mainsequence 9.0.11__tar.gz → 9.0.12__tar.gz

{mainsequence-9.0.11 → mainsequence-9.0.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.11
+Version: 9.0.12
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.11 → mainsequence-9.0.12}/agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -147,6 +147,13 @@ person, read `User.get_by_uid(uid)`: a workload identity has `identity_type`
 `"workload"`. Caller authentication is not resource authorization; apply the
 endpoint's application policy using the verified user UID.
 
+To list the people, Teams and workloads the caller can see, for example to
+offer sharing candidates, read inside `reads_as_caller()` from
+`mainsequence.server.fastapi`: `User.filter`, `User.get_by_uid`, `Team.filter`
+and `Team.get_by_uid` then answer with the caller's visibility, and workload
+rows carry `managed_by_caller`. Outside a signed HTTP request it raises
+`RequestIdentityError`; it never reads as the application instead.
+
 WebSockets retain the platform's gateway ticket/header contract rather than
 the HTTP Bearer/assertion flow; the getter is available while the authenticated
 connection is active. See the version-matched

mainsequence-9.0.12/mainsequence/_request_identity.py

@@ -0,0 +1,98 @@
+"""Private lifecycle shared by the request integration and the public user getter."""
+
+from contextlib import contextmanager
+from contextvars import ContextVar
+from dataclasses import dataclass, field
+from typing import Any
+from urllib.parse import urlsplit
+
+CALLER_ASSERTION_HEADER = "X-MainSequence-Caller-Assertion"
+
+
+class RequestIdentityError(RuntimeError):
+    """No authenticated caller is bound to the current request."""
+
+
+@dataclass
+class _RequestScope:
+    user: Any = None
+    active: bool = True
+    # The verified assertion of a hosted HTTP request, kept only so that
+    # reads_as_caller() can present it (ADR-0036, amended for #198).
+    caller_assertion: str | None = field(default=None, repr=False)
+
+
+_current_scope: ContextVar[_RequestScope | None] = ContextVar(
+    "mainsequence_request_identity", default=None
+)
+# The request scope whose caller the directory reads answer as, inside reads_as_caller().
+_caller_reads: ContextVar[_RequestScope | None] = ContextVar(
+    "mainsequence_caller_reads", default=None
+)
+
+
+@contextmanager
+def _request_scope():
+    scope = _RequestScope()
+    token = _current_scope.set(scope)
+    try:
+        yield scope
+    finally:
+        # Copied child-task contexts hold this same frame and must also expire.
+        scope.active = False
+        scope.user = None
+        scope.caller_assertion = None
+        _current_scope.reset(token)
+
+
+def _get_request_identity():
+    scope = _current_scope.get()
+    if scope is None or not scope.active or scope.user is None:
+        raise RequestIdentityError(
+            "No authenticated request user is available. Install request identity "
+            "once in the application and call User.get_logged_user() inside a request."
+        )
+    return scope.user
+
+
+@contextmanager
+def _reads_as_caller():
+    scope = _current_scope.get()
+    if scope is None or not scope.active or scope.user is None:
+        raise RequestIdentityError(
+            "Reading as the caller needs an authenticated request. Install request "
+            "identity once in the application and call reads_as_caller() inside a request."
+        )
+    if scope.caller_assertion is None:
+        raise RequestIdentityError(
+            "This request carries no caller assertion. Reading as the caller needs a "
+            "hosted HTTP request in assertion mode, not local mode or a WebSocket."
+        )
+    token = _caller_reads.set(scope)
+    try:
+        yield
+    finally:
+        _caller_reads.reset(token)
+
+
+def _origin(url: str) -> tuple[str, str | None, int | None]:
+    parts = urlsplit(url)
+    scheme = parts.scheme.lower()
+    return scheme, parts.hostname, parts.port or {"http": 80, "https": 443}.get(scheme)
+
+
+def _caller_read_headers(url: str, endpoint_url: str) -> dict[str, str]:
+    """The header a directory read sends to ``url``: none outside reads_as_caller()."""
+    scope = _caller_reads.get()
+    if scope is None:
+        return {}
+    if not scope.active or scope.caller_assertion is None:
+        raise RequestIdentityError(
+            "The request that reads_as_caller() belongs to has ended; its caller "
+            "assertion is no longer available."
+        )
+    if _origin(url) != _origin(endpoint_url):
+        raise RequestIdentityError(
+            "The caller assertion is sent only to the configured platform endpoint."
+        )
+    return {CALLER_ASSERTION_HEADER: scope.caller_assertion}

{mainsequence-9.0.11 → mainsequence-9.0.12}/mainsequence/cli/config.py

@@ -75,6 +75,8 @@ KEYCHAIN_ACCOUNT = "default"
 AUTH_RECORD_VERSION = 1
 # Credential entries a project `.env` must not hold. The CLI removes them and
 # never writes them; the session lives in the operating system credential store.
+# The runtime credential secret and `MAINSEQUENCE_TOKEN` are no longer read: they
+# stay listed so that an entry an earlier version left in a checkout is removed.
 PROJECT_ENV_CREDENTIAL_KEYS = (
     "MAINSEQUENCE_ACCESS_TOKEN",
     "MAINSEQUENCE_REFRESH_TOKEN",
@@ -805,7 +807,7 @@ def session_report() -> dict:
     refresh_expires_at = token_expiry(refresh)
 
     if auth_mode == "runtime_credential":
-        # The credential is an ID with a bootstrap secret or an identity token file.
+        # The credential is an ID with the identity token file that proves it.
         authenticated = bool(access or runtime_credential_configured())
         session_expires_at = None
     elif refresh:

{mainsequence-9.0.11 → mainsequence-9.0.12}/mainsequence/client/base.py

@@ -180,6 +180,11 @@ class BaseObjectOrm:
     def _sdk_owned_query_context(cls, operation: str) -> dict[str, Any]:
         return {}
 
+    @classmethod
+    def _read_request_headers(cls, url: str) -> dict[str, str]:
+        """Headers a filter or detail read adds to its own request to ``url``."""
+        return {}
+
     @classmethod
     def _sdk_owned_create_context(cls, operation: str) -> dict[str, Any]:
         return {}
@@ -540,12 +545,13 @@ class BaseObjectOrm:
 
         while next_url:
             req_payload = {"params": params} if params else {}
+            headers = cls._read_request_headers(next_url)
             r = make_request(
                 s=cls.build_session(),
                 loaders=cls.LOADERS,
                 r_type="GET",
                 url=next_url,
-                payload=req_payload,
+                payload={**req_payload, "headers": headers} if headers else req_payload,
                 time_out=timeout,
             )
             raise_for_response(r, payload=req_payload)
@@ -610,12 +616,16 @@ class BaseObjectOrm:
                 **cls._sdk_owned_query_context(operation),
             }
 
+            payload = {"params": params}  # neede to pass special serializer
+            headers = cls._read_request_headers(detail_url)
+            if headers:
+                payload["headers"] = headers
             r = make_request(
                 s=cls.build_session(),
                 loaders=cls.LOADERS,
                 r_type="GET",
                 url=detail_url,
-                payload={"params": params},  # neede to pass special serializer
+                payload=payload,
                 time_out=timeout,
             )
             raise_for_response(r)

{mainsequence-9.0.11 → mainsequence-9.0.12}/mainsequence/client/models_user.py

@@ -6,7 +6,11 @@ from uuid import UUID
 
 from pydantic import BaseModel, ConfigDict, Field, StrictBool, field_validator, model_validator
 
-from mainsequence._request_identity import RequestIdentityError, _get_request_identity
+from mainsequence._request_identity import (
+    RequestIdentityError,
+    _caller_read_headers,
+    _get_request_identity,
+)
 from mainsequence.defaults import STANDARD_BACKEND_URL
 
 from .base import (
@@ -336,7 +340,18 @@ class TeamMembershipUpdateResult(BasePydanticModel):
     )
 
 
-class Team(PermissionManagedObjectMixin, BasePydanticModel, UserApiBaseObjectOrm):
+class _CallerDirectoryReadMixin:
+    """Inside ``reads_as_caller()``, ``filter`` and ``get`` reads answer as the
+    request's caller (ADR-0036, amended for #198)."""
+
+    @classmethod
+    def _read_request_headers(cls, url: str) -> dict[str, str]:
+        return _caller_read_headers(url, cls.get_object_url())
+
+
+class Team(
+    _CallerDirectoryReadMixin, PermissionManagedObjectMixin, BasePydanticModel, UserApiBaseObjectOrm
+):
     ENDPOINT: ClassVar[str] = "teams"
     FILTERSET_FIELDS: ClassVar[dict[str, list[str]] | None] = {
         "uid": ["exact", "in"],
@@ -960,7 +975,7 @@ class ShareableAccessState(BasePydanticModel):
     )
 
 
-class User(UserApiBaseObjectOrm, BasePydanticModel):
+class User(_CallerDirectoryReadMixin, UserApiBaseObjectOrm, BasePydanticModel):
     """A platform User: a person, or the workload identity a deployed Job,
     FastAPI release or Agent runs as.
 
@@ -974,6 +989,10 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
     The reverse direction is ``workload_user_uid`` on ``Job``,
     ``ResourceRelease`` and ``Agent``: the UID of the User that workload runs
     as, to pass to ``User.get_by_uid`` and to sharing calls.
+
+    Inside ``mainsequence.server.fastapi.reads_as_caller()``, ``User.filter``
+    and ``User.get_by_uid`` answer with what the request's caller may see, and
+    workload rows carry ``managed_by_caller``.
     """
 
     # Platform facts, not application authorization policy. None means the
@@ -986,6 +1005,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         "uid": ["exact", "in"],
         "email": ["exact", "contains", "in"],
         "identity_type": ["exact"],
+        "search": ["exact"],
     }
     FILTER_VALUE_NORMALIZERS: ClassVar[dict[str, str]] = {
         "uid": "uid",
@@ -994,6 +1014,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         "email__contains": "str",
         "email__in": "str",
         "identity_type": "str",
+        "search": "str",
     }
 
     id: int | None = Field(
@@ -1038,6 +1059,15 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="UID of the Agent a workload identity belongs to; None otherwise.",
         examples=[None],
     )
+    managed_by_caller: bool | None = Field(
+        None,
+        title="Managed By Caller",
+        description=(
+            "On a workload identity read inside `reads_as_caller()`: whether the "
+            "request's caller manages that workload. None when the row does not carry it."
+        ),
+        examples=[True],
+    )
     profile_picture: str | None = Field(
         None,
         title="Profile Picture URL",

{mainsequence-9.0.11 → mainsequence-9.0.12}/mainsequence/client/utils.py

@@ -23,8 +23,6 @@ from mainsequence.defaults import resolve_backend_endpoint
 from mainsequence.logconf import logger
 from mainsequence.runtime_credential_exchange import (
     RUNTIME_CREDENTIAL_ID_ENV,
-    RUNTIME_CREDENTIAL_SECRET_ENV,
-    RUNTIME_IDENTITY_TOKEN_FILE_ENV,
     RuntimeIdentityTokenError,
     exchange_runtime_credential,
     identity_token_file_from_environment,
@@ -321,17 +319,16 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
     """
     Exchange the runtime credential the platform injected for short-lived access tokens.
 
-    The proof is the projected workload identity token when
-    `MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE` is set: the file is read for every
-    exchange, and `MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET` is never read or sent.
-    Otherwise the proof is that bootstrap secret. The token is never kept on the
-    provider, and the secret is left out of `repr()` and `str()`. Throttled
-    (`429`) and temporarily unavailable (`503`) exchanges are retried within the
-    timeout budget; a rejected one (`401`) fails at once.
+    The proof is the projected workload identity token in the file named by
+    `MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`, read for every exchange. It is the
+    only proof: an unset variable, or a missing, unreadable or empty file, raises
+    `AuthError` instead of sending the exchange. The token is never kept on the
+    provider.
+    Throttled (`429`) and temporarily unavailable (`503`) exchanges are retried
+    within the timeout budget; a rejected one (`401`) fails at once.
     """
 
     credential_id: str | None = None
-    credential_secret: str | None = field(default=None, repr=False)
     token_url: str | None = None
     token_type: str = "Bearer"
     refresh_skew_seconds: int = 30
@@ -347,8 +344,6 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
             self.identity_token_file = identity_token_file_from_environment()
         else:
             self.identity_token_file = str(self.identity_token_file).strip() or None
-        if self.credential_secret is None and not self.identity_token_file:
-            self.credential_secret = os.getenv(RUNTIME_CREDENTIAL_SECRET_ENV)
         if not self.token_url:
             self.token_url = f"{API_ENDPOINT}/runtime-credentials/token/"
 
@@ -376,19 +371,11 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
 
     def _exchange(self) -> requests.Response:
         credential_id = (self.credential_id or "").strip()
-        identity_token_file = self.identity_token_file
-        credential_secret = None if identity_token_file else (self.credential_secret or "").strip()
         if not credential_id:
             raise AuthError(
                 "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID is required when "
                 "MAINSEQUENCE_AUTH_MODE=runtime_credential."
             )
-        if not identity_token_file and not credential_secret:
-            raise AuthError(
-                "MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET is required when "
-                "MAINSEQUENCE_AUTH_MODE=runtime_credential and "
-                f"{RUNTIME_IDENTITY_TOKEN_FILE_ENV} is not set."
-            )
         try:
             # One budget for every attempt and wait, inside the caller's budget if any.
             with request_budget(self.timeout) as budget:
@@ -405,8 +392,7 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
                 return exchange_runtime_credential(
                     post,
                     credential_id=credential_id,
-                    credential_secret=credential_secret,
-                    identity_token_file=identity_token_file,
+                    identity_token_file=self.identity_token_file,
                     deadline=budget.deadline,
                     on_retry=self._log_exchange_retry,
                 )

{mainsequence-9.0.11 → mainsequence-9.0.12}/mainsequence/logconf.py

@@ -25,7 +25,6 @@ from .instrumentation import OTelJSONRenderer
 from .repository_identity_security import UNSUPPORTED_SOURCE_IDENTITY_ENV_NAMES
 from .runtime_credential_exchange import (
     RUNTIME_CREDENTIAL_ID_ENV,
-    RUNTIME_CREDENTIAL_SECRET_ENV,
     exchange_runtime_credential,
     identity_token_file_from_environment,
     runtime_credential_configured,
@@ -104,7 +103,6 @@ def _request_job_startup_state(*, timeout_s: float = 10.0) -> dict[str, Any]:
     def _exchange_runtime_credential() -> bool:
         if not runtime_credential_configured():
             return False
-        identity_token_file = identity_token_file_from_environment()
         token_url = f"{_backend_base_url()}/api/v1/runtime-credentials/token/"
 
         def _post(body: dict[str, str]) -> requests.Response:
@@ -120,12 +118,7 @@ def _request_job_startup_state(*, timeout_s: float = 10.0) -> dict[str, Any]:
             token_resp = exchange_runtime_credential(
                 _post,
                 credential_id=(os.getenv(RUNTIME_CREDENTIAL_ID_ENV) or "").strip(),
-                credential_secret=(
-                    None
-                    if identity_token_file
-                    else (os.getenv(RUNTIME_CREDENTIAL_SECRET_ENV) or "").strip()
-                ),
-                identity_token_file=identity_token_file,
+                identity_token_file=identity_token_file_from_environment(),
                 deadline=time.monotonic() + timeout_s,
             )
         except Exception:

{mainsequence-9.0.11 → mainsequence-9.0.12}/mainsequence/runtime_credential_exchange.py

@@ -3,13 +3,11 @@ The runtime credential exchange, shared by the auth provider and the logger.
 
 A runtime started with ``MAINSEQUENCE_AUTH_MODE=runtime_credential`` exchanges its
 credential at ``POST /api/v1/runtime-credentials/token/`` for a short-lived access
-token. The request carries ``credential_id`` and exactly one proof:
-
-* ``workload_identity_token`` when ``MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`` is
-  set: the projected token read from that file for every exchange, because the
-  file is rotated. The bootstrap secret is then never read or sent, and a missing,
-  unreadable or empty file is an error, never a fallback to the secret.
-* ``credential_secret`` otherwise: ``MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET``.
+token. The request carries exactly ``credential_id`` and ``workload_identity_token``:
+the projected token read from the file named by
+``MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`` for every exchange, because the file is
+rotated. That token is the only proof. An unset variable and a missing, unreadable
+or empty file are errors, raised instead of sending the request.
 
 The token exists only inside one exchange request. It is not kept on any object,
 written to the environment or a file, logged, or included in an error message.
@@ -29,7 +27,6 @@ from urllib3.exceptions import InvalidHeader
 from urllib3.util import Retry
 
 RUNTIME_CREDENTIAL_ID_ENV = "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID"
-RUNTIME_CREDENTIAL_SECRET_ENV = "MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET"
 RUNTIME_IDENTITY_TOKEN_FILE_ENV = "MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE"
 
 # 429: the exchange is throttled. 503: verification is temporarily unavailable.
@@ -42,7 +39,7 @@ _RETRY_AFTER = Retry(total=0)
 
 
 class RuntimeIdentityTokenError(Exception):
-    """The runtime identity token file cannot be used. The message never holds its content."""
+    """The identity token file is unset or cannot be used. The message never holds its content."""
 
 
 def _environment_value(name: str) -> str:
@@ -58,18 +55,22 @@ def runtime_credential_configured() -> bool:
     """
     Say whether the environment holds a runtime credential to exchange.
 
-    That is a credential ID and one proof: the identity token file, or else the
-    bootstrap secret. Only the presence of the setting is checked. The token file
-    is read by the exchange itself, which reports a missing or empty file.
+    That is a credential ID and the identity token file that proves it. Only the
+    presence of both settings is checked. The token file is read by the exchange
+    itself, which reports a missing or empty file.
     """
-    if not _environment_value(RUNTIME_CREDENTIAL_ID_ENV):
-        return False
-    if identity_token_file_from_environment():
-        return True
-    return bool(_environment_value(RUNTIME_CREDENTIAL_SECRET_ENV))
+    return bool(
+        _environment_value(RUNTIME_CREDENTIAL_ID_ENV) and identity_token_file_from_environment()
+    )
 
 
-def _read_identity_token(path: str) -> str:
+def _read_identity_token(path: str | None) -> str:
+    if not path:
+        raise RuntimeIdentityTokenError(
+            f"{RUNTIME_IDENTITY_TOKEN_FILE_ENV} is required when "
+            "MAINSEQUENCE_AUTH_MODE=runtime_credential: a runtime credential is exchanged "
+            "only with the projected workload identity token in that file."
+        )
     source = f"The runtime identity token file {path} ({RUNTIME_IDENTITY_TOKEN_FILE_ENV})"
     try:
         with open(path, "rb") as token_file:
@@ -92,17 +93,11 @@ def _read_identity_token(path: str) -> str:
     return token
 
 
-def _request_body(
-    credential_id: str,
-    credential_secret: str | None,
-    identity_token_file: str | None,
-) -> dict[str, str]:
-    if identity_token_file:
-        return {
-            "credential_id": credential_id,
-            "workload_identity_token": _read_identity_token(identity_token_file),
-        }
-    return {"credential_id": credential_id, "credential_secret": credential_secret or ""}
+def _request_body(credential_id: str, identity_token_file: str | None) -> dict[str, str]:
+    return {
+        "credential_id": credential_id,
+        "workload_identity_token": _read_identity_token(identity_token_file),
+    }
 
 
 def _retry_delay(response: Any, attempt: int) -> float:
@@ -120,7 +115,6 @@ def exchange_runtime_credential(
     send: Callable[[dict[str, str]], Any],
     *,
     credential_id: str,
-    credential_secret: str | None,
     identity_token_file: str | None,
     deadline: float,
     on_retry: Callable[[int, float], None] | None = None,
@@ -135,8 +129,6 @@ def exchange_runtime_credential(
         response. It is called once per attempt.
     credential_id:
         The runtime credential ID.
-    credential_secret:
-        The bootstrap secret. Ignored when ``identity_token_file`` is set.
     identity_token_file:
         The projected token file. It is read again for every attempt.
     deadline:
@@ -147,12 +139,12 @@ def exchange_runtime_credential(
     A ``429`` or ``503`` answer is retried up to ``EXCHANGE_RETRIES`` times. The
     wait is the exponential backoff or the answer's ``Retry-After``, whichever is
     longer; a wait that would not end before ``deadline`` ends the retries. Any
-    other answer, ``401`` included, is returned at once and the proof is never
-    switched. ``RuntimeIdentityTokenError`` is raised when the token file cannot
-    be used.
+    other answer, ``401`` included, is returned at once. ``RuntimeIdentityTokenError``
+    is raised instead of sending an attempt when ``identity_token_file`` is not set
+    or the file cannot be used.
     """
     for attempt in range(EXCHANGE_RETRIES + 1):
-        response = send(_request_body(credential_id, credential_secret, identity_token_file))
+        response = send(_request_body(credential_id, identity_token_file))
         status = response.status_code
         if status not in RETRYABLE_EXCHANGE_STATUSES or attempt == EXCHANGE_RETRIES:
             return response

{mainsequence-9.0.11 → mainsequence-9.0.12}/mainsequence/server/caller_assertions.py

@@ -16,7 +16,8 @@ import requests
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
 from jwt import InvalidKeyError, InvalidTokenError
 
-ASSERTION_HEADER = "X-MainSequence-Caller-Assertion"
+from mainsequence._request_identity import CALLER_ASSERTION_HEADER as ASSERTION_HEADER
+
 ASSERTION_TYPE = "mainsequence-caller-assertion+jwt"
 ASSERTION_ALGORITHM = "EdDSA"
 MAX_ASSERTION_SECONDS = 300

{mainsequence-9.0.11 → mainsequence-9.0.12}/mainsequence/server/fastapi.py

@@ -6,11 +6,12 @@ import asyncio
 import json
 import os
 import re
+from contextlib import contextmanager
 from uuid import UUID
 
 import requests
 
-from mainsequence._request_identity import _request_scope
+from mainsequence._request_identity import _reads_as_caller, _request_scope
 from mainsequence.client.models_user import RequestUserIdentity
 
 from .caller_assertions import (
@@ -220,6 +221,7 @@ class _RequestIdentityMiddleware:
                         )
                         state["resource_release_uid"] = caller.release_uid
                         state["organization_environment_uid"] = caller.environment_uid
+                        context.caller_assertion = assertion
                     else:
                         user = await asyncio.to_thread(_local_user, scope)
                     context.user = user
@@ -267,4 +269,19 @@ def install_request_identity(app):
     )
 
 
-__all__ = ["install_request_identity"]
+@contextmanager
+def reads_as_caller():
+    """Read the directory as the request's caller instead of as the application.
+
+    Inside the block, ``User.filter``, ``User.get_by_uid``, ``Team.filter`` and
+    ``Team.get_by_uid`` present the caller assertion the request arrived with,
+    and the platform answers with what the caller may see. No other call sends
+    it. Raises ``RequestIdentityError`` outside an authenticated request or when
+    the request carries no assertion (local mode, WebSockets); it never reads as
+    the application instead. See ADR-0036.
+    """
+    with _reads_as_caller():
+        yield
+
+
+__all__ = ["install_request_identity", "reads_as_caller"]

{mainsequence-9.0.11 → mainsequence-9.0.12}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.11
+Version: 9.0.12
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.11 → mainsequence-9.0.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.11"
+version = "9.0.12"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"