regent-httpsig 0.1.1__tar.gz → 0.3.0__tar.gz

regent_httpsig-0.3.0/CHANGELOG.md

@@ -0,0 +1,68 @@
+# Changelog
+
+## 0.3.0
+
+**AAuth Budgets** (draft-hardt-aauth-budgets, editor's copy) — the resource
+side, first known implementation (running in production on get4agent.com):
+
+- **Auth tokens** (`typ: aa-auth+jwt`): PS-issued budget carriers verified
+  against a configuration-pinned PS (`HttpsigConfig.trusted_ps`: issuer →
+  JWKS URL), `aud`-checked against `resource_url`, `cnf`-bound, ≤1h lifetime.
+- **`BudgetClaim` + `InMemoryMeter`**: atomic reserve → commit → release
+  pooled per the draft's `(iss, sub, aud)` aggregation key; conservative
+  crash-safety (an unresolved reservation counts as consumed); consumption
+  records **scoped to the presenting agent's `jkt`** so one agent never
+  learns about a sibling's spending.
+- **`BudgetMiddleware`** (FastAPI): `price_fn` hook, metering cycle,
+  refusals (401 + `AAuth-Requirement` with `reason=insufficient-budget` /
+  `budget-exhausted` and an optional resource token via
+  `resource_token_provider`), per-response `AAuth-Budget` header; error
+  responses release the reservation.
+- `build_aauth_budget_header` / `build_aauth_requirement` — RFC 9651
+  serialization (note: the field is a Dictionary, so members are
+  comma-separated; the draft's §11 example shows parameter separators).
+
+## 0.2.0
+
+AAuth draft **-11** support (per the editor's copy, ahead of datatracker publication):
+
+- **Fully-specified algorithms (RFC 9864):** `Ed25519` accepted everywhere
+  (registered with PyJWT, including JWKS entries PyJWK cannot parse).
+  New `HttpsigConfig.require_fully_specified_algs` enforces the -11 MUST NOT on
+  the polymorphic `EdDSA`; the default keeps accepting it while the -10
+  ecosystem migrates, and will flip when -11 posts.
+- **Person tokens** (`typ: aa-person+jwt`): PS-issued, per-resource `aud`,
+  `cnf`-bound, ≤1h lifetime — verified via `{iss}/.well-known/aauth-person.json`.
+  Opt-in: set `HttpsigConfig.resource_url` (the token's `aud` must name it).
+  Result scheme: `"aauth-person"`, `sub` = the PS's directed user identifier.
+- Strict mode also enforces the -11 requirement that `cnf.jwk` carries a
+  fully-specified `alg` member.
+
+## 0.1.1
+
+- AAuth: tolerate absent `keyid` (RFC 9421 makes it optional; the key comes from
+  the token's `cnf.jwk`). Exposed by cross-library interop with
+  christian-posta/aauth-signing, whose signers correctly omit it; that signer's
+  exact keyid-less shape is now pinned in CI.
+
+## 0.1.0
+
+Initial release, extracted from Regent Protocol's production marketplace
+(get4agent.com), where it authenticates self-onboarding AI agents.
+
+- `HttpsigVerifier` — RFC 9421 verification for both agent dialects:
+  - Web Bot Auth (draft -05): sf-dictionary `Signature-Agent` with `;key=`
+    member selection AND the legacy sf-string form OpenAI ships in production;
+    key discovery via `/.well-known/http-message-signatures-directory`.
+  - AAuth (identity-based mode, `[aauth]` extra): `aa-agent+jwt` in
+    `Signature-Key`, issuer JWKS discovery, `cnf.jwk` proof of possession.
+  - SSRF-guarded directory fetching (https-only, public-IP-only, no redirects,
+    size-capped) with bounded per-instance caching.
+- `EgressSigner` + `regent-httpsig keygen` — sign outbound agent traffic
+  (Web Bot Auth), generate keys and ready-to-publish well-known files.
+- FastAPI integration (`[fastapi]` extra): `SignatureDep` (enrichment) and
+  `RequiredSignatureDep` (authentication with a self-explaining 401).
+- Test suite pinned to the official RFC 9421 B.2.6 vector, both Web Bot Auth
+  appendix vectors (A.2.2 re-signed — the draft's printed signature does not
+  verify over its own base; reported), and full sign→verify roundtrips for
+  both dialects.

{regent_httpsig-0.1.1 → regent_httpsig-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: regent-httpsig
-Version: 0.1.1
+Version: 0.3.0
 Summary: Verify and sign AI agent HTTP traffic in Python — RFC 9421 HTTP Message Signatures: Web Bot Auth (what OpenAI ships) and AAuth.
 Project-URL: Homepage, https://github.com/regent-protocol/regent-httpsig
 Project-URL: Repository, https://github.com/regent-protocol/regent-httpsig
@@ -72,6 +72,12 @@ signature yields `None`, and nothing ever raises on untrusted input. Use
 `regent_httpsig.fastapi.RequiredSignatureDep` when a signature must be present — the 401
 tells the agent exactly how to sign.
 
+> **Behind a reverse proxy?** The agent signed the *public* URL
+> (`https://api.example/…`), but your ASGI server sees `http://container/…`. The FastAPI
+> dependency rebuilds the signed URL from `X-Forwarded-Proto` + `Host`, so make sure your
+> proxy forwards the scheme — nginx: `proxy_set_header X-Forwarded-Proto $scheme;`.
+> If signatures mysteriously fail to verify in production, check this first.
+
 ## Sign: get your agent past bot walls
 
 ```python
@@ -125,10 +131,43 @@ keyid-less shape is pinned in CI.
 - **AAuth** (`draft-hardt-oauth-aauth-protocol`, identity-based mode): the agent carries a
   JWT `agent_token` in `Signature-Key`; the issuer's JWKS verifies the token, the token's
   `cnf.jwk` verifies the request signature. Install with `pip install 'regent-httpsig[aauth]'`.
+  Tracks the **-11 editor's copy**: fully-specified algorithms (RFC 9864, `Ed25519` — with a
+  transition flag for the -10 ecosystem's `EdDSA`) and **person tokens** (`aa-person+jwt`,
+  opt-in via `HttpsigConfig.resource_url`).
   For a full-protocol AAuth implementation (both roles, all token types) see
   [christian-posta/aauth-python-library](https://github.com/christian-posta/aauth-python-library) —
   this library is the thin relying-party verifier that handles both dialects.
 
+## Budgets: meter a spending envelope (draft-hardt-aauth-budgets)
+
+An agent can carry a PS-issued **auth token** (`typ: aa-auth+jwt`) with a
+`budget` claim — a spending envelope it uses offline, no per-call round trip
+to the control plane. The middleware does the whole resource-side checklist:
+verify the token against your pinned PS, atomically reserve → commit →
+release per request, answer with `AAuth-Budget`, and refuse exhausted
+envelopes with a `401` + `AAuth-Requirement` (optionally carrying your signed
+resource token with the agent's own consumption records — scoped to its key,
+so one agent never learns about a sibling's spending):
+
+```python
+from regent_httpsig import HttpsigConfig, HttpsigVerifier, InMemoryMeter
+from regent_httpsig.fastapi import BudgetMiddleware
+
+app.add_middleware(
+    BudgetMiddleware,
+    verifier=HttpsigVerifier(HttpsigConfig(
+        resource_url="https://api.example",
+        trusted_ps={"my-ps": "https://ps.example/jwks.json"},
+    )),
+    meter=InMemoryMeter(),
+    price_fn=lambda request: PRICES.get(request.url.path),  # max cost, minor units
+)
+```
+
+The only thing the library cannot do for you is pricing (`price_fn`) — that
+is your domain. First known implementation of the draft; running in
+production on [get4agent.com](https://get4agent.com).
+
 ## Security model (what a naive implementation gets wrong)
 
 The verifier fetches key directories from **attacker-nameable origins** — whoever signs a

{regent_httpsig-0.1.1 → regent_httpsig-0.3.0}/README.md

@@ -42,6 +42,12 @@ signature yields `None`, and nothing ever raises on untrusted input. Use
 `regent_httpsig.fastapi.RequiredSignatureDep` when a signature must be present — the 401
 tells the agent exactly how to sign.
 
+> **Behind a reverse proxy?** The agent signed the *public* URL
+> (`https://api.example/…`), but your ASGI server sees `http://container/…`. The FastAPI
+> dependency rebuilds the signed URL from `X-Forwarded-Proto` + `Host`, so make sure your
+> proxy forwards the scheme — nginx: `proxy_set_header X-Forwarded-Proto $scheme;`.
+> If signatures mysteriously fail to verify in production, check this first.
+
 ## Sign: get your agent past bot walls
 
 ```python
@@ -95,10 +101,43 @@ keyid-less shape is pinned in CI.
 - **AAuth** (`draft-hardt-oauth-aauth-protocol`, identity-based mode): the agent carries a
   JWT `agent_token` in `Signature-Key`; the issuer's JWKS verifies the token, the token's
   `cnf.jwk` verifies the request signature. Install with `pip install 'regent-httpsig[aauth]'`.
+  Tracks the **-11 editor's copy**: fully-specified algorithms (RFC 9864, `Ed25519` — with a
+  transition flag for the -10 ecosystem's `EdDSA`) and **person tokens** (`aa-person+jwt`,
+  opt-in via `HttpsigConfig.resource_url`).
   For a full-protocol AAuth implementation (both roles, all token types) see
   [christian-posta/aauth-python-library](https://github.com/christian-posta/aauth-python-library) —
   this library is the thin relying-party verifier that handles both dialects.
 
+## Budgets: meter a spending envelope (draft-hardt-aauth-budgets)
+
+An agent can carry a PS-issued **auth token** (`typ: aa-auth+jwt`) with a
+`budget` claim — a spending envelope it uses offline, no per-call round trip
+to the control plane. The middleware does the whole resource-side checklist:
+verify the token against your pinned PS, atomically reserve → commit →
+release per request, answer with `AAuth-Budget`, and refuse exhausted
+envelopes with a `401` + `AAuth-Requirement` (optionally carrying your signed
+resource token with the agent's own consumption records — scoped to its key,
+so one agent never learns about a sibling's spending):
+
+```python
+from regent_httpsig import HttpsigConfig, HttpsigVerifier, InMemoryMeter
+from regent_httpsig.fastapi import BudgetMiddleware
+
+app.add_middleware(
+    BudgetMiddleware,
+    verifier=HttpsigVerifier(HttpsigConfig(
+        resource_url="https://api.example",
+        trusted_ps={"my-ps": "https://ps.example/jwks.json"},
+    )),
+    meter=InMemoryMeter(),
+    price_fn=lambda request: PRICES.get(request.url.path),  # max cost, minor units
+)
+```
+
+The only thing the library cannot do for you is pricing (`price_fn`) — that
+is your domain. First known implementation of the draft; running in
+production on [get4agent.com](https://get4agent.com).
+
 ## Security model (what a naive implementation gets wrong)
 
 The verifier fetches key directories from **attacker-nameable origins** — whoever signs a

{regent_httpsig-0.1.1 → regent_httpsig-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "regent-httpsig"
-version = "0.1.1"
+version = "0.3.0"
 description = "Verify and sign AI agent HTTP traffic in Python — RFC 9421 HTTP Message Signatures: Web Bot Auth (what OpenAI ships) and AAuth."
 readme = "README.md"
 license = "Apache-2.0"

{regent_httpsig-0.1.1 → regent_httpsig-0.3.0}/src/regent_httpsig/__init__.py

@@ -4,26 +4,44 @@ Web Bot Auth (what OpenAI ships, what Cloudflare/AWS/Google verify) and AAuth
 (draft-hardt), in plain Python. See https://github.com/regent-protocol/regent-httpsig
 """
 
+from regent_httpsig.budget import (
+    BudgetClaim,
+    InMemoryMeter,
+    InsufficientBudget,
+    InvalidBudgetClaim,
+    UnitMismatch,
+)
 from regent_httpsig.config import HttpsigConfig
 from regent_httpsig.jwk import b64url, jwk_thumbprint, load_ed25519_jwk
 from regent_httpsig.netguard import NotPublicURL, assert_public_url
-from regent_httpsig.sfv import parse_signature_agent
+from regent_httpsig.sfv import (
+    build_aauth_budget_header,
+    build_aauth_requirement,
+    parse_signature_agent,
+)
 from regent_httpsig.sign import DIRECTORY_MEDIA_TYPE, EgressSigner, generate_seed
 from regent_httpsig.verify import WBA_TAG, HttpsigVerifier, VerifiedSignature
 
-__version__ = "0.1.1"
+__version__ = "0.3.0"
 
 __all__ = [
     "DIRECTORY_MEDIA_TYPE",
+    "BudgetClaim",
     "EgressSigner",
     "HttpsigConfig",
     "HttpsigVerifier",
+    "InMemoryMeter",
+    "InsufficientBudget",
+    "InvalidBudgetClaim",
     "NotPublicURL",
+    "UnitMismatch",
     "VerifiedSignature",
     "WBA_TAG",
     "__version__",
     "assert_public_url",
     "b64url",
+    "build_aauth_budget_header",
+    "build_aauth_requirement",
     "generate_seed",
     "jwk_thumbprint",
     "load_ed25519_jwk",

regent_httpsig-0.3.0/src/regent_httpsig/budget.py

@@ -0,0 +1,248 @@
+"""AAuth Budgets (draft-hardt-aauth-budgets, editor's copy) — resource-side core.
+
+The auth token carries a spending envelope::
+
+    "budget": { "amount": 2000000, "unit": "USD", "decimals": 6 }   # = $2.00
+
+and the resource meters every request against it: reserve the request's maximum
+cost atomically, serve, commit the actual cost, release the difference. The
+draft requires consumption to be aggregated atomically across all live auth
+tokens for the key ``(iss, sub, aud)`` (§14.4), so the meter pools the grants
+of a principal's live tokens and counts reservations + consumption against
+that pool.
+
+Everything here is framework-free; the FastAPI glue lives in
+:mod:`regent_httpsig.fastapi` (``BudgetMiddleware``).
+"""
+
+from __future__ import annotations
+
+import asyncio
+import itertools
+import time
+from collections.abc import Mapping
+from dataclasses import dataclass, field
+from typing import Any
+
+__all__ = [
+    "BudgetClaim",
+    "InMemoryMeter",
+    "InsufficientBudget",
+    "InvalidBudgetClaim",
+    "Reservation",
+    "UnitMismatch",
+]
+
+MeterKey = tuple[str, str, str]  # (iss, sub, aud) — the draft's aggregation key
+
+
+class InvalidBudgetClaim(ValueError):
+    """A ``budget`` member is present but malformed (issuer bug — not spendable)."""
+
+
+class UnitMismatch(ValueError):
+    """A grant's unit/decimals differ from the pool's — one envelope, one unit."""
+
+
+@dataclass(frozen=True)
+class BudgetClaim:
+    """The ``budget`` claim: integer amount in ``unit`` scaled by ``decimals``.
+
+    ``amount=5000000, unit="USD", decimals=6`` is $5.00 — all arithmetic stays
+    in integers; the scale only matters at display time.
+    """
+
+    amount: int
+    unit: str
+    decimals: int
+
+    @staticmethod
+    def parse(claims: Mapping[str, Any]) -> BudgetClaim | None:
+        """Extract the claim from a token's claim set. ``None`` when absent;
+        :class:`InvalidBudgetClaim` when present but malformed (all three
+        members are REQUIRED, integers must be non-negative, bools are not
+        integers here)."""
+        raw = claims.get("budget")
+        if raw is None:
+            return None
+        if not isinstance(raw, Mapping):
+            raise InvalidBudgetClaim("budget claim must be an object")
+        amount, unit, decimals = raw.get("amount"), raw.get("unit"), raw.get("decimals")
+        if (
+            isinstance(amount, bool) or not isinstance(amount, int) or amount < 0
+            or not isinstance(unit, str) or not unit
+            or isinstance(decimals, bool) or not isinstance(decimals, int) or decimals < 0
+        ):
+            raise InvalidBudgetClaim("budget claim requires amount/unit/decimals")
+        return BudgetClaim(amount=amount, unit=unit, decimals=decimals)
+
+
+@dataclass(frozen=True)
+class Reservation:
+    """An atomic hold on the pool for one in-flight request. Never revised —
+    committed (with the actual cost) or released, exactly once."""
+
+    rid: int
+    key: MeterKey
+    jti: str
+    amount: int
+
+
+@dataclass(frozen=True)
+class InsufficientBudget:
+    """Refusal: the request's maximum cost exceeds the pool's remaining balance.
+    ``exhausted`` distinguishes the draft's two reason tokens: an empty envelope
+    (``budget-exhausted``) vs a too-expensive request (``insufficient-budget``)."""
+
+    remaining: int
+    exhausted: bool
+
+
+@dataclass
+class _Pool:
+    unit: str
+    decimals: int
+    grants: dict[str, tuple[int, float]] = field(default_factory=dict)  # jti -> (amount, exp)
+    consumed: dict[str, int] = field(default_factory=dict)  # jti -> total committed
+    jkt_of: dict[str, str] = field(default_factory=dict)  # jti -> presenting key thumbprint
+    reservations: dict[int, tuple[str, int, float]] = field(default_factory=dict)
+    last_activity: float = 0.0
+
+
+class InMemoryMeter:
+    """Single-process meter (asyncio-safe). Right for a single-instance service;
+    multi-replica deployments need a shared backend behind the same interface.
+
+    Crash-safety is conservative: a reservation not committed or released within
+    ``reservation_ttl`` seconds is treated as fully consumed — the owner's
+    envelope is never silently under-counted by a crashed handler.
+    """
+
+    def __init__(self, *, reservation_ttl: float = 120.0,
+                 retention_seconds: float = 7200.0) -> None:
+        self._pools: dict[MeterKey, _Pool] = {}
+        self._lock = asyncio.Lock()
+        self._rids = itertools.count(1)
+        self._reservation_ttl = reservation_ttl
+        self._retention = retention_seconds
+
+    # ── internals (call under lock) ──────────────────────────────────────────
+
+    def _purge(self, key: MeterKey, now: float) -> _Pool | None:
+        pool = self._pools.get(key)
+        if pool is None:
+            return None
+        # Expired, unresolved reservations count as consumed (conservative).
+        for rid, (jti, amount, deadline) in list(pool.reservations.items()):
+            if deadline <= now:
+                pool.consumed[jti] = pool.consumed.get(jti, 0) + amount
+                del pool.reservations[rid]
+        # Expired grants leave the pool; their consumption records remain for
+        # budget_consumed reporting until the retention window passes.
+        for jti, (_, exp) in list(pool.grants.items()):
+            if exp <= now:
+                del pool.grants[jti]
+        if (not pool.grants and not pool.reservations
+                and now - pool.last_activity > self._retention):
+            del self._pools[key]
+            return None
+        return pool
+
+    @staticmethod
+    def _remaining(pool: _Pool) -> int:
+        live = sum(a for a, _ in pool.grants.values())
+        spent = sum(pool.consumed.get(jti, 0) for jti in pool.grants)
+        held = sum(a for _, a, _ in pool.reservations.values())
+        return max(0, live - spent - held)
+
+    # ── public interface (the BudgetMeter contract) ──────────────────────────
+
+    async def observe_grant(self, key: MeterKey, jti: str, claim: BudgetClaim,
+                            exp: float, jkt: str = "") -> None:
+        """Register a token's envelope in the principal's pool (idempotent per
+        ``jti``). ``jkt`` is the RFC 7638 thumbprint of the token's ``cnf`` key —
+        recorded so consumption records can be scoped to the presenting agent
+        (one agent must not learn about its siblings). Raises
+        :class:`UnitMismatch` if the pool already runs in a different unit —
+        one envelope, one unit, no FX at the meter."""
+        async with self._lock:
+            now = time.monotonic()
+            wall_delta = exp - time.time()
+            pool = self._purge(key, now)
+            if pool is None:
+                pool = self._pools.setdefault(
+                    key, _Pool(unit=claim.unit, decimals=claim.decimals))
+            if (pool.unit, pool.decimals) != (claim.unit, claim.decimals):
+                raise UnitMismatch(
+                    f"pool runs in {pool.unit}/{pool.decimals}, "
+                    f"grant is {claim.unit}/{claim.decimals}")
+            pool.last_activity = now
+            if jkt:
+                pool.jkt_of.setdefault(jti, jkt)
+            if jti not in pool.grants and wall_delta > 0:
+                pool.grants[jti] = (claim.amount, now + wall_delta)
+
+    async def reserve(self, key: MeterKey, jti: str,
+                      max_cost: int) -> Reservation | InsufficientBudget:
+        async with self._lock:
+            now = time.monotonic()
+            pool = self._purge(key, now)
+            if pool is None or jti not in pool.grants:
+                return InsufficientBudget(remaining=0, exhausted=True)
+            remaining = self._remaining(pool)
+            if max_cost > remaining:
+                return InsufficientBudget(remaining=remaining,
+                                          exhausted=remaining == 0)
+            rid = next(self._rids)
+            pool.reservations[rid] = (jti, max_cost, now + self._reservation_ttl)
+            pool.last_activity = now
+            return Reservation(rid=rid, key=key, jti=jti, amount=max_cost)
+
+    async def commit(self, res: Reservation, actual: int) -> int:
+        """Commit the actual cost (clamped to the reserved amount — reservations
+        are never revised upward) and return the pool's remaining balance."""
+        async with self._lock:
+            now = time.monotonic()
+            pool = self._purge(res.key, now)
+            if pool is None:
+                return 0
+            held = pool.reservations.pop(res.rid, None)
+            cost = min(max(actual, 0), held[1] if held else res.amount)
+            pool.consumed[res.jti] = pool.consumed.get(res.jti, 0) + cost
+            pool.last_activity = now
+            return self._remaining(pool)
+
+    async def release(self, res: Reservation) -> int:
+        async with self._lock:
+            pool = self._purge(res.key, time.monotonic())
+            if pool is None:
+                return 0
+            pool.reservations.pop(res.rid, None)
+            return self._remaining(pool)
+
+    async def remaining(self, key: MeterKey) -> int:
+        async with self._lock:
+            pool = self._purge(key, time.monotonic())
+            return 0 if pool is None else self._remaining(pool)
+
+    async def consumed_records(self, key: MeterKey,
+                               jkt: str | None = None) -> list[dict[str, Any]]:
+        """Per-token consumption for the resource token's ``budget_consumed``
+        claim: ``[{"jti": ..., "consumed": ...}, ...]``. Non-destructive — the
+        PS deduplicates by ``jti``, so reporting the same record twice is safe.
+
+        When ``jkt`` is given, records are scoped to tokens bound to that key:
+        the agent carrying the resource token sees only its OWN spending, never
+        its siblings' (privacy between a principal's agents, and no extra
+        figures to infer the ceiling from). Consequence: an abandoned agent's
+        records are never carried home by siblings — the PS-side conservative
+        rule (unreported expired allocation = fully consumed) is the backstop."""
+        async with self._lock:
+            pool = self._purge(key, time.monotonic())
+            if pool is None:
+                return []
+            return [
+                {"jti": jti, "consumed": total}
+                for jti, total in sorted(pool.consumed.items())
+                if total > 0 and (jkt is None or pool.jkt_of.get(jti) == jkt)
+            ]

{regent_httpsig-0.1.1 → regent_httpsig-0.3.0}/src/regent_httpsig/config.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from dataclasses import dataclass, field
 
 __all__ = ["HttpsigConfig"]
@@ -30,3 +31,17 @@ class HttpsigConfig:
     # Hosts exempt from the https-only + public-IP SSRF guard (local dev only —
     # e.g. frozenset({"localhost"})). Leave empty in production.
     insecure_hosts: frozenset[str] = field(default_factory=frozenset)
+    # AAuth -11 (editor's copy): JOSE algs must be fully-specified per RFC 9864 —
+    # implementations MUST NOT accept the polymorphic "EdDSA". True enforces that;
+    # the False default keeps accepting "EdDSA" while the -10 ecosystem migrates.
+    require_fully_specified_algs: bool = False
+    # This service's public URL (e.g. "https://api.example"). Required to accept
+    # AAuth person tokens — their `aud` must name this resource. None disables
+    # the person-token path entirely.
+    resource_url: str | None = None
+    # AAuth auth tokens (typ "aa-auth+jwt" — the carrier of budget envelopes):
+    # issuer → JWKS URL for each Person Server this resource accepts auth tokens
+    # from. A resource has an established relationship with its PS, so the key
+    # location is pinned by configuration rather than discovered open-world.
+    # Empty (the default) disables the auth-token path entirely.
+    trusted_ps: Mapping[str, str] = field(default_factory=dict)