pinky-core 0.1.0.dev4__tar.gz → 0.1.0.dev6__tar.gz

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev6}/.github/workflows/ci.yml

@@ -3,16 +3,20 @@ name: CI
 on:
   push:
     branches: [main, develop]
-    paths: ['src/**', 'tests/**', 'pyproject.toml', 'scripts/**', '.pre-commit-config.yaml', '.github/workflows/ci.yml']
   pull_request:
     branches: [main, develop]
-    paths: ['src/**', 'tests/**', 'pyproject.toml', 'scripts/**', '.pre-commit-config.yaml', '.github/workflows/ci.yml']
 
 jobs:
   ci:
     runs-on: ubuntu-latest
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+    # Explicite, alors que le défaut d'org est déjà `read` : ce défaut est un réglage
+    # d'organisation, invisible du fichier et modifiable sans toucher aucun repo. Le déclarer ici
+    # rend le workflow immunisé si ce défaut repasse un jour en `write` (règle CodeQL
+    # actions/missing-workflow-permissions, 14 alertes sur l'org au scan 2026-07-25).
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
@@ -33,10 +37,10 @@ jobs:
         uses: j178/prek-action@v2
 
       - name: Install dependencies
-        # All optional extras, not just validate/address/dev — omitting xml/schedule/lint
-        # silently skips their test files at collection time (pytest.importorskip on the
-        # missing package), deflating the coverage number without ever failing CI.
-        run: pip install -e ".[validate,address,schedule,xml,lint,dev]"
+        # --group dev, pas ".[dev]" : les deps de dev sont un dependency-group PEP 735 depuis
+        # 2026-07-22 (voir le commentaire dans pyproject.toml — `uv run` désinstallait les extras).
+        # Requiert pip >= 25.1 ; ensurepip en livre 26.1.2 avec Python 3.12, donc rien à épingler.
+        run: pip install -e ".[validate,address,schedule,xml,lint]" --group dev
 
       - name: Tests
         run: pytest
@@ -45,6 +49,8 @@ jobs:
     # ADR-0023 pilot gate: hermetic pre-commit hooks must run on the brother's
     # machine (Windows, prek only, no toolchain) — this is the real gate, not the Mac.
     runs-on: windows-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         shell: [cmd, pwsh]

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev6}/.gitignore

@@ -12,7 +12,10 @@ build/
 
 # ── Environments ─────────────────────────────────────────────────────────────
 .env
-.venv/
+# No trailing slash: with `centralized-project-envs`, uv puts the env in ~/.cache/uv and drops a
+# SYMLINK named .venv here. `.venv/` matches directories only, so the link stayed untracked-visible
+# and committable — a machine-absolute path, useless on any other machine.
+.venv
 venv/
 .conda/
 

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev6}/.pre-commit-config.yaml

@@ -15,6 +15,15 @@ default_install_hook_types: [pre-commit, commit-msg]
 # Pin explicite : sans ça, les hooks `language: python` (mdformat, mypy, interrogate, darglint…)
 # créent leur venv avec le python3 ambiant du PATH au moment de l'install, pas une version garantie
 # par le repo — non-déterministe en local (CI est protégée par actions/setup-python en amont).
+#
+# Règle (2026-07-22) : tout hook `repo: local` dont l'`entry` commence par `python` DOIT être
+# `language: python`, jamais `language: system`. `system` exécute la commande telle quelle dans le
+# shell, et `python` nu n'existe ni sur macOS hors conda (homebrew ne pose que `python3`) ni sur une
+# machine Windows vanilla — ça ne marchait que par l'auto-activation de conda base. Avec
+# `language: python`, prek provisionne l'interpréteur (et le télécharge s'il manque) et met le bin/
+# de son venv en tête du PATH : `python` y est garanti sur les trois OS. Les scripts de
+# scripts/hooks/ étant 100 % stdlib, ils partagent tous un seul venv (dédupliqué par langage +
+# version + additional_dependencies) — coût quasi nul.
 default_language_version:
   python: python3.12
 
@@ -43,6 +52,28 @@ repos:
         stages: [pre-commit]
         pass_filenames: false
 
+  # ── Test suite: the blocking quality gate ─────────────────────────────────
+  # Universal, NOT the `python` extra (moved 2026-07-25, same day it was introduced). The first
+  # placement rested on an unverified assumption — "the repos outside the python extra have no test
+  # suite". Measured: pinky-workspace, the engine itself, carries 25 test files / 264 tests, and
+  # pinky-studio carries tests with NO CI at all. Only assets/infra have no tests/ directory, and
+  # the hook's own `[ -d tests ]` guard makes those a real no-op.
+  #
+  # Before this hook, the only test execution at commit time was the one buried inside generate-docs
+  # feeding the coverage badge, whose failure printed a warning and returned 0 — a broken suite
+  # passed pre-commit. generate-docs keeps its own run for the badge data and stays non-blocking;
+  # this hook owns the verdict. See core/hooks/run-tests for why the two runs stay independent, and
+  # why an absent pytest warns instead of blocking.
+  - repo: local
+    hooks:
+      - id: run-tests
+        name: "[TESTS] Suite must pass"
+        entry: scripts/hooks/run-tests
+        language: script
+        files: ^(src|tests)/
+        pass_filenames: false
+        stages: [pre-commit]
+
   # ── Formatting: Markdown ──────────────────────────────────────────────────
   - repo: local
     hooks:
@@ -80,7 +111,7 @@ repos:
       - id: check-zws
         name: "[ZWS] Invisible characters (zero-width)"
         entry: python scripts/hooks/check_zws.py
-        language: system
+        language: python
         pass_filenames: true
 
   # ── Employer reference guard ──────────────────────────────────────────────
@@ -89,7 +120,7 @@ repos:
       - id: check-forbidden-keywords
         name: "[FORBIDDEN] Employer references"
         entry: python scripts/hooks/check_forbidden_keywords.py
-        language: system
+        language: python
         pass_filenames: true
 
   # ── Commit message format ─────────────────────────────────────────────────
@@ -171,10 +202,22 @@ repos:
       - id: check-typed-api
         name: "[TYPED-API] No raw dict/tuple/set in public annotations"
         entry: python scripts/hooks/check_typed_api.py
-        language: system
+        language: python
         types: [python]
         files: ^src/
 
+  # Weak-assertion ratchet — first hook to target tests/, not src/ (tests.md § generator oracle).
+  # Blocks a fragment `assert "x" in <generator(...)>` that has no whole-output equality oracle in
+  # the same file. Narrow by design (name-matched generators only) so it stays at ~0 flags.
+  - repo: local
+    hooks:
+      - id: check-weak-assertions
+        name: "[WEAK-ASSERT] Generated-output assertion needs an equality oracle"
+        entry: python scripts/hooks/check_weak_assertions.py
+        language: python
+        types: [python]
+        files: ^tests/
+
   # ── EXTRA snowflake — Snowpark / Core API repos ───────────────────────────
   # Snowpark / Core API conventions (no session.sql(), canonical method names)
   - repo: local
@@ -182,6 +225,6 @@ repos:
       - id: check-snowpark-api
         name: "[SNOWPARK-API] No session.sql(), canonical method names"
         entry: python scripts/hooks/check_snowpark_api.py
-        language: system
+        language: python
         types: [python]
         files: ^src/

pinky_core-0.1.0.dev6/.python-version

@@ -0,0 +1 @@
+3.12

pinky_core-0.1.0.dev6/.vscode/settings.json

@@ -0,0 +1,8 @@
+{
+  // uv keeps this repo's environment in its own cache, OUT of the synced iCloud drive (ADR-0023),
+  // and the `.venv` here is a SYMLINK to it. VSCode's environment auto-discovery does NOT follow that
+  // symlink, so the interpreter is declared explicitly rather than picked by hand each time.
+  // ${workspaceFolder} is THIS repo when the multi-root `pinky.code-workspace` is open.
+  // Env missing? `uv sync --all-extras` recreates it.
+  "python.defaultInterpreterPath": "${workspaceFolder}/.venv/bin/python"
+}

pinky_core-0.1.0.dev6/CONTEXT.md

@@ -0,0 +1,24 @@
+# CONTEXT.md — pinky-core
+*Update date : 2026-07-12 13:12*
+
+Single source of truth for naming in this repo. Variables, functions, modules, and prose follow it.
+**Agent rule: read this before naming anything.**
+
+| Term (preferred) | Avoid | Definition |
+|---|---|---|
+| `validate_*` (`validate_siret`, `validate_identifier`, …) | check, verify, sanitize | Reject-only — returns the input unchanged if valid, raises/returns invalid otherwise. Never transforms. |
+| `standardize_*` (`standardize_email`, `standardize_phone`) | normalize, format | Validates **and** normalizes to a canonical form (e.g. phone → E.164). |
+| `safe_*` (`safe_filepath`) | sanitize, escape | Same contract as `validate_*` — reject-only. Named `safe_` (not `sanitize_`) because the caller's safety comes from the *rejection*, not from any escaping/transform; a docstring once claimed it escaped quotes, it never did (coco review, 2026-07-12) — don't reintroduce that confusion. |
+| `ref` / `refs` (`extract_table_refs`, `resolve_query`'s `refs` param) | reference(s) | A table reference string — see `FQN`. |
+| `FQN` | fully-qualified name, qualified identifier | `DATABASE.SCHEMA.TABLE` (or `SCHEMA.TABLE`) — pinky-provider's identifier convention. A bare, unqualified name is never a legitimate FQN in this codebase (see `extract_table_refs`). |
+| `predicate` (schedule.py's `is_business_day`, `is_eve_of_holiday`, …) | check, rule, condition | A pure `bool`-returning function taking a `date`, callable as a DAG root-task SKIP gate (ADR-0013 in pinky-provider). |
+| `*Result` (`EmailResult`, `FecParseResult`, …) | `*Response`, `*Output` | A model wrapping the outcome of one validate/parse call — success or failure both representable, never raised. |
+| `*Error` (`FecRowError`, `FecBalanceError`) | `*Failure`, `*Issue` | A record of one specific failure collected *during* processing (e.g. one bad row) — distinct from `*Result`, which wraps the whole call's outcome. |
+| `lazy import` (`from unidecode import unidecode` inside a function body) | optional import, deferred import | The pattern every optional-dependency function uses so importing the *module* never requires the extra — only calling that specific function does. |
+
+## Flagged ambiguities
+
+- **`slugify` breaks the `to_*` prefix convention** (`to_upper_snake_case`, `to_camel_case`) — kept
+  bare because "slugify" is an established cross-language term (same name in Django, JS `slugify`
+  packages, etc.); renaming it `to_slug` would be more consistent internally but less recognizable.
+  Not revisited unless a second bare-verb name is added and the inconsistency compounds.

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pinky-core
-Version: 0.1.0.dev4
+Version: 0.1.0.dev6
 Summary: Shared Python utilities for Snowflake development
 Project-URL: Homepage, https://github.com/pinky-and-co/pinky-core
 Project-URL: Repository, https://github.com/pinky-and-co/pinky-core
@@ -40,19 +40,6 @@ Requires-Dist: sqlglot
 Requires-Dist: unidecode
 Provides-Extra: address
 Requires-Dist: usaddress; extra == 'address'
-Provides-Extra: dev
-Requires-Dist: bandit; extra == 'dev'
-Requires-Dist: darglint; extra == 'dev'
-Requires-Dist: genbadge[coverage]; extra == 'dev'
-Requires-Dist: interrogate; extra == 'dev'
-Requires-Dist: mkdocs-awesome-pages-plugin>=2.0; extra == 'dev'
-Requires-Dist: mkdocs-material>=9.0; extra == 'dev'
-Requires-Dist: mkdocstrings[python]>=0.25; extra == 'dev'
-Requires-Dist: mypy; extra == 'dev'
-Requires-Dist: pre-commit; extra == 'dev'
-Requires-Dist: pytest; extra == 'dev'
-Requires-Dist: pytest-cov; extra == 'dev'
-Requires-Dist: ruff; extra == 'dev'
 Provides-Extra: fec
 Requires-Dist: unidecode; extra == 'fec'
 Provides-Extra: lint
@@ -158,18 +145,22 @@ pinky-core/
 │       ├── ci.yml
 │       ├── publish.yml
 │       └── release.yml
+├── .vscode/
+│   └── settings.json
 ├── scripts/
 │   ├── hooks/
 │   │   ├── badges.toml
 │   │   ├── check_forbidden_keywords.py
 │   │   ├── check_snowpark_api.py
 │   │   ├── check_typed_api.py
+│   │   ├── check_weak_assertions.py
 │   │   ├── check_zws.py
 │   │   ├── commit-msg
 │   │   ├── docs_identity.json
 │   │   ├── generate-docs
 │   │   ├── generate_ci_badges.py
-│   │   └── render_docs.py
+│   │   ├── render_docs.py
+│   │   └── run-tests
 │   └── deploy_validate_udfs.py
 ├── sql/
 │   └── deploy_udf_example.sql
@@ -191,6 +182,13 @@ pinky-core/
 │       └── xml.py
 ├── tests/
 │   ├── fixtures/
+│   │   ├── golden/
+│   │   │   ├── dl_card_basic.html
+│   │   │   ├── dl_card_expiry.html
+│   │   │   ├── generate_html_basic.html
+│   │   │   ├── task_table_error.html
+│   │   │   ├── task_table_no_snowsight.html
+│   │   │   └── task_table_snowsight.html
 │   │   └── cats_domination.xml
 │   ├── __init__.py
 │   ├── test_fec.py
@@ -208,10 +206,13 @@ pinky-core/
 ├── .gitignore
 ├── .gitleaks.toml
 ├── .pre-commit-config.yaml
+├── .python-version
 ├── .secrets.baseline
+├── CONTEXT.md
 ├── LICENSE
 ├── pyproject.toml
-└── README.md
+├── README.md
+└── uv.lock
 ```
 
 </details>

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev6}/README.md

@@ -85,18 +85,22 @@ pinky-core/
 │       ├── ci.yml
 │       ├── publish.yml
 │       └── release.yml
+├── .vscode/
+│   └── settings.json
 ├── scripts/
 │   ├── hooks/
 │   │   ├── badges.toml
 │   │   ├── check_forbidden_keywords.py
 │   │   ├── check_snowpark_api.py
 │   │   ├── check_typed_api.py
+│   │   ├── check_weak_assertions.py
 │   │   ├── check_zws.py
 │   │   ├── commit-msg
 │   │   ├── docs_identity.json
 │   │   ├── generate-docs
 │   │   ├── generate_ci_badges.py
-│   │   └── render_docs.py
+│   │   ├── render_docs.py
+│   │   └── run-tests
 │   └── deploy_validate_udfs.py
 ├── sql/
 │   └── deploy_udf_example.sql
@@ -118,6 +122,13 @@ pinky-core/
 │       └── xml.py
 ├── tests/
 │   ├── fixtures/
+│   │   ├── golden/
+│   │   │   ├── dl_card_basic.html
+│   │   │   ├── dl_card_expiry.html
+│   │   │   ├── generate_html_basic.html
+│   │   │   ├── task_table_error.html
+│   │   │   ├── task_table_no_snowsight.html
+│   │   │   └── task_table_snowsight.html
 │   │   └── cats_domination.xml
 │   ├── __init__.py
 │   ├── test_fec.py
@@ -135,10 +146,13 @@ pinky-core/
 ├── .gitignore
 ├── .gitleaks.toml
 ├── .pre-commit-config.yaml
+├── .python-version
 ├── .secrets.baseline
+├── CONTEXT.md
 ├── LICENSE
 ├── pyproject.toml
-└── README.md
+├── README.md
+└── uv.lock
 ```
 
 </details>

pinky_core-0.1.0.dev6/docs/adr/0001-zero-dependency-static-html.md

@@ -0,0 +1,26 @@
+---
+title: "0001"
+---
+# ADR-0001 — Zero Snowflake dependency at import time
+Status: accepted
+Date: 2026-05-31
+
+## Contexte
+
+`pinky-core` doit être importable dans tous les contextes où Python s'exécute : pipelines CI,
+scripts de développement local, gestionnaires UDF à l'intérieur de Snowflake, et Streamlit dans les applications Snowflake.
+L'importation inconditionnelle de Snowpark lève une erreur ou ajoute un coût de démarrage dans les contextes
+qui n'ont pas de session active.
+
+## Décision
+
+Aucun module dans `pinky-core` n'importe Snowflake ou Snowpark au niveau du module.
+Les dépendances optionnelles (`email-validator`, `phonenumbers`, `python-stdnum`, `croniter`) sont
+importées paresseusement dans les fonctions. Les importations réservées au type vérification utilisent la garde `TYPE_CHECKING`.
+
+## Conséquences
+
+- `pinky-core` est installable dans n'importe quel environnement Python 3.11+ sans client
+  Snowflake — `pip install pinky-core` fonctionne en CI pur.
+- Tout module qui a besoin d'une session active appartient à `pinky-snowpark`, pas ici.
+- Les erreurs d'exécution dues aux dépendances optionnelles manquantes apparaissent au moment de l'appel, non à l'importation.

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev6}/docs/explanation/2-features.md

@@ -2,7 +2,7 @@
 title: Features
 ---
 # Features — pinky-core
-*Update date : 2026-07-12 10:37*
+*Update date : 2026-07-25 09:25*
 
 Feature list ordered by priority. `stable` = in production. `planned` = not yet built, order = priority.
 
@@ -18,7 +18,7 @@ Feature list ordered by priority. `stable` = in production. `planned` = not yet
 | `sql.py` | SQL parsing helpers powered by sqlglot: statement kind, table-ref extraction, query resolution, statement splitting | stable |
 | `html.py` | HTML templating engine — emails, reports, mini-sites, Outlook-safe | stable |
 | `xml.py` | XPath helpers, namespace-aware parsing, safe attribute extraction | stable |
-| `files.py` | S3/MFT filename pattern normalisation — `detect_file_pattern`, `FileDetection` | stable |
+| `files.py` | S3/MFT filename pattern normalisation — `detect_file_pattern`, `FileDetection`; replaces dates, timestamps, UUIDs, ISO country codes, structured business identifiers (SIRET/SIREN/IBAN/VAT_FR), and numeric IDs with placeholders | stable |
 | `schedule.py` | French public holidays, business-day helpers, cron human-readable formatting, Airflow-timetable predicates (month/week/fiscal-quarter, eve-of-holiday) | stable |
 | `lint.py` | Optional lint/format delegation (sqlfluff/ruff/yamllint/detect-secrets) — consumed by pinky-provider for the secret-scan deploy gate and SQL pre-flight | stable |
 | `warnings.py` | `PinkyDeprecationWarning` — deprecated pinky APIs and UDFs. No consumer wired yet (destined for pinky-provider's registry `status: deprecated`) | stable |

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev6}/docs/reference/generated/coverage_badge.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="114" height="20" role="img" aria-label="coverage: 84.34%"><title>coverage: 84.34%</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="114" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="53" height="20" fill="#67ac09"/><rect width="114" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="315" y="150" fill-opacity=".8" filter="url(#blur)" textLength="510">coverage</text><text x="315" y="150" fill-opacity=".3" textLength="510">coverage</text></g><text x="315" y="140" textLength="510">coverage</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="865" y="150" fill-opacity=".8" filter="url(#blur)" textLength="430">84.34%</text><text x="865" y="150" fill-opacity=".3" textLength="430">84.34%</text></g><text x="865" y="140" textLength="430">84.34%</text></g></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="114" height="20" role="img" aria-label="coverage: 84.32%"><title>coverage: 84.32%</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="114" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="53" height="20" fill="#67ac09"/><rect width="114" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="315" y="150" fill-opacity=".8" filter="url(#blur)" textLength="510">coverage</text><text x="315" y="150" fill-opacity=".3" textLength="510">coverage</text></g><text x="315" y="140" textLength="510">coverage</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="865" y="150" fill-opacity=".8" filter="url(#blur)" textLength="430">84.32%</text><text x="865" y="150" fill-opacity=".3" textLength="430">84.32%</text></g><text x="865" y="140" textLength="430">84.32%</text></g></g></svg>

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev6}/docs/reference/generated/hooks_badge.svg

@@ -1,12 +1,12 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="81" height="20">
-  <title>generate-docs · mdformat · check-zws · check-forbidden-keywords · commit-msg-format · mypy · interrogate · darglint · check-typed-api · check-snowpark-api</title>
+  <title>generate-docs · run-tests · mdformat · check-zws · check-forbidden-keywords · commit-msg-format · mypy · interrogate · darglint · check-typed-api · check-weak-assertions · check-snowpark-api</title>
   <rect width="81" height="20" rx="3" fill="#555"/>
   <rect x="50" width="31" height="20" rx="3" fill="#007ec6"/>
   <rect x="50" width="4" height="20" fill="#007ec6"/>
   <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
     <text x="25" y="15" fill="#010101" fill-opacity=".3">hooks</text>
     <text x="25" y="14">hooks</text>
-    <text x="65" y="15" fill="#010101" fill-opacity=".3">10</text>
-    <text x="65" y="14">10</text>
+    <text x="65" y="15" fill="#010101" fill-opacity=".3">12</text>
+    <text x="65" y="14">12</text>
   </g>
 </svg>

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pinky-core"
-version = "0.1.0.dev4"
+version = "0.1.0.dev6"
 description = "Shared Python utilities for Snowflake development"
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -32,7 +32,18 @@ xml      = ["lxml", "lxml-stubs"]
 fec      = ["unidecode"]
 # Delegated lint/format/scan backends for pinky_core.lint (SQL / YAML / Python / secrets).
 lint     = ["sqlfluff>=3.0", "yamllint>=1.35", "ruff", "detect-secrets>=1.5"]
-dev      = [
+
+# Deps de dev en dependency-group (PEP 735), PAS en extra (2026-07-22, repo pilote).
+# `uv run` resynchronise l'environnement vers l'état PAR DÉFAUT : les extras n'en font pas partie, il
+# les DÉSINSTALLE donc silencieusement, puis retombe sur le premier pytest trouvé sur le PATH — c'est
+# ce qui avait produit un « 1180 tests au vert » qui validait en réalité les envs conda. Le groupe
+# `dev` de PEP 735, lui, est synchronisé par défaut : `uv run` redevient correct sans aucun flag à
+# retenir. (`[tool.uv] default-extras` est accepté sans erreur mais reste sans effet — testé.)
+# Côté CI, l'équivalent de `-e ".[dev]"` est `-e . --group dev` (pip >= 25.1 ; ensurepip livre 26.1.2
+# avec Python 3.12, donc aucune contrainte à gérer). Un extra reste le bon outil pour une option
+# destinée aux CONSOMMATEURS de la lib — validate/address/schedule/xml/fec/lint restent des extras.
+[dependency-groups]
+dev = [
     "mkdocs-material>=9.0",
     "mkdocs-awesome-pages-plugin>=2.0",
     "mkdocstrings[python]>=0.25",
@@ -52,6 +63,14 @@ Homepage   = "https://github.com/pinky-and-co/pinky-core"
 Repository = "https://github.com/pinky-and-co/pinky-core"
 Issues     = "https://github.com/pinky-and-co/pinky-core/issues"
 
+# ── uv ───────────────────────────────────────────────────────────────────────
+# The project environment lives in uv's cache, NOT in a `.venv` at the repo root: this workspace sits
+# on a synced iCloud drive, and ADR-0023 recorded confirmed corruption when a tool environment lives
+# inside one. Preview feature, accepted knowingly — `uv sync` prints the resolved path, so re-check it
+# still lands under ~/.cache/uv after a uv upgrade.
+[tool.uv]
+preview-features = ["centralized-project-envs"]
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/pinky_core"]