httpquoted 0.2.0__tar.gz → 1.0.0__tar.gz

httpquoted-1.0.0/CHANGELOG.md

@@ -0,0 +1,83 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.0.0] - 2026-10-17
+
+The public API is now stable: the eleven names in `httpquoted.__all__`, their
+signatures, defaults, results and error types, and the `httpquoted` command with its
+options and exit statuses. Results on valid input are identical to 0.2.0.
+
+### Changed
+
+- The `strict`, `ascii_only` and `comments` options must be real `bool` values; anything
+  else raises `TypeError` (0.2.0 used the truth value, so `strict="no"` meant strict).
+- `QuotedStringError` survives pickling (0.2.0 raised `TypeError` when unpickled).
+- The package no longer exposes a stray `annotations` attribute.
+- Public names report `httpquoted` as their module instead of a private module. One
+  side effect: `inspect.getsource(httpquoted.QuotedStringError)` can no longer find the
+  class source (functions are not affected).
+- A `TypeError` message names at most 40 characters of the offending type name.
+- A `str` or `bytes` subclass is read as its plain value without calling any of its
+  methods, and an `int` subclass given as `start` is read as its plain value.
+- A scanner `start` outside the text is reported at offset 0 or at the length of the
+  text instead of at the given value (0.2.0 could not even format a `start` with more
+  than 4,300 digits).
+- Command line: on POSIX systems each argument is read back as the octets it was given
+  (ISO-8859-1, like standard input) instead of as file system text, so a UTF-8 argument
+  is written out unchanged; an interrupt exits with status 130 and a closed output
+  (`| head`, reported as EPIPE on POSIX and EINVAL on Windows) with status 1, both
+  without a traceback. A closed standard input reads as no values, a closed standard
+  output exits with status 1, another write error (a full disk) is reported with its
+  errno and exits with status 1, and with standard error closed the reasons are dropped
+  instead of being written into the output. The help names the values `VALUE`
+  and the separator `SEP`.
+- The sdist is built from an explicit file list, so a local virtual environment or
+  scratch file next to the sources is never packed.
+
+### Added
+
+- `GUIDE.md`: the grammar, lenient and strict modes, every error reason, the command
+  line and how the results compare with Werkzeug, h11, the standard library and the
+  WHATWG Fetch Standard.
+- A runnable example in the docstring of every public name.
+
+### Upgrading from 0.2.0
+
+- Pass `True` or `False` to `strict`, `ascii_only` and `comments`.
+- Code that compared `QuotedStringError.__module__` or a function's `__module__` with
+  a private module name now sees `httpquoted`.
+
+## [0.2.0] - 2026-10-16
+
+### Added
+
+- `QuotedStringError`, a `ValueError` with `reason` and `offset`.
+- `strict=True` on `unquote` (exactly a token or a quoted-string) and `split_list`
+  (field content only, every quoted-string and comment well formed and closed).
+- `scan_quoted_string` and `scan_comment`: read one quoted-string or (nested) comment
+  inside a larger value and return its value and end offset.
+- `quote_comment` and `unquote_comment` for the comment syntax of section 5.6.5.
+- `quote_if_needed` and `needs_quoting` for parameter values (section 5.6.6).
+- `split_list` options: `separator` (";" for parameters, `str` or `bytes`) and `comments=True` for Via,
+  User-Agent and Server, where a comment may hold commas and a lone DQUOTE.
+- `bytes` support everywhere: bytes in, bytes out, read as ISO-8859-1.
+- `ascii_only=True` on the quoting functions to refuse obs-text.
+- The `httpquoted` command (`quote`, `unquote`, `split`) and `python -m httpquoted`;
+  standard input and output are read and written as ISO-8859-1.
+
+### Changed
+
+- `quote` raises `QuotedStringError` for CR, LF, NUL, the other controls, DEL and
+  characters above U+00FF instead of writing them into the header.
+- Every function raises `TypeError` for input that is neither `str` nor `bytes`;
+  `is_token(None)` returned `False` before.
+
+## [0.1.0] - 2026-10-12
+
+- First release: `quote`, `unquote`, `is_token` and `split_list` for the HTTP
+  quoted-string primitive (RFC 9110).

{httpquoted-0.2.0 → httpquoted-1.0.0}/CONTRIBUTING.md

@@ -1,19 +1,19 @@
-# Contributing
-
-Thanks for taking the time. This project keeps a small, predictable shape.
-
-## Setup
-
-```
-pip install -r requirements-dev.txt
-```
-
-## Before you open a pull request
-
-- Keep public API in `src/httpquoted/__init__.py`; internals live in `_`-prefixed modules.
-- Add a test for the behaviour you change. Tests inject time, disk and network; they
-  never touch the real thing.
-- Run `scripts/check.ps1` (format, lint, types, tests) and make sure it passes.
-- One logical change per commit, imperative subject line.
-
-Open an issue first if the change is large or shifts the public API.
+# Contributing
+
+Thanks for taking the time. This project keeps a small, predictable shape.
+
+## Setup
+
+```
+pip install -r requirements-dev.txt
+```
+
+## Before you open a pull request
+
+- Keep public API in `src/httpquoted/__init__.py`; internals live in `_`-prefixed modules.
+- Add a test for the behaviour you change. Tests inject time, disk and network; they
+  never touch the real thing.
+- Run `scripts/check.ps1` (format, lint, types, tests) and make sure it passes.
+- One logical change per commit, imperative subject line.
+
+Open an issue first if the change is large or shifts the public API.

httpquoted-1.0.0/GUIDE.md

@@ -0,0 +1,149 @@
+# httpquoted guide
+
+This guide describes every behaviour of httpquoted 1.0 in detail. The
+[README](https://github.com/JaviLianes8/httpquoted/blob/main/README.md) has the quick start.
+
+## The grammar
+
+RFC 9110 section 5.6 defines the pieces this library reads and writes:
+
+| Rule | Characters |
+|---|---|
+| `tchar` (token) | letters, digits and ``!#$%&'*+-.^_`|~`` |
+| `qdtext` | HTAB, SP, `!`, `#` to `[`, `]` to `~`, obs-text |
+| `ctext` | HTAB, SP, `!` to `'`, `*` to `[`, `]` to `~`, obs-text |
+| `quoted-pair` | backslash followed by HTAB, SP, a visible ASCII character or obs-text |
+| `obs-text` | the octets 0x80 to 0xFF |
+
+A quoted-string is `DQUOTE *( qdtext / quoted-pair ) DQUOTE`. A comment is
+`"(" *( ctext / quoted-pair / comment ) ")"`, so comments nest, and inside a comment
+DQUOTE is plain text. The test suite evaluates these rules from the fetched RFC and
+compares them with the library for every code point up to U+010F.
+
+## Writing values
+
+`quote` escapes only DQUOTE and backslash, `quote_comment` only `(`, `)` and backslash,
+as section 5.6.4 asks of senders. Both refuse anything a quoted-pair cannot carry: NUL,
+CR, LF and the other controls, DEL, and every character above U+00FF. That is what stops
+a value from smuggling a line break into a header. With `ascii_only=True` they also
+refuse obs-text, which section 5.5 discourages in new fields.
+
+`quote_if_needed` returns a token unchanged and quotes anything else, including the
+empty value; `needs_quoting` and `is_token` answer the same question as booleans.
+
+## Reading values: lenient and strict
+
+Every reader has two modes.
+
+- Lenient (the default) never raises on malformed input. `unquote` and
+  `unquote_comment` strip the first and last character when they are the quotes (or the
+  parentheses) and resolve every backslash pair in between; anything else comes back
+  unchanged. The scanners stop at the first unescaped closing quote or matching
+  parenthesis and let an unterminated value run to the end of the text; a backslash at
+  the very end is kept. This is the "collect an HTTP quoted string" algorithm of the
+  WHATWG Fetch Standard, which the tests compare character by character.
+- Strict (`strict=True`) checks every character against the grammar and raises
+  `QuotedStringError` at the first one that breaks it. `unquote` accepts exactly a token
+  or one quoted-string; `unquote_comment` exactly one comment.
+
+`scan_quoted_string(text, start)` and `scan_comment(text, start)` return the value and
+the offset just past the closing character, so a hand-written parser can continue from
+there. The value of a comment keeps the parentheses of nested comments and has every
+quoted-pair resolved, so `\)` and a nesting `)` look alike in it; slice the raw comment
+with the returned offset to parse it again.
+
+## Splitting lists
+
+`split_list` splits on a separator outside quoted-strings (and outside comments with
+`comments=True`, for Via, User-Agent and Server), trims spaces and tabs around each
+element and drops empty elements, as section 5.6.1.2 asks of recipients. Elements keep
+their quotes; pass them to `unquote` to read a value. `separator=";"` splits parameters.
+The separator must be one field character other than DQUOTE, backslash, `(` and `)`.
+
+Strict mode refuses a character that is not field content and any quoted-string or
+comment that breaks its grammar or never ends, and, with `comments=True`, a stray `)`.
+It does not check the grammar of each element, which belongs to the field: `"a"b` is
+one element.
+
+## str and bytes
+
+Every function takes `str` or `bytes` and returns the same type. Bytes are read as
+ISO-8859-1, where each octet is the code point of the same value, so obs-text
+round-trips unchanged and every offset is an octet offset. `bytearray`, `memoryview` and
+other types raise `TypeError`. The signatures use the `AnyStr` type variable, so a type
+checker wants a value known to be `str` or known to be `bytes`; narrow a `str | bytes`
+value with `isinstance` before the call. A subclass of `str` or `bytes` is read as its
+plain value: none of its overridden methods are called. Lenient `unquote`,
+`unquote_comment` and `quote_if_needed` return the very object they were given when they
+have nothing to change.
+
+## Errors
+
+| Error | When |
+|---|---|
+| `QuotedStringError` | a value breaks the grammar; a subclass of `ValueError` |
+| `TypeError` | the value or the separator is not `str` or `bytes`; `strict`, `ascii_only` or `comments` is not a `bool`; `start` is not an `int` |
+| `ValueError` | `split_list` was given a separator that cannot split a field value |
+
+`QuotedStringError` carries `reason` and `offset`, and its message is
+`"<reason> at offset <offset>"`. It never quotes the input: characters are named by
+code point (`U+000A`) and type names are cut to 40 characters, so a huge or secret value
+never reaches a log through an error. It survives pickling. The reasons are:
+
+| Reason | Offset points at |
+|---|---|
+| `U+XXXX is not allowed` | a character `quote`, `quote_comment` or strict `split_list` refuses |
+| `U+XXXX is obs-text` | an obs-text character refused by `ascii_only=True` |
+| `U+XXXX is not allowed in a quoted-string` (or `comment`) | a character outside qdtext or ctext |
+| `U+XXXX cannot be quoted` | the character after a backslash |
+| `a quoted-pair needs a character` | a backslash at the end of the text |
+| `unterminated quoted-string` (or `comment`) | the opening quote, or the outermost opening parenthesis |
+| `text after the closing quote` (or `parenthesis`) | the first character after it |
+| `not a token or a quoted-string` | the first character that is not a token character |
+| `a quoted-string must start with "` (or `comment`, `(`) | the `start` given to a scanner, moved to 0 or to the length of the text when it lies outside, or 0 for strict `unquote_comment` |
+| `unbalanced )` | a stray `)` in `split_list(..., comments=True, strict=True)` |
+
+## Command line
+
+```
+httpquoted quote [-h] [--comment] [--ascii-only] [VALUE ...]
+httpquoted unquote [-h] [--comment] [--strict] [VALUE ...]
+httpquoted split [-h] [--separator SEP] [--comments] [--strict] [VALUE ...]
+```
+
+Values come from the arguments, or one per line from standard input. Standard input and
+output are read and written as ISO-8859-1, so octets pass through unchanged. On POSIX
+systems each argument is read back as the octets it was given; on Windows arguments are
+text and each character up to U+00FF is written as that octet. A closed standard input
+reads as no values; with standard error closed the reasons are dropped rather than
+mixed into the output. `python -m httpquoted` works the same way.
+
+| Exit status | Meaning |
+|---|---|
+| 0 | every value was written |
+| 1 | a value was rejected (the reason goes to standard error), the output closed early, or it could not be written |
+| 2 | usage error |
+| 130 | interrupted |
+
+## Compared with other parsers
+
+The tests run these tools on the same seeded inputs and check each statement below.
+
+- Werkzeug 3.1.9: `quote_header_value` gives the same result as `quote_if_needed`, and
+  `unquote_header_value` the same as lenient `unquote` (except after a backslash
+  followed by LF). `parse_list_header` gives `[unquote(e) for e in split_list(v)]`,
+  but returns an empty list when a quoted-string never closes.
+- The standard library: `urllib.request.parse_http_list` splits a well-formed value at the same commas but
+  keeps empty items and drops the backslash of each quoted-pair; `email.utils.quote`
+  escapes the same two characters as `quote`.
+- h11 0.16.0 recognises the same tokens; it accepts the controls 0x01 to 0x08, 0x0E to
+  0x1F and 0x7F in a field value, which RFC 9110 does not allow and httpquoted refuses.
+- The WHATWG Fetch Standard: lenient `scan_quoted_string` is its "collect an HTTP quoted
+  string" algorithm, and `split_list` is its "get, decode, and split" without the empty
+  values. Node's `util.MIMEType` reads parameter values the same way.
+
+## Performance and threads
+
+Every function is linear in the length of its input, including a megabyte of
+backslashes, quotes or nested parentheses; nesting depth uses no recursion. The functions
+keep no state and are safe to call from any number of threads.

{httpquoted-0.2.0 → httpquoted-1.0.0}/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Javier Lianes
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Javier Lianes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{httpquoted-0.2.0 → httpquoted-1.0.0}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.5
 Name: httpquoted
-Version: 0.2.0
+Version: 1.0.0
 Summary: Strict, typed and zero-dependency codec for HTTP quoted-strings, comments and tokens (RFC 9110): safe quoting, strict parsing, scanners and quote-aware list splitting
 Project-URL: Homepage, https://lianes8studio.com
-Project-URL: Repository, https://github.com/JaviLianes8/httpquoted
+Project-URL: Source, https://github.com/JaviLianes8/httpquoted
 Project-URL: Issues, https://github.com/JaviLianes8/httpquoted/issues
 Project-URL: Changelog, https://github.com/JaviLianes8/httpquoted/blob/main/CHANGELOG.md
 Project-URL: LinkedIn, https://www.linkedin.com/in/jlianes/
@@ -12,7 +12,7 @@ Author-email: Javier Lianes <javier@lianes8studio.com>
 License-Expression: MIT
 License-File: LICENSE
 Keywords: comment,field-value,header,http,list,parser,quote,quoted-string,rfc7230,rfc9110,token,unquote
-Classifier: Development Status :: 4 - Beta
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
@@ -29,14 +29,19 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Provides-Extra: dev
 Requires-Dist: build; extra == 'dev'
+Requires-Dist: h11==0.16.0; extra == 'dev'
 Requires-Dist: mypy; extra == 'dev'
 Requires-Dist: pytest; extra == 'dev'
+Requires-Dist: pytest-timeout; extra == 'dev'
 Requires-Dist: ruff; extra == 'dev'
 Requires-Dist: twine; extra == 'dev'
+Requires-Dist: werkzeug==3.1.9; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # httpquoted
 
+[![Lianes8 Certified](https://lianes8studio.com/certified/lianes8-certified-badge.svg)](https://lianes8studio.com/certified)
+
 Strict, typed and zero-dependency codec for the HTTP quoted-string, comment and token
 primitives of RFC 9110 section 5.6: safe quoting, strict or lenient parsing, scanners for
 hand-written parsers and list splitting that respects quotes and comments.
@@ -143,8 +148,8 @@ $ httpquoted split --comments '1.0 fred (proxy, eu), 1.1 example.net'
 Values come from the arguments, or one per line from standard input. `quote` takes
 `--comment` and `--ascii-only`; `unquote` takes `--comment` and `--strict`; `split`
 takes `--separator`, `--comments` and `--strict`. Standard input and output are read
-and written as ISO-8859-1, so octets pass through unchanged. A rejected value exits with
-status 1.
+and written as ISO-8859-1, so octets pass through unchanged. The exit status is 0 on
+success, 1 when a value is rejected, 2 for a usage error and 130 when interrupted.
 
 ## API
 
@@ -184,24 +189,37 @@ parentheses.
 
 ## Why
 
-The quoted-string codec of RFC 9110 sits under almost every HTTP header parser, yet no
-small typed library ships it on its own: the stdlib `quopri` handles MIME
-quoted-printable (a different thing), and the logic is vendored privately into
-frameworks and SDKs, often without the checks that stop header injection. Other
-ecosystems expose it directly (Ruby has `Protocol::HTTP::QuotedString`). This is that
-primitive, zero-dependency and typed, for the times you parse or build a header by hand.
+The quoted-string codec of RFC 9110 sits under almost every HTTP header parser, yet in
+Python it lives in pieces inside larger packages, each with its own rules:
+`urllib.request.parse_http_list` keeps empty items and drops the backslash of every
+quoted-pair, `email.utils.unquote` follows the mail rules and also strips `<...>`, and
+Werkzeug's `quote_header_value` writes a CR LF into the quoted value instead of refusing
+it. Other ecosystems expose the primitive directly (Ruby has
+`Protocol::HTTP::QuotedString`). This is that primitive, zero-dependency and typed, with
+strict parsing and quoting that cannot inject a header line, for the times you parse or
+build a header by hand. The [guide](https://github.com/JaviLianes8/httpquoted/blob/main/GUIDE.md)
+lists how its results compare with those tools, as checked by the tests.
 
 ## Development
 
-`scripts/check.ps1` runs format, lint, `mypy --strict` and the tests. The RFC checks
-read the RFCs from `tests/upstream/`, which is not committed: `python
-scripts/fetch_upstream.py` downloads them and verifies the sha256 of each against
-`tests/upstream/MANIFEST.json`; until then those tests skip. Set `HTTPQUOTED_E2E=1` to
-build the wheel and drive it from a fresh virtual environment.
+`scripts/check.ps1` runs format, lint, `mypy --strict` and the tests. The checks against
+the RFCs, the WHATWG Fetch Standard and the CPython and Werkzeug test vectors read those
+files from `tests/upstream/`, which is not committed: `python scripts/fetch_upstream.py`
+downloads them and verifies the sha256 of each against `tests/upstream/MANIFEST.json`;
+until then those tests skip. `tests/fixtures/oracle_runs.json` holds the answers of
+Werkzeug, h11, the standard library and Node recorded by `scripts/oracle_fixture.py`.
+Set `HTTPQUOTED_E2E=1` to build the wheel and drive it from a fresh virtual environment,
+and `HTTPQUOTED_E2E_PYPI=1` to upgrade the PyPI release in place and compare results.
+
+## Documentation
+
+- [Guide](https://github.com/JaviLianes8/httpquoted/blob/main/GUIDE.md): grammar, lenient
+  and strict modes, errors, command line, comparison with other parsers
+- [Changelog](https://github.com/JaviLianes8/httpquoted/blob/main/CHANGELOG.md)
 
 ## License
 
-MIT. See [LICENSE](LICENSE).
+MIT. See [LICENSE](https://github.com/JaviLianes8/httpquoted/blob/main/LICENSE).
 
 ## Links
 

{httpquoted-0.2.0 → httpquoted-1.0.0}/README.md

@@ -1,5 +1,7 @@
 # httpquoted
 
+[![Lianes8 Certified](https://lianes8studio.com/certified/lianes8-certified-badge.svg)](https://lianes8studio.com/certified)
+
 Strict, typed and zero-dependency codec for the HTTP quoted-string, comment and token
 primitives of RFC 9110 section 5.6: safe quoting, strict or lenient parsing, scanners for
 hand-written parsers and list splitting that respects quotes and comments.
@@ -106,8 +108,8 @@ $ httpquoted split --comments '1.0 fred (proxy, eu), 1.1 example.net'
 Values come from the arguments, or one per line from standard input. `quote` takes
 `--comment` and `--ascii-only`; `unquote` takes `--comment` and `--strict`; `split`
 takes `--separator`, `--comments` and `--strict`. Standard input and output are read
-and written as ISO-8859-1, so octets pass through unchanged. A rejected value exits with
-status 1.
+and written as ISO-8859-1, so octets pass through unchanged. The exit status is 0 on
+success, 1 when a value is rejected, 2 for a usage error and 130 when interrupted.
 
 ## API
 
@@ -147,24 +149,37 @@ parentheses.
 
 ## Why
 
-The quoted-string codec of RFC 9110 sits under almost every HTTP header parser, yet no
-small typed library ships it on its own: the stdlib `quopri` handles MIME
-quoted-printable (a different thing), and the logic is vendored privately into
-frameworks and SDKs, often without the checks that stop header injection. Other
-ecosystems expose it directly (Ruby has `Protocol::HTTP::QuotedString`). This is that
-primitive, zero-dependency and typed, for the times you parse or build a header by hand.
+The quoted-string codec of RFC 9110 sits under almost every HTTP header parser, yet in
+Python it lives in pieces inside larger packages, each with its own rules:
+`urllib.request.parse_http_list` keeps empty items and drops the backslash of every
+quoted-pair, `email.utils.unquote` follows the mail rules and also strips `<...>`, and
+Werkzeug's `quote_header_value` writes a CR LF into the quoted value instead of refusing
+it. Other ecosystems expose the primitive directly (Ruby has
+`Protocol::HTTP::QuotedString`). This is that primitive, zero-dependency and typed, with
+strict parsing and quoting that cannot inject a header line, for the times you parse or
+build a header by hand. The [guide](https://github.com/JaviLianes8/httpquoted/blob/main/GUIDE.md)
+lists how its results compare with those tools, as checked by the tests.
 
 ## Development
 
-`scripts/check.ps1` runs format, lint, `mypy --strict` and the tests. The RFC checks
-read the RFCs from `tests/upstream/`, which is not committed: `python
-scripts/fetch_upstream.py` downloads them and verifies the sha256 of each against
-`tests/upstream/MANIFEST.json`; until then those tests skip. Set `HTTPQUOTED_E2E=1` to
-build the wheel and drive it from a fresh virtual environment.
+`scripts/check.ps1` runs format, lint, `mypy --strict` and the tests. The checks against
+the RFCs, the WHATWG Fetch Standard and the CPython and Werkzeug test vectors read those
+files from `tests/upstream/`, which is not committed: `python scripts/fetch_upstream.py`
+downloads them and verifies the sha256 of each against `tests/upstream/MANIFEST.json`;
+until then those tests skip. `tests/fixtures/oracle_runs.json` holds the answers of
+Werkzeug, h11, the standard library and Node recorded by `scripts/oracle_fixture.py`.
+Set `HTTPQUOTED_E2E=1` to build the wheel and drive it from a fresh virtual environment,
+and `HTTPQUOTED_E2E_PYPI=1` to upgrade the PyPI release in place and compare results.
+
+## Documentation
+
+- [Guide](https://github.com/JaviLianes8/httpquoted/blob/main/GUIDE.md): grammar, lenient
+  and strict modes, errors, command line, comparison with other parsers
+- [Changelog](https://github.com/JaviLianes8/httpquoted/blob/main/CHANGELOG.md)
 
 ## License
 
-MIT. See [LICENSE](LICENSE).
+MIT. See [LICENSE](https://github.com/JaviLianes8/httpquoted/blob/main/LICENSE).
 
 ## Links
 

{httpquoted-0.2.0 → httpquoted-1.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "httpquoted"
-version = "0.2.0"
+version = "1.0.0"
 description = "Strict, typed and zero-dependency codec for HTTP quoted-strings, comments and tokens (RFC 9110): safe quoting, strict parsing, scanners and quote-aware list splitting"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -13,7 +13,7 @@ license-files = ["LICENSE"]
 authors = [{ name = "Javier Lianes", email = "javier@lianes8studio.com" }]
 keywords = ["http", "header", "quoted-string", "quote", "unquote", "comment", "token", "field-value", "list", "parser", "rfc9110", "rfc7230"]
 classifiers = [
-    "Development Status :: 4 - Beta",
+    "Development Status :: 5 - Production/Stable",
     "Intended Audience :: Developers",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3 :: Only",
@@ -31,14 +31,14 @@ classifiers = [
 dependencies = []
 
 [project.optional-dependencies]
-dev = ["ruff", "mypy", "pytest", "build", "twine"]
+dev = ["ruff", "mypy", "pytest", "pytest-timeout", "build", "twine", "werkzeug==3.1.9", "h11==0.16.0"]
 
 [project.scripts]
 httpquoted = "httpquoted._cli:main"
 
 [project.urls]
 Homepage = "https://lianes8studio.com"
-Repository = "https://github.com/JaviLianes8/httpquoted"
+Source = "https://github.com/JaviLianes8/httpquoted"
 Issues = "https://github.com/JaviLianes8/httpquoted/issues"
 Changelog = "https://github.com/JaviLianes8/httpquoted/blob/main/CHANGELOG.md"
 LinkedIn = "https://www.linkedin.com/in/jlianes/"
@@ -48,12 +48,21 @@ Funding = "https://buymeacoffee.com/jlianesglrs"
 packages = ["src/httpquoted"]
 
 [tool.hatch.build.targets.sdist]
+# An explicit list, so a local virtual environment or scratch file is never packed.
 # Third-party reference files are fetched locally and never shipped; only their manifest is.
-exclude = [
-    ".github",
-    "IMPROVEMENTS-round*.md",
-    "tests/upstream/*.txt",
+only-include = [
+    "src",
+    "tests",
+    "scripts/fetch_upstream.py",
+    "scripts/oracle_fixture.py",
+    "README.md",
+    "GUIDE.md",
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
+    "LICENSE",
+    "requirements-dev.txt",
 ]
+exclude = ["tests/upstream/*.txt", "__pycache__"]
 
 [tool.ruff]
 line-length = 100
@@ -70,3 +79,4 @@ strict = true
 testpaths = ["tests"]
 pythonpath = ["src"]
 addopts = "-q"
+timeout = 300