aether-dsc 0.2.0__py3-none-any.whl

aether_dsc/__init__.py

@@ -0,0 +1,99 @@
+# Copyright 2026 Alessandro Masat
+# SPDX-License-Identifier: Apache-2.0
+
+"""aether-dsc — the sealed AETHER header payload.
+
+aether ships to Python-only users as a SEALED PAYLOAD, never as readable
+headers inside a wheel's include tree: one digest-named, zlib-compressed tar
+blob (opacity, not secrecy — see :mod:`aether_dsc._core`) carrying the
+`aether/`/`rtc/` headers a HAWK-emitted device kernel needs, plus eagle's
+`plugin/gref_layout.h` (device-clean) and `plugin/gref_abi.h` (host-only —
+NVRTC never sees its real bytes; :mod:`hawk.compile.nvrtc` serves an alias to
+the layout header's instead). Two consumers:
+
+* **device** — NVRTC compiles a kernel straight from :func:`payload`'s
+  in-memory `headers` mapping; nothing touches disk.
+* **host, or any file-only compiler** — :meth:`Payload.serve` materialises
+  the payload into a private, owner-only RAM directory for the compile's
+  lifetime and removes it afterwards, failure path included.
+
+Typical use::
+
+    import aether_dsc
+    p = aether_dsc.payload()        # the blob shipped in this wheel
+    # device: hand p.digest / p.headers to NVRTC (hawk.compile.nvrtc)
+    with p.serve() as include_root:  # host / any file compiler
+        ...                          # -I include_root
+
+Building a payload from a live checkout (never the shipped-wheel path — a
+developer's own aether tree, or the CLI that regenerates the shipped blob)
+goes through :func:`seal`; see :mod:`aether_dsc.seal`'s module docstring.
+"""
+from __future__ import annotations
+
+from ._core import Payload, PAYLOAD_DIR, _unpack, digest_of
+# Imported from `_seal_impl`, deliberately NOT from `.seal`:
+# `aether_dsc/seal.py` is `python -m aether_dsc.seal`'s CLI file, and
+# Python binds `aether_dsc.seal` to that MODULE the instant anything imports
+# it — which running the CLI does internally. Importing the function from
+# its own home (`_seal_impl.py`) instead means `aether_dsc.seal` stays
+# callable even in a process that has also run the CLI or imported
+# `aether_dsc.seal` as a submodule (see `_seal_impl`'s docstring;
+# `tests/test_aether_dsc.py` exercises both in one process).
+from ._seal_impl import seal
+
+__all__ = ["Payload", "seal", "payload", "version", "PAYLOAD_DIR"]
+
+#: This distribution's version — tracks aether's own (`aether/version.h`:
+#: `constexpr version()`), because a sealed payload speaks for exactly one
+#: aether checkout and a version skew between the two would silently claim
+#: otherwise.
+version = "0.2.0"
+
+_PAYLOAD_CACHE: Payload | None = None
+
+
+def payload() -> Payload:
+    """The sealed blob shipped in this distribution — decompressed
+    once per process and cached; every call after the first returns the same
+    object.
+
+    Raises `FileNotFoundError` when this checkout carries no blob yet (a
+    source tree that has never run ``python -m aether_dsc.seal``, or an
+    editable install before the first seal). Nothing here falls back to
+    sealing the live tree — that fallback belongs to
+    ``hawk.compile.payload.current_payload()``, gated on
+    `$HAWK_AETHER_INCLUDE`: a caller that wants "seal if there is no
+    blob" asks for it explicitly, `payload()` never guesses.
+    """
+    global _PAYLOAD_CACHE
+    if _PAYLOAD_CACHE is not None:
+        return _PAYLOAD_CACHE
+    blobs = sorted(PAYLOAD_DIR.glob("*.bin")) if PAYLOAD_DIR.is_dir() else []
+    if not blobs:
+        raise FileNotFoundError(
+            f"no sealed payload under {PAYLOAD_DIR} — run `python -m "
+            "aether_dsc.seal` from the aether/dsc checkout to build one")
+    if len(blobs) > 1:
+        raise RuntimeError(
+            f"{PAYLOAD_DIR} carries {len(blobs)} blobs "
+            f"({[b.name for b in blobs]}) — exactly one is expected; a stale "
+            "blob from a previous seal was not cleaned up")
+    blob_path = blobs[0]
+    claimed_digest = blob_path.stem
+    headers, host_only_names = _unpack(blob_path.read_bytes())
+    actual_digest = digest_of(headers)
+    if actual_digest != claimed_digest:
+        raise ValueError(
+            f"{blob_path} is named for digest {claimed_digest} but its content "
+            f"digests to {actual_digest} — corrupt or hand-edited blob")
+    _PAYLOAD_CACHE = Payload(actual_digest, headers, host_only_names)
+    return _PAYLOAD_CACHE
+
+
+def _reset_payload_cache() -> None:
+    """Test/dev hook: forget the cached :func:`payload` so a re-seal (or a
+    freshly written blob in a test's tmp `_payload/` dir) is picked up
+    without restarting the process."""
+    global _PAYLOAD_CACHE
+    _PAYLOAD_CACHE = None

aether_dsc/_core.py

@@ -0,0 +1,200 @@
+# Copyright 2026 Alessandro Masat
+# SPDX-License-Identifier: Apache-2.0
+
+"""The `Payload` type and its (de)serialisation — everything `aether_dsc`
+needs at IMPORT time, with zero third-party dependencies. Kept apart
+from :mod:`aether_dsc.seal`, which needs `cuda-bindings` for its NVRTC-clean
+gate: an ordinary consumer who only ever calls `payload()`/`.serve()` must
+never pay for (or need installed) a CUDA binding just to unpack a blob.
+"""
+from __future__ import annotations
+
+import contextlib
+import hashlib
+import io
+import os
+import shutil
+import tarfile
+import tempfile
+import zlib
+from pathlib import Path
+from typing import Iterator, Mapping
+
+__all__ = ["Payload", "PAYLOAD_DIR", "digest_of"]
+
+#: Where a sealed blob lives once `python -m aether_dsc.seal` has written one
+#: — `aether_dsc/_payload/<digest>.bin`, shipped as package data.
+PAYLOAD_DIR = Path(__file__).resolve().parent / "_payload"
+
+
+def digest_of(headers: Mapping[str, bytes]) -> str:
+    """The payload's content digest: sha256 over the
+    SORTED `(name, bytes)` pairs. Sorting is what makes it order-independent
+    — two payloads built by walking the same files in a different order (a
+    different filesystem, a different `os.walk` order) still digest to the
+    same value, and a single renamed or altered file changes it.
+    """
+    h = hashlib.sha256()
+    for name in sorted(headers):
+        encoded = name.encode()
+        h.update(len(encoded).to_bytes(4, "big"))
+        h.update(encoded)
+        data = headers[name]
+        h.update(len(data).to_bytes(8, "big"))
+        h.update(data)
+    return h.hexdigest()
+
+
+#: The tar member :func:`_pack`/:func:`_unpack` use to carry the host-only
+#: name set through the blob. Never a real header's own name — every real
+#: payload entry spells ``aether/...``, ``rtc/...`` or ``plugin/...``, so a
+#: bare dunder name with no such prefix cannot collide with one, now or as
+#: the manifests grow.
+_HOST_ONLY_MANIFEST_MEMBER = "__host_only_names__"
+
+
+def _pack(headers: Mapping[str, bytes],
+          host_only_names: frozenset[str] = frozenset()) -> bytes:
+    """Serialise `headers` (both sections — NVRTC-clean and host-only —
+    already merged into one mapping by the caller) to the on-disk blob
+    format: a zlib-compressed tar, one member per header plus one more
+    (:data:`_HOST_ONLY_MANIFEST_MEMBER`) naming which of those members are
+    host-only, newline-joined and sorted. Opacity, not secrecy, so a viewer
+    cannot casually `strings` or `cat` the payload."""
+    buf = io.BytesIO()
+    with tarfile.open(fileobj=buf, mode="w") as tf:
+        for name in sorted(headers):
+            data = headers[name]
+            info = tarfile.TarInfo(name=name)
+            info.size = len(data)
+            tf.addfile(info, io.BytesIO(data))
+        if host_only_names:
+            data = "\n".join(sorted(host_only_names)).encode()
+            info = tarfile.TarInfo(name=_HOST_ONLY_MANIFEST_MEMBER)
+            info.size = len(data)
+            tf.addfile(info, io.BytesIO(data))
+    return zlib.compress(buf.getvalue(), level=9)
+
+
+def _unpack(blob: bytes) -> tuple[dict[str, bytes], frozenset[str]]:
+    """The inverse of :func:`_pack`: ``(headers, host_only_names)`` — the
+    latter empty when the blob predates the host-only section (an older
+    payload sealed only the NVRTC-clean set)."""
+    raw = zlib.decompress(blob)
+    headers: dict[str, bytes] = {}
+    host_only_names: frozenset[str] = frozenset()
+    with tarfile.open(fileobj=io.BytesIO(raw), mode="r") as tf:
+        for member in tf.getmembers():
+            if not member.isfile():
+                continue
+            extracted = tf.extractfile(member)
+            data = extracted.read() if extracted else b""
+            if member.name == _HOST_ONLY_MANIFEST_MEMBER:
+                host_only_names = frozenset(
+                    ln for ln in data.decode().splitlines() if ln)
+            else:
+                headers[member.name] = data
+    return headers, host_only_names
+
+
+def _is_tmpfs(path: Path) -> bool:
+    """Whether `path` is itself a tmpfs mount (prefer `/dev/shm` when it is
+    one). Read from `/proc/mounts` rather than assumed from the name —
+    `/dev/shm` is conventional, not guaranteed, and measurement found a box
+    where a private tmpfs mount is refused entirely (SELinux enforcing), so
+    this function only ever REPORTS what is already mounted, never mounts
+    anything itself."""
+    try:
+        target = str(path.resolve())
+    except OSError:
+        return False
+    try:
+        with open("/proc/mounts") as f:
+            for line in f:
+                parts = line.split()
+                if len(parts) >= 3 and parts[1] == target and parts[2] == "tmpfs":
+                    return True
+    except OSError:
+        return False
+    return False
+
+
+def _ram_dir() -> Path:
+    """Where :meth:`Payload.serve` stages files: `/dev/shm` when it is a
+    tmpfs, else `$TMPDIR` (the measured fallback when a private mount
+    namespace is refused)."""
+    shm = Path("/dev/shm")
+    if shm.is_dir() and _is_tmpfs(shm):
+        return shm
+    return Path(os.environ.get("TMPDIR", "/tmp"))
+
+
+class Payload:
+    """A sealed set of headers plus its content digest.
+
+    `headers` maps include-relative names (`aether/...`, `rtc/<std name>`,
+    `plugin/gref_layout.h`) to their bytes; `digest` is :func:`digest_of`
+    applied to that mapping — two `Payload` instances with the same file set and
+    content always carry the same digest, independent of how or in what
+    order their files were discovered (:mod:`aether_dsc.seal`'s own
+    order-independence guarantee, exercised by
+    `tests/test_aether_dsc.py::test_seal_digest_order_independent`).
+
+    `host_only_names` names the subset of `headers` that is the HOST-ONLY
+    section: sealed (so :meth:`serve` writes them out for a host `-I` root
+    exactly like every other entry) but never claimed NVRTC-clean and never
+    handed to an NVRTC compile — see :attr:`device_headers`. `digest` covers
+    `headers` whole, host-only entries included, so a changed host-only file
+    changes the digest too (the cache-validity term every compile keys on).
+    """
+
+    __slots__ = ("digest", "headers", "host_only_names")
+
+    def __init__(self, digest: str, headers: Mapping[str, bytes],
+                host_only_names: frozenset[str] = frozenset()):
+        self.digest = digest
+        self.headers = dict(headers)
+        self.host_only_names = frozenset(host_only_names)
+
+    def __repr__(self) -> str:  # pragma: no cover - debugging aid
+        return (f"Payload(digest={self.digest[:12]}…, {len(self.headers)} headers, "
+                f"{len(self.host_only_names)} host-only)")
+
+    @property
+    def device_headers(self) -> dict[str, bytes]:
+        """`headers` minus the host-only section — what an NVRTC compile is
+        actually served (:mod:`hawk.compile.drivers`'s device path,
+        :mod:`hawk.compile.nvrtc`'s public ``device``/``cubin``): the
+        host-only headers are never NVRTC-clean-checked and must never
+        reach NVRTC even as an unreferenced, served-but-unused file."""
+        if not self.host_only_names:
+            return self.headers
+        return {k: v for k, v in self.headers.items() if k not in self.host_only_names}
+
+    @contextlib.contextmanager
+    def serve(self) -> Iterator[Path]:
+        """Materialise every header into a PRIVATE, owner-only directory for
+        the compile's lifetime, then remove it — on the normal exit path and
+        when the `with` block raises.
+
+        Prefers a tmpfs (`/dev/shm`, checked via `/proc/mounts` — never
+        assumed from the path alone) so nothing touches spinning or
+        networked storage; falls back to `$TMPDIR` otherwise. A private
+        mount namespace with its own tmpfs is an opportunistic upgrade this
+        function does not attempt: measurement found it refused outright on
+        an SELinux-enforcing box, so the plain RAM directory is the one
+        path every caller can rely on.
+        """
+        base = _ram_dir()
+        base.mkdir(parents=True, exist_ok=True)
+        served = Path(tempfile.mkdtemp(prefix="aether_dsc_", dir=str(base)))
+        os.chmod(served, 0o700)
+        try:
+            for name, data in self.headers.items():
+                dest = served / name
+                dest.parent.mkdir(parents=True, exist_ok=True)
+                dest.write_bytes(data)
+                os.chmod(dest, 0o600)
+            yield served
+        finally:
+            shutil.rmtree(served, ignore_errors=True)

aether_dsc/_rtc_check.py

@@ -0,0 +1,254 @@
+# Copyright 2026 Alessandro Masat
+# SPDX-License-Identifier: Apache-2.0
+
+"""The NVRTC-clean-compile check: the manifest of aether headers claimed
+to be NVRTC-clean, the seven ``rtc/`` shim names, the NVRTC options
+measured to compile cleanly, and the one compile-and-report primitive
+both :func:`aether_dsc._seal_impl.seal_and_write`'s gate and the
+standalone ``aether/tools/rtc_seal_check.py`` CLI share.
+
+Self-contained by design: this module reaches nowhere outside
+``aether_dsc`` — no ``sys.path`` mutation, no dependency on
+``aether/tools/`` being on disk. The manifest ships as package data
+(``aether_dsc/payload_headers.txt``, declared in ``pyproject.toml`` so a
+wheel carries it), and the one third-party import this module needs
+(``cuda-bindings``, for :func:`check_headers_nvrtc_clean`'s NVRTC calls)
+happens inside that function only — ``import aether_dsc`` never pays for
+a CUDA binding just because this module exists.
+"""
+from __future__ import annotations
+
+import importlib.util
+import os
+import platform
+import shutil
+from pathlib import Path
+from typing import Mapping
+
+__all__ = ["RTC_SHIM_NAMES", "NVRTC_OPTIONS", "PAYLOAD_MANIFEST",
+           "HOST_ONLY_MANIFEST", "manifest_paths", "host_only_manifest_paths",
+           "repo_headers", "cccl_include_dir", "served_name",
+           "check_headers_nvrtc_clean"]
+
+#: The seven NVRTC compatibility shims — see ``aether/rtc/``'s own files for the served text.
+RTC_SHIM_NAMES = ("cstddef", "cstdint", "type_traits", "utility", "concepts",
+                   "cmath", "atomic")
+
+#: NVRTC options measured to compile cleanly: c++20 device standard, this
+#: box's default arch (P2000 = sm_61), ``-default-device`` so a bare
+#: ``AETHER_DEVICE()``-qualified free function needs no
+#: ``extern "C" __global__`` wrapper to be reachable from the probe TU.
+NVRTC_OPTIONS = ["-std=c++20", "-arch=compute_61", "-default-device"]
+
+#: The committed manifest, shipped as package data — the ``aether/...``
+#: paths claimed to be NVRTC-clean. A directory walk is deliberately
+#: NOT the source of truth (see ``payload_headers.txt``'s own header
+#: comment): growing the payload to cover more headers is a deliberate,
+#: evidenced addition made later, not a default.
+PAYLOAD_MANIFEST = Path(__file__).resolve().parent / "payload_headers.txt"
+
+#: The host-only manifest (``payload_headers_host.txt``) — headers sealed
+#: into the payload's host-only section (see that file's own header
+#: comment): never claimed NVRTC-clean, never part of the NVRTC-clean gate
+#: this module runs, never handed to an NVRTC compile at all
+#: (:data:`aether_dsc._core.Payload.device_headers` excludes every name
+#: this manifest lists).
+HOST_ONLY_MANIFEST = Path(__file__).resolve().parent / "payload_headers_host.txt"
+
+
+def manifest_paths() -> list[str]:
+    """The manifest's ``aether/...`` entries — comments (``#``) and blank
+    lines skipped, order preserved as committed (already sorted)."""
+    lines = PAYLOAD_MANIFEST.read_text().splitlines()
+    return [ln for ln in lines if ln.strip() and not ln.lstrip().startswith("#")]
+
+
+def host_only_manifest_paths() -> list[str]:
+    """:data:`HOST_ONLY_MANIFEST`'s entries, same shape as
+    :func:`manifest_paths` — never fed to :func:`check_headers_nvrtc_clean`
+    by anything in this package; that gate reads :func:`manifest_paths`
+    alone."""
+    lines = HOST_ONLY_MANIFEST.read_text().splitlines()
+    return [ln for ln in lines if ln.strip() and not ln.lstrip().startswith("#")]
+
+
+def repo_headers(aether_root: Path, rtc_dir: Path) -> dict[str, bytes]:
+    """Every manifested ``aether/...`` file under ``aether_root``, plus the
+    seven ``rtc/<name>`` shims under ``rtc_dir`` — named exactly as a sealed
+    payload would name them. Raises ``FileNotFoundError`` naming the missing
+    file; never silently returns fewer headers than the manifest promises."""
+    headers: dict[str, bytes] = {}
+    for rel in manifest_paths():
+        f = aether_root / rel
+        if not f.is_file():
+            raise FileNotFoundError(
+                f"{PAYLOAD_MANIFEST} lists {rel!r}, which does not exist under {aether_root}")
+        headers[rel] = f.read_bytes()
+    for name in RTC_SHIM_NAMES:
+        f = rtc_dir / name
+        if not f.is_file():
+            raise FileNotFoundError(f"NVRTC shim missing: {f}")
+        headers[f"rtc/{name}"] = f.read_bytes()
+    return headers
+
+
+def _default_options(nvrtc) -> list[str]:
+    """:data:`NVRTC_OPTIONS` with ``-arch`` set to the oldest architecture the
+    loaded NVRTC supports (``nvrtcGetSupportedArchs``): ``compute_61`` on a
+    CUDA 12.x NVRTC, ``compute_75`` on CUDA 13, whose NVRTC dropped the older
+    targets. Falls back to the constant when the query is unavailable."""
+    try:
+        err, archs = nvrtc.nvrtcGetSupportedArchs()
+        oldest = min(int(a) for a in archs)
+    except Exception:
+        return list(NVRTC_OPTIONS)
+    return [f"-arch=compute_{oldest}" if o.startswith("-arch=") else o
+            for o in NVRTC_OPTIONS]
+
+
+def _loaded_nvrtc_root() -> str | None:
+    """The toolkit root (the directory above ``lib``/``lib64``) of the
+    ``libnvrtc`` this process has loaded, or ``None`` when none is mapped."""
+    try:
+        from cuda.bindings import nvrtc  # noqa: F401  (loads the library)
+    except Exception:
+        pass
+    try:
+        with open("/proc/self/maps") as maps:
+            for line in maps:
+                path = line.split(None, 5)[-1].strip() if line.count(" ") >= 5 else ""
+                if "/libnvrtc.so" in path or "/libnvrtc-" in path:
+                    lib = Path(path).resolve().parent
+                    while lib.name in ("lib", "lib64", "x86_64-linux", "sbsa-linux",
+                                       "aarch64-linux") or lib.parent.name == "targets":
+                        lib = lib.parent
+                    return str(lib.parent if lib.name == "targets" else lib)
+    except OSError:
+        pass
+    return None
+
+
+def cccl_include_dir() -> str:
+    """Where ``<cuda/std/...>`` lives: the ``nvidia-cuda-cccl-cu12`` wheel's
+    ``include/`` directory when it is installed, else a CUDA toolkit's own
+    headers. Every CUDA 12.x/13 toolkit ships CCCL, either in a flat
+    ``include/`` (CUDA 13: ``include/cccl/``) or in NVIDIA's
+    ``targets/<arch>-linux/include/`` layout (a
+    conda toolkit has only the latter). Toolkit roots are tried in order:
+    the root of the loaded NVRTC, ``$CUDA_PATH``, ``$CONDA_PREFIX``, the toolkit holding the ``nvcc`` on
+    ``PATH``, then ``/usr/local/cuda``.
+
+    ``importlib.util.find_spec`` on a DOTTED name imports the PARENT first
+    (``nvidia``) to look inside it, and raises ``ModuleNotFoundError`` rather
+    than returning ``None`` when that parent does not exist at all — the
+    exact shape of a box with no ``nvidia-cuda-*`` wheel installed to create
+    the ``nvidia`` namespace package at all. That is a "not installed"
+    answer, the same as the wheel existing but lacking ``cuda_cccl``, so it
+    is caught here rather than left to crash a caller that only wanted to
+    know whether the wheel is there."""
+    try:
+        spec = importlib.util.find_spec("nvidia.cuda_cccl")
+    except ModuleNotFoundError:
+        spec = None
+    if spec is not None and spec.submodule_search_locations:
+        for loc in spec.submodule_search_locations:
+            candidate = Path(loc) / "include"
+            if (candidate / "cuda" / "std").is_dir():
+                return str(candidate)
+    for candidate in _toolkit_include_dirs():
+        if (candidate / "cuda" / "std").is_dir():
+            return str(candidate)
+    raise RuntimeError(
+        "no CCCL include directory found: install nvidia-cuda-cccl-cu12 or "
+        "set $CUDA_PATH to a toolkit whose include/cuda/std exists")
+
+
+def _toolkit_include_dirs() -> list[Path]:
+    """Candidate toolkit include directories for :func:`cccl_include_dir`,
+    most specific first: for each toolkit root, its flat ``include/``, then
+    ``targets/<arch>-linux/include/`` (this machine's arch first, then any
+    other ``targets/*-linux`` the toolkit carries, e.g. ``sbsa-linux``)."""
+    roots = [_loaded_nvrtc_root(), os.environ.get("CUDA_PATH"),
+             os.environ.get("CONDA_PREFIX")]
+    nvcc = shutil.which("nvcc")
+    if nvcc:
+        roots.append(str(Path(nvcc).resolve().parent.parent))
+    roots.append("/usr/local/cuda")
+    dirs: list[Path] = []
+    for root in dict.fromkeys(r for r in roots if r):
+        base = Path(root)
+        targets = base / "targets"
+        own = targets / f"{platform.machine()}-linux" / "include"
+        others = sorted(targets.glob("*-linux/include")) if targets.is_dir() else []
+        flat = [base / "include", own, *others]
+        # CUDA 13 moved CCCL into an ``include/cccl`` subdirectory.
+        for d in [p for x in flat for p in (x / "cccl", x)]:
+            if d not in dirs:
+                dirs.append(d)
+    return dirs
+
+
+def served_name(payload_name: str) -> str:
+    """The name NVRTC is asked to resolve for a payload entry — what a REAL
+    ``#include`` directive spells. ``aether/...``/``plugin/...`` entries are
+    ``#include``d by that exact prefixed name, so they serve unchanged; an
+    ``rtc/<std name>`` shim is never included by that stored path itself — it
+    satisfies aether's own plain ``#include <cstdint>`` et al., so it must be
+    offered under the bare std name with the ``rtc/`` storage prefix
+    stripped (NVRTC's header lookup is an exact string match)."""
+    return payload_name.split("/", 1)[1] if payload_name.startswith("rtc/") else payload_name
+
+
+def check_headers_nvrtc_clean(headers: Mapping[str, bytes], *,
+                               cccl_include: str | None = None,
+                               options: list[str] | None = None,
+                               exclude_from_toplevel: frozenset[str] = frozenset(),
+                               ) -> list[str]:
+    """Compile ONE synthetic TU ``#include``-ing every TOP-LEVEL name in
+    ``headers`` (sorted, for a reproducible diagnostic order) through NVRTC,
+    serving every name from ``headers`` itself — never from disk — under its
+    :func:`served_name`. Only ``aether/...``/``plugin/...`` entries not in
+    ``exclude_from_toplevel`` are ``#include``d directly; ``rtc/...`` shims
+    are reachable only indirectly, exactly as real aether source reaches
+    them.
+
+    ``exclude_from_toplevel`` is for an entry that is served (resolvable if
+    something reaches it) but never itself the subject of the NVRTC-clean
+    claim — see :mod:`aether_dsc._seal_impl`'s ``GREF_ABI_HOST_NAME`` for
+    the one case this applies to.
+
+    Returns the NVRTC log's diagnostic lines (empty means the claim holds);
+    raises only on an environment failure (no NVRTC binding, no CCCL) that
+    is not itself the thing under test.
+    """
+    from cuda.bindings import nvrtc  # function-local: only a real check pays for this
+
+    cccl_include = cccl_include or cccl_include_dir()
+    opts = list(options or _default_options(nvrtc)) + [f"-I{cccl_include}"]
+    names = sorted(headers)
+    top_level = [n for n in names
+                 if not n.startswith("rtc/") and n not in exclude_from_toplevel]
+    src = "".join(f'#include "{n}"\n' for n in top_level)
+    src += "\n// reachability only — the TU need not use anything.\n"
+
+    _, prog = nvrtc.nvrtcCreateProgram(
+        src.encode(), b"rtc_seal_check.cu",
+        len(names), [headers[n] for n in names],
+        [served_name(n).encode() for n in names])
+    try:
+        nvrtc.nvrtcCompileProgram(prog, len(opts), [o.encode() for o in opts])
+        _, log_size = nvrtc.nvrtcGetProgramLogSize(prog)
+        log_buf = bytearray(log_size)
+        nvrtc.nvrtcGetProgramLog(prog, log_buf)
+        log = bytes(log_buf).decode(errors="replace").rstrip("\x00")
+    finally:
+        nvrtc.nvrtcDestroyProgram(prog)
+    return [line for line in log.splitlines()
+            if line.strip() and not _is_target_deprecation_notice(line)]
+
+
+def _is_target_deprecation_notice(line: str) -> bool:
+    """NVRTC 12.x warns that pre-sm_75 targets are deprecated. That notice is about
+    the toolkit's support window for the chosen ``-arch``, not about the headers
+    under test, so it never counts against the NVRTC-clean claim."""
+    return "Architectures prior to" in line and "are deprecated" in line

aether_dsc/_seal_impl.py

@@ -0,0 +1,175 @@
+# Copyright 2026 Alessandro Masat
+# SPDX-License-Identifier: Apache-2.0
+
+"""The real `seal()` implementation, kept out of `aether_dsc/seal.py` on
+purpose: that file is `python -m aether_dsc.seal`'s CLI entry point, and
+Python sets `aether_dsc.seal` to the MODULE object the moment anything
+does `import aether_dsc.seal` (exactly what running it as `-m` does
+internally) — which would silently shadow a `seal` FUNCTION of the same
+name re-exported through `aether_dsc/__init__.py` (`aether_dsc.seal`
+would stop being callable). Splitting the implementation into its own
+module and having BOTH `aether_dsc/__init__.py` and `aether_dsc/seal.py`
+import it from here (never from each other) means both `seal` spellings —
+the function `aether_dsc.seal(*roots)` and the CLI
+`python -m aether_dsc.seal` — can coexist.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Mapping
+
+from . import _rtc_check as _tools
+from ._core import Payload, PAYLOAD_DIR, _pack, digest_of
+
+__all__ = ["seal", "seal_and_write"]
+
+#: This checkout's own repo root (`aether_dsc/_seal_impl.py` -> `aether_dsc/`
+#: -> `dsc/` -> the `aether` repo root) and its workspace parent — the same
+#: "the four *-abi worktrees and aether hang off one directory" convention
+#: `hawk._roots.WORKSPACE` documents. Used only to DEFAULT `seal()`'s own
+#: `aether_root`/`layout_header` arguments to THIS checkout — never to reach
+#: outside the package for logic, which now lives entirely in `_rtc_check`
+#: (`aether_dsc` mutates no `sys.path` and needs nothing on disk outside
+#: its own package directory to be imported, only to seal).
+_AETHER_REPO_ROOT = Path(__file__).resolve().parents[2]
+_WORKSPACE = _AETHER_REPO_ROOT.parent
+
+
+#: Served, never force-#include'd by the NVRTC-clean check (see
+#: `tools.check_headers_nvrtc_clean`'s `exclude_from_toplevel` docstring):
+#: eagle's real `plugin/gref_abi.h` reaches `<stdexcept>`/`<string>`, so it is
+#: sealed for the host `-I <served root>` path only. `hawk.compile.nvrtc`'s
+#: own NVRTC serving layer answers a request for this exact name with
+#: `plugin/gref_layout.h`'s bytes instead (`GREF_ABI_ALIAS_NAME`) — hawk's
+#: emitted prelude text spells `#include "plugin/gref_abi.h"` on both
+#: backends unconditionally, and that string is pinned byte-for-byte by
+#: read-only corpora that must not change independently: hawk's own
+#: `tests/test_index_width.py::test_the_mandated_include_order_is_aether_first`
+#: and the golden kernel sources of its consumers. The
+#: substitution is transparent to what a device kernel actually computes: it
+#: never reaches `gref_abi.h`'s host-only validation functions, only the
+#: mirror PODs/constants both files carry identically.
+GREF_ABI_HOST_NAME = "plugin/gref_abi.h"
+
+
+def _default_layout_header() -> Path:
+    """`eagle/plugin/gref_layout.h` from the sibling eagle checkout under this
+    workspace. `aether_dsc` depends on this ONE file from eagle (not on eagle
+    as a whole): the sealed payload must carry it because a HAWK-emitted
+    device kernel `#include`s it, and nothing else about eagle belongs in an
+    AETHER payload.
+    """
+    for name in ("eagle", "eagle-abi"):
+        candidate = _WORKSPACE / name / "plugin" / "gref_layout.h"
+        if candidate.is_file():
+            return candidate
+    raise FileNotFoundError(
+        "seal(): no eagle checkout with plugin/gref_layout.h found under "
+        f"{_WORKSPACE} — pass layout_header= explicitly, or check out eagle as "
+        "a sibling of this aether checkout")
+
+
+def seal(aether_root: str | Path | None = None,
+         rtc_dir: str | Path | None = None,
+         layout_header: str | Path | None = None) -> Payload:
+    """Build a fresh :class:`~aether_dsc._core.Payload` from headers on disk.
+    Every argument defaults to THIS checkout's own paths,
+    so a bare `seal()` reproduces exactly what `python -m aether_dsc.seal`
+    ships; a caller with a different aether install (`hawk.compile.toolchain
+    .aether_include()`'s resolved root, when it differs from this checkout)
+    passes its own roots instead.
+
+    * `aether_root` — an aether INCLUDE ROOT: a directory such that
+      `aether_root/aether/<name>` are the library's own headers, exactly
+      what a compiler resolves for `#include <aether/...>` against
+      `-I aether_root`. Only the paths listed in this PACKAGE's own
+      `aether_dsc/payload_headers.txt` (the NVRTC-clean manifest, shipped
+      as package data — see that file's header comment for why a manifest,
+      not a directory walk: aether/ holds headers not yet claimed to be
+      NVRTC-clean) are sealed from this root — never a blind walk of
+      everything under it.
+    * `rtc_dir` — the directory of the seven NVRTC std shims; every one
+      becomes a payload header named `"rtc/<filename>"`.
+    * `layout_header` — the path to eagle's `plugin/gref_layout.h`;
+      sealed as exactly `"plugin/gref_layout.h"`. Its own directory is also
+      where eagle's REAL host-only `gref_abi.h` is found, sealed as
+      :data:`GREF_ABI_HOST_NAME` for the host `-I` path (see that constant's
+      docstring — NVRTC never receives it under this content, only under an
+      alias to `gref_layout.h`'s bytes).
+
+    A second, HOST-ONLY set of headers — this package's own
+    `payload_headers_host.txt` manifest — is sealed into the SAME payload
+    alongside the above: never claimed NVRTC-clean (excluded from
+    :func:`seal_and_write`'s gate entirely, not merely from its
+    force-`#include` set) and never served to an NVRTC compile
+    (:attr:`~aether_dsc._core.Payload.device_headers` excludes them), but
+    served to a host `-I` root exactly like every other entry
+    (:meth:`~aether_dsc._core.Payload.serve`). Resolved from the SAME
+    `aether_root`, since both manifests name files under one aether
+    checkout.
+
+    Raises `FileNotFoundError` naming the missing file when a manifested
+    header, a shim, or a layout/abi header is not where expected — never
+    silently seals a smaller payload than either manifest promises.
+    """
+    root = Path(aether_root) if aether_root is not None else _AETHER_REPO_ROOT
+    rtc = Path(rtc_dir) if rtc_dir is not None else (_AETHER_REPO_ROOT / "rtc")
+    layout = Path(layout_header) if layout_header is not None else _default_layout_header()
+    abi = layout.parent / "gref_abi.h"
+
+    headers: dict[str, bytes] = {}
+    for rel in _tools.manifest_paths():
+        f = root / rel
+        if not f.is_file():
+            raise FileNotFoundError(f"seal(): manifested header missing: {f}")
+        headers[rel] = f.read_bytes()
+    for name in _tools.RTC_SHIM_NAMES:
+        f = rtc / name
+        if not f.is_file():
+            raise FileNotFoundError(f"seal(): NVRTC shim missing: {f}")
+        headers[f"rtc/{name}"] = f.read_bytes()
+    if not layout.is_file():
+        raise FileNotFoundError(f"seal(): eagle layout header missing: {layout}")
+    if not abi.is_file():
+        raise FileNotFoundError(f"seal(): eagle host-abi header missing: {abi}")
+    headers["plugin/gref_layout.h"] = layout.read_bytes()
+    headers[GREF_ABI_HOST_NAME] = abi.read_bytes()
+
+    host_only_names = frozenset(_tools.host_only_manifest_paths())
+    for rel in host_only_names:
+        f = root / rel
+        if not f.is_file():
+            raise FileNotFoundError(f"seal(): host-only manifested header missing: {f}")
+        headers[rel] = f.read_bytes()
+
+    return Payload(digest_of(headers), headers, host_only_names)
+
+
+def seal_and_write(headers: Mapping[str, bytes],
+                   host_only_names: frozenset[str] = frozenset()) -> Path:
+    """Runs the NVRTC-clean gate over the NVRTC-clean section ONLY, then
+    writes `_payload/<digest>.bin` — refuses to write a payload that fails
+    the gate. Removes any stale blob first: `aether_dsc.payload()` globs
+    `_payload/*.bin` and would otherwise have two candidates after a
+    re-seal that changed the digest.
+
+    `host_only_names` — `headers` entries never passed to the gate at all
+    (not merely excluded from its force-#include set, the way
+    `GREF_ABI_HOST_NAME` is — see its own docstring): the host-only section
+    is never claimed NVRTC-clean and the gate never even sees its content.
+    """
+    nvrtc_headers = ({k: v for k, v in headers.items() if k not in host_only_names}
+                     if host_only_names else headers)
+    diagnostics = _tools.check_headers_nvrtc_clean(
+        nvrtc_headers, exclude_from_toplevel=frozenset({GREF_ABI_HOST_NAME}))
+    if diagnostics:
+        raise RuntimeError(
+            "NVRTC-clean check FAILED: the sealed payload does not compile clean under NVRTC "
+            f"({len(diagnostics)} diagnostic line(s)):\n" + "\n".join(diagnostics))
+    digest = digest_of(headers)
+    PAYLOAD_DIR.mkdir(parents=True, exist_ok=True)
+    for stale in PAYLOAD_DIR.glob("*.bin"):
+        stale.unlink()
+    blob_path = PAYLOAD_DIR / f"{digest}.bin"
+    blob_path.write_bytes(_pack(headers, host_only_names))
+    return blob_path

aether_dsc/payload_headers.txt

@@ -0,0 +1,69 @@
+# NVRTC-clean payload manifest — committed, sorted, one path per line, same
+# discipline as tests/expected_tests_*.txt: a manifest, not a count, so a
+# same-commit swap cannot pass silently.
+#
+# Every aether header listed here is claimed NVRTC-clean (the seven rtc/
+# shims, AETHER_BITCOPY, no offsetof-in-constant-expression) and
+# `tools/rtc_seal_check.py` gates that claim on every run. This is the
+# ground-truth closure measured for `benchmarks._hawk_arm.grav_body` (hawk
+# repo) via a real `nvcc -MD` build — not a directory walk: measured,
+# ~28 other aether headers (aether/accum/, aether/banded/,
+# aether/chunk/, aether/interop/, aether/residency/, aether/backend/,
+# aether/err/, aether/dtype/Format.h, some aether/view/Make*.h) reach std
+# headers the rtc/ shim set does not cover (<algorithm>, <cstring>,
+# <stdexcept>, DLPack's own includes) — profiling them is deliberately out
+# of scope here; the manifest grows deliberately, one committed line at a
+# time, exactly like the test-count manifests: add a path, run this
+# script, commit the diff.
+#
+# `aether/aether.h` (the umbrella) is deliberately not listed: it
+# transitively includes every one of the ~28 excluded headers, so it is
+# not yet part of the payload either.
+aether/device.h
+aether/device/Device.h
+aether/dtype/DType.h
+aether/dtype/Fetch.h
+aether/dtype/WorkingType.h
+aether/dtype/dlpack.h
+aether/expr/Assign.h
+aether/expr/Expression.h
+aether/expr/Operations.h
+aether/expr/Reduce.h
+aether/expr/nodes/Arithmetic.h
+aether/expr/nodes/Constant.h
+aether/expr/nodes/Elementwise.h
+aether/expr/nodes/Geometric.h
+aether/expr/nodes/Inverse.h
+aether/expr/nodes/Product.h
+aether/expr/nodes/Quaternion.h
+aether/expr/nodes/Structural.h
+aether/index/BundleIndex.h
+aether/index/Offset.h
+aether/index/SampleIndex.h
+aether/layout/Extents.h
+aether/layout/Layout.h
+aether/layout/detail/Carray.h
+aether/macros.h
+aether/math/detail/BandedFwd.h
+aether/math/detail/BoundedTrig.h
+aether/math/detail/HostVectorMathRoute.h
+aether/math/detail/MathDispatch.h
+aether/math/detail/MathDispatchUndef.h
+aether/math/explog.h
+aether/math/hyperbolic.h
+aether/math/invtrig.h
+aether/math/math.h
+aether/math/root.h
+aether/math/round.h
+aether/math/special.h
+aether/math/trig.h
+aether/random/detail/Backend.h
+aether/random/detail/Philox.h
+aether/typedefs.h
+aether/view/Item.h
+aether/view/Reshape.h
+aether/view/RuntimeView.h
+aether/view/TableHandle.h
+aether/view/TableView.h
+aether/view/View.h
+aether/view/WorkView.h

aether_dsc/payload_headers_host.txt

@@ -0,0 +1,32 @@
+# Host-only payload manifest — committed, sorted, one path per line, same
+# discipline as payload_headers.txt (and the test-count manifests): a
+# manifest, not a directory walk.
+#
+# These headers are sealed into the SAME payload as payload_headers.txt's
+# NVRTC-clean set, but are a SEPARATE section: never claimed NVRTC-clean,
+# never handed to an NVRTC compile at all (`Payload.device_headers` excludes
+# every name listed here; only `Payload.headers`/`Payload.serve()`, the HOST
+# `-I` path, carries them). Growing this manifest does not touch the NVRTC
+# gate (`aether/tools/rtc_seal_check.py`, `aether_dsc._rtc_check
+# .manifest_paths`) at all — a wholly separate list, checked by nothing but
+# "does this file exist under the aether root being sealed".
+#
+# Ground truth: the real dependency closure of
+# `aether/math/detail/HostVectorMath.h` under `-DAETHER_HOST_VECTOR_MATH`,
+# measured via a real `g++ -MD` build of a hawk-emitted host
+# kernel (`osc_step`-shaped) with hawk's own host flags
+# (`hawk.compile.toolchain.host_flags()`) against a real aether checkout —
+# not a directory walk. `HostVectorMathRoute.h` (already in
+# payload_headers.txt) `#include`s `HostVectorMath.h` only when
+# `AETHER_HOST_VECTOR_MATH` is defined and the pass is not `__CUDACC__`, so
+# NVRTC never reaches these headers through any real include chain either;
+# the exclusion here is belt-and-braces, not a response to an NVRTC failure
+# ever observed.
+aether/backend/cpu/simd/math/PacketArcTrig.h
+aether/backend/cpu/simd/math/PacketExpLog.h
+aether/backend/cpu/simd/math/PacketHyperbolic.h
+aether/backend/cpu/simd/math/PacketMathCore.h
+aether/backend/cpu/simd/math/PacketMisc.h
+aether/backend/cpu/simd/math/PacketRounding.h
+aether/backend/cpu/simd/math/PacketSinCos.h
+aether/math/detail/HostVectorMath.h

aether_dsc/seal.py

@@ -0,0 +1,47 @@
+# Copyright 2026 Alessandro Masat
+# SPDX-License-Identifier: Apache-2.0
+
+"""`python -m aether_dsc.seal` — the packaging CLI.
+
+Seals this repository's own checkout, runs the NVRTC-clean gate (every
+payload header must compile under NVRTC with zero diagnostics), and only
+then writes `aether_dsc/_payload/<digest>.bin` — a payload that fails the
+gate is refused, never shipped silently broken. The actual sealing logic
+lives in :mod:`aether_dsc._seal_impl` (see that module's docstring for
+why: this file being importable as `aether_dsc.seal` — which `-m` does
+internally — would otherwise shadow the `aether_dsc.seal(*roots)`
+function exposed from `aether_dsc/__init__.py`).
+
+    python -m aether_dsc.seal
+"""
+from __future__ import annotations
+
+import sys
+
+from ._seal_impl import seal, seal_and_write
+
+__all__ = ["main"]
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Seal this checkout, gate it on the NVRTC-clean check, write the
+    blob. Prints the outcome; exit 0 on a written blob, 1 on a gate
+    failure or a missing input file."""
+    del argv  # no options today — the CLI seals exactly this checkout
+    try:
+        p = seal()
+    except FileNotFoundError as exc:
+        print(f"RED: {exc}", file=sys.stderr)
+        return 1
+    try:
+        blob_path = seal_and_write(p.headers, p.host_only_names)
+    except RuntimeError as exc:
+        print(f"RED: {exc}", file=sys.stderr)
+        return 1
+    print(f"GREEN: sealed {len(p.headers)} headers "
+          f"({len(p.host_only_names)} host-only), digest {p.digest[:16]}… -> {blob_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

aether_dsc-0.2.0.dist-info/METADATA

@@ -0,0 +1,60 @@
+Metadata-Version: 2.4
+Name: aether-dsc
+Version: 0.2.0
+Summary: aether-dsc — the sealed AETHER header payload: opaque, digest-named, no readable source in the wheel
+Author: Alessandro Masat
+License: Apache-2.0
+Project-URL: Homepage, https://github.com/amasat01/aether
+Project-URL: Documentation, https://amasat01.github.io/aether/
+Project-URL: Repository, https://github.com/amasat01/aether
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Provides-Extra: test
+Requires-Dist: pytest; extra == "test"
+Dynamic: license-file
+
+# aether-dsc
+
+The sealed AETHER header payload.
+
+## What the payload is
+
+aether ships to Python-only users as ONE opaque, digest-named blob instead of
+readable headers inside a wheel's include tree. `aether_dsc.payload()`
+returns a `Payload(digest, headers)`: `digest` is a sha256 over the sorted
+`(name, bytes)` pairs of `headers`; `headers` maps include-relative names
+(`aether/...`, `rtc/<std name>`, `plugin/gref_layout.h`, `plugin/gref_abi.h`)
+to bytes — the exact set an NVRTC-compiled HAWK device kernel needs, plus
+what a host compiler needs through `Payload.serve()`.
+
+Two consumers: **device** — NVRTC compiles a kernel straight from
+`payload().headers`, in memory, nothing written to disk; **host, or any
+file-only compiler** — `payload().serve()` is a context manager materialising
+the headers into a private, owner-only (`0700`) RAM directory (`/dev/shm`
+when it is a tmpfs, else `$TMPDIR`), removed on both the normal exit path
+AND a `with`-block exception.
+
+## How to seal one
+
+```bash
+python -m aether_dsc.seal
+```
+Reads this checkout's aether headers — scoped to the committed manifest
+`aether_dsc/payload_headers.txt` (package data, not every file under
+`aether/` — see that file's comment for why) — the seven `rtc/` shims, and
+the sibling `eagle` checkout's `plugin/gref_layout.h` + `plugin/gref_abi.h`
+(host path only — NVRTC gets an alias to the layout header's bytes instead);
+runs the NVRTC-clean gate (every device-reachable header compiles under
+NVRTC with zero diagnostics); only then writes
+`aether_dsc/_payload/<digest>.bin` — a payload failing the gate is
+refused, never shipped silently broken.
+
+## Opacity, not secrecy
+
+The blob is a zlib-compressed tar — not obfuscation against a determined
+reader, just enough that `strings`/`cat` on the wheel does not hand back
+readable C++ source.

aether_dsc-0.2.0.dist-info/RECORD

@@ -0,0 +1,14 @@
+aether_dsc/__init__.py,sha256=BTSt5dDWg5nkzSB10YofaPEeynrNF8DNDLmuqkdobgI,4553
+aether_dsc/_core.py,sha256=GGlSbrMKHaH-d0ddccBFqJzq_nFNSxRURUcSPTTySzw,8561
+aether_dsc/_rtc_check.py,sha256=fWJRkwRY6qtyOyhkIJbZmoF0-UcZIuPw5bi9rQhVE6c,12339
+aether_dsc/_seal_impl.py,sha256=byfbFycI7_1IApC83weY4ysrC9YyGw9hBUF_66EsTKY,9017
+aether_dsc/payload_headers.txt,sha256=SRafdxuFrnj-jCvBia-SpOAhsspdd_TBvrbIMSvwIBo,2460
+aether_dsc/payload_headers_host.txt,sha256=r0m51s0dr6eSDV3kKPjqXldPw1uIM8m63Q5jnUZzygg,1800
+aether_dsc/seal.py,sha256=iE2i4B8xXKRaSONq7dgIAOsNmeahHHBQQH91UrFgj0s,1646
+aether_dsc/_payload/a9c89146169d59183c41dba2a050a420a5f3dd40729154ae547b61a2239c38b8.bin,sha256=4UjU0YpFv530FyQaUlisxNvwQlLoW7TQqmTss3CGFZY,130534
+aether_dsc-0.2.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+aether_dsc-0.2.0.dist-info/licenses/NOTICE,sha256=cvnGaTwoxgk98Vzj3SGSL_72LeoEyYZhETfzaUitL3k,39
+aether_dsc-0.2.0.dist-info/METADATA,sha256=sqYtN4t_Q9PW_jtZR9Wt7bUuFfDYRdPQtizDF46QJPA,2529
+aether_dsc-0.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+aether_dsc-0.2.0.dist-info/top_level.txt,sha256=KBrIE6wia1rnS9vjcp7fsNUP8P1Zsq_T6K1tYJPBuwc,11
+aether_dsc-0.2.0.dist-info/RECORD,,

aether_dsc-0.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

aether_dsc-0.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

aether_dsc-0.2.0.dist-info/licenses/NOTICE

@@ -0,0 +1,2 @@
+aether
+Copyright 2026 Alessandro Masat

aether_dsc-0.2.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+aether_dsc