pyproject.toml

[project]
name = "atlan-application-sdk"
version = "3.15.0"
description = "Atlan Application SDK is a Python library for developing applications on the Atlan Platform"
license = "Apache-2.0"
authors = [
    {name = "Atlan App Team", email = "connect@atlan.com"}
]
readme = "README.md"
requires-python = ">=3.11"
classifiers = [
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Operating System :: OS Independent",
    "Development Status :: 4 - Beta",
]
keywords = ["atlan", "sdk", "platform", "app", "development"]
dependencies = [
    "aiohttp>=3.10.0,<4.0.0",
    "opentelemetry-exporter-otlp>=1.41.1,<2.0.0",
    "opentelemetry-exporter-prometheus>=0.62b1,<0.63",
    "opentelemetry-instrumentation-fastapi>=0.62b1,<0.63",
    "prometheus-client>=0.20.0,<1.0",
    "fastapi[standard]>=0.136.1,<0.140.0",
    "pyatlan>=9,<10",
    "httpx-retries>=0.4.0,<0.5.0",
    "pydantic>=2.10.6,<3.0.0",
    "loguru>=0.7.3,<0.8.0",
    "uvloop>=0.21.0,<0.23.0; sys_platform != 'win32'",
    "python-dotenv>=1.1.0,<2.0.0",
    "pyyaml>=6.0.2,<7.0.0",
    "obstore>=0.9.1,<0.10.0",
    # Cloud credential libraries — required at runtime for any storage auth mode;
    # connectors don't know which auth mechanism a deployment will choose, so
    # these cannot be optional extras.
    "boto3>=1.38.6,<2.0.0",
    "azure-identity>=1.15.0",
    # Temporal runtime (httpx-retries at L29 is the Dapr HTTP client replacement)
    "temporalio>=1.25.0,<2.0.0",
    "orjson>=3.11.6,<4.0.0",
]

[project.scripts]
application-sdk = "application_sdk.main:main"

[project.urls]
Repository = "https://github.com/atlanhq/application-sdk"
Documentation = "https://github.com/atlanhq/application-sdk/README.md"
"Changelog" = "https://github.com/atlanhq/application-sdk/blob/main/CHANGELOG.md"

# Optional dependencies for specific functionality
[project.optional-dependencies]
# Backwards-compatibility shims (dapr/temporalio/orjson promoted to core in v3.1)
workflows = [
    "temporalio>=1.25.0,<2.0.0",
    "orjson>=3.11.6,<4.0.0",
]
# SQL connectors: SqlMetadataExtractor, SqlQueryExtractor, and any SQL-based connector
sql = [
    "pandas>=2.2.3,<3.0.0",
    "pyarrow>=20.0.0,<23.0.0",
    "sqlalchemy[asyncio]>=2.0.36,<3.0.0",
    "duckdb>=1.1.3,<1.6.0",
    "duckdb-engine>=0.17.0,<0.18.0",
]
# Daft transformer engine
daft = [
    "daft==0.7.3",
]
# Disk-backed RocksDB storage utilities (SpillableDict, rocksdb_utils).
# Standalone extra — non-incremental connectors that want disk-backed
# scratch state pull this in directly without needing the full
# incremental analytics stack.
storage = [
    "rocksdict>=0.3.0",
]
# Incremental extraction: sql + daft + RocksDB state store.
# Includes ``storage`` because the incremental TableScope pattern uses
# RocksDB for state — keep one source of truth for the rocksdict pin.
incremental = [
    "atlan-application-sdk[storage]",
    "pandas>=2.2.3,<3.0.0",
    "pyarrow>=20.0.0,<23.0.0",
    "sqlalchemy[asyncio]>=2.0.36,<3.0.0",
    "duckdb>=1.1.3,<1.6.0",
    "duckdb-engine>=0.17.0,<0.18.0",
    "daft==0.7.3",
]
# Backwards-compatibility shim — boto3 promoted to core in v3.14; keeping this
# extra means existing connector pyproject.toml files that specify [iam_auth]
# continue to install without error.
iam_auth = [
    "boto3>=1.38.6,<2.0.0",
]
azure = [
    # azure-identity promoted to core in v3.14 (same reason as iam_auth above).
    "azure-identity>=1.15.0",
    # azure-storage-{blob,file-datalake} remain optional: only needed by connectors
    # that use the Azure SDK directly (outside of obstore).
    "azure-storage-blob>=12.19.0",
    "azure-storage-file-datalake>=12.19.0",
]
distributed_lock = [
    "redis[hiredis]>=5.2.0,<8.0.0",
]
mcp = [
    "fastmcp>=3.2.0,<4.0.0",
]
tests = [
    "pytest-order>=1.3.0,<2.0.0",
    "pandera[io]>=0.23.1,<0.28.0",
    "httpx>=0.27.0,<0.29.0",
]
scale_data_generator = [
    "faker>=37.1.0,<40.0.0",
    "numpy>=1.23.5,<3.0.0",
]
# Removed in v3.1 — use sql extra instead
sqlalchemy = [
    "sqlalchemy[asyncio]>=2.0.36,<3.0.0",
]
# Removed in v3.1 — use sql extra instead
pandas = [
    "pandas>=2.2.3,<3.0.0",
    "pyarrow>=20.0.0,<23.0.0",
]

# Development dependencies - Install using: uv sync --group dev
[dependency-groups]
dev = [
    "pre-commit>=4.2.0,<5.0.0",
    "isort>=5.13.2,<6.0.0",
    "boto3-stubs>=1.38.6,<2.0.0",
    "poethepoet>=0.34.0,<0.40.0",
    "libcst>=1.4.0,<2.0.0",
]
test = [
    "mock>=5.1.0,<6.0.0",
    "pytest>=8.3.3,<10.0.0",
    "coverage>=7.6.1,<8.0.0",
    "pytest-asyncio>=0.26.0,<1.4.0",
    "pytest-timeout>=2.3.0,<3.0.0",
    "hypothesis>=6.114.0,<7.0.0",
    "trustme>=1.2.1,<2.0.0",
    "pyjwt[crypto]>=2.12.0",
]
examples = [
    "snowflake-sqlalchemy>=1.7.0,<2.0.0",
    "psycopg[binary]>=3.2.7,<4.0.0",
]
docs = [
    "mkdocs>=1.6.1,<2.0.0",
    "mkdocs-material>=9.6.4,<10.0.0",
    "pymdown-extensions>=10.15.0,<11.0.0",
    "pydoctor>=24.11.2,<26.0.0",
    "mike>=2.1.3,<3.0.0",
]

[tool.poe.tasks]
download-components.shell = "ls -l components/*.yaml"
# Dapr and Temporal service tasks
start-dapr = "dapr run --enable-api-logging --log-level debug --app-id app --app-port 8000 --dapr-http-port 3500 --dapr-grpc-port 50001 --scheduler-host-address '' --placement-host-address '' --max-body-size 1024Mi --config components/configuration.yaml --resources-path components"

# if you need to test dapr with environment values for an app
#start-dapr.shell = "set -a && source .env && set +a && dapr run --enable-api-logging --log-level debug --app-id app --app-port 8000 --dapr-http-port 3500 --dapr-grpc-port 50001 --scheduler-host-address '' --placement-host-address '' --max-body-size 1024Mi --config components/configuration.yaml --resources-path components"

start-temporal = "temporal server start-dev --db-filename ./temporal.db"
# Export Dapr ports before backgrounding so `uv run main.py` (run separately)
# sees them. Without this, devs must manually `export DAPR_HTTP_PORT=3500`.
start-deps.shell = "export DAPR_HTTP_PORT=3500 DAPR_GRPC_PORT=50001 && poe start-dapr & poe start-temporal &"
stop-deps.shell = "lsof -ti:3000,3500,7233,8233,50001 | xargs kill -9 2>/dev/null || true"
test-integration.shell = "temporal server start-dev --db-filename /tmp/temporal-integ.db &>/tmp/temporal-integ.log & sleep 3 && uv run pytest tests/integration/ -m integration -v --timeout=120; EXIT=$?; kill %1 2>/dev/null; exit $EXIT"

# API docs — must be before any sub-table header ([tool.poe.tasks.*])
# or TOML nests it inside the sub-table rather than the parent tasks namespace
generate-apidocs.shell = "mkdocs build && pydoctor --html-output=site/api application_sdk --docformat=google"

# Local credential provisioning
[tool.poe.tasks.provision-credentials]
help = "Provision credentials for local development"
cmd = "python -m application_sdk.tools.provision_credentials"

# Capability manifest — regenerate docs/agents/sdk-capabilities.md from application_sdk/
# Used by the /capability-manifest skill, devs, and CI. Idempotent and deterministic;
# the cmp gate exits non-zero if rendering is non-deterministic.
# interpreter = "bash" is required: poe defaults to /usr/bin/sh (dash on Ubuntu),
# which does not support `set -o pipefail`.
[tool.poe.tasks.regen-capabilities]
interpreter = "bash"
shell = """
set -euo pipefail
mkdir -p /tmp/capability-manifest
EXTRACTOR=.claude/skills/capability-manifest/references/extractor.py
PURPOSES=.claude/skills/capability-manifest/references/subpackage-purposes.yaml
uv run --with griffe python "$EXTRACTOR" dump > /tmp/capability-manifest/raw.json
uv run --with griffe python "$EXTRACTOR" normalize /tmp/capability-manifest/raw.json > /tmp/capability-manifest/normalized.json
uv run --with griffe python "$EXTRACTOR" render /tmp/capability-manifest/normalized.json "$PURPOSES" > /tmp/capability-manifest/fresh1.md
uv run --with griffe python "$EXTRACTOR" render /tmp/capability-manifest/normalized.json "$PURPOSES" > /tmp/capability-manifest/fresh2.md
cmp /tmp/capability-manifest/fresh1.md /tmp/capability-manifest/fresh2.md
cp /tmp/capability-manifest/fresh1.md docs/agents/sdk-capabilities.md
uv run pre-commit run --files docs/agents/sdk-capabilities.md || true
"""

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["application_sdk"]

[tool.pyright]
venvPath = "."
venv = ".venv"
typeCheckingMode = "standard"
exclude = [
    "application_sdk/test_utils/**",
    "application_sdk/testing/scale_data_generator/**",
    ".github/**",
    "tests"
]
reportUnknownMemberType = "warning"
reportAttributeAccessIssue = "warning"
reportPossiblyUnboundVariable = "information"
reportFunctionMemberAccess = "warning"
reportArgumentType = "warning"
reportGeneralTypeIssues = "warning"
reportMissingImports = "warning"
reportInvalidTypeForm = "warning"

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
addopts = "-m 'not integration and not e2e and not s3_integration and not azure_integration and not gcs_integration'"
markers = [
    "integration: tests requiring local Temporal server",
    "e2e: tests requiring a live K8s cluster",
    "s3_integration: tests requiring real AWS S3 credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, S3_BUCKET)",
    "azure_integration: tests requiring real Azure Blob Storage credentials (AZURE_STORAGE_ACCOUNT, AZURE_STORAGE_KEY)",
    "gcs_integration: tests requiring real GCS credentials (GCS_BUCKET, GCS_PROJECT_ID, GOOGLE_APPLICATION_CREDENTIALS)",
]

[tool.coverage.run]
# `application_sdk/testing/**` ships test infrastructure for downstream apps
# (mocks, fixtures) and internal test runners (integration, e2e, hypothesis,
# parity, scale generation) that are exercised under different markers, not
# under unit tests. Including them in unit coverage drags the percentage down
# without representing product-code quality. Keep `mocks.py` and `fixtures.py`
# in scope since downstream apps consume them as a public testing API.
omit = [
    "tests/**",
    "application_sdk/test_utils/**",
    "application_sdk/testing/scale_data_generator/**",
    "application_sdk/testing/integration/**",
    "application_sdk/testing/e2e/**",
    "application_sdk/testing/hypothesis/**",
    "application_sdk/testing/parity/**",
]
source = ["application_sdk"]

[tool.coverage.report]
exclude_lines = [
    "pragma: no cover",
    "def __repr__",
    "if self.debug:",
    "raise NotImplementedError",
    "if __name__ == .__main__.:",
    "pass",
    "raise ImportError",
]
fail_under = 85
show_missing = true
precision = 2

[tool.ruff.lint]
# explicit-preview-rules: only the preview rules listed in extend-select are
# enabled — other preview rules remain off. This lets us opt into PLC0415
# without inheriting every other preview rule's churn.
preview = true
explicit-preview-rules = true
extend-select = [
    "G001",    # % operator inline in log call (not lazy)
    "G003",    # string concatenation in log call
    "G004",    # f-string in log call
    "T201",    # print() in production code
    "PLC0415", # imports must be at top of module — prevents broken-import-at-runtime bugs (e.g. PR #1543)
    "S110",    # try-except-pass detected
    "S112",    # try-except-continue detected
    "LOG009",  # logger.warn() is deprecated — use .warning()
]

[tool.ruff.lint.per-file-ignores]
"application_sdk/main.py" = ["T201"]
".github/**" = ["G004", "T201"]
# tests, tools, examples exempted from PLC0415: production runtime risk does
# not apply, and tests sometimes use inline imports for fixture isolation.
# F841 is also exempted in tests because enabling `preview = true` (required
# for PLC0415) made F841 stricter on tuple unpacking and codemod tests
# routinely capture-and-discard return values for assertion staging.
"tests/**" = ["G004", "PLC0415", "F841"]
"tools/**" = ["T201", "PLC0415"]
"application_sdk/tools/**" = ["T201", "PLC0415"]
"examples/**" = ["T201", "PLC0415"]
"contract-toolkit/scripts/**" = ["T201", "PLC0415"]
"contract-toolkit/examples/**/generated/_input.py" = ["F401"]
# Mid-file import required to break circular dependency between models.py and assertions.py
"application_sdk/testing/integration/models.py" = ["E402"]
# Post-importorskip imports required so the test module skips cleanly when rocksdict is absent.
"tests/unit/common/test_spillable_dict.py" = ["E402"]

[tool.uv]
default-groups = ["dev", "test"]
constraint-dependencies = [
    "python-multipart>=0.0.26",  # CVE-2026-24486, CVE-2026-40347
    "protobuf>=6.33.5",          # CVE-2026-0994
    "authlib>=1.6.11",           # CVE-2026-28802, GHSA-jj8c-mmj3-mmgv (CSRF via cache)
    "black>=26.3.1",             # CVE-2026-32274
    "pyjwt>=2.12.0",             # CVE-2026-32597
    "simpleeval>=1.0.5",         # CVE-2026-32640
    "python-dotenv>=1.2.2",      # CVE-2026-28684 (symlink file overwrite)
]

# Uncomment the following section in case you want to publish to testpypi
# [[tool.uv.index]]
# name = "testpypi"
# url = "https://test.pypi.org/simple/"
# publish-url = "https://test.pypi.org/legacy/"
# explicit = true