volcano-sdk 0.9.4 → 0.10.0

data/lib/volcano/generated/lib/volcano-generated/api/frontends_api.rb

@@ -20,7 +20,7 @@ module Volcano::Generated
       @api_client = api_client
     end
     # Create a new frontend deployment
-    # Creates and deploys a frontend for the project. If a frontend with the same name already exists in the project, this operation updates that frontend using the uploaded archive and starts a new deployment. A deployment that starts immediately returns `status: provisioning`, then transitions to `active`, `degraded`, or `failed`. If another deployment is running, the response preserves the frontend's current status and exposes the queued deployment through `pending_deployment_id`. Existing frontend traffic continues to use an available runtime while the new deployment builds and provisions. Each deployment publishes its own static assets before the runtimes switch to its build, and the live build's assets keep serving until the new deployment is live, so a page loaded mid-deployment resolves its assets whichever build served it. A failed redeploy puts the runtimes back on the build they were running, leaves the frontend `active` on the previous deployment, and records the attempted deployment as failed. `degraded` means the runtime remains available but edge synchronization requires recovery; Volcano retries the edge step without rebuilding. Only one deployment may run for a given frontend, while independent frontends and projects can deploy concurrently. For monorepos, provide `app_root` as a relative path from the uploaded archive root to the Next.js app that should be built. Omit it for single-app archives. Supported frontend environments are Next.js 15.x and 16.x with Node.js 22.x or 24.x. The Node.js runtime is inferred from `package.json` `engines.node`; if omitted, Volcano uses Node.js 22.x. The selected Node.js family must also satisfy the installed Next.js package's `engines.node` constraint. Volcano tests Next 15.5.25 (`^18.18.0 || ^19.8.0 || >=20.0.0`) and Next 16.3.4 (`>=20.9.0`). Source archive size is enforced by the API with `SOURCE_ARCHIVE_SIZE_LIMIT_MB`; the CLI does not apply its own source archive size limit. After the final container images are built, the publish build enforces `LAMBDA_TARGET_CONTAINER_SIZE_LIMIT_MB` before pushing. This operation is limited by plan-based frontend deployment quotas (`FREE_FRONTEND_DEPLOYMENTS`, `PRO_FRONTEND_DEPLOYMENTS`). Each project can contain up to 10,000 frontends regardless of plan. 
+    # Creates and deploys a frontend for the project. If a frontend with the same name already exists in the project, this operation updates that frontend using the uploaded archive and starts a new deployment. A deployment that starts immediately returns `status: provisioning`, then transitions to `active`, `degraded`, or `failed`. If another deployment is running, the response preserves the frontend's current status and exposes the queued deployment through `pending_deployment_id`. Existing frontend traffic continues to use an available runtime while the new deployment builds and provisions. Each deployment publishes its own static assets before the runtimes switch to its build, and the live build's assets keep serving until the new deployment is live, so a page loaded mid-deployment resolves its assets whichever build served it. A failed redeploy puts the runtimes back on the build they were running, leaves the frontend `active` on the previous deployment, and records the attempted deployment as failed. `degraded` means the runtime remains available but edge synchronization requires recovery; Volcano retries the edge step without rebuilding. Only one deployment may run for a given frontend, while independent frontends and projects can deploy concurrently. For monorepos, provide `app_root` as a relative path from the uploaded archive root to the Next.js app that should be built. Omit it for single-app archives. Supported frontend environments are Next.js 15.x and 16.x with Node.js 22.x or 24.x. The Node.js runtime is inferred from `package.json` `engines.node`; if omitted, Volcano uses Node.js 22.x. The selected Node.js family must also satisfy the installed Next.js package's `engines.node` constraint. Volcano tests Next 15.5.25 (`^18.18.0 || ^19.8.0 || >=20.0.0`) and Next 16.3.5 (`>=20.9.0`). Source archive size is enforced by the API with `SOURCE_ARCHIVE_SIZE_LIMIT_MB`; the CLI does not apply its own source archive size limit. After the final container images are built, the publish build enforces `LAMBDA_TARGET_CONTAINER_SIZE_LIMIT_MB` before pushing. This operation is limited by plan-based frontend deployment quotas (`FREE_FRONTEND_DEPLOYMENTS`, `PRO_FRONTEND_DEPLOYMENTS`). Each project can contain up to 10,000 frontends regardless of plan. 
     # @param id [String] Project ID
     # @param name [String] DNS-safe frontend name
     # @param archive [File] ZIP or tar.gz archive of the frontend project directory or monorepo workspace root. The API enforces SOURCE_ARCHIVE_SIZE_LIMIT_MB and stores a normalized tar.gz archive.
@@ -34,7 +34,7 @@ module Volcano::Generated
     end
 
     # Create a new frontend deployment
-    # Creates and deploys a frontend for the project. If a frontend with the same name already exists in the project, this operation updates that frontend using the uploaded archive and starts a new deployment. A deployment that starts immediately returns `status: provisioning`, then transitions to `active`, `degraded`, or `failed`. If another deployment is running, the response preserves the frontend's current status and exposes the queued deployment through `pending_deployment_id`. Existing frontend traffic continues to use an available runtime while the new deployment builds and provisions. Each deployment publishes its own static assets before the runtimes switch to its build, and the live build's assets keep serving until the new deployment is live, so a page loaded mid-deployment resolves its assets whichever build served it. A failed redeploy puts the runtimes back on the build they were running, leaves the frontend `active` on the previous deployment, and records the attempted deployment as failed. `degraded` means the runtime remains available but edge synchronization requires recovery; Volcano retries the edge step without rebuilding. Only one deployment may run for a given frontend, while independent frontends and projects can deploy concurrently. For monorepos, provide `app_root` as a relative path from the uploaded archive root to the Next.js app that should be built. Omit it for single-app archives. Supported frontend environments are Next.js 15.x and 16.x with Node.js 22.x or 24.x. The Node.js runtime is inferred from `package.json` `engines.node`; if omitted, Volcano uses Node.js 22.x. The selected Node.js family must also satisfy the installed Next.js package's `engines.node` constraint. Volcano tests Next 15.5.25 (`^18.18.0 || ^19.8.0 || >=20.0.0`) and Next 16.3.4 (`>=20.9.0`). Source archive size is enforced by the API with `SOURCE_ARCHIVE_SIZE_LIMIT_MB`; the CLI does not apply its own source archive size limit. After the final container images are built, the publish build enforces `LAMBDA_TARGET_CONTAINER_SIZE_LIMIT_MB` before pushing. This operation is limited by plan-based frontend deployment quotas (`FREE_FRONTEND_DEPLOYMENTS`, `PRO_FRONTEND_DEPLOYMENTS`). Each project can contain up to 10,000 frontends regardless of plan. 
+    # Creates and deploys a frontend for the project. If a frontend with the same name already exists in the project, this operation updates that frontend using the uploaded archive and starts a new deployment. A deployment that starts immediately returns `status: provisioning`, then transitions to `active`, `degraded`, or `failed`. If another deployment is running, the response preserves the frontend's current status and exposes the queued deployment through `pending_deployment_id`. Existing frontend traffic continues to use an available runtime while the new deployment builds and provisions. Each deployment publishes its own static assets before the runtimes switch to its build, and the live build's assets keep serving until the new deployment is live, so a page loaded mid-deployment resolves its assets whichever build served it. A failed redeploy puts the runtimes back on the build they were running, leaves the frontend `active` on the previous deployment, and records the attempted deployment as failed. `degraded` means the runtime remains available but edge synchronization requires recovery; Volcano retries the edge step without rebuilding. Only one deployment may run for a given frontend, while independent frontends and projects can deploy concurrently. For monorepos, provide `app_root` as a relative path from the uploaded archive root to the Next.js app that should be built. Omit it for single-app archives. Supported frontend environments are Next.js 15.x and 16.x with Node.js 22.x or 24.x. The Node.js runtime is inferred from `package.json` `engines.node`; if omitted, Volcano uses Node.js 22.x. The selected Node.js family must also satisfy the installed Next.js package's `engines.node` constraint. Volcano tests Next 15.5.25 (`^18.18.0 || ^19.8.0 || >=20.0.0`) and Next 16.3.5 (`>=20.9.0`). Source archive size is enforced by the API with `SOURCE_ARCHIVE_SIZE_LIMIT_MB`; the CLI does not apply its own source archive size limit. After the final container images are built, the publish build enforces `LAMBDA_TARGET_CONTAINER_SIZE_LIMIT_MB` before pushing. This operation is limited by plan-based frontend deployment quotas (`FREE_FRONTEND_DEPLOYMENTS`, `PRO_FRONTEND_DEPLOYMENTS`). Each project can contain up to 10,000 frontends regardless of plan. 
     # @param id [String] Project ID
     # @param name [String] DNS-safe frontend name
     # @param archive [File] ZIP or tar.gz archive of the frontend project directory or monorepo workspace root. The API enforces SOURCE_ARCHIVE_SIZE_LIMIT_MB and stores a normalized tar.gz archive.

data/lib/volcano/generated/lib/volcano-generated/api/functions_api.rb

@@ -27,10 +27,12 @@ module Volcano::Generated
     # @param runtime [String] Runtime environment. Required. - Node.js: nodejs22.x, nodejs24.x - Python: python3.10, python3.11, python3.12, python3.13, python3.14 - Ruby: ruby3.3, ruby3.4, ruby4.0 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :handler The name of the function to invoke. Defaults to \\\"handler\\\" if not specified. Your code must export/define a function with this name: - Node.js: exports.handler (in index.js) - Python: def handler() (in main.py) - Ruby: def handler() (in main.rb)  (default to 'handler')
-    # @option opts [Boolean] :is_public Whether the function can be reached through public invocation ingress. (default to false)
+    # @option opts [Boolean] :is_public Whether the function can be reached through public invocation ingress. Omit it to keep the function's current visibility; a new function starts private. 
     # @option opts [FunctionInvocationMode] :invocation_mode 
     # @option opts [FunctionHTTPAuthMode] :http_auth_mode 
     # @option opts [String] :openapi_spec JSON-encoded OpenAPI 3.0 or 3.1 metadata for an HTTP-mode function.
+    # @option opts [String] :variable_scope Which project variables this function receives. `all` (the default) gives it only project variables marked `shared: true`; `scoped` gives it only the variables it selects. Omitting this leaves an existing function's scope unchanged. 
+    # @option opts [String] :variables JSON-encoded array of project variable names this function requires, on top of the ones detected in its source. A declared name the project does not define is rejected with 400; a detected name it does not define is ignored. Only used when `variable_scope` is `scoped`. Omitting this leaves an existing function's declared names unchanged. 
     # @return [Function]
     def create_function(id, name, code, runtime, opts = {})
       data, _status_code, _headers = create_function_with_http_info(id, name, code, runtime, opts)
@@ -45,10 +47,12 @@ module Volcano::Generated
     # @param runtime [String] Runtime environment. Required. - Node.js: nodejs22.x, nodejs24.x - Python: python3.10, python3.11, python3.12, python3.13, python3.14 - Ruby: ruby3.3, ruby3.4, ruby4.0 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :handler The name of the function to invoke. Defaults to \\\"handler\\\" if not specified. Your code must export/define a function with this name: - Node.js: exports.handler (in index.js) - Python: def handler() (in main.py) - Ruby: def handler() (in main.rb)  (default to 'handler')
-    # @option opts [Boolean] :is_public Whether the function can be reached through public invocation ingress. (default to false)
+    # @option opts [Boolean] :is_public Whether the function can be reached through public invocation ingress. Omit it to keep the function's current visibility; a new function starts private. 
     # @option opts [FunctionInvocationMode] :invocation_mode 
     # @option opts [FunctionHTTPAuthMode] :http_auth_mode 
     # @option opts [String] :openapi_spec JSON-encoded OpenAPI 3.0 or 3.1 metadata for an HTTP-mode function.
+    # @option opts [String] :variable_scope Which project variables this function receives. `all` (the default) gives it only project variables marked `shared: true`; `scoped` gives it only the variables it selects. Omitting this leaves an existing function's scope unchanged. 
+    # @option opts [String] :variables JSON-encoded array of project variable names this function requires, on top of the ones detected in its source. A declared name the project does not define is rejected with 400; a detected name it does not define is ignored. Only used when `variable_scope` is `scoped`. Omitting this leaves an existing function's declared names unchanged. 
     # @return [Array<(Function, Integer, Hash)>] Function data, response status code and response headers
     def create_function_with_http_info(id, name, code, runtime, opts = {})
       if @api_client.config.debugging
@@ -84,6 +88,10 @@ module Volcano::Generated
       if @api_client.config.client_side_validation && !allowable_values.include?(runtime)
         fail ArgumentError, "invalid value for \"runtime\", must be one of #{allowable_values}"
       end
+      allowable_values = ["all", "scoped"]
+      if @api_client.config.client_side_validation && opts[:'variable_scope'] && !allowable_values.include?(opts[:'variable_scope'])
+        fail ArgumentError, "invalid value for \"variable_scope\", must be one of #{allowable_values}"
+      end
       # resource path
       local_var_path = '/projects/{id}/functions'.sub('{' + 'id' + '}', CGI.escape(id.to_s))
 
@@ -110,6 +118,8 @@ module Volcano::Generated
       form_params['invocation_mode'] = opts[:'invocation_mode'] if !opts[:'invocation_mode'].nil?
       form_params['http_auth_mode'] = opts[:'http_auth_mode'] if !opts[:'http_auth_mode'].nil?
       form_params['openapi_spec'] = opts[:'openapi_spec'] if !opts[:'openapi_spec'].nil?
+      form_params['variable_scope'] = opts[:'variable_scope'] if !opts[:'variable_scope'].nil?
+      form_params['variables'] = opts[:'variables'] if !opts[:'variables'].nil?
 
       # http body (model)
       post_body = opts[:debug_body]
@@ -220,7 +230,7 @@ module Volcano::Generated
     # Deploy multiple functions in one request
     # Upload multiple function source archives in one multipart request. Each archive should contain source files plus dependency manifests/lockfiles, not installed dependency directories. ZIP and tar.gz uploads are accepted and normalized to tar.gz before storage. The API enforces `SOURCE_ARCHIVE_SIZE_LIMIT_MB` for each uploaded and normalized source archive. The server records a shared deployment batch ID for the resulting function deployments. Each function deployment runs its own compile/publish workflow concurrently, and each publish build enforces `LAMBDA_TARGET_CONTAINER_SIZE_LIMIT_MB` for the final container image. One batch request can include up to 100 functions. Submit multiple batch requests for larger projects. If one function fails before its workflow starts, already-started function deployments are left running and the failed function is reported in the `failed` array. Failed new functions are deleted; failed updates are rolled back to their previous metadata/status where possible. 
     # @param id [String] Project ID
-    # @param functions [String] JSON array of functions with &#x60;name&#x60;, &#x60;runtime&#x60;, optional &#x60;handler&#x60;, and &#x60;file_field&#x60;. Each &#x60;file_field&#x60; must name a multipart file field containing that function&#39;s ZIP or tar.gz source bundle.
+    # @param functions [String] JSON array of functions with &#x60;name&#x60;, &#x60;runtime&#x60;, optional &#x60;handler&#x60;, and &#x60;file_field&#x60;. Each &#x60;file_field&#x60; must name a multipart file field containing that function&#39;s ZIP or tar.gz source bundle.  Each entry may also declare &#x60;variable_scope&#x60; (&#x60;all&#x60; or &#x60;scoped&#x60;) and &#x60;variables&#x60; (an array of project variable names). Omitting them leaves the function&#39;s stored declaration unchanged. Volcano detects direct environment references in the uploaded source code and keeps them separate from the declared names: detected names are not written back to the declaration and do not appear in a config export. A scoped function receives its declared names plus the detected ones the project defines; a detected name the project does not define is ignored, since such a reference is often optional. Detection reads code only, so a name appearing solely in a comment or in an unrelated string is not a reference. Declare a name when the function reads it through a computed key, or when it must not deploy without the variable. The request is rejected with 400 before anything is deployed if a scoped function declares a variable the project does not define, or if the resulting environment exceeds 4096 bytes. 
     # @param [Hash] opts the optional parameters
     # @option opts [File] :code_0 Function ZIP or tar.gz archive referenced by the first manifest entry&#39;s &#x60;file_field&#x60;; additional code_N file fields may be included. Each archive is subject to SOURCE_ARCHIVE_SIZE_LIMIT_MB.
     # @return [BatchFunctionDeployResponse]
@@ -232,7 +242,7 @@ module Volcano::Generated
     # Deploy multiple functions in one request
     # Upload multiple function source archives in one multipart request. Each archive should contain source files plus dependency manifests/lockfiles, not installed dependency directories. ZIP and tar.gz uploads are accepted and normalized to tar.gz before storage. The API enforces &#x60;SOURCE_ARCHIVE_SIZE_LIMIT_MB&#x60; for each uploaded and normalized source archive. The server records a shared deployment batch ID for the resulting function deployments. Each function deployment runs its own compile/publish workflow concurrently, and each publish build enforces &#x60;LAMBDA_TARGET_CONTAINER_SIZE_LIMIT_MB&#x60; for the final container image. One batch request can include up to 100 functions. Submit multiple batch requests for larger projects. If one function fails before its workflow starts, already-started function deployments are left running and the failed function is reported in the &#x60;failed&#x60; array. Failed new functions are deleted; failed updates are rolled back to their previous metadata/status where possible. 
     # @param id [String] Project ID
-    # @param functions [String] JSON array of functions with &#x60;name&#x60;, &#x60;runtime&#x60;, optional &#x60;handler&#x60;, and &#x60;file_field&#x60;. Each &#x60;file_field&#x60; must name a multipart file field containing that function&#39;s ZIP or tar.gz source bundle.
+    # @param functions [String] JSON array of functions with &#x60;name&#x60;, &#x60;runtime&#x60;, optional &#x60;handler&#x60;, and &#x60;file_field&#x60;. Each &#x60;file_field&#x60; must name a multipart file field containing that function&#39;s ZIP or tar.gz source bundle.  Each entry may also declare &#x60;variable_scope&#x60; (&#x60;all&#x60; or &#x60;scoped&#x60;) and &#x60;variables&#x60; (an array of project variable names). Omitting them leaves the function&#39;s stored declaration unchanged. Volcano detects direct environment references in the uploaded source code and keeps them separate from the declared names: detected names are not written back to the declaration and do not appear in a config export. A scoped function receives its declared names plus the detected ones the project defines; a detected name the project does not define is ignored, since such a reference is often optional. Detection reads code only, so a name appearing solely in a comment or in an unrelated string is not a reference. Declare a name when the function reads it through a computed key, or when it must not deploy without the variable. The request is rejected with 400 before anything is deployed if a scoped function declares a variable the project does not define, or if the resulting environment exceeds 4096 bytes. 
     # @param [Hash] opts the optional parameters
     # @option opts [File] :code_0 Function ZIP or tar.gz archive referenced by the first manifest entry&#39;s &#x60;file_field&#x60;; additional code_N file fields may be included. Each archive is subject to SOURCE_ARCHIVE_SIZE_LIMIT_MB.
     # @return [Array<(BatchFunctionDeployResponse, Integer, Hash)>] BatchFunctionDeployResponse data, response status code and response headers
@@ -405,6 +415,8 @@ module Volcano::Generated
 
       # header parameters
       header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
 
       # form parameters
       form_params = opts[:form_params] || {}
@@ -576,7 +588,7 @@ module Volcano::Generated
     end
 
     # Invoke a function
-    # Invoke a serverless function.  **With Service Key** (admin/background operations): - Use for background jobs, webhooks, cron, admin operations - Function receives payload only (no user context) - Database queries bypass RLS (admin access)  **With Auth User Token** (user-facing): - Use for user-initiated actions - Function receives payload + `__volcano_auth` context:   ```javascript   {     user_id: \"uuid\",     email: \"user@example.com\",     project_id: \"uuid\",     role: \"authenticated\" or \"anonymous\"   }   ``` - Database queries enforce RLS (user-scoped data)  **With Anon Key** (public function only): - Requires anon key permission: `functions.invoke` - Function must have `is_public: true` - Function receives payload only (no `__volcano_auth`)  **Transport and CORS:** - This operation is the authenticated direct RPC endpoint and always uses the   POST `{payload: ...}` contract, including for functions whose DNS ingress is   configured in HTTP mode. - The geo-routed DNS ingress is `https://{functionId}.functions.<domain>/`. - RPC-mode DNS ingress accepts POST at `/`. HTTP-mode DNS ingress accepts GET,   HEAD, POST, PUT, PATCH, and DELETE at `/` and nested paths. - Direct and RPC-mode CORS preflight advertises `POST, OPTIONS`. HTTP-mode DNS   preflight advertises `GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS`. - `http_auth_mode: none` applies only to public HTTP-mode DNS ingress; this   direct operation always requires a Volcano credential. 
+    # Invoke a serverless function.  **With Service Key** (admin/background operations): - Use for background jobs, webhooks, cron, admin operations - Function receives payload only (no user context) - Database queries bypass RLS (admin access)  **With Auth User Token** (user-facing): - Use for user-initiated actions - Function receives payload + `__volcano_auth` context:   ```javascript   {     user_id: \"uuid\",     email: \"user@example.com\",     project_id: \"uuid\",     role: \"authenticated\" or \"anonymous\"   }   ``` - Database queries enforce RLS (user-scoped data)  **With Anon Key** (public function only): - Requires anon key permission: `functions.invoke` - Function must have `is_public: true` - Function receives payload only (no `__volcano_auth`)  **Transport and CORS:** - This operation is the authenticated direct RPC endpoint and always uses the   POST `{payload: ...}` contract, including for functions whose DNS ingress is   configured in HTTP mode. - The geo-routed DNS ingress is `https://{functionId}.functions.<domain>/`. - RPC-mode DNS ingress accepts POST at `/`. HTTP-mode DNS ingress accepts GET,   HEAD, POST, PUT, PATCH, and DELETE at `/` and nested paths. - Direct and RPC-mode CORS preflight advertises `POST, OPTIONS`. HTTP-mode DNS   preflight advertises `GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS`. - `http_auth_mode: none` applies only to public HTTP-mode DNS ingress; this   direct operation always requires a Volcano credential.  **Durable functions are not invocable here.** A durable function's id answers 404, whatever its visibility, because a synchronous call would run it with no execution record, no idempotency and no concurrency accounting. Start one with `POST /durable-functions/{functionId}/executions`. 
     # @param function_id [String] Function ID
     # @param function_invocation_request [FunctionInvocationRequest] 
     # @param [Hash] opts the optional parameters
@@ -587,7 +599,7 @@ module Volcano::Generated
     end
 
     # Invoke a function
-    # Invoke a serverless function.  **With Service Key** (admin/background operations): - Use for background jobs, webhooks, cron, admin operations - Function receives payload only (no user context) - Database queries bypass RLS (admin access)  **With Auth User Token** (user-facing): - Use for user-initiated actions - Function receives payload + &#x60;__volcano_auth&#x60; context:   &#x60;&#x60;&#x60;javascript   {     user_id: \&quot;uuid\&quot;,     email: \&quot;user@example.com\&quot;,     project_id: \&quot;uuid\&quot;,     role: \&quot;authenticated\&quot; or \&quot;anonymous\&quot;   }   &#x60;&#x60;&#x60; - Database queries enforce RLS (user-scoped data)  **With Anon Key** (public function only): - Requires anon key permission: &#x60;functions.invoke&#x60; - Function must have &#x60;is_public: true&#x60; - Function receives payload only (no &#x60;__volcano_auth&#x60;)  **Transport and CORS:** - This operation is the authenticated direct RPC endpoint and always uses the   POST &#x60;{payload: ...}&#x60; contract, including for functions whose DNS ingress is   configured in HTTP mode. - The geo-routed DNS ingress is &#x60;https://{functionId}.functions.&lt;domain&gt;/&#x60;. - RPC-mode DNS ingress accepts POST at &#x60;/&#x60;. HTTP-mode DNS ingress accepts GET,   HEAD, POST, PUT, PATCH, and DELETE at &#x60;/&#x60; and nested paths. - Direct and RPC-mode CORS preflight advertises &#x60;POST, OPTIONS&#x60;. HTTP-mode DNS   preflight advertises &#x60;GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS&#x60;. - &#x60;http_auth_mode: none&#x60; applies only to public HTTP-mode DNS ingress; this   direct operation always requires a Volcano credential. 
+    # Invoke a serverless function.  **With Service Key** (admin/background operations): - Use for background jobs, webhooks, cron, admin operations - Function receives payload only (no user context) - Database queries bypass RLS (admin access)  **With Auth User Token** (user-facing): - Use for user-initiated actions - Function receives payload + &#x60;__volcano_auth&#x60; context:   &#x60;&#x60;&#x60;javascript   {     user_id: \&quot;uuid\&quot;,     email: \&quot;user@example.com\&quot;,     project_id: \&quot;uuid\&quot;,     role: \&quot;authenticated\&quot; or \&quot;anonymous\&quot;   }   &#x60;&#x60;&#x60; - Database queries enforce RLS (user-scoped data)  **With Anon Key** (public function only): - Requires anon key permission: &#x60;functions.invoke&#x60; - Function must have &#x60;is_public: true&#x60; - Function receives payload only (no &#x60;__volcano_auth&#x60;)  **Transport and CORS:** - This operation is the authenticated direct RPC endpoint and always uses the   POST &#x60;{payload: ...}&#x60; contract, including for functions whose DNS ingress is   configured in HTTP mode. - The geo-routed DNS ingress is &#x60;https://{functionId}.functions.&lt;domain&gt;/&#x60;. - RPC-mode DNS ingress accepts POST at &#x60;/&#x60;. HTTP-mode DNS ingress accepts GET,   HEAD, POST, PUT, PATCH, and DELETE at &#x60;/&#x60; and nested paths. - Direct and RPC-mode CORS preflight advertises &#x60;POST, OPTIONS&#x60;. HTTP-mode DNS   preflight advertises &#x60;GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS&#x60;. - &#x60;http_auth_mode: none&#x60; applies only to public HTTP-mode DNS ingress; this   direct operation always requires a Volcano credential.  **Durable functions are not invocable here.** A durable function&#39;s id answers 404, whatever its visibility, because a synchronous call would run it with no execution record, no idempotency and no concurrency accounting. Start one with &#x60;POST /durable-functions/{functionId}/executions&#x60;. 
     # @param function_id [String] Function ID
     # @param function_invocation_request [FunctionInvocationRequest] 
     # @param [Hash] opts the optional parameters

data/lib/volcano/generated/lib/volcano-generated/api/o_auth_authentication_api.rb

@@ -745,7 +745,7 @@ module Volcano::Generated
     end
 
     # Call OAuth provider API
-    # Make an authenticated request to an OAuth provider's API on behalf of the user. The user's stored access token is automatically used and refreshed if needed.  The request is always sent to the provider's fixed API base URL joined with the caller-supplied `endpoint`. `endpoint` must be a relative path beginning with `/` (optionally with a query string); it cannot change the target host. Absolute URLs, protocol-relative `//host` values, or userinfo (`@host`) are rejected with `400` so the request can never be redirected to another host.  Examples of `endpoint`: - Google userinfo: `/oauth2/v1/userinfo` - GitHub repositories: `/user/repos` - Microsoft Graph profile: `/me`  The response wraps the provider's raw JSON value with request metadata. An empty provider body is represented as `data: null`; the envelope preserves the provider's HTTP status in `status_code`, including errors. Provider response bodies are limited to 8 MiB after decompression. Transport failures, invalid JSON, and oversized bodies return `502`. 
+    # Make an authenticated request to an OAuth provider's API on behalf of the user. The user's stored access token is automatically used and refreshed if needed.  The request is always sent to the provider's fixed API base URL joined with the caller-supplied `endpoint`. `endpoint` must be a relative path beginning with `/` (optionally with a query string); it cannot change the target host. Absolute URLs, protocol-relative `//host` values, or userinfo (`@host`) are rejected with `400` so the request can never be redirected to another host.  Examples of `endpoint`: - Google userinfo: `/oauth2/v1/userinfo` - GitHub repositories: `/user/repos` - Microsoft Graph profile: `/me`  The response wraps the provider's raw JSON value with request metadata. An empty provider body is represented as `data: null`; the envelope preserves the provider's HTTP status in `status_code`, including errors. Provider response bodies are limited to 8 MiB after decompression. Transport failures, invalid JSON (including invalid UTF-8), and oversized bodies return `502`. Provider redirects to another origin are blocked and return `400`. 
     # @param provider [String] 
     # @param call_o_auth_provider_api_request [CallOAuthProviderAPIRequest] 
     # @param [Hash] opts the optional parameters
@@ -756,7 +756,7 @@ module Volcano::Generated
     end
 
     # Call OAuth provider API
-    # Make an authenticated request to an OAuth provider's API on behalf of the user. The user's stored access token is automatically used and refreshed if needed.  The request is always sent to the provider's fixed API base URL joined with the caller-supplied `endpoint`. `endpoint` must be a relative path beginning with `/` (optionally with a query string); it cannot change the target host. Absolute URLs, protocol-relative `//host` values, or userinfo (`@host`) are rejected with `400` so the request can never be redirected to another host.  Examples of `endpoint`: - Google userinfo: `/oauth2/v1/userinfo` - GitHub repositories: `/user/repos` - Microsoft Graph profile: `/me`  The response wraps the provider's raw JSON value with request metadata. An empty provider body is represented as `data: null`; the envelope preserves the provider's HTTP status in `status_code`, including errors. Provider response bodies are limited to 8 MiB after decompression. Transport failures, invalid JSON, and oversized bodies return `502`. 
+    # Make an authenticated request to an OAuth provider's API on behalf of the user. The user's stored access token is automatically used and refreshed if needed.  The request is always sent to the provider's fixed API base URL joined with the caller-supplied `endpoint`. `endpoint` must be a relative path beginning with `/` (optionally with a query string); it cannot change the target host. Absolute URLs, protocol-relative `//host` values, or userinfo (`@host`) are rejected with `400` so the request can never be redirected to another host.  Examples of `endpoint`: - Google userinfo: `/oauth2/v1/userinfo` - GitHub repositories: `/user/repos` - Microsoft Graph profile: `/me`  The response wraps the provider's raw JSON value with request metadata. An empty provider body is represented as `data: null`; the envelope preserves the provider's HTTP status in `status_code`, including errors. Provider response bodies are limited to 8 MiB after decompression. Transport failures, invalid JSON (including invalid UTF-8), and oversized bodies return `502`. Provider redirects to another origin are blocked and return `400`. 
     # @param provider [String] 
     # @param call_o_auth_provider_api_request [CallOAuthProviderAPIRequest] 
     # @param [Hash] opts the optional parameters

data/lib/volcano/generated/lib/volcano-generated/api/projects_api.rb

@@ -624,7 +624,7 @@ module Volcano::Generated
     end
 
     # Export project configuration
-    # Exports the project's current user-facing configuration as a declarative manifest. Returns JSON by default. Request the canonical volcano-config.yaml rendering with `Accept: application/yaml` or `?format=yaml`; the YAML is returned verbatim as the raw response body (`Content-Type: application/yaml`) and is meant to be saved as-is. Write-only secrets (SMTP password, OAuth client secrets, TLS material) are omitted from the export; the YAML rendering adds a header comment describing how to set them via CLI environment interpolation. 
+    # Exports the project's current user-facing configuration as a declarative manifest. Returns JSON by default. Request the canonical volcano-config.yaml rendering with `Accept: application/yaml` or `?format=yaml`; the YAML is returned verbatim as the raw response body (`Content-Type: application/yaml`) and is meant to be saved as-is. Variable values and write-only secrets (SMTP password, OAuth client secrets, TLS material) are omitted from the export; shared_variables contains names only; the YAML rendering adds a header comment describing how to set them via CLI environment interpolation. 
     # @param id [String] Project ID
     # @param [Hash] opts the optional parameters
     # @option opts [String] :format Response format override. Takes precedence over the Accept header.
@@ -635,7 +635,7 @@ module Volcano::Generated
     end
 
     # Export project configuration
-    # Exports the project's current user-facing configuration as a declarative manifest. Returns JSON by default. Request the canonical volcano-config.yaml rendering with `Accept: application/yaml` or `?format=yaml`; the YAML is returned verbatim as the raw response body (`Content-Type: application/yaml`) and is meant to be saved as-is. Write-only secrets (SMTP password, OAuth client secrets, TLS material) are omitted from the export; the YAML rendering adds a header comment describing how to set them via CLI environment interpolation. 
+    # Exports the project's current user-facing configuration as a declarative manifest. Returns JSON by default. Request the canonical volcano-config.yaml rendering with `Accept: application/yaml` or `?format=yaml`; the YAML is returned verbatim as the raw response body (`Content-Type: application/yaml`) and is meant to be saved as-is. Variable values and write-only secrets (SMTP password, OAuth client secrets, TLS material) are omitted from the export; shared_variables contains names only; the YAML rendering adds a header comment describing how to set them via CLI environment interpolation. 
     # @param id [String] Project ID
     # @param [Hash] opts the optional parameters
     # @option opts [String] :format Response format override. Takes precedence over the Accept header.
@@ -1483,6 +1483,80 @@ module Volcano::Generated
       return data, status_code, headers
     end
 
+    # Replace shared variable names
+    # Atomically replaces the complete shared function-variable list without changing values. Names must already exist. Validates final affected function environments before membership or propagation side effects. An empty list clears membership. Omitted names remain stored as non-shared variables. 
+    # @param id [String] Project ID
+    # @param replace_shared_variables_request [ReplaceSharedVariablesRequest] 
+    # @param [Hash] opts the optional parameters
+    # @return [nil]
+    def replace_shared_variables(id, replace_shared_variables_request, opts = {})
+      replace_shared_variables_with_http_info(id, replace_shared_variables_request, opts)
+      nil
+    end
+
+    # Replace shared variable names
+    # Atomically replaces the complete shared function-variable list without changing values. Names must already exist. Validates final affected function environments before membership or propagation side effects. An empty list clears membership. Omitted names remain stored as non-shared variables. 
+    # @param id [String] Project ID
+    # @param replace_shared_variables_request [ReplaceSharedVariablesRequest] 
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(nil, Integer, Hash)>] nil, response status code and response headers
+    def replace_shared_variables_with_http_info(id, replace_shared_variables_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ProjectsApi.replace_shared_variables ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ProjectsApi.replace_shared_variables"
+      end
+      # verify the required parameter 'replace_shared_variables_request' is set
+      if @api_client.config.client_side_validation && replace_shared_variables_request.nil?
+        fail ArgumentError, "Missing the required parameter 'replace_shared_variables_request' when calling ProjectsApi.replace_shared_variables"
+      end
+      # resource path
+      local_var_path = '/projects/{id}/shared-variables'.sub('{' + 'id' + '}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(replace_shared_variables_request)
+
+      # return_type
+      return_type = opts[:debug_return_type]
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['UserToken']
+
+      new_options = opts.merge(
+        :operation => :"ProjectsApi.replace_shared_variables",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:PUT, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ProjectsApi#replace_shared_variables\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Set the branch a project deploys from
     # Changes only the production branch, leaving the repository binding alone. PUT /projects/{id}/git-connection can also set it, but that is a full rebind: it needs connection_id, installation_id and a repository selector resent, and re-resolves the repository against GitHub for a field that does not depend on it.  The branch does not have to exist. It is validated as a Git branch name and nothing more, so a project can be pointed at a branch that is about to be pushed — the case a repository created empty depends on.  Setting the branch here marks it as the project's own choice, so a later default-branch rename on GitHub no longer moves it. Projects that never set one keep following the repository's default branch. 
     # @param id [String] Project ID

data/lib/volcano/generated/lib/volcano-generated/models/create_database_request.rb

@@ -19,7 +19,7 @@ module Volcano::Generated
     # Database name (must be unique within project)
     attr_accessor :name
 
-    # Region for database hosting
+    # Region for database hosting. The accepted values are the regions this environment runs in, so read them from `GET /databases/regions` rather than hardcoding a list. A region the environment does not offer is rejected with 400. 
     attr_accessor :region
 
     # PostgreSQL major version
@@ -164,8 +164,6 @@ module Volcano::Generated
       return false if @name.to_s.length > 64
       return false if @name !~ Regexp.new(/^[a-z0-9_]+$/)
       return false if @region.nil?
-      region_validator = EnumAttributeValidator.new('String', ["aws-us-east-1", "aws-us-east-2", "aws-us-west-2", "aws-eu-central-1", "aws-eu-west-2", "aws-ap-southeast-1", "aws-ap-southeast-2", "aws-sa-east-1"])
-      return false unless region_validator.valid?(@region)
       return false if @pg_version.nil?
       pg_version_validator = EnumAttributeValidator.new('String', ["15", "16"])
       return false unless pg_version_validator.valid?(@pg_version)
@@ -193,13 +191,13 @@ module Volcano::Generated
       @name = name
     end
 
-    # Custom attribute writer method checking allowed values (enum).
-    # @param [Object] region Object to be assigned
+    # Custom attribute writer method with validation
+    # @param [Object] region Value to be assigned
     def region=(region)
-      validator = EnumAttributeValidator.new('String', ["aws-us-east-1", "aws-us-east-2", "aws-us-west-2", "aws-eu-central-1", "aws-eu-west-2", "aws-ap-southeast-1", "aws-ap-southeast-2", "aws-sa-east-1"])
-      unless validator.valid?(region)
-        fail ArgumentError, "invalid value for \"region\", must be one of #{validator.allowable_values}."
+      if region.nil?
+        fail ArgumentError, 'region cannot be nil'
       end
+
       @region = region
     end
 

data/lib/volcano/generated/lib/volcano-generated/models/create_variable_request.rb

@@ -15,6 +15,9 @@ require 'time'
 
 module Volcano::Generated
   class CreateVariableRequest < ApiModelBase
+    # Include this name in the project's shared function variables. Omission preserves existing membership; new variables default to true for legacy clients. Send false explicitly to create a non-shared variable.
+    attr_accessor :shared
+
     attr_accessor :name
 
     attr_accessor :value
@@ -22,6 +25,7 @@ module Volcano::Generated
     # Attribute mapping from ruby-style variable name to JSON key.
     def self.attribute_map
       {
+        :'shared' => :'shared',
         :'name' => :'name',
         :'value' => :'value'
       }
@@ -40,6 +44,7 @@ module Volcano::Generated
     # Attribute type mapping.
     def self.openapi_types
       {
+        :'shared' => :'Boolean',
         :'name' => :'String',
         :'value' => :'String'
       }
@@ -67,6 +72,10 @@ module Volcano::Generated
         h[k.to_sym] = v
       }
 
+      if attributes.key?(:'shared')
+        self.shared = attributes[:'shared']
+      end
+
       if attributes.key?(:'name')
         self.name = attributes[:'name']
       else
@@ -159,6 +168,7 @@ module Volcano::Generated
     def ==(o)
       return true if self.equal?(o)
       self.class == o.class &&
+          shared == o.shared &&
           name == o.name &&
           value == o.value
     end
@@ -172,7 +182,7 @@ module Volcano::Generated
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [name, value].hash
+      [shared, name, value].hash
     end
 
     # Builds the object from hash