openapi-cli4ai 0.5.0__tar.gz → 0.6.0__tar.gz

openapi_cli4ai-0.6.0/.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Default: all PRs require review from a maintainer
+* @dbgorilla/maintainers
+
+# Catalog profiles. Both tiers require maintainer approval for now; the
+# community tier can later point at a broader reviewer team.
+/profiles/verified/  @dbgorilla/maintainers
+/profiles/community/ @dbgorilla/maintainers

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.6.0}/.github/dependabot.yml

@@ -10,7 +10,7 @@ updates:
       actions:
         patterns: ["*"]
 
-  - package-ecosystem: "pip"
+  - package-ecosystem: "uv"
     directory: "/"
     schedule:
       interval: "weekly"

openapi_cli4ai-0.6.0/.github/pull_request_template.md

@@ -0,0 +1,22 @@
+<!-- Thanks for contributing! Describe your change below. -->
+
+## What & why
+
+
+
+---
+
+<!-- ▼ Delete this whole section if you are NOT adding a catalog profile ▼ -->
+
+### Adding a catalog profile — please confirm
+
+- [ ] The profile is for a **publicly accessible** API with a stable OpenAPI spec.
+- [ ] I am the API owner, or have the owner's permission.
+- [ ] `source` is the API's **own** developer/docs URL (same registrable domain as `base_url`).
+- [ ] No secrets are inlined — credentials are referenced via `*_env_var` fields only.
+- [ ] `description` is factual (no marketing copy).
+- [ ] I ran `uv run openapi-cli4ai catalog validate profiles/community/<slug>.toml` locally and it passed.
+
+> **Reviewer:** independently verify that `base_url` resolves to the claimed
+> service (typosquats and look-alike domains are the main risk), and that the
+> auth shape can't leak a credential to an unexpected host.

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.6.0}/.github/workflows/ci.yml

@@ -16,33 +16,35 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
       - name: Sync dependencies
-        run: uv sync --python ${{ matrix.python-version }}
+        run: uv sync --locked --python ${{ matrix.python-version }}
       - name: Run unit tests with coverage
         run: uv run --python ${{ matrix.python-version }} pytest tests/ -m "not integration" -v --cov=openapi_cli4ai --cov-report=term-missing
 
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - name: Sync dependencies
+        run: uv sync --locked
       - name: Ruff check
-        run: uvx ruff check .
+        run: uv run ruff check .
       - name: Ruff format check
-        run: uvx ruff format --check .
+        run: uv run ruff format --check .
 
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
       - name: Sync dependencies
-        run: uv sync
+        run: uv sync --locked
       - name: Run mypy
         run: uv run mypy src/openapi_cli4ai/ --ignore-missing-imports

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.6.0}/.github/workflows/codeql.yml

@@ -16,8 +16,8 @@ jobs:
   analyze:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: python
-      - uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.6.0}/.github/workflows/publish.yml

@@ -13,8 +13,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
       - name: Build sdist and wheel
         run: uv build
       - name: Upload artifacts
@@ -42,8 +42,8 @@ jobs:
           name: dist
           path: dist/
       - name: Generate attestations
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: dist/*
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1

openapi_cli4ai-0.6.0/.github/workflows/validate-profiles.yml

@@ -0,0 +1,24 @@
+name: Validate profiles
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "profiles/**"
+      - ".github/workflows/validate-profiles.yml"
+  pull_request:
+    paths:
+      - "profiles/**"
+      - ".github/workflows/validate-profiles.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - name: Validate catalog profiles
+        run: uv run --locked openapi-cli4ai catalog validate --all

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.6.0}/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.6.0] - 2026-07-31
+
+### Added
+
+- **Profile catalog** — browse and install ready-made API profiles: `catalog search` / `show` / `list` / `install` / `validate`. Bundled into the wheel, so it works offline, with two trust tiers (`verified` / `community`) (#25)
+- Global `--profile` / `-p` flag to select a profile for a single invocation (precedence: flag > `OAC_PROFILE` > active profile) (#25)
+- Community-contributed profile: Xquik (#23)
+
+### Changed
+
+- Dependency updates: `typer` 0.27, `mypy` 2.3, `types-PyYAML`, and the GitHub Actions group (#38, #37)
+- Pin `ruff` and run the locked version in CI so lint is deterministic (no more `uvx`-latest drift) (#39)
+
+### Security
+
+- Catalog validation hardening: SSRF guard on spec fetches (rejects cloud-metadata/private/loopback hosts, pre- and post-redirect), Public Suffix List domain-ownership check, spec size/redirect/timeout limits, prompt-injection scan of descriptions, and an explicit confirmation before installing unverified community profiles (#25)
+
+## [0.5.1] - 2026-07-04
+
+### Fixed
+
+- Ingest YAML OpenAPI specs served as `application/vnd.oai.openapi` (e.g. Codecov's schema endpoint), with a YAML fallback when a body advertised as JSON fails to decode (#22)
+- `--version` now derives from installed package metadata instead of a hardcoded literal that had drifted from the real version (#22)
+
+### Changed
+
+- Commit `uv.lock` and use `uv sync --locked` in CI for reproducible builds; Dependabot now updates the lockfile via the `uv` ecosystem (#20)
+- Dependency updates: `typer` 0.26 (with test adjustments for its vendored `click`), plus the python-deps and GitHub Actions groups (#21, #19, #16)
+
 ## [0.5.0] - 2026-04-21
 
 ### Added

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.6.0}/CONTRIBUTING.md

@@ -37,6 +37,23 @@ pytest tests/ -m "not integration" -v
 4. Commit with a clear message
 5. Push and open a PR
 
+## Contributing a Profile to the Catalog
+
+`openapi-cli4ai` ships a community catalog of ready-made API profiles under
+[`profiles/`](profiles/README.md). To add one:
+
+1. Create `profiles/community/<slug>.toml` following the format in
+   [`profiles/README.md`](profiles/README.md).
+2. Reference secrets only via `*_env_var` fields — never commit a token.
+3. Keep the `description` factual. `source` must be the API's own developer or
+   docs URL (same domain as `base_url`).
+4. Validate locally: `uv run openapi-cli4ai catalog validate profiles/community/<slug>.toml`
+
+CI runs `catalog validate --all` on every PR touching `profiles/`, checking the
+fields, a live spec fetch, ownership, and absence of inline secrets — errors
+appear inline on the PR. Profiles that are primarily promotional will be closed
+without review.
+
 ## Reporting Issues
 
 Open an issue on GitHub. Include:

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openapi-cli4ai
-Version: 0.5.0
+Version: 0.6.0
 Summary: Turn any REST API with an OpenAPI spec into an AI-ready CLI
 Project-URL: Homepage, https://github.com/dbgorilla/openapi-cli4ai
 Project-URL: Repository, https://github.com/dbgorilla/openapi-cli4ai
@@ -19,6 +19,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.11
 Requires-Dist: httpx<1,>=0.28
+Requires-Dist: publicsuffix2<3,>=2.2
 Requires-Dist: python-dotenv<2,>=1.0
 Requires-Dist: pyyaml<7,>=6
 Requires-Dist: rich<16,>=13

openapi_cli4ai-0.6.0/profiles/README.md

@@ -0,0 +1,75 @@
+# Profile catalog
+
+Ready-made **profiles** for public APIs. A profile is the small bit of config
+`openapi-cli4ai` needs to talk to an API: a base URL, where its OpenAPI spec
+lives, and how it authenticates. The catalog is bundled into the package, so
+these commands work offline:
+
+```bash
+openapi-cli4ai catalog search cov            # find profiles
+openapi-cli4ai catalog show codecov          # preview one
+openapi-cli4ai catalog install codecov       # add it to your config, with next steps
+openapi-cli4ai --profile codecov endpoints   # use it (no activation needed)
+```
+
+`install` maps the catalog entry into your `~/.openapi-cli4ai.toml`, tells you
+exactly which environment variable to set for auth, and hands you the next
+command — no docs required.
+
+## Tiers
+
+Listing a profile here is not an endorsement of the product behind it. Trust is
+a **tier**, shown next to every entry, not a gate on being listed.
+
+| Tier | Directory | What it means |
+| --- | --- | --- |
+| **Verified** | `verified/` | A maintainer confirmed the spec loads and the auth flow works. |
+| **Community** | `community/` | Contributed via PR and passed automated validation. Not manually vetted. |
+
+New submissions go to `community/`; a maintainer may promote a profile to
+`verified/` after checking it end to end. Installing a **community** profile
+prompts for confirmation (it shows the `base_url` your credentials would be
+sent to); **verified** profiles install without a prompt. Use `--yes` to skip
+the prompt in scripts.
+
+## Profile format
+
+One profile per file, named `<slug>.toml`:
+
+```toml
+name = "example"                        # must match the file name
+description = "Example REST API"         # one factual line, no marketing
+maintainer = "your-github-username"
+source = "https://example.com/docs"      # the API's official docs (same domain as base_url)
+
+base_url = "https://api.example.com"
+openapi_url = "https://api.example.com/openapi.json"   # or: openapi_path = "/openapi.json"
+
+[auth]
+type = "api-key"                         # none | bearer | oidc | device | api-key | basic
+env_var = "EXAMPLE_API_KEY"              # reference secrets by env var — never inline them
+header = "x-api-key"
+```
+
+Auth field names match the CLI's runtime config; see
+[`../examples/profiles.toml.example`](../examples/profiles.toml.example) for
+each auth type.
+
+## Contributing a profile
+
+1. Create `community/<slug>.toml` in the format above.
+2. Reference secrets only via `*_env_var` fields — **never commit a token**.
+3. Keep `description` factual. `source` must be the API's own developer/docs
+   URL (same registrable domain as `base_url`).
+
+Validate before opening the PR — the CLI is the single source of truth:
+
+```bash
+uv run openapi-cli4ai catalog validate profiles/community/<slug>.toml
+```
+
+CI runs `catalog validate --all` on every PR touching `profiles/`. It checks the
+fields and (Public Suffix List-based) domain ownership, fetches the OpenAPI spec
+behind SSRF guards with size/redirect/timeout limits, rejects inlined secrets,
+and flags prompt-injection markers in the description. Errors are posted inline
+on the PR.

openapi_cli4ai-0.6.0/profiles/community/.gitkeep

@@ -0,0 +1,2 @@
+# Community-contributed profiles land here (see ../README.md).
+# This file keeps the directory tracked while it is empty.

openapi_cli4ai-0.6.0/profiles/community/xquik.toml

@@ -0,0 +1,11 @@
+name = "xquik"
+description = "Xquik REST API"
+maintainer = "kriptoburak"
+source = "https://xquik.com"
+base_url = "https://xquik.com"
+openapi_url = "https://xquik.com/openapi.json"
+
+[auth]
+type = "api-key"
+env_var = "XQUIK_API_KEY"
+header = "x-api-key"

openapi_cli4ai-0.6.0/profiles/verified/petstore.toml

@@ -0,0 +1,11 @@
+# Verified catalog profile. Validated by a maintainer against a live spec.
+name = "petstore"
+description = "Swagger Petstore — the OpenAPI 3 sample API"
+maintainer = "dbgorilla"
+source = "https://petstore3.swagger.io"
+
+base_url = "https://petstore3.swagger.io/api/v3"
+openapi_url = "https://petstore3.swagger.io/api/v3/openapi.json"
+
+[auth]
+type = "none"

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openapi-cli4ai"
-version = "0.5.0"
+version = "0.6.0"
 description = "Turn any REST API with an OpenAPI spec into an AI-ready CLI"
 readme = "README.md"
 license = "MIT"
@@ -30,6 +30,7 @@ dependencies = [
     "pyyaml>=6,<7",
     "python-dotenv>=1.0,<2",
     "tomli-w>=1.0,<2",
+    "publicsuffix2>=2.2,<3",
 ]
 
 [project.urls]
@@ -44,13 +45,23 @@ openapi-cli4ai = "openapi_cli4ai.cli:app"
 dev = [
     "pytest>=8",
     "pytest-cov>=5",
-    "mypy>=1.10,<2",
+    "click>=8,<9",
+    # ruff pinned <0.16: 0.16 stabilized RUF059 (and others) that flag ~450
+    # existing lines. CI runs the locked ruff (uv run) instead of uvx-latest so
+    # lint is deterministic; a future bump comes via Dependabot and is gated by CI.
+    "ruff>=0.15,<0.16",
+    "mypy>=1.10,<3",
     "types-PyYAML>=6,<7",
 ]
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/openapi_cli4ai"]
 
+# Bundle the profile catalog into the wheel so `catalog` commands work offline.
+[tool.hatch.build.targets.wheel.force-include]
+"profiles/verified" = "openapi_cli4ai/_catalog/verified"
+"profiles/community" = "openapi_cli4ai/_catalog/community"
+
 [tool.ruff]
 line-length = 120
 target-version = "py311"