devhelm 1.4.0__tar.gz → 1.6.0__tar.gz

{devhelm-1.4.0 → devhelm-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devhelm
-Version: 1.4.0
+Version: 1.6.0
 Summary: DevHelm SDK for Python — typed client for monitors, incidents, alerting, and more
 Project-URL: Homepage, https://github.com/devhelmhq/sdk-python
 Project-URL: Repository, https://github.com/devhelmhq/sdk-python.git

{devhelm-1.4.0 → devhelm-1.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devhelm"
-version = "1.4.0"
+version = "1.6.0"
 description = "DevHelm SDK for Python — typed client for monitors, incidents, alerting, and more"
 authors = [{ name = "DevHelm", email = "hello@devhelm.io" }]
 license = "MIT"
@@ -28,7 +28,10 @@ Repository = "https://github.com/devhelmhq/sdk-python.git"
 Issues = "https://github.com/devhelmhq/sdk-python/issues"
 
 [build-system]
-requires = ["hatchling"]
+# hatchling 1.30+ emits Metadata-Version 2.5, which released twine and
+# PyPI still reject. Cap until twine ships 2.5 support and warehouse
+# accepts it (pypa/twine#1317, pypi/warehouse#19083).
+requires = ["hatchling>=1.27,<1.30"]
 build-backend = "hatchling.build"
 
 [tool.hatch.build.targets.wheel]

{devhelm-1.4.0 → devhelm-1.6.0}/scripts/inject_strict_config.py

@@ -1,7 +1,13 @@
 #!/usr/bin/env python3
-"""Inject ``model_config = ConfigDict(extra='forbid', populate_by_name=True)``
-into every generated Pydantic BaseModel class, and add Pydantic v2
-``Field(discriminator=...)`` annotations on tagged-union fields.
+"""Inject ``model_config`` into every generated Pydantic BaseModel class,
+and add Pydantic v2 ``Field(discriminator=...)`` annotations on tagged-union
+fields.
+
+Request / Params models get ``extra='forbid'`` so typos fail before the HTTP
+call. Every other generated model — response DTOs and nested value objects
+used when decoding API responses — gets ``extra='ignore'`` (Postel's Law).
+Additive API fields, including nullable ones the published surface has never
+seen, must not crash the client.
 
 datamodel-code-generator does not emit a config block when the source
 OpenAPI spec lacks ``additionalProperties: false``. Springdoc never emits
@@ -30,9 +36,10 @@ discriminator, Pydantic routes to the correct subtype based on the tag
 value and reports only that subtype's errors (typically 1).
 Implements P0.Bug4 from the round-3 DevEx audit.
 
-This implements policies P1 (response extras forbidden) and P2 (request
-extras forbidden) from `mini/cowork/design/040-codegen-policies.md` plus
-the two DevEx fixes above.
+This implements Postel's Law on the wire (`runbooks/api-contract.md` § 2.2:
+tolerant response decoders, strict request authoring) plus the two DevEx
+fixes above. P2 (request extras forbidden) stays; P1 is now "response extras
+ignored", not rejected.
 
 The transform is purely syntactic so we can run it on the codegen output
 without parsing Python AST. Idempotent: re-runs upgrade an existing
@@ -50,7 +57,32 @@ from pathlib import Path
 # `root-model-extra`), so skip them. Their behavior is governed by the
 # inner type, which on its own enforces strict validation.
 CLASS_RE = re.compile(r"^class\s+([A-Za-z_][\w]*)\s*\(\s*(BaseModel)\s*\)\s*:\s*$")
-CONFIG_LINE = "    model_config = ConfigDict(extra='forbid', populate_by_name=True)"
+CONFIG_LINE_STRICT = (
+    "    model_config = ConfigDict(extra='forbid', populate_by_name=True)"
+)
+CONFIG_LINE_TOLERANT = (
+    "    model_config = ConfigDict(extra='ignore', populate_by_name=True)"
+)
+
+
+def _is_response_shape(class_name: str) -> bool:
+    """Tolerate unknown fields on every non-authoring model (Postel's Law).
+
+    ``*Request`` / ``*Params`` stay ``extra='forbid'``. Everything else —
+    ``*Dto``, nested value objects on those DTOs (``StatusPageBranding``,
+    check-detail variants, channel configs), envelopes — ignores unknown
+    keys so an additive API field is a non-event. Shared nested types used
+    on both request and response follow the response rule: crashing a
+    ``get`` / ``list`` is worse than dropping an unknown nested request key
+    the API would ignore anyway.
+    """
+    if not class_name or class_name[0].islower():
+        return False
+    return not class_name.endswith(("Request", "Params"))
+
+
+# Keep the old name for backward compat in case anything imports it
+CONFIG_LINE = CONFIG_LINE_STRICT
 
 # Doc-banner injections keyed by class name. Inserted as a leading docstring
 # inside the target class so the note shows up in IDE hovers and stays put
@@ -61,7 +93,7 @@ CLASS_BANNERS: dict[str, str] = {
         "Note: ``currentStatus`` was removed from this DTO. "
         "Inspect ``enabled`` and the incident-policy API to derive a "
         "live status for a monitor instead."
-    ),
+    )
 }
 
 
@@ -87,9 +119,7 @@ def inject(source: str) -> tuple[str, int]:
     """Return (new_source, count_of_classes_modified)."""
     if "from pydantic import" in source and "ConfigDict" not in source:
         source = source.replace(
-            "from pydantic import",
-            "from pydantic import ConfigDict, ",
-            1,
+            "from pydantic import", "from pydantic import ConfigDict, ", 1
         )
         source = source.replace("ConfigDict, ConfigDict, ", "ConfigDict, ", 1)
 
@@ -130,6 +160,11 @@ def inject(source: str) -> tuple[str, int]:
             i += 1
             continue
         class_name = m.group(1)
+        config_line = (
+            CONFIG_LINE_TOLERANT
+            if _is_response_shape(class_name)
+            else CONFIG_LINE_STRICT
+        )
         # Look at the very next line. If it's already model_config or pass,
         # leave the class alone (idempotency / empty class).
         next_idx = i + 1
@@ -141,10 +176,10 @@ def inject(source: str) -> tuple[str, int]:
             out.append(f'    """{banner}"""\n')
             modified += 1
         if "model_config" in next_line:
-            # Upgrade the existing config line to include populate_by_name=True
-            # if it isn't already there. Idempotent across re-runs.
-            if "populate_by_name" not in next_line:
-                out.append(CONFIG_LINE + "\n")
+            # Replace the existing config line if it doesn't match the
+            # desired strictness or is missing populate_by_name.
+            if next_line.strip() != config_line.strip():
+                out.append(config_line + "\n")
                 i += 2  # replace the existing model_config line
                 modified += 1
                 continue
@@ -154,11 +189,11 @@ def inject(source: str) -> tuple[str, int]:
         # exact match (NOT startswith) — fields like `passed: Annotated[...]`
         # also start with "pass" but are not empty class markers.
         if next_line.strip() in ("pass", "pass\n"):
-            out.append(CONFIG_LINE + "\n")
+            out.append(config_line + "\n")
             i += 2  # skip the pass
             modified += 1
             continue
-        out.append(CONFIG_LINE + "\n")
+        out.append(config_line + "\n")
         modified += 1
         i += 1
     return "".join(out), modified

{devhelm-1.4.0 → devhelm-1.6.0}/scripts/typegen.sh

@@ -69,11 +69,10 @@ uv run datamodel-codegen \
 # satisfying the discriminator requirement and making the field optional at
 # construction (callers don't need to repeat the discriminator value).
 
-# Post-process: inject `model_config = ConfigDict(extra='forbid')` into every
-# generated class so that requests with unknown fields and responses with
-# unknown fields BOTH fail loudly. Implements P1 + P2 from
-# `mini/cowork/design/040-codegen-policies.md`.
-echo "=> Injecting strict-fail config (extra='forbid') into generated models..."
+# Post-process: extra='forbid' on *Request/*Params, extra='ignore' on every
+# other generated model (Postel's Law — additive API response fields must
+# not crash). See scripts/inject_strict_config.py.
+echo "=> Injecting model_config (forbid on requests, ignore on responses)..."
 uv run python "$SCRIPT_DIR/inject_strict_config.py" "$OUTPUT"
 
 # Re-format after injection so the file stays ruff-clean. Non-fatal so the