simple-module-cli 0.0.32__tar.gz → 0.0.34__tar.gz

{simple_module_cli-0.0.32 → simple_module_cli-0.0.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_cli
-Version: 0.0.32
+Version: 0.0.34
 Summary: Standalone scaffolder for the SimpleModule framework — `smpy new`, `smpy create-module`, plugin host.
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python

{simple_module_cli-0.0.32 → simple_module_cli-0.0.34}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_cli"
-version = "0.0.32"
+version = "0.0.34"
 description = "Standalone scaffolder for the SimpleModule framework — `smpy new`, `smpy create-module`, plugin host."
 readme = "README.md"
 license = "MIT"

{simple_module_cli-0.0.32 → simple_module_cli-0.0.34}/simple_module_cli/package_update.py

@@ -2,8 +2,14 @@
 
 Walks the project's ``pyproject.toml`` (and any ``[tool.uv.workspace]`` members),
 finds every dependency whose distribution name starts with ``simple_module_`` /
-``simple-module-``, queries PyPI for the latest non-yanked release, and rewrites
-the constraint to ``name>=<latest>``.
+``simple-module-``, queries PyPI for the latest non-yanked release, and points
+the constraint at it.
+
+The rewrite preserves the pin style you wrote: ``==0.0.32`` becomes
+``==0.0.33``, ``>=0.0.32`` becomes ``>=0.0.33``, and an upper bound that
+excludes the latest release skips the dependency instead of being dropped.
+``--loosen`` restores the older behaviour of rewriting every constraint to
+``name>=<latest>``.
 
 Dependencies whose ``[tool.uv.sources]`` entry points at a workspace member, a
 local path, a git ref, or a URL are left untouched — those aren't installed
@@ -12,11 +18,7 @@ from PyPI.
 
 from __future__ import annotations
 
-import json
 import re
-import urllib.error
-import urllib.request
-from collections.abc import Callable
 from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass
 from pathlib import Path
@@ -26,17 +28,12 @@ import tomlkit
 import typer
 from tomlkit.items import Array, Table
 
-__all__ = ["package_update", "run_update"]
+from simple_module_cli.pypi import Fetcher, default_fetcher, fetch_latest
+from simple_module_cli.requirements import parse_requirement, rewrite_requirement
 
-Fetcher = Callable[[str], dict[str, Any]]
+__all__ = ["package_update", "run_update"]
 
-_PYPI_URL = "https://pypi.org/pypi/{name}/json"
 _SM_PREFIX_RE = re.compile(r"^simple[_-]module[_-]", re.IGNORECASE)
-# PEP 440 release segments contain only digits + dots; any letter signals
-# a pre/post/dev release (a, b, rc, post, dev). Coarser than packaging.version
-# but `packaging` isn't a CLI dep (see test_no_framework_deps.py).
-_PRE_RELEASE_RE = re.compile(r"[a-zA-Z]")
-_REQ_OPS = ("===", "==", ">=", "<=", "!=", "~=", ">", "<")
 
 
 @dataclass(frozen=True)
@@ -60,14 +57,8 @@ def _is_sm_package(name: str) -> bool:
 
 def _dep_name(spec: str) -> str | None:
     """Extract the distribution name from a PEP 508 requirement string."""
-    base = spec.split(";", 1)[0].strip()
-    base = base.split("[", 1)[0]
-    for op in _REQ_OPS:
-        if op in base:
-            base = base.split(op, 1)[0]
-            break
-    name = base.strip()
-    return name or None
+    parsed = parse_requirement(spec)
+    return parsed.name if parsed else None
 
 
 def _is_local_source(source: Any) -> bool:
@@ -89,40 +80,6 @@ def _get_uv_section(doc: tomlkit.TOMLDocument, key: str) -> dict[str, Any] | Non
     return section if isinstance(section, dict) else None
 
 
-def _fetch_latest(name: str, *, include_pre: bool, fetcher: Fetcher) -> str | None:
-    try:
-        data = fetcher(_PYPI_URL.format(name=name))
-    except (urllib.error.HTTPError, urllib.error.URLError):
-        return None
-    releases = data.get("releases") or {}
-    candidates: list[str] = []
-    for version, files in releases.items():
-        if not files:
-            continue
-        if any(f.get("yanked") for f in files):
-            continue
-        if not include_pre and _PRE_RELEASE_RE.search(version):
-            continue
-        candidates.append(version)
-    if candidates:
-        return max(candidates, key=_version_key)
-    info = data.get("info") or {}
-    return info.get("version")
-
-
-def _version_key(v: str) -> tuple[int, ...]:
-    parts: list[int] = []
-    for part in v.split("."):
-        digits = re.match(r"\d+", part)
-        parts.append(int(digits.group()) if digits else 0)
-    return tuple(parts)
-
-
-def _default_fetcher(url: str) -> dict[str, Any]:
-    with urllib.request.urlopen(url, timeout=10) as resp:
-        return json.loads(resp.read().decode("utf-8"))
-
-
 def _workspace_member_dirs(root_pyproject: Path, doc: tomlkit.TOMLDocument) -> list[Path]:
     workspace = _get_uv_section(doc, "workspace")
     if workspace is None:
@@ -166,6 +123,7 @@ def _process_file(
     doc: tomlkit.TOMLDocument,
     *,
     cache: dict[str, str | None],
+    loosen: bool = False,
 ) -> tuple[list[Change], list[Skip], tomlkit.TOMLDocument | None]:
     project = doc.get("project")
     if not isinstance(project, (dict, Table)):
@@ -190,11 +148,13 @@ def _process_file(
         if latest is None:
             skips.append(Skip(path, name, "not found on PyPI"))
             continue
-        new_dep = f"{name}>={latest}"
-        if new_dep == dep_str.strip():
+        result = rewrite_requirement(dep_str, latest, loosen=loosen)
+        if result.spec is None:
+            if result.reason:
+                skips.append(Skip(path, name, result.reason))
             continue
-        deps[idx] = new_dep
-        changes.append(Change(path, name, dep_str.strip(), new_dep))
+        deps[idx] = result.spec
+        changes.append(Change(path, name, dep_str.strip(), result.spec))
 
     return changes, skips, doc if changes else None
 
@@ -226,6 +186,7 @@ def run_update(
     *,
     dry_run: bool = False,
     include_pre: bool = False,
+    loosen: bool = False,
     fetcher: Fetcher | None = None,
 ) -> None:
     """Programmatic entry point — separated from the Typer command for testing."""
@@ -234,7 +195,7 @@ def run_update(
         typer.echo(f"ERROR: {root} not found.", err=True)
         raise typer.Exit(code=1)
 
-    fetch = fetcher or _default_fetcher
+    fetch = fetcher or default_fetcher
     root_doc = tomlkit.parse(root.read_text(encoding="utf-8"))
     files: list[tuple[Path, tomlkit.TOMLDocument]] = [(root, root_doc)]
     for member in _workspace_member_dirs(root, root_doc):
@@ -246,7 +207,7 @@ def run_update(
     if unique_names:
         with ThreadPoolExecutor(max_workers=min(8, len(unique_names))) as pool:
             results = pool.map(
-                lambda n: (n, _fetch_latest(n, include_pre=include_pre, fetcher=fetch)),
+                lambda n: (n, fetch_latest(n, include_pre=include_pre, fetcher=fetch)),
                 unique_names,
             )
             cache = dict(results)
@@ -256,7 +217,7 @@ def run_update(
     pending: list[tuple[Path, tomlkit.TOMLDocument]] = []
 
     for file, doc in files:
-        changes, skips, new_doc = _process_file(file, doc, cache=cache)
+        changes, skips, new_doc = _process_file(file, doc, cache=cache, loosen=loosen)
         all_changes.extend(changes)
         all_skips.extend(skips)
         if new_doc is not None:
@@ -282,6 +243,20 @@ def package_update(
         bool,
         typer.Option("--include-pre", help="Include pre-release versions."),
     ] = False,
+    loosen: Annotated[
+        bool,
+        typer.Option(
+            "--loosen",
+            help="Rewrite every constraint to `>=<latest>` instead of keeping its operator.",
+        ),
+    ] = False,
 ) -> None:
-    """Update all simple_module_* dependencies to the latest PyPI versions."""
-    run_update(path, dry_run=dry_run, include_pre=include_pre)
+    """Update all simple_module_* dependencies to the latest PyPI versions.
+
+    Each constraint keeps the operator it already has — `==0.0.32` becomes
+    `==0.0.33`, `>=0.0.32` becomes `>=0.0.33` — so bumping versions never
+    silently changes a project's pinning policy. A dependency whose upper
+    bound excludes the latest release is reported and left alone. Pass
+    `--loosen` to rewrite everything to `>=<latest>` instead.
+    """
+    run_update(path, dry_run=dry_run, include_pre=include_pre, loosen=loosen)

simple_module_cli-0.0.34/simple_module_cli/pypi.py

@@ -0,0 +1,55 @@
+"""PyPI release lookup for ``smpy package-update``.
+
+Split out of ``package_update`` so the network half is separately testable and
+neither file approaches the 300-line cap. The ``Fetcher`` indirection is what
+lets the CLI tests run without touching the network.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import urllib.error
+import urllib.request
+from collections.abc import Callable
+from typing import Any
+
+from simple_module_cli.requirements import version_key
+
+__all__ = ["PYPI_URL", "Fetcher", "default_fetcher", "fetch_latest"]
+
+Fetcher = Callable[[str], dict[str, Any]]
+
+PYPI_URL = "https://pypi.org/pypi/{name}/json"
+
+# PEP 440 release segments contain only digits + dots; any letter signals
+# a pre/post/dev release (a, b, rc, post, dev). Coarser than packaging.version
+# but `packaging` isn't a CLI dep (see test_no_framework_deps.py).
+_PRE_RELEASE_RE = re.compile(r"[a-zA-Z]")
+
+
+def fetch_latest(name: str, *, include_pre: bool, fetcher: Fetcher) -> str | None:
+    """Latest non-yanked release of ``name``, or ``None`` if PyPI doesn't have it."""
+    try:
+        data = fetcher(PYPI_URL.format(name=name))
+    except (urllib.error.HTTPError, urllib.error.URLError):
+        return None
+    releases = data.get("releases") or {}
+    candidates: list[str] = []
+    for version, files in releases.items():
+        if not files:
+            continue
+        if any(f.get("yanked") for f in files):
+            continue
+        if not include_pre and _PRE_RELEASE_RE.search(version):
+            continue
+        candidates.append(version)
+    if candidates:
+        return max(candidates, key=version_key)
+    info = data.get("info") or {}
+    return info.get("version")
+
+
+def default_fetcher(url: str) -> dict[str, Any]:
+    with urllib.request.urlopen(url, timeout=10) as resp:
+        return json.loads(resp.read().decode("utf-8"))

simple_module_cli-0.0.34/simple_module_cli/requirements.py

@@ -0,0 +1,232 @@
+"""PEP 508 requirement rewriting for ``smpy package-update``.
+
+Split out of ``package_update`` so the version-bump rules live in one place
+with their own tests, and so neither file approaches the 300-line cap.
+
+The rule that matters: bumping a dependency changes its *version*, not its
+*pin style*. ``simple_module_core==0.0.32`` becomes ``==0.0.33``, not
+``>=0.0.33`` — a host that pins exactly has made a deliberate choice, and the
+published module wheels pin exactly too, so loosening the host leaves the
+effective version decided by whichever wheel pins hardest. ``--loosen``
+restores the old blanket ``>=`` rewrite for anyone who wants it.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+__all__ = ["ParsedRequirement", "RewriteResult", "parse_requirement", "rewrite_requirement"]
+
+# Longest-first: ``===`` must win over ``==``, and ``>=`` over ``>``.
+_OPS = ("===", "==", "~=", "!=", ">=", "<=", ">", "<")
+_CLAUSE_RE = re.compile(rf"\s*({'|'.join(re.escape(op) for op in _OPS)})\s*([^,]+)")
+
+#: Operators naming a plain floor the bump should raise. ``>`` is deliberately
+#: absent: ``>0.0.31`` is already satisfied by anything newer, and rewriting it
+#: to ``>0.0.33`` would exclude the very version being installed. ``~=`` is
+#: absent too — it carries an implicit ceiling, handled separately below.
+_FLOOR_OPS = frozenset({"==", "===", ">="})
+
+#: Suffix marking a PEP 440 wildcard (``==1.4.*``, ``!=1.0.*``). These match on
+#: a *prefix* of the release segments, so they must never go through the
+#: numeric comparison — ``version_key`` maps ``*`` to 0, which would read
+#: ``1.0.*`` as ``1.0.0`` and quietly answer the wrong question.
+_WILDCARD = ".*"
+
+
+@dataclass(frozen=True)
+class ParsedRequirement:
+    """A PEP 508 requirement split into the parts the rewrite cares about."""
+
+    name: str
+    #: Extras bracket including the brackets (``"[redis]"``), or ``""``.
+    extras: str
+    #: ``(operator, version)`` pairs in source order.
+    clauses: tuple[tuple[str, str], ...]
+    #: Environment marker including the leading ``;``, or ``""``.
+    marker: str
+
+
+@dataclass(frozen=True)
+class RewriteResult:
+    """Outcome of a rewrite: a new spec, or a reason there isn't one."""
+
+    #: The rewritten requirement, or ``None`` when nothing should change.
+    spec: str | None
+    #: Human-readable reason when ``spec`` is ``None`` and the user should be
+    #: told (an excluded latest); ``None`` when the no-op is unremarkable.
+    reason: str | None = None
+
+
+def version_key(version: str) -> tuple[int, ...]:
+    """Coarse PEP 440 release-segment ordering.
+
+    ``packaging`` isn't a CLI dependency (see ``test_no_framework_deps.py``),
+    so this compares the numeric release segments only. Good enough to answer
+    "does the latest release trip this upper bound", which is all it's for.
+    """
+    parts: list[int] = []
+    for part in version.split("."):
+        digits = re.match(r"\d+", part)
+        parts.append(int(digits.group()) if digits else 0)
+    return tuple(parts)
+
+
+def _compare(left: str, right: str) -> int:
+    """Three-way compare two versions on their release segments, zero-padded."""
+    a, b = version_key(left), version_key(right)
+    width = max(len(a), len(b))
+    a += (0,) * (width - len(a))
+    b += (0,) * (width - len(b))
+    return (a > b) - (a < b)
+
+
+def parse_requirement(spec: str) -> ParsedRequirement | None:
+    """Split a PEP 508 requirement string, or ``None`` if the name is unusable."""
+    base, sep, marker = spec.partition(";")
+    base = base.strip()
+    marker = f";{marker}" if sep else ""
+
+    head, bracket, rest = base.partition("[")
+    if bracket:
+        extras_body, closed, tail = rest.partition("]")
+        if not closed:
+            return None
+        extras = f"[{extras_body}]"
+        remainder = tail
+    else:
+        extras = ""
+        # No extras: the name runs until the first operator character.
+        match = re.match(r"[^<>=!~]*", head)
+        name_end = match.end() if match else 0
+        head, remainder = head[:name_end], head[name_end:]
+
+    name = head.strip()
+    if not name:
+        return None
+
+    clauses = tuple((op, version.strip()) for op, version in _CLAUSE_RE.findall(remainder))
+    return ParsedRequirement(name=name, extras=extras, clauses=clauses, marker=marker)
+
+
+def _render(parsed: ParsedRequirement, clauses: tuple[tuple[str, str], ...]) -> str:
+    body = ",".join(f"{op}{version}" for op, version in clauses)
+    return f"{parsed.name}{parsed.extras}{body}{parsed.marker}"
+
+
+def _matches_wildcard(version: str, pattern: str) -> bool:
+    """Does ``version`` fall under a PEP 440 wildcard like ``1.4.*``?"""
+    prefix = version_key(pattern[: -len(_WILDCARD)])
+    release = version_key(version)
+    return len(release) >= len(prefix) and release[: len(prefix)] == prefix
+
+
+def _compatible_band(version: str) -> str | None:
+    """The wildcard a ``~=`` clause implies, or ``None`` if it has none.
+
+    ``~=1.4`` means ``>=1.4, ==1.*``; ``~=1.4.2`` means ``>=1.4.2, ==1.4.*``.
+    A single-segment ``~=1`` is invalid PEP 440 and has no band to derive.
+    """
+    parts = version.split(".")
+    if len(parts) < 2:
+        return None
+    return ".".join(parts[:-1]) + _WILDCARD
+
+
+def _allows(op: str, version: str, latest: str) -> bool:
+    """Would this clause still be satisfied by ``latest``?
+
+    Floors (``==``/``===``/``>=``) are always "allowed": the rewrite moves them
+    *to* ``latest``, so they can't exclude it. Everything else either carries a
+    ceiling of its own or is left verbatim, and has to be checked.
+    """
+    if op in _FLOOR_OPS and not version.endswith(_WILDCARD):
+        return True
+    if version.endswith(_WILDCARD):
+        # ``==1.0.*`` allows anything under the prefix; ``!=1.0.*`` allows
+        # anything outside it.
+        inside = _matches_wildcard(latest, version)
+        return inside if op in ("==", "===") else not inside
+    if op == "~=":
+        band = _compatible_band(version)
+        return band is not None and _matches_wildcard(latest, band)
+    cmp = _compare(latest, version)
+    if op == "<":
+        return cmp < 0
+    if op == "<=":
+        return cmp <= 0
+    if op == "!=":
+        return cmp != 0
+    # ``>`` — already satisfied by anything newer than the pin.
+    return True
+
+
+def _excluded_by(parsed: ParsedRequirement, latest: str) -> str | None:
+    """Return the clause that rules ``latest`` out, or ``None`` if it's allowed."""
+    for op, version in parsed.clauses:
+        if not _allows(op, version, latest):
+            return f"{op}{version}"
+    return None
+
+
+def _bump(op: str, version: str, latest: str) -> str:
+    """The version this clause should carry after the update.
+
+    Only a plain floor moves, and only *upwards*: PyPI's latest can legitimately
+    be older than what a project already asks for (a version bumped in the
+    workspace but not yet published), and rewriting ``==0.0.33`` to ``==0.0.32``
+    would force an actual downgrade on the next ``uv sync``.
+
+    A wildcard band (``==1.0.*``, ``!=1.0.*``) that already allows ``latest`` is
+    left exactly as written — narrowing it to a single release would be a policy
+    change, not a version bump. ``~=`` moves within its own width for the same
+    reason: ``~=1.4`` becomes ``~=1.5``, never ``~=1.5.0``, because the latter
+    narrows the implied band from ``==1.*`` to ``==1.5.*`` and would make the
+    next run report the following minor as excluded.
+    """
+    if version.endswith(_WILDCARD):
+        return version
+    if op == "~=":
+        segments = len(version.split("."))
+        parts = latest.split(".")
+        if len(parts) < segments:
+            return version
+        candidate = ".".join(parts[:segments])
+        return candidate if _compare(candidate, version) > 0 else version
+    if op in _FLOOR_OPS:
+        return latest if _compare(latest, version) > 0 else version
+    return version
+
+
+def rewrite_requirement(spec: str, latest: str, *, loosen: bool = False) -> RewriteResult:
+    """Point ``spec`` at ``latest``, preserving its pin style unless ``loosen``.
+
+    Returns a ``RewriteResult`` whose ``spec`` is ``None`` when the requirement
+    already asks for ``latest`` (or for something newer), when it carries no
+    floor to raise, or when an upper bound excludes ``latest`` (the last
+    carries a ``reason``).
+    """
+    parsed = parse_requirement(spec)
+    if parsed is None:
+        return RewriteResult(None)
+
+    if loosen or not parsed.clauses:
+        # Nothing to preserve — an unconstrained dependency has no pin style,
+        # so it gets the tool's default floor. Extras and markers survive.
+        new = f"{parsed.name}{parsed.extras}>={latest}{parsed.marker}"
+        return RewriteResult(None) if new == spec.strip() else RewriteResult(new)
+
+    blocker = _excluded_by(parsed, latest)
+    if blocker is not None:
+        return RewriteResult(None, reason=f"{latest} excluded by {blocker}")
+
+    bumped = tuple((op, _bump(op, version, latest)) for op, version in parsed.clauses)
+    if bumped == parsed.clauses:
+        # Nothing here names a floor to raise — a bare ``>``/``<``/``!=``, or a
+        # wildcard band that already covers ``latest``. Rewriting either would
+        # invent a constraint the author didn't ask for.
+        return RewriteResult(None)
+
+    new = _render(parsed, bumped)
+    return RewriteResult(None) if new == spec.strip() else RewriteResult(new)

{simple_module_cli-0.0.32 → simple_module_cli-0.0.34}/simple_module_cli/templates/host/main.py

@@ -33,12 +33,15 @@ if str(_HOST_DIR) not in sys.path:
 os.chdir(_REPO_ROOT)
 load_dotenv_into_environ(_REPO_ROOT / ".env")
 
-from simple_module_hosting import Settings, create_app  # noqa: E402
+from simple_module_hosting import create_app, merge_host_settings  # noqa: E402
 from simple_module_hosting.logging import setup_logging  # noqa: E402
 
 from routes import router as host_router  # noqa: E402
 
-settings = Settings()
+# merge_host_settings, not Settings(): the host knobs (log level, trusted
+# proxy, auth provider, DB pool) are DB-backed, and create_app's own fallback
+# does not fire because settings is passed to it explicitly below.
+settings = merge_host_settings()
 
 setup_logging(
     level=settings.log_level,

{simple_module_cli-0.0.32 → simple_module_cli-0.0.34}/tests/conftest.py

@@ -1,4 +1,4 @@
-"""Fixtures shared by the module-asset tests in this directory.
+"""Fixtures shared by the tests in this directory.
 
 These test files have no ``__init__.py`` (test basenames are globally unique
 instead), so a plain helper import across files is not available — a fixture is
@@ -10,10 +10,47 @@ from __future__ import annotations
 import subprocess
 import sys
 from pathlib import Path
+from urllib.error import HTTPError
 
 import pytest
 
 
+@pytest.fixture
+def fake_pypi():
+    """Return a factory building a `package-update` fetcher stub.
+
+    Takes `{dist_name: latest_version}` and answers only for those names;
+    anything else raises the 404 the real fetcher would see. Keeps the CLI
+    tests off the network.
+    """
+
+    def factory(versions: dict[str, str]):
+        def fetcher(url: str) -> dict:
+            name = url.rsplit("/json", 1)[0].rsplit("/", 1)[1]
+            if name not in versions:
+                raise HTTPError(url, 404, "not found", {}, None)
+            latest = versions[name]
+            return {"info": {"version": latest}, "releases": {latest: [{"yanked": False}]}}
+
+        return fetcher
+
+    return factory
+
+
+@pytest.fixture
+def write_pyproject():
+    """Return a factory writing a minimal pyproject with the given deps."""
+
+    def factory(path: Path, *deps: str) -> None:
+        body = "".join(f'    "{d}",\n' for d in deps)
+        path.write_text(
+            f'[project]\nname = "x"\nversion = "0"\ndependencies = [\n{body}]\n',
+            encoding="utf-8",
+        )
+
+    return factory
+
+
 @pytest.fixture
 def make_importable_module(tmp_path: Path):
     """Return a factory creating a real importable package bound to a ModuleBase.