capo-lambda 0.11.0__tar.gz → 0.13.0__tar.gz

{capo_lambda-0.11.0/src/capo_lambda.egg-info → capo_lambda-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capo-lambda
-Version: 0.11.0
+Version: 0.13.0
 Summary: Python SDK for AWS Lambda.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
@@ -17,6 +17,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: jmespath>=1.0
 Requires-Dist: zapros>=0.13.0
 Provides-Extra: sso
 Requires-Dist: capo-sso>=0.2.0; extra == "sso"
@@ -45,6 +46,57 @@ async def main():
         print(response["status_code"])
 ```
 
+## Pagination
+
+Some operations in this SDK support pagination. If the operation supports pagination it will have an `iter_` prefixed method that returns an async iterator.
+
+```python
+from capo_lambda import AsyncLambdaClient
+
+
+async def main():
+    async with AsyncLambdaClient() as lambda_:
+        # Example: paginate over list_capacity_providers
+        async for item in lambda_.iter_list_capacity_providers():
+            print(item)
+```
+
+## Streaming Request
+
+Some operations accept a streaming request body. Pass an async iterator of `bytes` chunks, or the whole body as `bytes`, for the streaming parameter.
+
+```python
+from capo_lambda import AsyncLambdaClient
+
+
+async def main():
+    async with AsyncLambdaClient() as lambda_:
+        # Example: call invoke_async with a streaming request body
+        async def chunks():
+            yield b'Hello, World!'
+
+        response = await lambda_.invoke_async(invoke_args=chunks())
+        print(response)
+
+        # Or pass the whole body as bytes
+        response = await lambda_.invoke_async(invoke_args=b'Hello, World!')
+        print(response)
+```
+
+## Waiters
+
+Waiters poll an operation until a resource reaches a desired state. If the operation supports waiters it will have a `wait_until_` prefixed method.
+
+```python
+from capo_lambda import AsyncLambdaClient
+
+
+async def main():
+    async with AsyncLambdaClient() as lambda_:
+        # Example: wait for function_exists
+        await lambda_.wait_until_function_exists(max_wait_time=300)
+```
+
 ## Error Handling
 
 The SDK raises exceptions for errors returned by the API. Catch them to handle failures gracefully.

{capo_lambda-0.11.0 → capo_lambda-0.13.0}/README.md

@@ -19,6 +19,57 @@ async def main():
         print(response["status_code"])
 ```
 
+## Pagination
+
+Some operations in this SDK support pagination. If the operation supports pagination it will have an `iter_` prefixed method that returns an async iterator.
+
+```python
+from capo_lambda import AsyncLambdaClient
+
+
+async def main():
+    async with AsyncLambdaClient() as lambda_:
+        # Example: paginate over list_capacity_providers
+        async for item in lambda_.iter_list_capacity_providers():
+            print(item)
+```
+
+## Streaming Request
+
+Some operations accept a streaming request body. Pass an async iterator of `bytes` chunks, or the whole body as `bytes`, for the streaming parameter.
+
+```python
+from capo_lambda import AsyncLambdaClient
+
+
+async def main():
+    async with AsyncLambdaClient() as lambda_:
+        # Example: call invoke_async with a streaming request body
+        async def chunks():
+            yield b'Hello, World!'
+
+        response = await lambda_.invoke_async(invoke_args=chunks())
+        print(response)
+
+        # Or pass the whole body as bytes
+        response = await lambda_.invoke_async(invoke_args=b'Hello, World!')
+        print(response)
+```
+
+## Waiters
+
+Waiters poll an operation until a resource reaches a desired state. If the operation supports waiters it will have a `wait_until_` prefixed method.
+
+```python
+from capo_lambda import AsyncLambdaClient
+
+
+async def main():
+    async with AsyncLambdaClient() as lambda_:
+        # Example: wait for function_exists
+        await lambda_.wait_until_function_exists(max_wait_time=300)
+```
+
 ## Error Handling
 
 The SDK raises exceptions for errors returned by the API. Catch them to handle failures gracefully.

{capo_lambda-0.11.0 → capo_lambda-0.13.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "capo-lambda"
-version = "0.11.0"
+version = "0.13.0"
 description = "Python SDK for AWS Lambda."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -19,6 +19,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
+    "jmespath>=1.0",
     "zapros>=0.13.0",
 ]
 

{capo_lambda-0.11.0 → capo_lambda-0.13.0}/src/capo_lambda/_auth/_signers.py

@@ -48,6 +48,12 @@ class SigV4Signer(Signer[Credentials]):
             "session_token": creds.get("session_token"),
             "signing_region": self._auth_scheme["signingRegion"],
             "signing_name": self._auth_scheme["signingName"],
+            "disable_double_encoding": self._auth_scheme.get(
+                "disableDoubleEncoding", False
+            ),
+            "disable_normalize_path": self._auth_scheme.get(
+                "disableNormalizePath", False
+            ),
         }
         if req.body is None:
             body: bytes | None = b""
@@ -55,10 +61,6 @@ class SigV4Signer(Signer[Credentials]):
             body = req.body
         else:
             body = None
-        # Strip Accept-Encoding so transports/intermediaries can't transcode
-        # the response and so the value never enters the canonical request.
-        if "accept-encoding" in req.headers:
-            del req.headers["Accept-Encoding"]
         return sign_sigv4(req, ctx, body)
 
     def sign(self, req: Request) -> Request:
@@ -70,6 +72,12 @@ class SigV4Signer(Signer[Credentials]):
             "session_token": creds.get("session_token"),
             "signing_region": self._auth_scheme["signingRegion"],
             "signing_name": self._auth_scheme["signingName"],
+            "disable_double_encoding": self._auth_scheme.get(
+                "disableDoubleEncoding", False
+            ),
+            "disable_normalize_path": self._auth_scheme.get(
+                "disableNormalizePath", False
+            ),
         }
         if req.body is None:
             body: bytes | None = b""
@@ -77,8 +85,4 @@ class SigV4Signer(Signer[Credentials]):
             body = req.body
         else:
             body = None
-        # Strip Accept-Encoding so transports/intermediaries can't transcode
-        # the response and so the value never enters the canonical request.
-        if "accept-encoding" in req.headers:
-            del req.headers["Accept-Encoding"]
         return sign_sigv4(req, ctx, body)

{capo_lambda-0.11.0 → capo_lambda-0.13.0}/src/capo_lambda/_auth/_sigv4.py

@@ -25,21 +25,29 @@ from zapros._utils import get_host_header_value
 
 
 def build_sigv4_auth_scheme(
-    signing_name: str, region: str | None
+    signing_name: str, region: str | None, endpoint_scheme: dict[str, Any] | None = None
 ) -> dict[str, Any] | None:
-    """Return a sigv4 auth scheme dict for the given signing name and region.
-
-    Returns None when region is not set so callers can use it in an ``or`` chain.
+    """Return the sigv4 auth scheme for ``signing_name``/``region``, with the
+    endpoint rule set's matching ``authSchemes`` entry overlaid on top.
+
+    The rule set only *modifies* signing properties of the resolved scheme
+    (Smithy rules engine, ``authSchemes``): keys it carries win, keys it omits
+    keep the operation defaults — IAM's global endpoint names only
+    ``signingRegion``, for instance. Returns None when no signing region is
+    known from either source.
     """
-    if region is None:
-        return None
-    return {
+    scheme: dict[str, Any] = {
         "name": "sigv4",
         "signingName": signing_name,
         "signingRegion": region,
         "disableDoubleEncoding": False,
         "disableNormalizePath": False,
     }
+    if endpoint_scheme:
+        scheme.update(endpoint_scheme)
+    if scheme.get("signingRegion") is None:
+        return None
+    return scheme
 
 
 class SigV4AuthContext(TypedDict):
@@ -49,6 +57,11 @@ class SigV4AuthContext(TypedDict):
     session_token: str | None
     signing_region: str
     signing_name: str
+    # Rules-engine sigv4 auth-scheme flags (False = standard SigV4: normalize
+    # dot segments, double-encode the path). S3-family endpoint rulesets set
+    # ``disableDoubleEncoding`` so the path is signed exactly as sent.
+    disable_double_encoding: bool
+    disable_normalize_path: bool
 
 
 _SIGV4_ALGORITHM = "AWS4-HMAC-SHA256"
@@ -82,23 +95,49 @@ _UNSIGNED_HEADERS = frozenset(
 
 _MULTI_SPACE = re.compile(r" +")
 
+# Services that require the payload hash to travel in ``x-amz-content-sha256``.
+# Other services sign the hash into the canonical request without sending it.
+_S3_SIGNING_NAMES = frozenset({"s3", "s3express", "s3-outposts", "s3-object-lambda"})
+
 
 def _uri_encode(value: str) -> str:
     """RFC 3986 percent-encoding using only the unreserved set as safe."""
     return quote(value, safe="-_.~")
 
 
-def _canonical_path(path: str, *, service: str) -> str:
+def _remove_dot_segments(path: str) -> str:
+    """RFC 3986 §5.2.4 dot-segment removal (mirrors botocore's normalize_url_path)."""
+    segments: list[str] = []
+    for seg in path.split("/"):
+        if not seg or seg == ".":
+            continue
+        if seg == "..":
+            if segments:
+                segments.pop()
+        else:
+            segments.append(seg)
+    first = "/" if path.startswith("/") else ""
+    last = "/" if path.endswith("/") and segments else ""
+    return first + "/".join(segments) + last
+
+
+def _canonical_path(path: str, *, double_encode: bool, normalize: bool) -> str:
     """Build CanonicalURI.
 
-    Per the SigV4 spec, every segment is URI-encoded; for services other
-    than S3 each segment is URI-encoded **twice**. S3 keeps the path
-    exactly as provided (no normalization, no double-encoding).
+    Per the SigV4 spec, every segment is URI-encoded; standard services
+    normalize dot segments and URI-encode each segment **twice**. The
+    rules-engine ``disableNormalizePath`` / ``disableDoubleEncoding`` flags
+    turn those steps off — S3-family services set both, so the path is
+    signed exactly as provided.
     """
     if not path:
         return "/"
-    if service == "s3":
-        return path if path.startswith("/") else "/" + path
+    if not path.startswith("/"):
+        path = "/" + path
+    if normalize:
+        path = _remove_dot_segments(path)
+    if not double_encode:
+        return path
     decoded = unquote(path)
     first = quote(decoded, safe="/~")
     return quote(first, safe="/~")
@@ -148,9 +187,12 @@ def _build_canonical_request(
     query: str,
     headers: Headers,
     payload_hash: str,
-    service: str,
+    double_encode: bool,
+    normalize: bool,
 ) -> tuple[str, str]:
-    canonical_uri = _canonical_path(path, service=service)
+    canonical_uri = _canonical_path(
+        path, double_encode=double_encode, normalize=normalize
+    )
     canonical_query = _canonical_query(query)
     canonical_headers, signed_headers = _canonical_headers(headers)
     canonical_request = (
@@ -212,8 +254,8 @@ def sign_sigv4(
         date_stamp = now.strftime("%Y%m%d")
         headers["X-Amz-Date"] = amz_date
 
-    # Payload hash. For S3, x-amz-content-sha256 is mandatory and must be set
-    # BEFORE computing the canonical request (it gets signed).
+    # Payload hash. For S3-family services, x-amz-content-sha256 is mandatory
+    # and must be set BEFORE computing the canonical request (it gets signed).
     payload_hash = headers.get("X-Amz-Content-SHA256")
     if payload_hash is None:
         if body is None:
@@ -222,7 +264,7 @@ def sign_sigv4(
             payload_hash = (
                 hashlib.sha256(body).hexdigest() if body else _EMPTY_PAYLOAD_SHA256
             )
-    if service == "s3":
+    if service in _S3_SIGNING_NAMES:
         headers["X-Amz-Content-SHA256"] = payload_hash
 
     # Session token (STS / assumed-role credentials).
@@ -240,7 +282,8 @@ def sign_sigv4(
         query=request.url.search,
         headers=headers,
         payload_hash=payload_hash,
-        service=service,
+        double_encode=not ctx["disable_double_encoding"],
+        normalize=not ctx["disable_normalize_path"],
     )
 
     credential_scope = f"{date_stamp}/{region}/{service}/aws4_request"
@@ -343,9 +386,14 @@ def presign_sigv4(
     existing = list(URLSearchParams(request.url.search).entries())
     canonical_query = _canonical_query_from_pairs(existing + amz_params)
 
+    canonical_uri = _canonical_path(
+        request.url.pathname,
+        double_encode=not ctx["disable_double_encoding"],
+        normalize=not ctx["disable_normalize_path"],
+    )
     canonical_request = (
         f"{request.method.upper()}\n"
-        f"{_canonical_path(request.url.pathname, service=service)}\n"
+        f"{canonical_uri}\n"
         f"{canonical_query}\n"
         f"{canonical_headers}\n"
         f"{signed_headers}\n"

{capo_lambda-0.11.0 → capo_lambda-0.13.0}/src/capo_lambda/_auth/_zapros_handler.py

@@ -33,6 +33,21 @@ def ensure_sync_handler(
     )
 
 
+def strip_accept_encoding(request: Request) -> Request:
+    """Drop the ``Accept-Encoding`` zapros adds to every request.
+
+    Like the AWS SDKs, the client never asks for transport compression: a
+    response body must be the service's actual bytes so ``Content-Length``,
+    checksums and ``Range`` stay coherent and a ``Content-Encoding`` on it is
+    always stored metadata (an S3 object's), never something to undo. Removing
+    the header before signing also keeps it out of the canonical request, where
+    a proxy rewriting it in flight would break the signature.
+    """
+    if "accept-encoding" in request.headers:
+        del request.headers["Accept-Encoding"]
+    return request
+
+
 class AuthMiddleware(BaseMiddleware, AsyncBaseMiddleware):
     """Sign the outgoing request using the Signer placed in ``context["signer"]``.
 
@@ -40,7 +55,8 @@ class AuthMiddleware(BaseMiddleware, AsyncBaseMiddleware):
     effective auth scheme to a concrete :class:`Signer` and threads it
     through ``request.context`` before dispatch. This middleware does the
     actual signing; ``None`` means the operation opted out via
-    ``@optionalAuth`` and the request passes through untouched.
+    ``@optionalAuth`` and the request passes through unsigned. Either way
+    ``Accept-Encoding`` is stripped first (see :func:`strip_accept_encoding`).
     """
 
     def __init__(self, next_handler: BaseHandler | AsyncBaseHandler) -> None:
@@ -49,6 +65,7 @@ class AuthMiddleware(BaseMiddleware, AsyncBaseMiddleware):
 
     def handle(self, request: Request) -> Response:
         next_handler = ensure_sync_handler(self.next)
+        request = strip_accept_encoding(request)
         signer = cast(Optional[Signer], request.context.get("signer"))
         if signer is not None:
             request = signer.sign(request)
@@ -56,6 +73,7 @@ class AuthMiddleware(BaseMiddleware, AsyncBaseMiddleware):
 
     async def ahandle(self, request: Request) -> Response:
         next_handler = ensure_async_handler(self.async_next)
+        request = strip_accept_encoding(request)
         signer = cast(Optional[Signer], request.context.get("signer"))
         if signer is not None:
             request = await signer.asign(request)

{capo_lambda-0.11.0 → capo_lambda-0.13.0}/src/capo_lambda/_operations/aws_gir_api_service/add_layer_version_permission.py

@@ -86,19 +86,26 @@ def get_signer(
     auth_schemes: list[dict[str, Any]] | None = None,
 ) -> capo_lambda._auth._signers.Signer | None:
     name_to_schema = {s["name"]: s for s in (auth_schemes or [])}  # noqa: F841
+    if (
+        options.credentials_provider is not None
+        and name_to_schema
+        and not name_to_schema.keys() & {"sigv4", "sigv4-s3express"}
+    ):
+        raise RuntimeError(
+            "Endpoint requires an unsupported auth scheme: " + ", ".join(name_to_schema)
+        )
     if options.credentials_provider is not None:
-        sigv4_config = (
-            name_to_schema.get("sigv4")
-            or name_to_schema.get("sigv4a")
-            or name_to_schema.get("sigv4-s3express")
-            or capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
-                "lambda", options.region
-            )
+        endpoint_scheme = name_to_schema.get("sigv4") or name_to_schema.get(
+            "sigv4-s3express"
         )
-        if sigv4_config is not None:
-            return capo_lambda._auth._signers.SigV4Signer(
-                options.credentials_provider, auth_scheme=sigv4_config
+        if endpoint_scheme is not None or not name_to_schema:
+            sigv4_config = capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
+                "lambda", options.region, endpoint_scheme
             )
+            if sigv4_config is not None:
+                return capo_lambda._auth._signers.SigV4Signer(
+                    options.credentials_provider, auth_scheme=sigv4_config
+                )
     raise RuntimeError("Auth was not resolved")
 
 
@@ -147,7 +154,7 @@ def add_layer_version_permission(
 ]:
     response = options.client.handler.handle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             response.read()
             handle_error(response)
         return handle_response(response), response
@@ -165,7 +172,7 @@ async def async_add_layer_version_permission(
 ]:
     response = await options.client.handler.ahandle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             await response.aread()
             handle_error(response)
         return await async_handle_response(response), response

{capo_lambda-0.11.0 → capo_lambda-0.13.0}/src/capo_lambda/_operations/aws_gir_api_service/add_permission.py

@@ -96,19 +96,26 @@ def get_signer(
     auth_schemes: list[dict[str, Any]] | None = None,
 ) -> capo_lambda._auth._signers.Signer | None:
     name_to_schema = {s["name"]: s for s in (auth_schemes or [])}  # noqa: F841
+    if (
+        options.credentials_provider is not None
+        and name_to_schema
+        and not name_to_schema.keys() & {"sigv4", "sigv4-s3express"}
+    ):
+        raise RuntimeError(
+            "Endpoint requires an unsupported auth scheme: " + ", ".join(name_to_schema)
+        )
     if options.credentials_provider is not None:
-        sigv4_config = (
-            name_to_schema.get("sigv4")
-            or name_to_schema.get("sigv4a")
-            or name_to_schema.get("sigv4-s3express")
-            or capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
-                "lambda", options.region
-            )
+        endpoint_scheme = name_to_schema.get("sigv4") or name_to_schema.get(
+            "sigv4-s3express"
         )
-        if sigv4_config is not None:
-            return capo_lambda._auth._signers.SigV4Signer(
-                options.credentials_provider, auth_scheme=sigv4_config
+        if endpoint_scheme is not None or not name_to_schema:
+            sigv4_config = capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
+                "lambda", options.region, endpoint_scheme
             )
+            if sigv4_config is not None:
+                return capo_lambda._auth._signers.SigV4Signer(
+                    options.credentials_provider, auth_scheme=sigv4_config
+                )
     raise RuntimeError("Auth was not resolved")
 
 
@@ -151,7 +158,7 @@ def add_permission(
 ]:
     response = options.client.handler.handle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             response.read()
             handle_error(response)
         return handle_response(response), response
@@ -168,7 +175,7 @@ async def async_add_permission(
 ]:
     response = await options.client.handler.ahandle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             await response.aread()
             handle_error(response)
         return await async_handle_response(response), response

{capo_lambda-0.11.0 → capo_lambda-0.13.0}/src/capo_lambda/_operations/aws_gir_api_service/checkpoint_durable_execution.py

@@ -88,19 +88,26 @@ def get_signer(
     auth_schemes: list[dict[str, Any]] | None = None,
 ) -> capo_lambda._auth._signers.Signer | None:
     name_to_schema = {s["name"]: s for s in (auth_schemes or [])}  # noqa: F841
+    if (
+        options.credentials_provider is not None
+        and name_to_schema
+        and not name_to_schema.keys() & {"sigv4", "sigv4-s3express"}
+    ):
+        raise RuntimeError(
+            "Endpoint requires an unsupported auth scheme: " + ", ".join(name_to_schema)
+        )
     if options.credentials_provider is not None:
-        sigv4_config = (
-            name_to_schema.get("sigv4")
-            or name_to_schema.get("sigv4a")
-            or name_to_schema.get("sigv4-s3express")
-            or capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
-                "lambda", options.region
-            )
+        endpoint_scheme = name_to_schema.get("sigv4") or name_to_schema.get(
+            "sigv4-s3express"
         )
-        if sigv4_config is not None:
-            return capo_lambda._auth._signers.SigV4Signer(
-                options.credentials_provider, auth_scheme=sigv4_config
+        if endpoint_scheme is not None or not name_to_schema:
+            sigv4_config = capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
+                "lambda", options.region, endpoint_scheme
             )
+            if sigv4_config is not None:
+                return capo_lambda._auth._signers.SigV4Signer(
+                    options.credentials_provider, auth_scheme=sigv4_config
+                )
     raise RuntimeError("Auth was not resolved")
 
 
@@ -148,7 +155,7 @@ def checkpoint_durable_execution(
 ]:
     response = options.client.handler.handle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             response.read()
             handle_error(response)
         return handle_response(response), response
@@ -166,7 +173,7 @@ async def async_checkpoint_durable_execution(
 ]:
     response = await options.client.handler.ahandle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             await response.aread()
             handle_error(response)
         return await async_handle_response(response), response

{capo_lambda-0.11.0 → capo_lambda-0.13.0}/src/capo_lambda/_operations/aws_gir_api_service/create_alias.py

@@ -86,19 +86,26 @@ def get_signer(
     auth_schemes: list[dict[str, Any]] | None = None,
 ) -> capo_lambda._auth._signers.Signer | None:
     name_to_schema = {s["name"]: s for s in (auth_schemes or [])}  # noqa: F841
+    if (
+        options.credentials_provider is not None
+        and name_to_schema
+        and not name_to_schema.keys() & {"sigv4", "sigv4-s3express"}
+    ):
+        raise RuntimeError(
+            "Endpoint requires an unsupported auth scheme: " + ", ".join(name_to_schema)
+        )
     if options.credentials_provider is not None:
-        sigv4_config = (
-            name_to_schema.get("sigv4")
-            or name_to_schema.get("sigv4a")
-            or name_to_schema.get("sigv4-s3express")
-            or capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
-                "lambda", options.region
-            )
+        endpoint_scheme = name_to_schema.get("sigv4") or name_to_schema.get(
+            "sigv4-s3express"
         )
-        if sigv4_config is not None:
-            return capo_lambda._auth._signers.SigV4Signer(
-                options.credentials_provider, auth_scheme=sigv4_config
+        if endpoint_scheme is not None or not name_to_schema:
+            sigv4_config = capo_lambda._auth._sigv4.build_sigv4_auth_scheme(
+                "lambda", options.region, endpoint_scheme
             )
+            if sigv4_config is not None:
+                return capo_lambda._auth._signers.SigV4Signer(
+                    options.credentials_provider, auth_scheme=sigv4_config
+                )
     raise RuntimeError("Auth was not resolved")
 
 
@@ -137,7 +144,7 @@ def create_alias(
 ) -> tuple[capo_lambda.types.alias_configuration.AliasConfiguration, zapros.Response]:
     response = options.client.handler.handle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             response.read()
             handle_error(response)
         return handle_response(response), response
@@ -152,7 +159,7 @@ async def async_create_alias(
 ) -> tuple[capo_lambda.types.alias_configuration.AliasConfiguration, zapros.Response]:
     response = await options.client.handler.ahandle(build_request(options, input_))
     try:
-        if response.status >= 400:
+        if response.status >= 300:
             await response.aread()
             handle_error(response)
         return await async_handle_response(response), response