waitbus 0.1.0__tar.gz

waitbus-0.1.0/.github/CONTRIBUTING.md

@@ -0,0 +1,350 @@
+# Contributing to waitbus
+
+waitbus is a single-author project at present. Contributions are welcome via
+GitHub issues (bug reports, feature requests) and pull requests. This document
+covers the local development workflow, per-surface testing, version sync, and
+release policy. For install and operation, see [README.md](../README.md).
+
+---
+
+## Quick start (local dev)
+
+```bash
+git clone https://github.com/astrogilda/waitbus && cd waitbus
+uv sync --all-groups
+uvx prek install -f
+uv run pytest tests/ -p no:xdist
+```
+
+All runtime deps live in `[project.dependencies]`; dev deps (pytest, ruff,
+mypy, hypothesis, build, tiktoken) live in `[dependency-groups].dev`.
+`uv sync --all-groups` installs both. The git hook manager is `prek`
+(Rust drop-in alternative to the pre-commit framework, schema-compatible
+with the same `.pre-commit-config.yaml`); CI runs `uvx prek run --all-files`
+on every push.
+
+---
+
+## Project conventions
+
+- **Python target:** 3.11 minimum (`requires-python = ">=3.11"`). CI tests 3.11, 3.12, 3.13, and 3.14.
+- **Ruff rule set:** `["E", "F", "I", "N", "UP", "B", "SIM", "RUF"]`. `tests/*` allows `E402` for property-test deferred imports.
+- **Line length:** 120 characters.
+- **Mypy strict** on `waitbus/` only; tests are excluded (`[tool.mypy] files = ["waitbus"]`).
+- **Tests run serial:** `pytest -p no:xdist`. Hypothesis fixture races occur under xdist.
+- **Runtime dependency closure:** `typer` (CLI), `platformdirs` (path resolution), `mcp` + `pydantic` + `pydantic-core` (MCP server).
+
+### Per-surface dev commands
+
+```bash
+# Full test suite (serial)
+uv run pytest tests/ -vv -p no:xdist
+
+# Lint
+uv run ruff check waitbus tests scripts
+
+# Type-check
+uv run mypy waitbus
+
+# Integration test (wheel build + install-in-venv + entry-point assertions)
+uv run pytest tests/test_install.py -vv -p no:xdist -m slow
+```
+
+The test suite has ~600 tests. Use `-p no:xdist` (serial mode) in development
+and CI to avoid Hypothesis fixture races. The slow integration test builds a
+wheel, installs it into a fresh venv, and asserts entry-points and
+`systemd-analyze verify` output — it runs in roughly one second on a warm cache.
+
+### MCP server
+
+The MCP server lives in `waitbus/mcp.py` and is reachable via
+`waitbus mcp serve`. It subscribes to the broadcast socket over stdlib
+`socket.socket(AF_UNIX, SOCK_STREAM)` and re-emits each non-heartbeat frame
+as both a vendor-specific Claude Code notification frame
+(`notifications/claude/channel`) and a standard `notifications/resources/updated`
+frame (for Claude Desktop and generic MCP clients).
+
+```bash
+# Run the MCP-server unit tests (fast, mocks the broadcast socket)
+uv run pytest tests/test_mcp.py -vv -p no:xdist
+
+# Run the server against a live broadcast daemon (Ctrl+D to stop)
+uv run waitbus mcp serve
+```
+
+On macOS the server logs one info message and idles — the broadcast daemon
+stack is Linux-only.
+
+### Systemd units
+
+Validate units before committing:
+
+```bash
+systemd-analyze --user verify systemd/*.service systemd/*.socket systemd/*.timer
+```
+
+CI runs this check as well. When adding or removing unit files, update
+`systemd/MANIFEST.txt` — `waitbus install-systemd --sync` reads that file
+to compute orphan units from previous package versions.
+
+---
+
+## Development install vs released install
+
+**Working from a checkout:**
+
+```bash
+uv pip install --editable .
+```
+
+Console scripts point at your source tree — edits are picked up immediately.
+However, editable installs do **not** place `share/systemd/user/` on disk.
+Hatchling's `shared-data` directive only fires during a wheel build, not during
+`--editable`. For systemd-unit testing during dev, build a wheel and install it
+into a throwaway venv:
+
+```bash
+uv build --wheel
+# Install the produced dist/waitbus-*.whl into a fresh venv
+```
+
+Or symlink the dev unit files to `~/.config/systemd/user/` manually for rapid
+iteration without a wheel rebuild.
+
+**Working from a released wheel:**
+
+```bash
+uv tool install waitbus
+waitbus install-systemd
+```
+
+---
+
+## Loading the plugin locally
+
+To test the full Claude Code plugin without installing from the registry:
+
+```bash
+claude --plugin-dir /path/to/waitbus --dangerously-load-development-channels
+```
+
+`.mcp.json` invokes `uvx --from waitbus waitbus mcp serve`, which
+resolves the latest published `waitbus` from PyPI. To exercise local
+source instead, either `uv tool install --editable .` from this directory
+(rebinds the `waitbus` shim onto your working tree) or temporarily swap the
+`.mcp.json` `args` to `["run", "waitbus", "mcp", "serve"]`.
+
+---
+
+## Updating the sdist manifest snapshot
+
+The sdist hygiene test in `tests/test_sdist_manifest.py` asserts that the file
+list inside the produced source distribution matches a committed snapshot at
+`tests/data/expected-sdist-manifest.txt`, plus a size budget, a copyleft-header
+scan, and a forbidden-paths regression guard.
+
+When you add or remove a file that ships in the sdist, regenerate the snapshot
+in the same PR:
+
+```bash
+uv build --sdist
+tar tzf dist/waitbus-*.tar.gz | sort > tests/data/expected-sdist-manifest.txt
+```
+
+Review the diff before committing — an unexpected addition is exactly what this
+test is designed to catch.
+
+---
+
+## Linux + systemd assumption
+
+The daemon stack is **Linux-only** at runtime. The Python library, listener, ETag
+poller, and query CLI work on macOS, but without systemd integration.
+
+Specific reasons:
+
+- `broadcast.py` authenticates subscribers with `SO_PEERCRED` and coalesces
+  doorbell wakeups with `os.eventfd`, both Linux-only. The wire itself is
+  `AF_UNIX SOCK_STREAM` with length-prefix framing (portable; macOS lacks
+  `SOCK_SEQPACKET`), but the broadcast, doorbell, and `read-events --watch`
+  test modules carry `pytestmark = pytest.mark.skipif(sys.platform != "linux", ...)`
+  for the eventfd and peer-credential paths.
+- `broadcast._peer_uid` resolves `SO_PEERCRED` via
+  `getattr(socket, "SO_PEERCRED", None)` so the package still imports cleanly
+  on macOS for the library and listener surfaces.
+- The MCP server (`waitbus/mcp.py`) subscribes to the broadcast bus; on macOS
+  it emits one info-severity notification and exits cleanly because that
+  broadcast daemon stack is Linux-only.
+
+---
+
+## Version sync
+
+The canonical version lives in `pyproject.toml [project].version`. Three
+manifests must agree: `pyproject.toml`, `.claude-plugin/plugin.json`, and
+`server.json`. Propagate with:
+
+```bash
+scripts/sync-versions.py           # mutate all three manifests; exit 0
+scripts/sync-versions.py --check   # exit 1 on any drift
+```
+
+The `--check` mode runs in the pre-commit hook and in CI. Never bump version
+fields manually in `plugin.json` or `server.json` — only edit `pyproject.toml`
+and then run `sync-versions.py`.
+
+---
+
+## Commit conventions
+
+Commits and PR titles follow [Conventional Commits](https://www.conventionalcommits.org/):
+
+```
+feat(waitbus): add broadcast lag counter metric
+fix(waitbus): handle SIGTERM during fan-out drain
+docs(waitbus): expand install-systemd shared-data note
+test(waitbus): add Hypothesis property tests for ULID ordering
+chore(waitbus): update pre-commit hook versions
+ci(waitbus): add systemd-analyze verify step to workflow
+```
+
+Rules:
+- No emoji.
+- No internal jargon (no internal project jargon).
+- Subject line under 72 characters, imperative mood.
+- PR body explains *why*, not *what*.
+
+---
+
+## Commit signing
+
+We recommend signing your commits. Release tags are already signed, and signed
+commits extend that chain of trust back through the history they tag.
+
+Enable signing locally with either an SSH key or a GPG key:
+
+```bash
+# SSH-key signing (simplest if you already push over SSH):
+git config commit.gpgsign true
+git config gpg.format ssh
+git config user.signingkey ~/.ssh/id_ed25519.pub
+
+# Or GPG-key signing:
+git config commit.gpgsign true
+git config user.signingkey <your-gpg-key-id>
+```
+
+This is a recommendation, not a CI gate: signed commits are not enforced on
+pull requests (that would be premature ahead of a public, multi-contributor
+flow). The signed release tag remains the enforced trust boundary.
+
+---
+
+## Console scripts (1)
+
+The package ships a single entry point: `waitbus`. All previous per-daemon
+scripts are now sub-commands of that umbrella CLI.
+
+| Sub-command | Purpose |
+|-------------|---------|
+| `waitbus init` | Create state directory and SQLite schema |
+| `waitbus install-systemd` | Copy systemd user units (Linux) |
+| `waitbus install-launchd` | Copy launchd plists (macOS) |
+| `waitbus keygen` | Store HMAC secret in OS keyring |
+| `waitbus doctor` | Health-gate: config, keyring, binaries, daemons |
+| `waitbus status` | Operational dashboard: event counts, daemon liveness |
+| `waitbus verify-plugin` | Validate `.claude-plugin/plugin.json` fields |
+| `waitbus listener serve` | HTTP webhook receiver (loopback :9000) |
+| `waitbus broadcast serve` | AF_UNIX SOCK_STREAM fan-out daemon |
+| `waitbus etag-poll run` | ETag-aware backup poller (one-shot) |
+| `waitbus mcp serve` | MCP server (stdio), re-emits broadcast events |
+| `waitbus read-events list` | Query the event store |
+| `waitbus read-events watch` | Tail the event store (live) |
+| `waitbus pr-monitor tick` | Roll job events into per-PR state |
+| `waitbus watchdog-check run` | Alertmanager watchdog freshness probe |
+
+---
+
+## Systemd units (8)
+
+| Unit file | Purpose |
+|-----------|---------|
+| `waitbus-listener.service` | Webhook HTTP server |
+| `waitbus-broadcast.service` | Broadcast daemon (socket-activated) |
+| `waitbus-broadcast.socket` | AF_UNIX SOCK_STREAM activation socket |
+| `waitbus-etag-poll.service` | ETag poller one-shot service |
+| `waitbus-etag-poll.timer` | 45-second timer for the poller |
+| `waitbus-watchdog.service` | Ingestion-silence detector service |
+| `waitbus-watchdog.timer` | Timer for the watchdog probe |
+| `waitbus-forward@.service` | Templated per-repository forwarder |
+
+All eight units use `ExecStart=%h/.local/bin/waitbus <subcmd> <verb>` and
+carry systemd hardening directives (`PrivateTmp`, `ProtectSystem=strict`,
+`NoNewPrivileges`, `SystemCallFilter` allow-list). `waitbus install-systemd`
+copies them from the wheel's `share/systemd/user/` destination into
+`~/.config/systemd/user/`.
+
+---
+
+## `--dry-run` vs `doctor`
+
+- **`waitbus init --dry-run`** — prints intended actions and always exits 0.
+  Use for inspection before committing to install actions.
+- **`waitbus doctor`** — reads the *current* state of config, keyring,
+  binaries, and systemd units. Exits 0 if everything resolves; exits 1 on any
+  issue. Use as a health gate before and after deploys.
+
+---
+
+## Versioning policy
+
+This project follows [Semantic Versioning](https://semver.org/). Pre-1.0
+releases may refine the API based on real-world usage. After 6+ months of
+stable public usage, v1.0 will declare API stability.
+
+---
+
+## Release process
+
+1. Bump `pyproject.toml [project].version` to the target (e.g., `0.2.0`).
+2. Run `scripts/sync-versions.py` to propagate to all manifests.
+3. Update `CHANGELOG.md` — add a dated section for the new version.
+4. Commit + push + open PR. CI must pass before merging.
+5. After merge to main:
+   ```bash
+   git tag v0.2.0
+   git push origin v0.2.0
+   ```
+6. The tag triggers `.github/workflows/release.yml`, which:
+   - Publishes `waitbus` to PyPI (OIDC + sigstore attestations).
+   - Registers `io.github.astrogilda/waitbus` with the MCP Registry.
+   - Creates a GitHub Release with the plugin `.zip` attached.
+
+Pre-release tags (`-rc1`, `-alpha`, `-beta`, `-dev`) trigger the full test
+matrix as a rehearsal but skip every publish job, so the PyPI version slot is
+not burned on a dry run. Only tags matching `vN.N.N` or `vN.N.N.postN` shapes
+invoke the publish jobs.
+
+### Partial-publish recovery
+
+The three publish steps (PyPI, MCP Registry, GitHub Release) are
+decoupled. If one succeeds and another fails:
+
+- **PyPI** is immutable. Bump to `0.2.0.post1` in `pyproject.toml`, run
+  `sync-versions.py`, and retag `v0.2.0.post1`. The `.post1` PEP 440
+  post-release suffix signals the artifact identity is stable.
+- **MCP Registry** accepts a retag of the same version number, so `.post1` is
+  only required when PyPI was the registry that succeeded.
+
+---
+
+## Code of Conduct
+
+A `CODE_OF_CONDUCT.md` lives at the repo root (Contributor Covenant 2.1 adoption).
+
+---
+
+## License
+
+MIT. By contributing you agree that your contributions are MIT-licensed under
+the same terms as the rest of this project. See [LICENSE](../LICENSE).

waitbus-0.1.0/.gitignore

@@ -0,0 +1,73 @@
+# Python build / cache artifacts
+__pycache__/
+*.pyc
+*.egg-info/
+build/
+dist/
+
+# Virtualenv (managed by `uv sync` or `pip install -e`)
+.venv/
+
+# Test / type-check / property-test / lint caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.hypothesis/
+.coverage
+coverage.json
+htmlcov/
+
+# IDE / editor scratch
+.vscode/
+.idea/
+
+# LSP/MCP project state cache (local, no upstream consumers)
+.serena/
+
+# Claude harness session state (per-conversation correlation IDs; not source)
+.claude_correlation/
+
+# Per-run benchmark output JSONs (host- and timestamp-stamped). Only the
+# committed baselines under benchmarks/baselines/ are tracked; per-run
+# results land here for ad-hoc inspection but are runner-specific.
+benchmarks/results/*.json
+
+# Vendored hetzner-bench-toolkit clone used by scripts/run_soak_on_hetzner.sh
+# on the maintainer-side soak runner. It is an embedded git checkout that
+# should not be tracked here and is already excluded from the sdist via
+# `[tool.hatch.build.targets.sdist].exclude` in pyproject.toml.
+scripts/.hbt/
+
+# Crawl / context bundles (derived artifacts, never committed)
+crawl-output/
+
+# Operator-local pytest run logs (per-run timestamped .log + .junit.xml +
+# warnings.log). Persistent across reboots so a failed / skipped / warned
+# run can be retroactively inspected without re-execution. Drop here via
+# scripts/run_full_pytest.sh.
+.local-pytest-logs/
+
+# Operator-local stress run logs (per-run timestamped .log + .verdict.json
+# + .progress.jsonl). Persistent across reboots so an operator-driven
+# real-mode stress invocation can be re-inspected without re-execution.
+.local-stress-logs/
+
+# Operator-local reference fixtures: live-recorded LLM envelopes the
+# operator captures off ``claude -p`` / ``gemini -p`` runs and uses as a
+# source-of-truth shape reference. The tests embed envelope content
+# inline (see ``tests/test_stress_real_drivers.py``); this directory is
+# the operator's working copy of the live captures and is not shipped.
+tests/fixtures/
+
+# Code-intelligence index snapshot — generated, rebuildable; not source.
+codedb.snapshot
+
+# Benchmark run output — per-run timestamped verdict/log/progress scratch the
+# benches write here; a good run is promoted to benchmarks/baselines/ (which IS
+# committed). The dir itself is kept via .gitkeep; individual runs are scratch.
+benchmarks/results/*
+!benchmarks/results/.gitkeep
+
+# local soak-run outputs (fetched from Hetzner)
+soak-verdict.json
+soak-verdict.json.progress.jsonl

waitbus-0.1.0/CHANGELOG.md

@@ -0,0 +1,63 @@
+# Changelog
+
+All notable changes to **waitbus** are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## Versioning
+
+Pre-1.0 releases may refine the API based on real-world usage; v1.0 will
+declare API stability after a period of stable public use.
+
+## [0.1.0] — first public release
+
+waitbus is a workstation-local async event bus for your machine's agents:
+wait on anything from any source, and let your agents coordinate over the
+same local bus. It is local-only (an `AF_UNIX` socket, no network egress),
+durable (events persist to SQLite with replay), and zero-polling (an
+`eventfd` doorbell wakes subscribers instead of a clock loop).
+
+### Sources — wait on what already finished or failed
+
+- **CI jobs** — a GitHub workflow run finishing or failing.
+- **Test runs** — a pytest run passing or failing.
+- **Containers** — docker container lifecycle events.
+- **Filesystem** — file and directory changes.
+- Third-party sources register through the `waitbus.sources.v1` entry-point group.
+
+### Subscribers — any agent or script can wait and react
+
+- **Agent frameworks** — Pydantic AI and LangGraph agents subscribe and react over the public SDK.
+- **Claude Code** — receives pushes over the MCP notification channel.
+- **Any MCP client** — pulls events via tool calls or a `tail_events` long-poll.
+- **Scripts / CLI** — `waitbus wait`, plus hand-decoding subscriber snippets in Python, Go, Rust, and TypeScript.
+
+### Core
+
+- `waitbus wait <predicate>` blocks until a matching event arrives, with a
+  `since=` cursor for durable offline catch-up.
+- Daemon broadcast fan-out delivers each event to every subscriber over its
+  own buffer.
+- Cross-agent failure broadcast: when one peer fails, the rest of the swarm
+  is notified on the same bus.
+- Broadcast wire protocol v1 (frozen): typed frames with an open `kind`
+  discriminator, an ack-first subscribe handshake, and an `event_id` identity
+  carried on every data frame.
+- Backpressure with whole-frame delivery: a subscriber that falls behind is
+  evicted with a `subscribe_rejected{lag_limit_exceeded}` frame when the wire
+  sits at a frame boundary, or a clean EOF otherwise — never a torn frame.
+- Opt-in loopback Prometheus `/metrics` on the broadcast daemon;
+  `waitbus_broadcast_events_delivered_total` counts event frames only, at
+  kernel-accept (control frames are never counted).
+- `waitbus serve` supervises the broadcast daemon plus the configured source
+  watchers in one foreground process: a daemon crash or a startup failure
+  exits 1, and the docker watcher stops gracefully at shutdown.
+
+### Install
+
+```
+pip install waitbus
+```
+
+[0.1.0]: https://github.com/astrogilda/waitbus/releases/tag/v0.1.0

waitbus-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sankalp Gilda
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

waitbus-0.1.0/NOTICE

@@ -0,0 +1,121 @@
+waitbus
+Copyright (c) 2026 Sankalp Gilda
+
+This product is licensed under the MIT License. See the LICENSE file for the
+full license text.
+
+This product bundles no third-party source code. It does, however, declare a
+runtime dependency closure that `pip install waitbus` resolves and installs
+alongside it. The packages below are NOT redistributed inside the waitbus sdist
+or wheel; each is fetched from its own publisher and retains its own license
+and copyright. They are enumerated here so downstream redistributors have a
+single place to find the licenses that apply to a complete waitbus install.
+
+A per-dependency license audit (method, resolved versions, verdict) is
+recorded in docs/DEPENDENCY_LICENSES.md. Every license below is
+redistribution-compatible with waitbus's MIT license. The one weak-copyleft
+dependency, certifi (MPL-2.0), is file-level copyleft: its obligations attach
+only to modifications of certifi's own files, not to the MIT-licensed work
+that merely depends on it.
+
+Licenses are taken from each package's published distribution metadata
+(SPDX license expression, then OSI trove classifiers, then the License
+field). Where the metadata gives an SPDX expression with a choice (for
+example "MIT OR Apache-2.0"), waitbus exercises no election; the package
+remains available under all of the offered terms.
+
+------------------------------------------------------------------------------
+Runtime dependencies (the closure `pip install waitbus` resolves)
+------------------------------------------------------------------------------
+
+Direct runtime dependencies (declared in pyproject.toml [project.dependencies]):
+
+  mcp                       MIT                         https://modelcontextprotocol.io
+                            Copyright (c) Anthropic, PBC
+  msgspec                   BSD-3-Clause                https://github.com/jcrist/msgspec
+                            Copyright (c) Jim Crist-Harif
+  platformdirs              MIT                         https://github.com/tox-dev/platformdirs
+                            Copyright (c) The platformdirs developers
+  prometheus-client         Apache-2.0 AND BSD-2-Clause https://github.com/prometheus/client_python
+                            Copyright (c) The Prometheus Authors
+  pydantic-settings         MIT                         https://github.com/pydantic/pydantic-settings
+                            Copyright (c) Samuel Colvin and other contributors
+  stamina                   MIT                         https://github.com/hynek/stamina
+                            Copyright (c) Hynek Schlawack
+  typer                     MIT                         https://github.com/fastapi/typer
+                            Copyright (c) Sebastian Ramirez
+
+Transitive runtime dependencies (pulled in by the packages above). Two
+entries, colorama and pywin32, install only on Windows (they carry a
+sys_platform == 'win32' marker) and are not installed on Linux or macOS:
+
+  annotated-doc             MIT                         https://github.com/fastapi/annotated-doc
+  annotated-types           MIT                         https://github.com/annotated-types/annotated-types
+  anyio                     MIT                         https://github.com/agronholm/anyio
+  attrs                     MIT                         https://github.com/python-attrs/attrs
+  certifi                   MPL-2.0                     https://github.com/certifi/python-certifi
+  click                     BSD-3-Clause                https://github.com/pallets/click
+  colorama                  BSD-3-Clause (Windows only) https://github.com/tartley/colorama
+  h11                       MIT                         https://github.com/python-hyper/h11
+  httpcore                  BSD-3-Clause                https://github.com/encode/httpcore
+  httpx                     BSD-3-Clause                https://github.com/encode/httpx
+  httpx-sse                 MIT                         https://github.com/florimondmanca/httpx-sse
+  idna                      BSD-3-Clause                https://github.com/kjd/idna
+  jsonschema                MIT                         https://github.com/python-jsonschema/jsonschema
+  jsonschema-specifications MIT                         https://github.com/python-jsonschema/jsonschema-specifications
+  markdown-it-py            MIT                         https://github.com/executablebooks/markdown-it-py
+  mdurl                     MIT                         https://github.com/executablebooks/mdurl
+  pydantic                  MIT                         https://github.com/pydantic/pydantic
+  pydantic-core             MIT                         https://github.com/pydantic/pydantic-core
+  pygments                  BSD-2-Clause                https://github.com/pygments/pygments
+  pyjwt                     MIT                         https://github.com/jpadilla/pyjwt
+  python-dotenv             BSD-3-Clause                https://github.com/theskumar/python-dotenv
+  python-multipart          Apache-2.0                  https://github.com/Kludex/python-multipart
+  pywin32                   PSF-2.0 (Windows only)      https://github.com/mhammond/pywin32
+  referencing               MIT                         https://github.com/python-jsonschema/referencing
+  rich                      MIT                         https://github.com/Textualize/rich
+  rpds-py                   MIT                         https://github.com/crate-py/rpds
+  shellingham               ISC                         https://github.com/sarugaku/shellingham
+  sse-starlette             BSD-3-Clause                https://github.com/sysid/sse-starlette
+  starlette                 BSD-3-Clause                https://github.com/encode/starlette
+  tenacity                  Apache-2.0                  https://github.com/jd/tenacity
+  typing-extensions         PSF-2.0                     https://github.com/python/typing_extensions
+  typing-inspection         MIT                         https://github.com/pydantic/typing-inspection
+  uvicorn                   BSD-3-Clause                https://github.com/encode/uvicorn
+
+------------------------------------------------------------------------------
+Optional dependencies (installed only via the matching extra)
+------------------------------------------------------------------------------
+
+  [analyze]        duckdb                  MIT                         https://github.com/duckdb/duckdb
+  [fs]             watchdog                Apache-2.0                  https://github.com/gorakhargosh/watchdog
+  [bench] / [soak] hdrhistogram            Apache-2.0                  https://github.com/HdrHistogram/HdrHistogram_py
+  [bench] / [soak] pbr                     Apache-2.0                  https://opendev.org/openstack/pbr
+  [bench] / [soak] setuptools              MIT                         https://github.com/pypa/setuptools
+  [bench]          tiktoken                MIT                         https://github.com/openai/tiktoken
+  [bench]          regex                   Apache-2.0 AND CNRI-Python  https://github.com/mrabarnett/mrab-regex
+  [bench]          requests                Apache-2.0                  https://github.com/psf/requests
+  [bench]          charset-normalizer      MIT                         https://github.com/jawah/charset_normalizer
+  [plugin-verify]  pypi-attestations       Apache-2.0                  https://github.com/trailofbits/pypi-attestations
+  [plugin-verify]  sigstore                Apache-2.0                  https://github.com/sigstore/sigstore-python
+  [plugin-verify]  sigstore-models         Apache-2.0                  https://github.com/sigstore/sigstore-python
+  [plugin-verify]  sigstore-rekor-types    Apache-2.0                  https://github.com/sigstore/rekor
+  [plugin-verify]  cryptography            Apache-2.0 OR BSD-3-Clause  https://github.com/pyca/cryptography
+  [plugin-verify]  pyopenssl               Apache-2.0                  https://github.com/pyca/pyopenssl
+  [plugin-verify]  cffi                    MIT                         https://github.com/python-cffi/cffi
+  [plugin-verify]  pycparser               BSD-3-Clause                https://github.com/eliben/pycparser
+  [plugin-verify]  pyasn1                  BSD-2-Clause                https://github.com/pyasn1/pyasn1
+  [plugin-verify]  securesystemslib        MIT                         https://github.com/secure-systems-lab/securesystemslib
+  [plugin-verify]  tuf                     Apache-2.0 OR MIT           https://github.com/theupdateframework/python-tuf
+  [plugin-verify]  id                      Apache-2.0                  https://github.com/di/id
+  [plugin-verify]  rfc3161-client          Apache-2.0                  https://github.com/trailofbits/rfc3161-client
+  [plugin-verify]  rfc3986                 Apache-2.0                  https://github.com/python-hyper/rfc3986
+  [plugin-verify]  rfc8785                 Apache-2.0                  https://github.com/trailofbits/rfc8785.py
+  [plugin-verify]  packaging               Apache-2.0 OR BSD-2-Clause  https://github.com/pypa/packaging
+  [plugin-verify]  requests                Apache-2.0                  https://github.com/psf/requests
+  [plugin-verify]  charset-normalizer      MIT                         https://github.com/jawah/charset_normalizer
+  [plugin-verify]  urllib3                 MIT                         https://github.com/urllib3/urllib3
+
+Copyright holders for the transitive and optional packages above are recorded
+in each package's own distribution metadata and license file; consult the
+project URLs for the authoritative copyright and license text.