pyclilogin 0.1.1__tar.gz

pyclilogin-0.1.1/.gitignore

@@ -0,0 +1,13 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv
+.coverage
+coverage.xml
+*.egg-info/

pyclilogin-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Birch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

pyclilogin-0.1.1/PKG-INFO

@@ -0,0 +1,211 @@
+Metadata-Version: 2.5
+Name: pyclilogin
+Version: 0.1.1
+Summary: Device-grant login for Python CLIs: one config file, a keychain token store with a visible fallback, and a refresh serialized across processes
+Project-URL: Repository, https://github.com/datapointchris/pyclilogin
+Project-URL: Issues, https://github.com/datapointchris/pyclilogin/issues
+Project-URL: Changelog, https://github.com/datapointchris/pyclilogin/releases
+Author-email: Chris Birch <datapointchris@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: cli,device-authorization-grant,keyring,login,oauth2,oidc
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: httpx2>=2.9.1
+Requires-Dist: keyring>=25
+Provides-Extra: typer
+Requires-Dist: typer>=0.15.0; extra == 'typer'
+Description-Content-Type: text/markdown
+
+# pyclilogin
+
+OIDC device-grant login for Python command-line tools. Tokens live in the OS
+keychain, and the refresh is serialized across every process on the machine.
+The same tool run by a service, with no person to approve a login, uses the
+client-credentials grant instead.
+
+It is the Python sibling of
+[goclilogin](https://github.com/datapointchris/goclilogin), and keeps its
+contract point for point: the same config file, the same keychain fallback, the
+same refresh lock. A Go CLI and a Python CLI built on the two log in, store and
+refresh the same way. Its server-side counterpart is
+[pyapiauth](https://github.com/datapointchris/pyapiauth), which verifies the
+tokens this package obtains.
+
+## Install
+
+```bash
+uv add pyclilogin            # the core
+uv add "pyclilogin[typer]"   # plus the ready-made `auth` commands
+```
+
+## Starting from scratch
+
+A CLI called `acme` describes itself once, as a `Product`, and mounts the
+`auth` commands on its typer app:
+
+```python
+from contextvars import ContextVar
+
+import typer
+from pyclilogin import Product
+from pyclilogin.typercmd import add_auth_commands
+
+PRODUCT = Product(name='acme', keyring_service='acme-cli')
+API_FLAG: ContextVar[str] = ContextVar('api_flag', default='')
+
+app = typer.Typer()
+
+
+@app.callback()
+def root(api: str = typer.Option('', '--api')):
+    API_FLAG.set(api)
+
+
+add_auth_commands(app, PRODUCT, api_flag=API_FLAG.get)
+```
+
+That gives `acme auth login [URL]`, `acme auth logout`, `acme auth token` and
+`acme auth status`. Every other command gets its token the same way:
+
+```python
+import httpx2
+
+resolved = PRODUCT.load(API_FLAG.get())            # the config file, with --api outranking it
+source = PRODUCT.token_source(resolved)            # NotLoggedIn where nothing is stored
+response = httpx2.get(
+    f'{resolved.api.value}/items',
+    headers={'Authorization': f'Bearer {source.token().access_token}'},  # refreshed first if it lapsed
+)
+```
+
+The first run needs three things from outside the CLI:
+
+- The provider advertises a `device_authorization_endpoint` in its OIDC
+  discovery document.
+- The client id is registered at the provider as a public client with no
+  secret.
+- The API serves RFC 9728 protected-resource metadata naming its login server.
+  A `config.toml` that already sets `issuer` skips this.
+
+Every error is a `LoginError` whose message names its fix, so a CLI's entry
+point catches that one class and prints the message.
+
+## Which call answers which question
+
+| Ask | Call | Reads |
+| --- | --- | --- |
+| Where is this CLI pointed | `Product.load`, `write_deployment` | the config file, and an `--api`'s RFC 9728 metadata where it differs from the file's |
+| What does a first login fill in | `Product.for_login` | the config file, then the API's RFC 9728 metadata for a missing `issuer` |
+| How does a person log in | `Provider.login` | the issuer's discovery document, then the device grant |
+| Where did the token go | `TokenStore.save`, `TokenStore.load` | the OS keychain, then the mode-600 file in the state directory |
+| How do requests get a token | `Product.token_source` | the store, then on a refresh the refresh lock and the discovery document |
+| How does a service with no person authenticate | `ServiceTokenSource` | the token endpoint, with the client's secret |
+| How does a CLI use tokens a broker hands it | `CommandTokenSource` | the stdout of `token_command` from the config file |
+| How do my tests avoid the real keychain | `pyclilogin.testing.MemoryKeyring` | a dict |
+
+## One config file says where the CLI is pointed, and only login writes it
+
+`$XDG_CONFIG_HOME/<name>/config.toml` holds three keys:
+
+```toml
+api = "https://acme.example.com"
+issuer = "https://auth.example.com"
+client_id = "acme-cli-laptop"
+```
+
+Every command reads it through `Product.load`. An explicit `--api` outranks the
+file's. Nothing else is read: no environment variable, and no address compiled
+into the package, because each value names one installation.
+
+`acme auth login https://acme.example.com` fills in only what the file lacks.
+`api` comes from the URL, `issuer` from the API's
+`/.well-known/oauth-protected-resource`, and `client_id` from `--client-id` or
+`acme-cli-<short hostname>`. Each is printed with where it came from before the
+grant starts, and written once the grant succeeds. A value the file already
+holds is never rewritten, and a typed value differing from it is refused.
+
+An `--api` differing from the file's must name the file's issuer in its own
+metadata. Otherwise the command is refused before any request carries a token.
+
+Login never writes through a symlink. A link means a config manager owns the
+file, and its source may be every machine's. A client id written there would
+become every machine's.
+
+A key outside these three belongs to the product, as in goclilogin. A product
+whose file holds nothing else passes `product_keys=frozenset()`, and a renamed
+key such as `api_base` is then refused rather than read as a file with no
+`api`.
+
+## The refresh is serialized across every process on the machine
+
+A provider following RFC 9700 rotates the refresh token on every use, and
+revokes the whole grant when a consumed one is presented again. Two processes
+refreshing from the same stored token therefore cost an interactive login.
+One rotates, and the other replays the token that rotation consumed.
+
+`TokenSource.token` holds an exclusive `flock` in the state directory for the
+refresh, and reads the store again once it has the lock. A process that waited
+uses the winner's token instead of replaying its own. A lock that cannot be
+taken within ten seconds gives an unlocked refresh. That risks one login, where
+blocking on a wedged holder would hang every command.
+
+A command holding a live token makes no call to the provider at all.
+
+## The token goes to the keychain, and the downgrade is visible
+
+`TokenStore.save` returns the backend that took the token. On a Linux host with
+no Secret Service, that is a mode-600 `token.json` in the state directory, and
+`auth login` says so. A macOS keychain locked to an SSH session is refused
+instead, with `security unlock-keychain` as the fix. A plaintext copy written
+there would outlive the lock. `TokenStore.delete` clears both stores, so a file
+token written before a host had a keyring cannot outlive the logout.
+
+## A service authenticates as itself, never as a person
+
+With `ACME_CLIENT_SECRET` set, `Product.token_source` authenticates as the
+config file's `client_id` with the client-credentials grant. The variable is
+`<NAME>_CLIENT_SECRET` unless `Product.secret_variable` names another. The
+secret stays in the environment, because `auth status` prints the file.
+
+```python
+source = PRODUCT.token_source(resolved, service_scopes=('acme.items.read',))
+```
+
+A service's token carries only the scopes its command names, so a command
+naming none is refused before any request. Nothing is stored and no lock is
+taken: the grant issues no refresh token. Name the service's client so the API
+can tell it from a person's, such as `acme-svc-scheduler`.
+
+## A broker's token command replaces the login
+
+A workload whose broker hands it short-lived tokens names the broker's command
+in the file:
+
+```toml
+api = "https://acme.example.com"
+token_command = ["broker", "token", "--audience", "acme"]
+```
+
+The command prints an RFC 6749 § 5.1 token response. Every request carries its
+`access_token`, and the command runs again once `expires_in` lapses.
+
+## Linux and macOS
+
+The refresh lock is `fcntl.flock`, so the package runs on Linux and macOS.
+Releases are cut only from a commit whose suite passes on both, on Python 3.11
+and 3.13.
+
+## What it deliberately does not do
+
+It is not a general OIDC client. It has no ID token verification, no
+back-channel logout, no DPoP and no mTLS-bound tokens. An API that verifies
+tokens against the provider's JWKS, as pyapiauth does, needs none of them.

pyclilogin-0.1.1/README.md

@@ -0,0 +1,184 @@
+# pyclilogin
+
+OIDC device-grant login for Python command-line tools. Tokens live in the OS
+keychain, and the refresh is serialized across every process on the machine.
+The same tool run by a service, with no person to approve a login, uses the
+client-credentials grant instead.
+
+It is the Python sibling of
+[goclilogin](https://github.com/datapointchris/goclilogin), and keeps its
+contract point for point: the same config file, the same keychain fallback, the
+same refresh lock. A Go CLI and a Python CLI built on the two log in, store and
+refresh the same way. Its server-side counterpart is
+[pyapiauth](https://github.com/datapointchris/pyapiauth), which verifies the
+tokens this package obtains.
+
+## Install
+
+```bash
+uv add pyclilogin            # the core
+uv add "pyclilogin[typer]"   # plus the ready-made `auth` commands
+```
+
+## Starting from scratch
+
+A CLI called `acme` describes itself once, as a `Product`, and mounts the
+`auth` commands on its typer app:
+
+```python
+from contextvars import ContextVar
+
+import typer
+from pyclilogin import Product
+from pyclilogin.typercmd import add_auth_commands
+
+PRODUCT = Product(name='acme', keyring_service='acme-cli')
+API_FLAG: ContextVar[str] = ContextVar('api_flag', default='')
+
+app = typer.Typer()
+
+
+@app.callback()
+def root(api: str = typer.Option('', '--api')):
+    API_FLAG.set(api)
+
+
+add_auth_commands(app, PRODUCT, api_flag=API_FLAG.get)
+```
+
+That gives `acme auth login [URL]`, `acme auth logout`, `acme auth token` and
+`acme auth status`. Every other command gets its token the same way:
+
+```python
+import httpx2
+
+resolved = PRODUCT.load(API_FLAG.get())            # the config file, with --api outranking it
+source = PRODUCT.token_source(resolved)            # NotLoggedIn where nothing is stored
+response = httpx2.get(
+    f'{resolved.api.value}/items',
+    headers={'Authorization': f'Bearer {source.token().access_token}'},  # refreshed first if it lapsed
+)
+```
+
+The first run needs three things from outside the CLI:
+
+- The provider advertises a `device_authorization_endpoint` in its OIDC
+  discovery document.
+- The client id is registered at the provider as a public client with no
+  secret.
+- The API serves RFC 9728 protected-resource metadata naming its login server.
+  A `config.toml` that already sets `issuer` skips this.
+
+Every error is a `LoginError` whose message names its fix, so a CLI's entry
+point catches that one class and prints the message.
+
+## Which call answers which question
+
+| Ask | Call | Reads |
+| --- | --- | --- |
+| Where is this CLI pointed | `Product.load`, `write_deployment` | the config file, and an `--api`'s RFC 9728 metadata where it differs from the file's |
+| What does a first login fill in | `Product.for_login` | the config file, then the API's RFC 9728 metadata for a missing `issuer` |
+| How does a person log in | `Provider.login` | the issuer's discovery document, then the device grant |
+| Where did the token go | `TokenStore.save`, `TokenStore.load` | the OS keychain, then the mode-600 file in the state directory |
+| How do requests get a token | `Product.token_source` | the store, then on a refresh the refresh lock and the discovery document |
+| How does a service with no person authenticate | `ServiceTokenSource` | the token endpoint, with the client's secret |
+| How does a CLI use tokens a broker hands it | `CommandTokenSource` | the stdout of `token_command` from the config file |
+| How do my tests avoid the real keychain | `pyclilogin.testing.MemoryKeyring` | a dict |
+
+## One config file says where the CLI is pointed, and only login writes it
+
+`$XDG_CONFIG_HOME/<name>/config.toml` holds three keys:
+
+```toml
+api = "https://acme.example.com"
+issuer = "https://auth.example.com"
+client_id = "acme-cli-laptop"
+```
+
+Every command reads it through `Product.load`. An explicit `--api` outranks the
+file's. Nothing else is read: no environment variable, and no address compiled
+into the package, because each value names one installation.
+
+`acme auth login https://acme.example.com` fills in only what the file lacks.
+`api` comes from the URL, `issuer` from the API's
+`/.well-known/oauth-protected-resource`, and `client_id` from `--client-id` or
+`acme-cli-<short hostname>`. Each is printed with where it came from before the
+grant starts, and written once the grant succeeds. A value the file already
+holds is never rewritten, and a typed value differing from it is refused.
+
+An `--api` differing from the file's must name the file's issuer in its own
+metadata. Otherwise the command is refused before any request carries a token.
+
+Login never writes through a symlink. A link means a config manager owns the
+file, and its source may be every machine's. A client id written there would
+become every machine's.
+
+A key outside these three belongs to the product, as in goclilogin. A product
+whose file holds nothing else passes `product_keys=frozenset()`, and a renamed
+key such as `api_base` is then refused rather than read as a file with no
+`api`.
+
+## The refresh is serialized across every process on the machine
+
+A provider following RFC 9700 rotates the refresh token on every use, and
+revokes the whole grant when a consumed one is presented again. Two processes
+refreshing from the same stored token therefore cost an interactive login.
+One rotates, and the other replays the token that rotation consumed.
+
+`TokenSource.token` holds an exclusive `flock` in the state directory for the
+refresh, and reads the store again once it has the lock. A process that waited
+uses the winner's token instead of replaying its own. A lock that cannot be
+taken within ten seconds gives an unlocked refresh. That risks one login, where
+blocking on a wedged holder would hang every command.
+
+A command holding a live token makes no call to the provider at all.
+
+## The token goes to the keychain, and the downgrade is visible
+
+`TokenStore.save` returns the backend that took the token. On a Linux host with
+no Secret Service, that is a mode-600 `token.json` in the state directory, and
+`auth login` says so. A macOS keychain locked to an SSH session is refused
+instead, with `security unlock-keychain` as the fix. A plaintext copy written
+there would outlive the lock. `TokenStore.delete` clears both stores, so a file
+token written before a host had a keyring cannot outlive the logout.
+
+## A service authenticates as itself, never as a person
+
+With `ACME_CLIENT_SECRET` set, `Product.token_source` authenticates as the
+config file's `client_id` with the client-credentials grant. The variable is
+`<NAME>_CLIENT_SECRET` unless `Product.secret_variable` names another. The
+secret stays in the environment, because `auth status` prints the file.
+
+```python
+source = PRODUCT.token_source(resolved, service_scopes=('acme.items.read',))
+```
+
+A service's token carries only the scopes its command names, so a command
+naming none is refused before any request. Nothing is stored and no lock is
+taken: the grant issues no refresh token. Name the service's client so the API
+can tell it from a person's, such as `acme-svc-scheduler`.
+
+## A broker's token command replaces the login
+
+A workload whose broker hands it short-lived tokens names the broker's command
+in the file:
+
+```toml
+api = "https://acme.example.com"
+token_command = ["broker", "token", "--audience", "acme"]
+```
+
+The command prints an RFC 6749 § 5.1 token response. Every request carries its
+`access_token`, and the command runs again once `expires_in` lapses.
+
+## Linux and macOS
+
+The refresh lock is `fcntl.flock`, so the package runs on Linux and macOS.
+Releases are cut only from a commit whose suite passes on both, on Python 3.11
+and 3.13.
+
+## What it deliberately does not do
+
+It is not a general OIDC client. It has no ID token verification, no
+back-channel logout, no DPoP and no mTLS-bound tokens. An API that verifies
+tokens against the provider's JWKS, as pyapiauth does, needs none of them.

pyclilogin-0.1.1/pyproject.toml

@@ -0,0 +1,218 @@
+[project]
+name = "pyclilogin"
+dynamic = ["version"]
+description = "Device-grant login for Python CLIs: one config file, a keychain token store with a visible fallback, and a refresh serialized across processes"
+authors = [{ name = "Chris Birch", email = "datapointchris@gmail.com" }]
+license = "MIT"
+license-files = ["LICENSE"]
+readme = "README.md"
+keywords = ["oauth2", "oidc", "device-authorization-grant", "cli", "keyring", "login"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Operating System :: MacOS",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3 :: Only",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries",
+    "Typing :: Typed",
+]
+
+# 3.11 is what `tomllib` and `enum.StrEnum` require, and every dependency
+# supports it. Raising the floor excludes callers.
+requires-python = ">=3.11"
+
+# Each one is on the credential path, so each earns its place: httpx2 for the
+# five requests the login makes, and keyring for the OS keychain, the Python
+# counterpart of the go-keyring goclilogin uses.
+dependencies = [
+    "httpx2>=2.9.1",
+    "keyring>=25",
+]
+
+[project.optional-dependencies]
+typer = ["typer>=0.15.0"]
+
+[project.urls]
+Repository = "https://github.com/datapointchris/pyclilogin"
+Issues = "https://github.com/datapointchris/pyclilogin/issues"
+Changelog = "https://github.com/datapointchris/pyclilogin/releases"
+
+[dependency-groups]
+dev = [
+    "bandit>=1.7.8",
+    "mypy>=1.10.0",
+    "pre-commit>=4.3.0",
+    "pytest>=8.0.0",
+    "ruff==0.17.1",
+    "typer>=0.15.0",
+]
+
+
+# ---------- Tool Configurations ---------- #
+
+
+[tool.bandit]
+exclude_dirs = [".git", ".mypy_cache", ".pytest_cache", ".ruff_cache", ".venv", "tests"]
+skips = ["B404", "B603"]
+
+
+[tool.codespell]
+skip = '*.lock'
+check-filenames = true
+check-hidden = true
+builtin = "clear,rare"
+uri-ignore-words-list = "*"
+
+
+[tool.mypy]
+pretty = true
+ignore_missing_imports = true
+check_untyped_defs = false
+warn_return_any = false
+
+[tool.pytest.ini_options]
+minversion = "8.0"
+testpaths = ["tests"]
+verbosity_assertions = 2
+
+
+[tool.refurb]
+enable_all = true
+
+
+[tool.ruff]
+line-length = 140
+exclude = [
+    ".git",
+    "__pycache__",
+    ".mypy_cache",
+    ".ruff_cache",
+    ".vscode",
+    ".venv",
+    "build",
+    "dist",
+]
+extend-exclude = ["*.md"]
+
+[tool.ruff.format]
+quote-style = "single"
+indent-style = "space"
+skip-magic-trailing-comma = false
+line-ending = "auto"
+docstring-code-format = true
+
+[tool.ruff.lint]
+select = [
+    "E",    # pycodestyle errors
+    "F",    # pyflakes
+    "UP",   # pyupgrade
+    "B",    # flake8-bugbear
+    "SIM",  # flake8-simplify
+    "I",    # isort
+    "ICN",  # flake8-import-conventions
+    # flake8-bandit by rule, never as the family. Most of what the family
+    # reports is a subprocess call made on purpose, and silencing that takes an
+    # ignore list that grows with every project.
+    "S102",  # exec
+    "S113",  # an HTTP request with no timeout, which can hang forever
+    "S301",  # pickle, which runs code from the bytes it loads
+    "S307",  # eval
+    "S324",  # md5 or sha1 used for security
+    "S501",  # TLS certificate verification turned off
+]
+ignore = [
+    "SIM108",  # ternary operator — often less readable
+]
+
+[tool.ruff.lint.isort]
+force-single-line = true
+
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["F401"]
+
+[tool.ruff.lint.flake8-import-conventions]
+banned-from = ["datetime", "pyspark.sql.functions", "pyspark.sql.types"]
+
+[tool.ruff.lint.flake8-import-conventions.extend-aliases]
+datetime = "dt"
+sqlalchemy = "sa"
+"pyspark.sql.functions" = "sf"
+"pyspark.sql.types" = "st"
+dataclasses = "dc"
+
+[tool.semantic_release]
+# A feature release on 0.x stays on 0.x. python-semantic-release v10 defaults
+# this to false, which makes the next release of a 0.x project 1.0.0.
+allow_zero_version = true
+# 1.0 is a compatibility promise, so a breaking change on 0.x is a minor bump.
+# Removing this key is how the project reaches 1.0.
+major_on_zero = false
+
+
+# ---------- Build System ---------- #
+
+
+[tool.pyright]
+typeCheckingMode = "standard"
+analyzeUnannotatedFunctions = true  # or pylance stops analyzing in vscode
+
+[tool.hatch.version]
+source = "uv-dynamic-versioning"
+
+[tool.uv-dynamic-versioning]
+style = "semver"
+
+# A new commit or tag changes the version, so it has to invalidate uv's cache.
+[tool.uv]
+cache-keys = [{ file = "pyproject.toml" }, { git = { commit = true, tags = true } }]
+
+# The published sdist holds the package and its metadata, and none of the
+# repo's tooling or tests. hatchling's default takes the whole tree.
+[tool.hatch.build.targets.sdist]
+only-include = ["src"]
+
+[tool.forge]
+# Keys the shared toolchain standard owns, written by its generator.
+# Dropping one from the template removes it here on the next sync; a key absent
+# from this list belongs to the project and is never touched. Do not hand-edit.
+managed = [
+    ["ruff", "line-length"],
+    ["ruff", "extend-exclude"],
+    ["ruff", "format", "quote-style"],
+    ["ruff", "format", "indent-style"],
+    ["ruff", "format", "skip-magic-trailing-comma"],
+    ["ruff", "format", "line-ending"],
+    ["ruff", "format", "docstring-code-format"],
+    ["ruff", "lint", "select"],
+    ["ruff", "lint", "ignore"],
+    ["ruff", "lint", "isort", "force-single-line"],
+    ["ruff", "lint", "flake8-import-conventions", "banned-from"],
+    ["ruff", "lint", "flake8-import-conventions", "extend-aliases", "datetime"],
+    ["ruff", "lint", "flake8-import-conventions", "extend-aliases", "dataclasses"],
+    ["ruff", "lint", "flake8-import-conventions", "extend-aliases", "sqlalchemy"],
+    ["ruff", "lint", "flake8-import-conventions", "extend-aliases", "pyspark.sql.functions"],
+    ["ruff", "lint", "flake8-import-conventions", "extend-aliases", "pyspark.sql.types"],
+    ["ruff", "lint", "per-file-ignores", "__init__.py"],
+    ["mypy", "pretty"],
+    ["mypy", "ignore_missing_imports"],
+    ["mypy", "check_untyped_defs"],
+    ["mypy", "warn_return_any"],
+    ["pyright", "typeCheckingMode"],
+    ["pyright", "analyzeUnannotatedFunctions"],
+    ["codespell", "check-filenames"],
+    ["codespell", "check-hidden"],
+    ["codespell", "builtin"],
+    ["codespell", "uri-ignore-words-list"],
+    ["pytest", "ini_options", "verbosity_assertions"],
+    ["pytest", "ini_options", "minversion"],
+    ["pytest", "ini_options", "testpaths"],
+]
+# Dependencies held at the version the pre-commit hook runs, in every group
+# and extra that names them, so a local run and CI cannot disagree.
+pinned = ["ruff"]
+
+[build-system]
+requires = ["hatchling", "uv-dynamic-versioning"]
+build-backend = "hatchling.build"