Metadata-Version: 2.4
Name: boldsec
Version: 0.1.0
Summary: BoLD live authorization monitoring for Python: the shared extraction core (a byte-parity port of @boldsec/core) plus the FastAPI adapter. Metadata only, fail-safe, zero extraction logic outside the core.
License: UNLICENSED
Requires-Python: >=3.10
Requires-Dist: httpx>=0.27
Provides-Extra: fastapi
Requires-Dist: fastapi>=0.115; extra == 'fastapi'
Requires-Dist: starlette>=0.37; extra == 'fastapi'
Description-Content-Type: text/markdown

# boldsec (Python)

BoLD live authorization monitoring for Python. `boldsec.core` is a hand-port of `@boldsec/core`
(the shared TypeScript extraction core): the same id/owner/scope/tenant/GraphQL extraction.
Verified against the JS core on the full shared golden conformance vector suite
(`web/sdk/bold-conformance/test-vectors*.json`, run end to end against a real FastAPI target),
the hand-lifted unit cases ported from `extract.test.ts`/`observe.test.ts`, a mechanical regex
battery generated from the real built `@boldsec/core` regex objects, and a set of differential
tests added specifically for traps a naive port would get wrong (JS's `Object.values()`
integer-index key reordering, the four-character JS line-terminator class, and JS
truthiness/`String()`/`??` semantics on off-contract resolver values). This is not a claim of
byte-parity on every conceivable input; see `boldsec/core.py`'s module docstring for the one
disclosed, bounded ceiling (a non-integer-fractional float's string representation).

`boldsec.fastapi` is the FastAPI adapter: a custom `APIRoute` subclass that reads the framework's
authoritative matched route param and the already-buffered request/response bodies, then hands a
`NeutralObservation` to `boldsec.core.observe_neutral()`, which composes and ships the metadata
event. The adapter contains zero extraction logic; it only translates.

Metadata only, fail-safe: no payloads, credentials, or response bodies are ever persisted or
logged, and any error inside the adapter can never break, slow, or alter the wrapped application's
response.

See `web/UNIVERSAL_SDK_PHASE_2_DESIGN.md` (Section B) and `web/UNIVERSAL_SDK_PHASE_2_BUILD_PLAN.md`
(Phase 2.2) for the governing design and build plan.
