mainsequence 9.0.10.dev47__py3-none-any.whl → 9.0.10.dev48__py3-none-any.whl

agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -138,11 +138,14 @@ remain projections of the same identity, not a separate resolver. Outside an
 authenticated request, including public routes, `User.get_logged_user()` raises
 `RequestIdentityError`.
 
-On a protected route, this identity is the human making the current HTTP
-request. It is not the release creator, deployment owner, runtime workload
-principal, or the process account returned by `User.get_authenticated_user_details()`.
-Caller authentication is not resource authorization; apply the endpoint's
-application policy using the verified user UID.
+On a protected route, this identity is the caller of the current HTTP request:
+a person, or the workload identity a deployed Job, FastAPI release or Agent runs
+as. It is not the release creator, deployment owner, the application's own
+runtime workload principal, or the process account returned by
+`User.get_authenticated_user_details()`. To tell a workload caller from a
+person, read `User.get_by_uid(uid)`: a workload identity has `identity_type`
+`"workload"`. Caller authentication is not resource authorization; apply the
+endpoint's application policy using the verified user UID.
 
 WebSockets retain the platform's gateway ticket/header contract rather than
 the HTTP Bearer/assertion flow; the getter is available while the authenticated

mainsequence/client/models_user.py

@@ -23,14 +23,21 @@ from .value_sets import OpenValueSet
 
 
 class RequestUserIdentity(BaseModel):
-    """Minimal identity of the human making the current runtime request."""
+    """Minimal identity of the caller of the current runtime request.
+
+    The caller is a person or a workload identity; ``User.get_by_uid(uid)``
+    reads its User.
+    """
 
     model_config = ConfigDict(extra="forbid", frozen=True)
 
     uid: str = Field(
         ...,
         title="User UID",
-        description="Canonical public UUID of the human making the current request.",
+        description=(
+            "Canonical public UUID of the User making the current request, a person or a "
+            "workload identity."
+        ),
     )
     username: str | None = Field(
         None,
@@ -954,6 +961,17 @@ class ShareableAccessState(BasePydanticModel):
 
 
 class User(UserApiBaseObjectOrm, BasePydanticModel):
+    """A platform User: a person, or the workload identity a deployed Job,
+    FastAPI release or Agent runs as.
+
+    A workload identity is read with ``User.get_by_uid(uid)`` or listed with
+    ``User.filter(identity_type="workload")``. Its row carries ``uid``,
+    ``identity_type`` (``"workload"``), ``is_active`` and the UID of its
+    workload in ``job_uid``, ``resource_release_uid`` or ``agent_uid``, without
+    a username, email, join date or name. Fields the row does not carry are
+    ``None``, or empty for lists.
+    """
+
     # Platform facts, not application authorization policy. None means the
     # connected platform has not supplied the versioned additive contract.
     is_organization_admin: StrictBool | None = None
@@ -963,6 +981,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
     FILTERSET_FIELDS: ClassVar[dict[str, list[str]] | None] = {
         "uid": ["exact", "in"],
         "email": ["exact", "contains", "in"],
+        "identity_type": ["exact"],
     }
     FILTER_VALUE_NORMALIZERS: ClassVar[dict[str, str]] = {
         "uid": "uid",
@@ -970,6 +989,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         "email": "str",
         "email__contains": "str",
         "email__in": "str",
+        "identity_type": "str",
     }
 
     id: int | None = Field(
@@ -985,6 +1005,35 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="Stable public unique identifier of the user.",
         examples=["8f5d6b54-2f5e-4a8b-bb10-0b17f3f4c123"],
     )
+    identity_type: (
+        OpenValueSet[Literal["human", "service_account", "deleted_user", "workload"]] | None
+    ) = Field(
+        None,
+        title="Identity Type",
+        description=(
+            "Kind of identity: `workload` for the identity a deployed Job, FastAPI release "
+            "or Agent runs as. None when the response does not carry it."
+        ),
+        examples=["workload"],
+    )
+    job_uid: str | None = Field(
+        None,
+        title="Job UID",
+        description="UID of the Job a workload identity belongs to; None otherwise.",
+        examples=["88888888-8888-4888-8888-888888888888"],
+    )
+    resource_release_uid: str | None = Field(
+        None,
+        title="Resource Release UID",
+        description="UID of the release a workload identity belongs to; None otherwise.",
+        examples=[None],
+    )
+    agent_uid: str | None = Field(
+        None,
+        title="Agent UID",
+        description="UID of the Agent a workload identity belongs to; None otherwise.",
+        examples=[None],
+    )
     profile_picture: str | None = Field(
         None,
         title="Profile Picture URL",
@@ -1022,10 +1071,13 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         examples=["enterprise"],
     )
 
-    date_joined: datetime.datetime = Field(
-        ...,
+    date_joined: datetime.datetime | None = Field(
+        None,
         title="Date Joined",
-        description="Timestamp when the user account was created.",
+        description=(
+            "Timestamp when the user account was created. None when the response does not "
+            "carry it, as for a workload identity."
+        ),
         examples=["2025-01-10T08:15:00Z"],
     )
     is_active: bool = Field(
@@ -1034,16 +1086,22 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="Whether the user account is active.",
         examples=[True],
     )
-    username: str = Field(
-        ...,
+    username: str | None = Field(
+        None,
         title="Username",
-        description="Unique username used by the platform.",
+        description=(
+            "Unique username used by the platform. None when the response does not carry it, "
+            "as for a workload identity."
+        ),
         examples=["jose@main-sequence.io"],
     )
-    email: str = Field(
-        ...,
+    email: str | None = Field(
+        None,
         title="Email",
-        description="Primary email address of the user.",
+        description=(
+            "Primary email address of the user. None when the response does not carry it, "
+            "as for a workload identity."
+        ),
         examples=["jose@main-sequence.io"],
     )
     first_name: str | None = Field(
@@ -1064,16 +1122,22 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="Timestamp of the last successful login.",
         examples=["2026-03-15T11:20:00Z"],
     )
-    api_request_limit: int = Field(
-        ...,
+    api_request_limit: int | None = Field(
+        None,
         title="API Request Limit",
-        description="Maximum number of API requests available to the user in the current limit window.",
+        description=(
+            "Maximum number of API requests available to the user in the current limit "
+            "window. None when the response does not carry it, as for a workload identity."
+        ),
         examples=[10000],
     )
-    mfa_enabled: bool = Field(
-        ...,
+    mfa_enabled: bool | None = Field(
+        None,
         title="MFA Enabled",
-        description="Whether multi-factor authentication is enabled for the user.",
+        description=(
+            "Whether multi-factor authentication is enabled for the user. None when the "
+            "response does not carry it, as for a workload identity."
+        ),
         examples=[True],
     )
     organization: Organization | None = Field(

{mainsequence-9.0.10.dev47.dist-info → mainsequence-9.0.10.dev48.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.10.dev47
+Version: 9.0.10.dev48
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.10.dev47.dist-info → mainsequence-9.0.10.dev48.dist-info}/RECORD

@@ -1,6 +1,6 @@
 agent_scaffold/AGENTS.md,sha256=W91rpnyQuoQIa-3dsebIYyuwnbGLvkmuq_8X5k2hTAw,6399
 agent_scaffold/skills/a2a_sdk_execution/SKILL.md,sha256=NKtcXibE8TxZzKzz1KzJ2cVZ_EeuJJkb660U6wLvZ3s,11809
-agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=GdbPjIf4xMs5Pz6VrjAwBBePkc7rC3P57s70PNjYZWU,15997
+agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=BUaqO3MkZ-d5sdh2xNPNQ904aO3RIJZfQW54FhDRxkc,16225
 agent_scaffold/skills/mainsequence-inference/SKILL.md,sha256=yv8aAHLQ2FBBSWPIFadY7pGNTwtR-yiR_-UzaGRN9-g,12502
 agent_scaffold/skills/maintenance/bug_auditor/SKILL.md,sha256=CCKs7edyZ9RK-WtAgXJXucokJFXZxk8sRUe0_imFtu8,8610
 agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=pPsZaERlfokSJ6b6vLjpA5U0KuKxbOFzzcxOVW_ikiI,17935
@@ -45,7 +45,7 @@ mainsequence/client/github_issues.py,sha256=pSTUw3UPrmE6wqnpoJctartTaNSq6iu6PQRr
 mainsequence/client/inference.py,sha256=tYKHRxLR6mA5iLmgd3qURwweWc2OPQuw0__tD3LQgSI,7748
 mainsequence/client/models_foundry.py,sha256=JwQdPLDSO4dZI-KC0SUdmN6izmNIKMb9IzZlYXy0Mig,36488
 mainsequence/client/models_helpers.py,sha256=vwZdQhEQZBCxXojP9-DxhdRc-TlceWz4lTqQQnT05Ms,46465
-mainsequence/client/models_user.py,sha256=co9uhe-LKkt7Kw5u8-wDMWcp0yL_lS2LuUOyauW5KF0,38557
+mainsequence/client/models_user.py,sha256=fD0PZ0raeaTz-E08mVCMeM0RmKGAgI8TxOYwU5CMMoY,40963
 mainsequence/client/observability.py,sha256=_WrDKCaNk_TXmKElKCXC1inork6Exxxe8FRY4m1GI9s,16008
 mainsequence/client/utils.py,sha256=d6lXJPAOe683gb-ph9x0GJcvK5c5Pg9gr90ihDgQGug,32484
 mainsequence/client/value_sets.py,sha256=7TA-mpuAd3hOduNgO1WTQQTuNOGaFgue-VqCsDWKaC8,6181
@@ -54,9 +54,9 @@ mainsequence/instrumentation/utils.py,sha256=b-ihjSioAepeLfMpudM2SqCtvnxMqIXileH
 mainsequence/server/__init__.py,sha256=BHUAhtdWPDRdxX07NYO_6wrBv5mf0GsXflecO52PmUc,73
 mainsequence/server/caller_assertions.py,sha256=f9jHhVeoFK1ScDCmW8h3lEIU5V7zKw70SUSVV2P7wUI,10975
 mainsequence/server/fastapi.py,sha256=Y5QB51CRVbuUVRUcWh5GKQ5b5vMPjbs9scioTt684oQ,10712
-mainsequence-9.0.10.dev47.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.10.dev47.dist-info/METADATA,sha256=t0hclwLjy2rK78xGkVSr9-JGEpOpE77iTfe0s-ZP-tQ,7403
-mainsequence-9.0.10.dev47.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.10.dev47.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.10.dev47.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.10.dev47.dist-info/RECORD,,
+mainsequence-9.0.10.dev48.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.10.dev48.dist-info/METADATA,sha256=ozfGPFF2jw8BHsmJMoRdGXanBzDnthptLoTBs6t0Bss,7403
+mainsequence-9.0.10.dev48.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.10.dev48.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.10.dev48.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.10.dev48.dist-info/RECORD,,