Merge branch 'feature/78_api' into dev

.gitignore

@@ -11,3 +11,4 @@ build
 **/decp.duckdb
 **/decp.duckdb.tmp
 **/decp.duckdb.lock
+**/schema.cache.json

.template.env

@@ -9,7 +9,7 @@ ANNOUNCEMENTS=
 
 # Chemin vers le schéma de données
 DATA_SCHEMA_PATH=https://www.data.gouv.fr/api/1/datasets/r/9a4144c0-ee44-4dec-bee5-bbef38191d9a
-DATA_SCHEMA_PATH_LOCAL=../schema.json
+DATA_SCHEMA_CACHE=./schema.cache.json
 
 # Colonnes masquées par défaut
 DISPLAYED_COLUMNS="uid, acheteur_id, acheteur_nom, montant, objet, titulaire_nom, titulaire_id, dateNotification, dureeMois, acheteur_departement_code, sourceDataset"
@@ -25,3 +25,10 @@ TO_EMAIL="to@example.com"               # adresse de destination des emails (To)
 MATOMO_ID_SITE=
 MATOMO_BASE_URL=
 MATOMO_TOKEN=
+
+# API privée
+DISABLE_API_AUTH="false"
+USERS_DB_PATH=./users.sqlite
+MATOMO_URL=https://analytics.maudry.com/matomo.php
+MATOMO_SITE_ID=14
+MATOMO_TRACKING_ENABLED=true

CHANGELOG.md

@@ -1,3 +1,19 @@
+## [Unreleased]
+
+### Ajouté
+
+- API privée tabulaire `/api/v1/data` (filtres dynamiques, pagination, tri).
+- Endpoint `/api/v1/schema` (description du dataset).
+- Endpoint `/api/v1/health` (sonde monitoring).
+- Documentation interactive Swagger UI à `/api/v1/swagger`.
+- CLI d'administration des tokens : `python -m src.api.tokens_cli` (create, list, revoke).
+- Suivi de consommation : compteurs SQLite (`api_tokens.count_total`, `last_used_at`) + événements Matomo async.
+
+### Configuration
+
+- Nouvelles variables d'environnement : `USERS_DB_PATH`, `MATOMO_URL`, `MATOMO_SITE_ID`, `MATOMO_TRACKING_ENABLED`.
+- Création de 2 Custom Dimensions côté Matomo : `dimension1=token_id`, `dimension2=http_status`.
+
 ##### 2.7.9 (9 juin 2026)
 
 - Ajout d'une vue "étapes" (elle sera mieux intégrée dans le site à l'avenir)

docs/superpowers/plans/2026-06-12-bootstrap-resilient-donnees-schema.md

@@ -0,0 +1,665 @@
+# Bootstrap résilient des données et du schéma — Plan d'implémentation
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Rendre le démarrage de decp.info résilient aux ressources externes KO (parquet, schéma, stats), pour que l'API partagée ne tombe plus à cause d'un déploiement défaillant.
+
+**Architecture:** Trois invariants. (1) Le DuckDB est réutilisé si la reconstruction échoue. (2) Le schéma suit la chaîne `URL → cache → RuntimeError`, le dernier schéma distant fonctionnel étant persisté localement. (3) Les chargements de pages au boot ne lèvent jamais sur une ressource externe KO. Une tâche préalable répare le baseline de tests laissé rouge par le merge de `main`.
+
+**Tech Stack:** Python, Polars, DuckDB, httpx, flask-caching, pytest (+ monkeypatch).
+
+**Spec de référence:** `docs/superpowers/specs/2026-06-12-bootstrap-resilient-donnees-schema-design.md`
+
+---
+
+## Structure des fichiers
+
+| Fichier                               | Responsabilité                           | Action                        |
+| ------------------------------------- | ---------------------------------------- | ----------------------------- |
+| `tests/test_db.py`                    | Tests bootstrap DuckDB                   | Modifier (réparer + ajouter)  |
+| `tests/conftest.py`                   | Setup déterministe des tests             | Modifier (seed schéma)        |
+| `tests/schema.fixture.json`           | Schéma complet figé pour tests (offline) | Créer (commité)               |
+| `tests/test_schema.py`                | Tests résolution schéma                  | Créer                         |
+| `tests/test_page_loads.py`            | Tests chargements best-effort (C/D)      | Créer                         |
+| `src/utils/data.py`                   | Résolution schéma                        | Modifier                      |
+| `src/db.py`                           | Bootstrap DuckDB                         | Modifier (`_ensure_database`) |
+| `src/utils/__init__.py`               | Helper date MAJ best-effort              | Modifier (ajout fonction)     |
+| `src/pages/tableau.py`                | Date MAJ au niveau module                | Modifier                      |
+| `src/figures.py`                      | `get_sources_tables`                     | Modifier                      |
+| `.template.env`, `.env`, `.gitignore` | Config                                   | Modifier                      |
+
+---
+
+## Task 1 : Réparer le baseline de tests `test_db.py`
+
+Le merge de `main` a changé `build_database(db_path)` (1 arg, parquet lu via env) et memoïsé `get_last_modified` (besoin du contexte d'app). Trois corrections pour repartir au vert. **Aucune logique applicative ne change ici.**
+
+**Files:**
+
+- Modify: `tests/test_db.py`
+
+- [ ] **Step 1 : Corriger la fixture `built_db` (signature `build_database`)**
+
+Dans `tests/test_db.py`, remplacer :
+
+```python
+    from src.db import build_database
+
+    build_database(db_path, parquet_path)
+    return db_path
+```
+
+par :
+
+```python
+    from src.db import build_database
+
+    build_database(db_path)
+    return db_path
+```
+
+(L'env `DATA_FILE_PARQUET_PATH` est déjà posé juste au-dessus dans la fixture.)
+
+- [ ] **Step 2 : Corriger `test_concurrent_build_serialized`**
+
+Ajouter `monkeypatch` à la signature et poser l'env du parquet ; corriger l'appel `build_database`.
+
+Remplacer la ligne de signature :
+
+```python
+def test_concurrent_build_serialized(tmp_path):
+```
+
+par :
+
+```python
+def test_concurrent_build_serialized(tmp_path, monkeypatch):
+```
+
+Juste après `df.write_parquet(parquet_path)`, ajouter :
+
+```python
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", str(parquet_path))
+```
+
+Et dans `worker()`, remplacer :
+
+```python
+                    if db.should_rebuild(db_path, parquet_path):
+                        db.build_database(db_path, parquet_path)
+```
+
+par :
+
+```python
+                    if db.should_rebuild(db_path, parquet_path):
+                        db.build_database(db_path)
+```
+
+- [ ] **Step 3 : Corriger les 2 tests prod de `should_rebuild` (memoïsation)**
+
+`should_rebuild` non-dev appelle `get_last_modified`, memoïsé et inutilisable hors contexte d'app en test. On le monkeypatche pour tester la logique de comparaison de dates.
+
+Dans `test_should_rebuild_prod_when_parquet_newer`, juste avant l'`assert`, ajouter :
+
+```python
+    monkeypatch.setattr("src.db.get_last_modified", lambda p: parquet.stat().st_mtime)
+```
+
+Dans `test_should_not_rebuild_prod_when_parquet_older`, juste avant l'`assert`, ajouter la même ligne :
+
+```python
+    monkeypatch.setattr("src.db.get_last_modified", lambda p: parquet.stat().st_mtime)
+```
+
+- [ ] **Step 4 : Lancer les tests, vérifier le vert**
+
+Run: `rtk proxy python -m pytest tests/test_db.py -q`
+Expected: tous PASS (plus aucun `TypeError`/`AttributeError`).
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add tests/test_db.py
+git commit -m "test: réparer le baseline test_db cassé par le merge (#78)"
+```
+
+---
+
+## Task 2 : Schéma résilient — chaîne `URL → cache → RuntimeError`
+
+Réécrire `get_data_schema` avec helpers robustes et persistance du dernier schéma distant fonctionnel. Supprimer `DATA_SCHEMA_LOCAL` au profit de `DATA_SCHEMA_CACHE`.
+
+**Files:**
+
+- Create: `tests/schema.fixture.json`, `tests/test_schema.py`
+- Modify: `tests/conftest.py`, `src/utils/data.py`, `.template.env`, `.env`, `.gitignore`
+
+- [ ] **Step 1 : Créer le fixture schéma complet (offline, déterministe)**
+
+Run:
+
+```bash
+cp ../decp-processing/dist/schema.json tests/schema.fixture.json
+test -s tests/schema.fixture.json && python -c "import json;assert 'fields' in json.load(open('tests/schema.fixture.json'))" && echo OK
+```
+
+Expected: `OK` (le fixture contient bien une clé `fields`).
+
+- [ ] **Step 2 : Rendre la résolution du schéma déterministe en test (conftest)**
+
+Dans `tests/conftest.py`, ajouter `import json` en tête (avec les autres imports) puis, au niveau module **avant** toute logique existante (juste après la ligne `_DB_PATH = Path(...)`), ajouter :
+
+```python
+# Schéma déterministe et hors-ligne pour les tests : on pointe le cache sur un
+# fixture commité et on désactive la récupération distante.
+_SCHEMA_FIXTURE = Path(os.path.abspath("tests/schema.fixture.json"))
+os.environ["DATA_SCHEMA_CACHE"] = str(_SCHEMA_FIXTURE)
+os.environ.pop("DATA_SCHEMA_PATH", None)
+```
+
+- [ ] **Step 3 : Écrire les tests schéma (échouent d'abord)**
+
+Créer `tests/test_schema.py` :
+
+```python
+import json
+
+import httpx
+import pytest
+
+from src.utils import data as data_mod
+
+VALID = {"fields": [{"name": "uid", "title": "UID"}, {"name": "objet"}]}
+
+
+class FakeResp:
+    def __init__(self, payload, ok=True, bad_json=False):
+        self._payload = payload
+        self._ok = ok
+        self._bad_json = bad_json
+
+    def raise_for_status(self):
+        if not self._ok:
+            raise httpx.HTTPError("boom")
+        return self
+
+    def json(self):
+        if self._bad_json:
+            raise json.JSONDecodeError("bad", "", 0)
+        return self._payload
+
+
+def test_remote_ok_returns_schema_and_writes_cache(tmp_path, monkeypatch):
+    cache = tmp_path / "schema.cache.json"
+    monkeypatch.setenv("DATA_SCHEMA_PATH", "http://x")
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    monkeypatch.setattr(data_mod, "get", lambda *a, **k: FakeResp(VALID))
+    result = data_mod.get_data_schema()
+    assert "uid" in result
+    assert json.loads(cache.read_text())["fields"][0]["name"] == "uid"
+
+
+def test_remote_http_error_falls_back_to_cache(tmp_path, monkeypatch):
+    cache = tmp_path / "schema.cache.json"
+    cache.write_text(json.dumps(VALID))
+    monkeypatch.setenv("DATA_SCHEMA_PATH", "http://x")
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    monkeypatch.setattr(data_mod, "get", lambda *a, **k: FakeResp(None, ok=False))
+    assert "uid" in data_mod.get_data_schema()
+
+
+def test_remote_malformed_falls_back_to_cache(tmp_path, monkeypatch):
+    cache = tmp_path / "schema.cache.json"
+    cache.write_text(json.dumps(VALID))
+    monkeypatch.setenv("DATA_SCHEMA_PATH", "http://x")
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    monkeypatch.setattr(data_mod, "get", lambda *a, **k: FakeResp({"nope": 1}))
+    assert "uid" in data_mod.get_data_schema()
+
+
+def test_no_url_uses_cache(tmp_path, monkeypatch):
+    cache = tmp_path / "schema.cache.json"
+    cache.write_text(json.dumps(VALID))
+    monkeypatch.delenv("DATA_SCHEMA_PATH", raising=False)
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    assert "uid" in data_mod.get_data_schema()
+
+
+def test_no_source_raises(tmp_path, monkeypatch):
+    monkeypatch.delenv("DATA_SCHEMA_PATH", raising=False)
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(tmp_path / "missing.json"))
+    with pytest.raises(RuntimeError):
+        data_mod.get_data_schema()
+
+
+def test_cache_write_failure_is_non_blocking(tmp_path, monkeypatch):
+    # parent inexistant => l'écriture du cache échoue, mais le schéma est renvoyé
+    cache = tmp_path / "nodir" / "schema.cache.json"
+    monkeypatch.setenv("DATA_SCHEMA_PATH", "http://x")
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    monkeypatch.setattr(data_mod, "get", lambda *a, **k: FakeResp(VALID))
+    assert "uid" in data_mod.get_data_schema()
+```
+
+- [ ] **Step 4 : Lancer les tests, vérifier l'échec**
+
+Run: `rtk proxy python -m pytest tests/test_schema.py -q`
+Expected: FAIL (les helpers/comportements n'existent pas encore ; `get_data_schema` actuel plante différemment).
+
+- [ ] **Step 5 : Réécrire `get_data_schema` + helpers**
+
+Dans `src/utils/data.py`, remplacer entièrement la fonction `get_data_schema` (actuellement lignes ~68-95) par :
+
+```python
+def _validate_schema(raw) -> dict | None:
+    if isinstance(raw, dict) and isinstance(raw.get("fields"), list) and raw["fields"]:
+        return raw
+    return None
+
+
+def _fetch_remote_schema(url: str | None) -> dict | None:
+    if not url:
+        return None
+    try:
+        raw = get(url, follow_redirects=True).raise_for_status().json()
+    except (httpx.HTTPError, json.JSONDecodeError) as e:
+        logger.error(f"Schéma distant indisponible ({url}) : {e}")
+        return None
+    return _validate_schema(raw)
+
+
+def _load_schema_file(path: str) -> dict | None:
+    if not path or not os.path.exists(path):
+        return None
+    try:
+        with open(path) as f:
+            raw = json.load(f)
+    except (OSError, json.JSONDecodeError) as e:
+        logger.error(f"Schéma local illisible ({path}) : {e}")
+        return None
+    return _validate_schema(raw)
+
+
+def _persist_schema_cache(raw: dict, path: str) -> None:
+    if not path:
+        return
+    try:
+        tmp = f"{path}.tmp"
+        with open(tmp, "w") as f:
+            json.dump(raw, f)
+        os.replace(tmp, path)
+    except OSError as e:
+        logger.warning(f"Écriture du cache schéma échouée ({path}) : {e}")
+
+
+def get_data_schema() -> dict:
+    cache_path = os.getenv("DATA_SCHEMA_CACHE", "./schema.cache.json")
+    raw = _fetch_remote_schema(os.getenv("DATA_SCHEMA_PATH"))
+    if raw is not None:
+        _persist_schema_cache(raw, cache_path)
+    else:
+        raw = _load_schema_file(cache_path)
+    if raw is None:
+        raise RuntimeError("Aucun schéma disponible (ni distant ni cache).")
+    return OrderedDict((c["name"], c) for c in raw["fields"])
+```
+
+Vérifier que les imports en tête de `src/utils/data.py` couvrent : `json`, `os`, `OrderedDict`, `httpx`, `get` (déjà présents : `from httpx import HTTPError, get`). `HTTPError` peut devenir inutilisé — voir Step 7.
+
+- [ ] **Step 6 : Lancer les tests, vérifier le vert**
+
+Run: `rtk proxy python -m pytest tests/test_schema.py -q`
+Expected: 6 PASS.
+
+- [ ] **Step 7 : Nettoyer imports + config + gitignore**
+
+Dans `src/utils/data.py`, si `HTTPError` n'est plus utilisé, remplacer `from httpx import HTTPError, get` par `from httpx import get` (garder `import httpx`). Vérifier avec :
+
+Run: `rtk proxy python -m ruff check src/utils/data.py`
+Expected: pas d'erreur F401.
+
+Dans `.gitignore`, ajouter sous la ligne `**/decp.duckdb` :
+
+```
+**/schema.cache.json
+```
+
+Dans `.template.env`, supprimer la ligne `DATA_SCHEMA_PATH_LOCAL=...` et ajouter :
+
+```
+DATA_SCHEMA_CACHE=./schema.cache.json
+```
+
+Dans `.env` (local, non versionné), supprimer la ligne `DATA_SCHEMA_LOCAL=...` et ajouter `DATA_SCHEMA_CACHE=./schema.cache.json`.
+
+- [ ] **Step 8 : Commit**
+
+```bash
+git add tests/schema.fixture.json tests/test_schema.py tests/conftest.py src/utils/data.py .template.env .gitignore
+git commit -m "feat: schéma résilient URL→cache + suppression DATA_SCHEMA_LOCAL (#78)"
+```
+
+---
+
+## Task 3 : Bootstrap DuckDB résilient
+
+Ajouter le garde-fou `try/except` dans `_ensure_database` : réutiliser le DuckDB existant si la reconstruction échoue ; ne lever qu'en cold start.
+
+**Files:**
+
+- Modify: `src/db.py:117-128` (`_ensure_database`)
+- Test: `tests/test_db.py`
+
+- [ ] **Step 1 : Écrire les tests (échouent d'abord)**
+
+Ajouter à la fin de `tests/test_db.py` :
+
+```python
+def _raise(*args, **kwargs):
+    raise RuntimeError("boom")
+
+
+def test_ensure_database_reuses_db_when_should_rebuild_raises(tmp_path, monkeypatch):
+    import src.db as db
+
+    dbf = tmp_path / "decp.duckdb"
+    dbf.write_bytes(b"existing")
+    monkeypatch.setenv("DUCKDB_PATH", str(dbf))
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", "http://unreachable")
+    monkeypatch.setattr(db, "should_rebuild", _raise)
+    result = db._ensure_database()  # ne doit pas lever
+    assert result == dbf
+    assert dbf.read_bytes() == b"existing"
+
+
+def test_ensure_database_reuses_db_when_build_raises(tmp_path, monkeypatch):
+    import src.db as db
+
+    dbf = tmp_path / "decp.duckdb"
+    dbf.write_bytes(b"existing")
+    monkeypatch.setenv("DUCKDB_PATH", str(dbf))
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", "http://unreachable")
+    monkeypatch.setattr(db, "should_rebuild", lambda *a, **k: True)
+    monkeypatch.setattr(db, "build_database", _raise)
+    db._ensure_database()  # ne doit pas lever
+    assert dbf.read_bytes() == b"existing"
+
+
+def test_ensure_database_raises_on_cold_start(tmp_path, monkeypatch):
+    import src.db as db
+
+    dbf = tmp_path / "decp.duckdb"  # n'existe pas
+    monkeypatch.setenv("DUCKDB_PATH", str(dbf))
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", "http://unreachable")
+    monkeypatch.setattr(db, "should_rebuild", lambda *a, **k: True)
+    monkeypatch.setattr(db, "build_database", _raise)
+    with pytest.raises(RuntimeError):
+        db._ensure_database()
+
+
+def test_ensure_database_builds_when_needed(tmp_path, monkeypatch):
+    import src.db as db
+
+    dbf = tmp_path / "decp.duckdb"
+    dbf.write_bytes(b"old")
+    monkeypatch.setenv("DUCKDB_PATH", str(dbf))
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", "http://x")
+    called = {}
+    monkeypatch.setattr(db, "should_rebuild", lambda *a, **k: True)
+    monkeypatch.setattr(db, "build_database", lambda p: called.setdefault("built", p))
+    db._ensure_database()
+    assert called.get("built") == dbf
+```
+
+Ajouter `import pytest` en tête de `tests/test_db.py` s'il n'y est pas déjà (il y est).
+
+- [ ] **Step 2 : Lancer, vérifier l'échec**
+
+Run: `rtk proxy python -m pytest tests/test_db.py -q -k ensure_database`
+Expected: FAIL (le `try/except` n'existe pas ; les exceptions remontent).
+
+- [ ] **Step 3 : Implémenter le garde-fou**
+
+Dans `src/db.py`, remplacer `_ensure_database` (lignes ~117-128) par :
+
+```python
+def _ensure_database() -> Path:
+    db_path = Path(os.getenv("DUCKDB_PATH", "./decp.duckdb"))
+    parquet_path = os.getenv("DATA_FILE_PARQUET_PATH", "")
+    lock_path = db_path.with_suffix(".duckdb.lock")
+    db_exists = db_path.exists()
+
+    with open(lock_path, "w") as lock_fd:
+        fcntl.flock(lock_fd, fcntl.LOCK_EX)
+        try:
+            if should_rebuild(db_path, parquet_path):
+                build_database(db_path)
+            else:
+                logger.debug("Base de données déjà disponible et à jour.")
+        except Exception as e:
+            if db_exists:
+                logger.error(
+                    f"Bootstrap données KO ({e}). "
+                    f"Réutilisation du DuckDB existant : {db_path}"
+                )
+            else:
+                logger.critical("Aucune base DuckDB et reconstruction impossible.")
+                raise
+    return db_path
+```
+
+- [ ] **Step 4 : Lancer, vérifier le vert**
+
+Run: `rtk proxy python -m pytest tests/test_db.py -q`
+Expected: tous PASS (anciens + 4 nouveaux).
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/db.py tests/test_db.py
+git commit -m "feat: réutiliser le DuckDB existant si le bootstrap échoue (#78)"
+```
+
+---
+
+## Task 4 : Chargements de pages best-effort (C + D)
+
+`tableau.py` (date MAJ via `get_last_modified`) et `a-propos.py` (stats via `get_sources_tables`) chargent au boot et peuvent tuer le démarrage. On les rend best-effort.
+
+**Files:**
+
+- Create: `tests/test_page_loads.py`
+- Modify: `src/utils/__init__.py`, `src/pages/tableau.py`, `src/figures.py`
+
+- [ ] **Step 1 : Écrire les tests (échouent d'abord)**
+
+Créer `tests/test_page_loads.py` :
+
+```python
+import os
+
+
+def test_update_timestamp_falls_back_to_db_mtime(tmp_path, monkeypatch):
+    import src.utils as u
+    from src.utils import get_data_update_timestamp
+
+    def boom(*a, **k):
+        raise RuntimeError("net down")
+
+    monkeypatch.setattr(u, "get_last_modified", boom)
+    fb = tmp_path / "decp.duckdb"
+    fb.write_bytes(b"x")
+    assert get_data_update_timestamp("http://x", str(fb)) == os.path.getmtime(str(fb))
+
+
+def test_update_timestamp_none_when_all_fail(monkeypatch):
+    import src.utils as u
+    from src.utils import get_data_update_timestamp
+
+    def boom(*a, **k):
+        raise RuntimeError("net down")
+
+    monkeypatch.setattr(u, "get_last_modified", boom)
+    assert get_data_update_timestamp("http://x", None) is None
+
+
+def test_update_timestamp_nominal(monkeypatch):
+    import src.utils as u
+    from src.utils import get_data_update_timestamp
+
+    monkeypatch.setattr(u, "get_last_modified", lambda p: 123.0)
+    assert get_data_update_timestamp("http://x", None) == 123.0
+
+
+def test_sources_tables_none_path():
+    from src.figures import get_sources_tables
+
+    div = get_sources_tables(None)
+    assert "indisponible" in str(div.children).lower()
+
+
+def test_sources_tables_missing_file():
+    from src.figures import get_sources_tables
+
+    div = get_sources_tables("/does/not/exist.csv")
+    assert "indisponible" in str(div.children).lower()
+
+
+def test_sources_tables_valid_csv(tmp_path):
+    from dash import dash_table
+
+    from src.figures import get_sources_tables
+
+    csv = tmp_path / "s.csv"
+    csv.write_text(
+        "nom,organisation,nb_marchés,nb_acheteurs,code,url,unique\n"
+        "Source A,Org A,5,2,XA,http://a,1\n"
+    )
+    div = get_sources_tables(str(csv))
+    assert isinstance(div.children, dash_table.DataTable)
+```
+
+- [ ] **Step 2 : Lancer, vérifier l'échec**
+
+Run: `rtk proxy python -m pytest tests/test_page_loads.py -q`
+Expected: FAIL (`get_data_update_timestamp` n'existe pas ; `get_sources_tables(None)` plante).
+
+- [ ] **Step 3 : Ajouter `get_data_update_timestamp` dans `src/utils/__init__.py`**
+
+À la fin de `src/utils/__init__.py`, ajouter :
+
+```python
+def get_data_update_timestamp(
+    parquet_path: str, fallback_path: str | None = None
+) -> float | None:
+    """Date de MAJ des données, best-effort, sans jamais lever (usage au boot)."""
+    try:
+        return get_last_modified(parquet_path)
+    except Exception as e:
+        logger.warning(f"Date de mise à jour des données indisponible ({e})")
+    if fallback_path:
+        try:
+            return os.path.getmtime(fallback_path)
+        except OSError:
+            pass
+    return None
+```
+
+(`os` et `logger` sont déjà disponibles dans ce module.)
+
+- [ ] **Step 4 : Utiliser le helper dans `tableau.py`**
+
+Dans `src/pages/tableau.py`, remplacer l'import ligne 24 :
+
+```python
+from src.utils import get_last_modified, logger
+```
+
+par :
+
+```python
+from src.utils import get_data_update_timestamp, logger
+```
+
+Et remplacer les lignes 36-38 :
+
+```python
+update_date_timestamp = get_last_modified(os.getenv("DATA_FILE_PARQUET_PATH", ""))
+update_date = datetime.fromtimestamp(update_date_timestamp).strftime("%d/%m/%Y")
+update_date_iso = datetime.fromtimestamp(update_date_timestamp).isoformat()
+```
+
+par :
+
+```python
+update_date_timestamp = get_data_update_timestamp(
+    os.getenv("DATA_FILE_PARQUET_PATH", ""),
+    os.getenv("DUCKDB_PATH", "./decp.duckdb"),
+)
+if update_date_timestamp is not None:
+    update_date = datetime.fromtimestamp(update_date_timestamp).strftime("%d/%m/%Y")
+    update_date_iso = datetime.fromtimestamp(update_date_timestamp).isoformat()
+else:
+    update_date = "date inconnue"
+    update_date_iso = ""
+```
+
+- [ ] **Step 5 : Élargir `get_sources_tables` dans `src/figures.py`**
+
+Dans `src/figures.py` (`get_sources_tables`, ~lignes 122-125), remplacer :
+
+```python
+    try:
+        dff = pl.read_csv(source_path)
+    except (URLError, HTTPError):
+        return html.Div("Erreur de connexion")
+```
+
+par :
+
+```python
+    try:
+        if not source_path:
+            raise ValueError("SOURCE_STATS_CSV_PATH non défini")
+        dff = pl.read_csv(source_path)
+    except Exception as e:
+        logger.warning(f"Sources de données indisponibles ({e})")
+        return html.Div("Sources de données momentanément indisponibles.")
+```
+
+Si `URLError`/`HTTPError` (import ligne 3 `from urllib.error import HTTPError, URLError`) ne sont plus utilisés ailleurs dans le fichier, supprimer cet import.
+
+Run: `rtk proxy python -m ruff check src/figures.py`
+Expected: pas d'erreur F401.
+
+- [ ] **Step 6 : Lancer, vérifier le vert**
+
+Run: `rtk proxy python -m pytest tests/test_page_loads.py -q`
+Expected: 6 PASS.
+
+- [ ] **Step 7 : Smoke test — l'import des modules modifiés ne casse pas**
+
+Run: `rtk proxy python -c "import src.figures, src.pages.tableau; print('import OK')"`
+Expected: `import OK`.
+(NB : `a-propos.py` a un tiret, non importable par nom — son correctif `get_sources_tables` est couvert par les tests unitaires du Step 6 et la page sera validée par la suite Selenium au Step 8.)
+
+- [ ] **Step 8 : Suite complète**
+
+Run: `rtk proxy python -m pytest -q`
+Expected: vert (hors tests Selenium nécessitant Chrome, à lancer si l'environnement le permet).
+
+- [ ] **Step 9 : Commit**
+
+```bash
+git add tests/test_page_loads.py src/utils/__init__.py src/pages/tableau.py src/figures.py
+git commit -m "feat: chargements de pages best-effort au boot (tableau, sources) (#78)"
+```
+
+---
+
+## Notes d'exécution
+
+- **Dev hors-ligne 1er run :** « cache seul » supprime le fallback in-repo. Au tout premier démarrage sur une machine sans `schema.cache.json` ni réseau, le boot lèvera `RuntimeError`. En conditions normales (URL OK une fois, ou cache déjà présent) c'est transparent. Les tests sont rendus déterministes via `tests/schema.fixture.json` (Task 2).
+- **CHANGELOG :** penser à ajouter une entrée (résilience bootstrap données/schéma) avant de finaliser la PR #78, si le projet le tient à jour.
+- **`get_last_modified` reste memoïsé** : non modifié ici ; le cache FileSystem est vidé à chaque boot (`rmtree` dans `app.py`), donc pas de last-modified périmé entre déploiements.

docs/superpowers/specs/2026-05-13-api-privee-design.md

@@ -0,0 +1,428 @@
+# API privée decp.info — Design
+
+**Date** : 2026-05-13
+**Statut** : design validé, en attente du plan d'implémentation
+
+## 1. Contexte et objectifs
+
+decp.info reçoit des demandes récurrentes pour un accès programmatique aux
+données DECP exposées par l'application web. Le besoin est d'ouvrir une API
+HTTP **privée** (accès sur token), inspirée de l'API tabulaire de data.gouv.fr
+(https://tabular-api.data.gouv.fr/api/resources/22847056-61df-452d-837d-8b8ceadbfc52/swagger/),
+qu'un utilisateur en cours s'est déjà appropriée comme référence.
+
+Objectifs explicites :
+
+- Réponses rapides.
+- API documentée (OpenAPI + Swagger UI).
+- Suivi de la consommation par utilisateur.
+
+Non-objectifs (V1) :
+
+- Self-service de création de tokens via UI web.
+- Rate-limiting / quotas.
+- Formats de sortie autres que JSON (CSV, Parquet…).
+- Endpoints sémantiques métier (`/acheteurs/{id}`, etc.).
+
+## 2. Choix structurants
+
+### 2.1 Framework : Flask + flask-smorest
+
+L'API est ajoutée à l'application Flask existante (serveur Dash) sous forme
+d'un blueprint flask-smorest monté sur `/api/v1`. Choix motivé par :
+
+- L'app Dash actuelle tourne déjà sur Flask via gunicorn.
+- DuckDB est ouvert une seule fois au boot dans `src/db.py` (`conn` read-only)
+  et peut être partagé directement par les endpoints API.
+- L'API est tabulaire avec filtres **dynamiques** : la liste des colonnes et
+  des types vient du schéma DuckDB, pas d'une déclaration Pydantic. Les
+  bénéfices de FastAPI (auto-validation Pydantic) sont donc faibles.
+- flask-smorest génère OpenAPI + sert Swagger UI nativement.
+- Un seul process, un seul serveur, un seul déploiement.
+
+Alternatives écartées :
+
+- **FastAPI séparé reverse-proxié** : deux processus, ops plus complexe,
+  bénéfice marginal vu les filtres dynamiques.
+- **FastAPI englobant Flask via WSGIMiddleware** : changerait le serveur de
+  toute l'app Dash existante, migration risquée.
+
+### 2.2 Style d'API : tabulaire générique
+
+Un endpoint unique de requête (`/api/v1/data`) avec filtres dynamiques sur
+toutes les colonnes du schéma, à l'image du swagger cible. Aucun endpoint
+sémantique métier en V1.
+
+### 2.3 Authentification : tokens admin manuels
+
+Tokens Bearer émis manuellement par l'admin via un CLI. Pas de page web de
+gestion en V1. Modèle prévu pour se lier ultérieurement aux comptes
+utilisateurs (cf. `comptes_utilisateurs.md`) sans migration de données.
+
+### 2.4 Suivi de consommation : Matomo asynchrone + compteurs locaux
+
+- Matomo en fire-and-forget pour l'analyse fine (qui, quand, quoi, code HTTP).
+- Compteurs locaux SQLite (`count_total`, `last_used_at`) pour identifier
+  les tokens inactifs et préparer un éventuel rate-limit futur.
+
+## 3. Architecture
+
+### 3.1 Arborescence
+
+```
+src/api/
+├── __init__.py        # init_api(server) — enregistre le blueprint flask-smorest
+├── routes.py          # endpoints /data, /schema, /health
+├── schemas.py         # marshmallow : query params, réponses
+├── filters.py         # parsing & validation `col__op=val` → (where_sql, params)
+├── auth.py            # décorateur @require_token, header Authorization Bearer
+├── tracking.py        # worker thread compteurs SQLite + httpx fire-and-forget Matomo
+├── tokens_db.py       # CRUD api_tokens dans users.sqlite
+└── tokens_cli.py      # python -m src.api.tokens_cli create|list|revoke
+```
+
+`src/auth/` reste réservé aux comptes utilisateurs interactifs
+(`comptes_utilisateurs.md`), distincts des tokens API.
+
+### 3.2 Branchement
+
+Dans `src/app.py`, après l'init Dash :
+
+```python
+from src.api import init_api
+init_api(app.server)
+```
+
+`init_api` enregistre le blueprint sur `/api/v1` et expose :
+
+- `/api/v1/data`
+- `/api/v1/schema`
+- `/api/v1/health`
+- `/api/v1/swagger` (UI)
+- `/api/v1/openapi.json`
+
+### 3.3 Partage de la connexion DuckDB
+
+Les routes importent `src.db.conn` et utilisent les helpers existants
+(`query_marches`, `count_marches`) ainsi que `src.db.schema` (Polars Schema)
+pour la whitelist de colonnes.
+
+## 4. Stockage
+
+### 4.1 SQLite consolidée
+
+Une seule base SQLite, `users.sqlite` à la racine, contient :
+
+- `users` (futur — cf. `comptes_utilisateurs.md`)
+- `api_tokens` (V1)
+
+Bénéfice : un seul fichier à sauvegarder et migrer ; la liaison future
+`api_tokens.user_id → users.id` est immédiate sans migration de données.
+
+### 4.2 Schéma `api_tokens`
+
+```sql
+CREATE TABLE api_tokens (
+    id           INTEGER PRIMARY KEY,
+    token_hash   TEXT NOT NULL UNIQUE,
+    label        TEXT NOT NULL,
+    user_id      INTEGER,
+    created_at   TEXT NOT NULL,
+    last_used_at TEXT,
+    count_total  INTEGER NOT NULL DEFAULT 0,
+    revoked_at   TEXT
+);
+CREATE INDEX idx_api_tokens_hash ON api_tokens(token_hash);
+```
+
+`user_id` est `NULL` pour les tokens admin manuels. Quand le self-service
+arrivera, il suffira de le renseigner.
+
+## 5. Endpoints
+
+### 5.1 Vue d'ensemble
+
+| Méthode | Path                   | Auth   | Rôle                                        |
+| ------- | ---------------------- | ------ | ------------------------------------------- |
+| GET     | `/api/v1/data`         | Bearer | Endpoint tabulaire principal                |
+| GET     | `/api/v1/schema`       | Bearer | Liste des colonnes (nom, type, description) |
+| GET     | `/api/v1/health`       | Aucune | Sonde monitoring                            |
+| GET     | `/api/v1/swagger`      | Aucune | Swagger UI                                  |
+| GET     | `/api/v1/openapi.json` | Aucune | Spec OpenAPI                                |
+
+### 5.2 `/api/v1/data` — langage de requête
+
+Filtres en query string, opérateurs suffixés par `__` (mirror swagger cible) :
+
+| Opérateur            | Sens                                                  |
+| -------------------- | ----------------------------------------------------- |
+| `__exact`            | égalité                                               |
+| `__contains`         | sous-chaîne (LIKE %v%)                                |
+| `__notcontains`      | négation de `__contains`                              |
+| `__less`             | ≤                                                     |
+| `__greater`          | ≥                                                     |
+| `__strictly_less`    | <                                                     |
+| `__strictly_greater` | >                                                     |
+| `__in`               | liste séparée par virgules                            |
+| `__notin`            | négation de `__in`                                    |
+| `__isnull`           | `IS NULL` (valeur ignorée)                            |
+| `__isnotnull`        | `IS NOT NULL` (valeur ignorée)                        |
+| `__sort`             | `asc` ou `desc` — ordre = ordre des params dans l'URL |
+
+Autres paramètres réservés :
+
+- `page` (int, défaut 1, ≥1)
+- `page_size` (int, défaut 50, max 1000)
+- `columns` (string, liste séparée par virgules ; défaut = toutes)
+- `count` (bool, défaut `true` ; `false` → `meta.total` absent, économise un `COUNT(*)`)
+
+Exemple :
+
+```
+GET /api/v1/data?acheteur_departement_code__exact=44
+                 &dateNotification__greater=2024-01-01
+                 &montant__strictly_greater=100000
+                 &objet__contains=informatique
+                 &cpv_8__in=72000000,72200000
+                 &dateNotification__sort=desc
+                 &page=1
+                 &page_size=50
+                 &columns=uid,objet,montant,dateNotification
+```
+
+### 5.3 Sécurité du parsing
+
+`filters.py` est l'unique chemin de génération du `WHERE` SQL :
+
+1. Chaque clé `<col>__<op>` est splittée puis validée :
+   - `<col>` doit être dans `src.db.schema` (whitelist stricte).
+   - `<op>` doit être dans la liste blanche d'opérateurs.
+   - La valeur est convertie selon le type Polars de la colonne :
+     - `String` : utilisée telle quelle.
+     - `Int*` : `int(value)`, 400 si non parseable.
+     - `Float*` : `float(value)`, 400 si non parseable.
+     - `Date` / `Datetime` : ISO 8601 (`YYYY-MM-DD` ou `YYYY-MM-DDTHH:MM:SS`), 400 sinon.
+     - Booléens : **les colonnes booléennes sont stockées comme strings
+       "oui"/"non" en DuckDB** (cf. `src/db.py:43`), donc traitées comme
+       `String`. L'utilisateur filtre avec `colonne__exact=oui`.
+2. Le `WHERE` est composé de fragments paramétrés (`?`) ; les valeurs
+   utilisateur sont passées au moteur DuckDB via les paramètres, **jamais
+   concaténées** dans le SQL.
+3. Le résultat est consommé par `src.db.query_marches(where_sql=..., params=...)`
+   qui existe déjà.
+
+### 5.4 Format de réponse
+
+```json
+{
+  "data": [{ "uid": "...", "objet": "...", "montant": 12345.0 }],
+  "meta": { "page": 1, "page_size": 50, "total": 1234 },
+  "links": {
+    "next": "/api/v1/data?...&page=2",
+    "prev": null
+  }
+}
+```
+
+`meta.total` est omis si `count=false`. `links.next`/`links.prev` sont
+`null` aux extrémités.
+
+### 5.5 `/api/v1/schema`
+
+```json
+{
+  "columns": [
+    { "name": "uid", "type": "string", "description": "..." },
+    { "name": "montant", "type": "float", "description": "..." }
+  ]
+}
+```
+
+Descriptions tirées de `../decp-processing/reference/base_schema.json` si
+disponible ; sinon vides.
+
+### 5.6 V1 : JSON only
+
+Pas de CSV / Parquet. Ajout possible plus tard via `?format=`.
+
+## 6. Authentification
+
+### 6.1 Transmission
+
+Header HTTP standard :
+
+```
+Authorization: Bearer decpinfo_a1b2c3d4...
+```
+
+Pas de support via query string (fuites dans les logs).
+
+### 6.2 Format du token
+
+Préfixe `decpinfo_` + 32 octets aléatoires hex (43 caractères au total).
+Le préfixe facilite la détection de fuites (gitleaks, etc.).
+
+### 6.3 Hashing
+
+`sha256(token)` stocké dans `api_tokens.token_hash`. Pas de bcrypt/argon2 :
+les tokens ont 256 bits d'entropie, le brute-force est impossible et un
+hash lent ralentirait inutilement chaque requête API.
+
+### 6.4 Décorateur `@require_token`
+
+1. Lit `Authorization` ; absent → 401 `missing_token`.
+2. Calcule `sha256`, `SELECT` indexé.
+3. Pas trouvé → 401 `invalid_token`.
+4. `revoked_at IS NOT NULL` → 401 `revoked_token`.
+5. Pose `flask.g.token_id` pour `tracking.py`.
+
+### 6.5 CLI de gestion
+
+`python -m src.api.tokens_cli` :
+
+```
+create --label "Marie Dupont - étude transport 2026"
+   → affiche UNE FOIS le token plaintext (irrécupérable ensuite)
+
+list
+   → id | label | created_at | last_used_at | count_total | revoked?
+
+revoke <id>
+   → set revoked_at = now() (ISO 8601 UTC)
+```
+
+Pas d'UI web pour les tokens en V1.
+
+## 7. Suivi de consommation
+
+### 7.1 Hook
+
+`@bp.after_request` déclenche deux actions **sans bloquer la réponse** :
+
+1. Enfilage d'un update SQLite dans une `queue.Queue` consommée par un
+   worker thread unique (writer série, pas de contention SQLite).
+2. POST httpx fire-and-forget vers la Tracking API Matomo.
+
+Les erreurs des deux chemins sont loggées en `warning` mais jamais propagées
+à l'utilisateur.
+
+### 7.2 Update SQLite
+
+```sql
+UPDATE api_tokens
+SET count_total = count_total + 1,
+    last_used_at = ?
+WHERE id = ?
+```
+
+### 7.3 Event Matomo
+
+```
+POST https://analytics.maudry.com/matomo.php
+  idsite=14
+  rec=1
+  url=https://decp.info/api/v1/data?<query>
+  action_name=API /data
+  uid=token-<id>           # jamais le token plaintext
+  dimension1=<token_id>
+  dimension2=<status_code>
+  ua=<user_agent client>
+```
+
+Custom Dimensions à créer côté Matomo : `dimension1=token_id`,
+`dimension2=http_status`.
+
+### 7.4 Variables d'environnement nouvelles
+
+```
+MATOMO_URL=https://analytics.maudry.com/matomo.php
+MATOMO_SITE_ID=14
+MATOMO_TRACKING_ENABLED=true     # false en dev/test par défaut
+USERS_DB_PATH=./users.sqlite     # tests : tests/users.test.sqlite
+```
+
+## 8. Erreurs
+
+Format uniforme (RFC 7807, déjà standard flask-smorest) :
+
+```json
+{
+  "code": 400,
+  "status": "Bad Request",
+  "message": "Colonne inconnue 'foo'.",
+  "errors": { "field": "foo__exact" }
+}
+```
+
+| HTTP | Cas                                                                   |
+| ---- | --------------------------------------------------------------------- |
+| 200  | Succès                                                                |
+| 400  | Colonne/opérateur/valeur invalide, `page_size` hors bornes            |
+| 401  | `missing_token` / `invalid_token` / `revoked_token`                   |
+| 404  | Path API inexistant                                                   |
+| 500  | Exception non gérée — message générique, stack trace loggée seulement |
+
+Pas de 429 en V1.
+
+Les 4xx sont loggées en `info` (path + token_id), les 500 en `error` avec
+stack trace.
+
+## 9. Tests
+
+Tests pytest purs (pas de Selenium) via `app.server.test_client()`.
+
+```
+tests/api/
+├── test_filters.py            # parsing, génération SQL/params, erreurs
+├── test_auth.py               # 401 cases, last_used_at update
+├── test_tokens_cli.py         # create/list/revoke
+├── test_endpoints_data.py     # pagination, filtres, sort, columns, count=false
+├── test_endpoints_schema.py   # /schema renvoie les colonnes attendues
+├── test_health.py             # /health 200 sans auth
+└── test_tracking.py           # compteurs SQLite, Matomo désactivé par défaut + mock httpx
+```
+
+Fixtures pytest :
+
+- `api_client` : `app.server.test_client()`
+- `valid_token_header` : crée un token dans `tests/users.test.sqlite`, renvoie le header `Authorization: Bearer …`
+- `revoked_token_header` : idem avec `revoked_at` set
+
+Ajouts `pyproject.toml` `[tool.pytest.ini_options].env` :
+
+```
+USERS_DB_PATH=tests/users.test.sqlite
+MATOMO_TRACKING_ENABLED=false
+```
+
+Couverture cible : 100% de `filters.py` et `auth.py` (sécurité-critique) ;
+raisonnable ailleurs.
+
+## 10. Dépendances nouvelles
+
+À ajouter dans `pyproject.toml` :
+
+- `flask-smorest` (blueprint + OpenAPI + Swagger UI)
+- `marshmallow` (déjà transitif de flask-smorest, à expliciter)
+
+`httpx` est déjà présent. Pas d'autres dépendances.
+
+## 11. Documentation utilisateur
+
+À fournir séparément (hors scope spec, à inclure dans le plan d'implémentation) :
+
+- Section "API" dans la page À propos ou page dédiée `/api` avec :
+  - lien vers Swagger UI
+  - exemples curl
+  - procédure pour obtenir un token (« contactez X »)
+- Mention dans le `CHANGELOG.md` à la sortie de version.
+
+## 12. Risques et points ouverts
+
+- **Coût du `COUNT(*)`** sur gros filtres : mitigé par `count=false` opt-out.
+- **Charge SQLite write** : un worker série suffira pour le trafic attendu
+  (admin tokens manuels, faible volume). Si le volume monte, passer à un
+  buffer en RAM avec flush périodique.
+- **Matomo down** : impact nul sur l'API (fire-and-forget loggué).
+- **Évolution vers self-service** : déjà préparée par `user_id` nullable et
+  séparation `src/api/` vs `src/auth/`.

docs/superpowers/specs/2026-06-12-bootstrap-resilient-donnees-schema-design.md

@@ -0,0 +1,293 @@
+# Bootstrap résilient des données et du schéma
+
+**Date :** 2026-06-12
+**Branche :** `feature/78_api`
+**Statut :** design approuvé, à implémenter
+
+## Problème
+
+L'API et l'appli Web Dash partagent le même process Python (`gunicorn app:server`).
+L'API sera consommée par des clients en production. Or decp.info tombe « de temps
+en temps », et comme tout est dans le même process, une chute du Web emporte l'API.
+
+**Diagnostic (clé).** Les chutes ne sont **pas** des crashs runtime aléatoires
+pendant l'ingestion. Ce sont des **échecs de bootstrap au déploiement** :
+
+- env oubliée lors d'un déploiement (ex. `DATA_FILE_PARQUET_PATH` vide) ;
+- `DATA_FILE_PARQUET_PATH` (désormais une URL data.gouv.fr) injoignable ou
+  pointant vers un parquet absent/invalide à cause d'un souci dans
+  `decp-processing` ;
+- `DATA_SCHEMA_PATH` (URL data.gouv.fr) qui renvoie une erreur.
+
+Le process démarre sur des ressources manquantes/invalides, lève une exception
+**au moment de l'import** (`src/db.py` et `src/utils/data.py` font leur bootstrap
+au niveau module), et meurt au boot — API comprise.
+
+## Pourquoi pas « séparer les process » ?
+
+La séparation API / Web protège contre la **contagion runtime** (un callback Dash
+qui tue le worker). Elle ne protège **pas** contre le mode d'échec réel : si les
+deux process partagent les mêmes ressources de bootstrap (parquet, schéma, env),
+ils échouent **tous les deux** au démarrage, de manière identique.
+
+Le levier réel est donc le **durcissement du bootstrap avec fallback
+« last-known-good »** : garantir présence + validité des ressources, et sinon
+repartir sur les dernières ressources fonctionnelles.
+
+La séparation des process reste **hors périmètre** de ce spec. La couche données
+(`src/db.py`) est déjà process-agnostique et sans dépendance à Dash, donc la
+séparation restera bon marché à dégainer plus tard _si_ un vrai crash runtime
+touche l'API. On ne paie pas cette complexité tant qu'on n'en a pas la preuve.
+
+## État actuel du code (post-merge `main`)
+
+### `src/db.py`
+
+- Bootstrap au niveau module : `DB_PATH = _ensure_database()` puis ouverture d'une
+  connexion DuckDB read-only partagée et lecture du `schema`.
+- `build_database()` écrit dans un fichier temporaire puis `os.replace()` atomique :
+  un build qui échoue en cours de route **laisse l'ancien DuckDB intact**. ✅
+- **Faille :** `should_rebuild()` appelle `get_last_modified(parquet_path)` qui
+  fait un `httpx.head(...).headers["last-modified"]` **sans aucune gestion
+  d'erreur** (`src/utils/__init__.py:12`). URL injoignable, lente, ou sans en-tête
+  `last-modified` ⇒ exception ⇒ remonte jusqu'à l'import ⇒ **mort au démarrage
+  alors qu'un DuckDB valide existe sur disque**.
+- **Faille :** `_load_source_frame()` fait `assert os.path.exists(parquet_path)`
+  (non-http) et `scan_parquet` (http) — les deux peuvent lever et ne sont pas
+  rattrapés au niveau de `_ensure_database()`.
+
+### `src/utils/data.py` — `get_data_schema()`
+
+- Tente l'URL, attrape **seulement 4 erreurs httpx** (`ReadTimeout`, `ReadError`,
+  `ConnectError`, `ConnectTimeout`), sinon fallback sur `DATA_SCHEMA_LOCAL`.
+- **Faille :** pas de `raise_for_status()`. Quand data.gouv renvoie une **erreur
+  HTTP** (le cas cité par l'utilisateur), `.json()` ne contient pas `"fields"` ⇒
+  `KeyError` ligne 92, **sans fallback local**.
+- **Faille :** un payload distant valide JSON mais malformé (sans `"fields"`)
+  plante aussi sans fallback.
+- **Faille :** si les deux sources échouent, `original_schema["fields"]` ⇒
+  `KeyError` opaque au lieu d'une erreur claire.
+
+## Décisions
+
+1. **Schéma** : URL primaire, **cache seul** en fallback (on supprime
+   `DATA_SCHEMA_LOCAL`). (confirmé)
+2. **DuckDB** : réutiliser le dernier DuckDB construit en cas d'échec. (confirmé)
+3. **Last-known-good réel du schéma** : après un fetch distant réussi, persister
+   le schéma dans un cache local pour que le fallback soit toujours le _dernier
+   schéma distant fonctionnel_. (confirmé)
+
+### Chemin de persistance du schéma : `DATA_SCHEMA_CACHE` seul
+
+On remplace `DATA_SCHEMA_LOCAL` (qui pointait, en dev, vers
+`../decp-processing/dist/schema.json` — un fichier cross-repo qu'on ne veut pas
+écraser) par un **cache unique possédé par l'app**.
+
+- `DATA_SCHEMA_PATH` (URL) — source primaire.
+- `DATA_SCHEMA_CACHE` (nouveau, ex. défaut `./schema.cache.json`) — écrit après
+  chaque fetch distant réussi, lu en fallback.
+
+Chaîne de résolution : `URL → cache → RuntimeError`.
+
+**Pourquoi c'est suffisant.** Le déploiement est en place sur un VM persistant
+(`ssh → cd /var/www/APP_NAME → git pull → restart systemd`), donc le fichier de
+cache survit aux déploiements — **même garantie de persistance que le DuckDB
+réutilisé**. Tous les incidents constatés (env oubliée, parquet KO, URL schéma en
+erreur) surviennent sur un **redéploiement** d'un hôte déjà chaud, où le cache a
+déjà été écrit par un boot précédent réussi ⇒ couvert.
+
+**Seul cas non couvert (assumé) :** le _cold start absolu_ — un hôte qui n'a jamais
+booté avec succès **et** URL distante down au même instant. Étroit, non-récurrent.
+Fermable plus tard par une graine commitée in-repo si jamais il se matérialise
+(YAGNI).
+
+**Contraintes :**
+
+- `DATA_SCHEMA_CACHE` (`./schema.cache.json`) doit être **`.gitignore`** — sinon le
+  `git pull` du déploiement entrerait en conflit. (Comme `decp.duckdb` aujourd'hui.)
+- En dev, plus de fallback vers le schéma frais de `decp-processing` : on bascule
+  sur le cache (dernier schéma data.gouv). Acceptable, l'URL restant primaire.
+
+## Design
+
+### Invariant 1 — Bootstrap DuckDB (`src/db.py`)
+
+> Le process démarre tant qu'un DuckDB exploitable existe, quel que soit l'état de
+> la source distante/parquet. Échec dur **seulement** s'il n'existe aucune base
+> (cold start).
+
+Garde-fou unique dans `_ensure_database()` :
+
+```python
+def _ensure_database() -> Path:
+    db_path = Path(os.getenv("DUCKDB_PATH", "./decp.duckdb"))
+    parquet_path = os.getenv("DATA_FILE_PARQUET_PATH", "")
+    lock_path = db_path.with_suffix(".duckdb.lock")
+    db_exists = db_path.exists()
+    with open(lock_path, "w") as lock_fd:
+        fcntl.flock(lock_fd, fcntl.LOCK_EX)
+        try:
+            if should_rebuild(db_path, parquet_path):
+                build_database(db_path)
+        except Exception as e:
+            if db_exists:
+                logger.error(
+                    f"Bootstrap données KO ({e}). "
+                    f"Réutilisation du DuckDB existant : {db_path}"
+                )
+            else:
+                logger.critical("Aucune base DuckDB et reconstruction impossible.")
+                raise
+    return db_path
+```
+
+- `should_rebuild()` qui lève (via `get_last_modified()`) est désormais rattrapé :
+  base existante ⇒ on la réutilise.
+- `build_database()` qui lève sur parquet invalide : base existante intacte
+  (atomicité) ⇒ on la réutilise.
+- Le mode `DEVELOPMENT` sort de `should_rebuild()` **avant** tout appel réseau
+  (court-circuit `if dev and not force: return False`) ⇒ dev inchangé.
+
+### Invariant 2 — Schéma (`src/utils/data.py`)
+
+> Un schéma valide non-vide est toujours retourné si une source (distant ou cache)
+> en fournit un. Échec dur seulement si aucune.
+
+```python
+def get_data_schema() -> dict:
+    cache_path = os.getenv("DATA_SCHEMA_CACHE", "./schema.cache.json")
+    raw = _fetch_remote_schema(os.getenv("DATA_SCHEMA_PATH"))   # dict valide | None
+    if raw is not None:
+        _persist_schema_cache(raw, cache_path)
+    else:
+        raw = _load_schema_file(cache_path)
+    if raw is None:
+        raise RuntimeError("Aucun schéma disponible (ni distant ni cache).")
+    return OrderedDict((c["name"], c) for c in raw["fields"])
+```
+
+Helpers :
+
+- `_fetch_remote_schema(url) -> dict | None` : `get(...).raise_for_status().json()`,
+  **valide `"fields" in data`**, attrape large (`httpx.HTTPError`,
+  `json.JSONDecodeError`, `KeyError`), log l'erreur, renvoie `None` sur tout échec.
+- `_load_schema_file(path) -> dict | None` : lit le fichier s'il existe, parse,
+  valide `"fields"`, renvoie `None` sinon.
+- `_persist_schema_cache(data, path)` : écriture atomique (tmp + `os.replace`) ;
+  un échec d'écriture est loggé mais **non bloquant** (le schéma en mémoire reste
+  valide).
+
+### Invariant 3 — Chargements au niveau module des pages
+
+> L'import d'une page (exécuté au boot via `use_pages`) ne doit jamais tuer le
+> démarrage à cause d'une ressource externe KO. Une ressource indisponible
+> dégrade gracieusement l'affichage.
+
+Audit des chargements à l'import (tous les `layout` de pages sont au niveau
+module ⇒ leur contenu s'exécute au boot). Deux points de rupture **externes** :
+
+**C — `src/pages/tableau.py:36-38`.** `get_last_modified(URL parquet)` fait un
+HTTP HEAD **sans gestion d'erreur** (URL injoignable, en-tête `last-modified`
+absent) ⇒ import KO ⇒ boot KO. C'est le même piège que `db.py`, mais dans une page.
+
+Correctif : un helper best-effort dans `src/utils/__init__.py` qui ne lève jamais
+et retombe sur le mtime du DuckDB (garanti présent par l'Invariant 1) :
+
+```python
+def get_data_update_timestamp(parquet_path: str, fallback_path: str | None = None) -> float | None:
+    """Date de MAJ des données, best-effort, sans jamais lever (usage au boot)."""
+    try:
+        return get_last_modified(parquet_path)
+    except Exception as e:
+        logger.warning(f"Date de mise à jour des données indisponible ({e})")
+    if fallback_path:
+        try:
+            return os.path.getmtime(fallback_path)
+        except OSError:
+            pass
+    return None
+```
+
+`tableau.py` l'utilise et gère le cas `None` (affiche « date inconnue »,
+`update_date_iso = ""`).
+
+**D — `src/pages/a-propos.py:103`.** `get_sources_tables(SOURCE_STATS_CSV_PATH)`
+(`src/figures.py:121`) fait `pl.read_csv(source_path)` mais ne rattrape que
+`URLError, HTTPError` — pas les erreurs Polars, ni `source_path` vide/`None`, ni
+fichier absent ⇒ import KO ⇒ boot KO.
+
+Correctif : élargir le `except` et gérer le chemin vide :
+
+```python
+def get_sources_tables(source_path) -> html.Div:
+    try:
+        if not source_path:
+            raise ValueError("SOURCE_STATS_CSV_PATH non défini")
+        dff = pl.read_csv(source_path)
+    except Exception as e:
+        logger.warning(f"Sources de données indisponibles ({e})")
+        return html.Div("Sources de données momentanément indisponibles.")
+    ...  # suite inchangée
+```
+
+Hors périmètre des pages : `data/departements.json` + `.geojson` (fichiers
+in-repo apportés par `git pull`, pas pilotés par env/URL — voir Hors périmètre).
+
+## Tests (TDD)
+
+Couvrir chaque branche de fallback. Sans dépendre du réseau réel.
+
+**Schéma (`get_data_schema` / helpers) :**
+
+1. URL OK ⇒ schéma distant retourné **et** cache écrit.
+2. URL renvoie une erreur HTTP (mock 500) ⇒ fallback cache.
+3. URL renvoie un JSON malformé (sans `"fields"`) ⇒ fallback cache.
+4. URL KO + cache présent ⇒ schéma du cache.
+5. URL KO + cache absent ⇒ `RuntimeError` claire.
+6. Échec d'écriture du cache ⇒ schéma quand même retourné (non bloquant).
+
+**Bootstrap DuckDB (`_ensure_database`) :**
+
+7. `should_rebuild` lève + DuckDB existant ⇒ réutilisé, pas d'exception.
+8. `build_database` lève + DuckDB existant ⇒ réutilisé, pas d'exception.
+9. Échec + **aucun** DuckDB (cold start) ⇒ ré-lève.
+10. Cas nominal : rebuild nécessaire et possible ⇒ build effectué.
+
+Mocker `get_last_modified` / `build_database` / `httpx.get` ; utiliser des fichiers
+DuckDB et schéma temporaires (`tmp_path`).
+
+**Chargements de pages (Invariant 3) :**
+
+11. `get_data_update_timestamp` : `get_last_modified` lève + `fallback_path`
+    existant ⇒ retourne le mtime du fallback (pas d'exception).
+12. `get_data_update_timestamp` : tout KO (lève + pas de fallback) ⇒ `None`.
+13. `get_data_update_timestamp` : cas nominal ⇒ retourne la valeur de
+    `get_last_modified` (mocké).
+14. `get_sources_tables(None)` ⇒ `html.Div` de repli (pas d'exception).
+15. `get_sources_tables("/inexistant.csv")` ⇒ `html.Div` de repli.
+16. `get_sources_tables(<csv valide>)` ⇒ `html.Div` contenant la `DataTable`.
+
+## Hors périmètre
+
+- Séparation des process API / Web (reportée — voir plus haut).
+- Surveillance / alerting externe (les logs `error`/`critical` suffisent pour ce lot).
+- Validation fine du contenu du parquet au-delà de « lisible par Polars/DuckDB ».
+- Durcissement des `open()` in-repo (`data/departements.json` + `.geojson`) :
+  fichiers versionnés, apportés par `git pull`, jamais pilotés par env/URL (YAGNI).
+
+## Variables d'environnement
+
+| Variable                 | Rôle                                    | Changement   |
+| ------------------------ | --------------------------------------- | ------------ |
+| `DATA_FILE_PARQUET_PATH` | Source parquet (URL ou chemin)          | inchangé     |
+| `DATA_SCHEMA_PATH`       | URL schéma (primaire)                   | inchangé     |
+| `DATA_SCHEMA_LOCAL`      | Ancien fichier de secours statique      | **supprimé** |
+| `DATA_SCHEMA_CACHE`      | Cache last-known-good du schéma distant | **nouveau**  |
+| `DUCKDB_PATH`            | Fichier DuckDB                          | inchangé     |
+| `SOURCE_STATS_CSV_PATH`  | CSV stats sources (page À propos, D)    | inchangé     |
+
+À faire côté config :
+
+- Ajouter `DATA_SCHEMA_CACHE` à `.template.env`, retirer `DATA_SCHEMA_LOCAL` de
+  `.template.env` / `.env`.
+- Ajouter `schema.cache.json` (ou la valeur de `DATA_SCHEMA_CACHE`) au `.gitignore`.

pyproject.toml

@@ -22,6 +22,8 @@ dependencies = [
   "flask-caching",
   "pyarrow>=23.0.1",
   "flask-cors>=6.0.2",
+  "flask-smorest>=0.46.0",
+  "marshmallow>=3.20.0",
 ]
 
 [dependency-groups]
@@ -42,6 +44,9 @@ env = [
   "DATA_FILE_PARQUET_PATH=tests/test.parquet",
   "DEVELOPMENT=true",
   "REBUILD_DUCKDB=true",
+  "DATA_SCHEMA_PATH=/home/colin/git/decp-processing/dist/schema.json",
+  "USERS_DB_PATH=tests/users.test.sqlite",
+  "MATOMO_TRACKING_ENABLED=false",
   "DATA_SCHEMA_LOCAL=/home/colin/git/decp-processing/dist/schema.json",
 ]
 addopts = "-p no:warnings"

src/api/__init__.py

@@ -0,0 +1,26 @@
+from flask_smorest import Api
+
+from src.api import routes
+
+
+def init_api(server) -> None:
+    """Enregistre le blueprint d'API privée sur le serveur Flask."""
+    server.config.setdefault("API_TITLE", "decp.info API")
+    server.config.setdefault("API_VERSION", "v1")
+    server.config.setdefault("OPENAPI_VERSION", "3.0.3")
+    server.config.setdefault("OPENAPI_URL_PREFIX", "/api/v1")
+    server.config.setdefault("OPENAPI_JSON_PATH", "openapi.json")
+    server.config.setdefault("OPENAPI_SWAGGER_UI_PATH", "swagger")
+    server.config.setdefault(
+        "OPENAPI_SWAGGER_UI_URL",
+        "https://cdn.jsdelivr.net/npm/swagger-ui-dist/",
+    )
+
+    api = Api(server)
+    api.register_blueprint(routes.bp)
+
+    import os
+
+    from src.api import tracking
+
+    tracking.start_worker(os.environ["USERS_DB_PATH"])

src/api/auth.py

@@ -0,0 +1,35 @@
+import os
+from functools import wraps
+
+from flask import abort, g, jsonify, make_response, request
+
+from src.api import tokens_db
+
+API_AUTH_DISABLED = os.getenv("API_AUTH_DISABLED", "False").lower() == "true"
+
+
+def _abort_401(message: str):
+    resp = make_response(jsonify({"message": message}), 401)
+    abort(resp)
+
+
+def require_token(fn):
+    @wraps(fn)
+    def wrapper(*args, **kwargs):
+        if not API_AUTH_DISABLED:
+            header = request.headers.get("Authorization", "")
+            if not header.startswith("Bearer "):
+                _abort_401("missing_token")
+            token = header[len("Bearer ") :].strip()
+            if not token:
+                _abort_401("missing_token")
+            db_path = os.environ["USERS_DB_PATH"]
+            row = tokens_db.get_token_by_plaintext(db_path, token)
+            if row is None:
+                _abort_401("invalid_token")
+            if row["revoked_at"] is not None:
+                _abort_401("revoked_token")
+            g.token_id = row["id"]
+        return fn(*args, **kwargs)
+
+    return wrapper

src/api/filters.py

@@ -0,0 +1,138 @@
+from datetime import date, datetime
+
+import polars as pl
+
+OPERATORS = {
+    "exact",
+    "contains",
+    "notcontains",
+    "less",
+    "greater",
+    "strictly_less",
+    "strictly_greater",
+    "in",
+    "notin",
+    "isnull",
+    "isnotnull",
+    "sort",
+}
+
+RESERVED_PARAMS = {"page", "page_size", "columns", "count"}
+
+
+class FilterError(ValueError):
+    def __init__(self, message: str, field: str | None = None):
+        super().__init__(message)
+        self.field = field
+
+
+def _coerce(value: str, dtype: pl.DataType, key: str):
+    if dtype == pl.String:
+        return value
+    if dtype.is_integer():
+        try:
+            return int(value)
+        except ValueError:
+            raise FilterError(f"Valeur entière attendue, reçu {value!r}", field=key)
+    if dtype.is_float():
+        try:
+            return float(value)
+        except ValueError:
+            raise FilterError(f"Valeur décimale attendue, reçu {value!r}", field=key)
+    if dtype == pl.Date:
+        try:
+            return date.fromisoformat(value)
+        except ValueError:
+            raise FilterError(
+                f"Date ISO 8601 attendue (YYYY-MM-DD), reçu {value!r}", field=key
+            )
+    if dtype == pl.Datetime:
+        try:
+            return datetime.fromisoformat(value)
+        except ValueError:
+            raise FilterError(f"Datetime ISO 8601 attendu, reçu {value!r}", field=key)
+    return value
+
+
+def _split_key(key: str) -> tuple[str, str] | None:
+    if "__" not in key:
+        return None
+    col, _, op = key.rpartition("__")
+    if not col or not op:
+        return None
+    return col, op
+
+
+def build_where(
+    args: list[tuple[str, str]], schema: pl.Schema
+) -> tuple[str, list, str | None]:
+    """Parse query params into (where_sql, params, order_by_sql).
+
+    args: list of (key, value) tuples preserving URL order (Werkzeug MultiDict
+    preserves insertion order on `request.args.items(multi=True)`).
+    """
+    where_parts: list[str] = []
+    params: list = []
+    order_parts: list[str] = []
+
+    for key, value in args:
+        if key in RESERVED_PARAMS:
+            continue
+
+        parsed = _split_key(key)
+        if not parsed:
+            raise FilterError(f"Paramètre non reconnu : {key}", field=key)
+        col, op = parsed
+
+        if op not in OPERATORS:
+            raise FilterError(f"Opérateur inconnu : __{op}", field=key)
+
+        if col not in schema:
+            raise FilterError(f"Colonne inconnue : {col!r}", field=key)
+
+        if op == "sort":
+            direction = value.lower()
+            if direction not in ("asc", "desc"):
+                raise FilterError(
+                    f"Tri attendu 'asc' ou 'desc', reçu {value!r}", field=key
+                )
+            order_parts.append(f'"{col}" {direction.upper()}')
+            continue
+
+        if op in ("isnull", "isnotnull"):
+            sql = "IS NULL" if op == "isnull" else "IS NOT NULL"
+            where_parts.append(f'"{col}" {sql}')
+            continue
+
+        dtype = schema[col]
+
+        if op in ("in", "notin"):
+            values = [_coerce(v.strip(), dtype, key) for v in value.split(",")]
+            placeholders = ",".join(["?"] * len(values))
+            sql_op = "IN" if op == "in" else "NOT IN"
+            where_parts.append(f'"{col}" {sql_op} ({placeholders})')
+            params.extend(values)
+            continue
+
+        v = _coerce(value, dtype, key)
+
+        op_sql = {
+            "exact": "=",
+            "less": "<=",
+            "greater": ">=",
+            "strictly_less": "<",
+            "strictly_greater": ">",
+        }
+        if op in op_sql:
+            where_parts.append(f'"{col}" {op_sql[op]} ?')
+            params.append(v)
+        elif op == "contains":
+            where_parts.append(f'"{col}" LIKE ?')
+            params.append(f"%{v}%")
+        elif op == "notcontains":
+            where_parts.append(f'"{col}" NOT LIKE ?')
+            params.append(f"%{v}%")
+
+    where_sql = " AND ".join(where_parts) if where_parts else "TRUE"
+    order_sql = ", ".join(order_parts) if order_parts else None
+    return where_sql, params, order_sql

src/api/routes.py

@@ -0,0 +1,143 @@
+from flask import g, request
+from flask_smorest import Blueprint, abort
+
+from src.api import tracking
+from src.api.auth import require_token
+from src.api.filters import FilterError, build_where
+from src.db import count_marches, query_marches
+from src.db import schema as duckdb_schema
+
+bp = Blueprint(
+    "api_v1",
+    "api_v1",
+    url_prefix="/api/v1",
+    description="API privée decp.info — accès tabulaire aux marchés publics.",
+)
+
+MAX_PAGE_SIZE = 1000
+
+
+def _parse_pagination():
+    try:
+        page = int(request.args.get("page", "1"))
+        page_size = int(request.args.get("page_size", "50"))
+    except ValueError:
+        abort(400, message="page et page_size doivent être des entiers")
+    if page < 1:
+        abort(400, message="page doit être >= 1")
+    if page_size < 1 or page_size > MAX_PAGE_SIZE:
+        abort(
+            400,
+            message=f"page_size doit être dans [1, {MAX_PAGE_SIZE}]",
+        )
+    return page, page_size
+
+
+def _parse_columns():
+    raw = request.args.get("columns")
+    if not raw:
+        return None
+    cols = [c.strip() for c in raw.split(",") if c.strip()]
+    unknown = [c for c in cols if c not in duckdb_schema]
+    if unknown:
+        abort(400, message=f"Colonnes inconnues : {unknown}")
+    return cols
+
+
+def _build_links(page, page_size, total):
+    base = request.path
+    qs = request.args.to_dict(flat=False)
+    qs.pop("page", None)
+
+    def url_for(p):
+        from urllib.parse import urlencode
+
+        params = [(k, v) for k, vs in qs.items() for v in vs]
+        params.append(("page", str(p)))
+        return f"{base}?{urlencode(params)}"
+
+    prev_url = url_for(page - 1) if page > 1 else None
+    next_url = None
+    if total is None or page * page_size < total:
+        next_url = url_for(page + 1)
+    return {"prev": prev_url, "next": next_url}
+
+
+@bp.after_request
+def _track_consumption(response):
+    token_id = getattr(g, "token_id", None)
+    if token_id is not None:
+        tracking.enqueue_counter_update(token_id)
+        tracking.enqueue_matomo_event(
+            token_id=token_id,
+            path=request.path,
+            query_string=request.query_string.decode("utf-8", errors="replace"),
+            status_code=response.status_code,
+            user_agent=request.headers.get("User-Agent", ""),
+        )
+    return response
+
+
+@bp.route("/health")
+def health():
+    """Sonde de santé, sans authentification."""
+    return {"status": "ok"}
+
+
+@bp.route("/schema")
+@require_token
+def schema():
+    """Liste des colonnes disponibles dans le dataset DECP."""
+    cols = [{"name": name, "type": str(dtype)} for name, dtype in duckdb_schema.items()]
+    return {"columns": cols}
+
+
+@bp.route("/data")
+@require_token
+def data():
+    """Récupère des marchés publics filtrés.
+
+    Filtres en query string sous la forme `<colonne>__<opérateur>=<valeur>`.
+
+    Opérateurs : exact, contains, notcontains, less, greater,
+    strictly_less, strictly_greater, in, notin, isnull, isnotnull, sort.
+
+    Paramètres réservés : page (défaut 1), page_size (défaut 50, max 1000),
+    columns (csv), count (true|false ; mettre false pour économiser le COUNT(*)).
+    """
+    import polars as pl
+    import polars.selectors as cs
+
+    page, page_size = _parse_pagination()
+    columns = _parse_columns()
+    count = request.args.get("count", "true").lower() != "false"
+
+    try:
+        where_sql, params, order_sql = build_where(
+            list(request.args.items(multi=True)), duckdb_schema
+        )
+    except FilterError as e:
+        abort(400, message=str(e), errors={"field": e.field})
+
+    df = query_marches(
+        where_sql=where_sql,
+        params=params,
+        columns=columns,
+        order_by=order_sql,
+        limit=page_size,
+        offset=(page - 1) * page_size,
+    )
+
+    # JSON ne sérialise pas date/datetime nativement → cast en string ISO
+    df_ready = df.with_columns(cs.temporal().cast(pl.String))
+
+    total = count_marches(where_sql, params) if count else None
+    meta = {"page": page, "page_size": page_size}
+    if total is not None:
+        meta["total"] = total
+
+    return {
+        "data": df_ready.to_dicts(),
+        "meta": meta,
+        "links": _build_links(page, page_size, total),
+    }

src/api/tokens_cli.py

@@ -0,0 +1,57 @@
+import argparse
+import os
+import sys
+
+from src.api import tokens_db
+
+
+def main(argv=None, env=None) -> int:
+    env = env if env is not None else os.environ
+    parser = argparse.ArgumentParser(prog="python -m src.api.tokens_cli")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+
+    p_create = sub.add_parser("create", help="Créer un token API")
+    p_create.add_argument("--label", required=True)
+    p_create.add_argument("--user-id", type=int, default=None)
+
+    sub.add_parser("list", help="Lister les tokens")
+
+    p_revoke = sub.add_parser("revoke", help="Révoquer un token")
+    p_revoke.add_argument("token_id", type=int)
+
+    args = parser.parse_args(argv)
+    db_path = env["USERS_DB_PATH"]
+    tokens_db.init_schema(db_path)
+
+    if args.cmd == "create":
+        token, token_id = tokens_db.create_token(db_path, args.label, args.user_id)
+        print(f"id={token_id} label={args.label}")
+        print(f"token (à conserver, ne sera plus affiché) : {token}")
+        return 0
+
+    if args.cmd == "list":
+        rows = tokens_db.list_tokens(db_path)
+        if not rows:
+            print("(aucun token)")
+            return 0
+        print(
+            f"{'id':<4} {'label':<40} {'created_at':<26} {'last_used_at':<26} {'count':<7} revoked"
+        )
+        for r in rows:
+            print(
+                f"{r['id']:<4} {r['label']:<40} {r['created_at']:<26} "
+                f"{(r['last_used_at'] or '-'):<26} {r['count_total']:<7} "
+                f"{r['revoked_at'] or ''}"
+            )
+        return 0
+
+    if args.cmd == "revoke":
+        tokens_db.revoke_token(db_path, args.token_id)
+        print(f"token id={args.token_id} révoqué")
+        return 0
+
+    return 1
+
+
+if __name__ == "__main__":  # pragma: no cover
+    sys.exit(main())

src/api/tokens_db.py

@@ -0,0 +1,94 @@
+import hashlib
+import secrets
+import sqlite3
+from contextlib import contextmanager
+from datetime import datetime, timezone
+from pathlib import Path
+
+TOKEN_PREFIX = "decpinfo_"
+
+SCHEMA = """
+CREATE TABLE IF NOT EXISTS api_tokens (
+    id           INTEGER PRIMARY KEY,
+    token_hash   TEXT NOT NULL UNIQUE,
+    label        TEXT NOT NULL,
+    user_id      INTEGER,
+    created_at   TEXT NOT NULL,
+    last_used_at TEXT,
+    count_total  INTEGER NOT NULL DEFAULT 0,
+    revoked_at   TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_api_tokens_hash ON api_tokens(token_hash);
+"""
+
+
+def _utcnow_iso() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec="seconds")
+
+
+def _hash(token: str) -> str:
+    return hashlib.sha256(token.encode()).hexdigest()
+
+
+@contextmanager
+def _connect(db_path):
+    conn = sqlite3.connect(str(db_path))
+    conn.row_factory = sqlite3.Row
+    try:
+        yield conn
+    finally:
+        conn.close()
+
+
+def init_schema(db_path) -> None:
+    Path(db_path).parent.mkdir(parents=True, exist_ok=True)
+    with _connect(db_path) as conn:
+        conn.executescript(SCHEMA)
+        conn.commit()
+
+
+def create_token(db_path, label: str, user_id: int | None = None) -> tuple[str, int]:
+    token = TOKEN_PREFIX + secrets.token_hex(32)
+    with _connect(db_path) as conn:
+        cur = conn.execute(
+            "INSERT INTO api_tokens (token_hash, label, user_id, created_at) "
+            "VALUES (?, ?, ?, ?)",
+            (_hash(token), label, user_id, _utcnow_iso()),
+        )
+        conn.commit()
+        return token, cur.lastrowid
+
+
+def get_token_by_plaintext(db_path, token: str) -> dict | None:
+    with _connect(db_path) as conn:
+        row = conn.execute(
+            "SELECT * FROM api_tokens WHERE token_hash = ?",
+            (_hash(token),),
+        ).fetchone()
+    return dict(row) if row else None
+
+
+def revoke_token(db_path, token_id: int) -> None:
+    with _connect(db_path) as conn:
+        conn.execute(
+            "UPDATE api_tokens SET revoked_at = ? WHERE id = ?",
+            (_utcnow_iso(), token_id),
+        )
+        conn.commit()
+
+
+def increment_usage(db_path, token_id: int) -> None:
+    with _connect(db_path) as conn:
+        conn.execute(
+            "UPDATE api_tokens "
+            "SET count_total = count_total + 1, last_used_at = ? "
+            "WHERE id = ?",
+            (_utcnow_iso(), token_id),
+        )
+        conn.commit()
+
+
+def list_tokens(db_path) -> list[dict]:
+    with _connect(db_path) as conn:
+        rows = conn.execute("SELECT * FROM api_tokens ORDER BY id").fetchall()
+    return [dict(r) for r in rows]

src/api/tracking.py

@@ -0,0 +1,110 @@
+import os
+import queue
+import threading
+from typing import Optional
+
+import httpx
+
+from src.api import tokens_db
+from src.utils import logger
+
+_STOP_SENTINEL = object()
+_queue: Optional[queue.Queue] = None
+_worker_thread: Optional[threading.Thread] = None
+
+
+def _worker_loop(q: queue.Queue, db_path: str) -> None:
+    while True:
+        item = q.get()
+        try:
+            if item is _STOP_SENTINEL:
+                return
+            kind, payload = item
+            if kind == "counter":
+                token_id = payload
+                try:
+                    tokens_db.increment_usage(db_path, token_id)
+                except Exception:  # noqa: BLE001
+                    logger.warning(
+                        "tracking: échec increment_usage token_id=%s",
+                        token_id,
+                        exc_info=True,
+                    )
+            elif kind == "matomo":
+                try:
+                    _post_matomo(**payload)
+                except Exception:  # noqa: BLE001
+                    logger.warning("tracking: échec envoi Matomo", exc_info=True)
+        finally:
+            q.task_done()
+
+
+def _post_matomo(url: str, params: dict) -> None:
+    """POST fire-and-forget vers la Tracking API Matomo. Mockable en test."""
+    httpx.post(url, data=params, timeout=5.0)
+
+
+def enqueue_matomo_event(
+    token_id: int,
+    path: str,
+    query_string: str,
+    status_code: int,
+    user_agent: str,
+) -> None:
+    if _queue is None:
+        return
+    if os.getenv("MATOMO_TRACKING_ENABLED", "false").lower() != "true":
+        return
+    url = os.getenv("MATOMO_URL")
+    site_id = os.getenv("MATOMO_SITE_ID")
+    if not url or not site_id:
+        return
+    full_url = f"https://decp.info{path}"
+    if query_string:
+        full_url += f"?{query_string}"
+    params = {
+        "idsite": site_id,
+        "rec": "1",
+        "url": full_url,
+        "action_name": f"API {path}",
+        "uid": f"token-{token_id}",
+        "dimension1": str(token_id),
+        "dimension2": str(status_code),
+        "ua": user_agent,
+    }
+    _queue.put(("matomo", {"url": url, "params": params}))
+
+
+def start_worker(db_path: str) -> None:
+    global _queue, _worker_thread
+    if _worker_thread is not None and _worker_thread.is_alive():
+        return
+    _queue = queue.Queue()
+    _worker_thread = threading.Thread(
+        target=_worker_loop, args=(_queue, db_path), daemon=True
+    )
+    _worker_thread.start()
+
+
+def stop_worker() -> None:
+    global _worker_thread, _queue
+    if _worker_thread is None:
+        return
+    _queue.put(_STOP_SENTINEL)
+    _worker_thread.join(timeout=2.0)
+    _worker_thread = None
+    _queue = None
+
+
+def enqueue_counter_update(token_id: int) -> None:
+    if _queue is None:
+        return  # tracking désactivé (tests par ex.)
+    _queue.put(("counter", token_id))
+
+
+def flush(timeout: float = 2.0) -> None:
+    """Attend que la queue soit drainée. Utile en test."""
+    q = _queue
+    if q is None:
+        return
+    q.join()

src/app.py

@@ -57,6 +57,10 @@ app: Dash = Dash(
     meta_tags=META_TAGS,
 )
 
+from src.api import init_api  # noqa: E402  # inline: src.db.conn must be ready first
+
+init_api(app.server)
+
 
 # robots.txt
 @app.server.route("/robots.txt")

src/db.py

@@ -118,13 +118,24 @@ def _ensure_database() -> Path:
     db_path = Path(os.getenv("DUCKDB_PATH", "./decp.duckdb"))
     parquet_path = os.getenv("DATA_FILE_PARQUET_PATH", "")
     lock_path = db_path.with_suffix(".duckdb.lock")
+    db_exists = db_path.exists()
 
     with open(lock_path, "w") as lock_fd:
         fcntl.flock(lock_fd, fcntl.LOCK_EX)
+        try:
             if should_rebuild(db_path, parquet_path):
                 build_database(db_path)
             else:
                 logger.debug("Base de données déjà disponible et à jour.")
+        except Exception as e:
+            if db_exists and db_path.exists():
+                logger.error(
+                    f"Bootstrap données KO ({e}). "
+                    f"Réutilisation du DuckDB existant : {db_path}"
+                )
+            else:
+                logger.critical("Aucune base DuckDB et reconstruction impossible.")
+                raise
     return db_path
 
 

src/figures.py

@@ -1,6 +1,5 @@
 from datetime import datetime
 from typing import Literal
-from urllib.error import HTTPError, URLError
 
 import dash_bootstrap_components as dbc
 import dash_leaflet as dl
@@ -120,9 +119,12 @@ def get_barchart_sources(lff: pl.LazyFrame, type_date: str):
 
 def get_sources_tables(source_path) -> html.Div:
     try:
+        if not source_path:
+            raise ValueError("SOURCE_STATS_CSV_PATH non défini")
         dff = pl.read_csv(source_path)
-    except (URLError, HTTPError):
+    except Exception as e:
-        return html.Div("Erreur de connexion")
+        logger.warning(f"Sources de données indisponibles ({e})")
+        return html.Div("Sources de données momentanément indisponibles.")
     dff = dff.with_columns(
         (
             pl.lit('<a href = "')

src/pages/a-propos.py

@@ -49,6 +49,16 @@ Vous pouvez consommer les données qui alimentent decp.info
 
 - en les téléchargeant [sur data.gouv.fr](https://www.data.gouv.fr/datasets/donnees-essentielles-de-la-commande-publique-consolidees-format-tabulaire) (Parquet, CSV), pensez à lire la description du jeu de données
 - en interrogeant l'[API REST ouverte](https://www.data.gouv.fr/datasets/donnees-essentielles-de-la-commande-publique-consolidees-format-tabulaire#user-content-api-rest)
+"""
+                        ),
+                        html.H4("API privée", id="api-privee"),
+                        dcc.Markdown(
+                            """
+Une API HTTP est disponible pour accéder aux mêmes données par programme.
+Documentation interactive : [Swagger UI](/api/v1/swagger).
+
+L'accès se fait sur token. Pour en obtenir un, contactez
+[colin@maudry.com](mailto:colin@maudry.com).
 """
                         ),
                         html.H4("Contact", id="contact"),
@@ -149,6 +159,11 @@ J'enregistre également les données suivantes, de manière anonyme, afin de mie
                                     href="#donnees-brutes",
                                     className="toc-link",
                                 ),
+                                html.A(
+                                    "API privée",
+                                    href="#api-privee",
+                                    className="toc-link",
+                                ),
                                 html.A(
                                     "Contact", href="#contact", className="toc-link"
                                 ),

src/pages/tableau.py

@@ -21,7 +21,7 @@ from dash import (
 
 from src.db import query_marches, schema
 from src.figures import DataTable, make_column_picker
-from src.utils import get_last_modified, logger
+from src.utils import get_data_update_timestamp, logger
 from src.utils.seo import META_CONTENT
 from src.utils.table import (
     COLUMNS,
@@ -33,9 +33,16 @@ from src.utils.table import (
 )
 from src.utils.tracking import track_search
 
-update_date_timestamp = get_last_modified(os.getenv("DATA_FILE_PARQUET_PATH", ""))
+update_date_timestamp = get_data_update_timestamp(
+    os.getenv("DATA_FILE_PARQUET_PATH", ""),
+    os.getenv("DUCKDB_PATH", "./decp.duckdb"),
+)
+if update_date_timestamp is not None:
     update_date = datetime.fromtimestamp(update_date_timestamp).strftime("%d/%m/%Y")
     update_date_iso = datetime.fromtimestamp(update_date_timestamp).isoformat()
+else:
+    update_date = "date inconnue"
+    update_date_iso = ""
 
 
 NAME = "Tableau"
@@ -117,7 +124,11 @@ layout = [
                             "contentUrl": "https://www.data.gouv.fr/api/1/datasets/r/11cea8e8-df3e-4ed1-932b-781e2635e432",
                         },
                     ],
-                    "temporalCoverage": f"2018-01-01/{update_date_iso[:10]}",
+                    **(
+                        {"temporalCoverage": f"2018-01-01/{update_date_iso[:10]}"}
+                        if update_date_iso
+                        else {}
+                    ),
                     "spatialCoverage": {
                         "@type": "Place",
                         "address": {"countryCode": "FR"},

src/utils/__init__.py

@@ -41,3 +41,19 @@ DOMAIN_NAME = (
     if os.getenv("DEVELOPMENT", "False").lower() == "true"
     else "decp.info"
 )
+
+
+def get_data_update_timestamp(
+    parquet_path: str, fallback_path: str | None = None
+) -> float | None:
+    """Date de MAJ des données, best-effort, sans jamais lever (usage au boot)."""
+    try:
+        return get_last_modified(parquet_path)
+    except Exception as e:
+        logger.warning(f"Date de mise à jour des données indisponible ({e})")
+    if fallback_path:
+        try:
+            return os.path.getmtime(fallback_path)
+        except OSError:
+            pass
+    return None

src/utils/data.py

@@ -2,7 +2,6 @@ import json
 import logging
 import os
 from collections import OrderedDict
-from pathlib import Path
 
 import httpx
 import polars as pl
@@ -65,34 +64,67 @@ def get_departement_region(code_postal: str | None):
     return "", "", ""
 
 
-def get_data_schema() -> dict:
+def _validate_schema(raw) -> dict | None:
-    # Récupération du schéma des données tabulaires
+    if (
-    url = os.getenv("DATA_SCHEMA_PATH")
+        isinstance(raw, dict)
-    local_path = Path(os.getenv("DATA_SCHEMA_LOCAL", ""))
+        and isinstance(raw.get("fields"), list)
-
+        and raw["fields"]
-    original_schema = {}
+        and all(isinstance(c, dict) and "name" in c for c in raw["fields"])
-    if url:
-        try:
-            original_schema: dict = get(url, follow_redirects=True).json()
-        except (
-            httpx.ReadTimeout,
-            httpx.ReadError,
-            httpx.ConnectError,
-            httpx.ConnectTimeout,
     ):
-            logger.error(f"Erreur HTTP lors de la récupération du schéma ({url})")
+        return raw
+    return None
 
-    if os.path.exists(local_path) and original_schema == {}:
-        with open(local_path) as f:
-            original_schema: dict = json.load(f)
-        logger.info(f"Utilisation du schéma local ({local_path})")
 
-    new_schema = OrderedDict()
+def _fetch_remote_schema(url: str | None) -> dict | None:
+    if not url:
+        return None
+    try:
+        raw = get(url, follow_redirects=True).raise_for_status().json()
+    except (
+        httpx.HTTPError,
+        httpx.TransportError,
+        httpx.TimeoutException,
+        json.JSONDecodeError,
+    ) as e:
+        logger.error(f"Schéma distant indisponible ({url}) : {e}")
+        return None
+    return _validate_schema(raw)
 
-    for col in original_schema["fields"]:
-        new_schema[col["name"]] = col
 
-    return new_schema
+def _load_schema_file(path: str) -> dict | None:
+    if not path or not os.path.exists(path):
+        return None
+    try:
+        with open(path) as f:
+            raw = json.load(f)
+    except (OSError, json.JSONDecodeError) as e:
+        logger.error(f"Schéma local illisible ({path}) : {e}")
+        return None
+    return _validate_schema(raw)
+
+
+def _persist_schema_cache(raw: dict, path: str) -> None:
+    if not path:
+        return
+    try:
+        tmp = f"{path}.tmp"
+        with open(tmp, "w") as f:
+            json.dump(raw, f)
+        os.replace(tmp, path)
+    except (OSError, ValueError) as e:
+        logger.warning(f"Écriture du cache schéma échouée ({path}) : {e}")
+
+
+def get_data_schema() -> dict:
+    cache_path = os.getenv("DATA_SCHEMA_CACHE", "./schema.cache.json")
+    raw = _fetch_remote_schema(os.getenv("DATA_SCHEMA_PATH"))
+    if raw is not None:
+        _persist_schema_cache(raw, cache_path)
+    else:
+        raw = _load_schema_file(cache_path)
+    if raw is None:
+        raise RuntimeError("Aucun schéma disponible (ni distant ni cache).")
+    return OrderedDict((c["name"], c) for c in raw["fields"])
 
 
 def prepare_dashboard_data(**filter_params) -> pl.DataFrame:

tests/api/conftest.py

@@ -0,0 +1,37 @@
+import pytest
+
+
+@pytest.fixture
+def temp_db(tmp_path, monkeypatch):
+    """Une SQLite éphémère pour les tests qui modifient la DB."""
+    db_path = tmp_path / "users.test.sqlite"
+    monkeypatch.setenv("USERS_DB_PATH", str(db_path))
+    from src.api import tokens_db
+
+    tokens_db.init_schema(db_path)
+    return db_path
+
+
+@pytest.fixture
+def api_client(monkeypatch, tmp_path):
+    """Client Flask test avec USERS_DB_PATH éphémère et blueprint API monté."""
+    db_path = tmp_path / "users.test.sqlite"
+    monkeypatch.setenv("USERS_DB_PATH", str(db_path))
+    from flask import Flask
+
+    from src.api import init_api, tokens_db, tracking
+
+    tokens_db.init_schema(db_path)
+    server = Flask(__name__)
+    init_api(server)
+    yield server.test_client(), db_path
+    tracking.stop_worker()
+
+
+@pytest.fixture
+def valid_token_header(api_client):
+    from src.api import tokens_db
+
+    _, db_path = api_client
+    token, _ = tokens_db.create_token(db_path, "test-token")
+    return {"Authorization": f"Bearer {token}"}

tests/api/test_auth.py

@@ -0,0 +1,59 @@
+from flask import Flask, g, jsonify
+
+from src.api import tokens_db
+from src.api.auth import require_token
+
+
+def _make_app():
+    app = Flask(__name__)
+
+    @app.route("/protected")
+    @require_token
+    def protected():
+        return jsonify({"token_id": g.token_id})
+
+    return app
+
+
+def test_missing_header_returns_401(temp_db):
+    app = _make_app()
+    resp = app.test_client().get("/protected")
+    assert resp.status_code == 401
+    assert resp.get_json()["message"] == "missing_token"
+
+
+def test_bearer_without_value_returns_401(temp_db):
+    app = _make_app()
+    resp = app.test_client().get("/protected", headers={"Authorization": "Bearer "})
+    assert resp.status_code == 401
+    assert resp.get_json()["message"] == "missing_token"
+
+
+def test_invalid_token_returns_401(temp_db):
+    app = _make_app()
+    resp = app.test_client().get(
+        "/protected", headers={"Authorization": "Bearer decpinfo_unknown"}
+    )
+    assert resp.status_code == 401
+    assert resp.get_json()["message"] == "invalid_token"
+
+
+def test_revoked_token_returns_401(temp_db):
+    token, token_id = tokens_db.create_token(temp_db, "x")
+    tokens_db.revoke_token(temp_db, token_id)
+    app = _make_app()
+    resp = app.test_client().get(
+        "/protected", headers={"Authorization": f"Bearer {token}"}
+    )
+    assert resp.status_code == 401
+    assert resp.get_json()["message"] == "revoked_token"
+
+
+def test_valid_token_sets_g_and_calls_view(temp_db):
+    token, token_id = tokens_db.create_token(temp_db, "x")
+    app = _make_app()
+    resp = app.test_client().get(
+        "/protected", headers={"Authorization": f"Bearer {token}"}
+    )
+    assert resp.status_code == 200
+    assert resp.get_json()["token_id"] == token_id

tests/api/test_endpoints_data.py

@@ -0,0 +1,104 @@
+def test_data_without_token_returns_401(api_client):
+    client, _ = api_client
+    resp = client.get("/api/v1/data")
+    assert resp.status_code == 401
+
+
+def test_data_default_pagination(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get("/api/v1/data", headers=valid_token_header)
+    assert resp.status_code == 200
+    body = resp.get_json()
+    assert set(body.keys()) >= {"data", "meta", "links"}
+    assert isinstance(body["data"], list)
+    assert len(body["data"]) <= 50  # default page_size
+    assert body["meta"]["page"] == 1
+    assert body["meta"]["page_size"] == 50
+    assert "total" in body["meta"]
+
+
+def test_data_count_false_omits_total(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get("/api/v1/data?count=false", headers=valid_token_header)
+    assert resp.status_code == 200
+    body = resp.get_json()
+    assert "total" not in body["meta"]
+
+
+def test_data_page_size_max_enforced(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get("/api/v1/data?page_size=5000", headers=valid_token_header)
+    assert resp.status_code == 400
+
+
+def test_data_page_size_below_min_rejected(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get("/api/v1/data?page_size=0", headers=valid_token_header)
+    assert resp.status_code == 400
+
+
+def test_data_pagination_links(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get("/api/v1/data?page=1&page_size=1", headers=valid_token_header)
+    body = resp.get_json()
+    assert body["links"]["prev"] is None
+    if body["meta"]["total"] > 1:
+        assert body["links"]["next"] is not None
+        assert "page=2" in body["links"]["next"]
+
+
+def test_data_filter_exact_string(api_client, valid_token_header):
+    client, _ = api_client
+    # On choisit une valeur qui existe dans test.parquet : récupère via la 1re ligne
+    base = client.get("/api/v1/data?page_size=1", headers=valid_token_header).get_json()
+    assert base["data"], "test.parquet vide ?"
+    uid = base["data"][0]["uid"]
+
+    resp = client.get(f"/api/v1/data?uid__exact={uid}", headers=valid_token_header)
+    assert resp.status_code == 200
+    body = resp.get_json()
+    assert all(row["uid"] == uid for row in body["data"])
+
+
+def test_data_unknown_column_filter_returns_400(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get(
+        "/api/v1/data?colonne_inexistante__exact=x",
+        headers=valid_token_header,
+    )
+    assert resp.status_code == 400
+
+
+def test_data_columns_selection(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get(
+        "/api/v1/data?columns=uid,objet&page_size=3",
+        headers=valid_token_header,
+    )
+    assert resp.status_code == 200
+    body = resp.get_json()
+    for row in body["data"]:
+        assert set(row.keys()) == {"uid", "objet"}
+
+
+def test_data_columns_unknown_returns_400(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get(
+        "/api/v1/data?columns=uid,foobar",
+        headers=valid_token_header,
+    )
+    assert resp.status_code == 400
+
+
+def test_data_sort_desc(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get(
+        "/api/v1/data?dateNotification__sort=desc&page_size=5",
+        headers=valid_token_header,
+    )
+    assert resp.status_code == 200
+    body = resp.get_json()
+    dates = [
+        row["dateNotification"] for row in body["data"] if row.get("dateNotification")
+    ]
+    assert dates == sorted(dates, reverse=True)

tests/api/test_endpoints_schema.py

@@ -0,0 +1,19 @@
+def test_schema_without_token_returns_401(api_client):
+    client, _ = api_client
+    resp = client.get("/api/v1/schema")
+    assert resp.status_code == 401
+
+
+def test_schema_returns_columns(api_client, valid_token_header):
+    client, _ = api_client
+    resp = client.get("/api/v1/schema", headers=valid_token_header)
+    assert resp.status_code == 200
+    data = resp.get_json()
+    assert "columns" in data
+    assert isinstance(data["columns"], list)
+    assert len(data["columns"]) > 0
+    first = data["columns"][0]
+    assert set(first.keys()) >= {"name", "type"}
+    # uid doit être présent dans le schéma DECP de test
+    names = [c["name"] for c in data["columns"]]
+    assert "uid" in names

tests/api/test_filters.py

@@ -0,0 +1,141 @@
+import polars as pl
+import pytest
+
+from src.api.filters import FilterError, build_where
+
+SCHEMA = pl.Schema(
+    {
+        "uid": pl.String,
+        "objet": pl.String,
+        "montant": pl.Float64,
+        "annee": pl.Int64,
+        "dateNotification": pl.Date,
+    }
+)
+
+
+def test_no_filters_returns_true():
+    where, params, order = build_where([], SCHEMA)
+    assert where == "TRUE"
+    assert params == []
+    assert order is None
+
+
+def test_exact_filter():
+    where, params, _ = build_where([("uid__exact", "abc")], SCHEMA)
+    assert where == '"uid" = ?'
+    assert params == ["abc"]
+
+
+def test_contains_filter_uses_like_wildcards():
+    where, params, _ = build_where([("objet__contains", "informatique")], SCHEMA)
+    assert where == '"objet" LIKE ?'
+    assert params == ["%informatique%"]
+
+
+def test_notcontains_filter():
+    where, params, _ = build_where([("objet__notcontains", "x")], SCHEMA)
+    assert where == '"objet" NOT LIKE ?'
+    assert params == ["%x%"]
+
+
+def test_comparison_operators_on_int():
+    where, params, _ = build_where([("annee__strictly_greater", "2023")], SCHEMA)
+    assert where == '"annee" > ?'
+    assert params == [2024 - 1]  # int coercion: 2023
+
+
+def test_in_filter_splits_on_commas():
+    where, params, _ = build_where([("annee__in", "2022,2023,2024")], SCHEMA)
+    assert where == '"annee" IN (?,?,?)'
+    assert params == [2022, 2023, 2024]
+
+
+def test_notin_filter():
+    where, params, _ = build_where([("annee__notin", "2020,2021")], SCHEMA)
+    assert where == '"annee" NOT IN (?,?)'
+    assert params == [2020, 2021]
+
+
+def test_isnull_filter_ignores_value():
+    where, params, _ = build_where([("dateNotification__isnull", "anything")], SCHEMA)
+    assert where == '"dateNotification" IS NULL'
+    assert params == []
+
+
+def test_isnotnull_filter():
+    where, params, _ = build_where([("dateNotification__isnotnull", "")], SCHEMA)
+    assert where == '"dateNotification" IS NOT NULL'
+
+
+def test_multiple_filters_joined_by_and():
+    where, params, _ = build_where(
+        [("uid__exact", "a"), ("annee__greater", "2020")], SCHEMA
+    )
+    assert where == '"uid" = ? AND "annee" >= ?'
+    assert params == ["a", 2020]
+
+
+def test_unknown_column_raises():
+    with pytest.raises(FilterError) as exc:
+        build_where([("foo__exact", "bar")], SCHEMA)
+    assert "foo" in str(exc.value)
+    assert exc.value.field == "foo__exact"
+
+
+def test_unknown_operator_raises():
+    with pytest.raises(FilterError) as exc:
+        build_where([("uid__weird", "x")], SCHEMA)
+    assert "weird" in str(exc.value)
+
+
+def test_bad_int_value_raises():
+    with pytest.raises(FilterError):
+        build_where([("annee__exact", "notanint")], SCHEMA)
+
+
+def test_bad_date_value_raises():
+    with pytest.raises(FilterError):
+        build_where([("dateNotification__exact", "notadate")], SCHEMA)
+
+
+def test_date_iso_coercion():
+    where, params, _ = build_where(
+        [("dateNotification__greater", "2024-01-01")], SCHEMA
+    )
+    from datetime import date
+
+    assert params == [date(2024, 1, 1)]
+
+
+def test_reserved_params_are_ignored():
+    where, params, order = build_where(
+        [
+            ("page", "2"),
+            ("page_size", "100"),
+            ("columns", "uid"),
+            ("count", "false"),
+            ("uid__exact", "z"),
+        ],
+        SCHEMA,
+    )
+    assert where == '"uid" = ?'
+    assert params == ["z"]
+
+
+def test_sort_returns_order_by():
+    where, params, order = build_where(
+        [("annee__sort", "desc"), ("uid__sort", "asc")], SCHEMA
+    )
+    assert where == "TRUE"
+    assert order == '"annee" DESC, "uid" ASC'
+
+
+def test_sort_invalid_direction_raises():
+    with pytest.raises(FilterError):
+        build_where([("uid__sort", "sideways")], SCHEMA)
+
+
+def test_param_without_operator_raises():
+    with pytest.raises(FilterError):
+        build_where([("uidexact", "x")], SCHEMA)

tests/api/test_health.py

@@ -0,0 +1,25 @@
+from flask import Flask
+
+from src.api import init_api
+
+
+def _make_app():
+    app = Flask(__name__)
+    init_api(app)
+    return app
+
+
+def test_health_returns_ok_without_auth():
+    app = _make_app()
+    resp = app.test_client().get("/api/v1/health")
+    assert resp.status_code == 200
+    assert resp.get_json() == {"status": "ok"}
+
+
+def test_health_via_real_app():
+    """Vérifie que init_api est bien branché dans src.app."""
+    from src.app import app as dash_app
+
+    resp = dash_app.server.test_client().get("/api/v1/health")
+    assert resp.status_code == 200
+    assert resp.get_json() == {"status": "ok"}

tests/api/test_tokens_cli.py

@@ -0,0 +1,33 @@
+from src.api import tokens_cli, tokens_db
+
+
+def _run(args, env):
+    return tokens_cli.main(args, env=env)
+
+
+def test_create_prints_plaintext_token_once(temp_db, capsys):
+    rc = _run(["create", "--label", "alice"], env={"USERS_DB_PATH": str(temp_db)})
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert "decpinfo_" in out
+    tokens = tokens_db.list_tokens(temp_db)
+    assert len(tokens) == 1
+    assert tokens[0]["label"] == "alice"
+
+
+def test_list_shows_tokens(temp_db, capsys):
+    tokens_db.create_token(temp_db, "alice")
+    tokens_db.create_token(temp_db, "bob")
+    rc = _run(["list"], env={"USERS_DB_PATH": str(temp_db)})
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert "alice" in out
+    assert "bob" in out
+
+
+def test_revoke_sets_revoked_at(temp_db, capsys):
+    _, token_id = tokens_db.create_token(temp_db, "alice")
+    rc = _run(["revoke", str(token_id)], env={"USERS_DB_PATH": str(temp_db)})
+    assert rc == 0
+    tokens = tokens_db.list_tokens(temp_db)
+    assert tokens[0]["revoked_at"] is not None

tests/api/test_tokens_db.py

@@ -0,0 +1,64 @@
+import sqlite3
+
+from src.api import tokens_db
+
+
+def test_init_schema_creates_table(temp_db):
+    with sqlite3.connect(str(temp_db)) as conn:
+        rows = conn.execute(
+            "SELECT name FROM sqlite_master WHERE type='table' AND name='api_tokens'"
+        ).fetchall()
+    assert rows == [("api_tokens",)]
+
+
+def test_create_token_returns_plaintext_and_stores_hash(temp_db):
+    token, token_id = tokens_db.create_token(temp_db, "test-label")
+    assert token.startswith("decpinfo_")
+    assert len(token) == len("decpinfo_") + 64  # 32 octets hex = 64 chars
+    assert token_id >= 1
+
+    with sqlite3.connect(str(temp_db)) as conn:
+        row = conn.execute(
+            "SELECT token_hash, label, count_total FROM api_tokens WHERE id = ?",
+            (token_id,),
+        ).fetchone()
+    assert row[1] == "test-label"
+    assert row[2] == 0
+    assert row[0] != token  # stocké en clair impossible
+    assert len(row[0]) == 64  # sha256 hex
+
+
+def test_get_token_by_plaintext_returns_row(temp_db):
+    token, token_id = tokens_db.create_token(temp_db, "x")
+    row = tokens_db.get_token_by_plaintext(temp_db, token)
+    assert row is not None
+    assert row["id"] == token_id
+    assert row["label"] == "x"
+    assert row["revoked_at"] is None
+
+
+def test_get_token_unknown_returns_none(temp_db):
+    assert tokens_db.get_token_by_plaintext(temp_db, "decpinfo_zzz") is None
+
+
+def test_revoke_token_sets_revoked_at(temp_db):
+    token, token_id = tokens_db.create_token(temp_db, "x")
+    tokens_db.revoke_token(temp_db, token_id)
+    row = tokens_db.get_token_by_plaintext(temp_db, token)
+    assert row["revoked_at"] is not None
+
+
+def test_increment_usage_updates_counter_and_timestamp(temp_db):
+    token, token_id = tokens_db.create_token(temp_db, "x")
+    tokens_db.increment_usage(temp_db, token_id)
+    tokens_db.increment_usage(temp_db, token_id)
+    row = tokens_db.get_token_by_plaintext(temp_db, token)
+    assert row["count_total"] == 2
+    assert row["last_used_at"] is not None
+
+
+def test_list_tokens_returns_all(temp_db):
+    tokens_db.create_token(temp_db, "a")
+    tokens_db.create_token(temp_db, "b")
+    rows = tokens_db.list_tokens(temp_db)
+    assert [r["label"] for r in rows] == ["a", "b"]

tests/api/test_tracking.py

@@ -0,0 +1,80 @@
+from src.api import tokens_db, tracking
+
+
+def test_counter_worker_increments_count(temp_db):
+    _, token_id = tokens_db.create_token(temp_db, "x")
+
+    tracking.stop_worker()  # reset any worker left by earlier tests
+    tracking.start_worker(str(temp_db))
+    try:
+        tracking.enqueue_counter_update(token_id)
+        tracking.enqueue_counter_update(token_id)
+        # Laisser le worker drainer la queue
+        tracking.flush(timeout=2.0)
+    finally:
+        tracking.stop_worker()
+
+    rows = tokens_db.list_tokens(temp_db)
+    assert rows[0]["count_total"] == 2
+    assert rows[0]["last_used_at"] is not None
+
+
+def test_after_request_hook_increments_counter_async(api_client, valid_token_header):
+    client, db_path = api_client
+    # Récupérer le token_id du token créé par la fixture
+    from src.api import tokens_db, tracking
+
+    rows = tokens_db.list_tokens(db_path)
+    assert len(rows) == 1  # vérification du token créé par la fixture
+
+    # Faire une requête (qui doit déclencher l'incrément)
+    client.get("/api/v1/health")  # pas authentifiée → ne compte pas
+    client.get("/api/v1/schema", headers=valid_token_header)
+
+    tracking.flush(timeout=2.0)
+
+    rows = tokens_db.list_tokens(db_path)
+    assert rows[0]["count_total"] == 1
+
+
+def test_matomo_disabled_skips_call(monkeypatch, api_client, valid_token_header):
+    monkeypatch.setenv("MATOMO_TRACKING_ENABLED", "false")
+    client, _ = api_client
+
+    from src.api import tracking
+
+    called = []
+    monkeypatch.setattr(
+        tracking,
+        "_post_matomo",
+        lambda **kw: called.append(kw),
+    )
+    client.get("/api/v1/health")
+    tracking.flush(timeout=2.0)
+    assert called == []
+
+
+def test_matomo_enabled_posts_event(monkeypatch, api_client, valid_token_header):
+    monkeypatch.setenv("MATOMO_TRACKING_ENABLED", "true")
+    monkeypatch.setenv("MATOMO_URL", "https://matomo.example/matomo.php")
+    monkeypatch.setenv("MATOMO_SITE_ID", "42")
+
+    from src.api import tracking
+
+    captured = []
+    monkeypatch.setattr(
+        tracking,
+        "_post_matomo",
+        lambda **kw: captured.append(kw),
+    )
+
+    client, _ = api_client
+    client.get("/api/v1/schema", headers=valid_token_header)
+    tracking.flush(timeout=2.0)
+
+    assert len(captured) == 1
+    call = captured[0]
+    assert call["params"]["idsite"] == "42"
+    assert call["params"]["rec"] == "1"
+    assert "token-" in call["params"]["uid"]
+    assert call["params"]["dimension2"] == "200"

tests/conftest.py

@@ -42,6 +42,12 @@ _TEST_DATA = [
 _PARQUET_PATH = Path(os.path.abspath("tests/test.parquet"))
 _DB_PATH = Path(os.path.abspath("decp.duckdb"))
 
+# Schéma déterministe et hors-ligne pour les tests : on pointe le cache sur un
+# fixture commité et on désactive la récupération distante.
+_SCHEMA_FIXTURE = Path(os.path.abspath("tests/schema.fixture.json"))
+os.environ["DATA_SCHEMA_CACHE"] = str(_SCHEMA_FIXTURE)
+os.environ.pop("DATA_SCHEMA_PATH", None)
+
 
 def _cleanup_db_artifacts() -> None:
     for artifact in (

tests/schema.fixture.json

@@ -0,0 +1,468 @@
+{
+  "fields": [
+    {
+      "name": "acheteur_categorie",
+      "type": "string",
+      "title": "Catégorie de l'acheteur",
+      "description": "Catégorie de l'acheteur selon son code juridique INSEE.",
+      "short_title": "Catégorie acheteur",
+      "enum": [
+        "Commune",
+        "Groupement de communes",
+        "Département",
+        "Département outre-mer",
+        "Région",
+        "État",
+        "Établissement hospitalier",
+        "EPIC",
+        "Syndicat mixte"
+      ]
+    },
+    {
+      "name": "acheteur_commune_code",
+      "type": "string",
+      "title": "Commune de l'acheteur (code)",
+      "description": "Code de la commune où se trouve l'acheteur.",
+      "short_title": "Commune ach. (code)"
+    },
+    {
+      "name": "acheteur_commune_nom",
+      "type": "string",
+      "title": "Commune de l'acheteur",
+      "description": "Nom de la commune où se trouve l'acheteur.",
+      "short_title": "Commune acheteur"
+    },
+    {
+      "name": "acheteur_departement_code",
+      "type": "string",
+      "title": "Département de l'acheteur (code)",
+      "description": "Code du département où se trouve l'acheteur.",
+      "short_title": "Département ach. (code)"
+    },
+    {
+      "name": "acheteur_departement_nom",
+      "type": "string",
+      "title": "Département de l'acheteur",
+      "description": "Nom du département où se trouve l'acheteur.",
+      "short_title": "Département acheteur"
+    },
+    {
+      "name": "acheteur_id",
+      "type": "integer",
+      "title": "SIRET acheteur",
+      "description": "Identifiant de l'établissement de l'acheteur (SIRET), référencé dans la base SIRENE de l'INSEE.",
+      "short_title": null
+    },
+    {
+      "name": "acheteur_latitude",
+      "type": "number",
+      "title": "Latitude de l'acheteur",
+      "description": "Latitude des coordonnées géographiques de l'acheteur.",
+      "short_title": "Latitude acheteur"
+    },
+    {
+      "name": "acheteur_longitude",
+      "type": "number",
+      "title": "Longitude de l'acheteur",
+      "description": "Longitude des coordonnées géographiques de l'acheteur.",
+      "short_title": "Longitude acheteur"
+    },
+    {
+      "name": "acheteur_nom",
+      "type": "string",
+      "title": "Nom acheteur",
+      "description": "Nom de l'acheteur tel que renseigné dans la base SIRENE de l'INSEE.",
+      "short_title": "Acheteur"
+    },
+    {
+      "name": "acheteur_region_code",
+      "type": "string",
+      "title": "Région de l'acheteur (code)",
+      "description": "Code de la région où se trouve l'acheteur.",
+      "short_title": "Région ach. (code)"
+    },
+    {
+      "name": "acheteur_region_nom",
+      "type": "string",
+      "title": "Région de l'acheteur",
+      "description": "Nom de la région où se trouve l'acheteur.",
+      "short_title": "Région acheteur"
+    },
+    {
+      "name": "attributionAvance",
+      "type": "boolean",
+      "title": "Attribution avance",
+      "description": "Si une avance sur le montant du marché public a été attribuée aux titulaires.",
+      "short_title": null
+    },
+    {
+      "name": "ccag",
+      "type": "string",
+      "title": "CCAG",
+      "description": "Cahier des clauses administratives générales et techniques (CCAG) utilisé pour le marché public.",
+      "short_title": null,
+      "enum": [
+        "Travaux",
+        "Maitrise d'œuvre",
+        "Fournitures courantes et services",
+        "Marchés industriels",
+        "Prestations intellectuelles",
+        "Techniques de l'information et de la communication"
+      ]
+    },
+    {
+      "name": "codeCPV",
+      "type": "string",
+      "title": "Code CPV",
+      "description": "Catégorie de bien, service ou travaux achetés, selon le Vocabulaire commun pour les marchés publics (CPV).",
+      "short_title": "CPV"
+    },
+    {
+      "name": "considerationsEnvironnementales",
+      "type": "string",
+      "title": "Considérations environnementales",
+      "description": "Les considérations environnementales prévues dans le marché public.",
+      "short_title": "Cons. environnementales",
+      "enum": ["Clause environnementale", "Critère environnemental"]
+    },
+    {
+      "name": "considerationsSociales",
+      "type": "string",
+      "title": "Considérations sociales",
+      "description": "Les considérations sociales prévues dans le marché public.",
+      "short_title": "Cons. sociales",
+      "enum": ["Clause sociale", "Critère social", "Marché réservé"]
+    },
+    {
+      "name": "dateNotification",
+      "type": "date",
+      "title": "Date notification",
+      "description": "Date à laquelle le marché public ou de la modification a été notifiée aux titulaires du marché public.",
+      "short_title": null,
+      "format": "default"
+    },
+    {
+      "name": "datePublicationDonnees",
+      "type": "date",
+      "title": "Date publication données",
+      "description": "Date à laquelle les données du marché public ou de la modification ont été publiées sur data.gouv.fr.",
+      "short_title": "Date pub. données",
+      "format": "default"
+    },
+    {
+      "name": "donneesActuelles",
+      "type": "boolean",
+      "title": "Données actuelles",
+      "description": "Si les données de cette ligne sont les données actuelles du marché public, une fois les éventuelles modifications prises en compte.",
+      "short_title": null
+    },
+    {
+      "name": "dureeMois",
+      "type": "integer",
+      "title": "Durée (mois)",
+      "description": "Durée en mois du marché attribué.",
+      "short_title": null
+    },
+    {
+      "name": "dureeRestanteMois",
+      "type": "number",
+      "title": "Durée restante (mois)",
+      "description": "Durée approximative en mois restante dans le marché, en tenant compte de la date de notification et de la durée du marché. Ce nombre ne peut être inférieur à 0.",
+      "short_title": null
+    },
+    {
+      "name": "formePrix",
+      "type": "string",
+      "title": "Forme prix",
+      "description": "La forme du prix du marché public. Unitaire, Forfaitaire ou Mixte.",
+      "short_title": null
+    },
+    {
+      "name": "id",
+      "type": "string",
+      "title": "Identifiant interne",
+      "description": "Identifiant attribué par l'acheteur, censé être unique au sein de ses marchés.",
+      "short_title": "Id. interne"
+    },
+    {
+      "name": "idAccordCadre",
+      "type": "string",
+      "title": "Identifiant accord-cadre",
+      "description": "Pour un marché subséquent, l'identifiant interne du marché public relevant de la technique d'achat accord-cadre auquel il est lié.",
+      "short_title": "Id. accord-cadre"
+    },
+    {
+      "name": "lieuExecution_code",
+      "type": "integer",
+      "title": "Code lieu exécution",
+      "description": "Code du lieu d'exécution du marché public. Le type de code est renseigné par 'Type code lieu exécution'.",
+      "short_title": "Lieu exécution"
+    },
+    {
+      "name": "lieuExecution_typeCode",
+      "type": "string",
+      "title": "Type code lieu exécution",
+      "description": "Type du code du lieu d'exécution.",
+      "short_title": "Type lieu exécution",
+      "enum": [
+        "Code postal",
+        "Code commune",
+        "Code arrondissement",
+        " Code canton",
+        "Code département",
+        "Code région",
+        "Code pays"
+      ]
+    },
+    {
+      "name": "marcheInnovant",
+      "type": "boolean",
+      "title": "Marché innovant",
+      "description": "Si le marché comporte des travaux, services ou fournitures innovantes.",
+      "short_title": null
+    },
+    {
+      "name": "modalitesExecution",
+      "type": "string",
+      "title": "Modalités exécution",
+      "description": "Les modalités d'exécution du marché public.",
+      "short_title": null,
+      "enum": ["Tranches", "Bons de commande", "Marchés subséquents"]
+    },
+    {
+      "name": "modification_id",
+      "type": "integer",
+      "title": "Identifiant modification",
+      "description": "Identifiant de la modification. 0 = données initiales du marché public, 1 = première modification, etc.",
+      "short_title": "Id. modification"
+    },
+    {
+      "name": "montant",
+      "type": "number",
+      "title": "Montant attribué",
+      "description": "Montant forfaitaire ou montant maximum estimé hors-taxes, en euros. Ce montant est le montant attribué. Le montant final payé aux titulaires peut évoluer lors de la signature du contrat et de l'exécution du marché.",
+      "short_title": "Montant"
+    },
+    {
+      "name": "nature",
+      "type": "string",
+      "title": "Nature",
+      "description": "Marché, Marché de partenariat ou Marché de sécurité.",
+      "short_title": null
+    },
+    {
+      "name": "objet",
+      "type": "string",
+      "title": "Objet",
+      "description": "Objet du marché public. Potentiellement coupé à 256 ou 1 000 caractères par le producteur de données.",
+      "short_title": null
+    },
+    {
+      "name": "offresRecues",
+      "type": "integer",
+      "title": "Offres reçues",
+      "description": "Le nombre d'offres reçues pendant la phase d'appel d'offres. Comprend aussi les offres irrégulières, inacceptables, inappropriées et anormalement basses.",
+      "short_title": null
+    },
+    {
+      "name": "origineFrance",
+      "type": "number",
+      "title": "Origine France",
+      "description": "Pour les marchés de fournitures de denrées alimentaires, de véhicules, de produits de santé et d'habillement, selon la liste annexée à l'arrêté du 22 décembre 2022, la part des produits français avec laquelle le marché sera exécuté. 0.2 = 20 % de la part des produits sont français. Cette valeur ne peut pas être supérieure à la valeur de origineUE.",
+      "short_title": null
+    },
+    {
+      "name": "origineUE",
+      "type": "number",
+      "title": "Origine UE",
+      "description": "Pour les marchés de fournitures de denrées alimentaires, de véhicules, de produits de santé et d'habillement, selon la liste annexée à l'arrêté du 22 décembre 2022, la part des produits issus de l'Union européenne avec laquelle le marché sera exécuté. 0.2 = 20 % de la part des produits provient de l'Union européenne. Cette valeur ne peut pas être inférieure à la valeur de origineFrance.",
+      "short_title": null
+    },
+    {
+      "name": "procedure",
+      "type": "string",
+      "title": "Procédure",
+      "description": "Le type de procédure utilisé pour le marché public.",
+      "short_title": null,
+      "enum": [
+        "Procédure négociée ouverte",
+        "Procédure non négociée ouverte",
+        "Procédure négociée restreinte",
+        "Procédure non négociée restreinte"
+      ]
+    },
+    {
+      "name": "sourceDataset",
+      "type": "string",
+      "title": "Source dataset",
+      "description": "Code du jeu de données dont proviennent les données de ce marché public.",
+      "short_title": null
+    },
+    {
+      "name": "sourceFile",
+      "type": "string",
+      "title": "Source fichier",
+      "description": "Lien vers le fichier de données ouvertes dont proviennent les données de ce marché public.",
+      "short_title": null,
+      "format": "uri"
+    },
+    {
+      "name": "sousTraitanceDeclaree",
+      "type": "boolean",
+      "title": "Sous-traitance déclarée",
+      "description": "Au moment de la notification du marché, les titulaires du marché ont déclaré s'appuyer sur un ou plusieurs sous-traitants pour ce marché public.",
+      "short_title": "Sous-traitance"
+    },
+    {
+      "name": "tauxAvance",
+      "type": "number",
+      "title": "Taux avance",
+      "description": "Taux de l'avance attribuée au titulaire principal du marché public par rapport au montant du marché (O.1 = 10 % du montant du marché). En fonction de la valeur de attributionAvance, une valeur égale à 0 signifie qu'il y a une avance mais que le taux n'est pas connu (attributionAvance=true).",
+      "short_title": null
+    },
+    {
+      "name": "techniques",
+      "type": "string",
+      "title": "Techniques",
+      "description": "Les techniques d'achat utilisées pour le marché public.",
+      "short_title": null,
+      "enum": [
+        "Accord-cadre",
+        "Concours",
+        "Système de qualification",
+        "Système d'acquisition dynamique",
+        "Catalogue électronique",
+        "Enchère électronique"
+      ]
+    },
+    {
+      "name": "titulaire_categorie",
+      "type": "string",
+      "title": "Catégorie du titulaire",
+      "description": "Catégorie de l'entreprise titulaire selon la classification de l'INSEE.",
+      "short_title": "Catégorie titulaire",
+      "enum": ["PME", "ETI", "GE"]
+    },
+    {
+      "name": "titulaire_commune_code",
+      "type": "string",
+      "title": "Commune du titulaire (code)",
+      "description": "Code de la commune où se trouve le titulaire.",
+      "short_title": "Commune tit. (code)"
+    },
+    {
+      "name": "titulaire_commune_nom",
+      "type": "string",
+      "title": "Commune du titulaire",
+      "description": "Nom de la commune où se trouve le titulaire.",
+      "short_title": "Commune titulaire"
+    },
+    {
+      "name": "titulaire_departement_code",
+      "type": "string",
+      "title": "Département du titulaire (code)",
+      "description": "Code du département où se trouve le titulaire.",
+      "short_title": "Département tit. (code)"
+    },
+    {
+      "name": "titulaire_departement_nom",
+      "type": "string",
+      "title": "Département du titulaire",
+      "description": "Nom du département où se trouve le titulaire.",
+      "short_title": "Département titulaire"
+    },
+    {
+      "name": "titulaire_distance",
+      "type": "integer",
+      "title": "Distance acheteur-titulaire",
+      "description": "Distance en kilomètres entre l'adresse de l'acheteur et celle du titulaire.",
+      "short_title": "Distance"
+    },
+    {
+      "name": "titulaire_id",
+      "type": "integer",
+      "title": "Identifiant titulaire",
+      "description": "Identifiant du titulaire du marché. Voir 'Type identifiant' pour le référentiel utilisé",
+      "short_title": "Id. titulaire"
+    },
+    {
+      "name": "titulaire_latitude",
+      "type": "number",
+      "title": "Latitude du titulaire",
+      "description": "Latitude des coordonnées géographiques du titulaire.",
+      "short_title": "Latitude titulaire"
+    },
+    {
+      "name": "titulaire_longitude",
+      "type": "number",
+      "title": "Longitude du titulaire",
+      "description": "Longitude des coordonnées géographiques du titulaire.",
+      "short_title": "Longitude titulaire"
+    },
+    {
+      "name": "titulaire_nom",
+      "type": "string",
+      "title": "Nom titulaire",
+      "description": "Nom du titulaire. Nom tel que renseigné dans la base SIRENE de l'INSEE si c'est un SIRET.",
+      "short_title": "Titulaire"
+    },
+    {
+      "name": "titulaire_region_code",
+      "type": "string",
+      "title": "Région du titulaire (code)",
+      "description": "Code de la région où se trouve le titulaire.",
+      "short_title": "Région tit. (code)"
+    },
+    {
+      "name": "titulaire_region_nom",
+      "type": "string",
+      "title": "Région du titulaire",
+      "description": "Nom de la région où se trouve le titulaire.",
+      "short_title": "Région titulaire"
+    },
+    {
+      "name": "titulaire_typeIdentifiant",
+      "type": "string",
+      "title": "Type identifiant",
+      "description": "Référentiel utilisé pour l'identifiant du titulaire.",
+      "short_title": "Type id.",
+      "enum": ["SIRET", "TVA", "TAHITI", "RIDET", "FRWF", "IREP", "HORS-UE"]
+    },
+    {
+      "name": "type",
+      "type": "string",
+      "title": "Type",
+      "description": "Type de marché public : fournitures, services ou travaux (dérivé du code CPV).",
+      "short_title": "Type",
+      "enum": ["Fournitures", "Services", "Travaux"]
+    },
+    {
+      "name": "typeGroupementOperateurs",
+      "type": "string",
+      "title": "Type groupement",
+      "description": "Le type de groupement d'entreprises ou d'opérateurs économiques.",
+      "short_title": "Groupement",
+      "enum": ["Conjoint", "Solidaire"]
+    },
+    {
+      "name": "typesPrix",
+      "type": "string",
+      "title": "Types prix",
+      "description": "Les types de prix du marché public.",
+      "short_title": null,
+      "enum": [
+        "Définitif ferme",
+        "Définitif actualisable",
+        "Définitif révisable",
+        "Provisoire"
+      ]
+    },
+    {
+      "name": "uid",
+      "type": "string",
+      "title": "Identifiant unique",
+      "description": "Concaténation du SIRET de l'acheteur (acheteur_id) et de l'identifiant interne de l'acheteur (id). Utilisé comme identifiant de marché unique au niveau national.",
+      "short_title": "Id. unique"
+    }
+  ]
+}

tests/test_db.py

@@ -31,6 +31,7 @@ def test_should_rebuild_prod_when_parquet_newer(parquet_and_db, monkeypatch):
     os.utime(db, (now, now))
     os.utime(parquet, (now + 10, now + 10))
     monkeypatch.setenv("DEVELOPMENT", "false")
+    monkeypatch.setattr("src.db.get_last_modified", lambda p: parquet.stat().st_mtime)
     assert should_rebuild(db, parquet) is True
 
 
@@ -42,6 +43,7 @@ def test_should_not_rebuild_prod_when_parquet_older(parquet_and_db, monkeypatch)
     os.utime(parquet, (now, now))
     os.utime(db, (now + 10, now + 10))
     monkeypatch.setenv("DEVELOPMENT", "false")
+    monkeypatch.setattr("src.db.get_last_modified", lambda p: parquet.stat().st_mtime)
     assert should_rebuild(db, parquet) is False
 
 
@@ -66,6 +68,7 @@ def test_should_rebuild_dev_when_rebuild_forced(parquet_and_db, monkeypatch):
     os.utime(parquet, (now + 10, now + 10))
     monkeypatch.setenv("DEVELOPMENT", "true")
     monkeypatch.setenv("REBUILD_DUCKDB", "true")
+    monkeypatch.setattr("src.db.get_last_modified", lambda p: parquet.stat().st_mtime)
     assert should_rebuild(db, parquet) is True
 
 
@@ -145,7 +148,7 @@ def built_db(tmp_path, monkeypatch):
 
     from src.db import build_database
 
-    build_database(db_path, parquet_path)
+    build_database(db_path)
     return db_path
 
 
@@ -190,8 +193,15 @@ def test_build_creates_derived_tables(built_db):
 
 
 def test_query_marches_returns_polars_frame(built_db, monkeypatch):
-    monkeypatch.setenv(
+    parquet_path = built_db.parent / "source.parquet"
-        "DATA_FILE_PARQUET_PATH", str(built_db.parent / "source.parquet")
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", str(parquet_path))
+    # Patch on both the source module and dst namespace: the reload re-imports
+    # get_last_modified from src.utils, so src.utils must be patched to survive.
+    monkeypatch.setattr(
+        "src.utils.get_last_modified", lambda p: parquet_path.stat().st_mtime
+    )
+    monkeypatch.setattr(
+        "src.db.get_last_modified", lambda p: parquet_path.stat().st_mtime
     )
     # Force src.db to load pointing at this test DB.
     import importlib
@@ -239,7 +249,7 @@ def test_query_marches_with_offset():
         assert set(page_0["uid"].to_list()).isdisjoint(set(page_1["uid"].to_list()))
 
 
-def test_concurrent_build_serialized(tmp_path):
+def test_concurrent_build_serialized(tmp_path, monkeypatch):
     """Multiple threads calling _ensure_database must serialize via flock.
 
     Only one should actually build; others wait, see the fresh DB, and skip.
@@ -269,6 +279,10 @@ def test_concurrent_build_serialized(tmp_path):
         }
     )
     df.write_parquet(parquet_path)
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", str(parquet_path))
+    monkeypatch.setattr(
+        "src.db.get_last_modified", lambda p: parquet_path.stat().st_mtime
+    )
 
     db_path = tmp_path / "decp.duckdb"
     lock_path = db_path.with_suffix(".duckdb.lock")
@@ -283,7 +297,7 @@ def test_concurrent_build_serialized(tmp_path):
                 fcntl.flock(lf.fileno(), fcntl.LOCK_EX)
                 try:
                     if db.should_rebuild(db_path, parquet_path):
-                        db.build_database(db_path, parquet_path)
+                        db.build_database(db_path)
                 finally:
                     fcntl.flock(lf.fileno(), fcntl.LOCK_UN)
         except BaseException as exc:
@@ -298,3 +312,60 @@ def test_concurrent_build_serialized(tmp_path):
     assert errors == []
     assert db_path.exists()
     assert not tmp_path_artifact.exists()
+
+
+def _raise(*args, **kwargs):
+    raise RuntimeError("boom")
+
+
+def test_ensure_database_reuses_db_when_should_rebuild_raises(tmp_path, monkeypatch):
+    import src.db as db
+
+    dbf = tmp_path / "decp.duckdb"
+    dbf.write_bytes(b"existing")
+    monkeypatch.setenv("DUCKDB_PATH", str(dbf))
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", "http://unreachable")
+    monkeypatch.setattr(db, "should_rebuild", _raise)
+    result = db._ensure_database()  # ne doit pas lever
+    assert result == dbf
+    assert dbf.read_bytes() == b"existing"
+
+
+def test_ensure_database_reuses_db_when_build_raises(tmp_path, monkeypatch):
+    import src.db as db
+
+    dbf = tmp_path / "decp.duckdb"
+    dbf.write_bytes(b"existing")
+    monkeypatch.setenv("DUCKDB_PATH", str(dbf))
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", "http://unreachable")
+    monkeypatch.setattr(db, "should_rebuild", lambda *a, **k: True)
+    monkeypatch.setattr(db, "build_database", _raise)
+    result = db._ensure_database()  # ne doit pas lever
+    assert result == dbf
+    assert dbf.read_bytes() == b"existing"
+
+
+def test_ensure_database_raises_on_cold_start(tmp_path, monkeypatch):
+    import src.db as db
+
+    dbf = tmp_path / "decp.duckdb"  # n'existe pas
+    monkeypatch.setenv("DUCKDB_PATH", str(dbf))
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", "http://unreachable")
+    monkeypatch.setattr(db, "should_rebuild", lambda *a, **k: True)
+    monkeypatch.setattr(db, "build_database", _raise)
+    with pytest.raises(RuntimeError):
+        db._ensure_database()
+
+
+def test_ensure_database_builds_when_needed(tmp_path, monkeypatch):
+    import src.db as db
+
+    dbf = tmp_path / "decp.duckdb"
+    dbf.write_bytes(b"old")
+    monkeypatch.setenv("DUCKDB_PATH", str(dbf))
+    monkeypatch.setenv("DATA_FILE_PARQUET_PATH", "http://x")
+    called = {}
+    monkeypatch.setattr(db, "should_rebuild", lambda *a, **k: True)
+    monkeypatch.setattr(db, "build_database", lambda p: called.setdefault("built", p))
+    db._ensure_database()
+    assert called.get("built") == dbf

tests/test_page_loads.py

@@ -0,0 +1,61 @@
+import os
+
+
+def test_update_timestamp_falls_back_to_db_mtime(tmp_path, monkeypatch):
+    import src.utils as u
+    from src.utils import get_data_update_timestamp
+
+    def boom(*a, **k):
+        raise RuntimeError("net down")
+
+    monkeypatch.setattr(u, "get_last_modified", boom)
+    fb = tmp_path / "decp.duckdb"
+    fb.write_bytes(b"x")
+    assert get_data_update_timestamp("http://x", str(fb)) == os.path.getmtime(str(fb))
+
+
+def test_update_timestamp_none_when_all_fail(monkeypatch):
+    import src.utils as u
+    from src.utils import get_data_update_timestamp
+
+    def boom(*a, **k):
+        raise RuntimeError("net down")
+
+    monkeypatch.setattr(u, "get_last_modified", boom)
+    assert get_data_update_timestamp("http://x", None) is None
+
+
+def test_update_timestamp_nominal(monkeypatch):
+    import src.utils as u
+    from src.utils import get_data_update_timestamp
+
+    monkeypatch.setattr(u, "get_last_modified", lambda p: 123.0)
+    assert get_data_update_timestamp("http://x", None) == 123.0
+
+
+def test_sources_tables_none_path():
+    from src.figures import get_sources_tables
+
+    div = get_sources_tables(None)
+    assert "indisponible" in str(div.children).lower()
+
+
+def test_sources_tables_missing_file():
+    from src.figures import get_sources_tables
+
+    div = get_sources_tables("/does/not/exist.csv")
+    assert "indisponible" in str(div.children).lower()
+
+
+def test_sources_tables_valid_csv(tmp_path):
+    from dash import dash_table
+
+    from src.figures import get_sources_tables
+
+    csv = tmp_path / "s.csv"
+    csv.write_text(
+        "nom,organisation,nb_marchés,nb_acheteurs,code,url,unique\n"
+        "Source A,Org A,5,2,XA,http://a,1\n"
+    )
+    div = get_sources_tables(str(csv))
+    assert isinstance(div.children, dash_table.DataTable)

tests/test_schema.py

@@ -0,0 +1,77 @@
+import json
+
+import httpx
+import pytest
+
+from src.utils import data as data_mod
+
+VALID = {"fields": [{"name": "uid", "title": "UID"}, {"name": "objet"}]}
+
+
+class FakeResp:
+    def __init__(self, payload, ok=True, bad_json=False):
+        self._payload = payload
+        self._ok = ok
+        self._bad_json = bad_json
+
+    def raise_for_status(self):
+        if not self._ok:
+            raise httpx.HTTPError("boom")
+        return self
+
+    def json(self):
+        if self._bad_json:
+            raise json.JSONDecodeError("bad", "", 0)
+        return self._payload
+
+
+def test_remote_ok_returns_schema_and_writes_cache(tmp_path, monkeypatch):
+    cache = tmp_path / "schema.cache.json"
+    monkeypatch.setenv("DATA_SCHEMA_PATH", "http://x")
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    monkeypatch.setattr(data_mod, "get", lambda *a, **k: FakeResp(VALID))
+    result = data_mod.get_data_schema()
+    assert "uid" in result
+    assert json.loads(cache.read_text())["fields"][0]["name"] == "uid"
+
+
+def test_remote_http_error_falls_back_to_cache(tmp_path, monkeypatch):
+    cache = tmp_path / "schema.cache.json"
+    cache.write_text(json.dumps(VALID))
+    monkeypatch.setenv("DATA_SCHEMA_PATH", "http://x")
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    monkeypatch.setattr(data_mod, "get", lambda *a, **k: FakeResp(None, ok=False))
+    assert "uid" in data_mod.get_data_schema()
+
+
+def test_remote_malformed_falls_back_to_cache(tmp_path, monkeypatch):
+    cache = tmp_path / "schema.cache.json"
+    cache.write_text(json.dumps(VALID))
+    monkeypatch.setenv("DATA_SCHEMA_PATH", "http://x")
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    monkeypatch.setattr(data_mod, "get", lambda *a, **k: FakeResp({"nope": 1}))
+    assert "uid" in data_mod.get_data_schema()
+
+
+def test_no_url_uses_cache(tmp_path, monkeypatch):
+    cache = tmp_path / "schema.cache.json"
+    cache.write_text(json.dumps(VALID))
+    monkeypatch.delenv("DATA_SCHEMA_PATH", raising=False)
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    assert "uid" in data_mod.get_data_schema()
+
+
+def test_no_source_raises(tmp_path, monkeypatch):
+    monkeypatch.delenv("DATA_SCHEMA_PATH", raising=False)
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(tmp_path / "missing.json"))
+    with pytest.raises(RuntimeError):
+        data_mod.get_data_schema()
+
+
+def test_cache_write_failure_is_non_blocking(tmp_path, monkeypatch):
+    # parent inexistant => l'écriture du cache échoue, mais le schéma est renvoyé
+    cache = tmp_path / "nodir" / "schema.cache.json"
+    monkeypatch.setenv("DATA_SCHEMA_PATH", "http://x")
+    monkeypatch.setenv("DATA_SCHEMA_CACHE", str(cache))
+    monkeypatch.setattr(data_mod, "get", lambda *a, **k: FakeResp(VALID))
+    assert "uid" in data_mod.get_data_schema()

uv.lock

@@ -37,6 +37,23 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/da/42/e921fccf5015463e32a3cf6ee7f980a6ed0f395ceeaa45060b61d86486c2/anyio-4.13.0-py3-none-any.whl", hash = "sha256:08b310f9e24a9594186fd75b4f73f4a4152069e3853f1ed8bfbf58369f4ad708", size = 114353, upload-time = "2026-03-24T12:59:08.246Z" },
 ]
 
+[[package]]
+name = "apispec"
+version = "6.10.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "packaging" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/4a/f1/1f5a9332df3ecd90cc5ab69bc58a4174b8ba2ac1720c4c26b01d20751bf5/apispec-6.10.0.tar.gz", hash = "sha256:0a888555cd4aa5fb7176041be15684154fd8961055e1672e703abf737e8761bf", size = 80631, upload-time = "2026-03-06T21:48:40.916Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/20/88/e149b20246c4689e7d27163e4e3bb8946ef31617cfb3b9c427813483fe5b/apispec-6.10.0-py3-none-any.whl", hash = "sha256:8ff23e0de9a0ceb62ff70047241126315bd17b8d0565a567934c0156f4ddbb43", size = 31313, upload-time = "2026-03-06T21:48:39.404Z" },
+]
+
+[package.optional-dependencies]
+marshmallow = [
+    { name = "marshmallow" },
+]
+
 [[package]]
 name = "attrs"
 version = "26.1.0"
@@ -46,6 +63,40 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/64/b4/17d4b0b2a2dc85a6df63d1157e028ed19f90d4cd97c36717afef2bc2f395/attrs-26.1.0-py3-none-any.whl", hash = "sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309", size = 67548, upload-time = "2026-03-19T14:22:23.645Z" },
 ]
 
+[[package]]
+name = "backports-datetime-fromisoformat"
+version = "2.0.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/71/81/eff3184acb1d9dc3ce95a98b6f3c81a49b4be296e664db8e1c2eeabef3d9/backports_datetime_fromisoformat-2.0.3.tar.gz", hash = "sha256:b58edc8f517b66b397abc250ecc737969486703a66eb97e01e6d51291b1a139d", size = 23588, upload-time = "2024-12-28T20:18:15.017Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/42/4b/d6b051ca4b3d76f23c2c436a9669f3be616b8cf6461a7e8061c7c4269642/backports_datetime_fromisoformat-2.0.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:5f681f638f10588fa3c101ee9ae2b63d3734713202ddfcfb6ec6cea0778a29d4", size = 27561, upload-time = "2024-12-28T20:16:47.974Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/40/e39b0d471e55eb1b5c7c81edab605c02f71c786d59fb875f0a6f23318747/backports_datetime_fromisoformat-2.0.3-cp310-cp310-macosx_11_0_universal2.whl", hash = "sha256:cd681460e9142f1249408e5aee6d178c6d89b49e06d44913c8fdfb6defda8d1c", size = 34448, upload-time = "2024-12-28T20:16:50.712Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/28/7a5c87c5561d14f1c9af979231fdf85d8f9fad7a95ff94e56d2205e2520a/backports_datetime_fromisoformat-2.0.3-cp310-cp310-macosx_11_0_x86_64.whl", hash = "sha256:ee68bc8735ae5058695b76d3bb2aee1d137c052a11c8303f1e966aa23b72b65b", size = 27093, upload-time = "2024-12-28T20:16:52.994Z" },
+    { url = "https://files.pythonhosted.org/packages/80/ba/f00296c5c4536967c7d1136107fdb91c48404fe769a4a6fd5ab045629af8/backports_datetime_fromisoformat-2.0.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8273fe7932db65d952a43e238318966eab9e49e8dd546550a41df12175cc2be4", size = 52836, upload-time = "2024-12-28T20:16:55.283Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/92/bb1da57a069ddd601aee352a87262c7ae93467e66721d5762f59df5021a6/backports_datetime_fromisoformat-2.0.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:39d57ea50aa5a524bb239688adc1d1d824c31b6094ebd39aa164d6cadb85de22", size = 52798, upload-time = "2024-12-28T20:16:56.64Z" },
+    { url = "https://files.pythonhosted.org/packages/df/ef/b6cfd355982e817ccdb8d8d109f720cab6e06f900784b034b30efa8fa832/backports_datetime_fromisoformat-2.0.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:ac6272f87693e78209dc72e84cf9ab58052027733cd0721c55356d3c881791cf", size = 52891, upload-time = "2024-12-28T20:16:58.887Z" },
+    { url = "https://files.pythonhosted.org/packages/37/39/b13e3ae8a7c5d88b68a6e9248ffe7066534b0cfe504bf521963e61b6282d/backports_datetime_fromisoformat-2.0.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:44c497a71f80cd2bcfc26faae8857cf8e79388e3d5fbf79d2354b8c360547d58", size = 52955, upload-time = "2024-12-28T20:17:00.028Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/e4/70cffa3ce1eb4f2ff0c0d6f5d56285aacead6bd3879b27a2ba57ab261172/backports_datetime_fromisoformat-2.0.3-cp310-cp310-win_amd64.whl", hash = "sha256:6335a4c9e8af329cb1ded5ab41a666e1448116161905a94e054f205aa6d263bc", size = 29323, upload-time = "2024-12-28T20:17:01.125Z" },
+    { url = "https://files.pythonhosted.org/packages/62/f5/5bc92030deadf34c365d908d4533709341fb05d0082db318774fdf1b2bcb/backports_datetime_fromisoformat-2.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e2e4b66e017253cdbe5a1de49e0eecff3f66cd72bcb1229d7db6e6b1832c0443", size = 27626, upload-time = "2024-12-28T20:17:03.448Z" },
+    { url = "https://files.pythonhosted.org/packages/28/45/5885737d51f81dfcd0911dd5c16b510b249d4c4cf6f4a991176e0358a42a/backports_datetime_fromisoformat-2.0.3-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:43e2d648e150777e13bbc2549cc960373e37bf65bd8a5d2e0cef40e16e5d8dd0", size = 34588, upload-time = "2024-12-28T20:17:04.459Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/6d/bd74de70953f5dd3e768c8fc774af942af0ce9f211e7c38dd478fa7ea910/backports_datetime_fromisoformat-2.0.3-cp311-cp311-macosx_11_0_x86_64.whl", hash = "sha256:4ce6326fd86d5bae37813c7bf1543bae9e4c215ec6f5afe4c518be2635e2e005", size = 27162, upload-time = "2024-12-28T20:17:06.752Z" },
+    { url = "https://files.pythonhosted.org/packages/47/ba/1d14b097f13cce45b2b35db9898957578b7fcc984e79af3b35189e0d332f/backports_datetime_fromisoformat-2.0.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d7c8fac333bf860208fd522a5394369ee3c790d0aa4311f515fcc4b6c5ef8d75", size = 54482, upload-time = "2024-12-28T20:17:08.15Z" },
+    { url = "https://files.pythonhosted.org/packages/25/e9/a2a7927d053b6fa148b64b5e13ca741ca254c13edca99d8251e9a8a09cfe/backports_datetime_fromisoformat-2.0.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:24a4da5ab3aa0cc293dc0662a0c6d1da1a011dc1edcbc3122a288cfed13a0b45", size = 54362, upload-time = "2024-12-28T20:17:10.605Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/99/394fb5e80131a7d58c49b89e78a61733a9994885804a0bb582416dd10c6f/backports_datetime_fromisoformat-2.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:58ea11e3bf912bd0a36b0519eae2c5b560b3cb972ea756e66b73fb9be460af01", size = 54162, upload-time = "2024-12-28T20:17:12.301Z" },
+    { url = "https://files.pythonhosted.org/packages/88/25/1940369de573c752889646d70b3fe8645e77b9e17984e72a554b9b51ffc4/backports_datetime_fromisoformat-2.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:8a375c7dbee4734318714a799b6c697223e4bbb57232af37fbfff88fb48a14c6", size = 54118, upload-time = "2024-12-28T20:17:13.609Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/46/f275bf6c61683414acaf42b2df7286d68cfef03e98b45c168323d7707778/backports_datetime_fromisoformat-2.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:ac677b1664c4585c2e014739f6678137c8336815406052349c85898206ec7061", size = 29329, upload-time = "2024-12-28T20:17:16.124Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/0f/69bbdde2e1e57c09b5f01788804c50e68b29890aada999f2b1a40519def9/backports_datetime_fromisoformat-2.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:66ce47ee1ba91e146149cf40565c3d750ea1be94faf660ca733d8601e0848147", size = 27630, upload-time = "2024-12-28T20:17:19.442Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/1d/1c84a50c673c87518b1adfeafcfd149991ed1f7aedc45d6e5eac2f7d19d7/backports_datetime_fromisoformat-2.0.3-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:8b7e069910a66b3bba61df35b5f879e5253ff0821a70375b9daf06444d046fa4", size = 34707, upload-time = "2024-12-28T20:17:21.79Z" },
+    { url = "https://files.pythonhosted.org/packages/71/44/27eae384e7e045cda83f70b551d04b4a0b294f9822d32dea1cbf1592de59/backports_datetime_fromisoformat-2.0.3-cp312-cp312-macosx_11_0_x86_64.whl", hash = "sha256:a3b5d1d04a9e0f7b15aa1e647c750631a873b298cdd1255687bb68779fe8eb35", size = 27280, upload-time = "2024-12-28T20:17:24.503Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/7a/a4075187eb6bbb1ff6beb7229db5f66d1070e6968abeb61e056fa51afa5e/backports_datetime_fromisoformat-2.0.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ec1b95986430e789c076610aea704db20874f0781b8624f648ca9fb6ef67c6e1", size = 55094, upload-time = "2024-12-28T20:17:25.546Z" },
+    { url = "https://files.pythonhosted.org/packages/71/03/3fced4230c10af14aacadc195fe58e2ced91d011217b450c2e16a09a98c8/backports_datetime_fromisoformat-2.0.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ffe5f793db59e2f1d45ec35a1cf51404fdd69df9f6952a0c87c3060af4c00e32", size = 55605, upload-time = "2024-12-28T20:17:29.208Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/0a/4b34a838c57bd16d3e5861ab963845e73a1041034651f7459e9935289cfd/backports_datetime_fromisoformat-2.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:620e8e73bd2595dfff1b4d256a12b67fce90ece3de87b38e1dde46b910f46f4d", size = 55353, upload-time = "2024-12-28T20:17:32.433Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/68/07d13c6e98e1cad85606a876367ede2de46af859833a1da12c413c201d78/backports_datetime_fromisoformat-2.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:4cf9c0a985d68476c1cabd6385c691201dda2337d7453fb4da9679ce9f23f4e7", size = 55298, upload-time = "2024-12-28T20:17:34.919Z" },
+    { url = "https://files.pythonhosted.org/packages/60/33/45b4d5311f42360f9b900dea53ab2bb20a3d61d7f9b7c37ddfcb3962f86f/backports_datetime_fromisoformat-2.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:d144868a73002e6e2e6fef72333e7b0129cecdd121aa8f1edba7107fd067255d", size = 29375, upload-time = "2024-12-28T20:17:36.018Z" },
+    { url = "https://files.pythonhosted.org/packages/be/03/7eaa9f9bf290395d57fd30d7f1f2f9dff60c06a31c237dc2beb477e8f899/backports_datetime_fromisoformat-2.0.3-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:90e202e72a3d5aae673fcc8c9a4267d56b2f532beeb9173361293625fe4d2039", size = 28980, upload-time = "2024-12-28T20:18:06.554Z" },
+    { url = "https://files.pythonhosted.org/packages/47/80/a0ecf33446c7349e79f54cc532933780341d20cff0ee12b5bfdcaa47067e/backports_datetime_fromisoformat-2.0.3-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2df98ef1b76f5a58bb493dda552259ba60c3a37557d848e039524203951c9f06", size = 28449, upload-time = "2024-12-28T20:18:07.77Z" },
+]
+
 [[package]]
 name = "backports-zstd"
 version = "1.5.0"
@@ -490,62 +541,62 @@ wheels = [
 
 [[package]]
 name = "cryptography"
-version = "48.0.0"
+version = "48.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9f/a9/db8f313fdcd85d767d4973515e1db101f9c71f95fced83233de224673757/cryptography-48.0.0.tar.gz", hash = "sha256:5c3932f4436d1cccb036cb0eaef46e6e2db91035166f1ad6505c3c9d5a635920", size = 832984, upload-time = "2026-05-04T22:59:38.133Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/12/45/870e7f4bef50e5f53b9f51d4428aee5290eedf58ba443f16b1ebb7ab8e66/cryptography-48.0.1.tar.gz", hash = "sha256:266f4ee051abb2f725b74ef8072b521ce1feacf685a3364fa6a6b45548db791a", size = 832989, upload-time = "2026-06-09T22:32:31.8Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/df/3d/01f6dd9190170a5a241e0e98c2d04be3664a9e6f5b9b872cde63aff1c3dd/cryptography-48.0.0-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:0c558d2cdffd8f4bbb30fc7134c74d2ca9a476f830bb053074498fbc86f41ed6", size = 8001587, upload-time = "2026-05-04T22:57:36.803Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/bc/ee4137cbbe105652c0ee4252792b78fc8e7afa4b8e61d9d5dc05a7f45731/cryptography-48.0.1-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:3e4a1a3232eef2e6c732827d5722db29a0cc8b27af2a4d865b094cf954be9ca1", size = 8008324, upload-time = "2026-06-09T22:31:00.702Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/6e/e90527eef33f309beb811cf7c982c3aeffcce8e3edb178baa4ca3ae4a6fa/cryptography-48.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f5333311663ea94f75dd408665686aaf426563556bb5283554a3539177e03b8c", size = 4690433, upload-time = "2026-05-04T22:57:40.373Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/85/6379d42181bfc713094f081360fc5784d6c816b599d45e7f082502d173ce/cryptography-48.0.1-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:32143b24adb918f078134e1e230f1eb8cc04886b92c28b5f0041aaf3e5699225", size = 4696243, upload-time = "2026-06-09T22:32:33.446Z" },
-    { url = "https://files.pythonhosted.org/packages/90/04/673510ed51ddff56575f306cf1617d80411ee76831ccd3097599140efdfe/cryptography-48.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7995ef305d7165c3f11ae07f2517e5a4f1d5c18da1376a0a9ed496336b69e5f3", size = 4710620, upload-time = "2026-05-04T22:57:42.935Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/87/c85d147b53323c7eb4d850920c8901377323c2a0ff8d79c262d4fee89aa2/cryptography-48.0.1-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f0d27a5696721ef7a672b8c810f6aded391058e0b9486e63e6d93baf765da691", size = 4713235, upload-time = "2026-06-09T22:31:40.141Z" },
-    { url = "https://files.pythonhosted.org/packages/14/d5/e9c4ef932c8d800490c34d8bd589d64a31d5890e27ec9e9ad532be893294/cryptography-48.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:40ba1f85eaa6959837b1d51c9767e230e14612eea4ef110ee8854ada22da1bf5", size = 4696283, upload-time = "2026-05-04T22:57:45.294Z" },
+    { url = "https://files.pythonhosted.org/packages/79/58/67cbf8cf1ee7c54b439ca07bbecf8362c07afc11a3724fea70f745784add/cryptography-48.0.1-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:eb86ce1af36fe65041b6db9a8bb064ee621a7e5fded0f80d475ec243477cd242", size = 4702323, upload-time = "2026-06-09T22:31:42.191Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/29/174b9dfb60b12d59ecfc6cfa04bc88c21b42a54f01b8aae09bb6e51e4c7f/cryptography-48.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:369a6348999f94bbd53435c894377b20ab95f25a9065c283570e70150d8abc3c", size = 5296573, upload-time = "2026-05-04T22:57:47.933Z" },
+    { url = "https://files.pythonhosted.org/packages/89/c6/24266ac10c47f6cd2a865f4446062b466da1d1f10b27189eac00e61bf0c9/cryptography-48.0.1-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:b024e784ad6c077ee0147b35ea9cbfc1e34e1fd4c1dcca214c2794d73a12df08", size = 5300085, upload-time = "2026-06-09T22:31:58.703Z" },
-    { url = "https://files.pythonhosted.org/packages/95/38/0d29a6fd7d0d1373f0c0c88a04ba20e359b257753ac497564cd660fc1d55/cryptography-48.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:a0e692c683f4df67815a2d258b324e66f4738bd7a96a218c826dce4f4bd05d8f", size = 4743677, upload-time = "2026-05-04T22:57:50.067Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/bb/cc4b78784f97efc8c5874c2a9743708d172be6663024b34a0467885ae0c8/cryptography-48.0.1-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3752f2dbc8f07a30aad2932c986cea495b03bb554887828225da104f732852b6", size = 4746137, upload-time = "2026-06-09T22:31:31.01Z" },
-    { url = "https://files.pythonhosted.org/packages/30/be/eef653013d5c63b6a490529e0316f9ac14a37602965d4903efed1399f32b/cryptography-48.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:18349bbc56f4743c8b12dc32e2bccb2cf83ee8b69a3bba74ef8ae857e26b3d25", size = 4330808, upload-time = "2026-05-04T22:57:52.301Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/52/0c44de3f5267f8fbe8e835138017522a333436166e406f0db9b9e6e3033f/cryptography-48.0.1-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:bd81490cd5801d755cf97bb68ac191f14b708470b1c7cf4580f669b9c9264cd8", size = 4333867, upload-time = "2026-06-09T22:32:28.096Z" },
-    { url = "https://files.pythonhosted.org/packages/84/9e/500463e87abb7a0a0f9f256ec21123ecde0a7b5541a15e840ea54551fd81/cryptography-48.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:7e8eac43dfca5c4cccc6dad9a80504436fca53bb9bc3100a2386d730fbe6b602", size = 4695941, upload-time = "2026-05-04T22:57:54.603Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/2e/772d7adbfa931537bc401640b7cac9976bff689bda187833e5d63b428e49/cryptography-48.0.1-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:66fd0771e7b9c6dcd44cf1120690d2338d16d72795cf40cae2786a39eba65429", size = 4701805, upload-time = "2026-06-09T22:31:38.284Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/dc/7303087450c2ec9e7fbb750e17c2abfbc658f23cbd0e54009509b7cc4091/cryptography-48.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9ccdac7d40688ecb5a3b4a604b8a88c8002e3442d6c60aead1db2a89a041560c", size = 5252579, upload-time = "2026-05-04T22:57:57.207Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/a3/b06844f303873493c963caf581c04df31c7035e0c1b0f02c4814d319ec80/cryptography-48.0.1-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:3fd2ca57062b241c856670b073487d2e86c4637937ca5601e48f97bf8e11fc8f", size = 5258461, upload-time = "2026-06-09T22:31:04.187Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/c0/7101d3b7215edcdc90c45da544961fd8ed2d6448f77577460fa75a8443f7/cryptography-48.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:bd72e68b06bb1e96913f97dd4901119bc17f39d4586a5adf2d3e47bc2b9d58b5", size = 4743326, upload-time = "2026-05-04T22:57:59.535Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/13/8b765e2e12b07c74941caadb9d1c8fdc006c4dfbf2b8f2d610519758954d/cryptography-48.0.1-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:0ee6ea481db1ab889cba043ec1eda17bb9c1ea79db6722f779c3667f9f70322f", size = 4745488, upload-time = "2026-06-09T22:32:30.07Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/d8/5b833bad13016f562ab9d063d68199a4bd121d18458e439515601d3357ec/cryptography-48.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:59baa2cb386c4f0b9905bd6eb4c2a79a69a128408fd31d32ca4d7102d4156321", size = 4826672, upload-time = "2026-05-04T22:58:01.996Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/aa/48972bce55049b32a94f4907eda4d75fa385aad8a39506cc2fc72196ecf0/cryptography-48.0.1-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:f2ceef93cb096aa3c4cc4b5c94ca6131f9196d28c64d6111533402a9b2054d41", size = 4830256, upload-time = "2026-06-09T22:31:43.868Z" },
-    { url = "https://files.pythonhosted.org/packages/98/e1/7074eb8bf3c135558c73fc2bcf0f5633f912e6fb87e868a55c454080ef09/cryptography-48.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9249e3cd978541d665967ac2cb2787fd6a62bddf1e75b3e347a594d7dacf4f74", size = 4972574, upload-time = "2026-05-04T22:58:03.968Z" },
+    { url = "https://files.pythonhosted.org/packages/47/a2/e5079a032fb85cf6005046ca92bbd78b0c82dad2b5751ab8c311659da06f/cryptography-48.0.1-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9bd3f92d76217892b15df84ca256c2c113d386fdda7a7d8691aeeced976507c6", size = 4979117, upload-time = "2026-06-09T22:31:05.845Z" },
-    { url = "https://files.pythonhosted.org/packages/04/70/e5a1b41d325f797f39427aa44ef8baf0be500065ab6d8e10369d850d4a4f/cryptography-48.0.0-cp311-abi3-win32.whl", hash = "sha256:9c459db21422be75e2809370b829a87eb37f74cd785fc4aa9ea1e5f43b47cda4", size = 3294868, upload-time = "2026-05-04T22:58:06.467Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/a0/8f50cae9c74e718ed769d63ed5c74bd0ea830c9550a74629cebd1b9c7bc7/cryptography-48.0.1-cp311-abi3-win32.whl", hash = "sha256:b9a32b876490d66c8bcc9963ef220199569748434ab01a9d6aaeabf88e7f5158", size = 3304154, upload-time = "2026-06-09T22:32:16.845Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/ac/8ac51b4a5fc5932eb7ee5c517ba7dc8cd834f0048962b6b352f00f41ebf9/cryptography-48.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:5b012212e08b8dd5edc78ef54da83dd9892fd9105323b3993eff6bea65dc21d7", size = 3817107, upload-time = "2026-05-04T22:58:08.845Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/69/0572c77dbace6fef72f33755bd52ea399c71367250d366237f8691826b9e/cryptography-48.0.1-cp311-abi3-win_amd64.whl", hash = "sha256:39489bfca54c7a1f6b297efcd8bc608ab92d16c4ca631b0cad4da46724588b24", size = 3817138, upload-time = "2026-06-09T22:32:00.388Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/84/70e3feea9feea87fd7cbe77efb2712ae1e3e6edf10749dc6e95f4e60e455/cryptography-48.0.0-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:3cb07a3ed6431663cd321ea8a000a1314c74211f823e4177fefa2255e057d1ec", size = 7986556, upload-time = "2026-05-04T22:58:11.172Z" },
+    { url = "https://files.pythonhosted.org/packages/42/06/3e768b4c3bc78201583fa35a0e18f640dd782ff41afba88f8545481a8874/cryptography-48.0.1-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:f817adc181390bd54f2f700107a7419040fb7c1bdf2fc26f36551a06a68c3345", size = 7989830, upload-time = "2026-06-09T22:31:07.8Z" },
-    { url = "https://files.pythonhosted.org/packages/89/6e/18e07a618bb5442ba10cf4df16e99c071365528aa570dfcb8c02e25a303b/cryptography-48.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8c7378637d7d88016fa6791c159f698b3d3eed28ebf844ac36b9dc04a14dae18", size = 4684776, upload-time = "2026-05-04T22:58:13.712Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/13/6476736484b94041110c8340a3eb63962fea4975baea8cb4a512adb44d4d/cryptography-48.0.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d5d30989c6917b478b5817902e85fddaea2261efa8648383d965381ccb9e1ac4", size = 4689201, upload-time = "2026-06-09T22:31:09.745Z" },
-    { url = "https://files.pythonhosted.org/packages/be/6a/4ea3b4c6c6759794d5ee2103c304a5076dc4b19ae1f9fe47dba439e159e9/cryptography-48.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:cc90c0b39b2e3c65ef52c804b72e3c58f8a04ab2a1871272798e5f9572c17d20", size = 4698121, upload-time = "2026-05-04T22:58:16.448Z" },
+    { url = "https://files.pythonhosted.org/packages/79/62/65a87f34d2a431546e2509b85d55e8c90df86d668f6731da64d538512ac2/cryptography-48.0.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:df637c05205ea7c1d7fbcbe54bbfea648a52951155f997af13d895d0ecc96991", size = 4702822, upload-time = "2026-06-09T22:32:24.409Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/59/6ff6ad6cae03bb887da2a5860b2c9805f8dac969ef01ce563336c49bd1d1/cryptography-48.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:76341972e1eff8b4bea859f09c0d3e64b96ce931b084f9b9b7db8ef364c30eff", size = 4690042, upload-time = "2026-05-04T22:58:18.544Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/59/810b5204b0a9b10f4b6bc06bd551a8b609803cd931806bc3b71884b225e5/cryptography-48.0.1-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:869c3b8a53bfe27147832df48b32adadf558249d50e76cb3769d40e986b13265", size = 4694875, upload-time = "2026-06-09T22:32:08.737Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/b4/fc334ed8cfd705aca282fe4d8f5ae64a8e0f74932e9feecb344610cf6e4d/cryptography-48.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:55b7718303bf06a5753dcdccf2f3945cf18ad7bffde41b61226e4db31ab89a9c", size = 5282526, upload-time = "2026-05-04T22:58:20.75Z" },
+    { url = "https://files.pythonhosted.org/packages/24/dc/d8ca05ffea724eec6d232ea6f18e74c269eb6bdfdcc9bfba689790d1325f/cryptography-48.0.1-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:e361afba8918070d376df76f408a4f67fec0ee9cff81a99e48fe9a233ef59e17", size = 5290385, upload-time = "2026-06-09T22:31:15.212Z" },
-    { url = "https://files.pythonhosted.org/packages/11/08/9f8c5386cc4cd90d8255c7cdd0f5baf459a08502a09de30dc51f553d38dc/cryptography-48.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:a64697c641c7b1b2178e573cbc31c7c6684cd56883a478d75143dbb7118036db", size = 4733116, upload-time = "2026-05-04T22:58:23.627Z" },
+    { url = "https://files.pythonhosted.org/packages/03/8c/3be6cb4da181f5bb6c19cf560c2359d60644a6b5fc5b57854e528f47b296/cryptography-48.0.1-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:d069066deead00ac7f090be101be875a06855908f7ec004c27b8fefb4acfb411", size = 4737082, upload-time = "2026-06-09T22:32:22.66Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/77/99307d7574045699f8805aa500fa0fb83422d115b5400a064ddd306d7750/cryptography-48.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:561215ea3879cb1cbbf272867e2efda62476f240fb58c64de6b393ae19246741", size = 4316030, upload-time = "2026-05-04T22:58:25.581Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/f6/d5f60a5a1434dbfd949e227fd0065d194c7e6b6ac526b17f5c06152b8231/cryptography-48.0.1-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:09f73a725d582cef64b91281a322cd798d14a33b2b6f2b7ad9531dc336d84c02", size = 4325328, upload-time = "2026-06-09T22:32:10.777Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/36/a608b98337af3cb2aff4818e406649d30572b7031918b04c87d979495348/cryptography-48.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:ad64688338ed4bc1a6618076ba75fd7194a5f1797ac60b47afe926285adb3166", size = 4689640, upload-time = "2026-05-04T22:58:27.747Z" },
+    { url = "https://files.pythonhosted.org/packages/17/b7/ba75dd947a14b6ad907b01ae8f6b5b348cdd1b48142f0063dee9e20c1d9d/cryptography-48.0.1-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:15254441469dd6bf027039453288e2072124f8b6603563f5d759e1c9b69273fa", size = 4694530, upload-time = "2026-06-09T22:31:53.105Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/a6/825010a291b4438aecc1f568bc428189fc1175515223632477c07dc0a6df/cryptography-48.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:906cbf0670286c6e0044156bc7d4af9cbb0ef6db9f73e52c3ec56ba6bdde5336", size = 5237657, upload-time = "2026-05-04T22:58:29.848Z" },
+    { url = "https://files.pythonhosted.org/packages/62/29/50d6b9e8aff12d8b67afaeb3569335e32dc83a5723e3bbded24fdac9f809/cryptography-48.0.1-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:8ace4507d1e6533c125f4fac754f8bb8b6a74c08e92179dabd7e16571a3efbf3", size = 5245046, upload-time = "2026-06-09T22:31:25.774Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/09/4e76a09b4caa29aad535ddc806f5d4c5d01885bd978bd984fbc6ca032cae/cryptography-48.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:ea8990436d914540a40ab24b6a77c0969695ed52f4a4874c5137ccf7045a7057", size = 4732362, upload-time = "2026-05-04T22:58:32.009Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/04/618f4115cfc0add0838c82507aa18a346089428da8653ad38b3ff36f5cb3/cryptography-48.0.1-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:b4e391975f038e66432328639620a4aff2d307513b004f1ca06d6225bced815c", size = 4736660, upload-time = "2026-06-09T22:32:12.676Z" },
-    { url = "https://files.pythonhosted.org/packages/18/78/444fa04a77d0cb95f417dda20d450e13c56ba8e5220fc892a1658f44f882/cryptography-48.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c18684a7f0cc9a3cb60328f496b8e3372def7c5d2df39ac267878b05565aaaae", size = 4819580, upload-time = "2026-05-04T22:58:34.254Z" },
+    { url = "https://files.pythonhosted.org/packages/24/9c/06e062462a0de28a3b3911322eded4c16deb9f441b1b7575d3dc59488ab5/cryptography-48.0.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:42fcd8e26fe555d9b3577a135f5091fefa0aa4e99129c23fb56787a1bd4ada72", size = 4822229, upload-time = "2026-06-09T22:31:17.062Z" },
-    { url = "https://files.pythonhosted.org/packages/38/85/ea67067c70a1fd4be2c63d35eeed82658023021affccc7b17705f8527dd2/cryptography-48.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:9be5aafa5736574f8f15f262adc81b2a9869e2cfe9014d52a44633905b40d52c", size = 4963283, upload-time = "2026-05-04T22:58:36.376Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/be/0561971eaaee4b8a0e7d5113c536921063ab91aaf23278ac374eaf881e11/cryptography-48.0.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:c1400da5e32a43253392277eac7490a60e497d810a63dd5608d71bbd7af507c9", size = 4966364, upload-time = "2026-06-09T22:31:32.842Z" },
-    { url = "https://files.pythonhosted.org/packages/75/54/cc6d0f3deac3e81c7f847e8a189a12b6cdd65059b43dad25d4316abd849a/cryptography-48.0.0-cp314-cp314t-win32.whl", hash = "sha256:c17dfe85494deaeddc5ce251aebd1d60bbe6afc8b62071bb0b469431a000124f", size = 3270954, upload-time = "2026-05-04T22:58:38.791Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/27/728c77876f12b000820b69ae490f3c4083775e79e07827e9e60be07ad209/cryptography-48.0.1-cp314-cp314t-win32.whl", hash = "sha256:0df56b056bc17c1b7d6821dfa65216e62bd232d8ab05eb3db44e71d235651471", size = 3278498, upload-time = "2026-06-09T22:31:29.154Z" },
-    { url = "https://files.pythonhosted.org/packages/49/67/cc947e288c0758a4e5473d1dcb743037ab7785541265a969240b8885441a/cryptography-48.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:27241b1dc9962e056062a8eef1991d02c3a24569c95975bd2322a8a52c6e5e12", size = 3797313, upload-time = "2026-05-04T22:58:40.746Z" },
+    { url = "https://files.pythonhosted.org/packages/06/e3/79a612c6d7b1e6ee0edd43633d53035bec2cfb78c82b76f7864f39e36f34/cryptography-48.0.1-cp314-cp314t-win_amd64.whl", hash = "sha256:9de21387aa95e2a895823d0745b430bed4f33503ba9ab5e0b5311f33e37d66d2", size = 3798790, upload-time = "2026-06-09T22:31:56.697Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/63/61d4a4e1c6b6bab6ce1e213cd36a24c415d90e76d78c5eb8577c5541d2e8/cryptography-48.0.0-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:58d00498e8933e4a194f3076aee1b4a97dfec1a6da444535755822fe5d8b0b86", size = 7983482, upload-time = "2026-05-04T22:58:43.769Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/6c/00fa2a95997164c8b2072ce327c23d4ab20809ccc323ea5fab91e53a4bba/cryptography-48.0.1-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:4fdc69f8e4316bcf0c8c8ec1f26f285d12e8142d88d96c876a59a03be3f6ae67", size = 7987408, upload-time = "2026-06-09T22:32:20.777Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/ac/f5b5995b87770c693e2596559ffafe195b4033a57f14a82268a2842953f3/cryptography-48.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:614d0949f4790582d2cc25553abd09dd723025f0c0e7c67376a1d77196743d6e", size = 4683266, upload-time = "2026-05-04T22:58:46.064Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/d9/45f309a7e4e5f3f8f121d6d3be9e94024a7726ec598d6e08ae04edb2f04d/cryptography-48.0.1-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:48fe40804d4caa2288f24e70ca8c64c42dd826da0ad7e4f1b41b2128d679e6c8", size = 4690196, upload-time = "2026-06-09T22:31:54.74Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/c6/8b14f67e18338fbc4adb76f66c001f5c3610b3e2d1837f268f47a347dbbb/cryptography-48.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7ce4bfae76319a532a2dc68f82cc32f5676ee792a983187dac07183690e5c66f", size = 4696228, upload-time = "2026-05-04T22:58:48.22Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/9f/a1bc8bcc798811b8527eb374bbccf30a3f3e806829d967118222bf1125eb/cryptography-48.0.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:86be3b1b0b6bf09482fb50a979c508d2950ed95f5621ec77f4e385962006b83a", size = 4696782, upload-time = "2026-06-09T22:31:45.615Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/73/f808fbae9514bd91b47875b003f13e284c8c6bdfd904b7944e803937eec1/cryptography-48.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:2eb992bbd4661238c5a397594c83f5b4dc2bc5b848c365c8f991b6780efcc5c7", size = 4689097, upload-time = "2026-05-04T22:58:50.9Z" },
+    { url = "https://files.pythonhosted.org/packages/66/c2/81a4fb4e4373c500bb526bc337ac5719dd31dd15b970b84a238168c6aa08/cryptography-48.0.1-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:4ab0a343c807bbcd90c971cd1ecf072937cd01847a9e002bef88fb47ac6be577", size = 4696618, upload-time = "2026-06-09T22:31:11.564Z" },
-    { url = "https://files.pythonhosted.org/packages/93/01/d86632d7d28db8ae83221995752eeb6639ffb374c2d22955648cf8d52797/cryptography-48.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:22a5cb272895dce158b2cacdfdc3debd299019659f42947dbdac6f32d68fe832", size = 5283582, upload-time = "2026-05-04T22:58:53.017Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/0b/aa68b221dde92d09cb29a024ede17550ee21e77a404e59fc093c82bb51e1/cryptography-48.0.1-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9621de99d2da096006b629979efd8ae7eb2d8b822488d0c89ee4000c306c59b1", size = 5289970, upload-time = "2026-06-09T22:31:20.368Z" },
-    { url = "https://files.pythonhosted.org/packages/02/e1/50edc7a50334807cc4791fc4a0ce7468b4a1416d9138eab358bfc9a3d70b/cryptography-48.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2b4d59804e8408e2fea7d1fbaf218e5ec984325221db76e6a241a9abd6cdd95c", size = 4730479, upload-time = "2026-05-04T22:58:55.611Z" },
+    { url = "https://files.pythonhosted.org/packages/78/13/fba657f958d2af66ea959a4ba01212632089249d34af1ae48054136344d7/cryptography-48.0.1-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:88c852a0ae366e262e5a1744b685e6a433dc8788dd2a277e418bf4904203609d", size = 4731873, upload-time = "2026-06-09T22:31:22.253Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/af/99a582b1b1641ff5911ac559beb45097cf79efd4ead4657f578ef1af2d47/cryptography-48.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:984a20b0f62a26f48a3396c72e4bc34c66e356d356bf370053066b3b6d54634a", size = 4326481, upload-time = "2026-05-04T22:58:57.607Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/4c/9a964756d24a26b3e34dfcb16f961b89838786e6700b635b0d1e3adff4b6/cryptography-48.0.1-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:43c5835e2cb98c8733d86f57d6fc879b613f5c3478607281c3e36daffc6dd8a6", size = 4330804, upload-time = "2026-06-09T22:31:36.56Z" },
-    { url = "https://files.pythonhosted.org/packages/90/ee/89aa26a06ef0a7d7611788ffd571a7c50e368cc6a4d5eef8b4884e866edb/cryptography-48.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:5a5ed8fde7a1d09376ca0b40e68cd59c69fe23b1f9768bd5824f54681626032a", size = 4688713, upload-time = "2026-05-04T22:59:00.077Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/0f/a10f3a6eb12950a10e3a874070283aa2dd5875b2bfd15fad8a3e17b3f13e/cryptography-48.0.1-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:fe0180af5bf9236518a087e35bf2d9a347d5f5f51e63c579d683ddff424e3d46", size = 4696217, upload-time = "2026-06-09T22:31:13.351Z" },
-    { url = "https://files.pythonhosted.org/packages/70/ba/bcb1b0bb7a33d4c7c0c4d4c7874b4a62ae4f56113a5f4baefa362dfb1f0f/cryptography-48.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:8cd666227ef7af430aa5914a9910e0ddd703e75f039cef0825cd0da71b6b711a", size = 5238165, upload-time = "2026-05-04T22:59:02.317Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/6f/5cd12f951165ea73ef85266775d97e4c763b2474ccfd816dd69d3a18d6f8/cryptography-48.0.1-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:b7a2d1a937a738a881737cec135a38bb61470589b17515b9f73f571d0ae10401", size = 5245252, upload-time = "2026-06-09T22:32:02.193Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/70/ca4003b1ce5ca3dc3186ada51908c8a9b9ff7d5cab83cc0d43ee14ec144f/cryptography-48.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:9071196d81abc88b3516ac8cdfad32e2b66dd4a5393a8e68a961e9161ddc6239", size = 4729947, upload-time = "2026-05-04T22:59:05.255Z" },
+    { url = "https://files.pythonhosted.org/packages/68/ab/8aaa12e4516ec4464033ab79b6f3b592bd5a92102467c4ace8a0d970203f/cryptography-48.0.1-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:b74ca3b8e5ecdd833bf6a002ca41b4793bb27fb8f1c06ffaf2643c9e9140e31b", size = 4731388, upload-time = "2026-06-09T22:32:04.019Z" },
-    { url = "https://files.pythonhosted.org/packages/44/a0/4ec7cf774207905aef1a8d11c3750d5a1db805eb380ee4e16df317870128/cryptography-48.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:1e2d54c8be6152856a36f0882ab231e70f8ec7f14e93cf87db8a2ed056bf160c", size = 4822059, upload-time = "2026-05-04T22:59:07.802Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/24/50027ea4dca85ec1f40688f3c24fb32ccacd520583c9592c3cc95628e6fb/cryptography-48.0.1-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:2c37f2461406063b417837f5f3daab668652acd82423efcd7f0a9f04be972de1", size = 4824186, upload-time = "2026-06-09T22:32:18.707Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/75/a2e55f99c16fcac7b5d6c1eb19ad8e00799854d6be5ca845f9259eae1681/cryptography-48.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a5da777e32ffed6f85a7b2b3f7c5cbc88c146bfcd0a1d7baf5fcc6c52ee35dd4", size = 4960575, upload-time = "2026-05-04T22:59:09.851Z" },
+    { url = "https://files.pythonhosted.org/packages/52/41/04cb5eb17085ade6f50cc611fb657df6a0f5885350de8764ece89c050197/cryptography-48.0.1-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:86fe77abb1bd87afb251d4d02ada7ecf53a32cee9b67d976abb2e45a13297475", size = 4964539, upload-time = "2026-06-09T22:31:18.793Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/23/6e6f32143ab5d8b36ca848a502c4bcd477ae75b9e1677e3530d669062578/cryptography-48.0.0-cp39-abi3-win32.whl", hash = "sha256:77a2ccbbe917f6710e05ba9adaa25fb5075620bf3ea6fb751997875aff4ae4bd", size = 3279117, upload-time = "2026-05-04T22:59:12.019Z" },
+    { url = "https://files.pythonhosted.org/packages/36/bf/ed70785c496e89d7e73b7cda2d21f2447fd6d4e821714b8d04ff217fed92/cryptography-48.0.1-cp39-abi3-win32.whl", hash = "sha256:6b2c0c3e6ccf3ade7750f836ef3ee36eea250cc467d45c256895573ac08cc6f1", size = 3282307, upload-time = "2026-06-09T22:30:53.162Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/9a/0fea98a70cf1749d41d738836f6349d97945f7c89433a259a6c2642eefeb/cryptography-48.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:16cd65b9330583e4619939b3a3843eec1e6e789744bb01e7c7e2e62e33c239c8", size = 3792100, upload-time = "2026-05-04T22:59:14.884Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/ff/371ea7d252656ee1eb6d83eeeef3d1d0c6baf1d6497687d081ea03814670/cryptography-48.0.1-cp39-abi3-win_amd64.whl", hash = "sha256:9a49ca6c81417f6a5edb50375a60cccdd70fa0a91a5211829dbea74eba94d2ac", size = 3793408, upload-time = "2026-06-09T22:32:15.191Z" },
-    { url = "https://files.pythonhosted.org/packages/be/d2/024b5e06be9d44cb021fb0e1a03d34d63989cf56a0fe62f3dfbab695b9b4/cryptography-48.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:84cf79f0dc8b36ac5da873481716e87aef31fcfa0444f9e1d8b4b2cece142855", size = 3950391, upload-time = "2026-05-04T22:59:17.415Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/d3/eb4e394e587341fdad09a09101fa76478ead3a78b0ad63e55c22f0d75c02/cryptography-48.0.1-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:08a597acce1ff37f347400087776599e2348a3a8bc53b44120e463cd274efe4a", size = 3951747, upload-time = "2026-06-09T22:31:23.871Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/17/3861e17c56fa0fd37491a14a8673fdb77c57fc5693cafe745ea8b06dba75/cryptography-48.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:fdfef35d751d510fcef5252703621574364fec16418c4a1e5e1055248401054b", size = 4637126, upload-time = "2026-05-04T22:59:20.197Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/4a/3f43451b4f858bfceaaaffc649e6e787e8d4fb332a1d443af39ab02cc8f1/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:735824ec41b7f74a7c45fb1591349333e4c696cb6c044e5f46356e560143e4cd", size = 4641226, upload-time = "2026-06-09T22:31:02.532Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/0a/7e226dbff530f21480727eb764973a7bff2b912f8e15cd4f129e71b56d1d/cryptography-48.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:0890f502ddf7d9c6426129c3f49f5c0a39278ed7cd6322c8755ffca6ee675a13", size = 4667270, upload-time = "2026-05-04T22:59:22.647Z" },
+    { url = "https://files.pythonhosted.org/packages/73/4e/855584c2c23b09e4ce2d3b9c30e983e679cd60b068c513c6bbdb91e11782/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:92a46e1d638daa264ba2971c0b0489c9409787943efae4d60ffda3d091ef832c", size = 4668958, upload-time = "2026-06-09T22:32:06.213Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/f2/5a72274ca9f1b2a8b44a662ee0bf1b435909deb473d6f97bcd035bcdbc71/cryptography-48.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:ecde28a596bead48b0cfd2a1b4416c3d43074c2d785e3a398d7ec1fc4d0f7fbb", size = 4636797, upload-time = "2026-05-04T22:59:24.912Z" },
+    { url = "https://files.pythonhosted.org/packages/42/3b/d35750e41d803d1e516fd6d6011f065424924da7af1748cef4cc9cb3ede1/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:7e234ac052af99f2700826a5c29ea99d9c1b1f80341cde62d11c8154dc8e0bd9", size = 4640793, upload-time = "2026-06-09T22:32:26.331Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/e1/48cedb2fe63626e91ded1edad159e2a4fb8b6906c4425eb7749673077ce7/cryptography-48.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:4defde8685ae324a9eb9d818717e93b4638ef67070ac9bc15b8ca85f63048355", size = 4666800, upload-time = "2026-05-04T22:59:27.474Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/aa/cdb7181fe865285e87e96825aaab239400f1de0c3bfba9bd9769b79f1a92/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:33842cf0888951cef5bc7ac724ab844a42044c1727b967b7f8997289a0464f92", size = 4668505, upload-time = "2026-06-09T22:31:27.534Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/ca/7e8365deec19afb2b2c7be7c1c0aa8f99633b54e90c570999acda93260fc/cryptography-48.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:db63bf618e5dea46c07de12e900fe1cdd2541e6dc9dbae772a70b7d4d4765f6a", size = 3739536, upload-time = "2026-05-04T22:59:29.61Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/8c/ce3823c06c2804f194f9e64f0d67fa3f4094a39f2bb1a990cd03603af8fc/cryptography-48.0.1-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:6184ca7b174f28d7c703f1290d4b297217c45355f77a98f67e9b7f14549ac54a", size = 3742204, upload-time = "2026-06-09T22:31:34.773Z" },
 ]
 
 [[package]]
@@ -760,8 +811,10 @@ dependencies = [
     { name = "duckdb" },
     { name = "flask-caching" },
     { name = "flask-cors" },
+    { name = "flask-smorest" },
     { name = "gunicorn" },
     { name = "httpx" },
+    { name = "marshmallow" },
     { name = "pandas", version = "2.3.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
     { name = "pandas", version = "3.0.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
     { name = "plotly", extra = ["express"] },
@@ -793,8 +846,10 @@ requires-dist = [
     { name = "duckdb" },
     { name = "flask-caching" },
     { name = "flask-cors", specifier = ">=6.0.2" },
+    { name = "flask-smorest", specifier = ">=0.46.0" },
     { name = "gunicorn" },
     { name = "httpx" },
+    { name = "marshmallow", specifier = ">=3.20.0" },
     { name = "pandas" },
     { name = "plotly", extras = ["express"] },
     { name = "polars" },
@@ -921,11 +976,11 @@ wheels = [
 
 [[package]]
 name = "filelock"
-version = "3.29.1"
+version = "3.29.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/1f/f9/f38573ed5844586db374d085911740a501ccfa373b455fc9413f09f85237/filelock-3.29.1.tar.gz", hash = "sha256:d97e6b1b9757569626c58caa07dc4beb1613f4a2938b1e8cc81afca398906c9e", size = 59335, upload-time = "2026-06-03T15:19:04.053Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/91/f5/3557bf28e0f1943e4849154c821533706e6dea010f96fb6aa0b6949037d1/filelock-3.29.3.tar.gz", hash = "sha256:7fc1b3f39cf172fd8203812043c57b8a65aef9969f38b6704f628b881f761a84", size = 61956, upload-time = "2026-06-10T17:37:11.832Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4c/a0/614c5fe402fd88951df45f4dda2fa3b4e17a99ecd92340771929169b3b95/filelock-3.29.1-py3-none-any.whl", hash = "sha256:85199dfd706869641b72b2e8955d5416a4b2b7dc4b0e8e6d97b4cc1299a6983b", size = 40750, upload-time = "2026-06-03T15:19:02.959Z" },
+    { url = "https://files.pythonhosted.org/packages/81/8f/b61d427c4f49a8bdadc93f4e7e74df8a6df6f77ee6e26bf0df53d3925363/filelock-3.29.3-py3-none-any.whl", hash = "sha256:e58333029cc9b925f39aad59b1d8f0a1ad836af4e60d7217f4a4dba87461261d", size = 42324, upload-time = "2026-06-10T17:37:10.37Z" },
 ]
 
 [[package]]
@@ -987,6 +1042,22 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/49/55/5bb1a2d918e9f02f131e47a59032bae70e48050e986e941511fd737a935c/flask_cors-6.0.5-py3-none-any.whl", hash = "sha256:68fcf75693e961f3af26683b23c4b9a8fb6b64de17d20d0c37b95e8de7ab2ed8", size = 16692, upload-time = "2026-06-08T20:20:16.247Z" },
 ]
 
+[[package]]
+name = "flask-smorest"
+version = "0.47.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "apispec", extra = ["marshmallow"] },
+    { name = "flask" },
+    { name = "marshmallow" },
+    { name = "webargs" },
+    { name = "werkzeug" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/99/b0/5edd5f3231ea26b52e786588c45d786df26929d2be8fec634bcb871b2a3f/flask_smorest-0.47.0.tar.gz", hash = "sha256:a415ce7db3d7e63dd854eb16d59047686dbf5d31c4913e245fa5657f88e7788d", size = 77600, upload-time = "2026-03-22T11:59:22.079Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4e/19/53cc4e4d4a3d61362053acd359a425f3e9f2c792698dd4dbb5f5441b5f97/flask_smorest-0.47.0-py3-none-any.whl", hash = "sha256:9329d8697f8710ea6446e9b7876a4f58af2dbc02116d10ebac6f24a7c0ebdea9", size = 32379, upload-time = "2026-03-22T11:59:20.449Z" },
+]
+
 [[package]]
 name = "geobuf"
 version = "2.0.1"
@@ -1326,6 +1397,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/70/bc/6f1c2f612465f5fa89b95bead1f44dcb607670fd42891d8fdcd5d039f4f4/markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa", size = 14146, upload-time = "2025-09-27T18:37:28.327Z" },
 ]
 
+[[package]]
+name = "marshmallow"
+version = "4.3.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "backports-datetime-fromisoformat", marker = "python_full_version < '3.11'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/25/7e/1dbd4096eb7c148cd2841841916f78820bb85a4d80a0c25c02d30815a7fb/marshmallow-4.3.0.tar.gz", hash = "sha256:fb43c53b3fe240b8f6af37223d6ef1636f927ad9bea8ab323afad95dff090880", size = 224485, upload-time = "2026-04-03T21:46:32.72Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/e0/ff24e25218bb59eb6290a530cea40651b14068b6e3659b20f9c175179632/marshmallow-4.3.0-py3-none-any.whl", hash = "sha256:46c4fe6984707e3cbd485dfebbf0a59874f58d695aad05c1668d15e8c6e13b46", size = 49148, upload-time = "2026-04-03T21:46:31.241Z" },
+]
+
 [[package]]
 name = "more-itertools"
 version = "10.8.0"
@@ -1814,17 +1898,17 @@ wheels = [
 
 [[package]]
 name = "protobuf"
-version = "7.35.0"
+version = "7.35.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/60/fd/5b1491d9e4b586d621c54f4c36b888714164b6875f8d6afa3f9072906a51/protobuf-7.35.0.tar.gz", hash = "sha256:a2efd84605f41e559f1881b0912b44099d0a2ac9bf46b3474823f10fb393b0e6", size = 458677, upload-time = "2026-05-19T23:02:29.197Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/da/01/9ef0afd7999eb9badb3a768b4aedd78c86d4c65cfaf1958ab276199e76b4/protobuf-7.35.1.tar.gz", hash = "sha256:ce115a26fe0c39a2c29973d914d327e516a6455464489fe3cd1e51a1b354f81a", size = 458717, upload-time = "2026-06-11T21:55:40.257Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/83/ee/93d06e358a4aa32280b00e722d3ea0a1f25fc3cc5778d80581c9cca2c10e/protobuf-7.35.0-cp310-abi3-macosx_10_9_universal2.whl", hash = "sha256:66be6c513931c794fa92c080ffee41671390da3d79da219cf9c0c0907f035dda", size = 433225, upload-time = "2026-05-19T23:02:19.884Z" },
+    { url = "https://files.pythonhosted.org/packages/10/03/8aeeb7458d22546bf64b5250ca1daeb5ff757d900e8e4a7476c6f0db843e/protobuf-7.35.1-cp310-abi3-macosx_10_9_universal2.whl", hash = "sha256:24f857477359a85c0c235261b8ba905fd51b2562f4a64ca1df5473f29850cbf6", size = 433226, upload-time = "2026-06-11T21:55:31.719Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/39/1c76c2da93f3c507e958e0aecee2391cc44d4625de6c728bbc555195b5a8/protobuf-7.35.0-cp310-abi3-manylinux2014_aarch64.whl", hash = "sha256:fcbe42a4ac09d3ec9c987ddfcd956afd0b15f1ff613bd8371bde9405ffd5c8e5", size = 328847, upload-time = "2026-05-19T23:02:22.3Z" },
+    { url = "https://files.pythonhosted.org/packages/37/4b/dfb89eb0e652a1ff073c39a59fb5e3a83cfe9b57a2c83fa6d78270101767/protobuf-7.35.1-cp310-abi3-manylinux2014_aarch64.whl", hash = "sha256:11d6b0ec246892d85215b0a13ca6e0233cf5284b68f0ac02646427f4ff88a799", size = 328847, upload-time = "2026-06-11T21:55:34.035Z" },
-    { url = "https://files.pythonhosted.org/packages/91/1a/39f7ce90a238c1a987a4d81ec26379e02ca0aff367de68e4a1fa474215b9/protobuf-7.35.0-cp310-abi3-manylinux2014_s390x.whl", hash = "sha256:4cbf5cc286130e06a6c9bbefac442431173906dfcc979712183d4adcc01b37ee", size = 344030, upload-time = "2026-05-19T23:02:23.591Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/58/dc12f2cd484951524af6e3382c785869b9b3fb5e52ee95ae23add53ee8f9/protobuf-7.35.1-cp310-abi3-manylinux2014_s390x.whl", hash = "sha256:b73f9489a4b8b1c9cb1f8ed951c736392592edb24b9d6819f36d2e10b171d5b4", size = 344030, upload-time = "2026-06-11T21:55:34.941Z" },
-    { url = "https://files.pythonhosted.org/packages/70/5b/6baf9008817964454055ff3fe65f1de0b5f1e26c80c82f7fb108b7cd4ea3/protobuf-7.35.0-cp310-abi3-manylinux2014_x86_64.whl", hash = "sha256:6c0f98f10c8a05ea30f8993dfef2de093d27b490fdae78bb60c8343795d55011", size = 327130, upload-time = "2026-05-19T23:02:24.637Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/be/5b3cfe508bfab6761414ff944e3366eb13be4fd71efcd69450f89ba39f43/protobuf-7.35.1-cp310-abi3-manylinux2014_x86_64.whl", hash = "sha256:74758715c53d7158fb76caf4f0cfdacc5329a4b1bb994f865d6cf302d413a1c4", size = 327130, upload-time = "2026-06-11T21:55:35.921Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/e5/e46adb0badc388bfb84877a5f9f026aff63f60e611016cf64dbe77e05446/protobuf-7.35.0-cp310-abi3-win32.whl", hash = "sha256:4c4617b83ade0e279d1d2bfe04025a1adb87f9ed657de038620dc0ff959357f6", size = 428946, upload-time = "2026-05-19T23:02:25.741Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/bc/6d6c7ba8709c85f8f2c390b2b118d6fb08a783676a572271851bf45a7d22/protobuf-7.35.1-cp310-abi3-win32.whl", hash = "sha256:353652e4efd0bca5b5fc2656abf8307ef351f0cf938c9eba09f0e09c20a25c30", size = 428945, upload-time = "2026-06-11T21:55:37.034Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/ab/547fbd9e16d879dd13c167478f8ae0a83a428008ca07a5e06acdc23ad473/protobuf-7.35.0-cp310-abi3-win_amd64.whl", hash = "sha256:f05bcadf9a2a6b8dda047007075135fb7d08c73d9177aabc067e1be46881a201", size = 439996, upload-time = "2026-05-19T23:02:26.808Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/19/8d0cb6f20a1ef7b18f1c8986ad5783f22f84cce39c6ce9a6e645ea55192e/protobuf-7.35.1-cp310-abi3-win_amd64.whl", hash = "sha256:230a75ddfc2de4806e56696ce9640c1cdfdb6543b7cfce98d42a4c0a0e7bdb87", size = 439996, upload-time = "2026-06-11T21:55:38.123Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/ef/50433d346c56657a70d27f156c7b349ac59a068b01de4eb796e747eecc43/protobuf-7.35.0-py3-none-any.whl", hash = "sha256:c13f325cf242bad135c350629eeb5d54b24228eb472fb3e2e9ebbd4c5dc20ca0", size = 171659, upload-time = "2026-05-19T23:02:27.842Z" },
+    { url = "https://files.pythonhosted.org/packages/19/c7/5f7c636ec43e0c545e28d1f1db71990108306f7bdcb89f069ba97e428e7f/protobuf-7.35.1-py3-none-any.whl", hash = "sha256:4bc97768d8fe4ad6743c8a19403e314511ed9f6d13205b687e52421c023ac1b9", size = 171659, upload-time = "2026-06-11T21:55:39.155Z" },
 ]
 
 [[package]]
@@ -2129,15 +2213,15 @@ wheels = [
 
 [[package]]
 name = "python-discovery"
-version = "1.4.0"
+version = "1.4.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "filelock" },
     { name = "platformdirs" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a6/12/38c1a0b1e64806780c9563e3fc9f6e472251839662587cfbe9bfaf2ae10a/python_discovery-1.4.0.tar.gz", hash = "sha256:eb8bc7daad3c226c147e45bb4e970a1feb1bf4048ee178e6db59e197b8010ce3", size = 68455, upload-time = "2026-05-28T01:15:37.639Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/0b/1a/cbbaf13b730abb0a16b964d984e19f2fe520c21a4dc664051359a3f5a9e7/python_discovery-1.4.2.tar.gz", hash = "sha256:8f3746c4b4968d22afbb97d36e1a0e5b66e6c0f297290f2e95f05b9b8bf18690", size = 70277, upload-time = "2026-06-11T16:10:42.383Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c8/8d/3d316429f65029532bb1e28ff77b797d86b5ac3915bb44ca4e19aa283d43/python_discovery-1.4.0-py3-none-any.whl", hash = "sha256:26ed78d703e234879a66244c7d4114563fb13ec5cd30a2d1357e5fb4850782da", size = 33217, upload-time = "2026-05-28T01:15:36.573Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/82/a70006589557f267f15bd384c0642ad49f0d97b690c3a05b166b9dcbad3b/python_discovery-1.4.2-py3-none-any.whl", hash = "sha256:475803f53b7b2ed6e490e27373f9d8340f7d2eebf9acdaf645d7d714c97bb500", size = 33886, upload-time = "2026-06-11T16:10:41.192Z" },
 ]
 
 [[package]]
@@ -2462,7 +2546,7 @@ wheels = [
 
 [[package]]
 name = "virtualenv"
-version = "21.4.2"
+version = "21.4.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "distlib" },
@@ -2471,9 +2555,9 @@ dependencies = [
     { name = "python-discovery" },
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/e1/0d/4e93c8e6d1001a75763f87d8f5ecda8ebc7f4aa2153dddfaf4ae8892821a/virtualenv-21.4.2.tar.gz", hash = "sha256:38e6ee0a555615c0ea9da2ac7e9998fe8dc3b911dd33ad8eaad2020957653b0c", size = 7613326, upload-time = "2026-05-31T17:01:22.827Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/4b/50/7564c805bb8966d9771caaba8a143fa5e57c848ce4e7fdf2d55a1feb2ead/virtualenv-21.4.3.tar.gz", hash = "sha256:938ff0fd3f4e0f0d3a025f67a3d2f25e3c3aabbcd5857ea6170619138d72d141", size = 7644454, upload-time = "2026-06-11T16:47:04.843Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bf/c4/557dc082be035381b85fdb2b74e21d3d21b57750b74f2b47a32f3a639ff9/virtualenv-21.4.2-py3-none-any.whl", hash = "sha256:854210ca524a1a4d0d744734f4acbc721c3ffe163b85bbf5d56d14d5ae2f0fae", size = 7594079, upload-time = "2026-05-31T17:01:20.735Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/8d/84b0d07c6b5f685f85ddf6c87a59d3a8a895a3dfd89e759666fabe951b94/virtualenv-21.4.3-py3-none-any.whl", hash = "sha256:75f4127d4067397c64f38579ce918fec6bf9ca2cd4f48685e82952cc3c035840", size = 7625544, upload-time = "2026-06-11T16:47:01.78Z" },
 ]
 
 [[package]]
@@ -2485,6 +2569,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/8d/57/a27182528c90ef38d82b636a11f606b0cbb0e17588ed205435f8affe3368/waitress-3.0.2-py3-none-any.whl", hash = "sha256:c56d67fd6e87c2ee598b76abdd4e96cfad1f24cacdea5078d382b1f9d7b5ed2e", size = 56232, upload-time = "2024-11-16T20:02:33.858Z" },
 ]
 
+[[package]]
+name = "webargs"
+version = "8.7.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "marshmallow" },
+    { name = "packaging" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/37/64/17afc4e6f47eef154a553c6e56adcc9f1ac3003305c7df978d11aa62937e/webargs-8.7.1.tar.gz", hash = "sha256:799bf9039c76c23fd8dc1951107a75a9e561203c15d6ae8f89c1e46e234636c1", size = 97351, upload-time = "2025-10-29T16:07:50.066Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/41/ef/b0d17f3943429358184449771b592e0e1d33bbeaa6ed326434a95eac187b/webargs-8.7.1-py3-none-any.whl", hash = "sha256:a184aed9d2509e6e14ab99ee3e9dc3a614c7070affe94cd4dfdb0d002e0a6e5f", size = 32500, upload-time = "2025-10-29T16:07:47.895Z" },
+]
+
 [[package]]
 name = "webdriver-manager"
 version = "4.1.2"