floe-python 0.6.1__tar.gz → 0.6.2__tar.gz

{floe_python-0.6.1 → floe_python-0.6.2}/Cargo.lock

@@ -3384,7 +3384,7 @@ dependencies = [
 
 [[package]]
 name = "floe-cli"
-version = "0.6.1"
+version = "0.6.2"
 dependencies = [
  "assert_cmd",
  "clap",
@@ -3397,12 +3397,13 @@ dependencies = [
 
 [[package]]
 name = "floe-core"
-version = "0.6.1"
+version = "0.6.2"
 dependencies = [
  "apache-avro 0.16.0",
  "arrow",
  "async-trait",
  "aws-config",
+ "aws-credential-types",
  "aws-sdk-glue",
  "aws-sdk-s3",
  "azure_core",
@@ -3441,7 +3442,7 @@ dependencies = [
 
 [[package]]
 name = "floe-python"
-version = "0.6.1"
+version = "0.6.2"
 dependencies = [
  "floe-core",
  "pyo3",

{floe_python-0.6.1 → floe_python-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: floe-python
-Version: 0.6.1
+Version: 0.6.2
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Science/Research

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "floe-core"
-version = "0.6.1"
+version = "0.6.2"
 edition = "2021"
 description = "Core library for Floe, a YAML-driven technical ingestion tool."
 license = "MIT"
@@ -26,6 +26,9 @@ glob = "0.3"
 roxmltree = "0.20"
 aws-config = "1"
 aws-sdk-s3 = "1"
+# `ProvideCredentials` trait — used to resolve EKS Pod Identity / container credentials for
+# the Iceberg S3 write path (#426).
+aws-credential-types = "1"
 # Only used by the Iceberg Glue catalog path; gated under the `iceberg` feature.
 aws-sdk-glue = { version = "1", optional = true }
 apache-avro = "0.16"

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/src/config/template.rs

@@ -41,10 +41,13 @@ pub fn apply_templates_with_vars(
 
     if let Some(storages) = config.storages.as_mut() {
         for definition in storages.definitions.iter_mut() {
-            if let Some(prefix) = definition.prefix.as_mut() {
-                let field = format!("storages.definitions.{}.prefix", definition.name);
-                *prefix = replace_placeholders(prefix, &vars, &field, None)?;
-            }
+            let name = definition.name.clone();
+            replace_storage_definition_field(&mut definition.bucket, &vars, &name, "bucket")?;
+            replace_storage_definition_field(&mut definition.region, &vars, &name, "region")?;
+            replace_storage_definition_field(&mut definition.account, &vars, &name, "account")?;
+            replace_storage_definition_field(&mut definition.container, &vars, &name, "container")?;
+            replace_storage_definition_field(&mut definition.prefix, &vars, &name, "prefix")?;
+            replace_storage_definition_field(&mut definition.endpoint, &vars, &name, "endpoint")?;
         }
     }
 
@@ -93,6 +96,19 @@ pub fn apply_templates_with_vars(
     Ok(())
 }
 
+fn replace_storage_definition_field(
+    value: &mut Option<String>,
+    vars: &HashMap<String, String>,
+    definition_name: &str,
+    field_name: &str,
+) -> FloeResult<()> {
+    if let Some(current) = value.as_mut() {
+        let field = format!("storages.definitions.{definition_name}.{field_name}");
+        *current = replace_placeholders(current, vars, &field, None)?;
+    }
+    Ok(())
+}
+
 fn build_env_vars(
     config_dir: &Path,
     env: Option<&EnvConfig>,

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/src/io/storage/object_store.rs

@@ -3,7 +3,9 @@ use crate::errors::FloeError;
 use std::collections::HashMap;
 
 #[cfg(feature = "iceberg")]
-use iceberg::io::{CLIENT_REGION, S3_REGION};
+use iceberg::io::{
+    CLIENT_REGION, S3_ACCESS_KEY_ID, S3_REGION, S3_SECRET_ACCESS_KEY, S3_SESSION_TOKEN,
+};
 #[cfg(feature = "delta")]
 use url::Url;
 
@@ -149,3 +151,127 @@ pub fn iceberg_store_config(
         .into()),
     }
 }
+
+/// Resolve AWS credentials through the AWS SDK default provider chain and inject them as
+/// static `s3.*` properties for the opendal-backed Iceberg S3 writer.
+///
+/// The Iceberg write path builds its S3 operator through opendal + reqsign, whose default
+/// credential chain does **not** understand EKS Pod Identity / ECS container credentials
+/// (`AWS_CONTAINER_CREDENTIALS_FULL_URI` + token file) and falls back to EC2 IMDS — which
+/// fails inside EKS Pod Identity pods (#426). The AWS SDK chain (`aws-config`, the same one
+/// the Glue catalog and S3 reads already use successfully) does resolve those credentials, so
+/// we resolve them here and hand opendal explicit static credentials.
+///
+/// Best-effort and non-regressive: if no provider is configured or resolution fails, the props
+/// are left untouched so existing static-env / IMDS setups keep working. Caller-supplied
+/// credential props are never overwritten.
+#[cfg(feature = "iceberg")]
+pub async fn inject_aws_static_credentials(
+    props: &mut HashMap<String, String>,
+    region: Option<&str>,
+) {
+    use aws_credential_types::provider::ProvideCredentials;
+    use aws_sdk_s3::config::Region as S3Region;
+
+    // Respect explicitly-configured credentials; skip the resolver entirely.
+    if props.contains_key(S3_ACCESS_KEY_ID) {
+        return;
+    }
+
+    let mut loader = aws_config::defaults(aws_config::BehaviorVersion::latest());
+    if let Some(region) = region {
+        loader = loader.region(S3Region::new(region.to_string()));
+    }
+    let sdk_config = loader.load().await;
+
+    let Some(provider) = sdk_config.credentials_provider() else {
+        return;
+    };
+    let Ok(creds) = provider.provide_credentials().await else {
+        return;
+    };
+
+    apply_aws_credentials_to_props(props, &creds);
+}
+
+/// Map resolved AWS credentials onto the `s3.*` properties consumed by the opendal-backed
+/// Iceberg S3 writer. Existing credential props are left untouched.
+#[cfg(feature = "iceberg")]
+fn apply_aws_credentials_to_props(
+    props: &mut HashMap<String, String>,
+    creds: &aws_credential_types::Credentials,
+) {
+    if props.contains_key(S3_ACCESS_KEY_ID) {
+        return;
+    }
+    props.insert(
+        S3_ACCESS_KEY_ID.to_string(),
+        creds.access_key_id().to_string(),
+    );
+    props.insert(
+        S3_SECRET_ACCESS_KEY.to_string(),
+        creds.secret_access_key().to_string(),
+    );
+    if let Some(token) = creds.session_token() {
+        props.insert(S3_SESSION_TOKEN.to_string(), token.to_string());
+    }
+}
+
+#[cfg(all(test, feature = "iceberg"))]
+mod credential_tests {
+    use super::*;
+    use aws_credential_types::Credentials;
+
+    #[test]
+    fn maps_temporary_credentials_to_s3_props() {
+        let creds = Credentials::new(
+            "AKIDEXAMPLE",
+            "SECRET",
+            Some("SESSION".into()),
+            None,
+            "test",
+        );
+        let mut props = HashMap::new();
+        apply_aws_credentials_to_props(&mut props, &creds);
+
+        assert_eq!(
+            props.get(S3_ACCESS_KEY_ID).map(String::as_str),
+            Some("AKIDEXAMPLE")
+        );
+        assert_eq!(
+            props.get(S3_SECRET_ACCESS_KEY).map(String::as_str),
+            Some("SECRET")
+        );
+        assert_eq!(
+            props.get(S3_SESSION_TOKEN).map(String::as_str),
+            Some("SESSION")
+        );
+    }
+
+    #[test]
+    fn omits_session_token_for_long_lived_credentials() {
+        let creds = Credentials::new("AKIDEXAMPLE", "SECRET", None, None, "test");
+        let mut props = HashMap::new();
+        apply_aws_credentials_to_props(&mut props, &creds);
+
+        assert_eq!(
+            props.get(S3_ACCESS_KEY_ID).map(String::as_str),
+            Some("AKIDEXAMPLE")
+        );
+        assert!(!props.contains_key(S3_SESSION_TOKEN));
+    }
+
+    #[test]
+    fn does_not_overwrite_caller_supplied_credentials() {
+        let creds = Credentials::new("RESOLVED", "RESOLVED_SECRET", None, None, "test");
+        let mut props = HashMap::new();
+        props.insert(S3_ACCESS_KEY_ID.to_string(), "USER_KEY".to_string());
+        apply_aws_credentials_to_props(&mut props, &creds);
+
+        assert_eq!(
+            props.get(S3_ACCESS_KEY_ID).map(String::as_str),
+            Some("USER_KEY")
+        );
+        assert!(!props.contains_key(S3_SECRET_ACCESS_KEY));
+    }
+}

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/src/io/write/iceberg/rest.rs

@@ -80,6 +80,17 @@ pub(crate) async fn build_rest_catalog(
                 .next()
                 .unwrap_or("s3")
                 .to_string();
+            // Resolve EKS Pod Identity / container credentials so the opendal S3 writer does
+            // not fall back to EC2 IMDS (#426).
+            let region = props
+                .get(iceberg::io::S3_REGION)
+                .or_else(|| props.get(iceberg::io::CLIENT_REGION))
+                .cloned();
+            crate::io::storage::object_store::inject_aws_static_credentials(
+                &mut props,
+                region.as_deref(),
+            )
+            .await;
             Arc::new(OpenDalStorageFactory::S3 {
                 configured_scheme: scheme,
                 customized_credential_load: None,

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/src/io/write/iceberg.rs

@@ -389,6 +389,13 @@ async fn write_iceberg_table_async(
             .next()
             .unwrap_or("s3")
             .to_string();
+        // Resolve EKS Pod Identity / container credentials into static s3.* props so the
+        // opendal writer does not fall back to EC2 IMDS (#426).
+        let region = catalog_props
+            .get(iceberg::io::S3_REGION)
+            .or_else(|| catalog_props.get(iceberg::io::CLIENT_REGION))
+            .cloned();
+        object_store::inject_aws_static_credentials(&mut catalog_props, region.as_deref()).await;
         catalog_builder =
             catalog_builder.with_storage_factory(std::sync::Arc::new(OpenDalStorageFactory::S3 {
                 configured_scheme: scheme,
@@ -731,6 +738,13 @@ async fn collect_iceberg_batches(
             .next()
             .unwrap_or("s3")
             .to_string();
+        // Resolve EKS Pod Identity / container credentials so the opendal S3 reader does not
+        // fall back to EC2 IMDS when seeding from existing Iceberg metadata (#426).
+        let region = props
+            .get(iceberg::io::S3_REGION)
+            .or_else(|| props.get(iceberg::io::CLIENT_REGION))
+            .cloned();
+        object_store::inject_aws_static_credentials(&mut props, region.as_deref()).await;
         catalog_builder =
             catalog_builder.with_storage_factory(std::sync::Arc::new(OpenDalStorageFactory::S3 {
                 configured_scheme: scheme,

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/src/io/write/strategy/merge/mod.rs

@@ -2,7 +2,6 @@
 use crate::errors::FloeError;
 use polars::prelude::DataFrame;
 
-#[cfg(feature = "delta")]
 #[cfg(feature = "delta")]
 use crate::io::format::AcceptedMergeMetrics;
 #[cfg(feature = "delta")]

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/src/manifest/builder.rs

@@ -395,15 +395,21 @@ fn build_common_manifest(
         now_ts_ms()
     };
 
-    // Serialize profile sections as opaque JSON values so they can be re-applied at run time.
-    let storages = profile
-        .and_then(|p| p.storages.as_ref())
+    // Serialize the effective config sections (config-level definitions already merged with
+    // the profile via `apply_profile_*`, and `{{VAR}}` placeholders resolved) as opaque JSON
+    // values so the manifest is self-contained and can be replayed by `floe run --manifest`
+    // without re-supplying the config or profile.
+    let storages = config
+        .storages
+        .as_ref()
         .and_then(|v| serde_json::to_value(v).ok());
-    let catalogs = profile
-        .and_then(|p| p.catalogs.as_ref())
+    let catalogs = config
+        .catalogs
+        .as_ref()
         .and_then(|v| serde_json::to_value(v).ok());
-    let lineage = profile
-        .and_then(|p| p.lineage.as_ref())
+    let lineage = config
+        .lineage
+        .as_ref()
         .and_then(|v| serde_json::to_value(v).ok());
 
     CommonManifest {

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/src/manifest/reconstruct.rs

@@ -93,6 +93,23 @@ pub struct ManifestColumnDefForRun {
     pub trim: Option<bool>,
 }
 
+/// Deserialize an optional embedded manifest section (storages/catalogs/lineage),
+/// returning a clear error if the block is present but malformed rather than silently
+/// discarding it.
+fn deserialize_manifest_section<T: serde::de::DeserializeOwned>(
+    value: Option<&serde_json::Value>,
+    section: &str,
+) -> FloeResult<Option<T>> {
+    match value {
+        Some(v) => serde_json::from_value::<T>(v.clone()).map(Some).map_err(
+            |err| -> Box<dyn std::error::Error + Send + Sync> {
+                FloeError::config(format!("manifest {section} block is malformed: {err}")).into()
+            },
+        ),
+        None => Ok(None),
+    }
+}
+
 /// Parse a manifest JSON string and reconstruct a minimal RootConfig.
 /// Returns (config, report_base_uri).
 pub fn config_from_manifest_json(json: &str) -> FloeResult<(crate::config::RootConfig, String)> {
@@ -101,18 +118,16 @@ pub fn config_from_manifest_json(json: &str) -> FloeResult<(crate::config::RootC
             FloeError::config(format!("manifest parse error: {err}")).into()
         })?;
 
-    let storages = manifest
-        .storages
-        .as_ref()
-        .and_then(|v| serde_json::from_value::<StoragesConfig>(v.clone()).ok());
-    let catalogs = manifest
-        .catalogs
-        .as_ref()
-        .and_then(|v| serde_json::from_value::<CatalogsConfig>(v.clone()).ok());
-    let lineage = manifest
-        .lineage
-        .as_ref()
-        .and_then(|v| serde_json::from_value::<LineageConfig>(v.clone()).ok());
+    // Deserialize the embedded sections, surfacing malformed blocks as a clear error instead
+    // of silently dropping them (a swallowed error here previously surfaced downstream as the
+    // confusing "no storages block" failure when a hand-edited manifest had a slightly-off
+    // storages shape).
+    let storages =
+        deserialize_manifest_section::<StoragesConfig>(manifest.storages.as_ref(), "storages")?;
+    let catalogs =
+        deserialize_manifest_section::<CatalogsConfig>(manifest.catalogs.as_ref(), "catalogs")?;
+    let lineage =
+        deserialize_manifest_section::<LineageConfig>(manifest.lineage.as_ref(), "lineage")?;
 
     let entities = manifest
         .entities

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/tests/unit/config/templating.rs

@@ -2,7 +2,7 @@ use std::fs;
 use std::path::{Path, PathBuf};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use floe_core::load_config;
+use floe_core::{load_config, load_config_with_profile_vars};
 
 fn temp_dir(prefix: &str) -> PathBuf {
     let mut path = std::env::temp_dir();
@@ -30,6 +30,64 @@ fn write_env(dir: &Path, contents: &str) -> PathBuf {
     write_file(&path, contents)
 }
 
+#[test]
+fn profile_vars_apply_to_storage_definition_fields() {
+    let root = temp_dir("floe-storage-vars");
+    let config_yaml = format!(
+        r#"version: "0.1"
+storages:
+  default: "lakehouse_bronze"
+  definitions:
+    - name: "lakehouse_bronze"
+      type: "s3"
+      bucket: "{{{{BRONZE_BUCKET}}}}"
+      region: "{{{{STORAGE_REGION}}}}"
+      prefix: "{{{{STORAGE_PREFIX}}}}"
+      endpoint: "https://{{{{STORAGE_ENDPOINT}}}}"
+entities:
+  - name: "orders"
+    source:
+      format: "csv"
+      path: "{root}/in/orders.csv"
+    sink:
+      accepted:
+        format: "parquet"
+        storage: "lakehouse_bronze"
+        path: "sales/orders"
+    policy:
+      severity: "warn"
+    schema:
+      columns:
+        - name: "id"
+          type: "string"
+"#,
+        root = root.display(),
+    );
+    let config_path = write_config(&root, &config_yaml);
+    let profile_vars = [
+        ("BRONZE_BUCKET".to_string(), "lakehouse-bronze".to_string()),
+        ("STORAGE_REGION".to_string(), "us-east-1".to_string()),
+        ("STORAGE_PREFIX".to_string(), "bronze/root".to_string()),
+        (
+            "STORAGE_ENDPOINT".to_string(),
+            "s3.local.example".to_string(),
+        ),
+    ]
+    .into_iter()
+    .collect();
+
+    let parsed = load_config_with_profile_vars(&config_path, &profile_vars).expect("parse config");
+    let definition = &parsed.storages.as_ref().expect("storages").definitions[0];
+
+    assert_eq!(definition.bucket.as_deref(), Some("lakehouse-bronze"));
+    assert_eq!(definition.region.as_deref(), Some("us-east-1"));
+    assert_eq!(definition.prefix.as_deref(), Some("bronze/root"));
+    assert_eq!(
+        definition.endpoint.as_deref(),
+        Some("https://s3.local.example")
+    );
+}
+
 #[test]
 fn env_file_vars_apply_to_source_path() {
     let root = temp_dir("floe-env-file");

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-core/tests/unit/manifest/mod.rs

@@ -1076,6 +1076,116 @@ entities:
     assert_eq!(accepted.storage.as_deref(), Some("motherduck"));
 }
 
+#[test]
+fn manifest_embeds_config_level_storages_for_replay() {
+    // Storages defined at config level (not in a profile) must be embedded in the generated
+    // manifest so `floe run --manifest` is self-contained and can resolve named storages.
+    // Regression for #425 ("no storages block").
+    let temp_dir = tempfile::TempDir::new().expect("temp dir");
+    let cfg_dir = temp_dir.path().join("cfg");
+    std::fs::create_dir_all(&cfg_dir).expect("cfg dir");
+    let config_path = cfg_dir.join("config.yml");
+
+    let yaml = r#"version: "0.1"
+storages:
+  default: "local"
+  definitions:
+    - name: "local"
+      type: "local"
+    - name: "lakehouse_bronze"
+      type: "s3"
+      bucket: "example-bronze"
+      region: "eu-west-1"
+entities:
+  - name: "accounts"
+    source:
+      format: "csv"
+      storage: "local"
+      path: "./in/accounts.csv"
+    sink:
+      accepted:
+        format: "parquet"
+        storage: "lakehouse_bronze"
+        path: "sales/accounts"
+    policy:
+      severity: "warn"
+    schema:
+      columns:
+        - name: "id"
+          type: "string"
+"#;
+    std::fs::write(&config_path, yaml).expect("write config");
+
+    let config_location = resolve_config_location(config_path.to_str().expect("utf8"))
+        .expect("resolve config location");
+    let config = load_config(&config_location.path).expect("load config");
+    let opts = ManifestOptions {
+        path_mode: PathMode::ResolvedUri,
+        ..ManifestOptions::default()
+    };
+
+    let payload =
+        build_common_manifest_json(&config_location, &config, &[], None, &opts).expect("manifest");
+    let value: Value = serde_json::from_str(&payload).expect("valid json");
+
+    // The manifest must carry the config-level storages even without a profile.
+    let definitions = value["storages"]["definitions"]
+        .as_array()
+        .expect("storages.definitions should be present in the manifest");
+    assert!(
+        definitions
+            .iter()
+            .any(|d| d["name"] == "lakehouse_bronze" && d["bucket"] == "example-bronze"),
+        "config-level storage definition must be embedded in the manifest: {value:#}"
+    );
+
+    // ...and survive reconstruction so manifest replay can resolve the named storage.
+    let (reconstructed, _base) =
+        config_from_manifest_json(&payload).expect("reconstruct config from manifest");
+    let storages = reconstructed
+        .storages
+        .expect("storages should be populated after manifest round-trip");
+    let bronze = storages
+        .definitions
+        .iter()
+        .find(|d| d.name == "lakehouse_bronze")
+        .expect("lakehouse_bronze definition should survive round-trip");
+    assert_eq!(bronze.bucket.as_deref(), Some("example-bronze"));
+    assert_eq!(bronze.region.as_deref(), Some("eu-west-1"));
+}
+
+#[test]
+fn manifest_reconstruct_rejects_malformed_storages_block() {
+    // A present-but-malformed storages block must surface a clear error rather than being
+    // silently dropped (which previously resurfaced downstream as the confusing
+    // "no storages block" failure). Regression for #425.
+    let config_path = repo_root().join("example/config.yml");
+    let config_location = resolve_config_location(config_path.to_str().expect("utf8"))
+        .expect("resolve config location");
+    let config = load_config(&config_location.path).expect("load config");
+    let payload = build_common_manifest_json(
+        &config_location,
+        &config,
+        &[],
+        None,
+        &ManifestOptions::default(),
+    )
+    .expect("manifest");
+
+    let mut value: Value = serde_json::from_str(&payload).expect("valid json");
+    // A bare string is not a valid storages object.
+    value["storages"] = Value::String("totally-not-a-storages-block".into());
+    let corrupted = serde_json::to_string(&value).expect("reserialize");
+
+    let err =
+        config_from_manifest_json(&corrupted).expect_err("malformed storages block must error");
+    let msg = err.to_string();
+    assert!(
+        msg.contains("storages") && msg.contains("malformed"),
+        "expected a clear 'malformed storages' error, got: {msg}"
+    );
+}
+
 #[test]
 fn manifest_path_mode_resolved_uri_sets_path_from_uri() {
     let temp_dir = tempfile::TempDir::new().expect("temp dir");

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-python/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "floe-python"
-version = "0.6.1"
+version = "0.6.2"
 edition = "2021"
 description = "Python bindings for floe-core (PyO3-based)"
 license = "Apache-2.0"
@@ -14,7 +14,7 @@ name = "_floe"
 crate-type = ["cdylib"]
 
 [dependencies]
-floe-core = { path = "../floe-core", version = "0.6.1", default-features = false }
+floe-core = { path = "../floe-core", version = "0.6.2", default-features = false }
 pyo3 = { version = "0.29", features = ["extension-module", "abi3-py310"] }
 serde_json = "1"
 

{floe_python-0.6.1 → floe_python-0.6.2}/crates/floe-python/pyproject.duckdb.toml

@@ -22,7 +22,7 @@ build-backend = "maturin"
 
 [project]
 name = "floe-duckdb"
-version = "0.6.1"
+version = "0.6.2"
 description = "DuckDB companion extension for floe — adds the native DuckDB sink to the floe Python package"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -46,7 +46,7 @@ classifiers = [
 # only contributes the compiled DuckDB extension module into that package. Pin to
 # the exact lean version so the companion's `_floe_duckdb` ABI always matches the
 # `floe` package it plugs into.
-dependencies = ["floe-python==0.6.1"]
+dependencies = ["floe-python==0.6.2"]
 
 [project.urls]
 Homepage = "https://github.com/malon64/floe"

{floe_python-0.6.1 → floe_python-0.6.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "floe-python"
-version = "0.6.1"
+version = "0.6.2"
 description = "Python bindings for floe-core — run floe pipelines at Rust speed from Python and notebooks"
 readme = "README.md"
 requires-python = ">=3.10"