hyperfluid 0.1.0__py3-none-any.whl

hyperfluid/models/s3_gateway_decision_log.py

@@ -0,0 +1,53 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class S3GatewayDecisionLog(BaseModel):
+    """The `S3GatewayDecisionLog` object."""
+
+    action: str
+
+    allow: bool
+
+    backend_id: str
+
+    backend_kind: str
+
+    bucket: str
+
+    decision_id: str
+
+    denied_keys: list[str]
+
+    obligations: dict[str, t.Any]
+
+    organization_id: UUID
+
+    outcome: str
+
+    reason: str
+
+    subject: str
+
+    tenant: str
+
+    backend_status: int | None = None
+
+    copy_source: dict[str, t.Any] | None = None
+
+    delete_keys: list[str] | None = None
+
+    object: str | None = None
+
+    prefix: str | None = None
+
+    span_id: str | None = None
+
+    trace_id: str | None = None

hyperfluid/models/s3_gateway_gate_denied_log.py

@@ -0,0 +1,40 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class S3GatewayGateDeniedLog(BaseModel):
+    """A request the S3 gateway refused at its pre-policy gate. There is no
+    principal to attribute it to (an unsigned request, a forged or expired
+    credential); the org is the gateway's own, stamped by the operator, so the
+    event reads as "an access attempt against this org's gateway"."""
+
+    decision_id: str
+
+    operation: str
+    """The s3s operation the request resolved to, e.g. `ListObjectsV2`."""
+
+    organization_id: UUID
+
+    reason: str
+
+    stage: str
+    """`anonymous` | `operation_not_enforced` | `identity_rejected` | `tenant_not_routable`."""
+
+    suppressed_since_last: int
+    """Gate denials the gateway rate-limited away since the last one it
+    recorded; non-zero means the stream is sampled."""
+
+    access_key_id: str | None = None
+    """The access-key id presented, when one was (never the secret)."""
+
+    span_id: str | None = None
+
+    tenant: str | None = None
+
+    trace_id: str | None = None

hyperfluid/models/s3_gateway_session_issued_log.py

@@ -0,0 +1,32 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class S3GatewaySessionIssuedLog(BaseModel):
+    """Never add `SecretAccessKey` or `SessionToken` here — the same line
+    `outbound::sts_service::redact::SECRET_ELEMENTS` draws."""
+
+    access_key_id: str
+
+    endpoint: str
+
+    principal_type: str
+    """`user` or `service_account`, spelled exactly as the gateway spells them."""
+
+    resource_id: str
+    """The harbor slug, named `resource_id` so the audit-log API's existing `resource_id`
+    filter (`event->'data'->>'resource_id'`) reaches this event."""
+
+    subject_key: str
+    """The prefixed bundle subject key (`user:<oidc sub>` / `sa:<keycloak client id>`),
+    as the gateway's decision records key it."""
+
+    tenant: str
+
+    expires_at: str | None = None
+    """RFC 3339 UTC, as reported by the gateway."""

hyperfluid/models/s3_key_list_entry.py

@@ -0,0 +1,61 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+from datetime import datetime
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class S3KeyListEntry(BaseModel):
+    """The `S3KeyListEntry` object."""
+
+    access_key_id: str
+
+    active: bool
+
+    created_at: datetime
+
+    id: UUID
+
+    is_generated: bool
+    """`true` when the backing account was auto-generated by the scoped-key flow
+    (client id `s3key-…`), so it exists only to hold this key's grants and can
+    be deleted alongside the key. `false` for a customer's own account (the
+    "for a service account" path) or a key whose account was deleted."""
+
+    is_platform_managed: bool
+    """`true` when the backing service account is platform-managed (e.g. the
+    backup/registry/dag-sync identities the platform provisions). Such a key
+    is shown for audit but is not the customer's to revoke or rotate — that
+    is the platform's lifecycle. `false` when the account is customer-owned,
+    or has outlived (its account was deleted)."""
+
+    key_epoch: int
+
+    permissions: list[str]
+    """Distinct bucket permission keys (e.g. `bucket:read_objects`) granted at
+    those scopes. Same emptiness rules as `scopes`."""
+
+    scopes: list[str]
+    """Distinct bucket-grant `scope_path`s held by the key's backing service
+    account, at the time of listing. Empty when the key has outlived its
+    account (there is deliberately no FK from the ledger to
+    `service_accounts` — see `record_s3_long_lived_key`), or when the
+    account holds no bucket grants (e.g. an org-wide grant, which is
+    deliberately excluded — see `list_s3_keys`)."""
+
+    subject: str
+
+    tenant: str
+
+    label: str | None = None
+
+    revoked_at: datetime | None = None
+
+    service_account_id: UUID | None = None
+    """The backing service account's id, so the ledger can rotate the key (mint
+    a successor for the same account). `None` when the key has outlived its
+    account, in which case it can be revoked but not rotated."""

hyperfluid/models/s3_session_credentials.py

@@ -0,0 +1,30 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+from datetime import datetime
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class S3SessionCredentials(BaseModel):
+    """The `S3SessionCredentials` object."""
+
+    access_key_id: str
+
+    endpoint: str
+
+    internal_endpoint: str
+
+    region: str
+    """SigV4 signs over the region: ours is the RGW zonegroup `api_name`
+    (`default`), not `us-east-1`. Wrong value fails every signature check."""
+
+    secret_access_key: str
+
+    session_token: str
+
+    tenant: str
+
+    expires_at: datetime | None = None

hyperfluid/models/saved_queries_page.py

@@ -0,0 +1,30 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .saved_query import SavedQuery
+
+
+@dataclasses.dataclass(kw_only=True)
+class SavedQueriesPage(BaseModel):
+    """One page of `GET /api/v1/tiny-query/queries`.
+
+    Shape mirrors `PipelinesPage` (`data`/`total`/`page`/`limit`) — same
+    pagination contract, different resource."""
+
+    data: list[SavedQuery]
+
+    limit: int
+    """Page size actually served."""
+
+    page: int
+    """Zero-based page index actually served."""
+
+    total: int
+    """Total rows matching the filters, ignoring `page`/`limit` — for the
+    caller to compute page count."""

hyperfluid/models/saved_query.py

@@ -0,0 +1,41 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+from datetime import datetime
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .schedule_state import ScheduleState
+
+
+@dataclasses.dataclass(kw_only=True)
+class SavedQuery(BaseModel):
+    """The `SavedQuery` object."""
+
+    created_at: datetime
+
+    created_by: UUID
+
+    data_dock_id: UUID
+
+    id: UUID
+
+    organization_id: UUID
+
+    sql_text: str
+
+    tags: list[str]
+
+    title: str
+
+    updated_at: datetime
+
+    visibility: str
+
+    description: str | None = None
+
+    schedule: ScheduleState | None = None

hyperfluid/models/saved_query_sort.py

@@ -0,0 +1,22 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class SavedQuerySort(StrEnum):
+    """Sortable columns of the saved-queries list. A closed vocabulary rather
+    than a free-text column name: the repository maps each variant to a fixed
+    `ORDER BY` fragment, so caller input never reaches the SQL string."""
+
+    NEXT_RUN = "next_run"
+    LAST_RUN = "last_run"
+    TITLE = "title"
+    FAILURES = "failures"
+    UPDATED_AT = "updated_at"
+
+
+SavedQuerySortLiteral: t.TypeAlias = t.Literal[
+    "next_run", "last_run", "title", "failures", "updated_at"
+]
+"""The values of :class:`SavedQuerySort`, which arguments take as plain strings too."""

hyperfluid/models/scan_pipeline_health.py

@@ -0,0 +1,41 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class ScanPipelineHealth(BaseModel):
+    """The pipeline's own health, independent of any single scan's outcome — see
+    [`crate::hf_console::domain::workload_security::risk::pipeline_health`]."""
+
+    broken: bool
+    """The pipeline cannot be trusted at all right now (stale inventory, no
+    successful scan far past the interval while digests exist, or a
+    dangerously outdated vulnerability database) — the UI should show a
+    blocking banner, not just a warning badge."""
+
+    degraded: bool
+    """Degraded but still trustworthy (elevated failure rate, or a backed-up
+    queue) — worth a warning, not a blocking banner."""
+
+    disabled: bool
+    """`true` when `workload_security.enabled = false` (chart/config) — the
+    feature was deliberately switched off, so `broken`/`degraded` are
+    always `false` here too (a disabled feature is not a pipeline
+    failure, and the chart-gated vmalert rules key on `broken`/
+    `degraded`, so a disabled deployment must not spuriously page)."""
+
+    failed: int
+
+    inflight: int
+
+    reasons: list[str]
+
+    inventory_age_seconds: int | None = None
+
+    oldest_success_age_seconds: int | None = None
+
+    trivy_db_age_hours: int | None = None

hyperfluid/models/scan_state.py

@@ -0,0 +1,22 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class ScanState(StrEnum):
+    """The lifecycle of a scanned digest as the UI should read it — derived, not
+    stored (see [`crate::hf_console::domain::workload_security::risk::scan_state`])."""
+
+    NEVER_SCANNED = "never_scanned"
+    QUEUED = "queued"
+    SCANNING = "scanning"
+    FRESH = "fresh"
+    STALE = "stale"
+    FAILED = "failed"
+
+
+ScanStateLiteral: t.TypeAlias = t.Literal[
+    "never_scanned", "queued", "scanning", "fresh", "stale", "failed"
+]
+"""The values of :class:`ScanState`, which arguments take as plain strings too."""

hyperfluid/models/scan_status.py

@@ -0,0 +1,18 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class ScanStatus(StrEnum):
+    """Lifecycle of an image scan row (DB `scan_status` ENUM). Mirrors the
+    `registry_role` mapping pattern (`sqlx::Type` + `#[sqlx(type_name = ...)]`)."""
+
+    PENDING = "pending"
+    RUNNING = "running"
+    SUCCEEDED = "succeeded"
+    FAILED = "failed"
+
+
+ScanStatusLiteral: t.TypeAlias = t.Literal["pending", "running", "succeeded", "failed"]
+"""The values of :class:`ScanStatus`, which arguments take as plain strings too."""

hyperfluid/models/scan_summary.py

@@ -0,0 +1,28 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+from datetime import datetime
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .scan_status import ScanStatus
+    from .vulnerability_counts import VulnerabilityCounts
+
+
+@dataclasses.dataclass(kw_only=True)
+class ScanSummary(BaseModel):
+    """Lightweight projection for read-views (catalog/tag badges) and list endpoints
+    — never carries the full `report` blob."""
+
+    counts: VulnerabilityCounts
+
+    digest: str
+
+    status: ScanStatus
+
+    scanned_at: datetime | None = None
+
+    severity_max: str | None = None

hyperfluid/models/scan_trigger.py

@@ -0,0 +1,18 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class ScanTrigger(StrEnum):
+    """What requested a scan (DB `registry_scan_trigger` ENUM). Mirrors the
+    `ScanTrigger` carried on the `RegistryScan` CRD (`hf_lib_domain_core`); kept
+    as a separate console-DB enum so the domain crate takes no console dep."""
+
+    PUSH = "push"
+    SCHEDULED = "scheduled"
+    MANUAL = "manual"
+
+
+ScanTriggerLiteral: t.TypeAlias = t.Literal["push", "scheduled", "manual"]
+"""The values of :class:`ScanTrigger`, which arguments take as plain strings too."""

hyperfluid/models/schedule_state.py

@@ -0,0 +1,87 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+from datetime import datetime
+from uuid import UUID
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .scheduled_run_status import ScheduledRunStatus
+
+
+@dataclasses.dataclass(kw_only=True)
+class ScheduleState(BaseModel):
+    """A saved query's cron schedule and everything about its scheduled
+    execution — grouped into one type so "does this query have a schedule"
+    and "what's its run state" can't drift apart into independently optional
+    columns that are only ever meaningful together. `None` on
+    `SavedQuery.schedule` means on-demand execution only; every field here is
+    otherwise only ever read once that's `Some`."""
+
+    alert_on_failure: bool
+    """Whether the query has its default "keeps failing" alert rule. The
+    rule itself lives on the Alerting page, where it can be tuned."""
+
+    consecutive_failures: int
+    """Consecutive scheduled-run failures, reset to 0 on a successful run.
+    Lets the UI distinguish a single blip from a schedule that's been
+    failing repeatedly."""
+
+    cron: str
+    """Cron expression in the platform's shared dialect — the same grammar
+    Pipelines accept (5 fields with ranges/steps/lists and `JAN`/`MON`
+    names, or a `@daily`/`@every 1h` shorthand), validated by
+    `hf_lib_domain_pipeline::models::validate_schedule`.
+
+    Always evaluated in **UTC**, like every other cron on the platform
+    (Pipeline CronJobs, Iceberg optimize, CNPG scheduled backups). There is
+    deliberately no per-query timezone: adding one is a product decision
+    that has to cover DST for all of them at once, not just this surface."""
+
+    suspended: bool
+    """While `true`, the poller's `claim_due` never claims this row, even
+    past its stored `next_run_at` — a schedule can be paused without
+    losing its cron or its run history."""
+
+    last_error: str | None = None
+    """Why the last run failed. **Redacted to `None` for every reader except
+    the query's owner** (see `SavedQuery::redact_for`): engine errors
+    name catalogs, schemas, tables and columns, and any org member can read
+    any saved query today, so a raw passthrough would route Trino's error
+    text around the dock's OPA column policy."""
+
+    last_run_at: datetime | None = None
+
+    last_status: ScheduledRunStatus | None = None
+
+    last_success_at: datetime | None = None
+    """When this schedule last completed successfully, distinct from
+    `last_run_at` (which updates on every attempt, success or failure).
+    `None` if it has never succeeded. Measures staleness in wall-clock
+    time — `consecutive_failures` alone can't tell a 5-minute schedule
+    apart from a daily one that's failed the same number of times."""
+
+    next_run_at: datetime | None = None
+    """When the next run is due.
+
+    `None` means "due at the next poll" — the scheduler's claim predicate is
+    `(next_run_at IS NULL OR next_run_at <= now())`, so a freshly created or
+    freshly re-scheduled query runs on the next tick rather than waiting for
+    something to compute an occurrence first. It stays `None` until the
+    first run: `scheduled_query_runner_job` is the only writer, advancing it
+    via `next_occurrence` after each attempt. A UI must therefore read
+    `None` as "imminent", never as "not scheduled"."""
+
+    service_account_id: UUID | None = None
+    """The service account this schedule runs as. Its token is what reaches
+    Trino, so this — not the query's `created_by` — is the identity OPA
+    authorizes the run against (see ADR-0041).
+
+    `None` only ever describes a schedule that cannot currently run: a
+    pre-ADR-0041 row suspended by the migration and still awaiting an
+    assignment, or one whose account was removed. The DB mirrors exactly
+    that (`saved_queries_active_schedule_needs_service_account`), and
+    `claim_due` skips such rows, so an active schedule always has one."""

hyperfluid/models/scheduled_run_status.py

@@ -0,0 +1,20 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class ScheduledRunStatus(StrEnum):
+    """Outcome of a saved query's most recent scheduled run.
+
+    Mirrored into the DB column `last_status` (TEXT with a CHECK constraint on
+    the same vocabulary) and into the OpenAPI spec as an `enum`, so every
+    consumer — frontend via hey-api, operator via progenitor, SDK users — sees
+    the same closed set instead of guessing at free-form text."""
+
+    SUCCEEDED = "succeeded"
+    FAILED = "failed"
+
+
+ScheduledRunStatusLiteral: t.TypeAlias = t.Literal["succeeded", "failed"]
+"""The values of :class:`ScheduledRunStatus`, which arguments take as plain strings too."""

hyperfluid/models/scm_branch.py

@@ -0,0 +1,15 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class ScmBranch(BaseModel):
+    """A branch the user can pick after settling on a repo."""
+
+    name: str
+
+    protected: bool

hyperfluid/models/scm_repository.py

@@ -0,0 +1,39 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class ScmRepository(BaseModel):
+    """A repository the user can pick to clone into a dev-workstation."""
+
+    clone_url: str
+    """HTTPS clone URL, ready to use as the workstation's `repo_url`. Built
+    server-side from an origin the console validated — github.com for a
+    GitHub credential, the credential's own instance for GitLab — because a
+    self-managed GitLab is only knowable from the credential, and because
+    this string decides what a workstation fetches and offers its token to."""
+
+    default_branch: str
+    """Default branch — pre-fills the branch picker as a sensible starting point."""
+
+    full_name: str
+    """Canonical path identifier: `owner/name` on GitHub, and the full
+    `group/subgroup/project` path on GitLab, where namespaces nest. Pass it
+    back verbatim as the `repo` parameter of the branches endpoint."""
+
+    html_url: str
+    """Browsable URL on the forge the credential points at, behind the picker's
+    open-in-a-new-tab link."""
+
+    private: bool
+
+    updated_at: str
+    """ISO-8601 timestamp of the last push, used to sort and label the picker
+    rows ("Updated 3 days ago")."""
+
+    description: str | None = None
+    """Short description for the picker subtitle, if the SCM has one."""

hyperfluid/models/scoped_bucket_request.py

@@ -0,0 +1,17 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+
+from ..serialization import BaseModel
+
+
+@dataclasses.dataclass(kw_only=True)
+class ScopedBucketRequest(BaseModel):
+    """The `ScopedBucketRequest` object."""
+
+    bucket: str
+
+    prefixes: list[str] | None = None
+    """Object-key prefixes the key is confined to within `bucket`. Empty means
+    the whole bucket. One grant set is written per prefix."""

hyperfluid/models/search_mode.py

@@ -0,0 +1,27 @@
+# this file is @generated
+import typing as t
+
+from ..serialization import StrEnum
+
+
+class SearchMode(StrEnum):
+    """How to interpret the free-text `search` term (logs explorer).
+
+    - `Text` (default): a case-insensitive SUBSTRING match. The term is
+      RE2-escaped so every metacharacter is literal — `health` matches
+      `GET /healthz`, `a.b` matches only a literal `a.b`.
+    - `Regex`: the term is a user-authored RE2 pattern, validated to compile
+      before it is embedded. Still forced case-insensitive (a power user can
+      override with an inline `(?-i)`).
+
+    Both modes render to the same `~"(?i)…"` LogsQL regex filter on `_msg`; the
+    only difference is whether the term is escaped (Text) or passed through
+    (Regex). The term is always wrapped in a length-capped, quote/backslash
+    escaped LogsQL string — never raw query syntax."""
+
+    TEXT = "text"
+    REGEX = "regex"
+
+
+SearchModeLiteral: t.TypeAlias = t.Literal["text", "regex"]
+"""The values of :class:`SearchMode`, which arguments take as plain strings too."""

hyperfluid/models/secret_manager_ref.py

@@ -0,0 +1,20 @@
+# this file is @generated
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+from ..serialization import BaseModel
+
+if t.TYPE_CHECKING:
+    from .secret_manager_type import SecretManagerType
+
+
+@dataclasses.dataclass(kw_only=True)
+class SecretManagerRef(BaseModel):
+    """Reference to a secret stored in an external secret manager."""
+
+    name: str
+    """Name identifying the secret in the control plane"""
+
+    type: SecretManagerType