requ 0.1.0__tar.gz

requ-0.1.0/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+## 0.1.0
+
+- Bounded HTTP(S) methods, query pairs, bytes and finite JSON over a client-owned
+  HTTP/1.1 pool with explicit lifecycle and asynchronous worker-thread facade.
+- Verified TLS, explicit proxies, isolated redirects, strict framing, transport
+  errors and owned buffered responses without automatic retries or decompression.

requ-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Outside Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

requ-0.1.0/PKG-INFO

@@ -0,0 +1,65 @@
+Metadata-Version: 2.4
+Name: requ
+Version: 0.1.0
+Summary: Bounded HTTP(S) requests with client-owned connection pooling
+Author: ellainng
+Author-email: ellainng <299958882+ellainng@users.noreply.github.com>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Typing :: Typed
+Requires-Python: >=3.14
+Project-URL: Homepage, https://github.com/wispsy/requ
+Project-URL: Repository, https://github.com/wispsy/requ
+Project-URL: Issues, https://github.com/wispsy/requ/issues
+Description-Content-Type: text/markdown
+
+# requ
+
+Explicit, bounded HTTP(S) requests with Python's standard library. Python 3.14+;
+no runtime dependencies.
+
+```sh
+pip install requ
+```
+
+```python
+from requ import Client
+
+with Client(timeout=10, max_bytes=2_000_000, max_connections=4) as client:
+    response = client.post('https://api.example.com/users', json={'name': 'Ash'})
+    response.raise_for_status()
+    user = response.json()
+```
+
+Use `AsyncClient` with `async with` and `await client.request(...)` for asynchronous
+applications. Its I/O runs in worker threads. Canceling an await does not undo or
+stop a dispatched request; the connection remains leased until the worker returns.
+
+- General methods, query pairs, bounded bytes/finite JSON and owned responses.
+- Client-owned HTTP/1.1 pool with finite capacity, lease wait and idle expiry.
+- Verified TLS, validated headers, strict framing and bounded redirects.
+- No retries, cookies, automatic decompression or global opener changes.
+- Environment proxies require `trust_env=True`; proxy requests use non-pooled
+  urllib transport while retaining the client's concurrency/body/socket bounds.
+
+`timeout` bounds individual blocking socket operations. It is **not** a DNS or total
+wall-clock deadline. Direct sockets remain in the pool until expiry or `close()`;
+responses themselves contain only owned bytes. Always use a context or close the
+client when finished. GET/HEAD may follow bounded redirects; mutations return their
+redirect response without replay. Cross-origin redirect opt-in strips caller headers.
+
+See [the API reference](docs/api.md) for the precise limits and error contract.
+API resources, credentials and GraphQL belong in a higher-level library such as
+[apiconn](https://github.com/wispsy/apiconn).
+
+Development: `uv sync`, then
+`uv run python -W error::ResourceWarning -m unittest discover -s tests -v`.
+Build and independently test both distributions with
+`uv run python scripts/check_distribution.py`.
+
+MIT.

requ-0.1.0/README.md

@@ -0,0 +1,45 @@
+# requ
+
+Explicit, bounded HTTP(S) requests with Python's standard library. Python 3.14+;
+no runtime dependencies.
+
+```sh
+pip install requ
+```
+
+```python
+from requ import Client
+
+with Client(timeout=10, max_bytes=2_000_000, max_connections=4) as client:
+    response = client.post('https://api.example.com/users', json={'name': 'Ash'})
+    response.raise_for_status()
+    user = response.json()
+```
+
+Use `AsyncClient` with `async with` and `await client.request(...)` for asynchronous
+applications. Its I/O runs in worker threads. Canceling an await does not undo or
+stop a dispatched request; the connection remains leased until the worker returns.
+
+- General methods, query pairs, bounded bytes/finite JSON and owned responses.
+- Client-owned HTTP/1.1 pool with finite capacity, lease wait and idle expiry.
+- Verified TLS, validated headers, strict framing and bounded redirects.
+- No retries, cookies, automatic decompression or global opener changes.
+- Environment proxies require `trust_env=True`; proxy requests use non-pooled
+  urllib transport while retaining the client's concurrency/body/socket bounds.
+
+`timeout` bounds individual blocking socket operations. It is **not** a DNS or total
+wall-clock deadline. Direct sockets remain in the pool until expiry or `close()`;
+responses themselves contain only owned bytes. Always use a context or close the
+client when finished. GET/HEAD may follow bounded redirects; mutations return their
+redirect response without replay. Cross-origin redirect opt-in strips caller headers.
+
+See [the API reference](docs/api.md) for the precise limits and error contract.
+API resources, credentials and GraphQL belong in a higher-level library such as
+[apiconn](https://github.com/wispsy/apiconn).
+
+Development: `uv sync`, then
+`uv run python -W error::ResourceWarning -m unittest discover -s tests -v`.
+Build and independently test both distributions with
+`uv run python scripts/check_distribution.py`.
+
+MIT.

requ-0.1.0/docs/api.md

@@ -0,0 +1,97 @@
+# HTTP client contract
+
+`Client` and `AsyncClient` accept these keyword-only configuration fields (the
+synchronous dataclass also accepts positional configuration for compatibility):
+
+| Option | Default | Meaning |
+| --- | --- | --- |
+| timeout | 10 seconds | Each blocking socket operation; not DNS or total time |
+| max_bytes | 5,000,000 | Maximum buffered response bytes |
+| max_request_bytes | 5,000,000 | Maximum transmitted body bytes |
+| max_connections | 10 | Total concurrent leases/retained direct connections across origins |
+| pool_timeout | 10 seconds | Maximum wait for an available lease |
+| keepalive_expiry | 30 seconds | Idle direct connections expire on the next acquisition |
+| max_redirects | 5 | Maximum GET/HEAD redirects |
+| allow_cross_origin_redirects | False | Opt in, stripping all caller headers |
+| trust_env | False | Opt in to urllib environment/system proxy discovery |
+
+Numeric time bounds must be finite and positive; count/byte bounds must be positive
+integers, except `max_redirects` permits zero. Booleans are not accepted as numbers.
+Clients can be shared between threads. Async clients use the same core via
+`asyncio.to_thread`, not native event-loop sockets. Cancellation stops waiting and
+does not roll back mutations or cancel the active worker. Applications needing a
+hard process-level deadline must arrange it outside this client.
+
+## Requests
+
+`request(method, url, *, headers=None, body=None, json=..., params=None)` accepts
+absolute ASCII HTTP(S) URLs without credentials, whitespace or control characters.
+Fragments are removed. Unicode paths/hosts must already be URL/IDNA encoded.
+`params` uses standard `urlencode(..., doseq=True)` and may be a mapping or ordered
+pairs, preserving repeated keys. CONNECT, TRACE and GET/HEAD bodies are unsupported.
+Conveniences: `get`, `head`, `post`, `put`, `patch`, `delete`.
+
+Bodies are immutable bytes or strict finite JSON (`json=None` sends JSON null).
+`body` and `json` are exclusive. JSON uses UTF-8, string object keys, JSON primitive
+values, lists and dictionaries; tuple/custom-value coercion is rejected. Encoding
+occurs before the byte limit is checked, so the caller must also bound input memory.
+`encode_json` exposes the same encoder and `JSONValue` its recursive type.
+
+Headers are copied, case-insensitively deduplicated and validated as token names
+and Latin-1 values without controls. The transport owns Host, Connection,
+Content-Length, Transfer-Encoding, Proxy-Authorization, Proxy-Connection,
+Accept-Encoding, Keep-Alive, TE, Trailer, Upgrade and Expect. JSON defaults to
+Content-Type application/json; callers may select a specific JSON media type.
+No cookie store, ambient API credentials or automatic retries are installed.
+
+## Redirects, proxies and pooling
+
+Only GET/HEAD redirects are followed. Other methods return their 3xx response;
+`raise_for_status()` follows the usual 4xx/5xx convention, so inspect 3xx explicitly
+if your application requires 2xx. HTTPS downgrade, cycles, invalid targets and
+unselected cross-origin redirects fail. Cross-origin opt-in drops **all** caller
+headers permanently for the remaining redirect chain. Automatic decompression is
+absent and non-identity Content-Encoding fails for representation bodies.
+
+TLS uses the platform default verified context with HTTP/1.1 ALPN. There is no
+certificate-verification bypass. By default proxies and global urllib openers are
+ignored. `trust_env=True` selects urllib's proxy discovery, CONNECT and proxy auth;
+these requests hold a bounded lease but always close their actual sockets and do
+not pool proxy connections. HTTP proxies can observe unencrypted HTTP traffic.
+URLs are not an SSRF policy; callers select permitted destinations themselves.
+
+Direct connections are pooled by scheme, host and port. Only completely consumed,
+validly framed keep-alive responses return connections to the pool. Errors evict
+connections. Idle connections may be evicted for another origin; stale connections
+can fail and are never automatically retried, including safe methods. `close()` is
+idempotent, closes idle sockets, wakes lease waiters and prevents new requests.
+Active leases finish and close on return. Closing does not wait for or cancel them.
+Use `with Client(...)` / `async with AsyncClient(...)`; async close is `aclose()`.
+
+## Responses and errors
+
+Frozen `Response(url, status, headers, body)` owns immutable bytes and ordered
+header pairs, retaining duplicate response headers. `header(name)` selects the
+first; `headers_all(name)` returns all. `text` / `decode(encoding=None,
+errors='strict')` uses a declared charset or UTF-8, without sniffing. `json()`
+requires UTF-8 finite JSON and rejects duplicate object members. JSON/status errors
+retain no connection lease. Response content type is data; JSON parsing is explicit.
+
+Response framing accepts a valid Content-Length or exactly chunked transfer
+encoding, rejects conflicting/invalid lengths, TE+CL ambiguity and unsupported TE,
+and detects truncated bodies. Header line/count bounds come from `http.client`.
+HEAD/204/304 ignore representation length when checking body limits.
+
+| Error | Meaning |
+| --- | --- |
+| TransportError (OSError) | Connection, TLS, socket or HTTP protocol failure; chained original error |
+| TransportTimeoutError (also TimeoutError) | Socket operation timed out |
+| PoolTimeoutError (TimeoutError) | Lease wait expired; no request was sent |
+| ClientClosedError (RuntimeError) | No new request/lease is accepted |
+| RequestLimitError / ResponseLimitError (ValueError) | Selected byte bound exceeded |
+| RedirectError / ContentEncodingError (ValueError) | Selected redirect/encoding policy failed |
+| HTTPStatusError (RuntimeError) | Explicit raise_for_status rejected 4xx/5xx; `.response` preserved |
+| TypeError / ValueError | Invalid input, framing or JSON; no implicit correction |
+
+Transport failure or await cancellation can occur after a mutation reached the
+server. Applications must reconcile state before any explicit retry.

requ-0.1.0/examples/local_http.py

@@ -0,0 +1,36 @@
+"""Run a complete request without contacting an external service."""
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import threading
+from requ import Client
+
+
+class Handler(BaseHTTPRequestHandler):
+    def log_message(self, *args):
+        pass
+
+    def do_POST(self):
+        body = self.rfile.read(int(self.headers['Content-Length']))
+        self.send_response(200)
+        self.send_header('Content-Type', 'application/json')
+        self.send_header('Content-Length', str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+
+def main():
+    with ThreadingHTTPServer(('127.0.0.1', 0), Handler) as server:
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        try:
+            with Client() as client:
+                response = client.post(f'http://127.0.0.1:{server.server_port}/', json={'name': 'Ash'})
+                response.raise_for_status()
+                assert response.json() == {'name': 'Ash'}
+                print(response.json())
+        finally:
+            server.shutdown()
+            thread.join()
+
+
+if __name__ == '__main__':
+    main()

requ-0.1.0/pyproject.toml

@@ -0,0 +1,41 @@
+[project]
+name = "requ"
+version = "0.1.0"
+description = "Bounded HTTP(S) requests with client-owned connection pooling"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.14"
+dependencies = []
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.14",
+    "Typing :: Typed",
+]
+
+[[project.authors]]
+name = "ellainng"
+email = "299958882+ellainng@users.noreply.github.com"
+
+[project.urls]
+Homepage = "https://github.com/wispsy/requ"
+Repository = "https://github.com/wispsy/requ"
+Issues = "https://github.com/wispsy/requ/issues"
+
+[build-system]
+requires = ["uv_build>=0.13.6,<0.14.0"]
+build-backend = "uv_build"
+
+[tool.uv.build-backend]
+source-include = [
+    "tests/**",
+    "docs/**",
+    "scripts/**",
+    "examples/**",
+    "LICENSE",
+    "README.md",
+    "CHANGELOG.md",
+]

requ-0.1.0/pyproject.toml.orig

@@ -0,0 +1,32 @@
+[project]
+name = "requ"
+version = "0.1.0"
+description = "Bounded HTTP(S) requests with client-owned connection pooling"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [
+    { name = "ellainng", email = "299958882+ellainng@users.noreply.github.com" }
+]
+requires-python = ">=3.14"
+dependencies = []
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.14",
+    "Typing :: Typed",
+]
+
+[project.urls]
+Homepage = "https://github.com/wispsy/requ"
+Repository = "https://github.com/wispsy/requ"
+Issues = "https://github.com/wispsy/requ/issues"
+
+[build-system]
+requires = ["uv_build>=0.13.6,<0.14.0"]
+build-backend = "uv_build"
+
+[tool.uv.build-backend]
+source-include = ["tests/**", "docs/**", "scripts/**", "examples/**", "LICENSE", "README.md", "CHANGELOG.md"]

requ-0.1.0/scripts/check_distribution.py

@@ -0,0 +1,213 @@
+"""Build and verify exact distributions and independent installs."""
+
+import argparse
+import base64
+import csv
+from email.parser import BytesParser
+from email.policy import default
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tarfile
+import tempfile
+import tomllib
+import venv
+import zipfile
+
+PACKAGE_FILES = {'requ/__init__.py', 'requ/_pool.py', 'requ/py.typed'}
+TEST_FILES = {'test_requ.py', 'test_transport.py', 'test_async.py'}
+TEST_DATA_FILES = set()
+EXAMPLE_FILES = {'local_http.py'}
+DIAGNOSTIC_FILES = set()
+SOURCE_FILES = ({'README.md', 'LICENSE', 'CHANGELOG.md', 'docs/api.md',
+                 'scripts/check_distribution.py'}
+                | {f'src/{name}' for name in PACKAGE_FILES}
+                | {f'tests/{name}' for name in TEST_FILES}
+                | {f'examples/{name}' for name in EXAMPLE_FILES})
+
+
+def require(condition: bool, message: str) -> None:
+    if not condition:
+        raise RuntimeError(message)
+
+
+def run(args: list[str], *, cwd: Path, capture: bool = False) -> str:
+    env = os.environ.copy()
+    env.pop('PYTHONPATH', None)
+    env.pop('VIRTUAL_ENV', None)
+    result = subprocess.run(args, cwd=cwd, env=env, text=True, check=True,
+                            stdout=subprocess.PIPE if capture else None)
+    return result.stdout if capture else ''
+
+
+def wheel_files(path: Path) -> dict[str, bytes]:
+    with zipfile.ZipFile(path) as archive:
+        entries = [entry for entry in archive.infolist() if not entry.is_dir()]
+        names = [entry.filename for entry in entries]
+        require(len(names) == len(set(names)), 'duplicate wheel entries')
+        return {name: archive.read(name) for name in names}
+
+
+def source_files(path: Path, prefix: str) -> dict[str, bytes]:
+    result: dict[str, bytes] = {}
+    with tarfile.open(path, 'r:gz') as archive:
+        for member in archive:
+            require(not member.issym() and not member.islnk(), 'links are forbidden in sdist')
+            require(member.isdir() or member.isfile(), 'unexpected sdist member type')
+            if member.isdir():
+                continue
+            require(member.name.startswith(prefix + '/'), 'unexpected sdist root')
+            name = member.name.removeprefix(prefix + '/')
+            require(name not in result, 'duplicate sdist member')
+            file = archive.extractfile(member)
+            require(file is not None, 'unreadable sdist member')
+            with file:
+                result[name] = file.read()
+    return result
+
+
+def verify_metadata(data: bytes, readme: bytes, version: str) -> None:
+    metadata = BytesParser(policy=default).parsebytes(data)
+    for key, expected in {'Name': 'requ', 'Version': version,
+                          'Requires-Python': '>=3.14', 'License-Expression': 'MIT',
+                          'Description-Content-Type': 'text/markdown'}.items():
+        require(metadata.get(key) == expected, f'incorrect metadata: {key}')
+    require(not metadata.get_all('Requires-Dist'), 'runtime dependencies must be empty')
+    require(metadata.get_all('License-File') == ['LICENSE'], 'incorrect license metadata')
+    require('Typing :: Typed' in metadata.get_all('Classifier', []), 'missing typing classifier')
+    payload = metadata.get_payload(decode=True)
+    require(payload is not None, 'README metadata payload is missing')
+    require(payload.decode('utf-8').strip() == readme.decode('utf-8').strip(), 'README metadata differs')
+
+
+def verify_record(files: dict[str, bytes], dist_info: str) -> None:
+    record = f'{dist_info}/RECORD'
+    rows = list(csv.reader(io.StringIO(files[record].decode())))
+    require(len(rows) == len(files), 'RECORD file count differs')
+    require(len({row[0] for row in rows}) == len(rows), 'duplicate RECORD paths')
+    require({row[0] for row in rows} == set(files), 'RECORD paths differ')
+    for name, digest, size in rows:
+        if name == record:
+            require(digest == size == '', 'RECORD must not hash itself')
+            continue
+        expected = base64.urlsafe_b64encode(hashlib.sha256(files[name]).digest()).rstrip(b'=').decode()
+        require(digest == f'sha256={expected}', f'RECORD digest differs: {name}')
+        require(size == str(len(files[name])), f'RECORD size differs: {name}')
+
+
+def verify_install(artifact: Path, sandbox: Path, root: Path, version: str) -> None:
+    sandbox.mkdir()
+    environment = sandbox / 'environment'
+    venv.EnvBuilder(with_pip=False).create(environment)
+    python = environment / ('Scripts/python.exe' if os.name == 'nt' else 'bin/python')
+    # Source installation may resolve only the already-declared build backend.
+    args = ['uv', 'pip', 'install', '--python', str(python), '--no-deps']
+    if artifact.suffix == '.whl':
+        args.append('--no-index')
+    run([*args, str(artifact)], cwd=sandbox)
+    probe = (
+        'import requ, importlib.metadata, json; '
+        'print(json.dumps({"file": requ.__file__, "version": requ.__version__, '
+        '"metadata": importlib.metadata.version("requ"), '
+        '"requirements": importlib.metadata.requires("requ")}))'
+    )
+    installed = json.loads(run([str(python), '-I', '-c', probe], cwd=sandbox, capture=True))
+    require(Path(installed['file']).resolve().is_relative_to(environment.resolve()),
+            'package imported from outside its isolated environment')
+    require(installed['version'] == installed['metadata'] == version, 'installed version differs')
+    require(installed['requirements'] in (None, []), 'installed runtime requirements are nonempty')
+    tests, examples = sandbox / 'tests', sandbox / 'examples'
+    tests.mkdir()
+    examples.mkdir()
+    for name in TEST_FILES:
+        shutil.copyfile(root / 'tests' / name, tests / name)
+    for name in TEST_DATA_FILES:
+        target = tests / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(root / 'tests' / name, target)
+    for name in EXAMPLE_FILES:
+        shutil.copyfile(root / 'examples' / name, examples / name)
+    scripts = sandbox / 'scripts'
+    scripts.mkdir()
+    for name in DIAGNOSTIC_FILES | {'check_distribution.py'}:
+        shutil.copyfile(root / 'scripts' / name, scripts / name)
+    run([str(python), '-I', '-W', 'error::ResourceWarning', '-m', 'unittest',
+         'discover', '-s', str(tests), '-v'], cwd=sandbox)
+    for name in sorted(EXAMPLE_FILES):
+        run([str(python), '-I', str(examples / name)], cwd=sandbox)
+    print(f'Independent install passed: {artifact.name}', flush=True)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--tag', default='')
+    parser.add_argument('--output-dir', type=Path, default=Path('dist'))
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parents[1]
+    config = tomllib.loads((root / 'pyproject.toml').read_text())
+    version = config['project']['version']
+    require(not args.tag or args.tag == f'v{version}',
+            'release tag must match the package version')
+    require(config['project']['dependencies'] == [], 'runtime dependencies must be empty')
+    output = args.output_dir.resolve()
+    output.mkdir(parents=True, exist_ok=True)
+    wheel = output / f'requ-{version}-py3-none-any.whl'
+    source = output / f'requ-{version}.tar.gz'
+    require({path.name for path in output.iterdir()} <= {wheel.name, source.name, '.gitignore'},
+            'output directory contains unexpected files; use an empty build directory')
+    run(['uv', 'build', '--sdist', '--wheel', '--no-create-gitignore',
+         '--out-dir', str(output), str(root)], cwd=root)
+    require(wheel.is_file() and source.is_file(), 'expected distributions were not built')
+    files = wheel_files(wheel)
+    dist_info = f'requ-{version}.dist-info'
+    expected_wheel = PACKAGE_FILES | {f'{dist_info}/{name}' for name in
+                                      ('METADATA', 'WHEEL', 'RECORD', 'licenses/LICENSE')}
+    require(set(files) == expected_wheel, f'wheel allowlist differs: {set(files) ^ expected_wheel}')
+    for name in PACKAGE_FILES:
+        require(files[name] == (root / 'src' / name).read_bytes(), f'wheel source differs: {name}')
+    require(files[f'{dist_info}/licenses/LICENSE'] == (root / 'LICENSE').read_bytes(), 'wheel license differs')
+    wheel_metadata = BytesParser(policy=default).parsebytes(files[f'{dist_info}/WHEEL'])
+    require(wheel_metadata.get('Root-Is-Purelib') == 'true', 'wheel must be pure Python')
+    require(wheel_metadata.get_all('Tag') == ['py3-none-any'], 'unexpected wheel tag')
+    verify_metadata(files[f'{dist_info}/METADATA'], (root / 'README.md').read_bytes(), version)
+    verify_record(files, dist_info)
+    archived = source_files(source, f'requ-{version}')
+    expected_source = SOURCE_FILES | {'PKG-INFO', 'pyproject.toml', 'pyproject.toml.orig'}
+    require(set(archived) == expected_source, f'sdist allowlist differs: {set(archived) ^ expected_source}')
+    for name in SOURCE_FILES:
+        require(archived[name] == (root / name).read_bytes(), f'sdist source differs: {name}')
+    require(archived['pyproject.toml.orig'] == (root / 'pyproject.toml').read_bytes(), 'original configuration differs')
+    require(tomllib.loads(archived['pyproject.toml'].decode()) == config, 'sdist configuration semantics differ')
+    require(archived['PKG-INFO'] == files[f'{dist_info}/METADATA'], 'sdist and wheel metadata differ')
+    with tempfile.TemporaryDirectory(prefix='requ-distributions-') as temporary:
+        sandbox = Path(temporary)
+        rebuild = sandbox / 'rebuild'
+        run(['uv', 'build', '--wheel', '--no-create-gitignore', '--out-dir', str(rebuild), str(source)], cwd=sandbox)
+        rebuilt = wheel_files(rebuild / wheel.name)
+        require(set(rebuilt) == expected_wheel, 'source rebuild allowlist differs')
+        build_headers = {f'{dist_info}/WHEEL', f'{dist_info}/RECORD'}
+        require({name: data for name, data in rebuilt.items() if name not in build_headers}
+                == {name: data for name, data in files.items() if name not in build_headers},
+                'source rebuild package, license or metadata bytes differ')
+        rebuilt_metadata = BytesParser(policy=default).parsebytes(rebuilt[f'{dist_info}/WHEEL'])
+        # The declared backend range can resolve a newer uv_build than the
+        # invoking uv binary. Only the build-tool Generator header may differ.
+        require([(key, value) for key, value in rebuilt_metadata.items() if key != 'Generator']
+                == [(key, value) for key, value in wheel_metadata.items() if key != 'Generator'],
+                'source rebuild wheel compatibility metadata differs')
+        require(len(rebuilt_metadata.get_all('Generator', [])) == 1, 'missing build generator')
+        verify_record(rebuilt, dist_info)
+        verify_install(wheel, sandbox / 'wheel-install', root, version)
+        verify_install(source, sandbox / 'source-install', root, version)
+    print('Exact archives, metadata, RECORD, rebuild parity, installed tests and examples passed.')
+    for artifact in (wheel, source):
+        print(f'{hashlib.sha256(artifact.read_bytes()).hexdigest()}  {artifact.name}')
+
+
+if __name__ == '__main__':
+    main()