render 1.2.0__tar.gz → 1.3.0__tar.gz

{render-1.2.0 → render-1.3.0}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.3.0] - 2026-10-17
+
+### Added
+
+- (Sandboxes) `sandboxes.create()` accepts `network_policy=NetworkPolicy(type="allow-list", rules=[EgressRule(domain="pypi.org")])` to restrict outbound traffic. Rules support domain names and wildcard domains such as `*.pypi.org`. `EgressRule.protocol` defaults to `"https"`. Both the sync and async clients support these rules.
+- (REST API) Generated clients include flows, flow runs, run steps, and individual build retrieval.
+
+### Changed
+
+- **Breaking:** (Sandboxes) `Sandbox.network_policy` is a `NetworkPolicy` object with `type` and `rules` instead of a string. Read `sandbox.network_policy.type` to get the policy type. String inputs such as `network_policy="deny-all"` still work when you create a sandbox.
+- **Breaking:** (REST API) Removed `create_blueprint` and its request and response models. Build source Git fields use `docker_context` instead of `base_dir`. Build lists return `BuildWithCursor` entries with `build` and `cursor` fields instead of bare `Build` entries.
+- (REST API) Service creation can omit `runtime` when `build_source_id` is set. `auto_deploy` is deprecated; use `auto_deploy_trigger`. Sandbox status includes `suspending`. Service event list entries include a `cursor`.
+- (Workflows) The SDK sends import and startup timestamps with the initial input request. The runtime can use these timestamps to measure SDK import and startup time.
+
 ## [1.2.0] - 2026-09-23
 
 ### Added

{render-1.2.0 → render-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: render
-Version: 1.2.0
+Version: 1.3.0
 Summary: Python SDK for Render Workflows
 Author-email: Render <support@render.com>
 License-File: LICENSE

{render-1.2.0 → render-1.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "render"
-version = "1.2.0"
+version = "1.3.0"
 description = "Python SDK for Render Workflows"
 authors = [{ name = "Render", email = "support@render.com" }]
 readme = "README.md"

{render-1.2.0 → render-1.3.0}/render/__init__.py

@@ -33,7 +33,10 @@ Async REST API access:
     result = await task_run
 """
 
-__version__ = "1.2.0"
+# Must stay the first import: it records when SDK import began.
+from render import _startup
+
+__version__ = "1.3.0"
 
 # Render/RenderAsync are lazy-loaded so the workflow worker path stays fast.
 from typing import TYPE_CHECKING
@@ -98,3 +101,5 @@ def __dir__() -> list[str]:
 #
 # Raw API access available via:
 #   from render.public_api import AuthenticatedClient
+
+_startup.mark_import_finished()

render-1.3.0/render/_startup.py

@@ -0,0 +1,34 @@
+"""Wall-clock startup timestamps reported to the server on ``GET /input``.
+
+Imported first by ``render/__init__.py`` so the import start is the earliest
+point SDK code runs. Stdlib only, to stay cheap.
+"""
+
+import time
+
+_import_started_ns: int | None = time.time_ns()
+_import_finished_ns: int | None = None
+_sdk_started_ns: int | None = None
+
+
+def mark_import_finished() -> None:
+    global _import_finished_ns
+    if _import_finished_ns is None:
+        _import_finished_ns = time.time_ns()
+
+
+def mark_sdk_started() -> None:
+    global _sdk_started_ns
+    if _sdk_started_ns is None:
+        _sdk_started_ns = time.time_ns()
+
+
+def input_query() -> str:
+    """Return ``?k=v&...`` for the timestamps that were captured, or ``""``."""
+    params = (
+        ("sdk_import_started_at", _import_started_ns),
+        ("sdk_import_finished_at", _import_finished_ns),
+        ("sdk_started_at", _sdk_started_ns),
+    )
+    parts = [f"{name}={value}" for name, value in params if value]
+    return "?" + "&".join(parts) if parts else ""

render-1.3.0/render/experimental/object/tests/rate_limit.py

@@ -0,0 +1,59 @@
+"""Retry 429s in the object storage e2e tests.
+
+Every PR's E2E job shares one staging account, so concurrent runs trip the API
+rate limit. RateLimitError doesn't carry the Retry-After header, so back off
+exponentially with jitter instead.
+"""
+
+import asyncio
+import functools
+import random
+from collections.abc import Awaitable, Callable
+from typing import ParamSpec, TypeVar
+
+from render.client.errors import RateLimitError
+from render.experimental.object.client import ObjectClient
+
+P = ParamSpec("P")
+R = TypeVar("R")
+
+# Total window is ~60 seconds before jitter
+MAX_ATTEMPTS = 7
+INITIAL_DELAY_S = 1.0
+MAX_DELAY_S = 16.0
+
+
+def retry_rate_limited(
+    func: Callable[P, Awaitable[R]],
+    *,
+    initial_delay_s: float = INITIAL_DELAY_S,
+) -> Callable[P, Awaitable[R]]:
+    @functools.wraps(func)
+    async def wrapper(*args: P.args, **kwargs: P.kwargs) -> R:
+        for attempt in range(MAX_ATTEMPTS):
+            try:
+                return await func(*args, **kwargs)
+            except RateLimitError:
+                if attempt >= MAX_ATTEMPTS - 1:
+                    raise
+                delay = min(initial_delay_s * 2**attempt, MAX_DELAY_S)
+                await asyncio.sleep(delay * random.uniform(0.5, 1.5))  # noqa: S311
+        raise AssertionError("unreachable")  # pragma: no cover
+
+    return wrapper
+
+
+def patch_rate_limit_retries(
+    client: ObjectClient, *, initial_delay_s: float = INITIAL_DELAY_S
+) -> None:
+    """Wrap the client's API methods in place.
+
+    ScopedObjectClient delegates to these, so scoped() is covered too.
+    """
+    for name in ("put", "get", "delete", "list"):
+        method = getattr(client, name)
+        setattr(
+            client,
+            name,
+            retry_rate_limited(method, initial_delay_s=initial_delay_s),
+        )

{render-1.2.0 → render-1.3.0}/render/experimental/object/tests/test_e2e.py

@@ -14,7 +14,9 @@ import uuid
 
 import pytest
 
+from render.experimental.object.client import ObjectClient
 from render.experimental.object.e2e_helpers import object_storage_crud_check
+from render.experimental.object.tests.rate_limit import patch_rate_limit_retries
 from render.render_async import RenderAsync
 
 # ---------------------------------------------------------------------------
@@ -42,6 +44,13 @@ def render():
     )
 
 
+@pytest.fixture
+def objects(render) -> ObjectClient:
+    client = render.client.experimental.storage.objects
+    patch_rate_limit_retries(client)
+    return client
+
+
 @pytest.fixture
 def owner_id():
     return os.environ["RENDER_E2E_OWNER_ID"]
@@ -57,20 +66,14 @@ def region():
 # ---------------------------------------------------------------------------
 class TestObjectClientE2E:
     @pytest.mark.asyncio
-    async def test_crud_cycle(self, render, owner_id, region):
+    async def test_crud_cycle(self, objects, owner_id, region):
         """Full PUT → LIST → GET → DELETE → verify-deletion cycle."""
-        await object_storage_crud_check(
-            render.client.experimental.storage.objects,
-            owner_id,
-            region,
-        )
+        await object_storage_crud_check(objects, owner_id, region)
 
     @pytest.mark.asyncio
-    async def test_scoped_accessor(self, render, owner_id, region):
+    async def test_scoped_accessor(self, objects, owner_id, region):
         """Verify scoped() wiring with a simple PUT/GET/DELETE."""
-        scoped = render.client.experimental.storage.objects.scoped(
-            owner_id=owner_id, region=region
-        )
+        scoped = objects.scoped(owner_id=owner_id, region=region)
         key = f"e2e-test/{uuid.uuid4()}/scoped-test.txt"
 
         try:
@@ -93,11 +96,10 @@ class TestObjectClientE2E:
 )
 class TestObjectClientPagination:
     @pytest.mark.asyncio
-    async def test_pagination(self, render):
+    async def test_pagination(self, objects):
         """Walk all pages with limit=2, verify multiple pages returned."""
         owner_id = os.environ["RENDER_E2E_PAGINATION_OWNER_ID"]
         region = os.environ.get("RENDER_E2E_REGION", "oregon")
-        objects = render.client.experimental.storage.objects
 
         page_size = 2
         cursor = None

render-1.3.0/render/experimental/object/tests/test_rate_limit.py

@@ -0,0 +1,75 @@
+"""Tests for the e2e rate-limit retry wrapper."""
+
+from types import SimpleNamespace
+
+import pytest
+
+from render.client.errors import ClientError, RateLimitError
+from render.experimental.object.client import ObjectClient
+from render.experimental.object.tests.rate_limit import (
+    MAX_ATTEMPTS,
+    patch_rate_limit_retries,
+    retry_rate_limited,
+)
+from render.experimental.object.types import ListObjectsResponse
+
+
+@pytest.mark.asyncio
+async def test_retries_rate_limit_until_success():
+    calls = 0
+
+    async def fn() -> str:
+        nonlocal calls
+        calls += 1
+        if calls < 3:
+            raise RateLimitError("list objects failed: rate limit exceeded")
+        return "ok"
+
+    assert await retry_rate_limited(fn, initial_delay_s=0)() == "ok"
+    assert calls == 3
+
+
+@pytest.mark.asyncio
+async def test_reraises_after_max_attempts():
+    calls = 0
+
+    async def fn() -> None:
+        nonlocal calls
+        calls += 1
+        raise RateLimitError("rate limit exceeded")
+
+    with pytest.raises(RateLimitError):
+        await retry_rate_limited(fn, initial_delay_s=0)()
+    assert calls == MAX_ATTEMPTS
+
+
+@pytest.mark.asyncio
+async def test_does_not_retry_other_client_errors():
+    calls = 0
+
+    async def fn() -> None:
+        nonlocal calls
+        calls += 1
+        raise ClientError("object not found")
+
+    with pytest.raises(ClientError):
+        await retry_rate_limited(fn, initial_delay_s=0)()
+    assert calls == 1
+
+
+@pytest.mark.asyncio
+async def test_patch_covers_scoped_client(mocker):
+    client = ObjectClient(SimpleNamespace())
+    list_mock = mocker.AsyncMock(
+        side_effect=[
+            RateLimitError("rate limit exceeded"),
+            ListObjectsResponse(objects=[], next_cursor=None, has_next=False),
+        ]
+    )
+    mocker.patch.object(client, "list", new=list_mock)
+
+    patch_rate_limit_retries(client, initial_delay_s=0)
+    response = await client.scoped(owner_id="tea-test", region="oregon").list()
+
+    assert response.objects == []
+    assert list_mock.await_count == 2

{render-1.2.0 → render-1.3.0}/render/experimental/sandbox/__init__.py

@@ -12,6 +12,8 @@ from render.experimental.sandbox.errors import (
     SnapshotPlanMismatchError,
 )
 from render.experimental.sandbox.types import (
+    EgressRule,
+    NetworkPolicy,
     Sandbox,
     SandboxExecEvent,
     SandboxExecExit,
@@ -24,6 +26,8 @@ from render.experimental.sandbox.types import (
 )
 
 __all__ = [
+    "EgressRule",
+    "NetworkPolicy",
     "Sandbox",
     "SandboxClient",
     "SandboxDownloadError",

{render-1.2.0 → render-1.3.0}/render/experimental/sandbox/api.py

@@ -54,6 +54,8 @@ from render.experimental.sandbox.files import (
     resolve_file_dest,
 )
 from render.experimental.sandbox.types import (
+    EgressRule,
+    NetworkPolicy,
     Sandbox,
     SandboxExecEvent,
     SandboxExecExit,
@@ -77,11 +79,20 @@ from render.public_api.api.sandboxes import (
 )
 from render.public_api.models.error import Error
 from render.public_api.models.sandbox import Sandbox as GeneratedSandbox
+from render.public_api.models.sandbox_egress_rule import SandboxEgressRule
+from render.public_api.models.sandbox_egress_rule_protocol import (
+    SandboxEgressRuleProtocol,
+)
 from render.public_api.models.sandbox_group import SandboxGroup as GeneratedSandboxGroup
 from render.public_api.models.sandbox_group_with_cursor import SandboxGroupWithCursor
-from render.public_api.models.sandbox_network_policy import SandboxNetworkPolicy
-from render.public_api.models.sandbox_network_policy_default import (
-    SandboxNetworkPolicyDefault,
+from render.public_api.models.sandbox_network_policy import (
+    SandboxNetworkPolicy as GeneratedNetworkPolicy,
+)
+from render.public_api.models.sandbox_network_policy_post import (
+    SandboxNetworkPolicyPOST,
+)
+from render.public_api.models.sandbox_network_policy_type import (
+    SandboxNetworkPolicyType,
 )
 from render.public_api.models.sandbox_plan import SandboxPlan
 from render.public_api.models.sandbox_post import SandboxPOST
@@ -131,12 +142,42 @@ def _set_or_none(value: _T | Unset | None) -> _T | None:
     return None if isinstance(value, Unset) else value
 
 
+def _to_egress_rule(model: SandboxEgressRule) -> EgressRule:
+    if isinstance(model.protocol, Unset):
+        return EgressRule(domain=model.domain)
+    return EgressRule(domain=model.domain, protocol=model.protocol.value)
+
+
+def _to_network_policy(model: GeneratedNetworkPolicy) -> NetworkPolicy:
+    rules = _set_or_none(model.rules) or []
+    return NetworkPolicy(
+        type=model.type_.value,
+        rules=[_to_egress_rule(rule) for rule in rules],
+    )
+
+
+def _to_network_policy_post(policy: NetworkPolicy | str) -> SandboxNetworkPolicyPOST:
+    if isinstance(policy, str):
+        policy = NetworkPolicy(type=policy)
+    body = SandboxNetworkPolicyPOST(type_=SandboxNetworkPolicyType(policy.type))
+    if policy.type == "allow-list":
+        body.rules = [
+            SandboxEgressRule(
+                domain=rule.domain, protocol=SandboxEgressRuleProtocol(rule.protocol)
+            )
+            for rule in policy.rules
+        ]
+    elif policy.rules:
+        raise ValueError("rules are only allowed for an allow-list network policy")
+    return body
+
+
 def _to_sandbox(model: GeneratedSandbox) -> Sandbox:
     return Sandbox(
         id=model.id,
         status=model.status.value,
         plan=model.plan.value,
-        network_policy=model.network_policy.default.value,
+        network_policy=_to_network_policy(model.network_policy),
         region=model.region,
         timeout_seconds=model.timeout_seconds,
         created_at=model.created_at,
@@ -239,7 +280,7 @@ class SandboxApi:
         owner_id: str,
         plan: str | None,
         timeout_seconds: int | None,
-        network_policy: str | None,
+        network_policy: NetworkPolicy | str | None,
         region: str | None,
         env: dict[str, str] | None,
         snapshot_id: str | None,
@@ -253,9 +294,7 @@ class SandboxApi:
         if region is not None:
             body.region = region
         if network_policy is not None:
-            body.network_policy = SandboxNetworkPolicy(
-                default=SandboxNetworkPolicyDefault(network_policy)
-            )
+            body.network_policy = _to_network_policy_post(network_policy)
         if env is not None:
             body.env = SandboxPOSTEnv.from_dict(env)
         if snapshot_id is not None:

{render-1.2.0 → render-1.3.0}/render/experimental/sandbox/api_sync.py

@@ -56,6 +56,8 @@ from render.experimental.sandbox.files import (
     run_blocking,
 )
 from render.experimental.sandbox.types import (
+    EgressRule,
+    NetworkPolicy,
     Sandbox,
     SandboxExecEvent,
     SandboxExecExit,
@@ -79,11 +81,20 @@ from render.public_api.api.sandboxes import (
 )
 from render.public_api.models.error import Error
 from render.public_api.models.sandbox import Sandbox as GeneratedSandbox
+from render.public_api.models.sandbox_egress_rule import SandboxEgressRule
+from render.public_api.models.sandbox_egress_rule_protocol import (
+    SandboxEgressRuleProtocol,
+)
 from render.public_api.models.sandbox_group import SandboxGroup as GeneratedSandboxGroup
 from render.public_api.models.sandbox_group_with_cursor import SandboxGroupWithCursor
-from render.public_api.models.sandbox_network_policy import SandboxNetworkPolicy
-from render.public_api.models.sandbox_network_policy_default import (
-    SandboxNetworkPolicyDefault,
+from render.public_api.models.sandbox_network_policy import (
+    SandboxNetworkPolicy as GeneratedNetworkPolicy,
+)
+from render.public_api.models.sandbox_network_policy_post import (
+    SandboxNetworkPolicyPOST,
+)
+from render.public_api.models.sandbox_network_policy_type import (
+    SandboxNetworkPolicyType,
 )
 from render.public_api.models.sandbox_plan import SandboxPlan
 from render.public_api.models.sandbox_post import SandboxPOST
@@ -133,12 +144,42 @@ def _set_or_none(value: _T | Unset | None) -> _T | None:
     return None if isinstance(value, Unset) else value
 
 
+def _to_egress_rule(model: SandboxEgressRule) -> EgressRule:
+    if isinstance(model.protocol, Unset):
+        return EgressRule(domain=model.domain)
+    return EgressRule(domain=model.domain, protocol=model.protocol.value)
+
+
+def _to_network_policy(model: GeneratedNetworkPolicy) -> NetworkPolicy:
+    rules = _set_or_none(model.rules) or []
+    return NetworkPolicy(
+        type=model.type_.value,
+        rules=[_to_egress_rule(rule) for rule in rules],
+    )
+
+
+def _to_network_policy_post(policy: NetworkPolicy | str) -> SandboxNetworkPolicyPOST:
+    if isinstance(policy, str):
+        policy = NetworkPolicy(type=policy)
+    body = SandboxNetworkPolicyPOST(type_=SandboxNetworkPolicyType(policy.type))
+    if policy.type == "allow-list":
+        body.rules = [
+            SandboxEgressRule(
+                domain=rule.domain, protocol=SandboxEgressRuleProtocol(rule.protocol)
+            )
+            for rule in policy.rules
+        ]
+    elif policy.rules:
+        raise ValueError("rules are only allowed for an allow-list network policy")
+    return body
+
+
 def _to_sandbox(model: GeneratedSandbox) -> Sandbox:
     return Sandbox(
         id=model.id,
         status=model.status.value,
         plan=model.plan.value,
-        network_policy=model.network_policy.default.value,
+        network_policy=_to_network_policy(model.network_policy),
         region=model.region,
         timeout_seconds=model.timeout_seconds,
         created_at=model.created_at,
@@ -241,7 +282,7 @@ class SyncSandboxApi:
         owner_id: str,
         plan: str | None,
         timeout_seconds: int | None,
-        network_policy: str | None,
+        network_policy: NetworkPolicy | str | None,
         region: str | None,
         env: dict[str, str] | None,
         snapshot_id: str | None,
@@ -255,9 +296,7 @@ class SyncSandboxApi:
         if region is not None:
             body.region = region
         if network_policy is not None:
-            body.network_policy = SandboxNetworkPolicy(
-                default=SandboxNetworkPolicyDefault(network_policy)
-            )
+            body.network_policy = _to_network_policy_post(network_policy)
         if env is not None:
             body.env = SandboxPOSTEnv.from_dict(env)
         if snapshot_id is not None:

{render-1.2.0 → render-1.3.0}/render/experimental/sandbox/client.py

@@ -11,6 +11,7 @@ from render.client.errors import RenderError
 from render.experimental.sandbox.api import SandboxApi
 from render.experimental.sandbox.files import normalize_remote_path
 from render.experimental.sandbox.types import (
+    NetworkPolicy,
     Sandbox,
     SandboxExecEvent,
     SandboxGroupList,
@@ -56,7 +57,7 @@ class SandboxClient:
         owner_id: str | None = None,
         plan: str | None = None,
         timeout_seconds: int | None = None,
-        network_policy: str | None = None,
+        network_policy: NetworkPolicy | str | None = None,
         region: str | None = None,
         env: dict[str, str] | None = None,
         snapshot_id: str | None = None,
@@ -68,6 +69,11 @@ class SandboxClient:
         workspace defaults enforced by the API (plan starter, 7200s timeout,
         workspace default region and network policy).
 
+        network_policy is a NetworkPolicy, or a policy type string as a
+        shorthand for one without rules. To restrict outbound traffic to
+        specific destinations, pass
+        NetworkPolicy(type="allow-list", rules=[EgressRule(domain=...)]).
+
         snapshot_id starts the sandbox from that snapshot; snapshot_name starts
         it from the available snapshot that name currently resolves to in the
         sandbox group. The two parameters are mutually exclusive. For a runtime

{render-1.2.0 → render-1.3.0}/render/experimental/sandbox/client_sync.py

@@ -13,6 +13,7 @@ from render.client.errors import RenderError
 from render.experimental.sandbox.api_sync import SyncSandboxApi
 from render.experimental.sandbox.files import normalize_remote_path
 from render.experimental.sandbox.types import (
+    NetworkPolicy,
     Sandbox,
     SandboxExecEvent,
     SandboxGroupList,
@@ -58,7 +59,7 @@ class SyncSandboxClient:
         owner_id: str | None = None,
         plan: str | None = None,
         timeout_seconds: int | None = None,
-        network_policy: str | None = None,
+        network_policy: NetworkPolicy | str | None = None,
         region: str | None = None,
         env: dict[str, str] | None = None,
         snapshot_id: str | None = None,
@@ -70,6 +71,11 @@ class SyncSandboxClient:
         workspace defaults enforced by the API (plan starter, 7200s timeout,
         workspace default region and network policy).
 
+        network_policy is a NetworkPolicy, or a policy type string as a
+        shorthand for one without rules. To restrict outbound traffic to
+        specific destinations, pass
+        NetworkPolicy(type="allow-list", rules=[EgressRule(domain=...)]).
+
         snapshot_id starts the sandbox from that snapshot; snapshot_name starts
         it from the available snapshot that name currently resolves to in the
         sandbox group. The two parameters are mutually exclusive. For a runtime