httpquoted 0.2.0__tar.gz

httpquoted-0.2.0/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

httpquoted-0.2.0/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+build/
+dist/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Third-party reference files, fetched locally by scripts/fetch_upstream.py; only the manifest is tracked.
+tests/upstream/*
+!tests/upstream/MANIFEST.json

httpquoted-0.2.0/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.2.0]
+
+### Added
+
+- `QuotedStringError`, a `ValueError` with `reason` and `offset`.
+- `strict=True` on `unquote` (exactly a token or a quoted-string) and `split_list`
+  (field content only, every quoted-string and comment well formed and closed).
+- `scan_quoted_string` and `scan_comment`: read one quoted-string or (nested) comment
+  inside a larger value and return its value and end offset.
+- `quote_comment` and `unquote_comment` for the comment syntax of section 5.6.5.
+- `quote_if_needed` and `needs_quoting` for parameter values (section 5.6.6).
+- `split_list` options: `separator` (";" for parameters, `str` or `bytes`) and `comments=True` for Via,
+  User-Agent and Server, where a comment may hold commas and a lone DQUOTE.
+- `bytes` support everywhere: bytes in, bytes out, read as ISO-8859-1.
+- `ascii_only=True` on the quoting functions to refuse obs-text.
+- The `httpquoted` command (`quote`, `unquote`, `split`) and `python -m httpquoted`;
+  standard input and output are read and written as ISO-8859-1.
+
+### Changed
+
+- `quote` raises `QuotedStringError` for CR, LF, NUL, the other controls, DEL and
+  characters above U+00FF instead of writing them into the header.
+- Every function raises `TypeError` for input that is neither `str` nor `bytes`;
+  `is_token(None)` returned `False` before.
+
+## [0.1.0]
+
+- First release: `quote`, `unquote`, `is_token` and `split_list` for the HTTP
+  quoted-string primitive (RFC 9110).

httpquoted-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,19 @@
+# Contributing
+
+Thanks for taking the time. This project keeps a small, predictable shape.
+
+## Setup
+
+```
+pip install -r requirements-dev.txt
+```
+
+## Before you open a pull request
+
+- Keep public API in `src/httpquoted/__init__.py`; internals live in `_`-prefixed modules.
+- Add a test for the behaviour you change. Tests inject time, disk and network; they
+  never touch the real thing.
+- Run `scripts/check.ps1` (format, lint, types, tests) and make sure it passes.
+- One logical change per commit, imperative subject line.
+
+Open an issue first if the change is large or shifts the public API.

httpquoted-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Javier Lianes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

httpquoted-0.2.0/PKG-INFO

@@ -0,0 +1,210 @@
+Metadata-Version: 2.5
+Name: httpquoted
+Version: 0.2.0
+Summary: Strict, typed and zero-dependency codec for HTTP quoted-strings, comments and tokens (RFC 9110): safe quoting, strict parsing, scanners and quote-aware list splitting
+Project-URL: Homepage, https://lianes8studio.com
+Project-URL: Repository, https://github.com/JaviLianes8/httpquoted
+Project-URL: Issues, https://github.com/JaviLianes8/httpquoted/issues
+Project-URL: Changelog, https://github.com/JaviLianes8/httpquoted/blob/main/CHANGELOG.md
+Project-URL: LinkedIn, https://www.linkedin.com/in/jlianes/
+Project-URL: Funding, https://buymeacoffee.com/jlianesglrs
+Author-email: Javier Lianes <javier@lianes8studio.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: comment,field-value,header,http,list,parser,quote,quoted-string,rfc7230,rfc9110,token,unquote
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: build; extra == 'dev'
+Requires-Dist: mypy; extra == 'dev'
+Requires-Dist: pytest; extra == 'dev'
+Requires-Dist: ruff; extra == 'dev'
+Requires-Dist: twine; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# httpquoted
+
+Strict, typed and zero-dependency codec for the HTTP quoted-string, comment and token
+primitives of RFC 9110 section 5.6: safe quoting, strict or lenient parsing, scanners for
+hand-written parsers and list splitting that respects quotes and comments.
+
+## Install
+
+```
+pip install httpquoted
+```
+
+## Usage
+
+Quote a value for a header and read it back. Only DQUOTE and backslash are escaped, as
+section 5.6.4 asks of senders, and a value that is a token can travel bare:
+
+```python
+from httpquoted import quote, quote_if_needed, unquote
+
+print(quote('say "hi"'))
+print(unquote('"say \\"hi\\""'))
+print(quote_if_needed("utf-8"), quote_if_needed("two words"))
+# "say \"hi\""
+# say "hi"
+# utf-8 "two words"
+```
+
+Quoting refuses what a quoted-string cannot carry, so a CR LF never reaches a header.
+Parsing is lenient by default; `strict=True` raises with the broken rule and its offset:
+
+```python
+from httpquoted import QuotedStringError, quote, unquote
+
+for call in (lambda: quote("a\r\nX-Injected: 1"), lambda: unquote('"a"b"', strict=True)):
+    try:
+        call()
+    except QuotedStringError as error:
+        print(error.reason, error.offset)
+print(unquote('"a"b"'))
+# U+000D is not allowed 1
+# text after the closing quote 3
+# a"b
+```
+
+Split a list on commas outside quoted-strings, or parameters on semicolons. Fields
+whose grammar has comments (Via, User-Agent, Server) pass `comments=True`:
+
+```python
+from httpquoted import split_list, unquote
+
+print(split_list('gzip, "a,b", , br'))
+print(split_list('text/plain; charset="utf-8"', separator=";"))
+print(split_list("1.0 fred (proxy, eu), 1.1 example.net", comments=True))
+print([unquote(tag, strict=True) for tag in split_list('"xyzzy", "r2d2xxxx"')])
+# ['gzip', '"a,b"', 'br']
+# ['text/plain', 'charset="utf-8"']
+# ['1.0 fred (proxy, eu)', '1.1 example.net']
+# ['xyzzy', 'r2d2xxxx']
+```
+
+Comments nest and have their own escaping. The scanners read one quoted-string or
+comment inside a larger value and return where it ends:
+
+```python
+from httpquoted import quote_comment, scan_comment, scan_quoted_string, unquote_comment
+
+print(quote_comment("Windows NT 10.0; (x64)"))
+print(unquote_comment("(a (nested) \\) comment)", strict=True))
+text = 'title="a, \\"b\\""; lang=en'
+value, end = scan_quoted_string(text, 6, strict=True)
+print(value, text[end:])
+print(scan_comment("Mozilla/5.0 (X11; Linux) Gecko", 12))
+# (Windows NT 10.0; \(x64\))
+# a (nested) ) comment
+# a, "b" ; lang=en
+# ('X11; Linux', 24)
+```
+
+Every function takes `str` or `bytes` and returns the same type. Bytes are read as
+ISO-8859-1, so the obs-text octets 0x80 to 0xFF round-trip unchanged:
+
+```python
+from httpquoted import quote, split_list, unquote
+
+print(quote(b"caf\xe9"))
+print(unquote(b'"caf\xe9"', strict=True))
+print(split_list(b'a, "b,c"'))
+# b'"caf\xe9"'
+# b'caf\xe9'
+# [b'a', b'"b,c"']
+```
+
+## Command line
+
+```
+$ httpquoted quote 'say "hi"'
+"say \"hi\""
+$ httpquoted unquote --strict '"a"b"'
+httpquoted: text after the closing quote at offset 3
+$ httpquoted split --comments '1.0 fred (proxy, eu), 1.1 example.net'
+1.0 fred (proxy, eu)
+1.1 example.net
+```
+
+Values come from the arguments, or one per line from standard input. `quote` takes
+`--comment` and `--ascii-only`; `unquote` takes `--comment` and `--strict`; `split`
+takes `--separator`, `--comments` and `--strict`. Standard input and output are read
+and written as ISO-8859-1, so octets pass through unchanged. A rejected value exits with
+status 1.
+
+## API
+
+| Name | What it does |
+|---|---|
+| `quote(value, *, ascii_only=False)` | Quoted-string with DQUOTE and backslash escaped; refuses controls, DEL and anything above U+00FF, and obs-text when `ascii_only` |
+| `unquote(value, *, strict=False)` | Strips quotes and resolves quoted-pairs; a bare value comes back unchanged. Strict: exactly a token or a quoted-string |
+| `quote_if_needed(value, *, ascii_only=False)` | A token unchanged, anything else quoted (parameter values, section 5.6.6) |
+| `needs_quoting(value)` | True unless the value is a token |
+| `is_token(value)` | True for a non-empty run of tchar |
+| `quote_comment(value, *, ascii_only=False)` | Comment with "(", ")" and backslash escaped |
+| `unquote_comment(value, *, strict=False)` | Strips the outer parentheses and resolves quoted-pairs; nested comments stay as text |
+| `scan_quoted_string(text, start=0, *, strict=False)` | Value of the quoted-string at `start` and the offset after it |
+| `scan_comment(text, start=0, *, strict=False)` | Value of the (nested) comment at `start` and the offset after it |
+| `split_list(header, *, separator=",", comments=False, strict=False)` | Elements outside quotes (and comments), trimmed, empty ones dropped |
+| `QuotedStringError` | `ValueError` with `reason` and `offset` |
+
+Lenient mode never raises on malformed input. The scanners stop at the first closing
+quote or parenthesis and let an unterminated value run to the end, while lenient
+`unquote` and `unquote_comment` keep the 0.1.0 behaviour: they strip the first and last
+character when those are the quotes (or parentheses) and resolve quoted-pairs in between.
+
+Strict mode checks the token, quoted-string, quoted-pair and comment rules of RFC 9110
+sections 5.6.2 to 5.6.5 character by character; the tests evaluate that grammar from the
+fetched RFC and compare it with the functions for every code point up to U+010F. Strict
+`split_list` checks field content and every quoted-string and comment it meets, not the
+grammar of each element, which belongs to the field (`"a"b` is one element).
+
+The value of a comment is display text: quoted-pairs are resolved and nested comments
+keep their parentheses, so `\)` and a nesting `)` look alike. To parse it again, slice
+the raw comment with the end offset that `scan_comment` returns.
+
+obs-text includes U+0080 to U+009F, which some tools treat as line breaks (U+0085);
+section 5.5 asks new fields to use ASCII, which `ascii_only=True` enforces. Every scan
+is linear in the length of the input, including a megabyte of backslashes or nested
+parentheses.
+
+## Why
+
+The quoted-string codec of RFC 9110 sits under almost every HTTP header parser, yet no
+small typed library ships it on its own: the stdlib `quopri` handles MIME
+quoted-printable (a different thing), and the logic is vendored privately into
+frameworks and SDKs, often without the checks that stop header injection. Other
+ecosystems expose it directly (Ruby has `Protocol::HTTP::QuotedString`). This is that
+primitive, zero-dependency and typed, for the times you parse or build a header by hand.
+
+## Development
+
+`scripts/check.ps1` runs format, lint, `mypy --strict` and the tests. The RFC checks
+read the RFCs from `tests/upstream/`, which is not committed: `python
+scripts/fetch_upstream.py` downloads them and verifies the sha256 of each against
+`tests/upstream/MANIFEST.json`; until then those tests skip. Set `HTTPQUOTED_E2E=1` to
+build the wheel and drive it from a fresh virtual environment.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## Links
+
+- Website: https://lianes8studio.com
+- GitHub: https://github.com/JaviLianes8
+- LinkedIn: https://www.linkedin.com/in/jlianes/

httpquoted-0.2.0/README.md

@@ -0,0 +1,173 @@
+# httpquoted
+
+Strict, typed and zero-dependency codec for the HTTP quoted-string, comment and token
+primitives of RFC 9110 section 5.6: safe quoting, strict or lenient parsing, scanners for
+hand-written parsers and list splitting that respects quotes and comments.
+
+## Install
+
+```
+pip install httpquoted
+```
+
+## Usage
+
+Quote a value for a header and read it back. Only DQUOTE and backslash are escaped, as
+section 5.6.4 asks of senders, and a value that is a token can travel bare:
+
+```python
+from httpquoted import quote, quote_if_needed, unquote
+
+print(quote('say "hi"'))
+print(unquote('"say \\"hi\\""'))
+print(quote_if_needed("utf-8"), quote_if_needed("two words"))
+# "say \"hi\""
+# say "hi"
+# utf-8 "two words"
+```
+
+Quoting refuses what a quoted-string cannot carry, so a CR LF never reaches a header.
+Parsing is lenient by default; `strict=True` raises with the broken rule and its offset:
+
+```python
+from httpquoted import QuotedStringError, quote, unquote
+
+for call in (lambda: quote("a\r\nX-Injected: 1"), lambda: unquote('"a"b"', strict=True)):
+    try:
+        call()
+    except QuotedStringError as error:
+        print(error.reason, error.offset)
+print(unquote('"a"b"'))
+# U+000D is not allowed 1
+# text after the closing quote 3
+# a"b
+```
+
+Split a list on commas outside quoted-strings, or parameters on semicolons. Fields
+whose grammar has comments (Via, User-Agent, Server) pass `comments=True`:
+
+```python
+from httpquoted import split_list, unquote
+
+print(split_list('gzip, "a,b", , br'))
+print(split_list('text/plain; charset="utf-8"', separator=";"))
+print(split_list("1.0 fred (proxy, eu), 1.1 example.net", comments=True))
+print([unquote(tag, strict=True) for tag in split_list('"xyzzy", "r2d2xxxx"')])
+# ['gzip', '"a,b"', 'br']
+# ['text/plain', 'charset="utf-8"']
+# ['1.0 fred (proxy, eu)', '1.1 example.net']
+# ['xyzzy', 'r2d2xxxx']
+```
+
+Comments nest and have their own escaping. The scanners read one quoted-string or
+comment inside a larger value and return where it ends:
+
+```python
+from httpquoted import quote_comment, scan_comment, scan_quoted_string, unquote_comment
+
+print(quote_comment("Windows NT 10.0; (x64)"))
+print(unquote_comment("(a (nested) \\) comment)", strict=True))
+text = 'title="a, \\"b\\""; lang=en'
+value, end = scan_quoted_string(text, 6, strict=True)
+print(value, text[end:])
+print(scan_comment("Mozilla/5.0 (X11; Linux) Gecko", 12))
+# (Windows NT 10.0; \(x64\))
+# a (nested) ) comment
+# a, "b" ; lang=en
+# ('X11; Linux', 24)
+```
+
+Every function takes `str` or `bytes` and returns the same type. Bytes are read as
+ISO-8859-1, so the obs-text octets 0x80 to 0xFF round-trip unchanged:
+
+```python
+from httpquoted import quote, split_list, unquote
+
+print(quote(b"caf\xe9"))
+print(unquote(b'"caf\xe9"', strict=True))
+print(split_list(b'a, "b,c"'))
+# b'"caf\xe9"'
+# b'caf\xe9'
+# [b'a', b'"b,c"']
+```
+
+## Command line
+
+```
+$ httpquoted quote 'say "hi"'
+"say \"hi\""
+$ httpquoted unquote --strict '"a"b"'
+httpquoted: text after the closing quote at offset 3
+$ httpquoted split --comments '1.0 fred (proxy, eu), 1.1 example.net'
+1.0 fred (proxy, eu)
+1.1 example.net
+```
+
+Values come from the arguments, or one per line from standard input. `quote` takes
+`--comment` and `--ascii-only`; `unquote` takes `--comment` and `--strict`; `split`
+takes `--separator`, `--comments` and `--strict`. Standard input and output are read
+and written as ISO-8859-1, so octets pass through unchanged. A rejected value exits with
+status 1.
+
+## API
+
+| Name | What it does |
+|---|---|
+| `quote(value, *, ascii_only=False)` | Quoted-string with DQUOTE and backslash escaped; refuses controls, DEL and anything above U+00FF, and obs-text when `ascii_only` |
+| `unquote(value, *, strict=False)` | Strips quotes and resolves quoted-pairs; a bare value comes back unchanged. Strict: exactly a token or a quoted-string |
+| `quote_if_needed(value, *, ascii_only=False)` | A token unchanged, anything else quoted (parameter values, section 5.6.6) |
+| `needs_quoting(value)` | True unless the value is a token |
+| `is_token(value)` | True for a non-empty run of tchar |
+| `quote_comment(value, *, ascii_only=False)` | Comment with "(", ")" and backslash escaped |
+| `unquote_comment(value, *, strict=False)` | Strips the outer parentheses and resolves quoted-pairs; nested comments stay as text |
+| `scan_quoted_string(text, start=0, *, strict=False)` | Value of the quoted-string at `start` and the offset after it |
+| `scan_comment(text, start=0, *, strict=False)` | Value of the (nested) comment at `start` and the offset after it |
+| `split_list(header, *, separator=",", comments=False, strict=False)` | Elements outside quotes (and comments), trimmed, empty ones dropped |
+| `QuotedStringError` | `ValueError` with `reason` and `offset` |
+
+Lenient mode never raises on malformed input. The scanners stop at the first closing
+quote or parenthesis and let an unterminated value run to the end, while lenient
+`unquote` and `unquote_comment` keep the 0.1.0 behaviour: they strip the first and last
+character when those are the quotes (or parentheses) and resolve quoted-pairs in between.
+
+Strict mode checks the token, quoted-string, quoted-pair and comment rules of RFC 9110
+sections 5.6.2 to 5.6.5 character by character; the tests evaluate that grammar from the
+fetched RFC and compare it with the functions for every code point up to U+010F. Strict
+`split_list` checks field content and every quoted-string and comment it meets, not the
+grammar of each element, which belongs to the field (`"a"b` is one element).
+
+The value of a comment is display text: quoted-pairs are resolved and nested comments
+keep their parentheses, so `\)` and a nesting `)` look alike. To parse it again, slice
+the raw comment with the end offset that `scan_comment` returns.
+
+obs-text includes U+0080 to U+009F, which some tools treat as line breaks (U+0085);
+section 5.5 asks new fields to use ASCII, which `ascii_only=True` enforces. Every scan
+is linear in the length of the input, including a megabyte of backslashes or nested
+parentheses.
+
+## Why
+
+The quoted-string codec of RFC 9110 sits under almost every HTTP header parser, yet no
+small typed library ships it on its own: the stdlib `quopri` handles MIME
+quoted-printable (a different thing), and the logic is vendored privately into
+frameworks and SDKs, often without the checks that stop header injection. Other
+ecosystems expose it directly (Ruby has `Protocol::HTTP::QuotedString`). This is that
+primitive, zero-dependency and typed, for the times you parse or build a header by hand.
+
+## Development
+
+`scripts/check.ps1` runs format, lint, `mypy --strict` and the tests. The RFC checks
+read the RFCs from `tests/upstream/`, which is not committed: `python
+scripts/fetch_upstream.py` downloads them and verifies the sha256 of each against
+`tests/upstream/MANIFEST.json`; until then those tests skip. Set `HTTPQUOTED_E2E=1` to
+build the wheel and drive it from a fresh virtual environment.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## Links
+
+- Website: https://lianes8studio.com
+- GitHub: https://github.com/JaviLianes8
+- LinkedIn: https://www.linkedin.com/in/jlianes/

httpquoted-0.2.0/pyproject.toml

@@ -0,0 +1,72 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "httpquoted"
+version = "0.2.0"
+description = "Strict, typed and zero-dependency codec for HTTP quoted-strings, comments and tokens (RFC 9110): safe quoting, strict parsing, scanners and quote-aware list splitting"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Javier Lianes", email = "javier@lianes8studio.com" }]
+keywords = ["http", "header", "quoted-string", "quote", "unquote", "comment", "token", "field-value", "list", "parser", "rfc9110", "rfc7230"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Operating System :: OS Independent",
+    "Environment :: Console",
+    "Topic :: Internet :: WWW/HTTP",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["ruff", "mypy", "pytest", "build", "twine"]
+
+[project.scripts]
+httpquoted = "httpquoted._cli:main"
+
+[project.urls]
+Homepage = "https://lianes8studio.com"
+Repository = "https://github.com/JaviLianes8/httpquoted"
+Issues = "https://github.com/JaviLianes8/httpquoted/issues"
+Changelog = "https://github.com/JaviLianes8/httpquoted/blob/main/CHANGELOG.md"
+LinkedIn = "https://www.linkedin.com/in/jlianes/"
+Funding = "https://buymeacoffee.com/jlianesglrs"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/httpquoted"]
+
+[tool.hatch.build.targets.sdist]
+# Third-party reference files are fetched locally and never shipped; only their manifest is.
+exclude = [
+    ".github",
+    "IMPROVEMENTS-round*.md",
+    "tests/upstream/*.txt",
+]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "W", "F", "I", "UP", "B", "SIM", "RUF"]
+
+[tool.mypy]
+python_version = "3.10"
+strict = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+addopts = "-q"

httpquoted-0.2.0/requirements-dev.txt

@@ -0,0 +1,3 @@
+# Development dependencies: the package in editable mode plus its dev extras
+# (ruff, mypy, pytest, build, twine). Install with:  pip install -r requirements-dev.txt
+-e .[dev]

httpquoted-0.2.0/scripts/check.ps1

@@ -0,0 +1,16 @@
+# Local quality gate. Run before every commit. No CI runs in the cloud.
+# $ErrorActionPreference does NOT stop on a native command's non-zero exit, so each tool's
+# exit code is checked explicitly: a red gate must fail, never pass silently.
+$ErrorActionPreference = "Stop"
+
+function Invoke-Step($label, [scriptblock]$cmd) {
+    Write-Host "== $label =="
+    & $cmd
+    if ($LASTEXITCODE -ne 0) { Write-Host "FAILED: $label (exit $LASTEXITCODE)"; exit $LASTEXITCODE }
+}
+
+Invoke-Step "ruff format" { ruff format --check . }
+Invoke-Step "ruff lint"   { ruff check . }
+Invoke-Step "mypy"        { mypy --strict src tests scripts }
+Invoke-Step "pytest"      { pytest }
+Write-Host "gate green"

httpquoted-0.2.0/scripts/fetch_upstream.py

@@ -0,0 +1,44 @@
+"""Fetch the third-party reference files listed in tests/upstream/MANIFEST.json.
+
+The files are not part of the repository. Their tests skip until this script has fetched
+them; each download is checked against the size and sha256 in the manifest.
+
+    python scripts/fetch_upstream.py
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+import urllib.request
+from pathlib import Path
+
+FOLDER = Path(__file__).resolve().parents[1] / "tests" / "upstream"
+
+
+def main() -> int:
+    manifest = json.loads((FOLDER / "MANIFEST.json").read_text(encoding="utf-8"))
+    failed = 0
+    for name, entry in manifest.items():
+        try:
+            with urllib.request.urlopen(entry["url"], timeout=60) as response:
+                body = response.read()
+        except OSError as error:
+            print(f"{name}: cannot fetch {entry['url']}: {error}")
+            failed += 1
+            continue
+        digest = hashlib.sha256(body).hexdigest()
+        if len(body) != entry["size"] or digest != entry["sha256"]:
+            print(f"{name}: got {len(body)} bytes, sha256 {digest}; manifest differs")
+            failed += 1
+            continue
+        target = FOLDER / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(body)
+        print(f"{name}: ok")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

httpquoted-0.2.0/scripts/release.ps1

@@ -0,0 +1,28 @@
+# Build and upload to PyPI. Run scripts/check.ps1 first.
+# The name must not already exist on PyPI; the token is read from a secret store, never git.
+$ErrorActionPreference = "Stop"
+
+# Works on both Windows PowerShell 5.1 and pwsh 7 (generic catch, no PS7-only types).
+$taken = $true
+try {
+    Invoke-WebRequest -UseBasicParsing "https://pypi.org/pypi/httpquoted/json" | Out-Null
+} catch {
+    if ($_.Exception.Response.StatusCode.value__ -eq 404) { $taken = $false } else { throw }
+}
+if ($taken) { throw "The name 'httpquoted' already exists on PyPI. Choose another before publishing." }
+
+$token = $env:PYPI_TOKEN
+if (-not $token -and (Test-Path "C:\secrets\pypi-token.txt")) {
+    $token = (Get-Content "C:\secrets\pypi-token.txt" -Raw).Trim()
+}
+if (-not $token) {
+    throw "No PyPI token. Set `$env:PYPI_TOKEN or save it to C:\secrets\pypi-token.txt (never commit it)."
+}
+
+Remove-Item -Recurse -Force dist -ErrorAction SilentlyContinue
+python -m build
+python -m twine check dist/*
+
+$env:TWINE_USERNAME = "__token__"
+$env:TWINE_PASSWORD = $token
+try { python -m twine upload dist/* } finally { Remove-Item Env:\TWINE_PASSWORD -ErrorAction SilentlyContinue }

httpquoted-0.2.0/src/httpquoted/__init__.py

@@ -0,0 +1,26 @@
+"""Typed codec for the HTTP quoted-string and comment primitives (RFC 9110)."""
+
+from __future__ import annotations
+
+from ._chars import QuotedStringError
+from ._comment import quote_comment, unquote_comment
+from ._quote import quote, quote_if_needed, unquote
+from ._scan import scan_comment, scan_quoted_string
+from ._split import split_list
+from ._token import is_token, needs_quoting
+
+__version__ = "0.2.0"
+
+__all__ = [
+    "QuotedStringError",
+    "is_token",
+    "needs_quoting",
+    "quote",
+    "quote_comment",
+    "quote_if_needed",
+    "scan_comment",
+    "scan_quoted_string",
+    "split_list",
+    "unquote",
+    "unquote_comment",
+]