hpke-http 0.1.2__tar.gz

hpke_http-0.1.2/PKG-INFO

@@ -0,0 +1,266 @@
+Metadata-Version: 2.4
+Name: hpke_http
+Version: 0.1.2
+Summary: End-to-end encryption for HTTP APIs using RFC 9180 HPKE
+Author: Duale AI
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/dualeai/hpke-http
+Project-URL: Documentation, https://github.com/dualeai/hpke-http#readme
+Project-URL: Repository, https://github.com/dualeai/hpke-http.git
+Project-URL: Changelog, https://github.com/dualeai/hpke-http/releases
+Project-URL: Issues, https://github.com/dualeai/hpke-http/issues
+Keywords: hpke,encryption,rfc9180,cryptography,http,e2e,chacha20,x25519,fastapi,aiohttp,sse,streaming
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography~=46.0
+Provides-Extra: dev
+Requires-Dist: granian~=2.0; extra == "dev"
+Requires-Dist: hypothesis~=6.148; extra == "dev"
+Requires-Dist: pyright~=1.1; extra == "dev"
+Requires-Dist: pytest-asyncio~=0.24; extra == "dev"
+Requires-Dist: pytest-cov~=7.0; extra == "dev"
+Requires-Dist: pytest-mock~=3.14; extra == "dev"
+Requires-Dist: pytest-xdist[psutil]~=3.8; extra == "dev"
+Requires-Dist: pytest~=8.3; extra == "dev"
+Requires-Dist: ruff~=0.7; extra == "dev"
+Requires-Dist: twine~=6.1; extra == "dev"
+Requires-Dist: typing_extensions~=4.12; extra == "dev"
+Requires-Dist: vulture~=2.14; extra == "dev"
+Provides-Extra: testing
+Requires-Dist: pytest-asyncio~=0.24; extra == "testing"
+Requires-Dist: pytest~=8.3; extra == "testing"
+Provides-Extra: fastapi
+Requires-Dist: starlette~=0.50; extra == "fastapi"
+Provides-Extra: aiohttp
+Requires-Dist: aiohttp~=3.13; extra == "aiohttp"
+Provides-Extra: zstd
+Requires-Dist: backports.zstd>=1.0; python_version < "3.14" and extra == "zstd"
+
+# hpke-http
+
+End-to-end encryption for HTTP APIs.
+
+```bash
+uv add git+https://github.com/duale-ai/hpke-http
+```
+
+## Highlights
+
+- **Transparent** - Drop-in middleware, no application code changes
+- **E2E encryption** - Protects data even with TLS termination at CDN/LB
+- **PSK binding** - Each request cryptographically bound to API key
+- **Replay protection** - SSE counter prevents replay attacks
+- **RFC 9180 compliant** - Auditable, interoperable standard
+
+## Quick Start
+
+### Server (FastAPI)
+
+```python
+from fastapi import FastAPI, Request
+from fastapi.responses import StreamingResponse
+from hpke_http.middleware.fastapi import HPKEMiddleware
+from hpke_http.constants import KemId
+
+app = FastAPI()
+
+async def resolve_psk(scope: dict) -> tuple[bytes, bytes]:
+    api_key = dict(scope["headers"]).get(b"authorization", b"").decode()
+    return (api_key.encode(), (await lookup_tenant(api_key)).encode())
+
+app.add_middleware(
+    HPKEMiddleware,
+    private_keys={KemId.DHKEM_X25519_HKDF_SHA256: private_key},
+    psk_resolver=resolve_psk,
+    # compress=True,  # Optional: Zstd compression for SSE responses
+    # max_sse_event_size=128 * 1024 * 1024,  # Optional: 128MB for large payloads
+)
+
+@app.post("/chat")
+async def chat(request: Request):
+    data = await request.json()  # Decrypted by middleware
+
+    async def generate():
+        yield b"event: progress\ndata: {\"step\": 1}\n\n"
+        yield b"event: complete\ndata: {\"result\": \"done\"}\n\n"
+
+    # Just use StreamingResponse - encryption is automatic!
+    return StreamingResponse(generate(), media_type="text/event-stream")
+```
+
+### Client (aiohttp)
+
+```python
+from hpke_http.middleware.aiohttp import HPKEClientSession
+
+async with HPKEClientSession(
+    base_url="https://api.example.com",
+    psk=api_key,        # >= 32 bytes
+    psk_id=tenant_id,
+    # compress=True,    # Optional: Zstd compression for requests
+) as session:
+    resp = await session.post("/chat", json={"prompt": "Hello"})
+    async for chunk in session.iter_sse(resp):
+        # bytes - matches native aiohttp response.content iteration
+        print(chunk)  # b"event: progress\ndata: {...}\n\n"
+```
+
+## Documentation
+
+- [RFC 9180 - HPKE](https://datatracker.ietf.org/doc/rfc9180/)
+- [RFC 7748 - X25519](https://datatracker.ietf.org/doc/rfc7748/)
+- [RFC 5869 - HKDF](https://datatracker.ietf.org/doc/rfc5869/)
+- [RFC 8439 - ChaCha20-Poly1305](https://datatracker.ietf.org/doc/rfc8439/)
+- [RFC 8878 - Zstandard](https://datatracker.ietf.org/doc/rfc8878/) (optional compression)
+
+## Cipher Suite
+
+| Component | Algorithm | ID |
+|-----------|-----------|------|
+| KEM | DHKEM(X25519, HKDF-SHA256) | 0x0020 |
+| KDF | HKDF-SHA256 | 0x0001 |
+| AEAD | ChaCha20-Poly1305 | 0x0003 |
+| Mode | PSK | 0x01 |
+
+## Wire Format
+
+### Request
+
+```text
+┌─────────┬─────────┬─────────┬─────────┬──────┬────────────┐
+│ Ver(1B) │ KEM(2B) │ KDF(2B) │AEAD(2B) │Mode  │ Ciphertext │
+│  0x01   │ 0x0020  │ 0x0001  │ 0x0003  │(1B)  │  + 16B tag │
+└─────────┴─────────┴─────────┴─────────┴──────┴────────────┘
+Header: X-HPKE-Enc: <base64url(32B ephemeral key)>
+Overhead: 24 bytes (8B header + 16B tag)
+```
+
+### SSE Event
+
+```text
+event: enc
+data: <base64url(counter_be32 || ciphertext || tag)>
+Decrypted: raw SSE chunk (e.g., "event: progress\ndata: {...}\n\n")
+```
+
+## How SSE Auto-Encryption Works
+
+The middleware automatically encrypts SSE responses when **both** conditions are met:
+
+1. **Request was encrypted** - `SCOPE_HPKE_CONTEXT` exists in scope (from decrypted request)
+2. **Response is SSE** - `Content-Type: text/event-stream` header detected
+
+```python
+# Middleware detection logic (simplified)
+from hpke_http.constants import SCOPE_HPKE_CONTEXT
+
+if scope.get(SCOPE_HPKE_CONTEXT) and b"text/event-stream" in content_type:
+    # Auto-encrypt this streaming response
+```
+
+This is why `media_type="text/event-stream"` is required - it's the WHATWG-standard MIME type that signals "this is an SSE stream" to both browsers and the middleware.
+
+## Compression (Optional)
+
+Zstd compression reduces bandwidth by **40-95%** for JSON/text. Events <64B are sent uncompressed automatically.
+
+```python
+HPKEMiddleware(..., compress=True)      # Server: compress SSE responses
+HPKEClientSession(..., compress=True)   # Client: compress requests
+```
+
+### Design
+
+| Choice | Rationale |
+|--------|-----------|
+| **Compress-then-encrypt** | Encrypted data is incompressible |
+| **Zstd (RFC 8878)** | Best ratio/speed. Python 3.14 native. |
+| **64B threshold** | Smaller payloads skip compression |
+| **Per-chunk** | Each SSE event independent for streaming |
+
+### Expected Savings
+
+| Data Type | Savings |
+|-----------|---------|
+| Large JSON (>1KB) | 80-95% |
+| Medium JSON (200B-1KB) | 40-70% |
+| HTML/XML | 70-85% |
+| Logs, code | 40-60% |
+| Small events (64-200B) | 0-20% |
+| Base64, random | 0-25% |
+
+### Wire Format
+
+```text
+Plaintext:  encoding_id (1B) || compressed_data
+Encoding:   0x00 = identity, 0x01 = zstd
+```
+
+## Pitfalls
+
+```python
+# PSK too short
+HPKEClientSession(psk=b"short")                 # ❌ InvalidPSKError
+HPKEClientSession(psk=secrets.token_bytes(32))  # ✅ >= 32 bytes
+
+# SSE without proper content-type (won't auto-encrypt)
+return StreamingResponse(gen())                                    # ❌ No encryption
+return StreamingResponse(gen(), media_type="text/event-stream")    # ✅ Auto-encrypted
+
+# Out-of-order decryption (multi-message context)
+recipient.open(aad, ct2)  # ❌ Expects seq=0
+recipient.open(aad, ct1)  # ✅ Decrypt in order
+```
+
+## Limits
+
+| Resource | Limit |
+|----------|-------|
+| HPKE messages/context | 2^96-1 |
+| SSE events/session | 2^32-1 |
+| SSE event buffer | 64MB (configurable) |
+| PSK minimum | 32 bytes |
+| Overhead | 24 bytes |
+
+> **Note:** SSE is text-only (UTF-8). Binary data must be base64-encoded (+33% overhead).
+
+## Security
+
+Uses OpenSSL constant-time implementations via `cryptography` library.
+
+## Development
+
+```bash
+# Install with extras
+uv add "hpke-http[fastapi] @ git+https://github.com/duale-ai/hpke-http"        # Server
+uv add "hpke-http[aiohttp] @ git+https://github.com/duale-ai/hpke-http"        # Client
+uv add "hpke-http[fastapi,zstd] @ git+https://github.com/duale-ai/hpke-http"   # Server + compression
+
+# Local development
+make install      # Setup venv
+make test         # Run tests (1273 tests, 93% coverage)
+make test-fuzz    # Property-based fuzz tests
+make lint         # Format and lint
+```
+
+### Low-Level API
+
+```python
+from hpke_http.hpke import seal_psk, open_psk
+
+enc, ct = seal_psk(pk_r, b"info", psk, psk_id, b"aad", b"plaintext")
+pt = open_psk(enc, sk_r, b"info", psk, psk_id, b"aad", ct)
+```

hpke_http-0.1.2/README.md

@@ -0,0 +1,215 @@
+# hpke-http
+
+End-to-end encryption for HTTP APIs.
+
+```bash
+uv add git+https://github.com/duale-ai/hpke-http
+```
+
+## Highlights
+
+- **Transparent** - Drop-in middleware, no application code changes
+- **E2E encryption** - Protects data even with TLS termination at CDN/LB
+- **PSK binding** - Each request cryptographically bound to API key
+- **Replay protection** - SSE counter prevents replay attacks
+- **RFC 9180 compliant** - Auditable, interoperable standard
+
+## Quick Start
+
+### Server (FastAPI)
+
+```python
+from fastapi import FastAPI, Request
+from fastapi.responses import StreamingResponse
+from hpke_http.middleware.fastapi import HPKEMiddleware
+from hpke_http.constants import KemId
+
+app = FastAPI()
+
+async def resolve_psk(scope: dict) -> tuple[bytes, bytes]:
+    api_key = dict(scope["headers"]).get(b"authorization", b"").decode()
+    return (api_key.encode(), (await lookup_tenant(api_key)).encode())
+
+app.add_middleware(
+    HPKEMiddleware,
+    private_keys={KemId.DHKEM_X25519_HKDF_SHA256: private_key},
+    psk_resolver=resolve_psk,
+    # compress=True,  # Optional: Zstd compression for SSE responses
+    # max_sse_event_size=128 * 1024 * 1024,  # Optional: 128MB for large payloads
+)
+
+@app.post("/chat")
+async def chat(request: Request):
+    data = await request.json()  # Decrypted by middleware
+
+    async def generate():
+        yield b"event: progress\ndata: {\"step\": 1}\n\n"
+        yield b"event: complete\ndata: {\"result\": \"done\"}\n\n"
+
+    # Just use StreamingResponse - encryption is automatic!
+    return StreamingResponse(generate(), media_type="text/event-stream")
+```
+
+### Client (aiohttp)
+
+```python
+from hpke_http.middleware.aiohttp import HPKEClientSession
+
+async with HPKEClientSession(
+    base_url="https://api.example.com",
+    psk=api_key,        # >= 32 bytes
+    psk_id=tenant_id,
+    # compress=True,    # Optional: Zstd compression for requests
+) as session:
+    resp = await session.post("/chat", json={"prompt": "Hello"})
+    async for chunk in session.iter_sse(resp):
+        # bytes - matches native aiohttp response.content iteration
+        print(chunk)  # b"event: progress\ndata: {...}\n\n"
+```
+
+## Documentation
+
+- [RFC 9180 - HPKE](https://datatracker.ietf.org/doc/rfc9180/)
+- [RFC 7748 - X25519](https://datatracker.ietf.org/doc/rfc7748/)
+- [RFC 5869 - HKDF](https://datatracker.ietf.org/doc/rfc5869/)
+- [RFC 8439 - ChaCha20-Poly1305](https://datatracker.ietf.org/doc/rfc8439/)
+- [RFC 8878 - Zstandard](https://datatracker.ietf.org/doc/rfc8878/) (optional compression)
+
+## Cipher Suite
+
+| Component | Algorithm | ID |
+|-----------|-----------|------|
+| KEM | DHKEM(X25519, HKDF-SHA256) | 0x0020 |
+| KDF | HKDF-SHA256 | 0x0001 |
+| AEAD | ChaCha20-Poly1305 | 0x0003 |
+| Mode | PSK | 0x01 |
+
+## Wire Format
+
+### Request
+
+```text
+┌─────────┬─────────┬─────────┬─────────┬──────┬────────────┐
+│ Ver(1B) │ KEM(2B) │ KDF(2B) │AEAD(2B) │Mode  │ Ciphertext │
+│  0x01   │ 0x0020  │ 0x0001  │ 0x0003  │(1B)  │  + 16B tag │
+└─────────┴─────────┴─────────┴─────────┴──────┴────────────┘
+Header: X-HPKE-Enc: <base64url(32B ephemeral key)>
+Overhead: 24 bytes (8B header + 16B tag)
+```
+
+### SSE Event
+
+```text
+event: enc
+data: <base64url(counter_be32 || ciphertext || tag)>
+Decrypted: raw SSE chunk (e.g., "event: progress\ndata: {...}\n\n")
+```
+
+## How SSE Auto-Encryption Works
+
+The middleware automatically encrypts SSE responses when **both** conditions are met:
+
+1. **Request was encrypted** - `SCOPE_HPKE_CONTEXT` exists in scope (from decrypted request)
+2. **Response is SSE** - `Content-Type: text/event-stream` header detected
+
+```python
+# Middleware detection logic (simplified)
+from hpke_http.constants import SCOPE_HPKE_CONTEXT
+
+if scope.get(SCOPE_HPKE_CONTEXT) and b"text/event-stream" in content_type:
+    # Auto-encrypt this streaming response
+```
+
+This is why `media_type="text/event-stream"` is required - it's the WHATWG-standard MIME type that signals "this is an SSE stream" to both browsers and the middleware.
+
+## Compression (Optional)
+
+Zstd compression reduces bandwidth by **40-95%** for JSON/text. Events <64B are sent uncompressed automatically.
+
+```python
+HPKEMiddleware(..., compress=True)      # Server: compress SSE responses
+HPKEClientSession(..., compress=True)   # Client: compress requests
+```
+
+### Design
+
+| Choice | Rationale |
+|--------|-----------|
+| **Compress-then-encrypt** | Encrypted data is incompressible |
+| **Zstd (RFC 8878)** | Best ratio/speed. Python 3.14 native. |
+| **64B threshold** | Smaller payloads skip compression |
+| **Per-chunk** | Each SSE event independent for streaming |
+
+### Expected Savings
+
+| Data Type | Savings |
+|-----------|---------|
+| Large JSON (>1KB) | 80-95% |
+| Medium JSON (200B-1KB) | 40-70% |
+| HTML/XML | 70-85% |
+| Logs, code | 40-60% |
+| Small events (64-200B) | 0-20% |
+| Base64, random | 0-25% |
+
+### Wire Format
+
+```text
+Plaintext:  encoding_id (1B) || compressed_data
+Encoding:   0x00 = identity, 0x01 = zstd
+```
+
+## Pitfalls
+
+```python
+# PSK too short
+HPKEClientSession(psk=b"short")                 # ❌ InvalidPSKError
+HPKEClientSession(psk=secrets.token_bytes(32))  # ✅ >= 32 bytes
+
+# SSE without proper content-type (won't auto-encrypt)
+return StreamingResponse(gen())                                    # ❌ No encryption
+return StreamingResponse(gen(), media_type="text/event-stream")    # ✅ Auto-encrypted
+
+# Out-of-order decryption (multi-message context)
+recipient.open(aad, ct2)  # ❌ Expects seq=0
+recipient.open(aad, ct1)  # ✅ Decrypt in order
+```
+
+## Limits
+
+| Resource | Limit |
+|----------|-------|
+| HPKE messages/context | 2^96-1 |
+| SSE events/session | 2^32-1 |
+| SSE event buffer | 64MB (configurable) |
+| PSK minimum | 32 bytes |
+| Overhead | 24 bytes |
+
+> **Note:** SSE is text-only (UTF-8). Binary data must be base64-encoded (+33% overhead).
+
+## Security
+
+Uses OpenSSL constant-time implementations via `cryptography` library.
+
+## Development
+
+```bash
+# Install with extras
+uv add "hpke-http[fastapi] @ git+https://github.com/duale-ai/hpke-http"        # Server
+uv add "hpke-http[aiohttp] @ git+https://github.com/duale-ai/hpke-http"        # Client
+uv add "hpke-http[fastapi,zstd] @ git+https://github.com/duale-ai/hpke-http"   # Server + compression
+
+# Local development
+make install      # Setup venv
+make test         # Run tests (1273 tests, 93% coverage)
+make test-fuzz    # Property-based fuzz tests
+make lint         # Format and lint
+```
+
+### Low-Level API
+
+```python
+from hpke_http.hpke import seal_psk, open_psk
+
+enc, ct = seal_psk(pk_r, b"info", psk, psk_id, b"aad", b"plaintext")
+pt = open_psk(enc, sk_r, b"info", psk, psk_id, b"aad", ct)
+```

hpke_http-0.1.2/pyproject.toml

@@ -0,0 +1,174 @@
+[project]
+name = "hpke_http"
+version = "0.1.2"
+description = "End-to-end encryption for HTTP APIs using RFC 9180 HPKE"
+readme = "README.md"
+license = "Apache-2.0"
+requires-python = ">=3.10"
+authors = [
+    {name = "Duale AI"},
+]
+keywords = [
+    "hpke",
+    "encryption",
+    "rfc9180",
+    "cryptography",
+    "http",
+    "e2e",
+    "chacha20",
+    "x25519",
+    "fastapi",
+    "aiohttp",
+    "sse",
+    "streaming",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: Implementation :: CPython",
+    "Topic :: Security :: Cryptography",
+    "Topic :: Internet :: WWW/HTTP",
+    "Typing :: Typed",
+]
+dependencies = [
+    "cryptography~=46.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "granian~=2.0",              # Rust ASGI server for E2E tests
+    "hypothesis~=6.148",         # Property-based fuzz testing
+    "pyright~=1.1",
+    "pytest-asyncio~=0.24",
+    "pytest-cov~=7.0",
+    "pytest-mock~=3.14",
+    "pytest-xdist[psutil]~=3.8",
+    "pytest~=8.3",
+    "ruff~=0.7",
+    "twine~=6.1",                # Package verification before PyPI upload
+    "typing_extensions~=4.12",   # assert_type for API contract tests (Python 3.10)
+    "vulture~=2.14",
+]
+# For downstream services using testing fixtures
+testing = [
+    "pytest-asyncio~=0.24",
+    "pytest~=8.3",
+]
+# FastAPI middleware (optional for server-side)
+fastapi = [
+    "starlette~=0.50",  # Upgraded from ~=0.41 for security fixes
+]
+# aiohttp client (optional for client-side)
+aiohttp = [
+    "aiohttp~=3.13",  # Upgraded from ~=3.11 for security fixes
+]
+# Zstd compression (optional, RFC 8878)
+zstd = [
+    "backports.zstd>=1.0; python_version<'3.14'",
+]
+
+[project.urls]
+Homepage = "https://github.com/dualeai/hpke-http"
+Documentation = "https://github.com/dualeai/hpke-http#readme"
+Repository = "https://github.com/dualeai/hpke-http.git"
+Changelog = "https://github.com/dualeai/hpke-http/releases"
+Issues = "https://github.com/dualeai/hpke-http/issues"
+
+[build-system]
+requires = ["setuptools>=78.1.1"]  # Pinned for CVE-2025-47273
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["hpke_http*"]
+
+[tool.setuptools.package-data]
+hpke_http = ["py.typed"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+asyncio_mode = "auto"
+addopts = [
+    "--cov=hpke_http",            # Package name
+    "--cov-report=term-missing", # Show missing lines in terminal
+    "--cov-report=html",         # Generate HTML report
+    "--cov-fail-under=80",       # Require 80% minimum coverage
+    "--tb=short",                # Short traceback format
+    "-v",                        # Verbose output, easier LLM debugging
+    "--strict-markers",          # Ensure all markers are registered
+    "-n",                        # Run tests in parallel
+    "auto",                      # Use all available CPUs
+]
+markers = [
+    "vectors: RFC 9180 test vector validation (slow, 74MB JSON)",
+    "fuzz: Property-based fuzz tests using Hypothesis",
+]
+
+# Subprocess coverage for granian E2E tests (pytest-cov 7.x)
+[tool.coverage.run]
+patch = ["subprocess", "fork", "_exit"]
+parallel = true
+sigterm = true
+
+# NOTE: Rules for static testing are standard across all the monorepo, those rules are strict and must be followed, in any exception case please discuss with the team, in the meantime, if it fails, fix the issue, NEVER turn off the linter.
+
+[tool.pyright]
+typeCheckingMode = "strict"
+venv = ".venv"
+venvPath = "."
+exclude = [".venv", "vulture_whitelist.py"]
+
+[tool.ruff]
+line-length = 120
+
+[tool.ruff.lint]
+select = [
+    "A",     # flake8-builtins
+    "ARG",   # flake8-unused-arguments
+    "ASYNC", # flake8-async
+    "B",     # flake8-bugbear
+    "BLE",   # flake8-blind-except
+    "DTZ",   # flake8-datetimez
+    "E",     # pycodestyle errors
+    "F",     # pyflakes
+    "FAST",  # FastAPI
+    "FBT",   # flake8-boolean-trap
+    "I",     # isort
+    "N",     # pep8-naming
+    "PERF",  # Perflint
+    "PIE",   # flake8-pie
+    "PL",    # Pylint
+    "PYI",   # flake8-pyi
+    "Q",     # flake8-quotes
+    "RET",   # flake8-return
+    "RUF",   # Ruff-specific
+    "S",     # flake8-bandit (security)
+    "SIM",   # flake8-simplify
+    "SLF",   # flake8-self
+    "T20",   # flake8-print
+    "TID",   # flake8-tidy-imports
+    "UP",    # pyupgrade
+    "W",     # pycodestyle warnings
+]
+ignore = ["PLR0913", "RUF012", "S311"]  # S311: random for non-crypto (we use secrets)
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**/*.py" = ["PLR2004", "S101", "S603", "ASYNC109", "ASYNC220", "SIM117", "F841", "RUF059", "PLC0415"]  # Tests: magic values, assert, subprocess, async patterns, nested with, unused vars, local imports
+"tests/**/test_rfc9180*.py" = ["SLF001"]  # Vector tests need internal state access
+"tests/**/test_fuzz.py" = ["SLF001"]  # Fuzz tests need internal state access for overflow testing
+"tests/**/test_aiohttp_client.py" = ["SLF001"]  # Unit tests for private parsing methods
+"tests/**/test_streaming_errors.py" = ["SLF001"]  # Error tests need internal cipher access
+"src/**/streaming.py" = ["PLW0603", "PLC0415"]  # Optional zstd: module caching requires global, lazy import for optional deps
+
+[tool.vulture]
+exclude = [".venv/"]  # Exclude deps
+paths = ["src", "tests", "vulture_whitelist.py"]  # Include whitelist
+min_confidence = 80  # Ignore crap detections
+sort_by_size = true  # Most impactful issues first

hpke_http-0.1.2/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+