authweave-webhooks 7.1.2__tar.gz

authweave_webhooks-7.1.2/.gitignore

@@ -0,0 +1,36 @@
+# macOS
+.DS_Store
+
+# Python bytecode and native build products
+__pycache__/
+*.py[cod]
+*.so
+
+# Local environments and secrets
+/.venv/
+/.uv-cache/
+.env
+.env.*
+!.env.example
+
+# Packaging output
+/build/
+/dist/
+*.egg-info/
+
+# Test, coverage, and tool caches
+.coverage
+.coverage.*
+/coverage.xml
+/htmlcov/
+/.pytest_cache/
+/.ruff_cache/
+/.cache/
+
+# Generated documentation and code intelligence
+/site/
+/docs/_include/
+/.codegraph/
+
+# Docker reference ephemeral key material
+/docker/reference/http-signatures/_runtime/

authweave_webhooks-7.1.2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vladislav Shepilov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

authweave_webhooks-7.1.2/PKG-INFO

@@ -0,0 +1,122 @@
+Metadata-Version: 2.4
+Name: authweave-webhooks
+Version: 7.1.2
+Summary: Asymmetric Standard Webhooks toolkit for AuthWeave integrations
+Project-URL: homepage, https://github.com/ZYLVEXT/litestar-auth
+Project-URL: documentation, https://zylvext.github.io/litestar-auth/
+Project-URL: source, https://github.com/ZYLVEXT/litestar-auth
+Project-URL: tracker, https://github.com/ZYLVEXT/litestar-auth/issues
+Author-email: Vladislav Shepilov <shepilov.v@protonmail.com>
+Maintainer-email: Vladislav Shepilov <shepilov.v@protonmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: authentication,ed25519,security,standard-webhooks,webhooks
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries
+Requires-Python: <3.15.0,>=3.12.0
+Requires-Dist: authweave-core==7.1.2
+Requires-Dist: cryptography<51.0,>=50.0.0
+Provides-Extra: httpx
+Requires-Dist: httpx<1.0,>=0.28.1; extra == 'httpx'
+Provides-Extra: litestar
+Requires-Dist: litestar<3.0,>=2.24.0; extra == 'litestar'
+Provides-Extra: redis
+Requires-Dist: redis<9.0,>=8.1.0; extra == 'redis'
+Description-Content-Type: text/markdown
+
+# authweave-webhooks
+
+Asymmetric Standard Webhooks toolkit for AuthWeave integrations
+(`authweave-standard-webhooks-v1a` Ed25519 profile).
+
+This package does **not** depend on `litestar-auth` and is not authentication
+middleware. It verifies or produces webhook deliveries before JSON parsing.
+
+```bash
+uv add 'authweave-webhooks[redis]'
+```
+
+```python
+from authweave_webhooks import (
+    Ed25519PublicKey,
+    PublicKeyDocument,
+    StandardWebhooksVerifier,
+    StaticPublicKeyResolver,
+)
+from authweave_webhooks.redis_store import RedisReplayStore
+
+resolver = StaticPublicKeyResolver(
+    PublicKeyDocument(
+        version="1",
+        environment="sandbox",
+        owner="merchant-1",
+        endpoint="https://merchant.example/hooks/payments",
+        not_before=0,
+        retire_after=None,
+        keys=(Ed25519PublicKey(public_key),),
+    )
+)
+verifier = StandardWebhooksVerifier(
+    resolver,
+    replay_store=RedisReplayStore(redis),
+    expected_environment="sandbox",
+    expected_owner="merchant-1",
+    expected_endpoint="https://merchant.example/hooks/payments",
+    time_source=lambda: 1_700_000_000,
+)
+verified = await verifier.verify(headers=headers, body=raw_body)
+```
+
+The replay store is mandatory. After a signature succeeds, `verify()` atomically
+claims the `webhook-id` in a namespace derived from environment, owner, endpoint,
+and id. The library derives a TTL that covers the complete inclusive timestamp
+acceptance window; replay-store outage or capacity pressure fails verification
+closed. A repeated valid delivery is returned with `verified.replay_detected=True`;
+the flag is telemetry, not business idempotency.
+
+After **every** successful verification, atomically insert the complete raw body
+and verified metadata into a durable inbox with a unique key over environment,
+owner, endpoint, and `webhook_id`. Never overwrite an existing row, and acknowledge
+the HTTP delivery only after that transaction commits. A retry can then restore an
+inbox row missing after a crash, while a committed row absorbs concurrent or later
+retries. Use a shared replay store such as Redis in multi-worker deployments.
+
+Pass an optional core `SecurityObserver` to the verifier or HTTP sender to emit
+bounded verification/replay/delivery telemetry. Retry and queue consumers may
+pass `TraceCorrelation` values through `links=`; trace context is correlation
+only and is never accepted as identity.
+
+`HttpxWebhookSender` requires a non-empty exact endpoint allowlist, disables
+redirects, and streams at most 65,536 response bytes. The application must also
+place its HTTP client behind the controlled egress proxy/subnet described in the
+merchant sender threat model; DNS safety is not inferred from HTTPS syntax.
+
+```python
+from authweave_webhooks.sender import HttpxWebhookSender
+
+sender = HttpxWebhookSender(
+    httpx_client,
+    allowed_endpoints={"https://merchant.example/hooks/payments"},
+)
+result = await sender.send(endpoint=merchant_endpoint, delivery=delivery)
+```
+
+## Extras
+
+- `[redis]` — shared `RedisReplayStore` for fail-closed verification
+- `[httpx]` — one-shot HTTPS sender without auto-retry
+- `[litestar]` — raw-body verification helper
+
+Private keys stay inside `AsyncMessageSigner` implementations. The library never
+accepts private key bytes on verifier APIs and keeps secrets out of `repr` /
+error messages.
+
+See `docs/roadmap.md`, `docs/merchant/webhooks.md`, the sender threat model, and
+ADR 0002 for key-tenancy and egress rules. Language-neutral vectors plus Python
+and dependency-free Node.js verifiers live in `docs/vectors/webhooks/v1a/`.

authweave_webhooks-7.1.2/README.md

@@ -0,0 +1,90 @@
+# authweave-webhooks
+
+Asymmetric Standard Webhooks toolkit for AuthWeave integrations
+(`authweave-standard-webhooks-v1a` Ed25519 profile).
+
+This package does **not** depend on `litestar-auth` and is not authentication
+middleware. It verifies or produces webhook deliveries before JSON parsing.
+
+```bash
+uv add 'authweave-webhooks[redis]'
+```
+
+```python
+from authweave_webhooks import (
+    Ed25519PublicKey,
+    PublicKeyDocument,
+    StandardWebhooksVerifier,
+    StaticPublicKeyResolver,
+)
+from authweave_webhooks.redis_store import RedisReplayStore
+
+resolver = StaticPublicKeyResolver(
+    PublicKeyDocument(
+        version="1",
+        environment="sandbox",
+        owner="merchant-1",
+        endpoint="https://merchant.example/hooks/payments",
+        not_before=0,
+        retire_after=None,
+        keys=(Ed25519PublicKey(public_key),),
+    )
+)
+verifier = StandardWebhooksVerifier(
+    resolver,
+    replay_store=RedisReplayStore(redis),
+    expected_environment="sandbox",
+    expected_owner="merchant-1",
+    expected_endpoint="https://merchant.example/hooks/payments",
+    time_source=lambda: 1_700_000_000,
+)
+verified = await verifier.verify(headers=headers, body=raw_body)
+```
+
+The replay store is mandatory. After a signature succeeds, `verify()` atomically
+claims the `webhook-id` in a namespace derived from environment, owner, endpoint,
+and id. The library derives a TTL that covers the complete inclusive timestamp
+acceptance window; replay-store outage or capacity pressure fails verification
+closed. A repeated valid delivery is returned with `verified.replay_detected=True`;
+the flag is telemetry, not business idempotency.
+
+After **every** successful verification, atomically insert the complete raw body
+and verified metadata into a durable inbox with a unique key over environment,
+owner, endpoint, and `webhook_id`. Never overwrite an existing row, and acknowledge
+the HTTP delivery only after that transaction commits. A retry can then restore an
+inbox row missing after a crash, while a committed row absorbs concurrent or later
+retries. Use a shared replay store such as Redis in multi-worker deployments.
+
+Pass an optional core `SecurityObserver` to the verifier or HTTP sender to emit
+bounded verification/replay/delivery telemetry. Retry and queue consumers may
+pass `TraceCorrelation` values through `links=`; trace context is correlation
+only and is never accepted as identity.
+
+`HttpxWebhookSender` requires a non-empty exact endpoint allowlist, disables
+redirects, and streams at most 65,536 response bytes. The application must also
+place its HTTP client behind the controlled egress proxy/subnet described in the
+merchant sender threat model; DNS safety is not inferred from HTTPS syntax.
+
+```python
+from authweave_webhooks.sender import HttpxWebhookSender
+
+sender = HttpxWebhookSender(
+    httpx_client,
+    allowed_endpoints={"https://merchant.example/hooks/payments"},
+)
+result = await sender.send(endpoint=merchant_endpoint, delivery=delivery)
+```
+
+## Extras
+
+- `[redis]` — shared `RedisReplayStore` for fail-closed verification
+- `[httpx]` — one-shot HTTPS sender without auto-retry
+- `[litestar]` — raw-body verification helper
+
+Private keys stay inside `AsyncMessageSigner` implementations. The library never
+accepts private key bytes on verifier APIs and keeps secrets out of `repr` /
+error messages.
+
+See `docs/roadmap.md`, `docs/merchant/webhooks.md`, the sender threat model, and
+ADR 0002 for key-tenancy and egress rules. Language-neutral vectors plus Python
+and dependency-free Node.js verifiers live in `docs/vectors/webhooks/v1a/`.

authweave_webhooks-7.1.2/authweave_webhooks/__init__.py

@@ -0,0 +1,52 @@
+"""Asymmetric Standard Webhooks toolkit for AuthWeave integrations."""
+
+from authweave_webhooks.errors import WebhookFailureCode, WebhookVerificationError
+from authweave_webhooks.headers import build_signing_input, format_signature_header, parse_headers
+from authweave_webhooks.keys import PublicKeyResolver, StaticPublicKeyResolver
+from authweave_webhooks.models import (
+    DEFAULT_TIMESTAMP_TOLERANCE_SECONDS,
+    HEADER_ID,
+    HEADER_SIGNATURE,
+    HEADER_TIMESTAMP,
+    MAX_BODY_BYTES,
+    MAX_PUBLIC_KEYS,
+    MAX_SIGNATURES,
+    MAX_WEBHOOK_ID_LENGTH,
+    SIGNATURE_VERSION,
+    Ed25519PublicKey,
+    PublicKeyDocument,
+    VerifiedWebhook,
+    WebhookDelivery,
+)
+from authweave_webhooks.signer import AsyncMessageSigner, LocalEd25519KeyringSigner, create_delivery
+from authweave_webhooks.verify import StandardWebhooksVerifier
+
+__version__ = "7.1.2"
+
+__all__ = (
+    "DEFAULT_TIMESTAMP_TOLERANCE_SECONDS",
+    "HEADER_ID",
+    "HEADER_SIGNATURE",
+    "HEADER_TIMESTAMP",
+    "MAX_BODY_BYTES",
+    "MAX_PUBLIC_KEYS",
+    "MAX_SIGNATURES",
+    "MAX_WEBHOOK_ID_LENGTH",
+    "SIGNATURE_VERSION",
+    "AsyncMessageSigner",
+    "Ed25519PublicKey",
+    "LocalEd25519KeyringSigner",
+    "PublicKeyDocument",
+    "PublicKeyResolver",
+    "StandardWebhooksVerifier",
+    "StaticPublicKeyResolver",
+    "VerifiedWebhook",
+    "WebhookDelivery",
+    "WebhookFailureCode",
+    "WebhookVerificationError",
+    "__version__",
+    "build_signing_input",
+    "create_delivery",
+    "format_signature_header",
+    "parse_headers",
+)

authweave_webhooks-7.1.2/authweave_webhooks/errors.py

@@ -0,0 +1,34 @@
+"""Typed errors and outcomes for Standard Webhooks verification."""
+
+from __future__ import annotations
+
+from enum import StrEnum
+
+
+class WebhookFailureCode(StrEnum):
+    """Bounded failure codes returned to callers without key-discrimination detail."""
+
+    MALFORMED_HEADERS = "malformed_headers"
+    DUPLICATE_HEADER = "duplicate_header"
+    BODY_TOO_LARGE = "body_too_large"
+    TIMESTAMP_INVALID = "timestamp_invalid"
+    TIMESTAMP_OUT_OF_TOLERANCE = "timestamp_out_of_tolerance"
+    SIGNATURE_INVALID = "signature_invalid"
+    KEY_UNAVAILABLE = "key_unavailable"
+    ENVIRONMENT_MISMATCH = "environment_mismatch"
+    OWNER_MISMATCH = "owner_mismatch"
+    ENDPOINT_MISMATCH = "endpoint_mismatch"
+    STORE_UNAVAILABLE = "store_unavailable"
+
+
+class WebhookVerificationError(Exception):
+    """Fail-closed verification error with a secret-free bounded code."""
+
+    def __init__(self, code: WebhookFailureCode) -> None:
+        """Bind the public failure code without embedding raw material."""
+        self.code = code
+        super().__init__(code.value)
+
+    def __repr__(self) -> str:
+        """Return a secret-free representation."""
+        return f"WebhookVerificationError(code={self.code!r})"

authweave_webhooks-7.1.2/authweave_webhooks/headers.py

@@ -0,0 +1,135 @@
+"""Bounded Standard Webhooks header and signing-input helpers."""
+
+from __future__ import annotations
+
+import base64
+import re
+from collections.abc import Mapping
+from dataclasses import dataclass, field
+
+from authweave_webhooks.errors import WebhookFailureCode, WebhookVerificationError
+from authweave_webhooks.models import (
+    ED25519_SIGNATURE_BYTES,
+    HEADER_ID,
+    HEADER_SIGNATURE,
+    HEADER_TIMESTAMP,
+    MAX_BODY_BYTES,
+    MAX_SIGNATURES,
+    MAX_WEBHOOK_ID_LENGTH,
+    SIGNATURE_VERSION,
+)
+
+_ID_PATTERN = re.compile(r"^[A-Za-z0-9_-]+$")
+_TIMESTAMP_PATTERN = re.compile(r"^[0-9]+$")
+
+
+@dataclass(frozen=True, slots=True)
+class ParsedWebhookHeaders:
+    """Exactly one id, timestamp, and signature list after duplicate rejection."""
+
+    webhook_id: str
+    timestamp: int
+    signatures: tuple[bytes, ...] = field(repr=False)
+
+
+def build_signing_input(*, webhook_id: str, timestamp: int, body: bytes) -> bytes:
+    """Build the Standard Webhooks signed byte sequence.
+
+    Returns:
+        ASCII ``webhook-id.timestamp.`` concatenated with the exact raw body.
+    """
+    prefix = f"{webhook_id}.{timestamp}.".encode("ascii")
+    return prefix + body
+
+
+def parse_headers(
+    headers: Mapping[str, str] | list[tuple[str, str]],
+    *,
+    body: bytes,
+    max_body_bytes: int = MAX_BODY_BYTES,
+) -> ParsedWebhookHeaders:
+    """Parse and bound Standard Webhooks headers before cryptographic verify.
+
+    Returns:
+        The parsed header triple.
+
+    Raises:
+        WebhookVerificationError: On duplicate, malformed, or oversized input.
+    """
+    if len(body) > max_body_bytes:
+        raise WebhookVerificationError(WebhookFailureCode.BODY_TOO_LARGE)
+
+    values = _collect_headers(headers)
+    webhook_id = _require_one(values, HEADER_ID)
+    timestamp_raw = _require_one(values, HEADER_TIMESTAMP)
+    signature_raw = _require_one(values, HEADER_SIGNATURE)
+
+    if (
+        not webhook_id
+        or len(webhook_id) > MAX_WEBHOOK_ID_LENGTH
+        or "." in webhook_id
+        or _ID_PATTERN.fullmatch(webhook_id) is None
+    ):
+        raise WebhookVerificationError(WebhookFailureCode.MALFORMED_HEADERS)
+    if not timestamp_raw or "." in timestamp_raw or _TIMESTAMP_PATTERN.fullmatch(timestamp_raw) is None:
+        raise WebhookVerificationError(WebhookFailureCode.TIMESTAMP_INVALID)
+
+    signatures = _parse_signatures(signature_raw)
+    return ParsedWebhookHeaders(webhook_id=webhook_id, timestamp=int(timestamp_raw), signatures=signatures)
+
+
+def format_signature_header(signatures: list[bytes]) -> str:
+    """Format one or more Ed25519 signatures as a Standard Webhooks header.
+
+    Returns:
+        A space-delimited ``v1a,<base64>`` list.
+    """
+    if not signatures or len(signatures) > MAX_SIGNATURES:
+        msg = f"signature count must be 1..{MAX_SIGNATURES}"
+        raise ValueError(msg)
+    parts: list[str] = []
+    for signature in signatures:
+        if len(signature) != ED25519_SIGNATURE_BYTES:
+            msg = "Ed25519 signature must be 64 bytes"
+            raise ValueError(msg)
+        parts.append(f"{SIGNATURE_VERSION},{base64.b64encode(signature).decode('ascii')}")
+    return " ".join(parts)
+
+
+def _collect_headers(headers: Mapping[str, str] | list[tuple[str, str]]) -> dict[str, list[str]]:
+    items = headers.items() if not isinstance(headers, list) else headers
+    collected: dict[str, list[str]] = {}
+    for raw_name, raw_value in items:
+        name = raw_name.lower()
+        if name not in {HEADER_ID, HEADER_TIMESTAMP, HEADER_SIGNATURE}:
+            continue
+        collected.setdefault(name, []).append(raw_value)
+    return collected
+
+
+def _require_one(values: dict[str, list[str]], name: str) -> str:
+    present = values.get(name, [])
+    if len(present) > 1:
+        raise WebhookVerificationError(WebhookFailureCode.DUPLICATE_HEADER)
+    if len(present) != 1:
+        raise WebhookVerificationError(WebhookFailureCode.MALFORMED_HEADERS)
+    return present[0]
+
+
+def _parse_signatures(raw: str) -> tuple[bytes, ...]:
+    parts = raw.split()
+    if not parts or len(parts) > MAX_SIGNATURES:
+        raise WebhookVerificationError(WebhookFailureCode.SIGNATURE_INVALID)
+    signatures: list[bytes] = []
+    for part in parts:
+        version, sep, payload = part.partition(",")
+        if sep != "," or version != SIGNATURE_VERSION or not payload:
+            raise WebhookVerificationError(WebhookFailureCode.SIGNATURE_INVALID)
+        try:
+            decoded = base64.b64decode(payload, validate=True)
+        except ValueError as exc:
+            raise WebhookVerificationError(WebhookFailureCode.SIGNATURE_INVALID) from exc
+        if len(decoded) != ED25519_SIGNATURE_BYTES:
+            raise WebhookVerificationError(WebhookFailureCode.SIGNATURE_INVALID)
+        signatures.append(decoded)
+    return tuple(signatures)

authweave_webhooks-7.1.2/authweave_webhooks/keys.py

@@ -0,0 +1,70 @@
+"""Public-key resolver protocol and static onboarding documents."""
+
+from __future__ import annotations
+
+from typing import Protocol
+
+from authweave_webhooks.models import PublicKeyDocument
+
+
+class PublicKeyResolver(Protocol):
+    """Resolve and optionally refresh the trusted public-key document."""
+
+    async def resolve(self) -> PublicKeyDocument:
+        """Return the currently trusted key document.
+
+        Returns:
+            The onboarding-trusted public-key document.
+        """
+        ...
+
+    async def refresh(self) -> PublicKeyDocument | None:
+        """Perform at most one controlled refresh when verification misses.
+
+        Returns:
+            The latest trusted document, or ``None`` when refresh is
+            unavailable. Concurrent callers may receive a document refreshed by
+            another caller without performing a second remote refresh.
+        """
+        ...
+
+
+class StaticPublicKeyResolver:
+    """In-memory resolver for tests and single-document onboarding fixtures."""
+
+    __slots__ = ("_document", "_refresh_document", "_refreshed")
+
+    def __init__(
+        self,
+        document: PublicKeyDocument,
+        *,
+        refresh_document: PublicKeyDocument | None = None,
+    ) -> None:
+        """Bind the active document and an optional one-shot refresh document."""
+        self._document = document
+        self._refresh_document = refresh_document
+        self._refreshed = False
+
+    async def resolve(self) -> PublicKeyDocument:
+        """Return the current document.
+
+        Returns:
+            The trusted public-key document.
+        """
+        return self._document
+
+    async def refresh(self) -> PublicKeyDocument | None:
+        """Replace the document once from the configured refresh snapshot.
+
+        Returns:
+            The refreshed/current document, or ``None`` when no refresh snapshot
+            is configured. Only the first caller changes the snapshot; later
+            concurrent callers receive the same refreshed document.
+        """
+        if self._refreshed:
+            return self._document
+        if self._refresh_document is None:
+            return None
+        self._refreshed = True
+        self._document = self._refresh_document
+        return self._document

authweave_webhooks-7.1.2/authweave_webhooks/litestar_adapter.py

@@ -0,0 +1,31 @@
+"""Optional Litestar raw-body adapter for webhook verification."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Protocol
+
+if TYPE_CHECKING:
+    from collections.abc import Mapping
+
+    from authweave_webhooks.models import VerifiedWebhook
+    from authweave_webhooks.verify import StandardWebhooksVerifier
+
+
+class _LitestarRequest(Protocol):
+    headers: Mapping[str, str]
+
+    async def body(self) -> bytes: ...
+
+
+async def verify_litestar_request(
+    verifier: StandardWebhooksVerifier,
+    request: _LitestarRequest,
+) -> VerifiedWebhook:
+    """Verify a Litestar request using exact raw body bytes before deserialization.
+
+    Returns:
+        The verified webhook envelope.
+    """
+    body = await request.body()
+    headers = list(request.headers.items())
+    return await verifier.verify(headers=headers, body=bytes(body))

authweave_webhooks-7.1.2/authweave_webhooks/models.py

@@ -0,0 +1,115 @@
+"""Immutable webhook models and key-document contracts."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Final
+
+ED25519_PUBLIC_KEY_BYTES = 32
+ED25519_SIGNATURE_BYTES = 64
+MAX_BODY_BYTES: Final = 262_144
+MAX_WEBHOOK_ID_LENGTH: Final = 128
+MAX_SIGNATURES: Final = 3
+MAX_PUBLIC_KEYS: Final = 3
+DEFAULT_TIMESTAMP_TOLERANCE_SECONDS: Final = 300
+SIGNATURE_VERSION: Final = "v1a"
+HEADER_ID: Final = "webhook-id"
+HEADER_TIMESTAMP: Final = "webhook-timestamp"
+HEADER_SIGNATURE: Final = "webhook-signature"
+
+
+@dataclass(frozen=True, slots=True)
+class Ed25519PublicKey:
+    """One onboarding-trusted Ed25519 public key (32 raw bytes)."""
+
+    public_key: bytes
+
+    def __post_init__(self) -> None:
+        """Reject non-Ed25519 key material."""
+        if len(self.public_key) != ED25519_PUBLIC_KEY_BYTES:
+            msg = "Ed25519 public key must be 32 bytes"
+            raise ValueError(msg)
+
+    def __repr__(self) -> str:
+        """Omit raw key bytes from representations."""
+        return "Ed25519PublicKey(public_key=...)"
+
+
+@dataclass(frozen=True, slots=True)
+class PublicKeyDocument:
+    """Bounded public-key set for one merchant/endpoint environment.
+
+    At most three keys cover active/next/retiring rotation overlap. Private keys
+    never appear in this document.
+    """
+
+    version: str
+    environment: str
+    owner: str
+    endpoint: str
+    not_before: int
+    retire_after: int | None
+    keys: tuple[Ed25519PublicKey, ...]
+
+    def __post_init__(self) -> None:
+        """Enforce rotation cardinality and identity bounds."""
+        if not self.version or not self.environment or not self.owner or not self.endpoint:
+            msg = "version, environment, owner, and endpoint are required"
+            raise ValueError(msg)
+        if not self.keys or len(self.keys) > MAX_PUBLIC_KEYS:
+            msg = f"public key document must contain 1..{MAX_PUBLIC_KEYS} keys"
+            raise ValueError(msg)
+        if self.retire_after is not None and self.retire_after < self.not_before:
+            msg = "retire_after must be >= not_before"
+            raise ValueError(msg)
+
+
+@dataclass(frozen=True, slots=True)
+class VerifiedWebhook:
+    """Immutable verification result produced before JSON parsing."""
+
+    webhook_id: str
+    timestamp: int
+    body: bytes
+    environment: str
+    owner: str
+    endpoint: str
+    key_document_version: str
+    replay_detected: bool = False
+
+    def __repr__(self) -> str:
+        """Omit raw body bytes from representations."""
+        return (
+            "VerifiedWebhook("
+            f"webhook_id={self.webhook_id!r}, timestamp={self.timestamp}, "
+            f"body_len={len(self.body)}, environment={self.environment!r}, "
+            f"owner={self.owner!r}, endpoint={self.endpoint!r}, "
+            f"key_document_version={self.key_document_version!r}, "
+            f"replay_detected={self.replay_detected!r})"
+        )
+
+
+@dataclass(frozen=True, slots=True)
+class WebhookDelivery:
+    """Producer output: exact headers and raw body for one delivery attempt."""
+
+    webhook_id: str
+    timestamp: int
+    body: bytes
+    signature_header: str
+
+    def headers(self) -> dict[str, str]:
+        """Return the three Standard Webhooks headers for this attempt."""
+        return {
+            HEADER_ID: self.webhook_id,
+            HEADER_TIMESTAMP: str(self.timestamp),
+            HEADER_SIGNATURE: self.signature_header,
+        }
+
+    def __repr__(self) -> str:
+        """Omit raw body and signature material from representations."""
+        return (
+            "WebhookDelivery("
+            f"webhook_id={self.webhook_id!r}, timestamp={self.timestamp}, "
+            f"body_len={len(self.body)}, signature_header=...)"
+        )

authweave_webhooks-7.1.2/authweave_webhooks/redis_store.py

@@ -0,0 +1,35 @@
+"""Optional Redis-backed webhook replay store."""
+
+from __future__ import annotations
+
+from authweave_core import ReplayOutcome, validate_replay_key
+
+
+class RedisReplayStore:
+    """Thin Redis SET NX EX adapter satisfying authweave-core ``ReplayStore``.
+
+    Requires the ``authweave-webhooks[redis]`` extra. Connection failures map to
+    ``Unavailable`` so webhook verification fails closed.
+    """
+
+    __slots__ = ("_redis",)
+
+    def __init__(self, redis: object) -> None:
+        """Bind an async Redis client exposing ``set(name, value, nx=True, ex=...)``."""
+        self._redis = redis
+
+    async def check_and_store(self, key: str, *, ttl_seconds: float) -> ReplayOutcome:
+        """Atomically claim ``key`` with a TTL.
+
+        Returns:
+            The typed put-if-absent outcome.
+        """
+        validate_replay_key(key)
+        if ttl_seconds <= 0:
+            msg = "ttl_seconds must be positive"
+            raise ValueError(msg)
+        try:
+            created = await self._redis.set(key, "1", nx=True, ex=int(ttl_seconds))  # ty: ignore[unresolved-attribute]
+        except Exception:  # ruff: ignore[blind-except] - any client/transport failure is Unavailable
+            return ReplayOutcome.UNAVAILABLE
+        return ReplayOutcome.STORED if created else ReplayOutcome.REPLAY

authweave_webhooks-7.1.2/authweave_webhooks/sender.py

@@ -0,0 +1,155 @@
+"""Optional bounded HTTPS webhook sender (one attempt, no auto-retry)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+from urllib.parse import urlparse
+
+from authweave_core import SecurityOperation, SecurityOutcome, observe_security
+
+from authweave_webhooks.models import HEADER_ID, HEADER_SIGNATURE, HEADER_TIMESTAMP, WebhookDelivery
+
+if TYPE_CHECKING:
+    from collections.abc import Collection, Sequence
+
+    from authweave_core import SecurityObserver, TraceCorrelation
+
+_MAX_RESPONSE_BYTES = 65_536
+
+
+@dataclass(frozen=True, slots=True)
+class SenderResult:
+    """Outcome of a single webhook POST attempt."""
+
+    status_code: int
+    retry_after_seconds: int | None
+    body: bytes
+
+    def __repr__(self) -> str:
+        """Omit response body contents from representations.
+
+        Returns:
+            A secret-free summary.
+        """
+        return (
+            f"SenderResult(status_code={self.status_code}, "
+            f"retry_after_seconds={self.retry_after_seconds}, body_len={len(self.body)})"
+        )
+
+
+def validate_https_endpoint(url: str) -> str:
+    """Accept only explicit HTTPS endpoints without userinfo or fragment.
+
+    Returns:
+        The validated URL.
+
+    Raises:
+        ValueError: If the URL is not an allowed HTTPS endpoint.
+    """
+    parsed = urlparse(url)
+    if parsed.scheme != "https" or not parsed.hostname or parsed.username or parsed.password or parsed.fragment:
+        msg = "webhook endpoint must be HTTPS without userinfo or fragment"
+        raise ValueError(msg)
+    return url
+
+
+class HttpxWebhookSender:
+    """Send one bounded HTTPS delivery attempt.
+
+    Does not retry automatically. ``Retry-After`` is returned as a typed
+    recommendation only. Every destination must match the constructor's exact
+    onboarding allowlist. A controlled egress proxy/subnet is still required to
+    contain DNS rebinding and compromised allowlisted destinations.
+    """
+
+    __slots__ = ("_allowed_endpoints", "_client", "_observer", "_timeout_seconds")
+
+    def __init__(
+        self,
+        client: object,
+        *,
+        allowed_endpoints: Collection[str],
+        timeout_seconds: float = 5.0,
+        observer: SecurityObserver | None = None,
+    ) -> None:
+        """Bind an httpx-like async client and exact onboarding endpoints."""
+        if timeout_seconds <= 0:
+            msg = "timeout_seconds must be positive"
+            raise ValueError(msg)
+        if not allowed_endpoints:
+            msg = "allowed_endpoints must contain at least one endpoint"
+            raise ValueError(msg)
+        self._client = client
+        self._allowed_endpoints = frozenset(validate_https_endpoint(endpoint) for endpoint in allowed_endpoints)
+        self._timeout_seconds = timeout_seconds
+        self._observer = observer
+
+    async def send(
+        self,
+        *,
+        endpoint: str,
+        delivery: WebhookDelivery,
+        links: Sequence[TraceCorrelation] = (),
+    ) -> SenderResult:
+        """POST one delivery attempt to ``endpoint``.
+
+        Returns:
+            Status, optional Retry-After recommendation, and a bounded body.
+
+        Raises:
+            ValueError: If the endpoint fails the HTTPS policy or exact
+                onboarding allowlist.
+        """
+        with observe_security(
+            self._observer,
+            SecurityOperation.WEBHOOK_DELIVER,
+            profile="standard_webhooks",
+            links=links,
+        ) as observation:
+            validated_endpoint = validate_https_endpoint(endpoint)
+            if validated_endpoint not in self._allowed_endpoints:
+                msg = "webhook endpoint is not in the configured exact allowlist"
+                raise ValueError(msg)
+            async with self._client.stream(  # ty: ignore[unresolved-attribute]
+                "POST",
+                validated_endpoint,
+                content=delivery.body,
+                headers={
+                    HEADER_ID: delivery.webhook_id,
+                    HEADER_TIMESTAMP: str(delivery.timestamp),
+                    HEADER_SIGNATURE: delivery.signature_header,
+                    "content-type": "application/json",
+                },
+                timeout=self._timeout_seconds,
+                follow_redirects=False,
+            ) as response:
+                body = await _read_bounded_body(response)
+                retry_after = _parse_retry_after(response.headers.get("retry-after"))
+                status_code = int(response.status_code)
+            result = SenderResult(status_code=status_code, retry_after_seconds=retry_after, body=body)
+            observation.set_outcome(
+                SecurityOutcome.SUCCESS if 200 <= result.status_code < 300 else SecurityOutcome.ERROR,
+            )
+            return result
+
+
+async def _read_bounded_body(response: object) -> bytes:
+    body = bytearray()
+    async for raw_chunk in response.aiter_bytes():  # ty: ignore[unresolved-attribute]
+        chunk = bytes(raw_chunk)
+        remaining = _MAX_RESPONSE_BYTES - len(body)
+        body.extend(chunk[:remaining])
+        if len(body) == _MAX_RESPONSE_BYTES:
+            break
+    return bytes(body)
+
+
+def _parse_retry_after(raw: str | None) -> int | None:
+    if raw is None:
+        return None
+    try:
+        value = int(raw)
+    except ValueError:
+        return None
+    return value if value >= 0 else None

authweave_webhooks-7.1.2/authweave_webhooks/signer.py

@@ -0,0 +1,101 @@
+"""Ed25519 signing protocol and local keyring signer."""
+
+from __future__ import annotations
+
+from typing import Protocol
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from authweave_webhooks.headers import build_signing_input, format_signature_header
+from authweave_webhooks.models import WebhookDelivery
+
+
+class AsyncMessageSigner(Protocol):
+    """Sign bounded webhook bytes using an approved key reference.
+
+    Implementations must accept a key reference, never raw private key bytes, in
+    the public call signature. Private material stays inside the signer/KMS.
+    """
+
+    async def sign(self, *, key_ref: str, message: bytes) -> bytes:
+        """Return a 64-byte Ed25519 signature over ``message``.
+
+        Returns:
+            The raw Ed25519 signature bytes.
+        """
+        ...
+
+
+class LocalEd25519KeyringSigner:
+    """Reference signer that looks up private keys by opaque key reference.
+
+    Intended for tests and single-process demos. Production deployments should
+    use a KMS/HSM-backed ``AsyncMessageSigner``. Private keys never appear in
+    ``repr`` or raised error messages.
+    """
+
+    __slots__ = ("_keys",)
+
+    def __init__(self, keys: dict[str, Ed25519PrivateKey]) -> None:
+        """Bind opaque key references to private keys held only in memory."""
+        if not keys:
+            msg = "keyring must contain at least one key"
+            raise ValueError(msg)
+        self._keys = dict(keys)
+
+    def __repr__(self) -> str:
+        """List key references without private material."""
+        refs = sorted(self._keys)
+        return f"LocalEd25519KeyringSigner(key_refs={refs!r})"
+
+    async def sign(self, *, key_ref: str, message: bytes) -> bytes:
+        """Sign ``message`` with the referenced key.
+
+        Returns:
+            The raw Ed25519 signature.
+
+        Raises:
+            KeyError: If the key reference is unknown.
+        """
+        try:
+            private_key = self._keys[key_ref]
+        except KeyError as exc:
+            msg = "unknown key reference"
+            raise KeyError(msg) from exc
+        return private_key.sign(message)
+
+
+async def create_delivery(
+    *,
+    signer: AsyncMessageSigner,
+    key_refs: list[str],
+    webhook_id: str,
+    timestamp: int,
+    body: bytes,
+) -> WebhookDelivery:
+    """Construct one Standard Webhooks delivery attempt.
+
+    ``webhook_id`` must be stable across retries; ``timestamp`` is the attempt
+    time and should be refreshed on retry. ``key_refs`` may include active and
+    next keys during rotation overlap.
+
+    Returns:
+        Headers-ready delivery material.
+
+    Raises:
+        ValueError: If identifiers are malformed.
+    """
+    if not webhook_id or "." in webhook_id:
+        msg = "webhook_id must be non-empty and must not contain '.'"
+        raise ValueError(msg)
+    if timestamp < 0:
+        msg = "timestamp must be non-negative"
+        raise ValueError(msg)
+    message = build_signing_input(webhook_id=webhook_id, timestamp=timestamp, body=body)
+    signatures = [await signer.sign(key_ref=key_ref, message=message) for key_ref in key_refs]
+    return WebhookDelivery(
+        webhook_id=webhook_id,
+        timestamp=timestamp,
+        body=body,
+        signature_header=format_signature_header(signatures),
+    )

authweave_webhooks-7.1.2/authweave_webhooks/verify.py

@@ -0,0 +1,240 @@
+"""Standard Webhooks Ed25519 verifier."""
+
+from __future__ import annotations
+
+from dataclasses import replace
+from hashlib import sha256
+from json import dumps
+from typing import TYPE_CHECKING
+
+from authweave_core import ReplayOutcome, SecurityOperation, SecurityOutcome, observe_security
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+from authweave_webhooks.errors import WebhookFailureCode, WebhookVerificationError
+from authweave_webhooks.headers import build_signing_input, parse_headers
+from authweave_webhooks.models import (
+    DEFAULT_TIMESTAMP_TOLERANCE_SECONDS,
+    MAX_BODY_BYTES,
+    VerifiedWebhook,
+)
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Mapping, Sequence
+
+    from authweave_core import ReplayStore, SecurityObserver, TraceCorrelation
+
+    from authweave_webhooks.keys import PublicKeyResolver
+    from authweave_webhooks.models import PublicKeyDocument
+
+
+class StandardWebhooksVerifier:
+    """Verify asymmetric Standard Webhooks deliveries before JSON parsing."""
+
+    __slots__ = (
+        "_expected_endpoint",
+        "_expected_environment",
+        "_expected_owner",
+        "_max_body_bytes",
+        "_observer",
+        "_replay_store",
+        "_replay_ttl_seconds",
+        "_resolver",
+        "_time_source",
+        "_tolerance",
+    )
+
+    def __init__(
+        self,
+        resolver: PublicKeyResolver,
+        *,
+        replay_store: ReplayStore,
+        expected_environment: str,
+        expected_owner: str,
+        expected_endpoint: str,
+        timestamp_tolerance_seconds: int = DEFAULT_TIMESTAMP_TOLERANCE_SECONDS,
+        max_body_bytes: int = MAX_BODY_BYTES,
+        time_source: Callable[[], int],
+        observer: SecurityObserver | None = None,
+    ) -> None:
+        """Bind onboarding identity, clock, key resolver, and replay store."""
+        if timestamp_tolerance_seconds <= 0:
+            msg = "timestamp_tolerance_seconds must be positive"
+            raise ValueError(msg)
+        self._resolver = resolver
+        self._replay_store = replay_store
+        self._expected_environment = expected_environment
+        self._expected_owner = expected_owner
+        self._expected_endpoint = expected_endpoint
+        self._tolerance = timestamp_tolerance_seconds
+        # Both timestamp boundaries are inclusive; cover a proof first seen at the future boundary.
+        self._replay_ttl_seconds = timestamp_tolerance_seconds * 2 + 1
+        self._max_body_bytes = max_body_bytes
+        self._time_source = time_source
+        self._observer = observer
+
+    async def verify(
+        self,
+        *,
+        headers: Mapping[str, str] | list[tuple[str, str]],
+        body: bytes,
+        links: Sequence[TraceCorrelation] = (),
+    ) -> VerifiedWebhook:
+        """Verify headers and body, refreshing keys at most once on miss.
+
+        Returns:
+            An immutable verified webhook envelope.
+
+        Raises:
+            WebhookVerificationError: On any fail-closed verification failure.
+        """
+        with observe_security(
+            self._observer,
+            SecurityOperation.VERIFY_WEBHOOK,
+            profile="standard_webhooks",
+            credential_kind="ed25519",
+            links=links,
+        ) as observation:
+            try:
+                result = await self._verify(headers=headers, body=body)
+                result = replace(
+                    result,
+                    replay_detected=await self._claim_replay(result, links=links),
+                )
+            except WebhookVerificationError as exc:
+                outcome = (
+                    SecurityOutcome.UNAVAILABLE
+                    if exc.code in {WebhookFailureCode.KEY_UNAVAILABLE, WebhookFailureCode.STORE_UNAVAILABLE}
+                    else SecurityOutcome.INVALID
+                )
+                observation.set_outcome(outcome, reason_code=exc.code.value)
+                raise
+            observation.set_outcome(SecurityOutcome.VERIFIED)
+            return result
+
+    async def _verify(
+        self,
+        *,
+        headers: Mapping[str, str] | list[tuple[str, str]],
+        body: bytes,
+    ) -> VerifiedWebhook:
+        parsed = parse_headers(
+            headers if isinstance(headers, list) else dict(headers),
+            body=body,
+            max_body_bytes=self._max_body_bytes,
+        )
+        self._check_timestamp(parsed.timestamp)
+        message = build_signing_input(
+            webhook_id=parsed.webhook_id,
+            timestamp=parsed.timestamp,
+            body=body,
+        )
+        document = await self._resolver.resolve()
+        self._check_ownership(document)
+        if self._signatures_match(document, message, parsed.signatures):
+            return self._result(parsed.webhook_id, parsed.timestamp, body, document)
+
+        with observe_security(
+            self._observer,
+            SecurityOperation.KEY_REFRESH,
+            profile="standard_webhooks",
+        ) as observation:
+            refreshed = await self._resolver.refresh()
+            candidate = await self._resolver.resolve() if refreshed is None else refreshed
+            self._check_ownership(candidate)
+            matched = self._signatures_match(candidate, message, parsed.signatures)
+            if matched:
+                observation.set_outcome(SecurityOutcome.HIT if refreshed is None else SecurityOutcome.SUCCESS)
+            else:
+                observation.set_outcome(SecurityOutcome.MISS)
+        if matched:
+            return self._result(parsed.webhook_id, parsed.timestamp, body, candidate)
+        raise WebhookVerificationError(WebhookFailureCode.SIGNATURE_INVALID)
+
+    async def _claim_replay(
+        self,
+        result: VerifiedWebhook,
+        *,
+        links: Sequence[TraceCorrelation],
+    ) -> bool:
+        namespace = dumps(
+            (result.environment, result.owner, result.endpoint, result.webhook_id),
+            ensure_ascii=False,
+            separators=(",", ":"),
+        ).encode()
+        key = f"webhook:v1:{sha256(namespace).hexdigest()}"
+        with observe_security(
+            self._observer,
+            SecurityOperation.REPLAY_CHECK,
+            profile="standard_webhooks",
+            links=links,
+        ) as observation:
+            outcome = await self._replay_store.check_and_store(
+                key,
+                ttl_seconds=self._replay_ttl_seconds,
+            )
+            if outcome is ReplayOutcome.STORED:
+                observation.set_outcome(SecurityOutcome.STORED)
+            elif outcome is ReplayOutcome.REPLAY:
+                observation.set_outcome(SecurityOutcome.REPLAY)
+            elif outcome is ReplayOutcome.CAPACITY_EXCEEDED:
+                observation.set_outcome(SecurityOutcome.CAPACITY_EXCEEDED)
+            else:
+                observation.set_outcome(SecurityOutcome.UNAVAILABLE)
+        if outcome is ReplayOutcome.STORED:
+            return False
+        if outcome is ReplayOutcome.REPLAY:
+            return True
+        raise WebhookVerificationError(WebhookFailureCode.STORE_UNAVAILABLE)
+
+    def _check_timestamp(self, timestamp: int) -> None:
+        now = self._time_source()
+        if abs(now - timestamp) > self._tolerance:
+            raise WebhookVerificationError(WebhookFailureCode.TIMESTAMP_OUT_OF_TOLERANCE)
+
+    def _check_ownership(self, document: PublicKeyDocument) -> None:
+        if document.environment != self._expected_environment:
+            raise WebhookVerificationError(WebhookFailureCode.ENVIRONMENT_MISMATCH)
+        if document.owner != self._expected_owner:
+            raise WebhookVerificationError(WebhookFailureCode.OWNER_MISMATCH)
+        if document.endpoint != self._expected_endpoint:
+            raise WebhookVerificationError(WebhookFailureCode.ENDPOINT_MISMATCH)
+        now = self._time_source()
+        if now < document.not_before:
+            raise WebhookVerificationError(WebhookFailureCode.KEY_UNAVAILABLE)
+        if document.retire_after is not None and now > document.retire_after:
+            raise WebhookVerificationError(WebhookFailureCode.KEY_UNAVAILABLE)
+
+    def _signatures_match(
+        self,
+        document: PublicKeyDocument,
+        message: bytes,
+        signatures: tuple[bytes, ...],
+    ) -> bool:
+        for key in document.keys:
+            public_key = Ed25519PublicKey.from_public_bytes(key.public_key)
+            for signature in signatures:
+                try:
+                    public_key.verify(signature, message)
+                except InvalidSignature:
+                    continue
+                else:
+                    return True
+        return False
+
+    def _result(
+        self,
+        webhook_id: str,
+        timestamp: int,
+        body: bytes,
+        document: PublicKeyDocument,
+    ) -> VerifiedWebhook:
+        return VerifiedWebhook(
+            webhook_id=webhook_id,
+            timestamp=timestamp,
+            body=body,
+            environment=document.environment,
+            owner=document.owner,
+            endpoint=document.endpoint,
+            key_document_version=document.version,
+        )

authweave_webhooks-7.1.2/pyproject.toml

@@ -0,0 +1,70 @@
+[project]
+name = "authweave-webhooks"
+version = "7.1.2"
+description = "Asymmetric Standard Webhooks toolkit for AuthWeave integrations"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [
+    {name = "Vladislav Shepilov", email = "shepilov.v@protonmail.com"},
+]
+maintainers = [
+    {name = "Vladislav Shepilov", email = "shepilov.v@protonmail.com"},
+]
+keywords = ["webhooks", "ed25519", "standard-webhooks", "authentication", "security"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+]
+requires-python = "<3.15.0,>=3.12.0"
+dependencies = [
+    "authweave-core==7.1.2",
+    "cryptography>=50.0.0,<51.0",
+]
+
+[project.optional-dependencies]
+redis = ["redis>=8.1.0,<9.0"]
+httpx = ["httpx>=0.28.1,<1.0"]
+litestar = ["litestar>=2.24.0,<3.0"]
+
+[project.urls]
+homepage = "https://github.com/ZYLVEXT/litestar-auth"
+documentation = "https://zylvext.github.io/litestar-auth/"
+source = "https://github.com/ZYLVEXT/litestar-auth"
+tracker = "https://github.com/ZYLVEXT/litestar-auth/issues"
+
+[build-system]
+requires = ["hatchling==1.31.0"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["authweave_webhooks"]
+
+[tool.hatch.build.targets.sdist]
+only-include = ["authweave_webhooks"]
+
+[tool.coverage.run]
+source = ["authweave_webhooks"]
+branch = true
+
+[tool.coverage.report]
+fail_under = 100
+show_missing = true
+
+[tool.ty.environment]
+python-version = "3.12"
+
+[tool.ty.src]
+include = ["authweave_webhooks", "tests"]
+
+[tool.deptry]
+experimental_namespace_package = true
+
+[tool.deptry.per_rule_ignores]
+DEP002 = ["httpx", "litestar", "redis"]