solvapay-python 0.9.0__py3-none-any.whl → 0.9.2__py3-none-any.whl

solvapay/__init__.py

@@ -37,7 +37,7 @@ from solvapay.exceptions import (
 )
 from solvapay.models import BalanceResponse, Merchant, Plan, PlatformConfig, Product
 from solvapay.paywall import PaywallRequired
-from solvapay.webhooks import verify_webhook
+from solvapay.webhooks import sign_webhook, verify_webhook
 
 # Register stable exports in MANIFEST (HLD V1.2).
 # stable(X) returns X unchanged — isinstance() continues to work (HLD SM1).
@@ -54,6 +54,7 @@ stable(APIServerError)
 stable(APIConnectionError)
 stable(APITimeoutError)
 stable(PaywallRequired)
+stable(sign_webhook)
 stable(verify_webhook)
 stable(BalanceResponse)
 stable(Product)
@@ -99,10 +100,36 @@ __all__ = [
     "SolvaPayAPIError",
     "SolvaPayError",
     "WebhookEvent",
+    # adapters exposed lazily via __getattr__ below (PEP 562)
+    "adapters",
     "deprecated",
     "experimental",
     "paywall",
+    "sign_webhook",
     "stable",
     "verify_webhook",
 ]
-__version__ = "0.9.0"
+__version__ = "0.9.2"
+
+# PEP 562 — lazy adapter submodule access.
+# Adapters drag in optional heavy deps (fastmcp, langchain-core, fastapi).
+# __getattr__ defers their load until first access; they never load on bare
+# `import solvapay` for users who don't use framework adapters.
+_LAZY_MODULES = {
+    "adapters": "solvapay.adapters",
+}
+
+
+def __getattr__(name: str) -> object:
+    if name in _LAZY_MODULES:
+        import importlib
+
+        mod = importlib.import_module(_LAZY_MODULES[name])
+        globals()[name] = mod
+        return mod
+    raise AttributeError(f"module 'solvapay' has no attribute {name!r}")
+
+
+def __dir__() -> list[str]:
+    # PEP 562: include lazy names alongside normal module attrs.
+    return sorted(set(globals()) | set(_LAZY_MODULES))

{solvapay_python-0.9.0.dist-info → solvapay_python-0.9.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: solvapay-python
-Version: 0.9.0
+Version: 0.9.2
 Summary: Community Python SDK for SolvaPay (agent-native payment rails)
 Project-URL: Homepage, https://github.com/dhruv-sanan/solvapay-python
 Project-URL: Issues, https://github.com/dhruv-sanan/solvapay-python/issues
@@ -21,15 +21,17 @@ Classifier: Topic :: Office/Business :: Financial
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
-Requires-Dist: httpx>=0.27
-Requires-Dist: pydantic<2.13,>=2.6
+Requires-Dist: httpx<0.29,>=0.27
+Requires-Dist: pydantic<2.14,>=2.6
 Provides-Extra: asgi
+Provides-Extra: bench
+Requires-Dist: pytest-benchmark<6,>=4.0; extra == 'bench'
 Provides-Extra: fastapi
 Requires-Dist: fastapi>=0.110; extra == 'fastapi'
 Provides-Extra: langchain
-Requires-Dist: langchain-core<0.4,>=0.3; extra == 'langchain'
+Requires-Dist: langchain-core<1.5,>=0.3; extra == 'langchain'
 Provides-Extra: mcp
-Requires-Dist: fastmcp<0.5,>=0.4; extra == 'mcp'
+Requires-Dist: fastmcp<4,>=3.2.0; extra == 'mcp'
 Provides-Extra: retry
 Requires-Dist: tenacity<10,>=8.2; extra == 'retry'
 Description-Content-Type: text/markdown
@@ -138,16 +140,23 @@ if limits.within_limits:
 
 ## Idempotency
 
-All mutating ops accept `idempotency_key`. Use `solvapay.idempotency.from_payload` to derive deterministic keys from request content:
+All mutating ops accept `idempotency_key`. Use `solvapay.idempotency.from_payload` to derive deterministic keys:
 
 ```python
 from solvapay.idempotency import from_payload
 
+# Default: key includes UTC date — rolls at midnight, bounds replay past server TTL
 key = from_payload("track_usage", customer_ref, product_ref, "requests", units)
 sv.usage.track(..., idempotency_key=key)   # retry-safe
+
+# Hourly bucket (high-frequency ops)
+key = from_payload("charge", customer_ref, time_bucket="hour")
+
+# Pure payload hash — caller manages TTL externally
+key = from_payload("idempotent_op", ref, time_bucket=None)
 ```
 
-Retried POSTs **must reuse the same key**. Key should change only when the logical request changes.
+Retried POSTs **must reuse the same key**. A bucket roll (midnight / hour boundary) produces a new key — the server treats it as a new request.
 
 ---
 
@@ -174,7 +183,7 @@ except SolvaPayError as e:
     ...  # catch-all
 ```
 
-No built-in retries by design. Layer `tenacity` manually. `solvapay[retry]` RetryTransport ships in v0.9.
+No built-in retries by default. `solvapay[retry]` ships `RetryTransport` — exponential backoff with jitter, 3 attempts, respects `OpSpec.retry_safety` (won't retry non-idempotent ops without an idempotency key). Or layer `tenacity` manually.
 
 ---
 
@@ -193,6 +202,30 @@ pipeline = WebhookPipeline(
 envelope = pipeline.process(body=request.body, signature=request.headers["sv-signature"])
 ```
 
+**Secret rotation** — pass multiple secrets; primary tried first, secondary on mismatch:
+
+```python
+pipeline = WebhookPipeline(["whsec_new...", "whsec_old..."])
+```
+
+**Sign a webhook** (testing / outbound fanout) — available at the top level since v0.9.2:
+
+```python
+from solvapay import sign_webhook          # top-level (v0.9.2+)
+# from solvapay.webhooks import sign_webhook  # subpackage path also works
+
+header = sign_webhook(body=b'{"type":"purchase.created"}', secret="whsec_...")
+# → "t=1716470000,v1=abc123..."
+```
+
+**ASGI adapter** — mount directly in FastAPI / Starlette / Litestar:
+
+```python
+from solvapay.adapters.asgi import webhook_app
+
+app.mount("/webhook", webhook_app(pipeline, on_event=handle))
+```
+
 **Typed events** — discriminated union over 13 event types:
 
 ```python
@@ -279,6 +312,9 @@ pip install solvapay-python                   # core
 pip install 'solvapay-python[mcp]'            # + FastMCP adapter (FastMCP ≥0.4)
 pip install 'solvapay-python[langchain]'      # + LangChain adapter (langchain-core ≥0.3)
 pip install 'solvapay-python[fastapi]'        # + FastAPI webhook router
+pip install 'solvapay-python[asgi]'           # + raw ASGI webhook adapter (no extra deps)
+pip install 'solvapay-python[retry]'          # + RetryTransport (tenacity)
+pip install 'solvapay-python[bench]'          # + pytest-benchmark (dev/perf testing)
 ```
 
 ## Environment variables
@@ -302,17 +338,43 @@ pip install 'solvapay-python[fastapi]'        # + FastAPI webhook router
 
 ---
 
+## API version pinning
+
+Pin the API version your code was written against — prevents silent breakage when the server evolves:
+
+```python
+sv = SolvaPay(api_version="2026-05-22")   # sends Solvapay-Version header
+sv = SolvaPay(api_version=None)            # omit header (use server default)
+```
+
+Default is `"2026-05-22"` (v0.9 ship date). Bump only on major SDK versions.
+
+---
+
 ## Roadmap
 
 | Version | Theme |
 |---------|-------|
 | v0.8 ✅ | V1 architecture spine — Transport kernel, OpSpec registry, paywall/webhook packages, `@payable_tool`, stability manifest, layer DAG CI gate |
-| v0.9 | Production polish — API-version pinning, idempotency TTL, `RetryTransport`, `RecordingTransport`, contract tests, lint automation, doc site (MkDocs Material), supply-chain hygiene |
-| v1.0 | Gated on founder signal — OpenAPI-generated models, full secret rotation, production hardening |
+| v0.9 ✅ | Production polish — API-version pinning, idempotency TTL, `RetryTransport`, `RecordingTransport`, ASGI adapter, secret rotation, `sign_webhook`, contract tests, lint automation, MkDocs site, supply-chain hygiene |
+| v0.9.1 ✅ | Security & supply-chain quality — PyPI attestations (PEP 740 / Sigstore), CycloneDX SBOM on releases, `bandit` + `osv-scanner` CI, Hypothesis-driven secret-redaction property tests, constant-time `verify_webhook` smoke test, explicit PCI-scope statement |
+| v0.9.2 ✅ | Performance & stability quality — cold-import baseline harness, PEP 562 lazy adapter imports, `solvapay.sign_webhook` top-level re-export, microbenchmark harness (`solvapay[bench]`), troubleshooting docs |
+| v1.0 | Gated on founder signal — OpenAPI-generated models, WSGI/Lambda adapters, V2 planning |
 
 ---
 
 ## Status
 
-**v0.8.0** — V1 architecture spine + AI-agent moat. `mypy --strict` clean (43 files). 261 tests. 89% line coverage.  
+**v0.9.2** — Performance & stability quality patch. Cold-import baseline harness (`tests/test_cold_import.py`, 1.5x regression gate). PEP 562 lazy adapter imports — bare `import solvapay` no longer loads framework adapter modules. `solvapay.sign_webhook` promoted to top-level (alongside `verify_webhook`). Microbenchmark harness under `tests/benchmarks/` (opt-in `solvapay[bench]`). New docs: `docs/troubleshooting.md` (top-10 errors) and `docs/architecture/cold-start.md`. 305 tests. 87% line coverage. `mypy --strict` clean (45 files).
+
+**v0.9.1** — Security & supply-chain quality patch. PyPI uploads now carry PEP 740 attestations (Sigstore-backed via OIDC trusted publishing); each GitHub release ships a CycloneDX SBOM (`sbom.cdx.json`). `mypy --strict` clean (45 files). 302 tests. 87% line / 85% branch coverage.
+
+**Supply chain & security posture:**
+- PyPI trusted publishing with PEP 740 attestations (Sigstore)
+- CycloneDX 1.6 SBOM attached to every release
+- CI runs `bandit -r src/ -lll`, `osv-scanner --lockfile=uv.lock`, and `pip-audit` (cross-DB vuln check) on PR and nightly cron
+- Constant-time HMAC comparison (`hmac.compare_digest`) regression-smoked
+- Hypothesis-driven property tests assert no API key, hex token, or webhook secret leaks into log output at any level
+- Tightened upper bounds on volatile deps (`httpx<0.29`, `pydantic<2.14`, `langchain-core<1.5`)
+
 Community SDK, not official. Proposal: [solvapay/solvapay-sdk#187](https://github.com/solvapay/solvapay-sdk/issues/187).

{solvapay_python-0.9.0.dist-info → solvapay_python-0.9.2.dist-info}/RECORD

@@ -1,4 +1,4 @@
-solvapay/__init__.py,sha256=2_muEPRVjPE7yZApCj83y2hQviJ6OUHdaKwWjje-QOw,2610
+solvapay/__init__.py,sha256=SCzaOP-4tqWo90KW1d_L6YpDACNQqahD85iHeRa3X9w,3488
 solvapay/_async_client.py,sha256=TdeCyvnfZQCJzkLnYC73WNEG_fYjKWb226Gct1wt7pI,10759
 solvapay/_config.py,sha256=yPU_GM77pXwPfIzuncuLRNv4322q5bB9qaawN3izEB8,606
 solvapay/_http.py,sha256=rtjU-MOmxsh3xO-HT7KtjYaTUagPlPqV5eBv-o51Y1Q,408
@@ -44,7 +44,7 @@ solvapay/webhooks/replay.py,sha256=DIv52mCwi1GRtAl7q_O_JWuFSJQMwcQ24JkOuD1uLmU,2
 solvapay/webhooks/rotation.py,sha256=qYNMBBSp6Zvg59gPc2SUC1cqNIAizrBJ50MRf5B_ztg,1248
 solvapay/webhooks/sign.py,sha256=X7rA0iZkDBsXo3nvxK8YnQ-zpLfMhCMY-r6ts_MUM90,1150
 solvapay/webhooks/verify.py,sha256=TIkho3IG-S9IpXWvBLmDHdGfG9_XxUK6w87kNwkLQYo,1954
-solvapay_python-0.9.0.dist-info/METADATA,sha256=HKW0WzV46vAPLNe6BItN9of81caqnEkREEUZHMWK6q8,10006
-solvapay_python-0.9.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-solvapay_python-0.9.0.dist-info/licenses/LICENSE,sha256=wJURmEXLdSdApQdHG-RCwBoZVka1Oux8zNrLxGC30S8,1068
-solvapay_python-0.9.0.dist-info/RECORD,,
+solvapay_python-0.9.2.dist-info/METADATA,sha256=pJb_W5Y_kURJU9HPlqoFUwlVX_Lt0lGd5JyVGTcDafk,13711
+solvapay_python-0.9.2.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+solvapay_python-0.9.2.dist-info/licenses/LICENSE,sha256=wJURmEXLdSdApQdHG-RCwBoZVka1Oux8zNrLxGC30S8,1068
+solvapay_python-0.9.2.dist-info/RECORD,,

{solvapay_python-0.9.0.dist-info → solvapay_python-0.9.2.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.29.0
+Generator: hatchling 1.30.1
 Root-Is-Purelib: true
 Tag: py3-none-any