django-spec-cli 0.2.1__tar.gz → 0.3.0__tar.gz

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/.github/workflows/release.yml

@@ -43,7 +43,7 @@ jobs:
 
       - name: Publish to PyPI
         if: steps.prepare.outputs.released == 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           # Idempotent on purpose. What gates a release is the git tag, not the
           # index (see `prepare`), so re-running this job after a failure in a

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] — 2026-11-04
+
+### Changed
+- **The kernel floor is `django-service-specs>=0.24.0`, the first kernel
+  release with `PermissionCheckDenied` in `REFUSALS`.** The kernel raises it,
+  a subclass of `NotPermitted`, when a permission check the spec declares
+  answers `False`. A run it refuses still exits `NOT_PERMITTED`, through the
+  `NotPermitted` row, as it did on every earlier kernel, so no exit code
+  changes. The test holding the exit codes against the kernel's list now
+  decides that refusal's code by name, and the lowest-declared-versions job
+  runs the suite on 0.24.0.
+
 ## [0.2.1] — 2026-10-21
 
 ### Fixed
@@ -55,7 +67,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `django-service-specs>=0.10.0`, the first kernel release with every name the
   command reads at its root.
 
-[Unreleased]: https://github.com/Artui/django-spec-cli/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/Artui/django-spec-cli/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/Artui/django-spec-cli/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/Artui/django-spec-cli/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/Artui/django-spec-cli/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/Artui/django-spec-cli/compare/v0.0.0...v0.1.0

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/CLAUDE.md

@@ -137,7 +137,7 @@ configured and enforced. isort order is stdlib, third party, first party.
 | --- | --- | --- |
 | Python | 3.10 | 3.10 through 3.14 |
 | Django | 4.2 | 4.2, 5.0, 5.1, 5.2, 6.0, 6.1 |
-| django-service-specs | 0.11.0 | the newest release, and the floor in the `floor` job |
+| django-service-specs | 0.24.0 | the newest release, and the floor in the `floor` job |
 
 The Python and Django floors are the kernel's, and cannot sit below them.
 

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: django-spec-cli
-Version: 0.2.1
+Version: 0.3.0
 Summary: Run a django-service-specs registry from manage.py: one subcommand per spec, options generated from its parameters, exit codes for every refusal.
 Project-URL: Homepage, https://github.com/Artui/django-spec-cli
 Project-URL: Repository, https://github.com/Artui/django-spec-cli
@@ -30,7 +30,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
-Requires-Dist: django-service-specs>=0.11.0
+Requires-Dist: django-service-specs>=0.24.0
 Requires-Dist: django>=4.2
 Description-Content-Type: text/markdown
 
@@ -61,7 +61,7 @@ the import path, the system check ids and the setting key are this package's.
 pip install django-spec-cli
 ```
 
-Python 3.10 or later, Django 4.2 or later, and `django-service-specs` 0.11.0 or
+Python 3.10 or later, Django 4.2 or later, and `django-service-specs` 0.24.0 or
 later, which it installs.
 
 ## Quickstart

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/README.md

@@ -25,7 +25,7 @@ the import path, the system check ids and the setting key are this package's.
 pip install django-spec-cli
 ```
 
-Python 3.10 or later, Django 4.2 or later, and `django-service-specs` 0.11.0 or
+Python 3.10 or later, Django 4.2 or later, and `django-service-specs` 0.24.0 or
 later, which it installs.
 
 ## Quickstart

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/django_spec_cli/exit_code_for.py

@@ -28,8 +28,9 @@ _CODES: tuple[tuple[type[Exception], ExitCode], ...] = (
 """Each refusal's code, read top to bottom, first match wins.
 
 A subclass sits above its base, or the base's row would answer for it. Only
-rows that change the answer are listed: ``InvalidArguments`` and
-``ActionUnavailable`` take their base's code, so the base's row is theirs.
+rows that change the answer are listed: ``InvalidArguments``,
+``PermissionCheckDenied`` and ``ActionUnavailable`` take their base's code, so
+the base's row is theirs.
 Coverage sees one expression, not eight rows, so each row is held by its own
 case of test_every_refusal_the_kernel_raises_has_its_code."""
 

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/django_spec_cli/types/exit_code.py

@@ -18,7 +18,7 @@ class ExitCode(IntEnum):
     | 1 | `ERROR` | failed in a way nobody declared | anything else, with a traceback |
     | 2 | `USAGE` | never started: the command line was malformed | argparse's own refusals |
     | 3 | `INVALID_ARGUMENTS` | was refused its arguments | `InvalidArguments`, `ServiceValidationError`, any other `DispatchError` |
-    | 4 | `NOT_PERMITTED` | was refused to the principal | `NotPermitted` |
+    | 4 | `NOT_PERMITTED` | was refused to the principal | `NotPermitted`, `PermissionCheckDenied` |
     | 5 | `PRINCIPAL_UNAVAILABLE` | had nobody to run as | `PrincipalUnavailable` |
     | 6 | `NOT_FOUND` | found no row to act on | a `not_found` result, `ServiceNotFound` |
     | 7 | `CONFLICT` | was refused by the row's current state | `ServiceConflict`, `ActionUnavailable` |

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/django_spec_cli/version.py

@@ -2,6 +2,6 @@
 
 from __future__ import annotations
 
-__version__: str = "0.2.1"
+__version__: str = "0.3.0"
 
 __all__ = ["__version__"]

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/docs/index.md

@@ -27,7 +27,7 @@ pip install django-spec-cli
 ```
 
 It installs [`django-service-specs`](https://artui.github.io/django-service-specs/), the kernel whose specs it serves,
-from 0.11.0, on Python 3.10 and Django 4.2 or later. The command line was the
+from 0.24.0, on Python 3.10 and Django 4.2 or later. The command line was the
 kernel's `commands/` subpackage, and moved here so the kernel carries no
 transport.
 
@@ -184,7 +184,7 @@ branch on:
 | 1 | `ERROR` | failed in a way nobody declared: the traceback is printed |
 | 2 | `USAGE` | never started: the command line was malformed |
 | 3 | `INVALID_ARGUMENTS` | `InvalidArguments`, `ServiceValidationError`, any other `DispatchError` |
-| 4 | `NOT_PERMITTED` | `NotPermitted` |
+| 4 | `NOT_PERMITTED` | `NotPermitted`, and `PermissionCheckDenied`, a declared check's denial |
 | 5 | `PRINCIPAL_UNAVAILABLE` | `PrincipalUnavailable`: no such user, or a deactivated one |
 | 6 | `NOT_FOUND` | the row named does not exist, or the service raised `ServiceNotFound` |
 | 7 | `CONFLICT` | `ServiceConflict`, and `ActionUnavailable` with its code in the message |

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/pyproject.toml

@@ -40,14 +40,14 @@ dependencies = [
     # kernel's specs, so this package cannot support a Django the kernel does
     # not.
     "django>=4.2",
-    # The first kernel release without its own copy of the command. A separate
-    # distribution reads only the kernel's root surface, and below 0.11.0 the
-    # kernel still ships ``commands/``, registers its own ``W001`` and ``W003``
-    # and re-exports every moved name, so a project listing both apps sees two
-    # sets of ids and a missed import rewrite resolves against the wrong code.
-    # ``relax_partial``, ``refusal_messages`` and ``unguarded_specs`` are at its
-    # root from 0.10.0.
-    "django-service-specs>=0.11.0",
+    # The first kernel release with ``PermissionCheckDenied`` in ``REFUSALS``.
+    # ``tests/test_exit_code_for.py`` holds the exit codes against that list
+    # and decides the new refusal's code by name, so the suite, and the floor
+    # job running it, cannot import below 0.24.0. The code itself is
+    # ``NotPermitted``'s on every kernel. Below 0.11.0 the kernel also still
+    # shipped its own copy of the command and registered its own ``W001`` and
+    # ``W003``.
+    "django-service-specs>=0.24.0",
 ]
 
 [project.urls]
@@ -147,7 +147,7 @@ skip-magic-trailing-comma = false
 root = ["./django_spec_cli"]
 
 [tool.bumpversion]
-current_version = "0.2.1"
+current_version = "0.3.0"
 allow_dirty = false
 commit = false
 tag = false

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/tests/test_exit_code_for.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from typing import Any
+
 from django_service_specs import (
     REFUSALS,
     ActionUnavailable,
@@ -7,7 +9,11 @@ from django_service_specs import (
     DispatchError,
     InvalidArguments,
     NotPermitted,
+    PermissionCheck,
+    PermissionCheckDenied,
     PrincipalUnavailable,
+    SelectorKind,
+    SelectorSpec,
     ServiceConflict,
     ServiceError,
     ServiceNotFound,
@@ -22,6 +28,7 @@ EXPECTED: dict[type[Exception], ExitCode] = {
     DispatchError: ExitCode.INVALID_ARGUMENTS,
     InvalidArguments: ExitCode.INVALID_ARGUMENTS,
     NotPermitted: ExitCode.NOT_PERMITTED,
+    PermissionCheckDenied: ExitCode.NOT_PERMITTED,
     PrincipalUnavailable: ExitCode.PRINCIPAL_UNAVAILABLE,
     ServiceError: ExitCode.REFUSED,
     ServiceValidationError: ExitCode.INVALID_ARGUMENTS,
@@ -33,9 +40,20 @@ EXPECTED: dict[type[Exception], ExitCode] = {
 """Every refusal the kernel raises, and its code, decided one by one."""
 
 
+class _Denies(PermissionCheck):
+    def has_permission(self, principal: Any, spec: Any) -> bool:
+        return False
+
+
 def _instance(kind: type[Exception]) -> Exception:
     if kind is InvalidArguments:
         return InvalidArguments({"title": ["Required."]})
+    if kind is PermissionCheckDenied:
+        # Built as ``authorize`` raises it: the check that answered and the
+        # spec declaring it.
+        check = _Denies()
+        spec = SelectorSpec(kind=SelectorKind.LIST, selector=list, permissions=[check])
+        return PermissionCheckDenied(check=check, spec=spec)
     if kind is ServiceValidationError:
         return ServiceValidationError("Taken.")
     if kind is ActionUnavailable:

{django_spec_cli-0.2.1 → django_spec_cli-0.3.0}/uv.lock

@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 5
 requires-python = ">=3.10"
 resolution-markers = [
     "python_full_version >= '3.12'",
@@ -438,16 +438,16 @@ wheels = [
 
 [[package]]
 name = "django-service-specs"
-version = "0.11.0"
+version = "0.25.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "django", version = "5.2.18", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.12'" },
     { name = "django", version = "6.1.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/4d/cc/edf2c86492b44d4a313978440f510a2faeed85da86833c1418db98e54dc2/django_service_specs-0.11.0.tar.gz", hash = "sha256:926fa982735696153dc0ce3238c42c10c95a30b51c7a274b4aea0e55114ee0a3", size = 951537, upload-time = "2026-10-20T19:28:24.563Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/15/fc/f9d84274df2031d8a954713d68058d11949e29a537c91a4cc4e663badd6f/django_service_specs-0.25.1.tar.gz", hash = "sha256:d1c5ef473ebc3d5bec162b70664895c2493394bbdfdc1447090390071228233c", size = 1172311, upload-time = "2026-11-03T14:45:24.825Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/67/01/34ed8dc96613e5aff52058c659359a315186e38711c81145c89f195cdbe3/django_service_specs-0.11.0-py3-none-any.whl", hash = "sha256:a4ddc9ff79ec3df475dcef2a04b1eebee98c37f7775d116e5ccb28fbe232aeaa", size = 432549, upload-time = "2026-10-20T19:28:22.69Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/85/27c0da45b031c1080b226b8226e84504d7e1973367380826040db75566a7/django_service_specs-0.25.1-py3-none-any.whl", hash = "sha256:d4d19e64b5a785800a09b81e0b323c6e4acefdabf4694ce297b86493a9560ef8", size = 513779, upload-time = "2026-11-03T14:45:23.115Z" },
 ]
 
 [package.optional-dependencies]
@@ -490,7 +490,7 @@ docs = [
 [package.metadata]
 requires-dist = [
     { name = "django", specifier = ">=4.2" },
-    { name = "django-service-specs", specifier = ">=0.11.0" },
+    { name = "django-service-specs", specifier = ">=0.24.0" },
 ]
 
 [package.metadata.requires-dev]
@@ -1761,7 +1761,7 @@ wheels = [
 
 [[package]]
 name = "virtualenv"
-version = "21.14.11"
+version = "21.14.13"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "distlib" },
@@ -1773,9 +1773,9 @@ dependencies = [
     { name = "python-discovery" },
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/7f/be/4d1d59d309db76b5808fcfd78bd5996f4e7241366691c38fc331a3136398/virtualenv-21.14.11.tar.gz", hash = "sha256:593052d8477ea8c55a842387ce111bd08c72618f0c1133c302cafe335e570a57", size = 5503091, upload-time = "2026-10-18T07:06:34.716Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/70/aa/bff50daee0488e16d611258a9b6c5a1d0c9e128f8ca424e9f4e1c0444ef2/virtualenv-21.14.13.tar.gz", hash = "sha256:de5307ba4b9a0001d9c8ea02832d38f63ca432880f416c1bface61c4323fd905", size = 5570301, upload-time = "2026-10-22T20:10:16.952Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ce/6b/d85da8982b41190eafcb9df91dff9d83fc6989e98af4b5be4c8f85510c95/virtualenv-21.14.11-py3-none-any.whl", hash = "sha256:b319f8590a84e5de5f8f2c803ecd2237e9bc0ffa7c1e875e3169c107cecb7454", size = 5495268, upload-time = "2026-10-18T07:06:32.719Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/a9/c10d8a44a29fb94a18b43fdf11f38caca53ae7c9406f11a72b1cb8f624f1/virtualenv-21.14.13-py3-none-any.whl", hash = "sha256:5fbb04138a4861580b78ba9110d529a26bc48fcc93c8ec36bc0202eeed96a788", size = 5557094, upload-time = "2026-10-22T20:10:15.096Z" },
 ]
 
 [[package]]