dominus-sdk-python 9.0.13__tar.gz → 9.0.15__tar.gz

{dominus_sdk_python-9.0.13 → dominus_sdk_python-9.0.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dominus-sdk-python
-Version: 9.0.13
+Version: 9.0.15
 Summary: Python SDK for the Dominus gateway-first platform
 Author-email: CareBridge Systems <dev@carebridge.io>
 License-Expression: LicenseRef-Proprietary
@@ -48,7 +48,7 @@ cleanup audit is `docs/janitor/2026-09-19-1300-sdk-python-cleanup-audit.md`.
 - Gateway-scoped client mode for MCP and other user-JWT sessions
 - Transport compatibility for wrapped `{success,data}` responses and unwrapped Warden/control-plane success objects
 - Local helpers for JWT verification, trace propagation, retries, and console capture
-- Current package version: `9.0.13`
+- Current package version: `9.0.15`
 
 ## Install
 

{dominus_sdk_python-9.0.13 → dominus_sdk_python-9.0.15}/README.md

@@ -15,7 +15,7 @@ cleanup audit is `docs/janitor/2026-09-19-1300-sdk-python-cleanup-audit.md`.
 - Gateway-scoped client mode for MCP and other user-JWT sessions
 - Transport compatibility for wrapped `{success,data}` responses and unwrapped Warden/control-plane success objects
 - Local helpers for JWT verification, trace propagation, retries, and console capture
-- Current package version: `9.0.13`
+- Current package version: `9.0.15`
 
 ## Install
 

{dominus_sdk_python-9.0.13 → dominus_sdk_python-9.0.15}/dominus/__init__.py

@@ -191,7 +191,7 @@ from .errors import (
     TimeoutError as DominusTimeoutError,
 )
 
-__version__ = "9.0.13"
+__version__ = "9.0.15"
 __all__ = [
     # Main SDK instance
     "dominus",

{dominus_sdk_python-9.0.13 → dominus_sdk_python-9.0.15}/dominus/namespaces/secrets.py

@@ -262,15 +262,22 @@ class SecretsNamespace:
         environment: str,
         project_id: str,
     ) -> Dict[str, Any]:
-        """Set one Infisical secret for an environment (``POST /api/secrets/set``)."""
+        """Set one Infisical secret for an environment (``POST /api/secrets/set``).
+
+        The wire keys are the canonical ``target_org_id`` / ``target_env``
+        (PLAN T6 / board T7); secrets-core rejects the retired
+        ``target_project_id`` / ``environment`` aliases with a typed
+        ``invalid_wire_key`` validation error. The Python parameter names are
+        unchanged — only the request body vocabulary is canonical.
+        """
         return await self._client._request(
             endpoint="/api/secrets/set",
             method="POST",
             body={
                 "key": key,
                 "value": value,
-                "environment": environment,
-                "target_project_id": project_id,
+                "target_env": environment,
+                "target_org_id": project_id,
             },
             use_gateway=True,
         )
@@ -282,14 +289,17 @@ class SecretsNamespace:
         environment: str,
         project_id: str,
     ) -> Dict[str, Any]:
-        """Delete one Infisical secret for an environment (``POST /api/secrets/delete``)."""
+        """Delete one Infisical secret for an environment (``POST /api/secrets/delete``).
+
+        Canonical wire keys only — see :meth:`set_project_secret`.
+        """
         return await self._client._request(
             endpoint="/api/secrets/delete",
             method="POST",
             body={
                 "key": key,
-                "environment": environment,
-                "target_project_id": project_id,
+                "target_env": environment,
+                "target_org_id": project_id,
             },
             use_gateway=True,
         )

{dominus_sdk_python-9.0.13 → dominus_sdk_python-9.0.15}/dominus/start.py

@@ -437,7 +437,9 @@ class Dominus:
                     response = await client.get(endpoint)
                 elif method == "DELETE":
                     # Kernel wire format: same base64 JSON body as POST (Node SDK parity).
-                    response = await client.delete(endpoint, content=body_b64)
+                    # httpx.AsyncClient.delete() accepts no body kwarg (unlike
+                    # post/put), so use the generic verb to keep the body on the wire.
+                    response = await client.request("DELETE", endpoint, content=body_b64)
                 elif method == "PUT":
                     response = await client.put(endpoint, content=body_b64)
                 else:

{dominus_sdk_python-9.0.13 → dominus_sdk_python-9.0.15}/dominus_sdk_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dominus-sdk-python
-Version: 9.0.13
+Version: 9.0.15
 Summary: Python SDK for the Dominus gateway-first platform
 Author-email: CareBridge Systems <dev@carebridge.io>
 License-Expression: LicenseRef-Proprietary
@@ -48,7 +48,7 @@ cleanup audit is `docs/janitor/2026-09-19-1300-sdk-python-cleanup-audit.md`.
 - Gateway-scoped client mode for MCP and other user-JWT sessions
 - Transport compatibility for wrapped `{success,data}` responses and unwrapped Warden/control-plane success objects
 - Local helpers for JWT verification, trace propagation, retries, and console capture
-- Current package version: `9.0.13`
+- Current package version: `9.0.15`
 
 ## Install
 

{dominus_sdk_python-9.0.13 → dominus_sdk_python-9.0.15}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dominus-sdk-python"
-version = "9.0.13"
+version = "9.0.15"
 description = "Python SDK for the Dominus gateway-first platform"
 readme = "README.md"
 license = "LicenseRef-Proprietary"

{dominus_sdk_python-9.0.13 → dominus_sdk_python-9.0.15}/tests/test_secrets_presence_contract.py

@@ -120,6 +120,42 @@ async def test_malformed_responses_fail_without_raw_cell_in_error_or_logs(caplog
     assert RAW_SENTINEL not in caplog.text
 
 
+@pytest.mark.asyncio
+async def test_project_secret_mutations_speak_the_canonical_wire_vocabulary():
+    """T7 contracts the secrets request surface onto target_org_id/target_env.
+
+    dominus-secrets-core rejects the retired `target_project_id` / `environment`
+    aliases with a typed `invalid_wire_key` validation error instead of
+    silently ignoring them, so emitting either key here would 400 the call.
+    The Python method signatures keep their own parameter names; only the wire
+    body keys are canonical.
+    """
+    client = Client({"ok": True})
+    ns = SecretsNamespace(client)
+
+    await ns.set_project_secret(key="K", value="V", environment="production", project_id="org-1")
+    await ns.delete_project_secret(key="K", environment="production", project_id="org-1")
+
+    assert client.calls == [
+        {
+            "endpoint": "/api/secrets/set",
+            "method": "POST",
+            "body": {"key": "K", "value": "V", "target_env": "production", "target_org_id": "org-1"},
+            "use_gateway": True,
+        },
+        {
+            "endpoint": "/api/secrets/delete",
+            "method": "POST",
+            "body": {"key": "K", "target_env": "production", "target_org_id": "org-1"},
+            "use_gateway": True,
+        },
+    ]
+
+    for call in client.calls:
+        assert "target_project_id" not in call["body"]
+        assert "environment" not in call["body"]
+
+
 def test_public_types_and_return_annotation_are_exact():
     from dominus import SecretEnvironment, SecretPresenceCell, SecretPresenceGrid
     from dominus.namespaces import (

{dominus_sdk_python-9.0.13 → dominus_sdk_python-9.0.15}/tests/test_transport_compat.py

@@ -1,3 +1,4 @@
+import base64
 import json
 import sys
 from pathlib import Path
@@ -56,6 +57,51 @@ class RequestClient:
         return FakeResponse(json.dumps({"success": True, "data": {"ok": True}}))
 
 
+class HttpxFaithfulDeleteClient:
+    """Fake AsyncClient whose ``delete()`` mirrors httpx's real signature.
+
+    httpx.AsyncClient.delete() takes no body kwarg (unlike post/put), so a fake
+    that tolerated ``content=`` here would silently mask the very regression
+    these tests exist to catch. ``request()`` is the body-capable generic verb.
+    """
+
+    calls = []
+
+    def __init__(self, *, base_url, headers, timeout):
+        self.base_url = base_url
+        self.headers = headers
+        self.timeout = timeout
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, exc_type, exc, tb):
+        return False
+
+    async def delete(self, endpoint, *, params=None, headers=None, cookies=None):
+        # Exact httpx 0.28 surface: no content/json/data parameter.
+        raise AssertionError(
+            "_request() must not send a body through httpx's body-less delete(); "
+            "use client.request('DELETE', ...) instead"
+        )
+
+    async def get(self, endpoint):
+        self.calls.append({"method": "GET", "endpoint": endpoint, "content": None})
+        return FakeResponse(json.dumps({"success": True, "data": {"ok": True}}))
+
+    async def post(self, endpoint, content=None):
+        self.calls.append({"method": "POST", "endpoint": endpoint, "content": content})
+        return FakeResponse(json.dumps({"success": True, "data": {"ok": True}}))
+
+    async def put(self, endpoint, content=None):
+        self.calls.append({"method": "PUT", "endpoint": endpoint, "content": content})
+        return FakeResponse(json.dumps({"success": True, "data": {"ok": True}}))
+
+    async def request(self, method, endpoint, *, content=None, **kwargs):
+        self.calls.append({"method": method, "endpoint": endpoint, "content": content})
+        return FakeResponse(json.dumps({"success": True, "data": {"ok": True}}))
+
+
 class UnwrappedRequestClient:
     calls = []
 
@@ -199,6 +245,52 @@ async def test_request_accepts_raw_json_success_envelope(monkeypatch, sdk):
     assert RequestClient.calls[0]["endpoint"] == "/svc/health"
 
 
+@pytest.mark.asyncio
+async def test_guardian_delete_reaches_transport_with_body(monkeypatch, sdk):
+    """Regression: guardian_delete (no explicit body) hit httpx's delete() kwarg wall.
+
+    Live failure 2026-09-22: AsyncClient.delete() got an unexpected keyword
+    argument 'content' -- every DELETE through _request raised TypeError.
+    """
+    HttpxFaithfulDeleteClient.calls = []
+
+    async def fake_ensure_valid_jwt(psk_token, base_url):
+        return "jwt-abc"
+
+    monkeypatch.setattr(core_module, "_ensure_valid_jwt", fake_ensure_valid_jwt)
+    monkeypatch.setattr(start_module.httpx, "AsyncClient", HttpxFaithfulDeleteClient)
+
+    result = await sdk.auth.guardian_delete("tenants", "5d05b96e-0aef-4dbf-a4dc-19354da9f58e")
+
+    assert result == {"ok": True}
+    call = HttpxFaithfulDeleteClient.calls[0]
+    assert call["method"] == "DELETE"
+    assert call["endpoint"] == "/svc/guardian/tenants/5d05b96e-0aef-4dbf-a4dc-19354da9f58e"
+    assert call["content"] == base64.b64encode(json.dumps({}).encode()).decode()
+
+
+@pytest.mark.asyncio
+async def test_non_guardian_delete_reaches_transport_with_body(monkeypatch, sdk):
+    """Same shared _request path, non-guardian namespace, real body on the wire."""
+    HttpxFaithfulDeleteClient.calls = []
+
+    async def fake_ensure_valid_jwt(psk_token, base_url):
+        return "jwt-abc"
+
+    monkeypatch.setattr(core_module, "_ensure_valid_jwt", fake_ensure_valid_jwt)
+    monkeypatch.setattr(start_module.httpx, "AsyncClient", HttpxFaithfulDeleteClient)
+
+    result = await sdk.ddl.drop_table("public", "widgets")
+
+    assert result == {"ok": True}
+    call = HttpxFaithfulDeleteClient.calls[0]
+    assert call["method"] == "DELETE"
+    assert call["endpoint"] == "/svc/smith/schema/drop-table"
+    assert call["content"] == base64.b64encode(
+        json.dumps({"schema": "public", "table": "widgets"}).encode()
+    ).decode()
+
+
 @pytest.mark.asyncio
 async def test_request_accepts_unwrapped_control_plane_success(monkeypatch, sdk):
     UnwrappedRequestClient.calls = []