mostlyright-data 0.9.0__py3-none-any.whl

mostlyright/data_harness/ux/cloud_auth.py

@@ -0,0 +1,447 @@
+"""Bounded, direct Cloud v1 device-key management client.
+
+The Cloud service is authoritative for device-key liveness and identity.  This module only
+projects a fixed public allowlist from its responses; it never treats local metadata as authority
+and never includes a credential, raw response, header, or exception representation in an error.
+"""
+
+from __future__ import annotations
+
+import json
+import ssl
+import urllib.error
+import urllib.parse
+import urllib.request
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass
+from typing import Any, Final
+
+REQUEST_TIMEOUT_SECONDS: Final = 10.0
+MAX_RESPONSE_BYTES: Final = 64 * 1024
+MAX_KEY_ID_CHARS: Final = 256
+_ROLE_VALUES: Final = frozenset({"owner", "admin", "editor", "viewer"})
+
+
+class CloudAuthError(RuntimeError):
+    """A stable, credential-free client outcome."""
+
+    def __init__(self, code: str, detail: str, *, retry_after_seconds: int | None = None) -> None:
+        super().__init__(f"{code}: {detail}")
+        self.code = code
+        self.detail = detail
+        self.retry_after_seconds = retry_after_seconds
+
+    def __repr__(self) -> str:
+        return (
+            "CloudAuthError("
+            f"code={self.code!r}, detail={self.detail!r}, "
+            f"retry_after_seconds={self.retry_after_seconds!r})"
+        )
+
+
+@dataclass(frozen=True)
+class CloudAuthResponse:
+    """A bounded response seam used by both urllib and isolated tests."""
+
+    status: int
+    headers: Mapping[str, str]
+    body: bytes
+
+
+@dataclass(frozen=True)
+class DeviceMetadata:
+    """Display-safe device metadata projected from the Cloud allowlist."""
+
+    key_id: str
+    name: str
+    prefix: str
+    last_four: str
+    created_at: str
+    last_used_at: str | None
+    current: bool | None = None
+
+    def to_receipt(self) -> dict[str, str | bool | None]:
+        receipt: dict[str, str | bool | None] = {
+            "id": self.key_id,
+            "name": self.name,
+            "prefix": self.prefix,
+            "last_four": self.last_four,
+            "created_at": self.created_at,
+            "last_used_at": self.last_used_at,
+        }
+        if self.current is not None:
+            receipt["current"] = self.current
+        return receipt
+
+
+@dataclass(frozen=True)
+class CloudIdentity:
+    organization_id: str
+    user_id: str
+    role: str
+
+    def to_receipt(self) -> dict[str, str]:
+        return {
+            "organization_id": self.organization_id,
+            "user_id": self.user_id,
+            "role": self.role,
+        }
+
+
+@dataclass(frozen=True)
+class StudioIdentity:
+    workspace_id: str
+    principal_id: str
+
+    def to_receipt(self) -> dict[str, str]:
+        return {"workspace_id": self.workspace_id, "principal_id": self.principal_id}
+
+
+@dataclass(frozen=True)
+class CurrentIdentity:
+    cloud: CloudIdentity
+    studio: StudioIdentity | None
+
+    def to_receipt(self) -> dict[str, Any]:
+        return {
+            "cloud": self.cloud.to_receipt(),
+            "studio": None if self.studio is None else self.studio.to_receipt(),
+        }
+
+
+@dataclass(frozen=True)
+class CurrentDevice:
+    device: DeviceMetadata
+    identity: CurrentIdentity
+
+    def to_receipt(self) -> dict[str, Any]:
+        return {"device": self.device.to_receipt(), "identity": self.identity.to_receipt()}
+
+
+@dataclass(frozen=True)
+class RevokeProof:
+    """One exact remote proof; callers still own every local state transition."""
+
+    status: str
+
+    def to_receipt(self) -> dict[str, str]:
+        return {"status": self.status}
+
+
+Transport = Callable[[urllib.request.Request, float], CloudAuthResponse]
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    """Do not let an auth header cross an unreviewed redirect boundary."""
+
+    def redirect_request(self, *args: Any, **kwargs: Any) -> None:
+        del args, kwargs
+        return None
+
+
+class _ObjectPairs(list[tuple[str, Any]]):
+    """Marks JSON objects so a top-level array cannot imitate an object pair list."""
+
+
+class CloudAuthClient:
+    """The exact v1 current/list/delete contract, over direct HTTPS only."""
+
+    def __init__(
+        self,
+        cloud_url: str,
+        raw_key: str,
+        *,
+        transport: Transport | None = None,
+    ) -> None:
+        self._base_url = _validated_base_url(cloud_url)
+        if not isinstance(raw_key, str) or not raw_key:
+            raise CloudAuthError(
+                "CLOUD_AUTH_CREDENTIAL_INVALID", "the device credential is invalid"
+            )
+        self._raw_key = raw_key
+        self._transport = transport or _urllib_transport
+
+    def __repr__(self) -> str:
+        return f"CloudAuthClient(cloud_url={self._base_url!r}, raw_key='<redacted>')"
+
+    def current(self) -> CurrentDevice:
+        """Return the allowlisted current device and remotely authoritative identity."""
+
+        response = self._request("GET", "/api/cli/v1/device-keys/current")
+        value = _json_object(response.body)
+        _require_api_version(value)
+        device = _device_metadata(value.get("deviceKey"))
+        identity_value = value.get("identity")
+        if not isinstance(identity_value, dict):
+            raise _contract_error()
+        cloud_value = identity_value.get("cloud")
+        if not isinstance(cloud_value, dict):
+            raise _contract_error()
+        organization_id = _required_text(cloud_value, "organizationId")
+        user_id = _required_text(cloud_value, "userId")
+        role = _required_text(cloud_value, "role")
+        if role not in _ROLE_VALUES:
+            raise _contract_error()
+        studio_value = identity_value.get("studio")
+        if studio_value is None:
+            studio = None
+        elif isinstance(studio_value, dict):
+            # Both fields must be present together.  Any additional remote data stays remote.
+            studio = StudioIdentity(
+                workspace_id=_required_text(studio_value, "workspaceId"),
+                principal_id=_required_text(studio_value, "principalId"),
+            )
+        else:
+            raise _contract_error()
+        return CurrentDevice(
+            device=device,
+            identity=CurrentIdentity(
+                cloud=CloudIdentity(
+                    organization_id=organization_id,
+                    user_id=user_id,
+                    role=role,
+                ),
+                studio=studio,
+            ),
+        )
+
+    def list_devices(self) -> tuple[DeviceMetadata, ...]:
+        """Return Cloud-ordered metadata only; no local capability is inferred."""
+
+        response = self._request("GET", "/api/cli/v1/device-keys")
+        value = _json_object(response.body)
+        _require_api_version(value)
+        device_keys = value.get("deviceKeys")
+        if not isinstance(device_keys, list):
+            raise _contract_error()
+        return tuple(_device_metadata(item, require_current=True) for item in device_keys)
+
+    def revoke(
+        self,
+        key_id: str,
+        *,
+        exact_secret_same_key_replay: bool = False,
+    ) -> RevokeProof:
+        """Prove only Cloud's exact DELETE acknowledgement.
+
+        ``already_revoked`` is meaningful solely when the caller retained the raw secret for the
+        very same key and explicitly marks that recovery condition.  The client does not delete
+        anything locally.
+        """
+
+        path_segment = _path_segment(key_id)
+        response = self._request("DELETE", f"/api/cli/v1/device-keys/{path_segment}")
+        proof = _exact_revoke_proof(response.body)
+        if proof.status == "already_revoked" and not exact_secret_same_key_replay:
+            raise _contract_error()
+        return proof
+
+    def _request(self, method: str, path: str) -> CloudAuthResponse:
+        request = urllib.request.Request(
+            urllib.parse.urljoin(self._base_url + "/", path.lstrip("/")),
+            headers={"x-api-key": self._raw_key},
+            method=method,
+        )
+        try:
+            response = self._transport(request, REQUEST_TIMEOUT_SECONDS)
+        except urllib.error.HTTPError as error:
+            response = CloudAuthResponse(
+                status=error.code,
+                headers={str(key): str(value) for key, value in error.headers.items()},
+                body=b"",
+            )
+        except (urllib.error.URLError, TimeoutError, ssl.SSLError, OSError, ValueError):
+            raise CloudAuthError(
+                "CLOUD_AUTH_TRANSPORT_FAILED", "Cloud could not be reached securely"
+            ) from None
+        if not isinstance(response, CloudAuthResponse):
+            raise CloudAuthError("CLOUD_AUTH_TRANSPORT_FAILED", "Cloud returned no usable response")
+        _bounded_response(response)
+        mapped = _remote_error(response)
+        if mapped is not None:
+            raise mapped
+        if response.status != 200:
+            raise CloudAuthError(
+                "CLOUD_AUTH_UNEXPECTED_STATUS", "Cloud returned an unexpected status"
+            )
+        if not _is_json_media_type(response.headers):
+            raise _contract_error()
+        return response
+
+
+def _validated_base_url(value: str) -> str:
+    if not isinstance(value, str) or len(value) > 2048:
+        raise CloudAuthError("CLOUD_AUTH_URL_INVALID", "Cloud URL is invalid")
+    parsed = urllib.parse.urlsplit(value)
+    if (
+        parsed.scheme != "https"
+        or not parsed.hostname
+        or parsed.username is not None
+        or parsed.password is not None
+        or parsed.query
+        or parsed.fragment
+    ):
+        raise CloudAuthError("CLOUD_AUTH_URL_INVALID", "Cloud URL is invalid")
+    try:
+        _ = parsed.port
+    except ValueError:
+        raise CloudAuthError("CLOUD_AUTH_URL_INVALID", "Cloud URL is invalid") from None
+    return urllib.parse.urlunsplit((parsed.scheme, parsed.netloc, parsed.path.rstrip("/"), "", ""))
+
+
+def _urllib_transport(request: urllib.request.Request, timeout: float) -> CloudAuthResponse:
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), _NoRedirect())
+    with opener.open(request, timeout=timeout) as response:
+        headers = {str(key): str(value) for key, value in response.headers.items()}
+        content_length = headers.get("Content-Length")
+        if content_length is not None:
+            try:
+                if int(content_length) > MAX_RESPONSE_BYTES:
+                    raise _contract_error()
+            except ValueError:
+                raise _contract_error() from None
+        body = response.read(MAX_RESPONSE_BYTES + 1)
+        return CloudAuthResponse(status=response.status, headers=headers, body=body)
+
+
+def _bounded_response(response: CloudAuthResponse) -> None:
+    if not isinstance(response.status, int) or isinstance(response.status, bool):
+        raise CloudAuthError("CLOUD_AUTH_TRANSPORT_FAILED", "Cloud returned no usable response")
+    if not isinstance(response.body, bytes) or len(response.body) > MAX_RESPONSE_BYTES:
+        raise _contract_error()
+    if not isinstance(response.headers, Mapping):
+        raise CloudAuthError("CLOUD_AUTH_TRANSPORT_FAILED", "Cloud returned no usable response")
+
+
+def _remote_error(response: CloudAuthResponse) -> CloudAuthError | None:
+    code = {
+        401: "CLOUD_AUTH_UNAUTHORIZED",
+        403: "CLOUD_AUTH_FORBIDDEN",
+        404: "CLOUD_AUTH_NOT_FOUND",
+        429: "CLOUD_AUTH_RATE_LIMITED",
+        503: "CLOUD_AUTH_TEMPORARILY_UNAVAILABLE",
+    }.get(response.status)
+    if code is None:
+        return None
+    retry_after = _retry_after(response.headers) if response.status in {429, 503} else None
+    details = {
+        "CLOUD_AUTH_UNAUTHORIZED": "Cloud did not accept this device credential",
+        "CLOUD_AUTH_FORBIDDEN": "Cloud did not authorize this device operation",
+        "CLOUD_AUTH_NOT_FOUND": "Cloud did not find that device operation",
+        "CLOUD_AUTH_RATE_LIMITED": "Cloud temporarily rate limited this device operation",
+        "CLOUD_AUTH_TEMPORARILY_UNAVAILABLE": "Cloud is temporarily unavailable",
+    }
+    return CloudAuthError(code, details[code], retry_after_seconds=retry_after)
+
+
+def _retry_after(headers: Mapping[str, str]) -> int | None:
+    value = next((item for key, item in headers.items() if key.lower() == "retry-after"), None)
+    if not isinstance(value, str) or not value.isascii() or not value.isdecimal():
+        return None
+    parsed = int(value)
+    return parsed if 0 <= parsed <= 86_400 else None
+
+
+def _is_json_media_type(headers: Mapping[str, str]) -> bool:
+    value = next((item for key, item in headers.items() if key.lower() == "content-type"), None)
+    return isinstance(value, str) and value.split(";", 1)[0].strip().lower() == "application/json"
+
+
+def _json_object(body: bytes) -> dict[str, Any]:
+    try:
+        value = json.loads(body.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise _contract_error() from None
+    if not isinstance(value, dict):
+        raise _contract_error()
+    return value
+
+
+def _require_api_version(value: Mapping[str, Any]) -> None:
+    if value.get("apiVersion") != "1":
+        raise _contract_error()
+
+
+def _required_text(value: Mapping[str, Any], field: str) -> str:
+    item = value.get(field)
+    if not _safe_text(item, required=True):
+        raise _contract_error()
+    return item
+
+
+def _safe_text(value: object, *, required: bool) -> bool:
+    return (
+        isinstance(value, str)
+        and (bool(value) if required else True)
+        and len(value) <= 4096
+        and not any(ord(character) < 0x20 or ord(character) == 0x7F for character in value)
+    )
+
+
+def _device_metadata(value: Any, *, require_current: bool = False) -> DeviceMetadata:
+    if not isinstance(value, dict):
+        raise _contract_error()
+    if "lastUsedAt" not in value:
+        raise _contract_error()
+    last_used_at = value["lastUsedAt"]
+    if last_used_at is not None and not _safe_text(last_used_at, required=False):
+        raise _contract_error()
+    current = value.get("current")
+    if require_current and not isinstance(current, bool):
+        raise _contract_error()
+    return DeviceMetadata(
+        key_id=_required_text(value, "id"),
+        name=_required_text(value, "name"),
+        prefix=_required_text(value, "prefix"),
+        last_four=_required_text(value, "lastFour"),
+        created_at=_required_text(value, "createdAt"),
+        last_used_at=last_used_at,
+        current=current if require_current else None,
+    )
+
+
+def _path_segment(key_id: str) -> str:
+    if (
+        not isinstance(key_id, str)
+        or not key_id
+        or len(key_id) > MAX_KEY_ID_CHARS
+        or any(ord(character) < 0x20 or ord(character) == 0x7F for character in key_id)
+    ):
+        raise CloudAuthError("CLOUD_AUTH_KEY_ID_INVALID", "device key id is invalid")
+    return urllib.parse.quote(key_id, safe="")
+
+
+def _exact_revoke_proof(body: bytes) -> RevokeProof:
+    try:
+        value = json.loads(body.decode("utf-8"), object_pairs_hook=_ObjectPairs)
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise _contract_error() from None
+    if not isinstance(value, _ObjectPairs) or len(value) != 2:
+        raise _contract_error()
+    keys = [key for key, _item in value]
+    if set(keys) != {"apiVersion", "status"} or len(set(keys)) != 2:
+        raise _contract_error()
+    fields = dict(value)
+    if fields.get("apiVersion") != "1" or fields.get("status") not in {
+        "revoked",
+        "already_revoked",
+    }:
+        raise _contract_error()
+    return RevokeProof(status=fields["status"])
+
+
+def _contract_error() -> CloudAuthError:
+    return CloudAuthError("CLOUD_AUTH_CONTRACT_INVALID", "Cloud returned an invalid auth contract")
+
+
+__all__ = [
+    "CloudAuthClient",
+    "CloudAuthError",
+    "CloudAuthResponse",
+    "CloudIdentity",
+    "CurrentDevice",
+    "CurrentIdentity",
+    "DeviceMetadata",
+    "RevokeProof",
+    "StudioIdentity",
+]

mostlyright/data_harness/ux/commands/__init__.py

@@ -0,0 +1,260 @@
+"""Closed, lazy descriptors for the ``mr-data`` subcommands.
+
+Inventory and top-level help read the literal descriptors below without scanning packages,
+loading entry points, or importing command implementations. A selected command resolves exactly
+one fixed module and verifies that module's ``SPEC`` still matches its descriptor.
+"""
+
+from __future__ import annotations
+
+import argparse
+import importlib
+import pkgutil
+from collections.abc import Callable, Iterable, Mapping, Sequence
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass(frozen=True)
+class CommandSpec:
+    """One subcommand: its name, its help line, its arguments, and its payload builder.
+
+    ``run`` returns the payload mapping and nothing else. It never prints and never decides the
+    output mode -- the caller renders the payload as plain lines or as JSON.
+
+    ``exit_code`` is read from that same payload, for the commands whose answer is a gate a script
+    acts on rather than a report a person reads. It is derived from the payload rather than
+    returned alongside it so that the exit code cannot say anything the printed answer does not;
+    a command without one always succeeds when it produced a payload at all.
+
+    ``validate`` refuses an argument set ``run`` would refuse, without running it. Argparse can
+    only express the rules one flag states about itself; a command whose flags are required in one
+    mode and forbidden in another has rules argparse cannot carry, and without this hook the only
+    way to discover them is to execute the command. A command that declares one promises that
+    ``validate`` accepts exactly the namespaces ``run`` reaches its first side effect with.
+    """
+
+    name: str
+    help: str
+    add_arguments: Callable[[argparse.ArgumentParser], None]
+    run: Callable[[argparse.Namespace], dict[str, Any]]
+    exit_code: Callable[[Mapping[str, Any]], int] | None = None
+    implementation_module: str | None = None
+    validate: Callable[[argparse.Namespace], None] | None = None
+
+    def resolve(self) -> CommandSpec:
+        """Load and verify this descriptor's fixed implementation, if it is lazy."""
+
+        if self.implementation_module is None:
+            return self
+        return _load(self.implementation_module, self.name, self.help)
+
+
+_LOADED: dict[str, CommandSpec] = {}
+
+
+def _load(module_name: str, expected_name: str, expected_help: str) -> CommandSpec:
+    loaded = _LOADED.get(module_name)
+    if loaded is None:
+        module = importlib.import_module(f"{__name__}.{module_name}")
+        loaded = getattr(module, "SPEC", None)
+        if not isinstance(loaded, CommandSpec):
+            raise RuntimeError(f"command module {module_name!r} does not declare a CommandSpec")
+        if loaded.name != expected_name or loaded.help != expected_help:
+            raise RuntimeError(
+                f"command descriptor for {expected_name!r} disagrees with module {module_name!r}"
+            )
+        _LOADED[module_name] = loaded
+    return loaded
+
+
+def _lazy(module_name: str, name: str, help_text: str) -> CommandSpec:
+    def add_arguments(parser: argparse.ArgumentParser) -> None:
+        _load(module_name, name, help_text).add_arguments(parser)
+
+    def run(args: argparse.Namespace) -> dict[str, Any]:
+        return _load(module_name, name, help_text).run(args)
+
+    def exit_code(payload: Mapping[str, Any]) -> int:
+        implementation = _load(module_name, name, help_text).exit_code
+        return 0 if implementation is None else implementation(payload)
+
+    def validate(args: argparse.Namespace) -> None:
+        implementation = _load(module_name, name, help_text).validate
+        if implementation is not None:
+            implementation(args)
+
+    return CommandSpec(
+        name=name,
+        help=help_text,
+        add_arguments=add_arguments,
+        run=run,
+        exit_code=exit_code,
+        implementation_module=module_name,
+        validate=validate,
+    )
+
+
+_DISCOVERED: tuple[CommandSpec, ...] = (
+    _lazy(
+        "approve",
+        "approve",
+        "freeze one recipe by fingerprint, after showing you exactly what you are freezing",
+    ),
+    _lazy(
+        "auth",
+        "auth",
+        "inspect remotely validated device authority and token boundaries",
+    ),
+    _lazy(
+        "author",
+        "author",
+        "turn a YAML recipe description into a recipe you can approve",
+    ),
+    # The provider-scale workflow is three verbs -- harvest, then author, then publish -- and each
+    # one is a separate mutation with a receipt of its own: `catalog-harvest` is the only one that
+    # reaches a network or reads a key, and it is also the only one that can be asked for the key
+    # check on its own. The descriptor tuple stays sorted by name, so they are not listed in the
+    # order they are run.
+    _lazy(
+        "catalog_author",
+        "catalog-author",
+        "author one converged public catalog generation into bounded authoring shards",
+    ),
+    _lazy(
+        "catalog_fill",
+        "catalog-fill",
+        "stage, reconcile, and publish one bounded public catalog successor",
+    ),
+    _lazy(
+        "catalog_harvest",
+        "catalog-harvest",
+        "stage one keyed public catalog sweep, or just check the key file boundary",
+    ),
+    _lazy(
+        "catalog_publish",
+        "catalog-publish",
+        "classify one authored generation, publish it, and write its one composite receipt",
+    ),
+    _lazy(
+        "catalog_search",
+        "catalog-search",
+        "search one exact verified sealed source catalog",
+    ),
+    _lazy(
+        "catalog_update",
+        "catalog-update",
+        "install one published catalog release after checking its exact fingerprint",
+    ),
+    _lazy(
+        "deploy",
+        "deploy",
+        "stage one verified Build and activate it as the authenticated Editor",
+    ),
+    _lazy(
+        "deploy_dataset",
+        "deploy-dataset",
+        "bring the Build a deployment released back here and write its dataset notebook",
+    ),
+    _lazy(
+        "deploy_plan",
+        "deploy-plan",
+        "plan a live dataset request without deploying it",
+    ),
+    _lazy(
+        "deploy_status",
+        "deploy-status",
+        "report what Studio says about the run one deployment queued",
+    ),
+    _lazy("diff", "diff", "compare two builds and say what changed"),
+    _lazy(
+        "index",
+        "index",
+        "build one bounded private index from exact-verified local Builds",
+    ),
+    _lazy(
+        "inventory",
+        "inventory",
+        "list what this build can do: operations, types, joins, engines, and checks",
+    ),
+    _lazy(
+        "list_builds",
+        "list",
+        "list the builds under a folder, and say whether they were checked",
+    ),
+    _lazy(
+        "login",
+        "login",
+        "sign in to the Mostly Right cloud and store a device credential",
+    ),
+    _lazy(
+        "peek",
+        "peek",
+        "open any file or public https address and show its columns, types, and first rows",
+    ),
+    _lazy(
+        "plan_check",
+        "plan-check",
+        "build this plan into a throwaway folder to see whether it works, then throw it away",
+    ),
+    _lazy("preflight", "preflight", "check what would stop a build before you start it"),
+    _lazy(
+        "record",
+        "record",
+        "seal already-recorded live messages into batches a build can read",
+    ),
+    _lazy(
+        "review_setup",
+        "review-setup",
+        "create protected review material; this does not approve a Build",
+    ),
+    _lazy(
+        "search",
+        "search",
+        "search exact published public and private local stores without changing them",
+    ),
+    _lazy(
+        "show",
+        "show",
+        "show one build: what it answers, what a row is, its columns, checks, and fingerprints",
+    ),
+    _lazy(
+        "whoami",
+        "whoami",
+        "compatibility alias for auth status",
+    ),
+)
+
+
+def discovered_commands() -> tuple[CommandSpec, ...]:
+    """Return the closed descriptor tuple without importing implementation modules."""
+
+    return _DISCOVERED
+
+
+def _module_names(search_path: Sequence[str] | None = None) -> tuple[str, ...]:
+    """Module names in this package, sorted, excluding private ones."""
+
+    path = list(search_path) if search_path is not None else list(__path__)
+    return tuple(
+        sorted(name for _finder, name, _ispkg in pkgutil.iter_modules(path) if name[:1] != "_")
+    )
+
+
+def _collect(modules: Iterable[tuple[str, Any]]) -> tuple[CommandSpec, ...]:
+    """Read one ``SPEC`` per module, preserving order and refusing duplicate command names."""
+
+    specs: list[CommandSpec] = []
+    seen: dict[str, str] = {}
+    for module_name, module in modules:
+        spec = getattr(module, "SPEC", None)
+        if spec is None:
+            continue
+        if spec.name in seen:
+            raise RuntimeError(
+                f"two command modules declare the command name {spec.name!r}: "
+                f"{seen[spec.name]!r} and {module_name!r}"
+            )
+        seen[spec.name] = module_name
+        specs.append(spec)
+    return tuple(specs)