splent-cli 1.12.0__tar.gz → 1.16.0__tar.gz

{splent_cli-1.12.0/src/splent_cli.egg-info → splent_cli-1.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.12.0
+Version: 1.16.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 Project-URL: Homepage, https://github.com/diverso-lab/splent_cli
@@ -10,6 +10,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click==8.1.8
 Requires-Dist: packaging>=24.0
+Requires-Dist: pyyaml>=6.0
 Requires-Dist: requests>=2.31.0
 Requires-Dist: tomli_w>=1.0.0
 Provides-Extra: dev

{splent_cli-1.12.0 → splent_cli-1.16.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "splent_cli"
-version = "1.12.0"
+version = "1.16.0"
 description = "SPLENT-CLI is a CLI to be able to work on your development more easily."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -14,6 +14,7 @@ license-files = ["LICENSE"]
 dependencies = [
     "click==8.1.8",
     "packaging>=24.0",
+    "pyyaml>=6.0",
     "requests>=2.31.0",
     "tomli_w>=1.0.0",
 ]

{splent_cli-1.12.0 → splent_cli-1.16.0}/src/splent_cli/cli.py

@@ -3,9 +3,7 @@ import os
 import click
 from dotenv import load_dotenv
 
-from splent_cli.utils.dynamic_imports import get_app
 from splent_cli.utils.command_loader import load_commands
-from splent_cli.utils.db_utils import check_db_connection
 
 load_dotenv()
 
@@ -40,6 +38,8 @@ class SPLENTCLI(click.Group):
 
         self._feature_cmds_cache: dict[str, click.BaseCommand] = {}
         try:
+            from splent_cli.utils.dynamic_imports import get_app
+
             app = get_app()
             with app.app_context():
                 registry = app.extensions.get("splent_feature_commands", {})
@@ -84,6 +84,9 @@ class SPLENTCLI(click.Group):
         command = self.get_command(ctx, cmd_name)
 
         if command and getattr(command, "requires_app", False):
+            from splent_cli.utils.dynamic_imports import get_app
+            from splent_cli.utils.db_utils import check_db_connection
+
             app = get_app()
             if getattr(command, "requires_db", False):
                 if not check_db_connection(app):
@@ -109,6 +112,15 @@ class SPLENTCLI(click.Group):
             "🧬 SPL & Variability": [
                 cmd for cmd in all_cmds if cmd.startswith(("spl:", "uvl:"))
             ],
+            "🛒 Marketplace": [
+                cmd
+                for cmd in all_cmds
+                # login/logout/whoami are bare on purpose (docker-login
+                # ergonomics), so they are listed by name next to the
+                # namespaced marketplace commands they belong with.
+                if cmd.startswith("marketplace:")
+                or cmd in ("login", "logout", "whoami")
+            ],
             "🧱 Database": [cmd for cmd in all_cmds if cmd.startswith("db:")],
             "💾 Cache": [cmd for cmd in all_cmds if cmd.startswith("cache:")],
             "🔍 Checks": [cmd for cmd in all_cmds if cmd.startswith("check:")],

splent_cli-1.16.0/src/splent_cli/commands/check/check_contracts.py

@@ -0,0 +1,212 @@
+"""
+check:contracts — Verify that feature contracts and SPL UVL models agree.
+
+The dependency truth must not be split: a feature's requires.features (in
+[tool.splent.contract]) and the SPL's UVL implications (A => B) describe
+the same reality from two sides. This check reports:
+
+  - contract dependencies with no matching UVL constraint (ERROR: the SPL
+    would let a product select A without B and break at runtime), and
+  - UVL implications not backed by any contract (WARNING: the dependency
+    is invisible to feature:install and the marketplace).
+"""
+
+from pathlib import Path
+
+import click
+import tomllib
+
+from splent_cli.services import context, marketplace, spl_store
+
+
+def _snapshot_version_key(pyproject_path: Path) -> tuple:
+    """Semver sort key for a cache snapshot dir like splent_feature_x@v1.10.0."""
+    import re
+
+    _, _, version = pyproject_path.parent.name.partition("@")
+    m = re.match(r"v?(\d+)\.(\d+)\.(\d+)", version)
+    if not m:
+        return (-1, -1, -1)
+    return (int(m.group(1)), int(m.group(2)), int(m.group(3)))
+
+
+def _local_contract_requires(workspace: str, package: str) -> list[str] | None:
+    """requires.features of a feature found locally (workspace root, else the
+    newest cache snapshot by semver). None when not available locally."""
+    candidates = [Path(workspace) / package / "pyproject.toml"]
+    cache = Path(workspace) / ".splent_cache" / "features"
+    if cache.is_dir():
+        candidates.extend(
+            sorted(
+                cache.glob(f"*/{package}@*/pyproject.toml"),
+                key=_snapshot_version_key,
+                reverse=True,
+            )
+        )
+
+    for path in candidates:
+        if not path.is_file():
+            continue
+        try:
+            data = tomllib.loads(path.read_text())
+        except (OSError, tomllib.TOMLDecodeError):
+            continue
+        requires = (
+            data.get("tool", {})
+            .get("splent", {})
+            .get("contract", {})
+            .get("requires", {})
+        )
+        return {
+            "features": requires.get("features", []),
+            "optional": requires.get("features_optional", []),
+        }
+    return None
+
+
+@click.command(
+    "check:contracts",
+    short_help="Check that feature contracts and SPL UVL constraints agree.",
+)
+@click.option("--spl", "spl_name", default=None, help="Check a single SPL.")
+def check_contracts(spl_name):
+    """
+    Cross-check requires.features in every contract against the UVL
+    constraints of every SPL model this workspace knows.
+
+    \b
+    Examples:
+      splent check:contracts
+      splent check:contracts --spl cms_spl
+    """
+    workspace = str(context.workspace())
+
+    if spl_name:
+        spl_names = [spl_name]
+    else:
+        spl_names = spl_store.known_spls(workspace)
+
+    if not spl_names:
+        click.secho("  No SPL models known to this workspace.", fg="red")
+        click.echo("  Start one with: splent spl:create <name>")
+        raise SystemExit(1)
+
+    total_errors = 0
+    total_warnings = 0
+
+    for name in spl_names:
+        spl_errors = 0
+        spl_warnings = 0
+        pin = spl_store.read_pin(workspace, name)
+        uvl_path_str = spl_store.find_uvl(
+            workspace, name, version=pin.version, doi=pin.doi
+        )
+        click.echo()
+        click.echo(click.style(f"  check:contracts  {name}", bold=True))
+        click.echo(click.style(f"  {'-' * 60}", fg="bright_black"))
+
+        if not uvl_path_str:
+            if pin.fetchable:
+                click.secho(
+                    f"  UVL not on disk, run: splent spl:fetch {name}",
+                    fg="yellow",
+                )
+            else:
+                click.secho(
+                    f"  No UVL and no DOI for '{name}', nothing to check against.",
+                    fg="yellow",
+                )
+            total_warnings += 1
+            continue
+
+        uvl_path = Path(uvl_path_str)
+        model = marketplace.parse_uvl_structure(uvl_path.read_text())
+        shorts = model["features"]  # short -> {package, org, ...}
+        implications = {(a, b) for a, b in model["constraints"]}
+
+        contracts: dict[str, list[str] | None] = {}
+        for short, meta in shorts.items():
+            contracts[short] = _local_contract_requires(workspace, meta["package"])
+
+        missing_local = sorted(s for s, req in contracts.items() if req is None)
+
+        # 1. Contract deps that the UVL does not enforce.
+        for short, req in sorted(contracts.items()):
+            for dep in (req or {}).get("features", []):
+                if dep not in shorts:
+                    # Dependency on a feature outside this SPL: the SPL simply
+                    # cannot offer this feature safely without it.
+                    click.secho(
+                        f"  ✗ {short} requires '{dep}' (contract), but '{dep}' "
+                        f"is not a feature of {name}",
+                        fg="red",
+                    )
+                    spl_errors += 1
+                elif (short, dep) not in implications:
+                    click.secho(
+                        f"  ✗ {short} requires '{dep}' (contract), but the UVL "
+                        f"has no '{short} => {dep}' constraint",
+                        fg="red",
+                    )
+                    click.echo(
+                        click.style(
+                            f"      fix: add '{short} => {dep}' to the UVL "
+                            f"constraints (splent spl:add-constraints "
+                            f"{name} is interactive)",
+                            fg="bright_black",
+                        )
+                    )
+                    spl_errors += 1
+
+        # 2. UVL implications with no contract behind them.
+        for a, b in sorted(implications):
+            req = contracts.get(a)
+            if a not in shorts or b not in shorts:
+                continue  # constraint over infra features (redis, nginx…)
+            if req is None:
+                continue  # feature not local — cannot verify
+            if b in req["optional"]:
+                continue  # SPL hardening a soft (graceful) dependency — fine
+            if b not in req["features"]:
+                click.secho(
+                    f"  ⚠  UVL says '{a} => {b}' but {a}'s contract does not "
+                    f"require '{b}'",
+                    fg="yellow",
+                )
+                click.echo(
+                    click.style(
+                        f'      fix: add "{b}" to requires.features_manual in '
+                        f"{shorts[a]['package']}/pyproject.toml (preserved on "
+                        "regeneration), or confirm it is SPL-level policy",
+                        fg="bright_black",
+                    )
+                )
+                spl_warnings += 1
+
+        if missing_local:
+            click.echo(
+                click.style(
+                    f"  ℹ  not local (skipped): {', '.join(missing_local)}",
+                    fg="bright_black",
+                )
+            )
+
+        if not spl_errors and not spl_warnings:
+            click.secho("  ✅ Contracts and UVL agree.", fg="green")
+        total_errors += spl_errors
+        total_warnings += spl_warnings
+
+    click.echo()
+    if total_errors or total_warnings:
+        click.echo(
+            click.style(
+                f"  {total_errors} error(s), {total_warnings} warning(s).",
+                bold=True,
+            )
+        )
+        click.echo()
+    if total_errors:
+        raise SystemExit(1)
+
+
+cli_command = check_contracts

{splent_cli-1.12.0 → splent_cli-1.16.0}/src/splent_cli/commands/check/check_deps.py

@@ -196,31 +196,36 @@ def check_deps():
     product = context.require_app()
     product_dir = os.path.join(workspace, product)
 
-    # Read UVL (catalog or legacy)
+    # Read the UVL: the named SPL model, or the legacy in-product file
+    from splent_cli.services import spl_store
+
     try:
         reader = PyprojectReader.for_product(product_dir)
-        # 1. Catalog: [tool.splent].spl
         spl_name = reader.splent_config.get("spl")
         if spl_name:
-            uvl_path = os.path.join(
-                workspace, "splent_catalog", spl_name, f"{spl_name}.uvl"
-            )
+            uvl_path = spl_store.product_uvl(workspace, product, allow_fetch=True)
+            if not uvl_path:
+                click.secho(
+                    "  [x] " + spl_store.missing_model_message(workspace, spl_name),
+                    fg="red",
+                )
+                raise SystemExit(1)
         else:
             # 2. Legacy: [tool.splent.uvl].file
             uvl_file = reader.uvl_config.get("file")
             if not uvl_file:
                 click.secho(
-                    "  [✖] No UVL configured. Set [tool.splent].spl or [tool.splent.uvl].file.",
+                    "  [x] No UVL configured. Set [tool.splent].spl or [tool.splent.uvl].file.",
                     fg="red",
                 )
                 raise SystemExit(1)
             uvl_path = os.path.join(product_dir, "uvl", uvl_file)
     except (FileNotFoundError, RuntimeError) as e:
-        click.secho(f"  [✖] Cannot read pyproject.toml: {e}", fg="red")
+        click.secho(f"  [x] Cannot read pyproject.toml: {e}", fg="red")
         raise SystemExit(1)
 
     if not os.path.isfile(uvl_path):
-        click.secho(f"  [✖] UVL file not found: {uvl_path}", fg="red")
+        click.secho(f"  [x] UVL file not found: {uvl_path}", fg="red")
         raise SystemExit(1)
 
     package_map, allowed_deps = _parse_uvl_deps(uvl_path)

splent_cli-1.16.0/src/splent_cli/commands/check/check_pypi.py

@@ -0,0 +1,127 @@
+import click
+
+from splent_cli.services import registry, release_gate
+
+
+@click.command(
+    "check:pypi",
+    short_help="Verify PyPI credentials from .env (TWINE_USERNAME / TWINE_PASSWORD)",
+)
+@click.option(
+    "--test", is_flag=True, default=False, help="Check against TestPyPI instead of PyPI"
+)
+def check_pypi(test: bool):
+    click.echo(click.style("\nPyPI Credentials Check\n", fg="cyan", bold=True))
+
+    # Exactly the credentials the upload will use, resolved once, so this
+    # command and the release gate can never disagree about what is configured.
+    resolved_user, resolved_password = release_gate.pypi_credentials()
+    username = (resolved_user or "").strip()
+    password = (resolved_password or "").strip()
+
+    registry_name = "TestPyPI" if test else "PyPI"
+
+    # --- presence checks ---
+    if not username:
+        click.echo(click.style("[✖] ", fg="red") + "TWINE_USERNAME not set in .env")
+        click.secho(
+            "   Run 'splent tokens:setup' for setup instructions.", fg="bright_black"
+        )
+        raise SystemExit(1)
+    click.echo(click.style("[✔] ", fg="green") + f"TWINE_USERNAME = {username}")
+
+    if not password:
+        click.echo(
+            click.style("[✖] ", fg="red")
+            + "TWINE_PASSWORD (or PYPI_PASSWORD) not set in .env"
+        )
+        click.secho(
+            "   Run 'splent tokens:setup' for setup instructions.", fg="bright_black"
+        )
+        raise SystemExit(1)
+
+    masked = (
+        password[:4] + "*" * (len(password) - 8) + password[-4:]
+        if len(password) > 8
+        else "****"
+    )
+    click.echo(click.style("[✔] ", fg="green") + f"TWINE_PASSWORD = {masked}")
+
+    if username == "__token__" and not password.startswith("pypi-"):
+        click.echo(
+            click.style("[⚠] ", fg="yellow")
+            + "TWINE_USERNAME is '__token__' but password doesn't start with 'pypi-', may be invalid"
+        )
+    elif username == "__token__":
+        click.echo(
+            click.style("[✔] ", fg="green") + "Token format looks correct (pypi-...)"
+        )
+
+    # --- verify via the upload endpoint (valid token -> 400, invalid -> 403/401) ---
+    # The probe itself lives in services/registry.py, the single PyPI boundary,
+    # so the release gate and this command read the same signal from the same
+    # request instead of two probes that can disagree.
+    click.echo(f"\nContacting {registry_name} API...")
+    try:
+        probe = registry.pypi_upload_probe(username, password, test=test)
+    except registry.RegistryError as e:
+        click.echo(click.style("[✖] ", fg="red") + f"{e}")
+        raise SystemExit(1)
+
+    if probe.rate_limited:
+        click.echo(
+            click.style("[✖] ", fg="red")
+            + f"{registry_name} is RATE LIMITING this account (HTTP 429)"
+        )
+        click.secho(f"   {release_gate.pypi_window(probe.retry_after)}", fg="yellow")
+        click.secho(
+            "   The credentials are not the problem. Uploads will be refused until "
+            "the limit clears.",
+            fg="bright_black",
+        )
+        raise SystemExit(1)
+
+    if probe.status in (401, 403):
+        click.echo(
+            click.style("[✖] ", fg="red")
+            + f"Credentials rejected by {registry_name} (HTTP {probe.status}), "
+            "token invalid or expired"
+        )
+        click.secho(
+            "   Run 'splent tokens:setup' for instructions on obtaining a valid token.",
+            fg="bright_black",
+        )
+        raise SystemExit(1)
+
+    if probe.status == 400:
+        click.echo(
+            click.style("[✔] ", fg="green")
+            + f"Credentials valid ({registry_name} returned 400, expected for an empty upload)"
+        )
+    elif 200 <= probe.status < 300:
+        click.echo(
+            click.style("[✔] ", fg="green") + f"Credentials accepted by {registry_name}"
+        )
+    else:
+        # An answer that is not a verdict is not a pass. The release gate
+        # refuses on this exact input, and the command an operator runs to
+        # decide whether to release must not be the more permissive of the two.
+        click.echo(
+            click.style("[✖] ", fg="red")
+            + f"{registry_name} returned HTTP {probe.status}, which is not a usable "
+            "answer, so the credentials could NOT be confirmed"
+        )
+        if probe.detail:
+            click.secho(f"   {probe.detail}", fg="bright_black")
+        click.secho(
+            "   Retry once it answers normally. A release would be refused in this "
+            "state.",
+            fg="yellow",
+        )
+        raise SystemExit(1)
+
+    click.echo()
+    click.secho(f"PyPI credentials OK ({registry_name}).", fg="green")
+
+
+cli_command = check_pypi

{splent_cli-1.12.0 → splent_cli-1.16.0}/src/splent_cli/commands/check/check_pyproject.py

@@ -128,14 +128,24 @@ def check_pyproject():
     # SPL / UVL
     spl_name = splent.get("spl")
     if spl_name:
-        uvl_path = os.path.join(
-            workspace, "splent_catalog", spl_name, f"{spl_name}.uvl"
+        from splent_cli.services import spl_store
+
+        pin = spl_store.read_pin(workspace, spl_name, product=product)
+        uvl_path = spl_store.find_uvl(
+            workspace, spl_name, version=pin.version, doi=pin.doi
         )
-        if os.path.isfile(uvl_path):
-            _ok(f"SPL catalog: {spl_name} (UVL found)")
+        if uvl_path:
+            _ok(f"SPL model {spl_name} (UVL found at {uvl_path})")
+        elif pin.fetchable:
+            _warn(
+                f"SPL model {spl_name} not downloaded yet, run: "
+                f"splent spl:fetch {spl_name}"
+            )
         else:
             _fail(
-                f"SPL catalog: {spl_name} — UVL not found at splent_catalog/{spl_name}/{spl_name}.uvl"
+                f"SPL model {spl_name} has no UVL on disk and no DOI recorded. "
+                f"Add [tool.splent.spl_model] with the DOI, or run: "
+                f"splent spl:create {spl_name}"
             )
     else:
         # Legacy fallback