hyperfluid 0.1.0__py3-none-any.whl

hyperfluid/models/atlas_save_entry.py

@@ -0,0 +1,35 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .atlas_entry_kind import AtlasEntryKind
+    from .atlas_status import AtlasStatus
+    from .atlas_visibility import AtlasVisibility
+
+
+@dataclasses.dataclass(kw_only=True)
+class AtlasSaveEntry(BaseModel):
+    """The `AtlasSaveEntry` object."""
+
+    expected_revision: int
+
+    kind: AtlasEntryKind
+
+    body: str | None = None
+
+    doc_id: str | None = None
+
+    doc_ids: list[str] | None = None
+
+    section_id: str | None = None
+
+    status: AtlasStatus | None = None
+
+    title: str | None = None
+
+    visibility: AtlasVisibility | None = None

hyperfluid/models/atlas_search_request.py

@@ -0,0 +1,24 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import UNSET, BaseModel, Unset
+
+
+@dataclasses.dataclass(kw_only=True)
+class AtlasSearchRequest(BaseModel):
+    """The `AtlasSearchRequest` object."""
+
+    query: str
+
+    kind: str | None | Unset = UNSET
+    """Filter before ranking and limiting results."""
+
+    limit: int | None | Unset = UNSET
+
+    locale: str | None | Unset = UNSET
+
+    persona: str | None | Unset = UNSET
+
+    service: str | None | Unset = UNSET

hyperfluid/models/atlas_search_response.py

@@ -0,0 +1,24 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .atlas_search_result import AtlasSearchResult
+
+
+@dataclasses.dataclass(kw_only=True)
+class AtlasSearchResponse(BaseModel):
+    """The `AtlasSearchResponse` object."""
+
+    organization_content_available: bool
+    """False when organization procedures could not be loaded; official results remain usable."""
+
+    query: str
+
+    results: list[AtlasSearchResult]
+
+    total: int

hyperfluid/models/atlas_search_result.py

@@ -0,0 +1,27 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class AtlasSearchResult(BaseModel):
+    """The `AtlasSearchResult` object."""
+
+    doc_id: str
+
+    excerpt: str
+
+    kind: str
+
+    locale: str
+
+    score: int
+
+    section_id: str
+
+    summary: str
+
+    title: str

hyperfluid/models/atlas_status.py

@@ -0,0 +1,19 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class AtlasStatus(StrEnum):
+    """The values of `AtlasStatus`; others are kept as received."""
+
+    DRAFT = "draft"
+    PUBLISHED = "published"
+    IN_PROGRESS = "in_progress"
+    COMPLETED = "completed"
+
+
+AtlasStatusLiteral: t.TypeAlias = t.Literal[
+    "draft", "published", "in_progress", "completed"
+]
+"""The values of :class:`AtlasStatus`, which arguments take as plain strings too."""

hyperfluid/models/atlas_verification.py

@@ -0,0 +1,17 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class AtlasVerification(BaseModel):
+    """The `AtlasVerification` object."""
+
+    reviewed_at: str
+
+    runtime_verified: bool
+
+    status: str

hyperfluid/models/atlas_visibility.py

@@ -0,0 +1,15 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class AtlasVisibility(StrEnum):
+    """The values of `AtlasVisibility`; others are kept as received."""
+
+    PRIVATE = "private"
+    ORGANIZATION = "organization"
+
+
+AtlasVisibilityLiteral: t.TypeAlias = t.Literal["private", "organization"]
+"""The values of :class:`AtlasVisibility`, which arguments take as plain strings too."""

hyperfluid/models/atlas_workspace.py

@@ -0,0 +1,23 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .atlas_entry import AtlasEntry
+
+
+@dataclasses.dataclass(kw_only=True)
+class AtlasWorkspace(BaseModel):
+    """The `AtlasWorkspace` object."""
+
+    caller_id: UUID
+    """Database user id, distinct from the authentication provider's subject."""
+
+    can_publish: bool
+
+    entries: list[AtlasEntry]

hyperfluid/models/audit_actor.py

@@ -0,0 +1,20 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditActor(BaseModel):
+    """The person behind a decision, when its `oauth_id` resolved to a console user."""
+
+    email: str
+
+    first_name: str
+
+    id: UUID
+
+    last_name: str

hyperfluid/models/audit_actor_kind.py

@@ -0,0 +1,23 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class AuditActorKind(StrEnum):
+    """Which kind of principal an audited `oauth_id` resolved to. `Platform` is a
+    client the operator provisioned for the platform's own components in the
+    org's realm (Bifrost, the dock's Trino OAuth client, object-storage STS —
+    see `platform_identities`). `Unknown` covers both a human with no
+    `user_identities` row yet and a subject nobody owns."""
+
+    USER = "user"
+    SERVICE_ACCOUNT = "service_account"
+    PLATFORM = "platform"
+    UNKNOWN = "unknown"
+
+
+AuditActorKindLiteral: t.TypeAlias = t.Literal[
+    "user", "service_account", "platform", "unknown"
+]
+"""The values of :class:`AuditActorKind`, which arguments take as plain strings too."""

hyperfluid/models/audit_entry_kind.py

@@ -0,0 +1,15 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class AuditEntryKind(StrEnum):
+    """A compacted SQL query (`query_traces`) or a single audited event (`access_events`)."""
+
+    QUERY = "query"
+    EVENT = "event"
+
+
+AuditEntryKindLiteral: t.TypeAlias = t.Literal["query", "event"]
+"""The values of :class:`AuditEntryKind`, which arguments take as plain strings too."""

hyperfluid/models/audit_log_event.py

@@ -0,0 +1,111 @@
+# this file is @generated
+from __future__ import annotations
+
+import typing as t
+
+from ..serialization import Discriminator, UnknownVariant
+from .audit_log_event_authz_break_glass_used_variant import (
+    AuditLogEventAuthzBreakGlassUsedVariant,
+)
+from .audit_log_event_authz_organization_policy_revoked_variant import (
+    AuditLogEventAuthzOrganizationPolicyRevokedVariant,
+)
+from .audit_log_event_console_authz_decision_variant import (
+    AuditLogEventConsoleAuthzDecisionVariant,
+)
+from .audit_log_event_container_app_image_synced_variant import (
+    AuditLogEventContainerAppImageSyncedVariant,
+)
+from .audit_log_event_data_dock_opa_evaluation_variant import (
+    AuditLogEventDataDockOpaEvaluationVariant,
+)
+from .audit_log_event_managed_postgresql_import_created_variant import (
+    AuditLogEventManagedPostgresqlImportCreatedVariant,
+)
+from .audit_log_event_object_storage_owner_key_revealed_variant import (
+    AuditLogEventObjectStorageOwnerKeyRevealedVariant,
+)
+from .audit_log_event_object_storage_usage_collected_variant import (
+    AuditLogEventObjectStorageUsageCollectedVariant,
+)
+from .audit_log_event_platform_admin_action_variant import (
+    AuditLogEventPlatformAdminActionVariant,
+)
+from .audit_log_event_runtime_security_alert_variant import (
+    AuditLogEventRuntimeSecurityAlertVariant,
+)
+from .audit_log_event_s3_gateway_decision_variant import (
+    AuditLogEventS3GatewayDecisionVariant,
+)
+from .audit_log_event_s3_gateway_gate_denied_variant import (
+    AuditLogEventS3GatewayGateDeniedVariant,
+)
+from .audit_log_event_s3_gateway_session_issued_variant import (
+    AuditLogEventS3GatewaySessionIssuedVariant,
+)
+from .audit_log_event_security_decision_variant import (
+    AuditLogEventSecurityDecisionVariant,
+)
+from .audit_log_event_trino_query_completed_variant import (
+    AuditLogEventTrinoQueryCompletedVariant,
+)
+from .audit_log_event_virtual_machine_console_session_variant import (
+    AuditLogEventVirtualMachineConsoleSessionVariant,
+)
+from .audit_log_event_workstation_agent_request_variant import (
+    AuditLogEventWorkstationAgentRequestVariant,
+)
+from .audit_log_event_workstation_preview_session_variant import (
+    AuditLogEventWorkstationPreviewSessionVariant,
+)
+from .audit_log_event_workstation_terminal_command_variant import (
+    AuditLogEventWorkstationTerminalCommandVariant,
+)
+
+AuditLogEvent: t.TypeAlias = t.Annotated[
+    AuditLogEventDataDockOpaEvaluationVariant
+    | AuditLogEventSecurityDecisionVariant
+    | AuditLogEventConsoleAuthzDecisionVariant
+    | AuditLogEventS3GatewayDecisionVariant
+    | AuditLogEventS3GatewaySessionIssuedVariant
+    | AuditLogEventS3GatewayGateDeniedVariant
+    | AuditLogEventAuthzOrganizationPolicyRevokedVariant
+    | AuditLogEventAuthzBreakGlassUsedVariant
+    | AuditLogEventPlatformAdminActionVariant
+    | AuditLogEventRuntimeSecurityAlertVariant
+    | AuditLogEventTrinoQueryCompletedVariant
+    | AuditLogEventWorkstationAgentRequestVariant
+    | AuditLogEventWorkstationTerminalCommandVariant
+    | AuditLogEventWorkstationPreviewSessionVariant
+    | AuditLogEventManagedPostgresqlImportCreatedVariant
+    | AuditLogEventVirtualMachineConsoleSessionVariant
+    | AuditLogEventContainerAppImageSyncedVariant
+    | AuditLogEventObjectStorageOwnerKeyRevealedVariant
+    | AuditLogEventObjectStorageUsageCollectedVariant
+    | UnknownVariant,
+    Discriminator(
+        "type",
+        {
+            "data_dock_opa_evaluation": AuditLogEventDataDockOpaEvaluationVariant,
+            "security_decision": AuditLogEventSecurityDecisionVariant,
+            "console_authz_decision": AuditLogEventConsoleAuthzDecisionVariant,
+            "s3_gateway_decision": AuditLogEventS3GatewayDecisionVariant,
+            "s3_gateway_session_issued": AuditLogEventS3GatewaySessionIssuedVariant,
+            "s3_gateway_gate_denied": AuditLogEventS3GatewayGateDeniedVariant,
+            "authz_organization_policy_revoked": AuditLogEventAuthzOrganizationPolicyRevokedVariant,
+            "authz_break_glass_used": AuditLogEventAuthzBreakGlassUsedVariant,
+            "platform_admin_action": AuditLogEventPlatformAdminActionVariant,
+            "runtime_security_alert": AuditLogEventRuntimeSecurityAlertVariant,
+            "trino_query_completed": AuditLogEventTrinoQueryCompletedVariant,
+            "workstation_agent_request": AuditLogEventWorkstationAgentRequestVariant,
+            "workstation_terminal_command": AuditLogEventWorkstationTerminalCommandVariant,
+            "workstation_preview_session": AuditLogEventWorkstationPreviewSessionVariant,
+            "managed_postgresql_import_created": AuditLogEventManagedPostgresqlImportCreatedVariant,
+            "virtual_machine_console_session": AuditLogEventVirtualMachineConsoleSessionVariant,
+            "container_app_image_synced": AuditLogEventContainerAppImageSyncedVariant,
+            "object_storage_owner_key_revealed": AuditLogEventObjectStorageOwnerKeyRevealedVariant,
+            "object_storage_usage_collected": AuditLogEventObjectStorageUsageCollectedVariant,
+        },
+    ),
+]
+"""Told apart by `type`; a variant this SDK version does not know is an `UnknownVariant`."""

hyperfluid/models/audit_log_event_authz_break_glass_used_variant.py

@@ -0,0 +1,20 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .authz_break_glass_used_log import AuthzBreakGlassUsedLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventAuthzBreakGlassUsedVariant(BaseModel):
+    """A request was allowed via the platform break-glass bypass. Audited
+    unconditionally: this is the one path that overrides deny and guardrails."""
+
+    data: AuthzBreakGlassUsedLog
+
+    type: t.Literal["authz_break_glass_used"] = "authz_break_glass_used"

hyperfluid/models/audit_log_event_authz_organization_policy_revoked_variant.py

@@ -0,0 +1,23 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .authz_organization_policy_revoked_log import AuthzOrganizationPolicyRevokedLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventAuthzOrganizationPolicyRevokedVariant(BaseModel):
+    """A guardrail (`organization_policy`) was removed by cascade-GC when its
+    resource subtree was deleted. Audited because dropping a deny-unless
+    guardrail *widens* access."""
+
+    data: AuthzOrganizationPolicyRevokedLog
+
+    type: t.Literal["authz_organization_policy_revoked"] = (
+        "authz_organization_policy_revoked"
+    )

hyperfluid/models/audit_log_event_console_authz_decision_variant.py

@@ -0,0 +1,19 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .console_authz_decision_log import ConsoleAuthzDecisionLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventConsoleAuthzDecisionVariant(BaseModel):
+    """The `AuditLogEventConsoleAuthzDecisionVariant` object."""
+
+    data: ConsoleAuthzDecisionLog
+
+    type: t.Literal["console_authz_decision"] = "console_authz_decision"

hyperfluid/models/audit_log_event_container_app_image_synced_variant.py

@@ -0,0 +1,21 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .container_app_image_synced_log import ContainerAppImageSyncedLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventContainerAppImageSyncedVariant(BaseModel):
+    """A ContainerApp's Git source resolved a new image and rolled it out
+    (ADR-0052 §7): pushing to the tracked branch or tag is deploy access, so
+    every such change is attributed to the commit and its author."""
+
+    data: ContainerAppImageSyncedLog
+
+    type: t.Literal["container_app_image_synced"] = "container_app_image_synced"

hyperfluid/models/audit_log_event_data_dock_opa_evaluation_variant.py

@@ -0,0 +1,19 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .opa_decision_log import OpaDecisionLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventDataDockOpaEvaluationVariant(BaseModel):
+    """The `AuditLogEventDataDockOpaEvaluationVariant` object."""
+
+    data: OpaDecisionLog
+
+    type: t.Literal["data_dock_opa_evaluation"] = "data_dock_opa_evaluation"

hyperfluid/models/audit_log_event_managed_postgresql_import_created_variant.py

@@ -0,0 +1,24 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .managed_postgresql_import_created_log import ManagedPostgresqlImportCreatedLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventManagedPostgresqlImportCreatedVariant(BaseModel):
+    """A principal started loading a staged dump into a managed PostgreSQL
+    instance. Recorded because the import replays arbitrary SQL as the
+    chosen database role, which is a write no other trail attributes to a
+    person."""
+
+    data: ManagedPostgresqlImportCreatedLog
+
+    type: t.Literal["managed_postgresql_import_created"] = (
+        "managed_postgresql_import_created"
+    )

hyperfluid/models/audit_log_event_object_storage_owner_key_revealed_variant.py

@@ -0,0 +1,27 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .object_storage_owner_key_revealed_log import ObjectStorageOwnerKeyRevealedLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventObjectStorageOwnerKeyRevealedVariant(BaseModel):
+    """A console-mediated read returned the raw value of a Ceph RGW
+    tenant-owner key (a Secret-Manager entry named under
+    `services/ceph/<binding>/owner/` or tagged `ceph-harbor-owner-user`, by
+    `harbor_binding_reconciler.rs`'s `publish_owner_credentials_to_console`).
+    The only observability left once that credential leaves Secret Manager —
+    see `handlers::secrets::read_secret_value`. Recorded through the acked
+    emitter: a reveal that cannot be recorded is refused."""
+
+    data: ObjectStorageOwnerKeyRevealedLog
+
+    type: t.Literal["object_storage_owner_key_revealed"] = (
+        "object_storage_owner_key_revealed"
+    )

hyperfluid/models/audit_log_event_object_storage_usage_collected_variant.py

@@ -0,0 +1,23 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .object_storage_usage_collected_log import ObjectStorageUsageCollectedLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventObjectStorageUsageCollectedVariant(BaseModel):
+    """The platform's usage sweep read the organization's buckets on one
+    backend (ADR-0048 D5: the collector's principal is named, and it is
+    audited like every other job that reads object data). One event per
+    sweep per (organization, backend), reported by the operator through
+    the internal API."""
+
+    data: ObjectStorageUsageCollectedLog
+
+    type: t.Literal["object_storage_usage_collected"] = "object_storage_usage_collected"

hyperfluid/models/audit_log_event_platform_admin_action_variant.py

@@ -0,0 +1,21 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .platform_admin_action_log import PlatformAdminActionLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventPlatformAdminActionVariant(BaseModel):
+    """A platform administrator changed org-level commercial state from the
+    cockpit (plan, quota overrides, feature toggles). The actor is the
+    VALIDATED platform-realm JWT subject, recorded at the mutation site."""
+
+    data: PlatformAdminActionLog
+
+    type: t.Literal["platform_admin_action"] = "platform_admin_action"

hyperfluid/models/audit_log_event_runtime_security_alert_variant.py

@@ -0,0 +1,25 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .runtime_security_alert_log import RuntimeSecurityAlertLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventRuntimeSecurityAlertVariant(BaseModel):
+    """A runtime-security detection fired on a node. Emitted by Falco and
+    ingested through the internal runtime-security router.
+
+    Attribution is best-effort: the enclosing request's `organization_id`
+    is `None` for platform namespaces and for anything the namespace-label
+    resolver could not place. Those are surfaced as "unattributed", never
+    silently dropped — see `runtime_security::attribution`."""
+
+    data: RuntimeSecurityAlertLog
+
+    type: t.Literal["runtime_security_alert"] = "runtime_security_alert"

hyperfluid/models/audit_log_event_s3_gateway_decision_variant.py

@@ -0,0 +1,19 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .s3_gateway_decision_log import S3GatewayDecisionLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventS3GatewayDecisionVariant(BaseModel):
+    """The `AuditLogEventS3GatewayDecisionVariant` object."""
+
+    data: S3GatewayDecisionLog
+
+    type: t.Literal["s3_gateway_decision"] = "s3_gateway_decision"

hyperfluid/models/audit_log_event_s3_gateway_gate_denied_variant.py

@@ -0,0 +1,21 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .s3_gateway_gate_denied_log import S3GatewayGateDeniedLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventS3GatewayGateDeniedVariant(BaseModel):
+    """A request the S3 gateway refused before any policy ran (unsigned,
+    unknown credential…). Unattributable to a principal by nature; kept
+    because it is the only record of a credential-forgery attempt."""
+
+    data: S3GatewayGateDeniedLog
+
+    type: t.Literal["s3_gateway_gate_denied"] = "s3_gateway_gate_denied"

hyperfluid/models/audit_log_event_s3_gateway_session_issued_variant.py

@@ -0,0 +1,19 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .s3_gateway_session_issued_log import S3GatewaySessionIssuedLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventS3GatewaySessionIssuedVariant(BaseModel):
+    """The `AuditLogEventS3GatewaySessionIssuedVariant` object."""
+
+    data: S3GatewaySessionIssuedLog
+
+    type: t.Literal["s3_gateway_session_issued"] = "s3_gateway_session_issued"