cryptolike 0.1.0__tar.gz

cryptolike-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CryptoLike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

cryptolike-0.1.0/PKG-INFO

@@ -0,0 +1,184 @@
+Metadata-Version: 2.4
+Name: cryptolike
+Version: 0.1.0
+Summary: Official server-side SDK for the CryptoLike merchant API: signed requests, automatic Idempotency-Key, retries with backoff, typed resources and webhook verification.
+Author: CryptoLike team
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Cryptolike-net/cryptolike-python
+Project-URL: Documentation, https://cryptolike.net/docs/sdk
+Project-URL: Repository, https://github.com/Cryptolike-net/cryptolike-python
+Project-URL: Issues, https://github.com/Cryptolike-net/cryptolike-python/issues
+Keywords: cryptolike,crypto,cryptocurrency,crypto payments,payment gateway,payments,bitcoin,usdt,invoices,webhooks,hmac,api client,sdk
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Office/Business :: Financial
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Operating System :: OS Independent
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.33.0
+Requires-Dist: urllib3>=2.8.0
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Dynamic: license-file
+
+# cryptolike (Python SDK)
+
+Official **server-side** SDK for the CryptoLike merchant API (Python ≥ 3.10, `requests`; typed, `py.typed`).
+
+- Signed requests (`X-API-Key` / `X-Timestamp` / `X-Signature`, HMAC-SHA256 — [Authentication](https://cryptolike.net/docs/auth))
+- `Idempotency-Key` generated for every `POST` (pass your own to make retries exact)
+- Retries with exponential backoff and jitter on `429` (honours `Retry-After`), `5xx` and transport errors
+- Dataclasses for every object; amounts are `Decimal` — floats are refused
+- `verify_webhook()` — signature and timestamp check of webhook deliveries ([Webhooks](https://cryptolike.net/docs/webhooks))
+
+## The secret stays on your server
+
+> The API secret signs requests *as you*: whoever has it can create payments, read balances and
+> change your webhooks. Use this SDK from your backend only; never put the secret into code that
+> ships to a browser or a mobile app. Your page needs only the invoice id / `checkout_url` your
+> server obtained — see [Payment widget §1](https://cryptolike.net/docs/widget).
+
+The client reads `CRYPTOLIKE_API_KEY_ID` and `CRYPTOLIKE_API_SECRET` from the environment when you
+do not pass them, never logs them and redacts them from `repr(client)` — and therefore from
+`print(client)`, f-strings and most log formatters. `vars(client)` still shows `_secret`.
+
+## Install
+
+```bash
+pip install cryptolike
+```
+
+## Quickstart — to the first confirmed payment
+
+```python
+from cryptolike import Client, ApiError
+
+api = Client()  # CRYPTOLIKE_API_KEY_ID + CRYPTOLIKE_API_SECRET from the environment
+
+# 1. Create a payment on your server; send the customer to checkout_url.
+invoice = api.invoices.create(
+    amount="10.50", currency="USD", order_id="A-1001",
+    return_url="https://shop.example/orders/A-1001",
+    idempotency_key="order-A-1001",  # a retry never creates a second payment
+)
+redirect(invoice.checkout_url)
+
+# 2. Learn the outcome from the webhook (below) — or poll:
+detail = api.invoices.get(invoice.id)
+if detail.status == "paid":
+    fulfil(detail.order_id)
+```
+
+```python
+# 3. Webhook receiver (Flask) — verify over the RAW body, dedupe by event_id, answer 2xx fast.
+from flask import request, abort
+from cryptolike import verify_webhook, WebhookVerificationError
+
+@app.post("/hooks/cryptolike")
+def hook():
+    try:
+        event = verify_webhook(request.headers, request.get_data(), os.environ["CRYPTOLIKE_WEBHOOK_SECRET"])
+    except WebhookVerificationError:
+        abort(401)
+    if not already_seen(event.event_id):
+        handle(event)  # event.type == "invoice.paid" → fulfil
+    return "", 200
+```
+
+Full examples: [`examples/create_payment.py`](https://github.com/Cryptolike-net/cryptolike-python/blob/main/examples/create_payment.py), [`examples/flask_webhook.py`](https://github.com/Cryptolike-net/cryptolike-python/blob/main/examples/flask_webhook.py).
+
+## Resources
+
+| Resource | Methods |
+|---|---|
+| `api.invoices` | `create(amount, currency, *, coin_id, allowed_coin_ids, description, order_id, ttl_seconds, return_url, webhook_url, fee_paid_by, metadata, idempotency_by_order_id, idempotency_key)`, `get(id)`, `list(**filters)`, `iterate(**filters)`, `cancel(id)`, `export_csv(**filters)` |
+| `api.addresses` | `create(coin_id, customer_id, *, label)`, `get(id, limit=, cursor=)`, `list`, `iterate`, `archive(id)`, `restore(id)` |
+| `api` (archive) | `archive_static_address(id)`, `restore_static_address(id)`, `list_archived_static_addresses(**filters)`, `iterate_archived_static_addresses(**filters)` |
+| `api.transactions` | `list`, `iterate`, `get`, `export_csv` |
+| `api.balances` / `api.currencies` / `api.rates` | `list()` (`rates.list(fiat="EUR")`) |
+| `api.withdrawals` | `estimate(coin_id, amount, *, to_address)`, `create(coin_id, amount, to_address, *, payout_id, comment)`, `get`, `list`, `iterate`, `cancel` |
+| `api.webhooks.endpoints` | `list`, `create(url, events, *, secret)`, `get`, `update(id, *, url, events, enabled)`, `delete`, `rotate_secret` |
+| `api.webhooks.deliveries` | `list`, `get`, `retry` |
+| `api.embed` | `get()`, `set(allowed_origins)` — checkout widget allowlist |
+| `api.request(method, path, query=, body=, idempotency_key=)` | any endpoint, signed |
+
+### Static-address archive
+
+Archiving stops offering an address and takes it out of real-time scanning; it is never deleted, and its address is never issued again. The platform checks archived addresses for incoming transfers regularly (every 24 h by default): a transfer found is credited as usual and restores the address automatically (webhook `static_address.restored`, reason `deposit`). Addresses with no incoming transfers for the platform's period (180 days by default) are archived automatically after a warning 7 days earlier (`static_address.archive_warning`, then `static_address.archived` with reason `auto`).
+
+```python
+api.archive_static_address(address_id)                    # POST /v1/addresses/{id}/archive — a repeat is a no-op
+page = api.list_archived_static_addresses(search="shop")  # status=archived; coin_id, customer_id, limit, cursor
+for a in api.iterate_archived_static_addresses():
+    print(a.id, a.archive_reason)
+api.restore_static_address(address_id)                    # 409 conflict + details["active_address_id"]: archive the other active address first
+```
+
+`event.typed_data()` of a verified `static_address.*` event returns `StaticAddressArchivedData` / `StaticAddressRestoredData` (`reason`, `deposit`, `conflict_with`) / `StaticAddressArchiveWarningData` (`archive_after`, `inactive_since`); constants `STATIC_ADDRESS_ARCHIVED|RESTORED|ARCHIVE_WARNING`. Full example: `examples/static_address_archive.py`, `examples/flask_webhook.py`.
+
+List filters are keyword arguments named as in the API (`status="paid"`, `from_="2026-09-01T00:00:00Z"`
+— `from_` because `from` is a keyword). `list()` returns a `Page` (`items`, `next_cursor`);
+`iterate()` walks every page. Unknown response fields are kept in `.raw`.
+
+## Payer chooses the coin
+
+An invoice in a fiat currency (or a ticker on several networks) without `coin_id` lets the payer
+choose the coin on the payment page; each option shows an estimate (≈) — the exact amount and
+rate are fixed when the payer picks. `allowed_coin_ids` narrows the choice for one invoice; leave
+it out to offer every coin you offer for invoices:
+
+```python
+ids = [c.id for c in api.currencies.list()  # signed: each coin carries invoice_enabled
+       if c.invoice_enabled is not False and not c.maintenance and c.ticker == "USDT"]
+inv = api.invoices.create(amount="49.90", currency="USD", allowed_coin_ids=ids)
+# inv.allowed_coin_ids — the kept set; None = every coin offered for invoices.
+```
+
+The server keeps the ids you offer for invoices («Available for invoices» in the cabinet → Coins)
+that match `currency`, drops the rest; none left → `ApiError` 422 `no_allowed_coins`
+(`field == "allowed_coin_ids"`). Not combinable with `coin_id` (400). An empty list raises
+`ValueError` before the request — a filter that found nothing never turns into "every coin".
+
+## Errors
+
+Every non-2xx response raises `ApiError` with `status`, `code` (stable machine code), `message`,
+`details`, `field`, `retry_after` and `request_id`. Transport failures after all retries raise
+`NetworkError`. Codes: [Authentication §5](https://cryptolike.net/docs/auth), [API §5](https://cryptolike.net/docs/api).
+A payout with a key whose `withdraw` a developer requested and an owner/admin has not approved yet is
+`403` `WITHDRAW_PENDING_APPROVAL` (`e.withdraw_pending_approval`): nothing was created, not retried —
+approve the request in the cabinet (API keys); the key's other permissions work meanwhile.
+
+## Retries and idempotency
+
+`429` (after `Retry-After`, or backoff), `5xx` except `501`, and connection/timeout errors are
+retried up to `max_retries` (default 3) with `min(retry_max, retry_base · 2^attempt)` full-jitter
+backoff. Every `POST` carries an `Idempotency-Key` (yours, or a UUID generated once per call and
+reused on each retry), so a retry never creates a second invoice, address or withdrawal. Each
+attempt is signed with a fresh timestamp. A `401 auth.replay` — two identical requests signed
+within the same second share a signature — waits for the next second and signs afresh.
+
+## Options
+
+```python
+Client(key_id=None, secret=None, *, base_url=None, session=None, timeout=30.0,
+       max_retries=3, retry_base=0.5, retry_max=8.0, retry_after_max=30.0,
+       api_version="v1", app_info="my-shop/2.3")
+```
+
+## Webhook verification
+
+`verify_webhook(headers, raw_body, secret, *, tolerance=300, now=None)` returns a `WebhookEvent`
+(`event_id`, `type`, `created_at`, `data`, `raw`) or raises `WebhookVerificationError` (`reason`:
+`missing_header` | `invalid_timestamp` | `timestamp_out_of_tolerance` | `invalid_signature` |
+`invalid_body`). `raw_body` must be the bytes as received (Flask `request.get_data()`, Django
+`request.body`). Answer `401`/`400` on failure, `2xx` on success, and deduplicate by `event_id` —
+deliveries are at least once and may arrive out of order.

cryptolike-0.1.0/README.md

@@ -0,0 +1,152 @@
+# cryptolike (Python SDK)
+
+Official **server-side** SDK for the CryptoLike merchant API (Python ≥ 3.10, `requests`; typed, `py.typed`).
+
+- Signed requests (`X-API-Key` / `X-Timestamp` / `X-Signature`, HMAC-SHA256 — [Authentication](https://cryptolike.net/docs/auth))
+- `Idempotency-Key` generated for every `POST` (pass your own to make retries exact)
+- Retries with exponential backoff and jitter on `429` (honours `Retry-After`), `5xx` and transport errors
+- Dataclasses for every object; amounts are `Decimal` — floats are refused
+- `verify_webhook()` — signature and timestamp check of webhook deliveries ([Webhooks](https://cryptolike.net/docs/webhooks))
+
+## The secret stays on your server
+
+> The API secret signs requests *as you*: whoever has it can create payments, read balances and
+> change your webhooks. Use this SDK from your backend only; never put the secret into code that
+> ships to a browser or a mobile app. Your page needs only the invoice id / `checkout_url` your
+> server obtained — see [Payment widget §1](https://cryptolike.net/docs/widget).
+
+The client reads `CRYPTOLIKE_API_KEY_ID` and `CRYPTOLIKE_API_SECRET` from the environment when you
+do not pass them, never logs them and redacts them from `repr(client)` — and therefore from
+`print(client)`, f-strings and most log formatters. `vars(client)` still shows `_secret`.
+
+## Install
+
+```bash
+pip install cryptolike
+```
+
+## Quickstart — to the first confirmed payment
+
+```python
+from cryptolike import Client, ApiError
+
+api = Client()  # CRYPTOLIKE_API_KEY_ID + CRYPTOLIKE_API_SECRET from the environment
+
+# 1. Create a payment on your server; send the customer to checkout_url.
+invoice = api.invoices.create(
+    amount="10.50", currency="USD", order_id="A-1001",
+    return_url="https://shop.example/orders/A-1001",
+    idempotency_key="order-A-1001",  # a retry never creates a second payment
+)
+redirect(invoice.checkout_url)
+
+# 2. Learn the outcome from the webhook (below) — or poll:
+detail = api.invoices.get(invoice.id)
+if detail.status == "paid":
+    fulfil(detail.order_id)
+```
+
+```python
+# 3. Webhook receiver (Flask) — verify over the RAW body, dedupe by event_id, answer 2xx fast.
+from flask import request, abort
+from cryptolike import verify_webhook, WebhookVerificationError
+
+@app.post("/hooks/cryptolike")
+def hook():
+    try:
+        event = verify_webhook(request.headers, request.get_data(), os.environ["CRYPTOLIKE_WEBHOOK_SECRET"])
+    except WebhookVerificationError:
+        abort(401)
+    if not already_seen(event.event_id):
+        handle(event)  # event.type == "invoice.paid" → fulfil
+    return "", 200
+```
+
+Full examples: [`examples/create_payment.py`](https://github.com/Cryptolike-net/cryptolike-python/blob/main/examples/create_payment.py), [`examples/flask_webhook.py`](https://github.com/Cryptolike-net/cryptolike-python/blob/main/examples/flask_webhook.py).
+
+## Resources
+
+| Resource | Methods |
+|---|---|
+| `api.invoices` | `create(amount, currency, *, coin_id, allowed_coin_ids, description, order_id, ttl_seconds, return_url, webhook_url, fee_paid_by, metadata, idempotency_by_order_id, idempotency_key)`, `get(id)`, `list(**filters)`, `iterate(**filters)`, `cancel(id)`, `export_csv(**filters)` |
+| `api.addresses` | `create(coin_id, customer_id, *, label)`, `get(id, limit=, cursor=)`, `list`, `iterate`, `archive(id)`, `restore(id)` |
+| `api` (archive) | `archive_static_address(id)`, `restore_static_address(id)`, `list_archived_static_addresses(**filters)`, `iterate_archived_static_addresses(**filters)` |
+| `api.transactions` | `list`, `iterate`, `get`, `export_csv` |
+| `api.balances` / `api.currencies` / `api.rates` | `list()` (`rates.list(fiat="EUR")`) |
+| `api.withdrawals` | `estimate(coin_id, amount, *, to_address)`, `create(coin_id, amount, to_address, *, payout_id, comment)`, `get`, `list`, `iterate`, `cancel` |
+| `api.webhooks.endpoints` | `list`, `create(url, events, *, secret)`, `get`, `update(id, *, url, events, enabled)`, `delete`, `rotate_secret` |
+| `api.webhooks.deliveries` | `list`, `get`, `retry` |
+| `api.embed` | `get()`, `set(allowed_origins)` — checkout widget allowlist |
+| `api.request(method, path, query=, body=, idempotency_key=)` | any endpoint, signed |
+
+### Static-address archive
+
+Archiving stops offering an address and takes it out of real-time scanning; it is never deleted, and its address is never issued again. The platform checks archived addresses for incoming transfers regularly (every 24 h by default): a transfer found is credited as usual and restores the address automatically (webhook `static_address.restored`, reason `deposit`). Addresses with no incoming transfers for the platform's period (180 days by default) are archived automatically after a warning 7 days earlier (`static_address.archive_warning`, then `static_address.archived` with reason `auto`).
+
+```python
+api.archive_static_address(address_id)                    # POST /v1/addresses/{id}/archive — a repeat is a no-op
+page = api.list_archived_static_addresses(search="shop")  # status=archived; coin_id, customer_id, limit, cursor
+for a in api.iterate_archived_static_addresses():
+    print(a.id, a.archive_reason)
+api.restore_static_address(address_id)                    # 409 conflict + details["active_address_id"]: archive the other active address first
+```
+
+`event.typed_data()` of a verified `static_address.*` event returns `StaticAddressArchivedData` / `StaticAddressRestoredData` (`reason`, `deposit`, `conflict_with`) / `StaticAddressArchiveWarningData` (`archive_after`, `inactive_since`); constants `STATIC_ADDRESS_ARCHIVED|RESTORED|ARCHIVE_WARNING`. Full example: `examples/static_address_archive.py`, `examples/flask_webhook.py`.
+
+List filters are keyword arguments named as in the API (`status="paid"`, `from_="2026-09-01T00:00:00Z"`
+— `from_` because `from` is a keyword). `list()` returns a `Page` (`items`, `next_cursor`);
+`iterate()` walks every page. Unknown response fields are kept in `.raw`.
+
+## Payer chooses the coin
+
+An invoice in a fiat currency (or a ticker on several networks) without `coin_id` lets the payer
+choose the coin on the payment page; each option shows an estimate (≈) — the exact amount and
+rate are fixed when the payer picks. `allowed_coin_ids` narrows the choice for one invoice; leave
+it out to offer every coin you offer for invoices:
+
+```python
+ids = [c.id for c in api.currencies.list()  # signed: each coin carries invoice_enabled
+       if c.invoice_enabled is not False and not c.maintenance and c.ticker == "USDT"]
+inv = api.invoices.create(amount="49.90", currency="USD", allowed_coin_ids=ids)
+# inv.allowed_coin_ids — the kept set; None = every coin offered for invoices.
+```
+
+The server keeps the ids you offer for invoices («Available for invoices» in the cabinet → Coins)
+that match `currency`, drops the rest; none left → `ApiError` 422 `no_allowed_coins`
+(`field == "allowed_coin_ids"`). Not combinable with `coin_id` (400). An empty list raises
+`ValueError` before the request — a filter that found nothing never turns into "every coin".
+
+## Errors
+
+Every non-2xx response raises `ApiError` with `status`, `code` (stable machine code), `message`,
+`details`, `field`, `retry_after` and `request_id`. Transport failures after all retries raise
+`NetworkError`. Codes: [Authentication §5](https://cryptolike.net/docs/auth), [API §5](https://cryptolike.net/docs/api).
+A payout with a key whose `withdraw` a developer requested and an owner/admin has not approved yet is
+`403` `WITHDRAW_PENDING_APPROVAL` (`e.withdraw_pending_approval`): nothing was created, not retried —
+approve the request in the cabinet (API keys); the key's other permissions work meanwhile.
+
+## Retries and idempotency
+
+`429` (after `Retry-After`, or backoff), `5xx` except `501`, and connection/timeout errors are
+retried up to `max_retries` (default 3) with `min(retry_max, retry_base · 2^attempt)` full-jitter
+backoff. Every `POST` carries an `Idempotency-Key` (yours, or a UUID generated once per call and
+reused on each retry), so a retry never creates a second invoice, address or withdrawal. Each
+attempt is signed with a fresh timestamp. A `401 auth.replay` — two identical requests signed
+within the same second share a signature — waits for the next second and signs afresh.
+
+## Options
+
+```python
+Client(key_id=None, secret=None, *, base_url=None, session=None, timeout=30.0,
+       max_retries=3, retry_base=0.5, retry_max=8.0, retry_after_max=30.0,
+       api_version="v1", app_info="my-shop/2.3")
+```
+
+## Webhook verification
+
+`verify_webhook(headers, raw_body, secret, *, tolerance=300, now=None)` returns a `WebhookEvent`
+(`event_id`, `type`, `created_at`, `data`, `raw`) or raises `WebhookVerificationError` (`reason`:
+`missing_header` | `invalid_timestamp` | `timestamp_out_of_tolerance` | `invalid_signature` |
+`invalid_body`). `raw_body` must be the bytes as received (Flask `request.get_data()`, Django
+`request.body`). Answer `401`/`400` on failure, `2xx` on success, and deduplicate by `event_id` —
+deliveries are at least once and may arrive out of order.

cryptolike-0.1.0/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["setuptools>=77", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "cryptolike"
+version = "0.1.0"
+description = "Official server-side SDK for the CryptoLike merchant API: signed requests, automatic Idempotency-Key, retries with backoff, typed resources and webhook verification."
+readme = "README.md"
+license = "MIT"  # SPDX (PEP 639)
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+authors = [{ name = "CryptoLike team" }]
+keywords = ["cryptolike", "crypto", "cryptocurrency", "crypto payments", "payment gateway", "payments", "bitcoin", "usdt", "invoices", "webhooks", "hmac", "api client", "sdk"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "Topic :: Office/Business :: Financial",
+  "Topic :: Software Development :: Libraries :: Python Modules",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Operating System :: OS Independent",
+  "Typing :: Typed",
+]
+dependencies = ["requests>=2.33.0", "urllib3>=2.8.0"]
+
+[project.optional-dependencies]
+test = ["pytest>=7"]
+
+[project.urls]
+Homepage = "https://github.com/Cryptolike-net/cryptolike-python"
+Documentation = "https://cryptolike.net/docs/sdk"
+Repository = "https://github.com/Cryptolike-net/cryptolike-python"
+Issues = "https://github.com/Cryptolike-net/cryptolike-python/issues"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+cryptolike = ["py.typed"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

cryptolike-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

cryptolike-0.1.0/src/cryptolike/__init__.py

@@ -0,0 +1,87 @@
+"""cryptolike — official server-side SDK for the CryptoLike merchant API.
+
+    from cryptolike import Client, verify_webhook
+
+    api = Client()  # CRYPTOLIKE_API_KEY_ID + CRYPTOLIKE_API_SECRET from the environment
+    invoice = api.invoices.create(amount="10.50", currency="USD", order_id="A-1001")
+
+The API secret must stay on your server (https://cryptolike.net/docs/widget §1).
+"""
+
+from ._version import USER_AGENT, VERSION
+from .auth import body_sha256, canonical_string, sign
+from .client import Client
+from .errors import WITHDRAW_PENDING_APPROVAL, ApiError, CryptoLikeError, NetworkError, WebhookVerificationError
+from .types import (
+    Balance,
+    Currency,
+    EmbedSettings,
+    Invoice,
+    InvoiceEvent,
+    Page,
+    Rate,
+    StaticAddress,
+    StaticAddressArchivedData,
+    StaticAddressArchiveWarningData,
+    StaticAddressCard,
+    StaticAddressRestoreDeposit,
+    StaticAddressRestoredData,
+    Transaction,
+    WebhookDelivery,
+    WebhookEndpoint,
+    WebhookEndpointCreated,
+    WebhookStaticAddress,
+    Withdrawal,
+    WithdrawalEstimate,
+)
+from .webhook import (
+    EVENT_DATA_TYPES,
+    STATIC_ADDRESS_ARCHIVE_WARNING,
+    STATIC_ADDRESS_ARCHIVED,
+    STATIC_ADDRESS_RESTORED,
+    WebhookEvent,
+    verify_webhook,
+    webhook_signature,
+)
+
+__version__ = VERSION
+__all__ = [
+    "Client",
+    "ApiError",
+    "WITHDRAW_PENDING_APPROVAL",
+    "CryptoLikeError",
+    "NetworkError",
+    "WebhookVerificationError",
+    "WebhookEvent",
+    "verify_webhook",
+    "webhook_signature",
+    "EVENT_DATA_TYPES",
+    "STATIC_ADDRESS_ARCHIVED",
+    "STATIC_ADDRESS_RESTORED",
+    "STATIC_ADDRESS_ARCHIVE_WARNING",
+    "sign",
+    "canonical_string",
+    "body_sha256",
+    "Balance",
+    "Currency",
+    "EmbedSettings",
+    "Invoice",
+    "InvoiceEvent",
+    "Page",
+    "Rate",
+    "StaticAddress",
+    "StaticAddressCard",
+    "StaticAddressArchivedData",
+    "StaticAddressRestoredData",
+    "StaticAddressArchiveWarningData",
+    "StaticAddressRestoreDeposit",
+    "WebhookStaticAddress",
+    "Transaction",
+    "WebhookDelivery",
+    "WebhookEndpoint",
+    "WebhookEndpointCreated",
+    "Withdrawal",
+    "WithdrawalEstimate",
+    "VERSION",
+    "USER_AGENT",
+]

cryptolike-0.1.0/src/cryptolike/_version.py

@@ -0,0 +1,4 @@
+"""Package version — kept in sync with pyproject.toml by tests/test_version.py."""
+
+VERSION = "0.1.0"
+USER_AGENT = f"cryptolike-sdk-python/{VERSION}"

cryptolike-0.1.0/src/cryptolike/auth.py

@@ -0,0 +1,32 @@
+"""Request signing (https://cryptolike.net/docs/auth §3). Runs on your server only — the secret never leaves it."""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+from typing import Union
+
+Bytes = Union[bytes, bytearray, memoryview]
+
+EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+
+
+def _to_bytes(body: Union[str, Bytes]) -> bytes:
+    return body.encode("utf-8") if isinstance(body, str) else bytes(body)
+
+
+def body_sha256(body: Union[str, Bytes] = b"") -> str:
+    """Lower-case hex SHA-256 of the raw body bytes (a string is taken as UTF-8)."""
+    data = _to_bytes(body)
+    return EMPTY_SHA256 if not data else hashlib.sha256(data).hexdigest()
+
+
+def canonical_string(timestamp: Union[int, str], method: str, path_query: str, body: Union[str, Bytes] = b"") -> str:
+    """Four lines joined with LF, no trailing newline. ``path_query`` is the target exactly as sent."""
+    return "\n".join([str(timestamp), method.upper(), path_query, body_sha256(body)])
+
+
+def sign(secret: str, timestamp: Union[int, str], method: str, path_query: str, body: Union[str, Bytes] = b"") -> str:
+    """``X-Signature``: hex HMAC-SHA256 of the canonical string, keyed with the secret as shown in the cabinet."""
+    canonical = canonical_string(timestamp, method, path_query, body)
+    return hmac.new(secret.encode("utf-8"), canonical.encode("utf-8"), hashlib.sha256).hexdigest()