nab-python 0.0.6__py3-none-any.whl → 0.0.8__py3-none-any.whl

nab_python/_build/runner.py

@@ -33,12 +33,12 @@ import build
 import pyproject_hooks
 import tomli
 
-from .._vendor.packaging.requirements import Requirement
+from nab_resolver.resolver import ResolutionError
+
+from .._vendor.packaging.requirements import InvalidRequirement, Requirement
 from .._vendor.packaging.specifiers import InvalidSpecifier, SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
 from .._vendor.packaging.version import InvalidVersion, Version
-from nab_resolver.resolver import ResolutionError
-
 from ..metadata import WheelMetadata
 from .env import BuildEnvError, NabBuildEnv
 from .errors import BuildBackendError
@@ -238,15 +238,19 @@ def _parse_metadata(metadata_path: Path) -> WheelMetadata:
             SpecifierSet(requires_python_raw) if requires_python_raw else None
         )
     except InvalidSpecifier as exc:
-        msg = f"backend METADATA has invalid Requires-Python {requires_python_raw!r}: {exc}"
+        msg = (
+            f"backend METADATA has invalid Requires-Python "
+            f"{requires_python_raw!r}: {exc}"
+        )
         raise BuildBackendError(msg) from exc
 
-    requires_dist: list[Requirement] = []
-    for raw in msg_obj.get_all("Requires-Dist") or ():
-        try:
-            requires_dist.append(Requirement(raw))
-        except (ValueError, TypeError):  # noqa: PERF203
-            logger.warning("skipping unparseable Requires-Dist: %s", raw)
+    try:
+        requires_dist: list[Requirement] = [
+            Requirement(raw) for raw in msg_obj.get_all("Requires-Dist") or ()
+        ]
+    except InvalidRequirement as exc:
+        msg = f"backend METADATA has an invalid Requires-Dist: {exc}"
+        raise BuildBackendError(msg) from exc
 
     provides_extra: list[str] = sorted(
         {

nab_python/_lockfile/builder.py

@@ -21,6 +21,7 @@ from nab_index.client import SdistFile, WheelFile
 
 from .._toml import tool_nab_section
 from .._vendor.packaging.pylock import Pylock, PylockValidationError
+from .._vendor.packaging.specifiers import InvalidSpecifier, SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
 
 if TYPE_CHECKING:
@@ -30,6 +31,7 @@ if TYPE_CHECKING:
 
     from .._vendor.packaging.version import Version
     from ..lockfile import (
+        ArchivePin,
         IndexPin,
         LockInput,
         PinShape,
@@ -37,7 +39,7 @@ if TYPE_CHECKING:
         VcsPin,
         WheelArtifact,
     )
-    from ..provider import DistPolicy, LocalSource, VcsSource
+    from ..provider import ArchiveSource, DistPolicy, LocalSource, VcsSource
 
 
 __all__ = [
@@ -95,6 +97,10 @@ class LockInputProvider(Protocol):
         """Return the configured VcsSource for ``canonical_name`` or None."""
         ...
 
+    def archive_source_for(self, canonical_name: str, /) -> ArchiveSource | None:
+        """Return the configured ArchiveSource for ``canonical_name`` or None."""
+        ...
+
     def vcs_pin_for(self, canonical_name: str, /) -> str | None:
         """Return the resolved 40-char SHA captured during materialisation."""
         ...
@@ -287,6 +293,12 @@ def build_lock_input_from_provider(  # noqa: PLR0913 - each flag maps to a disti
                 resolved_sha=provider.vcs_pin_for(canonical),
             )
             continue
+        archive_source = provider.archive_source_for(canonical)
+        if archive_source is not None:
+            lock_pins[canonical] = _archive_pin_from_source(
+                canonical, version, archive_source
+            )
+            continue
         lock_pins[canonical] = _index_pin_from_listing(
             provider, canonical, version, indexes
         )
@@ -339,6 +351,9 @@ def _forward_dependency_graph(
                 for dep in extra_map.get(extra, {})
             )
         dep_names &= pinned
+        # An umbrella extra (pkg[all] pulling pkg[graphviz]) can name its own
+        # package; drop it so pkg is never an edge to itself.
+        dep_names.discard(canonical)
         if dep_names:
             graph[canonical] = tuple(sorted(dep_names))
     return graph
@@ -519,11 +534,27 @@ def require_artifact_hashes(lock_input: LockInput) -> None:
 
 
 def _common_requires_python(files: Iterable[WheelFile | SdistFile]) -> str | None:
-    """Return a single Requires-Python value if all files agree, else ``None``."""
+    """Return the package-level Requires-Python value, or ``None``.
+
+    An artefact with no Requires-Python is unconstrained, so a single
+    such artefact leaves the whole package unconstrained. Otherwise the
+    value survives only when every artefact agrees.
+
+    A malformed value counts as unconstrained too, matching
+    ``excluded_by_python``, which admits a dist whose Requires-Python is
+    an unparseable specifier on any Python. So the lock writer always
+    parses a valid specifier or ``None``, and the pin is never
+    over-constrained by an artefact whose floor nab could not read.
+    """
     seen: set[str] = set()
     for f in files:
-        if f.requires_python is not None:
-            seen.add(f.requires_python)
+        if f.requires_python is None:
+            return None
+        try:
+            SpecifierSet(f.requires_python)
+        except InvalidSpecifier:
+            return None
+        seen.add(f.requires_python)
     if len(seen) == 1:
         return next(iter(seen))
     return None
@@ -593,3 +624,30 @@ def _vcs_pin_from_source(
         requested_revision=requested_revision,
         vcs_type=parsed.scheme,
     )
+
+
+def _archive_pin_from_source(
+    canonical: str,
+    version: Version,
+    source: ArchiveSource,
+) -> ArchivePin:
+    """Build an :class:`ArchivePin` from an :class:`ArchiveSource`.
+
+    The URL, hashes, and subdirectory come from the source declaration,
+    which config parse validated (a hash is required), so the pin records
+    the exact archive the resolve used.  The URL is stripped of any
+    credential userinfo, like every other pin, so a committed lockfile
+    never carries a token.
+    """
+    from nab_index.archive import ArchiveRequest
+
+    from ..lockfile import ArchivePin
+
+    request = ArchiveRequest.parse(source.url)
+    return ArchivePin(
+        name=canonical,
+        version=str(version),
+        url=_strip_userinfo(request.url),
+        hashes=request.hashes,
+        subdirectory=request.subdirectory or None,
+    )

nab_python/_lockfile/pylock.py

@@ -21,6 +21,7 @@ import tomli_w
 from .._vendor.packaging.markers import Marker
 from .._vendor.packaging.pylock import (
     Package,
+    PackageArchive,
     PackageDirectory,
     PackageSdist,
     PackageVcs,
@@ -214,7 +215,7 @@ def _pin_to_package(
     lock_dir: Path,
     dependencies: list[dict[str, str]] | None = None,
 ) -> Package:
-    from ..lockfile import IndexPin, LocalPin, VcsPin
+    from ..lockfile import ArchivePin, IndexPin, LocalPin, VcsPin
 
     if isinstance(pin, IndexPin):
         return Package(
@@ -267,6 +268,20 @@ def _pin_to_package(
                 requested_revision=pin.requested_revision,
             ),
         )
+    if isinstance(pin, ArchivePin):
+        # An archive is content-pinned by its hash, so the version is
+        # stable and recorded (unlike the directory/VCS cases above).
+        return Package(
+            name=canonicalize_name(pin.name),
+            version=Version(pin.version),
+            marker=marker,
+            dependencies=dependencies,
+            archive=PackageArchive(
+                url=pin.url,
+                hashes=dict(pin.hashes),
+                subdirectory=pin.subdirectory,
+            ),
+        )
     msg = f"unknown pin shape: {pin!r}"
     raise TypeError(msg)
 
@@ -423,7 +438,7 @@ def _group_pins_by_pin(
 
 def _pin_discriminator(pin: PinShape) -> tuple:
     """Return a hashable key that identifies the source + version of ``pin``."""
-    from ..lockfile import IndexPin, LocalPin, VcsPin
+    from ..lockfile import ArchivePin, IndexPin, LocalPin, VcsPin
 
     if isinstance(pin, IndexPin):
         return ("index", pin.version, pin.index)
@@ -447,6 +462,8 @@ def _pin_discriminator(pin: PinShape) -> tuple:
             pin.repo_url,
             pin.subdirectory or "",
         )
+    if isinstance(pin, ArchivePin):
+        return ("archive", pin.version, pin.url, pin.hashes, pin.subdirectory or "")
     msg = f"unknown pin shape: {pin!r}"
     raise TypeError(msg)
 
@@ -456,8 +473,9 @@ def _merge_pins_in_group(pins: list[PinShape]) -> PinShape:
 
     For :class:`IndexPin`, accumulates every distinct wheel filename
     across the contributing tuples and keeps the first non-``None``
-    sdist.  ``requires_python`` survives only when every tuple agreed,
-    matching :func:`_common_requires_python`'s rule.
+    sdist.  ``requires_python`` survives only when every tuple carried
+    the same value and none was unconstrained, matching
+    :func:`_common_requires_python`'s rule.
     Non-IndexPin shapes are already fully discriminated, so the first
     pin is returned unchanged.
     """
@@ -469,16 +487,21 @@ def _merge_pins_in_group(pins: list[PinShape]) -> PinShape:
     seen_wheels: dict[str, WheelArtifact] = {}
     sdist = head.sdist
     requires_python_set: set[str] = set()
+    any_unconstrained = False
     for pin in pins:
         assert isinstance(pin, IndexPin)
         for wheel in pin.wheels:
             seen_wheels.setdefault(wheel.filename, wheel)
         if sdist is None and pin.sdist is not None:
             sdist = pin.sdist
-        if pin.requires_python is not None:
+        if pin.requires_python is None:
+            any_unconstrained = True
+        else:
             requires_python_set.add(pin.requires_python)
     requires_python = (
-        next(iter(requires_python_set)) if len(requires_python_set) == 1 else None
+        next(iter(requires_python_set))
+        if not any_unconstrained and len(requires_python_set) == 1
+        else None
     )
     return IndexPin(
         name=head.name,

nab_python/_lockfile/requirements.py

@@ -38,8 +38,11 @@ def write_requirements_with_hashes(
     accepts.  Local and VCS pins are emitted as ``name @ <url>`` lines
     without hashes (pip does not hash-check those forms); an editable
     local pin renders as ``-e <url>`` and a ``subdirectory`` as a
-    ``#subdirectory=`` fragment.  Returns the text and, when
-    ``output_path`` is provided, atomically writes it.
+    ``#subdirectory=`` fragment.  An archive pin is a third form, ``name @
+    <url>#sha256=...``, carrying its hash in the fragment;
+    :func:`require_artifact_hashes` skips it because that hash is guaranteed
+    at config parse.  Returns the text and, when ``output_path`` is provided,
+    atomically writes it.
     """
     require_artifact_hashes(lock_input)
     return _render_requirements(lock_input, with_hashes=True, output_path=output_path)
@@ -51,8 +54,8 @@ def write_requirements_without_hashes(
     """Render ``lock_input`` as a plain ``name==version`` list.
 
     Same shape as :func:`write_requirements_with_hashes` but without
-    the ``--hash=sha256:...`` lines.  Local and VCS pins render the
-    same in both variants.  Returns the text and, when ``output_path``
+    the ``--hash=sha256:...`` lines.  Local, VCS, and archive pins render
+    the same in both variants.  Returns the text and, when ``output_path``
     is provided, atomically writes it.
     """
     return _render_requirements(lock_input, with_hashes=False, output_path=output_path)
@@ -94,7 +97,7 @@ def _render_per_tuple_requirements(lock_input: LockInput, *, with_hashes: bool)
 
 def _render_pins(pins: Mapping[str, PinShape], *, with_hashes: bool) -> list[str]:
     """Render a flat ``{name: pin}`` mapping in alphabetical order."""
-    from ..lockfile import IndexPin, LocalPin, VcsPin
+    from ..lockfile import ArchivePin, IndexPin, LocalPin, VcsPin
 
     lines: list[str] = []
     for canonical in sorted(pins):
@@ -112,6 +115,14 @@ def _render_pins(pins: Mapping[str, PinShape], *, with_hashes: bool) -> list[str
                 lines.append(f"{pin.name} @ {url}")
         elif isinstance(pin, VcsPin):
             lines.append(f"{pin.name} @ {pin.repo_url}")
+        elif isinstance(pin, ArchivePin):
+            # The hash is the archive's identity, so carry it (and any
+            # subdirectory) in the fragment for a reproducible, hash-checkable
+            # install line, mirroring how VcsPin pins its commit in the URL.
+            fragment = "&".join(f"{algo}={digest}" for algo, digest in pin.hashes)
+            if pin.subdirectory is not None:
+                fragment += f"&subdirectory={quote(pin.subdirectory, safe='/')}"
+            lines.append(f"{pin.name} @ {pin.url}#{fragment}")
         else:  # pragma: no cover - exhaustive
             msg = f"unknown pin shape: {pin!r}"
             raise TypeError(msg)

nab_python/_packaging_provider.py

@@ -4,12 +4,13 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
+from ._vendor.packaging.ranges import VersionRange
+
 if TYPE_CHECKING:
     from collections.abc import Mapping
 
     from nab_resolver.types import Incompatibility, RangeProtocol
 
-    from ._vendor.packaging.ranges import VersionRange
     from ._vendor.packaging.specifiers import SpecifierSet
     from ._vendor.packaging.version import Version
 
@@ -47,12 +48,21 @@ class PackagingProvider:
                 return version
         return None
 
+    def has_satisfying_version(
+        self, package: str, version_range: RangeProtocol[Version]
+    ) -> bool:
+        """Report whether any available version falls in the range."""
+        return any(v in version_range for v in self._get_versions(package))
+
     def get_dependencies(
         self, package: str, version: Version
     ) -> dict[str, VersionRange]:
         """Convert SpecifierSet deps to VersionRange deps."""
         raw = self._packages.get(package, {}).get(version, {})
-        return {dep: spec.to_range() for dep, spec in raw.items()}
+        return {
+            dep: (spec.to_range() if spec else VersionRange.full(admit_arbitrary=False))
+            for dep, spec in raw.items()
+        }
 
     _CONFLICT_THRESHOLD = 5
 
@@ -96,3 +106,15 @@ class PackagingProvider:
     def consume_force_backtrack_targets(self) -> list[str]:
         """No force-backtrack signal from this in-memory provider."""
         return []
+
+    def widen_decision(self, package: str, version: Version) -> VersionRange | None:
+        """No widening: dependency clauses keep the exact decided version."""
+        del package, version
+        return None
+
+    def narrow_for_display(
+        self, package: str, constraint: RangeProtocol[Version]
+    ) -> RangeProtocol[Version]:
+        """Identity: constraints render as stored."""
+        del package
+        return constraint

nab_python/_provider/extras.py

@@ -43,26 +43,43 @@ def choose_extra_version(
     _, _, normalized = provider.split_and_normalize(base)
     version_list = provider.fetch_versions(base)
     all_versions = provider.versions_only(normalized, version_list)
-    candidates = list(version_range.filter(all_versions))
 
-    # Filter by base's positive range so we don't pick a proxy version
-    # that would force base==V into a known-conflicting state.
+    # Filter by the base's positive range so we don't pick a proxy version
+    # that would force base==V into a known-conflicting state.  Intersect
+    # rather than test membership: the base's range carries the pre-release
+    # admission granted by the requirement that named the extra, while the
+    # proxy's own range is built full.
     base_range = provider.solution_ranges.get(normalized)
-    excluded_by_base: list[Version] = []
-    if base_range is not None:
-        kept: list[Version] = []
-        for v in candidates:
-            if v in base_range:
-                kept.append(v)
-            else:
-                excluded_by_base.append(v)
-        candidates = kept
+    if base_range is None:
+        logger.debug(
+            "no base range for %s; base admission cannot be applied to %s",
+            normalized,
+            package,
+        )
+        candidates = list(version_range.filter(all_versions))
+    else:
+        candidates = list((version_range & base_range).filter(all_versions))
 
     if provider.wants_lowest(normalized):
         candidates = list(reversed(candidates))
 
     chosen = _pick_in_mode(provider, base, extra, candidates)
-    if chosen is None and excluded_by_base and base_range is not None:
+    # Enumerate pre-releases too: default filtering buffers a pre-release
+    # behind any matching final and would drop one that the base's bounds
+    # exclude, so it would never be recorded and the proxy would keep a
+    # permanent NO_VERSIONS clause past the backjump lifting the base
+    # decision.  Membership below is bounds-only, so the blocks stay sound.
+    if (
+        chosen is None
+        and base_range is not None
+        and (
+            excluded_by_base := [
+                v
+                for v in version_range.filter(all_versions, prereleases=True)
+                if v not in base_range
+            ]
+        )
+    ):
         _record_base_range_blocks(
             provider, package, normalized, base_range, excluded_by_base
         )
@@ -77,23 +94,15 @@ def _pick_in_mode(
 ) -> Version | None:
     """Pick a candidate honoring ``ExtrasMode``.
 
-    Fetches base metadata so an extraction failure (unparseable
-    PKG-INFO, or an sdist build the policy disallows) becomes a
-    candidate skip instead of a fatal error during the later
-    dependency fetch.  BACKTRACK mode additionally checks
-    ``Provides-Extra`` for transitive extras.
-
-    Missing-metadata cases (no PEP 658, no sdist) skip transitive
-    extras but fall through for user-requested ones; mock test
-    coordinators rely on this.
+    Fetches base metadata so an extraction failure (unparseable PKG-INFO,
+    a disallowed sdist build, or no metadata source at all) skips the
+    candidate rather than raising later, when the proxy refetches the base
+    to expand the extra. This applies to user-requested extras too, since
+    the proxy always needs the base metadata. BACKTRACK mode additionally
+    checks ``Provides-Extra`` for transitive extras.
     """
     # Late import: ``pypi`` imports this module at module load.
-    from ..provider import (
-        ExtrasMode,
-        MetadataError,
-        UnsupportedSdistError,
-        _normalize_extra,
-    )
+    from ..provider import ExtrasMode, MetadataError, _normalize_extra
 
     _, _, normalized = provider.split_and_normalize(base)
     is_user = (normalized, extra) in provider.root_extras
@@ -103,12 +112,8 @@ def _pick_in_mode(
             continue
         try:
             provider.get_dependencies(base, version)
-        except UnsupportedSdistError:
-            continue
         except MetadataError:
-            if not is_user or provider.has_invalid_metadata(normalized, version):
-                continue
-            return version
+            continue
         if is_user or not backtrack:
             return version
         metadata = provider.metadata_cache.get((normalized, version))
@@ -122,6 +127,32 @@ def _pick_in_mode(
     return None
 
 
+def version_provides_extra(
+    provider: Provider,
+    base: str,
+    extra: str,
+    version: Version,
+) -> bool:
+    """Whether ``version`` of ``base`` declares ``extra`` and yields metadata here.
+
+    Honoring a cross-tuple preference for a ``base[extra]`` proxy is only
+    safe when the preferred version both provides the extra and has
+    extractable metadata in this tuple.
+    """
+    # Late import: provider imports this module at module load.
+    from ..provider import MetadataError, _normalize_extra
+
+    _, _, normalized = provider.split_and_normalize(base)
+    try:
+        provider.get_dependencies(base, version)
+    except MetadataError:
+        return False
+
+    metadata = provider.metadata_cache[(normalized, version)]
+    provided = {_normalize_extra(e) for e in metadata.provides_extra}
+    return extra in provided
+
+
 def _record_base_range_blocks(
     provider: Provider,
     proxy_pkg: str,

nab_python/_provider/listing.py

@@ -50,6 +50,14 @@ def fetch_versions(provider: Provider, package: str) -> list[tuple[Version, Dist
         provider.versions_cache[normalized] = result
         return result
 
+    archive = provider.archive_sources.get(normalized)
+    if archive is not None:
+        # The download-and-verify guards are gated everywhere; only the
+        # post-extraction success tail needs the tar data filter (see sources.py).
+        result = provider.materialize_archive_source(normalized, archive)
+        provider.versions_cache[normalized] = result  # pragma: no cover
+        return result  # pragma: no cover
+
     files = provider.coordinator.index.get_listing(normalized)
     if files is None:
         event = provider.coordinator.request_listing(normalized)
@@ -572,13 +580,17 @@ def prefetch_new_deps(provider: Provider, deps: Mapping[str, VersionRange]) -> N
     candidate. This deepens the prefetch cascade so metadata is
     ready before the resolver asks for it.
 
-    Local and VCS sources are skipped; they have no PyPI listing
-    and the materialise path in ``fetch_versions`` will surface
-    them when the resolver asks.
+    Local, VCS, and archive sources are skipped; they have no PyPI
+    listing and the materialise path in ``fetch_versions`` will
+    surface them when the resolver asks.
     """
     for dep in deps:
         _, _, normalized = provider.split_and_normalize(dep)
-        if normalized in provider.local_sources or normalized in provider.vcs_sources:
+        if (
+            normalized in provider.local_sources
+            or normalized in provider.vcs_sources
+            or normalized in provider.archive_sources
+        ):
             continue
         if normalized not in provider.versions_cache:
             # Listing not cached: request it. When it arrives,