closeyourit 0.1.0__tar.gz

closeyourit-0.1.0/.env.example

@@ -0,0 +1,7 @@
+# Optional consumer configuration. The SDK itself requires no environment
+# variables to install, test, or build.
+CLOSEYOURIT_ENDPOINT_URL=
+CLOSEYOURIT_TOKEN=
+CLOSEYOURIT_PROJECT_ID=
+CLOSEYOURIT_ENVIRONMENT=development
+CLOSEYOURIT_RELEASE=

closeyourit-0.1.0/.github/actionlint.yaml

@@ -0,0 +1,19 @@
+self-hosted-runner:
+  # Labels of self-hosted runner in array of strings.
+  labels: [hetzner-ci]
+
+# Configuration variables in array of strings defined in your repository or
+# organization. `null` means disabling configuration variables check.
+# Empty array means no configuration variable is allowed.
+config-variables: null
+
+# Configuration for file paths. The keys are glob patterns to match to file
+# paths relative to the repository root. The values are the configurations for
+# the file paths. Note that the path separator is always '/'.
+# The following configurations are available.
+#
+# "ignore" is an array of regular expression patterns. Matched error messages
+# are ignored. This is similar to the "-ignore" command line option.
+paths:
+#  .github/workflows/**/*.yml:
+#    ignore: []

closeyourit-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,70 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*.*.*']
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref_type != 'tag' }}
+
+jobs:
+  quality:
+    runs-on: [self-hosted, hetzner-ci]
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
+      - name: Create virtual environment
+        run: mise exec -- python -m venv .venv
+      - name: Install development dependencies
+        run: |
+          .venv/bin/python -m pip install --upgrade pip
+          .venv/bin/python -m pip install -e ".[dev]"
+          .venv/bin/python -m pip check
+      - name: Lint
+        run: .venv/bin/ruff check .
+      - name: Format
+        run: .venv/bin/ruff format --check .
+      - name: Type check
+        run: .venv/bin/mypy
+      - name: Test
+        run: .venv/bin/python -m pytest
+      - name: Build distributions
+        run: .venv/bin/python -m build
+      - name: Validate distributions
+        run: .venv/bin/python -m twine check dist/*
+      - name: Smoke-test wheel
+        run: |
+          .venv/bin/python -m venv .smoke-venv
+          .smoke-venv/bin/python -m pip install dist/*.whl
+          .smoke-venv/bin/python -c "import closeyourit; print(closeyourit.__version__)"
+
+  compatibility:
+    runs-on: [self-hosted, hetzner-ci]
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.11', '3.12', '3.13', '3.14']
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
+      - name: Create virtual environment with Python ${{ matrix.python }}
+        run: mise exec python@${{ matrix.python }} -- python -m venv .venv
+      - name: Install package and test dependencies
+        run: |
+          .venv/bin/python -m pip install --upgrade pip
+          .venv/bin/python -m pip install -e ".[dev]"
+          .venv/bin/python -m pip check
+      - name: Test on Python ${{ matrix.python }}
+        run: .venv/bin/python -m pytest

closeyourit-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,106 @@
+name: Publish
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  compatibility:
+    if: github.ref_type == 'tag' && !contains(github.ref_name, '-')
+    runs-on: [self-hosted, hetzner-ci]
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.11', '3.12', '3.13', '3.14']
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - name: Create virtual environment with Python ${{ matrix.python }}
+        run: mise exec python@${{ matrix.python }} -- python -m venv .venv
+      - name: Install package and test dependencies
+        run: |
+          .venv/bin/python -m pip install --upgrade pip
+          .venv/bin/python -m pip install -e ".[dev]"
+          .venv/bin/python -m pip check
+      - name: Test on Python ${{ matrix.python }}
+        run: .venv/bin/python -m pytest
+
+  build:
+    if: github.ref_type == 'tag' && !contains(github.ref_name, '-')
+    runs-on: [self-hosted, hetzner-ci]
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - name: Create virtual environment
+        run: mise exec -- python -m venv .venv
+      - name: Install development dependencies
+        run: |
+          .venv/bin/python -m pip install --upgrade pip
+          .venv/bin/python -m pip install -e ".[dev]"
+          .venv/bin/python -m pip check
+      - name: Validate release metadata
+        run: .venv/bin/python scripts/check_release.py --tag "$GITHUB_REF_NAME"
+      - name: Lint
+        run: .venv/bin/ruff check .
+      - name: Format
+        run: .venv/bin/ruff format --check .
+      - name: Type check
+        run: .venv/bin/mypy
+      - name: Test
+        run: .venv/bin/python -m pytest
+      - name: Build distributions
+        run: .venv/bin/python -m build
+      - name: Validate distributions
+        run: .venv/bin/python -m twine check dist/*
+      - name: Smoke-test wheel
+        run: |
+          mise exec -- python -m venv .smoke-wheel-venv
+          .smoke-wheel-venv/bin/python -m pip install dist/*.whl
+          .smoke-wheel-venv/bin/python -c \
+            "import closeyourit; assert closeyourit.__version__ == '${GITHUB_REF_NAME#v}'"
+      - name: Smoke-test source distribution
+        run: |
+          mise exec -- python -m venv .smoke-sdist-venv
+          .smoke-sdist-venv/bin/python -m pip install dist/*.tar.gz
+          .smoke-sdist-venv/bin/python -c \
+            "import closeyourit; assert closeyourit.__version__ == '${GITHUB_REF_NAME#v}'"
+      - name: Store verified distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-package-distributions
+          path: dist/
+          if-no-files-found: error
+          retention-days: 7
+
+  publish:
+    if: github.ref_type == 'tag' && !contains(github.ref_name, '-')
+    needs: [compatibility, build]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/p/closeyourit
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Retrieve verified distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-package-distributions
+          path: dist/
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

closeyourit-0.1.0/.gitignore

@@ -0,0 +1,43 @@
+# Python
+__pycache__/
+*.py[cod]
+*.pyd
+*.so
+.Python
+
+# Virtual environments
+.venv/
+.smoke-venv/
+.smoke-*-venv/
+venv/
+
+# Packaging
+build/
+dist/
+*.egg-info/
+
+# Test and analysis caches
+.coverage
+coverage.xml
+htmlcov/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+
+# Local tooling
+.firecrawl/
+.mise.local.toml
+
+# Secrets and local configuration
+.env
+.env.*
+!.env.example
+*.key
+
+# Editors and operating systems
+.DS_Store
+.idea/
+.vscode/
+*.swp
+*.swo
+*~

closeyourit-0.1.0/CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+
+Tutte le modifiche rilevanti dello SDK saranno documentate in questo file.
+
+## [Unreleased]
+
+## [0.1.0] - 2026-07-13
+
+### Added
+
+- Scaffold Python tipizzato con test, coverage, lint, type check e build del package.
+- Pipeline di pubblicazione PyPI tramite Trusted Publishing OIDC, senza token permanenti.
+- Configurazione immutabile e fail-safe con validazione delle credenziali server-side.
+- Scope isolato per task e thread, snapshot immutabili e scrubbing PII ricorsivo.
+- Builder tipizzati per errori, messaggi, log strutturati e metriche performance.
+- Client con sampling deterministico, breadcrumb limitati e protocollo di sink sostituibile.
+- Transport HTTP asincrono con coda limitata, retry, diagnostica, flush, shutdown e fork safety.
+- Handler `logging` e hook reversibili per errori non gestiti di sys, threading e asyncio.
+- Contratto golden ingest vendorizzato con schema, fixture, matrice HTTP, lock e checksum.
+- Middleware WSGI/ASGI e adapter Django/Flask con scope isolato, streaming e privacy-by-default.
+- Integrazioni opzionali e reversibili per Requests, HTTPX sync/async e SQLAlchemy, con URL e SQL
+  privati per default, slow/repeated HTTP, query lente, conteggio query e rilevazione N+1.
+- Extra Celery con signal reversibili, metriche task/coda e capture fail-safe di failure, retry e
+  revoche senza acquisire argomenti o risultati.

closeyourit-0.1.0/CLAUDE.md

@@ -0,0 +1,80 @@
+# closeyourit-python
+
+SDK Python ufficiale, server-side, per CloseYourIt. Il contratto wire canonico vive in
+`../closeyourit-docs/API.md`; non introdurre payload o autenticazioni divergenti senza aggiornare
+prima il contratto e le fixture condivise.
+
+## Repository
+
+- **GitHub**: https://github.com/bussolabs/closeyourit-python
+- **CloseYourIt**: progetto `CYPY`
+- **Visibilità**: privata
+
+## Runtime e comandi
+
+Python è gestito con `mise` e fissato in `mise.toml`. Il package supporta Python 3.11+.
+
+```bash
+mise install
+mise exec -- python -m venv .venv
+.venv/bin/python -m pip install -e ".[dev]"
+.venv/bin/ruff check .
+.venv/bin/ruff format --check .
+.venv/bin/mypy
+.venv/bin/python -m pytest
+.venv/bin/python -m pip check
+.venv/bin/python -m build
+.venv/bin/python -m twine check dist/*
+actionlint
+```
+
+## Architettura
+
+- Codice package: `src/closeyourit/`
+- Test: `tests/`
+- Layout: `src`, package typed tramite `py.typed`
+- Build backend: Hatchling
+- API pubblica: esportata soltanto da `closeyourit/__init__.py`
+- `configuration.py`: configurazione immutabile, validazione e callback `before_send` fail-safe
+- `scope.py`: stato copy-on-write isolato tramite `ContextVar` e snapshot immutabili
+- `scrubber.py`: filtro PII ricorsivo conforme al denylist condiviso tra SDK
+- `models.py`: tipi JSON e conversione freeze/thaw senza rappresentazioni sensibili
+- `events.py`: builder puri per errori, messaggi, log e metriche conformi al wire condiviso
+- `client.py`: sampling, facade di capture e lifecycle `flush`/`close` del sink
+- `transport.py`: HTTP standard library, coda bounded, retry/redirect, worker lazy e fork safety
+- `hooks.py`: handler logging e hook sys/threading/asyncio reversibili, concatenati e fail-safe
+- `web.py`: lifecycle HTTP condiviso, header allowlist, route e metriche `slow_request`
+- `wsgi.py` / `asgi.py`: middleware core senza dipendenze, streaming e isolamento concorrente
+- `django.py` / `flask.py`: adapter opzionali con import lazy dei framework
+- `contracts/ingest/v1`: snapshot golden offline con lock e checksum della fonte canonica
+- `integrations/_http.py`: URL sicuri, slow/repeated HTTP e propagazione W3C allowlisted
+- `integrations/celery.py`: signal Celery opzionali, timing concorrente e contesto bounded
+- `integrations/requests.py`: hook e wrapper per-session reversibile per errori e timeout
+- `integrations/httpx.py`: event hook sync/async e wrapper per-client reversibile
+- `integrations/sqlalchemy.py`: listener engine, fingerprint SQL e profili query via ContextVar
+- `sql.py`: fingerprint SQL dependency-free condiviso da builder e integrazioni
+- Dipendenze runtime core: nessuna; extra opzionali `[celery]`, `[django]`, `[flask]`, `[requests]`,
+  `[httpx]` e `[sqlalchemy]`
+
+Applicare TDD red/green/refactor. Coverage minima: 90% line e branch. Testare confini numerici,
+0/1/N, timeout, retry, idempotenza, fork, shutdown, concorrenza sync/async, streaming e scrubbing
+PII. I middleware web non devono mai leggere il body della richiesta; gli adapter Celery non
+devono mai acquisire argomenti o risultati dei task né alterarne il controllo di flusso.
+
+## Variabili d'ambiente
+
+Lo sviluppo del package non richiede segreti. Le variabili in `.env.example` documentano il
+contratto per le applicazioni consumer. Valori reali esclusivamente fuori dal repository,
+caricati con `doppler run`; non creare file `.env`.
+
+## Servizi esterni
+
+- CloseYourIt ingest: transport verificato tramite requester e contratto golden, senza rete nei test.
+- PyPI: pubblicazione esclusiva tramite Trusted Publishing OIDC in GitHub Actions.
+
+## Deploy e release
+
+Non esiste un deploy applicativo. Le release usano tag stabili `vMAJOR.MINOR.PATCH` e il workflow
+`.github/workflows/publish.yml`, associato al GitHub environment `pypi` e al Trusted Publisher PyPI.
+Non pubblicare da locale e non configurare token PyPI permanenti. Il job con OIDC deve restare
+separato da build e test; ogni tag stabile richiede versione package e `CHANGELOG.md` allineati.