water-ogcapi 0.1.0__tar.gz

water_ogcapi-0.1.0/.agents/skills/live-api/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: live-api
+description: Use before sending any request to the live NWIS, FabricData, or GeoConnex endpoints, including recording test fixtures, writing or running network-marked tests, checking rate-limit or auth headers, and writing up API behavior findings. Covers credential handling, quota limits, and what evidence to keep.
+---
+
+# Working against the live endpoints
+
+These are production services that USGS runs for every user. Base URLs are in
+`README.md`.
+
+## Credentials
+
+A leaked key ends up in git history, CI logs, or a public issue, where anyone can spend
+its quota. Recorded fixtures and copied URLs are the easy ways for it to reach disk.
+
+- Read the key from the `USGS_API_KEY` environment variable. Never print it or write it
+    into a file, commit, issue, or chat message. Run an offline probe of code that reads
+    the variable as `env -u USGS_API_KEY <probe>` or with a fake value, and print only
+    comparisons (`headers["X-Api-Key"] == FAKE`); put `env -u` on the probe command
+    only, since the redaction filter below reads the variable.
+- USGS documents two forms: an `X-Api-Key` request header and an `api_key` query
+    parameter. Use the header. The query form puts the key in the request URL, and the
+    server may echo query parameters into the `next` links of the response body.
+- Scrub at record time, before anything is written to disk. Store no request headers.
+- GeoConnex takes no key. Never send it one.
+- The HTTP/2 encoder logs headers: `hpack` writes every header value, the key included,
+    at DEBUG on its own logger, and the package raises that logger to INFO at import
+    (D-20). A test that the key never reaches a log captures the root logger at DEBUG
+    while the real encoder runs. A mocked transport skips the encoder, so it proves only
+    the layers above it.
+- A server can echo the key back: a redirect's `Location` has carried it as a query
+    parameter. Pipe every probe's output through a filter that replaces the key's value,
+    and request a base URL with its trailing slash, since the bare form redirects.
+
+```bash
+<probe command> 2>&1 | python3 -c 'import os, sys; k = os.environ["USGS_API_KEY"]; sys.stdout.writelines(l.replace(k, "REDACTED") for l in sys.stdin)'
+```
+
+- Before finishing, scan for the current key. The command fails loudly when the variable
+    is unset or empty, prints file names only, and keeps the key off the command line.
+    No output means the current key is not in the working tree; it cannot find old or
+    encoded keys.
+
+```bash
+: "${USGS_API_KEY:?}" && command grep -rlF -f <(printenv USGS_API_KEY) . --exclude-dir=.git --exclude-dir=.pixi
+```
+
+## Quota
+
+- Keep probes small: a low `limit`, one page unless the question is about paging.
+- When a script derives a committed artifact (a snapshot, a fixture) from a live
+    response, save the raw response once, scrubbed as a fixture is, to the scratchpad
+    and never the repo, and develop the derivation against that file. Refetch only to
+    confirm the final artifact.
+- A test run reaches the live services only with `-m network` (`test-network`) or
+    `-m ''` (`test-all`); `addopts` deselects network-marked tests everywhere else, so a
+    narrowed run (`pixi r -e test315 pytest tests/test_x.py`) stays offline.
+- Probe through `Transport(max_retries=0)` so one call sends one request. The default
+    retries up to three times, and the caller never sees the intermediate responses.
+- Read `X-RateLimit-Remaining` on each response and stop well before zero. It lags a
+    burst of requests by a few seconds, so space probes out. If a service sends no
+    `X-RateLimit-*` headers, keep to a handful of requests per task.
+- Never provoke a 429. Test rate-limit handling against `httpx2.MockTransport` only.
+- Make network tests for FabricData skip when the backend does not respond.
+
+## Stable targets
+
+- NWIS: monitoring location `01646500` (Potomac River near Washington, DC), and a small
+    bounding box around Washington, DC.
+- GeoConnex: the 22 two-digit HUCs in `hu02`, `01` to `22`.
+
+## Fixtures
+
+- Record from real responses. Keep the status, the response headers, and the body. Keep
+    the request URL and params with credentials removed.
+- A fixture stores the decoded body, so drop the headers that describe the wire bytes,
+    `content-encoding` and `content-length`: a mock serving a decoded body under
+    `content-encoding: gzip` tries to gunzip plain JSON. Never store `set-cookie`.
+    `scripts/record_fixtures.py` drops all three.
+- Record the request date with each fixture. The NWIS API is v1 and USGS may change it.
+- If `tests/fixtures/` does not exist yet, propose a layout before creating one.
+- Note which services send `X-RateLimit-*` headers. The quota logic depends on it.
+
+## Checking that the key is honored
+
+Send one keyed and one unkeyed request to the same endpoint and compare the
+`X-RateLimit-*` headers. A higher limit on the keyed response shows the key was honored.
+Equal limits or missing headers are inconclusive; record them as such.
+
+USGS raises a key's limit on request, and a raised key reports its own limit on every
+endpoint (D-30). A check made with such a key shows that key's limit, so record a
+default limit only from a key that has the default. Ignore `X-RateLimit-*` on a response
+with `x-cache: Hit`: CloudFront serves the headers stored with the cached response.
+
+## Writing up findings
+
+Write each finding as a neutral, reproducible observation:
+
+1. The request: method, URL with credentials removed, and date.
+1. What the response showed: status, the relevant headers, a short body excerpt.
+1. What was expected, citing the OGC API spec or the USGS docs.
+
+Keep what you observed apart from what you infer from it. `docs/design.md` Q-07 lists
+claims that are still unverified. Do not state any of them as fact until a live response
+confirms it.

water_ogcapi-0.1.0/.agents/skills/update-package/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: update-package
+description: Update this package's locked dependencies and pre-commit hooks, then land the change. `pixi update` refreshes pixi.lock, `pixi r pcupdate` moves the hook revisions, the full gate from AGENTS.md runs with the dependency audit and the network tests, findings the newer tools raise get fixed at their cause, and the change goes in through a PR merged once CI passes. Use when asked to update dependencies, refresh or bump the lock file, update the pre-commit hooks, or run /update-package.
+---
+
+# Update dependencies and hooks
+
+Asking for this skill is the go-ahead to push the branch, open the PR, and merge it once
+CI passes, for a contributor allowed to merge; anyone else stops at the open PR and asks
+a maintainer. It covers nothing else: no tag, no release, no force-push, no change to
+repository settings, and no merge while a required check is red or pending.
+
+`$SCRATCH` below is a scratch directory outside the repository.
+
+## 1. Preflight
+
+Stop at the first failure and report it. The tree must be clean and match `origin/main`,
+since the PR has to hold the update and nothing else:
+
+```bash
+git fetch -q origin
+DEF=$(git symbolic-ref --short refs/remotes/origin/HEAD | sed 's#^origin/##')
+test "$(git branch --show-current)" = "$DEF" &&
+  test -z "$(git status --porcelain)" &&
+  test "$(git rev-parse HEAD)" = "$(git rev-parse "origin/$DEF")"
+```
+
+Then branch, following the `<type>/<short-description>` rule in AGENTS.md:
+`B=chore/update-deps-$(date +%F); git switch -c "$B"`, adding `-2` for a second run the
+same day.
+
+## 2. Update
+
+```bash
+pixi update --json >| "$SCRATCH/pixi-update.json"
+pixi r pcupdate >| "$SCRATCH/pcupdate.log" 2>&1
+python3 .agents/skills/update-package/summarize.py "$SCRATCH/pixi-update.json"
+```
+
+The script prints one Markdown row per change (package, before, after, environments) and
+the change count on stderr; a report with no changes prints `0 package changes`. A row
+with the same version on both sides is a build-string change. The hook log names each
+hook that moved (`updating v0.16.10 -> v0.17.1`). Mark the changes to the runtime
+dependencies, `[project] dependencies` in `pyproject.toml` (`httpx2` and `h2`), since
+reviewers read those first. When neither `pixi.lock` nor `.pre-commit-config.yaml`
+changed, report that, delete the branch, and stop.
+
+## 3. Gate
+
+Delete `.coverage` and any `.coverage.*` files first, since coverage accumulates across
+runs (AGENTS.md, Gotchas). Then run, each to a clean exit:
+
+```bash
+pixi r lint && pixi r typecheck && pixi r -e test313 test && pixi r -e test315 test &&
+  pixi r docs && pixi r audit
+```
+
+- Lint runs the new hook versions over every file. When a formatter rewrites files, run
+    lint once more and keep the rewrite for its own commit.
+- The docs build and the audit belong here even with no change under `docs/`: a new
+    zensical or mkdocstrings can break the build, and a new resolution can pull in an
+    advisory.
+- When a runtime dependency moved, also run `pixi r -e test315 test-network`, following
+    the `live-api` skill. The offline tests mock the wire that `httpx2` drives, so they
+    cannot see a change in it.
+
+## 4. Fix what the new versions raise
+
+Fix each finding at its cause. Never silence one to pass: no new ignore, no lowered
+strictness in `pyproject.toml`, no skipped or loosened test, and no package pinned back
+without the maintainer's yes. A finding that needs a design call, or a package whose new
+version breaks something with no small fix, goes to the maintainer with the failing
+output and the options: fix it, pin an upper bound, or hold the package out by updating
+the others by name (`pixi update <pkg> ...`). A fix that makes or reverses a design
+decision updates `docs/design.md` in the same change.
+
+## 5. Commit
+
+One commit per concern, staged by path, each chained to the gate with nothing between
+the gate and `&&`:
+
+1. `chore: update pixi.lock`, the body giving the change count and the runtime changes;
+1. `chore: update pre-commit hooks`, the body naming each hook's new revision;
+1. a formatter rewrite from the new hooks: `style: apply <tool> <version> formatting`;
+1. each fix, as `fix:` or `refactor:`, naming what the new version changed.
+
+Check each with `git show --stat HEAD` before making the next.
+
+## 6. Pull request and merge
+
+Push the branch and open the PR from `.github/pull_request_template.md`: the runtime
+changes, the hook revisions, the full table in a collapsed `<details>` block, and the
+gate results, network tests and audit included. With no issue to close, say so on the
+body's first line in place of `Closes #`.
+
+Wait for CI without a polling loop where your agent's environment forbids one; in a
+plain terminal, `gh pr checks <n> --watch --fail-fast` blocks until the checks finish.
+The ruleset on `main` requires `Test (test313)`, `Test (test315)`, `typecheck`, `lint`,
+and `build`. A red check is fixed on the branch and pushed, back through steps 3 to 5.
+
+Merge only when every required check passes and the PR reads CLEAN, with a rebase merge:
+`gh pr merge <n> --rebase`. Record the branch tip first (`TIP=$(git rev-parse "$B")`),
+then:
+
+```bash
+git fetch -q origin
+test "$(git rev-parse "origin/$DEF^{tree}")" = "$(git rev-parse "$TIP^{tree}")" &&
+  git switch -q "$DEF" && git merge -q --ff-only "origin/$DEF" && git branch -D "$B"
+```
+
+A tree mismatch means `main` moved during the merge: report it and keep the local
+branch. Report the PR, the merged commit, and the notable changes in a few lines.
+
+## Pre-flight before the merge
+
+Answer in writing: the branch holds only the update and its fixes; every gate step
+passed on the final tree, the docs build and the audit included; the network tests ran
+if a runtime dependency moved; no finding was silenced; the runtime changes are named in
+the PR; every required check passed and the PR is CLEAN.

water_ogcapi-0.1.0/.agents/skills/update-package/summarize.py

@@ -0,0 +1,49 @@
+"""Print one Markdown table row per package change in a ``pixi update --json`` report.
+
+Usage: ``python3 .agents/skills/update-package/summarize.py <report.json>``. The change
+count goes to stderr; a report with no changes prints ``0 package changes``.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+# A conda entry carries only its URL: name-version-build.conda
+CONDA_VERSION = re.compile(r"/[^/]+?-([^-/]+)-[^-/]+\.(?:conda|tar\.bz2)$")
+
+
+def version(side: dict[str, Any] | None) -> str:
+    """Return the version on one side of a change, ``-`` when the package is absent."""
+    if not side:
+        return "-"
+    if "version" in side:
+        return str(side["version"])
+    match = CONDA_VERSION.search(str(side.get("conda", "")))
+    return match.group(1) if match else "?"
+
+
+def main(report: Path) -> None:
+    """Print the rows for ``report``, one per package and version pair."""
+    changes: dict[tuple[str, str, str], set[str]] = {}
+    environments = json.loads(report.read_text(encoding="utf-8")).get("environment", {})
+    for env, platforms in environments.items():
+        for packages in platforms.values():
+            for package in packages:
+                key = (
+                    package["name"],
+                    version(package.get("before")),
+                    version(package.get("after")),
+                )
+                changes.setdefault(key, set()).add(env)
+    out = sys.stdout
+    for (name, old, new), envs in sorted(changes.items()):
+        out.write(f"| {name} | {old} | {new} | {', '.join(sorted(envs))} |\n")
+    sys.stderr.write(f"{len(changes)} package changes\n")
+
+
+if __name__ == "__main__":
+    main(Path(sys.argv[1]))

water_ogcapi-0.1.0/.gemini/settings.json

@@ -0,0 +1,8 @@
+{
+  "context": {
+    "fileName": [
+      "AGENTS.md",
+      "GEMINI.md"
+    ]
+  }
+}

water_ogcapi-0.1.0/.github/dependabot.yml

@@ -0,0 +1,7 @@
+# Keeps the SHA-pinned actions current; the comment after each pin gets bumped too.
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly

water_ogcapi-0.1.0/.github/pull_request_template.md

@@ -0,0 +1,26 @@
+Closes #
+
+## What changed
+
+<!-- What the change does and why, in a few sentences. Name the D-, L-, or Q- entries in
+docs/design.md it touches. -->
+
+## How it was checked
+
+<!-- Tick what ran. Add any live-API or manual check, with what it showed. -->
+
+- [ ] `pixi r lint`
+- [ ] `pixi r typecheck`
+- [ ] `pixi r -e test313 test`
+- [ ] `pixi r -e test315 test`
+- [ ] `pixi r docs` (needed when `docs/`, `README.md`, or `zensical.toml` changed)
+
+## Risk and revert
+
+<!-- What this could break and for whom, the review depth REVIEW.md asks for, and how to
+undo it: a revert of this PR, or, after a release, a fix release. -->
+
+## Design record
+
+- [ ] `docs/design.md` is updated, or this change makes, reverses, or answers nothing
+    there

water_ogcapi-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,76 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Test (${{ matrix.environment }}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        environment: [test313, test315]
+        # One runner per pixi platform: linux-64, osx-arm64, win-64.
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0  # hatch-vcs reads tags for the version
+    - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94  # v0.11.2
+      with:
+        pixi-version: v0.84.0  # Dependabot does not bump this; see D-55
+        environments: ${{ matrix.environment }}
+    # `test` excludes the network marker, so CI never touches USGS servers.
+    - run: pixi run -e ${{ matrix.environment }} test
+
+  # The install is the check: a dev package locked as an sdist must build here (D-71).
+  dev-install:
+    name: Install dev (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0  # hatch-vcs reads tags for the version
+    - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94  # v0.11.2
+      with:
+        pixi-version: v0.84.0  # Dependabot does not bump this; see D-55
+        environments: dev
+
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0
+    - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94  # v0.11.2
+      with:
+        pixi-version: v0.84.0  # Dependabot does not bump this; see D-55
+        environments: typecheck
+    - run: pixi run typecheck
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+    - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94  # v0.11.2
+      with:
+        pixi-version: v0.84.0  # Dependabot does not bump this; see D-55
+        environments: lint
+    - run: pixi run lint
+    # Needs network: resolves the runtime dependencies from PyPI and checks their advisories.
+    - run: pixi run audit

water_ogcapi-0.1.0/.github/workflows/docs.yml

@@ -0,0 +1,50 @@
+name: Docs
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # Refreshes the roadmap page, which is generated from the GitHub milestones.
+  schedule:
+  - cron: 0 6 * * *
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: read
+
+# Never cancel a Pages deployment mid-flight; superseded PR builds can go.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+    - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94  # v0.11.2
+      with:
+        pixi-version: v0.84.0  # Dependabot does not bump this; see D-55
+        environments: docs
+    # --strict fails the build on warnings such as broken links.
+    - run: pixi run docs
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+    - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5.0.0
+      with:
+        path: site
+
+  deploy:
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+    - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346  # v5.0.1
+      id: deployment

water_ogcapi-0.1.0/.github/workflows/drift.yml

@@ -0,0 +1,43 @@
+name: Drift
+
+# Weekly check that the live services still match the tests and the OpenAPI snapshots
+# (D-63). Never on pull_request, so no fork run sees the key.
+on:
+  schedule:
+  - cron: 0 7 * * 1
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  network-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0  # hatch-vcs reads tags for the version
+        persist-credentials: false
+    - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94  # v0.11.2
+      with:
+        pixi-version: v0.84.0  # Dependabot does not bump this; see D-55
+        environments: test315
+    - run: pixi run -e test315 test-network
+      env:
+        USGS_API_KEY: ${{ secrets.USGS_API_KEY }}  # a key used only here
+
+  openapi:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0
+        persist-credentials: false
+    - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94  # v0.11.2
+      with:
+        pixi-version: v0.84.0  # Dependabot does not bump this; see D-55
+        environments: test315
+    # Sends no key: the OpenAPI documents are public.
+    - run: pixi run -e test315 drift

water_ogcapi-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,94 @@
+name: Release
+
+on:
+  push:
+    # PEP 440 final and pre-release versions only.
+    tags:
+    - v[0-9]+.[0-9]+.[0-9]+
+    - v[0-9]+.[0-9]+.[0-9]+rc[0-9]+
+    - v[0-9]+.[0-9]+.[0-9]+[ab][0-9]+
+
+permissions: {}
+
+jobs:
+  release-notes:
+    name: Create release notes
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # create the GitHub release
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0
+        persist-credentials: false
+    # checkout can leave the tag lightweight (actions/checkout#882), dropping the release summary.
+    - run: git fetch --force origin "+refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
+    # tag_pattern matches only vX.Y.Z, so a pre-release such as v0.1.0rc1 gets its tag message as notes.
+    - id: kind
+      run: |
+        if [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          echo "prerelease=false" >> "$GITHUB_OUTPUT"
+        else
+          echo "prerelease=true" >> "$GITHUB_OUTPUT"
+          git tag -l --format='%(contents)' "$GITHUB_REF_NAME" > release-notes.md
+        fi
+    - uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff  # v4.9.1
+      if: steps.kind.outputs.prerelease == 'false'
+      with:
+        version: v2.14.2  # same as the dev environment's git-cliff
+        config: pyproject.toml
+        args: --latest --strip all
+      env:
+        OUTPUT: release-notes.md
+        GITHUB_REPO: ${{ github.repository }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - run: gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --verify-tag --notes-file release-notes.md --prerelease="$PRERELEASE"
+      env:
+        GH_TOKEN: ${{ github.token }}
+        PRERELEASE: ${{ steps.kind.outputs.prerelease }}
+
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        fetch-depth: 0  # hatch-vcs reads tags for the version
+        persist-credentials: false
+    - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
+      with:
+        enable-cache: false  # no cache poisoning in a publishing pipeline
+    - run: uv build
+    # Each distribution installs alone, imports, and carries the tag's version.
+    - run: |
+        for dist in dist/*.whl dist/*.tar.gz; do
+          uv run --isolated --no-project --with "$dist" python -c \
+            'import sys, water_ogcapi as w; assert w.__version__ == sys.argv[1], w.__version__' \
+            "${GITHUB_REF_NAME#v}"
+        done
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+      with:
+        name: dist
+        path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: [build, release-notes]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/water-ogcapi
+    permissions:
+      id-token: write  # trusted publishing and PEP 740 attestations
+    steps:
+    - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
+      with:
+        enable-cache: false
+    - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+      with:
+        name: dist
+        path: dist/
+    - uses: astral-sh/attest-action@39b6ce43875c196a579e31635b11aa2a2036384a  # v0.0.7
+    - run: uv publish

water_ogcapi-0.1.0/.gitignore

@@ -0,0 +1,83 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+env/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+.hypothesis/
+.pytest_cache/
+.pytest_tmp/
+
+# dotenv
+.env
+
+# virtualenv
+.venv
+venv/
+ENV/
+
+# mypy
+.mypy_cache/
+
+# IDE settings
+.vscode/
+.idea/
+
+# Pixi
+.pixi
+.pixi.lock
+
+# Zensical build output
+**/site/
+# Pages generated from the notebooks in docs/examples/ by `pixi r docs`
+/docs/examples/*.md
+!/docs/examples/index.md
+/docs/examples/*_files/
+# Generated from the GitHub milestones by `pixi r docs`
+/docs/roadmap.md
+
+# Misc
+.DS_Store
+junit.xml
+
+# AI agents. AGENTS.md and .agents/skills/ are the shared files; .claude/skills links to
+# the latter. The negations override a global ignore of these directories.
+!/.agents/
+/.agents/*
+!/.agents/skills
+!/.claude/
+/.claude/*
+!/.claude/skills
+# Claude Code skips AGENTS.md when a CLAUDE.md exists, so keep personal ones out.
+CLAUDE.md
+CLAUDE.local.md