v0.1.14

[0.1.14] - 2026-09-12

Added

• Security analysis, unpublished and previously undocumented: security zones
  (client.security_zones), full CRUD over saved security-matrix filters and
  running the matrix itself (client.security_matrix_filters,
  client.security_matrix), resource-pool analysis and pairwise connectivity
  (client.resource_pools), blast radius including the host-centric variant
  and its XLSX report (client.blast_radius), and internet exposure with the
  per-scanner exposed-hosts listing (client.internet_exposure). Resource
  pools are a new three-way discriminated union (DEVICE_ZONE/ON_PREM/
  CLOUD); blast radius reuses the published LocationFilter union already
  in the SDK. Verified live: filter created, matrix run, deleted; blast radius,
  resource-pool analysis, and internet exposure read on the local instance's
  real snapshot; the XLSX report streamed and its bytes confirmed as a genuine
  workbook.
• Dashboards and NQE panels, unpublished: client.dashboards (list, defaults,
  create, get, update with a whole-layout replace, delete, remove panels from
  every dashboard, display settings) and client.nqe_panels (list with usage,
  create, patch, delete one or many, metric values and a metric preview over an
  execution's result). Requested by the change-demo integration in its fourth
  report. Shapes from Forward's controllers; verified live with a dashboard and
  a panel created, embedded, unembedded and deleted. The metric-value reads are
  gated by an org property an org admin cannot set, so those two were verified
  against the source rather than a live instance.
• execution.result_key(): the R_ key naming an execution's result, which
  the metric reads take. Forward's published execution status omits it; the
  variant its UI reads (?for=ui) carries it.
• Synthetic devices, the unpublished remainder: backdate_* on every family
  (apply staged changes to an existing snapshot, invalidating it),
  compute_*_connections on the families that accept an NQE query
  (a preview of what the query produces, with failure in the body),
  l2vpns.add_l2_vpns (batch add), and
  internet_node.get_internet_connection_suggestions. Two families had no
  published surface at all: adjacent networks (client.adjacent_networks, full
  CRUD and connection filtering) and T-API optical containers
  (client.tapi_network_containers, hand-written because a container is
  created from uploaded documents). Verified live in a scratch network that
  was deleted afterwards; the backdate routes were confirmed to reach their
  handlers without invalidating anything.

Fixed

• device_tags.list() returned ["tags"]. Forward wraps the listing as
  {"tags": [...]}, published in the description, and the SDK read the payload
  as a list, which yielded the envelope's keys. Both forms, with and without
  devices, now return the tag records.

• device_tags.add_to_devices() and remove_from_devices() sent a bare array.
  Forward takes {"devices": [...]}, also published, and refused with "Cannot
  deserialize value of type DeviceSet from Array value". Both reported by the
  change-demo integration in its fourth report. Verified live with a tag
  created, applied to a device, removed and deleted.

  Both had tests, and both tests asserted the wrong shape, because fixture and
  parser were written from one assumption. The description had the right shape
  all along; nothing compared the SDK's bodies to it.

Changed

• The conformance test now validates the request bodies that hand-written
  builders assemble against the declared schema, structurally: type, key
  names, required keys the builder is responsible for, and enumerations the
  builder chose. Bodies had been excluded on the grounds that a synthesized
  payload proves nothing about content, which is true and beside the point: an
  array where the description declares an object is wrong whatever it holds.
  Reverting the device-tag builder makes the new check fail, so it would have
  caught this on the first release.