nab-python 0.0.5__py3-none-any.whl → 0.0.7__py3-none-any.whl

nab_python/_build/env.py

@@ -6,7 +6,7 @@
 * ``venv.EnvBuilder`` (stdlib) creates an empty interpreter at a temp
   path, ``with_pip=False``; nab does not need pip in there.
 * nab's own resolver picks versions for ``[build-system].requires``
-  using the same indexes / ``exclude-newer`` window as the outer
+  using the same indexes / ``uploaded-prior-to`` window as the outer
   resolve.
 * ``download_lock`` from :mod:`nab_python.download` fetches the
   resolved wheels into a temp directory.
@@ -37,6 +37,7 @@ from installer.destinations import SchemeDictionaryDestination
 from installer.sources import WheelFile
 from nab_index.urllib3_async_transport import Urllib3AsyncTransport
 
+from .._vcs_admission import UnsupportedVcsError
 from ..config import NabProjectConfig
 from ..download import download_lock
 
@@ -97,7 +98,7 @@ class NabBuildEnv:
 
     ``requires`` is the PEP 508 string list from
     ``[build-system].requires``. ``config`` carries the indexes,
-    ``exclude-newer`` window and other nab inputs from the outer
+    ``uploaded-prior-to`` window and other nab inputs from the outer
     resolve; it is pruned (no local sources, no workspace, no
     marker overlay) before the inner resolve so the build env is
     computed against PyPI alone.
@@ -269,20 +270,27 @@ class NabBuildEnv:
 
         inner_config = NabProjectConfig(
             indexes=self._config.indexes,
+            package_overrides=self._config.package_overrides,
             index_overrides=self._config.index_overrides,
             uploaded_prior_to=self._config.uploaded_prior_to,
-            uploaded_prior_to_overrides=self._config.uploaded_prior_to_overrides,
         )
         # download_lock closes its transport, and ``install`` may call
         # this again for ``get_requires_for_build_wheel`` follow-ups;
         # build a fresh transport each time.
         transport = self._transport_factory()
-        result = resolve_pyproject(
-            synthetic,
-            transport,
-            config=inner_config,
-            python_version=self._python_version,
-        )
+        try:
+            result = resolve_pyproject(
+                synthetic,
+                transport,
+                config=inner_config,
+                python_version=self._python_version,
+            )
+        except (UnsupportedVcsError, NotImplementedError) as exc:
+            # A direct-URL/VCS build requirement means nab cannot build this
+            # sdist. Report it as a build-env failure so the outer resolve
+            # skips the version instead of aborting on the raw error.
+            msg = f"build env resolve failed: {exc}"
+            raise BuildEnvError(msg) from exc
 
         # Reject sdist-only pins early: build deps that ship only an
         # sdist trigger a recursive backend invocation that this

nab_python/_build/runner.py

@@ -33,12 +33,12 @@ import build
 import pyproject_hooks
 import tomli
 
-from .._vendor.packaging.requirements import Requirement
+from nab_resolver.resolver import ResolutionError
+
+from .._vendor.packaging.requirements import InvalidRequirement, Requirement
 from .._vendor.packaging.specifiers import InvalidSpecifier, SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
 from .._vendor.packaging.version import InvalidVersion, Version
-from nab_resolver.resolver import ResolutionError
-
 from ..metadata import WheelMetadata
 from .env import BuildEnvError, NabBuildEnv
 from .errors import BuildBackendError
@@ -238,21 +238,25 @@ def _parse_metadata(metadata_path: Path) -> WheelMetadata:
             SpecifierSet(requires_python_raw) if requires_python_raw else None
         )
     except InvalidSpecifier as exc:
-        msg = f"backend METADATA has invalid Requires-Python {requires_python_raw!r}: {exc}"
+        msg = (
+            f"backend METADATA has invalid Requires-Python "
+            f"{requires_python_raw!r}: {exc}"
+        )
         raise BuildBackendError(msg) from exc
 
-    requires_dist: list[Requirement] = []
-    for raw in msg_obj.get_all("Requires-Dist") or ():
-        try:
-            requires_dist.append(Requirement(raw))
-        except (ValueError, TypeError):  # noqa: PERF203
-            logger.warning("skipping unparseable Requires-Dist: %s", raw)
+    try:
+        requires_dist: list[Requirement] = [
+            Requirement(raw) for raw in msg_obj.get_all("Requires-Dist") or ()
+        ]
+    except InvalidRequirement as exc:
+        msg = f"backend METADATA has an invalid Requires-Dist: {exc}"
+        raise BuildBackendError(msg) from exc
 
     provides_extra: list[str] = sorted(
         {
-            canonicalize_name(extra)
+            canonicalize_name(stripped)
             for extra in msg_obj.get_all("Provides-Extra") or ()
-            if extra
+            if (stripped := extra.strip())
         }
     )
 

nab_python/_conflict_kind.py

@@ -8,6 +8,14 @@ cycle.  :class:`nab_python.config.ConflictKind` takes its enum values from
 
 from __future__ import annotations
 
+import re
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Mapping
+
+    from ._vendor.packaging.markers import Marker
+
 KIND_EXTRA = "extra"
 KIND_GROUP = "group"
 
@@ -18,3 +26,37 @@ MARKER_VARIABLE_FOR_KIND = {
     KIND_EXTRA: "extras",
     KIND_GROUP: "dependency_groups",
 }
+
+# ``extras`` and ``dependency_groups`` are PEP 685 / PEP 735 set variables that
+# packaging only defines when consuming a lockfile.  At resolve time no
+# conflict-fork member is active as a marker-set member (forks fold their
+# members into requirements, not the environment), so both are empty.  Seeding
+# them keeps a dependency marker that tests one from raising a raw KeyError at
+# evaluation; the membership simply tests False and the dep is dropped.
+EMPTY_MEMBERSHIP_SETS: dict[str, frozenset[str]] = {
+    variable: frozenset() for variable in MARKER_VARIABLE_FOR_KIND.values()
+}
+
+_MEMBERSHIP_SET_PATTERN = re.compile(
+    r"\b(" + "|".join(MARKER_VARIABLE_FOR_KIND.values()) + r")\b"
+)
+
+
+def membership_set_in_marker(marker_text: str) -> str | None:
+    """Return the lockfile-only set variable a marker tests, or ``None``.
+
+    A dependency marker that tests ``extras`` or ``dependency_groups`` is a
+    mistake (usually meant as ``extra ==``): those variables are defined only
+    when consuming a lockfile, so they are empty at resolve time.
+    """
+    match = _MEMBERSHIP_SET_PATTERN.search(marker_text)
+    return match.group(1) if match else None
+
+
+def dependency_marker_holds(marker: Marker, environment: Mapping[str, str]) -> bool:
+    """Evaluate a dependency marker for a resolve-time ``environment``.
+
+    Seeds the empty lockfile-only set variables so a marker that tests one
+    evaluates cleanly to False instead of raising a raw KeyError.
+    """
+    return bool(marker.evaluate({**environment, **EMPTY_MEMBERSHIP_SETS}))

nab_python/_lockfile/builder.py

@@ -13,7 +13,7 @@ from collections import defaultdict
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import TYPE_CHECKING, Protocol, overload
-from urllib.parse import urlsplit, urlunsplit
+from urllib.parse import quote, urlsplit, urlunsplit
 
 import tomli
 
@@ -21,6 +21,7 @@ from nab_index.client import SdistFile, WheelFile
 
 from .._toml import tool_nab_section
 from .._vendor.packaging.pylock import Pylock, PylockValidationError
+from .._vendor.packaging.specifiers import InvalidSpecifier, SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
 
 if TYPE_CHECKING:
@@ -30,6 +31,7 @@ if TYPE_CHECKING:
 
     from .._vendor.packaging.version import Version
     from ..lockfile import (
+        ArchivePin,
         IndexPin,
         LockInput,
         PinShape,
@@ -37,7 +39,7 @@ if TYPE_CHECKING:
         VcsPin,
         WheelArtifact,
     )
-    from ..provider import DistPolicy, LocalSource, VcsSource
+    from ..provider import ArchiveSource, DistPolicy, LocalSource, VcsSource
 
 
 __all__ = [
@@ -47,6 +49,7 @@ __all__ = [
     "build_lock_input_from_provider",
     "read_lockfile_anchor",
     "read_lockfile_packages",
+    "require_artifact_hashes",
 ]
 
 
@@ -94,6 +97,10 @@ class LockInputProvider(Protocol):
         """Return the configured VcsSource for ``canonical_name`` or None."""
         ...
 
+    def archive_source_for(self, canonical_name: str, /) -> ArchiveSource | None:
+        """Return the configured ArchiveSource for ``canonical_name`` or None."""
+        ...
+
     def vcs_pin_for(self, canonical_name: str, /) -> str | None:
         """Return the resolved 40-char SHA captured during materialisation."""
         ...
@@ -104,8 +111,16 @@ class LockInputProvider(Protocol):
         """Return the listing slice that matches ``(canonical_name, version)``."""
         ...
 
-    def effective_dist_policy(self, canonical_name: str, /) -> DistPolicy:
-        """Return the effective :class:`DistPolicy` for ``canonical_name``."""
+    def effective_dist_policy(
+        self, canonical_name: str, version: Version, index_name: str | None = None, /
+    ) -> DistPolicy:
+        """Return the effective :class:`DistPolicy` for ``canonical_name==version``."""
+        ...
+
+    def effective_requires_python(
+        self, canonical_name: str, version: Version, /
+    ) -> str | None:
+        """Return the ``requires-python`` override for ``canonical_name==version``."""
         ...
 
 
@@ -205,17 +220,23 @@ def read_lockfile_packages(path: Path) -> dict[str, Version] | None:
 
 
 def _strip_userinfo(url: str) -> str:
-    """Return ``url`` with any ``user:password@`` userinfo removed.
-
-    Lockfiles are committed to version control, so an index or VCS
-    URL carrying embedded credentials must not be written verbatim.
-    Only the userinfo is dropped: host case and port are preserved
-    and a ``git+`` scheme prefix is left intact.  A no-op for URLs
-    without credentials.
+    """Return ``url`` with credential userinfo removed.
+
+    Lockfiles are committed to version control, so an index or VCS URL
+    carrying an embedded ``user:password`` must not be written verbatim.
+    An SSH login such as ``git@`` is the protocol login, not a secret,
+    and is required to clone, so it is kept (only an embedded password is
+    dropped); host case and port are preserved.  A no-op for URLs without
+    userinfo.
     """
     parts = urlsplit(url)
-    netloc = parts.netloc.rpartition("@")[2]
-    return urlunsplit(parts._replace(netloc=netloc))
+    userinfo, sep, host = parts.netloc.rpartition("@")
+    if not sep:
+        return url
+    if parts.scheme.endswith("ssh"):
+        login = userinfo.split(":", 1)[0]
+        host = f"{login}@{host}"
+    return urlunsplit(parts._replace(netloc=host))
 
 
 def build_lock_input_from_provider(  # noqa: PLR0913 - each flag maps to a distinct lockfile field
@@ -272,6 +293,12 @@ def build_lock_input_from_provider(  # noqa: PLR0913 - each flag maps to a disti
                 resolved_sha=provider.vcs_pin_for(canonical),
             )
             continue
+        archive_source = provider.archive_source_for(canonical)
+        if archive_source is not None:
+            lock_pins[canonical] = _archive_pin_from_source(
+                canonical, version, archive_source
+            )
+            continue
         lock_pins[canonical] = _index_pin_from_listing(
             provider, canonical, version, indexes
         )
@@ -324,6 +351,9 @@ def _forward_dependency_graph(
                 for dep in extra_map.get(extra, {})
             )
         dep_names &= pinned
+        # An umbrella extra (pkg[all] pulling pkg[graphviz]) can name its own
+        # package; drop it so pkg is never an edge to itself.
+        dep_names.discard(canonical)
         if dep_names:
             graph[canonical] = tuple(sorted(dep_names))
     return graph
@@ -348,13 +378,23 @@ def _index_pin_from_listing(
     package's wheels stayed in ``versions_cache`` as a possible
     metadata source for the resolver; only the sdist is emitted
     into the lock so installers download and build that archive.
+
+    A ``requires-python`` metadata override takes precedence over the
+    Simple-API value so the pin records the specifier the resolver
+    actually admitted against; a conforming :pep:`751` installer would
+    otherwise reject a widened pin whose lock still carried the narrow
+    artefact value.
     """
     from ..fetch import DEFAULT_INDEX_URL
     from ..lockfile import IndexPin, SdistArtifact, WheelArtifact
     from ..provider import DistPolicy
 
     files = list(provider.dist_files_for(canonical, version))
-    if provider.effective_dist_policy(canonical) is DistPolicy.SDIST_INSTALL:
+    serving = provider.coordinator.index.get_listing_index(canonical)
+    if (
+        provider.effective_dist_policy(canonical, version, serving)
+        is DistPolicy.SDIST_INSTALL
+    ):
         files = [f for f in files if not isinstance(f, WheelFile)]
         if not any(isinstance(f, SdistFile) for f in files):
             msg = (
@@ -365,17 +405,18 @@ def _index_pin_from_listing(
             raise MissingSdistError(msg)
 
     wheels = tuple(
-        _build_artifact(canonical, f, WheelArtifact)
-        for f in files
-        if isinstance(f, WheelFile)
+        _build_artifact(f, WheelArtifact) for f in files if isinstance(f, WheelFile)
     )
     sdist_file = next((f for f in files if isinstance(f, SdistFile)), None)
     sdist = (
-        _build_artifact(canonical, sdist_file, SdistArtifact)
-        if sdist_file is not None
-        else None
+        _build_artifact(sdist_file, SdistArtifact) if sdist_file is not None else None
+    )
+
+    override_rp = provider.effective_requires_python(canonical, version)
+    requires_python = (
+        override_rp if override_rp is not None else _common_requires_python(files)
     )
-    requires_python = _common_requires_python(files)
+
     serving_name = provider.coordinator.index.get_listing_index(canonical)
     by_name = {ix.name: ix.url for ix in indexes}
     index_url = by_name.get(serving_name) if serving_name is not None else None
@@ -402,25 +443,22 @@ def _index_pin_from_listing(
 
 @overload
 def _build_artifact(
-    canonical: str,
     source: WheelFile | SdistFile,
     cls: type[WheelArtifact],
 ) -> WheelArtifact: ...
 @overload
 def _build_artifact(
-    canonical: str,
     source: WheelFile | SdistFile,
     cls: type[SdistArtifact],
 ) -> SdistArtifact: ...
 def _build_artifact(
-    canonical: str,
     source: WheelFile | SdistFile,
     cls: type[WheelArtifact | SdistArtifact],
 ) -> WheelArtifact | SdistArtifact:
-    hashes = _filter_acceptable_hashes(canonical, source.filename, source.hashes)
+    hashes = _filter_acceptable_hashes(source.hashes)
     return cls(
         filename=source.filename,
-        url=source.url,
+        url=_strip_userinfo(source.url),
         hashes=hashes,
         size=source.size,
         upload_time=_parse_upload_time(source.upload_time),
@@ -449,38 +487,74 @@ def _parse_upload_time(raw: str | None) -> datetime | None:
 
 
 def _filter_acceptable_hashes(
-    canonical: str, filename: str, hashes: tuple[tuple[str, str], ...]
+    hashes: tuple[tuple[str, str], ...],
 ) -> tuple[tuple[str, str], ...]:
     """Return the subset of ``hashes`` whose algorithm is consumable.
 
     Pip's hash-checking mode and PEP 751 both accept any of sha256,
     sha384, or sha512; nab forwards every recorded entry so consumers
-    can pick.  Raise :class:`MissingHashError` when none of the
-    acceptable algorithms are present.
+    can pick.  Unacceptable algorithms (e.g. md5) are dropped, so the
+    result may be empty.
     """
     from ..lockfile import ACCEPTED_HASH_ALGORITHMS
 
-    accepted = tuple(
+    return tuple(
         (algo, digest)
         for algo, digest in sorted(hashes)
         if algo in ACCEPTED_HASH_ALGORITHMS
     )
-    if not accepted:
-        algos = sorted({algo for algo, _ in hashes})
-        msg = (
-            f"{canonical}: artefact {filename!r} has no acceptable hash"
-            f" (need one of {list(ACCEPTED_HASH_ALGORITHMS)!r}, got {algos!r})"
-        )
-        raise MissingHashError(msg)
-    return accepted
+
+
+def require_artifact_hashes(lock_input: LockInput) -> None:
+    """Raise :class:`MissingHashError` if a pinned artefact has no hash.
+
+    PEP 751 and pip's hash-checking mode each need at least one of
+    sha256/sha384/sha512 per artefact.  The plain ``name==version``
+    writer records no hash and does not call this.
+    """
+    from ..lockfile import ACCEPTED_HASH_ALGORITHMS, IndexPin
+
+    pin_groups: Iterable[Mapping[str, PinShape]] = (
+        lock_input.pins,
+        *lock_input.per_tuple_pins.values(),
+    )
+    for pins in pin_groups:
+        for pin in pins.values():
+            if not isinstance(pin, IndexPin):
+                continue
+            artefacts = (*pin.wheels, *((pin.sdist,) if pin.sdist is not None else ()))
+            for artefact in artefacts:
+                if not artefact.hashes:
+                    msg = (
+                        f"{pin.name}: artefact {artefact.filename!r} has no "
+                        f"acceptable hash (need one of "
+                        f"{list(ACCEPTED_HASH_ALGORITHMS)!r})"
+                    )
+                    raise MissingHashError(msg)
 
 
 def _common_requires_python(files: Iterable[WheelFile | SdistFile]) -> str | None:
-    """Return a single Requires-Python value if all files agree, else ``None``."""
+    """Return the package-level Requires-Python value, or ``None``.
+
+    An artefact with no Requires-Python is unconstrained, so a single
+    such artefact leaves the whole package unconstrained. Otherwise the
+    value survives only when every artefact agrees.
+
+    A malformed value counts as unconstrained too, matching
+    ``excluded_by_python``, which admits a dist whose Requires-Python is
+    an unparseable specifier on any Python. So the lock writer always
+    parses a valid specifier or ``None``, and the pin is never
+    over-constrained by an artefact whose floor nab could not read.
+    """
     seen: set[str] = set()
     for f in files:
-        if f.requires_python is not None:
-            seen.add(f.requires_python)
+        if f.requires_python is None:
+            return None
+        try:
+            SpecifierSet(f.requires_python)
+        except InvalidSpecifier:
+            return None
+        seen.add(f.requires_python)
     if len(seen) == 1:
         return next(iter(seen))
     return None
@@ -538,7 +612,7 @@ def _vcs_pin_from_source(
     bare_repo_url = _strip_userinfo(parsed.repo_url)
     repo_url = f"{parsed.scheme}+{bare_repo_url}@{resolved_sha}"
     if parsed.subdirectory:
-        repo_url += f"#subdirectory={parsed.subdirectory}"
+        repo_url += f"#subdirectory={quote(parsed.subdirectory, safe='/')}"
 
     return VcsPin(
         name=canonical,
@@ -550,3 +624,30 @@ def _vcs_pin_from_source(
         requested_revision=requested_revision,
         vcs_type=parsed.scheme,
     )
+
+
+def _archive_pin_from_source(
+    canonical: str,
+    version: Version,
+    source: ArchiveSource,
+) -> ArchivePin:
+    """Build an :class:`ArchivePin` from an :class:`ArchiveSource`.
+
+    The URL, hashes, and subdirectory come from the source declaration,
+    which config parse validated (a hash is required), so the pin records
+    the exact archive the resolve used.  The URL is stripped of any
+    credential userinfo, like every other pin, so a committed lockfile
+    never carries a token.
+    """
+    from nab_index.archive import ArchiveRequest
+
+    from ..lockfile import ArchivePin
+
+    request = ArchiveRequest.parse(source.url)
+    return ArchivePin(
+        name=canonical,
+        version=str(version),
+        url=_strip_userinfo(request.url),
+        hashes=request.hashes,
+        subdirectory=request.subdirectory or None,
+    )

nab_python/_lockfile/disjointness.py

@@ -99,8 +99,8 @@ def validate_marker_disjointness(
 
     ``declared_groups`` carries every conflict set regardless of policy
     so the hint can distinguish an undeclared collision (suggest adding
-    a declaration) from one already declared under ``at_least_one``
-    (suggest tightening to ``at_most_one`` or ``exactly_one``).
+    a declaration) from one already declared under ``at-least-one``
+    (suggest tightening to ``at-most-one`` or ``exactly-one``).
     """
     if not environments:
         return
@@ -265,7 +265,7 @@ def _conflict_hint(
     because a conflict declaration would not help.
 
     When ``declared_groups`` already covers the active members, the
-    hint instead suggests tightening the policy: an ``at_least_one``
+    hint instead suggests tightening the policy: an ``at-least-one``
     declaration permits co-selection, so the validator still raises and
     the user has to switch to an exclusive policy to prune the point.
     """
@@ -288,8 +288,8 @@ def _conflict_hint(
     if already_declared:
         return (
             ". These members are declared in [tool.nab].conflicts under a"
-            " policy that permits co-selection; switch to at_most_one or"
-            " exactly_one to prune the colliding context"
+            " policy that permits co-selection; switch to at-most-one or"
+            " exactly-one to prune the colliding context"
         )
     return (
         ". If these are intentionally mutually exclusive, declare them in"

nab_python/_lockfile/pylock.py

@@ -21,6 +21,7 @@ import tomli_w
 from .._vendor.packaging.markers import Marker
 from .._vendor.packaging.pylock import (
     Package,
+    PackageArchive,
     PackageDirectory,
     PackageSdist,
     PackageVcs,
@@ -31,6 +32,7 @@ from .._vendor.packaging.specifiers import SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
 from .._vendor.packaging.version import Version
 from ..config import conflict_exclusion_groups, conflict_member_groups
+from .builder import require_artifact_hashes
 from .disjointness import validate_marker_disjointness
 
 if TYPE_CHECKING:
@@ -82,14 +84,26 @@ def write_lock(
     With no ``output_path`` the current directory is the base.
     """
     lock_dir = Path(output_path).parent if output_path is not None else None
-    pylock = build_pylock(lock_input, lock_dir=lock_dir)
-    pylock.validate()
-    text = tomli_w.dumps(dict(pylock.to_dict()))
+    text = render_lock(lock_input, lock_dir=lock_dir)
     if output_path is not None:
         Path(output_path).write_text(text, encoding="utf-8")
     return text
 
 
+def render_lock(lock_input: LockInput, *, lock_dir: Path | None = None) -> str:
+    """Serialise ``lock_input`` to PEP 751 TOML text without writing a file.
+
+    ``lock_dir`` is the directory the lock will live in; directory, wheel
+    and sdist paths are emitted relative to it so the lock stays portable.
+    Defaults to the current directory.  Used by ``write_lock`` and by
+    ``nab lock --locked`` to render the would-be lock for comparison.
+    """
+    require_artifact_hashes(lock_input)
+    pylock = build_pylock(lock_input, lock_dir=lock_dir)
+    pylock.validate()
+    return tomli_w.dumps(dict(pylock.to_dict()))
+
+
 def build_pylock(lock_input: LockInput, *, lock_dir: Path | None = None) -> Pylock:
     """Build a :class:`Pylock` from the input shape.
 
@@ -201,7 +215,7 @@ def _pin_to_package(
     lock_dir: Path,
     dependencies: list[dict[str, str]] | None = None,
 ) -> Package:
-    from ..lockfile import IndexPin, LocalPin, VcsPin
+    from ..lockfile import ArchivePin, IndexPin, LocalPin, VcsPin
 
     if isinstance(pin, IndexPin):
         return Package(
@@ -254,6 +268,20 @@ def _pin_to_package(
                 requested_revision=pin.requested_revision,
             ),
         )
+    if isinstance(pin, ArchivePin):
+        # An archive is content-pinned by its hash, so the version is
+        # stable and recorded (unlike the directory/VCS cases above).
+        return Package(
+            name=canonicalize_name(pin.name),
+            version=Version(pin.version),
+            marker=marker,
+            dependencies=dependencies,
+            archive=PackageArchive(
+                url=pin.url,
+                hashes=dict(pin.hashes),
+                subdirectory=pin.subdirectory,
+            ),
+        )
     msg = f"unknown pin shape: {pin!r}"
     raise TypeError(msg)
 
@@ -410,7 +438,7 @@ def _group_pins_by_pin(
 
 def _pin_discriminator(pin: PinShape) -> tuple:
     """Return a hashable key that identifies the source + version of ``pin``."""
-    from ..lockfile import IndexPin, LocalPin, VcsPin
+    from ..lockfile import ArchivePin, IndexPin, LocalPin, VcsPin
 
     if isinstance(pin, IndexPin):
         return ("index", pin.version, pin.index)
@@ -434,6 +462,8 @@ def _pin_discriminator(pin: PinShape) -> tuple:
             pin.repo_url,
             pin.subdirectory or "",
         )
+    if isinstance(pin, ArchivePin):
+        return ("archive", pin.version, pin.url, pin.hashes, pin.subdirectory or "")
     msg = f"unknown pin shape: {pin!r}"
     raise TypeError(msg)
 
@@ -443,8 +473,9 @@ def _merge_pins_in_group(pins: list[PinShape]) -> PinShape:
 
     For :class:`IndexPin`, accumulates every distinct wheel filename
     across the contributing tuples and keeps the first non-``None``
-    sdist.  ``requires_python`` survives only when every tuple agreed,
-    matching :func:`_common_requires_python`'s rule.
+    sdist.  ``requires_python`` survives only when every tuple carried
+    the same value and none was unconstrained, matching
+    :func:`_common_requires_python`'s rule.
     Non-IndexPin shapes are already fully discriminated, so the first
     pin is returned unchanged.
     """
@@ -456,16 +487,21 @@ def _merge_pins_in_group(pins: list[PinShape]) -> PinShape:
     seen_wheels: dict[str, WheelArtifact] = {}
     sdist = head.sdist
     requires_python_set: set[str] = set()
+    any_unconstrained = False
     for pin in pins:
         assert isinstance(pin, IndexPin)
         for wheel in pin.wheels:
             seen_wheels.setdefault(wheel.filename, wheel)
         if sdist is None and pin.sdist is not None:
             sdist = pin.sdist
-        if pin.requires_python is not None:
+        if pin.requires_python is None:
+            any_unconstrained = True
+        else:
             requires_python_set.add(pin.requires_python)
     requires_python = (
-        next(iter(requires_python_set)) if len(requires_python_set) == 1 else None
+        next(iter(requires_python_set))
+        if not any_unconstrained and len(requires_python_set) == 1
+        else None
     )
     return IndexPin(
         name=head.name,
@@ -539,7 +575,7 @@ def _build_marker(
     ``tuple_markers`` means the caller has not declared a tuple
     universe and the marker is omitted.
 
-    A dep required by every member of an ``at_most_one`` set but not
+    A dep required by every member of an ``at-most-one`` set but not
     by the base is absent from ``env_base_names``, so it keeps the
     membership OR and does not install when no member is selected.
     An environment with no base-name set (no conflict fork ran) leaves