hyperfluid 0.1.0__py3-none-any.whl

hyperfluid/api/dev_workstations.py

@@ -0,0 +1,889 @@
+# this file is @generated
+"""Dev workstations API."""
+
+from __future__ import annotations
+
+import functools
+import typing as t
+from uuid import UUID
+
+from .. import models as _models
+from ..models import (
+    CreateDevWorkstationRequest,
+    DevWorkstationEgressResponse,
+    DevWorkstationResponse,
+    SkillRegistryRefDto,
+    UpdateDevWorkstationNetworkRequest,
+    UpdateDevWorkstationRequest,
+    UpdateWorkstationSkillRegistriesRequest,
+    WorkstationRepositoryInput,
+    WorkstationSkillRegistriesResponse,
+)
+from ..serialization import UNSET, Unset, to_json_value
+from ._response import async_to_raw_response_wrapper, to_raw_response_wrapper
+from .common import (
+    ApiBaseAsync,
+    ApiBaseSync,
+    ApiRequest,
+    Timeout,
+    decode_response,
+    encode_path_param,
+)
+from .dev_workstations_terminals import (
+    AsyncDevWorkstationsTerminals,
+    AsyncDevWorkstationsTerminalsWithRawResponse,
+    DevWorkstationsTerminals,
+    DevWorkstationsTerminalsWithRawResponse,
+)
+
+
+class AsyncDevWorkstations(ApiBaseAsync):
+    """Dev workstations API, for asyncio."""
+
+    @property
+    def with_raw_response(self) -> AsyncDevWorkstationsWithRawResponse:
+        """These methods, returning an :class:`APIResponse` with the status and headers."""
+        return AsyncDevWorkstationsWithRawResponse(self)
+
+    @functools.cached_property
+    def terminals(self) -> AsyncDevWorkstationsTerminals:
+        """The terminals API."""
+        return AsyncDevWorkstationsTerminals(self._cfg, self._httpx_client)
+
+    async def list_dev_workstations(
+        self,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> list[DevWorkstationResponse]:
+        """`GET /api/dev/workstations`."""
+        response = await self._request(
+            ApiRequest(
+                method="get",
+                path="/api/dev/workstations",
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, list[DevWorkstationResponse])
+
+    async def create_dev_workstation(
+        self,
+        *,
+        harbor_id: UUID,
+        name: str,
+        repo_url: str,
+        additional_repositories: list[WorkstationRepositoryInput] | None = None,
+        allowlists: list[str] | None = None,
+        egress_profile: str | None | Unset = UNSET,
+        extra_fqdns: list[str] | None = None,
+        inference_model: str | None | Unset = UNSET,
+        inference_provider: str | None | Unset = UNSET,
+        llm_providers: list[str] | None | Unset = UNSET,
+        oci_enabled: bool | None | Unset = UNSET,
+        oci_store_size: str | None | Unset = UNSET,
+        openrouter_key_secret_id: UUID | None | Unset = UNSET,
+        repo_provider: str | None | Unset = UNSET,
+        repo_ref: str | None | Unset = UNSET,
+        scm_secret_id: UUID | None | Unset = UNSET,
+        service_account_id: UUID | None | Unset = UNSET,
+        skill_registries: list[SkillRegistryRefDto] | None = None,
+        template_ref: str | None | Unset = UNSET,
+        template_version: str | None | Unset = UNSET,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationResponse:
+        """`POST /api/dev/workstations`.
+
+        :param additional_repositories: Repositories cloned alongside the primary one, each into its own directory under `/workspace`. Every entry must use the same `repo_provider` as the primary: one SCM credential covers the whole workstation.
+        :param allowlists: Names of `EgressAllowlist` CRs (created via the harbor-scoped egress-allowlists API) this workstation may reach on top of `extra_fqdns`. Each must already exist in the harbor's workstation namespace.
+        :param egress_profile: Egress allow-list profile: `default` | `restricted` | `extended`.
+        :param extra_fqdns: Extra FQDNs this workstation may reach, on top of the profile.
+        :param inference_model: Provider-qualified opencode model id the agent defaults to, e.g. `<provider>/<model>`. When omitted, the workstation entrypoint's curated default for the provider applies.
+        :param inference_provider: Inference provider for the agent: `sapience` (in-cluster LLMaaS, default), `openrouter` (external), or `claude` (Claude Code as the workstation agent, Anthropic API). Omitted/empty falls back to `sapience`.
+        :param llm_providers: Managed external LLM providers the agent may reach (openrouter, anthropic, openai, gemini). Defaults to [openrouter] when omitted.
+        :param oci_enabled: OCI container runtime (Docker engine sidecar + Block-mode PVC store per ADR-0019, amended; requires the Kata runtime class). When enabled, the operator provisions a privileged dockerd sidecar whose privilege is confined to the workstation microVM.  Omitted takes the platform default, which is ON wherever workstations run under Kata (ADR-0019 amendment 2) — pass `false` to opt this workstation out. A template that declares it needs the runtime turns containers on regardless, since its image and setup script assume an engine.
+        :param oci_store_size: Optional size of the Block PVC for the OCI store (e.g. "20Gi"). Defaults to "20Gi" when oci_enabled is true and size is unset. Only used when enabled.
+        :param openrouter_key_secret_id: Id of a Passe Partout secret of type `plaintext` holding the external provider API key (`sk-or-...` for OpenRouter, `sk-ant-...` for Claude). Required when `inference_provider` is `openrouter`; optional for `claude` (without it the user signs in interactively in the TUI).
+        :param repo_provider: SCM provider: `github` (external, default), `gitlab` (external) or `forgejo` (in-cluster forge). `gitlab` covers gitlab.com and a self-managed instance alike; which one is decided by the instance URL on the `scm_secret_id` credential, not here.
+        :param scm_secret_id: Id of a Passe Partout secret of type `scm_credential` holding the git token. Required for `github` and `gitlab`, where it also carries the instance URL that identifies a self-managed GitLab; omit for an in-cluster `forgejo` workstation — the operator mints a token from the owner's OIDC identity (ADR-0016 phase 2).
+        :param service_account_id: Id of a Hyperfluid Service-Account to authenticate hfctl with inside the workstation pod. When set, the operator resolves the SA credentials and mounts them at /run/secrets/hfctl/sa.json. Optional.
+        :param skill_registries: Skill registries to attach (ADR-0039), by name + scope. Harbor-scoped entries must already exist in this harbor; platform ones are the stock registries the chart installs.  Empty is the wire default. Attach-by-default (the wizard pre-checking the platform essentials registry and any `auto_attach` harbor registry) is console policy applied by the caller, never a default filled in here. Capped at `MAX_SKILL_REGISTRIES_PER_WORKSTATION`.
+        :param template_ref: CRD name of a [`WorkstationTemplate`] to resolve as the workstation's environment (ADR-0015). When set, the template is resolved at create time and the resulting base image + setup script are embedded in the CR spec. When absent, the workstation uses the platform default base, no extra setup.
+        :param template_version: Template version to pin. When set alongside `template_ref`, the resolve step checks that the template's version matches this value. When absent, the current version is used and recorded."""
+        response = await self._request(
+            ApiRequest(
+                method="post",
+                path="/api/dev/workstations",
+                json_body=to_json_value(
+                    CreateDevWorkstationRequest(
+                        additional_repositories=additional_repositories,
+                        allowlists=allowlists,
+                        egress_profile=egress_profile,
+                        extra_fqdns=extra_fqdns,
+                        harbor_id=harbor_id,
+                        inference_model=inference_model,
+                        inference_provider=inference_provider,
+                        llm_providers=llm_providers,
+                        name=name,
+                        oci_enabled=oci_enabled,
+                        oci_store_size=oci_store_size,
+                        openrouter_key_secret_id=openrouter_key_secret_id,
+                        repo_provider=repo_provider,
+                        repo_ref=repo_ref,
+                        repo_url=repo_url,
+                        scm_secret_id=scm_secret_id,
+                        service_account_id=service_account_id,
+                        skill_registries=skill_registries,
+                        template_ref=template_ref,
+                        template_version=template_version,
+                    ),
+                    CreateDevWorkstationRequest,
+                ),
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationResponse)
+
+    async def retrieve_dev_workstation(
+        self,
+        id: UUID,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationResponse:
+        """`GET /api/dev/workstations/{id}`."""
+        response = await self._request(
+            ApiRequest(
+                method="get",
+                path="/api/dev/workstations/{id}",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationResponse)
+
+    async def delete_dev_workstation(
+        self,
+        id: UUID,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> None:
+        """`DELETE /api/dev/workstations/{id}`."""
+        await self._request(
+            ApiRequest(
+                method="delete",
+                path="/api/dev/workstations/{id}",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+
+    async def update_dev_workstation(
+        self,
+        id: UUID,
+        *,
+        inference_model: str | None | Unset = UNSET,
+        inference_provider: str | None | Unset = UNSET,
+        openrouter_key_secret_id: UUID | None | Unset = UNSET,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationResponse:
+        """`PATCH /api/dev/workstations/{id}`.
+
+        :param inference_model: Provider-qualified opencode model id to default to. When present (even empty), replaces the workstation's default model; an empty string clears it so the entrypoint's curated default applies again.
+        :param inference_provider: Inference provider: `sapience` (in-cluster LLMaaS), `openrouter` (external), or `claude` (Claude Code as the workstation agent). When present, replaces the workstation's provider.
+        :param openrouter_key_secret_id: Id of a Passe Partout secret of type `plaintext` holding the OpenRouter API key. When present, replaces the workstation's key secret reference."""
+        response = await self._request(
+            ApiRequest(
+                method="patch",
+                path="/api/dev/workstations/{id}",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                json_body=to_json_value(
+                    UpdateDevWorkstationRequest(
+                        inference_model=inference_model,
+                        inference_provider=inference_provider,
+                        openrouter_key_secret_id=openrouter_key_secret_id,
+                    ),
+                    UpdateDevWorkstationRequest,
+                ),
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationResponse)
+
+    async def retrieve_dev_workstation_egress(
+        self,
+        id: UUID,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationEgressResponse:
+        """`GET /api/dev/workstations/{id}/egress`."""
+        response = await self._request(
+            ApiRequest(
+                method="get",
+                path="/api/dev/workstations/{id}/egress",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationEgressResponse)
+
+    async def update_dev_workstation_network(
+        self,
+        id: UUID,
+        *,
+        allowlists: list[str] | None | Unset = UNSET,
+        egress_profile: str | None | Unset = UNSET,
+        extra_fqdns: list[str] | None | Unset = UNSET,
+        llm_providers: list[str] | None | Unset = UNSET,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationEgressResponse:
+        """`PATCH /api/dev/workstations/{id}/network`.
+
+        :param allowlists: Replaces the workstation's referenced `EgressAllowlist` names when present. Each must exist in the workstation's harbor namespace.
+        :param egress_profile: Egress allow-list profile: `default` | `restricted` | `extended`.
+        :param extra_fqdns: Replaces the workstation's extra FQDNs when present.
+        :param llm_providers: Replaces the workstation's selected managed LLM providers when present."""
+        response = await self._request(
+            ApiRequest(
+                method="patch",
+                path="/api/dev/workstations/{id}/network",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                json_body=to_json_value(
+                    UpdateDevWorkstationNetworkRequest(
+                        allowlists=allowlists,
+                        egress_profile=egress_profile,
+                        extra_fqdns=extra_fqdns,
+                        llm_providers=llm_providers,
+                    ),
+                    UpdateDevWorkstationNetworkRequest,
+                ),
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationEgressResponse)
+
+    async def list_dev_workstation_skill_registries(
+        self,
+        id: UUID,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> WorkstationSkillRegistriesResponse:
+        """The skill registries this workstation attaches, read straight off its CR."""
+        response = await self._request(
+            ApiRequest(
+                method="get",
+                path="/api/dev/workstations/{id}/skill-registries",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, WorkstationSkillRegistriesResponse)
+
+    async def update_dev_workstation_skill_registries(
+        self,
+        id: UUID,
+        *,
+        skill_registries: list[SkillRegistryRefDto],
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> WorkstationSkillRegistriesResponse:
+        """Replace the workstation's attached skill registries.
+
+        A replace, not a merge: the request carries the complete list, so an empty
+        one detaches everything. The operator watches the registry CRs and fans a
+        change out onto the workstations referencing them, so this patch is all the
+        console has to do — no pod restart, no ConfigMap written from here.
+
+        Follows [`update_dev_workstation_network`]: owner-scoped, validate, patch the
+        CR, read the result back so the response reflects what the cluster now holds.
+
+        :param skill_registries: The complete new list — this is a replace, not a merge, so an empty list detaches everything. Capped at `MAX_SKILL_REGISTRIES_PER_WORKSTATION`."""
+        response = await self._request(
+            ApiRequest(
+                method="patch",
+                path="/api/dev/workstations/{id}/skill-registries",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                json_body=to_json_value(
+                    UpdateWorkstationSkillRegistriesRequest(
+                        skill_registries=skill_registries,
+                    ),
+                    UpdateWorkstationSkillRegistriesRequest,
+                ),
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, WorkstationSkillRegistriesResponse)
+
+
+class AsyncDevWorkstationsWithRawResponse:
+    """The methods of :class:`AsyncDevWorkstations`, returning an :class:`APIResponse`."""
+
+    def __init__(self, resource: AsyncDevWorkstations) -> None:
+        self._resource = resource
+        self.list_dev_workstations = async_to_raw_response_wrapper(
+            resource.list_dev_workstations
+        )
+        self.create_dev_workstation = async_to_raw_response_wrapper(
+            resource.create_dev_workstation
+        )
+        self.retrieve_dev_workstation = async_to_raw_response_wrapper(
+            resource.retrieve_dev_workstation
+        )
+        self.delete_dev_workstation = async_to_raw_response_wrapper(
+            resource.delete_dev_workstation
+        )
+        self.update_dev_workstation = async_to_raw_response_wrapper(
+            resource.update_dev_workstation
+        )
+        self.retrieve_dev_workstation_egress = async_to_raw_response_wrapper(
+            resource.retrieve_dev_workstation_egress
+        )
+        self.update_dev_workstation_network = async_to_raw_response_wrapper(
+            resource.update_dev_workstation_network
+        )
+        self.list_dev_workstation_skill_registries = async_to_raw_response_wrapper(
+            resource.list_dev_workstation_skill_registries
+        )
+        self.update_dev_workstation_skill_registries = async_to_raw_response_wrapper(
+            resource.update_dev_workstation_skill_registries
+        )
+
+    @property
+    def terminals(self) -> AsyncDevWorkstationsTerminalsWithRawResponse:
+        """The terminals API."""
+        return AsyncDevWorkstationsTerminalsWithRawResponse(self._resource.terminals)
+
+
+class DevWorkstations(ApiBaseSync):
+    """Dev workstations API."""
+
+    @property
+    def with_raw_response(self) -> DevWorkstationsWithRawResponse:
+        """These methods, returning an :class:`APIResponse` with the status and headers."""
+        return DevWorkstationsWithRawResponse(self)
+
+    @functools.cached_property
+    def terminals(self) -> DevWorkstationsTerminals:
+        """The terminals API."""
+        return DevWorkstationsTerminals(self._cfg, self._httpx_client)
+
+    def list_dev_workstations(
+        self,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> list[DevWorkstationResponse]:
+        """`GET /api/dev/workstations`."""
+        response = self._request(
+            ApiRequest(
+                method="get",
+                path="/api/dev/workstations",
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, list[DevWorkstationResponse])
+
+    def create_dev_workstation(
+        self,
+        *,
+        harbor_id: UUID,
+        name: str,
+        repo_url: str,
+        additional_repositories: list[WorkstationRepositoryInput] | None = None,
+        allowlists: list[str] | None = None,
+        egress_profile: str | None | Unset = UNSET,
+        extra_fqdns: list[str] | None = None,
+        inference_model: str | None | Unset = UNSET,
+        inference_provider: str | None | Unset = UNSET,
+        llm_providers: list[str] | None | Unset = UNSET,
+        oci_enabled: bool | None | Unset = UNSET,
+        oci_store_size: str | None | Unset = UNSET,
+        openrouter_key_secret_id: UUID | None | Unset = UNSET,
+        repo_provider: str | None | Unset = UNSET,
+        repo_ref: str | None | Unset = UNSET,
+        scm_secret_id: UUID | None | Unset = UNSET,
+        service_account_id: UUID | None | Unset = UNSET,
+        skill_registries: list[SkillRegistryRefDto] | None = None,
+        template_ref: str | None | Unset = UNSET,
+        template_version: str | None | Unset = UNSET,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationResponse:
+        """`POST /api/dev/workstations`.
+
+        :param additional_repositories: Repositories cloned alongside the primary one, each into its own directory under `/workspace`. Every entry must use the same `repo_provider` as the primary: one SCM credential covers the whole workstation.
+        :param allowlists: Names of `EgressAllowlist` CRs (created via the harbor-scoped egress-allowlists API) this workstation may reach on top of `extra_fqdns`. Each must already exist in the harbor's workstation namespace.
+        :param egress_profile: Egress allow-list profile: `default` | `restricted` | `extended`.
+        :param extra_fqdns: Extra FQDNs this workstation may reach, on top of the profile.
+        :param inference_model: Provider-qualified opencode model id the agent defaults to, e.g. `<provider>/<model>`. When omitted, the workstation entrypoint's curated default for the provider applies.
+        :param inference_provider: Inference provider for the agent: `sapience` (in-cluster LLMaaS, default), `openrouter` (external), or `claude` (Claude Code as the workstation agent, Anthropic API). Omitted/empty falls back to `sapience`.
+        :param llm_providers: Managed external LLM providers the agent may reach (openrouter, anthropic, openai, gemini). Defaults to [openrouter] when omitted.
+        :param oci_enabled: OCI container runtime (Docker engine sidecar + Block-mode PVC store per ADR-0019, amended; requires the Kata runtime class). When enabled, the operator provisions a privileged dockerd sidecar whose privilege is confined to the workstation microVM.  Omitted takes the platform default, which is ON wherever workstations run under Kata (ADR-0019 amendment 2) — pass `false` to opt this workstation out. A template that declares it needs the runtime turns containers on regardless, since its image and setup script assume an engine.
+        :param oci_store_size: Optional size of the Block PVC for the OCI store (e.g. "20Gi"). Defaults to "20Gi" when oci_enabled is true and size is unset. Only used when enabled.
+        :param openrouter_key_secret_id: Id of a Passe Partout secret of type `plaintext` holding the external provider API key (`sk-or-...` for OpenRouter, `sk-ant-...` for Claude). Required when `inference_provider` is `openrouter`; optional for `claude` (without it the user signs in interactively in the TUI).
+        :param repo_provider: SCM provider: `github` (external, default), `gitlab` (external) or `forgejo` (in-cluster forge). `gitlab` covers gitlab.com and a self-managed instance alike; which one is decided by the instance URL on the `scm_secret_id` credential, not here.
+        :param scm_secret_id: Id of a Passe Partout secret of type `scm_credential` holding the git token. Required for `github` and `gitlab`, where it also carries the instance URL that identifies a self-managed GitLab; omit for an in-cluster `forgejo` workstation — the operator mints a token from the owner's OIDC identity (ADR-0016 phase 2).
+        :param service_account_id: Id of a Hyperfluid Service-Account to authenticate hfctl with inside the workstation pod. When set, the operator resolves the SA credentials and mounts them at /run/secrets/hfctl/sa.json. Optional.
+        :param skill_registries: Skill registries to attach (ADR-0039), by name + scope. Harbor-scoped entries must already exist in this harbor; platform ones are the stock registries the chart installs.  Empty is the wire default. Attach-by-default (the wizard pre-checking the platform essentials registry and any `auto_attach` harbor registry) is console policy applied by the caller, never a default filled in here. Capped at `MAX_SKILL_REGISTRIES_PER_WORKSTATION`.
+        :param template_ref: CRD name of a [`WorkstationTemplate`] to resolve as the workstation's environment (ADR-0015). When set, the template is resolved at create time and the resulting base image + setup script are embedded in the CR spec. When absent, the workstation uses the platform default base, no extra setup.
+        :param template_version: Template version to pin. When set alongside `template_ref`, the resolve step checks that the template's version matches this value. When absent, the current version is used and recorded."""
+        response = self._request(
+            ApiRequest(
+                method="post",
+                path="/api/dev/workstations",
+                json_body=to_json_value(
+                    CreateDevWorkstationRequest(
+                        additional_repositories=additional_repositories,
+                        allowlists=allowlists,
+                        egress_profile=egress_profile,
+                        extra_fqdns=extra_fqdns,
+                        harbor_id=harbor_id,
+                        inference_model=inference_model,
+                        inference_provider=inference_provider,
+                        llm_providers=llm_providers,
+                        name=name,
+                        oci_enabled=oci_enabled,
+                        oci_store_size=oci_store_size,
+                        openrouter_key_secret_id=openrouter_key_secret_id,
+                        repo_provider=repo_provider,
+                        repo_ref=repo_ref,
+                        repo_url=repo_url,
+                        scm_secret_id=scm_secret_id,
+                        service_account_id=service_account_id,
+                        skill_registries=skill_registries,
+                        template_ref=template_ref,
+                        template_version=template_version,
+                    ),
+                    CreateDevWorkstationRequest,
+                ),
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationResponse)
+
+    def retrieve_dev_workstation(
+        self,
+        id: UUID,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationResponse:
+        """`GET /api/dev/workstations/{id}`."""
+        response = self._request(
+            ApiRequest(
+                method="get",
+                path="/api/dev/workstations/{id}",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationResponse)
+
+    def delete_dev_workstation(
+        self,
+        id: UUID,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> None:
+        """`DELETE /api/dev/workstations/{id}`."""
+        self._request(
+            ApiRequest(
+                method="delete",
+                path="/api/dev/workstations/{id}",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+
+    def update_dev_workstation(
+        self,
+        id: UUID,
+        *,
+        inference_model: str | None | Unset = UNSET,
+        inference_provider: str | None | Unset = UNSET,
+        openrouter_key_secret_id: UUID | None | Unset = UNSET,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationResponse:
+        """`PATCH /api/dev/workstations/{id}`.
+
+        :param inference_model: Provider-qualified opencode model id to default to. When present (even empty), replaces the workstation's default model; an empty string clears it so the entrypoint's curated default applies again.
+        :param inference_provider: Inference provider: `sapience` (in-cluster LLMaaS), `openrouter` (external), or `claude` (Claude Code as the workstation agent). When present, replaces the workstation's provider.
+        :param openrouter_key_secret_id: Id of a Passe Partout secret of type `plaintext` holding the OpenRouter API key. When present, replaces the workstation's key secret reference."""
+        response = self._request(
+            ApiRequest(
+                method="patch",
+                path="/api/dev/workstations/{id}",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                json_body=to_json_value(
+                    UpdateDevWorkstationRequest(
+                        inference_model=inference_model,
+                        inference_provider=inference_provider,
+                        openrouter_key_secret_id=openrouter_key_secret_id,
+                    ),
+                    UpdateDevWorkstationRequest,
+                ),
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationResponse)
+
+    def retrieve_dev_workstation_egress(
+        self,
+        id: UUID,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationEgressResponse:
+        """`GET /api/dev/workstations/{id}/egress`."""
+        response = self._request(
+            ApiRequest(
+                method="get",
+                path="/api/dev/workstations/{id}/egress",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationEgressResponse)
+
+    def update_dev_workstation_network(
+        self,
+        id: UUID,
+        *,
+        allowlists: list[str] | None | Unset = UNSET,
+        egress_profile: str | None | Unset = UNSET,
+        extra_fqdns: list[str] | None | Unset = UNSET,
+        llm_providers: list[str] | None | Unset = UNSET,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> DevWorkstationEgressResponse:
+        """`PATCH /api/dev/workstations/{id}/network`.
+
+        :param allowlists: Replaces the workstation's referenced `EgressAllowlist` names when present. Each must exist in the workstation's harbor namespace.
+        :param egress_profile: Egress allow-list profile: `default` | `restricted` | `extended`.
+        :param extra_fqdns: Replaces the workstation's extra FQDNs when present.
+        :param llm_providers: Replaces the workstation's selected managed LLM providers when present."""
+        response = self._request(
+            ApiRequest(
+                method="patch",
+                path="/api/dev/workstations/{id}/network",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                json_body=to_json_value(
+                    UpdateDevWorkstationNetworkRequest(
+                        allowlists=allowlists,
+                        egress_profile=egress_profile,
+                        extra_fqdns=extra_fqdns,
+                        llm_providers=llm_providers,
+                    ),
+                    UpdateDevWorkstationNetworkRequest,
+                ),
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, DevWorkstationEgressResponse)
+
+    def list_dev_workstation_skill_registries(
+        self,
+        id: UUID,
+        *,
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> WorkstationSkillRegistriesResponse:
+        """The skill registries this workstation attaches, read straight off its CR."""
+        response = self._request(
+            ApiRequest(
+                method="get",
+                path="/api/dev/workstations/{id}/skill-registries",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, WorkstationSkillRegistriesResponse)
+
+    def update_dev_workstation_skill_registries(
+        self,
+        id: UUID,
+        *,
+        skill_registries: list[SkillRegistryRefDto],
+        extra_headers: t.Mapping[str, str] | None = None,
+        extra_query: t.Mapping[str, object] | None = None,
+        extra_body: t.Mapping[str, object] | None = None,
+        timeout: Timeout | Unset = UNSET,
+        max_retries: int | None = None,
+    ) -> WorkstationSkillRegistriesResponse:
+        """Replace the workstation's attached skill registries.
+
+        A replace, not a merge: the request carries the complete list, so an empty
+        one detaches everything. The operator watches the registry CRs and fans a
+        change out onto the workstations referencing them, so this patch is all the
+        console has to do — no pod restart, no ConfigMap written from here.
+
+        Follows [`update_dev_workstation_network`]: owner-scoped, validate, patch the
+        CR, read the result back so the response reflects what the cluster now holds.
+
+        :param skill_registries: The complete new list — this is a replace, not a merge, so an empty list detaches everything. Capped at `MAX_SKILL_REGISTRIES_PER_WORKSTATION`."""
+        response = self._request(
+            ApiRequest(
+                method="patch",
+                path="/api/dev/workstations/{id}/skill-registries",
+                path_params={
+                    "id": encode_path_param("id", id, "simple", False),
+                },
+                json_body=to_json_value(
+                    UpdateWorkstationSkillRegistriesRequest(
+                        skill_registries=skill_registries,
+                    ),
+                    UpdateWorkstationSkillRegistriesRequest,
+                ),
+                error_types={
+                    "default": _models.ApiErrorBody,
+                },
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                max_retries=max_retries,
+            )
+        )
+        return decode_response(response, WorkstationSkillRegistriesResponse)
+
+
+class DevWorkstationsWithRawResponse:
+    """The methods of :class:`DevWorkstations`, returning an :class:`APIResponse`."""
+
+    def __init__(self, resource: DevWorkstations) -> None:
+        self._resource = resource
+        self.list_dev_workstations = to_raw_response_wrapper(
+            resource.list_dev_workstations
+        )
+        self.create_dev_workstation = to_raw_response_wrapper(
+            resource.create_dev_workstation
+        )
+        self.retrieve_dev_workstation = to_raw_response_wrapper(
+            resource.retrieve_dev_workstation
+        )
+        self.delete_dev_workstation = to_raw_response_wrapper(
+            resource.delete_dev_workstation
+        )
+        self.update_dev_workstation = to_raw_response_wrapper(
+            resource.update_dev_workstation
+        )
+        self.retrieve_dev_workstation_egress = to_raw_response_wrapper(
+            resource.retrieve_dev_workstation_egress
+        )
+        self.update_dev_workstation_network = to_raw_response_wrapper(
+            resource.update_dev_workstation_network
+        )
+        self.list_dev_workstation_skill_registries = to_raw_response_wrapper(
+            resource.list_dev_workstation_skill_registries
+        )
+        self.update_dev_workstation_skill_registries = to_raw_response_wrapper(
+            resource.update_dev_workstation_skill_registries
+        )
+
+    @property
+    def terminals(self) -> DevWorkstationsTerminalsWithRawResponse:
+        """The terminals API."""
+        return DevWorkstationsTerminalsWithRawResponse(self._resource.terminals)