replylayer 0.16.0__tar.gz → 0.17.0__tar.gz

{replylayer-0.16.0 → replylayer-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: replylayer
-Version: 0.16.0
+Version: 0.17.0
 Summary: Official Python SDK for ReplyLayer — email for AI agents
 License-Expression: MIT
 Keywords: agent,ai,email,mailbox,replylayer,sdk,webhook
@@ -167,7 +167,7 @@ except ReplyLayerError as err:
 
 ## Outbound attachments (Pro+)
 
-Attaching a file is a **two-phase** flow: upload the bytes to stage a handle, then reference `handle["id"]` in a send/reply/draft `attachment_ids` list. Every attachment is scanned (byte-level family validation + AV + secrets/PII over extracted text **and** filename) before it leaves. The mailbox must have outbound attachments **explicitly enabled** (a Pro+, session-gated dashboard action) — uploads to a non-enabled mailbox raise `ForbiddenError` with `code="OUTBOUND_ATTACHMENTS_DISABLED"`.
+Attaching a file is a **two-phase** flow: upload the bytes to stage a handle, then reference `handle["id"]` in a send/reply/draft `attachment_ids` list. Every attachment is scanned (byte-level family validation + AV + secrets/PII over extracted text **and** filename) before it leaves. The mailbox must have outbound attachments **explicitly enabled** by a human account owner in the dashboard (Pro+, mailbox Settings page, TOTP/password re-auth). Once enabled, API keys can send attachments; uploads to a non-enabled mailbox raise `ForbiddenError` with `code="OUTBOUND_ATTACHMENTS_DISABLED"`.
 
 ```python
 import time
@@ -470,7 +470,7 @@ Error classes: `ReplyLayerError` (base), `AuthenticationError` (401), `Forbidden
 
 ## Webhook signature verification
 
-> For a full integration guide (event catalog, retry behavior, idempotency, security, troubleshooting), see [`docs/webhooks.md`](../../docs/webhooks.md).
+> For a full integration guide (event catalog, retry behavior, idempotency, security, troubleshooting), see the hosted webhook docs (coming).
 
 ```python
 from replylayer import verify_webhook_signature
@@ -483,6 +483,19 @@ verify_webhook_signature(
 )
 ```
 
+Once verified, parse and dispatch on the event type. **The discriminator field is `event`, not `type`:**
+
+```python
+import json
+
+payload = json.loads(request.body)
+# payload["event"] is the discriminator — NOT payload["type"]
+if payload["event"] == "message.received":
+    # handle inbound message
+elif payload["event"] == "message.dispatch_failed":
+    # handle failed outbound send
+```
+
 ## Context managers
 
 Both clients support context managers to properly close connection pools:

{replylayer-0.16.0 → replylayer-0.17.0}/README.md

@@ -150,7 +150,7 @@ except ReplyLayerError as err:
 
 ## Outbound attachments (Pro+)
 
-Attaching a file is a **two-phase** flow: upload the bytes to stage a handle, then reference `handle["id"]` in a send/reply/draft `attachment_ids` list. Every attachment is scanned (byte-level family validation + AV + secrets/PII over extracted text **and** filename) before it leaves. The mailbox must have outbound attachments **explicitly enabled** (a Pro+, session-gated dashboard action) — uploads to a non-enabled mailbox raise `ForbiddenError` with `code="OUTBOUND_ATTACHMENTS_DISABLED"`.
+Attaching a file is a **two-phase** flow: upload the bytes to stage a handle, then reference `handle["id"]` in a send/reply/draft `attachment_ids` list. Every attachment is scanned (byte-level family validation + AV + secrets/PII over extracted text **and** filename) before it leaves. The mailbox must have outbound attachments **explicitly enabled** by a human account owner in the dashboard (Pro+, mailbox Settings page, TOTP/password re-auth). Once enabled, API keys can send attachments; uploads to a non-enabled mailbox raise `ForbiddenError` with `code="OUTBOUND_ATTACHMENTS_DISABLED"`.
 
 ```python
 import time
@@ -453,7 +453,7 @@ Error classes: `ReplyLayerError` (base), `AuthenticationError` (401), `Forbidden
 
 ## Webhook signature verification
 
-> For a full integration guide (event catalog, retry behavior, idempotency, security, troubleshooting), see [`docs/webhooks.md`](../../docs/webhooks.md).
+> For a full integration guide (event catalog, retry behavior, idempotency, security, troubleshooting), see the hosted webhook docs (coming).
 
 ```python
 from replylayer import verify_webhook_signature
@@ -466,6 +466,19 @@ verify_webhook_signature(
 )
 ```
 
+Once verified, parse and dispatch on the event type. **The discriminator field is `event`, not `type`:**
+
+```python
+import json
+
+payload = json.loads(request.body)
+# payload["event"] is the discriminator — NOT payload["type"]
+if payload["event"] == "message.received":
+    # handle inbound message
+elif payload["event"] == "message.dispatch_failed":
+    # handle failed outbound send
+```
+
 ## Context managers
 
 Both clients support context managers to properly close connection pools:

{replylayer-0.16.0 → replylayer-0.17.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "replylayer"
-version = "0.16.0"
+version = "0.17.0"
 description = "Official Python SDK for ReplyLayer — email for AI agents"
 readme = "README.md"
 license = "MIT"

{replylayer-0.16.0 → replylayer-0.17.0}/replylayer/__init__.py

@@ -76,7 +76,7 @@ from .types import (
     ScannerPolicy,
 )
 
-__version__ = "0.16.0"
+__version__ = "0.17.0"
 
 __all__ = [
     # WS1 — star response types (0.16.0).

{replylayer-0.16.0 → replylayer-0.17.0}/replylayer/_http.py

@@ -9,7 +9,7 @@ import httpx
 
 from .errors import ReplyLayerError, error_from_response
 
-_VERSION = "0.16.0"
+_VERSION = "0.17.0"
 _USER_AGENT = f"replylayer-sdk-py/{_VERSION}"
 _PROTECTED_HEADER_KEYS = frozenset({"authorization", "content-type", "user-agent"})
 

{replylayer-0.16.0 → replylayer-0.17.0}/replylayer/resources/attachments.py

@@ -51,8 +51,9 @@ class SyncAttachments:
         content_type: str | None = None,
     ) -> UploadAttachmentResponse:
         """Stage an outbound attachment (phase 1). Returns an opaque handle;
-        pass ``handle["id"]`` in a send/reply/draft ``attachment_ids`` list. The
-        mailbox must have outbound attachments enabled (Pro+). The returned
+        pass ``handle["id"]`` in a send/reply/draft ``attachment_ids`` list. A
+        human account owner must first enable outbound attachments for the
+        mailbox in the dashboard (Pro+, TOTP/password re-auth). The returned
         ``content_scan_status`` is ``"pending"`` — poll :meth:`get_upload` until
         terminal before referencing the handle, or the send fails with
         ``ATTACHMENT_SCAN_PENDING``.

{replylayer-0.16.0 → replylayer-0.17.0}/replylayer/resources/drafts.py

@@ -146,8 +146,14 @@ class SyncDrafts:
             q = {**query, "before": cursor or query["before"]}
             res = self._http.request("GET", f"/v1/mailboxes/{mailbox_id}/drafts", query=q)
             drafts = res.get("drafts", [])
-            next_cursor = drafts[-1]["id"] if len(drafts) == limit else None
-            return Page(data=drafts, has_more=len(drafts) == limit, cursor=next_cursor)
+            # UAT-22 — consume the server's authoritative `has_more` (#296) instead
+            # of the old `len(drafts) == limit` inference, which over-reported at
+            # the exact-`limit` boundary. Derive `next_cursor` FROM has_more so we
+            # only advance when the server says another page exists. Defensive
+            # default `False` for a pre-#296 server that omits the field.
+            has_more = res.get("has_more") is True
+            next_cursor = drafts[-1]["id"] if has_more and drafts else None
+            return Page(data=drafts, has_more=has_more, cursor=next_cursor)
 
         if auto_paginate:
             return sync_auto_paginate(fetch_page)
@@ -299,8 +305,14 @@ class AsyncDrafts:
             q = {**query, "before": cursor or query["before"]}
             res = await self._http.request("GET", f"/v1/mailboxes/{mailbox_id}/drafts", query=q)
             drafts = res.get("drafts", [])
-            next_cursor = drafts[-1]["id"] if len(drafts) == limit else None
-            return Page(data=drafts, has_more=len(drafts) == limit, cursor=next_cursor)
+            # UAT-22 — consume the server's authoritative `has_more` (#296) instead
+            # of the old `len(drafts) == limit` inference (byte-identical to the
+            # sync method). A sync-only fix would leave this async path still
+            # over-reporting at the exact-`limit` boundary. Defensive default
+            # `False` for a pre-#296 server that omits the field.
+            has_more = res.get("has_more") is True
+            next_cursor = drafts[-1]["id"] if has_more and drafts else None
+            return Page(data=drafts, has_more=has_more, cursor=next_cursor)
 
         if auto_paginate:
             return async_auto_paginate(fetch_page)

{replylayer-0.16.0 → replylayer-0.17.0}/replylayer/resources/threads.py

@@ -24,6 +24,7 @@ class SyncThreads:
         has_inbound: bool | None = None,
         include_firewall_blocked: bool = False,
         view: str | None = None,
+        starred: bool | None = None,
         auto_paginate: bool = False,
     ) -> Union[Page, Iterator[dict[str, Any]]]:
         def fetch_page(cursor: str | None) -> Page:
@@ -34,6 +35,9 @@ class SyncThreads:
                 "has_inbound": ("true" if has_inbound else "false") if has_inbound is not None else None,
                 "include_firewall_blocked": "true" if include_firewall_blocked else None,
                 "view": view,
+                # UAT-04 (F04 residual) — filter starred/unstarred threads. Mirrors
+                # the messages.list idiom; omitted when None so no param is sent.
+                "starred": str(starred).lower() if starred is not None else None,
             }
             res = self._http.request("GET", f"/v1/mailboxes/{mailbox_id}/threads", query=query)
             threads = res.get("threads", [])
@@ -115,6 +119,7 @@ class AsyncThreads:
         has_inbound: bool | None = None,
         include_firewall_blocked: bool = False,
         view: str | None = None,
+        starred: bool | None = None,
         auto_paginate: bool = False,
     ) -> Page | AsyncIterator[dict[str, Any]]:
         async def fetch_page(cursor: str | None) -> Page:
@@ -125,6 +130,9 @@ class AsyncThreads:
                 "has_inbound": ("true" if has_inbound else "false") if has_inbound is not None else None,
                 "include_firewall_blocked": "true" if include_firewall_blocked else None,
                 "view": view,
+                # UAT-04 (F04 residual) — filter starred/unstarred threads (async
+                # parity with SyncThreads.list). Omitted when None.
+                "starred": str(starred).lower() if starred is not None else None,
             }
             res = await self._http.request("GET", f"/v1/mailboxes/{mailbox_id}/threads", query=query)
             threads = res.get("threads", [])

{replylayer-0.16.0 → replylayer-0.17.0}/replylayer/types.py

@@ -1137,8 +1137,9 @@ class CreateDraftRequest(TypedDict, total=False):
     subaddress_instance_id: str
     subaddress_mode: SubaddressMode
     # Outbound attachment handles (plans/outbound-attachment-ux.md) — held on
-    # the draft and consumed once at dispatch. Requires the mailbox to have
-    # outbound attachments enabled (Pro+).
+    # the draft and consumed once at dispatch. Requires a human account owner
+    # to enable outbound attachments for the mailbox in the dashboard first
+    # (Pro+, TOTP/password re-auth).
     attachment_ids: list[str]
 
 

{replylayer-0.16.0 → replylayer-0.17.0}/tests/test_drafts.py

@@ -83,13 +83,71 @@ def test_drafts_list_page():
         }
         for i in range(50)
     ]
-    respx.get(f"{BASE}/v1/mailboxes/mbx1/drafts").mock(return_value=httpx.Response(200, json={"drafts": drafts}))
+    # UAT-22 — full page AND the server signals more rows exist.
+    respx.get(f"{BASE}/v1/mailboxes/mbx1/drafts").mock(
+        return_value=httpx.Response(200, json={"drafts": drafts, "has_more": True}),
+    )
     page = sdk().drafts.list("mbx1")
     assert len(page.data) == 50
     assert page.has_more is True
     assert page.cursor == "d49"
 
 
+# ── UAT-22 — both sync AND async `list` must read the server's `has_more`
+# instead of inferring it from `len(drafts) == limit`. The buggy inference
+# over-reported at the exact-`limit` boundary (a full page with no further
+# rows looked like "more"), costing an extra empty round-trip. ──
+
+@respx.mock
+def test_drafts_list_sync_exact_limit_boundary_follows_server_has_more():
+    # Exactly `limit` rows, but the server says there are no more. The old
+    # `len(drafts) == limit` inference would falsely report has_more=True and a
+    # non-null cursor here. Assert the SYNC list now follows the server field.
+    drafts = [
+        {
+            "id": f"d{i}", "mailbox_id": "mbx1", "state": "draft",
+            "sender": "bot@mail.replylayer.ai", "recipient": "r@example.com",
+            "subject": "t", "worst_decision": "allow",
+            "created_at": "2026-04-17T00:00:00Z", "updated_at": "2026-04-17T00:00:00Z",
+        }
+        for i in range(2)
+    ]
+    route = respx.get(f"{BASE}/v1/mailboxes/mbx1/drafts").mock(
+        return_value=httpx.Response(200, json={"drafts": drafts, "has_more": False}),
+    )
+    page = sdk().drafts.list("mbx1", limit=2)  # request exactly `limit` rows
+    # Request-capture: confirm the limit went out on the wire.
+    assert route.calls.last.request.url.params.get("limit") == "2"
+    assert len(page.data) == 2  # exactly the requested limit
+    assert page.has_more is False  # follows the server field, NOT len == limit
+    assert page.cursor is None  # cursor derived from has_more → no next page
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_drafts_list_async_exact_limit_boundary_follows_server_has_more():
+    # Async parity for the boundary case — a sync-only fix would leave this
+    # over-reporting at the exact-`limit` boundary.
+    drafts = [
+        {
+            "id": f"d{i}", "mailbox_id": "mbx1", "state": "draft",
+            "sender": "bot@mail.replylayer.ai", "recipient": "r@example.com",
+            "subject": "t", "worst_decision": "allow",
+            "created_at": "2026-04-17T00:00:00Z", "updated_at": "2026-04-17T00:00:00Z",
+        }
+        for i in range(2)
+    ]
+    route = respx.get(f"{BASE}/v1/mailboxes/mbx1/drafts").mock(
+        return_value=httpx.Response(200, json={"drafts": drafts, "has_more": False}),
+    )
+    async with async_sdk() as client:
+        page = await client.drafts.list("mbx1", limit=2)
+    assert route.calls.last.request.url.params.get("limit") == "2"
+    assert len(page.data) == 2
+    assert page.has_more is False  # async path also reads the server field
+    assert page.cursor is None
+
+
 @respx.mock
 def test_drafts_list_auto_paginate():
     page1 = [
@@ -108,9 +166,11 @@ def test_drafts_list_auto_paginate():
         "created_at": "2026-04-17T00:00:00Z", "updated_at": "2026-04-17T00:00:00Z",
     }]
     route = respx.get(f"{BASE}/v1/mailboxes/mbx1/drafts")
+    # UAT-22 — page1 signals more (has_more=True) so auto-paginate advances;
+    # page2 closes the iteration (has_more=False → no cursor → stop).
     route.side_effect = [
-        httpx.Response(200, json={"drafts": page1}),
-        httpx.Response(200, json={"drafts": page2}),
+        httpx.Response(200, json={"drafts": page1, "has_more": True}),
+        httpx.Response(200, json={"drafts": page2, "has_more": False}),
     ]
     ids = [d["id"] for d in sdk().drafts.list("mbx1", limit=2, auto_paginate=True)]
     assert ids == ["d0", "d1", "d2"]

replylayer-0.17.0/tests/test_threads.py

@@ -0,0 +1,96 @@
+"""
+Python SDK threads resource tests.
+
+UAT-04 (F04 residual) — `threads.list()` gained the `starred` kwarg so it has
+parity with `messages.list()` and the TS SDK. These tests assert the param is
+forwarded on the wire when supplied and omitted when not, for BOTH the sync and
+async list methods. Mirror the request-capture pattern in test_drafts.py /
+test_resources.py.
+"""
+import httpx
+import pytest
+import respx
+
+from replylayer import AsyncReplyLayer, ReplyLayer
+
+BASE = "https://api.test.replylayer.ai"
+
+
+def sdk() -> ReplyLayer:
+    return ReplyLayer(api_key="rl_live_test", base_url=BASE, max_retries=0)
+
+
+def async_sdk() -> AsyncReplyLayer:
+    return AsyncReplyLayer(api_key="rl_live_test", base_url=BASE, max_retries=0)
+
+
+# ── Sync ──
+
+@respx.mock
+def test_threads_list_forwards_starred_true():
+    route = respx.get(f"{BASE}/v1/mailboxes/mbx1/threads").mock(
+        return_value=httpx.Response(200, json={"threads": []}),
+    )
+    sdk().threads.list("mbx1", starred=True)
+    params = route.calls.last.request.url.params
+    assert params["starred"] == "true"
+
+
+@respx.mock
+def test_threads_list_forwards_starred_false():
+    route = respx.get(f"{BASE}/v1/mailboxes/mbx1/threads").mock(
+        return_value=httpx.Response(200, json={"threads": []}),
+    )
+    sdk().threads.list("mbx1", starred=False)
+    params = route.calls.last.request.url.params
+    # str(False).lower() == "false" — distinct from the omitted case below.
+    assert params["starred"] == "false"
+
+
+@respx.mock
+def test_threads_list_omits_starred_when_unset():
+    route = respx.get(f"{BASE}/v1/mailboxes/mbx1/threads").mock(
+        return_value=httpx.Response(200, json={"threads": []}),
+    )
+    sdk().threads.list("mbx1")
+    params = route.calls.last.request.url.params
+    assert "starred" not in params
+
+
+# ── Async parity — a sync-only fix would leave the async list without the
+# kwarg / param. ──
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_async_threads_list_forwards_starred_true():
+    route = respx.get(f"{BASE}/v1/mailboxes/mbx1/threads").mock(
+        return_value=httpx.Response(200, json={"threads": []}),
+    )
+    async with async_sdk() as client:
+        await client.threads.list("mbx1", starred=True)
+    params = route.calls.last.request.url.params
+    assert params["starred"] == "true"
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_async_threads_list_forwards_starred_false():
+    route = respx.get(f"{BASE}/v1/mailboxes/mbx1/threads").mock(
+        return_value=httpx.Response(200, json={"threads": []}),
+    )
+    async with async_sdk() as client:
+        await client.threads.list("mbx1", starred=False)
+    params = route.calls.last.request.url.params
+    assert params["starred"] == "false"
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_async_threads_list_omits_starred_when_unset():
+    route = respx.get(f"{BASE}/v1/mailboxes/mbx1/threads").mock(
+        return_value=httpx.Response(200, json={"threads": []}),
+    )
+    async with async_sdk() as client:
+        await client.threads.list("mbx1")
+    params = route.calls.last.request.url.params
+    assert "starred" not in params