feat(connectors)!: AAuth connectors with Cedar policy entities, and member policy attributes

[brightsparc]

What changed

• ConnectorAuthMode.AAUTH (aauth). An aauth connector sets person_server_url and application_id; the server validates both.
• Connectors carry policy_entities on read (Connector), create (ConnectorCreateRequest / connectors.create) and update (ConnectorUpdateRequest / connectors.update), sync and async. They are typed as PolicyEntity (uid: EntityUid, attrs: dict[str, Any] = {}, parents: list[EntityUid] = []), which is Cedar's JSON entity format. Callers can pass the models or plain dicts.
• Members carry policy_attributes: dict[str, Any] | None on read (Member), create and update (MemberUpdateRequest / members.update), sync and async. Values may reference an entity as {"__entity": {"type": ..., "id": ...}}.
• members.create() takes either a BusinessMemberCreate (email and name required, plus optional role) or a CustomerMemberCreate (external_user_id of the form user:{id} or anon:{id}, optional name/email, no role). Customer creates are owner-only. Both carry tags, metadata and policy_attributes, and both refuse unknown fields. A plain dict is validated through the MemberCreate discriminated union, and a dict without member_type is a business member. member_type is always sent. This mirrors the Rust SDK's MemberCreateParams.

Why

This brings the SDK in line with the control plane's current API: introspection-cloud #3272 (AAuth connectors, policy entities, member policy attributes) and #3391 (policy_attributes on member create, pending). It is the Python counterpart of introspection-rust-sdk #115, and PolicyEntity / EntityUid mirror that SDK's types.

Breaking change

approval_policy and person_server_mode are removed from Connector, ConnectorCreateRequest and connectors.create(). The ConnectorApprovalPolicy and ConnectorPersonServerMode enums are removed as well. The control plane no longer accepts or returns these fields; Cedar entities and member attributes replace them. No backwards-compatibility shim is kept.

members.create() and AsyncMembers.create() no longer take keyword arguments. Pass a BusinessMemberCreate, a CustomerMemberCreate or a dict. MemberCreateRequest is replaced by BusinessMemberCreate, CustomerMemberCreate and the MemberCreate union.

Tests

New responses-style contract tests in tests/rest/test_connectors.py and tests/rest/test_members.py:

• creating an aauth connector serializes typed policy_entities exactly, and dict input gets the defaults filled in
• creating an aauth connector without a person server raises the server's 422 as ValidationError
• reading a connector parses policy_entities, and a connector without them reads as None
• updating a connector replaces policy_entities, sync and async
• the removed fields are gone from all three connector models
• member read, create and update carry policy_attributes, sync and async, and a 403 is surfaced
• member create: a business create sends member_type: "business"; the customer body is serialized exactly; a dict without member_type is sent as business; a dict with member_type: "customer" works too
• member create rejects these before any request is sent: a customer without external_user_id, a business member without email, a customer with role, and an unknown member_type

Results:

• uv run pytest tests/ --cov=introspection_sdk: 761 passed, 93.38% coverage (floor 80%)
• ruff format, ruff check and ty check pass
• Pre-commit hooks pass on the changed files except the hook-pinned ty. That hook reports the same 36 diagnostics on untouched main files (otel, events, run-stream tests), none of them in files this PR changes.

🤖 Generated with Claude Code