tangle-cli 0.1.7__tar.gz → 0.1.10__tar.gz

{tangle_cli-0.1.7 → tangle_cli-0.1.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: tangle-cli
-Version: 0.1.7
+Version: 0.1.10
 Summary: CLI for Tangle, the open-source ML pipeline orchestration platform
 Author: Alexey Volkov, Tangle authors, Volv Grebennikov
 Author-email: Alexey Volkov <alexey.volkov@ark-kun.com>, Volv Grebennikov <volv.grebennikov@shopify.com>
@@ -86,6 +86,57 @@ API-backed commands commonly accept these options. Explicit CLI options win over
 | `--config` | YAML/JSON defaults. Many commands accept a single object, a list of objects, or `_defaults` + `configs`. |
 | `--log-type` | SDK progress logs: `console`, `none`, or `file`. Logs go to stderr or a temp log file so structured stdout stays parseable. |
 | `TANGLE_VERBOSE=1` | Redacted HTTP request/response diagnostics only. This is separate from normal progress logging. |
+| `--ca-bundle` | Global CLI flag: path to a PEM CA bundle used as the TLS trust store for every transport. Overrides `TANGLE_API_CA_BUNDLE`. Place before the subcommand. |
+| `--verify-tls` / `--no-verify-tls` | Global CLI flag: enable or disable TLS verification for every transport. Overrides `TANGLE_API_VERIFY_TLS`. `--no-verify-tls` is local-development only. Place before the subcommand. |
+| `TANGLE_API_CA_BUNDLE` | Path to a PEM CA bundle used to verify TLS for every transport. Use this to trust a private or corporate CA without disabling verification. |
+| `TANGLE_API_VERIFY_TLS` | TLS verification toggle. Values `0`, `false`, or `no` (case/space-insensitive) disable verification; any other nonempty value keeps it on. |
+
+### TLS verification
+
+TLS certificate verification is enabled by default for all HTTP transports (schema
+fetches, `tangle api` calls, and the programmatic clients). The effective setting is
+resolved with the following precedence, highest to lowest:
+
+1. An explicit `verify=` argument to the Python clients (a `bool` or a path to a CA bundle).
+2. The global CLI flags `--ca-bundle` / `--verify-tls` / `--no-verify-tls`.
+3. `TANGLE_API_CA_BUNDLE` — verify against the given CA bundle.
+4. `TANGLE_API_VERIFY_TLS` — enable or disable verification.
+5. The secure default: verification enabled against the system trust store.
+
+The global CLI flags are true root options that apply to every command — the static
+`tangle sdk ...` clients, the dynamic `tangle api ...` commands, and `tangle api refresh`.
+Place them **before** the subcommand, for example `tangle --ca-bundle ca.pem api ...` or
+`tangle --no-verify-tls sdk ...`. They are honored even by the dynamic OpenAPI schema
+discovery that runs before command dispatch. A defaulted (absent) flag does not override
+the environment: when a flag is not supplied, the `TANGLE_API_*` variables and the standard
+`REQUESTS_CA_BUNDLE` / `CURL_CA_BUNDLE` handling still apply. `--ca-bundle` combined with an
+explicit `--no-verify-tls` is contradictory and fails fast before any request; `--ca-bundle`
+with `--verify-tls` is redundant but accepted.
+
+If both env vars are set, `TANGLE_API_CA_BUNDLE` wins and TLS stays verified against the
+bundle. Empty values are treated as unset. A `--ca-bundle` or `TANGLE_API_CA_BUNDLE` that
+does not point to an existing file fails fast with an actionable error before any request is
+made. When no Tangle-specific setting is provided, the standard `REQUESTS_CA_BUNDLE` /
+`CURL_CA_BUNDLE` handling and any caller-supplied `requests.Session.verify` are left
+untouched.
+
+For a private CA, prefer `--ca-bundle` / `TANGLE_API_CA_BUNDLE` over disabling verification:
+it keeps certificates verified against a trusted root. `--no-verify-tls` /
+`TANGLE_API_VERIFY_TLS=0` disables verification entirely and is intended for local
+development only — never use it against production endpoints.
+
+```bash
+# Trust a private CA with the global flag (recommended for internal/self-hosted APIs)
+uv run tangle --ca-bundle /etc/ssl/private-ca.pem \
+  api refresh --base-url https://internal.example
+
+# Or via environment variable
+TANGLE_API_CA_BUNDLE=/etc/ssl/private-ca.pem \
+  uv run tangle api refresh --base-url https://internal.example
+
+# Disable verification (local development only)
+uv run tangle --no-verify-tls api refresh --base-url https://localhost:8443
+```
 
 Examples for protected APIs:
 
@@ -349,6 +400,95 @@ def greeting_pipeline(who: In[str], cfg) -> Out[str]:
 
 Task IDs default from the left-hand variable name at the call site, converted to title case. If there is no simple left-hand variable, or if you want a stable explicit label, call `.named("Task Id")` before invoking the task. Use `.bind(...)` to pre-fill task arguments and `.with_annotations({...})` to add per-task annotations.
 
+##### Conditional task execution
+
+Pipeline inputs used as conditions are ordinary `In[str]` values; there is no special conditional input annotation. Pass the value through the reserved task-call metadata keyword `is_enabled=`:
+
+```python
+@pipeline("Conditional greeting")
+def conditional_greeting(enabled: In[str]) -> Out[str]:
+    greeting = write_greeting(who="world", is_enabled=enabled)
+    return greeting.out
+```
+
+This emits the canonical task field rather than a component argument:
+
+```yaml
+isEnabled:
+  graphInput:
+    inputName: enabled
+```
+
+`is_enabled=` supports Python booleans (serialized as lowercase `"true"` / `"false"` strings), string constants, `In[...]` graph inputs, and previous task outputs such as `is_enabled=gate.Output`. It is container-component task metadata; component function parameters are not implicitly conditions.
+
+If a component itself declares an input named `is_enabled`, bind that component argument separately while using the call-site keyword for task metadata:
+
+```python
+@task(image="python:3.12")
+def work(is_enabled: str, message: str) -> str:
+    return message
+
+@pipeline("Input-name collision")
+def collision(runtime_condition: In[str]) -> Out[str]:
+    result = work.bind(is_enabled="component-input-value")(
+        message="hello",
+        is_enabled=runtime_condition,
+    )
+    return result.Output
+```
+
+The bound value remains under `arguments.is_enabled`; the call-site value emits as `isEnabled`. Tangle does not evaluate conditions on graph-component tasks, so `subpipeline(...)(is_enabled=...)` is rejected with guidance to condition tasks inside the child pipeline. A child graph input with that name remains available through `subpipeline(...).bind(is_enabled=...)(...)`. There is no `condition` alias.
+
+##### Task execution options and caching
+
+Tangle caches task results, so a task that reads state which changes between runs (a run's `createdBy`, wall-clock time, an external table that the graph does not depend on) must opt out of caching explicitly. Use the reserved task-call metadata keyword `max_cache_staleness=`:
+
+```python
+@pipeline("Scheduled-run gate")
+def scheduled_gate() -> Out[str]:
+    is_scheduled = read_runtime_state(
+        name="CLOUD_PIPELINES_PIPELINE_RUN_CREATED_BY",
+        max_cache_staleness="P0D",
+    )
+    return is_scheduled.Output
+```
+
+This emits the canonical task field rather than a component argument:
+
+```yaml
+executionOptions:
+  cachingStrategy:
+    maxCacheStaleness: P0D
+```
+
+`P0D` means "never reuse a cached result"; any other ISO-8601 duration (`P7D`) caps how stale a reusable result may be. For the rest of `ExecutionOptionsSpec`, use the general `execution_options=` passthrough:
+
+```python
+uploaded = flaky_upload(
+    payload=data.Output,
+    execution_options={"retryStrategy": {"maxRetries": 3}},
+)
+```
+
+Both keywords may be combined; `max_cache_staleness=` wins over a `cachingStrategy.maxCacheStaleness` supplied through `execution_options=`, and every other passthrough field is preserved. A mapping passed as `execution_options=` is never mutated, so one shared constant can be reused across tasks.
+
+Tangle models exactly two execution-option groups today — `cachingStrategy.maxCacheStaleness` and `retryStrategy.maxRetries` (required whenever `retryStrategy` is present). Any other key is rejected at compile time: the backend ignores unmodeled keys silently, so accepting one would advertise a setting that never takes effect.
+
+Execution options are STATIC compile-time settings, so `max_cache_staleness` takes an RFC3339 duration string and `retryStrategy.maxRetries` a non-negative integer. Graph inputs, task outputs, `dynamic_secret(...)`, and `raw(...)` values are rejected because the backend does not resolve them for `executionOptions`. Passing an empty `execution_options={}` is an error — omit the keyword instead.
+
+If a component itself declares an input named `max_cache_staleness` or `execution_options`, bind that component argument separately while using the call-site keyword for task metadata:
+
+```python
+result = work.bind(max_cache_staleness="component-input-value")(
+    message="hello",
+    max_cache_staleness="P0D",
+)
+```
+
+The bound value remains under `arguments.max_cache_staleness`; the call-site value emits as `executionOptions`. Tangle applies caching and retries to container-component tasks, so `subpipeline(...)(max_cache_staleness=...)` and `subpipeline(...)(execution_options=...)` are rejected with guidance to set them on tasks inside the child pipeline. A child graph input with either name remains available through `subpipeline(...).bind(...)`.
+
+See `examples/python_pipeline/execution_options_pipeline.py` for a runnable example.
+
 ##### Task images, dependencies, and image IDs
 
 Use `@task(image="...")` to write the component image directly. Use `dependencies_from="pyproject.toml"` when generated components need to install Python dependencies. Several tasks can share one authoring-only `TaskEnv`:

{tangle_cli-0.1.7 → tangle_cli-0.1.10}/README.md

@@ -60,6 +60,57 @@ API-backed commands commonly accept these options. Explicit CLI options win over
 | `--config` | YAML/JSON defaults. Many commands accept a single object, a list of objects, or `_defaults` + `configs`. |
 | `--log-type` | SDK progress logs: `console`, `none`, or `file`. Logs go to stderr or a temp log file so structured stdout stays parseable. |
 | `TANGLE_VERBOSE=1` | Redacted HTTP request/response diagnostics only. This is separate from normal progress logging. |
+| `--ca-bundle` | Global CLI flag: path to a PEM CA bundle used as the TLS trust store for every transport. Overrides `TANGLE_API_CA_BUNDLE`. Place before the subcommand. |
+| `--verify-tls` / `--no-verify-tls` | Global CLI flag: enable or disable TLS verification for every transport. Overrides `TANGLE_API_VERIFY_TLS`. `--no-verify-tls` is local-development only. Place before the subcommand. |
+| `TANGLE_API_CA_BUNDLE` | Path to a PEM CA bundle used to verify TLS for every transport. Use this to trust a private or corporate CA without disabling verification. |
+| `TANGLE_API_VERIFY_TLS` | TLS verification toggle. Values `0`, `false`, or `no` (case/space-insensitive) disable verification; any other nonempty value keeps it on. |
+
+### TLS verification
+
+TLS certificate verification is enabled by default for all HTTP transports (schema
+fetches, `tangle api` calls, and the programmatic clients). The effective setting is
+resolved with the following precedence, highest to lowest:
+
+1. An explicit `verify=` argument to the Python clients (a `bool` or a path to a CA bundle).
+2. The global CLI flags `--ca-bundle` / `--verify-tls` / `--no-verify-tls`.
+3. `TANGLE_API_CA_BUNDLE` — verify against the given CA bundle.
+4. `TANGLE_API_VERIFY_TLS` — enable or disable verification.
+5. The secure default: verification enabled against the system trust store.
+
+The global CLI flags are true root options that apply to every command — the static
+`tangle sdk ...` clients, the dynamic `tangle api ...` commands, and `tangle api refresh`.
+Place them **before** the subcommand, for example `tangle --ca-bundle ca.pem api ...` or
+`tangle --no-verify-tls sdk ...`. They are honored even by the dynamic OpenAPI schema
+discovery that runs before command dispatch. A defaulted (absent) flag does not override
+the environment: when a flag is not supplied, the `TANGLE_API_*` variables and the standard
+`REQUESTS_CA_BUNDLE` / `CURL_CA_BUNDLE` handling still apply. `--ca-bundle` combined with an
+explicit `--no-verify-tls` is contradictory and fails fast before any request; `--ca-bundle`
+with `--verify-tls` is redundant but accepted.
+
+If both env vars are set, `TANGLE_API_CA_BUNDLE` wins and TLS stays verified against the
+bundle. Empty values are treated as unset. A `--ca-bundle` or `TANGLE_API_CA_BUNDLE` that
+does not point to an existing file fails fast with an actionable error before any request is
+made. When no Tangle-specific setting is provided, the standard `REQUESTS_CA_BUNDLE` /
+`CURL_CA_BUNDLE` handling and any caller-supplied `requests.Session.verify` are left
+untouched.
+
+For a private CA, prefer `--ca-bundle` / `TANGLE_API_CA_BUNDLE` over disabling verification:
+it keeps certificates verified against a trusted root. `--no-verify-tls` /
+`TANGLE_API_VERIFY_TLS=0` disables verification entirely and is intended for local
+development only — never use it against production endpoints.
+
+```bash
+# Trust a private CA with the global flag (recommended for internal/self-hosted APIs)
+uv run tangle --ca-bundle /etc/ssl/private-ca.pem \
+  api refresh --base-url https://internal.example
+
+# Or via environment variable
+TANGLE_API_CA_BUNDLE=/etc/ssl/private-ca.pem \
+  uv run tangle api refresh --base-url https://internal.example
+
+# Disable verification (local development only)
+uv run tangle --no-verify-tls api refresh --base-url https://localhost:8443
+```
 
 Examples for protected APIs:
 
@@ -323,6 +374,95 @@ def greeting_pipeline(who: In[str], cfg) -> Out[str]:
 
 Task IDs default from the left-hand variable name at the call site, converted to title case. If there is no simple left-hand variable, or if you want a stable explicit label, call `.named("Task Id")` before invoking the task. Use `.bind(...)` to pre-fill task arguments and `.with_annotations({...})` to add per-task annotations.
 
+##### Conditional task execution
+
+Pipeline inputs used as conditions are ordinary `In[str]` values; there is no special conditional input annotation. Pass the value through the reserved task-call metadata keyword `is_enabled=`:
+
+```python
+@pipeline("Conditional greeting")
+def conditional_greeting(enabled: In[str]) -> Out[str]:
+    greeting = write_greeting(who="world", is_enabled=enabled)
+    return greeting.out
+```
+
+This emits the canonical task field rather than a component argument:
+
+```yaml
+isEnabled:
+  graphInput:
+    inputName: enabled
+```
+
+`is_enabled=` supports Python booleans (serialized as lowercase `"true"` / `"false"` strings), string constants, `In[...]` graph inputs, and previous task outputs such as `is_enabled=gate.Output`. It is container-component task metadata; component function parameters are not implicitly conditions.
+
+If a component itself declares an input named `is_enabled`, bind that component argument separately while using the call-site keyword for task metadata:
+
+```python
+@task(image="python:3.12")
+def work(is_enabled: str, message: str) -> str:
+    return message
+
+@pipeline("Input-name collision")
+def collision(runtime_condition: In[str]) -> Out[str]:
+    result = work.bind(is_enabled="component-input-value")(
+        message="hello",
+        is_enabled=runtime_condition,
+    )
+    return result.Output
+```
+
+The bound value remains under `arguments.is_enabled`; the call-site value emits as `isEnabled`. Tangle does not evaluate conditions on graph-component tasks, so `subpipeline(...)(is_enabled=...)` is rejected with guidance to condition tasks inside the child pipeline. A child graph input with that name remains available through `subpipeline(...).bind(is_enabled=...)(...)`. There is no `condition` alias.
+
+##### Task execution options and caching
+
+Tangle caches task results, so a task that reads state which changes between runs (a run's `createdBy`, wall-clock time, an external table that the graph does not depend on) must opt out of caching explicitly. Use the reserved task-call metadata keyword `max_cache_staleness=`:
+
+```python
+@pipeline("Scheduled-run gate")
+def scheduled_gate() -> Out[str]:
+    is_scheduled = read_runtime_state(
+        name="CLOUD_PIPELINES_PIPELINE_RUN_CREATED_BY",
+        max_cache_staleness="P0D",
+    )
+    return is_scheduled.Output
+```
+
+This emits the canonical task field rather than a component argument:
+
+```yaml
+executionOptions:
+  cachingStrategy:
+    maxCacheStaleness: P0D
+```
+
+`P0D` means "never reuse a cached result"; any other ISO-8601 duration (`P7D`) caps how stale a reusable result may be. For the rest of `ExecutionOptionsSpec`, use the general `execution_options=` passthrough:
+
+```python
+uploaded = flaky_upload(
+    payload=data.Output,
+    execution_options={"retryStrategy": {"maxRetries": 3}},
+)
+```
+
+Both keywords may be combined; `max_cache_staleness=` wins over a `cachingStrategy.maxCacheStaleness` supplied through `execution_options=`, and every other passthrough field is preserved. A mapping passed as `execution_options=` is never mutated, so one shared constant can be reused across tasks.
+
+Tangle models exactly two execution-option groups today — `cachingStrategy.maxCacheStaleness` and `retryStrategy.maxRetries` (required whenever `retryStrategy` is present). Any other key is rejected at compile time: the backend ignores unmodeled keys silently, so accepting one would advertise a setting that never takes effect.
+
+Execution options are STATIC compile-time settings, so `max_cache_staleness` takes an RFC3339 duration string and `retryStrategy.maxRetries` a non-negative integer. Graph inputs, task outputs, `dynamic_secret(...)`, and `raw(...)` values are rejected because the backend does not resolve them for `executionOptions`. Passing an empty `execution_options={}` is an error — omit the keyword instead.
+
+If a component itself declares an input named `max_cache_staleness` or `execution_options`, bind that component argument separately while using the call-site keyword for task metadata:
+
+```python
+result = work.bind(max_cache_staleness="component-input-value")(
+    message="hello",
+    max_cache_staleness="P0D",
+)
+```
+
+The bound value remains under `arguments.max_cache_staleness`; the call-site value emits as `executionOptions`. Tangle applies caching and retries to container-component tasks, so `subpipeline(...)(max_cache_staleness=...)` and `subpipeline(...)(execution_options=...)` are rejected with guidance to set them on tasks inside the child pipeline. A child graph input with either name remains available through `subpipeline(...).bind(...)`.
+
+See `examples/python_pipeline/execution_options_pipeline.py` for a runnable example.
+
 ##### Task images, dependencies, and image IDs
 
 Use `@task(image="...")` to write the component image directly. Use `dependencies_from="pyproject.toml"` when generated components need to install Python dependencies. Several tasks can share one authoring-only `TaskEnv`:

{tangle_cli-0.1.7 → tangle_cli-0.1.10}/packages/tangle-cli/src/tangle_cli/__init__.py

@@ -14,6 +14,6 @@ from tangle_cli.dynamic_discovery_client import TangleDynamicDiscoveryClient
 try:
     __version__ = metadata_version("tangle-cli")
 except PackageNotFoundError:
-    __version__ = "0.1.7"
+    __version__ = "0.1.10"
 
 __all__ = ["TangleDynamicDiscoveryClient", "__version__"]

{tangle_cli-0.1.7 → tangle_cli-0.1.10}/packages/tangle-cli/src/tangle_cli/api_cli.py

@@ -640,10 +640,22 @@ def _argv_dispatches_dynamic_command(argv: list[str]) -> bool:
 
 
 def _api_argv_tail(argv: list[str]) -> list[str] | None:
-    """Return args after the root `api` command, or None for non-API invocations."""
+    """Return args after the root `api` command, or None for non-API invocations.
+
+    Global TLS flags (``--ca-bundle``/``--verify-tls``/``--no-verify-tls``) may
+    precede the subcommand, so they are skipped before locating `api`.
+    """
 
     args = list(argv[1:])
-    for index, arg in enumerate(args):
+    index = 0
+    while index < len(args):
+        arg = args[index]
+        if arg == "--ca-bundle" and index + 1 < len(args):
+            index += 2
+            continue
+        if arg.startswith("--ca-bundle=") or arg in {"--verify-tls", "--no-verify-tls"}:
+            index += 1
+            continue
         if arg == "--":
             if index + 1 < len(args) and args[index + 1] == "api":
                 return args[index + 2 :]

{tangle_cli-0.1.7 → tangle_cli-0.1.10}/packages/tangle-cli/src/tangle_cli/api_schema.py

@@ -18,7 +18,9 @@ from .api_transport import (
     _normalize_base_url,
     _openapi_url,
     _request_headers,
+    _VERIFY_UNSET,
     default_base_url,
+    httpx_verify,
 )
 
 SUPPORTED_METHODS = {"get", "post", "put", "patch", "delete"}
@@ -122,6 +124,7 @@ def fetch_schema(
     auth_header: str | None = None,
     headers: dict[str, str] | None = None,
     include_env_credentials: bool = True,
+    verify: Any = _VERIFY_UNSET,
 ) -> dict[str, Any]:
     """Fetch ``/openapi.json``, applying bearer and custom auth headers."""
 
@@ -136,6 +139,7 @@ def fetch_schema(
             include_env_credentials=include_env_credentials,
         ),
         timeout=DEFAULT_TIMEOUT_SECONDS,
+        verify=httpx_verify(verify),
     )
     response.raise_for_status()
     payload = response.text
@@ -152,6 +156,7 @@ def refresh_schema(
     auth_header: str | None = None,
     headers: dict[str, str] | None = None,
     include_env_credentials: bool = True,
+    verify: Any = _VERIFY_UNSET,
 ) -> tuple[dict[str, Any], Path]:
     """Fetch and cache the latest schema for a backend."""
 
@@ -163,6 +168,7 @@ def refresh_schema(
         auth_header,
         headers,
         include_env_credentials=include_env_credentials,
+        verify=verify,
     )
     path = write_cached_schema(schema, base_url)
     return schema, path
@@ -175,6 +181,7 @@ def load_or_fetch_schema(
     auth_header: str | None = None,
     headers: dict[str, str] | None = None,
     include_env_credentials: bool = True,
+    verify: Any = _VERIFY_UNSET,
 ) -> dict[str, Any]:
     """Use a cached schema when available, otherwise fetch once and cache it."""
 
@@ -188,6 +195,7 @@ def load_or_fetch_schema(
         auth_header,
         headers,
         include_env_credentials=include_env_credentials,
+        verify=verify,
     )
     return schema
 

{tangle_cli-0.1.7 → tangle_cli-0.1.10}/packages/tangle-cli/src/tangle_cli/api_transport.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import json
 import os
 import re
+import ssl
 import sys
 import urllib.parse
 from pathlib import Path
@@ -16,6 +17,20 @@ DEFAULT_API_URL = "http://localhost:8000"
 DEFAULT_TIMEOUT_SECONDS = 30.0
 _HEADER_NAME_RE = re.compile(r"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$")
 _MISSING = object()
+
+# Canonical resolved TLS verification value: ``True``/``False`` or a CA bundle
+# path. Both requests and httpx transports adapt this single contract.
+VerifyValue = bool | str
+VerifyArgument = bool | str | os.PathLike[str] | None
+_VERIFY_UNSET = object()
+_TLS_FALSE_VALUES = frozenset({"0", "false", "no"})
+
+# Process-wide TLS override set from global CLI flags (``--ca-bundle`` /
+# ``--verify-tls`` / ``--no-verify-tls``). It sits between an explicit
+# ``verify=`` argument and the environment variables in :func:`resolve_verify`,
+# so a single resolver serves every transport, including the schema discovery
+# that runs before normal command dispatch.
+_CLI_VERIFY_OVERRIDE: Any = _VERIFY_UNSET
 _SENSITIVE_HEADER_NAMES = {"authorization", "cloud-auth", "cookie", "x-api-key"}
 _SENSITIVE_KEY_RE = re.compile(
     r"(authorization|authentication|(^|[-_])auth($|[-_])|cloud[-_]?auth|cookie|x[-_]?api[-_]?key|token|secret|password|credential|pre[-_]?signed[-_]?url|signed[-_]?url)",
@@ -40,6 +55,115 @@ def tangle_verbose_enabled() -> bool:
     return value.strip().lower() in {"1", "true", "yes", "on"}
 
 
+def _parse_verify_flag(raw: str) -> bool:
+    """Interpret ``TANGLE_API_VERIFY_TLS``.
+
+    Only the case/space-insensitive values ``0``, ``false``, and ``no`` disable
+    verification; any other nonempty value keeps it enabled.
+    """
+
+    return raw.strip().lower() not in _TLS_FALSE_VALUES
+
+
+def _validate_ca_bundle(path: str, source: str) -> str:
+    """Return an existing CA bundle path or fail before any network request."""
+
+    candidate = Path(path).expanduser()
+    if not candidate.is_file():
+        raise SystemExit(
+            f"{source} points to a CA bundle that does not exist: {path!r}. "
+            "Provide a path to an existing PEM file, or unset it to use the "
+            "system trust store."
+        )
+    return str(candidate)
+
+
+def _coerce_explicit_verify(value: bool | str | os.PathLike[str]) -> VerifyValue:
+    if isinstance(value, bool):
+        return value
+    if isinstance(value, (str, os.PathLike)):
+        return _validate_ca_bundle(os.fspath(value), "verify")
+    raise SystemExit("verify must be a bool or a path to a CA bundle file")
+
+
+def configure_cli_verify(
+    ca_bundle: str | os.PathLike[str] | None = None,
+    verify_tls: bool | None = None,
+) -> None:
+    """Install (or clear) the process-wide TLS override from global CLI flags.
+
+    ``ca_bundle`` is a path to a PEM trust store; ``verify_tls`` is the tri-state
+    ``--verify-tls`` / ``--no-verify-tls`` flag where ``None`` means the flag was
+    not supplied. A ``--ca-bundle`` combined with an explicit
+    ``--no-verify-tls`` is contradictory and fails fast before any network
+    request. Passing neither clears any previously installed override.
+
+    The resolved value is validated here so an invalid or missing CA bundle
+    fails before dynamic schema discovery. It is consulted by
+    :func:`resolve_verify` for every transport.
+    """
+
+    global _CLI_VERIFY_OVERRIDE
+    if ca_bundle is not None:
+        if verify_tls is False:
+            raise SystemExit(
+                "--ca-bundle cannot be combined with --no-verify-tls: a CA "
+                "bundle only takes effect when verification is enabled. Drop "
+                "one of the two flags."
+            )
+        _CLI_VERIFY_OVERRIDE = _validate_ca_bundle(os.fspath(ca_bundle), "--ca-bundle")
+        return
+    if verify_tls is not None:
+        _CLI_VERIFY_OVERRIDE = bool(verify_tls)
+        return
+    _CLI_VERIFY_OVERRIDE = _VERIFY_UNSET
+
+
+def resolve_verify(verify: Any = _VERIFY_UNSET) -> Any:
+    """Resolve the effective TLS verification setting.
+
+    Precedence, highest to lowest: an explicit ``verify`` argument, the global
+    CLI override (``--ca-bundle`` / ``--verify-tls`` / ``--no-verify-tls``), a
+    nonempty ``TANGLE_API_CA_BUNDLE``, ``TANGLE_API_VERIFY_TLS``, then a secure
+    enabled default. When none of these are set, ``_VERIFY_UNSET`` is returned
+    so callers can preserve library and caller defaults (for example requests'
+    ``REQUESTS_CA_BUNDLE``/``CURL_CA_BUNDLE`` handling and a caller-supplied
+    ``Session.verify``). Empty environment values are treated as unset.
+    """
+
+    if verify is not _VERIFY_UNSET and verify is not None:
+        return _coerce_explicit_verify(verify)
+    if _CLI_VERIFY_OVERRIDE is not _VERIFY_UNSET:
+        return _CLI_VERIFY_OVERRIDE
+    ca_bundle = os.environ.get("TANGLE_API_CA_BUNDLE", "")
+    if ca_bundle.strip():
+        return _validate_ca_bundle(ca_bundle.strip(), "TANGLE_API_CA_BUNDLE")
+    flag = os.environ.get("TANGLE_API_VERIFY_TLS", "")
+    if flag.strip():
+        return _parse_verify_flag(flag)
+    return _VERIFY_UNSET
+
+
+def resolve_verify_default(verify: Any = _VERIFY_UNSET) -> VerifyValue:
+    """Like :func:`resolve_verify`, but fall back to the secure ``True`` default."""
+
+    resolved = resolve_verify(verify)
+    return True if resolved is _VERIFY_UNSET else resolved
+
+
+def httpx_verify(verify: Any = _VERIFY_UNSET) -> bool | ssl.SSLContext:
+    """Adapt the resolved verify value to what httpx expects.
+
+    httpx 0.28 deprecates string CA-bundle paths, so a path is turned into an
+    :class:`ssl.SSLContext`; booleans pass through unchanged.
+    """
+
+    resolved = resolve_verify_default(verify)
+    if isinstance(resolved, bool):
+        return resolved
+    return ssl.create_default_context(cafile=resolved)
+
+
 def _redact_headers(headers: dict[str, Any] | None) -> dict[str, Any]:
     redacted: dict[str, Any] = {}
     for name, value in (headers or {}).items():
@@ -280,6 +404,7 @@ def request_operation(
     timeout: float = DEFAULT_TIMEOUT_SECONDS,
     allow_body_file_references: bool = False,
     include_env_credentials: bool = True,
+    verify: Any = _VERIFY_UNSET,
 ) -> httpx.Response:
     """Dispatch one normalized OpenAPI operation as an HTTP request.
 
@@ -306,6 +431,7 @@ def request_operation(
         content=content,
         headers=request_headers,
         timeout=timeout,
+        verify=httpx_verify(verify),
     )
     if tangle_verbose_enabled():
         log_http_exchange(

{tangle_cli-0.1.7 → tangle_cli-0.1.10}/packages/tangle-cli/src/tangle_cli/artifacts_cli.py

@@ -80,6 +80,7 @@ def artifacts_get(
                 header=args.header,
                 include_env_credentials=include_env_credentials_for_args(args, base_url),
                 command_name="artifact commands",
+                logger=logger,
             )
             if require_available := getattr(client, "require_available", None):
                 require_available()