Sync: sync/971f0c17c4

nebius/ai/v1/endpoint.proto

@@ -112,8 +112,9 @@ message EndpointSpec {
   MysteryBoxSecretRef auth_token_mysterybox_secret = 31;
 
   // Small config files injected into the container before the user process
-  // starts. Intended for configs, not datasets.
-  repeated FileInjection injected_files = 32 [(field_behavior) = INPUT_ONLY];
+  // starts. Intended for configs, not datasets. Read methods return target
+  // paths. File content is returned only by Get with view SECRET.
+  repeated FileInjection injected_files = 32 [(field_behavior) = IMMUTABLE];
 
   // EnvironmentVariable defines an environment variable for the endpoint's container.
   message EnvironmentVariable {
@@ -315,18 +316,18 @@ message EndpointSpec {
       required: true
     }];
 
-    // File content. Between 1 byte and 64 KiB (one mystery box secret payload).
-    //
-    // Not returned by read methods.
+    // File content. On create, must contain between 1 byte and 64 KiB
+    // (one mystery box secret payload).
+    // Returned only by Get with view SECRET.
     bytes content = 2 [
       (buf.validate.field) = {
         bytes: {
           min_len: 1
           max_len: 65536
         }
+        ignore: IGNORE_IF_ZERO_VALUE
       },
-      (sensitive) = true,
-      (field_behavior) = INPUT_ONLY
+      (sensitive) = true
     ];
   }
 

nebius/ai/v1/endpoint_service.proto

@@ -43,12 +43,25 @@ service EndpointService {
 }
 
 message GetEndpointRequest {
+  // Controls whether sensitive injected-file content is included.
+  enum View {
+    VIEW_UNSPECIFIED = 0;
+
+    SECRET = 1;
+  }
+
   string id = 1 [
     (buf.validate.field).required = true,
     (nid) = {
       resource: ["aiendpoint"]
     }
   ];
+
+  // SECRET includes injected file content and requires
+  // resource.aiendpoint.getSensitiveData.
+  View view = 101 [(buf.validate.field) = {
+    enum: {defined_only: true}
+  }];
 }
 
 message GetEndpointByNameRequest {

nebius/ai/v1/job.proto

@@ -99,8 +99,9 @@ message JobSpec {
   google.protobuf.Duration timeout = 31;
 
   // Small config files injected into the container before the user process
-  // starts. Intended for configs, not datasets.
-  repeated FileInjection injected_files = 32 [(field_behavior) = INPUT_ONLY];
+  // starts. Intended for configs, not datasets. Read methods return target
+  // paths. File content is returned only by Get with view SECRET.
+  repeated FileInjection injected_files = 32 [(field_behavior) = IMMUTABLE];
 
   // EnvironmentVariable defines an environment variable for the endpoint's container.
   message EnvironmentVariable {
@@ -302,18 +303,18 @@ message JobSpec {
       required: true
     }];
 
-    // File content. Between 1 byte and 64 KiB (one mystery box secret payload).
-    //
-    // Not returned by read methods.
+    // File content. On create, must contain between 1 byte and 64 KiB
+    // (one mystery box secret payload).
+    // Returned only by Get with view SECRET.
     bytes content = 2 [
       (buf.validate.field) = {
         bytes: {
           min_len: 1
           max_len: 65536
         }
+        ignore: IGNORE_IF_ZERO_VALUE
       },
-      (sensitive) = true,
-      (field_behavior) = INPUT_ONLY
+      (sensitive) = true
     ];
   }
 

nebius/ai/v1/job_service.proto

@@ -40,12 +40,25 @@ service JobService {
 }
 
 message GetJobRequest {
+  // Controls whether sensitive injected-file content is included.
+  enum View {
+    VIEW_UNSPECIFIED = 0;
+
+    SECRET = 1;
+  }
+
   string id = 1 [
     (buf.validate.field).required = true,
     (nid) = {
       resource: ["aijob"]
     }
   ];
+
+  // SECRET includes injected file content and requires
+  // resource.aijob.getSensitiveData.
+  View view = 101 [(buf.validate.field) = {
+    enum: {defined_only: true}
+  }];
 }
 
 message GetJobByNameRequest {

nebius/annotations.proto

@@ -207,6 +207,9 @@ enum FieldBehavior {
   // Compound values (messages, lists and maps) may result in unpredictable
   // updates (see examples in guidelines).
   NON_EMPTY_DEFAULT = 7;
+
+  // The same as `OUTPUT_ONLY`
+  PUBLIC_OUTPUT_ONLY = 8;
 }
 
 message DeprecationDetails {