style: apply ruff 0.16 formatting to Markdown code blocks

ruff 0.16.0 started formatting Python code blocks inside Markdown
files, so CI (which installs the latest ruff satisfying >=0.8) rejects
the previously formatted docs. Blank-line normalization only, no
content changes.

Author: RobertoIskandarani

README.md

@@ -20,6 +20,7 @@ from authplane_fastmcp import authplane_auth
 from fastmcp import FastMCP
 from fastmcp.server.auth import require_scopes
 
+
 async def main() -> None:
     result = await authplane_auth(
         issuer="https://auth.company.com",
@@ -37,6 +38,7 @@ async def main() -> None:
     finally:
         await result.aclose()
 
+
 asyncio.run(main())
 ```
 

authplane-fastmcp/README.md

@@ -32,9 +32,7 @@ async def main():
     )
 
     @mcp.tool(auth=require_scopes("tools/query"))
-    async def query_database(
-        query: str, token: AccessToken = CurrentAccessToken()
-    ) -> str:
+    async def query_database(query: str, token: AccessToken = CurrentAccessToken()) -> str:
         user_id = token.claims.get("sub")
         return f"Query: {query}, User: {user_id}"
 

authplane-fastmcp/docs/user-guide.md

@@ -37,6 +37,7 @@ import asyncio
 from fastmcp import FastMCP
 from authplane_fastmcp import authplane_auth
 
+
 async def main() -> None:
     result = await authplane_auth(
         issuer="https://auth.company.com",
@@ -55,6 +56,7 @@ async def main() -> None:
     finally:
         await result.aclose()
 
+
 asyncio.run(main())
 ```
 
@@ -99,11 +101,13 @@ Use FastMCP's built-in `require_scopes` decorator to enforce per-tool scope requ
 ```python
 from fastmcp.server.auth import require_scopes
 
+
 @mcp.tool(auth=require_scopes("tools/query"))
 def query(sql: str) -> str:
     """Requires the tools/query scope."""
     return f"Ran: {sql}"  # replace with your real handler
 
+
 @mcp.tool(auth=require_scopes("tools/admin", "tools/delete"))
 def delete_all() -> str:
     """Requires BOTH tools/admin AND tools/delete scopes."""
@@ -120,21 +124,22 @@ FastMCP enforces scopes **before** the handler runs by **filtering tools the cal
 from fastmcp.dependencies import CurrentAccessToken
 from fastmcp.server.auth import AccessToken
 
+
 @mcp.tool()
 async def my_tool(data: str, token: AccessToken = CurrentAccessToken()) -> str:
     # Standard JWT claims
-    sub = token.claims.get("sub")         # Subject (user ID)
-    jti = token.claims.get("jti")         # JWT ID
-    iss = token.claims.get("iss")         # Issuer
-    aud = token.claims.get("aud")         # Audience
-    exp = token.claims.get("exp")         # Expiration (Unix timestamp)
-    nbf = token.claims.get("nbf")         # Not before
-    iat = token.claims.get("iat")         # Issued at
+    sub = token.claims.get("sub")  # Subject (user ID)
+    jti = token.claims.get("jti")  # JWT ID
+    iss = token.claims.get("iss")  # Issuer
+    aud = token.claims.get("aud")  # Audience
+    exp = token.claims.get("exp")  # Expiration (Unix timestamp)
+    nbf = token.claims.get("nbf")  # Not before
+    iat = token.claims.get("iat")  # Issued at
 
     # OAuth claims
-    client_id = token.client_id           # Client ID
-    scopes = token.scopes                 # List of granted scopes
-    expires_at = token.expires_at         # Expiration (Unix timestamp)
+    client_id = token.client_id  # Client ID
+    scopes = token.scopes  # List of granted scopes
+    expires_at = token.expires_at  # Expiration (Unix timestamp)
 
     # Custom claims
     tenant = token.claims.get("tenant_id")
@@ -150,6 +155,7 @@ The `claims` dict contains the **full JWT payload** including all standard and c
 ```python
 from fastmcp.server.dependencies import get_access_token
 
+
 @mcp.tool()
 async def my_tool(data: str) -> str:
     token = get_access_token()  # Returns None if unauthenticated
@@ -247,10 +253,12 @@ Implement your own revocation logic with an async callable:
 ```python
 from authplane import VerifiedClaims
 
+
 async def check_blocklist(claims: VerifiedClaims, raw_token: str) -> bool:
     """Return True to reject the token (it is revoked)."""
     return await redis_client.sismember("revoked_tokens", claims.jti)
 
+
 await authplane_auth(
     issuer="https://auth.company.com",
     base_url="https://mcp.company.com",
@@ -280,8 +288,8 @@ result = await authplane_auth(
 downstream = await result.client.exchange(
     TokenExchangeOptions(
         subject_token=inbound_token,
-        scope="tools/add",                           # narrow to the minimum
-        resources=("https://downstream.example",),   # RFC 8707 audience binding
+        scope="tools/add",  # narrow to the minimum
+        resources=("https://downstream.example",),  # RFC 8707 audience binding
     )
 )
 
@@ -314,6 +322,7 @@ from authplane import ConsentRequiredError
 from authplane.oauth import TokenExchangeOptions
 from mcp.shared.exceptions import UrlElicitationRequiredError
 
+
 @mcp.tool(auth=require_scopes("tools/call_downstream"))
 async def call_downstream(payload: str) -> str:
     try:
@@ -406,6 +415,7 @@ When `fetch_settings` is provided, `dev_mode` is ignored for both metadata and J
 ```python
 import asyncio
 
+
 async def main() -> None:
     result = await authplane_auth(...)
     try:
@@ -414,6 +424,7 @@ async def main() -> None:
     finally:
         await result.aclose()
 
+
 asyncio.run(main())
 ```
 

authplane-mcp/docs/user-guide.md

@@ -102,12 +102,14 @@ Use the `require_scope()` helper at the top of tool handlers to enforce per-tool
 ```python
 from authplane_mcp import require_scope
 
+
 @mcp.tool()
 async def query(sql: str) -> str:
     """Requires the tools/query scope."""
     require_scope("tools/query")
     return f"Ran: {sql}"  # replace with your real handler
 
+
 @mcp.tool()
 async def delete_all() -> str:
     """Requires the tools/admin scope."""
@@ -128,14 +130,15 @@ Use the MCP SDK's `get_access_token()` to access the validated token in tool han
 ```python
 from mcp.server.auth.middleware.auth_context import get_access_token
 
+
 @mcp.tool()
 async def my_tool(data: str) -> str:
     token = get_access_token()
     if token:
-        client_id = token.client_id       # Client ID
-        scopes = token.scopes             # List of granted scopes
-        expires_at = token.expires_at     # Expiration (Unix timestamp)
-        resource = token.resource         # Resource (audience) URL
+        client_id = token.client_id  # Client ID
+        scopes = token.scopes  # List of granted scopes
+        expires_at = token.expires_at  # Expiration (Unix timestamp)
+        resource = token.resource  # Resource (audience) URL
     return f"Processing {data}"
 ```
 
@@ -238,10 +241,12 @@ Implement your own revocation logic with an async callable:
 ```python
 from authplane import VerifiedClaims
 
+
 async def check_blocklist(claims: VerifiedClaims, raw_token: str) -> bool:
     """Return True to reject the token (it is revoked)."""
     return await redis_client.sismember("revoked_tokens", claims.jti)
 
+
 await authplane_mcp_auth(
     issuer="https://auth.company.com",
     resource="https://mcp.company.com",
@@ -271,8 +276,8 @@ result = await authplane_mcp_auth(
 downstream = await result.client.exchange(
     TokenExchangeOptions(
         subject_token=inbound_token,
-        scope="tools/add",                           # narrow to the minimum
-        resources=("https://downstream.example",),   # RFC 8707 audience binding
+        scope="tools/add",  # narrow to the minimum
+        resources=("https://downstream.example",),  # RFC 8707 audience binding
     )
 )
 
@@ -305,6 +310,7 @@ The adapter handles this for you. The `client` returned by `authplane_mcp_auth(.
 ```python
 from authplane.oauth import TokenExchangeOptions
 
+
 @mcp.tool()
 async def call_downstream(user_token: str, payload: str) -> str:
     downstream = await result.client.exchange(
@@ -406,6 +412,7 @@ When `fetch_settings` is provided, `dev_mode` is ignored for both metadata and J
 ```python
 import asyncio
 
+
 async def main() -> None:
     auth_result = await authplane_mcp_auth(...)
     try:
@@ -414,6 +421,7 @@ async def main() -> None:
     finally:
         await auth_result.aclose()
 
+
 asyncio.run(main())
 ```
 

authplane/docs/user-guide.md

@@ -137,11 +137,11 @@ res = client.resource(
     resource="https://api.example.com",
     scopes=["read"],
     inbound_dpop=InboundDPoPOptions(
-        replay_store=InMemoryDPoPReplayStore(),     # process-scoped by default
+        replay_store=InMemoryDPoPReplayStore(),  # process-scoped by default
         max_proof_age_seconds=300,
         clock_skew_seconds=30,
         allowed_proof_algorithms=("RS256", "ES256"),
-        required=True,                              # reject bearer-only tokens
+        required=True,  # reject bearer-only tokens
     ),
 )
 ```
@@ -159,13 +159,16 @@ For each incoming request that may carry a DPoP-bound token, build a
 ```python
 from dataclasses import dataclass
 
+
 @dataclass
 class IncomingRequest:
     """Implements DPoPRequestContext."""
+
     method: str
     url: str
     proof: str | None
 
+
 claims = await res.verify(
     token,
     dpop_request=IncomingRequest(
@@ -261,6 +264,7 @@ res = client.resource(
 ```python
 from authplane import VerifiedClaims
 
+
 async def my_revocation_checker(claims: VerifiedClaims, raw_token: str) -> bool:
     return claims.jti in revoked_jtis
 ```
@@ -415,12 +419,12 @@ For multi-instance or shared-state deployments, provide your own `DPoPNonceStore
 ```python
 from authplane import DPoPKeyMaterial, DPoPNonceStore, DPoPProvider
 
+
 class MyNonceStore:
-    def get(self, key: str) -> str:
-        ...
+    def get(self, key: str) -> str: ...
+
+    def put(self, key: str, nonce: str) -> None: ...
 
-    def put(self, key: str, nonce: str) -> None:
-        ...
 
 provider = DPoPProvider(
     DPoPKeyMaterial.from_pem(private_key_pem),
@@ -597,8 +601,8 @@ except AuthplaneError as e:
 Generate an RFC 9728 protected resource metadata document with:
 
 ```python
-prm = res.prm_response()      # the document body (a dict)
-url = res.prm_url()           # the well-known URL where clients can fetch it
+prm = res.prm_response()  # the document body (a dict)
+url = res.prm_url()  # the well-known URL where clients can fetch it
 ```
 
 Example output: