otdf-python 0.4.4__tar.gz → 0.5.0__tar.gz

otdf_python-0.5.0/.gemini/config.yaml

@@ -0,0 +1,4 @@
+code_review:
+  ignore_patterns:
+    - "otdf-python-proto/proto-files/**/*"
+    - "otdf-python-proto/src/otdf_python_proto/**/*"

otdf_python-0.5.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+    ".": "0.5.0"
+}

{otdf_python-0.4.4 → otdf_python-0.5.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.5.0](https://github.com/b-long/opentdf-python-sdk/compare/otdf-python-v0.4.4...otdf-python-v0.5.0) (2026-05-08)
+
+
+### Features
+
+* **main:** update proto GIT_TAG to service/v0.8.0 ([#137](https://github.com/b-long/opentdf-python-sdk/issues/137)) ([05ea9a4](https://github.com/b-long/opentdf-python-sdk/commit/05ea9a4c2dcf23d2a709e421802f45ddb89d2ace))
+
 ## [0.4.4](https://github.com/b-long/opentdf-python-sdk/compare/otdf-python-v0.4.3...otdf-python-v0.4.4) (2026-04-30)
 
 

{otdf_python-0.4.4 → otdf_python-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: otdf-python
-Version: 0.4.4
+Version: 0.5.0
 Summary: Unofficial OpenTDF SDK for Python
 Project-URL: Homepage, https://github.com/b-long/opentdf-python-sdk
 Project-URL: Repository, https://github.com/b-long/opentdf-python-sdk

{otdf_python-0.4.4 → otdf_python-0.5.0}/otdf-python-proto/proto-files/authorization/v2/authorization.proto

@@ -21,11 +21,11 @@ message EntityIdentifier {
   oneof identifier {
     option (buf.validate.oneof).required = true;
 
-    // chain of one or more entities
+    // chain of one or more entities and at most 10
     entity.EntityChain entity_chain = 1 [(buf.validate.field).cel = {
       id: "entity_chain_required"
-      message: "entities must be provided"
-      expression: "has(this.entities) && this.entities.size() > 0"
+      message: "entities must be provided and between 1 and 10 in count"
+      expression: "has(this.entities) && this.entities.size() > 0 && this.entities.size() <= 10"
     }];
 
     // fully qualified name of the registered resource value stored in platform policy, where in
@@ -65,11 +65,13 @@ message Resource {
   }
 
   oneof resource {
+    // a set of attribute value FQNs, such as those on a TDF, between 1 and 20 in count
     AttributeValues attribute_values = 2 [(buf.validate.field).cel = {
       id: "attribute_values_required"
-      message: "if provided, resource.attribute_values must not be empty"
-      expression: "this.fqns.size() > 0 && this.fqns.all(item, item.isUri())"
+      message: "if provided, resource.attribute_values must be between 1 and 20 in count with all valid FQNs"
+      expression: "this.fqns.size() > 0 && this.fqns.size() <= 20 && this.fqns.all(item, item.isUri())"
     }];
+    // fully qualified name of the registered resource value stored in platform policy
     string registered_resource_value_fqn = 3 [(buf.validate.field).string = {
       min_len: 1
       uri: true
@@ -112,15 +114,17 @@ message GetDecisionResponse {
 // 1. one entity reference (actor)
 // 2. one action
 // 3. multiple resources
-// Note: this is a more performant bulk request for multiple resource decisions
+// Note: this is a more performant bulk request for multiple resource decisions, up to 1000 per request
 message GetDecisionMultiResourceRequest {
   // an entity must be identified for authorization decisioning
   EntityIdentifier entity_identifier = 1 [(buf.validate.field).required = true];
   // name on action is required
   policy.Action action = 2 [(buf.validate.field).required = true];
   repeated Resource resources = 3 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).repeated = {min_items: 1}
+    (buf.validate.field).repeated = {
+      min_items: 1
+      max_items: 1000
+    }
   ];
 
   option (buf.validate.message).cel = {
@@ -141,7 +145,12 @@ message GetDecisionMultiResourceResponse {
 // This is a more performant bulk request for complex decisioning (i.e. multiple entity chains or actions on
 // multiple resources)
 message GetDecisionBulkRequest {
-  repeated GetDecisionMultiResourceRequest decision_requests = 1;
+  repeated GetDecisionMultiResourceRequest decision_requests = 1 [
+    (buf.validate.field).repeated = {
+      min_items: 1
+      max_items: 200
+    }
+  ];
 }
 message GetDecisionBulkResponse {
   repeated GetDecisionMultiResourceResponse decision_responses = 1;

{otdf_python-0.4.4 → otdf_python-0.5.0}/otdf-python-proto/proto-files/policy/kasregistry/key_access_server_registry.proto

@@ -403,7 +403,7 @@ message CreateKeyRequest {
   Algorithm key_algorithm = 3 [(buf.validate.field).cel = {
     id: "key_algorithm_defined"
     message: "The key_algorithm must be one of the defined values."
-    expression: "this in [1, 2, 3, 4]" // Allow ALGORITHM_EC_P256, ALGORITHM_RSA_2048, ALGORITHM_X25519, ALGORITHM_AES_256_GCM
+    expression: "this in [1, 2, 3, 4, 5]" // Allow ALGORITHM_RSA_2048, ALGORITHM_RSA_4096, ALGORITHM_EC_P256, ALGORITHM_EC_P384, ALGORITHM_EC_P521
   }]; // The algorithm to be used for the key
   // Required
   KeyMode key_mode = 4 [(buf.validate.field).cel = {
@@ -445,7 +445,7 @@ message ListKeysRequest {
   Algorithm key_algorithm = 1 [(buf.validate.field).cel = {
     id: "key_algorithm_defined"
     message: "The key_algorithm must be one of the defined values."
-    expression: "this in [0, 1, 2, 3, 4]" // Allow ALGORITHM_EC_P256, ALGORITHM_RSA_2048, ALGORITHM_X25519, ALGORITHM_AES_256_GCM
+    expression: "this in [0, 1, 2, 3, 4, 5]" // Allow unspecified and object.Algorithm values for currently supported RSA bit sizes and EC curve types
   }]; // Filter keys by algorithm
 
   oneof kas_filter {
@@ -545,7 +545,7 @@ message RotateKeyRequest {
     Algorithm algorithm = 2 [(buf.validate.field).cel = {
       id: "key_algorithm_defined"
       message: "The key_algorithm must be one of the defined values."
-      expression: "this in [1, 2, 3, 4]" // Allow ALGORITHM_EC_P256, ALGORITHM_RSA_2048, ALGORITHM_X25519, ALGORITHM_AES_256_GCM
+      expression: "this in [1, 2, 3, 4, 5]" // Allow ALGORITHM_RSA_2048, ALGORITHM_RSA_4096, ALGORITHM_EC_P256, ALGORITHM_EC_P384, ALGORITHM_EC_P521
     }];
     // Required
     KeyMode key_mode = 3 [
@@ -553,7 +553,7 @@ message RotateKeyRequest {
       (buf.validate.field).cel = {
         id: "new_key_mode_defined"
         message: "The new key_mode must be one of the defined values (1-4)."
-        expression: "this in [1, 2, 3, 4]" // Allow all defined modes
+        expression: "this in [1, 2, 3, 4]" // Allow modes CONFIG_ROOT_KEY, PROVIDER_ROOT_KEY, REMOTE, PUBLIC_KEY_ONLY
       }
     ];
     // Required
@@ -617,6 +617,35 @@ message SetBaseKeyResponse {
   SimpleKasKey previous_base_key = 2; // The previous base key, if any
 }
 
+message MappedPolicyObject {
+  string id = 1; // The unique identifier of the policy object
+  string fqn = 2; // The fully qualified name of the policy object
+}
+
+message KeyMapping {
+  string kid = 1;
+  string kas_uri = 2;
+  repeated MappedPolicyObject namespace_mappings = 3; // List of namespaces mapped to the key
+  repeated MappedPolicyObject attribute_mappings = 4; // List of attribute definitions mapped to the key
+  repeated MappedPolicyObject value_mappings = 5; // List of attribute values mapped to the key
+}
+
+message ListKeyMappingsRequest {
+  oneof identifier {
+    option (buf.validate.oneof).required = false;
+    string id = 2 [(buf.validate.field).string.uuid = true]; // The unique identifier of the key to retrieve
+    KasKeyIdentifier key = 3;
+  }
+
+  policy.PageRequest pagination = 10; // Pagination request for the list of keys
+}
+
+message ListKeyMappingsResponse {
+  repeated KeyMapping key_mappings = 1; // The list of key mappings
+
+  policy.PageResponse pagination = 10; // Pagination response for the list of keys
+}
+
 service KeyAccessServerRegistryService {
   rpc ListKeyAccessServers(ListKeyAccessServersRequest) returns (ListKeyAccessServersResponse) {
     option (google.api.http) = {get: "/key-access-servers"};
@@ -660,4 +689,7 @@ service KeyAccessServerRegistryService {
 
   // Get Default kas keys
   rpc GetBaseKey(GetBaseKeyRequest) returns (GetBaseKeyResponse) {}
+
+  // Request to list key mappings in the Key Access Service.
+  rpc ListKeyMappings(ListKeyMappingsRequest) returns (ListKeyMappingsResponse) {}
 }

{otdf_python-0.4.4 → otdf_python-0.5.0}/otdf-python-proto/proto-files/policy/objects.proto

@@ -5,6 +5,7 @@ package policy;
 import "buf/validate/validate.proto";
 import "common/common.proto";
 import "google/protobuf/wrappers.proto";
+// import "google/protobuf/struct.proto";
 
 message SimpleKasPublicKey {
   Algorithm algorithm = 1;
@@ -447,7 +448,6 @@ message RegisteredResourceValue {
     // Common metadata
     common.Metadata metadata = 100;
   }
-
   string id = 1;
 
   string value = 2;
@@ -460,6 +460,50 @@ message RegisteredResourceValue {
   common.Metadata metadata = 100;
 }
 
+message Obligation {
+  string id = 1;
+
+  Namespace namespace = 2;
+
+  string name = 3;
+
+  repeated ObligationValue values = 4;
+  
+  common.Metadata metadata = 100;
+}
+
+message ObligationValue {
+  string id = 1;
+
+  Obligation obligation = 2;
+
+  string value = 3;
+
+  common.Metadata metadata = 100;
+}
+
+message ObligationTrigger {
+  string id = 1;
+
+  ObligationValue obligation_value = 2;
+
+  Action action = 3;
+
+  Value attribute_value = 4;
+
+  common.Metadata metadata = 100;
+}
+
+// message ObligationFulfiller {
+//   string id = 1;
+
+//   ObligationValue obligation_value = 2;
+
+//   google.protobuf.Struct conditionals = 3;
+
+//   common.Metadata metadata = 100;
+// }
+
 // Supported key algorithms.
 enum Algorithm {
   ALGORITHM_UNSPECIFIED = 0;

otdf_python-0.5.0/otdf-python-proto/proto-files/policy/obligations/obligations.proto

@@ -0,0 +1,260 @@
+syntax = "proto3";
+
+package policy.obligations;
+
+import "common/common.proto";
+import "policy/objects.proto";
+import "policy/selectors.proto";
+// import "google/protobuf/struct.proto";
+
+///
+/// Obligation
+///
+
+// Definitions
+message GetObligationRequest {
+    oneof identifier {
+        string id = 1;
+        string fqn = 2;
+    }
+}
+
+message GetObligationResponse {
+    policy.Obligation obligation = 1;
+}
+
+message GetObligationsByFQNsRequest {
+    repeated string fqns = 1;
+}
+
+message GetObligationsByFQNsResponse {
+    map<string, policy.Obligation> fqn_obligation_map = 1;
+}
+
+message CreateObligationRequest {
+    // Required
+    oneof namespace_identifier {
+        string id = 1;
+        string fqn = 2;
+    }
+    string name = 3;
+    // Optional
+    // Common metadata
+    common.MetadataMutable metadata = 100;
+}
+
+message CreateObligationResponse {
+    policy.Obligation obligation = 1;
+}
+
+message UpdateObligationRequest {
+    // Required
+    string id = 1;
+
+    // Optional
+    string name = 2;
+    common.MetadataMutable metadata = 100;
+    common.MetadataUpdateEnum metadata_update_behavior = 101;
+}
+
+message UpdateObligationResponse {
+    policy.Obligation obligation = 1;
+}
+
+message DeleteObligationRequest {
+    oneof identifier {
+        string id = 1;
+        string fqn = 2;
+    }
+}
+
+message DeleteObligationResponse {
+    policy.Obligation obligation = 1;
+}
+
+message ListObligationsRequest {
+    // Optional
+    // Namespace ID or FQN
+    oneof namespace_identifier {
+        string id = 1;
+        string fqn = 2;
+    }
+
+    // Optional
+    policy.PageRequest pagination = 10;
+}
+
+message ListObligationsResponse {
+    repeated policy.Obligation obligations = 1;
+
+    policy.PageResponse pagination = 10;
+}
+
+// Values
+message GetObligationValueRequest {
+    oneof identifier {
+        string id = 1;
+        string fqn = 2;
+    }
+}
+
+message GetObligationValueResponse {
+    policy.ObligationValue value = 1;
+}
+
+message GetObligationValuesByFQNsRequest {
+    repeated string fqns = 1;
+}
+
+message GetObligationValuesByFQNsResponse {
+    map<string, policy.ObligationValue> fqn_value_map = 1;
+}
+
+message CreateObligationValueRequest {
+    // Required
+    oneof obligation_identifier {
+        string id = 1;
+        string fqn = 2;
+    }
+    string value = 3;
+
+    // Optional
+    // Common metadata
+    common.MetadataMutable metadata = 100;
+}
+
+message CreateObligationValueResponse {
+    policy.ObligationValue value = 1;
+}
+
+message UpdateObligationValueRequest {
+    // Required
+    string id = 1;
+    
+    // Optional
+    string value = 2;
+    common.MetadataMutable metadata = 100;
+    common.MetadataUpdateEnum metadata_update_behavior = 101;
+}
+
+message UpdateObligationValueResponse {
+    policy.ObligationValue value = 1;
+}
+
+message DeleteObligationValueRequest {
+    oneof identifier {
+        string id = 1;
+        string fqn = 2;
+    }
+}
+
+message DeleteObligationValueResponse {
+    policy.ObligationValue value = 1;
+}
+
+// Triggers
+message AddObligationTriggerRequest {
+    // Required
+    string obligation_value_id = 1;
+    string action_id = 2;
+    string attribute_value_id = 3;
+    // Optional
+    // Common metadata
+    common.MetadataMutable metadata = 100;
+}
+
+message AddObligationTriggerResponse {
+    policy.ObligationTrigger trigger = 1;
+}
+
+message RemoveObligationTriggerRequest {
+    string id = 1;
+}
+
+message RemoveObligationTriggerResponse {
+    policy.ObligationTrigger trigger = 1;
+}
+
+// Fulfillers
+// message AddObligationFulfillerRequest {
+//     // Required
+//     string obligation_value_id = 1;
+//     google.protobuf.Struct conditionals = 2;
+//     // Optional
+//     // Common metadata
+//     common.MetadataMutable metadata = 100;
+// }
+
+// message AddObligationFulfillerResponse {
+//     policy.ObligationFulfiller fulfiller = 1;
+// }
+
+// message RemoveObligationFulfillerRequest {
+//     string id = 1;
+// }
+
+// message RemoveObligationFulfillerResponse {
+//     policy.ObligationFulfiller fulfiller = 1;
+// }
+
+///
+/// Obligation Service
+///
+service Service {
+
+   /*--------------------------------------*
+    * Obligation RPCs
+    *--------------------------------------*/
+
+    rpc ListObligations(ListObligationsRequest) returns (ListObligationsResponse) {
+        option idempotency_level = NO_SIDE_EFFECTS;
+    }
+
+    rpc GetObligation(GetObligationRequest) returns (GetObligationResponse) {
+        option idempotency_level = NO_SIDE_EFFECTS;
+    }
+
+    rpc GetObligationsByFQNs(GetObligationsByFQNsRequest) returns (GetObligationsByFQNsResponse) {
+        option idempotency_level = NO_SIDE_EFFECTS;
+    }
+
+    rpc CreateObligation(CreateObligationRequest) returns (CreateObligationResponse) {}
+
+    rpc UpdateObligation(UpdateObligationRequest) returns (UpdateObligationResponse) {}
+    
+    rpc DeleteObligation(DeleteObligationRequest) returns (DeleteObligationResponse) {}
+
+   /*--------------------------------------*
+    * Value RPCs
+    *--------------------------------------*/
+
+    rpc GetObligationValue(GetObligationValueRequest) returns (GetObligationValueResponse) {
+        option idempotency_level = NO_SIDE_EFFECTS;
+    }
+
+    rpc GetObligationValuesByFQNs(GetObligationValuesByFQNsRequest) returns (GetObligationValuesByFQNsResponse) {
+        option idempotency_level = NO_SIDE_EFFECTS;
+    }
+
+    rpc CreateObligationValue(CreateObligationValueRequest) returns (CreateObligationValueResponse) {}
+
+    rpc UpdateObligationValue(UpdateObligationValueRequest) returns (UpdateObligationValueResponse) {}
+    
+    rpc DeleteObligationValue(DeleteObligationValueRequest) returns (DeleteObligationValueResponse) {}
+
+   /*--------------------------------------*
+    * Trigger RPCs
+    *--------------------------------------*/
+    
+    rpc AddObligationTrigger(AddObligationTriggerRequest) returns (AddObligationTriggerResponse) {}
+
+    rpc RemoveObligationTrigger(RemoveObligationTriggerRequest) returns (RemoveObligationTriggerResponse) {}
+
+   /*--------------------------------------*
+    * Fulfiller RPCs
+    *--------------------------------------*/
+
+    // rpc AddObligationFulfiller(AddObligationFulfillerRequest) returns (AddObligationFulfillerResponse) {}
+
+    // rpc RemoveObligationFulfiller(RemoveObligationFulfillerRequest) returns (RemoveObligationFulfillerResponse) {}   
+}

{otdf_python-0.4.4 → otdf_python-0.5.0}/otdf-python-proto/proto-files/policy/unsafe/unsafe.proto

@@ -167,14 +167,21 @@ message UnsafeDeleteAttributeValueResponse {
 }
 
 // WARNING!!
+// Deleting a key will make it so that ANY TDF that was encrypted with this key cannot be decrypted by the platform.
 message UnsafeDeleteKasKeyRequest {
   // Required
   // UUID of the Key
   string id = 1 [(buf.validate.field).string.uuid = true];
+  // Required
+  // The key id assigned to this key (Ex: "key-1")
+  string kid = 2 [(buf.validate.field).required = true];
+  // Required
+  // The kas uri for which this key belongs (Ex: "https://kas.example.com:8080")
+  string kas_uri = 3 [(buf.validate.field).required = true];
 }
 
 message UnsafeDeleteKasKeyResponse {
-  policy.Key key = 1;
+  policy.KasKey key = 1;
 }
 
 ///

{otdf_python-0.4.4 → otdf_python-0.5.0}/otdf-python-proto/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "otdf-python-proto"
-version = "0.4.4"
+version = "0.5.0"
 description = "Generated protobuf files for OpenTDF Python SDK"
 readme = "README.md"
 authors = [
@@ -8,9 +8,10 @@ authors = [
 ]
 requires-python = ">=3.10"
 dependencies = [
-    "connect-python[compiler]>=0.4.2,<0.5",
+    "connect-python>=0.6.0",
     "protobuf>=6.31.1",
     "googleapis-common-protos>=1.66.0",
+    "protoc-gen-openapiv2>=0.0.1",
     # Legacy gRPC support (may be removed in future versions)
     "grpcio>=1.74.0",
     "grpcio-tools>=1.74.0",

{otdf_python-0.4.4 → otdf_python-0.5.0}/otdf-python-proto/scripts/generate_connect_proto.py

@@ -48,7 +48,7 @@ def check_dependencies() -> bool:
 
 def copy_opentdf_proto_files(proto_gen_dir: Path, git_tag: str | None = None) -> bool:
     """Clone OpenTDF platform repository and copy all proto files."""
-    GIT_TAG = git_tag or "service/v0.7.2"
+    GIT_TAG = git_tag or "service/v0.8.0"
     REPO_URL = "https://github.com/opentdf/platform.git"
 
     temp_repo_dir = proto_gen_dir / "temp_platform_repo"
@@ -153,28 +153,33 @@ def run_buf_generate(proto_gen_dir: Path) -> bool:
         connect_plugin_path = result.stdout.strip()
         print(f"Using Connect plugin at: {connect_plugin_path}")
 
-        # Update buf.gen.yaml with the correct absolute path for the local plugin
+        # Update buf.gen.yaml with the correct absolute path for the local plugin,
+        # then restore the original content after buf generate runs.
         buf_gen_path = proto_gen_dir / "buf.gen.yaml"
         with buf_gen_path.open() as f:
-            content = f.read()
+            original_content = f.read()
 
         updated_content = re.sub(
             r"- local:\s+\S*protoc-gen-connect[_-]python\S*",
             lambda _: f"- local: {connect_plugin_path}",
-            content,
+            original_content,
         )
 
-        with buf_gen_path.open("w") as f:
-            f.write(updated_content)
-
-        # Run buf generate
-        subprocess.run(
-            ["buf", "generate"],
-            cwd=proto_gen_dir,
-            capture_output=True,
-            text=True,
-            check=True,
-        )
+        try:
+            with buf_gen_path.open("w") as f:
+                f.write(updated_content)
+
+            # Run buf generate
+            subprocess.run(
+                ["buf", "generate"],
+                cwd=proto_gen_dir,
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+        finally:
+            with buf_gen_path.open("w") as f:
+                f.write(original_content)
 
         print("✓ Successfully generated protobuf and Connect RPC files")
         return True

otdf_python-0.5.0/otdf-python-proto/src/otdf_python_proto/__init__.py

@@ -0,0 +1,83 @@
+"""OpenTDF Python Protocol Buffers Package.
+
+This package contains generated Python code from OpenTDF protocol buffer definitions.
+It includes modules for authorization, common types, entities, policy management,
+and other OpenTDF services.
+"""
+import sys
+import types
+from pathlib import Path
+from importlib import metadata
+
+try:
+    __version__ = metadata.version("otdf-python-proto")
+except metadata.PackageNotFoundError:
+    # package is not installed, e.g., in development
+    __version__ = "0.0.0"
+
+# Marker attribute placed on stub modules created by _register_subpackage_aliases.
+# Used to distinguish our stubs from pre-existing third-party packages so we never
+# clobber the latter.
+_STUB_ATTR = "_otdf_python_proto_stub"
+
+
+def _register_subpackage_aliases() -> None:
+    # connect-generated files use absolute top-level imports (e.g. `import kas.kas_pb2`).
+    # Register each subpackage as a top-level sys.modules alias so those imports resolve
+    # without mutating sys.path for the whole process.
+    #
+    # Called twice: before the explicit imports below (creates lightweight stubs so that
+    # load-time absolute imports inside connect files succeed) and after (upgrades stubs
+    # to the fully-initialised module objects).
+    pkg_dir = Path(__file__).parent
+    for child in pkg_dir.iterdir():
+        if not child.is_dir() or not (child / "__init__.py").exists() or child.name.startswith("_"):
+            continue
+        name = child.name
+        current = sys.modules.get(name)
+        # Never overwrite a pre-existing entry that we did not create.
+        if current is not None and not getattr(current, _STUB_ATTR, False):
+            continue
+        full_name = f"otdf_python_proto.{name}"
+        if full_name in sys.modules:
+            # Real module is loaded; point the alias at it.
+            sys.modules[name] = sys.modules[full_name]
+        else:
+            # Subpackage not yet imported; create a lightweight stub with __path__ set
+            # so sub-imports like `import authorization.authorization_pb2` can locate
+            # modules on disk without needing sys.path mutation.
+            stub = types.ModuleType(name)
+            stub.__path__ = [str(child)]  # type: ignore[attr-defined]
+            stub.__package__ = name
+            stub.__file__ = str(child / "__init__.py")
+            setattr(stub, _STUB_ATTR, True)
+            sys.modules[name] = stub
+
+
+# First pass: create stubs so that connect-generated files can resolve absolute
+# top-level imports (e.g. `import kas.kas_pb2`) at subpackage load time.
+_register_subpackage_aliases()
+
+# Import submodules to make them available.
+# Note: authorization, entityresolution, wellknownconfiguration and policy subdirectories
+# are imported lazily to avoid import errors from generated protobuf files.
+from . import common
+from . import entity
+from . import kas
+from . import legacy_grpc
+from . import logger
+from . import policy
+
+# Second pass: upgrade stubs for the explicitly imported subpackages to the
+# fully-initialised module objects.
+_register_subpackage_aliases()
+
+# Export main module categories
+__all__ = [
+    "common",
+    "entity",
+    "kas",
+    "legacy_grpc",
+    "logger",
+    "policy",
+]