openapi-cli4ai 0.5.1__tar.gz → 0.7.0__tar.gz

openapi_cli4ai-0.7.0/.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Default: all PRs require review from a maintainer
+* @dbgorilla/maintainers
+
+# Catalog profiles. Both tiers require maintainer approval for now; the
+# community tier can later point at a broader reviewer team.
+/profiles/verified/  @dbgorilla/maintainers
+/profiles/community/ @dbgorilla/maintainers

openapi_cli4ai-0.7.0/.github/pull_request_template.md

@@ -0,0 +1,22 @@
+<!-- Thanks for contributing! Describe your change below. -->
+
+## What & why
+
+
+
+---
+
+<!-- ▼ Delete this whole section if you are NOT adding a catalog profile ▼ -->
+
+### Adding a catalog profile — please confirm
+
+- [ ] The profile is for a **publicly accessible** API with a stable OpenAPI spec.
+- [ ] I am the API owner, or have the owner's permission.
+- [ ] `source` is the API's **own** developer/docs URL (same registrable domain as `base_url`).
+- [ ] No secrets are inlined — credentials are referenced via `*_env_var` fields only.
+- [ ] `description` is factual (no marketing copy).
+- [ ] I ran `uv run openapi-cli4ai catalog validate profiles/community/<slug>.toml` locally and it passed.
+
+> **Reviewer:** independently verify that `base_url` resolves to the claimed
+> service (typosquats and look-alike domains are the main risk), and that the
+> auth shape can't leak a credential to an unexpected host.

{openapi_cli4ai-0.5.1 → openapi_cli4ai-0.7.0}/.github/workflows/ci.yml

@@ -16,8 +16,8 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
       - name: Set up Python ${{ matrix.python-version }}
@@ -30,18 +30,20 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Sync dependencies
+        run: uv sync --locked
       - name: Ruff check
-        run: uvx ruff check .
+        run: uv run ruff check .
       - name: Ruff format check
-        run: uvx ruff format --check .
+        run: uv run ruff format --check .
 
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - name: Sync dependencies
         run: uv sync --locked
       - name: Run mypy

{openapi_cli4ai-0.5.1 → openapi_cli4ai-0.7.0}/.github/workflows/codeql.yml

@@ -16,8 +16,8 @@ jobs:
   analyze:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: python
-      - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8

{openapi_cli4ai-0.5.1 → openapi_cli4ai-0.7.0}/.github/workflows/publish.yml

@@ -13,8 +13,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - name: Build sdist and wheel
         run: uv build
       - name: Upload artifacts
@@ -42,8 +42,8 @@ jobs:
           name: dist
           path: dist/
       - name: Generate attestations
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/*
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

openapi_cli4ai-0.7.0/.github/workflows/validate-profiles.yml

@@ -0,0 +1,26 @@
+name: Validate profiles
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "profiles/**"
+      - ".github/workflows/validate-profiles.yml"
+  pull_request:
+    paths:
+      - "profiles/**"
+      - ".github/workflows/validate-profiles.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Validate catalog profiles
+        run: uv run --locked openapi-cli4ai catalog validate --all
+      - name: Check profiles/index.json is current
+        run: uv run --locked openapi-cli4ai catalog index --check

{openapi_cli4ai-0.5.1 → openapi_cli4ai-0.7.0}/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.7.0] - 2026-09-11
+
+### Added
+
+- `--profile` is accepted after the subcommand (`openapi-cli4ai endpoints --profile x`); long form only, since `-p` is reused by subcommands (#52)
+- `catalog install --dry-run` prints the exact profile file that would be written and changes nothing (#53)
+- `catalog uninstall <name>` removes an installed catalog profile plus its cached spec and token, with confirm prompt and `--force` (#54)
+- Drop-in profiles: one file per profile under `~/.openapi-cli4ai/profiles.d/<name>.toml`, read alongside `~/.openapi-cli4ai.toml` (a drop-in overrides a same-named entry). `catalog install` writes there. No migration needed (#56)
+- Remote catalog index: `catalog list`/`search`/`show`/`install` merge `profiles/index.json` from `main` over the bundled catalog (3 s timeout, cached one hour, silent fallback to cache then bundled; every remote entry is re-validated). `OAC_CATALOG_OFFLINE=1` disables it. New `catalog index` command generates the committed index; CI checks it is current (#57)
+- DNS TXT domain verification: a profile may set `domain_verified = true`; `catalog validate` resolves `_openapi-cli4ai.<domain>` and requires `github=<maintainer>`. Shown as a `✓ dns` badge, separate from the tier (#58)
+
+### Changed
+
+- `cli.py` split into `config.py`, `catalog.py`, `validator.py` plus small state/UI modules; behavior unchanged (#55)
+- Adopted ruff 0.16's default rule set; the rule selection is no longer implicit (#50, #51)
+- Dependency updates: `typer` 0.27.2, `click` 8.5, `python-dotenv`, `mypy`, `types-PyYAML`, and the GitHub Actions group (#49, #50)
+
+### Fixed
+
+- Rich swallowed TOML table headers such as `[profiles.x]` in `profile show` output; now rendered as plain text (#53)
+- File paths in install output are never wrapped across lines (#56)
+
+## [0.6.0] - 2026-07-31
+
+### Added
+
+- **Profile catalog** — browse and install ready-made API profiles: `catalog search` / `show` / `list` / `install` / `validate`. Bundled into the wheel, so it works offline, with two trust tiers (`verified` / `community`) (#25)
+- Global `--profile` / `-p` flag to select a profile for a single invocation (precedence: flag > `OAC_PROFILE` > active profile) (#25)
+- Community-contributed profile: Xquik (#23)
+
+### Changed
+
+- Dependency updates: `typer` 0.27, `mypy` 2.3, `types-PyYAML`, and the GitHub Actions group (#38, #37)
+- Pin `ruff` and run the locked version in CI so lint is deterministic (no more `uvx`-latest drift) (#39)
+
+### Security
+
+- Catalog validation hardening: SSRF guard on spec fetches (rejects cloud-metadata/private/loopback hosts, pre- and post-redirect), Public Suffix List domain-ownership check, spec size/redirect/timeout limits, prompt-injection scan of descriptions, and an explicit confirmation before installing unverified community profiles (#25)
+
 ## [0.5.1] - 2026-07-04
 
 ### Fixed

openapi_cli4ai-0.7.0/CONTRIBUTING.md

@@ -0,0 +1,78 @@
+# Contributing to openapi-cli4ai
+
+Thanks for your interest in contributing!
+
+## Getting Started
+
+1. Fork the repository
+2. Clone your fork
+3. Install [uv](https://docs.astral.sh/uv/) if you don't have it
+4. Install in editable mode: `uv pip install -e .`
+5. Run `openapi-cli4ai --help` to verify everything works
+
+## Project Structure
+
+```
+src/openapi_cli4ai/
+  __init__.py       # Package exports
+  __main__.py       # python -m support
+  cli.py            # Typer commands, HTTP/auth flows, spec fetching
+  config.py         # Config file, cache dir, active-profile precedence
+  catalog.py        # Bundled profile catalog: load, find, map to a profile
+  validator.py      # Catalog profile validator (shared by `catalog validate` and CI)
+  _state.py         # Runtime flags set by the root command (--verbose, --profile, ...)
+  _ui.py            # Shared Rich consoles and the verbose logger
+openapi-cli4ai      # Standalone shim (imports from package)
+tests/              # pytest tests
+```
+
+Commands live in `src/openapi_cli4ai/cli.py`; it imports the helpers it needs from the service modules, so tests can patch either the service module or the `cli` binding. The standalone `openapi-cli4ai` script is a thin shim that imports from the package.
+
+## Testing
+
+```bash
+pytest tests/ -m "not integration" -v
+```
+
+## Submitting a Pull Request
+
+1. Create a feature branch (`git checkout -b my-feature`)
+2. Make your changes
+3. Run the tests
+4. Commit with a clear message
+5. Push and open a PR
+
+## Contributing a Profile to the Catalog
+
+`openapi-cli4ai` ships a community catalog of ready-made API profiles under
+[`profiles/`](profiles/README.md). To add one:
+
+1. Create `profiles/community/<slug>.toml` following the format in
+   [`profiles/README.md`](profiles/README.md).
+2. Reference secrets only via `*_env_var` fields — never commit a token.
+3. Keep the `description` factual. `source` must be the API's own developer or
+   docs URL (same domain as `base_url`).
+4. Validate locally: `uv run openapi-cli4ai catalog validate profiles/community/<slug>.toml`
+5. Regenerate the index and commit it: `uv run openapi-cli4ai catalog index`
+6. Optional: claim the domain-verified badge by setting `domain_verified = true`
+   and publishing a `_openapi-cli4ai.<domain>` TXT record naming you; see
+   "Domain verification" in [`profiles/README.md`](profiles/README.md).
+
+CI runs `catalog validate --all` and `catalog index --check` on every PR touching
+`profiles/`, checking the fields, a live spec fetch, ownership, absence of inline
+secrets, any `domain_verified` claim against DNS, and that `profiles/index.json`
+is current — errors appear inline on the PR. Once merged, the profile is visible to every installed CLI within an hour
+via the remote index (see `profiles/README.md`, "Freshness"). Profiles that are primarily promotional will be closed
+without review.
+
+## Reporting Issues
+
+Open an issue on GitHub. Include:
+- What you tried
+- What happened
+- What you expected
+- The API spec you were using (if relevant)
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the MIT License.

{openapi_cli4ai-0.5.1 → openapi_cli4ai-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: openapi-cli4ai
-Version: 0.5.1
+Version: 0.7.0
 Summary: Turn any REST API with an OpenAPI spec into an AI-ready CLI
 Project-URL: Homepage, https://github.com/dbgorilla/openapi-cli4ai
 Project-URL: Repository, https://github.com/dbgorilla/openapi-cli4ai
@@ -19,6 +19,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.11
 Requires-Dist: httpx<1,>=0.28
+Requires-Dist: publicsuffix2<3,>=2.2
 Requires-Dist: python-dotenv<2,>=1.0
 Requires-Dist: pyyaml<7,>=6
 Requires-Dist: rich<16,>=13
@@ -236,6 +237,8 @@ openapi-cli4ai logout
 
 Profiles are stored in `~/.openapi-cli4ai.toml`. Secrets are referenced via environment variables — never stored in the config file.
 
+Profiles can also live one-per-file under `~/.openapi-cli4ai/profiles.d/<name>.toml`, where the file holds the profile's keys directly (no `[profiles.<name>]` header) and the file name is the profile name. `catalog install` writes there so installing, upgrading and uninstalling a profile touch only that file. Both locations are read; a drop-in overrides a same-named entry in `~/.openapi-cli4ai.toml`. `active_profile` is only read from `~/.openapi-cli4ai.toml`.
+
 ```toml
 active_profile = "myapi"
 

{openapi_cli4ai-0.5.1 → openapi_cli4ai-0.7.0}/README.md

@@ -208,6 +208,8 @@ openapi-cli4ai logout
 
 Profiles are stored in `~/.openapi-cli4ai.toml`. Secrets are referenced via environment variables — never stored in the config file.
 
+Profiles can also live one-per-file under `~/.openapi-cli4ai/profiles.d/<name>.toml`, where the file holds the profile's keys directly (no `[profiles.<name>]` header) and the file name is the profile name. `catalog install` writes there so installing, upgrading and uninstalling a profile touch only that file. Both locations are read; a drop-in overrides a same-named entry in `~/.openapi-cli4ai.toml`. `active_profile` is only read from `~/.openapi-cli4ai.toml`.
+
 ```toml
 active_profile = "myapi"
 

openapi_cli4ai-0.7.0/profiles/README.md

@@ -0,0 +1,114 @@
+# Profile catalog
+
+Ready-made **profiles** for public APIs. A profile is the small bit of config
+`openapi-cli4ai` needs to talk to an API: a base URL, where its OpenAPI spec
+lives, and how it authenticates. The catalog is bundled into the package, so
+these commands work offline; when online they also pick up profiles merged to
+`main` since your release (see [Freshness](#freshness)):
+
+```bash
+openapi-cli4ai catalog search cov            # find profiles
+openapi-cli4ai catalog show codecov          # preview one
+openapi-cli4ai catalog install codecov       # add it to your config, with next steps
+openapi-cli4ai --profile codecov endpoints   # use it (no activation needed)
+```
+
+`install` maps the catalog entry into your `~/.openapi-cli4ai.toml`, tells you
+exactly which environment variable to set for auth, and hands you the next
+command — no docs required.
+
+## Tiers
+
+Listing a profile here is not an endorsement of the product behind it. Trust is
+a **tier**, shown next to every entry, not a gate on being listed.
+
+| Tier | Directory | What it means |
+| --- | --- | --- |
+| **Verified** | `verified/` | A maintainer confirmed the spec loads and the auth flow works. |
+| **Community** | `community/` | Contributed via PR and passed automated validation. Not manually vetted. |
+
+Independently of the tier, a profile can carry a **domain-verified** badge
+(`✓ dns` in listings): the owner of the API's domain has published a DNS TXT
+record naming the maintainer, so the listing is backed by domain control, not
+just a self-declared `source`. See [Domain verification](#domain-verification).
+
+New submissions go to `community/`; a maintainer may promote a profile to
+`verified/` after checking it end to end. Installing a **community** profile
+prompts for confirmation (it shows the `base_url` your credentials would be
+sent to); **verified** profiles install without a prompt. Use `--yes` to skip
+the prompt in scripts.
+
+## Freshness
+
+The bundled catalog is the offline baseline. On top of it, `catalog list`,
+`search`, `show` and `install` fetch [`index.json`](index.json) from this
+repository's `main` branch (3 s timeout, cached for an hour under
+`~/.cache/openapi-cli4ai/`) and merge it in, so a profile is usable as soon as
+its PR merges. Any failure falls back to the cached index, then to the bundled
+copy, silently. Every remote entry is re-checked with the offline validator
+before use; a bad one is skipped. Set `OAC_CATALOG_OFFLINE=1` to never fetch.
+
+`index.json` is generated from the TOML files by `openapi-cli4ai catalog index`
+and committed; CI fails a PR whose index is stale.
+
+## Profile format
+
+One profile per file, named `<slug>.toml`:
+
+```toml
+name = "example"                        # must match the file name
+description = "Example REST API"         # one factual line, no marketing
+maintainer = "your-github-username"
+source = "https://example.com/docs"      # the API's official docs (same domain as base_url)
+
+base_url = "https://api.example.com"
+openapi_url = "https://api.example.com/openapi.json"   # or: openapi_path = "/openapi.json"
+
+domain_verified = true                   # optional: see "Domain verification" below
+
+[auth]
+type = "api-key"                         # none | bearer | oidc | device | api-key | basic
+env_var = "EXAMPLE_API_KEY"              # reference secrets by env var — never inline them
+header = "x-api-key"
+```
+
+Auth field names match the CLI's runtime config; see
+[`../examples/profiles.toml.example`](../examples/profiles.toml.example) for
+each auth type.
+
+## Domain verification
+
+To claim the `✓ dns` badge, set `domain_verified = true` in the profile and have
+the API's domain owner publish this TXT record (registrable domain of
+`base_url`, e.g. `api.acme.co.uk` → `acme.co.uk`):
+
+```
+_openapi-cli4ai.acme.co.uk.  IN  TXT  "github=<maintainer>"
+```
+
+`<maintainer>` must equal the profile's `maintainer` field (case-insensitive).
+`catalog validate` resolves the record and fails the PR if it is missing or
+names someone else; the claim is re-checked on every profile change. Remove the
+claim (or the record) to drop the badge. The lookup needs `dnspython`, which
+`uv sync` installs for contributors; end users never resolve DNS.
+
+## Contributing a profile
+
+1. Create `community/<slug>.toml` in the format above.
+2. Reference secrets only via `*_env_var` fields — **never commit a token**.
+3. Keep `description` factual. `source` must be the API's own developer/docs
+   URL (same registrable domain as `base_url`).
+
+Validate before opening the PR — the CLI is the single source of truth — and
+regenerate the index:
+
+```bash
+uv run openapi-cli4ai catalog validate profiles/community/<slug>.toml
+uv run openapi-cli4ai catalog index
+```
+
+CI runs `catalog validate --all` on every PR touching `profiles/`. It checks the
+fields and (Public Suffix List-based) domain ownership, fetches the OpenAPI spec
+behind SSRF guards with size/redirect/timeout limits, rejects inlined secrets,
+and flags prompt-injection markers in the description. Errors are posted inline
+on the PR.

openapi_cli4ai-0.7.0/profiles/community/.gitkeep

@@ -0,0 +1,2 @@
+# Community-contributed profiles land here (see ../README.md).
+# This file keeps the directory tracked while it is empty.

openapi_cli4ai-0.7.0/profiles/community/xquik.toml

@@ -0,0 +1,11 @@
+name = "xquik"
+description = "Xquik REST API"
+maintainer = "kriptoburak"
+source = "https://xquik.com"
+base_url = "https://xquik.com"
+openapi_url = "https://xquik.com/openapi.json"
+
+[auth]
+type = "api-key"
+env_var = "XQUIK_API_KEY"
+header = "x-api-key"

openapi_cli4ai-0.7.0/profiles/index.json

@@ -0,0 +1,33 @@
+{
+  "profiles": [
+    {
+      "auth": {
+        "env_var": "XQUIK_API_KEY",
+        "header": "x-api-key",
+        "type": "api-key"
+      },
+      "base_url": "https://xquik.com",
+      "description": "Xquik REST API",
+      "maintainer": "kriptoburak",
+      "name": "xquik",
+      "openapi_url": "https://xquik.com/openapi.json",
+      "slug": "xquik",
+      "source": "https://xquik.com",
+      "tier": "community"
+    },
+    {
+      "auth": {
+        "type": "none"
+      },
+      "base_url": "https://petstore3.swagger.io/api/v3",
+      "description": "Swagger Petstore \u2014 the OpenAPI 3 sample API",
+      "maintainer": "dbgorilla",
+      "name": "petstore",
+      "openapi_url": "https://petstore3.swagger.io/api/v3/openapi.json",
+      "slug": "petstore",
+      "source": "https://petstore3.swagger.io",
+      "tier": "verified"
+    }
+  ],
+  "version": 1
+}

openapi_cli4ai-0.7.0/profiles/verified/petstore.toml

@@ -0,0 +1,11 @@
+# Verified catalog profile. Validated by a maintainer against a live spec.
+name = "petstore"
+description = "Swagger Petstore — the OpenAPI 3 sample API"
+maintainer = "dbgorilla"
+source = "https://petstore3.swagger.io"
+
+base_url = "https://petstore3.swagger.io/api/v3"
+openapi_url = "https://petstore3.swagger.io/api/v3/openapi.json"
+
+[auth]
+type = "none"

{openapi_cli4ai-0.5.1 → openapi_cli4ai-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openapi-cli4ai"
-version = "0.5.1"
+version = "0.7.0"
 description = "Turn any REST API with an OpenAPI spec into an AI-ready CLI"
 readme = "README.md"
 license = "MIT"
@@ -30,6 +30,7 @@ dependencies = [
     "pyyaml>=6,<7",
     "python-dotenv>=1.0,<2",
     "tomli-w>=1.0,<2",
+    "publicsuffix2>=2.2,<3",
 ]
 
 [project.urls]
@@ -45,17 +46,37 @@ dev = [
     "pytest>=8",
     "pytest-cov>=5",
     "click>=8,<9",
+    # CI runs the locked ruff (uv run) instead of uvx-latest so lint is
+    # deterministic; a bump comes via Dependabot and is gated by CI.
+    "ruff>=0.15,<0.17",
     "mypy>=1.10,<3",
     "types-PyYAML>=6,<7",
+    # DNS TXT domain verification in `catalog validate` (CI + contributors);
+    # end users never resolve DNS, so this is not a runtime dependency.
+    "dnspython>=2.4,<3",
 ]
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/openapi_cli4ai"]
 
+# Bundle the profile catalog into the wheel so `catalog` commands work offline.
+[tool.hatch.build.targets.wheel.force-include]
+"profiles/verified" = "openapi_cli4ai/_catalog/verified"
+"profiles/community" = "openapi_cli4ai/_catalog/community"
+
 [tool.ruff]
 line-length = 120
 target-version = "py311"
 
+[tool.ruff.lint]
+# Rule set = ruff's defaults for the locked version. Drift is guarded by the
+# version cap on the dev dependency plus uv.lock; a ruff bump arrives via
+# Dependabot and is gated by CI, so new rules are adopted deliberately.
+# RUF059 (unused unpacked variable) is ignored in tests: fixtures return
+# tuples like `mod, tmp_path, cache_dir = tmp_config` and unpacking the
+# full shape is clearer than `_`-prefixing whichever half a test skips.
+per-file-ignores = { "tests/**" = ["RUF059"] }
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 markers = ["integration: live API tests (may be slow)"]

{openapi_cli4ai-0.5.1 → openapi_cli4ai-0.7.0}/src/openapi_cli4ai/__init__.py

@@ -3,4 +3,4 @@
 from openapi_cli4ai.cli import VERSION, app
 
 __version__ = VERSION
-__all__ = ["app", "VERSION", "__version__"]
+__all__ = ["VERSION", "__version__", "app"]

openapi_cli4ai-0.7.0/src/openapi_cli4ai/_state.py

@@ -0,0 +1,22 @@
+"""Runtime settings set once by the root command and read by every layer.
+
+Module globals on purpose: the CLI is a single process handling one command,
+and tests set these directly (``_state._verbose_mode = True``).
+"""
+
+from __future__ import annotations
+
+_insecure_mode = False
+_verbose_mode = False
+_timeout_seconds = 60.0
+_max_retries = 0
+_profile_override: str | None = None
+
+
+def set_insecure_mode(insecure: bool) -> None:
+    global _insecure_mode
+    _insecure_mode = insecure
+
+
+def get_verify_ssl() -> bool:
+    return not _insecure_mode

openapi_cli4ai-0.7.0/src/openapi_cli4ai/_ui.py

@@ -0,0 +1,16 @@
+"""Shared Rich consoles and the verbose logger."""
+
+from __future__ import annotations
+
+from rich.console import Console
+
+from openapi_cli4ai import _state
+
+console = Console()
+err_console = Console(stderr=True)
+
+
+def _verbose(msg: str) -> None:
+    """Print a verbose message to stderr if verbose mode is enabled."""
+    if _state._verbose_mode:
+        err_console.print(f"[dim]> {msg}[/dim]")