials. It is a POST because it CHANGES STATE. As a GET it was reachable by a cross-site top-level navigation, which a SameSite=Lax cookie still rides, so any page could sign a SuperAdmin out; a POST is not carried cross-site by that cookie. It reads no request body and takes no argument: the session it ends is the one the request already carries.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4652,6 +4675,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "SessionEnded",
}
response_data = self.api_client.call_api(
*_param,
@@ -4680,9 +4704,9 @@ class DeployApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> RESTResponseType:
"""End the console session on this host
"""Ends the console session on this host.
Clears this console's session cookie and answers the signed-out state with the sign-in URL to start again. IAM's own session is untouched — this ends the console session only, so signing back in may not prompt for credentials. It is a POST because it changes state. As a GET it was reachable by a cross-site top-level navigation, which a SameSite=Lax cookie still rides, so any page could sign a SuperAdmin out; a POST is not carried cross-site by that cookie.
Ends the console session on this host. It clears this console's session cookie and answers the signed-out state with the sign-in URL to start again. IAM's own session is untouched — this ends the console session only, so signing back in may not prompt for credentials. It is a POST because it CHANGES STATE. As a GET it was reachable by a cross-site top-level navigation, which a SameSite=Lax cookie still rides, so any page could sign a SuperAdmin out; a POST is not carried cross-site by that cookie. It reads no request body and takes no argument: the session it ends is the one the request already carries.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4714,6 +4738,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "SessionEnded",
}
response_data = self.api_client.call_api(
*_param,
@@ -4751,6 +4776,13 @@ class DeployApi:
# process the body parameter
# set the HTTP header `Accept`
if 'Accept' not in _header_params:
_header_params['Accept'] = self.api_client.select_header_accept(
[
'application/json'
]
)
# authentication setting
@@ -4791,10 +4823,10 @@ class DeployApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
"""Render the configured git source and apply it to the cluster, once
) -> ReconcileReport:
"""Renders the configured git source and applies it to the cluster, once.
Runs one full GitOps sync through the embedded engine — render the configured repo, ref and path, then three-way server-side apply with scoped prune — and answers the revision it applied, the source it came from, the declared/synced/pruned/failed counts and a per-resource result. This is the WRITE half of the plane: it mutates live cluster objects and, with prune enabled, deletes objects the source no longer declares. SuperAdmin-only and fail-closed — a non-SuperAdmin is refused before any cluster object is read or touched. The git source is read AS THE CALLER, so the source plane scopes the answer itself rather than trusting this one to have scoped it. It reads no request body; the source is configuration, not a parameter. A deployment with the engine switched off, or with no usable cluster config, answers 503; a failure to start, render or sync is a 502.
Renders the configured git source and applies it to the cluster, once. It runs one full GitOps sync through the embedded engine — render the configured repo, ref and path, then three-way server-side apply with scoped prune — and answers the revision it applied, the source it came from, the declared/synced/pruned/failed counts and a per-resource result. This is the WRITE half of the plane: it mutates live cluster objects and, with prune enabled, deletes objects the source no longer declares. SuperAdmin-only and fail-closed, with the gate INSIDE the op because a typed op is also reached by POST /mcp and by the by-name call plane, where no route middleware runs. The git source is read AS THE PLATFORM, not as the caller: the coordinate is this deployment's own configuration and never a parameter, which is why the op reads no request body at all. A deployment with the engine switched off, or with no usable cluster config, answers 503; a failure to start, render or sync is a 502.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4826,6 +4858,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "ReconcileReport",
}
response_data = self.api_client.call_api(
*_param,
@@ -4853,10 +4886,10 @@ class DeployApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
"""Render the configured git source and apply it to the cluster, once
) -> ApiResponse[ReconcileReport]:
"""Renders the configured git source and applies it to the cluster, once.
Runs one full GitOps sync through the embedded engine — render the configured repo, ref and path, then three-way server-side apply with scoped prune — and answers the revision it applied, the source it came from, the declared/synced/pruned/failed counts and a per-resource result. This is the WRITE half of the plane: it mutates live cluster objects and, with prune enabled, deletes objects the source no longer declares. SuperAdmin-only and fail-closed — a non-SuperAdmin is refused before any cluster object is read or touched. The git source is read AS THE CALLER, so the source plane scopes the answer itself rather than trusting this one to have scoped it. It reads no request body; the source is configuration, not a parameter. A deployment with the engine switched off, or with no usable cluster config, answers 503; a failure to start, render or sync is a 502.
Renders the configured git source and applies it to the cluster, once. It runs one full GitOps sync through the embedded engine — render the configured repo, ref and path, then three-way server-side apply with scoped prune — and answers the revision it applied, the source it came from, the declared/synced/pruned/failed counts and a per-resource result. This is the WRITE half of the plane: it mutates live cluster objects and, with prune enabled, deletes objects the source no longer declares. SuperAdmin-only and fail-closed, with the gate INSIDE the op because a typed op is also reached by POST /mcp and by the by-name call plane, where no route middleware runs. The git source is read AS THE PLATFORM, not as the caller: the coordinate is this deployment's own configuration and never a parameter, which is why the op reads no request body at all. A deployment with the engine switched off, or with no usable cluster config, answers 503; a failure to start, render or sync is a 502.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4888,6 +4921,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "ReconcileReport",
}
response_data = self.api_client.call_api(
*_param,
@@ -4916,9 +4950,9 @@ class DeployApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> RESTResponseType:
"""Render the configured git source and apply it to the cluster, once
"""Renders the configured git source and applies it to the cluster, once.
Runs one full GitOps sync through the embedded engine — render the configured repo, ref and path, then three-way server-side apply with scoped prune — and answers the revision it applied, the source it came from, the declared/synced/pruned/failed counts and a per-resource result. This is the WRITE half of the plane: it mutates live cluster objects and, with prune enabled, deletes objects the source no longer declares. SuperAdmin-only and fail-closed — a non-SuperAdmin is refused before any cluster object is read or touched. The git source is read AS THE CALLER, so the source plane scopes the answer itself rather than trusting this one to have scoped it. It reads no request body; the source is configuration, not a parameter. A deployment with the engine switched off, or with no usable cluster config, answers 503; a failure to start, render or sync is a 502.
Renders the configured git source and applies it to the cluster, once. It runs one full GitOps sync through the embedded engine — render the configured repo, ref and path, then three-way server-side apply with scoped prune — and answers the revision it applied, the source it came from, the declared/synced/pruned/failed counts and a per-resource result. This is the WRITE half of the plane: it mutates live cluster objects and, with prune enabled, deletes objects the source no longer declares. SuperAdmin-only and fail-closed, with the gate INSIDE the op because a typed op is also reached by POST /mcp and by the by-name call plane, where no route middleware runs. The git source is read AS THE PLATFORM, not as the caller: the coordinate is this deployment's own configuration and never a parameter, which is why the op reads no request body at all. A deployment with the engine switched off, or with no usable cluster config, answers 503; a failure to start, render or sync is a 502.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -4950,6 +4984,7 @@ class DeployApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'200': "ReconcileReport",
}
response_data = self.api_client.call_api(
*_param,
@@ -4987,6 +5022,13 @@ class DeployApi:
# process the body parameter
# set the HTTP header `Accept`
if 'Accept' not in _header_params:
_header_params['Accept'] = self.api_client.select_header_accept(
[
'application/json'
]
)
# authentication setting
pkg/hanzoai/cloud/api/exec_api.py
+15 -12
View File
@@ -58,9 +58,9 @@ class ExecApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> List[Listing]:
"""Files lists what a session holds.
"""Lists the files in an execution session.
Files lists what a session holds. One recursive `find`, the same traversal the artifact sweep makes. It used to be `ls -1A` — top level only — while the sweep collected with `find`, so a run that wrote a nested artifact reported it in its reply and then omitted it here, and the client's prefix match read the file as expired. Two traversals of one directory is two answers about what a session holds; there is one now.
Lists the files in an execution session. Everything the session's sandbox holds — the uploads a run can read and the artifacts it produced — each then fetched from GET /v1/exec/download. The answer is a BARE JSON ARRAY of {name, lastModified}, where `name` is the same {session_id}/{fileId} identifier download takes, because that is what the client matches on. The obvious typed shape, `{files: […]}`, would have been a silent wire change: the request still succeeds and `response.data.find(...)` finds nothing, which reads as a session holding no files. The NAME of this handler is what the published summary is cut from, and it used to leak: the comment opened \"Files lists …\", which is not this function's identifier, so zipdoc's exact-match strip left it and every SDK, tool list and CLI help line opened with a Go symbol no caller can see. An openapi.Describe stated a better summary beside the route and was DISCARDED — Fold replaces a structural operation with the typed one — so the declaration read as landed and rendered nowhere. The comment is the one home for this sentence. One recursive `find`, the same traversal the artifact sweep makes. It used to be `ls -1A` — top level only — while the sweep collected with `find`, so a run that wrote a nested artifact reported it in its reply and then omitted it here, and the client's prefix match read the file as expired. Two traversals of one directory is two answers about what a session holds; there is one now.
:param sid: SID is the session identifier — the sandbox this listing is of. The URL is the addressing authority: a path segment binds after the body and after the query, so the address decides which session is read whatever else is sent. (required)
:type sid: str
@@ -125,9 +125,9 @@ class ExecApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[List[Listing]]:
"""Files lists what a session holds.
"""Lists the files in an execution session.
Files lists what a session holds. One recursive `find`, the same traversal the artifact sweep makes. It used to be `ls -1A` — top level only — while the sweep collected with `find`, so a run that wrote a nested artifact reported it in its reply and then omitted it here, and the client's prefix match read the file as expired. Two traversals of one directory is two answers about what a session holds; there is one now.
Lists the files in an execution session. Everything the session's sandbox holds — the uploads a run can read and the artifacts it produced — each then fetched from GET /v1/exec/download. The answer is a BARE JSON ARRAY of {name, lastModified}, where `name` is the same {session_id}/{fileId} identifier download takes, because that is what the client matches on. The obvious typed shape, `{files: […]}`, would have been a silent wire change: the request still succeeds and `response.data.find(...)` finds nothing, which reads as a session holding no files. The NAME of this handler is what the published summary is cut from, and it used to leak: the comment opened \"Files lists …\", which is not this function's identifier, so zipdoc's exact-match strip left it and every SDK, tool list and CLI help line opened with a Go symbol no caller can see. An openapi.Describe stated a better summary beside the route and was DISCARDED — Fold replaces a structural operation with the typed one — so the declaration read as landed and rendered nowhere. The comment is the one home for this sentence. One recursive `find`, the same traversal the artifact sweep makes. It used to be `ls -1A` — top level only — while the sweep collected with `find`, so a run that wrote a nested artifact reported it in its reply and then omitted it here, and the client's prefix match read the file as expired. Two traversals of one directory is two answers about what a session holds; there is one now.
:param sid: SID is the session identifier — the sandbox this listing is of. The URL is the addressing authority: a path segment binds after the body and after the query, so the address decides which session is read whatever else is sent. (required)
:type sid: str
@@ -192,9 +192,9 @@ class ExecApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> RESTResponseType:
"""Files lists what a session holds.
"""Lists the files in an execution session.
Files lists what a session holds. One recursive `find`, the same traversal the artifact sweep makes. It used to be `ls -1A` — top level only — while the sweep collected with `find`, so a run that wrote a nested artifact reported it in its reply and then omitted it here, and the client's prefix match read the file as expired. Two traversals of one directory is two answers about what a session holds; there is one now.
Lists the files in an execution session. Everything the session's sandbox holds — the uploads a run can read and the artifacts it produced — each then fetched from GET /v1/exec/download. The answer is a BARE JSON ARRAY of {name, lastModified}, where `name` is the same {session_id}/{fileId} identifier download takes, because that is what the client matches on. The obvious typed shape, `{files: […]}`, would have been a silent wire change: the request still succeeds and `response.data.find(...)` finds nothing, which reads as a session holding no files. The NAME of this handler is what the published summary is cut from, and it used to leak: the comment opened \"Files lists …\", which is not this function's identifier, so zipdoc's exact-match strip left it and every SDK, tool list and CLI help line opened with a Go symbol no caller can see. An openapi.Describe stated a better summary beside the route and was DISCARDED — Fold replaces a structural operation with the typed one — so the declaration read as landed and rendered nowhere. The comment is the one home for this sentence. One recursive `find`, the same traversal the artifact sweep makes. It used to be `ls -1A` — top level only — while the sweep collected with `find`, so a run that wrote a nested artifact reported it in its reply and then omitted it here, and the client's prefix match read the file as expired. Two traversals of one directory is two answers about what a session holds; there is one now.
:param sid: SID is the session identifier — the sandbox this listing is of. The URL is the addressing authority: a path segment binds after the body and after the query, so the address decides which session is read whatever else is sent. (required)
:type sid: str
@@ -592,9 +592,9 @@ class ExecApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
"""Programmatic tool calling (not served here)
"""Answers 501 — this deployment does not serve programmatic tool calling.
Answers 501. This address belongs to a DIFFERENT protocol from /v1/exec: the server suspends a program on each tool call, returns the pending calls with a continuation token, and resumes when the client posts results back. Serving it means implementing suspension and resumption, so it refuses in the open rather than answering with a shape the caller's parser cannot read.
Answers 501 — this deployment does not serve programmatic tool calling. That sentence is the SUMMARY every projection shows, so it says what a caller gets rather than what the code does; the rest names what it would take to stop refusing. /exec/programmatic is NOT this contract's sibling — it is a different protocol on an adjacent path: a multi-round-trip loop where the server suspends a Python program on a tool call, returns the pending calls with a continuation_token, and resumes when the client posts the results back (@hanzochat/agents ProgrammaticToolCalling). Implementing it means implementing suspension and resumption, which is a program, not an endpoint. So it answers 501 with that fact rather than being routed into `run`, which would hand the caller a CodeResult its parser cannot read — a wrong answer, where this is a refusal a client can act on. IT IS A TYPED OP, and the refusal for keeping it raw did not survive reading. It binds no body, opens no stream, relays no other process and sits on no wildcard, so none of the four wire facts that keep a route raw applies to it; what was cited instead was that a permanent stub should declare nothing. That argues for silence in the DOCUMENT and buys the silence everywhere else too — no MCP tool, no CLI command, no SDK method — so a caller could read this address and reach it by no projection but REST, and learn only by calling it that the protocol is not served. Declaring `zip.WithStatus(501)` is what makes typing honest: the document publishes the ONE status this route sends, over an Out with no schema, rather than the 204 a void op would otherwise have invented. ONE delta, pinned by TestProgrammaticRefusesEveryBody: a body that is not JSON now answers 400 rather than 501, because op.invoke decodes before the handler is entered. Both are refusals of a protocol this deployment does not serve, no real caller sends one, and 400 is what the rest of the fleet answers to bytes it cannot parse. It asks tenantOf for the reason every other operation here does, and the answer is the same on the wire it was: over HTTP the credential middleware has already run, so an admitted caller still reads 501. What the call closes is the entry point a route table cannot see — typing an operation makes it an MCP tool, which zip dispatches straight into the handler with no route and therefore no middleware. Uniformity is the whole property: every path into this subsystem reads the admission marker, so there is no operation anybody has to remember is the exception.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -626,6 +626,7 @@ class ExecApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'501': None,
}
response_data = self.api_client.call_api(
*_param,
@@ -654,9 +655,9 @@ class ExecApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
"""Programmatic tool calling (not served here)
"""Answers 501 — this deployment does not serve programmatic tool calling.
Answers 501. This address belongs to a DIFFERENT protocol from /v1/exec: the server suspends a program on each tool call, returns the pending calls with a continuation token, and resumes when the client posts results back. Serving it means implementing suspension and resumption, so it refuses in the open rather than answering with a shape the caller's parser cannot read.
Answers 501 — this deployment does not serve programmatic tool calling. That sentence is the SUMMARY every projection shows, so it says what a caller gets rather than what the code does; the rest names what it would take to stop refusing. /exec/programmatic is NOT this contract's sibling — it is a different protocol on an adjacent path: a multi-round-trip loop where the server suspends a Python program on a tool call, returns the pending calls with a continuation_token, and resumes when the client posts the results back (@hanzochat/agents ProgrammaticToolCalling). Implementing it means implementing suspension and resumption, which is a program, not an endpoint. So it answers 501 with that fact rather than being routed into `run`, which would hand the caller a CodeResult its parser cannot read — a wrong answer, where this is a refusal a client can act on. IT IS A TYPED OP, and the refusal for keeping it raw did not survive reading. It binds no body, opens no stream, relays no other process and sits on no wildcard, so none of the four wire facts that keep a route raw applies to it; what was cited instead was that a permanent stub should declare nothing. That argues for silence in the DOCUMENT and buys the silence everywhere else too — no MCP tool, no CLI command, no SDK method — so a caller could read this address and reach it by no projection but REST, and learn only by calling it that the protocol is not served. Declaring `zip.WithStatus(501)` is what makes typing honest: the document publishes the ONE status this route sends, over an Out with no schema, rather than the 204 a void op would otherwise have invented. ONE delta, pinned by TestProgrammaticRefusesEveryBody: a body that is not JSON now answers 400 rather than 501, because op.invoke decodes before the handler is entered. Both are refusals of a protocol this deployment does not serve, no real caller sends one, and 400 is what the rest of the fleet answers to bytes it cannot parse. It asks tenantOf for the reason every other operation here does, and the answer is the same on the wire it was: over HTTP the credential middleware has already run, so an admitted caller still reads 501. What the call closes is the entry point a route table cannot see — typing an operation makes it an MCP tool, which zip dispatches straight into the handler with no route and therefore no middleware. Uniformity is the whole property: every path into this subsystem reads the admission marker, so there is no operation anybody has to remember is the exception.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -688,6 +689,7 @@ class ExecApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'501': None,
}
response_data = self.api_client.call_api(
*_param,
@@ -716,9 +718,9 @@ class ExecApi:
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> RESTResponseType:
"""Programmatic tool calling (not served here)
"""Answers 501 — this deployment does not serve programmatic tool calling.
Answers 501. This address belongs to a DIFFERENT protocol from /v1/exec: the server suspends a program on each tool call, returns the pending calls with a continuation token, and resumes when the client posts results back. Serving it means implementing suspension and resumption, so it refuses in the open rather than answering with a shape the caller's parser cannot read.
Answers 501 — this deployment does not serve programmatic tool calling. That sentence is the SUMMARY every projection shows, so it says what a caller gets rather than what the code does; the rest names what it would take to stop refusing. /exec/programmatic is NOT this contract's sibling — it is a different protocol on an adjacent path: a multi-round-trip loop where the server suspends a Python program on a tool call, returns the pending calls with a continuation_token, and resumes when the client posts the results back (@hanzochat/agents ProgrammaticToolCalling). Implementing it means implementing suspension and resumption, which is a program, not an endpoint. So it answers 501 with that fact rather than being routed into `run`, which would hand the caller a CodeResult its parser cannot read — a wrong answer, where this is a refusal a client can act on. IT IS A TYPED OP, and the refusal for keeping it raw did not survive reading. It binds no body, opens no stream, relays no other process and sits on no wildcard, so none of the four wire facts that keep a route raw applies to it; what was cited instead was that a permanent stub should declare nothing. That argues for silence in the DOCUMENT and buys the silence everywhere else too — no MCP tool, no CLI command, no SDK method — so a caller could read this address and reach it by no projection but REST, and learn only by calling it that the protocol is not served. Declaring `zip.WithStatus(501)` is what makes typing honest: the document publishes the ONE status this route sends, over an Out with no schema, rather than the 204 a void op would otherwise have invented. ONE delta, pinned by TestProgrammaticRefusesEveryBody: a body that is not JSON now answers 400 rather than 501, because op.invoke decodes before the handler is entered. Both are refusals of a protocol this deployment does not serve, no real caller sends one, and 400 is what the rest of the fleet answers to bytes it cannot parse. It asks tenantOf for the reason every other operation here does, and the answer is the same on the wire it was: over HTTP the credential middleware has already run, so an admitted caller still reads 501. What the call closes is the entry point a route table cannot see — typing an operation makes it an MCP tool, which zip dispatches straight into the handler with no route and therefore no middleware. Uniformity is the whole property: every path into this subsystem reads the admission marker, so there is no operation anybody has to remember is the exception.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -750,6 +752,7 @@ class ExecApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'501': None,
}
response_data = self.api_client.call_api(
*_param,
pkg/hanzoai/cloud/api/git_api.py
+18 -18
View File
@@ -10549,7 +10549,7 @@ class GitApi:
) -> None:
"""Retired — forge pushes build via platform.hanzo.ai
GONE (410). This was the canonical forge's push-to-deploy endpoint, and it never dispatched a build in its life. It handed each verified push to cloud.OnGitPush, a single-registrant client whose only registrant lives in apps/platform. cloud runs each app as its own OS process, so in the git process that builder is nil forever — and this handler answered 204 either way. Delivered, signature valid, green on the forge's hook page, and nothing built. Push-to-deploy now belongs to POST https://platform.hanzo.ai/v1/git-webhook, which owns the build system-of-record and dispatches BuildKit Jobs. git.hanzo.ai delivers there through ONE forge-wide system webhook covering every repository; a repo opts in by committing hanzo.yml, not by owning a hook of its own. The route is kept, and answers 410 naming that address, precisely so a misdirected delivery says what is wrong. Deleting it would 404, and a 404 here reads as 'the API is switched off' — the wrong conclusion this estate has already drawn twice.
GONE (410). Push-to-deploy belongs to POST https://platform.hanzo.ai/v1/git-webhook, which owns the build system-of-record and dispatches BuildKit Jobs. git.hanzo.ai delivers there through ONE forge-wide system webhook covering every repository; a repo opts in by committing hanzo.yml, not by owning a hook of its own. Every delivery answers 410 whatever it carries — this endpoint reads no body and authenticates nothing. 410 rather than 404, because the address was real and its meaning moved, which is the distinction 410 carries. A 404 from this estate is ambiguous: Hanzo Git serves /v1, so /api/v1 404s too and reads as \"the API is switched off\". A retired endpoint says it is retired and names its replacement, so the answer carries its own fix.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -10611,7 +10611,7 @@ class GitApi:
) -> ApiResponse[None]:
"""Retired — forge pushes build via platform.hanzo.ai
GONE (410). This was the canonical forge's push-to-deploy endpoint, and it never dispatched a build in its life. It handed each verified push to cloud.OnGitPush, a single-registrant client whose only registrant lives in apps/platform. cloud runs each app as its own OS process, so in the git process that builder is nil forever — and this handler answered 204 either way. Delivered, signature valid, green on the forge's hook page, and nothing built. Push-to-deploy now belongs to POST https://platform.hanzo.ai/v1/git-webhook, which owns the build system-of-record and dispatches BuildKit Jobs. git.hanzo.ai delivers there through ONE forge-wide system webhook covering every repository; a repo opts in by committing hanzo.yml, not by owning a hook of its own. The route is kept, and answers 410 naming that address, precisely so a misdirected delivery says what is wrong. Deleting it would 404, and a 404 here reads as 'the API is switched off' — the wrong conclusion this estate has already drawn twice.
GONE (410). Push-to-deploy belongs to POST https://platform.hanzo.ai/v1/git-webhook, which owns the build system-of-record and dispatches BuildKit Jobs. git.hanzo.ai delivers there through ONE forge-wide system webhook covering every repository; a repo opts in by committing hanzo.yml, not by owning a hook of its own. Every delivery answers 410 whatever it carries — this endpoint reads no body and authenticates nothing. 410 rather than 404, because the address was real and its meaning moved, which is the distinction 410 carries. A 404 from this estate is ambiguous: Hanzo Git serves /v1, so /api/v1 404s too and reads as \"the API is switched off\". A retired endpoint says it is retired and names its replacement, so the answer carries its own fix.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -10673,7 +10673,7 @@ class GitApi:
) -> RESTResponseType:
"""Retired — forge pushes build via platform.hanzo.ai
GONE (410). This was the canonical forge's push-to-deploy endpoint, and it never dispatched a build in its life. It handed each verified push to cloud.OnGitPush, a single-registrant client whose only registrant lives in apps/platform. cloud runs each app as its own OS process, so in the git process that builder is nil forever — and this handler answered 204 either way. Delivered, signature valid, green on the forge's hook page, and nothing built. Push-to-deploy now belongs to POST https://platform.hanzo.ai/v1/git-webhook, which owns the build system-of-record and dispatches BuildKit Jobs. git.hanzo.ai delivers there through ONE forge-wide system webhook covering every repository; a repo opts in by committing hanzo.yml, not by owning a hook of its own. The route is kept, and answers 410 naming that address, precisely so a misdirected delivery says what is wrong. Deleting it would 404, and a 404 here reads as 'the API is switched off' — the wrong conclusion this estate has already drawn twice.
GONE (410). Push-to-deploy belongs to POST https://platform.hanzo.ai/v1/git-webhook, which owns the build system-of-record and dispatches BuildKit Jobs. git.hanzo.ai delivers there through ONE forge-wide system webhook covering every repository; a repo opts in by committing hanzo.yml, not by owning a hook of its own. Every delivery answers 410 whatever it carries — this endpoint reads no body and authenticates nothing. 410 rather than 404, because the address was real and its meaning moved, which is the distinction 410 carries. A 404 from this estate is ambiguous: Hanzo Git serves /v1, so /api/v1 404s too and reads as \"the API is switched off\". A retired endpoint says it is retired and names its replacement, so the answer carries its own fix.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -10786,7 +10786,7 @@ class GitApi:
) -> None:
"""Create a repository over the ZAP transport
Creates a repository in the caller's org and project scope and answers with its record. `name` is required and `description` is optional; `project` narrows the scope within the org. A name already taken in that scope is a 409 envelope and an invalid name a 400. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Creates a repository in the caller's org and project scope and answers with its record. `name` is required and `description` is optional; `project` narrows the scope within the org. A name already taken in that scope is a 409 envelope and an invalid name a 400. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param zap_proc_req:
:type zap_proc_req: ZapProcReq
@@ -10852,7 +10852,7 @@ class GitApi:
) -> ApiResponse[None]:
"""Create a repository over the ZAP transport
Creates a repository in the caller's org and project scope and answers with its record. `name` is required and `description` is optional; `project` narrows the scope within the org. A name already taken in that scope is a 409 envelope and an invalid name a 400. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Creates a repository in the caller's org and project scope and answers with its record. `name` is required and `description` is optional; `project` narrows the scope within the org. A name already taken in that scope is a 409 envelope and an invalid name a 400. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param zap_proc_req:
:type zap_proc_req: ZapProcReq
@@ -10918,7 +10918,7 @@ class GitApi:
) -> RESTResponseType:
"""Create a repository over the ZAP transport
Creates a repository in the caller's org and project scope and answers with its record. `name` is required and `description` is optional; `project` narrows the scope within the org. A name already taken in that scope is a 409 envelope and an invalid name a 400. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Creates a repository in the caller's org and project scope and answers with its record. `name` is required and `description` is optional; `project` narrows the scope within the org. A name already taken in that scope is a 409 envelope and an invalid name a 400. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param zap_proc_req:
:type zap_proc_req: ZapProcReq
@@ -11050,7 +11050,7 @@ class GitApi:
) -> None:
"""Delete a repository over the ZAP transport
Deletes the repository named by `name` and answers with the deleted name. A repository outside the caller's org and project scope is a 404 envelope, so a delete can never reach another tenant's repository. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Deletes the repository named by `name` and answers with the deleted name. A repository outside the caller's org and project scope is a 404 envelope, so a delete can never reach another tenant's repository. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param zap_proc_req:
:type zap_proc_req: ZapProcReq
@@ -11116,7 +11116,7 @@ class GitApi:
) -> ApiResponse[None]:
"""Delete a repository over the ZAP transport
Deletes the repository named by `name` and answers with the deleted name. A repository outside the caller's org and project scope is a 404 envelope, so a delete can never reach another tenant's repository. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Deletes the repository named by `name` and answers with the deleted name. A repository outside the caller's org and project scope is a 404 envelope, so a delete can never reach another tenant's repository. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param zap_proc_req:
:type zap_proc_req: ZapProcReq
@@ -11182,7 +11182,7 @@ class GitApi:
) -> RESTResponseType:
"""Delete a repository over the ZAP transport
Deletes the repository named by `name` and answers with the deleted name. A repository outside the caller's org and project scope is a 404 envelope, so a delete can never reach another tenant's repository. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Deletes the repository named by `name` and answers with the deleted name. A repository outside the caller's org and project scope is a 404 envelope, so a delete can never reach another tenant's repository. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param zap_proc_req:
:type zap_proc_req: ZapProcReq
@@ -11314,7 +11314,7 @@ class GitApi:
) -> None:
"""Read one repository over the ZAP transport
Answers a single repository's record, named by `name`. A repository outside the caller's org and project scope is a 404 envelope, the same answer one that does not exist gets. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Answers a single repository's record, named by `name`. A repository outside the caller's org and project scope is a 404 envelope, the same answer one that does not exist gets. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param zap_proc_req:
:type zap_proc_req: ZapProcReq
@@ -11380,7 +11380,7 @@ class GitApi:
) -> ApiResponse[None]:
"""Read one repository over the ZAP transport
Answers a single repository's record, named by `name`. A repository outside the caller's org and project scope is a 404 envelope, the same answer one that does not exist gets. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Answers a single repository's record, named by `name`. A repository outside the caller's org and project scope is a 404 envelope, the same answer one that does not exist gets. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param zap_proc_req:
:type zap_proc_req: ZapProcReq
@@ -11446,7 +11446,7 @@ class GitApi:
) -> RESTResponseType:
"""Read one repository over the ZAP transport
Answers a single repository's record, named by `name`. A repository outside the caller's org and project scope is a 404 envelope, the same answer one that does not exist gets. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Answers a single repository's record, named by `name`. A repository outside the caller's org and project scope is a 404 envelope, the same answer one that does not exist gets. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param zap_proc_req:
:type zap_proc_req: ZapProcReq
@@ -11577,7 +11577,7 @@ class GitApi:
) -> None:
"""List your repositories over the ZAP transport
Answers every repository in the caller's org and project scope. It reads NO body — the scope is entirely the caller's identity — so a request with an empty object is correct. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Answers every repository in the caller's org and project scope. It reads NO body — the scope is entirely the caller's identity — so a request with an empty object is correct. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -11639,7 +11639,7 @@ class GitApi:
) -> ApiResponse[None]:
"""List your repositories over the ZAP transport
Answers every repository in the caller's org and project scope. It reads NO body — the scope is entirely the caller's identity — so a request with an empty object is correct. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Answers every repository in the caller's org and project scope. It reads NO body — the scope is entirely the caller's identity — so a request with an empty object is correct. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -11701,7 +11701,7 @@ class GitApi:
) -> RESTResponseType:
"""List your repositories over the ZAP transport
Answers every repository in the caller's org and project scope. It reads NO body — the scope is entirely the caller's identity — so a request with an empty object is correct. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Answers every repository in the caller's org and project scope. It reads NO body — the scope is entirely the caller's identity — so a request with an empty object is correct. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -11813,7 +11813,7 @@ class GitApi:
) -> None:
"""Report your org's git storage footprint over the ZAP transport
Answers every repository in the caller's org with its size in bytes, plus the org's total — what git storage is actually being used, and by which repository. It reads NO body, and it is scoped to the caller's own org, so it is that org's footprint and never the fleet's. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Answers every repository in the caller's org with its size in bytes, plus the org's total — what git storage is actually being used, and by which repository. It reads NO body, and it is scoped to the caller's own org, so it is that org's footprint and never the fleet's. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -11875,7 +11875,7 @@ class GitApi:
) -> ApiResponse[None]:
"""Report your org's git storage footprint over the ZAP transport
Answers every repository in the caller's org with its size in bytes, plus the org's total — what git storage is actually being used, and by which repository. It reads NO body, and it is scoped to the caller's own org, so it is that org's footprint and never the fleet's. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Answers every repository in the caller's org with its size in bytes, plus the org's total — what git storage is actually being used, and by which repository. It reads NO body, and it is scoped to the caller's own org, so it is that org's footprint and never the fleet's. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -11937,7 +11937,7 @@ class GitApi:
) -> RESTResponseType:
"""Report your org's git storage footprint over the ZAP transport
Answers every repository in the caller's org with its size in bytes, plus the org's total — what git storage is actually being used, and by which repository. It reads NO body, and it is scoped to the caller's own org, so it is that org's footprint and never the fleet's. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns — which is a wire shape a typed op cannot produce, and the reason this stays a raw handler — and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
Answers every repository in the caller's org with its size in bytes, plus the org's total — what git storage is actually being used, and by which repository. It reads NO body, and it is scoped to the caller's own org, so it is that org's footprint and never the fleet's. A ZAP PROCEDURE, not a REST resource. It answers the bridge's {status, msg, data} envelope rather than the raw view the /v1 route returns, and it calls the SAME core function the REST route calls, so the two transports cannot diverge in behaviour. Org and project scope come from the request identity and NEVER from the body: the body cannot widen the caller's scope. Without a validated org the answer is a 403 envelope.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
pkg/hanzoai/cloud/api/kms_api.py
+26 -25
View File
@@ -16,8 +16,9 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
from typing import Any, Dict, List, Optional, Tuple, Union
from typing_extensions import Annotated
from pydantic import StrictStr
from pydantic import Field, StrictStr
from typing import Optional
from typing_extensions import Annotated
from hanzoai.cloud.models.kms_config import KmsConfig
from hanzoai.cloud.models.kms_health import KmsHealth
from hanzoai.cloud.models.kms_login import KmsLogin
@@ -542,10 +543,10 @@ class KmsApi:
@validate_call
def get_kms_secrets(
self,
env: Optional[StrictStr] = None,
environment: Optional[StrictStr] = None,
path: Optional[StrictStr] = None,
secret_path: Optional[StrictStr] = None,
env: Annotated[Optional[StrictStr], Field(description="Env selects the environment, which is part of a secret's storage key. OMITTED means EVERY environment — this is the enumeration surface, so it must be able to answer \"what is in here\" without being told where to look.")] = None,
environment: Annotated[Optional[StrictStr], Field(description="Environment is the KMS operator's spelling of Env, accepted so one caller need not learn the other's vocabulary. Env wins when both are sent.")] = None,
path: Annotated[Optional[StrictStr], Field(description="Path narrows the listing to one subtree beneath the caller's org root, as a `/`-separated path such as `/ci`. OMITTED means the whole org.")] = None,
secret_path: Annotated[Optional[StrictStr], Field(description="SecretPath is the KMS operator's spelling of Path. Path wins when both are sent.")] = None,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -563,13 +564,13 @@ class KmsApi:
Lists the secrets your org holds, without their values. Returns the METADATA of the caller's own secrets: each one's name, path, environment and sealing scheme. No value and no ciphertext is included — this operation exists to enumerate what is held, and reading a value is a separate, per-secret call. Scoped to the caller's own org and nothing else, structurally: there is no org in the path, the store root is derived from the validated org claim, and a caller therefore has no way to name another tenant's namespace. `path` narrows to a subpath and `env` selects the environment; both are also accepted under the operator's spellings, `secretPath` and `environment`. An omitted `env` means every environment and an omitted `path` means the whole org, because a default here reported a populated store as empty. Admission is fail-closed and in order: a validated member, an org that is a DNS-1123 label, and a store holding a master key — 403, 400 and 503 respectively, all decided before any record is touched.
:param env:
:param env: Env selects the environment, which is part of a secret's storage key. OMITTED means EVERY environment — this is the enumeration surface, so it must be able to answer \"what is in here\" without being told where to look.
:type env: str
:param environment:
:param environment: Environment is the KMS operator's spelling of Env, accepted so one caller need not learn the other's vocabulary. Env wins when both are sent.
:type environment: str
:param path:
:param path: Path narrows the listing to one subtree beneath the caller's org root, as a `/`-separated path such as `/ci`. OMITTED means the whole org.
:type path: str
:param secret_path:
:param secret_path: SecretPath is the KMS operator's spelling of Path. Path wins when both are sent.
:type secret_path: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -621,10 +622,10 @@ class KmsApi:
@validate_call
def get_kms_secrets_with_http_info(
self,
env: Optional[StrictStr] = None,
environment: Optional[StrictStr] = None,
path: Optional[StrictStr] = None,
secret_path: Optional[StrictStr] = None,
env: Annotated[Optional[StrictStr], Field(description="Env selects the environment, which is part of a secret's storage key. OMITTED means EVERY environment — this is the enumeration surface, so it must be able to answer \"what is in here\" without being told where to look.")] = None,
environment: Annotated[Optional[StrictStr], Field(description="Environment is the KMS operator's spelling of Env, accepted so one caller need not learn the other's vocabulary. Env wins when both are sent.")] = None,
path: Annotated[Optional[StrictStr], Field(description="Path narrows the listing to one subtree beneath the caller's org root, as a `/`-separated path such as `/ci`. OMITTED means the whole org.")] = None,
secret_path: Annotated[Optional[StrictStr], Field(description="SecretPath is the KMS operator's spelling of Path. Path wins when both are sent.")] = None,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -642,13 +643,13 @@ class KmsApi:
Lists the secrets your org holds, without their values. Returns the METADATA of the caller's own secrets: each one's name, path, environment and sealing scheme. No value and no ciphertext is included — this operation exists to enumerate what is held, and reading a value is a separate, per-secret call. Scoped to the caller's own org and nothing else, structurally: there is no org in the path, the store root is derived from the validated org claim, and a caller therefore has no way to name another tenant's namespace. `path` narrows to a subpath and `env` selects the environment; both are also accepted under the operator's spellings, `secretPath` and `environment`. An omitted `env` means every environment and an omitted `path` means the whole org, because a default here reported a populated store as empty. Admission is fail-closed and in order: a validated member, an org that is a DNS-1123 label, and a store holding a master key — 403, 400 and 503 respectively, all decided before any record is touched.
:param env:
:param env: Env selects the environment, which is part of a secret's storage key. OMITTED means EVERY environment — this is the enumeration surface, so it must be able to answer \"what is in here\" without being told where to look.
:type env: str
:param environment:
:param environment: Environment is the KMS operator's spelling of Env, accepted so one caller need not learn the other's vocabulary. Env wins when both are sent.
:type environment: str
:param path:
:param path: Path narrows the listing to one subtree beneath the caller's org root, as a `/`-separated path such as `/ci`. OMITTED means the whole org.
:type path: str
:param secret_path:
:param secret_path: SecretPath is the KMS operator's spelling of Path. Path wins when both are sent.
:type secret_path: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -700,10 +701,10 @@ class KmsApi:
@validate_call
def get_kms_secrets_without_preload_content(
self,
env: Optional[StrictStr] = None,
environment: Optional[StrictStr] = None,
path: Optional[StrictStr] = None,
secret_path: Optional[StrictStr] = None,
env: Annotated[Optional[StrictStr], Field(description="Env selects the environment, which is part of a secret's storage key. OMITTED means EVERY environment — this is the enumeration surface, so it must be able to answer \"what is in here\" without being told where to look.")] = None,
environment: Annotated[Optional[StrictStr], Field(description="Environment is the KMS operator's spelling of Env, accepted so one caller need not learn the other's vocabulary. Env wins when both are sent.")] = None,
path: Annotated[Optional[StrictStr], Field(description="Path narrows the listing to one subtree beneath the caller's org root, as a `/`-separated path such as `/ci`. OMITTED means the whole org.")] = None,
secret_path: Annotated[Optional[StrictStr], Field(description="SecretPath is the KMS operator's spelling of Path. Path wins when both are sent.")] = None,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -721,13 +722,13 @@ class KmsApi:
Lists the secrets your org holds, without their values. Returns the METADATA of the caller's own secrets: each one's name, path, environment and sealing scheme. No value and no ciphertext is included — this operation exists to enumerate what is held, and reading a value is a separate, per-secret call. Scoped to the caller's own org and nothing else, structurally: there is no org in the path, the store root is derived from the validated org claim, and a caller therefore has no way to name another tenant's namespace. `path` narrows to a subpath and `env` selects the environment; both are also accepted under the operator's spellings, `secretPath` and `environment`. An omitted `env` means every environment and an omitted `path` means the whole org, because a default here reported a populated store as empty. Admission is fail-closed and in order: a validated member, an org that is a DNS-1123 label, and a store holding a master key — 403, 400 and 503 respectively, all decided before any record is touched.
:param env:
:param env: Env selects the environment, which is part of a secret's storage key. OMITTED means EVERY environment — this is the enumeration surface, so it must be able to answer \"what is in here\" without being told where to look.
:type env: str
:param environment:
:param environment: Environment is the KMS operator's spelling of Env, accepted so one caller need not learn the other's vocabulary. Env wins when both are sent.
:type environment: str
:param path:
:param path: Path narrows the listing to one subtree beneath the caller's org root, as a `/`-separated path such as `/ci`. OMITTED means the whole org.
:type path: str
:param secret_path:
:param secret_path: SecretPath is the KMS operator's spelling of Path. Path wins when both are sent.
:type secret_path: str
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
pkg/hanzoai/cloud/api/node_api.py
+3 -3
View File
@@ -788,7 +788,7 @@ class NodeApi:
) -> None:
"""Replica-to-replica forward of one invocation to the pod holding the node's socket.
A machine hop, not a caller-facing route. A node's socket lands on one replica while invocations land on any, so the replica that took the request forwards it here to the one that actually holds the node, and returns that answer as its own. It authenticates with the shared peer token, compared in constant time, and carries no user identity at all. That is why the org arrives IN THE BODY here: the forwarding replica already derived it from a gateway-validated header, so the value is a fact being relayed rather than a claim being made. On any caller-facing route the same field would be a cross-tenant invoke primitive. It fails closed on its own configuration: with no peer token set, or a half-wired cluster that has presence but no way to forward, it serves 503 and forwards nothing — an unauthenticated endpoint that takes an org from a body is precisely the hole. A missing or wrong token is 403, and the forwarded body is bounded on read. Two things to get right. Its refusals are text/plain rather than the JSON every zip error uses, so a client decoding them as JSON will fail on the error path only. And an invocation that RAN but was denied still answers 200 here, carrying a stable error token in the JSON body — no such node, timeout, node gone, denied, failed — which the calling replica maps back onto the status codes a caller sees. Authorization already ran on this replica at the socket and is deliberately not repeated.
A machine hop, not a caller-facing route. A node's socket lands on one replica while invocations land on any, so the replica that took the request forwards it here to the one that actually holds the node, and returns that answer as its own. It authenticates with the shared peer token, compared in constant time, and carries no user identity at all. That is why the org arrives IN THE BODY here: the forwarding replica already derived it from a gateway-validated header, so the value is a fact being relayed rather than a claim being made. On any caller-facing route the same field would be a cross-tenant invoke primitive. It fails closed on its own configuration: with no peer token set, or a half-wired cluster that has presence but no way to forward, it serves 503 and forwards nothing — an unauthenticated endpoint that takes an org from a body is precisely the hole. A missing or wrong token is 403, and the forwarded body is bounded. Two things to get right. Its refusals are text/plain rather than the JSON every zip error uses, so a client decoding them as JSON will fail on the error path only. And an invocation that RAN but was denied still answers 200 here, carrying a stable error token in the JSON body — no such node, timeout, node gone, denied, failed — which the calling replica maps back onto the status codes a caller sees. Authorization already ran on this replica at the socket and is deliberately not repeated.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -850,7 +850,7 @@ class NodeApi:
) -> ApiResponse[None]:
"""Replica-to-replica forward of one invocation to the pod holding the node's socket.
A machine hop, not a caller-facing route. A node's socket lands on one replica while invocations land on any, so the replica that took the request forwards it here to the one that actually holds the node, and returns that answer as its own. It authenticates with the shared peer token, compared in constant time, and carries no user identity at all. That is why the org arrives IN THE BODY here: the forwarding replica already derived it from a gateway-validated header, so the value is a fact being relayed rather than a claim being made. On any caller-facing route the same field would be a cross-tenant invoke primitive. It fails closed on its own configuration: with no peer token set, or a half-wired cluster that has presence but no way to forward, it serves 503 and forwards nothing — an unauthenticated endpoint that takes an org from a body is precisely the hole. A missing or wrong token is 403, and the forwarded body is bounded on read. Two things to get right. Its refusals are text/plain rather than the JSON every zip error uses, so a client decoding them as JSON will fail on the error path only. And an invocation that RAN but was denied still answers 200 here, carrying a stable error token in the JSON body — no such node, timeout, node gone, denied, failed — which the calling replica maps back onto the status codes a caller sees. Authorization already ran on this replica at the socket and is deliberately not repeated.
A machine hop, not a caller-facing route. A node's socket lands on one replica while invocations land on any, so the replica that took the request forwards it here to the one that actually holds the node, and returns that answer as its own. It authenticates with the shared peer token, compared in constant time, and carries no user identity at all. That is why the org arrives IN THE BODY here: the forwarding replica already derived it from a gateway-validated header, so the value is a fact being relayed rather than a claim being made. On any caller-facing route the same field would be a cross-tenant invoke primitive. It fails closed on its own configuration: with no peer token set, or a half-wired cluster that has presence but no way to forward, it serves 503 and forwards nothing — an unauthenticated endpoint that takes an org from a body is precisely the hole. A missing or wrong token is 403, and the forwarded body is bounded. Two things to get right. Its refusals are text/plain rather than the JSON every zip error uses, so a client decoding them as JSON will fail on the error path only. And an invocation that RAN but was denied still answers 200 here, carrying a stable error token in the JSON body — no such node, timeout, node gone, denied, failed — which the calling replica maps back onto the status codes a caller sees. Authorization already ran on this replica at the socket and is deliberately not repeated.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -912,7 +912,7 @@ class NodeApi:
) -> RESTResponseType:
"""Replica-to-replica forward of one invocation to the pod holding the node's socket.
A machine hop, not a caller-facing route. A node's socket lands on one replica while invocations land on any, so the replica that took the request forwards it here to the one that actually holds the node, and returns that answer as its own. It authenticates with the shared peer token, compared in constant time, and carries no user identity at all. That is why the org arrives IN THE BODY here: the forwarding replica already derived it from a gateway-validated header, so the value is a fact being relayed rather than a claim being made. On any caller-facing route the same field would be a cross-tenant invoke primitive. It fails closed on its own configuration: with no peer token set, or a half-wired cluster that has presence but no way to forward, it serves 503 and forwards nothing — an unauthenticated endpoint that takes an org from a body is precisely the hole. A missing or wrong token is 403, and the forwarded body is bounded on read. Two things to get right. Its refusals are text/plain rather than the JSON every zip error uses, so a client decoding them as JSON will fail on the error path only. And an invocation that RAN but was denied still answers 200 here, carrying a stable error token in the JSON body — no such node, timeout, node gone, denied, failed — which the calling replica maps back onto the status codes a caller sees. Authorization already ran on this replica at the socket and is deliberately not repeated.
A machine hop, not a caller-facing route. A node's socket lands on one replica while invocations land on any, so the replica that took the request forwards it here to the one that actually holds the node, and returns that answer as its own. It authenticates with the shared peer token, compared in constant time, and carries no user identity at all. That is why the org arrives IN THE BODY here: the forwarding replica already derived it from a gateway-validated header, so the value is a fact being relayed rather than a claim being made. On any caller-facing route the same field would be a cross-tenant invoke primitive. It fails closed on its own configuration: with no peer token set, or a half-wired cluster that has presence but no way to forward, it serves 503 and forwards nothing — an unauthenticated endpoint that takes an org from a body is precisely the hole. A missing or wrong token is 403, and the forwarded body is bounded. Two things to get right. Its refusals are text/plain rather than the JSON every zip error uses, so a client decoding them as JSON will fail on the error path only. And an invocation that RAN but was denied still answers 200 here, carrying a stable error token in the JSON body — no such node, timeout, node gone, denied, failed — which the calling replica maps back onto the status codes a caller sees. Authorization already ran on this replica at the socket and is deliberately not repeated.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
pkg/hanzoai/cloud/api/s3_api.py
+15 -15
View File
@@ -64,7 +64,7 @@ class S3Api:
) -> None:
"""Removes an EMPTY bucket and answers 204.
Removes an EMPTY bucket and answers 204. A non-empty bucket is 409 rather than a cascade: deleting a tenant's objects behind a single bucket call is not a thing this surface will do silently. A bucket the caller's org does not own is the same 404 an unknown name gives.
Removes an EMPTY bucket and answers 204. A non-empty bucket is 409 rather than a cascade: deleting a tenant's objects behind a single bucket call is not a thing this surface will do silently. A bucket the caller's org does not own is the same 404 an unknown name gives. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing deleted, and the debit lands only once the bucket is gone.
:param bucket: Bucket is the bucket's friendly name, from the path. (required)
:type bucket: str
@@ -131,7 +131,7 @@ class S3Api:
) -> ApiResponse[None]:
"""Removes an EMPTY bucket and answers 204.
Removes an EMPTY bucket and answers 204. A non-empty bucket is 409 rather than a cascade: deleting a tenant's objects behind a single bucket call is not a thing this surface will do silently. A bucket the caller's org does not own is the same 404 an unknown name gives.
Removes an EMPTY bucket and answers 204. A non-empty bucket is 409 rather than a cascade: deleting a tenant's objects behind a single bucket call is not a thing this surface will do silently. A bucket the caller's org does not own is the same 404 an unknown name gives. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing deleted, and the debit lands only once the bucket is gone.
:param bucket: Bucket is the bucket's friendly name, from the path. (required)
:type bucket: str
@@ -198,7 +198,7 @@ class S3Api:
) -> RESTResponseType:
"""Removes an EMPTY bucket and answers 204.
Removes an EMPTY bucket and answers 204. A non-empty bucket is 409 rather than a cascade: deleting a tenant's objects behind a single bucket call is not a thing this surface will do silently. A bucket the caller's org does not own is the same 404 an unknown name gives.
Removes an EMPTY bucket and answers 204. A non-empty bucket is 409 rather than a cascade: deleting a tenant's objects behind a single bucket call is not a thing this surface will do silently. A bucket the caller's org does not own is the same 404 an unknown name gives. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing deleted, and the debit lands only once the bucket is gone.
:param bucket: Bucket is the bucket's friendly name, from the path. (required)
:type bucket: str
@@ -317,7 +317,7 @@ class S3Api:
) -> BucketList:
"""Lists the caller org's own buckets.
Lists the caller org's own buckets. Only the caller's: every bucket is physically named under a per-org prefix and the listing strips that prefix, so a tenant sees friendly names and another tenant's buckets are not in the answer at all.
Lists the caller org's own buckets. Only the caller's: every bucket is physically named under a per-org prefix and the listing strips that prefix, so a tenant sees friendly names and another tenant's buckets are not in the answer at all. Another org's bucket is not refused but INVISIBLE, so this cannot be used to learn that a name is taken elsewhere. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit lands only once the work has succeeded.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -380,7 +380,7 @@ class S3Api:
) -> ApiResponse[BucketList]:
"""Lists the caller org's own buckets.
Lists the caller org's own buckets. Only the caller's: every bucket is physically named under a per-org prefix and the listing strips that prefix, so a tenant sees friendly names and another tenant's buckets are not in the answer at all.
Lists the caller org's own buckets. Only the caller's: every bucket is physically named under a per-org prefix and the listing strips that prefix, so a tenant sees friendly names and another tenant's buckets are not in the answer at all. Another org's bucket is not refused but INVISIBLE, so this cannot be used to learn that a name is taken elsewhere. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit lands only once the work has succeeded.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -443,7 +443,7 @@ class S3Api:
) -> RESTResponseType:
"""Lists the caller org's own buckets.
Lists the caller org's own buckets. Only the caller's: every bucket is physically named under a per-org prefix and the listing strips that prefix, so a tenant sees friendly names and another tenant's buckets are not in the answer at all.
Lists the caller org's own buckets. Only the caller's: every bucket is physically named under a per-org prefix and the listing strips that prefix, so a tenant sees friendly names and another tenant's buckets are not in the answer at all. Another org's bucket is not refused but INVISIBLE, so this cannot be used to learn that a name is taken elsewhere. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit lands only once the work has succeeded.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -566,7 +566,7 @@ class S3Api:
) -> ObjectList:
"""Lists one folder level of a bucket.
Lists one folder level of a bucket. Folder-style by default: sub-prefixes come back as directory entries, which is the file-manager view. `?recursive=true` lists every key flat under the prefix instead. Keys are RELATIVE to `?prefix=`, and the listing is bounded so a huge bucket cannot exhaust memory — Total is what came back, not what the bucket holds.
Lists one folder level of a bucket. Folder-style by default: sub-prefixes come back as directory entries, which is the file-manager view. `?recursive=true` lists every key flat under the prefix instead. Keys are RELATIVE to `?prefix=`, and the listing is bounded so a huge bucket cannot exhaust memory — Total is what came back, not what the bucket holds. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing read, and the debit lands only once the listing has succeeded.
:param bucket: Bucket is the bucket to list, from the path. (required)
:type bucket: str
@@ -641,7 +641,7 @@ class S3Api:
) -> ApiResponse[ObjectList]:
"""Lists one folder level of a bucket.
Lists one folder level of a bucket. Folder-style by default: sub-prefixes come back as directory entries, which is the file-manager view. `?recursive=true` lists every key flat under the prefix instead. Keys are RELATIVE to `?prefix=`, and the listing is bounded so a huge bucket cannot exhaust memory — Total is what came back, not what the bucket holds.
Lists one folder level of a bucket. Folder-style by default: sub-prefixes come back as directory entries, which is the file-manager view. `?recursive=true` lists every key flat under the prefix instead. Keys are RELATIVE to `?prefix=`, and the listing is bounded so a huge bucket cannot exhaust memory — Total is what came back, not what the bucket holds. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing read, and the debit lands only once the listing has succeeded.
:param bucket: Bucket is the bucket to list, from the path. (required)
:type bucket: str
@@ -716,7 +716,7 @@ class S3Api:
) -> RESTResponseType:
"""Lists one folder level of a bucket.
Lists one folder level of a bucket. Folder-style by default: sub-prefixes come back as directory entries, which is the file-manager view. `?recursive=true` lists every key flat under the prefix instead. Keys are RELATIVE to `?prefix=`, and the listing is bounded so a huge bucket cannot exhaust memory — Total is what came back, not what the bucket holds.
Lists one folder level of a bucket. Folder-style by default: sub-prefixes come back as directory entries, which is the file-manager view. `?recursive=true` lists every key flat under the prefix instead. Keys are RELATIVE to `?prefix=`, and the listing is bounded so a huge bucket cannot exhaust memory — Total is what came back, not what the bucket holds. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing read, and the debit lands only once the listing has succeeded.
:param bucket: Bucket is the bucket to list, from the path. (required)
:type bucket: str
@@ -1108,7 +1108,7 @@ class S3Api:
) -> BucketItem:
"""Makes a new bucket for the caller's org and answers 201 with it.
Makes a new bucket for the caller's org and answers 201 with it. The physical name is derived from the caller's validated org, so a tenant can only ever create inside its own namespace and no request field can redirect that. A name already taken in the org is 409.
Makes a new bucket for the caller's org and answers 201 with it. The physical name is derived from the caller's validated org, so a tenant can only ever create inside its own namespace and no request field can redirect that. A name already taken in the org is 409. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing created, and the debit lands only once the bucket exists.
:param bucket_in: (required)
:type bucket_in: BucketIn
@@ -1175,7 +1175,7 @@ class S3Api:
) -> ApiResponse[BucketItem]:
"""Makes a new bucket for the caller's org and answers 201 with it.
Makes a new bucket for the caller's org and answers 201 with it. The physical name is derived from the caller's validated org, so a tenant can only ever create inside its own namespace and no request field can redirect that. A name already taken in the org is 409.
Makes a new bucket for the caller's org and answers 201 with it. The physical name is derived from the caller's validated org, so a tenant can only ever create inside its own namespace and no request field can redirect that. A name already taken in the org is 409. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing created, and the debit lands only once the bucket exists.
:param bucket_in: (required)
:type bucket_in: BucketIn
@@ -1242,7 +1242,7 @@ class S3Api:
) -> RESTResponseType:
"""Makes a new bucket for the caller's org and answers 201 with it.
Makes a new bucket for the caller's org and answers 201 with it. The physical name is derived from the caller's validated org, so a tenant can only ever create inside its own namespace and no request field can redirect that. A name already taken in the org is 409.
Makes a new bucket for the caller's org and answers 201 with it. The physical name is derived from the caller's validated org, so a tenant can only ever create inside its own namespace and no request field can redirect that. A name already taken in the org is 409. Billed per call: the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing created, and the debit lands only once the bucket exists.
:param bucket_in: (required)
:type bucket_in: BucketIn
@@ -1383,7 +1383,7 @@ class S3Api:
) -> PresignResponse:
"""Mints a presigned PUT URL the caller uploads to DIRECTLY.
Mints a presigned PUT URL the caller uploads to DIRECTLY. The bytes never pass through this binary and the admin credential never leaves the server: the URL is signed against the PUBLIC host, scoped to exactly this bucket and key, and expires. A deployment with no public endpoint configured cannot mint one and answers 503 rather than a URL that will not work.
Mints a presigned PUT URL the caller uploads to DIRECTLY. The bytes never pass through this binary and the admin credential never leaves the server: the URL is signed against the PUBLIC host, scoped to exactly this bucket and key, and expires. A deployment with no public endpoint configured cannot mint one and answers 503 rather than a URL that will not work. Billed per call — for MINTING the URL, which is the work this operation does; the upload that follows it goes straight to the store and is not seen here. The balance is checked BEFORE anything is touched, so an unfunded org is refused with no URL issued.
:param bucket: Bucket is the bucket to upload into, from the path. (required)
:type bucket: str
@@ -1454,7 +1454,7 @@ class S3Api:
) -> ApiResponse[PresignResponse]:
"""Mints a presigned PUT URL the caller uploads to DIRECTLY.
Mints a presigned PUT URL the caller uploads to DIRECTLY. The bytes never pass through this binary and the admin credential never leaves the server: the URL is signed against the PUBLIC host, scoped to exactly this bucket and key, and expires. A deployment with no public endpoint configured cannot mint one and answers 503 rather than a URL that will not work.
Mints a presigned PUT URL the caller uploads to DIRECTLY. The bytes never pass through this binary and the admin credential never leaves the server: the URL is signed against the PUBLIC host, scoped to exactly this bucket and key, and expires. A deployment with no public endpoint configured cannot mint one and answers 503 rather than a URL that will not work. Billed per call — for MINTING the URL, which is the work this operation does; the upload that follows it goes straight to the store and is not seen here. The balance is checked BEFORE anything is touched, so an unfunded org is refused with no URL issued.
:param bucket: Bucket is the bucket to upload into, from the path. (required)
:type bucket: str
@@ -1525,7 +1525,7 @@ class S3Api:
) -> RESTResponseType:
"""Mints a presigned PUT URL the caller uploads to DIRECTLY.
Mints a presigned PUT URL the caller uploads to DIRECTLY. The bytes never pass through this binary and the admin credential never leaves the server: the URL is signed against the PUBLIC host, scoped to exactly this bucket and key, and expires. A deployment with no public endpoint configured cannot mint one and answers 503 rather than a URL that will not work.
Mints a presigned PUT URL the caller uploads to DIRECTLY. The bytes never pass through this binary and the admin credential never leaves the server: the URL is signed against the PUBLIC host, scoped to exactly this bucket and key, and expires. A deployment with no public endpoint configured cannot mint one and answers 503 rather than a URL that will not work. Billed per call — for MINTING the URL, which is the work this operation does; the upload that follows it goes straight to the store and is not seen here. The balance is checked BEFORE anything is touched, so an unfunded org is refused with no URL issued.
:param bucket: Bucket is the bucket to upload into, from the path. (required)
:type bucket: str
pkg/hanzoai/cloud/api/tasks_api.py
+15 -15
View File
@@ -53,7 +53,7 @@ class TasksApi:
) -> None:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -115,7 +115,7 @@ class TasksApi:
) -> ApiResponse[None]:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -177,7 +177,7 @@ class TasksApi:
) -> RESTResponseType:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -289,7 +289,7 @@ class TasksApi:
) -> None:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -351,7 +351,7 @@ class TasksApi:
) -> ApiResponse[None]:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -413,7 +413,7 @@ class TasksApi:
) -> RESTResponseType:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -525,7 +525,7 @@ class TasksApi:
) -> None:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -587,7 +587,7 @@ class TasksApi:
) -> ApiResponse[None]:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -649,7 +649,7 @@ class TasksApi:
) -> RESTResponseType:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -761,7 +761,7 @@ class TasksApi:
) -> None:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -823,7 +823,7 @@ class TasksApi:
) -> ApiResponse[None]:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -885,7 +885,7 @@ class TasksApi:
) -> RESTResponseType:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -997,7 +997,7 @@ class TasksApi:
) -> None:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -1059,7 +1059,7 @@ class TasksApi:
) -> ApiResponse[None]:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
@@ -1121,7 +1121,7 @@ class TasksApi:
) -> RESTResponseType:
"""Redirect to the tasks API root
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The redirect is a routing fact derived from the engine's subtree, decided before any handler runs, so it is the same on every method. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
Answers 307 with Location /v1/tasks/ — this address serves nothing itself. The status and the Location are the same on every method; a GET additionally carries the short HTML body a browser falls back to when it does not follow the redirect itself. A 307 preserves both the method and the body, so a client that follows redirects re-sends the request unchanged to /v1/tasks/ and nothing is lost. A client that does NOT follow redirects sees only the 307 and performs no work — address /v1/tasks/ directly and the hop disappears.
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
pkg/hanzoai/cloud/api/team_api.py
+86 -10
View File
@@ -16,8 +16,8 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
from typing import Any, Dict, List, Optional, Tuple, Union
from typing_extensions import Annotated
from pydantic import Field, StrictStr
from typing import List, Optional
from pydantic import Field, StrictBytes, StrictStr
from typing import List, Optional, Tuple, Union
from typing_extensions import Annotated
from hanzoai.cloud.models.bot_roster import BotRoster
from hanzoai.cloud.models.bot_sync import BotSync
@@ -1587,7 +1587,7 @@ class TeamApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
) -> bytearray:
"""Open the wallet page
Serves the usage-and-wallet page the Team front links to — HTML, not JSON. It is a static React build compiled into this binary, so there is no upstream to be down and no build step at request time. SESSION-GATED: without a verified team session token — bearer, else the HttpOnly account cookie — the caller gets 401 and not one byte of the page, so an anonymous browser meets a refusal rather than a shell that then fails to load anything. The page is markup only. It reads money SAME-ORIGIN from cloud's own balance and usage endpoints, which pin the org from the IAM cookie the team OAuth callback set — nothing under this path proxies a money read, so there is no second auth mechanism here to get wrong. A deployment whose page was never built answers 503 naming the missing bundle, never a blank 200.
@@ -1622,6 +1622,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "bytearray",
}
response_data = self.api_client.call_api(
*_param,
@@ -1649,7 +1650,7 @@ class TeamApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
) -> ApiResponse[bytearray]:
"""Open the wallet page
Serves the usage-and-wallet page the Team front links to — HTML, not JSON. It is a static React build compiled into this binary, so there is no upstream to be down and no build step at request time. SESSION-GATED: without a verified team session token — bearer, else the HttpOnly account cookie — the caller gets 401 and not one byte of the page, so an anonymous browser meets a refusal rather than a shell that then fails to load anything. The page is markup only. It reads money SAME-ORIGIN from cloud's own balance and usage endpoints, which pin the org from the IAM cookie the team OAuth callback set — nothing under this path proxies a money read, so there is no second auth mechanism here to get wrong. A deployment whose page was never built answers 503 naming the missing bundle, never a blank 200.
@@ -1684,6 +1685,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "bytearray",
}
response_data = self.api_client.call_api(
*_param,
@@ -1746,6 +1748,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "bytearray",
}
response_data = self.api_client.call_api(
*_param,
@@ -1783,6 +1786,13 @@ class TeamApi:
# process the body parameter
# set the HTTP header `Accept`
if 'Accept' not in _header_params:
_header_params['Accept'] = self.api_client.select_header_accept(
[
'text/html; charset=utf-8'
]
)
# authentication setting
@@ -2307,7 +2317,7 @@ class TeamApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
) -> bytearray:
"""Download a workspace file
Streams one blob's raw BYTES back — this is the read side of the workspace file store, not a JSON envelope around it. THE BLOB IS NAMED BY THE `file` QUERY PARAMETER, NOT BY :filename. The path segment is only the name a browser saves the download under; a request without ?file= is a 400 no matter what the path says. The Content-Type is derived from the STORED BYTES, never from the name: only png, jpeg, gif and webp, recognized by their magic bytes, are served inline under their true type, and everything else is served inert as application/octet-stream with an attachment disposition. Every response carries nosniff, so a file uploaded under an .svg or .html name cannot be talked into executing in a viewer's origin. Blobs are immutable, so a hit caches privately for a year. Same gate as the upload: verified token, membership of the workspace. A genuine miss, another tenant's workspace, a workspace the caller is not in, and a blob id belonging to a different workspace are ONE answer — 404 — because the physical key is org- and workspace-scoped and a foreign id is simply a key that does not exist. An unavailable backend is a 502, never an empty 200.
@@ -2348,6 +2358,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "bytearray",
}
response_data = self.api_client.call_api(
*_param,
@@ -2377,7 +2388,7 @@ class TeamApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
) -> ApiResponse[bytearray]:
"""Download a workspace file
Streams one blob's raw BYTES back — this is the read side of the workspace file store, not a JSON envelope around it. THE BLOB IS NAMED BY THE `file` QUERY PARAMETER, NOT BY :filename. The path segment is only the name a browser saves the download under; a request without ?file= is a 400 no matter what the path says. The Content-Type is derived from the STORED BYTES, never from the name: only png, jpeg, gif and webp, recognized by their magic bytes, are served inline under their true type, and everything else is served inert as application/octet-stream with an attachment disposition. Every response carries nosniff, so a file uploaded under an .svg or .html name cannot be talked into executing in a viewer's origin. Blobs are immutable, so a hit caches privately for a year. Same gate as the upload: verified token, membership of the workspace. A genuine miss, another tenant's workspace, a workspace the caller is not in, and a blob id belonging to a different workspace are ONE answer — 404 — because the physical key is org- and workspace-scoped and a foreign id is simply a key that does not exist. An unavailable backend is a 502, never an empty 200.
@@ -2418,6 +2429,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "bytearray",
}
response_data = self.api_client.call_api(
*_param,
@@ -2488,6 +2500,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "bytearray",
}
response_data = self.api_client.call_api(
*_param,
@@ -2531,6 +2544,13 @@ class TeamApi:
# process the body parameter
# set the HTTP header `Accept`
if 'Accept' not in _header_params:
_header_params['Accept'] = self.api_client.select_header_accept(
[
'application/octet-stream'
]
)
# authentication setting
@@ -4108,6 +4128,7 @@ class TeamApi:
def post_team_files_by_workspace(
self,
workspace: StrictStr,
body: Optional[Union[StrictBytes, StrictStr, Tuple[StrictStr, StrictBytes]]] = None,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -4120,13 +4141,15 @@ class TeamApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
) -> bytearray:
"""Upload a file into a workspace
Stores one file in a workspace's blob store and answers the blob id it is addressable by, as plain text — the front discards that body, it is there for a caller driving this by hand. The body is a multipart form with a `file` part, and THAT PART'S FILENAME IS THE BLOB ID: the client mints it (a uuid v4) and the server stores under it, so a part whose filename is not a uuid is refused rather than assigned one. A file over 100 MiB is 413 and an empty one is 400. The caller must hold a verified session or workspace token AND be a member of the workspace; an unknown workspace, another tenant's workspace and a workspace the caller is not in all answer the same 404, so a probe learns nothing about what exists. The stored key embeds the verified org and the workspace, so an upload cannot land in another tenant's box whatever id it names. A storage backend that is unavailable fails closed with 502 rather than reporting a write it never made.
:param workspace: (required)
:type workspace: str
:param body:
:type body: bytearray
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
timeout. It can also be a pair (tuple) of
@@ -4151,6 +4174,7 @@ class TeamApi:
_param = self._post_team_files_by_workspace_serialize(
workspace=workspace,
body=body,
_request_auth=_request_auth,
_content_type=_content_type,
_headers=_headers,
@@ -4158,6 +4182,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "bytearray",
}
response_data = self.api_client.call_api(
*_param,
@@ -4174,6 +4199,7 @@ class TeamApi:
def post_team_files_by_workspace_with_http_info(
self,
workspace: StrictStr,
body: Optional[Union[StrictBytes, StrictStr, Tuple[StrictStr, StrictBytes]]] = None,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -4186,13 +4212,15 @@ class TeamApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
) -> ApiResponse[bytearray]:
"""Upload a file into a workspace
Stores one file in a workspace's blob store and answers the blob id it is addressable by, as plain text — the front discards that body, it is there for a caller driving this by hand. The body is a multipart form with a `file` part, and THAT PART'S FILENAME IS THE BLOB ID: the client mints it (a uuid v4) and the server stores under it, so a part whose filename is not a uuid is refused rather than assigned one. A file over 100 MiB is 413 and an empty one is 400. The caller must hold a verified session or workspace token AND be a member of the workspace; an unknown workspace, another tenant's workspace and a workspace the caller is not in all answer the same 404, so a probe learns nothing about what exists. The stored key embeds the verified org and the workspace, so an upload cannot land in another tenant's box whatever id it names. A storage backend that is unavailable fails closed with 502 rather than reporting a write it never made.
:param workspace: (required)
:type workspace: str
:param body:
:type body: bytearray
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
timeout. It can also be a pair (tuple) of
@@ -4217,6 +4245,7 @@ class TeamApi:
_param = self._post_team_files_by_workspace_serialize(
workspace=workspace,
body=body,
_request_auth=_request_auth,
_content_type=_content_type,
_headers=_headers,
@@ -4224,6 +4253,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "bytearray",
}
response_data = self.api_client.call_api(
*_param,
@@ -4240,6 +4270,7 @@ class TeamApi:
def post_team_files_by_workspace_without_preload_content(
self,
workspace: StrictStr,
body: Optional[Union[StrictBytes, StrictStr, Tuple[StrictStr, StrictBytes]]] = None,
_request_timeout: Union[
None,
Annotated[StrictFloat, Field(gt=0)],
@@ -4259,6 +4290,8 @@ class TeamApi:
:param workspace: (required)
:type workspace: str
:param body:
:type body: bytearray
:param _request_timeout: timeout setting for this request. If one
number provided, it will be total request
timeout. It can also be a pair (tuple) of
@@ -4283,6 +4316,7 @@ class TeamApi:
_param = self._post_team_files_by_workspace_serialize(
workspace=workspace,
body=body,
_request_auth=_request_auth,
_content_type=_content_type,
_headers=_headers,
@@ -4290,6 +4324,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "bytearray",
}
response_data = self.api_client.call_api(
*_param,
@@ -4301,6 +4336,7 @@ class TeamApi:
def _post_team_files_by_workspace_serialize(
self,
workspace,
body,
_request_auth,
_content_type,
_headers,
@@ -4328,9 +4364,39 @@ class TeamApi:
# process the header parameters
# process the form parameters
# process the body parameter
if body is not None:
# convert to byte array if the input is a file name (str)
if isinstance(body, str):
with open(body, "rb") as _fp:
_body_params = _fp.read()
elif isinstance(body, tuple):
# drop the filename from the tuple
_body_params = body[1]
else:
_body_params = body
# set the HTTP header `Accept`
if 'Accept' not in _header_params:
_header_params['Accept'] = self.api_client.select_header_accept(
[
'text/plain; charset=utf-8'
]
)
# set the HTTP header `Content-Type`
if _content_type:
_header_params['Content-Type'] = _content_type
else:
_default_content_type = (
self.api_client.select_header_content_type(
[
'application/octet-stream'
]
)
)
if _default_content_type is not None:
_header_params['Content-Type'] = _default_content_type
# authentication setting
_auth_settings: List[str] = [
@@ -4370,7 +4436,7 @@ class TeamApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> None:
) -> CookieAck:
"""Store the session token as this browser's cookie
Writes the team session token into the HttpOnly `account-token` cookie — Secure, SameSite=Lax, whole-origin scope, thirty days — and answers {\"result\": true}. This is how the client turns the token it caught off the OAuth bounce into a credential page JS can no longer read, which IS the security property: script that cannot see the cookie cannot exfiltrate it, and every later call on the files, billing and collaborator planes authenticates from it when no bearer is sent. The token is VERIFIED — signature and expiry, against this service's own signing secret — BEFORE it is stored. Anything this service did not sign is 401 and nothing is written; persisting a caller-supplied value unchecked would be a session-fixation hole, where an attacker pins a cookie the victim's browser then presents as its own. The token may arrive as `token` in the JSON body or, when the body is absent or unparseable, from the Authorization bearer — an unreadable body is NOT an error here. The sibling DELETE clears this same cookie and signs the browser out of team only: the IAM cookie set alongside it is a different credential with its own lifetime and is left alone.
@@ -4405,6 +4471,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "CookieAck",
}
response_data = self.api_client.call_api(
*_param,
@@ -4432,7 +4499,7 @@ class TeamApi:
_content_type: Optional[StrictStr] = None,
_headers: Optional[Dict[StrictStr, Any]] = None,
_host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
) -> ApiResponse[None]:
) -> ApiResponse[CookieAck]:
"""Store the session token as this browser's cookie
Writes the team session token into the HttpOnly `account-token` cookie — Secure, SameSite=Lax, whole-origin scope, thirty days — and answers {\"result\": true}. This is how the client turns the token it caught off the OAuth bounce into a credential page JS can no longer read, which IS the security property: script that cannot see the cookie cannot exfiltrate it, and every later call on the files, billing and collaborator planes authenticates from it when no bearer is sent. The token is VERIFIED — signature and expiry, against this service's own signing secret — BEFORE it is stored. Anything this service did not sign is 401 and nothing is written; persisting a caller-supplied value unchecked would be a session-fixation hole, where an attacker pins a cookie the victim's browser then presents as its own. The token may arrive as `token` in the JSON body or, when the body is absent or unparseable, from the Authorization bearer — an unreadable body is NOT an error here. The sibling DELETE clears this same cookie and signs the browser out of team only: the IAM cookie set alongside it is a different credential with its own lifetime and is left alone.
@@ -4467,6 +4534,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "CookieAck",
}
response_data = self.api_client.call_api(
*_param,
@@ -4529,6 +4597,7 @@ class TeamApi:
)
_response_types_map: Dict[str, Optional[str]] = {
'2XX': "CookieAck",
}
response_data = self.api_client.call_api(
*_param,
@@ -4566,6 +4635,13 @@ class TeamApi:
# process the body parameter
# set the HTTP header `Accept`
if 'Accept' not in _header_params:
_header_params['Accept'] = self.api_client.select_header_accept(
[
'application/json'
]
)
# authentication setting
pkg/hanzoai/cloud/api/websearch_api.py
+3 -3
View File
@@ -1472,7 +1472,7 @@ class WebsearchApi:
) -> WebSearchResults:
"""Search the live web
Searches the live web and answers with ranked results. This is the fleet's path to what is happening RIGHT NOW — today's weather, an outage, a release that postdates any model's training. `q` is the query and `language` narrows it to a locale. The answer is `{query, number_of_results, results:[{url, title, content, engine}]}`, where `content` is the ENGINE's snippet and not the page: read a page with POST /v1/crawl. It is served in-process by a Go meta-search over keyless public engines — never a third-party search API and never a search key. The enabled engines run concurrently and their hits are merged, deduplicated by normalised URL (host and path, trailing slash and fragment dropped, query kept, so distinct queries stay distinct results) and capped at 30. Ranking is deterministic rather than scored: the first configured engine's hits lead. It fails SOFT on the engines. One that errors, times out or is served a bot-challenge page contributes zero results and never fails the call, so an empty `results` is a real answer — nothing was found — and not an outage. The array is always present, never null. A VALIDATED PRINCIPAL IS REQUIRED, and there is no tenant beyond that: the results are public web pages, identical for every caller, so nothing here is scoped and nothing here can leak across orgs. A typed op is also an MCP tool and a CLI command, and tools/call invokes it with no route and therefore no middleware — so the gate is in the handler, where every caller reaches it, rather than in a middleware only one caller passes through.
Searches the live web and answers with ranked results. This is the fleet's path to what is happening RIGHT NOW — today's weather, an outage, a release that postdates any model's training. `q` is the query and `language` narrows it to a locale. The answer is `{query, number_of_results, results:[{url, title, content, engine}]}`, where `content` is the ENGINE's snippet and not the page: read a page with POST /v1/crawl. It is served in-process by a Go meta-search over keyless public engines — never a third-party search API and never a search key. The enabled engines run concurrently and their hits are merged, deduplicated by normalised URL (host and path, trailing slash and fragment dropped, query kept, so distinct queries stay distinct results) and capped at 30. Ranking is deterministic rather than scored: the first configured engine's hits lead. It fails SOFT on the engines. One that errors, times out or is served a bot-challenge page contributes zero results and never fails the call, so an empty `results` is a real answer — nothing was found — and not an outage. The array is always present, never null. Two refusals in the order they have to be asked, both in the PREAMBLE. A typed op is also an MCP tool, a call-plane operation, a graph field and a CLI command, and every one of those invokes it with no route and therefore no middleware — so what admits a caller here is asked where every caller reaches it rather than in a middleware only one of them passes through. A VALIDATED PRINCIPAL IS REQUIRED, and there is no tenant beyond that: the results are public web pages, identical for every caller, so nothing here is scoped and nothing here can leak across orgs. THEN THE ANTI-FORGERY TOKEN, immediately before the money, because that is what it is about. This search is the SAME bought meta-search the compat endpoint runs — the engines cost, and account.Shared/meter.go bills the caller's ledger for the answer — so a page the caller never visited must not be able to spend for them by sending their browser here with a cookie they already hold. Nothing leaks; the answer is unreadable cross-origin. What moves is money. It is account's control, the one every operation in this estate asks, and it is a no-op the moment a caller PRESENTS a credential (Bearer, gateway, API key) — which is every service and console caller here — so it costs a CLI, an agent and an API client nothing. Only the ambient-cookie path is asked for the echoed token. The raw /v1/websearch/search route asks the same control on its group (see Mount), so the two addresses of one search are admitted alike.
:param web_search_query: (required)
:type web_search_query: WebSearchQuery
@@ -1539,7 +1539,7 @@ class WebsearchApi:
) -> ApiResponse[WebSearchResults]:
"""Search the live web
Searches the live web and answers with ranked results. This is the fleet's path to what is happening RIGHT NOW — today's weather, an outage, a release that postdates any model's training. `q` is the query and `language` narrows it to a locale. The answer is `{query, number_of_results, results:[{url, title, content, engine}]}`, where `content` is the ENGINE's snippet and not the page: read a page with POST /v1/crawl. It is served in-process by a Go meta-search over keyless public engines — never a third-party search API and never a search key. The enabled engines run concurrently and their hits are merged, deduplicated by normalised URL (host and path, trailing slash and fragment dropped, query kept, so distinct queries stay distinct results) and capped at 30. Ranking is deterministic rather than scored: the first configured engine's hits lead. It fails SOFT on the engines. One that errors, times out or is served a bot-challenge page contributes zero results and never fails the call, so an empty `results` is a real answer — nothing was found — and not an outage. The array is always present, never null. A VALIDATED PRINCIPAL IS REQUIRED, and there is no tenant beyond that: the results are public web pages, identical for every caller, so nothing here is scoped and nothing here can leak across orgs. A typed op is also an MCP tool and a CLI command, and tools/call invokes it with no route and therefore no middleware — so the gate is in the handler, where every caller reaches it, rather than in a middleware only one caller passes through.
Searches the live web and answers with ranked results. This is the fleet's path to what is happening RIGHT NOW — today's weather, an outage, a release that postdates any model's training. `q` is the query and `language` narrows it to a locale. The answer is `{query, number_of_results, results:[{url, title, content, engine}]}`, where `content` is the ENGINE's snippet and not the page: read a page with POST /v1/crawl. It is served in-process by a Go meta-search over keyless public engines — never a third-party search API and never a search key. The enabled engines run concurrently and their hits are merged, deduplicated by normalised URL (host and path, trailing slash and fragment dropped, query kept, so distinct queries stay distinct results) and capped at 30. Ranking is deterministic rather than scored: the first configured engine's hits lead. It fails SOFT on the engines. One that errors, times out or is served a bot-challenge page contributes zero results and never fails the call, so an empty `results` is a real answer — nothing was found — and not an outage. The array is always present, never null. Two refusals in the order they have to be asked, both in the PREAMBLE. A typed op is also an MCP tool, a call-plane operation, a graph field and a CLI command, and every one of those invokes it with no route and therefore no middleware — so what admits a caller here is asked where every caller reaches it rather than in a middleware only one of them passes through. A VALIDATED PRINCIPAL IS REQUIRED, and there is no tenant beyond that: the results are public web pages, identical for every caller, so nothing here is scoped and nothing here can leak across orgs. THEN THE ANTI-FORGERY TOKEN, immediately before the money, because that is what it is about. This search is the SAME bought meta-search the compat endpoint runs — the engines cost, and account.Shared/meter.go bills the caller's ledger for the answer — so a page the caller never visited must not be able to spend for them by sending their browser here with a cookie they already hold. Nothing leaks; the answer is unreadable cross-origin. What moves is money. It is account's control, the one every operation in this estate asks, and it is a no-op the moment a caller PRESENTS a credential (Bearer, gateway, API key) — which is every service and console caller here — so it costs a CLI, an agent and an API client nothing. Only the ambient-cookie path is asked for the echoed token. The raw /v1/websearch/search route asks the same control on its group (see Mount), so the two addresses of one search are admitted alike.
:param web_search_query: (required)
:type web_search_query: WebSearchQuery
@@ -1606,7 +1606,7 @@ class WebsearchApi:
) -> RESTResponseType:
"""Search the live web
Searches the live web and answers with ranked results. This is the fleet's path to what is happening RIGHT NOW — today's weather, an outage, a release that postdates any model's training. `q` is the query and `language` narrows it to a locale. The answer is `{query, number_of_results, results:[{url, title, content, engine}]}`, where `content` is the ENGINE's snippet and not the page: read a page with POST /v1/crawl. It is served in-process by a Go meta-search over keyless public engines — never a third-party search API and never a search key. The enabled engines run concurrently and their hits are merged, deduplicated by normalised URL (host and path, trailing slash and fragment dropped, query kept, so distinct queries stay distinct results) and capped at 30. Ranking is deterministic rather than scored: the first configured engine's hits lead. It fails SOFT on the engines. One that errors, times out or is served a bot-challenge page contributes zero results and never fails the call, so an empty `results` is a real answer — nothing was found — and not an outage. The array is always present, never null. A VALIDATED PRINCIPAL IS REQUIRED, and there is no tenant beyond that: the results are public web pages, identical for every caller, so nothing here is scoped and nothing here can leak across orgs. A typed op is also an MCP tool and a CLI command, and tools/call invokes it with no route and therefore no middleware — so the gate is in the handler, where every caller reaches it, rather than in a middleware only one caller passes through.
Searches the live web and answers with ranked results. This is the fleet's path to what is happening RIGHT NOW — today's weather, an outage, a release that postdates any model's training. `q` is the query and `language` narrows it to a locale. The answer is `{query, number_of_results, results:[{url, title, content, engine}]}`, where `content` is the ENGINE's snippet and not the page: read a page with POST /v1/crawl. It is served in-process by a Go meta-search over keyless public engines — never a third-party search API and never a search key. The enabled engines run concurrently and their hits are merged, deduplicated by normalised URL (host and path, trailing slash and fragment dropped, query kept, so distinct queries stay distinct results) and capped at 30. Ranking is deterministic rather than scored: the first configured engine's hits lead. It fails SOFT on the engines. One that errors, times out or is served a bot-challenge page contributes zero results and never fails the call, so an empty `results` is a real answer — nothing was found — and not an outage. The array is always present, never null. Two refusals in the order they have to be asked, both in the PREAMBLE. A typed op is also an MCP tool, a call-plane operation, a graph field and a CLI command, and every one of those invokes it with no route and therefore no middleware — so what admits a caller here is asked where every caller reaches it rather than in a middleware only one of them passes through. A VALIDATED PRINCIPAL IS REQUIRED, and there is no tenant beyond that: the results are public web pages, identical for every caller, so nothing here is scoped and nothing here can leak across orgs. THEN THE ANTI-FORGERY TOKEN, immediately before the money, because that is what it is about. This search is the SAME bought meta-search the compat endpoint runs — the engines cost, and account.Shared/meter.go bills the caller's ledger for the answer — so a page the caller never visited must not be able to spend for them by sending their browser here with a cookie they already hold. Nothing leaks; the answer is unreadable cross-origin. What moves is money. It is account's control, the one every operation in this estate asks, and it is a no-op the moment a caller PRESENTS a credential (Bearer, gateway, API key) — which is every service and console caller here — so it costs a CLI, an agent and an API client nothing. Only the ambient-cookie path is asked for the echoed token. The raw /v1/websearch/search route asks the same control on its group (see Mount), so the two addresses of one search are admitted alike.
:param web_search_query: (required)
:type web_search_query: WebSearchQuery
pkg/hanzoai/cloud/models/__init__.py
+4
View File
@@ -68,6 +68,7 @@ from hanzoai.cloud.models.app_view import AppView
from hanzoai.cloud.models.appearance import Appearance
from hanzoai.cloud.models.application import Application
from hanzoai.cloud.models.application_list import ApplicationList
from hanzoai.cloud.models.applied_resource import AppliedResource
from hanzoai.cloud.models.apply_request import ApplyRequest
from hanzoai.cloud.models.approve_pairing_in import ApprovePairingIn
from hanzoai.cloud.models.argo_app import ArgoApp
@@ -1889,6 +1890,8 @@ from hanzoai.cloud.models.readme_json import ReadmeJSON
from hanzoai.cloud.models.receipt import Receipt
from hanzoai.cloud.models.recharge import Recharge
from hanzoai.cloud.models.recharged import Recharged
from hanzoai.cloud.models.reconcile_report import ReconcileReport
from hanzoai.cloud.models.reconcile_source import ReconcileSource
from hanzoai.cloud.models.record import Record
from hanzoai.cloud.models.record_in import RecordIn
from hanzoai.cloud.models.record_list import RecordList
@@ -2109,6 +2112,7 @@ from hanzoai.cloud.models.sequences import Sequences
from hanzoai.cloud.models.series_line import SeriesLine
from hanzoai.cloud.models.series_point import SeriesPoint
from hanzoai.cloud.models.session_detail import SessionDetail
from hanzoai.cloud.models.session_ended import SessionEnded
from hanzoai.cloud.models.session_list import SessionList
from hanzoai.cloud.models.session_user import SessionUser
from hanzoai.cloud.models.session_view import SessionView
pkg/hanzoai/cloud/models/applied_resource.py
+91
View File
@@ -0,0 +1,91 @@
# coding: utf-8
"""
Hanzo Cloud API
The Hanzo Cloud API as a customer calls it: every operation under /v1/ except the operator's admin product, relay routes, legacy spellings and capabilities still reached by flag. Tagged by product: the first path segment after /v1/.
The version of the OpenAPI document: v1
Generated by OpenAPI Generator (https://openapi-generator.tech)
Do not edit the class manually.
""" # noqa: E501
from __future__ import annotations
import pprint
import re # noqa: F401
import json
from pydantic import BaseModel, ConfigDict, Field, StrictStr
from typing import Any, ClassVar, Dict, List, Optional
from typing import Optional, Set
from typing_extensions import Self
class AppliedResource(BaseModel):
"""
AppliedResource
""" # noqa: E501
message: Optional[StrictStr] = Field(default=None, description="Message is the engine's own sentence about this object — the apiserver's refusal on a failure, and typically empty on success. It is for a human reading a failed run, not a value to branch on.")
resource: Optional[StrictStr] = Field(default=None, description="Resource identifies the object as group/version/kind/namespace/name, the engine's own key. It is stable across runs, so two reports can be diffed on it.")
status: Optional[StrictStr] = Field(default=None, description="Status is what happened to this object, from the engine's closed vocabulary: `Synced` (applied), `Pruned` (deleted because the source no longer declares it), `SyncFailed` (refused — read Message) and `PruneSkipped` (deletion was declined). It is the per-object detail behind the report's counts.")
__properties: ClassVar[List[str]] = ["message", "resource", "status"]
model_config = ConfigDict(
populate_by_name=True,
validate_assignment=True,
protected_namespaces=(),
)
def to_str(self) -> str:
"""Returns the string representation of the model using alias"""
return pprint.pformat(self.model_dump(by_alias=True))
def to_json(self) -> str:
"""Returns the JSON representation of the model using alias"""
# TODO: pydantic v2: use .model_dump_json(by_alias=True, exclude_unset=True) instead
return json.dumps(self.to_dict())
@classmethod
def from_json(cls, json_str: str) -> Optional[Self]:
"""Create an instance of AppliedResource from a JSON string"""
return cls.from_dict(json.loads(json_str))
def to_dict(self) -> Dict[str, Any]:
"""Return the dictionary representation of the model using alias.
This has the following differences from calling pydantic's
`self.model_dump(by_alias=True)`:
* `None` is only added to the output dict for nullable fields that
were set at model initialization. Other fields with value `None`
are ignored.
"""
excluded_fields: Set[str] = set([
])
_dict = self.model_dump(
by_alias=True,
exclude=excluded_fields,
exclude_none=True,
)
return _dict
@classmethod
def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
"""Create an instance of AppliedResource from a dict"""
if obj is None:
return None
if not isinstance(obj, dict):
return cls.model_validate(obj)
_obj = cls.model_validate({
"message": obj.get("message"),
"resource": obj.get("resource"),
"status": obj.get("status")
})
return _obj
pkg/hanzoai/cloud/models/d1_query.py
+3 -3
View File
@@ -17,7 +17,7 @@ import pprint
import re # noqa: F401
import json
from pydantic import BaseModel, ConfigDict, StrictStr
from pydantic import BaseModel, ConfigDict, Field, StrictStr
from typing import Any, ClassVar, Dict, List, Optional
from typing import Optional, Set
from typing_extensions import Self
@@ -26,8 +26,8 @@ class D1Query(BaseModel):
"""
D1Query
""" # noqa: E501
params: Optional[List[Any]] = None
sql: Optional[StrictStr] = None
params: Optional[List[Any]] = Field(default=None, description="Params are the statement's bound values, in the order its `?` placeholders appear — a string, a number, a boolean or null, whatever the column takes. Absent means the statement carries no placeholders; bind values here rather than interpolating them into the statement.")
sql: Optional[StrictStr] = Field(default=None, description="SQL is the statement to run. Blank (or absent) is refused before anything reaches D1.")
__properties: ClassVar[List[str]] = ["params", "sql"]
model_config = ConfigDict(
pkg/hanzoai/cloud/models/listing.py
+2 -2
View File
@@ -26,8 +26,8 @@ class Listing(BaseModel):
"""
Listing
""" # noqa: E501
last_modified: Optional[StrictStr] = Field(default=None, alias="lastModified")
name: Optional[StrictStr] = None
last_modified: Optional[StrictStr] = Field(default=None, description="LastModified is when the BYTES last changed, as RFC 3339 in UTC to the second — `2026-01-02T03:04:05Z`, the sandbox's own `date -u -r` on the file. It is an mtime and not a creation time, so a file a later run overwrote carries that run's clock. Never empty: a row exists only because `find` stat-ed the file.", alias="lastModified")
name: Optional[StrictStr] = Field(default=None, description="Name is the file's IDENTIFIER, `{session_id}/{fileId}` whole — never the bare filename, and never URL-escaped. It is exactly what GET /v1/exec/download takes after its prefix, and hanzo.chat matches it as a PREFIX (`name.startsWith(session + \"/\")`) to decide which rows belong to a session it is holding. `fileId` is the path RELATIVE to the session's artifact directory, so it carries `/` for anything the run wrote in a sub-directory.")
__properties: ClassVar[List[str]] = ["lastModified", "name"]
model_config = ConfigDict(
pkg/hanzoai/cloud/models/object_item.py
+1 -1
View File
@@ -26,7 +26,7 @@ class ObjectItem(BaseModel):
"""
ObjectItem
""" # noqa: E501
etag: Optional[StrictStr] = None
etag: Optional[StrictStr] = Field(default=None, description="ETag is the store's entity tag for the bytes currently at this key, with the quotes the store wraps it in stripped. It is an opaque VERSION and not a checksum to verify against: a single-part upload's tag happens to be the MD5 of the content and a multipart upload's is not, and nothing here says which this was. Compare two reads of one key to learn whether the object changed; absent for a folder entry, and for an object the store reports none for.")
is_dir: Optional[StrictBool] = Field(default=None, description="true for a folder (common prefix)", alias="isDir")
key: Optional[StrictStr] = Field(default=None, description="key RELATIVE to the requested prefix")
last_modified: Optional[StrictInt] = Field(default=None, description="unix seconds (0 for a folder)", alias="lastModified")
pkg/hanzoai/cloud/models/presign_response.py
+1 -1
View File
@@ -27,7 +27,7 @@ class PresignResponse(BaseModel):
PresignResponse
""" # noqa: E501
expires_in: Optional[StrictInt] = Field(default=None, description="seconds until the URL expires", alias="expiresIn")
key: Optional[StrictStr] = None
key: Optional[StrictStr] = Field(default=None, description="Key is the object key the URL was signed for, relative to the bucket root and path-cleaned — so it is what the store will actually read or write, which is not always the string the caller sent. The signature covers this one bucket and this one key: a URL minted here reaches nothing else.")
method: Optional[StrictStr] = Field(default=None, description="\"PUT\" (upload) or \"GET\" (download)")
url: Optional[StrictStr] = Field(default=None, description="presigned URL the browser follows directly")
__properties: ClassVar[List[str]] = ["expiresIn", "key", "method", "url"]
pkg/hanzoai/cloud/models/reconcile_report.py
+115
View File
@@ -0,0 +1,115 @@
# coding: utf-8
"""
Hanzo Cloud API
The Hanzo Cloud API as a customer calls it: every operation under /v1/ except the operator's admin product, relay routes, legacy spellings and capabilities still reached by flag. Tagged by product: the first path segment after /v1/.
The version of the OpenAPI document: v1
Generated by OpenAPI Generator (https://openapi-generator.tech)
Do not edit the class manually.
""" # noqa: E501
from __future__ import annotations
import pprint
import re # noqa: F401
import json
from pydantic import BaseModel, ConfigDict, Field, StrictBool, StrictInt, StrictStr
from typing import Any, ClassVar, Dict, List, Optional
from hanzoai.cloud.models.applied_resource import AppliedResource
from hanzoai.cloud.models.reconcile_source import ReconcileSource
from typing import Optional, Set
from typing_extensions import Self
class ReconcileReport(BaseModel):
"""
ReconcileReport
""" # noqa: E501
declared: Optional[StrictInt] = Field(default=None, description="Declared is how many objects the rendered source declares — the denominator the three outcome counts below are read against. Zero means the render produced nothing, which trips the prune fuse rather than sweeping the fleet.")
failed: Optional[StrictInt] = Field(default=None, description="Failed is how many objects the apply could not reconcile. Non-zero is a PARTIAL run reported at 200: the engine applied what it could and each failure names itself in Results, so a caller reads this number rather than the status code to learn whether the fleet matches the source.")
instance: Optional[StrictStr] = Field(default=None, description="Instance is the tracking id this run stamps on everything it manages, so a later run can tell the objects it owns from objects another instance declares. DEPLOY_ENGINE_INSTANCE names it; the default is `universe`.")
prune: Optional[StrictBool] = Field(default=None, description="Prune reports whether DELETION was enabled for this run. False means an object the source no longer declares was left alone rather than removed, so a zero Pruned below means \"nothing to delete\" only when this is true.")
pruned: Optional[StrictInt] = Field(default=None, description="Pruned is how many live objects this run DELETED because the source no longer declares them. Always 0 when Prune is false.")
results: Optional[List[AppliedResource]] = Field(default=None, description="Results is one entry per object the run acted on, in the order the engine applied them. Empty (never null) when the run reconciled nothing.")
revision: Optional[StrictStr] = Field(default=None, description="Revision is the source commit this run applied, as the source resolved it — a git commit SHA, not an image tag. It is what an operator cites when asking what the cluster was last made to match.")
source: Optional[ReconcileSource] = Field(default=None, description="Source is the git coordinate the run rendered. It is this deployment's own configuration echoed back, never a request parameter, and it is reported so a reader of the answer knows WHICH tree the revision names.")
synced: Optional[StrictInt] = Field(default=None, description="Synced is how many objects the run applied successfully.")
__properties: ClassVar[List[str]] = ["declared", "failed", "instance", "prune", "pruned", "results", "revision", "source", "synced"]
model_config = ConfigDict(
populate_by_name=True,
validate_assignment=True,
protected_namespaces=(),
)
def to_str(self) -> str:
"""Returns the string representation of the model using alias"""
return pprint.pformat(self.model_dump(by_alias=True))
def to_json(self) -> str:
"""Returns the JSON representation of the model using alias"""
# TODO: pydantic v2: use .model_dump_json(by_alias=True, exclude_unset=True) instead
return json.dumps(self.to_dict())
@classmethod
def from_json(cls, json_str: str) -> Optional[Self]:
"""Create an instance of ReconcileReport from a JSON string"""
return cls.from_dict(json.loads(json_str))
def to_dict(self) -> Dict[str, Any]:
"""Return the dictionary representation of the model using alias.
This has the following differences from calling pydantic's
`self.model_dump(by_alias=True)`:
* `None` is only added to the output dict for nullable fields that
were set at model initialization. Other fields with value `None`
are ignored.
"""
excluded_fields: Set[str] = set([
])
_dict = self.model_dump(
by_alias=True,
exclude=excluded_fields,
exclude_none=True,
)
# override the default output from pydantic by calling `to_dict()` of each item in results (list)
_items = []
if self.results:
for _item_results in self.results:
if _item_results:
_items.append(_item_results.to_dict())
_dict['results'] = _items
# override the default output from pydantic by calling `to_dict()` of source
if self.source:
_dict['source'] = self.source.to_dict()
return _dict
@classmethod
def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
"""Create an instance of ReconcileReport from a dict"""
if obj is None:
return None
if not isinstance(obj, dict):
return cls.model_validate(obj)
_obj = cls.model_validate({
"declared": obj.get("declared"),
"failed": obj.get("failed"),
"instance": obj.get("instance"),
"prune": obj.get("prune"),
"pruned": obj.get("pruned"),
"results": [AppliedResource.from_dict(_item) for _item in obj["results"]] if obj.get("results") is not None else None,
"revision": obj.get("revision"),
"source": ReconcileSource.from_dict(obj["source"]) if obj.get("source") is not None else None,
"synced": obj.get("synced")
})
return _obj
pkg/hanzoai/cloud/models/reconcile_source.py
+91
View File
@@ -0,0 +1,91 @@
# coding: utf-8
"""
Hanzo Cloud API
The Hanzo Cloud API as a customer calls it: every operation under /v1/ except the operator's admin product, relay routes, legacy spellings and capabilities still reached by flag. Tagged by product: the first path segment after /v1/.
The version of the OpenAPI document: v1
Generated by OpenAPI Generator (https://openapi-generator.tech)
Do not edit the class manually.
""" # noqa: E501
from __future__ import annotations
import pprint
import re # noqa: F401
import json
from pydantic import BaseModel, ConfigDict, Field, StrictStr
from typing import Any, ClassVar, Dict, List, Optional
from typing import Optional, Set
from typing_extensions import Self
class ReconcileSource(BaseModel):
"""
ReconcileSource
""" # noqa: E501
path: Optional[StrictStr] = Field(default=None, description="Path is the directory WITHIN the repository that is rendered — everything outside it is not this plane's desired state and is never applied.")
ref: Optional[StrictStr] = Field(default=None, description="Ref is the branch or tag the revision was resolved from.")
repo: Optional[StrictStr] = Field(default=None, description="Repo is the clone URL of the repository holding the desired state.")
__properties: ClassVar[List[str]] = ["path", "ref", "repo"]
model_config = ConfigDict(
populate_by_name=True,
validate_assignment=True,
protected_namespaces=(),
)
def to_str(self) -> str:
"""Returns the string representation of the model using alias"""
return pprint.pformat(self.model_dump(by_alias=True))
def to_json(self) -> str:
"""Returns the JSON representation of the model using alias"""
# TODO: pydantic v2: use .model_dump_json(by_alias=True, exclude_unset=True) instead
return json.dumps(self.to_dict())
@classmethod
def from_json(cls, json_str: str) -> Optional[Self]:
"""Create an instance of ReconcileSource from a JSON string"""
return cls.from_dict(json.loads(json_str))
def to_dict(self) -> Dict[str, Any]:
"""Return the dictionary representation of the model using alias.
This has the following differences from calling pydantic's
`self.model_dump(by_alias=True)`:
* `None` is only added to the output dict for nullable fields that
were set at model initialization. Other fields with value `None`
are ignored.
"""
excluded_fields: Set[str] = set([
])
_dict = self.model_dump(
by_alias=True,
exclude=excluded_fields,
exclude_none=True,
)
return _dict
@classmethod
def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
"""Create an instance of ReconcileSource from a dict"""
if obj is None:
return None
if not isinstance(obj, dict):
return cls.model_validate(obj)
_obj = cls.model_validate({
"path": obj.get("path"),
"ref": obj.get("ref"),
"repo": obj.get("repo")
})
return _obj
pkg/hanzoai/cloud/models/session_ended.py
+89
View File
@@ -0,0 +1,89 @@
# coding: utf-8
"""
Hanzo Cloud API
The Hanzo Cloud API as a customer calls it: every operation under /v1/ except the operator's admin product, relay routes, legacy spellings and capabilities still reached by flag. Tagged by product: the first path segment after /v1/.
The version of the OpenAPI document: v1
Generated by OpenAPI Generator (https://openapi-generator.tech)
Do not edit the class manually.
""" # noqa: E501
from __future__ import annotations
import pprint
import re # noqa: F401
import json
from pydantic import BaseModel, ConfigDict, Field, StrictBool, StrictStr
from typing import Any, ClassVar, Dict, List, Optional
from typing import Optional, Set
from typing_extensions import Self
class SessionEnded(BaseModel):
"""
SessionEnded
""" # noqa: E501
logged_in: Optional[StrictBool] = Field(default=None, description="LoggedIn is always false — this is the answer to having just signed out, so it states the resulting session state rather than reporting the request's outcome. It is not omitempty: false is the whole answer.", alias="loggedIn")
login_url: Optional[StrictStr] = Field(default=None, description="LoginURL is where to sign in again. Always present, because a caller that has just signed out is exactly the caller who needs it.", alias="loginUrl")
__properties: ClassVar[List[str]] = ["loggedIn", "loginUrl"]
model_config = ConfigDict(
populate_by_name=True,
validate_assignment=True,
protected_namespaces=(),
)
def to_str(self) -> str:
"""Returns the string representation of the model using alias"""
return pprint.pformat(self.model_dump(by_alias=True))
def to_json(self) -> str:
"""Returns the JSON representation of the model using alias"""
# TODO: pydantic v2: use .model_dump_json(by_alias=True, exclude_unset=True) instead
return json.dumps(self.to_dict())
@classmethod
def from_json(cls, json_str: str) -> Optional[Self]:
"""Create an instance of SessionEnded from a JSON string"""
return cls.from_dict(json.loads(json_str))
def to_dict(self) -> Dict[str, Any]:
"""Return the dictionary representation of the model using alias.
This has the following differences from calling pydantic's
`self.model_dump(by_alias=True)`:
* `None` is only added to the output dict for nullable fields that
were set at model initialization. Other fields with value `None`
are ignored.
"""
excluded_fields: Set[str] = set([
])
_dict = self.model_dump(
by_alias=True,
exclude=excluded_fields,
exclude_none=True,
)
return _dict
@classmethod
def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
"""Create an instance of SessionEnded from a dict"""
if obj is None:
return None
if not isinstance(obj, dict):
return cls.model_validate(obj)
_obj = cls.model_validate({
"loggedIn": obj.get("loggedIn"),
"loginUrl": obj.get("loginUrl")
})
return _obj
pkg/hanzoai/cloud/models/user_enablement_item.py
+6 -6
View File
@@ -26,12 +26,12 @@ class UserEnablementItem(BaseModel):
"""
UserEnablementItem
""" # noqa: E501
can_opt_in: Optional[StrictBool] = Field(default=None, description="beta && not yet opted in", alias="canOptIn")
effective: Optional[StrictBool] = Field(default=None, description="visible to the caller's org")
id: Optional[StrictStr] = None
kind: Optional[StrictStr] = None
opted_in: Optional[StrictBool] = Field(default=None, description="caller's org on the beta list", alias="optedIn")
state: Optional[StrictStr] = Field(default=None, description="off|beta|ga")
can_opt_in: Optional[StrictBool] = Field(default=None, description="CanOptIn is whether POST /v1/pricing/enablement/optin would do anything here: the item is in beta and this org is not on its list yet. False for a caller with no validated org, who has no org to enrol.", alias="canOptIn")
effective: Optional[StrictBool] = Field(default=None, description="Effective is whether the caller's org may use the item right now, which is the field to branch on: true for any ga item, for a beta this org holds, and never for an off one.")
id: Optional[StrictStr] = Field(default=None, description="ID is the item within that namespace — a model id, a provider name, or a feature key.")
kind: Optional[StrictStr] = Field(default=None, description="Kind is the namespace the id lives in: \"model\", \"provider\" or \"feature\".")
opted_in: Optional[StrictBool] = Field(default=None, description="OptedIn is whether the caller's org is on this item's beta grant list. It can be true on an \"off\" item — the list survives the kill switch and is simply ignored while it is thrown — so it does not imply Effective.", alias="optedIn")
state: Optional[StrictStr] = Field(default=None, description="State is the item's GLOBAL availability — \"off\", \"beta\" or \"ga\" — which is the operator's setting and not this caller's answer. Effective is that.")
__properties: ClassVar[List[str]] = ["canOptIn", "effective", "id", "kind", "optedIn", "state"]
model_config = ConfigDict(
pkg/hanzoai/cloud/models/worker_script_put.py
+4 -4
View File
@@ -27,10 +27,10 @@ class WorkerScriptPut(BaseModel):
WorkerScriptPut
""" # noqa: E501
bindings: Optional[Any] = None
compatibility_date: Optional[StrictStr] = Field(default=None, alias="compatibilityDate")
compatibility_flags: Optional[List[StrictStr]] = Field(default=None, alias="compatibilityFlags")
main_module: Optional[StrictStr] = Field(default=None, alias="mainModule")
script: Optional[StrictStr] = None
compatibility_date: Optional[StrictStr] = Field(default=None, description="CompatibilityDate pins which Workers runtime behaviour the script runs under, as a plain calendar date (\"2024-01-01\"). Absent leaves the account's own default in force.", alias="compatibilityDate")
compatibility_flags: Optional[List[StrictStr]] = Field(default=None, description="CompatibilityFlags turn individual runtime behaviours on or off around that date (\"nodejs_compat\"), in Cloudflare's own flag vocabulary. Absent means the date alone decides.", alias="compatibilityFlags")
main_module: Optional[StrictStr] = Field(default=None, description="MainModule is the module file the runtime starts at. Absent means \"worker.js\".", alias="mainModule")
script: Optional[StrictStr] = Field(default=None, description="Script means two things on this route, and the document says so in both places it appears: the PATH segment names the Worker to publish, and the BODY field carries that Worker's ES-module source — the code itself, never a name or a URL. A blank or absent source is refused; there is no empty Worker.")
__properties: ClassVar[List[str]] = ["bindings", "compatibilityDate", "compatibilityFlags", "mainModule", "script"]
model_config = ConfigDict(