cliV1 0.0.8__py3-none-any.whl

swagger_petstore_open_api_3_0/core/_internal/urls.py

@@ -0,0 +1,186 @@
+"""Turning a :class:`UrlTemplate` plus parameters into a request URL.
+
+Six pure functions in four groups. :func:`resolve_params` combines the parameters an API applies
+to every request with the ones a single call declares; :func:`render_segments` turns each of those
+into the URL segments it contributes, reading its declared type; :func:`build_url` then renders the
+result, with server variables filling the base URL's placeholders, path parameters filling the
+path's, and query parameters flattened and encoded onto the end. Resolution stays separate from
+rendering so each can be tested on its own, and none of the six holds state -- there is nothing to
+configure, so there is nothing to construct.
+
+:func:`strip_query` is the one that unbuilds rather than builds: the form of a URL that may be
+printed. It lives here because it is a fact about a URL's shape, and it has more than one reader."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping, Sequence
+from typing import Any, Final
+from urllib.parse import quote, urlencode
+
+from ..params import Param, UrlTemplate
+from .flattening import flatten
+from .wire import text_values
+
+_PLACEHOLDER: Final = re.compile(r"\{([^{}]+)\}")
+
+
+def expand_template(template: str, segments: Mapping[str, tuple[str, ...]]) -> str:
+    """Substitute every ``{placeholder}`` in ``template`` from ``segments``.
+
+    Each value is the sequence of *unencoded* members its placeholder expands from. Members are
+    percent-encoded with no safe characters and joined with ``,``, so a collection fills one path
+    segment rather than several -- OpenAPI's ``style: simple`` with ``explode: false``, the default
+    for a path parameter, and the same rule ``headers.py`` applies to a header array.
+
+    Encoding happens per member, *before* the join, which is what keeps the two commas apart: the
+    separator is written here and stays literal (a sub-delimiter under RFC 3986), while a comma
+    carried by a value is encoded to ``%2C`` along with everything else non-unreserved. A value
+    still cannot inject a path separator, for the same reason.
+
+    Any ``{name}`` is a placeholder -- the braces delimit it, so the name is not restricted to word
+    characters and a kebab-case or dotted path parameter resolves like any other. A name with no
+    segment raises rather than passing through: unencoded braces are not valid in a URL anyway.
+
+    Deciding what a value's members *are* belongs to :func:`render_segments`, which is the only
+    thing holding a declared type. This function therefore has one rule rather than four, and both
+    the join and the encoding live in exactly one place.
+
+    Args:
+        template: The URL or path holding the ``{placeholder}`` tokens.
+        segments: Each placeholder name mapped to its unencoded members.
+
+    Returns:
+        ``template`` with every placeholder substituted, each member percent-encoded.
+
+    Raises:
+        ValueError: If ``template`` is empty, or names a placeholder ``segments`` has no entry
+            for."""
+    if not template:
+        raise ValueError("URL template must not be empty")
+
+    def replace(match: re.Match[str]) -> str:
+        key = match.group(1)
+        if key not in segments:
+            raise ValueError(f"Missing template parameter: {key}")
+        return ",".join(quote(segment, safe="") for segment in segments[key])
+
+    return _PLACEHOLDER.sub(replace, template)
+
+
+def render_segments(params: Sequence[Param[Any]] | None) -> dict[str, tuple[str, ...]]:
+    """Render each parameter into the URL segments its ``{placeholder}`` expands to.
+
+    Serves a path parameter and a base URL's server variable alike -- both fill a placeholder and
+    both name the type they were declared as, so there is one rule rather than two.
+
+    Members, not finished text: :func:`expand_template` owns the ``,`` join and the
+    percent-encoding, so neither is written twice and no value can inject a path separator.
+
+    Args:
+        params: The path parameters or server variables; ``None`` is treated as none at all.
+
+    Returns:
+        Each parameter's key mapped to the unencoded members its placeholder expands to.
+
+    Raises:
+        ValueError: If a parameter contributes no value at all -- a placeholder cannot be left
+            unfilled -- or if its value does not match its declared type."""
+    rendered: dict[str, tuple[str, ...]] = {}
+    for param in params or ():
+        segments = text_values(param)
+        if not segments:
+            raise ValueError(f"URL parameter has no value: {param.key}")
+        rendered[param.key] = segments
+    return rendered
+
+
+def encode_query(params: Sequence[Param[Any]] | None) -> str:
+    """Flatten ``params`` and percent-encode them into a query string (no leading ``?``).
+
+    Args:
+        params: The query parameters; ``None`` is treated as none at all.
+
+    Returns:
+        The encoded query string, empty when nothing was contributed.
+
+    Raises:
+        ValueError: If a parameter's value does not match its declared type."""
+    return urlencode(flatten(params))
+
+
+def resolve_params(
+    global_params: Sequence[Param[Any]], call_params: Sequence[Param[Any]] | None
+) -> tuple[Param[Any], ...]:
+    """Return the parameters for one call, the call's winning per key.
+
+    One function for both kinds that need it: a path parameter and a query parameter are the same
+    type, so they are the same rule -- a call's parameter replaces a global of the same key but
+    keeps the global's position, so what an endpoint produces does not depend on which side supplied
+    a parameter. Keys are unique within either side -- a collection is carried by a single
+    :class:`Param` and expanded by its destination, never by repeating the key -- so replacing
+    rather than appending is unambiguous.
+
+    Both arguments share a type, so the precedence lives in their names rather than in the function
+    name: ``global_params`` is what the API prescribes, ``call_params`` what this one call declares.
+
+    Headers resolve separately, since they merge case-insensitively -- which ``render_headers`` gets
+    by lowercasing as it renders. Placeholders in a *base URL* are server variables, carried on the
+    :class:`UrlTemplate` itself and rendered by :func:`build_url`.
+
+    Args:
+        global_params: What the API prescribes for every call.
+        call_params: What this one call declares; wins per key.
+
+    Returns:
+        The effective parameters, each key once, in the order the global set established."""
+    by_key = {param.key: param for param in (*global_params, *(call_params or ()))}
+    return tuple(by_key.values())
+
+
+def build_url(
+    url_template: UrlTemplate,
+    *,
+    path_params: Sequence[Param[Any]] | None = None,
+    query_params: Sequence[Param[Any]] | None = None,
+) -> str:
+    """Resolve ``url_template`` into a complete request URL.
+
+    Args:
+        url_template: The unresolved URL, carrying its base URL, path and server variables.
+        path_params: The call's path parameters.
+        query_params: The call's query parameters.
+
+    Returns:
+        The absolute URL, base and path joined on exactly one ``/``, query appended when non-empty.
+
+    Raises:
+        ValueError: If a placeholder is unfilled or a parameter's value does not match its
+            declared type."""
+    base = expand_template(url_template.base_url, render_segments(url_template.variables))
+    path = expand_template(url_template.path, render_segments(path_params))
+
+    # Join on exactly one separator. Plain urljoin would be wrong here: it treats the base as a
+    # document reference and discards its last path segment, so a base of ".../v2" with path
+    # "users" would resolve to ".../users", silently dropping the version.
+    url = f"{base.rstrip('/')}/{path.lstrip('/')}"
+
+    query = encode_query(query_params)
+    return f"{url}?{query}" if query else url
+
+
+def strip_query(url: str) -> str:
+    """Return ``url`` without its query string -- the form of it that may be printed.
+
+    A query-placed api key lives in that string, folded onto the URL by :func:`resolve_params` like
+    any other query parameter, so no diagnostic carries one: not a request's repr, not the warning
+    naming a response nobody closed. A string form rather than redaction -- the URL a request is
+    sent to is never altered, only what is said about it afterwards.
+
+    Args:
+        url: The URL to describe.
+
+    Returns:
+        Everything before the first ``?``, or the whole of ``url`` when it has none."""
+    path, _, _ = url.partition("?")
+    return path

swagger_petstore_open_api_3_0/core/_internal/wire.py

@@ -0,0 +1,198 @@
+"""One declared value, one wire-ready form.
+
+Every request parameter -- query, form, path, header, or a base URL's server variable -- reaches
+the wire the same way: validated against the type the endpoint declared, dumped through that
+type's adapter, and turned into text. Only the *arrangement* differs, and that stays with each
+destination: :mod:`.form` explodes values into ``key[sub]`` pairs, :mod:`.urls` joins them into
+``/``-separated segments, :mod:`.headers` folds them into one field value.
+
+That shared prefix lives here, which is why a ``datetime`` declared ``RFC1123DateTime`` renders as
+its GMT string at every destination without any of them knowing what a datetime is -- and why a
+fifth destination would need no serialization code of its own."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Iterable, Mapping
+from typing import Any, TypeGuard
+
+from pydantic import ValidationError
+
+from ..optionality import strip_unset
+from ..params import Param
+
+
+def wire_value(param: Param[Any]) -> object:
+    """``param``'s value in wire form: validated against its declared type, then dumped.
+
+    The same two steps, in the same order, as :func:`json_body` -- and the reason a parameter
+    holds its resolved adapter rather than the type expression it came from. Validation coerces
+    dict-shaped input (``Model | FooDict`` companions) through the model's own rules; the dump
+    applies the type's serializer, which is what renders an ``RFC1123DateTime`` as its GMT string,
+    an enum as its value and a model under its wire aliases.
+
+    A validation failure is re-raised naming the parameter: pydantic titles the error by the
+    *type* (``1 validation error for int``), which on an endpoint with five parameters leaves the
+    caller guessing which one failed. ``ValidationError`` subclasses ``ValueError``, so a caller's
+    ``except ValueError`` covers both spellings, and the full per-field detail rides ``__cause__``.
+
+    ``strip_unset`` is what drops a field the caller never touched, and the only thing that can:
+    ``UnsetType`` is not ``None``, so the dump keeps the key and it serializes as ``null``, which a
+    JSON-encoded path segment or header value would carry verbatim. An *explicit* ``None`` is
+    kept -- see docs/designs/optional-nullable-fields.md. Which of those nulls survives is the
+    destination's own decision, taken in :func:`text_values` and ``flattening.flatten``: compact
+    JSON can spell one, a query pair or a flat path segment cannot.
+
+    The result is still structured -- a collection stays a list, a model stays a mapping -- because
+    the query and form destination needs that shape to explode into ``key[sub]`` keys.
+
+    Args:
+        param: The parameter to render, carrying its declared type's adapter.
+
+    Returns:
+        The dumped value, still structured; a top-level set is sorted so one call yields one URL.
+
+    Raises:
+        ValueError: If the value does not match its declared type. The message names the
+            parameter; pydantic's per-field detail rides ``__cause__``."""
+    try:
+        validated = param.adapter.validate_python(param.value)
+    except ValidationError as error:
+        raise ValueError(f"Parameter value does not match its declared type: {param.key}") from error
+
+    dumped: object = strip_unset(validated, param.adapter.dump_python(validated, mode="json"))
+
+    # JSON has no set, so the dump has already flattened one into a list in hash-iteration order.
+    # Sorting is what keeps one call producing one URL across runs. A *top-level* set is the whole
+    # reach on purpose: a set nested inside a container is not an emittable declared type --
+    # ``adapters.py``'s ``_CONTAINERS`` and ``strip_unset`` close at ``list``/``dict`` for the same
+    # reason -- so walking deeper would be speculative surface for a shape no spec yields.
+    if isinstance(validated, (set, frozenset)) and isinstance(dumped, list):
+        return sorted(dumped, key=str)
+
+    return dumped
+
+
+def text_values(param: Param[Any]) -> tuple[str, ...]:
+    """``param`` as the flat texts it contributes -- one per path segment or header list member.
+
+    Empty means it contributes nothing: its value was ``None``, or its collection was. A scalar is
+    one text, a flat collection is one text per member, and anything structured -- a mapping, a
+    model, or a collection holding either -- is one text of compact JSON, since neither a path
+    segment nor a header value can carry a nested shape any other way.
+
+    The arrangement is settled *before* the ``None`` rule, because the two arrangements can
+    represent different things: compact JSON spells ``null``, so a structured collection carries a
+    ``None`` member as one, while a flat collection has no such spelling and refuses it.
+
+    Args:
+        param: The parameter to render.
+
+    Returns:
+        One text per segment or header member; empty when the parameter contributes nothing.
+
+    Raises:
+        ValueError: If the value does not match its declared type, or if a *flat* collection holds
+            a ``None`` -- neither a path segment nor a header member can spell one."""
+    value = wire_value(param)
+    if value is None:
+        return ()
+
+    if isinstance(value, Mapping):
+        return (compact_json(value),)
+
+    if not is_collection(value):
+        return (to_text(value),)
+
+    members = list(value)
+    if any(isinstance(member, Mapping) or is_collection(member) for member in members):
+        return (compact_json(members),)
+
+    if any(member is None for member in members):
+        # Query and form encoding can drop a member, because it can also repeat or omit a key.
+        # Neither of these destinations can: a path would address a different route and a header
+        # would carry an empty list slot, both silently.
+        raise ValueError(f"Parameter value contains None: {param.key}")
+
+    return tuple(to_text(member) for member in members)
+
+
+def to_text(value: object) -> str:
+    """One dumped scalar as the text a URL or a header carries.
+
+    The adapter has already applied wire aliases, enum values and temporal formats, so only
+    booleans are left: every destination here is text and expects JSON's ``true``/``false``,
+    whereas ``str(True)`` would emit ``True``. Called only where a value actually becomes text,
+    which is what lets the structured branches above keep real booleans for :func:`compact_json`.
+
+    Args:
+        value: One already-dumped scalar.
+
+    Returns:
+        Its text form, with booleans lowercased to JSON's spelling."""
+    if isinstance(value, bool):
+        return "true" if value else "false"
+
+    return str(value)
+
+
+def parse_json(content: bytes) -> Any:
+    """Parse a response body as JSON, normalising both ways it can fail.
+
+    Parsed from the bytes rather than from a decoded ``str``, so RFC 8259 encoding detection applies
+    (UTF-8/16/32, BOM-tolerant) and an undecodable byte is a failure rather than a replacement
+    character smuggled into a successful payload.
+
+    ``json.JSONDecodeError`` and ``UnicodeDecodeError`` are both ``ValueError``s already, but they
+    read as two unrelated faults; a caller who reached a body that will not parse is owed one answer.
+    The inverse of :func:`compact_json`, and here for the same reason -- one spelling, every caller.
+
+    Args:
+        content: The raw body.
+
+    Returns:
+        Whatever the body parses to -- an object, array or scalar.
+
+    Raises:
+        ValueError: If the body is not valid JSON, or is not decodable at all."""
+    try:
+        return json.loads(content)
+    except (json.JSONDecodeError, UnicodeDecodeError) as exc:
+        raise ValueError("Response body is not valid JSON") from exc
+
+
+def compact_json(value: object) -> str:
+    """JSON-encode a structured value with no insignificant whitespace.
+
+    ``ensure_ascii`` stays at its default: a header field value is ISO-8859-1 by RFC 9110 and the
+    transport rejects anything outside it, so escaping non-ASCII is the only encoding that
+    survives. ``allow_nan`` is turned off: at its default a non-finite float encodes as
+    ``Infinity`` or ``NaN`` -- a Python dialect no RFC 8259 parser accepts -- so the call would
+    fail server-side, far from the line that produced the value.
+
+    Args:
+        value: The structured value to encode.
+
+    Returns:
+        Its JSON text, non-ASCII escaped and no insignificant whitespace.
+
+    Raises:
+        ValueError: If ``value`` holds a non-finite float, which has no RFC 8259 spelling."""
+    return json.dumps(value, separators=(",", ":"), allow_nan=False)
+
+
+def is_collection(value: object) -> TypeGuard[Iterable[object]]:
+    """True for an iterable that should expand into several wire values.
+
+    ``TypeGuard``, deliberately not the newer ``TypeIs``: ``TypeIs`` also narrows the *negative*
+    branch, which would be unsound here -- ``str`` is ``Iterable`` yet this returns ``False`` for
+    it, so a checker told "not an ``Iterable``" would wrongly rule out strings. ``TypeGuard``
+    narrows only where this returns ``True``, which is exactly what the caller needs to iterate.
+
+    Args:
+        value: The dumped value to classify.
+
+    Returns:
+        ``True`` for an iterable that expands into several wire values -- a ``str``, ``bytes`` or
+        ``Mapping`` is one value, not several."""
+    return isinstance(value, Iterable) and not isinstance(value, (str, bytes, Mapping))

swagger_petstore_open_api_3_0/core/adapters.py

@@ -0,0 +1,177 @@
+"""The one place a ``TypeAdapter`` is built, and what a value is validated *into*.
+
+Shared by the request path (:func:`json_body`, :func:`param`) and the response path (the decoders),
+so the expensive step in pydantic v2 -- building the adapter -- happens once per type for the life
+of the process rather than once per request.
+
+It sits on its own, below both paths, because both need it and neither owns it: a request-body
+module reaching into the response-decoding module for it would put a cycle in the import graph."""
+
+from __future__ import annotations
+
+from functools import reduce
+from operator import or_
+from threading import RLock
+from types import UnionType
+from typing import Any, Final, TypeVar, Union, get_args, get_origin
+
+from pydantic import TypeAdapter
+from typing_extensions import TypeForm, is_typeddict
+
+T = TypeVar("T")
+
+_CONTAINERS: Final = (list, dict)
+"""The container origins a spec can express -- an array and a map -- so the only two emitted."""
+
+_ADAPTER_CACHE_MAX: Final = 512
+_adapter_lock: Final = RLock()
+_adapters: Final[dict[object, TypeAdapter[Any]]] = {}
+
+
+def validation_target(type_: TypeForm[T]) -> TypeForm[T]:
+    """Drop the dict-shaped companions from ``type_``, leaving what a value is validated *into*.
+
+    An endpoint accepts ``Employee | EmployeeDict``, and that whole union is what it declares and
+    hands the factory -- but only ``Employee`` may reach :func:`adapter_for`. The adapter both
+    validates *and* dumps, and a dict matching the ``TypedDict`` arm is dumped verbatim: wire
+    aliases lost (``address_line_1`` for ``addressLine1``), defaulted fields absent, unknown keys
+    silently dropped. A companion is an *input* shape, never a wire shape, so the type describing
+    what a caller may pass and the type a value is validated into are two different things.
+
+    The strip reaches wherever a companion can be written -- through union members and into
+    container parameters -- so ``list[Employee | EmployeeDict]`` and
+    ``list[Employee] | list[EmployeeDict]`` both resolve to ``list[Employee]``. Generic over ``T``
+    so that ``adapter_for(validation_target(type_))`` keeps the adapter's type instead of erasing
+    it to ``Any`` at the one hop between two otherwise precise signatures.
+
+    A type form that is dict-shaped *throughout* has no target at all. Only a generator defect
+    emits one, and it type-checks, so it is named here rather than surfacing as ``reduce`` failing
+    on an empty sequence at the first request.
+
+    Args:
+        type_: The declared type expression, dict-shaped companions included.
+
+    Returns:
+        The same expression with every companion arm removed -- what a value validates into.
+
+    Raises:
+        TypeError: If ``type_`` is dict-shaped throughout, leaving no model arm to validate into."""
+    if _is_companion(type_):
+        raise TypeError(
+            f"{type_!r} names only dict-shaped companions, which are input shapes and never wire "
+            f"shapes -- a validation target needs the model arm each companion accompanies"
+        )
+
+    target: TypeForm[T] = _strip_companions(type_)
+    return target
+
+
+def _is_companion(type_: TypeForm[Any]) -> bool:
+    """Whether ``type_`` is dict-shaped throughout, so no model arm survives the strip.
+
+    ``all`` for a union and ``any`` for a container, and the asymmetry is the rule itself: a union
+    keeps a target while *one* member has one, whereas a container whose parameter has none has none
+    either -- ``list[EmployeeDict]`` cannot be narrowed to a list of anything.
+
+    Args:
+        type_: The type expression to classify.
+
+    Returns:
+        ``True`` when nothing in ``type_`` would survive the companion strip."""
+    if is_typeddict(type_):
+        return True
+
+    origin = get_origin(type_)
+    if origin in (Union, UnionType):
+        return all(_is_companion(arg) for arg in get_args(type_))
+    if origin in _CONTAINERS:
+        return any(_is_companion(arg) for arg in get_args(type_))
+    return False
+
+
+def _strip_companions(type_: TypeForm[Any]) -> TypeForm[Any]:
+    """``type_`` with every companion dropped, rebuilt only where something actually changed.
+
+    Two properties, each load-bearing:
+
+    - the origin checks, because ``get_args(list[str])`` is ``(str,)`` -- descending is only sound
+      for the origins whose parameters *are* element types, so everything else is returned
+      untouched. Notably ``Annotated``, which is how a discriminated union carries its
+      ``WireDiscriminator``: descending would silently untag it.
+      ``_CONTAINERS`` is closed at ``list`` and ``dict`` rather than "every container Python has" --
+      a spec expresses arrays and maps, and descending a shape no generator emits would be
+      speculative surface. A ``tuple`` or ``set`` parameter passes through like any other origin;
+    - the nothing-changed short-circuits, which hand back the expression *as written* rather than a
+      rebuilt one, so a companion-free union such as ``EmailStr | str`` cannot lose a member to
+      ``Union``'s deduplication, and one declared type keeps one :func:`adapter_for` cache entry.
+
+    Rebuilt with ``|`` rather than ``Union[tuple(targets)]``: mypy types that subscript as a typing
+    special form rather than a ``TypeForm``, so it cannot be returned from this signature. The
+    annotated locals are what keep the imprecision of ``get_args`` here instead of at every caller.
+
+    Args:
+        type_: The type expression to strip.
+
+    Returns:
+        ``type_`` itself when no companion was found, otherwise the rebuilt expression."""
+    origin = get_origin(type_)
+    args = get_args(type_)
+
+    if origin in (Union, UnionType):
+        targets = [_strip_companions(arg) for arg in args if not _is_companion(arg)]
+        if len(targets) == len(args) and all(target is arg for target, arg in zip(targets, args, strict=True)):
+            return type_
+        rebuilt: TypeForm[Any] = reduce(or_, targets)
+        return rebuilt
+
+    if origin in _CONTAINERS:
+        stripped = [_strip_companions(arg) for arg in args]
+        if all(target is arg for target, arg in zip(stripped, args, strict=True)):
+            return type_
+        reparametrized: TypeForm[Any] = origin[tuple(stripped)]
+        return reparametrized
+
+    return type_
+
+
+def adapter_for(type_: TypeForm[T]) -> TypeAdapter[T]:
+    """Return the process-wide cached ``TypeAdapter`` for ``type_``, building it once.
+
+    The cache must be module-level to work at all: a decoder is constructed per call, so
+    an instance-owned cache would be discarded with it and never see a second lookup.
+
+    Unhashable type forms bypass the cache. At ``_ADAPTER_CACHE_MAX`` entries it is cleared
+    wholesale -- predictable, and far beyond the number of distinct types one generated SDK
+    produces.
+
+    A hit is served without the lock, which is sound because a dict read is atomic under the GIL and
+    internally locked on free-threaded builds; a stale read racing the wholesale ``clear()`` still
+    returns a correct adapter for that type. The lock is there to make each *build* happen once --
+    the contract ``test_adapter_cache.py`` pins -- not to serialize reads, so the build stays inside
+    it and the re-check inside catches a type another thread built while this one waited.
+
+    Args:
+        type_: The validation target, already stripped of companions by :func:`validation_target`.
+
+    Returns:
+        The adapter for ``type_``, shared across the process unless ``type_`` is unhashable."""
+    try:
+        hash(type_)
+    except TypeError:
+        return TypeAdapter(type_)
+
+    cached = _adapters.get(type_)
+    if cached is not None:
+        return cached
+
+    with _adapter_lock:
+        cached = _adapters.get(type_)
+        if cached is not None:
+            return cached
+
+        if len(_adapters) >= _ADAPTER_CACHE_MAX:
+            _adapters.clear()
+
+        adapter: TypeAdapter[T] = TypeAdapter(type_)
+        _adapters[type_] = adapter
+        return adapter

swagger_petstore_open_api_3_0/core/auth/__init__.py

@@ -0,0 +1,70 @@
+"""The authentication layer's curated surface: its models, its contract, its composites.
+
+The route the runtime facade and ``raw_client`` take, so neither needs to know how this package is laid
+out. What only ``schemes/`` needs -- ``ScopeT``, ``OAuth2Credentials``, ``CredentialsPlacement``,
+``OAuthParams`` and ``scope_params`` -- stays behind, reached at ``models`` directly.
+
+⚠️ **``schemes/`` is deliberately not re-exported here.** A scheme module reaches ``raw_client``, which
+reaches this package -- so importing ``.schemes`` from this file would close that loop into an
+``ImportError`` on whichever of the two is imported first. The facade names ``.schemes`` itself."""
+
+from .composition import (
+    AllSchemes,
+    AnySchemes,
+    AsyncAllSchemes,
+    AsyncAnySchemes,
+    invalidate,
+    is_configured,
+    no_auth,
+    resolve_auth,
+)
+from .models import (
+    AuthParams,
+    OAuthError,
+    OAuthProviderError,
+    OAuthToken,
+    OAuthTokenRefreshable,
+    client_secret_basic,
+    client_secret_post,
+    oauth_error_response,
+)
+from .protocols import (
+    AsyncAuthScheme,
+    AsyncRefreshableTokenSource,
+    AsyncTokenSource,
+    AuthScheme,
+    RefreshableTokenSource,
+    RevocableAuthScheme,
+    TokenSource,
+)
+
+__all__ = [
+    # What one scheme contributes to a request
+    "AuthParams",
+    # The contract
+    "AuthScheme",
+    "AsyncAuthScheme",
+    "RevocableAuthScheme",
+    # The absent credential, and composition
+    "no_auth",
+    "is_configured",
+    "resolve_auth",
+    "invalidate",
+    "AllSchemes",
+    "AnySchemes",
+    "AsyncAllSchemes",
+    "AsyncAnySchemes",
+    # Managed OAuth 2.0 -- the token source seam
+    "TokenSource",
+    "AsyncTokenSource",
+    "RefreshableTokenSource",
+    "AsyncRefreshableTokenSource",
+    # Managed OAuth 2.0 -- the provider's vocabulary
+    "OAuthToken",
+    "OAuthTokenRefreshable",
+    "OAuthProviderError",
+    "OAuthError",
+    "oauth_error_response",
+    "client_secret_basic",
+    "client_secret_post",
+]