clavem 0.1.0__tar.gz

clavem-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,94 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  test:
+    name: Python 3.13 / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.2.0
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install locked dependencies
+        run: uv sync --frozen
+      - name: Run transport regressions
+        run: uv run --frozen pytest -q
+
+  build:
+    name: Build package
+    needs: test
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.2.0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Build package
+        run: uv build --no-sources
+
+      - name: Check wheel import
+        run: uv run --with dist/*.whl --no-project -- python -I -c "from clavem.transport import connect, serve; import clavem; print(clavem.__file__)"
+
+      - name: Upload package distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  publish:
+    name: Publish package
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/clavem/
+
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - name: Download package distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+      - name: Publish package
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Create GitHub Release
+        run: >-
+          gh release create "$GITHUB_REF_NAME"
+          dist/*.whl dist/*.tar.gz
+          --repo "$GITHUB_REPOSITORY"
+          --verify-tag --generate-notes
+        env:
+          GH_TOKEN: ${{ github.token }}

clavem-0.1.0/.gitignore

@@ -0,0 +1,224 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+*.lcov
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# uv
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi/*
+!.pixi/config.toml
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule*
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs/Zensical documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore that
+#   can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, you
+#   could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# Local pre-shared keys
+*.psk
+psk.bin

clavem-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cham
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

clavem-0.1.0/PKG-INFO

@@ -0,0 +1,139 @@
+Metadata-Version: 2.5
+Name: clavem
+Version: 0.1.0
+Summary: Small async TLS-PSK message channels.
+Project-URL: Repository, https://github.com/Chamkang6093/clavem
+Author: Cham
+License-Expression: MIT
+License-File: LICENSE
+Keywords: asyncio,messaging,psk,tls
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Typing :: Typed
+Requires-Python: >=3.13
+Description-Content-Type: text/markdown
+
+# clavem
+
+Small async TLS-PSK message channels. Python 3.13+, no third-party runtime dependencies.
+
+Clavem authenticates peers with a shared random key and carries length-prefixed byte
+messages over one TLS 1.3 connection. It does not reconnect, schedule heartbeats,
+serialize application data, or configure logging.
+
+## Install
+
+```bash
+pip install clavem
+```
+
+For an unpublished checkout, use `uv sync` and `uv run` instead. Both endpoints
+need a Python/OpenSSL build with PSK support:
+
+```bash
+python -c "import ssl; print(ssl.OPENSSL_VERSION, ssl.HAS_PSK)"
+```
+
+`HAS_PSK` must be `True`. Check this on the exact interpreter used for deployment
+and on the interpreter bundled into a desktop executable.
+
+## Connect and exchange messages
+
+Create one 32-byte random key and securely provision the same bytes on both peers.
+Use a different key for unrelated services. The identity is public, not a password.
+
+```python
+from pathlib import Path
+import asyncio
+
+from clavem.transport import connect
+
+
+async def main() -> None:
+    key = Path("psk.bin").read_bytes()
+    async with await connect("127.0.0.1", 9443, identity="home", key=key) as channel:
+        await channel.send(b"hello")
+        async with asyncio.timeout(5):
+            reply = await channel.receive()
+        print(reply)
+
+
+asyncio.run(main())
+```
+
+One task receives messages; multiple tasks may send, with complete frames serialized
+by the channel. TCP_NODELAY is enabled on both peers: the client uses asyncio's
+default, and the server explicitly enables it on accepted TLS sockets. Messages
+can be empty and are limited to 65,536 bytes. The wire format is a four-byte
+unsigned network-order length followed by that many bytes.
+
+## Serve
+
+```python
+from pathlib import Path
+import asyncio
+
+from clavem.channel import Channel
+from clavem.transport import serve
+
+
+async def echo(channel: Channel) -> None:
+    try:
+        while True:
+            async with asyncio.timeout(30):
+                message = await channel.receive()
+                await channel.send(message)
+    except (asyncio.IncompleteReadError, ConnectionError, TimeoutError):
+        return
+
+
+async def main() -> None:
+    key = Path("psk.bin").read_bytes()
+    async with serve(echo, "127.0.0.1", 9443, keys={"home": key}) as server:
+        await server.serve_forever()
+
+
+asyncio.run(main())
+```
+
+`serve()` owns accepted channels and handler tasks. Returning from a handler closes
+its channel. Leaving the server context closes the listener and cancels and awaits
+remaining handlers. Handle expected peer disconnects in your handler; unexpected
+handler exceptions stop the server and propagate through its task group.
+
+## Contract
+
+| API | Behavior |
+| --- | --- |
+| `connect(..., timeout=5)` | Bounds TCP connection and TLS authentication together. Returns a `Channel`. |
+| `serve(..., handshake_timeout=5)` | Async context manager yielding an `asyncio.Server`. |
+| `Channel.send(bytes)` | Checks the size before writing and applies stream backpressure. |
+| `Channel.receive()` | Reads a complete frame; EOF raises `asyncio.IncompleteReadError`. |
+| `Channel.close()` | Closes the stream; supported by `async with channel`. |
+| `client_context()` / `server_context()` | TLS contexts for applications that need lower-level asyncio integration. |
+
+An oversized incoming frame raises `clavem.channel.MessageTooLarge` and closes
+the stream. An oversized outgoing message raises the same error before writing.
+Network, TLS, and timeout exceptions retain their standard-library types. After
+cancelling or timing out an in-progress receive or send, close the channel rather
+than trying to reuse a potentially partial exchange.
+
+TLS contexts require external PSK authentication. The client loads no trusted CAs,
+the server loads no certificate and issues no session tickets, and the transport
+checks that PSK authentication was negotiated. There is no plaintext fallback.
+Clavem sets neither application idle timeouts nor connection-count limits; the
+hosting application owns those policies.
+
+## Development and release
+
+Use `uv sync` for the environment and committed `uv.lock`. Run `uv run pytest` for real
+loopback TLS regressions: normal PSK exchange, rejection of untrusted and trusted
+certificate fallback, and TCP_NODELAY checks on both peers. The publish workflow
+runs these checks before building distributions.
+
+Versions live in `pyproject.toml` and `uv.lock`. Release with a matching `vX.Y.Z`
+tag after configuring the repository's `pypi` environment and the PyPI Trusted
+Publisher. The workflow builds distributions, verifies an isolated wheel import,
+publishes to PyPI, and attaches distributions to a GitHub Release.

clavem-0.1.0/README.md

@@ -0,0 +1,122 @@
+# clavem
+
+Small async TLS-PSK message channels. Python 3.13+, no third-party runtime dependencies.
+
+Clavem authenticates peers with a shared random key and carries length-prefixed byte
+messages over one TLS 1.3 connection. It does not reconnect, schedule heartbeats,
+serialize application data, or configure logging.
+
+## Install
+
+```bash
+pip install clavem
+```
+
+For an unpublished checkout, use `uv sync` and `uv run` instead. Both endpoints
+need a Python/OpenSSL build with PSK support:
+
+```bash
+python -c "import ssl; print(ssl.OPENSSL_VERSION, ssl.HAS_PSK)"
+```
+
+`HAS_PSK` must be `True`. Check this on the exact interpreter used for deployment
+and on the interpreter bundled into a desktop executable.
+
+## Connect and exchange messages
+
+Create one 32-byte random key and securely provision the same bytes on both peers.
+Use a different key for unrelated services. The identity is public, not a password.
+
+```python
+from pathlib import Path
+import asyncio
+
+from clavem.transport import connect
+
+
+async def main() -> None:
+    key = Path("psk.bin").read_bytes()
+    async with await connect("127.0.0.1", 9443, identity="home", key=key) as channel:
+        await channel.send(b"hello")
+        async with asyncio.timeout(5):
+            reply = await channel.receive()
+        print(reply)
+
+
+asyncio.run(main())
+```
+
+One task receives messages; multiple tasks may send, with complete frames serialized
+by the channel. TCP_NODELAY is enabled on both peers: the client uses asyncio's
+default, and the server explicitly enables it on accepted TLS sockets. Messages
+can be empty and are limited to 65,536 bytes. The wire format is a four-byte
+unsigned network-order length followed by that many bytes.
+
+## Serve
+
+```python
+from pathlib import Path
+import asyncio
+
+from clavem.channel import Channel
+from clavem.transport import serve
+
+
+async def echo(channel: Channel) -> None:
+    try:
+        while True:
+            async with asyncio.timeout(30):
+                message = await channel.receive()
+                await channel.send(message)
+    except (asyncio.IncompleteReadError, ConnectionError, TimeoutError):
+        return
+
+
+async def main() -> None:
+    key = Path("psk.bin").read_bytes()
+    async with serve(echo, "127.0.0.1", 9443, keys={"home": key}) as server:
+        await server.serve_forever()
+
+
+asyncio.run(main())
+```
+
+`serve()` owns accepted channels and handler tasks. Returning from a handler closes
+its channel. Leaving the server context closes the listener and cancels and awaits
+remaining handlers. Handle expected peer disconnects in your handler; unexpected
+handler exceptions stop the server and propagate through its task group.
+
+## Contract
+
+| API | Behavior |
+| --- | --- |
+| `connect(..., timeout=5)` | Bounds TCP connection and TLS authentication together. Returns a `Channel`. |
+| `serve(..., handshake_timeout=5)` | Async context manager yielding an `asyncio.Server`. |
+| `Channel.send(bytes)` | Checks the size before writing and applies stream backpressure. |
+| `Channel.receive()` | Reads a complete frame; EOF raises `asyncio.IncompleteReadError`. |
+| `Channel.close()` | Closes the stream; supported by `async with channel`. |
+| `client_context()` / `server_context()` | TLS contexts for applications that need lower-level asyncio integration. |
+
+An oversized incoming frame raises `clavem.channel.MessageTooLarge` and closes
+the stream. An oversized outgoing message raises the same error before writing.
+Network, TLS, and timeout exceptions retain their standard-library types. After
+cancelling or timing out an in-progress receive or send, close the channel rather
+than trying to reuse a potentially partial exchange.
+
+TLS contexts require external PSK authentication. The client loads no trusted CAs,
+the server loads no certificate and issues no session tickets, and the transport
+checks that PSK authentication was negotiated. There is no plaintext fallback.
+Clavem sets neither application idle timeouts nor connection-count limits; the
+hosting application owns those policies.
+
+## Development and release
+
+Use `uv sync` for the environment and committed `uv.lock`. Run `uv run pytest` for real
+loopback TLS regressions: normal PSK exchange, rejection of untrusted and trusted
+certificate fallback, and TCP_NODELAY checks on both peers. The publish workflow
+runs these checks before building distributions.
+
+Versions live in `pyproject.toml` and `uv.lock`. Release with a matching `vX.Y.Z`
+tag after configuring the repository's `pypi` environment and the PyPI Trusted
+Publisher. The workflow builds distributions, verifies an isolated wheel import,
+publishes to PyPI, and attaches distributions to a GitHub Release.

clavem-0.1.0/clavem/channel.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+import asyncio
+import ssl
+import struct
+from types import TracebackType
+
+MAX_MESSAGE = 65_536
+_HEADER = struct.Struct("!I")
+
+
+class MessageTooLarge(ValueError):
+    """A message exceeds the channel's 64 KiB limit."""
+
+
+class Channel:
+    """One reader and serialized writers on a length-prefixed byte stream."""
+
+    def __init__(self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
+        self._reader: asyncio.StreamReader = reader
+        self._writer: asyncio.StreamWriter = writer
+        self._send_lock: asyncio.Lock = asyncio.Lock()
+
+    async def send(self, message: bytes) -> None:
+        """Send one message; concurrent senders cannot interleave frames."""
+        if len(message) > MAX_MESSAGE:
+            raise MessageTooLarge("message exceeds 64 KiB")
+        async with self._send_lock:
+            self._writer.write(_HEADER.pack(len(message)) + message)
+            await self._writer.drain()
+
+    async def receive(self) -> bytes:
+        """Read one message. Only one task may receive at a time."""
+        header = await self._reader.readexactly(_HEADER.size)
+        (length,) = _HEADER.unpack(header)
+        if length > MAX_MESSAGE:
+            self._writer.close()
+            raise MessageTooLarge("peer message exceeds 64 KiB; channel closed")
+        return await self._reader.readexactly(length)
+
+    async def close(self) -> None:
+        """Close the stream, bounded by its configured TLS shutdown timeout."""
+        self._writer.close()
+        try:
+            await self._writer.wait_closed()
+        except (ConnectionError, ssl.SSLError, TimeoutError):
+            # A disconnected peer cannot acknowledge TLS shutdown.
+            pass
+
+    async def __aenter__(self) -> Channel:
+        return self
+
+    async def __aexit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        traceback: TracebackType | None,
+    ) -> None:
+        await self.close()

clavem-0.1.0/clavem/tls.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+import ssl
+from collections.abc import Mapping
+
+
+def _validate(identity: str, key: bytes) -> None:
+    if not identity or len(identity.encode("utf-8")) > 255 or "\0" in identity:
+        raise ValueError("identity must contain 1-255 UTF-8 bytes without NUL")
+    if len(key) != 32:
+        raise ValueError("key must contain 32 randomly generated bytes")
+
+
+def _context(protocol: int) -> ssl.SSLContext:
+    if not ssl.HAS_PSK:
+        raise RuntimeError("this Python/OpenSSL build does not support TLS-PSK")
+    context = ssl.SSLContext(protocol)
+    context.minimum_version = ssl.TLSVersion.TLSv1_3
+    context.maximum_version = ssl.TLSVersion.TLSv1_3
+    return context
+
+
+def client_context(identity: str, key: bytes) -> ssl.SSLContext:
+    """Authenticate with an external PSK; do not trust certificate fallback."""
+    _validate(identity, key)
+    context = _context(ssl.PROTOCOL_TLS_CLIENT)
+    context.check_hostname = False
+    # A successful external-PSK handshake needs no CA. Certificate fallback
+    # must still fail verification rather than authenticate an unrelated peer.
+    context.verify_mode = ssl.CERT_REQUIRED
+    context.set_psk_client_callback(lambda _hint: (identity, key))
+    return context
+
+
+def server_context(keys: Mapping[str, bytes]) -> ssl.SSLContext:
+    """Accept only the supplied identities and their external PSKs."""
+    if not keys:
+        raise ValueError("at least one identity is required")
+    allowed = dict(keys)
+    for identity, key in allowed.items():
+        _validate(identity, key)
+    context = _context(ssl.PROTOCOL_TLS_SERVER)
+    context.num_tickets = 0
+
+    def lookup(identity: str | None) -> bytes:
+        if identity not in allowed:
+            return b""  # Decline unknown PSKs; no certificate fallback is configured.
+        return allowed[identity]
+
+    context.set_psk_server_callback(lookup)
+    return context

clavem-0.1.0/clavem/transport.py

@@ -0,0 +1,94 @@
+from __future__ import annotations
+
+import asyncio
+import socket
+import ssl
+from collections.abc import AsyncIterator, Awaitable, Callable, Mapping
+from contextlib import asynccontextmanager
+
+from clavem.channel import MAX_MESSAGE, Channel
+from clavem.tls import client_context, server_context
+
+Handler = Callable[[Channel], Awaitable[None]]
+
+
+async def connect(
+    host: str,
+    port: int,
+    *,
+    identity: str,
+    key: bytes,
+    timeout: float = 5,  # noqa: ASYNC109 - also bounds the TLS handshake.
+) -> Channel:
+    """Establish a TLS 1.3 external-PSK channel within timeout seconds."""
+    if timeout <= 0:
+        raise ValueError("timeout must be positive")
+    context = client_context(identity, key)
+    async with asyncio.timeout(timeout):
+        reader, writer = await asyncio.open_connection(
+            host,
+            port,
+            ssl=context,
+            server_hostname="",
+            ssl_handshake_timeout=timeout,
+            ssl_shutdown_timeout=2,
+            limit=MAX_MESSAGE + 4,
+        )
+    channel = Channel(reader, writer)
+    if not writer.get_extra_info("ssl_object").session_reused:
+        await channel.close()
+        raise ssl.SSLError("peer did not authenticate with an external PSK")
+    return channel
+
+
+@asynccontextmanager
+async def serve(
+    handler: Handler,
+    host: str,
+    port: int,
+    *,
+    keys: Mapping[str, bytes],
+    handshake_timeout: float = 5,
+) -> AsyncIterator[asyncio.Server]:
+    """Own a listener and its handlers; cancel handlers when leaving the context.
+
+    A handler owns one authenticated channel for its lifetime. Unexpected
+    handler errors propagate through the task group and stop the listener.
+    Applications should handle expected disconnects in their handler.
+    """
+    if handshake_timeout <= 0:
+        raise ValueError("handshake_timeout must be positive")
+    context = server_context(keys)
+    tasks: set[asyncio.Task[None]] = set()
+
+    async def run(reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
+        async with Channel(reader, writer) as channel:
+            if not writer.get_extra_info("ssl_object").session_reused:
+                raise ssl.SSLError("peer did not authenticate with an external PSK")
+            # Accepted sockets do not consistently inherit asyncio's TCP_NODELAY default.
+            writer.get_extra_info("socket").setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
+            await handler(channel)
+
+    async with asyncio.TaskGroup() as group:
+
+        def accept(reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
+            task = group.create_task(run(reader, writer))
+            tasks.add(task)
+            task.add_done_callback(tasks.discard)
+
+        server = await asyncio.start_server(
+            accept,
+            host,
+            port,
+            ssl=context,
+            ssl_handshake_timeout=handshake_timeout,
+            ssl_shutdown_timeout=2,
+            limit=MAX_MESSAGE + 4,
+        )
+        try:
+            yield server
+        finally:
+            server.close()
+            for task in tasks:
+                task.cancel()
+            await server.wait_closed()

clavem-0.1.0/pyproject.toml

@@ -0,0 +1,48 @@
+[build-system]
+requires = ["hatchling>=1.26"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["clavem"]
+
+[project]
+name = "clavem"
+version = "0.1.0"
+description = "Small async TLS-PSK message channels."
+readme = "README.md"
+requires-python = ">=3.13"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Cham" }]
+keywords = ["asyncio", "tls", "psk", "messaging"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.13",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.urls]
+Repository = "https://github.com/Chamkang6093/clavem"
+
+[dependency-groups]
+dev = ["pytest>=8.3", "pytest-asyncio>=1.0", "ruff>=0.11"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+
+[tool.ruff]
+line-length = 100
+target-version = "py313"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "ASYNC", "PTH", "RUF"]
+
+[tool.ruff.format]
+docstring-code-format = true
+quote-style = "double"
+line-ending = "lf"

clavem-0.1.0/tests/conftest.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+
+import asyncio
+import secrets
+import ssl
+from collections.abc import AsyncIterator
+from pathlib import Path
+
+import pytest
+import pytest_asyncio
+
+
+@pytest.fixture(scope="session", autouse=True)
+def require_psk() -> None:
+    assert ssl.HAS_PSK, "transport regressions require a Python/OpenSSL build with PSK"
+
+
+@pytest.fixture
+def key() -> bytes:
+    return secrets.token_bytes(32)
+
+
+@pytest.fixture
+def certificate() -> Path:
+    return Path(__file__).parent / "data" / "server-cert.pem"
+
+
+@pytest_asyncio.fixture
+async def certificate_server(certificate: Path) -> AsyncIterator[tuple[int, list[bool]]]:
+    """A real TLS server that declines PSK and offers a test-only certificate."""
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.minimum_version = ssl.TLSVersion.TLSv1_3
+    context.maximum_version = ssl.TLSVersion.TLSv1_3
+    context.load_cert_chain(certificate, certificate.with_name("server-key.pem"))
+    context.set_psk_server_callback(lambda _identity: b"")
+    context.num_tickets = 0
+    accepted: list[bool] = []
+
+    def accept(_reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
+        accepted.append(writer.get_extra_info("ssl_object").session_reused)
+        writer.close()
+
+    server = await asyncio.start_server(
+        accept,
+        "127.0.0.1",
+        0,
+        ssl=context,
+        ssl_handshake_timeout=2,
+        ssl_shutdown_timeout=1,
+    )
+    try:
+        yield server.sockets[0].getsockname()[1], accepted
+    finally:
+        server.close()
+        server.close_clients()
+        await server.wait_closed()

clavem-0.1.0/tests/data/README.md

@@ -0,0 +1,4 @@
+The certificate and private key in this directory are public, test-only fixtures
+for a loopback server. They are not deployment credentials and must never be used
+outside tests. The client trusts this certificate only in the explicit certificate
+fallback regression; the system trust store is never modified.

clavem-0.1.0/tests/data/server-cert.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBsjCCAVegAwIBAgIUdZbNcJpxwDLIu8sRDJvdBlTy318wCgYIKoZIzj0EAwIw
+HjEcMBoGA1UEAwwTY2xhdmVtLXRlc3QuaW52YWxpZDAeFw0yNjExMTExMDE2Mzda
+Fw0zNjExMDgxMDE2MzdaMB4xHDAaBgNVBAMME2NsYXZlbS10ZXN0LmludmFsaWQw
+WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASECx4F3R54DKWC3Mung5Ldkki2dUVK
+O4u+swzHE4mthGPGEJxbWIJgdAFQrtajS5dZQtmUQ8uHkXqFdloZX3YXo3MwcTAd
+BgNVHQ4EFgQUU24EwuFL7SGJYVU1IxhKRXb7rcowHwYDVR0jBBgwFoAUU24EwuFL
+7SGJYVU1IxhKRXb7rcowDwYDVR0TAQH/BAUwAwEB/zAeBgNVHREEFzAVghNjbGF2
+ZW0tdGVzdC5pbnZhbGlkMAoGCCqGSM49BAMCA0kAMEYCIQCGi7jSR0VNUyYyoAFB
+8aTdM11WPjNb/btQkrOnimB2mgIhAMSE6eZeoyVKRuSUYf0lt0Syiyj7c7RA0jvH
+ypg4hR3Q
+-----END CERTIFICATE-----

clavem-0.1.0/tests/data/server-key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOkroYoQ1yr0YPdBG
+24N92nZqeIT8TRMQo81t7FlZDyShRANCAASECx4F3R54DKWC3Mung5Ldkki2dUVK
+O4u+swzHE4mthGPGEJxbWIJgdAFQrtajS5dZQtmUQ8uHkXqFdloZX3YX
+-----END PRIVATE KEY-----

clavem-0.1.0/tests/test_nodelay.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+import asyncio
+import socket
+
+from clavem.channel import Channel
+from clavem.transport import connect, serve
+
+
+async def test_tcp_nodelay_is_enabled_on_both_peers(key: bytes) -> None:
+    server_option: asyncio.Future[int] = asyncio.get_running_loop().create_future()
+
+    async def inspect(channel: Channel) -> None:
+        connection = channel._writer.get_extra_info("socket")
+        server_option.set_result(connection.getsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY))
+        # Keep the channel open until the server context cancels this handler.
+        # Avoid an unrelated EOF masking a failed socket-option assertion.
+        await asyncio.Event().wait()
+
+    async with asyncio.timeout(5):
+        async with serve(inspect, "127.0.0.1", 0, keys={"home": key}) as server:
+            port = server.sockets[0].getsockname()[1]
+            async with await connect("127.0.0.1", port, identity="home", key=key) as channel:
+                connection = channel._writer.get_extra_info("socket")
+                # Enabled is nonzero; Darwin exposes the flag bit rather than 1.
+                assert connection.getsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY) != 0
+                assert await server_option != 0

clavem-0.1.0/tests/test_psk.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+import asyncio
+import ssl
+from pathlib import Path
+
+import pytest
+
+from clavem import transport
+from clavem.channel import Channel
+from clavem.tls import client_context
+
+
+async def test_psk_channel_exchanges_messages(key: bytes) -> None:
+    async def echo(channel: Channel) -> None:
+        await channel.send(await channel.receive())
+
+    async with asyncio.timeout(5):
+        async with transport.serve(echo, "127.0.0.1", 0, keys={"home": key}) as server:
+            port = server.sockets[0].getsockname()[1]
+            async with await transport.connect(
+                "127.0.0.1", port, identity="home", key=key
+            ) as channel:
+                await channel.send(b"authenticated")
+                assert await channel.receive() == b"authenticated"
+
+
+async def test_rejects_untrusted_certificate_fallback(
+    certificate_server: tuple[int, list[bool]], key: bytes
+) -> None:
+    port, _accepted = certificate_server
+    async with asyncio.timeout(5):
+        with pytest.raises(ssl.SSLCertVerificationError):
+            async with await transport.connect("127.0.0.1", port, identity="home", key=key):
+                pytest.fail("untrusted certificate fallback was accepted")
+
+
+async def test_rejects_trusted_certificate_fallback(
+    certificate_server: tuple[int, list[bool]],
+    certificate: Path,
+    key: bytes,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    port, accepted = certificate_server
+
+    def trusted_context(identity: str, secret: bytes) -> ssl.SSLContext:
+        context = client_context(identity, secret)
+        context.load_verify_locations(certificate)
+        return context
+
+    # First establish that the real certificate fallback succeeds when trusted.
+    # This rules out an unrelated TLS/certificate failure as the test's cause.
+    async with asyncio.timeout(5):
+        reader, writer = await asyncio.open_connection(
+            "127.0.0.1",
+            port,
+            ssl=trusted_context("home", key),
+            server_hostname="",
+            ssl_shutdown_timeout=1,
+        )
+        try:
+            assert not writer.get_extra_info("ssl_object").session_reused
+            assert await reader.read() == b""
+        finally:
+            writer.close()
+            await writer.wait_closed()
+        assert accepted == [False]
+
+        monkeypatch.setattr(transport, "client_context", trusted_context)
+        with pytest.raises(ssl.SSLError, match="external PSK"):
+            async with await transport.connect("127.0.0.1", port, identity="home", key=key):
+                pytest.fail("certificate-only authentication was accepted")

clavem-0.1.0/uv.lock

@@ -0,0 +1,122 @@
+version = 1
+revision = 3
+requires-python = ">=3.13"
+
+[[package]]
+name = "clavem"
+version = "0.1.0"
+source = { editable = "." }
+
+[package.dev-dependencies]
+dev = [
+    { name = "pytest" },
+    { name = "pytest-asyncio" },
+    { name = "ruff" },
+]
+
+[package.metadata]
+
+[package.metadata.requires-dev]
+dev = [
+    { name = "pytest", specifier = ">=8.3" },
+    { name = "pytest-asyncio", specifier = ">=1.0" },
+    { name = "ruff", specifier = ">=0.11" },
+]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "iniconfig"
+version = "2.3.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/01/e1/2069291243c926a2ff1cd706c7f3eeb9b62144bf60f77c9fb9ff2fb26bd3/iniconfig-2.3.1.tar.gz", hash = "sha256:67f4b9c50da0dedf52af349e7749a80a9057a5031199791b906c3bb3ae878960", size = 21209, upload-time = "2026-10-06T22:48:38.076Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/56/43/4ca9e49d27a1fcf6bece6f6aec0ea46bb9112489b93d4b688fb415457bdb/iniconfig-2.3.1-py3-none-any.whl", hash = "sha256:9121e2c1fdb355232495be3194c8dfe87ccc2d5dee45947b78e68f499790d7a7", size = 7552, upload-time = "2026-10-06T22:48:36.959Z" },
+]
+
+[[package]]
+name = "packaging"
+version = "26.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/fa/3944b40b07da9ce895c0e6303a5ab7d53da063554f534556b134a54d6093/packaging-26.3.tar.gz", hash = "sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79", size = 313412, upload-time = "2026-08-04T18:15:28.737Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/63/34/ba1c580383c9eada3711951fef0795c80b829a078d72188184bcab9dd527/packaging-26.3-py3-none-any.whl", hash = "sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c", size = 129956, upload-time = "2026-08-04T18:15:27.159Z" },
+]
+
+[[package]]
+name = "pluggy"
+version = "1.7.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bf/db/7fc19e6f2dc92a966727031389fc2e08b558f0f25eb7403c1119ad4713cd/pluggy-1.7.0.tar.gz", hash = "sha256:d1eaa46ebb595891b860ab086b4d09c8588af65ebd4361b8e8f4bb8920b90ba8", size = 123304, upload-time = "2026-10-15T09:50:58.343Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/40/9e/2b38731e0fc536806f16490e1a12d7f0dc2a1235aa8cc07bcc75416a7daa/pluggy-1.7.0-py3-none-any.whl", hash = "sha256:7dd7b0d8832ba3cb632c306926ded123429211b83641b35dc5c41ad2d34f9bec", size = 27082, upload-time = "2026-10-15T09:50:56.808Z" },
+]
+
+[[package]]
+name = "pygments"
+version = "2.21.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/49/2e/ced460408999b33da6b31b0021b0f37d329e202d4169aeb164493778f25b/pygments-2.21.0.tar.gz", hash = "sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c", size = 5005329, upload-time = "2026-08-17T08:02:48.824Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/71/46/17f022dd3e953bf20a04a028a21ec746d942f8d2af30fa0f124fa0e6a684/pygments-2.21.0-py3-none-any.whl", hash = "sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9", size = 1250147, upload-time = "2026-08-17T08:02:44.912Z" },
+]
+
+[[package]]
+name = "pytest"
+version = "9.2.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "iniconfig" },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/79/42/bb4641652e58dedeac2ec51abc1f8cae4fee4ec63899a0999016229a0f2a/pytest-9.2.0.tar.gz", hash = "sha256:97c4f3b1f3c7414aa36465e09b8220f1d03627993bd51b1282e193753c80557b", size = 1797555, upload-time = "2026-10-27T21:30:20.728Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/51/39/1f5d8c8877a0fa327db959c19341d4be61660de1ab6b7391f9eb805bcd67/pytest-9.2.0-py3-none-any.whl", hash = "sha256:07acdcf88ec174f907dc01af70bf52d49b014bbab03faeeade31c96b18c2e588", size = 411776, upload-time = "2026-10-27T21:30:19.131Z" },
+]
+
+[[package]]
+name = "pytest-asyncio"
+version = "1.4.1.post1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pytest" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/73/7f/c60a4338420b33453d4f814ac0c930abd399f162b9bdd21af4b9e363037f/pytest_asyncio-1.4.1.post1.tar.gz", hash = "sha256:f582d9ea4a1c082195abe8bd29a1fe106aeb1cd435e3dad2d3bc2749935c36a2", size = 145360, upload-time = "2026-11-01T18:26:03.732Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e3/de/adbc7578959cfab07e5e7c05cf6d54224a51e7667ea2c07458b6bc571e75/pytest_asyncio-1.4.1.post1-py3-none-any.whl", hash = "sha256:0755e488cc0a2b9bd2eab7292cc6390d4cbb8390f1020745647bae5a708e0165", size = 17140, upload-time = "2026-11-01T18:26:02.168Z" },
+]
+
+[[package]]
+name = "ruff"
+version = "0.17.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/84/0e/3d154514b5bad104f7e1c13169c2d09aa9959fccdc06eb47610ccdfa83ed/ruff-0.17.4.tar.gz", hash = "sha256:f32d178b50e826e00f6c6c1be3f56333068acb9b67fe167143527fa9b81e890d", size = 5357750, upload-time = "2026-11-05T18:52:17.638Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e0/61/c83c78bbb6108f6c6270a106cf12b54175f4f42da088b9bb880f18e31289/ruff-0.17.4-py3-none-linux_armv6l.whl", hash = "sha256:2b08c4ff98dc234f4a3871a3105353b922fa875ea1073ca31001eb8c06bb4d89", size = 10252195, upload-time = "2026-11-05T18:51:36.594Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/12/dd158708378866e8b53e145a465dbc51a7cccb9fa197a74d67eaedde7234/ruff-0.17.4-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:13e781c3c5f663e7fba737eaaeb70dd943dd55171daf316afb25cd5268cfe0c7", size = 10266044, upload-time = "2026-11-05T18:51:39.502Z" },
+    { url = "https://files.pythonhosted.org/packages/28/32/89a94a8eb11fd505a381ae6f04e190d038d9958695209dc1786ce5cfcda3/ruff-0.17.4-py3-none-macosx_11_0_arm64.whl", hash = "sha256:7ed2f416349944f908f9574215994602242b0836844eba48eec61473033afca0", size = 9432227, upload-time = "2026-11-05T18:51:41.968Z" },
+    { url = "https://files.pythonhosted.org/packages/58/de/a392dc38b215798ae72e639d228b7f6c02d826a95d1c0ad7c4c0ee49ef5b/ruff-0.17.4-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8ea6e0017c785f7282092b11e46338e4ebed1b9e575ebf2e55a8a1eda968241a", size = 10136900, upload-time = "2026-11-05T18:51:44.562Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/8f/a880f60f42005f6ffdf58f77af34c7ee327000b5607f48a2f6a69d8b242c/ruff-0.17.4-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:7e061dcc0933c7031a616ac8d66ac540309b2aa21ab558101a8f53e9ac7a1185", size = 10051245, upload-time = "2026-11-05T18:51:46.7Z" },
+    { url = "https://files.pythonhosted.org/packages/09/55/98844264108af7d5ec27ca3a9cd5a989094ca657a14599c4b69a537a0e9a/ruff-0.17.4-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f99e95a1515161138be3cbd1b06c06e739d8feb38ade35564556999fffc3686e", size = 10704341, upload-time = "2026-11-05T18:51:49.228Z" },
+    { url = "https://files.pythonhosted.org/packages/28/a2/5edf97659c3ac7c73f978003bd314936f671037fdac6b978e9de3e4b2b65/ruff-0.17.4-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5f28cf0dd37cb172fa5a8d2e92e6ada3a9dbd0609f094ed24039929eef0b7524", size = 11394465, upload-time = "2026-11-05T18:51:51.534Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/8f/51371ae856b2bef4d15a044a574695fbc0f6ae63aafa42a2a22428070fb6/ruff-0.17.4-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6b21c771b296888e8a35c6f48555f4b44e4483f61675d6ed51810a5203469ce6", size = 10988262, upload-time = "2026-11-05T18:51:53.91Z" },
+    { url = "https://files.pythonhosted.org/packages/af/1b/62874f14c7873f27c7887d2b1ea41de990e14ba9518801ffe8eacb5d51a6/ruff-0.17.4-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2cd025509b2e15721b426fc70fd946d71f43b3db3b08e946dfec2d696d911690", size = 10572829, upload-time = "2026-11-05T18:51:56.129Z" },
+    { url = "https://files.pythonhosted.org/packages/98/30/860b9dae67432b16b88558a9cb2d3194825fa62838f8b9cc49f5d9022095/ruff-0.17.4-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:49b77f7b3921669466882a4881168801bdb06ec2cd83fb936049016cf5fdece1", size = 10617545, upload-time = "2026-11-05T18:51:58.172Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/08/781a4b41a1c83fd6e30fea610d6502a6f94e49cf94693fd37bdcbc6bfe11/ruff-0.17.4-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:e3b84eb74f260d1c2dbd236fd9d4c011d4fdd0a52bdf8aea57a10e3a1b71fca5", size = 10111955, upload-time = "2026-11-05T18:52:00.59Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/e9/94b1c7b677120f30839254518924f73a8157e9bcfa200edcd5796fecdb99/ruff-0.17.4-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:20e43d7a08e712e33067ba887e6574546c79bd4831596ce8f16803ac7ff9ad90", size = 10058355, upload-time = "2026-11-05T18:52:03.61Z" },
+    { url = "https://files.pythonhosted.org/packages/27/5f/a825910b9f309336dc33cb8c0774126662c1d2f765699b3e0a1bd538d01f/ruff-0.17.4-py3-none-musllinux_1_2_i686.whl", hash = "sha256:0d1f4848fd2ec0499be4046db9b7dfcc952666885f00233cc7033515282556a8", size = 10415932, upload-time = "2026-11-05T18:52:06.264Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/b8/0796468423413ea4df1a6e2442ae26cf49b8f7dda0eecf246e0d5d0dde54/ruff-0.17.4-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:6007e7f3a0e55b0fbdb947af69cf24c21b4928df6be8ef3e767c69b5ccccf496", size = 10826033, upload-time = "2026-11-05T18:52:08.675Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/ab/d8e407669ffe5014429baf780c2df47e001968a6e4c17f615e2e7b13a9ba/ruff-0.17.4-py3-none-win32.whl", hash = "sha256:3971a78cba76298b284c8321e6d40d93045ed348bec5c369d85099efc97fb7cf", size = 9931993, upload-time = "2026-11-05T18:52:11.169Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/15/42af8a72d8946e3c9efd2bbf6641e462b6832783b0d043d63ef5b280ba7f/ruff-0.17.4-py3-none-win_amd64.whl", hash = "sha256:67c5a894fc054cf41f75f7afa24815de5a74329d97634126c2a1015740ff4e8c", size = 10292922, upload-time = "2026-11-05T18:52:13.436Z" },
+    { url = "https://files.pythonhosted.org/packages/68/9e/f1dbffcfb8ff25dadbc21f87a8b73c3848abe4abada9d4b08ccef8bec40c/ruff-0.17.4-py3-none-win_arm64.whl", hash = "sha256:181ae38a9a8fb94925bf7d0794327b48d7fd7f4b50cfd84c0e999cc09ef8d131", size = 9889396, upload-time = "2026-11-05T18:52:15.549Z" },
+]