mainsequence 9.0.10.dev47__tar.gz → 9.0.11__tar.gz

{mainsequence-9.0.10.dev47 → mainsequence-9.0.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.10.dev47
+Version: 9.0.11
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.10.dev47 → mainsequence-9.0.11}/agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -138,11 +138,14 @@ remain projections of the same identity, not a separate resolver. Outside an
 authenticated request, including public routes, `User.get_logged_user()` raises
 `RequestIdentityError`.
 
-On a protected route, this identity is the human making the current HTTP
-request. It is not the release creator, deployment owner, runtime workload
-principal, or the process account returned by `User.get_authenticated_user_details()`.
-Caller authentication is not resource authorization; apply the endpoint's
-application policy using the verified user UID.
+On a protected route, this identity is the caller of the current HTTP request:
+a person, or the workload identity a deployed Job, FastAPI release or Agent runs
+as. It is not the release creator, deployment owner, the application's own
+runtime workload principal, or the process account returned by
+`User.get_authenticated_user_details()`. To tell a workload caller from a
+person, read `User.get_by_uid(uid)`: a workload identity has `identity_type`
+`"workload"`. Caller authentication is not resource authorization; apply the
+endpoint's application policy using the verified user UID.
 
 WebSockets retain the platform's gateway ticket/header contract rather than
 the HTTP Bearer/assertion flow; the getter is available while the authenticated

{mainsequence-9.0.10.dev47 → mainsequence-9.0.11}/mainsequence/client/agent_runtime_models.py

@@ -579,6 +579,14 @@ class Agent(
             "or null when the Agent has no deployed runtime release."
         ),
     )
+    workload_user_uid: str | None = Field(
+        None,
+        description=(
+            "Read-only UID of the workload identity, the User this Agent runs as; the "
+            "same value its runtime release reports. Pass it to `User.get_by_uid` and "
+            "to sharing calls. None when the Agent has no runtime release."
+        ),
+    )
     code_repository_branch_uid: str | None = Field(
         None,
         description=(

{mainsequence-9.0.10.dev47 → mainsequence-9.0.11}/mainsequence/client/models_helpers.py

@@ -174,6 +174,16 @@ class Job(CurrentCodeRepositoryBranchCollectionMixin, BaseObjectOrm, BasePydanti
         examples=["58218213-5e4e-43de-a5bd-6757f4e1c8f6"],
     )
 
+    workload_user_uid: str | None = Field(
+        default=None,
+        description=(
+            "Read-only UID of the workload identity, the User this Job runs as. "
+            "Pass it to `User.get_by_uid` and to sharing calls. None when the Job "
+            "has no workload identity, for example a release's backing Job."
+        ),
+        examples=["88888888-8888-4888-8888-888888888888"],
+    )
+
     code_repository_commit_hash: str | None = Field(
         default=None,
         description=(
@@ -985,6 +995,16 @@ class ResourceRelease(
         description="Public UID of the job associated with this resource release.",
         examples=["7d0ab07c-d1c0-4b7f-9c69-3c1a41c0a4da"],
     )
+    workload_user_uid: str | None = Field(
+        None,
+        title="Workload User UID",
+        description=(
+            "Read-only UID of the workload identity, the User this release runs as. "
+            "Pass it to `User.get_by_uid` and to sharing calls. None when the release "
+            "has no workload identity, for example a static-site release."
+        ),
+        examples=["88888888-8888-4888-8888-888888888888"],
+    )
     observability: ObservabilityLinks | None = Field(
         default=None,
         description="Backend-owned runtime observability and related-history capabilities.",

{mainsequence-9.0.10.dev47 → mainsequence-9.0.11}/mainsequence/client/models_user.py

@@ -23,14 +23,21 @@ from .value_sets import OpenValueSet
 
 
 class RequestUserIdentity(BaseModel):
-    """Minimal identity of the human making the current runtime request."""
+    """Minimal identity of the caller of the current runtime request.
+
+    The caller is a person or a workload identity; ``User.get_by_uid(uid)``
+    reads its User.
+    """
 
     model_config = ConfigDict(extra="forbid", frozen=True)
 
     uid: str = Field(
         ...,
         title="User UID",
-        description="Canonical public UUID of the human making the current request.",
+        description=(
+            "Canonical public UUID of the User making the current request, a person or a "
+            "workload identity."
+        ),
     )
     username: str | None = Field(
         None,
@@ -954,6 +961,21 @@ class ShareableAccessState(BasePydanticModel):
 
 
 class User(UserApiBaseObjectOrm, BasePydanticModel):
+    """A platform User: a person, or the workload identity a deployed Job,
+    FastAPI release or Agent runs as.
+
+    A workload identity is read with ``User.get_by_uid(uid)`` or listed with
+    ``User.filter(identity_type="workload")``. Its row carries ``uid``,
+    ``identity_type`` (``"workload"``), ``is_active`` and the UID of its
+    workload in ``job_uid``, ``resource_release_uid`` or ``agent_uid``, without
+    a username, email, join date or name. Fields the row does not carry are
+    ``None``, or empty for lists.
+
+    The reverse direction is ``workload_user_uid`` on ``Job``,
+    ``ResourceRelease`` and ``Agent``: the UID of the User that workload runs
+    as, to pass to ``User.get_by_uid`` and to sharing calls.
+    """
+
     # Platform facts, not application authorization policy. None means the
     # connected platform has not supplied the versioned additive contract.
     is_organization_admin: StrictBool | None = None
@@ -963,6 +985,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
     FILTERSET_FIELDS: ClassVar[dict[str, list[str]] | None] = {
         "uid": ["exact", "in"],
         "email": ["exact", "contains", "in"],
+        "identity_type": ["exact"],
     }
     FILTER_VALUE_NORMALIZERS: ClassVar[dict[str, str]] = {
         "uid": "uid",
@@ -970,6 +993,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         "email": "str",
         "email__contains": "str",
         "email__in": "str",
+        "identity_type": "str",
     }
 
     id: int | None = Field(
@@ -985,6 +1009,35 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="Stable public unique identifier of the user.",
         examples=["8f5d6b54-2f5e-4a8b-bb10-0b17f3f4c123"],
     )
+    identity_type: (
+        OpenValueSet[Literal["human", "service_account", "deleted_user", "workload"]] | None
+    ) = Field(
+        None,
+        title="Identity Type",
+        description=(
+            "Kind of identity: `workload` for the identity a deployed Job, FastAPI release "
+            "or Agent runs as. None when the response does not carry it."
+        ),
+        examples=["workload"],
+    )
+    job_uid: str | None = Field(
+        None,
+        title="Job UID",
+        description="UID of the Job a workload identity belongs to; None otherwise.",
+        examples=["88888888-8888-4888-8888-888888888888"],
+    )
+    resource_release_uid: str | None = Field(
+        None,
+        title="Resource Release UID",
+        description="UID of the release a workload identity belongs to; None otherwise.",
+        examples=[None],
+    )
+    agent_uid: str | None = Field(
+        None,
+        title="Agent UID",
+        description="UID of the Agent a workload identity belongs to; None otherwise.",
+        examples=[None],
+    )
     profile_picture: str | None = Field(
         None,
         title="Profile Picture URL",
@@ -1022,10 +1075,13 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         examples=["enterprise"],
     )
 
-    date_joined: datetime.datetime = Field(
-        ...,
+    date_joined: datetime.datetime | None = Field(
+        None,
         title="Date Joined",
-        description="Timestamp when the user account was created.",
+        description=(
+            "Timestamp when the user account was created. None when the response does not "
+            "carry it, as for a workload identity."
+        ),
         examples=["2025-01-10T08:15:00Z"],
     )
     is_active: bool = Field(
@@ -1034,16 +1090,22 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="Whether the user account is active.",
         examples=[True],
     )
-    username: str = Field(
-        ...,
+    username: str | None = Field(
+        None,
         title="Username",
-        description="Unique username used by the platform.",
+        description=(
+            "Unique username used by the platform. None when the response does not carry it, "
+            "as for a workload identity."
+        ),
         examples=["jose@main-sequence.io"],
     )
-    email: str = Field(
-        ...,
+    email: str | None = Field(
+        None,
         title="Email",
-        description="Primary email address of the user.",
+        description=(
+            "Primary email address of the user. None when the response does not carry it, "
+            "as for a workload identity."
+        ),
         examples=["jose@main-sequence.io"],
     )
     first_name: str | None = Field(
@@ -1064,16 +1126,22 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="Timestamp of the last successful login.",
         examples=["2026-03-15T11:20:00Z"],
     )
-    api_request_limit: int = Field(
-        ...,
+    api_request_limit: int | None = Field(
+        None,
         title="API Request Limit",
-        description="Maximum number of API requests available to the user in the current limit window.",
+        description=(
+            "Maximum number of API requests available to the user in the current limit "
+            "window. None when the response does not carry it, as for a workload identity."
+        ),
         examples=[10000],
     )
-    mfa_enabled: bool = Field(
-        ...,
+    mfa_enabled: bool | None = Field(
+        None,
         title="MFA Enabled",
-        description="Whether multi-factor authentication is enabled for the user.",
+        description=(
+            "Whether multi-factor authentication is enabled for the user. None when the "
+            "response does not carry it, as for a workload identity."
+        ),
         examples=[True],
     )
     organization: Organization | None = Field(

{mainsequence-9.0.10.dev47 → mainsequence-9.0.11}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.10.dev47
+Version: 9.0.11
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.10.dev47 → mainsequence-9.0.11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.10.dev47"
+version = "9.0.11"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"