GeezerVison

Make httpx.AsyncClient pool config in split_pdf_hook.run_tasks configurable via env vars:

- UNSTRUCTURED_CLIENT_MAX_CONNECTIONS (default 100)
- UNSTRUCTURED_CLIENT_MAX_KEEPALIVE_CONNECTIONS (default 20)
- UNSTRUCTURED_CLIENT_KEEPALIVE_EXPIRY (default 5.0 seconds)

Defaults match httpx's built-in defaults, so this is fully backward
compatible.

Also extends the existing split_pdf event=plan_created INFO log to
include the resolved pool values, making the active config visible in
production logs.

When the SDK is used in an environment where load balancing happens at
TCP-connect time rather than per-request (a common Kubernetes setup
with simple Services), httpx's default keepalive pooling can lock onto
a subset of backends. Newly added backends never receive traffic
because existing connections stay glued to the originally-resolved
set. Allowing operators to force shorter keepalive (e.g.
MAX_KEEPALIVE_CONNECTIONS=1 + a low KEEPALIVE_EXPIRY) makes the client
re-establish connections more frequently, redistributing across the
available backends.

Defaults are unchanged — this purely adds knobs.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

ctrahey left a comment

Addresses review feedback on the pool-config PR: extend the same
env-var-driven approach to TLS verification and client certificates
so operators can plug in a custom CA bundle or mTLS cert without
modifying SDK code.

New env vars (all unset by default → httpx defaults):

- UNSTRUCTURED_CLIENT_TLS_CA_BUNDLE: path to a CA bundle file that
  overrides the system trust store. Typical use: internal CA for a
  corporate proxy or private hosting endpoint.
- UNSTRUCTURED_CLIENT_TLS_VERIFY: set to a falsy value
  ("false"/"0"/"no"/"off") to disable server cert verification
  entirely. Dev-only path.
- UNSTRUCTURED_CLIENT_TLS_CLIENT_CERT: path to a client cert PEM
  file for mTLS.
- UNSTRUCTURED_CLIENT_TLS_CLIENT_KEY: optional separate key file
  path. If unset, httpx reads the key from the cert PEM.

If CA bundle is set, it wins over the verify flag — explicit trust
store beats "disable verify".

Resolved config flows into both the existing batch_async_start DEBUG
log and the plan_created INFO log as `tls=<verify-mode> <cert-mode>`,
using human-readable descriptors that don't leak filesystem paths.

Tests cover: defaults, CA bundle path, verify-false (parameterized
over case/synonyms), verify-true (parameterized over truthy values),
CA-bundle-wins-over-verify, client cert alone, cert+key split, and a
mocked-AsyncClient end-to-end check that the resolved config reaches
the httpx.AsyncClient kwargs. 108/108 split_pdf_hook tests pass.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

awalker4 left a comment

Address Trahey's review feedback:

1. Drop the word "Client" from the trust-store env vars. In TLS,
   "client" specifically means mTLS client authentication, so a name
   like UNSTRUCTURED_CLIENT_TLS_VERIFY is ambiguous when it's really
   about server-cert verification.

2. Honor the standard env vars other libraries already respect
   (SSL_CERT_FILE first, then REQUESTS_CA_BUNDLE). A single env-var
   setting now applies uniformly across Python tooling.

The mTLS client-auth env vars (UNSTRUCTURED_CLIENT_TLS_CLIENT_CERT /
_CLIENT_KEY) keep their names — the word "CLIENT" there refers to TLS
client authentication, which is its correct usage.

The disable-verify knob is removed entirely; the standard env vars
have no such escape hatch by design.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Per Austin's review note: the repo no longer auto-generates, so this PR
owns its version bump and changelog entry directly.

- src/unstructured_client/_version.py: 0.44.1 -> 0.45.0
- CHANGELOG.md: 0.45.0 Features section covering pool limits, trust
  store (SSL_CERT_FILE / REQUESTS_CA_BUNDLE), mTLS client cert, and
  the extended plan_created observability log
- RELEASES.md: append matching Speakeasy-style v0.45.0 entry

Minor bump because all additions are new optional env vars with
defaults that match httpx (fully backward compatible).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>