From 8b2cbf1a9ae2e0030ac8de3d7b93f24a31358458 Mon Sep 17 00:00:00 2001
From: Tiago Kochenborger <tiago.kochenborger@sap.com>
Date: Tue, 6 Oct 2026 17:06:25 -0300
Subject: [PATCH 1/3] fix(adms): reject blank user_jwt in OBO mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Blank or whitespace-only user_jwt values triggered a silent fallback from
OBO (per-user) to service (application) credentials due to Python truthy
checks (if self._user_jwt / if _jwt). Empty and whitespace-only strings
are falsy, silently routing to get_token() (service credentials) instead
of exchange_token() (OBO) — an authorization-escalation attack surface.

Fix: add a single enforcement helper _require_non_blank_jwt and apply it
at every public entry point — constructors (conditional on is not None),
with_user_jwt methods (unconditional), and factory functions (conditional).
Correct both truthy-check bug sites to use is not None comparisons.

Behavior contract (before → after):
- create_client()/user_jwt=None  → service creds (unchanged)
- create_client(user_jwt='valid') → OBO exchange (unchanged)
- create_client(user_jwt='')/'  ' → ValueError
- AdmsHttp(user_jwt=None)        → service creds (unchanged)
- AdmsHttp(user_jwt='')/'  '     → ValueError
- with_user_jwt('valid')         → OBO exchange (unchanged)
- with_user_jwt('')/'  '/None    → ValueError

BREAKING CHANGE: passing empty or whitespace user_jwt (which previously
silently used service credentials) now raises ValueError. user_jwt=None /
omitted (service mode) is unchanged. Cross-repo scan confirmed zero
external consumers of sap_cloud_sdk.adms.
---
 src/sap_cloud_sdk/adms/_http.py      |  38 +++++++-
 src/sap_cloud_sdk/adms/client.py     |  22 ++++-
 src/sap_cloud_sdk/adms/user-guide.md |   9 ++
 tests/adms/unit/test_client.py       |  65 +++++++++++++
 tests/adms/unit/test_http.py         | 138 +++++++++++++++++++++++++++
 5 files changed, 267 insertions(+), 5 deletions(-)

diff --git a/src/sap_cloud_sdk/adms/_http.py b/src/sap_cloud_sdk/adms/_http.py
index 76a076ab..61844bd6 100644
--- a/src/sap_cloud_sdk/adms/_http.py
+++ b/src/sap_cloud_sdk/adms/_http.py
@@ -46,6 +46,24 @@
 _RESPONSE_TEXT_TRUNCATION_LIMIT = 500
 
 
+def _require_non_blank_jwt(user_jwt: str | None) -> None:
+    """Enforce the OBO invariant: a user assertion must be a non-blank string.
+
+    Raises :class:`ValueError` for ``None``, empty, or whitespace-only input.
+    Callers that want service credentials must omit *user_jwt* (or pass
+    ``None``) at the constructor/factory level, which guards with
+    ``if user_jwt is not None``.
+
+    Blank/whitespace JWTs must never silently fall through to application
+    credentials — callers must always supply a real assertion for OBO mode.
+    """
+    if user_jwt is None or not user_jwt.strip():
+        raise ValueError(
+            "user_jwt must be a non-blank string for OBO mode; "
+            "omit it (or pass None) to use service credentials"
+        )
+
+
 def quote_odata_string_key(value: str) -> str:
     """Quote and escape a string value for use in an OData V4 entity key segment.
 
@@ -177,6 +195,8 @@ def __init__(
         self._token_fetcher = token_fetcher
         self._session = session or requests.Session()
         self._user_jwt = user_jwt
+        if user_jwt is not None:
+            _require_non_blank_jwt(user_jwt)
         self._csrf_tokens: dict[str, str] = {}
         # Guards the _csrf_tokens dict.  ``AdmsHttp`` is documented as safe to
         # share across threads (matching ``requests.Session``); without this
@@ -190,10 +210,16 @@ def with_user_jwt(self, user_jwt: str) -> "AdmsHttp":
 
         Args:
             user_jwt: The user's OIDC or XSUAA JWT from the inbound request.
+                Must be a non-blank string — ``None`` and blank/whitespace raise
+                :class:`ValueError`.
 
         Returns:
             New :class:`AdmsHttp` for user-context calls.
+
+        Raises:
+            ValueError: If *user_jwt* is ``None``, empty, or whitespace-only.
         """
+        _require_non_blank_jwt(user_jwt)
         return AdmsHttp(
             config=self._config,
             token_fetcher=self._token_fetcher,
@@ -291,7 +317,7 @@ def _send_with_csrf(
     # ------------------------------------------------------------------
 
     def _bearer_token(self) -> str:
-        if self._user_jwt:
+        if self._user_jwt is not None:
             return self._token_fetcher.exchange_token(self._user_jwt)
         return self._token_fetcher.get_token()
 
@@ -436,6 +462,8 @@ def __init__(
         self._config = config
         self._token_fetcher = token_fetcher
         self._user_jwt = user_jwt
+        if user_jwt is not None:
+            _require_non_blank_jwt(user_jwt)
         # Default to owning the underlying ``httpx.AsyncClient``.  Borrowed
         # instances created via :meth:`with_user_jwt` flip this to ``False``
         # so they share — and do *not* close — the parent's connection pool.
@@ -443,7 +471,7 @@ def __init__(
         _jwt = user_jwt  # capture for closure before super().__init__()
         get_token = (
             (lambda: token_fetcher.exchange_token(_jwt))
-            if _jwt
+            if _jwt is not None
             else token_fetcher.get_token
         )
         super().__init__(
@@ -646,10 +674,16 @@ def with_user_jwt(self, user_jwt: str) -> "AsyncAdmsHttp":
 
         Args:
             user_jwt: The user's OIDC or XSUAA JWT from the inbound request.
+                Must be a non-blank string — ``None`` and blank/whitespace raise
+                :class:`ValueError`.
 
         Returns:
             New :class:`AsyncAdmsHttp` for user-context calls.
+
+        Raises:
+            ValueError: If *user_jwt* is ``None``, empty, or whitespace-only.
         """
+        _require_non_blank_jwt(user_jwt)
         borrowed = AsyncAdmsHttp(
             config=self._config,
             token_fetcher=self._token_fetcher,
diff --git a/src/sap_cloud_sdk/adms/client.py b/src/sap_cloud_sdk/adms/client.py
index 671ff396..25aa9f96 100644
--- a/src/sap_cloud_sdk/adms/client.py
+++ b/src/sap_cloud_sdk/adms/client.py
@@ -49,7 +49,7 @@
     _ConfigurationApi,
 )
 from sap_cloud_sdk.adms._document_api import _AsyncDocumentApi, _DocumentApi
-from sap_cloud_sdk.adms._http import AdmsHttp, AsyncAdmsHttp
+from sap_cloud_sdk.adms._http import AdmsHttp, AsyncAdmsHttp, _require_non_blank_jwt
 from sap_cloud_sdk.adms._ias_fetcher import IasTokenFetcher
 from sap_cloud_sdk.adms._job_api import _AsyncJobApi, _JobApi
 from sap_cloud_sdk.adms._relation_api import (
@@ -91,10 +91,16 @@ def with_user_jwt(self, user_jwt: str) -> "AdmsClient":
 
         Args:
             user_jwt: The user's OIDC or XSUAA JWT from the inbound request.
+                Must be a non-blank string — ``None`` and blank/whitespace raise
+                :class:`ValueError`.
 
         Returns:
             New :class:`AdmsClient` configured for user-context calls.
+
+        Raises:
+            ValueError: If *user_jwt* is ``None``, empty, or whitespace-only.
         """
+        _require_non_blank_jwt(user_jwt)
         return AdmsClient(self._http.with_user_jwt(user_jwt))
 
 
@@ -129,10 +135,16 @@ def with_user_jwt(self, user_jwt: str) -> "AsyncAdmsClient":
 
         Args:
             user_jwt: The user's OIDC or XSUAA JWT.
+                Must be a non-blank string — ``None`` and blank/whitespace raise
+                :class:`ValueError`.
 
         Returns:
             New :class:`AsyncAdmsClient` for user-context calls.
+
+        Raises:
+            ValueError: If *user_jwt* is ``None``, empty, or whitespace-only.
         """
+        _require_non_blank_jwt(user_jwt)
         return AsyncAdmsClient(self._http.with_user_jwt(user_jwt))
 
 
@@ -166,12 +178,14 @@ def create_client(
 
     Raises:
         ConfigError: If the binding configuration is missing or incomplete.
-        ValueError: If ``instance`` is an empty string.
+        ValueError: If ``instance`` is an empty string or ``user_jwt`` is blank/whitespace.
     """
     if instance is not None and instance == "":
         raise ValueError(
             "instance must not be an empty string; omit it to use 'default'"
         )
+    if user_jwt is not None:
+        _require_non_blank_jwt(user_jwt)
     try:
         if config is not None:
             token_fetcher = IasTokenFetcher(config=config, cache=token_cache)
@@ -210,12 +224,14 @@ def create_async_client(
 
     Raises:
         ConfigError: If binding configuration is missing or incomplete.
-        ValueError: If ``instance`` is an empty string.
+        ValueError: If ``instance`` is an empty string or ``user_jwt`` is blank/whitespace.
     """
     if instance is not None and instance == "":
         raise ValueError(
             "instance must not be an empty string; omit it to use 'default'"
         )
+    if user_jwt is not None:
+        _require_non_blank_jwt(user_jwt)
     try:
         if config is not None:
             token_fetcher = IasTokenFetcher(config=config, cache=token_cache)
diff --git a/src/sap_cloud_sdk/adms/user-guide.md b/src/sap_cloud_sdk/adms/user-guide.md
index ac4dd076..0f495f1f 100644
--- a/src/sap_cloud_sdk/adms/user-guide.md
+++ b/src/sap_cloud_sdk/adms/user-guide.md
@@ -78,6 +78,15 @@ client = create_client(config=config)
 client = create_client(user_jwt=request.headers["Authorization"].split()[1])
 ```
 
+> **Note:** `user_jwt` must be a non-blank string. Passing an
+> empty string or whitespace-only value raises `ValueError` instead of silently
+> falling back to service credentials. To use service credentials explicitly,
+> omit `user_jwt` or pass `None` at `create_client` / `create_async_client`.
+>
+> `with_user_jwt(...)` always requires a non-blank JWT — passing `None` or
+> blank raises `ValueError`, since the method signals explicit user-context
+> intent. Use the service-credentials factory path instead.
+
 ## Token Cache for Scale-Out
 
 ```python
diff --git a/tests/adms/unit/test_client.py b/tests/adms/unit/test_client.py
index fe5e23d2..6a139804 100644
--- a/tests/adms/unit/test_client.py
+++ b/tests/adms/unit/test_client.py
@@ -140,6 +140,25 @@ def test_with_user_jwt_uses_new_http(self, mock_http):
         assert user_client._http is mock_user_http
         assert client._http is mock_http
 
+    def test_with_user_jwt_empty_raises(self, mock_http):
+        facade guard fires before delegating to transport.
+        client = AdmsClient(mock_http)
+        with pytest.raises(ValueError, match="non-blank"):
+            client.with_user_jwt("")
+        mock_http.with_user_jwt.assert_not_called()
+
+    def test_with_user_jwt_whitespace_raises(self, mock_http):
+        client = AdmsClient(mock_http)
+        with pytest.raises(ValueError, match="non-blank"):
+            client.with_user_jwt("   ")
+        mock_http.with_user_jwt.assert_not_called()
+
+    def test_with_user_jwt_none_raises(self, mock_http):
+        client = AdmsClient(mock_http)
+        with pytest.raises(ValueError, match="non-blank"):
+            client.with_user_jwt(None)  # type: ignore[arg-type]
+        mock_http.with_user_jwt.assert_not_called()
+
 
 class TestCreateClientFactory:
     def test_raises_config_error_on_missing_binding(self):
@@ -220,6 +239,35 @@ def test_user_jwt_forwarded_to_http(self):
 
         assert client._http._user_jwt == "user-jwt-123"
 
+    def test_create_client_empty_user_jwt_raises(self):
+        factory guard must fire before binding resolution.
+        mock_config = AdmsConfig(
+            service_url="https://adm.example.com",
+            ias_url="https://ias.example.com",
+            client_id="cid",
+            client_secret="cs",
+        )
+        factory = MagicMock(return_value=mock_config)
+        with patch(
+            "sap_cloud_sdk.adms.client._make_config_factory", return_value=factory
+        ):
+            with pytest.raises(ValueError, match="non-blank"):
+                create_client(user_jwt="")
+
+    def test_create_client_whitespace_user_jwt_raises(self):
+        mock_config = AdmsConfig(
+            service_url="https://adm.example.com",
+            ias_url="https://ias.example.com",
+            client_id="cid",
+            client_secret="cs",
+        )
+        factory = MagicMock(return_value=mock_config)
+        with patch(
+            "sap_cloud_sdk.adms.client._make_config_factory", return_value=factory
+        ):
+            with pytest.raises(ValueError, match="non-blank"):
+                create_client(user_jwt="   ")
+
 
 # ── AsyncAdmsHttp ─────────────────────────────────────────────────────────────
 
@@ -482,6 +530,23 @@ def test_accepts_explicit_config(self, config):
         mock_make.assert_not_called()
         assert isinstance(client, AsyncAdmsClient)
 
+    def test_create_async_client_empty_user_jwt_raises(self, config):
+        async factory guard.
+        mock_factory = MagicMock(return_value=config)
+        with patch(
+            "sap_cloud_sdk.adms.client._make_config_factory", return_value=mock_factory
+        ):
+            with pytest.raises(ValueError, match="non-blank"):
+                create_async_client(user_jwt="")
+
+    def test_create_async_client_whitespace_user_jwt_raises(self, config):
+        mock_factory = MagicMock(return_value=config)
+        with patch(
+            "sap_cloud_sdk.adms.client._make_config_factory", return_value=mock_factory
+        ):
+            with pytest.raises(ValueError, match="non-blank"):
+                create_async_client(user_jwt="   ")
+
 
 # ── _AsyncDocumentApi ──────────────────────────────────────────────────────────
 
diff --git a/tests/adms/unit/test_http.py b/tests/adms/unit/test_http.py
index 751f74b6..5f5dcd03 100644
--- a/tests/adms/unit/test_http.py
+++ b/tests/adms/unit/test_http.py
@@ -3,12 +3,14 @@
 from typing import Optional
 from unittest.mock import MagicMock
 
+import httpx
 import pytest
 import requests
 
 from sap_cloud_sdk.adms._ias_fetcher import IasTokenFetcher
 from sap_cloud_sdk.adms._http import (
     AdmsHttp,
+    AsyncAdmsHttp,
     build_allowed_domain_key_path,
     build_business_object_node_type_key_path,
     build_doctype_botype_map_key_path,
@@ -221,6 +223,142 @@ def test_service_jwt_uses_get_token(self, config, token_fetcher):
         token_fetcher.exchange_token.assert_not_called()
 
 
+class TestAdmsHttpOboInvariant:
+    """OBO invariant — blank/whitespace/None user_jwt must raise ValueError.
+
+    Guards are at: AdmsHttp constructor, AdmsHttp.with_user_jwt,
+    AsyncAdmsHttp constructor, and AsyncAdmsHttp.with_user_jwt.
+    None remains the valid service-credentials sentinel ONLY at the
+    constructor level; with_user_jwt rejects it since it signals explicit OBO
+    intent.
+    """
+
+    # ------------------------------------------------------------------
+    # Sync transport — AdmsHttp
+    # ------------------------------------------------------------------
+
+    def test_constructor_empty_user_jwt_raises(self, config, token_fetcher):
+        with pytest.raises(ValueError, match="non-blank"):
+            AdmsHttp(config=config, token_fetcher=token_fetcher, user_jwt="")
+
+    def test_constructor_whitespace_user_jwt_raises(self, config, token_fetcher):
+        with pytest.raises(ValueError, match="non-blank"):
+            AdmsHttp(config=config, token_fetcher=token_fetcher, user_jwt="  ")
+
+    def test_constructor_none_user_jwt_does_not_raise(self, config, token_fetcher):
+        # Regression: None is the documented service-mode sentinel — must NOT raise.
+        http = AdmsHttp(config=config, token_fetcher=token_fetcher, user_jwt=None)
+        assert http is not None
+
+    def test_with_user_jwt_empty_raises(self, config, token_fetcher):
+        http = AdmsHttp(config=config, token_fetcher=token_fetcher)
+        with pytest.raises(ValueError, match="non-blank"):
+            http.with_user_jwt("")
+
+    def test_with_user_jwt_whitespace_raises(self, config, token_fetcher):
+        http = AdmsHttp(config=config, token_fetcher=token_fetcher)
+        with pytest.raises(ValueError, match="non-blank"):
+            http.with_user_jwt("   ")
+
+    def test_with_user_jwt_none_raises(self, config, token_fetcher):
+        # with_user_jwt signals explicit OBO intent — None must also raise.
+        http = AdmsHttp(config=config, token_fetcher=token_fetcher)
+        with pytest.raises(ValueError, match="non-blank"):
+            http.with_user_jwt(None)  # type: ignore[arg-type]
+
+    def test_valid_jwt_calls_exchange_not_get(self, config, token_fetcher):
+        session = MagicMock(spec=requests.Session)
+        session.request.return_value = _make_resp(200)
+        http = AdmsHttp(
+            config=config,
+            token_fetcher=token_fetcher,
+            session=session,
+            user_jwt="valid.jwt.token",
+        )
+        http.get("Document")
+        token_fetcher.exchange_token.assert_called_once_with("valid.jwt.token")
+        token_fetcher.get_token.assert_not_called()
+
+    def test_none_jwt_uses_service_credentials(self, config, token_fetcher):
+        # Regression: None → service creds, not OBO.
+        session = MagicMock(spec=requests.Session)
+        session.request.return_value = _make_resp(200)
+        http = AdmsHttp(
+            config=config, token_fetcher=token_fetcher, session=session, user_jwt=None
+        )
+        http.get("Document")
+        token_fetcher.get_token.assert_called()
+        token_fetcher.exchange_token.assert_not_called()
+
+    # ------------------------------------------------------------------
+    # Async transport — AsyncAdmsHttp
+    # ------------------------------------------------------------------
+
+    def test_async_constructor_empty_user_jwt_raises(self, config):
+        fetcher = MagicMock(spec=IasTokenFetcher)
+        with pytest.raises(ValueError, match="non-blank"):
+            AsyncAdmsHttp(
+                config=config,
+                token_fetcher=fetcher,
+                client=MagicMock(spec=httpx.AsyncClient),
+                user_jwt="",
+            )
+
+    def test_async_constructor_whitespace_user_jwt_raises(self, config):
+        fetcher = MagicMock(spec=IasTokenFetcher)
+        with pytest.raises(ValueError, match="non-blank"):
+            AsyncAdmsHttp(
+                config=config,
+                token_fetcher=fetcher,
+                client=MagicMock(spec=httpx.AsyncClient),
+                user_jwt="   ",
+            )
+
+    def test_async_constructor_none_does_not_raise(self, config):
+        fetcher = MagicMock(spec=IasTokenFetcher)
+        fetcher.get_token.return_value = "service-token"
+        http = AsyncAdmsHttp(
+            config=config,
+            token_fetcher=fetcher,
+            client=MagicMock(spec=httpx.AsyncClient),
+            user_jwt=None,
+        )
+        assert http is not None
+
+    def test_async_with_user_jwt_empty_raises(self, config):
+        fetcher = MagicMock(spec=IasTokenFetcher)
+        fetcher.get_token.return_value = "service-token"
+        http = AsyncAdmsHttp(
+            config=config,
+            token_fetcher=fetcher,
+            client=MagicMock(spec=httpx.AsyncClient),
+        )
+        with pytest.raises(ValueError, match="non-blank"):
+            http.with_user_jwt("")
+
+    def test_async_with_user_jwt_whitespace_raises(self, config):
+        fetcher = MagicMock(spec=IasTokenFetcher)
+        fetcher.get_token.return_value = "service-token"
+        http = AsyncAdmsHttp(
+            config=config,
+            token_fetcher=fetcher,
+            client=MagicMock(spec=httpx.AsyncClient),
+        )
+        with pytest.raises(ValueError, match="non-blank"):
+            http.with_user_jwt("   ")
+
+    def test_async_with_user_jwt_none_raises(self, config):
+        fetcher = MagicMock(spec=IasTokenFetcher)
+        fetcher.get_token.return_value = "service-token"
+        http = AsyncAdmsHttp(
+            config=config,
+            token_fetcher=fetcher,
+            client=MagicMock(spec=httpx.AsyncClient),
+        )
+        with pytest.raises(ValueError, match="non-blank"):
+            http.with_user_jwt(None)  # type: ignore[arg-type]
+
+
 class TestQuoteOdataStringKey:
     def test_simple_value(self):
         assert quote_odata_string_key("job-123") == "'job-123'"

From 6a47abe2f9072577d361c6c06ce04873e13fdebd Mon Sep 17 00:00:00 2001
From: Tiago Kochenborger <tiago.kochenborger@sap.com>
Date: Wed, 7 Oct 2026 15:11:39 -0300
Subject: [PATCH 2/3] fix(adms): remove dangling comment text from test_client
 and bump version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three test methods in test_client.py had bare text lines (left over from
comment cleanup) that were invalid Python — removed them. Bump version to
0.57.3 to satisfy the CI version-bump gate for src/ changes.
---
 pyproject.toml                 |  2 +-
 tests/adms/unit/test_client.py |  3 ---
 uv.lock                        | 28 +++++++++++++++++++++-------
 3 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 9f45a831..b894a0fb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "sap-cloud-sdk"
-version = "0.58.1"
+version = "0.58.2"
 description = "SAP Cloud SDK for Python"
 readme = "README.md"
 license = "Apache-2.0"
diff --git a/tests/adms/unit/test_client.py b/tests/adms/unit/test_client.py
index 6a139804..00700df7 100644
--- a/tests/adms/unit/test_client.py
+++ b/tests/adms/unit/test_client.py
@@ -141,7 +141,6 @@ def test_with_user_jwt_uses_new_http(self, mock_http):
         assert client._http is mock_http
 
     def test_with_user_jwt_empty_raises(self, mock_http):
-        facade guard fires before delegating to transport.
         client = AdmsClient(mock_http)
         with pytest.raises(ValueError, match="non-blank"):
             client.with_user_jwt("")
@@ -240,7 +239,6 @@ def test_user_jwt_forwarded_to_http(self):
         assert client._http._user_jwt == "user-jwt-123"
 
     def test_create_client_empty_user_jwt_raises(self):
-        factory guard must fire before binding resolution.
         mock_config = AdmsConfig(
             service_url="https://adm.example.com",
             ias_url="https://ias.example.com",
@@ -531,7 +529,6 @@ def test_accepts_explicit_config(self, config):
         assert isinstance(client, AsyncAdmsClient)
 
     def test_create_async_client_empty_user_jwt_raises(self, config):
-        async factory guard.
         mock_factory = MagicMock(return_value=config)
         with patch(
             "sap_cloud_sdk.adms.client._make_config_factory", return_value=mock_factory
diff --git a/uv.lock b/uv.lock
index dbff64b1..fa859196 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 5
+revision = 3
 requires-python = ">=3.11"
 resolution-markers = [
     "python_full_version >= '3.15' and sys_platform == 'win32'",
@@ -166,9 +166,9 @@ name = "aiologic"
 version = "0.17.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "sniffio" },
-    { name = "typing-extensions" },
-    { name = "wrapt" },
+    { name = "sniffio", marker = "python_full_version < '3.13'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+    { name = "wrapt", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/f1/7a/d51f2fde1e8ae8a83431f8e97b7a71e9358cdb1d4d2ce6be387fa44d68de/aiologic-0.17.1.tar.gz", hash = "sha256:2e1b93b9e88ced318c2a63ad7b382688f40cbfe40e3d42258d49dc9c5aea179d", size = 252354, upload-time = "2026-06-27T20:41:33.25Z" }
 wheels = [
@@ -816,8 +816,8 @@ name = "culsans"
 version = "0.11.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "aiologic" },
-    { name = "typing-extensions" },
+    { name = "aiologic", marker = "python_full_version < '3.13'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/d9/e3/49afa1bc180e0d28008ec6bcdf82a4072d1c7a41032b5b759b60814ca4b0/culsans-0.11.0.tar.gz", hash = "sha256:0b43d0d05dce6106293d114c86e3fb4bfc63088cfe8ff08ed3fe36891447fe33", size = 107546, upload-time = "2025-12-31T23:15:38.196Z" }
 wheels = [
@@ -1187,7 +1187,9 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/4e/a3/07297917485ee2ca85bc3c8dc6ed85ad3fffcf424047fba62671dba68e97/greenlet-3.5.5-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:be63afcbbccfad3dd95a1ba12ada84dab2ef32031973d80b5b92df67fa763a61", size = 294165, upload-time = "2026-08-10T13:25:17.987Z" },
     { url = "https://files.pythonhosted.org/packages/db/51/6f732f9314cda54c5fd48a7620c7160f4f286967e8045ad94b9d66ce80b7/greenlet-3.5.5-cp311-cp311-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8a268024ce2d7d2b04694bf1594058981a9fa663d1df4b762dee499211ed7c1c", size = 613610, upload-time = "2026-08-10T14:14:33.829Z" },
     { url = "https://files.pythonhosted.org/packages/d8/c0/b27589e25d220289edcd4d582b2b17b83058d1a56d53d971b6ea1a34f10d/greenlet-3.5.5-cp311-cp311-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:35cbb8bf55ace57fbccb4fb8622c4521713acd8691e77f4696d416ea7ca527da", size = 625481, upload-time = "2026-08-10T14:27:23.647Z" },
+    { url = "https://files.pythonhosted.org/packages/39/82/5c873dbb4fb001d22fbbd50e80d4c1b0181ddae106856132160f84b94e88/greenlet-3.5.5-cp311-cp311-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:abc8bc8d9f935cd685457545b6a53863a877fdc12c2c0f5ee9beee18d9db139c", size = 633329, upload-time = "2026-08-10T14:30:06.062Z" },
     { url = "https://files.pythonhosted.org/packages/51/2d/f2c928218ac52f26d7a2c188c171d1b7e728b23782cb3347e7b4fce1493a/greenlet-3.5.5-cp311-cp311-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:74cc6df89ec5302337adc9cf096221cbed2510fd444b0e0f1586cf0470740864", size = 624562, upload-time = "2026-08-10T13:40:48.064Z" },
+    { url = "https://files.pythonhosted.org/packages/70/12/f7df98e72a8eb4a7edfec5a08d6d1a4ab53a52c95ba0b2ea6c10b8dd9bd0/greenlet-3.5.5-cp311-cp311-manylinux_2_39_riscv64.whl", hash = "sha256:3134291427bb0f3526e9d90311988caf336eb43730e95244997a4fb15f45144f", size = 428145, upload-time = "2026-08-10T14:30:01.071Z" },
     { url = "https://files.pythonhosted.org/packages/3e/4a/92fc51d5d35912f4f06eec037ba347985defd0be47463a010a325634d9d2/greenlet-3.5.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:6d9b454c5fc48aeaa7c4337813dbf513a6870468e426438a04d922c6d0fe63db", size = 1584909, upload-time = "2026-08-10T14:15:04.343Z" },
     { url = "https://files.pythonhosted.org/packages/ac/58/ed98b80ac5738c149a5258544843c45601ade1fd70f61740cdaead6351b3/greenlet-3.5.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:03551ed792cb1b4fc0277a0c60dfd8c343894a0ba06fe60dcd22f568b433da39", size = 1651184, upload-time = "2026-08-10T13:40:28.879Z" },
     { url = "https://files.pythonhosted.org/packages/d8/be/b582ceb80cefdf9d8da34078714e4b12b3d16f509dee0f65e40a5cc8fc7d/greenlet-3.5.5-cp311-cp311-win_amd64.whl", hash = "sha256:ab3df3dffb58bf70564e93a5cec7941e4d9faa5a36cc4234a10d3131afe04f53", size = 323280, upload-time = "2026-08-10T13:26:07.495Z" },
@@ -1195,7 +1197,9 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/2e/7e/9ecd0285e3153532ae07aeb88063c43c72b4221cf0d4d123b02f3682e3ff/greenlet-3.5.5-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:49520f0c95a48b42cf55414b8e8479beb274ea70431afc33e3f79903c71f4380", size = 295809, upload-time = "2026-08-10T13:25:34.023Z" },
     { url = "https://files.pythonhosted.org/packages/35/73/60e4bbcc89252037b18087f2ec16405d5b2d5be42dde191bbf3667e96102/greenlet-3.5.5-cp312-cp312-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:55272212cbc5f43d1d723725ab931f1939969b7e9523882ca58b55061769d053", size = 611910, upload-time = "2026-08-10T14:14:35.18Z" },
     { url = "https://files.pythonhosted.org/packages/a4/17/cd5134be659cd4a443e7a61ae670dabec165a814c51162916d637b6dd38e/greenlet-3.5.5-cp312-cp312-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:655bca754a2ef4efcb0eb48a94d3f4593536d0f3d48f8ed44343c01d16a92f95", size = 624198, upload-time = "2026-08-10T14:27:25.229Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/30/87c212b5c684d0e72974f1063b7a9687631e8985902c06e1016542c874e7/greenlet-3.5.5-cp312-cp312-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6ca5d6ae0739e5764f2cfcfaa562ac5a990cbdaedca93251c5e3cf07c362371f", size = 629504, upload-time = "2026-08-10T14:30:07.967Z" },
     { url = "https://files.pythonhosted.org/packages/78/ac/5c5b959999b6f09c3026b5dfe171575bc3121c5236ce74f495096f25b203/greenlet-3.5.5-cp312-cp312-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:147b25a42e5ca5be3d42356e8f608b37af715a1c196e9bf9d1627f3341adfe1d", size = 621439, upload-time = "2026-08-10T13:40:49.391Z" },
+    { url = "https://files.pythonhosted.org/packages/63/2c/eb487fafc9f50ffff2b1e0b697f70fb34bf150821c08ab225aacf5583a7e/greenlet-3.5.5-cp312-cp312-manylinux_2_39_riscv64.whl", hash = "sha256:1b5ed9162c0c098e0bbc2cf88a94f433c1b8926f831745252e099e5d83e17759", size = 432462, upload-time = "2026-08-10T14:30:02.309Z" },
     { url = "https://files.pythonhosted.org/packages/c8/8b/6acf112ed8aee499f25b4d6949820fb02ac950ff9c1f3d793bd5be0599f2/greenlet-3.5.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:27493374cff1d1b7919dc8126547f2aea582737e3046147b434b1e12de56389b", size = 1581342, upload-time = "2026-08-10T14:15:05.653Z" },
     { url = "https://files.pythonhosted.org/packages/b8/d7/734e5f198888876b42d7616ff6644c075baf6b8a2412deadd6b0e1b8b20c/greenlet-3.5.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:12e2ee66c2aba86133f10fd99d6a8856c6d351ffb7be0e4d52ef2cc5fbb705b2", size = 1645744, upload-time = "2026-08-10T13:40:30.353Z" },
     { url = "https://files.pythonhosted.org/packages/de/30/1f42b88dc587b5899ee50616ad56ee40cafaf225df4fb829f10183c62a5c/greenlet-3.5.5-cp312-cp312-win_amd64.whl", hash = "sha256:49ddacd36af37735fab103846f4ee4d18a492dde72730d1699c0c8ebe30d9f18", size = 324171, upload-time = "2026-08-10T13:28:44.472Z" },
@@ -1203,7 +1207,9 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/fb/3d/8cef5f724ec0d4add2af8961d504535ec60c3cca9e464f6d03bdba29d85b/greenlet-3.5.5-cp313-cp313-macosx_11_0_universal2.whl", hash = "sha256:b79fd2a5bc099b5e744f34c4c9a58954a5f4cb7529fb4b6e8446057d61b6edaa", size = 294730, upload-time = "2026-08-10T13:27:51.206Z" },
     { url = "https://files.pythonhosted.org/packages/88/4b/8e7aa3f514273aecff30a16ab1bac09ff54cfc7e6860fdd8058c37ff2499/greenlet-3.5.5-cp313-cp313-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:634cf15a233a949136879dd388e25d3296e16f3f1e217d2456797b8579ebc6ed", size = 614536, upload-time = "2026-08-10T14:14:36.589Z" },
     { url = "https://files.pythonhosted.org/packages/85/48/4e95e9dd5a8a397dc6a6345dd7f1935113d0fca4f85e89d3976da9cd988d/greenlet-3.5.5-cp313-cp313-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:499adea519f748407fc6806d20eedabac2884fd73b9f38d81236e190ba20dfef", size = 626924, upload-time = "2026-08-10T14:27:27.048Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/84/eaa476d6bf3816828d0d70e80dcc36bf30a058233bd889e707e693f6e860/greenlet-3.5.5-cp313-cp313-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f7278591501941bb2456af102bb9cd59aab48c6cfd6e2dd68fa1290bb0c49a42", size = 632726, upload-time = "2026-08-10T14:30:09.874Z" },
     { url = "https://files.pythonhosted.org/packages/89/5d/398a1c71fa7a277deeb376c999979de6786f08fc2d5747a0b9d6e11738dd/greenlet-3.5.5-cp313-cp313-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2eabb980975cba5b93a95f6f69287d05fc05ac955bfd6a320a7c083eeb52c0b0", size = 623906, upload-time = "2026-08-10T13:40:50.501Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/f2/0cc2849ede68579291e9c59b3ab6ec1958f98681cca5b14d8fc75bf674a4/greenlet-3.5.5-cp313-cp313-manylinux_2_39_riscv64.whl", hash = "sha256:4dfc7c4470354e7b09184d1a3a985761053a2fd694ddb5b5c80242afc2c8c90b", size = 434966, upload-time = "2026-08-10T14:30:03.729Z" },
     { url = "https://files.pythonhosted.org/packages/04/1b/745450fc5ea9e0cb17d840d248f284db3363de736d362c7d2d883e3eadba/greenlet-3.5.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:03115c2e0a371999bf8ae616aa8d653f96641d4705c457aebaa187276e9f7537", size = 1581430, upload-time = "2026-08-10T14:15:06.853Z" },
     { url = "https://files.pythonhosted.org/packages/d4/29/d51b296e3191bb15d3d81ec375af1909e4466c0f395d744ed475801798a9/greenlet-3.5.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4441153ffba21b90d3ca89fe3d31f5c093ae6c0bf0cfdfc98f54cde22f95b62e", size = 1645684, upload-time = "2026-08-10T13:40:32.133Z" },
     { url = "https://files.pythonhosted.org/packages/12/63/369f1a1625e64e9e31df3963c6044056e3fdfa3fa3fdba3c54ffefa6e987/greenlet-3.5.5-cp313-cp313-win_amd64.whl", hash = "sha256:95c5b1f4b3a193f8a0c2de4bfdcb48d119f7f1063941f1de1f2168051b3e52dd", size = 324075, upload-time = "2026-08-10T13:26:58.974Z" },
@@ -1211,7 +1217,9 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/7f/8c/080e881fa2be95ff1ddbd6994b2bab3b1a78df3b3fcab39306011764fcc7/greenlet-3.5.5-cp314-cp314-macosx_11_0_universal2.whl", hash = "sha256:d4a389a852e392a6366058651a20fa5ba40d979865aa81bea2ccbdc44805070d", size = 295309, upload-time = "2026-08-10T13:26:03.032Z" },
     { url = "https://files.pythonhosted.org/packages/25/cc/0ac614e6586c0e42d4cc281a5819150f4f43685744a4c5ff77139286409d/greenlet-3.5.5-cp314-cp314-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:70b157cd319873e8b544ddc2de158f55bbd0a9b0218c8ce9332039801518e328", size = 661185, upload-time = "2026-08-10T14:14:37.867Z" },
     { url = "https://files.pythonhosted.org/packages/5e/b9/6808725354be8ad305dfe5172377664fc9642d4fc043be246b3314cf4482/greenlet-3.5.5-cp314-cp314-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8bdfd1424abcf26832961e766570cae79efdb9599d709088c9cb6ef82b194926", size = 673419, upload-time = "2026-08-10T14:27:28.652Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/52/f005d579acde46c3d1cc3cab1c9f3d5708c8a3006a4120e8cf5da801afe9/greenlet-3.5.5-cp314-cp314-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d98ef6f92e67c6dbf299dbfd8facc1b0d2d9cedf91e325e73b3d0373fe4309d8", size = 677863, upload-time = "2026-08-10T14:30:11.663Z" },
     { url = "https://files.pythonhosted.org/packages/42/2e/40c509967da7f254680826a2fa0dd22138ec79946c70b97542d74cde8b43/greenlet-3.5.5-cp314-cp314-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:182de51c6b572a705f2fafaab2e783bcf7d2760940229dfe73086cbae037af3e", size = 670822, upload-time = "2026-08-10T13:40:51.833Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/8a/a75f8a2bdcef3c358a3147cdc9db3aa83755f0a038f766ab0bedb66f512c/greenlet-3.5.5-cp314-cp314-manylinux_2_39_riscv64.whl", hash = "sha256:159df1942d88e8f784cbb38d6f18bdb365cd11319cfbb3e89623de2b97892d53", size = 480554, upload-time = "2026-08-10T14:30:05.171Z" },
     { url = "https://files.pythonhosted.org/packages/2d/22/c3c2eee4a8fe191d6d1d183086c56133d646024e3d70bfd414829f64560b/greenlet-3.5.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:8fec3f165dfe332e490c3247c0f6c23b0bfc45f06496ad7f00ddb00e3d35e4dc", size = 1628469, upload-time = "2026-08-10T14:15:08.11Z" },
     { url = "https://files.pythonhosted.org/packages/f7/87/25babd09b94cb1f03e71db815fde463f0262e40cfbd953d58a8d77311351/greenlet-3.5.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:c6ce25fee6cabc8bf22cb8b52e642cbb821be5b9aec8094d07ff03378141b8e9", size = 1691952, upload-time = "2026-08-10T13:40:33.502Z" },
     { url = "https://files.pythonhosted.org/packages/2e/3d/5cc9701117ea4dc0eb7bf1f4f9b7888a6e2e5277ddfae095805ace50f2b6/greenlet-3.5.5-cp314-cp314-win_amd64.whl", hash = "sha256:7dffc5c859fe6059974df1e37d7923d654a83e2ae18fdd616994270e001115e1", size = 327458, upload-time = "2026-08-10T13:27:02.868Z" },
@@ -1219,14 +1227,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/24/e0/50cd600b469e5734c72709b6b1838b6bc63f307b573c772c3132d6ecfe92/greenlet-3.5.5-cp314-cp314t-macosx_11_0_universal2.whl", hash = "sha256:0e5a7de979d764aea1f5b6e95cf92b5b37741b9823702041f34b126e7f690277", size = 305471, upload-time = "2026-08-10T13:26:20.568Z" },
     { url = "https://files.pythonhosted.org/packages/75/a3/77acd66dfc6387b5219b2080806c0cabb73c10eb1bb44b413c40a62015ba/greenlet-3.5.5-cp314-cp314t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fef01bd457f11fc158b130ca0027a3c365693280e8e231b65bdaf57999f39f5b", size = 672470, upload-time = "2026-08-10T14:14:39.058Z" },
     { url = "https://files.pythonhosted.org/packages/b9/71/0d178142dca3ec19f46fb2212ae73d30ad53b9d548dc64804086033a7089/greenlet-3.5.5-cp314-cp314t-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5173a72310725a74afc82c164f0e52cb8ad0de62f2bb623f24f6c0cc07d80272", size = 679973, upload-time = "2026-08-10T14:27:30.072Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/ac/0d7887aa4bbfc9eba075cc428244dfc96f623478454d5ec81180d0d6bd5a/greenlet-3.5.5-cp314-cp314t-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5e9ec2e7c98e895fcea0c5cc57b2606cf86ece6d0a56578f3eb225e2af4f0387", size = 681587, upload-time = "2026-08-10T14:30:13.519Z" },
     { url = "https://files.pythonhosted.org/packages/6e/31/46eb8567302eaf787abf88d09df014e14ae3baf460af1b8b0efdbd3efcd5/greenlet-3.5.5-cp314-cp314t-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:44f08341873200ba8a60a8bc14ace3d91f1754f7fa7bc66157714a8cd420a476", size = 676634, upload-time = "2026-08-10T13:40:53.004Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/18/8d58ba1c429b0383e3219a3d0e0bba241d0444d8ed05b73349953c7d7c7b/greenlet-3.5.5-cp314-cp314t-manylinux_2_39_riscv64.whl", hash = "sha256:102817506f6090b5176c746a82603341a549b40e5c3d5b72a4c672228a918c41", size = 510175, upload-time = "2026-08-10T14:30:07.047Z" },
     { url = "https://files.pythonhosted.org/packages/a3/e9/b88bbf5b29970cb84172dc2c32aa3e5e579ceb94c808e81c826454138850/greenlet-3.5.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:d246c0db9a2513cd45f019ba178ea4d4d4705bd210ee465e2c15d76a1ab13874", size = 1637320, upload-time = "2026-08-10T14:15:09.317Z" },
     { url = "https://files.pythonhosted.org/packages/6d/8c/7631ed29cc6f0392f11830076e172ce4885e70b0bc2c1bce1731176d4b4e/greenlet-3.5.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:72507285b5caa1d17904a3f7c322ca780823a54170a0e04ec3f37bcc60d4db71", size = 1697412, upload-time = "2026-08-10T13:40:34.924Z" },
     { url = "https://files.pythonhosted.org/packages/da/0f/f7dd935f9c4cb1be49098770587f54d8a78518e55c89bce86c4fb4109057/greenlet-3.5.5-cp314-cp314t-win_amd64.whl", hash = "sha256:7805655781fb8f28a55d05fe57ed61f5f10f1892fb587673e3bb5264f28041f0", size = 331514, upload-time = "2026-08-10T13:29:20.611Z" },
     { url = "https://files.pythonhosted.org/packages/b7/e5/681b01f8fbc1b55232822f99e8f8afeb78a55a7c76a7bf9dbdc7ccb03a6d/greenlet-3.5.5-cp315-cp315-macosx_11_0_universal2.whl", hash = "sha256:c0db80fcd5b8aece93f66c64f78a786bbb6b96c5fe63ef5a5a4581ecf8bab206", size = 295975, upload-time = "2026-08-10T13:28:45.985Z" },
     { url = "https://files.pythonhosted.org/packages/11/f2/69b488cd9e7267bf4b0fe8cdebf25d8d6df680d21bdf41150d23e23d6652/greenlet-3.5.5-cp315-cp315-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b241c32f912ada659808d68e308c568baf577eebf757d15471472de0c18cfad", size = 666823, upload-time = "2026-08-10T14:14:40.222Z" },
     { url = "https://files.pythonhosted.org/packages/84/d4/d5bc2fdebbdda0c94555925ba79948b8395d75a7f6a36cc85dce5bab9f11/greenlet-3.5.5-cp315-cp315-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ef6a08349401d8eaf3cb12688ac8557de95788556b8631ef17555a4a173022c0", size = 677613, upload-time = "2026-08-10T14:27:31.543Z" },
+    { url = "https://files.pythonhosted.org/packages/65/53/4e13642efc4d7ad6554ecb2242a5be42666b2e1a067323e88dfc0124a04b/greenlet-3.5.5-cp315-cp315-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:37faa97daccb6d9f4c2141ce3118d023c3c5506864a7d8bdf726f665018c1f76", size = 681436, upload-time = "2026-08-10T14:30:14.839Z" },
     { url = "https://files.pythonhosted.org/packages/bd/93/542d8a3a90f3b35c6ad8bf7e56a03010287f2cafa289a5b7985b5207db39/greenlet-3.5.5-cp315-cp315-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f2e3d061b8e13aec2f0441689b3c71b244a20e5d274a52cb0f7e31bd1d139552", size = 675930, upload-time = "2026-08-10T13:40:54.205Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/32/188447c9a468d6977d2989397226b0c6b65ab6f4cf943f931643328512fc/greenlet-3.5.5-cp315-cp315-manylinux_2_39_riscv64.whl", hash = "sha256:b18007dc2473a7942fd157366b55f01da6fed7ce85318591005b419e0a439474", size = 487404, upload-time = "2026-08-10T14:30:08.903Z" },
     { url = "https://files.pythonhosted.org/packages/52/b5/89c9f2e8460d71101037d47a1feed11928615a5edd42370be290e0657eeb/greenlet-3.5.5-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:9ab5f5b93655e77fe0d6c2dfd22b5eac751bb1f876d8ec21761b7c1fb9266007", size = 1633878, upload-time = "2026-08-10T14:15:10.693Z" },
     { url = "https://files.pythonhosted.org/packages/b8/60/297de93f3b02ac78a5e04d32bb8bbe3080f4a73d8ed95016561463b70618/greenlet-3.5.5-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:f0e5a21bd4452a88cf032fc43c4a5b307ab1380eacb63b5988f9c0317885e773", size = 1696597, upload-time = "2026-08-10T13:40:36.252Z" },
     { url = "https://files.pythonhosted.org/packages/18/25/54c6eaff4f337fb670215e89eb2d00d9499487b658e709d4b477be4a342e/greenlet-3.5.5-cp315-cp315-win_amd64.whl", hash = "sha256:469dbb0a78625642f4a626cfd0c6e8bccc0385b5e49189b6308bbe849ec88a8e", size = 327700, upload-time = "2026-08-10T13:28:06.752Z" },
@@ -1234,7 +1246,9 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/10/e2/3144c0a116067ac1e30457b0139a94d60d1d36a86e015de68e9ac87cb3bc/greenlet-3.5.5-cp315-cp315t-macosx_11_0_universal2.whl", hash = "sha256:68184dfcf50ccaa8e864770fe0633a7e27250ea9329f8192ef47ee9ecfd78e1c", size = 306387, upload-time = "2026-08-10T13:27:00.897Z" },
     { url = "https://files.pythonhosted.org/packages/5c/a1/cb4223a7e9b9f43b8807e8eb212358bfe2dfaa174a9ea2889eb1714dcba2/greenlet-3.5.5-cp315-cp315t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9ec0dc0e59dc9c61af5c47348365ccbbd7addfafe0a93b00336ff3da2907bdc6", size = 676472, upload-time = "2026-08-10T14:14:41.417Z" },
     { url = "https://files.pythonhosted.org/packages/9e/cd/a154b4498e5d8f12ada291cfb3b8d596eadde2177f5bf09a9be699d2a446/greenlet-3.5.5-cp315-cp315t-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e604f58e35833fc46ef20302bcb314dddbfd3fcf33a4f936216d51dd678d63ae", size = 684238, upload-time = "2026-08-10T14:27:32.946Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/f4/e450a68a152f819491d8c7df6a8254e761d87e6a78759268961f8c5bd4dd/greenlet-3.5.5-cp315-cp315t-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2888a3a38bc5ee5bb6c438372197152e815837e4fab7ed7a1f86ef18ffd58ad1", size = 686022, upload-time = "2026-08-10T14:30:15.96Z" },
     { url = "https://files.pythonhosted.org/packages/bf/bb/b0031d260c2968a3c87deebc51d80c64e499377f993aafe06ee3b7488cc2/greenlet-3.5.5-cp315-cp315t-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:40239b5384f96da3963585cc6d7eaa9b56f8ae67e8d92cc82dd9e202fc847de3", size = 681246, upload-time = "2026-08-10T13:40:55.402Z" },
+    { url = "https://files.pythonhosted.org/packages/18/23/17e63d6bf3b9c9b9dbea981b7f643a71f79603bdfb4f1c3a9cf353e22aed/greenlet-3.5.5-cp315-cp315t-manylinux_2_39_riscv64.whl", hash = "sha256:1e8d9391fe77f15649589a907cef972dbbd6352ef7ff7dc0492f658c0c26495f", size = 516951, upload-time = "2026-08-10T14:30:10.907Z" },
     { url = "https://files.pythonhosted.org/packages/9a/07/da554b71ab88e649da146e1065d86a48a5c5d92e50ab74ef41b504aa7f56/greenlet-3.5.5-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:a1eaccf5c3a1d3e46dead602c72e6836731e8e245c9de6a27764567b6b62d4c0", size = 1642735, upload-time = "2026-08-10T14:15:11.92Z" },
     { url = "https://files.pythonhosted.org/packages/78/76/26a3782a051677668af9d92beaa47cd87ba9dd5072f762961144a03dd4c6/greenlet-3.5.5-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:19e4e026fe20691f333b8eb1a3bc9625eceba8c3f9d62ec5a6f8581afbc6b5a5", size = 1700925, upload-time = "2026-08-10T13:40:37.656Z" },
     { url = "https://files.pythonhosted.org/packages/28/d9/fe7baf4190c2ae71f267efb9de21b3172bb35bc0ed1ef53dd6027d658e33/greenlet-3.5.5-cp315-cp315t-win_amd64.whl", hash = "sha256:712aee154f648bde84634654bb38bb78c69ac640c37a45c9effed800735049d8", size = 331829, upload-time = "2026-08-10T13:26:48.851Z" },
@@ -4349,7 +4363,7 @@ wheels = [
 
 [[package]]
 name = "sap-cloud-sdk"
-version = "0.58.1"
+version = "0.58.2"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },

From 936d322a333962c5bfee56192696648f3e93d1a4 Mon Sep 17 00:00:00 2001
From: Tiago Kochenborger <tiago.kochenborger@sap.com>
Date: Wed, 7 Oct 2026 15:26:16 -0300
Subject: [PATCH 3/3] fix(adms): use ty ignore syntax for intentional None
 arg-type in tests

Replace # type: ignore[arg-type] (mypy) with # ty: ignore[invalid-argument-type]
for three test calls that intentionally pass None to with_user_jwt to verify
the ValueError guard.
---
 tests/adms/unit/test_client.py | 2 +-
 tests/adms/unit/test_http.py   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/adms/unit/test_client.py b/tests/adms/unit/test_client.py
index 00700df7..41b1c9f9 100644
--- a/tests/adms/unit/test_client.py
+++ b/tests/adms/unit/test_client.py
@@ -155,7 +155,7 @@ def test_with_user_jwt_whitespace_raises(self, mock_http):
     def test_with_user_jwt_none_raises(self, mock_http):
         client = AdmsClient(mock_http)
         with pytest.raises(ValueError, match="non-blank"):
-            client.with_user_jwt(None)  # type: ignore[arg-type]
+            client.with_user_jwt(None)  # ty: ignore[invalid-argument-type]
         mock_http.with_user_jwt.assert_not_called()
 
 
diff --git a/tests/adms/unit/test_http.py b/tests/adms/unit/test_http.py
index 5f5dcd03..bfe35188 100644
--- a/tests/adms/unit/test_http.py
+++ b/tests/adms/unit/test_http.py
@@ -264,7 +264,7 @@ def test_with_user_jwt_none_raises(self, config, token_fetcher):
         # with_user_jwt signals explicit OBO intent — None must also raise.
         http = AdmsHttp(config=config, token_fetcher=token_fetcher)
         with pytest.raises(ValueError, match="non-blank"):
-            http.with_user_jwt(None)  # type: ignore[arg-type]
+            http.with_user_jwt(None)  # ty: ignore[invalid-argument-type]
 
     def test_valid_jwt_calls_exchange_not_get(self, config, token_fetcher):
         session = MagicMock(spec=requests.Session)
@@ -356,7 +356,7 @@ def test_async_with_user_jwt_none_raises(self, config):
             client=MagicMock(spec=httpx.AsyncClient),
         )
         with pytest.raises(ValueError, match="non-blank"):
-            http.with_user_jwt(None)  # type: ignore[arg-type]
+            http.with_user_jwt(None)  # ty: ignore[invalid-argument-type]
 
 
 class TestQuoteOdataStringKey: