chalk-remote-call-python 1.10.3__tar.gz → 1.10.4__tar.gz

{chalk_remote_call_python-1.10.3 → chalk_remote_call_python-1.10.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chalk-remote-call-python
-Version: 1.10.3
+Version: 1.10.4
 Summary: Chalk remote call Python runtime interface client
 Author: Chalk AI, Inc.
 Project-URL: Homepage, https://chalk.ai
@@ -126,6 +126,8 @@ set `RUST_LOG=info,chalk_metrics::metrics::config=debug` to include them.
 | Variable | Description |
 |----------|-------------|
 | `CHALK_INPUT_ARGS` | Comma-separated list of column names (e.g. `x,y,z`). Renames incoming RecordBatch columns by index. If unset, the original column names are used. Reserved columns (below) are held out of this mapping and keep their own name. |
+| `CHALK_FNQ_CONSUMER_ENDPOINT` | Opt into DP API `FnqConsumerService` consumption (HTTP or HTTPS gRPC endpoint). Unset preserves direct Redis consumption. API errors never fall back to Redis. |
+| `CHALK_FUNCTION_QUEUE_TOKEN_FILE` | Controller-mounted working JWT, reopened per RPC to observe rotation. Defaults to `/var/run/secrets/chalk-function-queue/identity-token`. The shim does not exchange credentials. |
 | `CHALK_FNQ_QUEUE_PROTOCOL` | Self-consumer work transport: `list_v1` (default/backward compatible) or `stream_v1`. Deployment tooling sets this from immutable scaling-group revision metadata. |
 
 #### Reserved columns
@@ -245,3 +247,23 @@ Payloads are bounded for gRPC header limits. Truncation is marked explicitly,
 with complete tracebacks kept in server logs. Exception objects and locals are
 never pickled or sent. Chalk SDK-generated handlers identify their dispatch
 frames, and notebook source maps identify the deployed snapshot's lines.
+
+### Fnq integration test
+
+On Linux, build the native extension and the paired `chalk-private` test harness:
+
+```bash
+# chalk-private, inside the Nix dev shell
+bazel build //rust-crates/chalk/dataplane-api-server:fnq_test_server
+
+# chalk-remote-call-python
+uv pip install -e ".[dev]" redis PyJWT cryptography
+FNQ_TEST_SERVER=/path/to/chalk-private/bazel-bin/rust-crates/chalk/dataplane-api-server/fnq_test_server \
+REDIS_URL=redis://127.0.0.1:6379 .venv/bin/pytest tests/test_fnq_api_e2e.py -v
+```
+
+Use an isolated Redis instance. The tests create temporary signing keys and start
+the production JWT layer and Fnq service, then exercise real native-shim execution,
+lease renewal, result writes, token rotation, and environment isolation. These tests
+skip unless `FNQ_TEST_SERVER` and `REDIS_URL` are set. Deploy the service before
+setting `CHALK_FNQ_CONSUMER_ENDPOINT` on a workload.

{chalk_remote_call_python-1.10.3 → chalk_remote_call_python-1.10.4}/README.md

@@ -88,6 +88,8 @@ set `RUST_LOG=info,chalk_metrics::metrics::config=debug` to include them.
 | Variable | Description |
 |----------|-------------|
 | `CHALK_INPUT_ARGS` | Comma-separated list of column names (e.g. `x,y,z`). Renames incoming RecordBatch columns by index. If unset, the original column names are used. Reserved columns (below) are held out of this mapping and keep their own name. |
+| `CHALK_FNQ_CONSUMER_ENDPOINT` | Opt into DP API `FnqConsumerService` consumption (HTTP or HTTPS gRPC endpoint). Unset preserves direct Redis consumption. API errors never fall back to Redis. |
+| `CHALK_FUNCTION_QUEUE_TOKEN_FILE` | Controller-mounted working JWT, reopened per RPC to observe rotation. Defaults to `/var/run/secrets/chalk-function-queue/identity-token`. The shim does not exchange credentials. |
 | `CHALK_FNQ_QUEUE_PROTOCOL` | Self-consumer work transport: `list_v1` (default/backward compatible) or `stream_v1`. Deployment tooling sets this from immutable scaling-group revision metadata. |
 
 #### Reserved columns
@@ -207,3 +209,23 @@ Payloads are bounded for gRPC header limits. Truncation is marked explicitly,
 with complete tracebacks kept in server logs. Exception objects and locals are
 never pickled or sent. Chalk SDK-generated handlers identify their dispatch
 frames, and notebook source maps identify the deployed snapshot's lines.
+
+### Fnq integration test
+
+On Linux, build the native extension and the paired `chalk-private` test harness:
+
+```bash
+# chalk-private, inside the Nix dev shell
+bazel build //rust-crates/chalk/dataplane-api-server:fnq_test_server
+
+# chalk-remote-call-python
+uv pip install -e ".[dev]" redis PyJWT cryptography
+FNQ_TEST_SERVER=/path/to/chalk-private/bazel-bin/rust-crates/chalk/dataplane-api-server/fnq_test_server \
+REDIS_URL=redis://127.0.0.1:6379 .venv/bin/pytest tests/test_fnq_api_e2e.py -v
+```
+
+Use an isolated Redis instance. The tests create temporary signing keys and start
+the production JWT layer and Fnq service, then exercise real native-shim execution,
+lease renewal, result writes, token rotation, and environment isolation. These tests
+skip unless `FNQ_TEST_SERVER` and `REDIS_URL` are set. Deploy the service before
+setting `CHALK_FNQ_CONSUMER_ENDPOINT` on a workload.

{chalk_remote_call_python-1.10.3 → chalk_remote_call_python-1.10.4}/chalk-remote-call-rs/Cargo.lock

@@ -537,6 +537,7 @@ name = "chalk-remote-call-server"
 version = "0.1.0"
 dependencies = [
  "arrow",
+ "base64 0.22.1",
  "bytes",
  "chalk-queue",
  "chalk-remote-call-proto",
@@ -2773,10 +2774,37 @@ checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
 dependencies = [
  "log",
  "ring",
- "rustls-webpki",
+ "rustls-webpki 0.101.7",
  "sct",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki 0.103.15",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
 [[package]]
 name = "rustls-pemfile"
 version = "1.0.4"
@@ -2786,6 +2814,15 @@ dependencies = [
  "base64 0.21.7",
 ]
 
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.14.1"
@@ -2805,6 +2842,17 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -3068,6 +3116,12 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -3312,7 +3366,17 @@ version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
 dependencies = [
- "rustls",
+ "rustls 0.21.12",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls 0.23.43",
  "tokio",
 ]
 
@@ -3418,10 +3482,10 @@ dependencies = [
  "percent-encoding",
  "pin-project",
  "prost 0.12.6",
- "rustls",
- "rustls-pemfile",
+ "rustls 0.21.12",
+ "rustls-pemfile 1.0.4",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.24.1",
  "tokio-stream",
  "tower 0.4.13",
  "tower-layer",
@@ -3451,8 +3515,11 @@ dependencies = [
  "percent-encoding",
  "pin-project",
  "prost 0.13.5",
+ "rustls-native-certs",
+ "rustls-pemfile 2.2.0",
  "socket2 0.5.10",
  "tokio",
+ "tokio-rustls 0.26.4",
  "tokio-stream",
  "tower 0.4.13",
  "tower-layer",

{chalk_remote_call_python-1.10.3 → chalk_remote_call_python-1.10.4}/chalk-remote-call-rs/chalk-remote-call-proto/src/gen/chalk.auth.v1.rs

@@ -1,5 +1,33 @@
 // @generated
 // This file is @generated by prost-build.
+/// Principal types that a permission may be assigned to directly. User-role
+/// assignment is managed separately; this metadata controls non-user principals.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
+#[repr(i32)]
+pub enum PermissionPrincipal {
+    Unspecified = 0,
+    ServiceToken = 1,
+}
+impl PermissionPrincipal {
+    /// String value of the enum field names used in the ProtoBuf definition.
+    ///
+    /// The values are not transformed in any way and thus are considered stable
+    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+    pub fn as_str_name(&self) -> &'static str {
+        match self {
+            PermissionPrincipal::Unspecified => "PERMISSION_PRINCIPAL_UNSPECIFIED",
+            PermissionPrincipal::ServiceToken => "PERMISSION_PRINCIPAL_SERVICE_TOKEN",
+        }
+    }
+    /// Creates an enum from field names used in the ProtoBuf definition.
+    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+        match value {
+            "PERMISSION_PRINCIPAL_UNSPECIFIED" => Some(Self::Unspecified),
+            "PERMISSION_PRINCIPAL_SERVICE_TOKEN" => Some(Self::ServiceToken),
+            _ => None,
+        }
+    }
+}
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
 #[repr(i32)]
 pub enum Permission {
@@ -42,6 +70,10 @@ pub enum Permission {
     InternalWorkingTokenExchange = 34,
     BillingWrite = 35,
     QueryOfflineRead = 36,
+    InternalResourceShareView = 37,
+    InternalExchangeTokenRenew = 38,
+    AgentsWrite = 39,
+    AgentsRead = 40,
 }
 impl Permission {
     /// String value of the enum field names used in the ProtoBuf definition.
@@ -87,6 +119,10 @@ impl Permission {
             Permission::InternalWorkingTokenExchange => "PERMISSION_INTERNAL_WORKING_TOKEN_EXCHANGE",
             Permission::BillingWrite => "PERMISSION_BILLING_WRITE",
             Permission::QueryOfflineRead => "PERMISSION_QUERY_OFFLINE_READ",
+            Permission::InternalResourceShareView => "PERMISSION_INTERNAL_RESOURCE_SHARE_VIEW",
+            Permission::InternalExchangeTokenRenew => "PERMISSION_INTERNAL_EXCHANGE_TOKEN_RENEW",
+            Permission::AgentsWrite => "PERMISSION_AGENTS_WRITE",
+            Permission::AgentsRead => "PERMISSION_AGENTS_READ",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -129,6 +165,10 @@ impl Permission {
             "PERMISSION_INTERNAL_WORKING_TOKEN_EXCHANGE" => Some(Self::InternalWorkingTokenExchange),
             "PERMISSION_BILLING_WRITE" => Some(Self::BillingWrite),
             "PERMISSION_QUERY_OFFLINE_READ" => Some(Self::QueryOfflineRead),
+            "PERMISSION_INTERNAL_RESOURCE_SHARE_VIEW" => Some(Self::InternalResourceShareView),
+            "PERMISSION_INTERNAL_EXCHANGE_TOKEN_RENEW" => Some(Self::InternalExchangeTokenRenew),
+            "PERMISSION_AGENTS_WRITE" => Some(Self::AgentsWrite),
+            "PERMISSION_AGENTS_READ" => Some(Self::AgentsRead),
             _ => None,
         }
     }