pyproject.toml

[project]
name = "atlan-application-sdk"
version = "3.55.3"
description = "Atlan Application SDK is a Python library for developing applications on the Atlan Platform"
license = "Apache-2.0"
authors = [
    {name = "Atlan App Team", email = "connect@atlan.com"}
]
readme = "README.md"
requires-python = ">=3.11"
classifiers = [
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Operating System :: OS Independent",
    "Development Status :: 4 - Beta",
]
keywords = ["atlan", "sdk", "platform", "app", "development"]
dependencies = [
    "atlan-application-sdk-api==3.55.3",
    # The OTLP gRPC exporters only, not the opentelemetry-exporter-otlp meta
    # package: that also pulls the HTTP exporter, which nothing imports.
    "opentelemetry-exporter-otlp-proto-grpc>=1.45.0,<2.0.0",
    # Imported directly (opentelemetry.sdk / .trace / .metrics / ._logs), so
    # declared directly rather than left to arrive through the exporter.
    "opentelemetry-api>=1.45.0,<2.0.0",
    "opentelemetry-sdk>=1.45.0,<2.0.0",
    "opentelemetry-exporter-prometheus>=0.66b0,<0.67",
    "opentelemetry-instrumentation-fastapi>=0.66b0,<0.67",
    "prometheus-client>=0.20.0,<1.0",
    # Plain fastapi plus the two packages of its [standard] extra the SDK uses:
    # uvicorn serves the handler and the worker's health/metrics app, and
    # python-multipart parses the object-store upload route's form. The rest of
    # [standard] (fastapi-cli, jinja2, email-validator, pydantic-settings, ...)
    # was never imported and shipped in every connector image.
    "fastapi>=0.162.0,<0.163.0",
    "uvicorn[standard]>=0.30.0,<1.0.0",
    "pyatlan>=11.7.0,<12",  # floor carries authlib~=1.9.1 (CVE-2026-96760) to consumers
    "httpx>=0.27.0,<0.29.0",
    "httpx-retries>=0.6.0,<0.7.0",
    # Published floor (not just [tool.uv] constraint-dependencies, which only
    # pins this repo's own lock) so connector apps inherit it on SDK upgrade.
    "certifi>=2026.10.19",  # GHSA-6q48-6c7w-9gw2
    # Arrives via pyatlan (~=1.9.1 on Python >=3.10). Published as well so the
    # api wheel's pyatlan extra can carry the same pin (test_api_distribution).
    "authlib>=1.9.4,<2",  # CVE-2026-96760; GHSA-9qr6-8289-9j56, GHSA-f3fg-34g9-v7jx, GHSA-gp2m-377p-m4j3
    # Transitive runtime deps, published for the same reason as certifi:
    # protobuf arrives via temporalio / opentelemetry-proto, pyjwt via
    # azure-identity -> msal.
    "protobuf>=6.33.5,<8",  # CVE-2026-0994
    "pyjwt>=2.12.0,<3",  # CVE-2026-32597
    # fastapi's File/Form parsing (handler/object_routes.py); fastapi imports
    # it, so it has no import site here. The floor is a CVE floor, and the api
    # wheel ships it with this exact pin (parity test).
    "python-multipart>=0.0.26",  # CVE-2026-24486, CVE-2026-40347
    "pydantic>=2.10.6,<3.0.0",
    # `deprecated` (PEP 702) and `TypeAliasType`; arrives via pydantic today,
    # but it is imported directly, so it is declared directly.
    "typing-extensions>=4.12.2,<5",
    "packaging>=24.0",
    "loguru>=0.7.3,<0.8.0",
    "python-dotenv>=1.2.2,<2.0.0",  # CVE-2026-28684 (symlink file overwrite)
    "pyyaml>=6.0.2,<7.0.0",
    "obstore>=0.12.0,<0.13.0",
    # Cloud credential libraries — required at runtime for any storage auth mode;
    # connectors don't know which auth mechanism a deployment will choose, so
    # these cannot be optional extras. google-auth powers GCS Application Default
    # Credentials / Workload Identity Federation (via obstore.auth.google) — the
    # GKE WI / customer-infra path obstore's built-in GCS file decoder can't do.
    "boto3>=1.38.6,<2.0.0",
    "azure-identity>=1.15.0",
    "google-auth>=2.0.0,<3.0.0",
    # Temporal runtime (httpx-retries at L29 is the Dapr HTTP client replacement)
    # >=1.35.0: older wheels bundle the zip crate <9.0.5 (CVE-2026-115905)
    "temporalio>=1.35.0,<2.0.0",
    "orjson>=3.11.6,<4.0.0",
    # Disk-backed SpillableDict. Core (not the [storage] extra) because the
    # upload hook's referential-integrity (orphan) pass needs it: as an extra,
    # whether an app got that check depended on an install choice nobody made
    # for that reason (FND-3414).
    "rocksdict>=0.3.0,<0.4.0",
]

[project.scripts]
application-sdk = "application_sdk.main:main"

[project.urls]
Repository = "https://github.com/atlanhq/application-sdk"
Documentation = "https://github.com/atlanhq/application-sdk/README.md"
"Changelog" = "https://github.com/atlanhq/application-sdk/blob/main/CHANGELOG.md"

# Optional dependencies for specific functionality
[project.optional-dependencies]
# Every extra below marked "Deprecated shim" installs nothing [sql] or core
# does not already provide, and is removed in v4.0.0. An extra is resolved by
# the installer, not imported, so there is no runtime warning: the removal is
# carried here, in docs/upgrade-guide-v3.md, and by conformance rule D017,
# which warns every app that still references one. The shim table D017 reads
# is checked against this file by
# packages/conformance/tests/test_dependency_conformance.py.
# Deprecated shim, removed in v4.0.0: temporalio and orjson are core since
# v3.1. Drop the extra.
workflows = [
    "temporalio>=1.35.0,<2.0.0",
    "orjson>=3.11.6,<4.0.0",
]
# SQL connectors: SqlMetadataExtractor, SqlQueryExtractor, and any SQL-based connector
sql = [
    "pandas>=2.2.3,<4.0.0",
    "pyarrow>=23.0.1,<27.0.0",
    "sqlalchemy[asyncio]>=2.0.36,<3.0.0",
    "duckdb>=1.1.3,<1.6.0",
]
# Deprecated shim: alias for [sql], removed in v4.0.0. Install [sql] (or
# [incremental]) instead; the daft transformer engine itself is gone.
#
# This aliases rather than resolving empty. Before v3.22 the extra pulled duckdb
# transitively; emptying it turned every app pinned to
# atlan-application-sdk[daft] into a latent "duckdb is required for
# DuckDBConnectionManager" ImportError on the first real transform — imports
# still succeed and mocked unit tests still pass, so the break only surfaces
# end-to-end, which is how it reached main on a connector after an automated
# upgrade crossed the 3.22 line. An emptied compat extra is not a shim; it is a
# silent removal wearing a shim's name. Policy here is compat shim + named
# removal version, and a true alias satisfies it: every affected app is fixed by
# a version bump with no per-repo remediation.
#
# There is no runtime deprecation signal available at this layer — an extra is
# resolved by the installer, not imported — so the removal version is carried
# here, in docs/upgrade-guide-v3.md, and by the D010 and D017 conformance rules.
daft = ["atlan-application-sdk[sql]"]
# Deprecated shim, removed in v4.0.0: rocksdict is core (FND-3414). Kept so
# a pyproject.toml that names [storage] still resolves until then. Drop the
# extra.
storage = [
    "rocksdict>=0.3.0,<0.4.0",
]
# Incremental extraction: an alias for [sql], since the RocksDB state store
# (rocksdict) is core. Kept as a supported name, not a shim: it states what the
# app uses, and it can diverge from [sql] again without apps changing their pin.
incremental = ["atlan-application-sdk[sql]"]
# Deprecated shim, removed in v4.0.0: boto3 is core since v3.14. Kept so a
# pyproject.toml that names [iam_auth] still resolves until then. Drop the
# extra.
iam_auth = [
    "boto3>=1.38.6,<2.0.0",
]
# Deprecated shim, removed in v4.0.0: azure-identity is core since v3.14.
# Drop the extra.
azure = [
    "azure-identity>=1.15.0",
    # azure-storage-{blob,file-datalake} were dropped (FND-4252): the SDK never
    # imported them. A connector that uses the Azure SDK directly declares them.
]
distributed_lock = [
    "redis[hiredis]>=5.2.0,<9.0.0",
]
mcp = [
    "fastmcp>=3.2.0,<4.0.0",
]
tests = [
    "pandera[io]>=0.35.0,<0.36.0",
    "httpx>=0.27.0,<0.29.0",
    # starlette's TestClient (fastapi.testclient) transport. Apps' tests got it
    # through fastapi[standard]; without it TestClient falls back to httpx with
    # a deprecation warning, which fails a suite run with `-W error`.
    "httpx2>=2.16.0,<3.0.0",
]
# Typed Kubernetes backend for application_sdk.testing.harness.cluster — the
# in-process client that replaces the `kubectl`-shelling reads in
# testing/e2e/{pods,logs}.py (FND-241).
#
# Deliberately NOT folded into [tests]: a connector installing test extras
# should not pull a Kubernetes client. Verified safe to keep separate —
# connectors pin atlan-application-sdk[iam-auth,sql,workflows,pandas] and carry
# their own `test` extra, so no connector's production closure changes either
# way. Keeping it apart is what keeps the reason legible.
#
# Only the harness imports this, and only under the e2e/scenario markers, so it
# is never on a production code path.
harness = [
    "kubernetes>=36.0.3,<38.0.0",
]
scale_data_generator = [
    "faker>=40.44.0,<41.0.0",
]
# Deprecated shim, removed in v4.0.0: a subset of [sql]. Use [sql] instead.
sqlalchemy = [
    "sqlalchemy[asyncio]>=2.0.36,<3.0.0",
]
# Deprecated shim, removed in v4.0.0: a subset of [sql]. Use [sql] instead.
pandas = [
    "pandas>=2.2.3,<4.0.0",
    "pyarrow>=23.0.1,<27.0.0",
]

# Development dependencies - Install using: uv sync --group dev
[dependency-groups]
dev = [
    "pre-commit>=4.2.0,<5.0.0",
    # Exact pin, equal to the ruff-pre-commit rev in .pre-commit-config.yaml
    # (enforced by .github/scripts/tests/test_lint_guards.py), so `uv run ruff`
    # and the CI hook lint, format and sort imports identically.
    "ruff==0.17.4",
    # Exact pin, equal to the pyright-python rev in .pre-commit-config.yaml
    # (enforced by .github/scripts/tests/test_check_pyright_baseline.py), so the
    # .github/scripts baseline check and the pre-commit hook run one pyright.
    "pyright==1.1.414",
    "boto3-stubs>=1.38.6,<2.0.0",
    "poethepoet>=0.49.0,<1.0.0",
    "libcst>=1.4.0,<2.0.0",
    "atlan-application-sdk-conformance",
]
test = [
    "mock>=5.1.0,<6.0.0",
    "pytest>=8.3.3,<10.0.0",
    "semver>=3.0.2,<4.0.0",
    "coverage>=7.6.1,<8.0.0",
    "pytest-asyncio>=1.4.0,<2.0.0",
    "pytest-timeout>=2.3.0,<3.0.0",
    "pytest-rerunfailures>=16.7,<17.0",
    "pytest-socket>=0.7.0,<1.0.0",
    "pytest-xdist>=3.8.0,<4.0.0",
    # starlette's TestClient (fastapi.testclient) is built on httpx2 and only
    # falls back to httpx with a deprecation warning. fastapi[standard] used to
    # bring it in; the SDK's tests and .github/scripts probes still need it.
    "httpx2>=2.16.0,<3.0.0",
    # pytest-cov, not bare `coverage run -m pytest`: `coverage run` only traces
    # the parent process, so every xdist worker's coverage is lost and the
    # --fail-under gate reads a number less than half the real one (measured on
    # tests/unit/observability: 28.24% serial, 13.87% under `coverage run -n 4`,
    # 28.24% under `pytest -n 4 --cov`). See FND-961.
    "pytest-cov>=7.1.0,<8.0.0",
    "hypothesis>=6.114.0,<7.0.0",
    "trustme>=1.2.1,<2.0.0",
    "pyjwt[crypto]>=2.12.0",
    # Test-only. The SDK ships psycopg3; psycopg2 reaches production through
    # connector apps. It is here so tests/unit/clients/test_sql_typecasters.py
    # can pin the psycopg2 facts the tolerant-decoder fix depends on (that
    # `extensions.encodings` is the dict the C layer reads, and that UNICODE
    # resolves to a utf-8 codec) against the real driver rather than a mock —
    # a driver upgrade that moves that seam must fail loudly in CI. See
    # CONAT-767. Never add this to [project.dependencies].
    "psycopg2-binary>=2.9.12,<3.0.0",
    # Test-only, for the same reason: TestAttachPsycopg3 in
    # tests/unit/clients/test_sql_typecasters.py runs against the real driver
    # and skips without it.
    "psycopg[binary]>=3.2.7,<4.0.0",
]
docs = [
    "mkdocs>=1.6.1,<2.0.0",
    "mkdocs-material>=9.6.4,<10.0.0",
    "pymdown-extensions>=12,<13.0",
    "pydoctor>=24.11.2,<26.0.0",
    "mike>=2.1.3,<3.0.0",
]
# Conformance suite — now a separate published package: atlan-application-sdk-conformance
# Install via: uv add --dev atlan-application-sdk-conformance

[tool.poe.tasks]
download-components.shell = "ls -l components/*.yaml"
# Dapr and Temporal service tasks
start-dapr = "dapr run --enable-api-logging --log-level debug --app-id app --app-port 8000 --dapr-http-port 3500 --dapr-grpc-port 50001 --scheduler-host-address '' --placement-host-address '' --max-body-size 1024Mi --config components/configuration.yaml --resources-path components"

# if you need to test dapr with environment values for an app
#start-dapr.shell = "set -a && source .env && set +a && dapr run --enable-api-logging --log-level debug --app-id app --app-port 8000 --dapr-http-port 3500 --dapr-grpc-port 50001 --scheduler-host-address '' --placement-host-address '' --max-body-size 1024Mi --config components/configuration.yaml --resources-path components"

start-temporal = "temporal server start-dev --db-filename ./temporal.db"
# Export Dapr ports before backgrounding so `uv run main.py` (run separately)
# sees them. Without this, devs must manually `export DAPR_HTTP_PORT=3500`.
start-deps.shell = "export DAPR_HTTP_PORT=3500 DAPR_GRPC_PORT=50001 && poe start-dapr & poe start-temporal &"
stop-deps.shell = "lsof -ti:3000,3500,7233,8233,50001 | xargs kill -9 2>/dev/null || true"
# Temporal and Dapr are provisioned in-process by the integration suite's
# embedded dev helpers (see tests/integration/conftest.py) — no external
# `temporal server start-dev` or daprd needed. Set TEMPORAL_HOST to point at
# an already-running server instead.
test-integration = "pytest tests/integration/ -m integration -v --timeout=120"
# Opt-in large-file storage load tests (real bytes, LocalStore, no CI).
# Size via ATLAN_LOAD_TEST_SIZE_MIB (default 1024; 51200 = 50 GiB). See tests/load/README.md.
load-test-storage = "pytest tests/load -m load -v -s --timeout=0"
test-scripts = "bats .github/scripts/tests"  # requires: bats-core (apt-get install -y bats)

# API docs — must be before any sub-table header ([tool.poe.tasks.*])
# or TOML nests it inside the sub-table rather than the parent tasks namespace
generate-apidocs.shell = "mkdocs build && pydoctor --html-output=site/api application_sdk --docformat=google"

# Local credential provisioning
[tool.poe.tasks.provision-credentials]
help = "Provision credentials for local development"
cmd = "python -m application_sdk.tools.provision_credentials"

# Capability manifest — regenerate docs/agents/sdk-capabilities.md from application_sdk/
# Used by the /capability-manifest skill, devs, and CI. Idempotent and deterministic;
# the cmp gate exits non-zero if rendering is non-deterministic.
# interpreter = "bash" is required: poe defaults to /usr/bin/sh (dash on Ubuntu),
# which does not support `set -o pipefail`.
#
# GRIFFE IS PINNED, and the pin is the whole point. griffe renders the field
# defaults this manifest records, so an unpinned `--with griffe` makes the
# committed artifact a function of whichever griffe the machine last cached
# rather than of application_sdk/. That is not theoretical: griffe 2.2.0 shipped
# on 2026-08-16 and dropped the redundant parentheses around a call in a Field
# default, so #3169 regenerated on it and rewrote ten committed lines with no
# source change, after which every PR whose runner still had an older griffe
# cached reported drift. The cmp gate above cannot catch this — it proves one
# machine agrees with itself, not that two machines agree with each other.
#
# 2.1.0 rather than 2.2.0 deliberately: the org §5 release-age cooldown applies
# to a tool that rewrites a committed artifact exactly as it applies to anything
# else, and 2.2.0 was a day old when it was first used here. Bump this
# deliberately, and regenerate in the same commit.
#
# Renovate cannot see this pin — its uv manager reads dependency tables, not an
# inline `--with` inside a poe shell string — so it will not be bumped for you
# and will not be cooled down for you either. That is the trade for keeping the
# tool out of the project environment; revisit if the pin starts rotting.
[tool.poe.tasks.regen-capabilities]
interpreter = "bash"
shell = """
set -euo pipefail
mkdir -p /tmp/capability-manifest
EXTRACTOR=.claude/skills/capability-manifest/references/extractor.py
PURPOSES=.claude/skills/capability-manifest/references/subpackage-purposes.yaml
GRIFFE=griffe==2.1.0
uv run --with "$GRIFFE" python "$EXTRACTOR" dump > /tmp/capability-manifest/raw.json
uv run --with "$GRIFFE" python "$EXTRACTOR" normalize /tmp/capability-manifest/raw.json > /tmp/capability-manifest/normalized.json
uv run --with "$GRIFFE" python "$EXTRACTOR" render /tmp/capability-manifest/normalized.json "$PURPOSES" > /tmp/capability-manifest/fresh1.md
uv run --with "$GRIFFE" python "$EXTRACTOR" render /tmp/capability-manifest/normalized.json "$PURPOSES" > /tmp/capability-manifest/fresh2.md
cmp /tmp/capability-manifest/fresh1.md /tmp/capability-manifest/fresh2.md
cp /tmp/capability-manifest/fresh1.md docs/agents/sdk-capabilities.md
uv run pre-commit run --files docs/agents/sdk-capabilities.md || true
"""

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["application_sdk"]
# >>> api-files: generated by .github/scripts/gen_api_files.py; do not edit >>>
# These files ship only in atlan-application-sdk-api, which the SDK depends
# on at its own version (docs/standards/api-distribution.md).
exclude = [
    "application_sdk/__init__.py",
    "application_sdk/_build_info.py",
    "application_sdk/_context_errors.py",
    "application_sdk/_install.py",
    "application_sdk/_logging.py",
    "application_sdk/_runtime/__init__.py",
    "application_sdk/_runtime/cgroup.py",
    "application_sdk/_runtime/offload.py",
    "application_sdk/_runtime/progress.py",
    "application_sdk/clients/__init__.py",
    "application_sdk/clients/_interface.py",
    "application_sdk/clients/_sql_failure_classifier.py",
    "application_sdk/clients/base.py",
    "application_sdk/clients/http_errors.py",
    "application_sdk/clients/models.py",
    "application_sdk/clients/sql.py",
    "application_sdk/clients/sql_errors.py",
    "application_sdk/clients/sql_typecasters.py",
    "application_sdk/clients/ssl_utils.py",
    "application_sdk/common/__init__.py",
    "application_sdk/common/_generated_tree.py",
    "application_sdk/common/_listing.py",
    "application_sdk/common/aws_utils.py",
    "application_sdk/common/aws_utils_errors.py",
    "application_sdk/common/backoff.py",
    "application_sdk/common/build_identity.py",
    "application_sdk/common/concurrency.py",
    "application_sdk/common/errors.py",
    "application_sdk/common/filter_matching.py",
    "application_sdk/common/logger.py",
    "application_sdk/common/models.py",
    "application_sdk/common/sql_filters.py",
    "application_sdk/common/sql_filters_errors.py",
    "application_sdk/common/task_queue.py",
    "application_sdk/common/types.py",
    "application_sdk/common/utils.py",
    "application_sdk/constants.py",
    "application_sdk/contracts/__init__.py",
    "application_sdk/contracts/base.py",
    "application_sdk/contracts/events.py",
    "application_sdk/contracts/types.py",
    "application_sdk/contracts/types_errors.py",
    "application_sdk/credentials/__init__.py",
    "application_sdk/credentials/errors.py",
    "application_sdk/credentials/extra.py",
    "application_sdk/credentials/ingress.py",
    "application_sdk/credentials/ref.py",
    "application_sdk/credentials/requirements.py",
    "application_sdk/credentials/spec.py",
    "application_sdk/credentials/types.py",
    "application_sdk/credentials/utils.py",
    "application_sdk/errors/__init__.py",
    "application_sdk/errors/base.py",
    "application_sdk/errors/categories.py",
    "application_sdk/errors/http.py",
    "application_sdk/errors/leaves.py",
    "application_sdk/errors/wire.py",
    "application_sdk/handler/__init__.py",
    "application_sdk/handler/_dispatch.py",
    "application_sdk/handler/_warmup.py",
    "application_sdk/handler/asgi.py",
    "application_sdk/handler/base.py",
    "application_sdk/handler/context.py",
    "application_sdk/handler/contracts.py",
    "application_sdk/handler/manifest.py",
    "application_sdk/handler/metadata_routes.py",
    "application_sdk/handler/object_routes.py",
    "application_sdk/handler/request_contract.py",
    "application_sdk/handler/routes.py",
    "application_sdk/handler/service_errors.py",
    "application_sdk/server/__init__.py",
    "application_sdk/server/fastapi/models.py",
    "application_sdk/templates/__init__.py",
    "application_sdk/templates/contracts/__init__.py",
    "application_sdk/templates/contracts/base_metadata_extraction.py",
    "application_sdk/templates/contracts/incremental_sql.py",
    "application_sdk/templates/contracts/sql_metadata.py",
    "application_sdk/templates/contracts/sql_query.py",
    "application_sdk/version.py",
]
# <<< api-files <<<

# Ship the Dapr component YAMLs inside the wheel so consumer apps get them
# for free from their existing application-sdk dependency instead of
# downloading them over the network (see docs/standards/build-security.md).
[tool.hatch.build.targets.wheel.force-include]
"components" = "application_sdk/components"

[tool.pyright]
venvPath = "."
venv = ".venv"
typeCheckingMode = "standard"
extraPaths = []
exclude = [
    "application_sdk/test_utils/**",
    "application_sdk/testing/scale_data_generator/**",
    ".github/**",
    "tests",
]
reportUnknownMemberType = "warning"
reportAttributeAccessIssue = "warning"
reportPossiblyUnboundVariable = "information"
reportFunctionMemberAccess = "warning"
reportArgumentType = "warning"
reportGeneralTypeIssues = "warning"
reportMissingImports = "warning"
reportInvalidTypeForm = "warning"

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
pythonpath = ["."]
# --dist loadgroup: ungrouped tests distribute exactly as under the default
# `load`; each `xdist_group` runs on a single worker. "procpool" marks the tests
# that spawn run_fault_isolated's process-pool children, so one worker owns them
# instead of every worker spawning its own and starving timing-sensitive tests
# of CPU (FND-4237). Inert without -n.
addopts = "-m 'not integration and not e2e and not s3_integration and not azure_integration and not gcs_integration and not storage_emulator and not load and not perf' --dist loadgroup"
markers = [
    "perf: throughput comparisons and large-scale probes (≥10s each); excluded from the unit matrix, run once in the `Unit Perf Tests` job via `pytest tests/unit -m perf`",
    "load: opt-in large-file storage load tests — real bytes at ATLAN_LOAD_TEST_SIZE_MIB (50 GiB-class); run via `poe load-test-storage`, never in CI",
    "integration: tests requiring local Temporal server",
    "e2e: tests requiring a live K8s cluster",
    "s3_integration: tests requiring keyless AWS access (S3_BUCKET + ambient AWS credentials, e.g. OIDC role)",
    "azure_integration: tests requiring keyless Azure Workload Identity Federation (AZURE_STORAGE_ACCOUNT, AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_FEDERATED_TOKEN_FILE)",
    "gcs_integration: tests requiring keyless GCS access (GCS_BUCKET, GCS_PROJECT_ID + ambient ADC, e.g. Workload Identity Federation)",
    "storage_emulator: hermetic object-store tests against local emulators (MinIO/Azurite/storage-testbench); run in CI with emulator sidecars",
]

[tool.coverage.run]
# `application_sdk/testing/**` ships test infrastructure for downstream apps
# (mocks, fixtures) and internal test runners (integration, e2e, hypothesis,
# parity, scale generation) that are exercised under different markers, not
# under unit tests. Including them in unit coverage drags the percentage down
# without representing product-code quality. Keep `mocks.py` and `fixtures.py`
# in scope since downstream apps consume them as a public testing API.
#
# `application_sdk/testing/harness/**` is deliberately ABSENT from this list.
# It is new code with a tenant-free unit surface — bounded waits, outcome
# vocabulary, budgets, pure evaluators, the sync bridge — so it counts toward
# the 85% gate like any other module. The `testing/e2e/**` exemption below is
# about code that only runs against a live tenant; inheriting it here by
# proximity would exempt the one part of this surface that is unit-testable.
omit = [
    "tests/**",
    "application_sdk/test_utils/**",
    "application_sdk/testing/scale_data_generator/**",
    "application_sdk/testing/integration/**",
    "application_sdk/testing/e2e/**",
    "application_sdk/testing/hypothesis/**",
    "application_sdk/testing/parity/**",
]
source = ["application_sdk"]

[tool.coverage.report]
exclude_lines = [
    "pragma: no cover",
    "def __repr__",
    "if self.debug:",
    "raise NotImplementedError",
    "if __name__ == .__main__.:",
    "pass",
    "raise ImportError",
    # An ellipsis-only body is a Protocol method or a typing stub: a signature
    # declaration, never a statement that runs. Anchored to a line that is
    # nothing but `...` so it cannot swallow a real statement.
    "^\\s*\\.\\.\\.$",
]
fail_under = 85
show_missing = true
precision = 2

[tool.ruff.format]
# ruff 0.17 also formats Python code blocks inside Markdown. The hook did not
# before (it was 0.6.4), and doc snippets are often deliberately partial or
# aligned for reading, so keep formatting to source files. In config rather
# than as hook `types`, so `uv run ruff format .` and the hook agree.
exclude = ["*.md"]

[tool.ruff.lint]
# explicit-preview-rules: only the preview rules listed in extend-select are
# enabled — other preview rules remain off. This lets us opt into PLC0415
# without inheriting every other preview rule's churn.
preview = true
explicit-preview-rules = true
# `select` is spelled out rather than inherited: ruff 0.17 widened its default
# rule set (thousands of new findings here), so leaving it implicit would let
# every ruff bump silently change what this repo enforces. These are the
# pre-0.17 defaults plus `I` (import sorting, which replaced isort in FND-4247).
select = ["E4", "E7", "E9", "F", "I"]
extend-select = [
    "G001",    # % operator inline in log call (not lazy)
    "G003",    # string concatenation in log call
    "G004",    # f-string in log call
    "T201",    # print() in production code
    "PLC0415", # imports must be at top of module — prevents broken-import-at-runtime bugs (e.g. PR #1543)
    "S110",    # try-except-pass detected
    "S112",    # try-except-continue detected
    "LOG009",  # logger.warn() is deprecated — use .warning()
]

[tool.ruff.lint.per-file-ignores]
"application_sdk/main.py" = ["T201"]
# A developer-facing CLI (`python -m application_sdk.dev.pkl`): its stdout IS
# the product — a generate task captures it — and its diagnostics go to stderr.
# The SDK logger is deliberately not used; it writes to stdout for OTel
# collection, which would corrupt the captured value. Same exemption as main.py
# and application_sdk/tools/**.
"application_sdk/dev/pkl.py" = ["T201"]
".github/**" = ["G004", "T201"]
# tests and tools exempted from PLC0415: production runtime risk does
# not apply, and tests sometimes use inline imports for fixture isolation.
# F841 is also exempted in tests because enabling `preview = true` (required
# for PLC0415) made F841 stricter on tuple unpacking and codemod tests
# routinely capture-and-discard return values for assertion staging.
"tests/**" = ["G004", "PLC0415", "F841"]
"tools/**" = ["T201", "PLC0415"]
"application_sdk/tools/**" = ["T201", "PLC0415"]
"contract-toolkit/scripts/**" = ["T201", "PLC0415"]
"local/**" = ["T201", "PLC0415"]
# Mid-file import required to break circular dependency between models.py and assertions.py
"application_sdk/testing/integration/models.py" = ["E402"]
# sys.path bootstrap required so the test module can import the sibling script it tests.
".github/scripts/tests/test_fetch_dataforge_source.py" = ["E402"]
".github/scripts/tests/test_resolve_e2e_source.py" = ["E402"]

[tool.uv]
default-groups = ["dev", "test"]
constraint-dependencies = [
    "python-multipart>=0.0.26",  # CVE-2026-24486, CVE-2026-40347
    "protobuf>=6.33.5",          # CVE-2026-0994
    "authlib>=1.9.4",  # CVE-2026-96760 (signature bypass), CVE-2026-28802, GHSA-jj8c-mmj3-mmgv, GHSA-9qr6-8289-9j56, GHSA-f3fg-34g9-v7jx, GHSA-gp2m-377p-m4j3
    "pyjwt>=2.12.0",             # CVE-2026-32597
    "python-dotenv>=1.2.2",      # CVE-2026-28684 (symlink file overwrite)
    "certifi>=2026.10.19",  # GHSA-6q48-6c7w-9gw2
    "filelock>=4.2.1",           # ReadWriteLock SQLite symlink/journal overwrite (dev/test only)
]

[tool.uv.sources]
# Source-pinned, not version-pinned: the conformance package's source lives
# in this same repo (packages/conformance) and is published from it. Using
# the local path means a packages/conformance change is picked up here
# immediately, with no separate release-then-bump-the-pin cycle.
atlan-application-sdk-conformance = { path = "packages/conformance" }
atlan-application-sdk-api = { path = "packages/api", editable = true }

# Uncomment the following section in case you want to publish to testpypi
# [[tool.uv.index]]
# name = "testpypi"
# url = "https://test.pypi.org/simple/"
# publish-url = "https://test.pypi.org/legacy/"
# explicit = true

# Pin the resolver's default index to PyPI explicitly (FND-1928).
#
# Atlan IT installs the Endor Labs package firewall as a machine-wide uv default index in
# `~/.config/uv/uv.toml` (`[[index]] … default = true`, credentials inline). With that in
# effect and no project-level override, every `uv run` / `uv sync` / `uv lock` silently
# rewrites all ~3,600 package URLs in `uv.lock` from `files.pythonhosted.org` to
# `factory.endorlabs.com/...`. Nothing surfaces in the command output — the command prints
# its usual result and leaves the tree dirty with a diff carrying zero version or hash
# changes. Committing that lock points CI at a credentialed host it cannot reach, and every
# job then fails at dependency install with `401 Unauthorized`, on a different package each
# run, looking exactly like an outage in someone else's infrastructure.
#
# A project-level default index takes precedence over the user-level one, so this stanza
# makes local resolution agree with CI (which has no Endor config and always resolved from
# PyPI) and keeps `uv.lock` portable. Adding it does not change resolution: same versions,
# same hashes, only the URLs stay put.
#
# This scopes the firewall bypass to this repo's Python resolution only; the machine-wide
# Endor config still governs npm, Maven, and every other project. Conformance rules D012
# (this pin is present) and D013 (no non-PyPI host reached `uv.lock`) enforce both halves
# fleet-wide.
[[tool.uv.index]]
name = "pypi"
url = "https://pypi.org/simple"
default = true