hyperfluid 0.1.0__py3-none-any.whl

hyperfluid/models/audit_log_event_security_decision_variant.py

@@ -0,0 +1,19 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .security_decision_log import SecurityDecisionLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventSecurityDecisionVariant(BaseModel):
+    """The `AuditLogEventSecurityDecisionVariant` object."""
+
+    data: SecurityDecisionLog
+
+    type: t.Literal["security_decision"] = "security_decision"

hyperfluid/models/audit_log_event_trino_query_completed_variant.py

@@ -0,0 +1,21 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .trino_query_completed_log import TrinoQueryCompletedLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventTrinoQueryCompletedVariant(BaseModel):
+    """A Trino query completed — the SQL + outcome trace root beyond OPA
+    (ADR-0040 roadmap item 4), from the coordinator's built-in HTTP event
+    listener."""
+
+    data: TrinoQueryCompletedLog
+
+    type: t.Literal["trino_query_completed"] = "trino_query_completed"

hyperfluid/models/audit_log_event_type.py

@@ -0,0 +1,52 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class AuditLogEventType(StrEnum):
+    """The values of `AuditLogEventType`; others are kept as received."""
+
+    DATA_DOCK_OPA_EVALUATION = "data_dock_opa_evaluation"
+    SECURITY_DECISION = "security_decision"
+    CONSOLE_AUTHZ_DECISION = "console_authz_decision"
+    S3_GATEWAY_DECISION = "s3_gateway_decision"
+    AUTHZ_ORGANIZATION_POLICY_REVOKED = "authz_organization_policy_revoked"
+    AUTHZ_BREAK_GLASS_USED = "authz_break_glass_used"
+    S3_GATEWAY_SESSION_ISSUED = "s3_gateway_session_issued"
+    S3_GATEWAY_GATE_DENIED = "s3_gateway_gate_denied"
+    PLATFORM_ADMIN_ACTION = "platform_admin_action"
+    RUNTIME_SECURITY_ALERT = "runtime_security_alert"
+    TRINO_QUERY_COMPLETED = "trino_query_completed"
+    WORKSTATION_AGENT_REQUEST = "workstation_agent_request"
+    WORKSTATION_TERMINAL_COMMAND = "workstation_terminal_command"
+    WORKSTATION_PREVIEW_SESSION = "workstation_preview_session"
+    MANAGED_POSTGRESQL_IMPORT_CREATED = "managed_postgresql_import_created"
+    VIRTUAL_MACHINE_CONSOLE_SESSION = "virtual_machine_console_session"
+    CONTAINER_APP_IMAGE_SYNCED = "container_app_image_synced"
+    OBJECT_STORAGE_OWNER_KEY_REVEALED = "object_storage_owner_key_revealed"
+    OBJECT_STORAGE_USAGE_COLLECTED = "object_storage_usage_collected"
+
+
+AuditLogEventTypeLiteral: t.TypeAlias = t.Literal[
+    "data_dock_opa_evaluation",
+    "security_decision",
+    "console_authz_decision",
+    "s3_gateway_decision",
+    "authz_organization_policy_revoked",
+    "authz_break_glass_used",
+    "s3_gateway_session_issued",
+    "s3_gateway_gate_denied",
+    "platform_admin_action",
+    "runtime_security_alert",
+    "trino_query_completed",
+    "workstation_agent_request",
+    "workstation_terminal_command",
+    "workstation_preview_session",
+    "managed_postgresql_import_created",
+    "virtual_machine_console_session",
+    "container_app_image_synced",
+    "object_storage_owner_key_revealed",
+    "object_storage_usage_collected",
+]
+"""The values of :class:`AuditLogEventType`, which arguments take as plain strings too."""

hyperfluid/models/audit_log_event_virtual_machine_console_session_variant.py

@@ -0,0 +1,23 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .virtual_machine_console_session_log import VirtualMachineConsoleSessionLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventVirtualMachineConsoleSessionVariant(BaseModel):
+    """A browser console session (VNC or serial) on a virtual machine was
+    opened or closed. Recorded at both ends so a session's duration and the
+    reason it ended are on the ledger."""
+
+    data: VirtualMachineConsoleSessionLog
+
+    type: t.Literal["virtual_machine_console_session"] = (
+        "virtual_machine_console_session"
+    )

hyperfluid/models/audit_log_event_workstation_agent_request_variant.py

@@ -0,0 +1,25 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .workstation_agent_request_log import WorkstationAgentRequestLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventWorkstationAgentRequestVariant(BaseModel):
+    """A request a user made of the agent inside a dev workstation, recorded
+    because the organization is in workstation audit mode.
+
+    Content, not a decision. Not part of the tenant audit trail: it is
+    served only by the workstation transcript endpoint, behind
+    `Permission::DevWorkstationAuditRead`, and is filtered out of
+    `GET /api/v1/audit-logs` the way platform-admin actions are."""
+
+    data: WorkstationAgentRequestLog
+
+    type: t.Literal["workstation_agent_request"] = "workstation_agent_request"

hyperfluid/models/audit_log_event_workstation_preview_session_variant.py

@@ -0,0 +1,22 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .workstation_preview_session_log import WorkstationPreviewSessionLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventWorkstationPreviewSessionVariant(BaseModel):
+    """A preview session was opened into a workstation while the organization
+    was in audit mode with `PreviewPosture::Record`. Records that an
+    unrecorded interactive channel was available, and for how long, which
+    is the fact a reviewer needs even without its contents."""
+
+    data: WorkstationPreviewSessionLog
+
+    type: t.Literal["workstation_preview_session"] = "workstation_preview_session"

hyperfluid/models/audit_log_event_workstation_terminal_command_variant.py

@@ -0,0 +1,20 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .workstation_terminal_command_log import WorkstationTerminalCommandLog
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogEventWorkstationTerminalCommandVariant(BaseModel):
+    """A command line submitted in a dev workstation terminal. Same audience
+    and same exclusion as [`Self::WorkstationAgentRequest`]."""
+
+    data: WorkstationTerminalCommandLog
+
+    type: t.Literal["workstation_terminal_command"] = "workstation_terminal_command"

hyperfluid/models/audit_log_freshness.py

@@ -0,0 +1,17 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+from datetime import datetime
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogFreshness(BaseModel):
+    """How far the durable audit log has been rolled up. Platform-wide, not per org: the rollup
+    advances one watermark for every tenant."""
+
+    complete_as_of: datetime | None = None
+    """Every decision ingested up to this instant has been rolled up into the durable log;
+    `None` until the first rollup has run (or with no audit warehouse configured)."""

hyperfluid/models/audit_log_page_audit_entry.py

@@ -0,0 +1,28 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+from datetime import datetime
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .audit_log_page_audit_entry_data_item import AuditLogPageAuditEntryDataItem
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogPageAuditEntry(BaseModel):
+    """One keyset-paged slice of an audit read. No total: counting needs a second full scan, so a
+    reader pages forward by `next_cursor` until `has_more` is false."""
+
+    data: list[AuditLogPageAuditEntryDataItem]
+
+    has_more: bool
+
+    window_start: datetime
+    """Earliest instant the read covered: the caller's `from`, or the default window's start.
+    Rows older than this were not searched."""
+
+    next_cursor: str | None = None
+    """Pass back as `cursor` for the next page; `None` on the last page."""

hyperfluid/models/audit_log_page_audit_entry_data_item.py

@@ -0,0 +1,124 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+from datetime import datetime
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .audit_actor_kind import AuditActorKind
+    from .audit_entry_kind import AuditEntryKind
+    from .audit_log_event import AuditLogEvent
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogPageAuditEntryDataItem(BaseModel):
+    """One row in the unified audit log; a query and an event share the same columns."""
+
+    actor_kind: AuditActorKind
+
+    columns_accessed: list[str]
+    """`catalog.schema.table.column`, from `metadata.tables[].columns[]`."""
+
+    event_type: str
+    """The bronze `event_type` (`data_dock_opa_evaluation`, `console_authz_decision`, …)."""
+
+    id: str
+    """`query_id` for a query, `record_id` for an event — the drill-down key."""
+
+    kind: AuditEntryKind
+
+    oauth_id: str
+
+    organization_id: UUID
+    """Always the row's real org, projected on every branch of the union — including on the
+    cross-org internal read, where it is what lets the cockpit label/filter the merged stream
+    client-side (the cockpit maps ids to names itself via its own org list, never the reverse)."""
+
+    resources: list[str]
+    """Tables touched (query) or the single resource id (event), best-effort."""
+
+    timestamp: datetime
+    """When the action happened (a query's start, an event's original timestamp)."""
+
+    action: str | None = None
+    """The OPA operation for an event (`GetObject`, …); `None` for a query row."""
+
+    allow: bool | None = None
+    """Overall verdict; `None` when no boolean decision contributed one (filter-only)."""
+
+    client_source: str | None = None
+    """`context.source` — the client that submitted the query (`trino-cli`, `bifrost`, …)."""
+
+    client_trace_tag: str | None = None
+    """The submitting Hyperfluid client's own id for the statement (tinyQuery
+    history id, Bifrost access-event `query_id`); `None` for other clients."""
+
+    completed_at: datetime | None = None
+
+    cpu_time_ms: int | None = None
+
+    data_dock_id: str | None = None
+
+    decision_count: int | None = None
+    """Number of OPA decisions compacted into a query row; `None` for events."""
+
+    error_code: str | None = None
+
+    event: AuditLogEvent | None = None
+
+    failure_message: str | None = None
+
+    ingested_at: datetime | None = None
+    """When the platform received the (last) decision behind this row — the arrival-time twin of
+    `timestamp`, so a reader can tell a late-arriving row from a late-happening one."""
+
+    input_bytes: int | None = None
+
+    input_rows: int | None = None
+
+    output_bytes: int | None = None
+
+    output_rows: int | None = None
+
+    peak_memory_bytes: int | None = None
+
+    platform_client_id: str | None = None
+    """Set only when `actor_kind` is `platform` — the provisioned client's
+    Keycloak `client_id` (`<dock>-bifrost-sa`, `<org>-storage-sa`, …)."""
+
+    query_state: str | None = None
+    """`FINISHED` / `FAILED` (Trino's own `QueryState`, passed through verbatim)."""
+
+    queued_time_ms: int | None = None
+
+    restricted: bool | None = None
+    """The query ran but a row filter or column mask shaped the result. Query rows only."""
+
+    service_account_id: UUID | None = None
+    """Set only when `actor_kind` is `service_account` — the console
+    `service_accounts.id`, so the UI can link to the account."""
+
+    service_account_name: str | None = None
+
+    source: str | None = None
+    """`trino` / `s3-gateway` / `console` — origin of the action."""
+
+    sql: str | None = None
+    """The rest of this block is populated only once the Trino query-completion
+    listener's event has landed for this query (ADR-0040 roadmap item 4) —
+    `None`/empty on a query row until then, and always `None`/empty on an
+    event row (the `access_events` branch of the union projects NULLs)."""
+
+    sql_truncated: bool | None = None
+
+    update_type: str | None = None
+
+    user_email: str | None = None
+
+    user_name: str | None = None
+
+    wall_time_ms: int | None = None

hyperfluid/models/audit_log_page_list_audit_log_item.py

@@ -0,0 +1,30 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+from datetime import datetime
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .audit_log_page_list_audit_log_item_data_item import (
+        AuditLogPageListAuditLogItemDataItem,
+    )
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogPageListAuditLogItem(BaseModel):
+    """One keyset-paged slice of an audit read. No total: counting needs a second full scan, so a
+    reader pages forward by `next_cursor` until `has_more` is false."""
+
+    data: list[AuditLogPageListAuditLogItemDataItem]
+
+    has_more: bool
+
+    window_start: datetime
+    """Earliest instant the read covered: the caller's `from`, or the default window's start.
+    Rows older than this were not searched."""
+
+    next_cursor: str | None = None
+    """Pass back as `cursor` for the next page; `None` on the last page."""

hyperfluid/models/audit_log_page_list_audit_log_item_data_item.py

@@ -0,0 +1,43 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+from datetime import datetime
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .audit_actor import AuditActor
+    from .audit_actor_kind import AuditActorKind
+    from .audit_log_event import AuditLogEvent
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuditLogPageListAuditLogItemDataItem(BaseModel):
+    """The `AuditLogPageListAuditLogItemDataItem` object."""
+
+    actor_kind: AuditActorKind
+
+    created_at: datetime
+
+    event: AuditLogEvent
+
+    id: UUID
+
+    oauth_id: UUID
+
+    organization_id: UUID
+
+    original_timestamp: datetime
+
+    platform_client_id: str | None = None
+    """Set only when `actor_kind` is `platform` — see `AuditEntry::platform_client_id`."""
+
+    service_account_id: UUID | None = None
+    """Set only when `actor_kind` is `service_account`."""
+
+    service_account_name: str | None = None
+
+    user: AuditActor | None = None

hyperfluid/models/authorize_preview_response.py

@@ -0,0 +1,27 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuthorizePreviewResponse(BaseModel):
+    """What the caller must do next to hold a usable preview capability."""
+
+    handoff_url: str | None = None
+    """`null` when previews live one label under the console host: the response
+    already carries the capability cookie, scoped to the console host, and
+    the browser sends it to the preview subdomain on its own.
+
+    Non-null when the platform pins previews to a parent of their own. The
+    console origin cannot then set a cookie the preview host would receive,
+    so the capability is handed over instead: load this URL once (a
+    `fetch` is enough — nothing needs to be read from the response) and the
+    preview host answers with a **host-only** cookie. It is
+    protocol-relative (`//host/path`), because the console cannot see the
+    browser-facing scheme through the proxy chain; resolve it against the
+    document.
+
+    Short-lived by design — spend it immediately."""

hyperfluid/models/authz_break_glass_used_log.py

@@ -0,0 +1,21 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuthzBreakGlassUsedLog(BaseModel):
+    """Audit payload for a break-glass bypass. One entry per authorized request that
+    resolved via the platform recovery subject."""
+
+    action: str
+    """The action that was allowed (`<resource_type>:<action>`)."""
+
+    resource_hrn: str
+    """Canonical HRN of the targeted resource."""
+
+    subject: str
+    """The break-glass subject that was used."""

hyperfluid/models/authz_organization_policy_revoked_log.py

@@ -0,0 +1,28 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class AuthzOrganizationPolicyRevokedLog(BaseModel):
+    """Audit payload for a guardrail removed by cascade-GC on resource delete.
+    One entry is written per removed guardrail."""
+
+    action: str
+    """The removed guardrail's action pattern (e.g. `secret:*` or `*`)."""
+
+    policy_id: UUID
+    """Id of the removed guardrail."""
+
+    resource_pattern: str
+    """The removed guardrail's resource-id pattern (e.g. `team-a/*`)."""
+
+    triggering_resource_path: str
+    """Canonical path of the deleted resource (e.g. `team-a` or `team-a/sales-db`)."""
+
+    triggering_resource_type: str
+    """Resource family whose deletion triggered the cascade (e.g. `harbor`)."""

hyperfluid/models/auto_suspend_input.py

@@ -0,0 +1,15 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class AutoSuspendInput(BaseModel):
+    """Idle auto-suspend policy."""
+
+    enabled: bool | None = None
+
+    idle_minutes: int | None = None

hyperfluid/models/autoscaling_spec.py

@@ -0,0 +1,52 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import UNSET, BaseModel, Unset
+
+
+@dataclasses.dataclass(kw_only=True)
+class AutoscalingSpec(BaseModel):
+    """Horizontal autoscaling of a ContainerApp, reconciled into a KEDA
+    `ScaledObject`.
+
+    Every target is optional and resolved by the operator, never written here:
+    an app that names no metric scales on CPU at
+    `DEFAULT_TARGET_CPU_UTILIZATION`, and `minReplicas: 0` without an HTTP
+    target scales on `DEFAULT_TARGET_HTTP_CONCURRENCY`."""
+
+    _JSON_KEYS: t.ClassVar[t.Mapping[str, str]] = {
+        "max_replicas": "maxReplicas",
+        "min_replicas": "minReplicas",
+        "scale_to_zero_after_seconds": "scaleToZeroAfterSeconds",
+        "target_cpu_utilization": "targetCpuUtilization",
+        "target_http_concurrency": "targetHttpConcurrency",
+        "target_memory_utilization": "targetMemoryUtilization",
+    }
+
+    max_replicas: int
+    """Most replicas the autoscaler may run. The quota reserves this many."""
+
+    min_replicas: int | None | Unset = UNSET
+    """Fewest replicas kept running. Absent means 1. `0` lets the app scale to
+    zero when it receives no HTTP traffic: its routes then go through the
+    KEDA HTTP interceptor, which holds the first request while a replica
+    starts."""
+
+    scale_to_zero_after_seconds: int | None | Unset = UNSET
+    """Seconds without traffic before an app with `minReplicas: 0` is scaled to
+    zero. Absent means KEDA's default, 300."""
+
+    target_cpu_utilization: int | None | Unset = UNSET
+    """Target average CPU use per replica, in percent of the vCPU sold to the
+    app (`resources.entitlement.cpu`)."""
+
+    target_http_concurrency: int | None | Unset = UNSET
+    """Target concurrent HTTP requests per replica. Setting it routes the
+    app's traffic through the KEDA HTTP interceptor, which counts them."""
+
+    target_memory_utilization: int | None | Unset = UNSET
+    """Target average memory use per replica, in percent of the memory sold to
+    the app (`resources.requests.memory`)."""

hyperfluid/models/available_image.py

@@ -0,0 +1,42 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .resolved_image import ResolvedImage
+
+
+@dataclasses.dataclass(kw_only=True)
+class AvailableImage(BaseModel):
+    """A changed entry a check found and did not roll out, because the source
+    syncs manually or the organization turned automatic sync off."""
+
+    _JSON_KEYS: t.ClassVar[t.Mapping[str, str]] = {
+        "commit_author": "commitAuthor",
+        "commit_message": "commitMessage",
+        "entry_hash": "entryHash",
+        "found_at": "foundAt",
+        "resolved_ref": "resolvedRef",
+    }
+
+    entry_hash: str
+    """sha256 of the entry, as in `entryHash`."""
+
+    found_at: str
+    """First check that found this entry (RFC 3339)."""
+
+    image: ResolvedImage
+
+    resolved_ref: str
+    """Branch name, or the tag the pattern selected."""
+
+    revision: str
+    """Commit the entry was read at."""
+
+    commit_author: str | None = None
+
+    commit_message: str | None = None

hyperfluid/models/backend_driver.py

@@ -0,0 +1,15 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class BackendDriver(StrEnum):
+    """The values of `BackendDriver`; others are kept as received."""
+
+    CEPH_RGW = "cephRgw"
+    S3 = "s3"
+
+
+BackendDriverLiteral: t.TypeAlias = t.Literal["cephRgw", "s3"]
+"""The values of :class:`BackendDriver`, which arguments take as plain strings too."""

hyperfluid/models/backup_origin.py

@@ -0,0 +1,19 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class BackupOrigin(StrEnum):
+    """Whether the backup was user-initiated or produced by a scheduled run that
+    the operator adopted. Mirrored into the DB column `origin` (VARCHAR(16)
+    with a CHECK constraint on the same vocabulary) and into the OpenAPI spec
+    as an `enum`, so every consumer (operator via progenitor, frontend via
+    hey-api, SDK users) sees the same closed set."""
+
+    MANUAL = "manual"
+    SCHEDULED = "scheduled"
+
+
+BackupOriginLiteral: t.TypeAlias = t.Literal["manual", "scheduled"]
+"""The values of :class:`BackupOrigin`, which arguments take as plain strings too."""