toolframe-auth 0.3.0__tar.gz → 0.3.2__tar.gz

{toolframe_auth-0.3.0 → toolframe_auth-0.3.2}/.github/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}/toolframe-sdk
-          ref: 2cd153ec36c585a9adb5ad566effc2985d9e222d
+          ref: 539ced4dbdf9e303ec0f0205a35d65287a480b2a
           path: toolframe-sdk
           token: ${{ secrets.TOOLFRAME_READ_TOKEN || secrets.TOOLFRAME_DEPENDENCIES_TOKEN || github.token }}
           persist-credentials: false
@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}/toolframe-sql-sqlite
-          ref: a2764f83840fb8ad71d7eaf138c7e09799ce19bd
+          ref: d4f3fcf9d8145fd0dab3d57aad8a452fb5aa527b
           path: toolframe-sql-sqlite
           token: ${{ secrets.TOOLFRAME_READ_TOKEN || secrets.TOOLFRAME_DEPENDENCIES_TOKEN || github.token }}
           persist-credentials: false

toolframe_auth-0.3.2/.github/workflows/compatibility.yml

@@ -0,0 +1,85 @@
+name: SDK compatibility
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 4 * * *'
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  wheel:
+    name: Build the shared plugin wheel
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - run: uv build --no-sources --wheel --out-dir build/compatibility-wheel
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: compatibility-wheel
+          path: build/compatibility-wheel/*.whl
+          if-no-files-found: error
+          retention-days: 7
+
+  compatibility:
+    name: SDK ${{ matrix.sdk }}
+    needs: wheel
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        sdk: [minimum, latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: compatibility-wheel
+          path: build/compatibility-wheel
+      - name: Select the unchanged wheel
+        id: wheels
+        shell: bash
+        run: |
+          plugin=(build/compatibility-wheel/toolframe_auth-*.whl)
+          test "${#plugin[@]}" = 1
+          echo "plugin=${plugin[0]}" >> "$GITHUB_OUTPUT"
+      - name: Verify installed wheel and package tests
+        uses: toolframe/toolframe-sdk/.github/actions/plugin-compatibility@2e2a3d79f35fbdb04249e8351fe9c75fc2164269
+        with:
+          mode: ${{ matrix.sdk }}
+          wheel: ${{ steps.wheels.outputs.plugin }}
+          output: build/compatibility-${{ matrix.sdk }}
+      - name: Retain compatibility evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: compatibility-${{ matrix.sdk }}
+          path: |
+            build/compatibility-${{ matrix.sdk }}/report.json
+            build/compatibility-${{ matrix.sdk }}/pytest.xml
+          if-no-files-found: warn
+          retention-days: 14

{toolframe_auth-0.3.0 → toolframe_auth-0.3.2}/.github/workflows/publish.yml

@@ -2,21 +2,12 @@ name: Publish Python package
 
 on:
   workflow_dispatch:
-    inputs:
-      repository:
-        description: Package index (run this workflow on a v<project.version> tag)
-        type: choice
-        options:
-          - testpypi
-          - pypi
-        default: testpypi
-        required: true
 
 permissions:
   contents: read
 
 concurrency:
-  group: publish-${{ github.repository }}-${{ github.ref }}-${{ inputs.repository }}
+  group: publish-${{ github.repository }}-${{ github.ref }}-pypi
   cancel-in-progress: false
 
 jobs:
@@ -26,12 +17,15 @@ jobs:
     with:
       release-ref: ${{ github.ref }}
 
+  compatibility:
+    uses: ./.github/workflows/compatibility.yml
+
   publish:
-    needs: validate
+    needs: [validate, compatibility]
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     environment:
-      name: ${{ inputs.repository }}
+      name: pypi
     permissions:
       id-token: write
     steps:
@@ -41,15 +35,7 @@ jobs:
           name: toolframe-auth-dist
           path: dist
 
-      - name: Publish to TestPyPI
-        if: inputs.repository == 'testpypi'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
-        with:
-          repository-url: https://test.pypi.org/legacy/
-          packages-dir: dist/
-
       - name: Publish to PyPI
-        if: inputs.repository == 'pypi'
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: dist/

{toolframe_auth-0.3.0 → toolframe_auth-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: toolframe-auth
-Version: 0.3.0
+Version: 0.3.2
 Summary: Managed access passwords and sessions for Toolframe
 Project-URL: Homepage, https://github.com/toolframe/toolframe-auth
 Project-URL: Repository, https://github.com/toolframe/toolframe-auth
@@ -11,21 +11,21 @@ License-Expression: Apache-2.0
 License-File: LICENSE
 License-File: NOTICE
 Requires-Python: >=3.14
-Requires-Dist: toolframe-sdk==0.4.0
+Requires-Dist: toolframe-sdk<1,>=0.4.0
 Description-Content-Type: text/markdown
 
 # Toolframe Auth
 
 Authentication and grant decisions for access passwords, federated users and
 revocable agent delegation. This provider owns `auth`'s managed SQL store; it never opens
-database files itself. It requires SDK 0.4.0 and `toolframe.sql`.
+database files itself. It requires SDK 0.4 and `toolframe.sql`.
 
 ## Install
 
 With a running Toolframe application and an active SQL storage provider:
 
 ```sh
-toolframe --home APP plugin add pypi:toolframe-auth==0.3.0 --enable
+toolframe --home APP plugin add pypi:toolframe-auth==0.3.2 --enable
 ```
 
 The [Entry Register template](https://github.com/toolframe/toolframe-core#readme)
@@ -107,7 +107,7 @@ uv build --wheel
 
 For the same isolated lint, tests, distribution and wheel-install checks used by
 GitHub Actions, run `python3.14 scripts/ci.py`. See [CI and publishing](docs/ci.md)
-for pinned sibling sources, local requirements and TestPyPI/PyPI setup.
+for pinned sibling sources, local requirements and PyPI setup.
 
 Core owns access policy. Its compatible OIDC integration supports
 `access.failure_mode = "closed"` for protected deployments; the default preserves
@@ -122,10 +122,13 @@ Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) and [NOTI
 
 ## PostgreSQL storage
 
-Version 0.2 requires SDK 0.3 and declares PostgreSQL migration SQL alongside the
+Version 0.3 requires SDK 0.4 and declares PostgreSQL migration SQL alongside the
 unchanged SQLite history. Provision this plugin’s stable store owner with the
 PostgreSQL provider before enabling it. The application still runs one Core;
 retain its private keys and configuration with the application home. Existing
 SQLite records are not imported automatically.
 
 For development hooks and contribution rules, see [Contributing](CONTRIBUTING.md).
+
+Plugin dependencies allow compatible SDK 0.x updates from the declared minimum.
+See the [SDK compatibility policy](https://github.com/toolframe/toolframe-sdk/blob/main/docs/compatibility.md) for API guarantees and minimum/latest verification.

{toolframe_auth-0.3.0 → toolframe_auth-0.3.2}/README.md

@@ -2,14 +2,14 @@
 
 Authentication and grant decisions for access passwords, federated users and
 revocable agent delegation. This provider owns `auth`'s managed SQL store; it never opens
-database files itself. It requires SDK 0.4.0 and `toolframe.sql`.
+database files itself. It requires SDK 0.4 and `toolframe.sql`.
 
 ## Install
 
 With a running Toolframe application and an active SQL storage provider:
 
 ```sh
-toolframe --home APP plugin add pypi:toolframe-auth==0.3.0 --enable
+toolframe --home APP plugin add pypi:toolframe-auth==0.3.2 --enable
 ```
 
 The [Entry Register template](https://github.com/toolframe/toolframe-core#readme)
@@ -91,7 +91,7 @@ uv build --wheel
 
 For the same isolated lint, tests, distribution and wheel-install checks used by
 GitHub Actions, run `python3.14 scripts/ci.py`. See [CI and publishing](docs/ci.md)
-for pinned sibling sources, local requirements and TestPyPI/PyPI setup.
+for pinned sibling sources, local requirements and PyPI setup.
 
 Core owns access policy. Its compatible OIDC integration supports
 `access.failure_mode = "closed"` for protected deployments; the default preserves
@@ -106,10 +106,13 @@ Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) and [NOTI
 
 ## PostgreSQL storage
 
-Version 0.2 requires SDK 0.3 and declares PostgreSQL migration SQL alongside the
+Version 0.3 requires SDK 0.4 and declares PostgreSQL migration SQL alongside the
 unchanged SQLite history. Provision this plugin’s stable store owner with the
 PostgreSQL provider before enabling it. The application still runs one Core;
 retain its private keys and configuration with the application home. Existing
 SQLite records are not imported automatically.
 
 For development hooks and contribution rules, see [Contributing](CONTRIBUTING.md).
+
+Plugin dependencies allow compatible SDK 0.x updates from the declared minimum.
+See the [SDK compatibility policy](https://github.com/toolframe/toolframe-sdk/blob/main/docs/compatibility.md) for API guarantees and minimum/latest verification.

{toolframe_auth-0.3.0 → toolframe_auth-0.3.2}/docs/ci.md

@@ -14,8 +14,8 @@ never used or modified.
 
 | Repository | Required commit |
 | --- | --- |
-| `toolframe-sdk` | `2cd153ec36c585a9adb5ad566effc2985d9e222d` |
-| `toolframe-sql-sqlite` | `a2764f83840fb8ad71d7eaf138c7e09799ce19bd` |
+| `toolframe-sdk` | `539ced4dbdf9e303ec0f0205a35d65287a480b2a` |
+| `toolframe-sql-sqlite` | `d4f3fcf9d8145fd0dab3d57aad8a452fb5aa527b` |
 
 By default, both repositories are siblings of this checkout. Use `--sdk-repo`
 and `--storage-repo` to point to other local clones. Internet access is required
@@ -68,14 +68,13 @@ the default `GITHUB_TOKEN` cannot read another private repository. Fork pull
 requests cannot access that secret and require publicly readable dependencies
 to pass. Checkout credentials are not persisted.
 
-`publish.yml` supports manual dispatch only, with `testpypi` as the default and
-`pypi` as the other selection. Run it on an existing tag named exactly
-`v<project.version>` (currently `v0.1.1`). A branch ref or mismatched tag fails
-the version gate. The reusable CI workflow validates the selected `github.sha`,
+`publish.yml` publishes to PyPI on manual dispatch only. Run it on an existing
+tag named exactly `v<project.version>`. A branch ref or mismatched tag fails the
+version gate. The reusable CI workflow validates the selected `github.sha`,
 and publishing downloads only that run's validated artifact. The publishing
 job has a 10-minute timeout and is the only job with `id-token: write`. It does
 not rebuild the distributions. Duplicate uploads fail; existing files are not
-silently skipped. Publish runs for the same tag and index are serialized without
+silently skipped. Publish runs for the same tag are serialized without
 cancelling an in-progress run.
 
 ## Publication

{toolframe_auth-0.3.0 → toolframe_auth-0.3.2}/docs/releasing.md

@@ -1,6 +1,6 @@
 # Releasing toolframe-auth
 
-The distribution name is `toolframe-auth`; its current version is `0.2.0`.
+The distribution name is `toolframe-auth`. The version is defined in `pyproject.toml`.
 Release tags must exactly match `v<project.version>`. Ordinary CI never uploads
 packages. The manual `publish.yml` workflow reruns validation and publishes only
 artifacts produced by that successful run.
@@ -10,13 +10,14 @@ artifacts produced by that successful run.
 Run the repository's existing validation workflow; its local commands and
 integration coverage are described in [CI](ci.md).
 
-Publish `toolframe-sdk==0.4.0` first. The coordinated order and native CLI channels are documented in
+Publish any newly required SDK version before the plugin. Compatible Core or SDK
+updates alone do not require a plugin release. The coordinated order and native CLI channels are documented in
 [Toolframe's release guide](https://github.com/toolframe/toolframe-core/blob/main/docs/releasing.md).
 
 ## Trusted Publishers
 
-Create GitHub environments named `testpypi` and `pypi`. On each corresponding
-package index, configure a normal or pending Trusted Publisher with these values:
+Create a GitHub environment named `pypi`. On PyPI, configure a normal or
+pending Trusted Publisher with these values:
 
 | Field | Value |
 | --- | --- |
@@ -24,7 +25,7 @@ package index, configure a normal or pending Trusted Publisher with these values
 | GitHub owner | `toolframe` |
 | GitHub repository | `toolframe-auth` |
 | Workflow filename | `publish.yml` |
-| Environment | `testpypi` or `pypi`, matching the index |
+| Environment | `pypi` |
 
 If publishing from another owner, use that actual owner in the publisher binding.
 Follow [PyPI's Trusted Publishing guide](https://docs.pypi.org/trusted-publishers/using-a-publisher/).
@@ -40,7 +41,7 @@ sibling owner where the workflow exposes that variable.
 ## Publish and verify
 
 After the release commit and matching tag are available remotely, manually run
-`publish.yml` at `v0.2.0`, selecting `testpypi` first and then `pypi`.
+`publish.yml` at the matching `v<project.version>` tag to publish to PyPI.
 A branch or mismatched tag is rejected. Downloaded files are the artifacts from
 that run; the publishing job does not rebuild them. Published files cannot be
 replaced under the same version.
@@ -49,11 +50,11 @@ After PyPI publication, verify a clean installation:
 
 ```sh
 uv venv --python 3.14.7 build/consumer
-uv pip install --python build/consumer/bin/python 'toolframe-auth==0.3.0'
+uv pip install --python build/consumer/bin/python 'toolframe-auth==0.3.2'
 uv pip check --python build/consumer/bin/python
 ```
 
-TestPyPI does not mirror dependencies. Test the specific artifact against an
-explicit dependency source; a local or TestPyPI check alone does not demonstrate
-that production PyPI resolution works. Keep logs, hashes and exact revisions in
-CI artifacts or ignored local evidence directories.
+Test the specific artifact with dependencies from PyPI. Local artifact checks
+alone do not demonstrate that the published package resolves correctly from
+PyPI. Keep logs, hashes and exact revisions in CI artifacts or ignored local
+evidence directories.

{toolframe_auth-0.3.0 → toolframe_auth-0.3.2}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "toolframe-auth"
-version = "0.3.0"
+version = "0.3.2"
 description = "Managed access passwords and sessions for Toolframe"
 readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 authors = [{ name = "byfb", email = "62798989+byfb@users.noreply.github.com" }]
 requires-python = ">=3.14"
-dependencies = ["toolframe-sdk==0.4.0"]
+dependencies = ["toolframe-sdk<1,>=0.4.0"]
 
 [project.urls]
 Homepage = "https://github.com/toolframe/toolframe-auth"
@@ -23,7 +23,7 @@ Issues = "https://github.com/toolframe/toolframe-auth/issues"
 auth = "toolframe_auth.plugin:plugin"
 
 [dependency-groups]
-dev = ["pytest>=8,<10", "pytest-asyncio>=1,<2", "ruff>=0.12,<1", "toolframe-sql-sqlite==0.4.0"]
+dev = ["pytest>=8,<10", "pytest-asyncio>=1,<2", "ruff>=0.12,<1", "toolframe-sql-sqlite>=0.4.1,<0.5"]
 
 [tool.uv.sources]
 toolframe-sdk = { path = "../toolframe-sdk", editable = true }

{toolframe_auth-0.3.0 → toolframe_auth-0.3.2}/scripts/ci.py

@@ -16,8 +16,8 @@ from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
 DEPENDENCIES = {
-    "toolframe-sdk": "2cd153ec36c585a9adb5ad566effc2985d9e222d",
-    "toolframe-sql-sqlite": "a2764f83840fb8ad71d7eaf138c7e09799ce19bd",
+    "toolframe-sdk": "539ced4dbdf9e303ec0f0205a35d65287a480b2a",
+    "toolframe-sql-sqlite": "d4f3fcf9d8145fd0dab3d57aad8a452fb5aa527b",
 }
 
 
@@ -229,7 +229,7 @@ from toolframe_auth.crypto import new_verifier, verifier
 location = pathlib.Path(toolframe_auth.__file__).resolve()
 assert location.is_relative_to(pathlib.Path(sys.prefix).resolve())
 assert metadata.version("toolframe-auth") == sys.argv[1]
-assert metadata.version("toolframe-sdk") == "0.4.0"
+assert metadata.version("toolframe-sdk") == "0.4.1"
 entry_point, = metadata.distribution("toolframe-auth").entry_points
 assert entry_point.group == "toolframe.plugins" and entry_point.name == "auth"
 assert entry_point.load() is plugin

{toolframe_auth-0.3.0 → toolframe_auth-0.3.2}/uv.lock

@@ -282,7 +282,7 @@ wheels = [
 
 [[package]]
 name = "toolframe-auth"
-version = "0.3.0"
+version = "0.3.2"
 source = { editable = "." }
 dependencies = [
     { name = "toolframe-sdk" },
@@ -309,7 +309,7 @@ dev = [
 
 [[package]]
 name = "toolframe-sdk"
-version = "0.4.0"
+version = "0.4.1"
 source = { editable = "../toolframe-sdk" }
 dependencies = [
     { name = "jsonschema" },
@@ -332,11 +332,12 @@ dev = [
     { name = "pytest", specifier = ">=8,<10" },
     { name = "pytest-asyncio", specifier = ">=1,<2" },
     { name = "ruff", specifier = ">=0.12,<1" },
+    { name = "tomlkit", specifier = ">=0.13,<1" },
 ]
 
 [[package]]
 name = "toolframe-sql-sqlite"
-version = "0.4.0"
+version = "0.4.1"
 source = { editable = "../toolframe-sql-sqlite" }
 dependencies = [
     { name = "toolframe-sdk" },