SK-3075: Document the new Detect methods for the skyvault and flowvault SDKs - #287

…lines

- common/skyvault generated rest version.py: guard metadata.version() with
  try/except PackageNotFoundError (matches flowvault), so importing the
  package never fails when the distribution metadata is absent.
- Refresh flowvault/skyvault public-API contract baselines for the Detect V2
  surface (flowvault adds the V2 enums; skyvault replaces V1 detect with V2).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The common package CI runs tests with `python -m unittest` (no pytest
installed), so rewrite common/tests/vault/detect/test_detect.py as a
unittest.TestCase (self.assertRaises, tempfile instead of the pytest
tmp_path fixture). Runs green under both unittest and pytest.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

"# DetectController — Detect V2" produced an awkward anchor
(#detectcontroller--detect-v2) and didn't match the cross-SDK convention; the
Go flowvault README uses "Detect". Renamed to "# Detect" (anchor #detect); the
section intro already states it is Detect V2 and how to get the controller.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* SK-3076 add v1-deprecation warning

* SK-3076 fix ci-check

The 865a4f5 regeneration renamed generated REST client methods but the
consuming code was not fully updated, breaking bearer-token auth (every
e2e failed with "Failed to generate bearer token") and the skyvault
data-plane:

- common/service_account/_utils.py: call get_bearer_token() (renamed from
  authentication_service_get_auth_token).
- common/utils/_skyflow_messages.py: resolve the host SDK version via an
  importlib.metadata fallback so messages/metrics report the real version
  instead of 0.0.0.
- skyvault/skyflow/service_account/__init__.py: re-export from
  common.service_account (skyvault's generated authentication client was
  removed by the regen), matching flowvault.
- skyvault/skyflow/vault/controller/_vault.py: rewire record/token/query
  calls to the new generated method names; move file upload to the files
  client (upload_file_v2).
- skyvault/skyflow/vault/client/client.py: add get_files_api().

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…entifySourceType split

The detect DataSourceType enum was split into per-SDK DeidentifySourceType
and ReidentifySourceType, but the committed griffe baselines were not
regenerated, so Contract Tests failed on public API drift. Regenerate both
skyvault and flowvault baselines to record the intended enum change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…d-detect-v2-skyvault-flowvault

…d common auth

Mirror the controller/auth migration in the unit tests so they exercise the
methods the code now calls:

- test__vault.py: rename the mocked generated methods to the new names
  (batch_operation/insert_records/update_record/delete_records/get_records/
  execute_query/detokenize/tokenize), point file-upload at the files client
  (get_files_api + upload_file_v2), and drop byot from the batch_operation
  expectation (batch_operation no longer takes it; BYOT rides on per-record
  tokens).
- service_account/test__utils.py and utils/test__utils.py: the public
  skyflow.service_account now routes through common, so patch
  common.service_account._utils.* and assert get_bearer_token on the mocked
  auth client instead of the removed authentication_service_get_auth_token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Mirror skyflow-java's SK-3175 change. RedactionLevel was one common class
carrying all four wire fields for every vault type. Replace it with an
abstract RedactionRule base in common (exposing the four wire accessors)
and a per-SDK RedactionLevel:

- skyvault RedactionLevel carries entity_name + redaction_type
- flowvault RedactionLevel carries token_group_name + redaction_pattern

The reidentify mapper reads the wire fields through the rule's accessors,
so each vault type only sends the fields its API supports. Refreshed the
skyvault API contract baseline for the new class.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

common.vault.detect no longer exports a concrete RedactionLevel (it exports
the RedactionRule base), so the reidentify mapping test uses a small concrete
RedactionRule double instead of importing RedactionLevel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The skyvault sdist omitted common/, so rebuilding a wheel from it (the release
smoke test) failed looking for a sibling common/ that only exists in the repo
checkout. Mirror flowvault: vendor common/ into the sdist via a CustomSdist
command plus graft common, and fall back to the vendored copy when the sibling
checkout is absent, so sdist-to-wheel builds and installs cleanly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

UploadFileRequestV2.file now carries format:binary in the spec, so the
regenerated upload_file_v2 sends file as a multipart part
(files={"file": file}) instead of a string form field, fixing the 500
"Expected primitive type, got <class 'list'>" from data-plane file upload.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The files-client regen also rewrote generated/rest/version.py to look up
metadata.version("skyflow.generated.rest"), a distribution that is never
installed (the module ships inside the "skyflow" dist), so it raised
PackageNotFoundError. unittest discover enumerates the package __all__
(which includes __version__), tripping the lazy import and failing
test/run-tests. Restore the metadata.version("skyflow") lookup with the
0.0.0 fallback. Durable fix belongs in the fern generator config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

No code change (empty commit). The previous push updated the PR head and
the release branch to the same SHA in one step, so GitHub created only the
push-triggered release run and never fired the pull_request PR CI. This
empty commit fires pull_request:synchronize so test/run-tests re-runs on
the restored version.py. The published 2.1.3.dev0+deaa724 wheel is built
from the identical code and stays valid.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Mirrors the Java migration doc as a repo reference: method and class
mapping, request field mapping, per-method V1/V2 examples, file
behaviour differences, and a migration checklist. Confirmed against the
V2 detect implementation and the V1 API on main.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ples

Rewrite the skyvault README Detect section from the removed V1 API to V2
(method table, configuration contract, Detect configuration reference,
file run status and output handling) and replace the V1 detect samples
with V2 equivalents. Mirror the same V2 Detect structure into the
flowvault README with flowvault semantics (token-group destination,
token_group_name / redaction_pattern) and enhance the flowvault samples
to cover inline configuration, submit-only / poll / presigned, and the
failure branches.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…-skyvault-flowvault' into promptless/SK-3075-skyvault-detect-v2-docs

# Conflicts:
#	skyvault/README.md
#	skyvault/samples/README.md
#	skyvault/samples/detect_api/check_guardrails.py
#	skyvault/samples/detect_api/deidentify_file.py
#	skyvault/samples/detect_api/deidentify_string.py
#	skyvault/samples/detect_api/get_run.py
#	skyvault/samples/detect_api/reidentify_file.py
#	skyvault/samples/detect_api/reidentify_string.py

…ult API contract

Cross-SDK parity review flagged four Detect V2 gaps in the Python flowvault
path versus the Java reference. All fixes live in shared common/ code and so
apply to both vaults.

- deidentify_file source rule now counts exactly one of file_path, file, value;
  a missing source and multiple sources raise distinct errors (adds the
  missing-source message).
- Shared deidentify/reidentify-file validation messages are vault-neutral and no
  longer name SKYFLOW_ID, which flowvault does not offer.
- With neither configuration_id nor configuration set, a configuration carrying
  only the vault id is sent, matching the Java behaviour.
- processed_file_extension resolves case-insensitively.

Also add skyflow.vault.detect to the flowvault public API contract and
regenerate both api-report baselines; skyvault is unchanged, flowvault gains the
detect surface.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ustomType

The generated wire types already carry these fields; surface them on the public
Detect config so callers can control VAULT_TOKEN tokenization, matching the Java
design doc.

- Add the IncludePrefix enum (YES / NO) and re-export it from both vaults'
  skyflow.utils.enums.
- Entity gains include_prefix and prefix_override.
- CustomType gains deidentification_type, destination, include_prefix and
  prefix_override.
- The request mapper sends all of them when set; omitted fields fall through to
  the server defaults.
- Regenerate both api-report baselines (the new public surface is the
  IncludePrefix enum; Entity / CustomType are re-export aliases).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…-skyvault-flowvault' into promptless/SK-3075-skyvault-detect-v2-docs

…apsed time

…fferences