rsconnect-python 1.31.0__tar.gz → 1.32.0__tar.gz

{rsconnect_python-1.31.0 → rsconnect_python-1.32.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: rsconnect_python
-Version: 1.31.0
+Version: 1.32.0
 Summary: The Posit Connect command-line interface.
 Author: Posit, PBC
 Author-email: Posit, PBC <rsconnect@posit.co>
@@ -29,7 +29,8 @@ Requires-Dist: typing-extensions>=4.8.0
 Requires-Dist: pip>=10.0.0
 Requires-Dist: uv>=0.9.0
 Requires-Dist: semver>=2.0.0,<4.0.0
-Requires-Dist: pyjwt>=2.4.0
+Requires-Dist: pyjwt>=2.4.0 ; python_full_version < '3.9'
+Requires-Dist: pyjwt>=2.15.0 ; python_full_version >= '3.9'
 Requires-Dist: click>=8.0.0
 Requires-Dist: packaging>=20.0
 Requires-Dist: toml>=0.10 ; python_full_version < '3.11'

{rsconnect_python-1.31.0 → rsconnect_python-1.32.0}/pyproject.toml

@@ -2,13 +2,14 @@
 name = "rsconnect_python"
 description = "The Posit Connect command-line interface."
 requires-python = ">=3.8"
-version = "1.31.0"
+version = "1.32.0"
 dependencies = [
     "typing-extensions>=4.8.0",
     "pip>=10.0.0",
     "uv>=0.9.0",
     "semver>=2.0.0,<4.0.0",
-    "pyjwt>=2.4.0",
+    "pyjwt>=2.4.0; python_version < '3.9'",
+    "pyjwt>=2.15.0; python_version >= '3.9'",
     "click>=8.0.0",
     "packaging>=20.0",
     "toml>=0.10; python_version < '3.11'",

{rsconnect_python-1.31.0 → rsconnect_python-1.32.0}/pyproject.toml.orig

@@ -2,8 +2,8 @@
 name = "rsconnect_python"
 description = "The Posit Connect command-line interface."
 requires-python = ">=3.8"
-version = "1.31.0"
-dependencies = [ "typing-extensions>=4.8.0", "pip>=10.0.0", "uv>=0.9.0", "semver>=2.0.0,<4.0.0", "pyjwt>=2.4.0", "click>=8.0.0", "packaging>=20.0", "toml>=0.10; python_version < '3.11'",]
+version = "1.32.0"
+dependencies = [ "typing-extensions>=4.8.0", "pip>=10.0.0", "uv>=0.9.0", "semver>=2.0.0,<4.0.0", "pyjwt>=2.4.0; python_version < '3.9'", "pyjwt>=2.15.0; python_version >= '3.9'", "click>=8.0.0", "packaging>=20.0", "toml>=0.10; python_version < '3.11'",]
 [[project.authors]]
 name = "Posit, PBC"
 email = "rsconnect@posit.co"

{rsconnect_python-1.31.0 → rsconnect_python-1.32.0}/rsconnect/api.py

@@ -167,7 +167,8 @@ class AbstractRemoteServer:
             safe_uri = _redacted_uri_for_log(response.full_uri)
             if response.exception:
                 raise RSConnectException(
-                    "Could not connect to %s - %s" % (_redacted_uri_for_log(self.url), response.exception),
+                    "Could not connect to %s (%s)"
+                    % (_redacted_uri_for_log(self.url), type(response.exception).__name__),
                     cause=response.exception,
                 )
             # Sometimes an ISP will respond to an unknown server name by returning a friendly
@@ -188,12 +189,11 @@ class AbstractRemoteServer:
                     raise RSConnectException(error, status=response.status)
                 if response.status is None or response.status < 200 or response.status > 299:
                     raise RSConnectException(
-                        "Received an unexpected response from %s (calling %s): %s %s"
+                        "Received an unexpected response from %s (calling %s): %s"
                         % (
                             self.remote_name,
                             safe_uri,
                             response.status,
-                            response.reason,
                         ),
                         status=response.status,
                     )
@@ -203,12 +203,11 @@ class AbstractRemoteServer:
                     # prior function call was not converted from a HTTPResponse to JSON. This
                     # should never happen, so raise an exception.
                     raise RSConnectException(
-                        "Received an unexpected response from %s (calling %s): %s %s"
+                        "Received an unexpected response from %s (calling %s): %s"
                         % (
                             self.remote_name,
                             safe_uri,
                             response.status,
-                            response.reason,
                         )
                     )
         return response
@@ -259,6 +258,7 @@ class ConnectCloudServer(AbstractRemoteServer):
         url: Optional[str] = None,
         server_name: Optional[str] = None,
         account_id: Optional[str] = None,
+        oauth_client_id: Optional[str] = None,
     ):
         # Accepts the bare "connect.posit.cloud" a user types for --server, the
         # same way ShinyappsServer accepts "shinyapps.io".
@@ -267,6 +267,9 @@ class ConnectCloudServer(AbstractRemoteServer):
         # The account's id, when it is known without asking the server. Only valid
         # for account_name: the two must be set together.
         self.account_id = account_id
+        # An in-progress device login keeps the public OAuth client it started
+        # with, even if CONNECT_CLOUD_OAUTH_CLIENT_ID changes before it finishes.
+        self.oauth_client_id = oauth_client_id
         self.access_token = access_token
         self.refresh_token = refresh_token
         # Retained so a new access token can be minted non-interactively when
@@ -396,6 +399,7 @@ class SPCSConnectServer(AbstractRemoteServer):
     def exchange_token(self) -> str:
         try:
             server = HTTPServer(url=self.token_endpoint())
+            server._suppress_oauth_response_logging = True
             payload = self.fmt_payload()
 
             response = server.request(
@@ -408,17 +412,17 @@ class SPCSConnectServer(AbstractRemoteServer):
             # since we don't want to pick up its json decoding assumptions
             if response.exception is not None:
                 raise RSConnectException(
-                    "Could not connect to %s - %s" % (self.token_endpoint(), response.exception),
+                    "Could not connect to %s (%s)"
+                    % (_redacted_uri_for_log(self.token_endpoint()), type(response.exception).__name__),
                     cause=response.exception,
                 )
             if response.status is None or response.status < 200 or response.status > 299:
                 raise RSConnectException(
-                    "Received an unexpected response from %s (calling %s): %s %s"
+                    "Received an unexpected response from %s (calling %s): %s"
                     % (
                         self.url,
-                        response.full_uri,
+                        _redacted_uri_for_log(response.full_uri),
                         response.status,
-                        response.reason,
                     )
                 )
 
@@ -594,10 +598,12 @@ class RSConnectClient(BearerTokenHTTPServer):
                     store._set(entry_name, entry)  # type: ignore[possibly-undefined]
                 logger.warning("OAuth client was re-registered; please run `rsconnect login` again.")
             except Exception as exc:
-                logger.warning(f"OAuth client re-registration failed: {exc}. Please run `rsconnect login` again.")
+                logger.warning(
+                    "OAuth client re-registration failed (%s). Please run `rsconnect login` again." % type(exc).__name__
+                )
             return False
         except Exception as exc:
-            logger.warning(f"OAuth token refresh failed: {exc}")
+            logger.warning("OAuth token refresh failed (%s)." % type(exc).__name__)
             return False
 
         new_access = token_response["access_token"]
@@ -668,6 +674,11 @@ class RSConnectClient(BearerTokenHTTPServer):
         response = self._server.handle_bad_response(response)
         return response
 
+    def nodejs_settings(self) -> dict[str, Any]:
+        """Return Node.js availability and publishability information."""
+        response = self.get("v1/server_settings/nodejs")
+        return cast(typing.Dict[str, Any], self._server.handle_bad_response(response))
+
     def app_get(self, app_id: str) -> ContentItemV0:
         response = cast(Union[ContentItemV0, HTTPResponse], self.get(f"applications/{app_id}"))
         response = self._server.handle_bad_response(response)
@@ -1375,6 +1386,7 @@ class RSConnectExecutor:
         polling: bool = True,
         quarto_inputs: Optional[List[str]] = None,
         infer_target: Optional[bool] = None,
+        app_store: Optional[AppStore] = None,
     ) -> None:
         self.remote_server: TargetableServer
         self.client: RSConnectClient | PositClient | ConnectCloudClient
@@ -1398,7 +1410,9 @@ class RSConnectExecutor:
         # None outside the Quarto deploy commands.
         self.quarto_inputs = quarto_inputs
         self.app_mode: AppMode | None = None
-        self.app_store: AppStore = AppStore(fake_module_file_from_directory(self.path))
+        self.app_store: AppStore = (
+            app_store if app_store is not None else AppStore(fake_module_file_from_directory(self.path))
+        )
         self.app_store_version: int | None = None
         self.api_key_is_required: bool | None = None
         # `deploy manifest` / `deploy bundle` pre-resolve `title` to a
@@ -2165,16 +2179,15 @@ for shinyapps.io. See command help for further details."
             )
             upload_result = S3Server(upload_url).handle_bad_response(upload_result, is_httpresponse=True)
 
-    def primary_file_for_connect_cloud(self) -> str:
-        """The entrypoint to report to Connect Cloud, read from the built bundle.
+    def bundle_manifest(self) -> dict[str, Any]:
+        """The manifest of the built bundle.
 
-        Connect Cloud needs a `primary_file` and uses it to decide, for example,
-        whether Shiny content is R or Python. Every deploy path writes the
-        entrypoint into the bundle's manifest, so reading it back from there
-        avoids having to thread it separately through each command.
+        Every deploy path writes what Connect Cloud needs into the bundle's
+        manifest, so reading it back from there avoids having to thread the same
+        values separately through each command.
         """
         if self.bundle is None:
-            raise RSConnectException("A bundle must be created before determining the primary file.")
+            raise RSConnectException("A bundle must be created before reading its manifest.")
 
         position = self.bundle.tell()
         try:
@@ -2186,12 +2199,34 @@ for shinyapps.io. See command help for further details."
                 extracted = tar.extractfile(member) if member is not None else None
                 if extracted is None:
                     raise RSConnectException("The bundle does not contain a manifest.json.")
-                manifest = json.loads(extracted.read().decode("utf-8"))
+                return cast("dict[str, Any]", json.loads(extracted.read().decode("utf-8")))
         except (tarfile.TarError, KeyError, ValueError) as exc:
             raise RSConnectException("Could not read the bundle manifest: %s" % exc) from exc
         finally:
             self.bundle.seek(position)
 
+    def python_version_for_connect_cloud(self) -> Optional[str]:
+        """The MAJOR.MINOR Python version to ask Connect Cloud for, or None.
+
+        None means the request omits the field: a redeploy keeps the version already
+        set on the content, and a first deploy takes Connect Cloud's default. Content
+        with no Python at all lands here too.
+        """
+        manifest = self.bundle_manifest()
+        environment: dict[str, Any] = manifest.get("environment") or {}
+        requirement: dict[str, Any] = environment.get("python") or {}
+        interpreter: dict[str, Any] = manifest.get("python") or {}
+        requires: Optional[str] = requirement.get("requires")
+        local_version: Optional[str] = interpreter.get("version")
+        return connect_cloud.resolve_python_version(requires, local_version)
+
+    def primary_file_for_connect_cloud(self) -> str:
+        """The entrypoint to report to Connect Cloud, read from the built bundle.
+
+        Connect Cloud needs a `primary_file` and uses it to decide, for example,
+        whether Shiny content is R or Python.
+        """
+        manifest = self.bundle_manifest()
         metadata = manifest.get("metadata") or {}
         primary_file = metadata.get("entrypoint") or metadata.get("primary_rmd") or metadata.get("primary_html")
         files = manifest.get("files") or {}
@@ -2302,6 +2337,7 @@ for shinyapps.io. See command help for further details."
                     title=self.title,
                     app_mode=self.app_mode,
                     primary_file=self.primary_file_for_connect_cloud(),
+                    python_version=self.python_version_for_connect_cloud(),
                     env_vars=self.env_vars,
                     update_title=not self.title_is_default,
                     app_id_is_explicit=self.app_id_is_explicit,
@@ -3293,6 +3329,7 @@ class ConnectCloudAccountSearchResults(TypedDict):
 class ConnectCloudRevision(TypedDict):
     id: str
     content_id: NotRequired[str]
+    python_version: NotRequired[Optional[str]]
     status: NotRequired[str]
     source_bundle_upload_url: NotRequired[str]
     publish_result: NotRequired[Optional[str]]
@@ -3366,6 +3403,20 @@ class ConnectCloudClient(BearerTokenHTTPServer):
         server = self._server
         return bool(server.refresh_token or (server.client_id and server.client_secret))
 
+    def _refresh_user_token(self) -> dict[str, Any]:
+        request_options: dict[str, Any] = {}
+        if self.request_deadline is not None:
+            remaining = self.request_deadline - time.monotonic()
+            if remaining <= 0:
+                raise RSConnectException("Device login finish deadline exceeded.")
+            request_options["request_timeout"] = min(self.request_timeout or remaining, remaining)
+            request_options["request_deadline"] = self.request_deadline
+        if self._server.oauth_client_id is not None:
+            request_options["client_id_override"] = self._server.oauth_client_id
+        if self._suppress_oauth_response_logging:
+            request_options["suppress_response_logging"] = True
+        return connect_cloud.refresh(cast(str, self._server.refresh_token), self._server.environment, **request_options)
+
     def _attempt_token_refresh(self) -> bool:
         """Mint a new access token and apply it to this client.
 
@@ -3387,13 +3438,13 @@ class ConnectCloudClient(BearerTokenHTTPServer):
                     server.client_id, server.client_secret, server.environment
                 )
             elif server.refresh_token:
-                tokens = connect_cloud.refresh(server.refresh_token, server.environment)
+                tokens = self._refresh_user_token()
             else:
                 return False
         except InvalidClientError as exc:
             if not service_account:
                 # This CLI's own OAuth client, not the user's credential.
-                logger.warning("Posit Connect Cloud token refresh failed: %s" % exc)
+                logger.warning("Posit Connect Cloud token refresh failed (%s)." % type(exc).__name__)
                 return False
             raise RSConnectException(
                 "The Posit Connect Cloud service account credential was rejected — it has been revoked or "
@@ -3402,7 +3453,7 @@ class ConnectCloudClient(BearerTokenHTTPServer):
             ) from exc
         except InvalidGrantError as exc:
             if service_account:
-                logger.warning("Posit Connect Cloud token refresh failed: %s" % exc)
+                logger.warning("Posit Connect Cloud token refresh failed (%s)." % type(exc).__name__)
                 return False
             self._persist_tokens(None, None)
             raise RSConnectException(
@@ -3410,7 +3461,7 @@ class ConnectCloudClient(BearerTokenHTTPServer):
                 "Authenticate again with `%s`." % self._add_command()
             ) from exc
         except RSConnectException as exc:
-            logger.warning("Posit Connect Cloud token refresh failed: %s" % exc)
+            logger.warning("Posit Connect Cloud token refresh failed (%s)." % type(exc).__name__)
             return False
 
         access_token = tokens.get("access_token")
@@ -3648,21 +3699,29 @@ class ConnectCloudClient(BearerTokenHTTPServer):
         primary_file: str,
         secrets: Optional[list[dict[str, str]]] = None,
         access: Optional[str] = None,
+        python_version: Optional[str] = None,
     ) -> ConnectCloudContent:
         """Create content to upload a bundle into.
 
         `access` is the content's visibility ("public" or "private"). Omitted from
         the request when None so the server picks its own default.
+
+        `python_version` is MAJOR.MINOR. Omitted when None, which is how content
+        with no Python is created; Connect Cloud then falls back to its own
+        default rather than reading the version out of the bundle's manifest.
         """
+        next_revision: dict[str, Any] = {
+            "source_type": "bundle",
+            "content_type": content_type,
+            "app_mode": app_mode,
+            "primary_file": primary_file,
+        }
+        if python_version is not None:
+            next_revision["python_version"] = python_version
         body: dict[str, Any] = {
             "account_id": account_id,
             "title": title,
-            "next_revision": {
-                "source_type": "bundle",
-                "content_type": content_type,
-                "app_mode": app_mode,
-                "primary_file": primary_file,
-            },
+            "next_revision": next_revision,
             "secrets": secrets or [],
         }
         if access is not None:
@@ -3680,6 +3739,7 @@ class ConnectCloudClient(BearerTokenHTTPServer):
         new_bundle: bool = True,
         title: Optional[str] = None,
         access: Optional[str] = None,
+        python_version: Optional[str] = None,
     ) -> ConnectCloudContent:
         """Update content, optionally minting a fresh revision to upload into.
 
@@ -3693,14 +3753,19 @@ class ConnectCloudClient(BearerTokenHTTPServer):
         deploy without -E/-t must leave the existing values alone. `access` (the
         content's visibility) is omitted the same way, so a redeploy without
         -V keeps whatever visibility the content already has.
+
+        `python_version` is omitted when None for the same reason: a redeploy of
+        content whose bundle carries no Python version keeps the version already
+        set on the content, including one chosen in the Connect Cloud UI.
         """
-        body: dict[str, Any] = {
-            "revision_overrides": {
-                "primary_file": primary_file,
-                "app_mode": app_mode,
-                "content_type": content_type,
-            },
+        revision_overrides: dict[str, Any] = {
+            "primary_file": primary_file,
+            "app_mode": app_mode,
+            "content_type": content_type,
         }
+        if python_version is not None:
+            revision_overrides["python_version"] = python_version
+        body: dict[str, Any] = {"revision_overrides": revision_overrides}
         if secrets is not None:
             body["secrets"] = secrets
         if title is not None:
@@ -3895,6 +3960,7 @@ class ConnectCloudService:
         update_title: bool = False,
         app_id_is_explicit: bool = False,
         visibility: Optional[str] = None,
+        python_version: Optional[str] = None,
     ) -> ConnectCloudDeployResult:
         """Create or fetch the content item and get a revision to upload into.
 
@@ -3961,6 +4027,7 @@ class ConnectCloudService:
                 content_type=content_type,
                 app_mode=app_mode.name(),
                 primary_file=primary_file,
+                python_version=python_version,
                 secrets=secrets,
                 access=visibility,
             )
@@ -3975,6 +4042,7 @@ class ConnectCloudService:
                 primary_file=primary_file,
                 app_mode=app_mode.name(),
                 content_type=content_type,
+                python_version=python_version,
                 secrets=secrets,
                 new_bundle=upload,
                 title=title if update_title and title else None,

{rsconnect_python-1.31.0 → rsconnect_python-1.32.0}/rsconnect/bundle.py

@@ -42,6 +42,8 @@ from typing import (
     cast,
 )
 
+from . import metadata
+
 # Even though TypedDict is available in Python 3.8, because it's used with NotRequired,
 # they should both come from the same typing module.
 # https://peps.python.org/pep-0655/#usage-in-python-3-11
@@ -79,10 +81,53 @@ directories_ignore_list = [
     "node_modules/",
 ]
 directories_to_ignore = {Path(d) for d in directories_ignore_list}
+_config_dir_names = {".rsconnect-python"}
 
 mimetypes.add_type("text/ipynb", ".ipynb")
 
 
+def _resolved_config_dir() -> Path:
+    return Path(metadata.config_dirname()).expanduser().resolve()
+
+
+def _path_is_within(path: Path, directory: Path) -> bool:
+    return path == directory or directory in path.parents
+
+
+def _is_config_path(
+    path: str | Path,
+    base_dir: str | Path | None = None,
+    config_dir: Path | None = None,
+) -> bool:
+    candidate = Path(path)
+    if base_dir is not None and not candidate.is_absolute():
+        candidate = Path(base_dir) / candidate
+    if _config_dir_names.intersection(candidate.parts):
+        return True
+    if config_dir is None:
+        if base_dir is None and not candidate.is_absolute():
+            return False
+        config_dir = _resolved_config_dir()
+    resolved = candidate.resolve()
+    return bool(_config_dir_names.intersection(resolved.parts)) or _path_is_within(resolved, config_dir)
+
+
+def _ensure_content_root_is_safe(path: str | Path, config_dir: Path) -> None:
+    content_root = Path(path)
+    if content_root.is_file():
+        content_root = content_root.parent
+    if _is_config_path(content_root, config_dir=config_dir):
+        raise RSConnectException(
+            f"Cannot bundle content from '{content_root.resolve()}' because it is inside the "
+            f"rsconnect-python configuration directory '{config_dir}' or a reserved '.rsconnect-python' directory. "
+            "Choose a content directory outside the configuration directory."
+        )
+
+
+def _filter_config_paths(paths: Sequence[str], base_dir: str | Path, config_dir: Path) -> list[str]:
+    return [path for path in paths if not _is_config_path(path, base_dir, config_dir)]
+
+
 class ManifestDataFile(TypedDict):
     checksum: str
 
@@ -565,10 +610,9 @@ def write_manifest(
     if environment.source == "file":
         skipped.append(environment_relative_path)
     else:
-        with open(environment_file, "w") as f:
-            f.write(environment.contents)
-            created.append(environment_relative_path)
-            logger.debug("wrote environment file: %s", environment_file)
+        write_environment_file(environment, output_dir)
+        created.append(environment_relative_path)
+        logger.debug("wrote environment file: %s", environment_file)
 
     return created, skipped
 
@@ -624,6 +668,11 @@ def make_notebook_source_bundle(
         extra_files = []
     base_dir = dirname(file)
     nb_name = basename(file)
+    config_dir = _resolved_config_dir()
+    _ensure_content_root_is_safe(base_dir, config_dir)
+    if _is_config_path(file, config_dir=config_dir):
+        raise RSConnectException("A credential configuration file cannot be bundled as notebook content.")
+    extra_files = _filter_config_paths(extra_files, base_dir, config_dir)
 
     manifest = make_source_manifest(
         AppModes.JUPYTER_NOTEBOOK,
@@ -741,6 +790,11 @@ def make_notebook_html_bundle(
     hide_tagged_input: bool,
     check_output: Callable[..., bytes] = subprocess.check_output,
 ) -> typing.IO[bytes]:
+    config_dir = _resolved_config_dir()
+    _ensure_content_root_is_safe(dirname(filename), config_dir)
+    if _is_config_path(filename, config_dir=config_dir):
+        raise RSConnectException("A credential configuration file cannot be bundled as notebook content.")
+
     # noinspection SpellCheckingInspection
     cmd = [
         python,
@@ -781,7 +835,12 @@ def make_notebook_html_bundle(
     return bundle_file
 
 
-def keep_manifest_specified_file(relative_path: str, ignore_path_set: set[Path] = directories_to_ignore) -> bool:
+def keep_manifest_specified_file(
+    relative_path: str,
+    ignore_path_set: set[Path] = directories_to_ignore,
+    base_dir: str | Path | None = None,
+    config_dir: Path | None = None,
+) -> bool:
     """
     A helper to see if the relative path given, which is assumed to have come
     from a manifest.json file, should be kept or ignored.
@@ -789,6 +848,8 @@ def keep_manifest_specified_file(relative_path: str, ignore_path_set: set[Path]
     :param relative_path: the relative path name to check.
     :return: True, if the path should kept or False, if it should be ignored.
     """
+    if _is_config_path(relative_path, base_dir, config_dir):
+        return False
     p = Path(relative_path)
     for parent in p.parents:
         if parent in ignore_path_set:
@@ -951,7 +1012,16 @@ def make_manifest_bundle(manifest_path: str | Path) -> typing.IO[bytes]:
     manifest, raw_manifest = read_manifest_file(manifest_path)
 
     base_dir = dirname(manifest_path)
-    files = list(filter(keep_manifest_specified_file, manifest.get("files", {}).keys()))
+    config_dir = _resolved_config_dir()
+    _ensure_content_root_is_safe(base_dir, config_dir)
+    manifest_files = manifest.get("files", {})
+    config_files = {path for path in manifest_files if _is_config_path(path, base_dir, config_dir)}
+    files = [
+        path for path in manifest_files if keep_manifest_specified_file(path, base_dir=base_dir, config_dir=config_dir)
+    ]
+    if config_files:
+        manifest["files"] = {path: value for path, value in manifest_files.items() if path not in config_files}
+        raw_manifest = json.dumps(manifest, indent=2)
 
     if "manifest.json" in files:
         # this will be created
@@ -1231,6 +1301,48 @@ def make_tensorflow_bundle(
     return bundle.to_file(directory)
 
 
+def _should_skip_walk_directory(
+    cur_dir: str,
+    sub_dirs: list[str],
+    exclude_paths: set[Path],
+    config_dir: Path,
+) -> bool:
+    sub_dirs[:] = [
+        sub_dir for sub_dir in sub_dirs if not _is_config_path(join(cur_dir, sub_dir), config_dir=config_dir)
+    ]
+    current_dir = Path(cur_dir)
+    return current_dir in exclude_paths or any(parent in exclude_paths for parent in current_dir.parents)
+
+
+def _iter_directory_files(
+    path: str,
+    extra_files: Sequence[str],
+    excludes: Sequence[str],
+    use_abspath: bool,
+    config_dir: Path,
+) -> Iterator[str]:
+    glob_set = create_glob_set(path, excludes)
+    exclude_paths = {Path(p) for p in excludes}
+    for cur_dir, sub_dirs, files in os.walk(path):
+        if _should_skip_walk_directory(cur_dir, sub_dirs, exclude_paths, config_dir):
+            continue
+        for file in files:
+            cur_path = os.path.join(cur_dir, file)
+            rel_path = relpath(cur_path, path)
+            if Path(cur_path) in exclude_paths:
+                continue
+            if not keep_manifest_specified_file(
+                rel_path,
+                exclude_paths | directories_to_ignore,
+                base_dir=path,
+                config_dir=config_dir,
+            ):
+                continue
+            if rel_path not in extra_files and glob_set.matches(cur_path):
+                continue
+            yield abspath(cur_path) if use_abspath else rel_path
+
+
 def create_file_list(
     path: str,
     extra_files: Sequence[str],
@@ -1248,32 +1360,19 @@ def create_file_list(
     :return: the list of relevant files, relative to the given directory.
     """
     extra_files = extra_files or []
-    excludes = excludes if excludes else []
-    glob_set = create_glob_set(path, excludes)
-    exclude_paths = {Path(p) for p in excludes}
-    file_set: set[str] = set(extra_files)
+    excludes = excludes or []
+    config_dir = _resolved_config_dir()
+    content_root = Path(path).parent if isfile(path) else Path(path)
+    _ensure_content_root_is_safe(content_root, config_dir)
+    file_set: set[str] = set(_filter_config_paths(extra_files, content_root, config_dir))
 
     if isfile(path):
-        path_to_add = abspath(path) if use_abspath else path
-        file_set.add(path_to_add)
+        if not _is_config_path(path, config_dir=config_dir):
+            path_to_add = abspath(path) if use_abspath else path
+            file_set.add(path_to_add)
         return sorted(file_set)
 
-    for cur_dir, _, files in os.walk(path):
-        if Path(cur_dir) in exclude_paths:
-            continue
-        if any(parent in exclude_paths for parent in Path(cur_dir).parents):
-            continue
-        for file in files:
-            cur_path = os.path.join(cur_dir, file)
-            rel_path = relpath(cur_path, path)
-
-            if Path(cur_path) in exclude_paths:
-                continue
-            if keep_manifest_specified_file(rel_path, exclude_paths | directories_to_ignore) and (
-                rel_path in extra_files or not glob_set.matches(cur_path)
-            ):
-                path_to_add = abspath(cur_path) if use_abspath else rel_path
-                file_set.add(path_to_add)
+    file_set.update(_iter_directory_files(path, extra_files, excludes, use_abspath, config_dir))
 
     return sorted(file_set)
 
@@ -1713,7 +1812,11 @@ def make_quarto_manifest(
         # Standalone Quarto document
         base_dir = dirname(file_or_directory)
         file_name = basename(file_or_directory)
-        relevant_files = [file_name] + list(extra_files or [])
+        config_dir = _resolved_config_dir()
+        _ensure_content_root_is_safe(base_dir, config_dir)
+        if _is_config_path(file_or_directory, config_dir=config_dir):
+            raise RSConnectException("A credential configuration file cannot be bundled as Quarto content.")
+        relevant_files = [file_name] + _filter_config_paths(extra_files or [], base_dir, config_dir)
 
     manifest = make_source_manifest(
         app_mode,
@@ -2016,8 +2119,12 @@ def write_notebook_manifest_json(
     :return: whether or not the environment file (requirements.txt, environment.yml,
     etc.) that goes along with the manifest exists.
     """
-    extra_files = validate_extra_files(dirname(entry_point_file), extra_files)
     directory = dirname(entry_point_file)
+    config_dir = _resolved_config_dir()
+    _ensure_content_root_is_safe(directory, config_dir)
+    if _is_config_path(entry_point_file, config_dir=config_dir):
+        raise RSConnectException("A credential configuration file cannot be bundled as notebook content.")
+    extra_files = _filter_config_paths(validate_extra_files(directory, extra_files), directory, config_dir)
     file_name = basename(entry_point_file)
     manifest_path = join(directory, "manifest.json")
 
@@ -2365,8 +2472,10 @@ def write_environment_file(
     :param directory: the directory where the file should be written.
     """
     environment_file_path = join(directory, environment.filename)
-    with open(environment_file_path, "w") as f:
-        f.write(environment.contents)
+    # Write bytes so that the file matches the manifest checksum on all platforms.
+    # Text mode changes line endings and encoding on Windows.
+    with open(environment_file_path, "wb") as f:
+        f.write(to_bytes(environment.contents))
 
 
 def describe_manifest(