ssc-app 0.0.3__py3-none-any.whl

ssc_app/__init__.py

@@ -0,0 +1,5 @@
+"""Tiny helper library apps may install to read the identity note (``ssc_app.identity``)."""
+
+from ssc_app.identity import IdentityRefused, IdentityVerifier, verify
+
+__all__ = ["IdentityRefused", "IdentityVerifier", "verify"]

ssc_app/data.py

@@ -0,0 +1,230 @@
+"""Read a database the org connected, through the cell's data gateway (SSC-052). Name the connection
+in ``[connections] names`` in ``ssc.toml``; an admin grants the environment the connection. For
+a ``postgres`` connection:
+
+    from ssc_app import data
+
+    result = data.query("finance", "select id, total from invoices where year = $1", [2026])
+    for row in result.rows:       # each row is a list in column order
+        ...
+
+The call carries the app's own workload token (``ssc_app.workload``), so the app holds no database
+credentials. The statement is one read, and nothing can write. Its form follows the connection's
+kind: one ``SELECT`` for ``postgres`` (``$1``, ``$2``, ... placeholders) and for ``mysql``,
+``sqlserver``, ``bigquery`` and ``snowflake`` (``?`` placeholders); and, with no parameters, an A1
+range for ``gsheets``, ``list <prefix>`` or ``get <key>`` for ``s3`` and ``gcs``,
+``<table>[ view <view>][ where <formula>]`` for ``airtable`` and a GET path for ``rest``.
+``max_rows``, ``max_bytes`` and ``timeout_ms`` only narrow what the platform, the connection and the
+grant allow, and ``truncated`` says the gateway stopped reading before the result ended. To act for
+the signed-in user, pass the ``X-SSC-Identity`` value of the request being answered as
+``identity``; without it the app acts for itself (``docs/contracts/data-gateway.md``).
+
+``data.describe("finance")`` names the tables of a granted connection and their typed columns
+(GA-5.8): a ``Schema`` of ``Table`` s, each ``{name, type, db_type}`` column as a query types it,
+none for a file not yet read. The data gateway keeps a description five minutes.
+
+The data gateway's address comes from the metadata server, as for ``ssc_app.files``, and
+``SSC_DATAGW_URL`` or ``url=`` replaces it. A query only reads, so it is tried once more when the
+data gateway cannot be reached or answers 502, 503 or 504; a query that timed out is not. Same
+names and behaviour as the Node helper ``@delimitus/ssc-data``, which has no ``describe`` yet.
+"""
+
+import json
+import os
+import threading
+import urllib.error
+import urllib.request
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from typing import Any, Final
+
+from ssc_app.files import RETRY_STATUSES, URL_VARIABLE, FilesError, gateway_url
+from ssc_app.workload import METADATA, WorkloadToken
+
+QUERY_TIMEOUT_SECONDS: Final = 60.0
+"""Longer than the data gateway's 30 s query limit plus its start from zero."""
+IDENTITY_HEADER: Final = "x-ssc-identity"
+
+
+class DataError(RuntimeError):
+    """A refusal or a failure. ``code`` is the data gateway's (``CONNECTION_NOT_GRANTED``,
+    ``CONNECTION_SUSPENDED``, ``QUERY_REFUSED``, ``QUERY_FAILED``, ``DAILY_BUDGET_SPENT``, ...) or
+    ``UNREACHABLE``; ``sqlstate`` is the database's for ``QUERY_FAILED`` when it gave one."""
+
+    def __init__(
+        self, code: str, message: str, status: int | None = None, sqlstate: str | None = None
+    ) -> None:
+        super().__init__(f"{code}: {message}")
+        self.code = code
+        self.status = status
+        self.sqlstate = sqlstate
+
+
+@dataclass(frozen=True, slots=True)
+class QueryResult:
+    """What a query returned. ``columns`` are ``{name, type, db_type}``; a decimal is a string,
+    a timestamp is ISO 8601, bytes are base64."""
+
+    columns: list[dict[str, str]]
+    rows: list[list[Any]]
+    row_count: int
+    truncated: bool
+    truncated_reason: str | None
+    request_id: str
+
+
+@dataclass(frozen=True, slots=True)
+class Table:
+    """One table of a connection as its reads name it. ``columns`` are ``{name, type,
+    db_type}``, typed as a query types them; none when only a read can tell (a file)."""
+
+    name: str
+    columns: list[dict[str, str]]
+
+
+@dataclass(frozen=True, slots=True)
+class Schema:
+    """What ``describe`` returned: the connection's name, its kind and its tables."""
+
+    connection: str
+    kind: str
+    tables: list[Table]
+
+
+def _send(url: str, headers: Mapping[str, str], body: bytes | None) -> tuple[int, bytes]:
+    """POST ``body``, or GET when it is None."""
+    method = "GET" if body is None else "POST"
+    request = urllib.request.Request(url, data=body, method=method, headers=dict(headers))  # noqa: S310
+    try:
+        with urllib.request.urlopen(request, timeout=QUERY_TIMEOUT_SECONDS) as response:  # noqa: S310
+            return response.status, response.read()
+    except urllib.error.HTTPError as exc:
+        return exc.code, exc.read()
+
+
+def _refusal(status: int, raw: bytes) -> DataError:
+    try:
+        error = json.loads(raw)["error"]
+        return DataError(str(error["code"]), str(error["message"]), status, error.get("sqlstate"))
+    except (ValueError, KeyError, TypeError):
+        return DataError("UNAVAILABLE", f"the data gateway answered HTTP {status}", status)
+
+
+class Data:
+    """The data gateway of the cell this app runs in. ``url`` and ``metadata`` replace the data
+    gateway's address and the metadata server's (tests). Safe to share between threads."""
+
+    def __init__(self, *, url: str | None = None, metadata: str = METADATA) -> None:
+        self._url = (url or os.environ.get(URL_VARIABLE) or "").rstrip("/") or None
+        self._metadata = metadata
+        self._tokens: WorkloadToken | None = None
+        self._lock = threading.Lock()
+
+    def query(  # noqa: PLR0913  (keyword-only)
+        self,
+        name: str,
+        sql: str,
+        params: Sequence[Any] = (),
+        *,
+        max_rows: int | None = None,
+        max_bytes: int | None = None,
+        timeout_ms: int | None = None,
+        identity: str | None = None,
+    ) -> QueryResult:
+        """Run one read-only statement on connection ``name``. ``DataError`` for a refusal."""
+        asks = {"max_rows": max_rows, "max_bytes": max_bytes, "timeout_ms": timeout_ms}
+        body: dict[str, Any] = {"sql": sql, "params": list(params)}
+        body.update({k: v for k, v in asks.items() if v is not None})
+        answer = self._ask(f"{name}/query", json.dumps(body).encode(), identity)
+        return QueryResult(
+            columns=answer["columns"],
+            rows=answer["rows"],
+            row_count=answer["row_count"],
+            truncated=answer["truncated"],
+            truncated_reason=answer["truncated_reason"],
+            request_id=answer["request_id"],
+        )
+
+    def describe(self, name: str) -> Schema:
+        """The tables of connection ``name`` and their columns. ``DataError`` for a refusal."""
+        answer = self._ask(f"{name}/schema", None, None)
+        return Schema(
+            connection=answer["connection"],
+            kind=answer["kind"],
+            tables=[Table(name=t["name"], columns=t["columns"]) for t in answer["tables"]],
+        )
+
+    def _ask(self, path: str, body: bytes | None, identity: str | None) -> dict[str, Any]:
+        """The data gateway's answer to ``/v1/connections/<path>``, asked once more while it
+        cannot be reached or starts."""
+        url, tokens = self._target()
+        for attempt in (1, 2):
+            headers = {"authorization": f"Bearer {tokens.get()}"}
+            if body is not None:
+                headers["content-type"] = "application/json"
+            if identity is not None:
+                headers[IDENTITY_HEADER] = identity
+            try:
+                status, raw = _send(f"{url}/v1/connections/{path}", headers, body)
+            except TimeoutError:
+                raise DataError("UNREACHABLE", "data gateway: TimeoutError") from None
+            except (urllib.error.URLError, OSError) as exc:
+                if attempt == 1:
+                    continue
+                raise DataError("UNREACHABLE", f"data gateway: {type(exc).__name__}") from None
+            if status in RETRY_STATUSES and attempt == 1:
+                continue
+            if status != 200:  # noqa: PLR2004
+                raise _refusal(status, raw)
+            return json.loads(raw)
+        raise AssertionError
+
+    def _target(self) -> tuple[str, WorkloadToken]:
+        with self._lock:
+            if self._url is None:
+                try:
+                    self._url = gateway_url(self._metadata)
+                except FilesError as exc:
+                    raise DataError(exc.code, str(exc).partition(": ")[2]) from None
+            if self._tokens is None:
+                self._tokens = WorkloadToken(audience=self._url, metadata=self._metadata)
+            return self._url, self._tokens
+
+
+_default: Data | None = None
+_default_lock = threading.Lock()
+
+
+def query(  # noqa: PLR0913  (keyword-only)
+    name: str,
+    sql: str,
+    params: Sequence[Any] = (),
+    *,
+    max_rows: int | None = None,
+    max_bytes: int | None = None,
+    timeout_ms: int | None = None,
+    identity: str | None = None,
+) -> QueryResult:
+    """``Data.query`` on this app's cell."""
+    return _data().query(
+        name,
+        sql,
+        params,
+        max_rows=max_rows,
+        max_bytes=max_bytes,
+        timeout_ms=timeout_ms,
+        identity=identity,
+    )
+
+
+def describe(name: str) -> Schema:
+    """``Data.describe`` on this app's cell."""
+    return _data().describe(name)
+
+
+def _data() -> Data:
+    global _default  # noqa: PLW0603
+    with _default_lock:
+        if _default is None:
+            _default = Data()
+        return _default

ssc_app/files.py

@@ -0,0 +1,194 @@
+"""Keep files through the cell's file broker (SSC-046). Ask for it with ``[files]`` in
+``ssc.toml``.
+
+    from ssc_app import files
+
+    files.put("photos/cat.png", data, content_type="image/png")
+    data = files.get("photos/cat.png")
+    url = files.link("get", "photos/cat.png")["url"]   # send a browser there to download
+    files.delete("photos/cat.png")
+
+Each call asks the data gateway for a signed link with the app's own workload token
+(``ssc_app.workload``), then sends the bytes to Cloud Storage with it; the app holds no storage
+credentials. A file is at most 25 MB, a name is ``/``-separated segments of letters, digits,
+``.``, ``_`` and ``-``, and a download always arrives as an attachment, never rendered as a page
+(``docs/contracts/data-gateway.md#files``).
+
+The data gateway's address comes from the metadata server: Cloud Run's ``instance/region``
+names the project number and the region, and the gateway is ``ssc-datagw`` there.
+``SSC_DATAGW_URL`` or ``url=`` replaces it. The data gateway runs from zero, so a call to it is
+tried once more when it cannot be reached, times out, or answers 502, 503 or 504. Same names and
+behaviour as the Node helper ``@delimitus/ssc-files``.
+"""
+
+import json
+import os
+import threading
+import urllib.error
+import urllib.request
+from collections.abc import Mapping
+from typing import Any, Final, Literal
+
+from ssc_app.workload import METADATA, TIMEOUT_SECONDS, WorkloadToken
+
+SERVICE: Final = "ssc-datagw"
+REGION_PATH: Final = "/computeMetadata/v1/instance/region"
+URL_VARIABLE: Final = "SSC_DATAGW_URL"
+GATEWAY_TIMEOUT_SECONDS: Final = 30.0
+"""Long enough for the data gateway to start from zero."""
+TRANSFER_TIMEOUT_SECONDS: Final = 120.0
+RETRY_STATUSES: Final = frozenset({502, 503, 504})
+DEFAULT_CONTENT_TYPE: Final = "application/octet-stream"
+
+Op = Literal["put", "get", "delete"]
+
+
+class FilesError(RuntimeError):
+    """A refusal or a failure. ``code`` is the data gateway's (``FILE_NOT_FOUND``,
+    ``FILES_QUOTA_EXCEEDED``, ``APP_NOT_ACTIVE``, ...), ``STORAGE_<status>`` when Cloud Storage
+    refused the transfer, or ``UNREACHABLE``."""
+
+    def __init__(self, code: str, message: str, status: int | None = None) -> None:
+        super().__init__(f"{code}: {message}")
+        self.code = code
+        self.status = status
+
+
+def gateway_url(metadata: str = METADATA) -> str:
+    """``https://ssc-datagw-<project number>.<region>.run.app`` of the cell this app runs in."""
+    request = urllib.request.Request(  # noqa: S310
+        f"{metadata}{REGION_PATH}", headers={"Metadata-Flavor": "Google"}
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=TIMEOUT_SECONDS) as response:  # noqa: S310
+            answer = response.read().decode().strip()
+    except (urllib.error.URLError, OSError) as exc:
+        raise FilesError("UNREACHABLE", f"metadata server: {type(exc).__name__}") from None
+    parts = answer.split("/")
+    if len(parts) != 4 or parts[0] != "projects" or parts[2] != "regions":  # noqa: PLR2004
+        raise FilesError("UNREACHABLE", "the metadata server did not name a region")
+    return f"https://{SERVICE}-{parts[1]}.{parts[3]}.run.app"
+
+
+def _send(
+    method: str, url: str, headers: Mapping[str, str], body: bytes | None, timeout: float
+) -> tuple[int, bytes]:
+    request = urllib.request.Request(url, data=body, method=method, headers=dict(headers))  # noqa: S310
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:  # noqa: S310
+            return response.status, response.read()
+    except urllib.error.HTTPError as exc:
+        return exc.code, exc.read()
+
+
+def _refusal(status: int, raw: bytes) -> FilesError:
+    try:
+        error = json.loads(raw)["error"]
+        return FilesError(str(error["code"]), str(error["message"]), status)
+    except (ValueError, KeyError, TypeError):
+        return FilesError("UNAVAILABLE", f"the data gateway answered HTTP {status}", status)
+
+
+class Files:
+    """The file broker of the cell this app runs in. ``url`` and ``metadata`` replace the data
+    gateway's address and the metadata server's (tests). Safe to share between threads."""
+
+    def __init__(self, *, url: str | None = None, metadata: str = METADATA) -> None:
+        self._url = (url or os.environ.get(URL_VARIABLE) or "").rstrip("/") or None
+        self._metadata = metadata
+        self._tokens: WorkloadToken | None = None
+        self._lock = threading.Lock()
+
+    def put(self, name: str, data: bytes, *, content_type: str = DEFAULT_CONTENT_TYPE) -> None:
+        """Store ``data`` as ``name``, replacing a file of that name."""
+        link = self.link("put", name, content_type=content_type)
+        self._transfer(link, data)
+
+    def get(self, name: str) -> bytes:
+        """The bytes of ``name``; ``FilesError`` ``FILE_NOT_FOUND`` when there is none."""
+        return self._transfer(self.link("get", name), None)
+
+    def delete(self, name: str) -> None:
+        """Remove ``name``; ``FilesError`` ``FILE_NOT_FOUND`` when there is none."""
+        self._ask("delete", {"name": name})
+
+    def link(self, op: Literal["put", "get"], name: str, **body: str) -> dict[str, Any]:
+        """The signed link itself: ``url``, ``method``, ``headers`` to send, ``expires_at`` (10
+        minutes), and ``max_bytes`` for ``put``. A ``get`` link suits a browser redirect."""
+        return self._ask(op, {"name": name, **body})
+
+    def _ask(self, op: Op, body: Mapping[str, str]) -> dict[str, Any]:
+        url, tokens = self._target()
+        raw_body = json.dumps(body).encode()
+        for attempt in (1, 2):
+            headers = {
+                "authorization": f"Bearer {tokens.get()}",
+                "content-type": "application/json",
+            }
+            try:
+                status, raw = _send(
+                    "POST", f"{url}/v1/files/{op}", headers, raw_body, GATEWAY_TIMEOUT_SECONDS
+                )
+            except (urllib.error.URLError, OSError) as exc:
+                if attempt == 1:
+                    continue
+                raise FilesError("UNREACHABLE", f"data gateway: {type(exc).__name__}") from None
+            if status in RETRY_STATUSES and attempt == 1:
+                continue
+            if status != 200:  # noqa: PLR2004
+                raise _refusal(status, raw)
+            return json.loads(raw)
+        raise AssertionError
+
+    def _transfer(self, link: Mapping[str, Any], data: bytes | None) -> bytes:
+        try:
+            status, raw = _send(
+                link["method"], link["url"], link["headers"], data, TRANSFER_TIMEOUT_SECONDS
+            )
+        except (urllib.error.URLError, OSError) as exc:
+            raise FilesError("UNREACHABLE", f"Cloud Storage: {type(exc).__name__}") from None
+        if status == 404 and link["method"] == "GET":  # noqa: PLR2004
+            raise FilesError("FILE_NOT_FOUND", "the file is gone", status)
+        if not 200 <= status < 300:  # noqa: PLR2004
+            raise FilesError(f"STORAGE_{status}", "Cloud Storage refused the transfer", status)
+        return raw
+
+    def _target(self) -> tuple[str, WorkloadToken]:
+        with self._lock:
+            if self._url is None:
+                self._url = gateway_url(self._metadata)
+            if self._tokens is None:
+                self._tokens = WorkloadToken(audience=self._url, metadata=self._metadata)
+            return self._url, self._tokens
+
+
+_default: Files | None = None
+_default_lock = threading.Lock()
+
+
+def _files() -> Files:
+    global _default  # noqa: PLW0603
+    with _default_lock:
+        if _default is None:
+            _default = Files()
+        return _default
+
+
+def put(name: str, data: bytes, *, content_type: str = DEFAULT_CONTENT_TYPE) -> None:
+    """``Files.put`` on this app's cell."""
+    _files().put(name, data, content_type=content_type)
+
+
+def get(name: str) -> bytes:
+    """``Files.get`` on this app's cell."""
+    return _files().get(name)
+
+
+def delete(name: str) -> None:
+    """``Files.delete`` on this app's cell."""
+    _files().delete(name)
+
+
+def link(op: Literal["put", "get"], name: str, **body: str) -> dict[str, Any]:
+    """``Files.link`` on this app's cell."""
+    return _files().link(op, name, **body)

ssc_app/identity.py

@@ -0,0 +1,250 @@
+"""Read the identity note the SSC gateway attaches to every request as ``X-SSC-Identity``.
+
+    from ssc_app.identity import IdentityVerifier
+
+    verifier = IdentityVerifier(audience="https://quiet-river-7f3k.delimitusapps.com",
+                                keys="https://keys.delimitus.com/cell-01/jwks.json")
+    note = verifier.from_headers(request.headers)
+    who = note.sub          # key on this
+    label = note.name       # display only
+
+Two rules:
+
+* **Key on ``sub``, never on ``email``.** ``sub`` is a stable ``usr_`` or ``sch_`` id. ``email`` and
+  ``name`` are display strings the company directory can change, and a schedule note has neither.
+* **Verify once, when the request arrives.** Do not re-verify inside a long WebSocket or event
+  stream; the note expires after five minutes and ending open streams is the platform kill
+  switch's job. Re-verifying mid-stream only breaks the stream.
+
+Every refusal is an :class:`IdentityRefused` carrying one code from :data:`REFUSAL_CODES`. Treat
+all of them the same way: the request is not from a signed-in user of this app.
+"""
+
+import base64
+import json
+import time
+from collections.abc import Mapping
+from typing import Any, Final, Literal, cast
+from urllib.parse import unquote_to_bytes
+
+import jwt
+from pydantic import ValidationError
+
+from ssc_app.note import (
+    IDENTITY_ALG,
+    IDENTITY_HEADER,
+    IDENTITY_TYP,
+    MAX_TTL_SECONDS,
+    IdentityNote,
+)
+
+RefusalCode = Literal[
+    "missing",
+    "malformed",
+    "wrong_type",
+    "wrong_algorithm",
+    "unknown_key",
+    "bad_signature",
+    "wrong_audience",
+    "wrong_issuer",
+    "expired",
+    "not_yet_valid",
+    "ttl_too_long",
+    "bad_claims",
+]
+REFUSAL_CODES: Final[frozenset[str]] = frozenset(
+    (
+        "missing",
+        "malformed",
+        "wrong_type",
+        "wrong_algorithm",
+        "unknown_key",
+        "bad_signature",
+        "wrong_audience",
+        "wrong_issuer",
+        "expired",
+        "not_yet_valid",
+        "ttl_too_long",
+        "bad_claims",
+    )
+)
+DEFAULT_LEEWAY_SECONDS: Final = 30
+
+KeySource = Mapping[str, Any] | jwt.PyJWKSet | jwt.PyJWKClient
+
+
+class IdentityRefused(Exception):  # noqa: N818  (public name; refusal, not a bug)
+    """The note was absent or did not verify. ``code`` says why; the message is for logs."""
+
+    code: RefusalCode
+
+    def __init__(self, code: RefusalCode, message: str) -> None:
+        super().__init__(f"{code}: {message}")
+        self.code = code
+
+
+def _signing_key(keys: KeySource, kid: str) -> jwt.PyJWK:
+    try:
+        if isinstance(keys, jwt.PyJWKClient):
+            return keys.get_signing_key(kid)
+        key_set = keys if isinstance(keys, jwt.PyJWKSet) else jwt.PyJWKSet.from_dict(dict(keys))
+        return key_set[kid]
+    except (KeyError, jwt.PyJWKClientError, jwt.PyJWKSetError, jwt.PyJWKError) as e:
+        raise IdentityRefused("unknown_key", f"no key {kid!r} in the JWKS") from e
+
+
+def _int_claim(claims: Mapping[str, Any], name: str) -> int:
+    value = claims.get(name)
+    if isinstance(value, bool) or not isinstance(value, int):
+        raise IdentityRefused("bad_claims", f"{name} is not an integer")
+    return value
+
+
+def verify(  # noqa: PLR0913  (keyword-only)
+    token: str | None,
+    *,
+    audience: str,
+    keys: KeySource,
+    issuer: str | None = None,
+    now: int | None = None,
+    leeway: int = DEFAULT_LEEWAY_SECONDS,
+) -> IdentityNote:
+    """Verify one note and return its claims, or raise :class:`IdentityRefused`.
+
+    ``audience`` is this app's exact origin, ``https://host`` with no path. A note minted for
+    another app is refused with ``wrong_audience`` even though the same cell signed it.
+    ``keys`` is the cell JWKS as a dict, a :class:`jwt.PyJWKSet`, or a :class:`jwt.PyJWKClient`
+    pointed at ``<issuer>/jwks.json``. ``now`` (Unix seconds) is for tests; default is the clock.
+    """
+    if token is None or token == "":
+        raise IdentityRefused("missing", f"no {IDENTITY_HEADER} header")
+    if not isinstance(token, str):  # pyright: ignore[reportUnnecessaryIsInstance]
+        raise IdentityRefused("malformed", "token is not a string")
+    try:
+        header = jwt.get_unverified_header(token)
+    except jwt.DecodeError as e:
+        raise IdentityRefused("malformed", str(e)) from e
+    if header.get("typ") != IDENTITY_TYP:
+        raise IdentityRefused("wrong_type", f"typ is {header.get('typ')!r}, not {IDENTITY_TYP!r}")
+    if header.get("alg") != IDENTITY_ALG:
+        raise IdentityRefused("wrong_algorithm", f"alg is {header.get('alg')!r}")
+    kid = header.get("kid")
+    if not isinstance(kid, str) or not kid:
+        raise IdentityRefused("unknown_key", "no kid in the header")
+    key = _signing_key(keys, kid)
+    try:
+        claims = jwt.decode(
+            token,
+            key,
+            algorithms=[IDENTITY_ALG],
+            options={
+                "verify_signature": True,
+                "verify_exp": False,
+                "verify_iat": False,
+                "verify_nbf": False,
+                "verify_aud": False,
+                "verify_iss": False,
+                "verify_sub": False,
+            },
+        )
+    except jwt.InvalidSignatureError as e:
+        raise IdentityRefused("bad_signature", "signature does not verify") from e
+    except jwt.InvalidAlgorithmError as e:
+        raise IdentityRefused("wrong_algorithm", str(e)) from e
+    except jwt.PyJWTError as e:
+        raise IdentityRefused("malformed", str(e)) from e
+    return check_claims(claims, audience=audience, issuer=issuer, now=now, leeway=leeway)
+
+
+def check_claims(
+    claims: Mapping[str, Any],
+    *,
+    audience: str,
+    issuer: str | None,
+    now: int | None,
+    leeway: int,
+) -> IdentityNote:
+    """The claim checks, after the signature. Split out so the order is readable and testable."""
+    if claims.get("aud") != audience:
+        raise IdentityRefused("wrong_audience", f"note is for {claims.get('aud')!r}")
+    if issuer is not None and claims.get("iss") != issuer:
+        raise IdentityRefused("wrong_issuer", f"note is from {claims.get('iss')!r}")
+    iat = _int_claim(claims, "iat")
+    exp = _int_claim(claims, "exp")
+    if exp - iat > MAX_TTL_SECONDS:
+        raise IdentityRefused("ttl_too_long", f"exp - iat is {exp - iat}s")
+    at = _now() if now is None else now
+    if at >= exp + leeway:
+        raise IdentityRefused("expired", f"expired {at - exp}s ago")
+    if iat > at + leeway:
+        raise IdentityRefused("not_yet_valid", f"issued {iat - at}s in the future")
+    try:
+        return IdentityNote.model_validate(dict(claims))
+    except ValidationError as e:
+        raise IdentityRefused("bad_claims", "; ".join(err["msg"] for err in e.errors())) from e
+
+
+def _now() -> int:
+    return int(time.time())
+
+
+def token_from_headers(headers: Mapping[str, str]) -> str | None:
+    """Pull the note from a request's headers, whatever the case of the header name."""
+    wanted = IDENTITY_HEADER.lower()
+    for name, value in headers.items():
+        if name.lower() == wanted:
+            return value
+    return None
+
+
+def _inline_jwks(url: str) -> dict[str, Any]:
+    header, _, payload = url.removeprefix("data:").partition(",")
+    raw = base64.b64decode(payload) if header.endswith(";base64") else unquote_to_bytes(payload)
+    return cast(dict[str, Any], json.loads(raw))
+
+
+class IdentityVerifier:
+    """One verifier per app process. Holds the audience and the key source.
+
+    ``keys`` is the JWKS URL (``<issuer>/jwks.json``; fetched and cached, refreshed when an
+    unknown ``kid`` shows up during a key rotation), the JWKS inline as a ``data:`` URL (how the
+    platform hands it to an app, which has no internet), or an already loaded JWKS dict.
+    """
+
+    def __init__(
+        self,
+        *,
+        audience: str,
+        keys: str | Mapping[str, Any],
+        issuer: str | None = None,
+        leeway: int = DEFAULT_LEEWAY_SECONDS,
+    ) -> None:
+        self.audience = audience
+        self.issuer = issuer
+        self.leeway = leeway
+        if isinstance(keys, str) and keys.startswith("data:"):
+            keys = _inline_jwks(keys)
+        self._keys: KeySource = (
+            jwt.PyJWKClient(keys, cache_keys=True, lifespan=300)
+            if isinstance(keys, str)
+            else jwt.PyJWKSet.from_dict(dict(keys))
+        )
+
+    def verify(self, token: str | None, *, now: int | None = None) -> IdentityNote:
+        return verify(
+            token,
+            audience=self.audience,
+            keys=self._keys,
+            issuer=self.issuer,
+            now=now,
+            leeway=self.leeway,
+        )
+
+    def from_headers(self, headers: Mapping[str, str], *, now: int | None = None) -> IdentityNote:
+        """Verify the note in ``headers``; ``missing`` when the gateway did not attach one."""
+        return self.verify(token_from_headers(headers), now=now)
+
+
+def refusal_code(error: BaseException) -> str | None:
+    """The code of an :class:`IdentityRefused`, or None for anything else."""
+    return cast(str, error.code) if isinstance(error, IdentityRefused) else None

ssc_app/note.py

@@ -0,0 +1,73 @@
+"""Identity note v1: the claims the gateway signs into ``X-SSC-Identity`` on every request.
+
+This is a public, versioned contract (``docs/contracts/identity-note.md``). It changes by adding
+a new version, never by editing v1. Two rules every consumer must keep:
+
+* Key on ``sub``. It is a ``usr_`` or ``sch_`` id that never changes. ``email`` and ``name`` are
+  display strings that a directory can change at any time, and a note for a schedule carries
+  neither.
+* Verify once per request, when it arrives. Do not re-verify in the middle of a long-lived
+  WebSocket or event stream: the note expires five minutes after issue, and ending open streams
+  is the kill switch's job, not the app's.
+
+Pure data. Signing lives in ``ssc_edge.identity_note`` and verification in ``ssc_app.identity``.
+"""
+
+from typing import Final, Literal, Self
+
+from pydantic import BaseModel, ConfigDict, Field, model_validator
+
+IDENTITY_HEADER: Final = "X-SSC-Identity"
+IDENTITY_TYP: Final = "ssc-id+jwt"
+IDENTITY_ALG: Final = "ES256"
+MAX_TTL_SECONDS: Final = 300
+MAX_GROUPS: Final = 50
+
+Role = Literal["builder", "user", "schedule"]
+EnvironmentName = Literal["prod", "preview"]
+
+_ORIGIN = r"^https://[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+(:[0-9]{1,5})?$"
+_EMAIL = r"^[^@\s]+@[^@\s]+\.[^@\s]+$"
+
+
+class IdentityNote(BaseModel):
+    """The claim set of one note. Frozen; unknown claims are refused."""
+
+    model_config = ConfigDict(frozen=True, extra="forbid")
+
+    iss: str = Field(pattern=r"^https://[a-z0-9.-]+/[a-z0-9-]+$")
+    aud: str = Field(pattern=_ORIGIN)
+    sub: str = Field(pattern=r"^(usr|sch)_[a-z0-9]{20}$")
+    iat: int = Field(ge=0)
+    exp: int = Field(ge=0)
+    org: str = Field(pattern=r"^org_[a-z0-9]{20}$")
+    app: str = Field(pattern=r"^app_[a-z0-9]{20}$")
+    env: EnvironmentName
+    role: Role
+    groups: tuple[str, ...] = Field(default=(), max_length=MAX_GROUPS)
+    name: str | None = Field(default=None, min_length=1, max_length=256)
+    email: str | None = Field(default=None, pattern=_EMAIL, max_length=320)
+
+    @property
+    def is_schedule(self) -> bool:
+        return self.sub.startswith("sch_")
+
+    @model_validator(mode="after")
+    def _consistent(self) -> Self:
+        if self.exp <= self.iat:
+            raise ValueError("exp must be after iat")
+        if self.exp - self.iat > MAX_TTL_SECONDS:
+            raise ValueError(f"a note lives at most {MAX_TTL_SECONDS} seconds")
+        if self.is_schedule:
+            if self.role != "schedule":
+                raise ValueError("a schedule subject carries role 'schedule'")
+            if self.name is not None or self.email is not None:
+                raise ValueError("a schedule note carries no name or email")
+        elif self.role == "schedule":
+            raise ValueError("only a schedule subject carries role 'schedule'")
+        for group in self.groups:
+            if not group.startswith("grp_") or len(group) != 24:
+                raise ValueError(f"not a group id: {group!r}")
+        if len(set(self.groups)) != len(self.groups):
+            raise ValueError("groups repeat")
+        return self

ssc_app/reconnect.js

@@ -0,0 +1,84 @@
+/**
+ * A WebSocket that comes back by itself (SSC-090). No dependencies; serve or inline it in a page
+ * as a plain script, then:
+ *
+ *   let last = -1;
+ *   const socket = sscSocket(() => `wss://${location.host}/ws?after=${last}`, {
+ *     onopen() { ... },                        // runs again after every reconnect
+ *     onmessage(event) { last = ...; },
+ *   });
+ *   socket.send('hello');                      // false while it is reconnecting
+ *
+ * The app closes its end with code 1012 a little before the limit the gateway reports
+ * (`close_before_deadline` in Python, `closeBeforeDeadline` in Node); this reconnects at once on
+ * that close, and after a growing pause on an unclean drop. WebKit reports every close the server
+ * starts as 1005 (no status), whatever its code, so 1005 counts as 1012. It gives up, calling
+ * `onclose`, after `attempts` reconnects in a row that did not stay open, or on a clean close with
+ * any other code. `url` may be a function, so a reconnect can say where to resume.
+ */
+(function (root) {
+  const RESTART_CODE = 1012;
+  const NO_STATUS = 1005;
+
+  /**
+   * @param {string | (() => string)} url
+   * @param {{protocols?: string | string[], onopen?: (event: Event) => void,
+   *   onmessage?: (event: MessageEvent) => void, onclose?: (event: CloseEvent) => void,
+   *   delayMs?: number, maxDelayMs?: number, attempts?: number}} [options]
+   */
+  function sscSocket(url, options = {}) {
+    const { protocols, onopen, onmessage, onclose, delayMs = 250, maxDelayMs = 10000, attempts = 10 } = options;
+    let ws = null;
+    let timer = null;
+    let failures = 0;
+    let openedAt = 0;
+    let stopped = false;
+
+    function stop(event) {
+      stopped = true;
+      if (onclose) onclose(event);
+    }
+
+    function open() {
+      timer = null;
+      openedAt = 0;
+      ws = new WebSocket(typeof url === 'function' ? url() : url, protocols);
+      ws.onopen = (event) => {
+        openedAt = Date.now();
+        if (onopen) onopen(event);
+      };
+      ws.onmessage = (event) => {
+        if (onmessage) onmessage(event);
+      };
+      ws.onclose = (event) => {
+        if (stopped) return;
+        const restart = event.code === RESTART_CODE || event.code === NO_STATUS;
+        if (event.wasClean && !restart) return stop(event);
+        if (openedAt !== 0 && Date.now() - openedAt >= maxDelayMs) failures = 0;
+        const wait = restart && failures === 0 ? 0 : Math.min(maxDelayMs, delayMs * 2 ** failures);
+        failures += 1;
+        if (failures > attempts) return stop(event);
+        timer = setTimeout(open, wait);
+      };
+    }
+
+    open();
+    return {
+      get socket() {
+        return ws;
+      },
+      send(data) {
+        if (!ws || ws.readyState !== 1) return false;
+        ws.send(data);
+        return true;
+      },
+      close(code = 1000, reason = '') {
+        stopped = true;
+        clearTimeout(timer);
+        if (ws) ws.close(code, reason);
+      },
+    };
+  }
+
+  root.sscSocket = sscSocket;
+})(globalThis);

ssc_app/reconnect.py

@@ -0,0 +1,112 @@
+"""Keep a WebSocket or an event stream going past the gateway's limit (SSC-090).
+
+Cloud Run ends every request at a fixed time, and an open WebSocket or event stream is one
+request: after 5 minutes for most apps, 60 for a session app. The gateway tells the app that time
+in ``X-SSC-Request-Deadline`` (Unix seconds). The
+server cannot reconnect a browser, so these helpers end the stream cleanly a little before that
+time and the browser opens a new one, which gets a new deadline:
+
+* An event stream: wrap the events in :func:`end_before_deadline`. It ends the stream with a
+  ``retry:`` hint and the browser's ``EventSource`` reconnects by itself, sending
+  ``Last-Event-ID`` when the events carry an ``id:``.
+* A WebSocket: run :func:`close_before_deadline` beside the socket. It closes the socket with
+  :data:`RESTART_CODE`; the browser client (:func:`browser_client`) reconnects on that close and
+  on an unclean drop.
+
+    return StreamingResponse(end_before_deadline(events(), request.headers),
+                             media_type="text/event-stream")
+
+    await socket.accept()
+    restart = asyncio.create_task(close_before_deadline(socket.close, socket.headers))
+    try:
+        ...  # the socket's own loop
+    finally:
+        restart.cancel()
+
+Without the header, as on a laptop, nothing is cut. A stream that opens with less than the margin
+left is ended after half the time left (:func:`seconds_to_wait`), never at once. Whatever must
+outlive one connection belongs in Postgres or in the browser, never in the connection. Same names,
+defaults and vectors as the Node helper ``@delimitus/ssc-reconnect``.
+"""
+
+import asyncio
+import time
+from collections.abc import AsyncIterable, AsyncIterator, Awaitable, Callable, Mapping
+from importlib.resources import files
+from typing import Final
+
+DEADLINE_HEADER: Final = "X-SSC-Request-Deadline"
+RESTART_CODE: Final = 1012
+DEFAULT_MARGIN_SECONDS: Final = 30.0
+DEFAULT_RETRY_MS: Final = 1000
+
+
+def seconds_left(headers: Mapping[str, str], *, now: float | None = None) -> float | None:
+    """Seconds until the gateway's limit ends this request, never below 0; None when the request
+    carries no readable ``X-SSC-Request-Deadline``. ``now`` (Unix seconds) is for tests."""
+    wanted = DEADLINE_HEADER.lower()
+    for name, value in headers.items():
+        if name.lower() == wanted:
+            raw = value.strip()
+            if not (raw.isascii() and raw.isdigit()):
+                return None
+            return max(0.0, int(raw) - (time.time() if now is None else now))
+    return None
+
+
+def seconds_to_wait(left: float | None, margin: float = DEFAULT_MARGIN_SECONDS) -> float | None:
+    """How long to keep a stream with ``left`` seconds to its deadline: until ``margin`` seconds
+    before it, or half of ``left`` when that is later, so a stream that opens inside the margin is
+    not ended at once and reopened in a loop. None, cut nothing, without a deadline or once it has
+    passed (this clock is ahead of the gateway's); the platform's limit ends that stream."""
+    if left is None or left <= 0:
+        return None
+    return max(left - margin, left / 2)
+
+
+async def end_before_deadline(
+    events: AsyncIterable[str | bytes],
+    headers: Mapping[str, str],
+    *,
+    margin: float = DEFAULT_MARGIN_SECONDS,
+    retry_ms: int = DEFAULT_RETRY_MS,
+) -> AsyncIterator[bytes]:
+    """``events``, each a whole event ending in a blank line, ended :func:`seconds_to_wait` from
+    now with ``retry: <retry_ms>`` so ``EventSource`` reconnects that many milliseconds later.
+    Without a deadline, ``events`` unchanged."""
+    wait = seconds_to_wait(seconds_left(headers), margin)
+    loop = asyncio.get_running_loop()
+    stop = None if wait is None else loop.time() + wait
+    source = aiter(events)
+    while True:
+        try:
+            wait = None if stop is None else max(0.0, stop - loop.time())
+            event = await asyncio.wait_for(anext(source), wait)
+        except StopAsyncIteration:
+            return
+        except TimeoutError:
+            yield f"retry: {retry_ms}\n\n".encode()
+            return
+        yield event.encode() if isinstance(event, str) else event
+
+
+async def close_before_deadline(
+    close: Callable[[int, str], Awaitable[object]],
+    headers: Mapping[str, str],
+    *,
+    margin: float = DEFAULT_MARGIN_SECONDS,
+) -> None:
+    """Wait :func:`seconds_to_wait`, then ``close(RESTART_CODE, "restart")``. Run it as a task
+    beside the socket and cancel it when the socket ends first. Without a deadline it returns at
+    once and closes nothing."""
+    wait = seconds_to_wait(seconds_left(headers), margin)
+    if wait is None:
+        return
+    await asyncio.sleep(wait)
+    await close(RESTART_CODE, "restart")
+
+
+def browser_client() -> str:
+    """The browser side of :func:`close_before_deadline`, dependency-free JavaScript to serve or
+    inline in a page. It defines ``sscSocket(url, options)``, a WebSocket that reconnects."""
+    return files("ssc_app").joinpath("reconnect.js").read_text(encoding="utf-8")

ssc_app/workload.py

@@ -0,0 +1,82 @@
+"""The app's own Google ID token, for calling the cell's data gateway (SSC-051).
+
+    from ssc_app.workload import WorkloadToken
+
+    tokens = WorkloadToken(audience=data_gateway_url)
+    headers = {"Authorization": f"Bearer {tokens.get()}"}
+
+The token comes from Cloud Run's metadata server and must be asked for with ``format=full``:
+without it Google leaves out ``email`` and ``email_verified``, and the data gateway, which knows
+the app environment only by its service account's email, refuses every query. A token is reused
+until five minutes before it expires. ``ssc_app.data.query`` and ``ssc_app.files`` find the
+gateway and send it; this is the part that must ask for the token correctly.
+"""
+
+import base64
+import json
+import threading
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from collections.abc import Callable
+from typing import Final
+
+METADATA: Final = "http://metadata.google.internal"
+IDENTITY_PATH: Final = "/computeMetadata/v1/instance/service-accounts/default/identity"
+REFRESH_BEFORE: Final = 300
+TIMEOUT_SECONDS: Final = 5.0
+
+
+class WorkloadTokenError(RuntimeError):
+    """The metadata server did not give a usable token."""
+
+
+def identity_url(audience: str, metadata: str = METADATA) -> str:
+    """The metadata server's ID-token URL for ``audience``, always with ``format=full``."""
+    query = urllib.parse.urlencode({"audience": audience, "format": "full"})
+    return f"{metadata}{IDENTITY_PATH}?{query}"
+
+
+def _expiry(token: str) -> float:
+    try:
+        payload = token.split(".")[1]
+        claims = json.loads(base64.urlsafe_b64decode(payload + "=" * (-len(payload) % 4)))
+        return float(claims["exp"])
+    except (IndexError, ValueError, KeyError, TypeError) as exc:
+        raise WorkloadTokenError("the metadata server returned an unreadable ID token") from exc
+
+
+class WorkloadToken:
+    """ID tokens for one ``audience``, cached and safe to share between threads. ``metadata``
+    replaces the metadata server's address (tests)."""
+
+    def __init__(
+        self,
+        *,
+        audience: str,
+        metadata: str = METADATA,
+        clock: Callable[[], float] = time.time,
+    ) -> None:
+        self._url = identity_url(audience, metadata)
+        self._clock = clock
+        self._lock = threading.Lock()
+        self._token: tuple[str, float] | None = None
+
+    def get(self) -> str:
+        """A token valid for at least five more minutes."""
+        with self._lock:
+            if self._token is None or self._token[1] - REFRESH_BEFORE <= self._clock():
+                token = self._fetch()
+                self._token = (token, _expiry(token))
+            return self._token[0]
+
+    def _fetch(self) -> str:
+        request = urllib.request.Request(self._url, headers={"Metadata-Flavor": "Google"})  # noqa: S310
+        try:
+            with urllib.request.urlopen(request, timeout=TIMEOUT_SECONDS) as response:  # noqa: S310
+                return response.read().decode().strip()
+        except urllib.error.HTTPError as exc:
+            raise WorkloadTokenError(f"metadata server answered HTTP {exc.code}") from None
+        except (urllib.error.URLError, OSError) as exc:
+            raise WorkloadTokenError(f"metadata server unreachable: {type(exc).__name__}") from None

ssc_app-0.0.3.dist-info/METADATA

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: ssc-app
+Version: 0.0.3
+Summary: The helper an app on Small Software Cloud installs: who is signed in, streams that reconnect, files and company data.
+License-Expression: MIT
+License-File: LICENSE
+Requires-Dist: pydantic>=2.5,<3
+Requires-Dist: pyjwt[crypto]>=2.15.0,<3
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# ssc-app
+
+The tiny helper an app installs to read the SSC identity note (`X-SSC-Identity`), to reconnect streams before the gateway's limit, to keep files and to read company data.
+
+```
+pip install ssc-app
+```
+
+Python 3.11 or later. Depends on `pydantic` (2.5 or later) and `pyjwt[crypto]` (2.15 or later) only, both as ranges, so the app keeps its own pins.
+
+```python
+import os
+
+from ssc_app.identity import IdentityRefused, IdentityVerifier
+
+verifier = IdentityVerifier(
+    audience="https://quiet-river-7f3k.delimitusapps.com",  # this app's exact origin
+    keys=os.environ["SSC_IDENTITY_KEYS_URL"],  # a data: URL in a cell; or a JWKS URL or dict
+)
+note = verifier.from_headers(request.headers)
+note.sub  # "usr_…" or "sch_…": key on this
+note.name  # display only; None for a schedule run
+note.email  # display only; None for a schedule run
+```
+
+Key on `sub`, never on `email`. Verify once per request; never re-verify inside a long WebSocket or event stream. Every refusal is `IdentityRefused` with a `code`; treat them all as "not a signed-in user of this app". Contract: `docs/contracts/identity-note.md`.
+
+## Reconnect before the limit
+
+Each WebSocket or event stream ends at the limit the gateway reports (5 minutes for most apps, 60 for session apps). `ssc_app.reconnect` reads the gateway's `X-SSC-Request-Deadline` header and ends the stream a little before then; the browser reconnects without a reload. No extra dependency.
+
+```python
+from ssc_app.reconnect import browser_client, close_before_deadline, end_before_deadline
+
+# Event stream: EventSource reconnects by itself, with Last-Event-ID if your events carry an id.
+return StreamingResponse(
+    end_before_deadline(events(), request.headers), media_type="text/event-stream"
+)
+
+# WebSocket: closed with code 1012, 30 seconds before the limit.
+await ws.accept()
+restart = asyncio.create_task(close_before_deadline(ws.close, ws.headers))
+try:
+    ...
+finally:
+    restart.cancel()
+
+# The browser side: serve browser_client(), then sscSocket(url, {onopen, onmessage}) instead of new WebSocket(url).
+```
+
+`seconds_left(request.headers)` gives the seconds until the limit, or None without the gateway. Options: `margin` (30 s) on both, `retry_ms` (1000) on `end_before_deadline`. A stream that opens with less than the margin left is ended after half the time left (`seconds_to_wait`), never at once. A reconnect is a new connection: keep what must outlive it in Postgres or in the browser. The Node helper `@delimitus/ssc-reconnect` has the same names and runs the same vectors (`conformance/reconnect/vectors.json`).
+
+## Files
+
+Ask for file storage with `[files]` in `ssc.toml`; the first deploy that asks sets it up once, in a few minutes. `ssc_app.files` asks the cell's data gateway for a signed link with the app's own ID token and sends the bytes to Cloud Storage; the app holds no storage credentials. No extra dependency.
+
+```python
+from ssc_app import files
+
+files.put("photos/cat.png", data, content_type="image/png")
+data = files.get("photos/cat.png")
+url = files.link("get", "photos/cat.png")["url"]  # redirect a browser here to download
+files.delete("photos/cat.png")
+```
+
+Each environment has its own files: at most 25 MB each and 1 GB together. A name is `/`-separated segments of `A-Z a-z 0-9 . _ -`, each starting with a letter or digit. A link lasts 10 minutes, and a download always arrives as an attachment, never shown as a page. Upload from the server: the bucket allows no browser-direct upload. Files are not scanned for viruses. Errors are `FilesError` with the data gateway's `code` (`FILE_NOT_FOUND`, `FILES_QUOTA_EXCEEDED`, `APP_NOT_ACTIVE`, ...), `STORAGE_<status>` or `UNREACHABLE`; the data gateway starts from zero, so a call to it is tried once more on a timeout, a lost connection or a 502, 503 or 504. The gateway's address comes from the metadata server (`SSC_DATAGW_URL` replaces it). The Node helper `@delimitus/ssc-files` has the same names, with `remove` for `delete`. Contract: `docs/contracts/data-gateway.md#files`.
+
+## Company data
+
+Name a connection in `[connections] names` in `ssc.toml`; an org admin grants the environment that connection. `ssc_app.data.query` sends one read-only statement to the cell's data gateway with the app's own ID token; the app holds no database credentials. No extra dependency. For a `postgres` connection:
+
+```python
+from ssc_app import data
+
+result = data.query("finance", "select id, total from invoices where year = $1", [2026])
+for row in result.rows:  # a list in column order
+    ...
+```
+
+The statement follows the connection's kind: one `SELECT` for `postgres` (`$1`, `$2`, ... placeholders) and for `mysql`, `sqlserver`, `bigquery` and `snowflake` (`?` placeholders); and, with no parameters, an A1 range for `gsheets`, `list <prefix>` or `get <key>` for `s3` and `gcs`, `<table>[ view <view>][ where <formula>]` for `airtable` and a GET path for `rest`. `max_rows`, `max_bytes` and `timeout_ms` only narrow what the platform, the connection and the grant allow; `result.truncated` and `result.truncated_reason` say the gateway stopped reading early. To act for the signed-in user pass the request's `X-SSC-Identity` value as `identity=`; without it the app acts for itself. A decimal is a string and a timestamp is ISO 8601. Errors are `DataError` with the data gateway's `code` (`CONNECTION_NOT_GRANTED`, `CONNECTION_SUSPENDED`, `QUERY_REFUSED`, `QUERY_FAILED` with a `sqlstate`, `DAILY_BUDGET_SPENT`, ...) or `UNREACHABLE`; a query is tried once more on a lost connection or a 502, 503 or 504, and one that timed out is not. The Node helper `@delimitus/ssc-data` has the same names with `maxRows`, `maxBytes` and `timeoutMs`. Contract: `docs/contracts/data-gateway.md`.

ssc_app-0.0.3.dist-info/RECORD

@@ -0,0 +1,13 @@
+ssc_app/__init__.py,sha256=0Z0mQkb-1xxDCFpswASGTCle4Ne-G9Mu6rTEiLB9amg,226
+ssc_app/data.py,sha256=Q5gqDB9Hcy2nOJXOYg5s8rlxcEsZSAfVI9Gg1nmILPU,9264
+ssc_app/files.py,sha256=ZWghYBR9Jc6n23b9O3QBX-QR0NZf-vdRkZNtozOvaM8,8178
+ssc_app/identity.py,sha256=tYUBXU8AG8htHyzWdwqPtjAMppUZgZX-zbJF7Q6aY9M,9063
+ssc_app/note.py,sha256=2Kvovk2DBF7B574vqc_G2auQAIEbM4ndowhhHTcpoEU,3115
+ssc_app/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+ssc_app/reconnect.js,sha256=U3T-wcGicc1cOfog7ZDbT4-ue4odM2ae4Vv1umIzFv8,2994
+ssc_app/reconnect.py,sha256=qN8ice02P6jxX19YVDNRCnZnaOvf48nG6wUgXChubik,5037
+ssc_app/workload.py,sha256=Wz3MMMveV7p4TSTaEnXH0VBgYQw9HYAmKu9GFkxgbVo,3272
+ssc_app-0.0.3.dist-info/licenses/LICENSE,sha256=d4h3gSdkq-2PMISQonnnlFr1dlZlDeAUrRAc8bUsa4k,1066
+ssc_app-0.0.3.dist-info/WHEEL,sha256=e4_1dyBeezi8ZjfxrZ3bnVOxFDa3ksqVqH0jTHkUZ3k,81
+ssc_app-0.0.3.dist-info/METADATA,sha256=-bM8UJ3svQr3i4BH_mJ_Hcd7bsmIV0WvReY42SAlP4s,6096
+ssc_app-0.0.3.dist-info/RECORD,,

ssc_app-0.0.3.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: uv 0.12.19
+Root-Is-Purelib: true
+Tag: py3-none-any

ssc_app-0.0.3.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Delimitus
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.