wingfoot 0.1.0__tar.gz

wingfoot-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install
+        run: pip install -e ".[test]"
+      - name: Test
+        run: pytest -q
+      - name: Demo smoke test
+        run: wingfoot demo

wingfoot-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,40 @@
+name: publish
+
+# Publishes to PyPI via Trusted Publishing (OIDC, no long-lived tokens).
+# One-time setup on pypi.org: add a "pending publisher" for this repo with
+# workflow file `publish.yml` and environment `pypi`, then publish a GitHub
+# Release (tag `v*`) to trigger it.
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist and wheel
+        run: |
+          pip install build
+          python -m build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write  # required for PyPI Trusted Publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

wingfoot-0.1.0/.gitignore

@@ -0,0 +1,25 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+
+# wingfoot local identity (never commit private keys)
+.wingfoot/
+*.pem
+
+# Large video render kept out of git history (ship via a GitHub Release instead).
+# The lightweight README hero (media/*.gif) and poster are committed.
+media/*.mp4
+
+# OS / editor
+.DS_Store
+.idea/
+.vscode/

wingfoot-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,35 @@
+# Contributing to wingfoot
+
+Thanks for helping. This is a young project and there is plenty of low-hanging fruit.
+
+## Setup
+
+```bash
+git clone https://github.com/AmirF194/wingfoot
+cd wingfoot
+pip install -e ".[test]"
+pytest
+wingfoot demo
+```
+
+## Ground rules
+
+- One issue, one branch, one focused PR. Keep changes small and reviewable.
+- Every behavior change ships with a test that fails without it. Tests in `tests/` are plain
+  `pytest` functions.
+- Be careful with the crypto. `rfc9421.py` is intentionally small and literal so it can be read
+  and checked. If you change the signature base or parameter handling, add a round-trip test and
+  cite the relevant RFC section.
+- Match the existing style: standard library first (the only runtime dependency is
+  `cryptography`), type hints, and clear CLI output.
+
+## Good places to start
+
+- New `doctor` checks (clock-skew hints, CDN-specific rejection signals).
+- Middleware adapters for `httpx`, `requests`, and `aiohttp`.
+- Interoperability tests against other Web Bot Auth implementations.
+
+## Reporting a problem
+
+Open an issue with what you ran, what happened, what you expected, and your OS and Python version.
+For anything large, let's agree on the approach in the issue before you build it.

wingfoot-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AmirF194
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

wingfoot-0.1.0/PKG-INFO

@@ -0,0 +1,213 @@
+Metadata-Version: 2.4
+Name: wingfoot
+Version: 0.1.0
+Summary: Verified-bot identity for AI agents (Web Bot Auth / RFC 9421), with a doctor that reports why a request was blocked.
+Project-URL: Homepage, https://github.com/AmirF194/wingfoot
+Project-URL: Issues, https://github.com/AmirF194/wingfoot/issues
+Author: AmirF194
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai-agents,bot-verification,cloudflare,crawler,http-message-signatures,rfc9421,web-bot-auth
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.9
+Requires-Dist: cryptography>=41
+Provides-Extra: httpx
+Requires-Dist: httpx>=0.23; extra == 'httpx'
+Provides-Extra: requests
+Requires-Dist: requests>=2; extra == 'requests'
+Provides-Extra: test
+Requires-Dist: httpx>=0.23; extra == 'test'
+Requires-Dist: pytest>=7; extra == 'test'
+Requires-Dist: requests>=2; extra == 'test'
+Description-Content-Type: text/markdown
+
+# wingfoot
+
+[![CI](https://github.com/AmirF194/wingfoot/actions/workflows/ci.yml/badge.svg)](https://github.com/AmirF194/wingfoot/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+![Python](https://img.shields.io/badge/python-3.9%2B-blue)
+
+<p align="center">
+  <img src="media/wingfoot-doctor.gif" alt="wingfoot doctor: a blocked 403 request becomes a verified 200 OK" width="760">
+</p>
+
+<p align="center"><em><code>wingfoot doctor</code> sends a signed request, reads the response, and tells you why a blocked <code>403</code> becomes a verified <code>200</code>.</em></p>
+
+Verified-bot identity for AI agents, using Web Bot Auth (a profile of
+[RFC 9421](https://www.rfc-editor.org/info/rfc9421/) HTTP Message Signatures).
+
+Sign your agent's outbound HTTP requests with an Ed25519 key, publish the public key at a
+well-known directory, and check whether a site accepts the signature. Includes a `doctor`
+command that sends a signed request and reports why it was accepted or rejected.
+
+Background: Cloudflare, Akamai, and Fastly increasingly block AI agents and crawlers by default.
+[Web Bot Auth](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/)
+lets a legitimate agent prove its identity instead of being treated as a hostile scraper. Setting
+it up by hand is fiddly, and a failed signature usually just returns `403` with no explanation.
+
+## Install
+
+Not on PyPI yet, so install from source:
+
+```bash
+git clone https://github.com/AmirF194/wingfoot
+cd wingfoot
+pip install -e .
+wingfoot demo
+```
+
+Python 3.9+. The only runtime dependency is `cryptography`.
+
+## Demo
+
+`wingfoot demo` starts a local reference verifier, sends one unsigned request and one signed
+request, and prints the result. It runs in a single process, so it works offline with no setup.
+
+```console
+$ wingfoot demo
+
+1. Unsigned request
+   HTTP 403 Forbidden   missing Signature-Input header
+
+2. Signed request
+   HTTP 200 OK          verified (keyid ig0azrI2bZdo...)
+```
+
+## Usage
+
+```bash
+# create a keypair and a key directory
+wingfoot init --agent https://your-bot.example
+
+# print the JWKS to publish at /.well-known/http-message-signatures-directory
+wingfoot directory
+
+# send a signed request
+wingfoot sign https://example.com/
+
+# check why a URL accepts or rejects your signed agent
+wingfoot doctor https://example.com/
+
+# get a ready-to-paste registration packet for Cloudflare, DataDome, ...
+wingfoot register --email you@example.com
+```
+
+`wingfoot doctor` sends a signed request, reads the response, and prints a checklist:
+
+```console
+$ wingfoot doctor http://localhost:8088/whoami
+
+  ok   Bot identity                       keyid RtsLV3gfcK73Ql4_...
+  ok   Signature is well-formed and cryptographically valid
+  ok   Key directory reachable and publishes this key
+  Probing the target
+  -    Unsigned request                   HTTP 403
+  ok   Signed request                     HTTP 200
+
+  Verified-bot access is working: signing changed HTTP 403 to 200.
+```
+
+When something is wrong it reports which check failed and how to fix it: expired signature, clock
+skew, unreachable directory, key not listed, missing `tag="web-bot-auth"`, and so on.
+
+## Register with verifiers
+
+A valid signature only helps once a verifier (Cloudflare, DataDome, ...) knows your key. None of
+them offer automated registration yet — each runs its own web form with a manual review behind
+it. `wingfoot register` shrinks that step to copy/paste: it first checks your hosted directory
+the way a reviewer would, then prints every answer their forms ask for:
+
+```console
+$ wingfoot register --email you@example.com
+
+Preflight — what a reviewer will check
+  ok   Key directory reachable
+  ok   Directory publishes this key
+  ok   Directory response is signed
+
+Cloudflare — Verified Bots
+  form   https://dash.cloudflare.com/?to=/:account/configurations
+    Bot / agent name          your-bot.example
+    User-Agent                wingfoot/0.1.0 (+https://github.com/AmirF194/wingfoot)
+    Key directory URL         https://your-bot.example/.well-known/http-message-signatures-directory
+    ...
+```
+
+Add `--open` to launch the forms in your browser, or name one provider: `wingfoot register datadome`.
+
+## Commands
+
+| Command | What it does |
+|---------|--------------|
+| `wingfoot demo` | Run the unsigned/signed flow against a local verifier. No setup. |
+| `wingfoot init --agent <url>` | Create a lasting identity (keypair + directory). |
+| `wingfoot directory` | Print the JWKS to host at the well-known path. |
+| `wingfoot serve` | Serve your key directory locally (and verify requests). |
+| `wingfoot sign <url>` | Send a Web-Bot-Auth-signed request. |
+| `wingfoot doctor <url>` | Diagnose why a URL blocks or accepts your signed agent. |
+| `wingfoot register [provider]` | Preflight your setup, then print what to paste into each verifier's registration form. |
+| `wingfoot verifier` | Run a reference verifier for others to test against. |
+
+## Use it in your code
+
+Signing is one line — hand a wingfoot auth object to the HTTP client you already use. Every
+outbound request gets a fresh Web Bot Auth signature (re-signed per call, so it never expires
+mid-session). Run `wingfoot init --agent <url>` once, then:
+
+```python
+import requests, wingfoot
+requests.get("https://example.com/", auth=wingfoot.requests_auth())
+
+import httpx, wingfoot
+httpx.get("https://example.com/", auth=wingfoot.httpx_auth())
+```
+
+`requests` and `httpx` are optional extras (`pip install "wingfoot[requests]"` /
+`"wingfoot[httpx]"`); wingfoot itself needs only `cryptography`. Driving a different client?
+`wingfoot.signed_headers(url)` returns the headers as a plain dict to merge in yourself.
+
+## How it works
+
+Web Bot Auth signs at least the `@authority` derived component and a `Signature-Agent` header,
+with the parameter `tag="web-bot-auth"`. Three request headers carry it:
+
+- `Signature-Agent`: the origin that hosts your key directory.
+- `Signature-Input`: the covered components plus `created`, `expires`, `keyid`, `tag`.
+- `Signature`: the Ed25519 signature over the RFC 9421 signature base.
+
+A verifier fetches `<Signature-Agent>/.well-known/http-message-signatures-directory` (a JWKS),
+looks up the key by its RFC 7638 thumbprint (`keyid`), and verifies the signature. The
+implementation of that slice lives in [`src/wingfoot/rfc9421.py`](src/wingfoot/rfc9421.py).
+
+## Status
+
+Alpha (v0.1). Signing, verification, the directory, and doctor work and are covered by tests
+against a reference verifier. Interoperability with a specific CDN depends on that CDN having your
+registered key. Doctor confirms your side is correct so you can register with confidence.
+
+Drop-in signing for `requests` and `httpx` ships now (see
+[Use it in your code](#use-it-in-your-code)).
+
+Planned:
+
+- Doctor checks for Cloudflare and Akamai rejection signals.
+- Middleware for `aiohttp`, plus an async `httpx` example.
+- A TypeScript/Node port.
+
+Issues and PRs welcome. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## References
+
+- [RFC 9421: HTTP Message Signatures](https://www.rfc-editor.org/info/rfc9421/)
+- [Web Bot Auth (Cloudflare docs)](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/)
+- [cloudflare/web-bot-auth](https://github.com/cloudflare/web-bot-auth)
+- [HTTP Message Signatures Directory draft](https://www.ietf.org/archive/id/draft-meunier-http-message-signatures-directory-01.html)

wingfoot-0.1.0/README.md

@@ -0,0 +1,185 @@
+# wingfoot
+
+[![CI](https://github.com/AmirF194/wingfoot/actions/workflows/ci.yml/badge.svg)](https://github.com/AmirF194/wingfoot/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+![Python](https://img.shields.io/badge/python-3.9%2B-blue)
+
+<p align="center">
+  <img src="media/wingfoot-doctor.gif" alt="wingfoot doctor: a blocked 403 request becomes a verified 200 OK" width="760">
+</p>
+
+<p align="center"><em><code>wingfoot doctor</code> sends a signed request, reads the response, and tells you why a blocked <code>403</code> becomes a verified <code>200</code>.</em></p>
+
+Verified-bot identity for AI agents, using Web Bot Auth (a profile of
+[RFC 9421](https://www.rfc-editor.org/info/rfc9421/) HTTP Message Signatures).
+
+Sign your agent's outbound HTTP requests with an Ed25519 key, publish the public key at a
+well-known directory, and check whether a site accepts the signature. Includes a `doctor`
+command that sends a signed request and reports why it was accepted or rejected.
+
+Background: Cloudflare, Akamai, and Fastly increasingly block AI agents and crawlers by default.
+[Web Bot Auth](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/)
+lets a legitimate agent prove its identity instead of being treated as a hostile scraper. Setting
+it up by hand is fiddly, and a failed signature usually just returns `403` with no explanation.
+
+## Install
+
+Not on PyPI yet, so install from source:
+
+```bash
+git clone https://github.com/AmirF194/wingfoot
+cd wingfoot
+pip install -e .
+wingfoot demo
+```
+
+Python 3.9+. The only runtime dependency is `cryptography`.
+
+## Demo
+
+`wingfoot demo` starts a local reference verifier, sends one unsigned request and one signed
+request, and prints the result. It runs in a single process, so it works offline with no setup.
+
+```console
+$ wingfoot demo
+
+1. Unsigned request
+   HTTP 403 Forbidden   missing Signature-Input header
+
+2. Signed request
+   HTTP 200 OK          verified (keyid ig0azrI2bZdo...)
+```
+
+## Usage
+
+```bash
+# create a keypair and a key directory
+wingfoot init --agent https://your-bot.example
+
+# print the JWKS to publish at /.well-known/http-message-signatures-directory
+wingfoot directory
+
+# send a signed request
+wingfoot sign https://example.com/
+
+# check why a URL accepts or rejects your signed agent
+wingfoot doctor https://example.com/
+
+# get a ready-to-paste registration packet for Cloudflare, DataDome, ...
+wingfoot register --email you@example.com
+```
+
+`wingfoot doctor` sends a signed request, reads the response, and prints a checklist:
+
+```console
+$ wingfoot doctor http://localhost:8088/whoami
+
+  ok   Bot identity                       keyid RtsLV3gfcK73Ql4_...
+  ok   Signature is well-formed and cryptographically valid
+  ok   Key directory reachable and publishes this key
+  Probing the target
+  -    Unsigned request                   HTTP 403
+  ok   Signed request                     HTTP 200
+
+  Verified-bot access is working: signing changed HTTP 403 to 200.
+```
+
+When something is wrong it reports which check failed and how to fix it: expired signature, clock
+skew, unreachable directory, key not listed, missing `tag="web-bot-auth"`, and so on.
+
+## Register with verifiers
+
+A valid signature only helps once a verifier (Cloudflare, DataDome, ...) knows your key. None of
+them offer automated registration yet — each runs its own web form with a manual review behind
+it. `wingfoot register` shrinks that step to copy/paste: it first checks your hosted directory
+the way a reviewer would, then prints every answer their forms ask for:
+
+```console
+$ wingfoot register --email you@example.com
+
+Preflight — what a reviewer will check
+  ok   Key directory reachable
+  ok   Directory publishes this key
+  ok   Directory response is signed
+
+Cloudflare — Verified Bots
+  form   https://dash.cloudflare.com/?to=/:account/configurations
+    Bot / agent name          your-bot.example
+    User-Agent                wingfoot/0.1.0 (+https://github.com/AmirF194/wingfoot)
+    Key directory URL         https://your-bot.example/.well-known/http-message-signatures-directory
+    ...
+```
+
+Add `--open` to launch the forms in your browser, or name one provider: `wingfoot register datadome`.
+
+## Commands
+
+| Command | What it does |
+|---------|--------------|
+| `wingfoot demo` | Run the unsigned/signed flow against a local verifier. No setup. |
+| `wingfoot init --agent <url>` | Create a lasting identity (keypair + directory). |
+| `wingfoot directory` | Print the JWKS to host at the well-known path. |
+| `wingfoot serve` | Serve your key directory locally (and verify requests). |
+| `wingfoot sign <url>` | Send a Web-Bot-Auth-signed request. |
+| `wingfoot doctor <url>` | Diagnose why a URL blocks or accepts your signed agent. |
+| `wingfoot register [provider]` | Preflight your setup, then print what to paste into each verifier's registration form. |
+| `wingfoot verifier` | Run a reference verifier for others to test against. |
+
+## Use it in your code
+
+Signing is one line — hand a wingfoot auth object to the HTTP client you already use. Every
+outbound request gets a fresh Web Bot Auth signature (re-signed per call, so it never expires
+mid-session). Run `wingfoot init --agent <url>` once, then:
+
+```python
+import requests, wingfoot
+requests.get("https://example.com/", auth=wingfoot.requests_auth())
+
+import httpx, wingfoot
+httpx.get("https://example.com/", auth=wingfoot.httpx_auth())
+```
+
+`requests` and `httpx` are optional extras (`pip install "wingfoot[requests]"` /
+`"wingfoot[httpx]"`); wingfoot itself needs only `cryptography`. Driving a different client?
+`wingfoot.signed_headers(url)` returns the headers as a plain dict to merge in yourself.
+
+## How it works
+
+Web Bot Auth signs at least the `@authority` derived component and a `Signature-Agent` header,
+with the parameter `tag="web-bot-auth"`. Three request headers carry it:
+
+- `Signature-Agent`: the origin that hosts your key directory.
+- `Signature-Input`: the covered components plus `created`, `expires`, `keyid`, `tag`.
+- `Signature`: the Ed25519 signature over the RFC 9421 signature base.
+
+A verifier fetches `<Signature-Agent>/.well-known/http-message-signatures-directory` (a JWKS),
+looks up the key by its RFC 7638 thumbprint (`keyid`), and verifies the signature. The
+implementation of that slice lives in [`src/wingfoot/rfc9421.py`](src/wingfoot/rfc9421.py).
+
+## Status
+
+Alpha (v0.1). Signing, verification, the directory, and doctor work and are covered by tests
+against a reference verifier. Interoperability with a specific CDN depends on that CDN having your
+registered key. Doctor confirms your side is correct so you can register with confidence.
+
+Drop-in signing for `requests` and `httpx` ships now (see
+[Use it in your code](#use-it-in-your-code)).
+
+Planned:
+
+- Doctor checks for Cloudflare and Akamai rejection signals.
+- Middleware for `aiohttp`, plus an async `httpx` example.
+- A TypeScript/Node port.
+
+Issues and PRs welcome. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## References
+
+- [RFC 9421: HTTP Message Signatures](https://www.rfc-editor.org/info/rfc9421/)
+- [Web Bot Auth (Cloudflare docs)](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/)
+- [cloudflare/web-bot-auth](https://github.com/cloudflare/web-bot-auth)
+- [HTTP Message Signatures Directory draft](https://www.ietf.org/archive/id/draft-meunier-http-message-signatures-directory-01.html)

wingfoot-0.1.0/pyproject.toml

@@ -0,0 +1,37 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "wingfoot"
+version = "0.1.0"
+description = "Verified-bot identity for AI agents (Web Bot Auth / RFC 9421), with a doctor that reports why a request was blocked."
+readme = "README.md"
+requires-python = ">=3.9"
+license = "MIT"
+authors = [{ name = "AmirF194" }]
+keywords = ["web-bot-auth", "rfc9421", "http-message-signatures", "ai-agents", "crawler", "bot-verification", "cloudflare"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Topic :: Internet :: WWW/HTTP",
+  "Topic :: Security :: Cryptography",
+]
+dependencies = ["cryptography>=41"]
+
+[project.optional-dependencies]
+requests = ["requests>=2"]
+httpx = ["httpx>=0.23"]
+test = ["pytest>=7", "requests>=2", "httpx>=0.23"]
+
+[project.urls]
+Homepage = "https://github.com/AmirF194/wingfoot"
+Issues = "https://github.com/AmirF194/wingfoot/issues"
+
+[project.scripts]
+wingfoot = "wingfoot.cli:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/wingfoot"]

wingfoot-0.1.0/src/wingfoot/__init__.py

@@ -0,0 +1,22 @@
+"""wingfoot: verified-bot identity for AI agents.
+
+A toolkit around Web Bot Auth (a profile of RFC 9421 HTTP Message Signatures). Sign your
+agent's outbound requests with an Ed25519 key, publish the public key at a `.well-known`
+directory, and diagnose why a site blocked a signed request.
+"""
+
+__version__ = "0.1.0"
+
+DIRECTORY_PATH = "/.well-known/http-message-signatures-directory"
+WEB_BOT_AUTH_TAG = "web-bot-auth"
+# Tag for the signature ON the key directory response itself (RFC 9421 directory
+# draft §5.2), distinct from the per-request WEB_BOT_AUTH_TAG. Verifiers such as
+# Cloudflare require the directory to carry its own signature so no one can mirror
+# it and register on your behalf.
+DIRECTORY_TAG = "http-message-signatures-directory"
+
+# Drop-in signing for requests / httpx. Imported last so the constants above are
+# already defined (integrations -> rfc9421 -> `from . import WEB_BOT_AUTH_TAG`).
+from .integrations import httpx_auth, requests_auth, signed_headers  # noqa: E402
+
+__all__ = ["httpx_auth", "requests_auth", "signed_headers", "__version__"]

wingfoot-0.1.0/src/wingfoot/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())