perd-contracts 0.1.0__py3-none-any.whl

manifest_from_descriptor.py

@@ -0,0 +1,209 @@
+r"""Derive an :class:`OperationSpec` manifest from a ``FileDescriptorSet``.
+
+This module is the mechanism that makes contract drift structurally impossible.
+
+In the v1 system the operation manifest was untyped JSON written to Firestore by
+the scaffold builder, while the ``.proto`` describing the same operations was
+uploaded separately to GCS. Two independently-shipped descriptions of one
+contract, cross-checked by nothing. A redeploy that updated one and not the
+other surfaced as a field-level parse error deep inside a running job.
+
+Here there is exactly one artifact -- the ``FileDescriptorSet`` embedded in the
+worker image -- and the manifest is a *projection* of it. There is no second
+description to drift from, and
+
+.. math::
+
+    \mathrm{contract\_hash} = \operatorname{SHA256}\!\left(\mathrm{FileDescriptorSet}\right)
+
+is the identity that the publisher, the client, and the orchestrator all pin to.
+
+where:
+
+- :math:`\mathrm{FileDescriptorSet}`: the serialized protobuf descriptor of a workflow's generated schema, produced once at build time and embedded in the worker image
+- :math:`\mathrm{contract\_hash}`: the value stored on the published version, pinned by the client, and re-verified by the orchestrator at worker registration
+
+Naming convention consumed here, emitted by the worker SDK's code generator:
+
+- an operation ``foo_bar`` produces RPC ``FooBar`` with messages ``FooBarRequest`` and ``FooBarResponse``
+- input-stream item fields live on the request message and are declared in the SDK-emitted ``perd.operation`` option; absent that, they are inferred from the RPC's client-streaming flag
+"""
+
+from __future__ import annotations
+
+import hashlib
+import re
+from dataclasses import dataclass
+
+from google.protobuf import descriptor_pb2
+
+# perd.v1.CallMode values, mirrored here so this tool has no import cycle back
+# through generated code it may itself be used to produce.
+CALL_MODE_UNARY = 1
+CALL_MODE_INPUT_STREAM = 2
+CALL_MODE_OUTPUT_STREAM = 3
+CALL_MODE_BI_DI = 4
+
+_MODE_BY_STREAMING = {
+    (False, False): CALL_MODE_UNARY,
+    (True, False): CALL_MODE_INPUT_STREAM,
+    (False, True): CALL_MODE_OUTPUT_STREAM,
+    (True, True): CALL_MODE_BI_DI,
+}
+
+_PROTO_TYPE_NAMES = {
+    descriptor_pb2.FieldDescriptorProto.TYPE_DOUBLE: "double",
+    descriptor_pb2.FieldDescriptorProto.TYPE_FLOAT: "float",
+    descriptor_pb2.FieldDescriptorProto.TYPE_INT64: "int64",
+    descriptor_pb2.FieldDescriptorProto.TYPE_UINT64: "uint64",
+    descriptor_pb2.FieldDescriptorProto.TYPE_INT32: "int32",
+    descriptor_pb2.FieldDescriptorProto.TYPE_BOOL: "bool",
+    descriptor_pb2.FieldDescriptorProto.TYPE_STRING: "string",
+    descriptor_pb2.FieldDescriptorProto.TYPE_BYTES: "bytes",
+    descriptor_pb2.FieldDescriptorProto.TYPE_UINT32: "uint32",
+}
+
+_STREAM_ITEM_RE = re.compile(r"^item_(\d+)$")
+
+
+class ManifestError(ValueError):
+    """Raised when a descriptor set cannot yield a well-formed manifest."""
+
+
+@dataclass(frozen=True, slots=True)
+class Field:
+    """One parameter or result field projected from a descriptor."""
+
+    name: str
+    proto_type: str
+    field_number: int
+    optional: bool
+
+
+@dataclass(frozen=True, slots=True)
+class Operation:
+    """One callable operation, fully described by the descriptor set."""
+
+    function_name: str
+    rpc_name: str
+    mode: int
+    params: tuple[Field, ...]
+    input_stream_fields: tuple[Field, ...]
+    output_fields: tuple[Field, ...]
+    docstring: str | None = None
+
+
+def contract_hash(descriptor_set: bytes) -> str:
+    r"""Return the canonical contract identity for a descriptor set.
+
+    .. math::
+
+        h = \operatorname{SHA256}(D)
+
+    where:
+
+    - :math:`D`: the serialized ``FileDescriptorSet`` bytes exactly as embedded in the worker image
+    - :math:`h`: lowercase hex digest, compared with :func:`hmac.compare_digest` at registration
+    """
+    return hashlib.sha256(descriptor_set).hexdigest()
+
+
+def _snake_case(name: str) -> str:
+    """``FooBar`` -> ``foo_bar``. Inverse of the SDK's RPC naming rule."""
+    return re.sub(r"(?<!^)(?=[A-Z])", "_", name).lower()
+
+
+def _fields_of(msg: descriptor_pb2.DescriptorProto) -> tuple[Field, ...]:
+    out = []
+    for f in msg.field:
+        proto_type = _PROTO_TYPE_NAMES.get(f.type)
+        if proto_type is None:
+            raise ManifestError(
+                f"Field '{msg.name}.{f.name}' has unsupported type {f.type}. "
+                "Workflow signatures may only use scalar types."
+            )
+        out.append(
+            Field(
+                name=f.name,
+                proto_type=proto_type,
+                field_number=f.number,
+                # proto3 explicit presence: the SDK marks every result field
+                # `optional` so a returned 0 / "" / False is distinguishable
+                # from an absent field. v1's MessageToDict elided all of them.
+                optional=f.proto3_optional,
+            )
+        )
+    return tuple(out)
+
+
+def _partition_request_fields(
+    fields: tuple[Field, ...], client_streaming: bool
+) -> tuple[tuple[Field, ...], tuple[Field, ...]]:
+    """Split request fields into (per-call params, per-stream-item fields).
+
+    Stream item fields are named ``item_1``, ``item_2``, ... by the SDK's
+    generator. Everything else is a trailing unary parameter, which is the
+    shape DCA_PINN uses: a 7-tuple input stream plus 12 hyperparameters.
+    """
+    if not client_streaming:
+        return fields, ()
+    matches = {f.name: _STREAM_ITEM_RE.match(f.name) for f in fields}
+    items = [f for f in fields if matches[f.name]]
+    params = [f for f in fields if not matches[f.name]]
+
+    def item_index(f: Field) -> int:
+        match = matches[f.name]
+        assert match is not None  # items was filtered on exactly this
+        return int(match.group(1))
+
+    items.sort(key=item_index)
+    return tuple(params), tuple(items)
+
+
+def build_manifest(descriptor_set: bytes) -> tuple[Operation, ...]:
+    """Project every RPC in ``descriptor_set`` into an :class:`Operation`.
+
+    Raises:
+        ManifestError: if the set has no service, or references a message type
+            that is not defined within the same set.
+    """
+    fds = descriptor_pb2.FileDescriptorSet()
+    fds.ParseFromString(descriptor_set)
+
+    messages: dict[str, descriptor_pb2.DescriptorProto] = {}
+    services: list[descriptor_pb2.ServiceDescriptorProto] = []
+    for file in fds.file:
+        pkg = file.package
+        for msg in file.message_type:
+            messages[f".{pkg}.{msg.name}" if pkg else f".{msg.name}"] = msg
+        services.extend(file.service)
+
+    if not services:
+        raise ManifestError("Descriptor set defines no service.")
+
+    operations: list[Operation] = []
+    for service in services:
+        for method in service.method:
+            req = messages.get(method.input_type)
+            res = messages.get(method.output_type)
+            if req is None or res is None:
+                raise ManifestError(
+                    f"RPC '{method.name}' references a message outside the "
+                    f"descriptor set ({method.input_type} / {method.output_type})."
+                )
+            params, stream_fields = _partition_request_fields(
+                _fields_of(req), method.client_streaming
+            )
+            operations.append(
+                Operation(
+                    function_name=_snake_case(method.name),
+                    rpc_name=method.name,
+                    mode=_MODE_BY_STREAMING[
+                        (method.client_streaming, method.server_streaming)
+                    ],
+                    params=params,
+                    input_stream_fields=stream_fields,
+                    output_fields=_fields_of(res),
+                )
+            )
+    return tuple(operations)

perd/v1/account_connect.py

@@ -0,0 +1,253 @@
+# -*- coding: utf-8 -*-
+# Generated by https://github.com/connectrpc/connect-python.  DO NOT EDIT!
+# source: perd/v1/account.proto
+
+from collections.abc import AsyncGenerator, AsyncIterator, Iterable, Iterator, Mapping
+from typing import Protocol
+
+from connectrpc.client import ConnectClient, ConnectClientSync
+from connectrpc.code import Code
+from connectrpc.compression import Compression
+from connectrpc.errors import ConnectError
+from connectrpc.interceptor import Interceptor, InterceptorSync
+from connectrpc.method import IdempotencyLevel, MethodInfo
+from connectrpc.request import Headers, RequestContext
+from connectrpc.server import ConnectASGIApplication, ConnectWSGIApplication, Endpoint, EndpointSync
+import perd.v1.account_pb2 as perd_dot_v1_dot_account__pb2
+
+
+class AccountService(Protocol):
+    async def list_api_keys(self, request: perd_dot_v1_dot_account__pb2.ListApiKeysRequest, ctx: RequestContext) -> perd_dot_v1_dot_account__pb2.ListApiKeysResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+    async def issue_api_key(self, request: perd_dot_v1_dot_account__pb2.IssueApiKeyRequest, ctx: RequestContext) -> perd_dot_v1_dot_account__pb2.IssueApiKeyResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+    async def revoke_api_key(self, request: perd_dot_v1_dot_account__pb2.RevokeApiKeyRequest, ctx: RequestContext) -> perd_dot_v1_dot_account__pb2.RevokeApiKeyResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class AccountServiceASGIApplication(ConnectASGIApplication[AccountService]):
+    def __init__(self, service: AccountService | AsyncGenerator[AccountService], *, interceptors: Iterable[Interceptor]=(), read_max_bytes: int | None = None, compressions: Iterable[Compression] | None = None) -> None:
+        super().__init__(
+            service=service,
+            endpoints=lambda svc: {
+                "/perd.v1.AccountService/ListApiKeys": Endpoint.unary(
+                    method=MethodInfo(
+                        name="ListApiKeys",
+                        service_name="perd.v1.AccountService",
+                        input=perd_dot_v1_dot_account__pb2.ListApiKeysRequest,
+                        output=perd_dot_v1_dot_account__pb2.ListApiKeysResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=svc.list_api_keys,
+                ),
+                "/perd.v1.AccountService/IssueApiKey": Endpoint.unary(
+                    method=MethodInfo(
+                        name="IssueApiKey",
+                        service_name="perd.v1.AccountService",
+                        input=perd_dot_v1_dot_account__pb2.IssueApiKeyRequest,
+                        output=perd_dot_v1_dot_account__pb2.IssueApiKeyResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=svc.issue_api_key,
+                ),
+                "/perd.v1.AccountService/RevokeApiKey": Endpoint.unary(
+                    method=MethodInfo(
+                        name="RevokeApiKey",
+                        service_name="perd.v1.AccountService",
+                        input=perd_dot_v1_dot_account__pb2.RevokeApiKeyRequest,
+                        output=perd_dot_v1_dot_account__pb2.RevokeApiKeyResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=svc.revoke_api_key,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+            compressions=compressions,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/perd.v1.AccountService"
+
+
+class AccountServiceClient(ConnectClient):
+    async def list_api_keys(
+        self,
+        request: perd_dot_v1_dot_account__pb2.ListApiKeysRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> perd_dot_v1_dot_account__pb2.ListApiKeysResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="ListApiKeys",
+                service_name="perd.v1.AccountService",
+                input=perd_dot_v1_dot_account__pb2.ListApiKeysRequest,
+                output=perd_dot_v1_dot_account__pb2.ListApiKeysResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    async def issue_api_key(
+        self,
+        request: perd_dot_v1_dot_account__pb2.IssueApiKeyRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> perd_dot_v1_dot_account__pb2.IssueApiKeyResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="IssueApiKey",
+                service_name="perd.v1.AccountService",
+                input=perd_dot_v1_dot_account__pb2.IssueApiKeyRequest,
+                output=perd_dot_v1_dot_account__pb2.IssueApiKeyResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    async def revoke_api_key(
+        self,
+        request: perd_dot_v1_dot_account__pb2.RevokeApiKeyRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> perd_dot_v1_dot_account__pb2.RevokeApiKeyResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="RevokeApiKey",
+                service_name="perd.v1.AccountService",
+                input=perd_dot_v1_dot_account__pb2.RevokeApiKeyRequest,
+                output=perd_dot_v1_dot_account__pb2.RevokeApiKeyResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+
+class AccountServiceSync(Protocol):
+    def list_api_keys(self, request: perd_dot_v1_dot_account__pb2.ListApiKeysRequest, ctx: RequestContext) -> perd_dot_v1_dot_account__pb2.ListApiKeysResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def issue_api_key(self, request: perd_dot_v1_dot_account__pb2.IssueApiKeyRequest, ctx: RequestContext) -> perd_dot_v1_dot_account__pb2.IssueApiKeyResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def revoke_api_key(self, request: perd_dot_v1_dot_account__pb2.RevokeApiKeyRequest, ctx: RequestContext) -> perd_dot_v1_dot_account__pb2.RevokeApiKeyResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class AccountServiceWSGIApplication(ConnectWSGIApplication):
+    def __init__(self, service: AccountServiceSync, interceptors: Iterable[InterceptorSync]=(), read_max_bytes: int | None = None, compressions: Iterable[Compression] | None = None) -> None:
+        super().__init__(
+            endpoints={
+                "/perd.v1.AccountService/ListApiKeys": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="ListApiKeys",
+                        service_name="perd.v1.AccountService",
+                        input=perd_dot_v1_dot_account__pb2.ListApiKeysRequest,
+                        output=perd_dot_v1_dot_account__pb2.ListApiKeysResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.list_api_keys,
+                ),
+                "/perd.v1.AccountService/IssueApiKey": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="IssueApiKey",
+                        service_name="perd.v1.AccountService",
+                        input=perd_dot_v1_dot_account__pb2.IssueApiKeyRequest,
+                        output=perd_dot_v1_dot_account__pb2.IssueApiKeyResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.issue_api_key,
+                ),
+                "/perd.v1.AccountService/RevokeApiKey": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="RevokeApiKey",
+                        service_name="perd.v1.AccountService",
+                        input=perd_dot_v1_dot_account__pb2.RevokeApiKeyRequest,
+                        output=perd_dot_v1_dot_account__pb2.RevokeApiKeyResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.revoke_api_key,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+            compressions=compressions,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/perd.v1.AccountService"
+
+
+class AccountServiceClientSync(ConnectClientSync):
+    def list_api_keys(
+        self,
+        request: perd_dot_v1_dot_account__pb2.ListApiKeysRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> perd_dot_v1_dot_account__pb2.ListApiKeysResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="ListApiKeys",
+                service_name="perd.v1.AccountService",
+                input=perd_dot_v1_dot_account__pb2.ListApiKeysRequest,
+                output=perd_dot_v1_dot_account__pb2.ListApiKeysResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def issue_api_key(
+        self,
+        request: perd_dot_v1_dot_account__pb2.IssueApiKeyRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> perd_dot_v1_dot_account__pb2.IssueApiKeyResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="IssueApiKey",
+                service_name="perd.v1.AccountService",
+                input=perd_dot_v1_dot_account__pb2.IssueApiKeyRequest,
+                output=perd_dot_v1_dot_account__pb2.IssueApiKeyResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def revoke_api_key(
+        self,
+        request: perd_dot_v1_dot_account__pb2.RevokeApiKeyRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> perd_dot_v1_dot_account__pb2.RevokeApiKeyResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="RevokeApiKey",
+                service_name="perd.v1.AccountService",
+                input=perd_dot_v1_dot_account__pb2.RevokeApiKeyRequest,
+                output=perd_dot_v1_dot_account__pb2.RevokeApiKeyResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )

perd/v1/account_pb2.py

@@ -0,0 +1,52 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# NO CHECKED-IN PROTOBUF GENCODE
+# source: perd/v1/account.proto
+# Protobuf Python Version: 5.29.3
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import runtime_version as _runtime_version
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+_runtime_version.ValidateProtobufRuntimeVersion(
+    _runtime_version.Domain.PUBLIC,
+    5,
+    29,
+    3,
+    '',
+    'perd/v1/account.proto'
+)
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x15perd/v1/account.proto\x12\x07perd.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\xcc\x01\n\x06\x41piKey\x12\x15\n\x06key_id\x18\x01 \x01(\tR\x05keyId\x12!\n\x0c\x64isplay_name\x18\x02 \x01(\tR\x0b\x64isplayName\x12\x39\n\ncreated_at\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tcreatedAt\x12>\n\nrevoked_at\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampH\x00R\trevokedAt\x88\x01\x01\x42\r\n\x0b_revoked_at\"\x14\n\x12ListApiKeysRequest\":\n\x13ListApiKeysResponse\x12#\n\x04keys\x18\x01 \x03(\x0b\x32\x0f.perd.v1.ApiKeyR\x04keys\"7\n\x12IssueApiKeyRequest\x12!\n\x0c\x64isplay_name\x18\x01 \x01(\tR\x0b\x64isplayName\"Q\n\x13IssueApiKeyResponse\x12!\n\x03key\x18\x01 \x01(\x0b\x32\x0f.perd.v1.ApiKeyR\x03key\x12\x17\n\x07\x61pi_key\x18\x02 \x01(\tR\x06\x61piKey\",\n\x13RevokeApiKeyRequest\x12\x15\n\x06key_id\x18\x01 \x01(\tR\x05keyId\"9\n\x14RevokeApiKeyResponse\x12!\n\x03key\x18\x01 \x01(\x0b\x32\x0f.perd.v1.ApiKeyR\x03key2\xf1\x01\n\x0e\x41\x63\x63ountService\x12H\n\x0bListApiKeys\x12\x1b.perd.v1.ListApiKeysRequest\x1a\x1c.perd.v1.ListApiKeysResponse\x12H\n\x0bIssueApiKey\x12\x1b.perd.v1.IssueApiKeyRequest\x1a\x1c.perd.v1.IssueApiKeyResponse\x12K\n\x0cRevokeApiKey\x12\x1c.perd.v1.RevokeApiKeyRequest\x1a\x1d.perd.v1.RevokeApiKeyResponseBX\n\x0b\x63om.perd.v1B\x0c\x41\x63\x63ountProtoP\x01\xa2\x02\x03PXX\xaa\x02\x07Perd.V1\xca\x02\x07Perd\\V1\xe2\x02\x13Perd\\V1\\GPBMetadata\xea\x02\x08Perd::V1b\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'perd.v1.account_pb2', _globals)
+if not _descriptor._USE_C_DESCRIPTORS:
+  _globals['DESCRIPTOR']._loaded_options = None
+  _globals['DESCRIPTOR']._serialized_options = b'\n\013com.perd.v1B\014AccountProtoP\001\242\002\003PXX\252\002\007Perd.V1\312\002\007Perd\\V1\342\002\023Perd\\V1\\GPBMetadata\352\002\010Perd::V1'
+  _globals['_APIKEY']._serialized_start=68
+  _globals['_APIKEY']._serialized_end=272
+  _globals['_LISTAPIKEYSREQUEST']._serialized_start=274
+  _globals['_LISTAPIKEYSREQUEST']._serialized_end=294
+  _globals['_LISTAPIKEYSRESPONSE']._serialized_start=296
+  _globals['_LISTAPIKEYSRESPONSE']._serialized_end=354
+  _globals['_ISSUEAPIKEYREQUEST']._serialized_start=356
+  _globals['_ISSUEAPIKEYREQUEST']._serialized_end=411
+  _globals['_ISSUEAPIKEYRESPONSE']._serialized_start=413
+  _globals['_ISSUEAPIKEYRESPONSE']._serialized_end=494
+  _globals['_REVOKEAPIKEYREQUEST']._serialized_start=496
+  _globals['_REVOKEAPIKEYREQUEST']._serialized_end=540
+  _globals['_REVOKEAPIKEYRESPONSE']._serialized_start=542
+  _globals['_REVOKEAPIKEYRESPONSE']._serialized_end=599
+  _globals['_ACCOUNTSERVICE']._serialized_start=602
+  _globals['_ACCOUNTSERVICE']._serialized_end=843
+# @@protoc_insertion_point(module_scope)

perd/v1/account_pb2.pyi

@@ -0,0 +1,55 @@
+from google.protobuf import timestamp_pb2 as _timestamp_pb2
+from google.protobuf.internal import containers as _containers
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from typing import ClassVar as _ClassVar, Iterable as _Iterable, Mapping as _Mapping, Optional as _Optional, Union as _Union
+
+DESCRIPTOR: _descriptor.FileDescriptor
+
+class ApiKey(_message.Message):
+    __slots__ = ("key_id", "display_name", "created_at", "revoked_at")
+    KEY_ID_FIELD_NUMBER: _ClassVar[int]
+    DISPLAY_NAME_FIELD_NUMBER: _ClassVar[int]
+    CREATED_AT_FIELD_NUMBER: _ClassVar[int]
+    REVOKED_AT_FIELD_NUMBER: _ClassVar[int]
+    key_id: str
+    display_name: str
+    created_at: _timestamp_pb2.Timestamp
+    revoked_at: _timestamp_pb2.Timestamp
+    def __init__(self, key_id: _Optional[str] = ..., display_name: _Optional[str] = ..., created_at: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., revoked_at: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ...) -> None: ...
+
+class ListApiKeysRequest(_message.Message):
+    __slots__ = ()
+    def __init__(self) -> None: ...
+
+class ListApiKeysResponse(_message.Message):
+    __slots__ = ("keys",)
+    KEYS_FIELD_NUMBER: _ClassVar[int]
+    keys: _containers.RepeatedCompositeFieldContainer[ApiKey]
+    def __init__(self, keys: _Optional[_Iterable[_Union[ApiKey, _Mapping]]] = ...) -> None: ...
+
+class IssueApiKeyRequest(_message.Message):
+    __slots__ = ("display_name",)
+    DISPLAY_NAME_FIELD_NUMBER: _ClassVar[int]
+    display_name: str
+    def __init__(self, display_name: _Optional[str] = ...) -> None: ...
+
+class IssueApiKeyResponse(_message.Message):
+    __slots__ = ("key", "api_key")
+    KEY_FIELD_NUMBER: _ClassVar[int]
+    API_KEY_FIELD_NUMBER: _ClassVar[int]
+    key: ApiKey
+    api_key: str
+    def __init__(self, key: _Optional[_Union[ApiKey, _Mapping]] = ..., api_key: _Optional[str] = ...) -> None: ...
+
+class RevokeApiKeyRequest(_message.Message):
+    __slots__ = ("key_id",)
+    KEY_ID_FIELD_NUMBER: _ClassVar[int]
+    key_id: str
+    def __init__(self, key_id: _Optional[str] = ...) -> None: ...
+
+class RevokeApiKeyResponse(_message.Message):
+    __slots__ = ("key",)
+    KEY_FIELD_NUMBER: _ClassVar[int]
+    key: ApiKey
+    def __init__(self, key: _Optional[_Union[ApiKey, _Mapping]] = ...) -> None: ...

perd/v1/common_pb2.py

@@ -0,0 +1,52 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# NO CHECKED-IN PROTOBUF GENCODE
+# source: perd/v1/common.proto
+# Protobuf Python Version: 5.29.3
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import runtime_version as _runtime_version
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+_runtime_version.ValidateProtobufRuntimeVersion(
+    _runtime_version.Domain.PUBLIC,
+    5,
+    29,
+    3,
+    '',
+    'perd/v1/common.proto'
+)
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x14perd/v1/common.proto\x12\x07perd.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\x8d\x02\n\x07\x46\x61ilure\x12(\n\x04\x63ode\x18\x01 \x01(\x0e\x32\x14.perd.v1.FailureCodeR\x04\x63ode\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x1c\n\tretryable\x18\x03 \x01(\x08R\tretryable\x12)\n\x0eretry_after_ms\x18\x04 \x01(\rH\x00R\x0cretryAfterMs\x88\x01\x01\x12%\n\x0bremediation\x18\x05 \x01(\tH\x01R\x0bremediation\x88\x01\x01\x12\x1e\n\x08trace_id\x18\x06 \x01(\tH\x02R\x07traceId\x88\x01\x01\x42\x11\n\x0f_retry_after_msB\x0e\n\x0c_remediationB\x0b\n\t_trace_id\"m\n\x0bWorkflowRef\x12\x1f\n\x0bworkflow_id\x18\x01 \x01(\tR\nworkflowId\x12\x18\n\x07version\x18\x02 \x01(\tR\x07version\x12#\n\rcontract_hash\x18\x03 \x01(\tR\x0c\x63ontractHash\"b\n\x05\x41\x63tor\x12\x17\n\x07user_id\x18\x01 \x01(\tR\x06userId\x12,\n\x0forganization_id\x18\x02 \x01(\tH\x00R\x0eorganizationId\x88\x01\x01\x42\x12\n\x10_organization_id\"\xc5\x01\n\nAuditStamp\x12\x39\n\ncreated_at\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\tcreatedAt\x12>\n\nupdated_at\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampH\x00R\tupdatedAt\x88\x01\x01\x12-\n\ncreated_by\x18\x03 \x01(\x0b\x32\x0e.perd.v1.ActorR\tcreatedByB\r\n\x0b_updated_at\"]\n\x0bPageRequest\x12\x1b\n\tpage_size\x18\x01 \x01(\rR\x08pageSize\x12\"\n\npage_token\x18\x02 \x01(\tH\x00R\tpageToken\x88\x01\x01\x42\r\n\x0b_page_token\"\x82\x01\n\x0cPageResponse\x12+\n\x0fnext_page_token\x18\x01 \x01(\tH\x00R\rnextPageToken\x88\x01\x01\x12\"\n\ntotal_size\x18\x02 \x01(\rH\x01R\ttotalSize\x88\x01\x01\x42\x12\n\x10_next_page_tokenB\r\n\x0b_total_size*\x84\x04\n\x0b\x46\x61ilureCode\x12\x1c\n\x18\x46\x41ILURE_CODE_UNSPECIFIED\x10\x00\x12!\n\x1d\x46\x41ILURE_CODE_INVALID_ARGUMENT\x10\x01\x12 \n\x1c\x46\x41ILURE_CODE_UNAUTHENTICATED\x10\x02\x12\"\n\x1e\x46\x41ILURE_CODE_PERMISSION_DENIED\x10\x03\x12\x1a\n\x16\x46\x41ILURE_CODE_NOT_FOUND\x10\x04\x12\x1f\n\x1b\x46\x41ILURE_CODE_ALREADY_EXISTS\x10\x05\x12#\n\x1f\x46\x41ILURE_CODE_RESOURCE_EXHAUSTED\x10\x06\x12\"\n\x1e\x46\x41ILURE_CODE_DEADLINE_EXCEEDED\x10\x07\x12\x1a\n\x16\x46\x41ILURE_CODE_CANCELLED\x10\x08\x12\"\n\x1e\x46\x41ILURE_CODE_CONTRACT_MISMATCH\x10\x14\x12&\n\"FAILURE_CODE_RESUME_WINDOW_EXPIRED\x10\x15\x12\x19\n\x15\x46\x41ILURE_CODE_INTERNAL\x10(\x12\x1c\n\x18\x46\x41ILURE_CODE_UNAVAILABLE\x10)\x12&\n\"FAILURE_CODE_WORKSTATION_NOT_READY\x10*\x12\x1f\n\x1b\x46\x41ILURE_CODE_QUOTA_EXCEEDED\x10+*\xaf\x01\n\x0c\x43omputeClass\x12\x1d\n\x19\x43OMPUTE_CLASS_UNSPECIFIED\x10\x00\x12\x17\n\x13\x43OMPUTE_CLASS_SMALL\x10\x01\x12\x18\n\x14\x43OMPUTE_CLASS_MEDIUM\x10\x02\x12\x17\n\x13\x43OMPUTE_CLASS_LARGE\x10\x03\x12\x18\n\x14\x43OMPUTE_CLASS_GPU_L4\x10\n\x12\x1a\n\x16\x43OMPUTE_CLASS_GPU_A100\x10\x0b\x42W\n\x0b\x63om.perd.v1B\x0b\x43ommonProtoP\x01\xa2\x02\x03PXX\xaa\x02\x07Perd.V1\xca\x02\x07Perd\\V1\xe2\x02\x13Perd\\V1\\GPBMetadata\xea\x02\x08Perd::V1b\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'perd.v1.common_pb2', _globals)
+if not _descriptor._USE_C_DESCRIPTORS:
+  _globals['DESCRIPTOR']._loaded_options = None
+  _globals['DESCRIPTOR']._serialized_options = b'\n\013com.perd.v1B\013CommonProtoP\001\242\002\003PXX\252\002\007Perd.V1\312\002\007Perd\\V1\342\002\023Perd\\V1\\GPBMetadata\352\002\010Perd::V1'
+  _globals['_FAILURECODE']._serialized_start=978
+  _globals['_FAILURECODE']._serialized_end=1494
+  _globals['_COMPUTECLASS']._serialized_start=1497
+  _globals['_COMPUTECLASS']._serialized_end=1672
+  _globals['_FAILURE']._serialized_start=67
+  _globals['_FAILURE']._serialized_end=336
+  _globals['_WORKFLOWREF']._serialized_start=338
+  _globals['_WORKFLOWREF']._serialized_end=447
+  _globals['_ACTOR']._serialized_start=449
+  _globals['_ACTOR']._serialized_end=547
+  _globals['_AUDITSTAMP']._serialized_start=550
+  _globals['_AUDITSTAMP']._serialized_end=747
+  _globals['_PAGEREQUEST']._serialized_start=749
+  _globals['_PAGEREQUEST']._serialized_end=842
+  _globals['_PAGERESPONSE']._serialized_start=845
+  _globals['_PAGERESPONSE']._serialized_end=975
+# @@protoc_insertion_point(module_scope)