cayu.egress.authority

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

build_egress_authority_cutover_receipt

from cayu.egress import build_egress_authority_cutover_receipt

Build a structurally validated, non-authoritative receipt value.

build_egress_authority_cutover_receipt(*, expected: EgressAuthorityIdentity, target: EgressAuthorityIdentity, environment_fingerprint: str) -> EgressAuthorityCutoverReceipt

Release source · Runtime guarantees · Capability guides

build_egress_authority_identity

from cayu.egress import build_egress_authority_identity

Resolve runtime policy objects into a bounded durable authority identity.

build_egress_authority_identity(*, policies: Mapping[str, EgressPolicy], bindings: Sequence[EgressAuthorityBindingIdentity], generation: int, authority_source: str, authority_scope: str, policy_version: str, runner_kind: str, cutover_strategy: EgressAuthorityCutoverStrategy) -> EgressAuthorityIdentity

Release source · Runtime guarantees · Capability guides

compare_egress_authority

from cayu.egress import compare_egress_authority

Compare allowed operations conservatively; uncertainty is incomparable.

compare_egress_authority(expected: EgressAuthorityIdentity, candidate: EgressAuthorityIdentity, *, refused: bool=False) -> EgressAuthorityChangeKind

Release source · Runtime guarantees · Capability guides

EGRESS_AUTHORITY_SCHEMA_VERSION

from cayu.egress import EGRESS_AUTHORITY_SCHEMA_VERSION

EGRESS_AUTHORITY_SCHEMA_VERSION = 1

Release source · Runtime guarantees · Capability guides

EgressAuthorityBindingIdentity

from cayu.egress import EgressAuthorityBindingIdentity

One destination/credential class bound to a named policy.

Bases: BaseModel.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
destination	str	Field(max_length=253)
policy_name	str	Field(max_length=EGRESS_AUTHORITY_TEXT_MAX_BYTES)
credential_kind	str	Field(max_length=EGRESS_AUTHORITY_TEXT_MAX_BYTES)
credential_authority_fingerprint	str	required

validate_destination (method)

EgressAuthorityBindingIdentity.validate_destination(value: str) -> str

validate_identity (method)

EgressAuthorityBindingIdentity.validate_identity(value: str, info) -> str

validate_credential_authority_fingerprint (method)

EgressAuthorityBindingIdentity.validate_credential_authority_fingerprint(value: str) -> str

Release source · Runtime guarantees · Capability guides

EgressAuthorityChangeKind

from cayu.egress import EgressAuthorityChangeKind

Typed comparison of a candidate authority against the active authority.

Bases: StrEnum.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
UNCHANGED	class attribute	'unchanged'
NARROWER	class attribute	'narrower'
WIDER	class attribute	'wider'
INCOMPARABLE	class attribute	'incomparable'
REFUSED	class attribute	'refused'

Release source · Runtime guarantees · Capability guides

EgressAuthorityCutoverReceipt

from cayu.egress import EgressAuthorityCutoverReceipt

Bounded receipt shape for one exact target generation.

Constructing this public model validates content only. Runtime activation additionally requires private evidence issued by the backend adapter.

Bases: BaseModel.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
record_type	Literal['cayu.egress-authority-cutover']	'cayu.egress-authority-cutover'
schema_version	Literal[1]	1
state	Literal[EgressAuthorityTransitionState.ACTIVE]	EgressAuthorityTransitionState.ACTIVE
from_fingerprint	str	required
to_fingerprint	str	required
from_generation	StrictInt	Field(ge=1)
to_generation	StrictInt	Field(ge=1)
runner_kind	str	Field(max_length=EGRESS_AUTHORITY_TEXT_MAX_BYTES)
strategy	EgressAuthorityCutoverStrategy	required
environment_fingerprint	str	required
same_allocation	Literal[True]	True
workspace_continuity_verified	Literal[True]	True
old_authority_revoked	Literal[True]	True
old_path_closed	Literal[True]	True
backend_verified	Literal[True]	True
fingerprint	str	required

validate_digest (method)

EgressAuthorityCutoverReceipt.validate_digest(value: str, info) -> str

validate_runner_kind (method)

EgressAuthorityCutoverReceipt.validate_runner_kind(value: str) -> str

validate_receipt (method)

EgressAuthorityCutoverReceipt.validate_receipt() -> EgressAuthorityCutoverReceipt

Release source · Runtime guarantees · Capability guides

EgressAuthorityCutoverStrategy

from cayu.egress import EgressAuthorityCutoverStrategy

How an adapter can replace one admitted egress generation.

Bases: StrEnum.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
VERIFIED_IN_PLACE	class attribute	'verified_in_place'
FRESH_AUTHORITY_PATH	class attribute	'fresh_authority_path'
ALLOCATION_REPLACEMENT	class attribute	'allocation_replacement'
UNSUPPORTED	class attribute	'unsupported'

Release source · Runtime guarantees · Capability guides

EgressAuthorityIdentity

from cayu.egress import EgressAuthorityIdentity

Versioned, bounded, secret-free identity for one admitted egress generation.

Bases: BaseModel.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
record_type	Literal['cayu.egress-authority']	'cayu.egress-authority'
schema_version	Literal[1]	EGRESS_AUTHORITY_SCHEMA_VERSION
generation	StrictInt	Field(ge=1)
authority_source	str	Field(max_length=EGRESS_AUTHORITY_TEXT_MAX_BYTES)
authority_scope	str	Field(max_length=EGRESS_AUTHORITY_TEXT_MAX_BYTES)
policy_version	str	Field(max_length=EGRESS_AUTHORITY_TEXT_MAX_BYTES)
runner_kind	str	Field(max_length=EGRESS_AUTHORITY_TEXT_MAX_BYTES)
cutover_strategy	EgressAuthorityCutoverStrategy	required
policies	tuple[EgressAuthorityPolicyIdentity, ...]	required
bindings	tuple[EgressAuthorityBindingIdentity, ...]	required
comparison_available	StrictBool	required
fingerprint	str	required

validate_identity_text (method)

EgressAuthorityIdentity.validate_identity_text(value: str, info) -> str

validate_policies (method)

EgressAuthorityIdentity.validate_policies(value: Any) -> tuple[EgressAuthorityPolicyIdentity, ...]

validate_bindings (method)

EgressAuthorityIdentity.validate_bindings(value: Any) -> tuple[EgressAuthorityBindingIdentity, ...]

validate_fingerprint (method)

EgressAuthorityIdentity.validate_fingerprint(value: str) -> str

validate_identity (method)

EgressAuthorityIdentity.validate_identity() -> EgressAuthorityIdentity

Release source · Runtime guarantees · Capability guides

EgressAuthorityOperation

from cayu.egress import EgressAuthorityOperation

One bounded HTTP operation admitted by a built-in policy.

Bases: BaseModel.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
method	str	Field(max_length=32)
path	str	Field(max_length=2048)
match	Literal['exact', 'prefix']	'exact'

validate_method (method)

EgressAuthorityOperation.validate_method(value: str) -> str

validate_path (method)

EgressAuthorityOperation.validate_path(value: str) -> str

Release source · Runtime guarantees · Capability guides

EgressAuthorityPolicyIdentity

from cayu.egress import EgressAuthorityPolicyIdentity

Secret-free canonical projection of one policy’s operation semantics.

Bases: BaseModel.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
name	str	Field(max_length=EGRESS_AUTHORITY_TEXT_MAX_BYTES)
kind	Literal['http', 'browser', 'opaque', 'public_web']	required
allowed_destinations	tuple[str, ...]	()
operations	tuple[EgressAuthorityOperation, ...]	()
denied_path_prefixes	tuple[str, ...]	()
comparison_available	StrictBool	True

validate_name (method)

EgressAuthorityPolicyIdentity.validate_name(value: str) -> str

validate_allowed_destinations (method)

EgressAuthorityPolicyIdentity.validate_allowed_destinations(value: Any) -> tuple[str, ...]

validate_operations (method)

EgressAuthorityPolicyIdentity.validate_operations(value: Any) -> tuple[EgressAuthorityOperation, ...]

validate_denied_prefixes (method)

EgressAuthorityPolicyIdentity.validate_denied_prefixes(value: Any) -> tuple[str, ...]

validate_comparison (method)

EgressAuthorityPolicyIdentity.validate_comparison() -> EgressAuthorityPolicyIdentity

Release source · Runtime guarantees · Capability guides

EgressAuthorityTransitionState

from cayu.egress import EgressAuthorityTransitionState

Durable lifecycle states for one governed authority replacement.

Bases: StrEnum.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
AUTHORIZED	class attribute	'authorized'
INSTALLING	class attribute	'installing'
ACTIVE	class attribute	'active'
REFUSED	class attribute	'refused'
AMBIGUOUS	class attribute	'ambiguous'

Release source · Runtime guarantees · Capability guides