dominus-sdk-python 9.0.14__tar.gz → 9.0.16__tar.gz

{dominus_sdk_python-9.0.14 → dominus_sdk_python-9.0.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dominus-sdk-python
-Version: 9.0.14
+Version: 9.0.16
 Summary: Python SDK for the Dominus gateway-first platform
 Author-email: CareBridge Systems <dev@carebridge.io>
 License-Expression: LicenseRef-Proprietary
@@ -38,8 +38,9 @@ Async Python SDK for the Dominus gateway-first service plane.
 ## Agent Guide
 
 Start with `docs/agent-guide/INDEX.md`. The current snapshot is
-`docs/agent-guide/2026-09-19-1300-sdk-python/00-reading-order.md`; the latest
-cleanup audit is `docs/janitor/2026-09-19-1300-sdk-python-cleanup-audit.md`.
+`docs/agent-guide/2026-10-16-1300-sdk-python/00-reading-order.md`; the latest
+cleanup audit is `docs/janitor/2026-10-16-1300-sdk-python-cleanup-audit.md`.
+Knowledge graph: graphify-out/GRAPH_REPORT.md — query with `graphify-run query "<question>"` before grepping.
 
 ## What This Repo Ships
 
@@ -48,7 +49,7 @@ cleanup audit is `docs/janitor/2026-09-19-1300-sdk-python-cleanup-audit.md`.
 - Gateway-scoped client mode for MCP and other user-JWT sessions
 - Transport compatibility for wrapped `{success,data}` responses and unwrapped Warden/control-plane success objects
 - Local helpers for JWT verification, trace propagation, retries, and console capture
-- Current package version: `9.0.14`
+- Current package version: `9.0.16`
 
 ## Install
 

{dominus_sdk_python-9.0.14 → dominus_sdk_python-9.0.16}/README.md

@@ -5,8 +5,9 @@ Async Python SDK for the Dominus gateway-first service plane.
 ## Agent Guide
 
 Start with `docs/agent-guide/INDEX.md`. The current snapshot is
-`docs/agent-guide/2026-09-19-1300-sdk-python/00-reading-order.md`; the latest
-cleanup audit is `docs/janitor/2026-09-19-1300-sdk-python-cleanup-audit.md`.
+`docs/agent-guide/2026-10-16-1300-sdk-python/00-reading-order.md`; the latest
+cleanup audit is `docs/janitor/2026-10-16-1300-sdk-python-cleanup-audit.md`.
+Knowledge graph: graphify-out/GRAPH_REPORT.md — query with `graphify-run query "<question>"` before grepping.
 
 ## What This Repo Ships
 
@@ -15,7 +16,7 @@ cleanup audit is `docs/janitor/2026-09-19-1300-sdk-python-cleanup-audit.md`.
 - Gateway-scoped client mode for MCP and other user-JWT sessions
 - Transport compatibility for wrapped `{success,data}` responses and unwrapped Warden/control-plane success objects
 - Local helpers for JWT verification, trace propagation, retries, and console capture
-- Current package version: `9.0.14`
+- Current package version: `9.0.16`
 
 ## Install
 

{dominus_sdk_python-9.0.14 → dominus_sdk_python-9.0.16}/dominus/__init__.py

@@ -191,7 +191,7 @@ from .errors import (
     TimeoutError as DominusTimeoutError,
 )
 
-__version__ = "9.0.14"
+__version__ = "9.0.16"
 __all__ = [
     # Main SDK instance
     "dominus",

{dominus_sdk_python-9.0.14 → dominus_sdk_python-9.0.16}/dominus/helpers/cache.py

@@ -108,7 +108,7 @@ def exponential_backoff_with_jitter(
     """
     delay = min(base_delay * (2 ** attempt), max_delay)
     jitter_range = delay * jitter
-    return delay + random.uniform(-jitter_range, jitter_range)
+    return min(max_delay, delay + random.uniform(-jitter_range, jitter_range))
 
 
 class DominusCache:
@@ -124,7 +124,7 @@ class DominusCache:
     """
 
     def __init__(self, default_ttl: int = 300):
-        self._store: Dict[str, Tuple[bytes, float]] = {}
+        self._store: Dict[str, Tuple[bytes, float, int]] = {}
         self._default_ttl = default_ttl
         self._cipher: Optional[Fernet] = None
 
@@ -141,7 +141,7 @@ class DominusCache:
         if not entry:
             return None
 
-        encrypted_value, expires_at = entry
+        encrypted_value, expires_at, duration = entry
 
         # Check expiry
         if time.time() >= expires_at:
@@ -159,8 +159,8 @@ class DominusCache:
         else:
             value = json.loads(encrypted_value.decode())
 
-        # Touch TTL
-        self._store[key] = (encrypted_value, time.time() + self._default_ttl)
+        # Touch TTL using the entry's own duration
+        self._store[key] = (encrypted_value, time.time() + duration, duration)
         return value
 
     def set(self, key: str, value: Any, ttl: Optional[int] = None) -> None:
@@ -173,7 +173,7 @@ class DominusCache:
         else:
             encrypted_value = json.dumps(value).encode()
 
-        self._store[key] = (encrypted_value, time.time() + duration)
+        self._store[key] = (encrypted_value, time.time() + duration, duration)
 
     def delete(self, key: str) -> bool:
         """Delete key."""

{dominus_sdk_python-9.0.14 → dominus_sdk_python-9.0.16}/dominus/namespaces/secrets.py

@@ -262,15 +262,22 @@ class SecretsNamespace:
         environment: str,
         project_id: str,
     ) -> Dict[str, Any]:
-        """Set one Infisical secret for an environment (``POST /api/secrets/set``)."""
+        """Set one Infisical secret for an environment (``POST /api/secrets/set``).
+
+        The wire keys are the canonical ``target_org_id`` / ``target_env``
+        (PLAN T6 / board T7); secrets-core rejects the retired
+        ``target_project_id`` / ``environment`` aliases with a typed
+        ``invalid_wire_key`` validation error. The Python parameter names are
+        unchanged — only the request body vocabulary is canonical.
+        """
         return await self._client._request(
             endpoint="/api/secrets/set",
             method="POST",
             body={
                 "key": key,
                 "value": value,
-                "environment": environment,
-                "target_project_id": project_id,
+                "target_env": environment,
+                "target_org_id": project_id,
             },
             use_gateway=True,
         )
@@ -282,14 +289,17 @@ class SecretsNamespace:
         environment: str,
         project_id: str,
     ) -> Dict[str, Any]:
-        """Delete one Infisical secret for an environment (``POST /api/secrets/delete``)."""
+        """Delete one Infisical secret for an environment (``POST /api/secrets/delete``).
+
+        Canonical wire keys only — see :meth:`set_project_secret`.
+        """
         return await self._client._request(
             endpoint="/api/secrets/delete",
             method="POST",
             body={
                 "key": key,
-                "environment": environment,
-                "target_project_id": project_id,
+                "target_env": environment,
+                "target_org_id": project_id,
             },
             use_gateway=True,
         )

{dominus_sdk_python-9.0.14 → dominus_sdk_python-9.0.16}/dominus_sdk_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dominus-sdk-python
-Version: 9.0.14
+Version: 9.0.16
 Summary: Python SDK for the Dominus gateway-first platform
 Author-email: CareBridge Systems <dev@carebridge.io>
 License-Expression: LicenseRef-Proprietary
@@ -38,8 +38,9 @@ Async Python SDK for the Dominus gateway-first service plane.
 ## Agent Guide
 
 Start with `docs/agent-guide/INDEX.md`. The current snapshot is
-`docs/agent-guide/2026-09-19-1300-sdk-python/00-reading-order.md`; the latest
-cleanup audit is `docs/janitor/2026-09-19-1300-sdk-python-cleanup-audit.md`.
+`docs/agent-guide/2026-10-16-1300-sdk-python/00-reading-order.md`; the latest
+cleanup audit is `docs/janitor/2026-10-16-1300-sdk-python-cleanup-audit.md`.
+Knowledge graph: graphify-out/GRAPH_REPORT.md — query with `graphify-run query "<question>"` before grepping.
 
 ## What This Repo Ships
 
@@ -48,7 +49,7 @@ cleanup audit is `docs/janitor/2026-09-19-1300-sdk-python-cleanup-audit.md`.
 - Gateway-scoped client mode for MCP and other user-JWT sessions
 - Transport compatibility for wrapped `{success,data}` responses and unwrapped Warden/control-plane success objects
 - Local helpers for JWT verification, trace propagation, retries, and console capture
-- Current package version: `9.0.14`
+- Current package version: `9.0.16`
 
 ## Install
 

{dominus_sdk_python-9.0.14 → dominus_sdk_python-9.0.16}/dominus_sdk_python.egg-info/SOURCES.txt

@@ -58,6 +58,7 @@ tests/test_artifacts_namespace.py
 tests/test_auth.py
 tests/test_authority_public_vocabulary.py
 tests/test_browser_namespace.py
+tests/test_cache_contracts.py
 tests/test_contract.py
 tests/test_control_plane_namespaces.py
 tests/test_error_recovery_action.py

{dominus_sdk_python-9.0.14 → dominus_sdk_python-9.0.16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dominus-sdk-python"
-version = "9.0.14"
+version = "9.0.16"
 description = "Python SDK for the Dominus gateway-first platform"
 readme = "README.md"
 license = "LicenseRef-Proprietary"

dominus_sdk_python-9.0.16/tests/test_cache_contracts.py

@@ -0,0 +1,115 @@
+"""Regression contracts for dominus.helpers.cache.
+
+Pins two documented behaviours that the implementation previously broke:
+
+1. ``exponential_backoff_with_jitter`` must never return a delay above the
+   ``max_delay`` cap, including when the exponential term already equals the
+   cap and positive jitter would otherwise push it over.
+2. ``DominusCache.get`` refreshes an entry using the TTL that ``set`` was
+   given (or ``default_ttl`` when none was supplied), never silently swapping
+   a short per-entry TTL for the cache default.
+
+Randomness is seeded so the backoff assertions are fully deterministic.
+"""
+import random
+
+import pytest
+
+import dominus.helpers.cache as cache_module
+from dominus.helpers.cache import (
+    DominusCache,
+    exponential_backoff_with_jitter,
+)
+
+
+class _Clock:
+    """Deterministic, advanceable replacement for ``time.time``."""
+
+    def __init__(self, start: float = 1000.0):
+        self.now = start
+
+    def __call__(self) -> float:
+        return self.now
+
+
+def test_backoff_never_exceeds_max_delay_across_attempts():
+    random.seed(1234)
+
+    samples = [
+        exponential_backoff_with_jitter(attempt, base_delay=1.0, max_delay=8.0, jitter=0.5)
+        for attempt in range(0, 8)
+        for _ in range(200)
+    ]
+
+    assert samples, "expected backoff samples"
+    assert all(delay <= 8.0 for delay in samples)
+    assert all(delay >= 0.0 for delay in samples)
+
+
+def test_backoff_caps_at_boundary_where_exponential_equals_max_delay():
+    # base_delay * 2 ** attempt == max_delay exactly at attempt 3 (1.0 * 8 == 8.0).
+    random.seed(7)
+
+    samples = [
+        exponential_backoff_with_jitter(3, base_delay=1.0, max_delay=8.0, jitter=0.5)
+        for _ in range(500)
+    ]
+
+    assert max(samples) <= 8.0
+    # Jitter must still be applied below the cap: some draws land under it.
+    assert min(samples) < 8.0
+
+
+def test_backoff_preserves_growth_and_jitter_below_cap():
+    # attempt 2 -> exponential term 4.0, strictly below the 8.0 cap, so the
+    # +/-50% jitter band must be intact and unclamped.
+    random.seed(99)
+
+    samples = [
+        exponential_backoff_with_jitter(2, base_delay=1.0, max_delay=8.0, jitter=0.5)
+        for _ in range(300)
+    ]
+
+    assert all(2.0 <= delay <= 6.0 for delay in samples)
+    assert any(delay < 4.0 for delay in samples)
+    assert any(delay > 4.0 for delay in samples)
+
+
+def test_get_refresh_preserves_explicit_per_entry_ttl(monkeypatch):
+    clock = _Clock()
+    monkeypatch.setattr(cache_module.time, "time", clock)
+
+    cache = DominusCache(default_ttl=300)
+    cache.set("short", "value", ttl=10)
+
+    clock.now += 5
+    assert cache.get("short") == "value"  # refresh must reuse the 10s TTL
+
+    clock.now += 11  # 1016s > refreshed expiry 1015s (5 + 10)
+    assert cache.get("short") is None
+
+
+def test_get_refresh_uses_default_ttl_when_entry_has_none(monkeypatch):
+    clock = _Clock()
+    monkeypatch.setattr(cache_module.time, "time", clock)
+
+    cache = DominusCache(default_ttl=300)
+    cache.set("default", "value")
+
+    clock.now += 100
+    assert cache.get("default") == "value"  # refresh to now + 300s
+
+    clock.now += 301  # 1401s > refreshed expiry 1400s (1100 + 300)
+    assert cache.get("default") is None
+
+
+def test_encrypted_cache_round_trips():
+    cache = DominusCache(default_ttl=300)
+    cache.set_encryption_key("super-secret-token")
+
+    assert cache._cipher is not None
+
+    payload = {"nested": {"a": 1, "b": [1, 2, 3]}, "text": "value"}
+    cache.set("encrypted", payload, ttl=30)
+
+    assert cache.get("encrypted") == payload

{dominus_sdk_python-9.0.14 → dominus_sdk_python-9.0.16}/tests/test_secrets_presence_contract.py

@@ -120,6 +120,42 @@ async def test_malformed_responses_fail_without_raw_cell_in_error_or_logs(caplog
     assert RAW_SENTINEL not in caplog.text
 
 
+@pytest.mark.asyncio
+async def test_project_secret_mutations_speak_the_canonical_wire_vocabulary():
+    """T7 contracts the secrets request surface onto target_org_id/target_env.
+
+    dominus-secrets-core rejects the retired `target_project_id` / `environment`
+    aliases with a typed `invalid_wire_key` validation error instead of
+    silently ignoring them, so emitting either key here would 400 the call.
+    The Python method signatures keep their own parameter names; only the wire
+    body keys are canonical.
+    """
+    client = Client({"ok": True})
+    ns = SecretsNamespace(client)
+
+    await ns.set_project_secret(key="K", value="V", environment="production", project_id="org-1")
+    await ns.delete_project_secret(key="K", environment="production", project_id="org-1")
+
+    assert client.calls == [
+        {
+            "endpoint": "/api/secrets/set",
+            "method": "POST",
+            "body": {"key": "K", "value": "V", "target_env": "production", "target_org_id": "org-1"},
+            "use_gateway": True,
+        },
+        {
+            "endpoint": "/api/secrets/delete",
+            "method": "POST",
+            "body": {"key": "K", "target_env": "production", "target_org_id": "org-1"},
+            "use_gateway": True,
+        },
+    ]
+
+    for call in client.calls:
+        assert "target_project_id" not in call["body"]
+        assert "environment" not in call["body"]
+
+
 def test_public_types_and_return_annotation_are_exact():
     from dominus import SecretEnvironment, SecretPresenceCell, SecretPresenceGrid
     from dominus.namespaces import (