dnsid 0.26.0__tar.gz

dnsid-0.26.0/.gitattributes

@@ -0,0 +1,2 @@
+# Generated API reference — collapsed by default in PR diffs.
+docs/reference/** linguist-generated=true

dnsid-0.26.0/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @dnsid-ai/sdk-maintainers

dnsid-0.26.0/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

dnsid-0.26.0/.github/workflows/codeql.yml

@@ -0,0 +1,33 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '27 3 * * 1'
+
+permissions:
+  security-events: write
+  packages: read
+  actions: read
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['python']
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+      - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        with:
+          category: /language:${{ matrix.language }}

dnsid-0.26.0/.github/workflows/compliance.yaml

@@ -0,0 +1,14 @@
+name: Compliance
+on: pull_request
+permissions:
+  contents: read
+  issues: write
+jobs:
+  compliance:
+    # The private compliance harness is not available to fork pull requests.
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    uses: dnsid-ai/dnsid-sdk-compliance/.github/workflows/sdk-compliance.yaml@74b48988742602e9ef95eec04f5638b366491ff2
+    with:
+      sdk: py
+      ref: ${{ github.event.pull_request.head.sha }}
+      base-ref: ${{ github.event.pull_request.base.sha }}

dnsid-0.26.0/.github/workflows/lint-test.yml

@@ -0,0 +1,57 @@
+name: Lint and Test
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  lint-test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      # Scans the installed environment (runtime + dev). Accepted risks: add
+      # `--ignore-vuln <ID>` here with a comment linking the advisory.
+      - name: Dependency vulnerability audit
+        if: matrix.python-version == '3.13'
+        run: pip install pip-audit && pip-audit
+
+      - name: Ruff lint check
+        run: ruff check .
+
+      - name: Mypy type check
+        run: mypy dnsid
+
+      - name: Run tests
+        run: pytest
+
+      # Advisory only: the regen-docs workflow pushes regenerated reference
+      # docs to same-repo PR branches automatically. The warning matters for
+      # fork PRs, where the bot cannot push.
+      - name: Docs freshness (generated reference)
+        if: matrix.python-version == '3.13'
+        run: |
+          python scripts/gen_docs.py
+          git diff --exit-code docs/reference/ || {
+            echo "::warning::docs/reference/ is stale — the auto-regen workflow pushes the fix to same-repo PRs; fork authors run python scripts/gen_docs.py and commit the result"
+            exit 0
+          }

dnsid-0.26.0/.github/workflows/regen-docs.yml

@@ -0,0 +1,73 @@
+name: Auto-regenerate reference docs
+
+# On every same-repo PR push, regenerate docs/reference/ and, when the output
+# changed, push the fix to the PR branch — contributors never run the docs
+# generator by hand. Fork PRs are skipped (GITHUB_TOKEN cannot push to forks);
+# the freshness warning in lint-test.yml still tells fork authors the manual
+# command.
+#
+# Loop guard: the job skips when the actor is github-actions[bot] (GraphQL-created
+# commits do re-trigger pull_request), and a re-run would find no diff anyway. The same property means CI results shown on the PR
+# belong to the contributor's last commit; the bot commit only touches
+# docs/reference/, which no test job consumes.
+on:
+  pull_request:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: regen-docs-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  regen:
+    # actor guard: createCommitOnBranch commits DO re-trigger pull_request, unlike GITHUB_TOKEN git pushes
+    if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'github-actions[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Regenerate reference
+        run: python scripts/gen_docs.py
+
+      # Commit through the GraphQL API instead of `git commit`: commits created
+      # by createCommitOnBranch are signed by GitHub's web-flow key, so the bot
+      # commit is Verified and satisfies signed-commit branch protection. A
+      # GITHUB_TOKEN commit still does not re-trigger this workflow.
+      - name: Commit and push if changed
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+        run: |
+          git add -A docs/reference/
+          if git diff --cached --quiet; then
+            echo "reference is current"
+            exit 0
+          fi
+          git diff --cached --name-only --diff-filter=AM -z \
+            | while IFS= read -r -d '' f; do base64 -w0 < "$f" > /tmp/b64; jq -n --arg p "$f" --rawfile c /tmp/b64 '{path: $p, contents: $c}'; done \
+            | jq -s . > /tmp/additions.json
+          git diff --cached --name-only --diff-filter=D -z \
+            | jq -Rs 'split("\u0000") | map(select(length > 0) | {path: .})' > /tmp/deletions.json
+          jq -n --arg repo "$GITHUB_REPOSITORY" --arg branch "$BRANCH" --arg head "$(git rev-parse HEAD)" \
+            --slurpfile additions /tmp/additions.json --slurpfile deletions /tmp/deletions.json '{
+              query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid } } }",
+              variables: { input: {
+                branch: { repositoryNameWithOwner: $repo, branchName: $branch },
+                expectedHeadOid: $head,
+                message: { headline: "docs: regenerate reference" },
+                fileChanges: { additions: $additions[0], deletions: $deletions[0] }
+              } }
+            }' > /tmp/commit.json
+          gh api graphql --input /tmp/commit.json --jq '.data.createCommitOnBranch.commit.oid'

dnsid-0.26.0/.github/workflows/release-pr.yml

@@ -0,0 +1,91 @@
+name: Update Release PR
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-release-pr:
+    if: "!startsWith(github.event.head_commit.message, 'chore: update changelog and version') && !startsWith(github.event.head_commit.message, 'Release v')"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install git-cliff
+        uses: taiki-e/install-action@861a07ce7084f55488e375df125cdc99bba60eb7 # v2
+        with:
+          tool: git-cliff
+
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Compute next version and changelog
+        id: prep
+        run: |
+          NEXT=$(git cliff --bumped-version | head -1)
+          [ -n "$NEXT" ] || { echo "ERROR: git-cliff --bumped-version returned an empty version"; exit 1; }
+
+          CURRENT="v$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
+          if [ "$NEXT" = "$CURRENT" ] && git rev-parse "refs/tags/${CURRENT}" >/dev/null 2>&1; then
+            echo "No releasable commits found (computed: ${NEXT}, current: ${CURRENT}). Skipping."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+            echo "version=$NEXT" >> "$GITHUB_OUTPUT"
+            if [ "$NEXT" = "$CURRENT" ]; then
+              python - "$CURRENT" <<'PY'
+          import sys
+          from pathlib import Path
+
+          path = Path("CHANGELOG.md")
+          changelog = path.read_text()
+          marker = f"## [{sys.argv[1].removeprefix('v')}]"
+          start = changelog.find(marker)
+          if start != -1:
+              next_start = changelog.find("\n## [", start + 1)
+              path.write_text(changelog[:start] + changelog[next_start + 1 if next_start != -1 else len(changelog):])
+          PY
+            fi
+            git cliff --unreleased --tag "$NEXT" --prepend CHANGELOG.md
+            python - "$NEXT" <<'PY' > /tmp/release-notes.md
+          import sys
+          from pathlib import Path
+
+          version = sys.argv[1].removeprefix("v")
+          changelog = Path("CHANGELOG.md").read_text()
+          marker = f"## [{version}]"
+          start = changelog.find(marker)
+          if start == -1:
+              raise SystemExit(f"ERROR: {marker} not found in CHANGELOG.md")
+
+          next_start = changelog.find("\n## [", start + 1)
+          section = changelog[start : next_start if next_start != -1 else len(changelog)]
+          print(section.strip())
+          PY
+          fi
+
+      - name: Bump pyproject.toml version
+        if: steps.prep.outputs.skip != 'true'
+        run: |
+          VERSION="${{ steps.prep.outputs.version }}"
+          VERSION_BARE="${VERSION#v}"
+          sed -i "s/^version = \".*\"/version = \"${VERSION_BARE}\"/" pyproject.toml
+
+      - name: Open or update release PR
+        if: steps.prep.outputs.skip != 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
+        with:
+          branch: release/next
+          sign-commits: true
+          title: "Release ${{ steps.prep.outputs.version }}"
+          body-path: /tmp/release-notes.md
+          commit-message: "chore: update changelog and version"
+          labels: autorelease

dnsid-0.26.0/.github/workflows/release.yml

@@ -0,0 +1,160 @@
+name: Release
+
+# Triggered when the "release/next" PR is merged into main, or manually.
+#
+# The `publish-pypi` job uploads the same checked wheel + sdist to PyPI via
+# trusted publishing (OIDC; no API token stored here). It is gated on the
+# repository variable PYPI_PUBLISHING == "enabled" so releases keep working
+# while the PyPI project name / trusted publisher are pending. To enable:
+#   1. PyPI project `dnsid` → Publishing → add GitHub publisher
+#      (owner dnsid-ai, repo dnsid-py, workflow release.yml, environment pypi)
+#   2. Repo Settings → Environments → create `pypi` (add required reviewers if desired)
+#   3. Repo Settings → Variables → PYPI_PUBLISHING = enabled
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  attestations: write
+  contents: write
+  id-token: write
+
+jobs:
+  release:
+    if: >-
+      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') ||
+      (github.event.pull_request.merged == true &&
+      github.event.pull_request.head.ref == 'release/next' &&
+      github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Read version
+        id: version
+        run: |
+          VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          [ -n "$VERSION" ] || { echo "ERROR: could not read version from pyproject.toml"; exit 1; }
+          echo "version=v${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Extract release notes
+        run: |
+          python - "${{ steps.version.outputs.version }}" <<'PY' > /tmp/release-notes.md
+          import sys
+          from pathlib import Path
+
+          version = sys.argv[1].removeprefix("v")
+          changelog = Path("CHANGELOG.md").read_text()
+          marker = f"## [{version}]"
+          start = changelog.find(marker)
+          if start == -1:
+              raise SystemExit(f"ERROR: {marker} not found in CHANGELOG.md")
+
+          next_start = changelog.find("\n## [", start + 1)
+          section = changelog[start : next_start if next_start != -1 else len(changelog)]
+          print(section.strip())
+          PY
+          echo "--- release notes ---"
+          cat /tmp/release-notes.md
+
+      - name: Verify release tag
+        id: tag
+        run: |
+          TAG="${{ steps.version.outputs.version }}"
+          if git rev-parse "refs/tags/${TAG}" >/dev/null 2>&1; then
+            [ "$(git rev-list -n 1 "${TAG}")" = "$GITHUB_SHA" ] || {
+              echo "ERROR: ${TAG} does not point at release commit ${GITHUB_SHA}"
+              exit 1
+            }
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Install build tools
+        run: python -m pip install build twine
+
+      - name: Build and check package
+        run: |
+          python -m build
+          python -m twine check dist/*
+
+      - name: Smoke test wheel
+        run: |
+          python -m venv /tmp/dnsid-smoke
+          /tmp/dnsid-smoke/bin/pip install dist/*.whl
+          (cd /tmp && /tmp/dnsid-smoke/bin/python -c "import dnsid")
+
+      - name: Upload distribution artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+      - name: Attest package provenance
+        if: github.event.repository.private == false
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+
+      - name: Tag release
+        if: steps.tag.outputs.exists != 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "${{ steps.version.outputs.version }}" -m "Release ${{ steps.version.outputs.version }}"
+          git push origin "${{ steps.version.outputs.version }}"
+
+      - name: Generate SBOM (CycloneDX)
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: sbom.cdx.json
+          upload-artifact: false
+
+      - name: Create GitHub Release
+        run: |
+          if gh release view "${{ steps.version.outputs.version }}" >/dev/null 2>&1; then
+            echo "Release ${{ steps.version.outputs.version }} already exists, skipping"
+          else
+            gh release create "${{ steps.version.outputs.version }}" \
+              dist/* sbom.cdx.json \
+              --verify-tag \
+              --title "Release ${{ steps.version.outputs.version }}" \
+              --notes-file /tmp/release-notes.md
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-pypi:
+    needs: release
+    if: vars.PYPI_PUBLISHING == 'enabled'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/dnsid/
+    permissions:
+      id-token: write
+    steps:
+      - name: Download distribution artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI (trusted publishing)
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          attestations: true

dnsid-0.26.0/.gitignore

@@ -0,0 +1,57 @@
+# Python
+__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+*.so
+*.egg
+*.egg-info/
+dist/
+build/
+wheels/
+sdist/
+*.egg-link
+pip-wheel-metadata/
+MANIFEST
+
+# Virtual environments
+.venv/
+venv/
+env/
+ENV/
+
+# Testing / coverage
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+*.xml
+
+# Type checking
+.mypy_cache/
+.dmypy.json
+.pytype/
+
+# Ruff / linters
+.ruff_cache/
+
+# Distribution / packaging
+*.tar.gz
+*.whl
+
+# Testnet runtime files (generated keys, certs)
+.testnet/
+keys.json
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+.DS_Store
+
+# Local scratch (never committed)
+.claude/
+/TASK*.md
+/*_ISSUES.md

dnsid-0.26.0/.gitleaksignore

@@ -0,0 +1,4 @@
+# false positives: AWS KMS key_spec enum, not a secret
+tests/test_aws_kms_key_provider.py:generic-api-key:75
+tests/test_aws_kms_key_provider.py:generic-api-key:95
+tests/test_aws_kms_key_provider.py:generic-api-key:311