meshagent-api 0.52.0__tar.gz → 0.52.3__tar.gz

{meshagent_api-0.52.0/meshagent_api.egg-info → meshagent_api-0.52.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshagent-api
-Version: 0.52.0
+Version: 0.52.3
 Summary: Python Server API for Meshagent
 License-Expression: Apache-2.0
 Project-URL: Documentation, https://docs.meshagent.com
@@ -18,7 +18,7 @@ Requires-Dist: pydantic~=2.11.7
 Requires-Dist: jinja2~=3.1.6
 Requires-Dist: pyyaml~=6.0.2
 Requires-Dist: certifi~=2026.1.4
-Requires-Dist: pyarrow~=21.0.0
+Requires-Dist: pyarrow~=22.0.0
 Requires-Dist: croniter~=6.0
 Provides-Extra: all
 Provides-Extra: sync

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/meshagent/api/client.py

@@ -1496,6 +1496,7 @@ class Meshagent:
             "admission": "admission",
             "room": "room",
             "room_roles": "room-roles",
+            "router": "router",
         }
         try:
             return paths[name]

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/meshagent/api/client_test.py

@@ -591,6 +591,35 @@ def test_project_settings_document_methods_reject_unknown_names() -> None:
         client._project_settings_document_path("legacy")
 
 
+@pytest.mark.asyncio
+async def test_router_settings_document_uses_router_route() -> None:
+    session = _FakeSession(
+        [
+            _FakeResponse(status=200, payload={"rules": []}),
+            _FakeResponse(status=200, payload={}),
+        ]
+    )
+    client = Meshagent(base_url="http://example.test", token="token", session=session)
+
+    assert await client.get_project_settings_document("proj_123", "router") == {
+        "rules": []
+    }
+    await client.set_project_settings_document("proj_123", "router", {"rules": []})
+
+    assert session.calls == [
+        (
+            "get",
+            "http://example.test/accounts/projects/proj_123/settings/router",
+            None,
+        ),
+        (
+            "put",
+            "http://example.test/accounts/projects/proj_123/settings/router",
+            {"rules": []},
+        ),
+    ]
+
+
 @pytest.mark.asyncio
 async def test_connect_agent_normalizes_legacy_messages_url():
     session = _FakeSession(

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/meshagent/api/http.py

@@ -1,14 +1,14 @@
 from __future__ import annotations
 
-from collections.abc import Mapping
-from typing import Any, Literal
 import os
 import ssl
+from collections.abc import Mapping
+from typing import Any, Literal
 
+import certifi
 from aiohttp import ClientSession, TCPConnector
 from aiohttp.abc import AbstractResolver
-from aiohttp.resolver import DefaultResolver
-import certifi
+from aiohttp.resolver import DefaultResolver, ThreadedResolver
 
 LLM_ANNOTATION_HEADER_PREFIX = "X-Meshagent-Annotation-"
 _LLM_ANNOTATION_HEADER_PREFIX_LOWER = LLM_ANNOTATION_HEADER_PREFIX.lower()
@@ -27,9 +27,16 @@ def normalize_meshagent_consistency(value: str | None) -> MeshagentConsistency:
 
 
 class _HostAliasResolver(AbstractResolver):
-    def __init__(self, aliases: Mapping[str, str]) -> None:
+    def __init__(
+        self,
+        aliases: Mapping[str, str],
+        *,
+        use_threaded_resolver: bool = False,
+    ) -> None:
         self._aliases = aliases
-        self._resolver = DefaultResolver()
+        self._resolver: AbstractResolver = (
+            ThreadedResolver() if use_threaded_resolver else DefaultResolver()
+        )
 
     async def resolve(
         self,
@@ -69,8 +76,16 @@ def new_tcp_connector(*args: Any, **kwargs: Any) -> TCPConnector:
         kwargs["ssl"] = ssl_context
     if "resolver" not in kwargs:
         aliases = _http_host_aliases()
+        use_threaded_resolver = os.environ.get(
+            "MESHAGENT_HTTP_THREADED_RESOLVER", ""
+        ).strip().lower() in {"1", "true", "yes"}
         if aliases:
-            kwargs["resolver"] = _HostAliasResolver(aliases)
+            kwargs["resolver"] = _HostAliasResolver(
+                aliases,
+                use_threaded_resolver=use_threaded_resolver,
+            )
+        elif use_threaded_resolver:
+            kwargs["resolver"] = ThreadedResolver()
     return TCPConnector(*args, **kwargs)
 
 

meshagent_api-0.52.3/meshagent/api/llm_router_config.py

@@ -0,0 +1,326 @@
+from __future__ import annotations
+
+import re
+from enum import StrEnum
+from typing import Annotated, Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+
+_PORTABLE_TOOL_NAME = re.compile(r"^[A-Za-z_][A-Za-z0-9_-]{0,63}$")
+_DOMAIN_LABEL = re.compile(r"^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$")
+
+
+def _non_empty(value: str, *, field: str) -> str:
+    if value.strip() == "":
+        raise ValueError(f"{field} must not be empty")
+    return value
+
+
+def _portable_tool_name(value: str) -> str:
+    value = value.strip()
+    if _PORTABLE_TOOL_NAME.fullmatch(value) is None:
+        raise ValueError(
+            "name must start with a letter or underscore, contain only letters, "
+            "numbers, underscores, or dashes, and be at most 64 characters"
+        )
+    return value
+
+
+def _domain_name(value: str) -> str:
+    value = value.strip().lower().rstrip(".")
+    if (
+        value == ""
+        or len(value) > 253
+        or "://" in value
+        or "/" in value
+        or any(_DOMAIN_LABEL.fullmatch(label) is None for label in value.split("."))
+    ):
+        raise ValueError("domain entries must be bare DNS host names")
+    return value
+
+
+class _StrictModel(BaseModel):
+    model_config = ConfigDict(extra="forbid", populate_by_name=True)
+
+
+class AllowedLlmModel(_StrictModel):
+    provider: str
+    model: str
+
+    @field_validator("provider")
+    @classmethod
+    def _provider(cls, value: str) -> str:
+        return _non_empty(value, field="provider").strip().lower()
+
+    @field_validator("model")
+    @classmethod
+    def _model(cls, value: str) -> str:
+        return _non_empty(value, field="model").strip()
+
+
+class LlmAppFilterMode(StrEnum):
+    BLOCKED = "blocked"
+    ALLOWED = "allowed"
+
+
+class LlmAppFilter(_StrictModel):
+    mode: LlmAppFilterMode = LlmAppFilterMode.BLOCKED
+    user_agent_patterns: list[str] = Field(
+        default_factory=list, alias="userAgentPatterns"
+    )
+    block_missing_user_agent: bool = Field(default=False, alias="blockMissingUserAgent")
+
+    @field_validator("user_agent_patterns")
+    @classmethod
+    def _patterns(cls, values: list[str]) -> list[str]:
+        return [_non_empty(value, field="user-agent pattern") for value in values]
+
+
+class LlmRouterProvider(StrEnum):
+    OPENAI = "openai"
+    ANTHROPIC = "anthropic"
+    GROK = "grok"
+
+
+class LlmRouterApi(StrEnum):
+    COMPLETIONS = "completions"
+    CHAT_COMPLETIONS = "chat_completions"
+    RESPONSES = "responses"
+    MESSAGES = "messages"
+    REALTIME = "realtime"
+
+
+class LlmRouterTransport(StrEnum):
+    HTTP = "http"
+    WEBSOCKET = "websocket"
+
+
+class LlmRouterMatch(_StrictModel):
+    header: dict[str, str] = Field(default_factory=dict)
+    models: list[str] = Field(default_factory=list)
+    providers: list[LlmRouterProvider] = Field(default_factory=list)
+    apis: list[LlmRouterApi] = Field(default_factory=list)
+    transports: list[LlmRouterTransport] = Field(default_factory=list)
+
+    @field_validator("header")
+    @classmethod
+    def _headers(cls, values: dict[str, str]) -> dict[str, str]:
+        result: dict[str, str] = {}
+        for name, pattern in values.items():
+            name = name.strip().lower()
+            if name == "" or not all(
+                character.isalnum() or character in "!#$%&'*+-.^_`|~"
+                for character in name
+            ):
+                raise ValueError("header names must be valid HTTP field names")
+            if name in result:
+                raise ValueError(f"duplicate header name: {name}")
+            result[name] = _non_empty(pattern, field="header pattern")
+        return result
+
+    @field_validator("models")
+    @classmethod
+    def _models(cls, values: list[str]) -> list[str]:
+        return [_non_empty(value, field="model pattern") for value in values]
+
+    @field_validator("providers", mode="before")
+    @classmethod
+    def _providers(cls, value: object) -> object:
+        if isinstance(value, list):
+            return [
+                item.strip().lower() if isinstance(item, str) else item
+                for item in value
+            ]
+        return value
+
+
+class LlmInstructionTransform(_StrictModel):
+    replace: str | None = None
+    append: str | None = None
+
+    @field_validator("replace", "append")
+    @classmethod
+    def _text(cls, value: str | None) -> str | None:
+        if value is not None:
+            _non_empty(value, field="instruction")
+        return value
+
+    @model_validator(mode="after")
+    def _operation(self) -> LlmInstructionTransform:
+        if self.replace is None and self.append is None:
+            raise ValueError("instructions requires replace or append")
+        return self
+
+
+class LlmToolSelector(_StrictModel):
+    type: str
+    name: str | None = None
+
+    @field_validator("type")
+    @classmethod
+    def _type(cls, value: str) -> str:
+        return _non_empty(value, field="tool type")
+
+    @field_validator("name")
+    @classmethod
+    def _name(cls, value: str | None) -> str | None:
+        return None if value is None else _non_empty(value, field="tool name")
+
+
+class LlmWebSearchTool(_StrictModel):
+    type: Literal["web_search"]
+    search_context_size: Literal["low", "medium", "high"] | None = None
+    allowed_domains: list[str] = Field(default_factory=list)
+    blocked_domains: list[str] = Field(default_factory=list)
+
+    @field_validator("allowed_domains", "blocked_domains")
+    @classmethod
+    def _domains(cls, values: list[str]) -> list[str]:
+        result = [_domain_name(value) for value in values]
+        if len(result) != len(set(result)):
+            raise ValueError("domain lists must not contain duplicates")
+        return result
+
+    @model_validator(mode="after")
+    def _domain_mode(self) -> LlmWebSearchTool:
+        if self.allowed_domains and self.blocked_domains:
+            raise ValueError(
+                "allowed_domains and blocked_domains are mutually exclusive"
+            )
+        return self
+
+
+class LlmStaticTool(_StrictModel):
+    type: Literal["static"]
+    name: str
+    description: str
+    content: str
+
+    @field_validator("name")
+    @classmethod
+    def _name(cls, value: str) -> str:
+        return _portable_tool_name(value)
+
+    @field_validator("description", "content")
+    @classmethod
+    def _text(cls, value: str) -> str:
+        return _non_empty(value, field="static tool text")
+
+
+class LlmAdvisor(_StrictModel):
+    provider: LlmRouterProvider
+    model: str
+    instructions: str | None = None
+    max_output_tokens: int | None = Field(default=None, ge=1)
+
+    @field_validator("provider", mode="before")
+    @classmethod
+    def _provider(cls, value: object) -> object:
+        return value.strip().lower() if isinstance(value, str) else value
+
+    @field_validator("model")
+    @classmethod
+    def _model(cls, value: str) -> str:
+        return _non_empty(value, field="advisor model").strip()
+
+    @field_validator("instructions")
+    @classmethod
+    def _instructions(cls, value: str | None) -> str | None:
+        if value is not None:
+            _non_empty(value, field="advisor instructions")
+        return value
+
+
+class LlmAdviceTool(_StrictModel):
+    type: Literal["advice"]
+    name: str
+    description: str
+    strategy: Literal["parallel"] = "parallel"
+    advisors: list[LlmAdvisor] = Field(min_length=1, max_length=8)
+
+    @field_validator("name")
+    @classmethod
+    def _name(cls, value: str) -> str:
+        return _portable_tool_name(value)
+
+    @field_validator("description")
+    @classmethod
+    def _description(cls, value: str) -> str:
+        return _non_empty(value, field="advice tool description")
+
+
+LlmEnsureTool = Annotated[
+    LlmWebSearchTool | LlmStaticTool | LlmAdviceTool,
+    Field(discriminator="type"),
+]
+
+
+class LlmToolTransform(_StrictModel):
+    deny: list[LlmToolSelector] = Field(default_factory=list)
+    ignore: list[LlmToolSelector] = Field(default_factory=list)
+    ensure: list[LlmEnsureTool] = Field(default_factory=list)
+
+    @model_validator(mode="after")
+    def _operations(self) -> LlmToolTransform:
+        if not self.deny and not self.ignore and not self.ensure:
+            raise ValueError("tools requires deny, ignore, or ensure")
+        identities: set[tuple[str, str | None]] = set()
+        for tool in self.ensure:
+            name = (
+                tool.name if isinstance(tool, (LlmStaticTool, LlmAdviceTool)) else None
+            )
+            identity = (
+                "function"
+                if isinstance(tool, (LlmStaticTool, LlmAdviceTool))
+                else tool.type,
+                name,
+            )
+            if identity in identities:
+                raise ValueError(f"duplicate ensured tool: {tool.type}")
+            identities.add(identity)
+        return self
+
+
+class LlmRouterThen(_StrictModel):
+    instructions: LlmInstructionTransform | None = None
+    tools: LlmToolTransform | None = None
+
+    @model_validator(mode="after")
+    def _transform(self) -> LlmRouterThen:
+        if self.instructions is None and self.tools is None:
+            raise ValueError("then requires instructions or tools")
+        return self
+
+
+class LlmRouterRule(_StrictModel):
+    name: str | None = None
+    when: LlmRouterMatch = Field(default_factory=LlmRouterMatch)
+    then: LlmRouterThen
+
+    @field_validator("name")
+    @classmethod
+    def _name(cls, value: str | None) -> str | None:
+        return None if value is None else _non_empty(value, field="rule name").strip()
+
+
+class LlmRouterConfig(_StrictModel):
+    allowed_models: list[AllowedLlmModel] | None = Field(
+        default=None, alias="allowedModels"
+    )
+    apps: LlmAppFilter = Field(default_factory=LlmAppFilter)
+    rules: list[LlmRouterRule] = Field(default_factory=list)
+
+    @model_validator(mode="before")
+    @classmethod
+    def _legacy_list(cls, value: Any) -> Any:
+        return {"allowedModels": value} if isinstance(value, list) else value
+
+    @model_validator(mode="after")
+    def _rule_names(self) -> LlmRouterConfig:
+        names = [rule.name for rule in self.rules if rule.name is not None]
+        if len(names) != len(set(names)):
+            raise ValueError("rule names must be unique")
+        return self
+
+    def to_document(self) -> dict[str, Any]:
+        return self.model_dump(mode="json", by_alias=True)

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/meshagent/api/managed_agents.py

@@ -77,6 +77,8 @@ class ManagedAgentToolkit(BaseModel):
 
 class ManagedAgentWebSearch(ManagedAgentToolkit):
     type: Literal["web_search"] = "web_search"
+    allowed_domains: list[str] | None = None
+    blocked_domains: list[str] | None = None
 
 
 class ManagedAgentWebFetch(ManagedAgentToolkit):

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/meshagent/api/managed_agents_test.py

@@ -187,3 +187,41 @@ def test_managed_agent_spec_drops_legacy_mcp_secret_authorization():
     server_data = toolkit.servers[0].model_dump(mode="json")
     assert server_data["server_label"] == "linear"
     assert "authorization" not in server_data
+
+
+@pytest.mark.parametrize(
+    "filters",
+    [
+        {},
+        {"allowed_domains": []},
+        {"blocked_domains": []},
+        {"allowed_domains": ["example.com"]},
+        {"blocked_domains": ["blocked.example.com"]},
+        {
+            "allowed_domains": ["example.com"],
+            "blocked_domains": ["blocked.example.com"],
+        },
+    ],
+)
+def test_managed_web_search_domain_filters_round_trip(filters):
+    toolkit = {"type": "web_search", **filters}
+    spec = ManagedAgentSpec.model_validate(
+        {
+            "metadata": {"name": "researcher"},
+            "allowed_models": [{"provider": "openai", "model": "gpt-4.1"}],
+            "toolkits": [toolkit],
+        }
+    )
+    assert spec.model_dump(exclude_none=True)["toolkits"] == [toolkit]
+
+
+@pytest.mark.parametrize("field", ["allowed_domains", "blocked_domains"])
+def test_managed_web_search_domain_filters_require_lists(field):
+    with pytest.raises(ValidationError):
+        ManagedAgentSpec.model_validate(
+            {
+                "metadata": {"name": "researcher"},
+                "allowed_models": [{"provider": "openai", "model": "gpt-4.1"}],
+                "toolkits": [{"type": "web_search", field: "example.com"}],
+            }
+        )

meshagent_api-0.52.3/meshagent/api/oauth_branding.py

@@ -0,0 +1,15 @@
+from typing import Literal
+
+from pydantic import BaseModel, HttpUrl, field_validator
+
+
+class OAuthClientBranding(BaseModel):
+    """Optional login branding stored in an OAuth client's metadata."""
+
+    logo_url: HttpUrl | None = None
+    theme: Literal["light", "dark", "auto"] = "auto"
+
+    @field_validator("logo_url", mode="before")
+    @classmethod
+    def empty_logo_is_default(cls, value: object) -> object:
+        return None if value == "" else value

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/meshagent/api/room_server_client.py

@@ -710,7 +710,7 @@ def _is_retryable_startup_close(
     kind: ProtocolCloseKind,
     reason: str | None,
 ) -> bool:
-    if kind == ProtocolCloseKind.ERROR:
+    if kind in (ProtocolCloseKind.ERROR, ProtocolCloseKind.SERVER):
         return True
 
     normalized_reason = (reason or "").lower()
@@ -8677,6 +8677,39 @@ class SqliteClient:
         finally:
             input_stream.close()
 
+    async def backup(
+        self,
+        *,
+        database: str,
+        namespace: Optional[list[str]] = None,
+    ) -> AsyncIterator[bytes]:
+        """Stream a consistent SQLite file, verifying its size and SHA-256 at EOF.
+
+        Consume the entire iterator before publishing the downloaded file.
+        Requires unrestricted table access to this database.
+        """
+        from meshagent.api.sqlite_transfer import backup
+
+        async for chunk in backup(self, database, namespace):
+            yield chunk
+
+    async def restore(
+        self,
+        *,
+        database: str,
+        source: AsyncIterable[bytes],
+        namespace: Optional[list[str]] = None,
+    ) -> None:
+        """Restore chunks of at most 256 KiB as a new, durably stored database.
+
+        Existing names are rejected. The server validates integrity and foreign
+        keys before creating the target. A lost final acknowledgement leaves the
+        outcome uncertain; retries never overwrite an existing database.
+        """
+        from meshagent.api.sqlite_transfer import restore
+
+        await restore(self, database, namespace, source)
+
     async def list_databases(
         self, *, namespace: Optional[list[str]] = None
     ) -> list[str]:

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/meshagent/api/room_server_client_test.py

@@ -702,15 +702,16 @@ class _ClosingProtocol(_FakeProtocol):
 
 
 class _ClosingProtocolWithReason(_FakeProtocol):
-    def __init__(self) -> None:
+    def __init__(self, reason: str = "websocket closed with code 1008") -> None:
         super().__init__()
         self._close_kind = ProtocolCloseKind.SERVER
+        self.reason = reason
 
     async def wait_for_close(self) -> None:
         return None
 
     def close_reason(self) -> str | None:
-        return "websocket closed with code 1008"
+        return self.reason
 
 
 class _StatusClosingProtocol(_FakeProtocol):
@@ -1803,7 +1804,7 @@ class _SharedReconnectRoomController:
 @pytest.mark.asyncio
 async def test_room_client_enter_raises_if_connection_closes_before_ready() -> None:
     protocol = _ClosingProtocol()
-    client = RoomClient(protocol_factory=protocol.create_factory())
+    client = RoomClient(protocol_factory=protocol.create_factory(), reconnect_timeout=0)
 
     with pytest.raises(
         RoomException,
@@ -1823,7 +1824,7 @@ async def test_room_client_enter_includes_close_reason_when_connection_closes_ea
     None
 ):
     protocol = _ClosingProtocolWithReason()
-    client = RoomClient(protocol_factory=protocol.create_factory())
+    client = RoomClient(protocol_factory=protocol.create_factory(), reconnect_timeout=0)
 
     with pytest.raises(
         RoomException,
@@ -1852,6 +1853,53 @@ async def test_room_client_enter_does_not_include_last_room_status_when_connecti
         await client.__aenter__()
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize("reason", [None, "websocket closed with code 1000"])
+async def test_room_client_enter_retries_server_close_before_ready(reason) -> None:
+    controller = _ReconnectRoomController(schema=_simple_thread_schema())
+    failed_protocols = []
+
+    def protocol_factory():
+        if len(failed_protocols) < 2:
+            protocol = (
+                _ClosingProtocol()
+                if reason is None
+                else _ClosingProtocolWithReason(reason=reason)
+            )
+            failed_protocols.append(protocol)
+            return protocol
+        return controller.protocol_factory()
+
+    async with RoomClient(
+        protocol_factory=protocol_factory,
+        reconnect_timeout=2,
+    ) as room:
+        assert room.is_connected
+        assert len(failed_protocols) == 2
+        assert all(protocol.exited for protocol in failed_protocols)
+        assert len(controller.protocols) == 1
+
+
+@pytest.mark.asyncio
+async def test_room_client_server_close_startup_retries_respect_timeout() -> None:
+    protocols = []
+
+    def protocol_factory():
+        protocol = _ClosingProtocolWithReason(reason="websocket closed with code 1000")
+        protocols.append(protocol)
+        return protocol
+
+    room = RoomClient(
+        protocol_factory=protocol_factory,
+        reconnect_timeout=0.03,
+    )
+    with pytest.raises(RoomException, match="room reconnect timed out"):
+        await asyncio.wait_for(room.__aenter__(), timeout=1)
+    assert len(protocols) >= 2
+    assert all(protocol.exited for protocol in protocols)
+    assert room.is_closed
+
+
 @pytest.mark.asyncio
 async def test_room_client_enter_retries_1013_server_close_before_ready() -> None:
     controller = _ReconnectRoomController(schema=_simple_thread_schema())

meshagent_api-0.52.3/meshagent/api/sqlite_transfer.py

@@ -0,0 +1,162 @@
+"""Bounded, checksum-verified whole-database transfers for the SQLite toolkit."""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+from collections.abc import AsyncIterable, AsyncIterator
+from typing import TYPE_CHECKING, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
+
+from meshagent.api.messaging import BinaryContent, Content, ErrorContent
+from meshagent.api.room_server_client import RoomException
+
+if TYPE_CHECKING:
+    from meshagent.api.room_server_client import SqliteClient
+
+CHUNK_SIZE = 256 * 1024
+
+
+class TransferComplete(BaseModel):
+    model_config = ConfigDict(extra="forbid", strict=True)
+    kind: Literal["complete"]
+    size: int = Field(ge=0)
+    sha256: str = Field(pattern=r"^[0-9a-f]{64}$")
+
+
+class _TransferInput:
+    def __init__(
+        self,
+        database: str,
+        namespace: list[str] | None,
+        source: AsyncIterable[bytes] | None = None,
+    ) -> None:
+        self.start = {"kind": "start", "database": database, "namespace": namespace}
+        self.source = source.__aiter__() if source is not None else None
+        self.pulls: asyncio.Queue[None] = asyncio.Queue()
+        self.closed = False
+        self.sent_start = False
+        self.complete: TransferComplete | None = None
+        self.digest = hashlib.sha256()
+        self.size = 0
+        self.error: Exception | None = None
+
+    def request_next(self) -> None:
+        self.pulls.put_nowait(None)
+
+    def close(self) -> None:
+        self.closed = True
+        self.request_next()
+
+    def __aiter__(self) -> _TransferInput:
+        return self
+
+    async def __anext__(self) -> Content:
+        if not self.sent_start:
+            self.sent_start = True
+            return BinaryContent(data=b"", headers=self.start)
+        await self.pulls.get()
+        if self.closed:
+            raise StopAsyncIteration
+        if self.source is None:
+            return BinaryContent(data=b"", headers={"kind": "pull"})
+        if self.complete is not None:
+            raise RoomException("Unexpected pull after SQLite upload completed")
+        try:
+            data = await self.source.__anext__()
+            if not isinstance(data, bytes) or not 0 < len(data) <= CHUNK_SIZE:
+                raise ValueError(
+                    f"SQLite upload chunks must contain 1–{CHUNK_SIZE} bytes"
+                )
+        except StopAsyncIteration:
+            self.complete = TransferComplete(
+                kind="complete", size=self.size, sha256=self.digest.hexdigest()
+            )
+            return BinaryContent(data=b"", headers=self.complete.model_dump())
+        except Exception as error:
+            self.error = error
+            return BinaryContent(data=b"", headers={"kind": "abort"})
+        self.digest.update(data)
+        self.size += len(data)
+        return BinaryContent(data=data, headers={"kind": "data"})
+
+
+def _binary(chunk: Content) -> BinaryContent:
+    if isinstance(chunk, ErrorContent):
+        raise RoomException(chunk.text, code=chunk.code)
+    if not isinstance(chunk, BinaryContent):
+        raise RoomException("SQLite transfer ended without verified completion")
+    return chunk
+
+
+def _complete(chunk: BinaryContent) -> TransferComplete:
+    try:
+        result = TransferComplete.model_validate(chunk.headers)
+    except ValidationError as error:
+        raise RoomException("Invalid SQLite transfer completion") from error
+    if chunk.data:
+        raise RoomException("Invalid SQLite transfer completion payload")
+    return result
+
+
+async def backup(
+    client: SqliteClient,
+    database: str,
+    namespace: list[str] | None,
+) -> AsyncIterator[bytes]:
+    """Yield file bytes; callers must consume through verified completion."""
+    inputs = _TransferInput(database, namespace)
+    digest = hashlib.sha256()
+    size = 0
+    try:
+        responses = await client._invoke_stream(operation="backup", input=inputs)
+        inputs.request_next()
+        async for response in responses:
+            chunk = _binary(response)
+            if chunk.headers.get("kind") == "complete":
+                result = _complete(chunk)
+                if result.size != size or result.sha256 != digest.hexdigest():
+                    raise RoomException("SQLite backup size or SHA-256 mismatch")
+                return
+            if (
+                chunk.headers.get("kind") != "data"
+                or not 0 < len(chunk.data) <= CHUNK_SIZE
+            ):
+                raise RoomException("Invalid SQLite backup data frame")
+            digest.update(chunk.data)
+            size += len(chunk.data)
+            yield chunk.data
+            inputs.request_next()
+        raise RoomException("SQLite backup interrupted before completion")
+    finally:
+        inputs.close()
+
+
+async def restore(
+    client: SqliteClient,
+    database: str,
+    namespace: list[str] | None,
+    source: AsyncIterable[bytes],
+) -> None:
+    inputs = _TransferInput(database, namespace, source)
+    try:
+        responses = await client._invoke_stream(operation="restore", input=inputs)
+        async for response in responses:
+            if inputs.error is not None:
+                raise inputs.error
+            chunk = _binary(response)
+            if chunk.headers.get("kind") == "pull" and not chunk.data:
+                inputs.request_next()
+            elif chunk.headers.get("kind") == "complete":
+                result = _complete(chunk)
+                if inputs.complete is None or result != inputs.complete:
+                    raise RoomException(
+                        "SQLite restore acknowledgement does not match upload"
+                    )
+                return
+            else:
+                raise RoomException("Invalid SQLite restore response")
+        raise RoomException("SQLite restore ended without durable completion")
+    finally:
+        inputs.close()

meshagent_api-0.52.3/meshagent/api/sqlite_transfer_test.py

@@ -0,0 +1,116 @@
+import hashlib
+from collections.abc import AsyncIterable
+from unittest.mock import AsyncMock
+
+import pytest
+
+from meshagent.api.messaging import BinaryContent, Content, ErrorContent
+from meshagent.api.room_server_client import RoomClient, RoomException, SqliteClient
+from meshagent.api.sqlite_transfer import CHUNK_SIZE
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("failure", [None, "checksum", "truncated", "server"])
+async def test_backup_checks_completion_and_requests_one_chunk_at_a_time(failure):
+    client = SqliteClient(AsyncMock(spec=RoomClient))
+    payload = b"SQLite format 3\x00" + b"x" * CHUNK_SIZE
+
+    async def invoke(*, operation: str, input: AsyncIterable[Content]):
+        assert operation == "backup"
+        iterator = input.__aiter__()
+
+        async def responses():
+            start = await iterator.__anext__()
+            assert start.headers == {
+                "kind": "start",
+                "database": "app",
+                "namespace": ["team"],
+            }
+            for offset in range(0, len(payload), CHUNK_SIZE):
+                pull = await iterator.__anext__()
+                assert pull.headers == {"kind": "pull"}
+                yield BinaryContent(
+                    headers={"kind": "data"}, data=payload[offset : offset + CHUNK_SIZE]
+                )
+            if failure == "truncated":
+                return
+            if failure == "server":
+                yield ErrorContent(text="read failed", code=1002)
+                return
+            yield BinaryContent(
+                data=b"",
+                headers={
+                    "kind": "complete",
+                    "size": len(payload),
+                    "sha256": "0" * 64
+                    if failure == "checksum"
+                    else hashlib.sha256(payload).hexdigest(),
+                },
+            )
+
+        return responses()
+
+    client._invoke_stream = invoke
+    if failure:
+        with pytest.raises(RoomException):
+            _ = [
+                chunk
+                async for chunk in client.backup(database="app", namespace=["team"])
+            ]
+    else:
+        assert (
+            b"".join(
+                [
+                    chunk
+                    async for chunk in client.backup(database="app", namespace=["team"])
+                ]
+            )
+            == payload
+        )
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("failure", [None, "truncated", "mismatch", "source"])
+async def test_restore_requires_matching_server_acknowledgement(failure):
+    client = SqliteClient(AsyncMock(spec=RoomClient))
+    payload = b"SQLite format 3\x00" + b"x" * 512
+
+    async def source():
+        yield payload
+        if failure == "source":
+            raise OSError("local read failed")
+
+    async def invoke(*, operation, input):
+        assert operation == "restore"
+        iterator = input.__aiter__()
+
+        async def responses():
+            assert (await iterator.__anext__()).headers["database"] == "new"
+            yield BinaryContent(data=b"", headers={"kind": "pull"})
+            assert (await iterator.__anext__()).data == payload
+            yield BinaryContent(data=b"", headers={"kind": "pull"})
+            final = await iterator.__anext__()
+            if failure == "source":
+                assert final.headers["kind"] == "abort"
+                yield ErrorContent(text="aborted", code=1002)
+                return
+            assert final.headers == {
+                "kind": "complete",
+                "size": len(payload),
+                "sha256": hashlib.sha256(payload).hexdigest(),
+            }
+            if failure == "truncated":
+                return
+            headers = dict(final.headers)
+            if failure == "mismatch":
+                headers["size"] += 1
+            yield BinaryContent(data=b"", headers=headers)
+
+        return responses()
+
+    client._invoke_stream = invoke
+    if failure:
+        with pytest.raises(OSError if failure == "source" else RoomException):
+            await client.restore(database="new", source=source())
+    else:
+        await client.restore(database="new", source=source())

meshagent_api-0.52.3/meshagent/api/version.py

@@ -0,0 +1 @@
+__version__ = "0.52.3"

{meshagent_api-0.52.0 → meshagent_api-0.52.3/meshagent_api.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshagent-api
-Version: 0.52.0
+Version: 0.52.3
 Summary: Python Server API for Meshagent
 License-Expression: Apache-2.0
 Project-URL: Documentation, https://docs.meshagent.com
@@ -18,7 +18,7 @@ Requires-Dist: pydantic~=2.11.7
 Requires-Dist: jinja2~=3.1.6
 Requires-Dist: pyyaml~=6.0.2
 Requires-Dist: certifi~=2026.1.4
-Requires-Dist: pyarrow~=21.0.0
+Requires-Dist: pyarrow~=22.0.0
 Requires-Dist: croniter~=6.0
 Provides-Extra: all
 Provides-Extra: sync

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/meshagent_api.egg-info/SOURCES.txt

@@ -16,6 +16,7 @@ meshagent/api/helpers.py
 meshagent/api/http.py
 meshagent/api/image_runtime.py
 meshagent/api/keys.py
+meshagent/api/llm_router_config.py
 meshagent/api/managed_agents.py
 meshagent/api/managed_agents_test.py
 meshagent/api/messaging.py
@@ -23,6 +24,7 @@ meshagent/api/messaging_test.py
 meshagent/api/mime_types.py
 meshagent/api/mime_types_test.py
 meshagent/api/oauth.py
+meshagent/api/oauth_branding.py
 meshagent/api/oauth_scopes.py
 meshagent/api/oauth_scopes_test.py
 meshagent/api/participant.py
@@ -52,6 +54,8 @@ meshagent/api/services.py
 meshagent/api/services_test.py
 meshagent/api/sql.py
 meshagent/api/sql_test.py
+meshagent/api/sqlite_transfer.py
+meshagent/api/sqlite_transfer_test.py
 meshagent/api/token_test.py
 meshagent/api/urls.py
 meshagent/api/version.py

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/meshagent_api.egg-info/requires.txt

@@ -7,7 +7,7 @@ pydantic~=2.11.7
 jinja2~=3.1.6
 pyyaml~=6.0.2
 certifi~=2026.1.4
-pyarrow~=21.0.0
+pyarrow~=22.0.0
 croniter~=6.0
 
 [all]

{meshagent_api-0.52.0 → meshagent_api-0.52.3}/pyproject.toml

@@ -19,7 +19,7 @@ dependencies = [
   "jinja2~=3.1.6",
   "pyyaml~=6.0.2",
   "certifi~=2026.1.4",
-  "pyarrow~=21.0.0",
+  "pyarrow~=22.0.0",
   "croniter~=6.0",
 ]
 classifiers = [

meshagent_api-0.52.0/meshagent/api/version.py

@@ -1 +0,0 @@
-__version__ = "0.52.0"