timbal 2.2.5__tar.gz → 2.2.7__tar.gz

{timbal-2.2.5 → timbal-2.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: timbal
-Version: 2.2.5
+Version: 2.2.7
 Summary: Simple, performant, battle-tested framework for building reliable AI applications
 Project-URL: Source, https://github.com/timbal-ai/timbal
 Author-email: Timbal <team@timbal.ai>

{timbal-2.2.5 → timbal-2.2.7}/python/timbal/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.2.5'
-__version_tuple__ = version_tuple = (2, 2, 5)
+__version__ = version = '2.2.7'
+__version_tuple__ = version_tuple = (2, 2, 7)
 
 __commit_id__ = commit_id = None

{timbal-2.2.5 → timbal-2.2.7}/python/timbal/core/models.py

@@ -43,7 +43,9 @@ def get_context_window(model_id: str) -> int | None:
 # ---------------------------------------------------------------------------
 # Model type with provider prefixes
 Model = Literal[
+    "anthropic/claude-fable-5",
     "anthropic/claude-opus-4-8",
+    "anthropic/claude-sonnet-5",
     "anthropic/claude-opus-4-7",
     "anthropic/claude-opus-4-6",
     "anthropic/claude-opus-4-5",

{timbal-2.2.5 → timbal-2.2.7}/python/timbal/models.yaml

@@ -10,6 +10,16 @@
 
 models:
 
+  - id: "anthropic/claude-fable-5"
+    provider: anthropic
+    display_name: "Claude Fable 5"
+    description: "Anthropic's most capable widely released model for long-horizon agentic work, complex reasoning, and ambitious coding tasks."
+    input_price: 10.0
+    output_price: 50.0
+    context_window: 1000000
+    capabilities: [vision, tools, reasoning]
+    notes: "Includes safety classifiers; blocked requests return stop_reason refusal. Configure Opus 4.8 fallback for production workloads."
+
   - id: "anthropic/claude-opus-4-8"
     provider: anthropic
     display_name: "Claude Opus 4.8"
@@ -19,6 +29,16 @@ models:
     context_window: 1000000
     capabilities: [vision, tools, reasoning]
 
+  - id: "anthropic/claude-sonnet-5"
+    provider: anthropic
+    display_name: "Claude Sonnet 5"
+    description: "Best combination of speed and intelligence. Drop-in upgrade from Sonnet 4.6 for coding, agents, and professional work."
+    input_price: 3.0
+    output_price: 15.0
+    context_window: 1000000
+    capabilities: [vision, tools, reasoning]
+    notes: "Introductory API pricing ($2/$10 per 1M tokens) through August 31, 2026."
+
   - id: "anthropic/claude-opus-4-7"
     provider: anthropic
     display_name: "Claude Opus 4.7"

{timbal-2.2.5 → timbal-2.2.7}/python/timbal/tools/netsuite.py

@@ -29,6 +29,8 @@ def _netsuite_auth_header(
     consumer_secret: str,
     token_id: str,
     token_secret: str,
+    query_params: dict[str, Any] | None = None,
+    body: str | None = None,
 ) -> str:
     """Generate OAuth 1.0a Token-Based Authentication (TBA) header for NetSuite."""
     import base64
@@ -41,7 +43,7 @@ def _netsuite_auth_header(
     nonce = uuid.uuid4().hex
     timestamp = str(int(time.time()))
 
-    params: dict[str, str] = {
+    oauth_params: dict[str, str] = {
         "oauth_consumer_key": consumer_key,
         "oauth_nonce": nonce,
         "oauth_signature_method": "HMAC-SHA256",
@@ -49,10 +51,21 @@ def _netsuite_auth_header(
         "oauth_token": token_id,
         "oauth_version": "1.0",
     }
+    if body is not None:
+        # NetSuite requires oauth_body_hash for non-form POST/PATCH/PUT bodies.
+        oauth_params["oauth_body_hash"] = base64.b64encode(
+            hashlib.sha1(body.encode(), usedforsecurity=False).digest()
+        ).decode()
+
+    signature_params = dict(oauth_params)
+    if query_params:
+        for key, value in query_params.items():
+            if value is not None:
+                signature_params[str(key)] = str(value)
 
     sorted_params = "&".join(
         f"{urllib.parse.quote(k, safe='')}={urllib.parse.quote(v, safe='')}"
-        for k, v in sorted(params.items())
+        for k, v in sorted(signature_params.items())
     )
     base_string = (
         f"{method.upper()}&"
@@ -64,11 +77,11 @@ def _netsuite_auth_header(
         hmac.new(signing_key.encode(), base_string.encode(), hashlib.sha256).digest()
     ).decode()
 
-    params["oauth_signature"] = signature
+    oauth_params["oauth_signature"] = signature
     realm = account_id.strip().upper()
 
     header_parts = [f'realm="{urllib.parse.quote(realm, safe="")}"'] + [
-        f'{k}="{urllib.parse.quote(v, safe="")}"' for k, v in sorted(params.items())
+        f'{k}="{urllib.parse.quote(v, safe="")}"' for k, v in sorted(oauth_params.items())
     ]
     return "OAuth " + ", ".join(header_parts)
 
@@ -273,7 +286,9 @@ class NetSuiteGetAccount(Tool):
             if fields:
                 params["fields"] = fields
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(
                     url,
@@ -328,7 +343,9 @@ class NetSuiteListAccounts(Tool):
             if query:
                 params["q"] = query
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(url, headers={"Authorization": auth, "Content-Type": "application/json"}, params=params)
                 response.raise_for_status()
@@ -492,7 +509,9 @@ class NetSuiteGetAssemblyBuild(Tool):
             if fields:
                 params["fields"] = fields
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(
                     url,
@@ -547,7 +566,9 @@ class NetSuiteListAssemblyBuilds(Tool):
             if query:
                 params["q"] = query
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(url, headers={"Authorization": auth, "Content-Type": "application/json"}, params=params)
                 response.raise_for_status()
@@ -952,7 +973,9 @@ class NetSuiteGetAssemblyItem(Tool):
             if fields:
                 params["fields"] = fields
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(
                     url,
@@ -1007,7 +1030,9 @@ class NetSuiteListAssemblyItems(Tool):
             if query:
                 params["q"] = query
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(url, headers={"Authorization": auth, "Content-Type": "application/json"}, params=params)
                 response.raise_for_status()
@@ -1108,7 +1133,9 @@ class NetSuiteSuiteQL(Tool):
 
             payload = {"q": query}
             params = {"limit": min(limit, 1000), "offset": offset}
-            auth = _netsuite_auth_header("POST", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "POST", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
 
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.post(
@@ -1284,7 +1311,9 @@ class NetSuiteGetBillingAccount(Tool):
             if fields:
                 params["fields"] = fields
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(
                     url,
@@ -1339,7 +1368,9 @@ class NetSuiteListBillingAccounts(Tool):
             if query:
                 params["q"] = query
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(url, headers={"Authorization": auth, "Content-Type": "application/json"}, params=params)
                 response.raise_for_status()
@@ -1552,7 +1583,9 @@ class NetSuiteGetBillingSchedule(Tool):
             if fields:
                 params["fields"] = fields
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(
                     url,
@@ -1607,7 +1640,9 @@ class NetSuiteListBillingSchedules(Tool):
             if query:
                 params["q"] = query
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(url, headers={"Authorization": auth, "Content-Type": "application/json"}, params=params)
                 response.raise_for_status()
@@ -1916,7 +1951,9 @@ class NetSuiteGetCalendarEvent(Tool):
             if fields:
                 params["fields"] = fields
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(
                     url,
@@ -1971,7 +2008,9 @@ class NetSuiteListCalendarEvents(Tool):
             if query:
                 params["q"] = query
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(url, headers={"Authorization": auth, "Content-Type": "application/json"}, params=params)
                 response.raise_for_status()
@@ -2118,7 +2157,9 @@ class NetSuiteCustomSuiteQL(Tool):
 
             payload = {"q": query}
             params = {"limit": min(limit, 1000), "offset": offset}
-            auth = _netsuite_auth_header("POST", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "POST", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
 
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.post(
@@ -2287,7 +2328,9 @@ class NetSuiteGetIntercompanyJournalEntry(Tool):
             if fields:
                 params["fields"] = fields
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(
                     url,
@@ -2342,7 +2385,9 @@ class NetSuiteListIntercompanyJournalEntries(Tool):
             if query:
                 params["q"] = query
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(url, headers={"Authorization": auth, "Content-Type": "application/json"}, params=params)
                 response.raise_for_status()
@@ -2557,7 +2602,9 @@ class NetSuiteGetBinTransfer(Tool):
             if fields:
                 params["fields"] = fields
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(
                     url,
@@ -2612,7 +2659,9 @@ class NetSuiteListBinTransfers(Tool):
             if query:
                 params["q"] = query
 
-            auth = _netsuite_auth_header("GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret)
+            auth = _netsuite_auth_header(
+                "GET", url, account_id, consumer_key, consumer_secret, token_id, token_secret, query_params=params
+            )
             async with httpx.AsyncClient(timeout=httpx.Timeout(30.0, connect=10.0)) as client:
                 response = await client.get(url, headers={"Authorization": auth, "Content-Type": "application/json"}, params=params)
                 response.raise_for_status()

{timbal-2.2.5 → timbal-2.2.7}/python/timbal/types/file.py

@@ -5,7 +5,7 @@ import tempfile
 from collections.abc import Callable, Iterator
 from pathlib import Path
 from typing import Any
-from urllib.parse import quote, urlparse
+from urllib.parse import unquote, urlparse
 from urllib.request import urlopen
 
 from pydantic import (
@@ -36,6 +36,13 @@ def _is_local_path(source: str) -> bool:
     )
 
 
+# Hosts serving platform-persisted content. URLs on these hosts are already
+# durable — re-uploading them via POST /files is wasteful and (worse) renames
+# the object using the encoded basename. `platform_config.cdn` is checked too,
+# but its default ("content.timbal.ai") predates the timbalusercontent.com move.
+_PLATFORM_CDN_HOSTS = ("timbalusercontent.com", "content.timbal.ai")
+
+
 def _extract_filename(headers: dict, url: str) -> str:
     """Extract filename from Content-Disposition header, falling back to URL path."""
     filename = None
@@ -46,7 +53,9 @@ def _extract_filename(headers: dict, url: str) -> str:
         except (IndexError, AttributeError):
             pass
     if not filename:
-        filename = url.split("/")[-1]
+        # Decode the basename: URL paths are percent-encoded, but the filename is
+        # used as-is for re-uploads — keeping it encoded double-encodes downstream.
+        filename = unquote(urlparse(url).path.split("/")[-1])
     return filename
 
 
@@ -386,7 +395,12 @@ class File(io.IOBase):
             url = str(self)
             if not run_context.platform_config:
                 return url
-            elif url.startswith(f"https://{run_context.platform_config.cdn}"):
+            # .hostname (unlike .netloc) drops port/userinfo and lowercases,
+            # so e.g. "content.timbal.ai:443" still matches. The configured cdn
+            # may carry a port too — strip it the same way.
+            host = urlparse(url).hostname
+            cdn_host = urlparse(f"//{run_context.platform_config.cdn}").hostname
+            if host and (host == cdn_host or host in _PLATFORM_CDN_HOSTS):
                 object.__setattr__(self, "__persisted__", url)
                 return url
 
@@ -416,11 +430,12 @@ class File(io.IOBase):
         from ..platform.utils import _request
         res = await _request("POST", path, files=files)
         upload_response = UploadFileResponse.model_validate(res.json())
-        # Re-encode only the filename segment; the rest of the URL is already safe.
-        # NOTE: str.rstrip() takes a *set of chars*, not a suffix, so it would chew
-        # arbitrary trailing chars from the URL when they happen to be in the name.
-        url = upload_response.url.removesuffix(upload_response.name)
-        url = f"{url}{quote(upload_response.name)}"
+        # The platform returns a fully percent-encoded URL — use it verbatim.
+        # Reconstructing it from `name` (raw, unencoded) breaks whenever the name
+        # needs encoding: removesuffix() finds no match, so the encoded name got
+        # appended to the already-complete URL, yielding a duplicated, doubly
+        # encoded path that 403s on the CDN.
+        url = upload_response.url
         object.__setattr__(self, "__persisted__", url)
         return url