posturanet 0.1.0__py3-none-any.whl

posturanet/__init__.py

@@ -0,0 +1,3 @@
+"""PosturaNet: evidence-backed remediation agent for AWS + Terraform."""
+
+__version__ = "0.1.0"

posturanet/__main__.py

@@ -0,0 +1,3 @@
+from posturanet.cli.app import main
+
+main()

posturanet/aws/__init__.py

@@ -0,0 +1,3 @@
+from posturanet.aws.readonly import ALLOWLIST, MutatingCallBlocked, ReadOnlyClient, iam_policy
+
+__all__ = ["ALLOWLIST", "MutatingCallBlocked", "ReadOnlyClient", "iam_policy"]

posturanet/aws/readonly.py

@@ -0,0 +1,96 @@
+"""Read-only AWS access (NFR-2, architecture doc 7.3).
+
+Every AWS call in PosturaNet goes through `ReadOnlyClient`. Operations not on the allowlist
+raise `MutatingCallBlocked` before anything reaches the network. The generated IAM policy
+(`iam_policy()`) is built from the same list so the two can't drift apart.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import re
+from typing import Any
+
+from posturanet.errors import PosturaNetError
+
+ALLOWLIST: tuple[str, ...] = (
+    "ec2:Describe*",
+    "logs:StartQuery",
+    "logs:GetQueryResults",
+    "logs:DescribeLogGroups",
+    "athena:StartQueryExecution",
+    "athena:GetQueryExecution",
+    "athena:GetQueryResults",
+    "s3:GetObject",
+    "s3:ListBucket",
+    "iam:Get*",
+    "iam:List*",
+    "iam:GenerateServiceLastAccessedDetails",
+    "iam:SimulatePrincipalPolicy",
+    "securityhub:GetFindings",
+    "access-analyzer:Get*",
+    "access-analyzer:List*",
+    "sts:GetCallerIdentity",
+    "sts:AssumeRole",
+)
+
+# boto3 service names that differ from IAM action prefixes.
+_IAM_PREFIX = {"accessanalyzer": "access-analyzer"}
+
+
+class MutatingCallBlocked(PosturaNetError):
+    """An AWS operation outside the read-only allowlist was attempted."""
+
+    exit_code = 10
+
+
+def iam_action(service: str, method: str) -> str:
+    """`("ec2", "describe_network_interfaces")` -> `"ec2:DescribeNetworkInterfaces"`."""
+    prefix = _IAM_PREFIX.get(service, service)
+    op = "".join(part.capitalize() for part in method.split("_"))
+    return f"{prefix}:{op}"
+
+
+def is_allowed(action: str) -> bool:
+    return any(fnmatch.fnmatchcase(action, pattern) for pattern in ALLOWLIST)
+
+
+_PAGINATOR = re.compile(r"^(get_paginator|can_paginate|get_waiter)$")
+
+
+class ReadOnlyClient:
+    """Wraps a boto3 client; only allowlisted operations are reachable."""
+
+    def __init__(self, client: Any, service: str) -> None:
+        self._client = client
+        self._service = service
+
+    @property
+    def service(self) -> str:
+        return self._service
+
+    def __getattr__(self, name: str) -> Any:
+        if name.startswith("_") or _PAGINATOR.match(name):
+            # Paginators and waiters would bypass the per-call check.
+            raise MutatingCallBlocked(f"{self._service}.{name} is not available in PosturaNet")
+        action = iam_action(self._service, name)
+        if not is_allowed(action):
+            raise MutatingCallBlocked(
+                f"{action} is not on the read-only allowlist; PosturaNet never writes to AWS"
+            )
+        return getattr(self._client, name)
+
+
+def iam_policy() -> dict[str, Any]:
+    """IAM policy document a customer attaches to PosturaNet's role."""
+    return {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "PosturaNetReadOnly",
+                "Effect": "Allow",
+                "Action": sorted(ALLOWLIST),
+                "Resource": "*",
+            }
+        ],
+    }

posturanet/aws/session.py

@@ -0,0 +1,55 @@
+"""Build read-only clients from ambient credentials or an assumed role."""
+
+from __future__ import annotations
+
+from typing import Any, Protocol
+
+from posturanet.aws.readonly import ReadOnlyClient
+from posturanet.errors import StageStop
+from posturanet.models.config import AwsConfig
+
+
+class ClientFactory(Protocol):
+    def __call__(self, service: str) -> ReadOnlyClient: ...
+
+
+def boto3_factory(cfg: AwsConfig, region: str | None = None) -> ClientFactory:
+    """Return a factory of read-only clients. Credentials are resolved lazily on first use."""
+    try:
+        import boto3
+        from botocore.exceptions import BotoCoreError, ClientError
+    except ImportError as exc:  # pragma: no cover - boto3 is a hard dependency
+        raise StageStop("evidence", "boto3 is not installed") from exc
+
+    session_cache: dict[str, Any] = {}
+
+    def _session() -> Any:
+        if "s" in session_cache:
+            return session_cache["s"]
+        base = boto3.session.Session(region_name=region or cfg.region)
+        if cfg.role_arn:
+            sts = ReadOnlyClient(base.client("sts"), "sts")
+            try:
+                creds = sts.assume_role(RoleArn=cfg.role_arn, RoleSessionName="posturanet")[
+                    "Credentials"
+                ]
+            except (BotoCoreError, ClientError) as exc:
+                raise StageStop(
+                    "evidence",
+                    f"could not assume {cfg.role_arn}",
+                    ["check the role trust policy and that this runner may assume it"],
+                    why=str(exc),
+                ) from exc
+            base = boto3.session.Session(
+                aws_access_key_id=creds["AccessKeyId"],
+                aws_secret_access_key=creds["SecretAccessKey"],
+                aws_session_token=creds["SessionToken"],
+                region_name=region or cfg.region,
+            )
+        session_cache["s"] = base
+        return base
+
+    def factory(service: str) -> ReadOnlyClient:
+        return ReadOnlyClient(_session().client(service), service)
+
+    return factory

posturanet/cli/app.py

@@ -0,0 +1,283 @@
+"""`posturanet` CLI. The only place that maps errors to exit codes (architecture doc 12)."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+from enum import StrEnum
+from pathlib import Path
+from typing import TYPE_CHECKING, Annotated, TextIO
+
+import typer
+
+from posturanet import __version__
+from posturanet.aws.readonly import iam_policy
+from posturanet.errors import PosturaNetError, UsageError
+from posturanet.evidence import FileSource
+from posturanet.models import RunRecord
+from posturanet.models.config import load_config
+from posturanet.output import banner, console
+from posturanet.pipeline import Context, Mode, run_fix
+
+if TYPE_CHECKING:
+    from posturanet.gate import GateResult
+
+app = typer.Typer(
+    name="posturanet",
+    help="PosturaNet: evidence-backed Terraform fixes for cloud security findings.",
+    add_completion=False,
+)
+contract_app = typer.Typer(help="Build and check behavior contracts.", no_args_is_help=True)
+app.add_typer(contract_app, name="contract")
+hook_app = typer.Typer(help="Editor and AI agent hooks.", no_args_is_help=True)
+app.add_typer(hook_app, name="hook")
+
+
+class OutputFormat(StrEnum):
+    TEXT = "text"
+    JSON = "json"
+
+
+RepoOpt = Annotated[Path, typer.Option(help="Terraform repo root.")]
+StateOpt = Annotated[
+    Path | None, typer.Option(help="Local copy of the Terraform state (never commit it).")
+]
+EvidenceOpt = Annotated[
+    Path | None,
+    typer.Option("--evidence-file", help="Exported flow-log aggregate (JSON) instead of AWS."),
+]
+WindowOpt = Annotated[str | None, typer.Option(help="Evidence window, e.g. 90d.")]
+FormatOpt = Annotated[OutputFormat, typer.Option("--format")]
+AsciiOpt = Annotated[bool, typer.Option("--ascii", help="ASCII-only output.")]
+
+
+def _version(value: bool) -> None:
+    if value:
+        typer.echo(f"PosturaNet {__version__}")
+        raise typer.Exit(0)
+
+
+def _banner(stream: TextIO) -> None:
+    if banner.allowed(stream):
+        console.write(banner.render(ascii_mode=console.wants_ascii(stream)), stream)
+
+
+@app.callback(invoke_without_command=True)
+def _root(
+    ctx: typer.Context,
+    version: Annotated[
+        bool, typer.Option("--version", callback=_version, is_eager=True, help="Show version.")
+    ] = False,
+) -> None:
+    if ctx.invoked_subcommand is None:
+        _banner(sys.stdout)
+        typer.echo(ctx.get_help())
+        raise typer.Exit(0)
+
+
+def _window(value: str | None) -> int | None:
+    if value is None:
+        return None
+    m = re.fullmatch(r"(\d+)d?", value.strip())
+    if not m or not 1 <= int(m.group(1)) <= 400:
+        raise UsageError(f"--window must look like 90d (1-400 days), got {value!r}")
+    return int(m.group(1))
+
+
+def _context(
+    mode: Mode,
+    repo: Path,
+    state: Path | None,
+    evidence_file: Path | None,
+    window: str | None,
+) -> Context:
+    if not repo.is_dir():
+        raise UsageError(f"--repo is not a directory: {repo}")
+    if evidence_file is not None and not evidence_file.is_file():
+        raise UsageError(f"--evidence-file not found: {evidence_file}")
+    ctx = Context(
+        mode=mode,
+        state_path=state,
+        evidence=FileSource(evidence_file) if evidence_file else None,
+        window_days=_window(window),
+    )
+    if mode != "dry-run":
+        from posturanet.aws.session import boto3_factory
+
+        config, _ = load_config(repo)
+        ctx.aws = boto3_factory(config.aws)
+    return ctx
+
+
+def _emit(record: RunRecord, output_format: OutputFormat, ascii_mode: bool) -> None:
+    if output_format is OutputFormat.JSON:
+        console.write(console.render_json(record))
+    else:
+        use_ascii = ascii_mode or console.wants_ascii(sys.stdout)
+        console.write(console.render_text(record, ascii_mode=use_ascii))
+    raise typer.Exit(record.exit_code)
+
+
+def _fail(exc: PosturaNetError) -> typer.Exit:
+    typer.echo(f"error: {exc}", err=True)
+    return typer.Exit(exc.exit_code)
+
+
+@app.command()
+def fix(
+    target: Annotated[str, typer.Argument(help="ASFF finding file (.json) or a resource id.")],
+    dry_run: Annotated[
+        bool, typer.Option("--dry-run", help="No AWS, GitHub or terraform plan; writes nothing.")
+    ] = False,
+    open_pr: Annotated[
+        bool, typer.Option("--open-pr", help="Open or update the PR when every check passes.")
+    ] = False,
+    repo: RepoOpt = Path("."),
+    state: StateOpt = None,
+    evidence_file: EvidenceOpt = None,
+    window: WindowOpt = None,
+    output_format: FormatOpt = OutputFormat.TEXT,
+    ascii_mode: AsciiOpt = False,
+) -> None:
+    """Turn a finding into a validated fix, and optionally a PR."""
+    try:
+        if dry_run and open_pr:
+            raise UsageError("--dry-run and --open-pr can't be used together")
+        mode: Mode = "dry-run" if dry_run else ("open-pr" if open_pr else "check")
+        ctx = _context(mode, repo, state, evidence_file, window)
+        config, _ = load_config(repo)
+        record = run_fix(target, repo, config, ctx)
+    except PosturaNetError as exc:
+        raise _fail(exc) from exc
+    _emit(record, output_format, ascii_mode)
+
+
+@contract_app.command("build")
+def contract_build(
+    target: Annotated[str, typer.Argument(help="ASFF finding file or security group id.")],
+    dry_run: Annotated[bool, typer.Option("--dry-run", help="Don't write the contract.")] = False,
+    repo: RepoOpt = Path("."),
+    state: StateOpt = None,
+    evidence_file: EvidenceOpt = None,
+    window: WindowOpt = None,
+    output_format: FormatOpt = OutputFormat.TEXT,
+    ascii_mode: AsciiOpt = False,
+) -> None:
+    """Build a draft behavior contract from observed usage."""
+    try:
+        ctx = _context("dry-run" if dry_run else "check", repo, state, evidence_file, window)
+        ctx.stop_after = "contract"
+        ctx.command = "contract build"
+        config, _ = load_config(repo)
+        record = run_fix(target, repo, config, ctx)
+    except PosturaNetError as exc:
+        raise _fail(exc) from exc
+    _emit(record, output_format, ascii_mode)
+
+
+_GATE_EXIT = {"PASS": 0, "BLOCK": 5, "UNKNOWN": 3}
+
+
+def _publish_check(result: GateResult, sha: str | None) -> str:
+    from posturanet.deliver.checks import publish
+    from posturanet.deliver.github import GitHub
+
+    token = os.environ.get("GITHUB_TOKEN")
+    repo_slug = os.environ.get("GITHUB_REPOSITORY")
+    head = sha or os.environ.get("GITHUB_SHA")
+    if not token or not repo_slug or not head:
+        raise UsageError(
+            "--github-check needs GITHUB_TOKEN, GITHUB_REPOSITORY and --sha (or GITHUB_SHA)"
+        )
+    return publish(GitHub(token, repo_slug), result, head)
+
+
+@contract_app.command("check")
+def contract_check(
+    plan: Annotated[
+        Path | None, typer.Option("--plan", help="`terraform show -json` output.")
+    ] = None,
+    source: Annotated[
+        bool,
+        typer.Option("--source", help="Check the Terraform source instead of a plan (offline)."),
+    ] = False,
+    files: Annotated[
+        list[Path] | None,
+        typer.Option("--file", help="With --source: only groups defined in this .tf file."),
+    ] = None,
+    github_check: Annotated[
+        bool, typer.Option("--github-check", help="Publish the result as a GitHub check run.")
+    ] = False,
+    sha: Annotated[str | None, typer.Option(help="Commit for the check run.")] = None,
+    repo: RepoOpt = Path("."),
+    output_format: FormatOpt = OutputFormat.TEXT,
+    ascii_mode: AsciiOpt = False,
+) -> None:
+    """Check a change against the contracts in the repo. Exit 5 on BLOCK, 3 on UNKNOWN."""
+    from posturanet.gate import check_plan, check_source
+
+    try:
+        if (plan is None) == (not source):
+            raise UsageError("use exactly one of --plan or --source")
+        if files and not source:
+            raise UsageError("--file only works with --source")
+        config, _ = load_config(repo)
+        if plan is not None:
+            if not plan.is_file():
+                raise UsageError(f"--plan not found: {plan}")
+            try:
+                plan_doc = json.loads(plan.read_text(encoding="utf-8"))
+            except json.JSONDecodeError as exc:
+                raise UsageError(f"--plan is not JSON (use `terraform show -json`): {exc}") from exc
+            result = check_plan(plan_doc, repo, config)
+        else:
+            result = check_source(repo, config, files or None)
+        check_url = _publish_check(result, sha) if github_check else None
+    except PosturaNetError as exc:
+        raise _fail(exc) from exc
+
+    if output_format is OutputFormat.JSON:
+        doc = result.to_dict()
+        if check_url is not None:
+            doc["check_url"] = check_url
+        console.write(json.dumps(doc, indent=2) + "\n")
+    else:
+        console.write(console.render_gate(result, ascii_mode or console.wants_ascii(sys.stdout)))
+    raise typer.Exit(_GATE_EXIT[result.status])
+
+
+@hook_app.command("claude-code")
+def hook_claude_code(repo: RepoOpt = Path(".")) -> None:
+    """Claude Code PostToolUse hook: check an edited .tf file against the contracts.
+
+    Reads the hook event from stdin. On BLOCK, tells Claude why so it can fix its own change.
+    Never fails the session on its own errors.
+    """
+    from posturanet.hooks import claude_code
+
+    console.write(claude_code(sys.stdin.read(), repo))
+    raise typer.Exit(0)
+
+
+@app.command()
+def init() -> None:
+    """Print the read-only IAM policy for PosturaNet's role. Writes nothing."""
+    _banner(sys.stderr)  # stderr, so `posturanet init > policy.json` stays clean JSON
+    console.write(json.dumps(iam_policy(), indent=2) + "\n")
+
+
+@app.command()
+def mcp() -> None:
+    """Run the read-only MCP server over stdio."""
+    try:
+        from posturanet.mcp.server import serve
+    except ImportError as exc:
+        typer.echo("error: install the MCP extra: pip install 'posturanet[mcp]'", err=True)
+        raise typer.Exit(2) from exc
+    serve()
+
+
+def main() -> None:
+    app()

posturanet/contracts/__init__.py

@@ -0,0 +1,18 @@
+from posturanet.contracts.builder import build_contract, default_must_deny
+from posturanet.contracts.store import (
+    contract_path,
+    dump_contract,
+    load_contract,
+    merge_human_fields,
+    write_contract,
+)
+
+__all__ = [
+    "build_contract",
+    "contract_path",
+    "default_must_deny",
+    "dump_contract",
+    "load_contract",
+    "merge_human_fields",
+    "write_contract",
+]

posturanet/contracts/builder.py

@@ -0,0 +1,63 @@
+"""Observations -> draft BehaviorContract (FR-14)."""
+
+from __future__ import annotations
+
+from posturanet import __version__
+from posturanet.contracts.invariants import SG_SENSITIVE_PORTS, WORLD_CIDRS
+from posturanet.evidence.periodicity import describe
+from posturanet.models import BehaviorContract, NetRule, Observations
+from posturanet.models.contract import ObservedMeta, ObservedWindow
+from posturanet.synth.sg_rules import Rule
+
+
+def default_must_deny(open_rules: list[Rule], observed_ports: set[int]) -> list[NetRule]:
+    """No world access on any sensitive port the open rules expose, nor on their single ports."""
+    ports: set[int] = set()
+    for r in open_rules:
+        if r.proto == "-1":
+            ports.update(SG_SENSITIVE_PORTS)
+            ports.update(observed_ports)
+            continue
+        if r.from_port == r.to_port and r.from_port >= 0:
+            ports.add(r.from_port)
+        ports.update(p for p in SG_SENSITIVE_PORTS if r.from_port <= p <= r.to_port)
+        ports.update(p for p in observed_ports if r.from_port <= p <= r.to_port)
+    return [NetRule(cidr=c, port=p, proto="tcp") for p in sorted(ports) for c in WORLD_CIDRS]
+
+
+def build_contract(
+    obs: Observations,
+    open_rules: list[Rule],
+    *,
+    account: str | None,
+    region: str | None,
+) -> BehaviorContract:
+    allow: list[NetRule] = []
+    review: list[NetRule] = []
+    for item in obs.items:
+        rule = NetRule(
+            cidr=item.cidr,
+            port=item.port,
+            proto=item.proto,
+            period=describe(item.period, item.hours_histogram),
+            count=item.count,
+        )
+        (review if item.needs_review else allow).append(rule)
+
+    return BehaviorContract(
+        resource=obs.resource_address,
+        account=account,
+        region=region,
+        observed=ObservedMeta(
+            source=obs.source,
+            window=ObservedWindow(
+                start=obs.window.start.date(), end=obs.window.end.date(), days=obs.window.days
+            ),
+            confidence=obs.confidence,
+        ),
+        must_allow=allow,
+        must_deny=default_must_deny(open_rules, {i.port for i in obs.items}),
+        needs_review=review,
+        unknown_risk=f"behavior rarer than once per {obs.window.days} days is not observed",
+        generated_by=f"posturanet {__version__}",
+    )

posturanet/contracts/invariants.py

@@ -0,0 +1,7 @@
+"""Default `must_deny` invariants per fix type (architecture doc 6.4)."""
+
+from __future__ import annotations
+
+# Adapted from postura-backend/app/aws/remediation/ip_safe.py (sensitive-port list).
+SG_SENSITIVE_PORTS: tuple[int, ...] = (22, 3389, 3306, 5432, 1433, 6379, 9200, 27017)
+WORLD_CIDRS: tuple[str, ...] = ("0.0.0.0/0", "::/0")

posturanet/contracts/store.py

@@ -0,0 +1,135 @@
+"""Read and write contract YAML in the repo (design system section 5).
+
+Approved contracts are never overwritten. On regeneration of a draft, human-added `owner`
+and `ref` fields on matching entries are kept.
+"""
+
+from __future__ import annotations
+
+import io
+import re
+from pathlib import Path
+from typing import Any
+
+from pydantic import ValidationError
+from ruamel.yaml import YAML
+from ruamel.yaml.comments import CommentedMap, CommentedSeq
+from ruamel.yaml.error import YAMLError
+
+from posturanet.errors import StageStop
+from posturanet.models import BehaviorContract, NetRule
+
+HEADER = "Generated by PosturaNet. Review must_allow and needs_review, then merge to approve."
+_KEY_ORDER = (
+    "schema",
+    "resource",
+    "account",
+    "region",
+    "kind",
+    "observed",
+    "must_allow",
+    "must_deny",
+    "needs_review",
+    "unknown_risk",
+    "status",
+    "approved_by",
+    "approved_at",
+    "generated_by",
+)
+_RULE_ORDER = ("cidr", "port", "proto", "period", "owner", "ref", "count")
+
+
+def contract_filename(address: str) -> str:
+    return re.sub(r'[\[\]"]', "_", address) + ".yaml"
+
+
+def contract_path(repo: Path, contracts_dir: str, address: str) -> Path:
+    return repo / contracts_dir / contract_filename(address)
+
+
+def load_contract(path: Path) -> BehaviorContract | None:
+    if not path.is_file():
+        return None
+    try:
+        data = YAML(typ="safe").load(path.read_text(encoding="utf-8"))
+        return BehaviorContract.model_validate(data)
+    except (YAMLError, ValidationError) as exc:
+        raise StageStop(
+            "contract",
+            f"contract {path.name} is invalid",
+            ["fix the YAML by hand, or delete it to regenerate a draft"],
+            why=str(exc).splitlines()[0],
+        ) from exc
+
+
+def merge_human_fields(new: BehaviorContract, old: BehaviorContract | None) -> BehaviorContract:
+    if old is None:
+        return new
+    kept = {(r.cidr, r.port, r.proto): r for r in [*old.must_allow, *old.needs_review]}
+
+    def carry(rules: list[NetRule]) -> list[NetRule]:
+        out = []
+        for r in rules:
+            prev = kept.get((r.cidr, r.port, r.proto))
+            if prev is not None:
+                r = r.model_copy(update={"owner": prev.owner or r.owner, "ref": prev.ref or r.ref})
+            out.append(r)
+        return out
+
+    return new.model_copy(
+        update={"must_allow": carry(new.must_allow), "needs_review": carry(new.needs_review)}
+    )
+
+
+def _flow(rule: NetRule) -> CommentedMap:
+    data = rule.model_dump(exclude_none=True)
+    m = CommentedMap((k, data[k]) for k in _RULE_ORDER if k in data)
+    m.fa.set_flow_style()
+    return m
+
+
+def _seq(rules: list[NetRule]) -> CommentedSeq:
+    s = CommentedSeq(_flow(r) for r in rules)
+    if not rules:
+        s.fa.set_flow_style()
+    return s
+
+
+def dump_contract(contract: BehaviorContract) -> str:
+    data: dict[str, Any] = contract.model_dump(by_alias=True, mode="python")
+    root = CommentedMap()
+    for key in _KEY_ORDER:
+        value = data[key]
+        if key in ("must_allow", "must_deny", "needs_review"):
+            value = _seq(getattr(contract, key))
+        elif key == "observed":
+            obs = CommentedMap(
+                [
+                    ("source", value["source"]),
+                    ("window", CommentedMap(value["window"])),
+                    ("confidence", str(value["confidence"])),
+                ]
+            )
+            obs["window"].fa.set_flow_style()
+            value = obs
+        elif key == "account" and value is not None:
+            value = str(value)
+        root[key] = value
+    root.yaml_set_start_comment(HEADER)
+
+    yaml = YAML()
+    yaml.indent(mapping=2, sequence=4, offset=2)
+    yaml.width = 200
+    buf = io.StringIO()
+    yaml.dump(root, buf)
+    text = buf.getvalue()
+    # Quote the account id so YAML never reads it as a number.
+    if contract.account:
+        text = text.replace(f"account: {contract.account}\n", f'account: "{contract.account}"\n')
+        text = text.replace(f"account: '{contract.account}'\n", f'account: "{contract.account}"\n')
+    return text
+
+
+def write_contract(path: Path, contract: BehaviorContract) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(dump_contract(contract), encoding="utf-8", newline="\n")

posturanet/deliver/__init__.py

@@ -0,0 +1,4 @@
+from posturanet.deliver.github import Delivery, GitHub, branch_name, deliver
+from posturanet.deliver.idempotency import idempotency_key
+
+__all__ = ["Delivery", "GitHub", "branch_name", "deliver", "idempotency_key"]