hyperun 0.2.0__py3-none-any.whl

hyperun/client.py

@@ -0,0 +1,280 @@
+"""The HTTP calls, and nothing else.
+
+END-TO-END FLOW of this file:
+
+  1. `cli.py` builds a `Client` from the credentials `config.load()` returned.
+  2. Every method turns one CLI command into one HTTP request against the
+     gateway server's routes.
+  3. A non-2xx response becomes a `ServerError` carrying the server's own
+     `detail` string, because that string is written for a human — the server
+     passes the CRD's validation messages through verbatim for this reason.
+  4. `logs()` is a generator so that `--follow` prints lines as they arrive
+     rather than buffering a training run's entire output.
+
+WHY THIS IS SEPARATE FROM cli.py. `cli.py` decides what to print; this decides
+what to ask for. Keeping them apart means the tests here can use a fake HTTP
+layer and the tests there can use a fake client, and neither needs a server.
+
+WHY THERE IS NO RETRY. A submit that timed out may or may not have created a
+job, and retrying it would create a second one that also rents a GPU. Until the
+API takes an idempotency key, the honest thing is to fail and say so.
+
+Grep anchor: DDPSRUN-CLI-CLIENT
+"""
+
+from __future__ import annotations
+
+from typing import Any
+from urllib.parse import quote
+
+import requests
+
+# A submit does real work (it creates an object and starts a rental), so it gets
+# a longer patience than a status read. Neither is the job's own runtime — the
+# server answers immediately in both cases and these only cover the network.
+SUBMIT_TIMEOUT = 30
+READ_TIMEOUT = 15
+
+
+class ServerError(Exception):
+    """The server refused, or could not be reached. `cli.py` prints and exits 1."""
+
+
+class Client:
+    """One user's connection to one gateway server."""
+
+    def __init__(self, server: str, token: str, session: Any | None = None) -> None:
+        """
+        Args:
+            server: base URL, no trailing slash.
+            token: the bearer token.
+            session: an object with `.request`, for tests. Defaults to a real
+                `requests.Session`.
+        """
+        self._server = server.rstrip("/")
+        self._token = token
+        self._session = session or requests.Session()
+
+    def _headers(self, authenticated: bool = True) -> dict[str, str]:
+        headers = {"Accept": "application/json"}
+        if authenticated:
+            headers["Authorization"] = f"Bearer {self._token}"
+        return headers
+
+    def _call(
+        self,
+        method: str,
+        path: str,
+        *,
+        json_body: dict[str, Any] | None = None,
+        timeout: int = READ_TIMEOUT,
+        authenticated: bool = True,
+        stream: bool = False,
+    ) -> requests.Response:
+        """Make one request and turn any failure into a `ServerError`.
+
+        Raises:
+            ServerError: the connection failed, timed out, or the response was
+                not 2xx. The message is the server's `detail` when there is one.
+        """
+        try:
+            response = self._session.request(
+                method,
+                f"{self._server}{path}",
+                json=json_body,
+                headers=self._headers(authenticated),
+                timeout=timeout,
+                stream=stream,
+            )
+        except requests.RequestException as exc:
+            raise ServerError(f"cannot reach {self._server}: {exc}") from exc
+
+        if response.status_code >= 400:
+            raise ServerError(_detail(response))
+        return response
+
+    def explain(self) -> str:
+        """Fetch the server's own description of itself. No token needed."""
+        return self._call("GET", "/v1/explain", authenticated=False).text
+
+    def schema(self) -> dict[str, Any]:
+        """Fetch the JSON Schema of a submit request. No token needed."""
+        return self._call("GET", "/v1/schema", authenticated=False).json()
+
+    def estimate(self, body: dict[str, Any]) -> dict[str, Any]:
+        """Ask how long a job will take and what it will cost. Submits nothing."""
+        return self._call("POST", "/v1/estimate", json_body=body).json()
+
+    def validate(self, body: dict[str, Any]) -> dict[str, Any]:
+        """Ask what is wrong with a job. Submits nothing."""
+        return self._call("POST", "/v1/validate", json_body=body).json()
+
+    def submit(self, body: dict[str, Any]) -> dict[str, Any]:
+        """Submit a job.
+
+        Args:
+            body: the submit request, already assembled by `cli.py`.
+
+        Returns:
+            `{job_id, name, result_path}`.
+        """
+        return self._call("POST", "/v1/jobs", json_body=body, timeout=SUBMIT_TIMEOUT).json()
+
+    def cancel(self, job_id: str) -> None:
+        """Stop a job and take it off the list.
+
+        Args:
+            job_id: an id the server issued.
+
+        Raises:
+            ServerError: 404 when there is no such job of yours, 502 when the
+                cluster could not be reached.
+        """
+        self._call("DELETE", f"/v1/jobs/{job_id}")
+
+    def status(self, job_id: str) -> dict[str, Any]:
+        """Read one job's state."""
+        return self._call("GET", f"/v1/jobs/{job_id}").json()
+
+    def secrets(self) -> dict[str, Any]:
+        """The words this deployment accepts in `secrets`.
+
+        Names only — never values, and never which Kubernetes Secret holds
+        them. Storing a new one is an operator's job in the cluster; this
+        answers the question a submitter actually has, which is "what may I
+        write".
+        """
+        return self._call("GET", "/v1/secrets").json()
+
+    def put_secret(self, name: str, value: str,
+                   expires_at: str | None = None) -> dict[str, Any]:
+        """Store one value under `name`, for this caller's own namespace.
+
+        DDPSRUN-USER-SECRET. The one call in this file that carries a secret.
+        It goes in the BODY and never in the path or a query string: a URL is
+        logged by every hop that touches it, and the server's own routes are
+        forbidden from putting personal data in a query string for the same
+        reason. The value is not returned by this or any other call.
+
+        Args:
+            name: the environment variable name, e.g. `HF_TOKEN`.
+            value: the secret, already read from a file or stdin by `cli.py`.
+            expires_at: when it stops working, ISO-8601. Omitted for a value
+                that does not expire. DDPSRUN-SECRET-EXPIRY.
+
+        Returns:
+            `{name, namespace, created}`.
+
+        Raises:
+            ServerError: 400 for an unusable name or value, 403 for someone
+                else's namespace, 409 for a name the deployment already binds,
+                502 when the cluster refused. The server's own message says
+                which.
+        """
+        body: dict[str, Any] = {"value": value}
+        if expires_at:
+            body["expires_at"] = expires_at
+        return self._call(
+            "PUT", f"/v1/secrets/{quote(name)}", json_body=body
+        ).json()
+
+    def delete_secret(self, name: str) -> None:
+        """Forget one name this caller's namespace registered.
+
+        Raises:
+            ServerError: 404 when the name is not registered here, which is
+                also the answer for an operator's binding -- those are not
+                this caller's to remove.
+        """
+        self._call("DELETE", f"/v1/secrets/{quote(name)}")
+
+    def stats(self) -> dict[str, Any]:
+        """Read this caller's team figures. Aggregate only."""
+        return self._call("GET", "/v1/stats").json()
+
+    def exec_in_job(
+        self, job: str, command: str, slot: int = 0, timeout_seconds: int = 20
+    ) -> dict[str, Any]:
+        """Run one shell line inside a running job's workload container.
+
+        The server relays it through the job's driver pod onto the rented
+        machine and brings the exit code back like ssh would. One command per
+        request — there is no held-open terminal behind a Lambda.
+
+        Args:
+            job: the job id, or the PacsJob's Kubernetes name.
+            command: one shell line, run as `sh -lc <command>`.
+            slot: which pod of a parallel job.
+            timeout_seconds: server-side wait, capped at 25 by the server.
+        """
+        return self._call(
+            "POST",
+            f"/v1/jobs/{job}/exec",
+            json_body={
+                "command": command,
+                "slot": slot,
+                "timeout_seconds": timeout_seconds,
+            },
+            # The server may hold the request for timeout_seconds before
+            # answering; the read timeout has to outlive that on purpose.
+            timeout=timeout_seconds + 10,
+        ).json()
+
+    def metrics(self, job_id: str, window_seconds: int = 3600) -> dict[str, Any]:
+        """Read a job's GPU usage and training progress."""
+        return self._call(
+            "GET", f"/v1/jobs/{job_id}/metrics?window_seconds={window_seconds}"
+        ).json()
+
+    def log_window(
+        self, job_id: str, since: str | None = None, window_seconds: int = 30
+    ) -> dict[str, Any]:
+        """Read one window of a job's output.
+
+        NOT A STREAM. The server cannot hold a connection open for a
+        thirty-hour job — a Lambda execution is capped at 15 minutes — so
+        `cmd_logs` calls this repeatedly and uses `last_timestamp` to skip what
+        it has already printed.
+
+        Args:
+            job_id: the id `submit` returned.
+            since: the previous call's `last_timestamp`, or None on the first.
+            window_seconds: how far back to read. Several times the interval
+                between calls, so a slow round trip does not lose lines.
+
+        Returns:
+            `{lines, last_timestamp, window_seconds}`.
+        """
+        query = f"?window_seconds={window_seconds}"
+        if since:
+            query += f"&since={quote(since)}"
+        return self._call("GET", f"/v1/jobs/{job_id}/logs{query}").json()
+
+
+def _detail(response: requests.Response) -> str:
+    """Pull the readable part out of an error response.
+
+    FastAPI puts it in `detail`, which is either a string (our own
+    `HTTPException`) or a list of field errors (pydantic's 422). Both are worth
+    showing; the raw JSON is not.
+    """
+    try:
+        body = response.json()
+    except ValueError:
+        return f"server returned {response.status_code}"
+
+    detail = body.get("detail") if isinstance(body, dict) else None
+    if isinstance(detail, str):
+        return detail
+    if isinstance(detail, list):
+        parts = []
+        for item in detail:
+            if not isinstance(item, dict):
+                continue
+            # loc is like ["body", "gpu", "vram_gb"]; the first element is
+            # always "body" and says nothing.
+            where = ".".join(str(p) for p in item.get("loc", [])[1:]) or "request"
+            parts.append(f"{where}: {item.get('msg', 'invalid')}")
+        if parts:
+            return "; ".join(parts)
+    return f"server returned {response.status_code}"

hyperun/config.py

@@ -0,0 +1,218 @@
+"""Where the CLI keeps the server address and the user's token.
+
+END-TO-END FLOW of this file:
+
+  1. `hyperun login` asks for a server URL and a token and calls `save()`.
+  2. `save()` writes them to `~/.config/hyperun/config.json` with mode 0600 and
+     creates the directory with mode 0700.
+  3. Every other command calls `load()`, which returns the same two values, or
+     raises `NotLoggedIn` with the exact command to run.
+
+WHY A FILE AND NOT AN ENVIRONMENT VARIABLE. A token in an environment variable
+is in the shell's history if it was ever exported on a command line, is
+inherited by every process the user starts, and is gone on a new terminal. A
+file survives, and 0600 is a boundary the operating system enforces.
+`HYPERUN_TOKEN` is still honoured for scripts and CI, where a file is the wrong
+shape — `load()` prefers it when it is set.
+
+WHY XDG AND NOT ~/.hyperun. `XDG_CONFIG_HOME` is what a Linux user's backup and
+dotfile tooling already knows about, and it falls back to `~/.config`, which is
+where macOS users' tools look too.
+
+★ THE COMMAND WAS `ddpsrun` UNTIL 2026-09-10, AND NOBODY IS LOGGED OUT BY THE
+RENAME. Two pieces of state carried the old name and both are user-visible, so
+both accept it still:
+
+  the directory   `save()` writes `~/.config/hyperun/`, and `config_path()`
+                  falls back to `~/.config/ddpsrun/config.json` when the new
+                  one does not exist. A rename that silently logged everybody
+                  out would be the same class of defect as the ones this file's
+                  comments already record — the fix is one `exists()` check.
+  the env vars    `HYPERUN_SERVER` / `HYPERUN_TOKEN` are read first, then
+                  `DDPSRUN_SERVER` / `DDPSRUN_TOKEN`. CI files and shell
+                  profiles already export the old pair.
+
+Neither fallback is dated for removal here. Deleting them is a decision about
+how long the old spelling has to keep working, which belongs to whoever knows
+who still has it exported.
+
+Grep anchor: DDPSRUN-CLI-CONFIG
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+from dataclasses import dataclass
+from pathlib import Path
+
+CONFIG_FILENAME = "config.json"
+CONFIG_DIRNAME = "hyperun"
+# The pre-2026-09-10 spelling of everything below. Read, never written.
+LEGACY_CONFIG_DIRNAME = "ddpsrun"
+SERVER_ENV = "HYPERUN_SERVER"
+TOKEN_ENV = "HYPERUN_TOKEN"
+LEGACY_SERVER_ENV = "DDPSRUN_SERVER"
+LEGACY_TOKEN_ENV = "DDPSRUN_TOKEN"
+
+
+class NotLoggedIn(Exception):
+    """No credentials anywhere. `cli.py` prints this and exits 2."""
+
+
+@dataclass(frozen=True)
+class Credentials:
+    """Everything needed to reach the server.
+
+    Attributes:
+        server: the gateway URL.
+        token: what goes in `Authorization: Bearer`. Either a static token an
+            operator issued, or a Cognito id_token from `hyperun login`.
+        refresh_token: only set after a browser sign-in. An id_token lives an
+            hour; this buys a new one without opening a browser again, and is
+            why the file is written at mode 0600.
+    """
+
+    server: str
+    token: str
+    refresh_token: str = ""
+
+
+def _xdg_base() -> Path:
+    """The directory the config directory sits in.
+
+    Returns:
+        `$XDG_CONFIG_HOME`, or `~/.config` when that is unset.
+    """
+    return Path(os.environ.get("XDG_CONFIG_HOME") or str(Path.home() / ".config"))
+
+
+def config_dir() -> Path:
+    """Where a NEW config file is written.
+
+    Returns:
+        `$XDG_CONFIG_HOME/hyperun`, or `~/.config/hyperun` when that is unset.
+        Always the new name: `save()` migrates by writing here, and nothing
+        writes the old directory again.
+    """
+    return _xdg_base() / CONFIG_DIRNAME
+
+
+def legacy_config_path() -> Path:
+    """The file the command wrote while it was called `ddpsrun`.
+
+    Returns:
+        `<xdg base>/ddpsrun/config.json`. It may not exist, which is the normal
+        case for anybody who first logged in after the rename.
+    """
+    return _xdg_base() / LEGACY_CONFIG_DIRNAME / CONFIG_FILENAME
+
+
+def config_path() -> Path:
+    """The config file to READ, new location first.
+
+    Returns:
+        `<xdg base>/hyperun/config.json` when it exists; otherwise the old
+        `ddpsrun` path when THAT exists; otherwise the new path, so a
+        "not logged in" message names the place a login will write.
+    """
+    current = config_dir() / CONFIG_FILENAME
+    if current.exists():
+        return current
+    legacy = legacy_config_path()
+    return legacy if legacy.exists() else current
+
+
+def save(credentials: Credentials) -> Path:
+    """Write the credentials, readable by this user only.
+
+    Args:
+        credentials: what `hyperun login` collected.
+
+    Returns:
+        The path written, so the caller can tell the user where it went.
+
+    The chmod happens AFTER the write and the file is opened with 0600 from the
+    start: creating it world-readable and narrowing it afterwards would leave a
+    window in which another user on a shared machine could read the token.
+    """
+    directory = config_dir()
+    directory.mkdir(parents=True, exist_ok=True)
+    os.chmod(directory, stat.S_IRWXU)
+
+    path = config_path()
+    # O_CREAT | O_WRONLY | O_TRUNC with mode 0600, rather than open(path, "w"),
+    # which would create it with the process umask applied to 0666.
+    descriptor = os.open(path, os.O_CREAT | os.O_WRONLY | os.O_TRUNC, stat.S_IRUSR | stat.S_IWUSR)
+    with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+        document = {"server": credentials.server, "token": credentials.token}
+        # Only written when there is one. A file from a static-token login stays
+        # exactly the shape it was before Cognito existed.
+        if credentials.refresh_token:
+            document["refresh_token"] = credentials.refresh_token
+        json.dump(document, handle, indent=2)
+        handle.write("\n")
+    return path
+
+
+def load() -> Credentials:
+    """Find the credentials to use.
+
+    Order: environment first, then the file. The environment wins so that a
+    script or a CI job can override a developer's own login without touching
+    their file.
+
+    Returns:
+        The credentials.
+
+    Raises:
+        NotLoggedIn: neither source had both values. The message names the
+            command that fixes it, because "not logged in" on its own has sent
+            more than one person to the documentation.
+    """
+    # New spelling first, old one second. Both are read so a shell profile or CI
+    # file that exports the pre-rename names keeps working.
+    server = (os.environ.get(SERVER_ENV, "")
+              or os.environ.get(LEGACY_SERVER_ENV, "")).strip()
+    token = (os.environ.get(TOKEN_ENV, "")
+             or os.environ.get(LEGACY_TOKEN_ENV, "")).strip()
+    if server and token:
+        return Credentials(server=server.rstrip("/"), token=token)
+
+    path = config_path()
+    if not path.exists():
+        raise NotLoggedIn(
+            f"not logged in. Run:\n"
+            f"    hyperun login --server <url>\n"
+            f"or set {SERVER_ENV} and {TOKEN_ENV}."
+        )
+    try:
+        with open(path, "r", encoding="utf-8") as handle:
+            document = json.load(handle)
+    except (OSError, json.JSONDecodeError) as exc:
+        raise NotLoggedIn(f"{path} is unreadable ({exc}). Run `hyperun login` again.") from exc
+
+    file_server = str(document.get("server", "")).strip()
+    file_token = str(document.get("token", "")).strip()
+    if not file_server or not file_token:
+        raise NotLoggedIn(f"{path} is missing a server or a token. Run `hyperun login` again.")
+
+    return Credentials(
+        server=(server or file_server).rstrip("/"),
+        token=token or file_token,
+        refresh_token=str(document.get("refresh_token", "")).strip(),
+    )
+
+
+def forget() -> bool:
+    """Delete the stored credentials.
+
+    Returns:
+        True if a file was removed, False if there was nothing to remove.
+    """
+    path = config_path()
+    if not path.exists():
+        return False
+    path.unlink()
+    return True

hyperun-0.2.0.dist-info/METADATA

@@ -0,0 +1,183 @@
+Metadata-Version: 2.4
+Name: hyperun
+Version: 0.2.0
+Summary: Submit a GPU job and get results back. No kubectl, no cloud account.
+Author: DDPS Lab
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/ddps-lab/pacsrun-gw
+Project-URL: Repository, https://github.com/ddps-lab/pacsrun-gw
+Project-URL: Issues, https://github.com/ddps-lab/pacsrun-gw/issues
+Keywords: gpu,kubernetes,batch,jobs,machine-learning,cloud
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Science/Research
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: System :: Distributed Computing
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.31
+Requires-Dist: PyYAML>=6.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: responses>=0.25; extra == "dev"
+Dynamic: license-file
+
+# hyperun
+
+**Submit a GPU job. Get results back. No `kubectl`, no cloud account, no VM to babysit.**
+
+`hyperun` is the front door to PACSrun, a Kubernetes-native batch job system that rents GPUs from
+whichever vendor is cheapest for the shape you asked for — AWS, GCP or RunPod — runs your code
+there, and puts the results in object storage. You describe the job; you never see the machine.
+
+```console
+$ hyperun login <token>
+$ hyperun estimate -f job.yaml
+$ hyperun submit -f job.yaml
+$ hyperun logs <job-id> --follow
+```
+
+## Why it exists
+
+A researcher who wants a GPU for two hours has three bad options today: get a cloud account and
+learn its console, get `kubectl` access to somebody's cluster, or ask a person. Each of those
+teaches infrastructure to somebody whose job is not infrastructure.
+
+The alternative here is that **a batch job is the unit**. You hand over a job description and a
+program. The platform decides which machine to rent, rents it, runs your code, brings the output
+home, and hands the machine back. When it goes wrong you get an exit code and a sentence, not a
+half-configured VM.
+
+## Install
+
+```console
+pip install hyperun
+```
+
+Two dependencies, `requests` and `PyYAML`, and that is deliberate: this package installs next to
+your research code, so every extra dependency is one that can fight with something you have
+pinned. No `click`, no `rich`, no `pydantic`.
+
+Python 3.9 or newer.
+
+## Configure
+
+`hyperun` needs a server URL and a token. Ask whoever runs your deployment for both.
+
+```console
+$ export HYPERUN_SERVER=https://<your-gateway-url>
+$ hyperun login <token>
+```
+
+`login` writes them to `~/.config/hyperun/config.json` with mode 0600, or to
+`$XDG_CONFIG_HOME/hyperun` when that is set. A config left behind by the old `ddpsrun`
+command is still read, so a rename logs nobody out. For CI, where a file is the wrong shape, set
+`HYPERUN_TOKEN` in the environment and skip `login` entirely.
+
+## The commands
+
+| | |
+|---|---|
+| `login` / `logout` | store and remove the server URL and token |
+| `explain` | what this deployment can do, in prose — run it first |
+| `schema` | the job description's fields and their types |
+| `estimate` | what a job would cost and how long it would take, before you spend anything |
+| `validate` | check a job description without submitting it |
+| `submit` | submit it |
+| `status` / `watch` | where a job is now; `watch` follows until it ends |
+| `logs` | your program's own output, `--follow` to stream |
+| `stats` | GPU utilisation, memory, temperature and power while the job runs |
+| `cancel` | stop a job and hand its machine back |
+
+Exit codes are contractual: **0** it worked, **1** the server refused or a `validate` finding would
+stop the job, **2** the command was wrong or there are no credentials.
+
+## Writing a job
+
+A job description is YAML:
+
+```yaml
+image: nvcr.io/nvidia/pytorch:24.10-py3
+command: ["/bin/bash", "-c"]
+args:
+  - |
+    python train.py --epochs 3
+resources:
+  gpus:
+    name: L4
+    count: 1
+resultPath: s3://<your-bucket>/runs/my-experiment/
+```
+
+Run `hyperun schema` for every field and `hyperun explain` for what your deployment allows.
+
+**Do not guess the GPU or the runtime.** `hyperun estimate` answers both from measured data, and
+guessing is how a job ends up on a card several times more expensive than it needed.
+
+## Using it from an AI coding agent
+
+This repository ships a [Claude Code](https://claude.com/claude-code) plugin. It teaches an agent
+five steps: read what the deployment allows, read your repository against the script contract,
+estimate rather than assume, validate and stop on a finding, and submit only after you approve.
+
+```
+/plugin marketplace add ddps-lab/pacsrun-gw
+/plugin install hyperun
+```
+
+The plugin's reference documents are in [`agent/references/`](agent/references/). The one worth
+reading yourself is [`script-contract.md`](agent/references/script-contract.md): a list of the ways
+a long training run dies in its last minute, each one taken from a run that did.
+
+## What this is not
+
+- **Not an interactive machine.** There is no SSH and no shell into a running job. You submit a
+  program and read its output. If you need to poke at a live container, this is the wrong tool
+  today.
+- **Not a scheduler you host.** `hyperun` is a client. Somebody has to run the gateway and the
+  PACSrun operator; see [`docs/`](docs/) if that somebody is you.
+- **Not free of limits.** A job's credentials for writing results last twelve hours, which is
+  AWS's hard maximum for a role session and not a setting anyone can raise. A run longer than that
+  must checkpoint and resume, and the driver warns half an hour before the deadline.
+
+## Repository layout
+
+| | |
+|---|---|
+| `cli/` | the `hyperun` package published to PyPI |
+| `server/` | the gateway: authenticates users, talks to Kubernetes |
+| `agent/` | the Claude Code plugin — one skill, four reference documents |
+| `ui/` | a small static web front end (`index.html`, `app.js`, `style.css`) |
+| `terraform/` | the deployment: Lambda, Cognito, S3, CloudFront |
+| `docs/` | seventeen design documents, numbered in reading order |
+
+## Development
+
+```console
+$ pip install -e 'cli/[dev]'      # the client
+$ pip install -e 'server/[dev]'   # the gateway
+$ pytest cli/tests server/tests
+```
+
+Both halves live in one repository so the two sides of an API change land in one commit. They share
+nothing else: the client never imports the Kubernetes libraries, and the server never imports the
+browser login flow.
+
+**No account identifiers in this repository.** Documents and code use placeholders —
+`<ACCOUNT_ID>`, `<RESULT_BUCKET>` — and CI checks every push for AWS account numbers, access keys,
+GitHub and RunPod tokens, private keys, and Google OAuth secrets.
+
+## License
+
+Apache-2.0. See [`LICENSE`](LICENSE).

hyperun-0.2.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+hyperun/__init__.py,sha256=jqE7O6dnVn8OKFCTmtmvpCTHjGKkyTm7YprruIL1zFI,1213
+hyperun/browser_login.py,sha256=gfiI2ZMtuJ8nyOVqJl0ILFKayAPsqDeEGILrePOa3tE,10219
+hyperun/cli.py,sha256=nYYX1yTuRUABa3iikQL-EHKJEDQjAi9khJnkU9bYIjc,52853
+hyperun/client.py,sha256=PIeS5PE2uKg8AiLN2N3G2gECWZKsMB_8BLK3ta9QlA0,10921
+hyperun/config.py,sha256=mSxuY-_vP3yTejEiaf_poeAK0r170CT5MNmf5aeZTDM,8041
+hyperun-0.2.0.dist-info/licenses/LICENSE,sha256=Gf64nZEw53YNYQFMUJSLB2ut7_ED3QKccibCx5T7jEo,11339
+hyperun-0.2.0.dist-info/METADATA,sha256=3BhDu36T8oB0bfN2PZHXI2P-qe-vJA9-_OwmLr56OM4,7247
+hyperun-0.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+hyperun-0.2.0.dist-info/entry_points.txt,sha256=WdF15yGaZtvGRDMp8r_pduSoyHQF5VsSlZRSeG7R5M4,45
+hyperun-0.2.0.dist-info/top_level.txt,sha256=zc7oVfTtWl4PCmCogtnUwP_X3KSf7qLplW5yBeO3-B0,8
+hyperun-0.2.0.dist-info/RECORD,,