xtr-http-kernel 1.5.0__tar.gz → 3.0.0__tar.gz

xtr_http_kernel-1.5.0/README.md → xtr_http_kernel-3.0.0/PKG-INFO

@@ -1,3 +1,37 @@
+Metadata-Version: 2.4
+Name: xtr-http-kernel
+Version: 3.0.0
+Summary: Requests turned into responses through events: a request lifecycle for FastAPI applications on the xtr kernel.
+Keywords: http,kernel,request,lifecycle,events,middleware,fastapi
+Author: Xterr
+Author-email: Xterr <me@xterr.dev>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Typing :: Typed
+Requires-Dist: fastapi>=0.121.3
+Requires-Dist: starlette>=0.40
+Requires-Dist: xtr-dependency-injection[fastapi]>=3.0,<4
+Requires-Dist: xtr-event-dispatcher>=3.0,<4
+Requires-Dist: xtr-event-dispatcher-contracts>=3.0,<4
+Requires-Dist: xtr-logging-contracts>=3.0,<4
+Requires-Dist: xtr-service-contracts>=3.0,<4
+Requires-Dist: typing-extensions>=4.4
+Requires-Dist: xtr-console>=3.0,<4 ; extra == 'console'
+Requires-Dist: xtr-logging>=3.0,<4 ; extra == 'logging'
+Requires-Dist: xtr-clock>=3.0,<4 ; extra == 'rate-limiter'
+Requires-Dist: xtr-rate-limiter[di]>=3.0,<4 ; extra == 'rate-limiter'
+Requires-Python: >=3.11
+Provides-Extra: console
+Provides-Extra: logging
+Provides-Extra: rate-limiter
+Description-Content-Type: text/markdown
+
 <div align="center">
 
 # xtr-http-kernel
@@ -38,6 +72,7 @@ Listeners are services, so they come from the container with everything else the
 uv add xtr-http-kernel                      # the lifecycle, its bundle and setup
 uv add "xtr-http-kernel[logging]"           # + the listeners that log
 uv add "xtr-http-kernel[console]"           # + the commands that report on the router
+uv add "xtr-http-kernel[rate-limiter]"      # + rate limits on routes, routers and the app
 ```
 
 Requires Python 3.11+. The web framework and the container layer come with the package
@@ -124,7 +159,7 @@ contribute. Each is dispatched at most once, however the request went:
 |---|---|---|---|
 | `RequestEvent` | `REQUEST` | it arrived, nothing has looked at it | read it, or `set_response(...)` to answer instead of the application |
 | `ResponseEvent` | `RESPONSE` | a response is about to start | assign `status_code`, change `headers` in place |
-| `ExceptionEvent` | `EXCEPTION` | handling raised, nothing was sent | read `exception`, or `set_response(...)` to answer with it |
+| `ExceptionEvent` | `EXCEPTION` | handling raised, nothing was sent | read `exception`, or `set_response(...)` to answer with it — an `Exception` only: a cancellation, interrupt or exit is announced and goes on |
 | `FinishRequestEvent` | `FINISH_REQUEST` | handling finished — **on every path** | put away what the request set up |
 | `TerminateEvent` | `TERMINATE` | everything was sent | work worth doing once the caller has their answer |
 
@@ -194,11 +229,87 @@ The bundle registers these; which ones depend on what is installed and active:
 | `DisallowRobotsIndexingListener` | `ResponseEvent` | always | stamps `X-Robots-Tag: noindex` on every response, when the config turns it on |
 | `LogUnitListener` | `RequestEvent`, `TerminateEvent` | logging bundle active | opens a [logging unit of work](../xtr-logging#units-of-work) per request and closes it once all was sent |
 | `ErrorLoggingListener` | `ExceptionEvent` | logging bundle active | writes every uncaught exception to the request channel — `error` below a 500 status, `critical` otherwise — leaving the response to whoever answers it |
+| `RateLimitHeadersListener` | `ResponseEvent` | rate limiter bundle active | writes the `X-RateLimit-*` headers of the [rate limit](#rate-limits) that speaks for the response, and makes it private |
 
 The two logging listeners join only when the logging bundle is active, and open and close the
 unit of work outside everything else so every record made while handling carries the request's
 id. The request id settles right after the unit opens, for the same reason.
 
+## Rate limits
+
+With the `rate-limiter` extra, a route, a router or the whole application can be held to a
+limiter configured in [xtr-rate-limiter](../xtr-rate-limiter)'s bundle. `RateLimited` is one
+declaration, written as a decorator or wherever the framework takes a dependency:
+
+```python
+from fastapi import APIRouter, FastAPI, Request
+
+from xtr_http_kernel.rate_limiter import RateLimited
+
+app = FastAPI(dependencies=[RateLimited("global")])  # every route
+
+
+@app.get("/books")
+@RateLimited("api", expose_headers=True)  # below the route decorator
+async def list_books() -> list[Book]: ...
+
+
+def by_username(request: Request) -> str:
+    return request.headers.get("x-username", "anonymous")
+
+
+@app.post("/login", dependencies=[RateLimited("login", key=by_username, methods="post")])
+async def login() -> None: ...
+
+
+reports = RateLimited("reports")(APIRouter(prefix="/reports"))  # before its routes
+app.include_router(admin, dependencies=[RateLimited("admin")])  # or when included
+```
+
+- **Where it runs.** After routing and before the endpoint: routing is the framework's, so the
+  limit is a dependency rather than a lifecycle listener, and runs in the framework's order —
+  the application's, the routers', then the route's. As a decorator it must sit **below** the
+  route decorator, which reads the endpoint when the route is declared; a router must be
+  limited **before** routes are added, since each route copies its router's dependencies.
+- **What a request is counted under.** `key` is a string, or a function of the request —
+  awaited when it returns an awaitable. By default: the client's address, the method and the
+  route's path template — `/books/{isbn}`, so asking for another book never earns a fresh
+  limit. Behind a proxy the address is the proxy's unless the server trusts its forwarded
+  headers (uvicorn's `--forwarded-allow-ips`).
+- **`tokens`** a request consumes, and **`methods`** limited — every one when empty; `GET` also
+  limits `HEAD`.
+- **A refusal** is answered `429 Too Many Requests` with `Retry-After`, raised as
+  `TooManyRequestsError` — the framework's own HTTP exception, so an exception handler
+  registered for it reshapes the body. A `RateLimitExceededEvent` naming the limiter and the key
+  is dispatched first. Limits consulted before a refusal keep their spend.
+- **Headers.** With `expose_headers=True` the response carries `X-RateLimit-Limit`,
+  `X-RateLimit-Remaining` and `X-RateLimit-Reset`, in calls rather than tokens, for the limit
+  closest to refusing among those exposing theirs; a refusing limit always speaks, and one that
+  keeps its state to itself leaves the response without them. The response is made private, so
+  a shared cache never serves one caller's count to another.
+- **The published schema** is untouched: the limit never appears as a parameter.
+
+A limiter the application did not configure fails the request with `UnknownRateLimiterError`,
+naming the ones it did. To limit by hand — throttling logins only on failure, say — inject the
+limiter by name like any service:
+
+```python
+from typing import Annotated
+
+from xtr_dependency_injection import Target
+from xtr_rate_limiter import RateLimiterFactoryInterface
+
+
+@app.post("/login")
+async def login(
+    limiter: Annotated[RateLimiterFactoryInterface, Target("login")],
+) -> None:
+    limit = limiter.create(username)
+    if not (await limit.consume(0)).is_accepted():
+        raise TooManyAttempts
+    ...
+```
+
 ## Use in an application
 
 Everything adding this package to an application on
@@ -206,13 +317,16 @@ Everything adding this package to an application on
 removing it undoes.
 
 - **Install** — `uv add "xtr-http-kernel[logging,console]"`; `logging` brings the listeners
-  that write to a log, `console` the commands that report on the router. Neither is needed to
-  serve requests.
+  that write to a log, `console` the commands that report on the router, `rate-limiter` the
+  [rate limits](#rate-limits). None is needed to serve requests.
+- **Recipe** — `uv run xtr-recipes recipes:sync` does the *Activate* step below: it lists
+  `HttpKernelBundle`. There is no config file, environment or ignore line to write; it prints the
+  `setup(app, kernel)` step, which a recipe cannot make for you.
 - **Activate** — `HttpKernelBundle: {"all": True}` in `BUNDLES` in `<app>/bundles.py`, imported
   from `xtr_http_kernel.bundle`. Then call `setup(app, kernel)` where the application is built.
 - **Brings along** — the [event dispatcher](../xtr-event-dispatcher) bundle always, because the
-  lifecycle dispatches through it; the [logging](../xtr-logging) and [console](../xtr-console)
-  bundles whenever those packages are *installed* — they are required peers, pulled in and made
+  lifecycle dispatches through it; the [logging](../xtr-logging), [console](../xtr-console) and
+  [rate limiter](../xtr-rate-limiter) bundles whenever those packages are *installed* — they are required peers, pulled in and made
   active without being listed, and left out silently when the package is not installed. Listing
   is not what activates them; installing the extra is.
 - **Configure** — nothing is required: the zero-config path gives a `uuid4` request id under
@@ -243,7 +357,7 @@ default:
 
 The constructor refuses values the lifecycle would silently misread: a `request_id_header` that
 is not an HTTP token, an empty `log_channel`, or an `app` that is not exactly one module and one
-attribute around a single `:`, each raise `ValueError`.
+attribute around a single `:`, each raise `InvalidArgumentError` — also a `ValueError`.
 
 The bundle declares the default `log_channel` on the logging config for you. An application
 renaming it must declare the new channel in its own logging configuration — this bundle's
@@ -352,6 +466,8 @@ async def test_it_uses_the_fake_catalogue() -> None:
 ```
 
 A key is a type, or a `(type, qualifier)` pair for a qualified service.
+The overrides live on the application itself, so two tests serving one application must not
+run at the same time: the block that exits last would restore what the other replaced.
 
 ## Errors
 
@@ -360,7 +476,11 @@ typed attributes rather than only a message.
 
 | Error | Raised when |
 |---|---|
+| `InvalidArgumentError` | an `HttpKernelConfig` field holds a value the lifecycle would misread; also a `ValueError` |
 | `InvalidMiddlewarePriorityError` | a `http_kernel.middleware` tag's `priority` is not an integer |
+| `InvalidRateLimitError` | a `RateLimited` takes fewer than one token, limits a router that already has routes, or its key function returns no string; also a `ValueError` |
+| `TooManyRequestsError` | a limiter refused the request — a 429 the framework answers, with `Retry-After` |
+| `UnknownRateLimiterError` | a `RateLimited` names a limiter the application did not configure; also a `LookupError` |
 
 ## Layout
 
@@ -374,6 +494,7 @@ xtr_http_kernel/
 ├── request_lifecycle_middleware.py the middleware that dispatches the events
 ├── middleware_stack.py             the ordered chain a bundle contributes to
 ├── middleware_tag.py               MIDDLEWARE_TAG, the tag bundles agree on
+├── rate_limiter/                   RateLimited, with the rate-limiter extra
 ├── command/                        debug:router and router:match
 ├── exception/                      HttpKernelError, the root of everything this library raises
 └── bundle/                         HttpKernelBundle and HttpKernelConfig

xtr_http_kernel-1.5.0/PKG-INFO → xtr_http_kernel-3.0.0/README.md

@@ -1,34 +1,3 @@
-Metadata-Version: 2.4
-Name: xtr-http-kernel
-Version: 1.5.0
-Summary: Requests turned into responses through events: a request lifecycle for FastAPI applications on the xtr kernel.
-Keywords: http,kernel,request,lifecycle,events,middleware,fastapi
-Author: Xterr
-Author-email: Xterr <me@xterr.dev>
-License-Expression: MIT
-License-File: LICENSE
-Classifier: Development Status :: 3 - Alpha
-Classifier: Intended Audience :: Developers
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Programming Language :: Python :: 3.14
-Classifier: Typing :: Typed
-Requires-Dist: fastapi>=0.121.3
-Requires-Dist: starlette>=0.40
-Requires-Dist: xtr-dependency-injection[fastapi]>=1.0,<2
-Requires-Dist: xtr-event-dispatcher>=1.0,<2
-Requires-Dist: xtr-event-dispatcher-contracts>=1.0,<2
-Requires-Dist: xtr-logging-contracts>=1.0,<2
-Requires-Dist: xtr-service-contracts>=1.0,<2
-Requires-Dist: typing-extensions>=4.4
-Requires-Dist: xtr-console>=1.0,<2 ; extra == 'console'
-Requires-Dist: xtr-logging>=1.0,<2 ; extra == 'logging'
-Requires-Python: >=3.11
-Provides-Extra: console
-Provides-Extra: logging
-Description-Content-Type: text/markdown
-
 <div align="center">
 
 # xtr-http-kernel
@@ -69,6 +38,7 @@ Listeners are services, so they come from the container with everything else the
 uv add xtr-http-kernel                      # the lifecycle, its bundle and setup
 uv add "xtr-http-kernel[logging]"           # + the listeners that log
 uv add "xtr-http-kernel[console]"           # + the commands that report on the router
+uv add "xtr-http-kernel[rate-limiter]"      # + rate limits on routes, routers and the app
 ```
 
 Requires Python 3.11+. The web framework and the container layer come with the package
@@ -155,7 +125,7 @@ contribute. Each is dispatched at most once, however the request went:
 |---|---|---|---|
 | `RequestEvent` | `REQUEST` | it arrived, nothing has looked at it | read it, or `set_response(...)` to answer instead of the application |
 | `ResponseEvent` | `RESPONSE` | a response is about to start | assign `status_code`, change `headers` in place |
-| `ExceptionEvent` | `EXCEPTION` | handling raised, nothing was sent | read `exception`, or `set_response(...)` to answer with it |
+| `ExceptionEvent` | `EXCEPTION` | handling raised, nothing was sent | read `exception`, or `set_response(...)` to answer with it — an `Exception` only: a cancellation, interrupt or exit is announced and goes on |
 | `FinishRequestEvent` | `FINISH_REQUEST` | handling finished — **on every path** | put away what the request set up |
 | `TerminateEvent` | `TERMINATE` | everything was sent | work worth doing once the caller has their answer |
 
@@ -225,11 +195,87 @@ The bundle registers these; which ones depend on what is installed and active:
 | `DisallowRobotsIndexingListener` | `ResponseEvent` | always | stamps `X-Robots-Tag: noindex` on every response, when the config turns it on |
 | `LogUnitListener` | `RequestEvent`, `TerminateEvent` | logging bundle active | opens a [logging unit of work](../xtr-logging#units-of-work) per request and closes it once all was sent |
 | `ErrorLoggingListener` | `ExceptionEvent` | logging bundle active | writes every uncaught exception to the request channel — `error` below a 500 status, `critical` otherwise — leaving the response to whoever answers it |
+| `RateLimitHeadersListener` | `ResponseEvent` | rate limiter bundle active | writes the `X-RateLimit-*` headers of the [rate limit](#rate-limits) that speaks for the response, and makes it private |
 
 The two logging listeners join only when the logging bundle is active, and open and close the
 unit of work outside everything else so every record made while handling carries the request's
 id. The request id settles right after the unit opens, for the same reason.
 
+## Rate limits
+
+With the `rate-limiter` extra, a route, a router or the whole application can be held to a
+limiter configured in [xtr-rate-limiter](../xtr-rate-limiter)'s bundle. `RateLimited` is one
+declaration, written as a decorator or wherever the framework takes a dependency:
+
+```python
+from fastapi import APIRouter, FastAPI, Request
+
+from xtr_http_kernel.rate_limiter import RateLimited
+
+app = FastAPI(dependencies=[RateLimited("global")])  # every route
+
+
+@app.get("/books")
+@RateLimited("api", expose_headers=True)  # below the route decorator
+async def list_books() -> list[Book]: ...
+
+
+def by_username(request: Request) -> str:
+    return request.headers.get("x-username", "anonymous")
+
+
+@app.post("/login", dependencies=[RateLimited("login", key=by_username, methods="post")])
+async def login() -> None: ...
+
+
+reports = RateLimited("reports")(APIRouter(prefix="/reports"))  # before its routes
+app.include_router(admin, dependencies=[RateLimited("admin")])  # or when included
+```
+
+- **Where it runs.** After routing and before the endpoint: routing is the framework's, so the
+  limit is a dependency rather than a lifecycle listener, and runs in the framework's order —
+  the application's, the routers', then the route's. As a decorator it must sit **below** the
+  route decorator, which reads the endpoint when the route is declared; a router must be
+  limited **before** routes are added, since each route copies its router's dependencies.
+- **What a request is counted under.** `key` is a string, or a function of the request —
+  awaited when it returns an awaitable. By default: the client's address, the method and the
+  route's path template — `/books/{isbn}`, so asking for another book never earns a fresh
+  limit. Behind a proxy the address is the proxy's unless the server trusts its forwarded
+  headers (uvicorn's `--forwarded-allow-ips`).
+- **`tokens`** a request consumes, and **`methods`** limited — every one when empty; `GET` also
+  limits `HEAD`.
+- **A refusal** is answered `429 Too Many Requests` with `Retry-After`, raised as
+  `TooManyRequestsError` — the framework's own HTTP exception, so an exception handler
+  registered for it reshapes the body. A `RateLimitExceededEvent` naming the limiter and the key
+  is dispatched first. Limits consulted before a refusal keep their spend.
+- **Headers.** With `expose_headers=True` the response carries `X-RateLimit-Limit`,
+  `X-RateLimit-Remaining` and `X-RateLimit-Reset`, in calls rather than tokens, for the limit
+  closest to refusing among those exposing theirs; a refusing limit always speaks, and one that
+  keeps its state to itself leaves the response without them. The response is made private, so
+  a shared cache never serves one caller's count to another.
+- **The published schema** is untouched: the limit never appears as a parameter.
+
+A limiter the application did not configure fails the request with `UnknownRateLimiterError`,
+naming the ones it did. To limit by hand — throttling logins only on failure, say — inject the
+limiter by name like any service:
+
+```python
+from typing import Annotated
+
+from xtr_dependency_injection import Target
+from xtr_rate_limiter import RateLimiterFactoryInterface
+
+
+@app.post("/login")
+async def login(
+    limiter: Annotated[RateLimiterFactoryInterface, Target("login")],
+) -> None:
+    limit = limiter.create(username)
+    if not (await limit.consume(0)).is_accepted():
+        raise TooManyAttempts
+    ...
+```
+
 ## Use in an application
 
 Everything adding this package to an application on
@@ -237,13 +283,16 @@ Everything adding this package to an application on
 removing it undoes.
 
 - **Install** — `uv add "xtr-http-kernel[logging,console]"`; `logging` brings the listeners
-  that write to a log, `console` the commands that report on the router. Neither is needed to
-  serve requests.
+  that write to a log, `console` the commands that report on the router, `rate-limiter` the
+  [rate limits](#rate-limits). None is needed to serve requests.
+- **Recipe** — `uv run xtr-recipes recipes:sync` does the *Activate* step below: it lists
+  `HttpKernelBundle`. There is no config file, environment or ignore line to write; it prints the
+  `setup(app, kernel)` step, which a recipe cannot make for you.
 - **Activate** — `HttpKernelBundle: {"all": True}` in `BUNDLES` in `<app>/bundles.py`, imported
   from `xtr_http_kernel.bundle`. Then call `setup(app, kernel)` where the application is built.
 - **Brings along** — the [event dispatcher](../xtr-event-dispatcher) bundle always, because the
-  lifecycle dispatches through it; the [logging](../xtr-logging) and [console](../xtr-console)
-  bundles whenever those packages are *installed* — they are required peers, pulled in and made
+  lifecycle dispatches through it; the [logging](../xtr-logging), [console](../xtr-console) and
+  [rate limiter](../xtr-rate-limiter) bundles whenever those packages are *installed* — they are required peers, pulled in and made
   active without being listed, and left out silently when the package is not installed. Listing
   is not what activates them; installing the extra is.
 - **Configure** — nothing is required: the zero-config path gives a `uuid4` request id under
@@ -274,7 +323,7 @@ default:
 
 The constructor refuses values the lifecycle would silently misread: a `request_id_header` that
 is not an HTTP token, an empty `log_channel`, or an `app` that is not exactly one module and one
-attribute around a single `:`, each raise `ValueError`.
+attribute around a single `:`, each raise `InvalidArgumentError` — also a `ValueError`.
 
 The bundle declares the default `log_channel` on the logging config for you. An application
 renaming it must declare the new channel in its own logging configuration — this bundle's
@@ -383,6 +432,8 @@ async def test_it_uses_the_fake_catalogue() -> None:
 ```
 
 A key is a type, or a `(type, qualifier)` pair for a qualified service.
+The overrides live on the application itself, so two tests serving one application must not
+run at the same time: the block that exits last would restore what the other replaced.
 
 ## Errors
 
@@ -391,7 +442,11 @@ typed attributes rather than only a message.
 
 | Error | Raised when |
 |---|---|
+| `InvalidArgumentError` | an `HttpKernelConfig` field holds a value the lifecycle would misread; also a `ValueError` |
 | `InvalidMiddlewarePriorityError` | a `http_kernel.middleware` tag's `priority` is not an integer |
+| `InvalidRateLimitError` | a `RateLimited` takes fewer than one token, limits a router that already has routes, or its key function returns no string; also a `ValueError` |
+| `TooManyRequestsError` | a limiter refused the request — a 429 the framework answers, with `Retry-After` |
+| `UnknownRateLimiterError` | a `RateLimited` names a limiter the application did not configure; also a `LookupError` |
 
 ## Layout
 
@@ -405,6 +460,7 @@ xtr_http_kernel/
 ├── request_lifecycle_middleware.py the middleware that dispatches the events
 ├── middleware_stack.py             the ordered chain a bundle contributes to
 ├── middleware_tag.py               MIDDLEWARE_TAG, the tag bundles agree on
+├── rate_limiter/                   RateLimited, with the rate-limiter extra
 ├── command/                        debug:router and router:match
 ├── exception/                      HttpKernelError, the root of everything this library raises
 └── bundle/                         HttpKernelBundle and HttpKernelConfig

{xtr_http_kernel-1.5.0 → xtr_http_kernel-3.0.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "xtr-http-kernel"
-version = "1.5.0"
+version = "3.0.0"
 description = "Requests turned into responses through events: a request lifecycle for FastAPI applications on the xtr kernel."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -27,11 +27,11 @@ classifiers = [
 dependencies = [
     "fastapi>=0.121.3",
     "starlette>=0.40",
-    "xtr-dependency-injection[fastapi]>=1.0,<2",
-    "xtr-event-dispatcher>=1.0,<2",
-    "xtr-event-dispatcher-contracts>=1.0,<2",
-    "xtr-logging-contracts>=1.0,<2",
-    "xtr-service-contracts>=1.0,<2",
+    "xtr-dependency-injection[fastapi]>=3.0,<4",
+    "xtr-event-dispatcher>=3.0,<4",
+    "xtr-event-dispatcher-contracts>=3.0,<4",
+    "xtr-logging-contracts>=3.0,<4",
+    "xtr-service-contracts>=3.0,<4",
     "typing-extensions>=4.4",
 ]
 
@@ -40,12 +40,19 @@ name = "Xterr"
 email = "me@xterr.dev"
 
 [project.optional-dependencies]
-logging = ["xtr-logging>=1.0,<2"]
-console = ["xtr-console>=1.0,<2"]
+logging = ["xtr-logging>=3.0,<4"]
+console = ["xtr-console>=3.0,<4"]
+rate-limiter = [
+    "xtr-clock>=3.0,<4",
+    "xtr-rate-limiter[di]>=3.0,<4",
+]
 
 [project.entry-points."xtr_dependency_injection.bundles"]
 http_kernel = "xtr_http_kernel.bundle:HttpKernelBundle"
 
+[project.entry-points.xtr_recipes]
+http_kernel = "xtr_http_kernel.recipe"
+
 [dependency-groups]
 dev = [
     "basedpyright>=1.21",
@@ -54,8 +61,10 @@ dev = [
     "pytest-cov>=5",
     "anyio>=4.0",
     "ty>=0.0.83",
-    "xtr-logging>=1.0,<2",
-    "xtr-console>=1.0,<2",
+    "xtr-logging>=3.0,<4",
+    "xtr-console>=3.0,<4",
+    "xtr-clock>=3.0,<4",
+    "xtr-rate-limiter[di]>=3.0,<4",
     "httpx>=0.27",
 ]
 

{xtr_http_kernel-1.5.0 → xtr_http_kernel-3.0.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "xtr-http-kernel"
-version = "1.5.0"
+version = "3.0.0"
 description = "Requests turned into responses through events: a request lifecycle for FastAPI applications on the xtr kernel."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -26,20 +26,24 @@ dependencies = [
     "fastapi>=0.121.3",
     # Imported directly — requests, responses, middleware — not only through fastapi.
     "starlette>=0.40",
-    "xtr-dependency-injection[fastapi]>=1.0,<2",
-    "xtr-event-dispatcher>=1.0,<2",
-    "xtr-event-dispatcher-contracts>=1.0,<2",
-    "xtr-logging-contracts>=1.0,<2",
-    "xtr-service-contracts>=1.0,<2",
+    "xtr-dependency-injection[fastapi]>=3.0,<4",
+    "xtr-event-dispatcher>=3.0,<4",
+    "xtr-event-dispatcher-contracts>=3.0,<4",
+    "xtr-logging-contracts>=3.0,<4",
+    "xtr-service-contracts>=3.0,<4",
     "typing-extensions>=4.4",
 ]
 
 [project.optional-dependencies]
 logging = [
-    "xtr-logging>=1.0,<2",
+    "xtr-logging>=3.0,<4",
 ]
 console = [
-    "xtr-console>=1.0,<2",
+    "xtr-console>=3.0,<4",
+]
+rate-limiter = [
+    "xtr-clock>=3.0,<4",
+    "xtr-rate-limiter[di]>=3.0,<4",
 ]
 
 # Advertises the bundle so debug:bundles can name it when installed but not listed.
@@ -47,6 +51,10 @@ console = [
 [project.entry-points."xtr_dependency_injection.bundles"]
 http_kernel = "xtr_http_kernel.bundle:HttpKernelBundle"
 
+# Advertises the recipe — what *Use in an application* takes — for recipes:sync.
+[project.entry-points."xtr_recipes"]
+http_kernel = "xtr_http_kernel.recipe"
+
 [dependency-groups]
 dev = [
     "basedpyright>=1.21",
@@ -55,8 +63,10 @@ dev = [
     "pytest-cov>=5",
     "anyio>=4.0",
     "ty>=0.0.83",
-    "xtr-logging>=1.0,<2",
-    "xtr-console>=1.0,<2",
+    "xtr-logging>=3.0,<4",
+    "xtr-console>=3.0,<4",
+    "xtr-clock>=3.0,<4",
+    "xtr-rate-limiter[di]>=3.0,<4",
     # Requests are driven straight at the application through an ASGI
     # transport, so the suite never binds a socket.
     "httpx>=0.27",