dyno-phi 0.3.0__tar.gz → 0.3.2__tar.gz

{dyno_phi-0.3.0 → dyno_phi-0.3.2}/.gitignore

@@ -92,6 +92,7 @@ cloudbuild/*.log
 *.pdb
 !tests/fixtures/metrics/ipsae_nonzero_multisubchain.pdb
 !examples/bindcraft2/*.pdb
+!experiments/campaigns/y4_agent_designs/assets/*.pdb
 *.cif
 !examples/bindcraft2/*.cif
 *.csv
@@ -122,4 +123,6 @@ experiments/cxcr3_vhh_design/data/scored/refold_manifest*.tsv
 # Agent-development guide is account/app-specific (DynoPhiAgent). Other
 # contributors run different agents/apps, so keep it local-only, not in the
 # shared repo.
-docs/agent-development.md
+docs/agent-development.md
+# The tag ruleset the docs tell an admin to apply; *.json is ignored above.
+!docs/github-rulesets/tags.json

dyno_phi-0.3.2/CHANGELOG.md

@@ -0,0 +1,134 @@
+# Changelog
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the
+package follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). The
+version is read from `src/phi/_version.py`; a release is the tag `client-v<version>`
+on `dynotx/phi-api`, which `.github/workflows/publish-client.yml` builds and publishes.
+
+## [Unreleased]
+
+## [0.3.2] - 2026-10-27
+
+### Changed
+
+- `phi auth whoami`'s `credits_available`, `phi quota`'s available line and the
+  `insufficient credits` message count purchased credits as well as the
+  allowance (`total_available`, falling back to `credits_available` on an older
+  server). `Quota.spendable` is that number; `phi quota` adds an allowance line.
+- `runs.estimate` sends `params` and `inputs`, and the estimate breakdown is a
+  list of `{stage, unit, count, cents}`. `phi pipeline estimate` asks
+  `POST /v1/jobs/estimate` for the price a submit would reserve.
+- `phi auth login` no longer prompts for a base URL and a key by default; that
+  is `phi auth login --interactive --key`.
+
+### Added
+
+- `JobTypeSchema.typical_seconds`, `PipelineTypeResponse.typical_seconds`,
+  `JobSubmitResponse.estimated_seconds` and `Job.typical_seconds`: how long a
+  job type usually takes from submit to completion, from the API's completed
+  runs. `phi models list` shows it as a Time column ("about 4 min", "40 s") and
+  `phi jobs wait` and `phi jobs submit --wait` count the elapsed time against
+  it ("[30s of about 240s] RUNNING fold").
+- `Job`, `JobStage`, `RunResponse`, `StageResponse` and `DagNode` read the
+  optional `error_code`, `exit_code` and `recommended_action` a failed run
+  carries; `phi jobs wait`, `phi pipeline run` and `phi quickstart` name the
+  code before the error when a failing job has one.
+- `phi.billing`: `get()` (the balance, auto-reload, the load presets and packs),
+  `load(amount_cents)` or `load(pack=...)` (starts a load and returns the URL
+  to pay at), `loads()`, `auto_reload(...)` and `portal()`; `phi billing`,
+  `phi billing load <dollars>`, `phi billing loads`, `phi billing auto-reload
+  --on|--off [--threshold] [--amount] [--cap]` and `phi billing portal`. A
+  `Load` carries its `provider_ref`.
+- `Quota` carries `purchased_balance`, `total_available`, `plan` and
+  `plan_source`, and `LedgerEntry` its `pool`; `phi quota` prints the plan and
+  the purchased balance. An older server that omits them still parses.
+- `Billing.payment_method` (brand, last four and expiry of the saved card) and
+  `LedgerEntry.run_name`, `pipeline_type` and `note`, as the server sends them
+  from 0.2.1; `phi billing` prints the card. `quota.history(reason=[...])` keeps
+  the reasons asked for, and `quota.months()` is the ledger by calendar month.
+- `phi skills list`, `phi skills show <name>` and `phi skills install [name]...
+  [--global] [--agent claude-code|cursor|codex|all]`: the agent skills Phi
+  publishes from `dynotx/phi-skills`, read from the site's index
+  (`https://phi.dynotx.com/skills.json`, or `PHI_SKILLS_INDEX`), installed
+  through `npx skills add` when `npx` is on `PATH` and otherwise written as
+  `SKILL.md` files into the agents' skill directories. `phi doctor` says how
+  many are installed and where.
+- `phi docs sync` publishes a checkout that has no retrieval guard when every
+  document declares `access: general` in its frontmatter (`dynotx/phi-skills`);
+  a document that does not is named in the refusal.
+- `phi auth login` signs in through the browser: Clerk's OAuth with PKCE and a
+  loopback redirect on a random port, the organization chosen at sign-in, the
+  access and refresh tokens saved in the profile (`auth = "oauth"`) and
+  refreshed when within sixty seconds of expiry or once when the API refuses the
+  token; a refresh the server declines ends with "Signed out. Run phi auth
+  login." and exit code 1. `--device` is the device authorization grant for a
+  machine with no browser; `--key [KEY]` is the key path, non-interactive when
+  the key or `PHI_API_KEY` is given. The base URL is `--api`, then the profile's,
+  then production; `--interactive` prompts. The CLI's OAuth client id is the
+  metadata document the API serves at `/.well-known/phi-cli-client.json`.
+- `phi auth logout` revokes the refresh token at Clerk; `phi auth whoami` and
+  `phi auth profiles` say how a profile is authenticated and when its token
+  expires. `phi doctor` checks the base URL, the credential, the installed
+  version against PyPI and whether another `phi` is first on `PATH`.
+- `PhiClient` and `AsyncPhiClient` take `user_agent=`; the CLI sends
+  `phi-cli/<version>`. `PhiSignedOutError` is exported.
+
+### Fixed
+
+- `Billing.presets` and `Billing.packs` use independent default lists for each
+  model instance.
+
+## [0.3.1] - 2026-10-17
+
+### Changed
+
+- The CLI is installed with the package: `pip install dyno-phi` puts `phi` on the
+  path. The `[cli]` extra is kept as a no-op alias, so `dyno-phi[cli]` still
+  installs.
+
+## [0.3.0] - 2026-10-17
+
+The first release of the Phi SDK and CLI on PyPI, published from `clients/phi` in
+`dynotx/phi-api`. It was distributed as `phi-client` 0.0.1 from this repository
+over git during the internal preview.
+
+`dyno-phi` 0.2.x on PyPI was an earlier, unrelated client of a retired API. 0.3.0
+replaces it under the same name; nothing from 0.2.x carries over.
+
+### Added
+
+- `PhiClient` and `AsyncPhiClient` with the same resources and signatures:
+  `projects`, `datasets`, `sequences`, `designs`, `jobs`, `job_types`, `runs`,
+  `run_admin`, `artifacts`, `files`, `uploads`, `logs`, `quota`, `tool_configs`,
+  `imports`, `documents`.
+- Typed request and response models, local JSON Schema validation of `params` and
+  `inputs` for every job type (`client.job_types.validate_params`), waiters for
+  jobs and runs, and a typed error taxonomy (`PhiError` and its subclasses).
+- The `phi` CLI behind the `[cli]` extra, every command taking `--json`:
+  `auth`, `projects`, `datasets`, `docs`, `models`, `jobs`, `runs`, `pipeline`,
+  `artifacts`, `export`, `logs`, `quota`, `use`, `quickstart`.
+- Profiles in `~/.config/phi/config.toml`, selected with `--profile` or
+  `PHI_PROFILE`.
+- A Claude Code skill (`skills/phi/SKILL.md`) that drives the CLI.
+
+### Changed from `dyno-phi` 0.2.x
+
+- Environment: `PHI_API` is the base URL and `PHI_KEY` or `PHI_API_KEY` the key
+  (`DYNO_API_BASE_URL` and `DYNO_API_KEY` are not read). `PHI_ORG` names the
+  organization for a static key; a Clerk key carries its own.
+- Command tree: `phi <group> <command>` as listed above. `phi upload`, `phi filter`,
+  `phi research`, `phi notes`, `phi tutorial`, the filter presets and the
+  per-model commands (`phi esmfold`, `phi alphafold`, ...) are gone; a model runs
+  as `phi jobs submit <JOB_TYPE>` and a chain of models as `phi runs submit` or
+  `phi pipeline run`. `phi quickstart` is the walkthrough.
+- State: `.phi/state.json` holds the active project and dataset and the last job
+  and run, nothing else; the API key is never written there.
+- Python 3.12 or newer. The SDK depends on `httpx` and `pydantic` alone; the CLI's
+  dependencies install only with the `[cli]` extra.
+- Web app: results open at `design.dynotx.com`; the dashboard URLs the old client
+  printed no longer exist.
+
+Versioning note: the client stays below 1.0 while the API it speaks to is itself
+pre-1.0 (0.1.x) and the request shapes can still change between releases. 0.3.0
+is the first release on this line only because 0.2.x was already taken on PyPI
+by the earlier client; it is not a continuation of it.

{dyno_phi-0.3.0 → dyno_phi-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dyno-phi
-Version: 0.3.0
+Version: 0.3.2
 Summary: Phi — Python SDK and CLI for the Phi protein design API
 Project-URL: Homepage, https://design.dynotx.com
 Project-URL: Documentation, https://design.dynotx.com/docs
@@ -20,21 +20,21 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Scientific/Engineering :: Bio-Informatics
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
+Requires-Dist: click>=8.1
 Requires-Dist: httpx>=0.27
 Requires-Dist: pydantic>=2.9
+Requires-Dist: pyyaml>=6
+Requires-Dist: rich>=13
+Requires-Dist: typer>=0.12
 Provides-Extra: cli
-Requires-Dist: click>=8.1; extra == 'cli'
-Requires-Dist: pyyaml>=6; extra == 'cli'
-Requires-Dist: rich>=13; extra == 'cli'
-Requires-Dist: typer>=0.12; extra == 'cli'
 Description-Content-Type: text/markdown
 
 # dyno-phi
 
 Python SDK and CLI for the [Phi](https://design.dynotx.com) protein design API.
 The `phi` package exposes synchronous (`PhiClient`) and asynchronous
-(`AsyncPhiClient`) clients; the CLI ships behind the `[cli]` extra so the SDK
-stays light. It is published to PyPI from `clients/phi` in
+(`AsyncPhiClient`) clients and the `phi` CLI, installed together. It is
+published to PyPI from `clients/phi` in
 [`dynotx/phi-api`](https://github.com/dynotx/phi-api).
 
 ## Install
@@ -42,16 +42,17 @@ stays light. It is published to PyPI from `clients/phi` in
 The CLI as an isolated tool on your `PATH`:
 
 ```bash
-uv tool install "dyno-phi[cli]"
+uv tool install dyno-phi
 ```
 
 `uv tool` provisions its own Python, which covers the client's **Python 3.12+**
 requirement on stock macOS, where the system Python is 3.9. Re-run with
-`--upgrade` to upgrade. `pip install "dyno-phi[cli]"` into a Python 3.12+ of
-your own does the same. From a `phi-api` checkout, `just install-cli` runs the
-first form and `just install-cli-dev` installs the working tree.
+`--upgrade` to upgrade. `pip install dyno-phi` into a Python 3.12+ of your own
+does the same. From a `phi-api` checkout, `just install-cli` runs the first
+form and `just install-cli-dev` installs the working tree.
 
-The SDK inside an existing project, without the CLI's dependencies:
+The SDK inside an existing project (the CLI comes with it; the `[cli]` extra
+from 0.3.0 still installs and adds nothing):
 
 ```bash
 uv add dyno-phi        # or: pip install dyno-phi
@@ -60,7 +61,7 @@ uv add dyno-phi        # or: pip install dyno-phi
 Check the install with `phi --version`. `dyno-phi` 0.2.x was an earlier,
 unrelated client of a retired API; if `phi --version` prints `0.2.x`, that
 client is first on your `PATH` (`which -a phi` lists every match) and
-`pip install --upgrade "dyno-phi[cli]"` in the Python that owns it replaces it.
+`pip install --upgrade dyno-phi` in the Python that owns it replaces it.
 Coming from 0.2.x: the key is `PHI_API_KEY` (or `PHI_KEY`) and the base URL
 `PHI_API`, the commands are `phi <group> <command>` as listed under
 [CLI](#cli), and Python 3.12+ is required; see
@@ -79,13 +80,31 @@ path=("$HOME/.local/bin" $path)
 
 ## Authentication
 
-Both the SDK and the CLI read connection settings from the environment, falling
-back to `~/.config/phi/config.toml`:
+Sign in through your browser:
+
+```bash
+phi auth login
+```
+
+It opens Dyno's sign-in, you pick the organization, and the CLI saves the sign-in
+to `~/.config/phi/config.toml`, refreshing it as it runs out. On a machine with
+no browser, `phi auth login --device` prints a URL and a code to enter on another
+device. `phi auth whoami` prints who you are and which organization and
+environment you are on; `phi doctor` checks the install when something is off.
+
+An agent, CI or a service account uses an API key from
+[design.dynotx.com](https://design.dynotx.com) instead, either saved as a profile
+or read from the environment:
+
+```bash
+phi auth login --key ak_...        # saved to the profile
+export PHI_API_KEY=ak_...          # or per process
+```
 
 | Variable | Purpose |
 |---|---|
-| `PHI_API` | Base URL of the API. Its host selects the environment class — `hosted`, `staging`, or `local`. |
-| `PHI_KEY` / `PHI_API_KEY` | API key. |
+| `PHI_API` | Base URL of the API. Its host selects the environment class: `hosted`, `staging`, or `local`. |
+| `PHI_KEY` / `PHI_API_KEY` | API key. Wins over a stored sign-in. |
 | `PHI_ORG` | Organization ID. Required with a static key. |
 
 ```bash
@@ -98,7 +117,8 @@ With a Clerk key (`ak_...`) the tenant comes from the key, so `PHI_ORG` is
 ignored; it is required only for a static key.
 
 Pass `base_url=`, `api_key=`, and `org=` to the client constructor to override
-the environment.
+the environment. `api_key=` takes a sign-in's access token as readily as a key.
+The three ways and when to use each: [`docs/sdk-and-cli.md`](https://github.com/dynotx/phi-api/blob/main/docs/sdk-and-cli.md#authentication).
 
 ## 60-second quickstart
 
@@ -180,7 +200,7 @@ Every command reads the same environment and accepts `--json` for scripting.
 
 | Group | Commands |
 |---|---|
-| `auth` | `login`, `whoami`, `logout`, `profiles` |
+| `auth` | `login [--device] [--key [KEY]]`, `whoami`, `logout`, `profiles` |
 | `projects` | `list`, `create`, `show`, `update`, `archive` |
 | `datasets` | `list`, `create`, `show`, `update`, `delete`, `copy`, `export`, `sequences` |
 | `docs` | `list`, `read`, `search`, `add`, `update`, `history`, `propose`, `activate`, `sync` |
@@ -192,8 +212,10 @@ Every command reads the same environment and accepts `--json` for scripting.
 | `export` | `sequences`, `designs`, `structure`, `pae` |
 | `logs` | `show`, `download`, `settings` |
 | `quota` | (summary), `history` |
+| `billing` | (summary), `load <dollars>`, `loads`, `auto-reload`, `portal` |
 | `use` | Set the active project |
 | `quickstart` | Run the end-to-end ESMFOLD example |
+| `doctor` | Check the base URL, the credential, the version and the `PATH` |
 
 `phi docs sync <dir> --dry-run` safely plans publication from a clean knowledge
 checkout. Without `--dry-run` it publishes only Git-tracked files in the

{dyno_phi-0.3.0 → dyno_phi-0.3.2}/README.md

@@ -2,8 +2,8 @@
 
 Python SDK and CLI for the [Phi](https://design.dynotx.com) protein design API.
 The `phi` package exposes synchronous (`PhiClient`) and asynchronous
-(`AsyncPhiClient`) clients; the CLI ships behind the `[cli]` extra so the SDK
-stays light. It is published to PyPI from `clients/phi` in
+(`AsyncPhiClient`) clients and the `phi` CLI, installed together. It is
+published to PyPI from `clients/phi` in
 [`dynotx/phi-api`](https://github.com/dynotx/phi-api).
 
 ## Install
@@ -11,16 +11,17 @@ stays light. It is published to PyPI from `clients/phi` in
 The CLI as an isolated tool on your `PATH`:
 
 ```bash
-uv tool install "dyno-phi[cli]"
+uv tool install dyno-phi
 ```
 
 `uv tool` provisions its own Python, which covers the client's **Python 3.12+**
 requirement on stock macOS, where the system Python is 3.9. Re-run with
-`--upgrade` to upgrade. `pip install "dyno-phi[cli]"` into a Python 3.12+ of
-your own does the same. From a `phi-api` checkout, `just install-cli` runs the
-first form and `just install-cli-dev` installs the working tree.
+`--upgrade` to upgrade. `pip install dyno-phi` into a Python 3.12+ of your own
+does the same. From a `phi-api` checkout, `just install-cli` runs the first
+form and `just install-cli-dev` installs the working tree.
 
-The SDK inside an existing project, without the CLI's dependencies:
+The SDK inside an existing project (the CLI comes with it; the `[cli]` extra
+from 0.3.0 still installs and adds nothing):
 
 ```bash
 uv add dyno-phi        # or: pip install dyno-phi
@@ -29,7 +30,7 @@ uv add dyno-phi        # or: pip install dyno-phi
 Check the install with `phi --version`. `dyno-phi` 0.2.x was an earlier,
 unrelated client of a retired API; if `phi --version` prints `0.2.x`, that
 client is first on your `PATH` (`which -a phi` lists every match) and
-`pip install --upgrade "dyno-phi[cli]"` in the Python that owns it replaces it.
+`pip install --upgrade dyno-phi` in the Python that owns it replaces it.
 Coming from 0.2.x: the key is `PHI_API_KEY` (or `PHI_KEY`) and the base URL
 `PHI_API`, the commands are `phi <group> <command>` as listed under
 [CLI](#cli), and Python 3.12+ is required; see
@@ -48,13 +49,31 @@ path=("$HOME/.local/bin" $path)
 
 ## Authentication
 
-Both the SDK and the CLI read connection settings from the environment, falling
-back to `~/.config/phi/config.toml`:
+Sign in through your browser:
+
+```bash
+phi auth login
+```
+
+It opens Dyno's sign-in, you pick the organization, and the CLI saves the sign-in
+to `~/.config/phi/config.toml`, refreshing it as it runs out. On a machine with
+no browser, `phi auth login --device` prints a URL and a code to enter on another
+device. `phi auth whoami` prints who you are and which organization and
+environment you are on; `phi doctor` checks the install when something is off.
+
+An agent, CI or a service account uses an API key from
+[design.dynotx.com](https://design.dynotx.com) instead, either saved as a profile
+or read from the environment:
+
+```bash
+phi auth login --key ak_...        # saved to the profile
+export PHI_API_KEY=ak_...          # or per process
+```
 
 | Variable | Purpose |
 |---|---|
-| `PHI_API` | Base URL of the API. Its host selects the environment class — `hosted`, `staging`, or `local`. |
-| `PHI_KEY` / `PHI_API_KEY` | API key. |
+| `PHI_API` | Base URL of the API. Its host selects the environment class: `hosted`, `staging`, or `local`. |
+| `PHI_KEY` / `PHI_API_KEY` | API key. Wins over a stored sign-in. |
 | `PHI_ORG` | Organization ID. Required with a static key. |
 
 ```bash
@@ -67,7 +86,8 @@ With a Clerk key (`ak_...`) the tenant comes from the key, so `PHI_ORG` is
 ignored; it is required only for a static key.
 
 Pass `base_url=`, `api_key=`, and `org=` to the client constructor to override
-the environment.
+the environment. `api_key=` takes a sign-in's access token as readily as a key.
+The three ways and when to use each: [`docs/sdk-and-cli.md`](https://github.com/dynotx/phi-api/blob/main/docs/sdk-and-cli.md#authentication).
 
 ## 60-second quickstart
 
@@ -149,7 +169,7 @@ Every command reads the same environment and accepts `--json` for scripting.
 
 | Group | Commands |
 |---|---|
-| `auth` | `login`, `whoami`, `logout`, `profiles` |
+| `auth` | `login [--device] [--key [KEY]]`, `whoami`, `logout`, `profiles` |
 | `projects` | `list`, `create`, `show`, `update`, `archive` |
 | `datasets` | `list`, `create`, `show`, `update`, `delete`, `copy`, `export`, `sequences` |
 | `docs` | `list`, `read`, `search`, `add`, `update`, `history`, `propose`, `activate`, `sync` |
@@ -161,8 +181,10 @@ Every command reads the same environment and accepts `--json` for scripting.
 | `export` | `sequences`, `designs`, `structure`, `pae` |
 | `logs` | `show`, `download`, `settings` |
 | `quota` | (summary), `history` |
+| `billing` | (summary), `load <dollars>`, `loads`, `auto-reload`, `portal` |
 | `use` | Set the active project |
 | `quickstart` | Run the end-to-end ESMFOLD example |
+| `doctor` | Check the base URL, the credential, the version and the `PATH` |
 
 `phi docs sync <dir> --dry-run` safely plans publication from a clean knowledge
 checkout. Without `--dry-run` it publishes only Git-tracked files in the

{dyno_phi-0.3.0 → dyno_phi-0.3.2}/pyproject.toml

@@ -33,10 +33,6 @@ classifiers = [
 dependencies = [
     "httpx>=0.27",
     "pydantic>=2.9",
-]
-
-[project.optional-dependencies]
-cli = [
     "typer>=0.12",
     # Typer vendors Click from 0.27 on, so it is no longer a transitive
     # dependency. The CLI imports click directly for UsageError and confirm.
@@ -45,6 +41,10 @@ cli = [
     "pyyaml>=6",
 ]
 
+[project.optional-dependencies]
+# The CLI ships with the package since 0.3.1; `dyno-phi[cli]` stays installable.
+cli = []
+
 [project.scripts]
 phi = "phi.cli:main"
 
@@ -57,7 +57,7 @@ Issues = "https://github.com/dynotx/phi-api/issues"
 
 [dependency-groups]
 dev = [
-    "dyno-phi[cli]",
+    "dyno-phi",
     "pytest>=8.3.0",
     "pytest-asyncio>=0.24.0",
     "respx>=0.21.0",

{dyno_phi-0.3.0 → dyno_phi-0.3.2}/src/phi/__init__.py

@@ -18,6 +18,7 @@ from .errors import (
 )
 from .graph import Node, PipelineGraph, PortRef
 from .models import JobTypeSchema
+from .oauth import PhiSignedOutError
 
 __all__ = [
     "AsyncPhiClient",
@@ -37,5 +38,6 @@ __all__ = [
     "PhiInsufficientCreditsError",
     "PhiRateLimitError",
     "PhiServerError",
+    "PhiSignedOutError",
     "__version__",
 ]

dyno_phi-0.3.2/src/phi/_version.py

@@ -0,0 +1 @@
+__version__ = "0.3.2"

{dyno_phi-0.3.0 → dyno_phi-0.3.2}/src/phi/async_client.py

@@ -13,8 +13,11 @@ from ._transport import (
     async_send_with_retry,
     parse_response,
 )
+from ._version import __version__
 from .config import Profile
 from .resources.artifacts import AsyncArtifactsResource
+from .resources.audit import AsyncAuditResource
+from .resources.billing import AsyncBillingResource
 from .resources.datasets import AsyncDatasetsResource
 from .resources.designs import AsyncDesignsResource
 from .resources.documents import AsyncDocumentsResource
@@ -43,16 +46,24 @@ class AsyncPhiClient:
         timeout: float = 30.0,
         max_retries: int = 3,
         http_client: httpx.AsyncClient | None = None,
+        user_agent: str | None = None,
     ) -> None:
+        """`api_key` is an API key or the access token of a sign-in; with neither, the
+        profile's stored credential is used and refreshed as it runs out."""
         self.profile = Profile(base_url=base_url, api_key=api_key, org=org, profile=profile)
         self.retry_policy = RetryPolicy(max_retries=max_retries)
         self._http = http_client or httpx.AsyncClient(
             base_url=self.profile.base_url,
-            headers=self.profile.auth_headers(),
+            headers={
+                **self.profile.auth_headers(),
+                "User-Agent": user_agent or f"dyno-phi/{__version__}",
+            },
             timeout=timeout,
         )
 
         self.quota = AsyncQuotaResource(self)
+        self.audit = AsyncAuditResource(self)
+        self.billing = AsyncBillingResource(self)
         self.projects = AsyncProjectsResource(self)
         self.datasets = AsyncDatasetsResource(self)
         self.jobs = AsyncJobsResource(self)
@@ -78,7 +89,15 @@ class AsyncPhiClient:
         return body
 
     async def send_with_headers(self, spec: RequestSpec) -> tuple[Any, httpx.Headers]:
-        response = await async_send_with_retry(
+        await self._refresh_if_expiring()
+        response = await self._send(spec)
+        # A token the server refuses is refreshed once; a second refusal is the answer.
+        if response.status_code == 401 and await self._refresh_token():
+            response = await self._send(spec)
+        return parse_response(response, method=spec.method, path=spec.path), response.headers
+
+    async def _send(self, spec: RequestSpec) -> httpx.Response:
+        return await async_send_with_retry(
             lambda: self._http.request(
                 spec.method,
                 spec.path,
@@ -90,10 +109,23 @@ class AsyncPhiClient:
             path=spec.path,
             policy=self.retry_policy,
         )
-        return parse_response(response, method=spec.method, path=spec.path), response.headers
 
-    def stream_lines(self, spec: RequestSpec) -> AsyncIterator[str]:
-        return async_iter_lines_with_retry(
+    async def _refresh_if_expiring(self) -> None:
+        if self.profile.needs_refresh():
+            await self._refresh_token()
+
+    async def _refresh_token(self) -> bool:
+        """Refresh a stored sign-in and carry the new token on every later request."""
+        if not await self.profile.arefresh():
+            return False
+        self._http.headers["X-API-Key"] = self.profile.api_key
+        return True
+
+    async def stream_lines(self, spec: RequestSpec) -> AsyncIterator[str]:
+        # The refresh is the iterator's first step, so it is awaited on the loop
+        # rather than run blocking before the iterator is handed back.
+        await self._refresh_if_expiring()
+        async for line in async_iter_lines_with_retry(
             lambda: self._http.stream(
                 spec.method,
                 spec.path,
@@ -104,7 +136,8 @@ class AsyncPhiClient:
             method=spec.method,
             path=spec.path,
             policy=self.retry_policy,
-        )
+        ):
+            yield line
 
     async def aclose(self) -> None:
         await self._http.aclose()

dyno_phi-0.3.2/src/phi/cli/commands/audit.py

@@ -0,0 +1,133 @@
+from __future__ import annotations
+
+import sys
+from datetime import datetime
+from enum import StrEnum
+from pathlib import Path
+
+import typer
+
+from .. import render
+from ..state import CliState
+
+app = typer.Typer(no_args_is_help=True, help="Inspect and export organization audit events.")
+
+
+class AuditFormat(StrEnum):
+    csv = "csv"
+    jsonl = "jsonl"
+
+
+def _datetime(value: str | None, option: str) -> datetime | None:
+    if value is None:
+        return None
+    return _required_datetime(value, option)
+
+
+def _required_datetime(value: str, option: str) -> datetime:
+    try:
+        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except ValueError as exc:
+        raise typer.BadParameter("must be an ISO 8601 timestamp", param_hint=option) from exc
+    if parsed.tzinfo is None or parsed.utcoffset() is None:
+        raise typer.BadParameter("must include a timezone", param_hint=option)
+    return parsed
+
+
+@app.command("list")
+def list_events(
+    ctx: typer.Context,
+    limit: int = typer.Option(50, "--limit", min=1, max=200),
+    from_: str | None = typer.Option(None, "--from"),
+    to: str | None = typer.Option(None, "--to"),
+    action: list[str] | None = typer.Option(None, "--action"),
+    category: list[str] | None = typer.Option(None, "--category"),
+    actor: str | None = typer.Option(None, "--actor"),
+    subject_type: str | None = typer.Option(None, "--subject-type"),
+    subject_id: str | None = typer.Option(None, "--subject-id"),
+    source: list[str] | None = typer.Option(None, "--source"),
+    outcome: list[str] | None = typer.Option(None, "--outcome"),
+    text: str | None = typer.Option(None, "--text"),
+) -> None:
+    state: CliState = ctx.obj
+    events = state.client.audit.list(
+        page_size=limit,
+        from_=_datetime(from_, "--from"),
+        to=_datetime(to, "--to"),
+        action=action,
+        category=category,
+        actor=actor,
+        subject_type=subject_type,
+        subject_id=subject_id,
+        source=source,
+        outcome=outcome,
+        text=text,
+    )
+    if state.json_output:
+        render.print_json([event.model_dump(mode="json") for event in events])
+        return
+    render.table(
+        ["id", "occurred_at", "action", "actor", "subject", "outcome", "source"],
+        [
+            (
+                event.id,
+                event.occurred_at.isoformat(),
+                event.action,
+                event.actor.label,
+                event.subject.label or event.subject.id or event.subject.type,
+                event.outcome,
+                event.source,
+            )
+            for event in events
+        ],
+        title="audit events",
+        no_color=state.no_color,
+    )
+
+
+@app.command("show")
+def show_event(
+    ctx: typer.Context,
+    event_id: int = typer.Argument(..., min=1),
+) -> None:
+    state: CliState = ctx.obj
+    render.model(state, state.client.audit.show(event_id), title="audit event")
+
+
+@app.command("export")
+def export_events(
+    ctx: typer.Context,
+    from_: str = typer.Option(..., "--from"),
+    to: str = typer.Option(..., "--to"),
+    format: AuditFormat = typer.Option(AuditFormat.csv, "--format"),
+    out: str = typer.Option("-", "--out", help="Output file, or - for stdout."),
+    action: list[str] | None = typer.Option(None, "--action"),
+    category: list[str] | None = typer.Option(None, "--category"),
+    actor: str | None = typer.Option(None, "--actor"),
+    subject_type: str | None = typer.Option(None, "--subject-type"),
+    subject_id: str | None = typer.Option(None, "--subject-id"),
+    source: list[str] | None = typer.Option(None, "--source"),
+    outcome: list[str] | None = typer.Option(None, "--outcome"),
+    text: str | None = typer.Option(None, "--text"),
+) -> None:
+    state: CliState = ctx.obj
+    lines = state.client.audit.export(
+        format=format.value,
+        from_=_required_datetime(from_, "--from"),
+        to=_required_datetime(to, "--to"),
+        action=action,
+        category=category,
+        actor=actor,
+        subject_type=subject_type,
+        subject_id=subject_id,
+        source=source,
+        outcome=outcome,
+        text=text,
+    )
+    if out == "-":
+        for line in lines:
+            sys.stdout.write(line + "\n")
+        return
+    with Path(out).open("w") as handle:
+        for line in lines:
+            handle.write(line + "\n")