mainsequence 3.18.2__tar.gz → 3.18.7__tar.gz

{mainsequence-3.18.2 → mainsequence-3.18.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 3.18.2
+Version: 3.18.7
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License: MainSequence GmbH SDK License Agreement

{mainsequence-3.18.2 → mainsequence-3.18.7}/mainsequence/cli/api.py

@@ -178,6 +178,28 @@ def refresh_access() -> str:
         NotLoggedIn: if refresh is missing or refresh fails
     """
     refresh = _refresh_token()
+    runtime_mode = (os.environ.get("MAINSEQUENCE_AUTH_MODE") or "").strip().lower() == "runtime_credential"
+
+    if not refresh and runtime_mode:
+        try:
+            from mainsequence.client.utils import RuntimeCredentialAuthProvider
+        except Exception as exc:
+            raise NotLoggedIn(f"Runtime credential auth is unavailable: {exc}") from exc
+
+        token_url = f"{backend_url().rstrip('/')}/orm/api/pods/runtime-credentials/token/"
+        try:
+            RuntimeCredentialAuthProvider(token_url=token_url).refresh(force=True)
+        except Exception as exc:
+            raise NotLoggedIn(f"Runtime credential exchange failed: {exc}") from exc
+
+        access = (os.environ.get("MAINSEQUENCE_ACCESS_TOKEN") or "").strip()
+        if not access:
+            raise NotLoggedIn("Runtime credential exchange did not produce MAINSEQUENCE_ACCESS_TOKEN.")
+
+        tokens = get_tokens()
+        save_tokens(tokens.get("username") or "", access, "")
+        return access
+
     if not refresh:
         raise NotLoggedIn("Not logged in. Run `mainsequence login`.")
 
@@ -422,7 +444,8 @@ def get_logged_user_details() -> dict[str, Any]:
 
     The CLI does not naturally run inside a request context, so this bridge resolves
     the current user id from the authenticated API session and temporarily binds
-    `X-User-ID` into `mainsequence.client.models_user._CURRENT_AUTH_HEADERS`
+    `X-User-ID` plus `Authorization` into
+    `mainsequence.client.models_user._CURRENT_AUTH_HEADERS`
     before calling the SDK method.
     """
     tokens = get_tokens()
@@ -486,7 +509,12 @@ def get_logged_user_details() -> dict[str, Any]:
 
         BaseObjectOrm.ROOT_URL = root_url
         ClientUser.ROOT_URL = root_url
-        headers_token = current_auth_headers.set({"X-User-ID": str(user_id)})
+        headers_token = current_auth_headers.set(
+            {
+                "X-User-ID": str(user_id),
+                "Authorization": f"Bearer {access}",
+            }
+        )
 
         user = ClientUser.get_logged_user()
         if isinstance(user, dict):

{mainsequence-3.18.2 → mainsequence-3.18.7}/mainsequence/cli/cli.py

@@ -756,6 +756,28 @@ def _require_login() -> dict:
         raise typer.Exit(1) from e
 
 
+def _runtime_credential_mode_enabled() -> bool:
+    return (os.environ.get("MAINSEQUENCE_AUTH_MODE") or "").strip().lower() == "runtime_credential"
+
+
+def _exchange_runtime_credential_for_cli_login(backend_url: str) -> str:
+    try:
+        from mainsequence.client.utils import RuntimeCredentialAuthProvider
+    except Exception as exc:
+        raise ApiError(f"Runtime credential auth is unavailable: {exc}") from exc
+
+    token_url = f"{backend_url.rstrip('/')}/orm/api/pods/runtime-credentials/token/"
+    try:
+        RuntimeCredentialAuthProvider(token_url=token_url).refresh(force=True)
+    except Exception as exc:
+        raise ApiError(f"Runtime credential exchange failed: {exc}") from exc
+
+    access = (os.environ.get("MAINSEQUENCE_ACCESS_TOKEN") or "").strip()
+    if not access:
+        raise ApiError("Runtime credential exchange did not produce MAINSEQUENCE_ACCESS_TOKEN.")
+    return access
+
+
 def _resolve_project_dir(project_id: int | None, path: str | None) -> pathlib.Path:
     """
     Resolve project directory by:
@@ -2034,10 +2056,15 @@ def login(
     Persists auth tokens in the active CLI auth store so subsequent
     CLI invocations can run without re-authentication. Backend/base-folder
     overrides passed to `login` are scoped to the current terminal session.
+    When no backend is provided, login defaults to the standard production backend.
 
     Interactive login uses browser-based authentication and finishes with
     standard JWT access/refresh tokens persisted by the CLI.
 
+    If `MAINSEQUENCE_AUTH_MODE=runtime_credential`, login exchanges the
+    configured runtime credential for a short-lived access token instead of
+    opening the browser or persisting CLI JWT tokens.
+
     Parameters
     ----------
     backend:
@@ -2066,9 +2093,21 @@ def login(
     mainsequence login --access-token "$TOKEN" --refresh-token "$REFRESH"
     mainsequence login --access-token "$TOKEN" --refresh-token "$REFRESH" --backend http://127.0.0.1:8000 --projects-base mainsequence-dev
     mainsequence login --export
+    MAINSEQUENCE_AUTH_MODE=runtime_credential mainsequence login
     ```
     """
     using_jwt = bool((access_token or "").strip() or (refresh_token or "").strip())
+    using_runtime_credential = _runtime_credential_mode_enabled()
+
+    if using_runtime_credential and using_jwt:
+        error(
+            "Runtime credential login cannot be combined with "
+            "--access-token/--refresh-token."
+        )
+        raise typer.Exit(1)
+
+    if using_runtime_credential and no_open:
+        warn("--no-open is ignored when MAINSEQUENCE_AUTH_MODE=runtime_credential.")
 
     if not using_jwt and backend and "@" in backend:
         error(
@@ -2081,7 +2120,8 @@ def login(
         if cfg.normalize_backend_url(backend) != cfg.normalize_backend_url(backend_option):
             error("Pass backend either positionally or with --backend, not both.")
             raise typer.Exit(1)
-    effective_backend_input = backend_option if backend_option is not None else backend
+    explicit_backend_input = backend_option if backend_option is not None else backend
+    effective_backend_input = explicit_backend_input if explicit_backend_input is not None else cfg.STANDARD_BACKEND_URL
 
     if projects_base and projects_base_option:
         if cfg.normalize_mainsequence_path(projects_base) != cfg.normalize_mainsequence_path(projects_base_option):
@@ -2100,28 +2140,39 @@ def login(
         raise typer.Exit(1)
 
     current_backend = cfg.backend_url()
-    normalized_backend = cfg.normalize_backend_url(effective_backend_input) if effective_backend_input else None
+    normalized_backend = cfg.normalize_backend_url(effective_backend_input)
 
-    if normalized_backend and normalized_backend != current_backend:
+    if explicit_backend_input is not None and normalized_backend != current_backend:
         if not effective_projects_base_input:
             error("When using a different backend, you must also specify a projects base folder.")
             raise typer.Exit(1)
 
     previous_backend_override = os.environ.get("MAIN_SEQUENCE_BACKEND_URL")
-    if normalized_backend:
-        os.environ["MAIN_SEQUENCE_BACKEND_URL"] = normalized_backend
+    os.environ["MAIN_SEQUENCE_BACKEND_URL"] = normalized_backend
 
     try:
-        if using_jwt:
+        if using_runtime_credential:
+            access = _exchange_runtime_credential_for_cli_login(normalized_backend)
+            persisted = cfg.save_tokens("", access, "")
+            res = {
+                "username": "",
+                "backend": normalized_backend,
+                "access": access,
+                "refresh": "",
+                "persisted": bool(persisted),
+                "auth_mode": "runtime_credential",
+            }
+        elif using_jwt:
             os.environ.pop(cfg.ENV_USERNAME, None)
             os.environ.pop(cfg.LEGACY_ENV_USERNAME, None)
             persisted = cfg.save_tokens("", (access_token or "").strip(), (refresh_token or "").strip())
             res = {
                 "username": "",
-                "backend": normalized_backend or current_backend,
+                "backend": normalized_backend,
                 "access": (access_token or "").strip(),
                 "refresh": (refresh_token or "").strip(),
                 "persisted": bool(persisted),
+                "auth_mode": "jwt",
             }
         else:
             def _emit_auth_url(url: str) -> None:
@@ -2146,10 +2197,11 @@ def login(
 
             res = {
                 "username": username,
-                "backend": normalized_backend or current_backend,
+                "backend": normalized_backend,
                 "access": access,
                 "refresh": refresh,
                 "persisted": bool(persisted),
+                "auth_mode": "jwt",
             }
     except BrowserAuthError as e:
         error(f"Browser login failed: {e}")
@@ -2158,26 +2210,26 @@ def login(
         error(f"Login failed: {e}")
         raise typer.Exit(1) from e
     finally:
-        if normalized_backend:
-            if previous_backend_override is None:
-                os.environ.pop("MAIN_SEQUENCE_BACKEND_URL", None)
-            else:
-                os.environ["MAIN_SEQUENCE_BACKEND_URL"] = previous_backend_override
+        if previous_backend_override is None:
+            os.environ.pop("MAIN_SEQUENCE_BACKEND_URL", None)
+        else:
+            os.environ["MAIN_SEQUENCE_BACKEND_URL"] = previous_backend_override
 
-    if normalized_backend or effective_projects_base_input:
-        cfg.set_session_overrides(
-            backend_url=normalized_backend,
-            mainsequence_path=effective_projects_base_input,
-        )
-    else:
-        cfg.clear_session_overrides()
+    cfg.set_session_overrides(
+        backend_url=normalized_backend,
+        mainsequence_path=effective_projects_base_input,
+    )
 
     if export:
         access = (res.get("access") or "").replace('"', '\\"')
         refresh = (res.get("refresh") or "").replace('"', '\\"')
         username = (res.get("username") or "").replace('"', '\\"')
+        auth_mode = (res.get("auth_mode") or "").replace('"', '\\"')
+        if auth_mode:
+            typer.echo(f'export MAINSEQUENCE_AUTH_MODE="{auth_mode}"')
         typer.echo(f'export MAINSEQUENCE_ACCESS_TOKEN="{access}"')
-        typer.echo(f'export MAINSEQUENCE_REFRESH_TOKEN="{refresh}"')
+        if refresh:
+            typer.echo(f'export MAINSEQUENCE_REFRESH_TOKEN="{refresh}"')
         if username:
             typer.echo(f'export MAINSEQUENCE_USERNAME="{username}"')
         return
@@ -2188,11 +2240,16 @@ def login(
     typer.echo("MAIN SEQUENCE")
     if res.get("username"):
         success(f"Signed in as {res['username']} (Backend: {res['backend']})")
+    elif res.get("auth_mode") == "runtime_credential":
+        success(f"Signed in with runtime credential (Backend: {res['backend']})")
     else:
         success(f"Signed in with JWT tokens (Backend: {res['backend']})")
     info(f"Projects base folder: {base}")
     auth_store_label = cfg.auth_persistence_label()
-    if res.get("persisted", True):
+    if res.get("auth_mode") == "runtime_credential":
+        info(f"Runtime credential access token is persisted in {auth_store_label}; no CLI JWT refresh token exists.")
+        info("When the access token expires, CLI will re-exchange the runtime credential automatically.")
+    elif res.get("persisted", True):
         info(f"Auth tokens are persisted in {auth_store_label} for subsequent CLI commands.")
     else:
         warn(f"Could not persist auth tokens in {auth_store_label}. Use --export for shell-based auth.")
@@ -2815,7 +2872,7 @@ def settings_set_base(path: str = typer.Argument(..., help="New projects base fo
 
 @settings.command("set-backend")
 def settings_set_backend(
-    url: str = typer.Argument(..., help="Backend base URL, e.g. https://api.main-sequence.app")
+    url: str = typer.Argument(..., help=f"Backend base URL, e.g. {cfg.STANDARD_BACKEND_URL}")
 ):
     """
     Set backend base URL used by CLI API calls.
@@ -2823,12 +2880,12 @@ def settings_set_backend(
     Parameters
     ----------
     url:
-        Backend base URL (for example `https://api.main-sequence.app`).
+        Backend base URL.
 
     Examples
     --------
     ```bash
-    mainsequence settings set-backend https://api.main-sequence.app
+    mainsequence settings set-backend <backend-url>
     ```
     """
     out = cfg.set_backend_url(url)
@@ -2837,6 +2894,59 @@ def settings_set_backend(
     success(f"Backend URL set to: {out.get('backend_url')}")
 
 
+def _settings_reset_impl() -> dict:
+    """
+    Reset persistent CLI settings to standard defaults and clear session overrides.
+    """
+    standard_backend = cfg.normalize_backend_url(cfg.STANDARD_BACKEND_URL)
+    standard_base = cfg.normalize_mainsequence_path(cfg.DEFAULTS.get("mainsequence_path"))
+    pathlib.Path(standard_base).mkdir(parents=True, exist_ok=True)
+    out = cfg.set_config(
+        {
+            "backend_url": standard_backend,
+            "mainsequence_path": standard_base,
+        }
+    )
+    cfg.clear_session_overrides()
+    return out
+
+
+@settings.command("reset")
+def settings_reset():
+    """
+    Reset CLI settings to standard defaults.
+
+    Resets backend URL to the standard production backend, base folder to the
+    default `~/mainsequence`, and clears current terminal session overrides.
+
+    Examples
+    --------
+    ```bash
+    mainsequence settings reset
+    ```
+    """
+    out = _settings_reset_impl()
+    if _emit_json(out):
+        return
+    success("Settings reset to standard defaults.")
+    info(f"Backend URL: {out.get('backend_url')}")
+    info(f"Projects base folder: {out.get('mainsequence_path')}")
+
+
+@settings.command("refresh")
+def settings_refresh():
+    """
+    Alias for `settings reset`.
+
+    Examples
+    --------
+    ```bash
+    mainsequence settings refresh
+    ```
+    """
+    settings_reset()
+
+
 # ---------- sdk group ----------
 
 

{mainsequence-3.18.2 → mainsequence-3.18.7}/mainsequence/cli/config.py

@@ -21,6 +21,8 @@ import subprocess
 import sys
 import time
 
+from mainsequence.defaults import STANDARD_BACKEND_URL
+
 APP_NAME = "MainSequenceCLI"
 
 
@@ -62,7 +64,7 @@ KEYCHAIN_SERVICE = "MainSequenceCLI.auth"
 KEYCHAIN_ACCOUNT = "default"
 
 DEFAULTS = {
-    "backend_url": os.environ.get("MAIN_SEQUENCE_BACKEND_URL", "https://api.main-sequence.app/"),
+    "backend_url": os.environ.get("MAIN_SEQUENCE_BACKEND_URL", f"{STANDARD_BACKEND_URL}/"),
     "mainsequence_path": str(pathlib.Path.home() / "mainsequence"),
     "version": 1,
 }
@@ -212,7 +214,7 @@ def set_backend_url(url: str) -> dict:
     Convenience helper to set backend_url in config.json.
 
     Args:
-        url: Backend base URL (e.g. https://api.main-sequence.app)
+        url: Backend base URL.
 
     Returns:
         dict: updated config
@@ -350,12 +352,13 @@ def get_tokens() -> dict:
     """
     Return auth tokens from environment variables, with persistent-store fallback.
     """
+    runtime_mode = (os.environ.get("MAINSEQUENCE_AUTH_MODE") or "").strip().lower() == "runtime_credential"
     tokens = {
         "username": os.environ.get(ENV_USERNAME) or os.environ.get(LEGACY_ENV_USERNAME, ""),
         "access": os.environ.get(ENV_ACCESS) or os.environ.get(LEGACY_ENV_ACCESS, ""),
         "refresh": os.environ.get(ENV_REFRESH) or os.environ.get(LEGACY_ENV_REFRESH, ""),
     }
-    if tokens["access"] and tokens["refresh"]:
+    if tokens["access"] and (tokens["refresh"] or runtime_mode):
         return tokens
 
     for secret in (_read_secure_tokens(), _read_local_tokens()):
@@ -366,7 +369,7 @@ def get_tokens() -> dict:
             "access": tokens["access"] or secret.get("access", ""),
             "refresh": tokens["refresh"] or secret.get("refresh", ""),
         }
-        if tokens["access"] and tokens["refresh"]:
+        if tokens["access"] and (tokens["refresh"] or runtime_mode):
             break
     return tokens
 

{mainsequence-3.18.2 → mainsequence-3.18.7}/mainsequence/client/client.py

@@ -7,6 +7,8 @@ from typing import Any
 
 import requests
 
+from mainsequence.defaults import STANDARD_BACKEND_URL
+
 from .exceptions import raise_for_response
 from .utils import AuthLoaders, build_session
 from .utils import loaders as _global_loaders
@@ -19,7 +21,7 @@ class MainSequenceClientConfig:
     endpoint: str = (
         os.getenv("MAINSEQUENCE_ENDPOINT")
         or os.getenv("TDAG_ENDPOINT")
-        or "https://api.main-sequence.app"
+        or STANDARD_BACKEND_URL
     )
     api_prefix: str = "/orm/api"
     # (connect, read) — align with your utils DEFAULT_TIMEOUT behavior

{mainsequence-3.18.2 → mainsequence-3.18.7}/mainsequence/client/command_center/workspace_snapshot.py

@@ -7,6 +7,8 @@ from pathlib import Path
 from typing import Any
 from urllib.parse import urlparse
 
+from mainsequence.defaults import STANDARD_BACKEND_URL
+
 from ..client import MainSequenceClientConfig
 from ..utils import AuthLoaders
 
@@ -78,7 +80,7 @@ def _infer_command_center_url_from_endpoint(endpoint: str) -> str:
     if host in {"localhost", "127.0.0.1"}:
         return f"{scheme}://localhost:5173"
 
-    if host == "api.main-sequence.app":
+    if host == (urlparse(STANDARD_BACKEND_URL).hostname or ""):
         return f"{scheme}://main-sequence.app"
 
     if host.startswith("api."):

{mainsequence-3.18.2 → mainsequence-3.18.7}/mainsequence/client/models_simple_tables.py

@@ -649,6 +649,13 @@ class SimpleTableUpdate(TableUpdateNode, BaseObjectOrm):
         description="Simple table storage referenced by this update.",
     )
     tags: list[str] | None = Field(default=[], description="List of tags")
+    labels: list[str] = Field(
+        default_factory=list,
+        description=(
+            "Organizational labels attached to the simple table update. "
+            "These are helpers for grouping and discovery only and do not change runtime behavior or functionality."
+        ),
+    )
     description: str | None = Field(None, description="Optional HTML description")
     update_details: SimpleTableUpdateDetails | int | None = None
     run_configuration: SimpleTableRunConfiguration | None = None

{mainsequence-3.18.2 → mainsequence-3.18.7}/mainsequence/client/models_tdag.py

@@ -275,6 +275,13 @@ class DataNodeUpdate(TableUpdateNode, BaseObjectOrm):
 
     data_node_storage: int | DataNodeStorage
     tags: list[str] | None = Field(default=[], description="List of tags")
+    labels: list[str] = Field(
+        default_factory=list,
+        description=(
+            "Organizational labels attached to the local time series update. "
+            "These are helpers for grouping and discovery only and do not change runtime behavior or functionality."
+        ),
+    )
     description: str | None = Field(None, description="Optional HTML description")
     update_details: DataNodeUpdateDetails | int | None = None
     run_configuration: RunConfiguration | None = None
@@ -1160,6 +1167,59 @@ class DataNodeStorage(AbstractTable, LabelableObjectMixin, ShareableObjectMixin,
 
         return r.json() if r.content else None
 
+    def delete_after_date(
+        self,
+        after_date: str | datetime.datetime,
+        *,
+        unique_identifier: str | None = None,
+        unique_identifier_list: list[str] | None = None,
+        timeout: int | None = None,
+    ) -> dict[str, Any]:
+        """
+        Delete rows at or after a cutoff timestamp from this dynamic table.
+
+        This is a backend tail-delete operation:
+
+        - it hits `POST /orm/api/ts_manager/dynamic_table/{id}/delete_after_date/`
+        - `after_date` is the inclusive cutoff
+        - there is no `end_date`; this is not arbitrary range deletion
+        - for multi-index tables, pass either `unique_identifier` for one
+          identifier or `unique_identifier_list` for multiple identifiers to
+          scope the tail delete
+
+        The authenticated user must have edit access to this DynamicTableMetaData.
+
+        The returned payload contains the authoritative post-delete table stats,
+        including `deleted_count`, `table_empty`, and index metadata. Consumers
+        can use those stats to update visible table metadata or refetch the table
+        detail after the delete.
+        """
+        if self.id is None:
+            raise ValueError("DataNodeStorage must have an id before deleting rows after a date.")
+        if unique_identifier is not None and unique_identifier_list is not None:
+            raise ValueError("Pass either unique_identifier or unique_identifier_list, not both.")
+
+        payload_body: dict[str, Any] = {
+            "after_date": after_date.isoformat() if isinstance(after_date, datetime.datetime) else after_date
+        }
+        if unique_identifier is not None:
+            payload_body["unique_identifier"] = unique_identifier
+        if unique_identifier_list is not None:
+            payload_body["unique_identifier_list"] = unique_identifier_list
+
+        cls = type(self)
+        url = f"{cls.get_object_url()}/{self.id}/delete_after_date/"
+        r = make_request(
+            s=cls.build_session(),
+            loaders=cls.LOADERS,
+            r_type="POST",
+            url=url,
+            payload={"json": payload_body},
+            time_out=timeout,
+        )
+        raise_for_response(r, payload=payload_body)
+        return r.json()
+
     def delete_table(self):
         data_source = PodDataSource._get_duck_db()
         duckdb_dynamic_data_source = DynamicTableDataSource.get_or_create_duck_db(

{mainsequence-3.18.2 → mainsequence-3.18.7}/mainsequence/client/models_user.py

@@ -8,6 +8,7 @@ from typing import Any, ClassVar, Literal
 
 from pydantic import Field
 
+from mainsequence.defaults import STANDARD_BACKEND_URL
 from mainsequence.logconf import logger
 
 from .base import (
@@ -141,7 +142,7 @@ class Organization(BasePydanticModel):
         None,
         title="Organization URL",
         description="Optional public or internal URL for the organization.",
-        examples=["https://api.main-sequence.app"],
+        examples=[STANDARD_BACKEND_URL],
     )
     organization_domain: str = Field(
         ...,