lockfloor 0.1.0__tar.gz

lockfloor-0.1.0/.gitignore

@@ -0,0 +1,5 @@
+.venv/
+__pycache__/
+*.egg-info/
+dist/
+.pytest_cache/

lockfloor-0.1.0/HANDOFF.md

@@ -0,0 +1,12 @@
+# lockfloor handoff (2026-11-10)
+
+State: pushed to private zaidwhy/lockfloor. 34 offline + 3 network tests. Targets uv#6794: raises pyproject lower bounds to uv-resolved versions, lowest version across resolver forks.
+
+Next: PyPI publish and any comment on uv#6794 are Zaid's call (outward-facing).
+
+## Release (prepared 2026-11-10, not uploaded)
+`uv build` produces lockfloor-0.1.0 sdist + wheel; `twine check` passes; the wheel installs and runs `lockfloor --help` in a clean env. The name is free on PyPI (JSON API 404 on 2026-11-10).
+Recommended first of the four Python packages (uv#6794 has the most demand). Steps for Zaid, in order:
+1. Done 2026-11-10: repo public, `[project.urls]` added.
+2. `cd "C:/Users/Asus/projects/lockfloor" && uv build && uvx twine upload dist/*` (asks for a PyPI API token).
+3. Comment on astral-sh/uv#6794 in his own words.

lockfloor-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zaid Ali Syed
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

lockfloor-0.1.0/PKG-INFO

@@ -0,0 +1,142 @@
+Metadata-Version: 2.5
+Name: lockfloor
+Version: 0.1.0
+Summary: Raise pyproject.toml lower bounds to the versions uv's resolver locks together
+Project-URL: Repository, https://github.com/zaidwhy/lockfloor
+Project-URL: Issues, https://github.com/zaidwhy/lockfloor/issues
+Project-URL: uv issue, https://github.com/astral-sh/uv/issues/6794
+Author-email: Zaid Ali Syed <sidzaid72@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: dependencies,lockfile,pyproject,upgrade,uv
+Classifier: Environment :: Console
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.11
+Requires-Dist: packaging>=24.0
+Requires-Dist: tomlkit>=0.12.0
+Description-Content-Type: text/markdown
+
+# lockfloor
+
+Raise the lower bounds in `pyproject.toml` to the versions uv's resolver actually locks together.
+
+**The new floor comes from `uv lock --upgrade`, never from "latest on PyPI".** The latest release of each package, picked one by one, is a set nobody has resolved; it can be uninstallable as a whole, or uninstallable on a Python version the project still supports. lockfloor upgrades the lock in a scratch copy of the workspace, reads what uv chose from that `uv.lock`, and moves each `>=` (or `~=`) up to it. If uv cannot resolve it, lockfloor does not write it.
+
+This answers [astral-sh/uv#6794](https://github.com/astral-sh/uv/issues/6794) ("Upgrade dependencies in pyproject.toml") until uv ships its own command.
+
+```
+uvx lockfloor            # dry run: print the plan, write nothing
+uvx lockfloor --write    # rewrite pyproject.toml files, then re-lock
+uvx lockfloor --check    # exit 1 if any floor lags the lock (CI)
+```
+
+## What a run looks like
+
+The fixture in [`examples/forked-workspace`](examples/forked-workspace) is a two-member workspace with `requires-python = ">=3.9"`, an extra, a dependency group, a pin, a marker and a workspace dependency. After `uv lock`, `lockfloor` printed:
+
+```
+member     group       package    old                               new                                 note
+---------  ----------  ---------  --------------------------------  ----------------------------------  ---------------------------------------------------------------------
+demo-app   main        httpx      >=0.25,<1                         >=0.28.1,<1
+demo-app   main        numpy      >=1.24                            >=2.0.2                             resolver forked (2.0.2, 2.2.6, 2.4.6, 2.5.4); floor set to the lowest
+demo-app   main        rich       == 13.7.0                         -                                   skipped: pinned with ==; pass --pins to move pins
+demo-app   main        click      >=8.0 ; python_version >= '3.10'  >=8.5.1 ; python_version >= '3.10'
+demo-app   main        demo-core                                    -                                   skipped: no version specifier; lockfloor does not invent one
+demo-app   extra:yaml  pyyaml     >=6.0                             >=6.0.3
+demo-app   dev         pytest     >=7.0                             >=8.4.2                             resolver forked (8.4.2, 9.2.0); floor set to the lowest
+demo-app   dev         packaging                                    -                                   skipped: no version specifier; lockfloor does not invent one
+demo-core  main        attrs      >=22.1                            >=26.1.0
+demo-core  main        idna       ~=3.4                             ~=3.20
+
+7 to raise, 3 left alone, 0 already at the resolved version.
+Dry run: no file was written. Pass --write to apply and re-lock.
+```
+
+The three files hashed the same before and after. `--write` then changed only the version digits on seven lines; the comments on those lines stayed:
+
+```diff
+-    "numpy>=1.24",  # the resolver forks this one across Python versions
++    "numpy>=2.0.2",  # the resolver forks this one across Python versions
+-    "click>=8.0 ; python_version >= '3.10'",
++    "click>=8.5.1 ; python_version >= '3.10'",
+```
+
+`uv lock --check` passed afterwards, and `lockfloor --check` exited 0.
+
+## Why the lowest fork
+
+With `requires-python = ">=3.9"` uv locks numpy four times: 2.0.2 for 3.9, 2.2.6 for 3.10, 2.4.6 for 3.11, 2.5.4 for 3.12+. A tool that keeps one version per package name writes whichever it saw last. Writing `numpy>=2.5.4` into that fixture gives:
+
+```
+  × No solution found when resolving dependencies for split (markers:
+  │ python_full_version == '3.11.*'):
+  ╰─▶ Because the requested Python version (>=3.9) does not satisfy
+      Python>=3.12 and numpy==2.5.4 depends on Python>=3.12, we can conclude
+      that numpy==2.5.4 cannot be used.
+```
+
+lockfloor reads the per-edge versions uv records for each project and group, keeps the forks whose marker can hold together with the requirement's own marker (a requirement guarded by `python_version >= '3.12'` gets 2.5.4), and raises the floor to the lowest of those. Every supported environment can still install it.
+
+## What it leaves alone, and says so
+
+Every requirement it does not raise appears in the table with the reason:
+
+| Requirement | Why it is skipped |
+|---|---|
+| `rich==13.7.0` | A pin is a decision. `--pins` moves single `==` pins: the scratch copy sees `>=`, the result is written back as `==`. |
+| `rich==13.*`, `x===1.0` | Wildcard and arbitrary-equality pins are never moved. |
+| `attrs<24`, `numpy!=1.25` | No lower bound to raise. Upper bounds and exclusions are kept in every rewrite. |
+| `attrs>22` | Strict `>`; rewrite it as `>=` if lockfloor should manage it. |
+| `packaging` | No specifier. lockfloor does not invent one. |
+| `tool @ git+https://...` | Direct reference. |
+| `[tool.uv.sources]` path, git, url or workspace | Detected from the lock entry's source, not guessed from the manifest. |
+
+`~=` keeps its width so its upper edge holds: `idna~=3.4` becomes `~=3.20`, still below 4. Local labels such as `+cpu` are dropped from the floor because PEP 440 forbids them in `>=`.
+
+## Workspaces and groups
+
+lockfloor finds the workspace root from any member, reads every member's `pyproject.toml`, and covers `[project.dependencies]`, every `[project.optional-dependencies]` extra, every PEP 735 `[dependency-groups]` group (skipping `{include-group = ...}` entries) and the older `[tool.uv] dev-dependencies`.
+
+```
+lockfloor httpx numpy             # only these dependencies
+lockfloor --package demo-core     # only this workspace member
+lockfloor --group dev --group extra:yaml
+```
+
+A filtered run asks uv to upgrade only the selected names (`--upgrade-package`), so the lock moves no further than the rows shown. An unfiltered run is `uv lock --upgrade`, which also moves transitive dependencies.
+
+## How a write stays safe
+
+1. The workspace is copied to a scratch directory (without `.venv`, `.git`, caches; capped at 512 MiB) and `uv lock --upgrade` runs there. When a path source climbs out of the workspace (`../shared`), the copy is made beside the workspace so that path still resolves.
+2. Manifests are edited with tomlkit: comments, ordering, quote style and line endings survive.
+3. The scratch `uv.lock` is adopted and `uv lock` re-records the new requirements.
+4. If any step fails, every `pyproject.toml` and `uv.lock` is restored byte for byte.
+
+lockfloor itself makes no network calls; uv does all the fetching. Each uv call has a timeout (`--timeout`, default 300 s).
+
+## Exit codes
+
+`0` done or nothing to raise, `1` with `--check` when a floor can be raised, `2` on an error (uv failed, unknown `--group` or `--package`, no `pyproject.toml`).
+
+## Compared with uv-upx
+
+[uv-upx](https://github.com/Alirex/uv_upgrade) also takes versions from `uv.lock` and preserves comments. From its source at the time of writing: its lock reader keeps [one version per package name](https://github.com/Alirex/uv_upgrade/blob/main/src/uv_upx/services/dependencies_from_project/parse_from_uv_lock_file.py), so a forked package gets the last version listed, the case shown above; it raises `>=` only and [ignores `~=`](https://github.com/Alirex/uv_upgrade/blob/main/src/uv_upx/services/dependency_up/constants/operators.py); it adds `>=locked` to bare names unless told not to; and its `--help` lists no CI exit-code mode. It has an interactive accept/reject mode, which lockfloor does not.
+
+## Limits
+
+- Raising floors is what an application wants. A library that should keep supporting old releases should not run `--write` blindly; read the table.
+- Fork overlap is tested on a grid of CPython 3.8 to 3.15 on Linux (x86_64, aarch64), macOS (arm64, x86_64) and Windows. A marker on anything else (PyPy, an exotic platform) keeps every fork, which only lowers the floor.
+- `[tool.uv] constraint-dependencies` and `override-dependencies`, and `requirements.txt` files, are not touched.
+- A member whose metadata is built dynamically from git (setuptools-scm, hatch-vcs) may fail to lock in the scratch copy, which has no `.git`.
+- There is no interactive mode and no major/minor/patch filter.
+
+## Development
+
+```
+py -3.12 -m venv .venv && .venv/Scripts/python -m pip install -e . pytest
+.venv/Scripts/python -m pytest              # offline suite, fake resolver
+.venv/Scripts/python -m pytest -m network   # real uv against PyPI
+```
+
+MIT licensed.

lockfloor-0.1.0/README.md

@@ -0,0 +1,123 @@
+# lockfloor
+
+Raise the lower bounds in `pyproject.toml` to the versions uv's resolver actually locks together.
+
+**The new floor comes from `uv lock --upgrade`, never from "latest on PyPI".** The latest release of each package, picked one by one, is a set nobody has resolved; it can be uninstallable as a whole, or uninstallable on a Python version the project still supports. lockfloor upgrades the lock in a scratch copy of the workspace, reads what uv chose from that `uv.lock`, and moves each `>=` (or `~=`) up to it. If uv cannot resolve it, lockfloor does not write it.
+
+This answers [astral-sh/uv#6794](https://github.com/astral-sh/uv/issues/6794) ("Upgrade dependencies in pyproject.toml") until uv ships its own command.
+
+```
+uvx lockfloor            # dry run: print the plan, write nothing
+uvx lockfloor --write    # rewrite pyproject.toml files, then re-lock
+uvx lockfloor --check    # exit 1 if any floor lags the lock (CI)
+```
+
+## What a run looks like
+
+The fixture in [`examples/forked-workspace`](examples/forked-workspace) is a two-member workspace with `requires-python = ">=3.9"`, an extra, a dependency group, a pin, a marker and a workspace dependency. After `uv lock`, `lockfloor` printed:
+
+```
+member     group       package    old                               new                                 note
+---------  ----------  ---------  --------------------------------  ----------------------------------  ---------------------------------------------------------------------
+demo-app   main        httpx      >=0.25,<1                         >=0.28.1,<1
+demo-app   main        numpy      >=1.24                            >=2.0.2                             resolver forked (2.0.2, 2.2.6, 2.4.6, 2.5.4); floor set to the lowest
+demo-app   main        rich       == 13.7.0                         -                                   skipped: pinned with ==; pass --pins to move pins
+demo-app   main        click      >=8.0 ; python_version >= '3.10'  >=8.5.1 ; python_version >= '3.10'
+demo-app   main        demo-core                                    -                                   skipped: no version specifier; lockfloor does not invent one
+demo-app   extra:yaml  pyyaml     >=6.0                             >=6.0.3
+demo-app   dev         pytest     >=7.0                             >=8.4.2                             resolver forked (8.4.2, 9.2.0); floor set to the lowest
+demo-app   dev         packaging                                    -                                   skipped: no version specifier; lockfloor does not invent one
+demo-core  main        attrs      >=22.1                            >=26.1.0
+demo-core  main        idna       ~=3.4                             ~=3.20
+
+7 to raise, 3 left alone, 0 already at the resolved version.
+Dry run: no file was written. Pass --write to apply and re-lock.
+```
+
+The three files hashed the same before and after. `--write` then changed only the version digits on seven lines; the comments on those lines stayed:
+
+```diff
+-    "numpy>=1.24",  # the resolver forks this one across Python versions
++    "numpy>=2.0.2",  # the resolver forks this one across Python versions
+-    "click>=8.0 ; python_version >= '3.10'",
++    "click>=8.5.1 ; python_version >= '3.10'",
+```
+
+`uv lock --check` passed afterwards, and `lockfloor --check` exited 0.
+
+## Why the lowest fork
+
+With `requires-python = ">=3.9"` uv locks numpy four times: 2.0.2 for 3.9, 2.2.6 for 3.10, 2.4.6 for 3.11, 2.5.4 for 3.12+. A tool that keeps one version per package name writes whichever it saw last. Writing `numpy>=2.5.4` into that fixture gives:
+
+```
+  × No solution found when resolving dependencies for split (markers:
+  │ python_full_version == '3.11.*'):
+  ╰─▶ Because the requested Python version (>=3.9) does not satisfy
+      Python>=3.12 and numpy==2.5.4 depends on Python>=3.12, we can conclude
+      that numpy==2.5.4 cannot be used.
+```
+
+lockfloor reads the per-edge versions uv records for each project and group, keeps the forks whose marker can hold together with the requirement's own marker (a requirement guarded by `python_version >= '3.12'` gets 2.5.4), and raises the floor to the lowest of those. Every supported environment can still install it.
+
+## What it leaves alone, and says so
+
+Every requirement it does not raise appears in the table with the reason:
+
+| Requirement | Why it is skipped |
+|---|---|
+| `rich==13.7.0` | A pin is a decision. `--pins` moves single `==` pins: the scratch copy sees `>=`, the result is written back as `==`. |
+| `rich==13.*`, `x===1.0` | Wildcard and arbitrary-equality pins are never moved. |
+| `attrs<24`, `numpy!=1.25` | No lower bound to raise. Upper bounds and exclusions are kept in every rewrite. |
+| `attrs>22` | Strict `>`; rewrite it as `>=` if lockfloor should manage it. |
+| `packaging` | No specifier. lockfloor does not invent one. |
+| `tool @ git+https://...` | Direct reference. |
+| `[tool.uv.sources]` path, git, url or workspace | Detected from the lock entry's source, not guessed from the manifest. |
+
+`~=` keeps its width so its upper edge holds: `idna~=3.4` becomes `~=3.20`, still below 4. Local labels such as `+cpu` are dropped from the floor because PEP 440 forbids them in `>=`.
+
+## Workspaces and groups
+
+lockfloor finds the workspace root from any member, reads every member's `pyproject.toml`, and covers `[project.dependencies]`, every `[project.optional-dependencies]` extra, every PEP 735 `[dependency-groups]` group (skipping `{include-group = ...}` entries) and the older `[tool.uv] dev-dependencies`.
+
+```
+lockfloor httpx numpy             # only these dependencies
+lockfloor --package demo-core     # only this workspace member
+lockfloor --group dev --group extra:yaml
+```
+
+A filtered run asks uv to upgrade only the selected names (`--upgrade-package`), so the lock moves no further than the rows shown. An unfiltered run is `uv lock --upgrade`, which also moves transitive dependencies.
+
+## How a write stays safe
+
+1. The workspace is copied to a scratch directory (without `.venv`, `.git`, caches; capped at 512 MiB) and `uv lock --upgrade` runs there. When a path source climbs out of the workspace (`../shared`), the copy is made beside the workspace so that path still resolves.
+2. Manifests are edited with tomlkit: comments, ordering, quote style and line endings survive.
+3. The scratch `uv.lock` is adopted and `uv lock` re-records the new requirements.
+4. If any step fails, every `pyproject.toml` and `uv.lock` is restored byte for byte.
+
+lockfloor itself makes no network calls; uv does all the fetching. Each uv call has a timeout (`--timeout`, default 300 s).
+
+## Exit codes
+
+`0` done or nothing to raise, `1` with `--check` when a floor can be raised, `2` on an error (uv failed, unknown `--group` or `--package`, no `pyproject.toml`).
+
+## Compared with uv-upx
+
+[uv-upx](https://github.com/Alirex/uv_upgrade) also takes versions from `uv.lock` and preserves comments. From its source at the time of writing: its lock reader keeps [one version per package name](https://github.com/Alirex/uv_upgrade/blob/main/src/uv_upx/services/dependencies_from_project/parse_from_uv_lock_file.py), so a forked package gets the last version listed, the case shown above; it raises `>=` only and [ignores `~=`](https://github.com/Alirex/uv_upgrade/blob/main/src/uv_upx/services/dependency_up/constants/operators.py); it adds `>=locked` to bare names unless told not to; and its `--help` lists no CI exit-code mode. It has an interactive accept/reject mode, which lockfloor does not.
+
+## Limits
+
+- Raising floors is what an application wants. A library that should keep supporting old releases should not run `--write` blindly; read the table.
+- Fork overlap is tested on a grid of CPython 3.8 to 3.15 on Linux (x86_64, aarch64), macOS (arm64, x86_64) and Windows. A marker on anything else (PyPy, an exotic platform) keeps every fork, which only lowers the floor.
+- `[tool.uv] constraint-dependencies` and `override-dependencies`, and `requirements.txt` files, are not touched.
+- A member whose metadata is built dynamically from git (setuptools-scm, hatch-vcs) may fail to lock in the scratch copy, which has no `.git`.
+- There is no interactive mode and no major/minor/patch filter.
+
+## Development
+
+```
+py -3.12 -m venv .venv && .venv/Scripts/python -m pip install -e . pytest
+.venv/Scripts/python -m pytest              # offline suite, fake resolver
+.venv/Scripts/python -m pytest -m network   # real uv against PyPI
+```
+
+MIT licensed.

lockfloor-0.1.0/examples/forked-workspace/packages/core/pyproject.toml

@@ -0,0 +1,12 @@
+[project]
+name = "demo-core"
+version = "0.1.0"
+requires-python = ">=3.9"
+dependencies = [
+    "attrs>=22.1",
+    "idna~=3.4",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"

lockfloor-0.1.0/examples/forked-workspace/pyproject.toml

@@ -0,0 +1,27 @@
+[project]
+name = "demo-app"
+version = "0.1.0"
+requires-python = ">=3.9"
+dependencies = [
+    # HTTP client; stay below 1.0 until the migration lands
+    "httpx>=0.25,<1",
+    "numpy>=1.24",  # the resolver forks this one across Python versions
+    'rich == 13.7.0',  # pinned on purpose
+    "click>=8.0 ; python_version >= '3.10'",
+    "demo-core",
+]
+
+[project.optional-dependencies]
+yaml = ["pyyaml>=6.0"]
+
+[dependency-groups]
+dev = [
+    "pytest>=7.0",
+    "packaging",
+]
+
+[tool.uv.sources]
+demo-core = { workspace = true }
+
+[tool.uv.workspace]
+members = ["packages/*"]

lockfloor-0.1.0/pyproject.toml

@@ -0,0 +1,40 @@
+[project]
+name = "lockfloor"
+version = "0.1.0"
+description = "Raise pyproject.toml lower bounds to the versions uv's resolver locks together"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Zaid Ali Syed", email = "sidzaid72@gmail.com" }]
+requires-python = ">=3.11"
+keywords = ["uv", "pyproject", "dependencies", "upgrade", "lockfile"]
+classifiers = [
+    "Environment :: Console",
+    "Programming Language :: Python :: 3",
+    "Topic :: Software Development :: Build Tools",
+]
+dependencies = [
+    "packaging>=24.0",
+    "tomlkit>=0.12.0",
+]
+
+[project.urls]
+Repository = "https://github.com/zaidwhy/lockfloor"
+Issues = "https://github.com/zaidwhy/lockfloor/issues"
+"uv issue" = "https://github.com/astral-sh/uv/issues/6794"
+
+[project.scripts]
+lockfloor = "lockfloor.cli:main"
+
+
+[dependency-groups]
+dev = ["pytest>=8.0"]
+
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+markers = ["network: runs the real uv resolver against PyPI"]
+addopts = "-m 'not network'"

lockfloor-0.1.0/src/lockfloor/__init__.py

@@ -0,0 +1,3 @@
+"""Raise pyproject.toml lower bounds to the versions uv's resolver locks together."""
+
+__version__ = "0.1.0"

lockfloor-0.1.0/src/lockfloor/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from lockfloor.cli import main
+
+sys.exit(main())

lockfloor-0.1.0/src/lockfloor/cli.py

@@ -0,0 +1,213 @@
+"""lockfloor: raise pyproject.toml lower bounds to the versions uv's resolver locks together."""
+
+from __future__ import annotations
+
+import argparse
+import logging
+import sys
+from pathlib import Path
+
+from packaging.requirements import InvalidRequirement, Requirement
+from packaging.utils import canonicalize_name
+
+from lockfloor import __version__
+from lockfloor.lockfile import LockIndex
+from lockfloor.manifest import (
+    Manifest,
+    ProjectError,
+    Slot,
+    find_workspace_root,
+    load_manifest,
+    requirement_slots,
+    workspace_manifests,
+)
+from lockfloor.plan import Row, plan_rows
+from lockfloor.resolver import ResolveError, UvResolver
+from lockfloor.specifier import is_pin, loosen_pin, split_name
+
+logger = logging.getLogger("lockfloor")
+
+EXIT_OK = 0
+EXIT_UPGRADES_PENDING = 1
+EXIT_ERROR = 2
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="lockfloor",
+        description=(
+            "Raise pyproject.toml lower bounds to the versions uv's resolver locks together. "
+            "Dry run by default."
+        ),
+    )
+    parser.add_argument("names", nargs="*", metavar="DEPENDENCY", help="only these dependencies (default: all)")
+    parser.add_argument("--project", type=Path, default=Path.cwd(), help="project or workspace directory")
+    parser.add_argument(
+        "--package", action="append", default=[], metavar="MEMBER", help="only this workspace member (repeatable)"
+    )
+    parser.add_argument(
+        "--group",
+        action="append",
+        default=[],
+        metavar="GROUP",
+        help="only this group: main, a dependency-group name, or extra:NAME (repeatable)",
+    )
+    parser.add_argument("--pins", action="store_true", help="also move single == pins to the resolved version")
+    mode = parser.add_mutually_exclusive_group()
+    mode.add_argument("--write", action="store_true", help="rewrite pyproject.toml files and re-lock")
+    mode.add_argument("--check", action="store_true", help="exit 1 when any floor can be raised (for CI)")
+    parser.add_argument("--timeout", type=float, default=300.0, help="seconds allowed per uv call (default 300)")
+    parser.add_argument("-v", "--verbose", action="store_true", help="log the uv commands")
+    parser.add_argument("--version", action="version", version=f"lockfloor {__version__}")
+    return parser
+
+
+def main(argv: list[str] | None = None, resolver: object | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    logging.basicConfig(level=logging.DEBUG if args.verbose else logging.WARNING, format="%(name)s: %(message)s")
+    if args.timeout <= 0:
+        print("lockfloor: --timeout must be positive", file=sys.stderr)
+        return EXIT_ERROR
+    try:
+        return _run(args, resolver or UvResolver(args.timeout))
+    except (ProjectError, ResolveError) as exc:
+        print(f"lockfloor: {exc}", file=sys.stderr)
+        return EXIT_ERROR
+
+
+def _run(args: argparse.Namespace, resolver) -> int:
+    root = find_workspace_root(args.project)
+    manifests = workspace_manifests(root)
+    slots = _select(manifests, args)
+    if not slots:
+        print("lockfloor: no requirements to look at")
+        return EXIT_OK
+
+    filtered = bool(args.names or args.group or args.package)
+    upgrade = sorted({_name(s.raw) for s in slots if _name(s.raw)}) if filtered else None
+    pins = [s for s in slots if args.pins and is_pin(s.raw)]
+    lock_text = resolver.upgraded_lock(root, upgrade, _pin_loosener(root, pins), _paths_escape(root, manifests))
+
+    rows = plan_rows(slots, LockIndex(lock_text), pins=args.pins)
+    print(render_table(rows, show_member=len(manifests) > 1))
+    raised = [r for r in rows if r.raises]
+    skipped = [r for r in rows if r.verdict.skip]
+    current = len(rows) - len(raised) - len(skipped)
+    print(f"\n{len(raised)} to raise, {len(skipped)} left alone, {current} already at the resolved version.")
+
+    if args.check:
+        return EXIT_UPGRADES_PENDING if raised else EXIT_OK
+    if not args.write:
+        print("Dry run: no file was written. Pass --write to apply and re-lock.")
+        return EXIT_OK
+    if not raised:
+        return EXIT_OK
+    _apply(root, raised, lock_text, resolver)
+    files = sorted({r.slot.manifest.path.relative_to(root).as_posix() for r in raised})
+    print(f"Wrote {', '.join(files)} and re-locked uv.lock.")
+    return EXIT_OK
+
+
+def _select(manifests: list[Manifest], args: argparse.Namespace) -> list[Slot]:
+    slots = [slot for manifest in manifests for slot in requirement_slots(manifest)]
+    if args.package:
+        known = {canonicalize_name(m.label): m for m in manifests}
+        wanted = {canonicalize_name(p) for p in args.package}
+        unknown = wanted - known.keys()
+        if unknown:
+            raise ProjectError(f"--package {', '.join(sorted(unknown))} is not a workspace member; members: {', '.join(m.label for m in manifests)}")
+        slots = [s for s in slots if canonicalize_name(s.manifest.label) in wanted]
+    if args.group:
+        labels = {s.group_label for s in slots}
+        unknown = set(args.group) - labels
+        if unknown:
+            raise ProjectError(f"--group {', '.join(sorted(unknown))} not found; groups here: {', '.join(sorted(labels))}")
+        slots = [s for s in slots if s.group_label in args.group]
+    if args.names:
+        wanted_names = {canonicalize_name(n) for n in args.names}
+        slots = [s for s in slots if _name(s.raw) in wanted_names]
+        if not slots:
+            raise ProjectError(f"no requirement named {', '.join(args.names)} in the selected groups")
+    return slots
+
+
+def _name(raw: str) -> str | None:
+    try:
+        return canonicalize_name(Requirement(raw).name)
+    except InvalidRequirement:
+        return None
+
+
+def _pin_loosener(root: Path, pins: list[Slot]):
+    """Return a callback that rewrites `==X` to `>=X` in the scratch copy, so uv may move the pin."""
+
+    def loosen(copy: Path) -> None:
+        by_file: dict[Path, list[Slot]] = {}
+        for slot in pins:
+            by_file.setdefault(slot.manifest.path, []).append(slot)
+        for path, file_pins in by_file.items():
+            scratch_manifest = load_manifest(copy / path.relative_to(root), copy)
+            scratch_slots = {(s.section, s.group, s.index): s for s in requirement_slots(scratch_manifest)}
+            for pin in file_pins:
+                scratch_slots[(pin.section, pin.group, pin.index)].replace(loosen_pin(pin.raw))
+            scratch_manifest.path.write_bytes(scratch_manifest.dump())
+
+    return loosen
+
+
+def _paths_escape(root: Path, manifests: list[Manifest]) -> bool:
+    """True when a [tool.uv.sources] path points outside the workspace root."""
+    for manifest in manifests:
+        sources = ((manifest.document.get("tool") or {}).get("uv") or {}).get("sources") or {}
+        for source in sources.values():
+            for entry in source if isinstance(source, list) else [source]:
+                path = entry.get("path") if hasattr(entry, "get") else None
+                if path and not (manifest.path.parent / str(path)).resolve().is_relative_to(root):
+                    return True
+    return False
+
+
+def _apply(root: Path, raised: list[Row], lock_text: str, resolver) -> None:
+    """Rewrite manifests, adopt the resolved lock, re-lock; restore every byte if any step fails."""
+    lock_path = root / "uv.lock"
+    lock_before = lock_path.read_bytes() if lock_path.exists() else None
+    touched = {id(r.slot.manifest): r.slot.manifest for r in raised}.values()
+    done = False
+    try:
+        for row in raised:
+            row.slot.replace(row.verdict.new)
+        for manifest in touched:
+            manifest.path.write_bytes(manifest.dump())
+        lock_path.write_bytes(lock_text.encode("utf-8"))
+        resolver.relock(root)
+        done = True
+    finally:
+        if not done:
+            for manifest in touched:
+                manifest.path.write_bytes(manifest.original)
+            if lock_before is None:
+                lock_path.unlink(missing_ok=True)
+            else:
+                lock_path.write_bytes(lock_before)
+            print("lockfloor: write failed; pyproject.toml files and uv.lock restored", file=sys.stderr)
+
+
+def render_table(rows: list[Row], *, show_member: bool) -> str:
+    header = (["member"] if show_member else []) + ["group", "package", "old", "new", "note"]
+    lines = [header]
+    for row in rows:
+        if not row.raises and not row.verdict.skip:
+            continue
+        old = split_name(row.slot.raw)[1].strip()
+        new = split_name(row.verdict.new)[1].strip() if row.verdict.new else "-"
+        note = row.verdict.skip or row.note
+        if row.verdict.skip:
+            note = f"skipped: {note}"
+        cells = ([row.slot.manifest.label] if show_member else []) + [row.slot.group_label, row.package, old, new, note]
+        lines.append(cells)
+    if len(lines) == 1:
+        return "Every floor already matches the resolved lock."
+    widths = [max(len(line[i]) for line in lines) for i in range(len(header))]
+    rendered = ["  ".join(cell.ljust(w) for cell, w in zip(line, widths)).rstrip() for line in lines]
+    rendered.insert(1, "  ".join("-" * w for w in widths))
+    return "\n".join(rendered)