nab-python 0.0.6__tar.gz → 0.0.7__tar.gz

{nab_python-0.0.6 → nab_python-0.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nab-python
-Version: 0.0.6
+Version: 0.0.7
 Summary: Index-backed provider, lockfile emitter, and downloader for nab
 Project-URL: Homepage, https://github.com/notatallshaw/nab
 Project-URL: Documentation, https://nab.readthedocs.io/
@@ -20,8 +20,8 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Requires-Dist: build>=1.2
 Requires-Dist: installer>=0.7
-Requires-Dist: nab-index==0.0.6
-Requires-Dist: nab-resolver==0.0.6
+Requires-Dist: nab-index==0.0.7
+Requires-Dist: nab-resolver==0.0.7
 Requires-Dist: pyproject-hooks>=1.2
 Requires-Dist: tomli-w>=1.2
 Requires-Dist: tomli>=2.0

{nab_python-0.0.6 → nab_python-0.0.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nab-python"
-version = "0.0.6"
+version = "0.0.7"
 description = "Index-backed provider, lockfile emitter, and downloader for nab"
 readme = "README.md"
 license = "MIT"
@@ -19,8 +19,8 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "nab-resolver==0.0.6",
-    "nab-index==0.0.6",
+    "nab-resolver==0.0.7",
+    "nab-index==0.0.7",
     "tomli>=2.0",
     "tomli_w>=1.2",
     "build>=1.2",

{nab_python-0.0.6 → nab_python-0.0.7}/src/nab_python/_build/runner.py

@@ -33,12 +33,12 @@ import build
 import pyproject_hooks
 import tomli
 
-from .._vendor.packaging.requirements import Requirement
+from nab_resolver.resolver import ResolutionError
+
+from .._vendor.packaging.requirements import InvalidRequirement, Requirement
 from .._vendor.packaging.specifiers import InvalidSpecifier, SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
 from .._vendor.packaging.version import InvalidVersion, Version
-from nab_resolver.resolver import ResolutionError
-
 from ..metadata import WheelMetadata
 from .env import BuildEnvError, NabBuildEnv
 from .errors import BuildBackendError
@@ -238,15 +238,19 @@ def _parse_metadata(metadata_path: Path) -> WheelMetadata:
             SpecifierSet(requires_python_raw) if requires_python_raw else None
         )
     except InvalidSpecifier as exc:
-        msg = f"backend METADATA has invalid Requires-Python {requires_python_raw!r}: {exc}"
+        msg = (
+            f"backend METADATA has invalid Requires-Python "
+            f"{requires_python_raw!r}: {exc}"
+        )
         raise BuildBackendError(msg) from exc
 
-    requires_dist: list[Requirement] = []
-    for raw in msg_obj.get_all("Requires-Dist") or ():
-        try:
-            requires_dist.append(Requirement(raw))
-        except (ValueError, TypeError):  # noqa: PERF203
-            logger.warning("skipping unparseable Requires-Dist: %s", raw)
+    try:
+        requires_dist: list[Requirement] = [
+            Requirement(raw) for raw in msg_obj.get_all("Requires-Dist") or ()
+        ]
+    except InvalidRequirement as exc:
+        msg = f"backend METADATA has an invalid Requires-Dist: {exc}"
+        raise BuildBackendError(msg) from exc
 
     provides_extra: list[str] = sorted(
         {

{nab_python-0.0.6 → nab_python-0.0.7}/src/nab_python/_lockfile/builder.py

@@ -21,6 +21,7 @@ from nab_index.client import SdistFile, WheelFile
 
 from .._toml import tool_nab_section
 from .._vendor.packaging.pylock import Pylock, PylockValidationError
+from .._vendor.packaging.specifiers import InvalidSpecifier, SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
 
 if TYPE_CHECKING:
@@ -30,6 +31,7 @@ if TYPE_CHECKING:
 
     from .._vendor.packaging.version import Version
     from ..lockfile import (
+        ArchivePin,
         IndexPin,
         LockInput,
         PinShape,
@@ -37,7 +39,7 @@ if TYPE_CHECKING:
         VcsPin,
         WheelArtifact,
     )
-    from ..provider import DistPolicy, LocalSource, VcsSource
+    from ..provider import ArchiveSource, DistPolicy, LocalSource, VcsSource
 
 
 __all__ = [
@@ -95,6 +97,10 @@ class LockInputProvider(Protocol):
         """Return the configured VcsSource for ``canonical_name`` or None."""
         ...
 
+    def archive_source_for(self, canonical_name: str, /) -> ArchiveSource | None:
+        """Return the configured ArchiveSource for ``canonical_name`` or None."""
+        ...
+
     def vcs_pin_for(self, canonical_name: str, /) -> str | None:
         """Return the resolved 40-char SHA captured during materialisation."""
         ...
@@ -287,6 +293,12 @@ def build_lock_input_from_provider(  # noqa: PLR0913 - each flag maps to a disti
                 resolved_sha=provider.vcs_pin_for(canonical),
             )
             continue
+        archive_source = provider.archive_source_for(canonical)
+        if archive_source is not None:
+            lock_pins[canonical] = _archive_pin_from_source(
+                canonical, version, archive_source
+            )
+            continue
         lock_pins[canonical] = _index_pin_from_listing(
             provider, canonical, version, indexes
         )
@@ -339,6 +351,9 @@ def _forward_dependency_graph(
                 for dep in extra_map.get(extra, {})
             )
         dep_names &= pinned
+        # An umbrella extra (pkg[all] pulling pkg[graphviz]) can name its own
+        # package; drop it so pkg is never an edge to itself.
+        dep_names.discard(canonical)
         if dep_names:
             graph[canonical] = tuple(sorted(dep_names))
     return graph
@@ -519,11 +534,27 @@ def require_artifact_hashes(lock_input: LockInput) -> None:
 
 
 def _common_requires_python(files: Iterable[WheelFile | SdistFile]) -> str | None:
-    """Return a single Requires-Python value if all files agree, else ``None``."""
+    """Return the package-level Requires-Python value, or ``None``.
+
+    An artefact with no Requires-Python is unconstrained, so a single
+    such artefact leaves the whole package unconstrained. Otherwise the
+    value survives only when every artefact agrees.
+
+    A malformed value counts as unconstrained too, matching
+    ``excluded_by_python``, which admits a dist whose Requires-Python is
+    an unparseable specifier on any Python. So the lock writer always
+    parses a valid specifier or ``None``, and the pin is never
+    over-constrained by an artefact whose floor nab could not read.
+    """
     seen: set[str] = set()
     for f in files:
-        if f.requires_python is not None:
-            seen.add(f.requires_python)
+        if f.requires_python is None:
+            return None
+        try:
+            SpecifierSet(f.requires_python)
+        except InvalidSpecifier:
+            return None
+        seen.add(f.requires_python)
     if len(seen) == 1:
         return next(iter(seen))
     return None
@@ -593,3 +624,30 @@ def _vcs_pin_from_source(
         requested_revision=requested_revision,
         vcs_type=parsed.scheme,
     )
+
+
+def _archive_pin_from_source(
+    canonical: str,
+    version: Version,
+    source: ArchiveSource,
+) -> ArchivePin:
+    """Build an :class:`ArchivePin` from an :class:`ArchiveSource`.
+
+    The URL, hashes, and subdirectory come from the source declaration,
+    which config parse validated (a hash is required), so the pin records
+    the exact archive the resolve used.  The URL is stripped of any
+    credential userinfo, like every other pin, so a committed lockfile
+    never carries a token.
+    """
+    from nab_index.archive import ArchiveRequest
+
+    from ..lockfile import ArchivePin
+
+    request = ArchiveRequest.parse(source.url)
+    return ArchivePin(
+        name=canonical,
+        version=str(version),
+        url=_strip_userinfo(request.url),
+        hashes=request.hashes,
+        subdirectory=request.subdirectory or None,
+    )

{nab_python-0.0.6 → nab_python-0.0.7}/src/nab_python/_lockfile/pylock.py

@@ -21,6 +21,7 @@ import tomli_w
 from .._vendor.packaging.markers import Marker
 from .._vendor.packaging.pylock import (
     Package,
+    PackageArchive,
     PackageDirectory,
     PackageSdist,
     PackageVcs,
@@ -214,7 +215,7 @@ def _pin_to_package(
     lock_dir: Path,
     dependencies: list[dict[str, str]] | None = None,
 ) -> Package:
-    from ..lockfile import IndexPin, LocalPin, VcsPin
+    from ..lockfile import ArchivePin, IndexPin, LocalPin, VcsPin
 
     if isinstance(pin, IndexPin):
         return Package(
@@ -267,6 +268,20 @@ def _pin_to_package(
                 requested_revision=pin.requested_revision,
             ),
         )
+    if isinstance(pin, ArchivePin):
+        # An archive is content-pinned by its hash, so the version is
+        # stable and recorded (unlike the directory/VCS cases above).
+        return Package(
+            name=canonicalize_name(pin.name),
+            version=Version(pin.version),
+            marker=marker,
+            dependencies=dependencies,
+            archive=PackageArchive(
+                url=pin.url,
+                hashes=dict(pin.hashes),
+                subdirectory=pin.subdirectory,
+            ),
+        )
     msg = f"unknown pin shape: {pin!r}"
     raise TypeError(msg)
 
@@ -423,7 +438,7 @@ def _group_pins_by_pin(
 
 def _pin_discriminator(pin: PinShape) -> tuple:
     """Return a hashable key that identifies the source + version of ``pin``."""
-    from ..lockfile import IndexPin, LocalPin, VcsPin
+    from ..lockfile import ArchivePin, IndexPin, LocalPin, VcsPin
 
     if isinstance(pin, IndexPin):
         return ("index", pin.version, pin.index)
@@ -447,6 +462,8 @@ def _pin_discriminator(pin: PinShape) -> tuple:
             pin.repo_url,
             pin.subdirectory or "",
         )
+    if isinstance(pin, ArchivePin):
+        return ("archive", pin.version, pin.url, pin.hashes, pin.subdirectory or "")
     msg = f"unknown pin shape: {pin!r}"
     raise TypeError(msg)
 
@@ -456,8 +473,9 @@ def _merge_pins_in_group(pins: list[PinShape]) -> PinShape:
 
     For :class:`IndexPin`, accumulates every distinct wheel filename
     across the contributing tuples and keeps the first non-``None``
-    sdist.  ``requires_python`` survives only when every tuple agreed,
-    matching :func:`_common_requires_python`'s rule.
+    sdist.  ``requires_python`` survives only when every tuple carried
+    the same value and none was unconstrained, matching
+    :func:`_common_requires_python`'s rule.
     Non-IndexPin shapes are already fully discriminated, so the first
     pin is returned unchanged.
     """
@@ -469,16 +487,21 @@ def _merge_pins_in_group(pins: list[PinShape]) -> PinShape:
     seen_wheels: dict[str, WheelArtifact] = {}
     sdist = head.sdist
     requires_python_set: set[str] = set()
+    any_unconstrained = False
     for pin in pins:
         assert isinstance(pin, IndexPin)
         for wheel in pin.wheels:
             seen_wheels.setdefault(wheel.filename, wheel)
         if sdist is None and pin.sdist is not None:
             sdist = pin.sdist
-        if pin.requires_python is not None:
+        if pin.requires_python is None:
+            any_unconstrained = True
+        else:
             requires_python_set.add(pin.requires_python)
     requires_python = (
-        next(iter(requires_python_set)) if len(requires_python_set) == 1 else None
+        next(iter(requires_python_set))
+        if not any_unconstrained and len(requires_python_set) == 1
+        else None
     )
     return IndexPin(
         name=head.name,

{nab_python-0.0.6 → nab_python-0.0.7}/src/nab_python/_lockfile/requirements.py

@@ -38,8 +38,11 @@ def write_requirements_with_hashes(
     accepts.  Local and VCS pins are emitted as ``name @ <url>`` lines
     without hashes (pip does not hash-check those forms); an editable
     local pin renders as ``-e <url>`` and a ``subdirectory`` as a
-    ``#subdirectory=`` fragment.  Returns the text and, when
-    ``output_path`` is provided, atomically writes it.
+    ``#subdirectory=`` fragment.  An archive pin is a third form, ``name @
+    <url>#sha256=...``, carrying its hash in the fragment;
+    :func:`require_artifact_hashes` skips it because that hash is guaranteed
+    at config parse.  Returns the text and, when ``output_path`` is provided,
+    atomically writes it.
     """
     require_artifact_hashes(lock_input)
     return _render_requirements(lock_input, with_hashes=True, output_path=output_path)
@@ -51,8 +54,8 @@ def write_requirements_without_hashes(
     """Render ``lock_input`` as a plain ``name==version`` list.
 
     Same shape as :func:`write_requirements_with_hashes` but without
-    the ``--hash=sha256:...`` lines.  Local and VCS pins render the
-    same in both variants.  Returns the text and, when ``output_path``
+    the ``--hash=sha256:...`` lines.  Local, VCS, and archive pins render
+    the same in both variants.  Returns the text and, when ``output_path``
     is provided, atomically writes it.
     """
     return _render_requirements(lock_input, with_hashes=False, output_path=output_path)
@@ -94,7 +97,7 @@ def _render_per_tuple_requirements(lock_input: LockInput, *, with_hashes: bool)
 
 def _render_pins(pins: Mapping[str, PinShape], *, with_hashes: bool) -> list[str]:
     """Render a flat ``{name: pin}`` mapping in alphabetical order."""
-    from ..lockfile import IndexPin, LocalPin, VcsPin
+    from ..lockfile import ArchivePin, IndexPin, LocalPin, VcsPin
 
     lines: list[str] = []
     for canonical in sorted(pins):
@@ -112,6 +115,14 @@ def _render_pins(pins: Mapping[str, PinShape], *, with_hashes: bool) -> list[str
                 lines.append(f"{pin.name} @ {url}")
         elif isinstance(pin, VcsPin):
             lines.append(f"{pin.name} @ {pin.repo_url}")
+        elif isinstance(pin, ArchivePin):
+            # The hash is the archive's identity, so carry it (and any
+            # subdirectory) in the fragment for a reproducible, hash-checkable
+            # install line, mirroring how VcsPin pins its commit in the URL.
+            fragment = "&".join(f"{algo}={digest}" for algo, digest in pin.hashes)
+            if pin.subdirectory is not None:
+                fragment += f"&subdirectory={quote(pin.subdirectory, safe='/')}"
+            lines.append(f"{pin.name} @ {pin.url}#{fragment}")
         else:  # pragma: no cover - exhaustive
             msg = f"unknown pin shape: {pin!r}"
             raise TypeError(msg)

{nab_python-0.0.6 → nab_python-0.0.7}/src/nab_python/_provider/extras.py

@@ -77,23 +77,15 @@ def _pick_in_mode(
 ) -> Version | None:
     """Pick a candidate honoring ``ExtrasMode``.
 
-    Fetches base metadata so an extraction failure (unparseable
-    PKG-INFO, or an sdist build the policy disallows) becomes a
-    candidate skip instead of a fatal error during the later
-    dependency fetch.  BACKTRACK mode additionally checks
-    ``Provides-Extra`` for transitive extras.
-
-    Missing-metadata cases (no PEP 658, no sdist) skip transitive
-    extras but fall through for user-requested ones; mock test
-    coordinators rely on this.
+    Fetches base metadata so an extraction failure (unparseable PKG-INFO,
+    a disallowed sdist build, or no metadata source at all) skips the
+    candidate rather than raising later, when the proxy refetches the base
+    to expand the extra. This applies to user-requested extras too, since
+    the proxy always needs the base metadata. BACKTRACK mode additionally
+    checks ``Provides-Extra`` for transitive extras.
     """
     # Late import: ``pypi`` imports this module at module load.
-    from ..provider import (
-        ExtrasMode,
-        MetadataError,
-        UnsupportedSdistError,
-        _normalize_extra,
-    )
+    from ..provider import ExtrasMode, MetadataError, _normalize_extra
 
     _, _, normalized = provider.split_and_normalize(base)
     is_user = (normalized, extra) in provider.root_extras
@@ -103,12 +95,8 @@ def _pick_in_mode(
             continue
         try:
             provider.get_dependencies(base, version)
-        except UnsupportedSdistError:
-            continue
         except MetadataError:
-            if not is_user or provider.has_invalid_metadata(normalized, version):
-                continue
-            return version
+            continue
         if is_user or not backtrack:
             return version
         metadata = provider.metadata_cache.get((normalized, version))
@@ -122,6 +110,32 @@ def _pick_in_mode(
     return None
 
 
+def version_provides_extra(
+    provider: Provider,
+    base: str,
+    extra: str,
+    version: Version,
+) -> bool:
+    """Whether ``version`` of ``base`` declares ``extra`` and yields metadata here.
+
+    Honoring a cross-tuple preference for a ``base[extra]`` proxy is only
+    safe when the preferred version both provides the extra and has
+    extractable metadata in this tuple.
+    """
+    # Late import: provider imports this module at module load.
+    from ..provider import MetadataError, _normalize_extra
+
+    _, _, normalized = provider.split_and_normalize(base)
+    try:
+        provider.get_dependencies(base, version)
+    except MetadataError:
+        return False
+
+    metadata = provider.metadata_cache[(normalized, version)]
+    provided = {_normalize_extra(e) for e in metadata.provides_extra}
+    return extra in provided
+
+
 def _record_base_range_blocks(
     provider: Provider,
     proxy_pkg: str,

{nab_python-0.0.6 → nab_python-0.0.7}/src/nab_python/_provider/listing.py

@@ -50,6 +50,14 @@ def fetch_versions(provider: Provider, package: str) -> list[tuple[Version, Dist
         provider.versions_cache[normalized] = result
         return result
 
+    archive = provider.archive_sources.get(normalized)
+    if archive is not None:
+        # The download-and-verify guards are gated everywhere; only the
+        # post-extraction success tail needs the tar data filter (see sources.py).
+        result = provider.materialize_archive_source(normalized, archive)
+        provider.versions_cache[normalized] = result  # pragma: no cover
+        return result  # pragma: no cover
+
     files = provider.coordinator.index.get_listing(normalized)
     if files is None:
         event = provider.coordinator.request_listing(normalized)
@@ -572,13 +580,17 @@ def prefetch_new_deps(provider: Provider, deps: Mapping[str, VersionRange]) -> N
     candidate. This deepens the prefetch cascade so metadata is
     ready before the resolver asks for it.
 
-    Local and VCS sources are skipped; they have no PyPI listing
-    and the materialise path in ``fetch_versions`` will surface
-    them when the resolver asks.
+    Local, VCS, and archive sources are skipped; they have no PyPI
+    listing and the materialise path in ``fetch_versions`` will
+    surface them when the resolver asks.
     """
     for dep in deps:
         _, _, normalized = provider.split_and_normalize(dep)
-        if normalized in provider.local_sources or normalized in provider.vcs_sources:
+        if (
+            normalized in provider.local_sources
+            or normalized in provider.vcs_sources
+            or normalized in provider.archive_sources
+        ):
             continue
         if normalized not in provider.versions_cache:
             # Listing not cached: request it. When it arrives,

{nab_python-0.0.6 → nab_python-0.0.7}/src/nab_python/_provider/metadata_resolver.py

@@ -11,11 +11,11 @@ from __future__ import annotations
 from typing import TYPE_CHECKING
 
 from nab_index.client import SdistFile, WheelFile
+from nab_index.local_index import read_wheel_metadata
 
 from .._conflict_kind import EMPTY_MEMBERSHIP_SETS
 from .._vcs_admission import admit_vcs_url
 from .._vendor.packaging.ranges import VersionRange
-from .._vendor.packaging.requirements import InvalidRequirement, Requirement
 from .._vendor.packaging.specifiers import SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
 from ..metadata import (
@@ -24,11 +24,18 @@ from ..metadata import (
     metadata_deps_are_static,
     parse_metadata,
 )
+from ..requirements_file import (
+    InvalidProjectRequirementError,
+    _parse_project_requirement,
+    _parse_requirements,
+    _require_string_list,
+)
 
 if TYPE_CHECKING:
     from collections.abc import Sequence
 
     from .._vendor.packaging.markers import Marker
+    from .._vendor.packaging.requirements import Requirement
     from .._vendor.packaging.version import Version
     from ..provider import DistFile, Provider
 
@@ -47,7 +54,7 @@ def resolve_metadata(
     only sdist values are subject to the :pep:`643` Dynamic
     guarantees and may need a ``pyproject.toml`` fallback.
     """
-    # Late import: ``pypi`` imports this module at module load.
+    # Late import: ``provider`` imports this module at module load.
     from ..provider import MetadataError
 
     _, _, normalized = provider.split_and_normalize(package)
@@ -78,6 +85,8 @@ def resolve_metadata(
         if integrity_error is not None:
             raise integrity_error
         metadata_text = provider.coordinator.index.get_metadata(normalized, ver_str)
+    elif isinstance(dist, WheelFile) and dist.local_path is not None:
+        metadata_text = read_wheel_metadata(dist.local_path)
     else:
         metadata_text = None
 
@@ -210,8 +219,15 @@ def augment_from_pyproject(
     """Replace dynamic deps with statically-declared pyproject deps.
 
     Returns the augmented metadata, or ``None`` if pyproject.toml
-    is missing, malformed, or itself marks deps dynamic via
+    is missing, unparseable, or itself marks deps dynamic via
     ``[project].dynamic``.
+
+    Raises :class:`InvalidProjectRequirementError` when ``dependencies``
+    or ``optional-dependencies`` is present but structurally wrong (not
+    an array of strings / not a table), rather than silently dropping the
+    declared dependencies.  ``get_dependencies`` catches it and rejects the
+    candidate version.  A well-typed entry that is not valid PEP 508 is
+    dropped with a warning.
     """
     # Late import keeps the resolver-time path off ``WheelMetadata``
     # construction unless the dynamic-deps pyproject fallback fires.
@@ -223,15 +239,16 @@ def augment_from_pyproject(
     if project is None:
         return None
 
-    deps_field = project.get("dependencies")
-    if deps_field is not None and not isinstance(deps_field, list):
-        return None
-    optional = project.get("optional-dependencies")
-    if optional is not None and not isinstance(optional, dict):
-        return None
+    deps = _require_string_list(
+        project.get("dependencies", []), "[project].dependencies"
+    )
+    optional = project.get("optional-dependencies", {})
+    if not isinstance(optional, dict):
+        msg = "[project].optional-dependencies must be a table"
+        raise InvalidProjectRequirementError(msg)
 
-    requires_dist = list(parse_pyproject_deps(deps_field or []))
-    provides_extra = extend_with_extras(requires_dist, optional or {})
+    requires_dist = list(parse_pyproject_deps(deps))
+    provides_extra = extend_with_extras(requires_dist, optional)
 
     provider.stats.sdist_pyproject_fallbacks += 1
     return _WheelMetadata(
@@ -246,38 +263,32 @@ def augment_from_pyproject(
 
 
 def extend_with_extras(requires_dist: list[Requirement], optional: dict) -> list[str]:
-    """Append extras-gated requirements and return Provides-Extra names."""
-    # Late import: ``pypi`` imports this module at module load.
-    from ..provider import _add_extra_marker
+    """Append extras-gated requirements and return Provides-Extra names.
 
+    A per-extra value that is not an array of strings, or a per-extra entry
+    that is not valid PEP 508, raises :class:`InvalidProjectRequirementError`,
+    so the version is rejected rather than resolved with the entry dropped.
+    """
     provides_extra: list[str] = []
     for extra_name, extra_deps in optional.items():
-        if not isinstance(extra_deps, list):
-            continue
+        source = f"[project].optional-dependencies extra {extra_name!r}"
         provides_extra.append(extra_name)
-        for dep_str in extra_deps:
-            if not isinstance(dep_str, str):
-                continue
-            try:
-                requires_dist.append(
-                    Requirement(_add_extra_marker(dep_str, extra_name))
-                )
-            except InvalidRequirement:
-                continue
+        requires_dist.extend(
+            _parse_project_requirement(dep_str, source, extra=extra_name)
+            for dep_str in _require_string_list(extra_deps, source)
+        )
     return provides_extra
 
 
 def parse_pyproject_deps(deps: list) -> list[Requirement]:
-    """Parse a ``project.dependencies`` list, dropping malformed entries."""
-    out: list[Requirement] = []
-    for dep_str in deps:
-        if not isinstance(dep_str, str):
-            continue
-        try:
-            out.append(Requirement(dep_str))
-        except InvalidRequirement:
-            continue
-    return out
+    """Parse a ``project.dependencies`` list, raising on a malformed entry.
+
+    Entries are already validated as strings by :func:`_require_string_list`;
+    a string that is not valid PEP 508 raises
+    :class:`InvalidProjectRequirementError`, so the whole version is rejected
+    rather than resolved with the dependency dropped.
+    """
+    return _parse_requirements(deps, "[project].dependencies")
 
 
 def find_sdist(

{nab_python-0.0.6 → nab_python-0.0.7}/src/nab_python/_provider/priority.py

@@ -74,10 +74,12 @@ def compute_matching(
         if cached is not None:
             return cached
 
-    # Local/VCS sources short-circuit the listing path; their synthetic
+    # Local/VCS/archive sources short-circuit the listing path; their synthetic
     # listing is materialised lazily by fetch_versions.
     has_local_source = (
-        normalized in provider.local_sources or normalized in provider.vcs_sources
+        normalized in provider.local_sources
+        or normalized in provider.vcs_sources
+        or normalized in provider.archive_sources
     )
     if normalized not in provider.versions_cache and not has_local_source:
         files = provider.coordinator.index.get_listing(normalized)