chore: release 1.4.0

.editorconfig

@@ -0,0 +1,16 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[Makefile]
+indent_style = tab
+indent_size = 2

.github/workflows/docker.yml

@@ -1,26 +1,34 @@
 name: Docker CI
-on: [push]
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/docker.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - 'stapler/*'
+      - 'Dockerfile'
+
+env:
+  BUILDKIT_VERSION: 'v0.29.0'
+
 jobs:
-  build:
+  docker-build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: docker/setup-buildx-action@v1
-      - uses: actions/cache@v4
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Set up buildkit cache
+        uses: actions/cache@v4
         with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-
-      - uses: docker/build-push-action@v2
+          path: /var/lib/buildkit
+          key: ${{ runner.os }}-buildkit-${{ env.BUILDKIT_VERSION }}
+      - name: Test docker build
+        uses: klemek/dockerfile-test-build@v1
         with:
-          context: ./
-          file: ./Dockerfile
-          builder: ${{ steps.buildx.outputs.name }}
-          push: false
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache-new
-      - run: |
-          rm -rf /tmp/.buildx-cache
-          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
-      - run: echo ${{ steps.docker_build.outputs.digest }}
+          buildkit_version: ${{ env.BUILDKIT_VERSION }}

.github/workflows/lint.yml

@@ -0,0 +1,46 @@
+name: Python Lint CI
+
+concurrency:
+  group: lint-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/lint.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.python-version'
+      - '**/*.py'
+
+jobs:
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
+      - name: Run Ruff check
+        run: uv run ruff check --output-format=github
+
+  ruff-format-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
+      - name: Run Ruff format check
+        run: uv run ruff format --check --output-format=github
+
+  ty:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
+      - name: Run ty check
+        run: uv run ty check --output-format=github

.github/workflows/pythonci.yml

@@ -1,37 +0,0 @@
-name: Python CI
-on: [push]
-jobs: 
-  ruff:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/ruff-action@v3
-  
-  ruff-format-check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/ruff-action@v3
-        with:
-          args: "format --check --diff"
-
-  ty:
-    runs-on: ubuntu-latest
-    steps:
-      - run: python3 -m pip install uv
-      - uses: actions/checkout@v5
-      - run: python3 -m uv sync
-      - run: python3 -m uv run ty check --output-format github
-  
-  coverage:
-    runs-on: ubuntu-latest
-    steps:
-      - run: python3 -m pip install uv
-      - uses: actions/checkout@v5
-      - run: python3 -m uv sync
-      - run: python3 -m uv run coverage run -m unittest -v
-      - run: python3 -m uv run coverage xml
-      - uses: irongut/CodeCoverageSummary@v1.3.0
-        with:
-          filename: coverage.xml
-

.github/workflows/test.yml

@@ -0,0 +1,32 @@
+name: Python Test CI
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/test.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.python-version'
+      - '**/*.py'
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
+      - name: Run tests with coverage
+        run: uv run coverage run -m unittest -v
+      - name: Generate coverage XML report
+        run: uv run coverage xml
+      - name: Create coverage summary
+        uses: actions/code-coverage-summary@v1.3.0
+        with:
+          filename: coverage.xml

.gitignore

@@ -12,3 +12,4 @@ crontab
 *.egg-info
 build
 dist
+.pytest_cache

Dockerfile

@@ -8,7 +8,7 @@ ENV HTTP_PORT=80
 ENV HTTPS_PORT=443
 ENV HOST=localhost
 ENV DATA_DIR=/data
-ENV MAX_SIZE=2000000
+ENV MAX_SIZE=20000000
 ENV BIND=0.0.0.0
 ENV CERTBOT_CONF=/etc/letsencrypt
 ENV CERTBOT_WWW=/data/.certbot

Makefile

@@ -15,6 +15,7 @@ COVERAGE ?= $(UV) run --active coverage
 DOCKER ?= docker
 DOCKER_TAG ?= localhost/stapler:latest
 PORT ?= 8080
+OPEN ?= xdg-open
 
 # DOCS
 
@@ -116,6 +117,7 @@ coverage-report: .venv ## coverage report
 .PHONY: coverage-html
 coverage-html: .venv ## coverage html
 	@$(COVERAGE) html
+	@$(OPEN) htmlcov/index.html || true
 
 .PHONY: coverage-xml
 coverage-xml: .venv ## coverage xml

README.md

@@ -1,3 +1,5 @@
+[![](https://git.klemek.fr/klemek/stapler/actions/workflows/lint.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=lint.yml) [![](https://git.klemek.fr/klemek/stapler/actions/workflows/test.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=test.yml) [![](https://git.klemek.fr/klemek/stapler/actions/workflows/docker.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=docker.yml)
+
 # Stapler <!-- omit in toc -->
 
 *Static pages as simple as a gzip file*
@@ -105,6 +107,7 @@ PUT /{page}/
   X-Token (your API token)
   X-Host (optional host as entrypoint)
   X-Host-Only (optional host as entrypoint)
+  X-SPA (optional SPA file)
   (body with tar data)
 ```
 
@@ -112,18 +115,21 @@ PUT /{page}/
 # create archive from 'dist' dir and upload it to /my-project/
 tar -czC dist -f dist.tar.gz .
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   --data-binary "@dist.tar.gz" \
   https://stapler-host/my-project/
 
 # same thing but one-liner
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   --data-binary @- \
   https://stapler-host/my-project/
 
-# make stapler server identifiers myproject.example.com and /my-project/
+# make stapler server identify myproject.example.com and /my-project/
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   --data-binary @- \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Host: myproject.example.com' \
@@ -131,10 +137,19 @@ tar -czC dist . | curl -X PUT \
 
 # make stapler server identifiers myproject.example.com only
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   --data-binary @- \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Host-Only: myproject.example.com' \
   https://stapler-host/my-project/
+
+# make a SPA site at /my-project/index.html
+tar -czC dist . | curl -X PUT \
+  --fail-with-body \
+  --data-binary @- \
+  -H 'X-Token: <TOKEN>' \
+  -H 'X-SPA: index.html' \
+  https://stapler-host/my-project/
 ```
 
 > [!NOTE]
@@ -153,12 +168,14 @@ PUT /{page}/
 ```bash
 # create /my-project/ that redirects to https://github.com/my-project
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Redirect: https://github.com/my-project' \
   https://stapler-host/my-project/
 
 # simple redirect from root host to www
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Proxy: https://www.my-website.com' \
   -H 'X-Host: my-website.com' \
@@ -178,6 +195,7 @@ PUT /{page}/
 ```bash
 # create /my-website/ that proxies to http://host.containers.internal:8000
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Proxy: http://host.containers.internal:8000' \
   https://stapler-host/my-project/
@@ -193,6 +211,7 @@ DELETE /{page}/
 ```bash
 # delete /my-project/
 curl -X DELETE \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   https://stapler-host/my-project/
 ```
@@ -218,7 +237,11 @@ curl -X DELETE \
       - name: Create archive
         run: tar -czC dist -f dist.tar.gz .
       - name: Deploy to Stapler server
-        run: curl -X PUT -H 'X-Token: ${{ secrets.STAPLER_TOKEN }}' -H 'X-Host: ${{ vars.TARGET_HOST }}' --data-binary "@dist.tar.gz" https://stapler-host/my-project/
+        run: |
+          curl -X PUT --fail-with-body --data-binary "@dist.tar.gz" \
+            -H 'X-Token: ${{ secrets.STAPLER_TOKEN }}' \
+            -H 'X-Host: ${{ vars.TARGET_HOST }}' \
+            ${{ vars.STAPLER_URL }}
 ```
 
 ### Redirecting hosts with DNS

crontab.example

@@ -1,3 +1,3 @@
 # do daily/weekly/monthly maintenance
 # min   hour    day     month   weekday command
-0       3       *       *       1       /app/main.py renew
+0       3       *       *       1       stapler renew

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stapler"
-version = "1.1.0"
+version = "1.4.0"
 description = "Static pages as simple as a gzip file"
 requires-python = ">=3.14"
 dependencies = [
@@ -21,13 +21,15 @@ module-name = "stapler"
 [dependency-groups]
 dev = [
     "coverage>=7.13.5",
+    "parameterized>=0.9.0",
+    "pytest>=9.0.3",
     "ruff>=0.15.10",
     "ty>=0.0.29",
 ]
 
 [tool.ruff.lint]
 select = ["ALL"]
-ignore = ["D", "E501", "S104", "PLR2004", "ANN401", "BLE001", "COM812", "S603", "PLR0911", "S101", "PT"]
+ignore = ["D", "E501", "S104", "PLR2004", "ANN401", "BLE001", "COM812", "S603", "PLR0911", "S101", "PT", "E722"]
 
 [tool.coverage.run]
 source = ["stapler"]

stapler/cert_manager.py

@@ -5,6 +5,8 @@ import ssl
 import subprocess
 import typing
 
+from stapler.strings import valid_host
+
 if typing.TYPE_CHECKING:
     from .params import Parameters
 
@@ -35,7 +37,7 @@ class CertManager:
         self.with_certbot: bool = params.with_certbot
         self.last_file_change: int | float = 0
 
-    def init(self, hosts: list[str]) -> None:
+    def init(self) -> None:
         self.logger.debug("Initializing...")
         if not self.certbot_www.exists():
             self.certbot_www.mkdir(parents=True)
@@ -43,8 +45,6 @@ class CertManager:
         if not self.self_signed_path.exists():
             self.self_signed_path.mkdir(parents=True)
             self.logger.debug("Created %s", self.self_signed_path)
-        for host in hosts:
-            self.init_cert(host)
 
     def exists(self, host: str) -> bool:
         return self.__exists_certbot(host) or self.__exists_self_signed(host)
@@ -57,7 +57,7 @@ class CertManager:
 
     def create_or_update(self, host: str) -> bool:
         created = self.init_cert(host)
-        if self.with_certbot and self.__create_certbot(host):
+        if self.with_certbot and valid_host(host) and self.__create_certbot(host):
             return True
         return created or self.__create_self_signed(host)
 
@@ -122,7 +122,9 @@ class CertManager:
             )
             self.logger.info("Created self-signed certificate for %s", host)
         except CertManagerError:
-            self.logger.exception("Could not create certbot certificate for %s\n%s")
+            self.logger.exception(
+                "Could not create self-signed certificate for %s", host
+            )
             return False
         except subprocess.CalledProcessError as e:
             self.logger.exception(
@@ -172,7 +174,7 @@ class CertManager:
             )
             self.logger.info("Created certbot certificate for %s", host)
         except CertManagerError:
-            self.logger.exception("Could not create certbot certificate for %s\n%s")
+            self.logger.exception("Could not create certbot certificate for %s", host)
             return False
         except subprocess.CalledProcessError as e:
             self.logger.exception(
@@ -183,11 +185,16 @@ class CertManager:
             return False
         return self.__exists_certbot(host)
 
-    def sni_callback(
-        self, socket: ssl.SSLObject, host: str | None, _: ssl.SSLContext, /
+    def servername_callback(
+        self,
+        socket: ssl.SSLSocket | ssl.SSLObject,
+        host: str | None,
+        _: ssl.SSLSocket,
+        /,
     ) -> None | int:
         if host is None:
             return None
+        self.logger.debug("servername callback: %s", host)
         if not self.exists(host) and not self.create_or_update(host):
             return None
         cert_file = self.get_cert(host)
@@ -198,6 +205,7 @@ class CertManager:
                 cert_file,
                 key_file,
             )
+            new_context.set_alpn_protocols(["http/1.1"])
             socket.context = new_context
         except Exception:
             self.logger.exception("Could not create HTTPS context for %s", host)

stapler/data_dir.py

@@ -16,7 +16,7 @@ class DataDir:
     ]
 
     PATH_REGEX = re.compile(r"^[\w-]+$")
-    NEEDED_FILES: typing.ClassVar[list[str]] = ["favicon.ico"]
+    NEEDED_FILES: typing.ClassVar[list[str]] = ["favicon.ico", "robots.txt"]
 
     def __init__(self, root_path: str) -> None:
         self.logger: logging.Logger = logging.getLogger(self.__class__.__name__)

stapler/handlers.py

@@ -1,4 +1,5 @@
 import abc
+import contextlib
 import http
 import http.cookiejar
 import http.server
@@ -15,6 +16,7 @@ import requests
 
 from . import PKG_VERSION, STAPLER_ASCII, logs
 from .data_dir import DataDir
+from .strings import sanitize_string, valid_host
 
 if typing.TYPE_CHECKING:
     from .page import Page
@@ -24,6 +26,10 @@ if typing.TYPE_CHECKING:
 
 
 class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
+    timeout = 10
+    protocol_version = "HTTP/1.1"
+    REQUEST_COUNT = 0
+
     @typing.override
     def __init__(
         self,
@@ -37,7 +43,10 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         self.__host: str | None = None
         self.__in_size: int | None = None
         self.https: bool = params.https
+        self.__class__.REQUEST_COUNT += 1
         super().__init__(*args, **kwargs)
+        with contextlib.suppress(Exception):
+            self.connection.close()
 
     @typing.override
     def send_error(
@@ -45,13 +54,25 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         code: int,
         message: str | None = None,
         explain: str | None = None,
+    ) -> None:
+        self.send_status(code, message, explain)
+
+    def send_status(
+        self,
+        code: int,
+        message: str | None = None,
+        explain: str | None = None,
     ) -> None:
         shortmsg, longmsg = self.responses[code]
         if message is None:
             message = shortmsg
         if explain is None:
             explain = longmsg
-        if "text/" in self._get_header("Accept"):
+        if (
+            not self._has_header("Accept")
+            or self._get_header("Accept").startswith("*/")
+            or self._get_header("Accept").startswith("text/")
+        ):
             self.send_basic_body(
                 f"{code} {message}\n{explain}\n\n{self.server_signature()}",
                 code=code,
@@ -60,6 +81,10 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         else:
             self.send_status_only(code, message)
 
+    @typing.override
+    def address_string(self) -> str:  # pragma: no cover
+        return sanitize_string(super().address_string())
+
     @typing.override
     def log_message(self, format: str, *args: typing.Any) -> None:  # pragma: no cover
         fmt = "%s - " + format
@@ -70,9 +95,25 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         fmt = "%s - " + format
         self.logger.error(fmt, self.address_string(), *args)
 
+    def _pre_log_request(self) -> None:  # pragma: no cover
+        args = (
+            "...",
+            self.address_string(),
+            self.host,
+            format(self.__class__.REQUEST_COUNT, "07_d"),
+            sanitize_string(self.requestline),
+        )
+        fmt = "← %s - %s - %s - %s - %s"
+        if self.in_size > 0:
+            args = (*args, self.in_size)
+            fmt += " - %s"
+        self.logger.debug(fmt, *args)
+
     @typing.override
     def log_request(self, code: str = "?", size: str = "-") -> None:  # ty:ignore[invalid-method-override] # pragma: no cover
         if isinstance(code, http.HTTPStatus):
+            code = code.value
+        if isinstance(code, int):
             color = logs.TermColor.RED
             if 100 <= code < 200:
                 color = logs.TermColor.CYAN
@@ -82,11 +123,17 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
                 color = logs.TermColor.BLUE
             elif 400 <= code < 500:
                 color = logs.TermColor.YELLOW
-            code = color + str(code.value) + logs.TermColor.RESET
+            code = color + str(code) + logs.TermColor.RESET
         if size == "" and self.out_size > 0:
             size = str(self.out_size)
-        args = (code, self.address_string(), self.host, self.requestline)
-        fmt = "→ %s - %s - %s - %s"
+        args = (
+            code,
+            self.address_string(),
+            self.host,
+            format(self.__class__.REQUEST_COUNT, "07_d"),
+            sanitize_string(self.requestline),
+        )
+        fmt = "→ %s - %s - %s - %s - %s"
         if size != "":
             args = (*args, size)
             fmt += " - %s"
@@ -104,7 +151,9 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         self.send_response(code, message)
         self.send_header("Content-Type", f"{content_type}; charset=UTF-8")
         self.send_header("Content-Length", str(len(encoded)))
+        self.send_header("Connection", "close")
         self.end_headers()
+        if self.command != http.HTTPMethod.HEAD:
             self.wfile.write(encoded)
         self.close_connection = True
 
@@ -118,6 +167,7 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
             headers = {}
         self.send_response(code, message)
         self.send_header("Content-Length", "0")
+        self.send_header("Connection", "close")
         for header, value in headers.items():
             self.send_header(header, value)
         self.end_headers()
@@ -147,13 +197,19 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
                 headers=headers,
                 allow_redirects=False,
                 timeout=480,
+                stream=False,
             )
         except Exception as e:
             self.send_error(
                 http.HTTPStatus.BAD_GATEWAY, f"Could not reach {url}", explain=str(e)
             )
             return
-        self.send_response(response.status_code, response.reason)
+        self.send_response(
+            response.status_code
+            if type(response.status_code) is int
+            else http.HTTPStatus.BAD_GATEWAY,
+            response.reason,
+        )
         for header, value in response.headers.items():
             if header.lower() not in [
                 "content-length",
@@ -161,11 +217,13 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
                 "transfer-encoding",
                 "server",
                 "date",
+                "connection",
             ]:
                 self.send_header(header, value.replace(target_host, self.host))
         self.send_header("Content-Length", str(out_size := len(response.content)))
+        self.send_header("Connection", "close")
         self.end_headers()
-        if out_size > 0:
+        if out_size > 0 and self.command != http.HTTPMethod.HEAD:
             self.wfile.write(response.content)
         self.close_connection = True
 
@@ -200,17 +258,17 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
             and len(self.headers[key]) > 0
         )
 
-    def _pre_log_request(self) -> None:  # pragma: no cover
-        args = ("...", self.address_string(), self.host, self.requestline)
-        fmt = "← %s - %s - %s - %s"
-        if self.in_size > 0:
-            args = (*args, self.in_size)
-            fmt += " - %s"
-        self.logger.debug(fmt, *args)
-
     def server_signature(self) -> str:
         return self.server_version + "\n\n" + STAPLER_ASCII + "\n"
 
+    @contextlib.contextmanager
+    def handle_errors(self) -> typing.Iterator[None]:
+        try:
+            yield
+        except Exception as e:
+            self.send_error(http.HTTPStatus.INTERNAL_SERVER_ERROR, str(e))
+            self.logger.exception("Internal Server Error")
+
 
 class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
     protocol_version = "HTTP/1.1"
@@ -219,12 +277,13 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
     UPDATE_PATH_REGEX = re.compile(r"^\/([\w-]+)\/?$")
     GET_PATH_REGEX = re.compile(r"^\/([\w-]+)($|\/)")
     HOST_PART_REGEX = re.compile(r"^([a-z0-9]|[a-z0-9][a-z0-9-]{,61}[a-z0-9])$")
-    AUTHORIZED_PATHS: typing.ClassVar[list[str]] = ["/favicon.ico"]
+    AUTHORIZED_PATHS: typing.ClassVar[list[str]] = ["/favicon.ico", "/robots.txt"]
     TOKEN_HEADER = "X-Token"  # noqa: S105
     HOST_HEADER = "X-Host"
     HOST_ONLY_HEADER = "X-Host-Only"
     REDIRECT_HEADER = "X-Redirect"
     PROXY_HEADER = "X-Proxy"
+    SPA_HEADER = "X-SPA"
 
     @typing.override
     def __init__(
@@ -238,6 +297,7 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
         self.logger: logging.Logger = logging.getLogger(self.__class__.__name__)
         self.token_manager: TokenManager = token_manager
         self.data_dir: DataDir = DataDir(params.data_dir)
+        self.root_path: pathlib.Path = pathlib.Path(params.data_dir)
         self.max_size_bytes: int = params.max_size_bytes
         self.registry: Registry = registry
         self.certbot_www: str = os.path.realpath(params.certbot_www)
@@ -246,7 +306,13 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
         self.__target_host_only: str | None = None
         self.__target_redirect: str | None = None
         self.__target_proxy: str | None = None
+        self.__target_spa: str | None = None
+        try:
             super().__init__(*args, directory=params.data_dir, **kwargs, params=params)  # ty:ignore[unknown-argument]
+        except (BrokenPipeError, ConnectionResetError) as e:
+            self.logger.error("Connection lost: %s", str(e))  # noqa: TRY400
+        except:
+            self.logger.exception("Could not handle request")
 
     @property
     def token(self) -> str:
@@ -308,46 +374,64 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
     def has_target_proxy(self) -> bool:
         return len(self.target_proxy) > 0
 
-    @typing.override
-    def do_HEAD(self) -> None:
-        self._pre_log_request()
-        if not self._proxy_or_redirect():
-            super().do_HEAD()
+    @property
+    def target_spa(self) -> str:
+        if self.__target_spa is None:
+            self.__target_spa = self._get_header(self.SPA_HEADER).lower()
+        return self.__target_spa
+
+    @property
+    def has_target_spa(self) -> bool:
+        return len(self.target_spa) > 0
 
     @typing.override
-    def do_GET(self) -> None:
+    def do_HEAD(self) -> None:
+        with self.handle_errors():
             self._pre_log_request()
             if self._proxy_or_redirect():
                 return None
             if self.path == "/" and self.host == self.default_host:
                 return self.send_basic_body(self.server_signature())
-        return super().do_GET()
+            super().do_HEAD()
+            self.close_connection = True
+            return None
 
-    def do_PUT(self) -> None:
+    @typing.override
+    def do_GET(self) -> None:
+        with self.handle_errors():
             self._pre_log_request()
             if self._proxy_or_redirect():
                 return None
-        if (path := self.__check_update_request()) is None:
+            if self.path == "/" and self.host == self.default_host:
+                return self.send_basic_body(self.server_signature())
+            super().do_GET()
+            self.close_connection = True
             return None
-        if not self.__check_put_headers():
-            return None
-        if (
-            self.has_target_host
-            and (page := self.registry.get_from_host(self.target_host)) is not None
-            and page.path != path
-        ):
-            return self.send_error(http.HTTPStatus.FORBIDDEN, "Host already taken")
+
+    def do_PUT(self) -> None:
+        with self.handle_errors():
+            self._pre_log_request()
+            if self._proxy_or_redirect():
+                return
+            if (path := self.__check_put_request()) is None:
+                return
             if self.has_target_redirect:
-            self._update_redirect(path)
+                if not self._update_redirect(path):
+                    return
             elif self.has_target_proxy:
-            self._update_proxy(path)
-        else:
-            self._update_extract(path)
+                if not self._update_proxy(path):
+                    return
+            elif not self._update_extract(path):
+                return
             if self.has_request_host:
                 self.registry.set_host(path, self.target_host)
             if self.has_request_host_only:
                 self.registry.set_host_only(path, self.target_host)
-        return None
+            self.send_status(
+                http.HTTPStatus.CREATED,
+                "Resource updated",
+                str(self.registry.get_from_path(path)),
+            )
 
     def do_POST(self) -> None:
         self.do_PUT()  # be gentle on them
@@ -356,93 +440,88 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
         self.do_PUT()  # be gentle on them
 
     def do_DELETE(self) -> None:
+        with self.handle_errors():
             self._pre_log_request()
             if self._proxy_or_redirect():
-            return None
+                return
             if (path := self.__check_update_request()) is None:
-            return None
-        return self._update_remove(path)
+                return
+            if self._update_remove(path):
+                self.send_status(
+                    http.HTTPStatus.OK,
+                    f"Resource /{path}/ removed",
+                )
+            return
 
     def do_CONNECT(self) -> None:
+        with self.handle_errors():
             self._pre_log_request()
             if not self._proxy_or_redirect():
                 self.send_error(http.HTTPStatus.METHOD_NOT_ALLOWED)
 
     def do_OPTIONS(self) -> None:
+        with self.handle_errors():
             self._pre_log_request()
             if not self._proxy_or_redirect():
                 self.send_error(http.HTTPStatus.METHOD_NOT_ALLOWED)
 
     def do_TRACE(self) -> None:
+        with self.handle_errors():
             self._pre_log_request()
             if not self._proxy_or_redirect():
                 self.send_error(http.HTTPStatus.METHOD_NOT_ALLOWED)
 
-    def _update_extract(self, path: str) -> None:
+    def _update_extract(self, path: str) -> bool:
         if self.in_size == 0:
-            return self.send_error(http.HTTPStatus.LENGTH_REQUIRED, "No body found")
+            self.send_error(http.HTTPStatus.LENGTH_REQUIRED, "No body found")
+            return False
         if self.in_size > self.max_size_bytes:
-            return self.send_error(
+            self.send_error(
                 http.HTTPStatus.CONTENT_TOO_LARGE,
                 "Archive too large",
             )
+            return False
         try:
             file_bytes = io.BytesIO(self.rfile.read(self.in_size))
             self.data_dir.extract_tar_bytes(path, file_bytes)
         except tarfile.TarError:
-            return self.send_error(http.HTTPStatus.BAD_REQUEST, "Invalid tar archive")
-        except Exception as e:
-            return self.send_error(http.HTTPStatus.INTERNAL_SERVER_ERROR, str(e))
+            self.send_error(http.HTTPStatus.BAD_REQUEST, "Invalid tar archive")
+            return False
         self.registry.add(path)
         self.token_manager.set_token(path, self.token)
-        self.send_status_only(
-            http.HTTPStatus.CREATED,
-            f"Resource /{path}/ updated",
-        )
-        return None
+        if self.has_target_spa:
+            self.registry.set_spa(path, self.target_spa)
+        return True
 
-    def _update_redirect(self, path: str) -> None:
+    def _update_redirect(self, path: str) -> bool:
         if self.in_size > 0:
-            return self.send_error(
+            self.send_error(
                 http.HTTPStatus.BAD_REQUEST,
                 f"No content must be sent with {self.REDIRECT_HEADER}",
             )
+            return False
         self.registry.set_redirect(path, self.target_redirect)
         self.token_manager.set_token(path, self.token)
-        self.send_status_only(
-            http.HTTPStatus.CREATED,
-            f"Resource /{path}/ updated",
-        )
-        return None
+        return True
 
-    def _update_proxy(self, path: str) -> None:
+    def _update_proxy(self, path: str) -> bool:
         if self.in_size > 0:
-            return self.send_error(
+            self.send_error(
                 http.HTTPStatus.BAD_REQUEST,
                 f"No content must be sent with {self.PROXY_HEADER}",
             )
+            return False
         self.registry.set_proxy(path, self.target_proxy)
         self.token_manager.set_token(path, self.token)
-        self.send_status_only(
-            http.HTTPStatus.CREATED,
-            f"Resource /{path}/ updated",
-        )
-        return None
+        return True
 
-    def _update_remove(self, path: str) -> None:
+    def _update_remove(self, path: str) -> bool:
         if not self.data_dir.exists(path):
             self.send_error(http.HTTPStatus.NOT_FOUND, "Not found")
-            return None
-        try:
+            return False
         self.data_dir.remove(path)
-        except Exception as e:
-            return self.send_error(http.HTTPStatus.INTERNAL_SERVER_ERROR, str(e))
-        self.send_status_only(
-            http.HTTPStatus.NO_CONTENT,
-            f"Resource /{path}/ removed",
-        )
         self.registry.remove(path)
-        return None
+        return True
 
     def _proxy_or_redirect(self) -> bool:
         if self.has_token or self.path.startswith(self.CERTBOT_CHALLENGE_PATH):
@@ -475,9 +554,20 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
                 return super().translate_path(path)
             return ""
         if self.host != self.default_host:
+            if (
+                not (self.root_path / page.path / path).is_file()
+                and path in self.AUTHORIZED_PATHS
+            ):
+                return super().translate_path(path)
             path = f"/{page.path}" + path
         if pathlib.Path(path).name.startswith("."):  # hidden files
             return ""
+        if (
+            page.spa is not None
+            and not (self.root_path / pathlib.Path(path[1:])).is_file()
+            and not (self.root_path / pathlib.Path(path[1:]) / "index.html").is_file()
+        ):
+            path = f"/{page.path}/{page.spa}"
         return super().translate_path(path)
 
     def __check_update_request(self) -> str | None:
@@ -497,35 +587,38 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
             return None
         return sub_path
 
-    def __check_put_headers(self) -> bool:
+    def __check_put_request(self) -> str | None:
+        if (path := self.__check_update_request()) is None:
+            return None
         if self.has_request_host and self.has_request_host_only:
             self.send_error(
                 http.HTTPStatus.BAD_REQUEST,
                 f"Cannot use {self.HOST_ONLY_HEADER} with {self.HOST_HEADER}",
             )
-            return False
-        if self.has_target_host and not self.__valid_host(self.target_host):
+            return None
+        if self.has_target_host and not valid_host(self.target_host):
             self.send_error(http.HTTPStatus.BAD_REQUEST, "Invalid requested host")
-            return False
+            return None
         if self.has_target_proxy and self.has_target_redirect:
             self.send_error(
                 http.HTTPStatus.BAD_REQUEST,
                 f"Cannot use {self.PROXY_HEADER} with {self.REDIRECT_HEADER}",
             )
-            return False
-        return True
+            return None
+        if (
+            self.has_target_host
+            and (page := self.registry.get_from_host(self.target_host)) is not None
+            and page.path != path
+        ):
+            self.send_error(http.HTTPStatus.FORBIDDEN, "Host already taken")
+            return None
+        return path
 
     def __get_path(self, path: str, regex: re.Pattern) -> str | None:
         if (match := regex.match(path.lower())) is not None:
             return match.group(1)
         return None
 
-    def __valid_host(self, host: str) -> bool:
-        return (
-            all(self.HOST_PART_REGEX.fullmatch(part) for part in host.split("."))
-            and len(host) < 256
-        )
-
     def __get_page(self, src_path: str) -> Page | None:
         if self.host == self.default_host:
             if (
@@ -539,14 +632,19 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
 
 
 class UpgradeHandler(RequestHandler):
+    protocol_version = "HTTP/1.0"
     server_version = "StaplerUpgradeServer/" + PKG_VERSION
 
     def do_HEAD(self) -> None:
+        with self.handle_errors():
             self._pre_log_request()
             self.send_redirect(f"https://{self.host}{self.path}")
+            self.close_connection = True
 
     def do_GET(self) -> None:
+        with self.handle_errors():
             if self.path.startswith(self.CERTBOT_CHALLENGE_PATH):
                 super().do_GET()
+                self.close_connection = True
             else:
                 self.do_HEAD()

stapler/page.py

@@ -10,6 +10,7 @@ class Page:
     token_hash: str | None = None
     redirect: str | None = None
     proxy: str | None = None
+    spa: str | None = None
 
     def __repr__(self) -> str:
         out = f"/{self.path}/"
@@ -23,4 +24,6 @@ class Page:
             out += " (no index)"
         if self.host_only:
             out += " (host only)"
+        if self.spa:
+            out += f" (spa: {self.spa})"
         return out

stapler/params.py

@@ -23,7 +23,7 @@ class Parameters:
     https_port: int = 443
     https: bool = True
     token_salt: str = ""
-    max_size_bytes: int = 2_000_000
+    max_size_bytes: int = 20_000_000
     bind: str = "0.0.0.0"
     command: typing.Literal["run", "renew", "token"] = "run"
 

stapler/registry.py

@@ -20,6 +20,7 @@ class Registry:
     TOKEN_FILE = ".token"  # noqa: S105
     REDIRECT_FILE = ".redirect"
     PROXY_FILE = ".proxy"
+    SPA_FILE = ".spa"
 
     def __init__(self, params: Parameters) -> None:
         self.logger: logging.Logger = logging.getLogger(self.__class__.__name__)
@@ -45,6 +46,7 @@ class Registry:
             token_hash=self.data_dir.get_file(path, self.TOKEN_FILE),
             redirect=self.data_dir.get_file(path, self.REDIRECT_FILE),
             proxy=self.data_dir.get_file(path, self.PROXY_FILE),
+            spa=self.data_dir.get_file(path, self.SPA_FILE),
         )
         self.logger.info("Updated %s", self.pages[path])
 
@@ -91,6 +93,12 @@ class Registry:
             self.pages[path].proxy = proxy
             self.logger.debug("Updated %s", self.pages[path])
 
+    def set_spa(self, path: str, spa: str) -> None:
+        if path in self.pages and (self.pages[path].spa != spa):
+            self.data_dir.set_file(path, self.SPA_FILE, spa)
+            self.pages[path].spa = spa
+            self.logger.debug("Updated %s", self.pages[path])
+
     def remove(self, path: str) -> None:
         if path in self.pages:
             page = self.pages[path]

stapler/robots.txt

@@ -0,0 +1,2 @@
+User-agent: *
+Disallow: /

stapler/server.py

@@ -29,7 +29,6 @@ class StaplerServer:
         "logger",
         "params",
         "registry",
-        "server",
         "token_manager",
     ]
 
@@ -41,7 +40,6 @@ class StaplerServer:
         self.token_manager: TokenManager = TokenManager(params, self.registry)
         self.data_dir: DataDir = DataDir(params.data_dir)
         self.default_host: str = params.host.split(":", maxsplit=2)[0]
-        self.server: http.server.ThreadingHTTPServer | None = None
 
     def __get_all_hosts(self) -> list[str]:
         return [self.default_host, *self.registry.get_hosts()]
@@ -50,7 +48,7 @@ class StaplerServer:
         self.logger.info("Starting up...")
         self.registry.load_pages()
         if self.params.with_certificates:
-            self.cert_manager.init(self.__get_all_hosts())
+            self.cert_manager.init()
         self.data_dir.init()
         self.token_manager.init()
 
@@ -75,7 +73,7 @@ class StaplerServer:
             )
             context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
             server.socket = context.wrap_socket(server.socket, server_side=True)
-            context.sni_callback = self.cert_manager.sni_callback
+            context.set_servername_callback(self.cert_manager.servername_callback)
         else:
             server = http.server.ThreadingHTTPServer(
                 (
@@ -131,7 +129,7 @@ class StaplerServer:
         for line in STAPLER_ASCII.split("\n"):
             self.logger.debug(line.ljust(36))
         self.__startup()
-        self.server = self.__create_base_server()
+        base_server = self.__create_base_server()
         upgrade_server = self.__start_upgrade_server() if self.params.https else None
         self.logger.info(
             "Server up and ready on %s://%s",
@@ -140,7 +138,7 @@ class StaplerServer:
         )
         self.__start_background_tasks()
         with contextlib.suppress(KeyboardInterrupt):
-            self.server.serve_forever()
+            base_server.serve_forever()
         self.logger.info("Shutting down...")
         if upgrade_server is not None:
             upgrade_server.shutdown()
@@ -152,7 +150,7 @@ class StaplerServer:
             self.logger.warning("Cannot renew without certificates")
             return 1
         self.registry.load_pages()
-        self.cert_manager.init(self.__get_all_hosts())
+        self.cert_manager.init()
         for host in self.__get_all_hosts():
             self.cert_manager.create_or_update(host)
         return 0

stapler/strings.py

@@ -0,0 +1,19 @@
+import re
+
+__HOST_PART_REGEX = re.compile(r"^([a-z0-9]|[a-z0-9][a-z0-9-]{,61}[a-z0-9])$")
+__SANITIZE_REGEX = re.compile(r"[^\x20-\x7F]")
+
+
+def valid_host(host: str) -> bool:
+    parts = host.split(".")
+    return (
+        len(parts) > 1
+        and len(parts[-1]) > 1
+        and all(__HOST_PART_REGEX.fullmatch(part) for part in parts)
+        and not all(part.isnumeric() for part in parts)
+        and len(host) < 256
+    )
+
+
+def sanitize_string(raw: str) -> str:
+    return __SANITIZE_REGEX.sub("?", raw)

tests/test_cert_manager.py

@@ -35,41 +35,33 @@ class TestRegistry(BaseTestCase):
             self.patch("shutil.which", count=0),
             self.patch("subprocess.check_output", count=0),
         ):
-            self.cert_manager.init([])
+            self.cert_manager.init()
             assert self.self_signed_path.is_dir()
             assert self.certbot_www.is_dir()
 
-    def test_init_with_hosts(self) -> None:
-        with (
-            self.patch("shutil.which", count=0),
-            self.patch("subprocess.check_output", count=0),
-        ):
-            self._make_self_signed("localhost")
-            self.cert_manager.init(["localhost"])
-
     def test_exists_self_signed(self) -> None:
-        self._make_self_signed("localhost")
-        assert self.cert_manager.exists("localhost")
+        self._make_self_signed("example.com")
+        assert self.cert_manager.exists("example.com")
 
     def test_exists_certbot(self) -> None:
-        self._make_certbot("localhost")
-        assert self.cert_manager.exists("localhost")
+        self._make_certbot("example.com")
+        assert self.cert_manager.exists("example.com")
 
     def test_exists_fail(self) -> None:
-        assert not self.cert_manager.exists("localhost")
+        assert not self.cert_manager.exists("example.com")
 
     def test_exists_fail_without_certbot(self) -> None:
         self.cert_manager.with_certbot = False
-        self._make_certbot("localhost")
-        assert not self.cert_manager.exists("localhost")
+        self._make_certbot("example.com")
+        assert not self.cert_manager.exists("example.com")
 
     def test_init_cert_existing(self) -> None:
         with (
             self.patch("shutil.which", count=0),
             self.patch("subprocess.check_output", count=0),
         ):
-            self._make_self_signed("localhost")
-            assert not self.cert_manager.init_cert("localhost")
+            self._make_self_signed("example.com")
+            assert not self.cert_manager.init_cert("example.com")
 
     def test_init_cert_fail(self) -> None:
         with (
@@ -77,7 +69,7 @@ class TestRegistry(BaseTestCase):
             self.patch("subprocess.check_output") as process_mock,
         ):
             process_mock.side_effect = subprocess.CalledProcessError(1, "", output=b"")
-            assert not self.cert_manager.init_cert("localhost")
+            assert not self.cert_manager.init_cert("example.com")
 
     def test_init_cert_new(self) -> None:
         with (
@@ -85,135 +77,139 @@ class TestRegistry(BaseTestCase):
             self.patch("subprocess.check_output") as process_mock,
         ):
             process_mock.side_effect = lambda *_, **__: self._make_self_signed(
-                "localhost"
+                "example.com"
             )
-            assert self.cert_manager.init_cert("localhost")
+            assert self.cert_manager.init_cert("example.com")
 
     def test_create_or_update_existing_no_certbot(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         self.cert_manager.with_certbot = False
         with (
             self.patch("shutil.which", return_value=""),
             self.patch("subprocess.check_output") as process_mock,
         ):
             process_mock.side_effect = lambda *_, **__: self._make_self_signed(
-                "localhost"
+                "example.com"
             )
-            assert self.cert_manager.create_or_update("localhost")
+            assert self.cert_manager.create_or_update("example.com")
 
     def test_create_or_update_existing_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         with (
             self.patch("shutil.which", return_value=""),
             self.patch("subprocess.check_output") as process_mock,
         ):
-            process_mock.side_effect = lambda *_, **__: self._make_certbot("localhost")
-            assert self.cert_manager.create_or_update("localhost")
+            process_mock.side_effect = lambda *_, **__: self._make_certbot(
+                "example.com"
+            )
+            assert self.cert_manager.create_or_update("example.com")
 
     def test_create_or_update_existing_fail_both(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         with (
             self.patch("shutil.which", return_value="", count=2),
             self.patch("subprocess.check_output", count=2) as process_mock,
         ):
             process_mock.side_effect = subprocess.CalledProcessError(1, "", output=b"")
-            assert not self.cert_manager.create_or_update("localhost")
+            assert not self.cert_manager.create_or_update("example.com")
 
     def test_create_or_update_existing_fail_both_binary(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         with (
             self.patch("shutil.which", count=2),
             self.patch("subprocess.check_output", count=0),
         ):
-            assert not self.cert_manager.create_or_update("localhost")
+            assert not self.cert_manager.create_or_update("example.com")
 
     def test_get_cert_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         self.assertEqual(
-            self.cert_manager.get_cert("localhost"),
-            self.certbot_conf / "live" / "localhost" / CertManager.CRT_FILE,
+            self.cert_manager.get_cert("example.com"),
+            self.certbot_conf / "live" / "example.com" / CertManager.CRT_FILE,
         )
 
     def test_get_cert_self_signed(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         self.assertEqual(
-            self.cert_manager.get_cert("localhost"),
-            self.self_signed_path / "localhost" / CertManager.CRT_FILE,
+            self.cert_manager.get_cert("example.com"),
+            self.self_signed_path / "example.com" / CertManager.CRT_FILE,
         )
 
     def test_get_cert_fail(self) -> None:
         self.assertRaises(
             CertManagerError,
-            lambda: self.cert_manager.get_cert("localhost"),
+            lambda: self.cert_manager.get_cert("example.com"),
         )
 
     def test_get_key_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         self.assertEqual(
-            self.cert_manager.get_key("localhost"),
-            self.certbot_conf / "live" / "localhost" / CertManager.KEY_FILE,
+            self.cert_manager.get_key("example.com"),
+            self.certbot_conf / "live" / "example.com" / CertManager.KEY_FILE,
         )
 
     def test_get_key_self_signed(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         self.assertEqual(
-            self.cert_manager.get_key("localhost"),
-            self.self_signed_path / "localhost" / CertManager.KEY_FILE,
+            self.cert_manager.get_key("example.com"),
+            self.self_signed_path / "example.com" / CertManager.KEY_FILE,
         )
 
     def test_get_key_fail(self) -> None:
         self.assertRaises(
             CertManagerError,
-            lambda: self.cert_manager.get_key("localhost"),
+            lambda: self.cert_manager.get_key("example.com"),
         )
 
-    def test_sni_callback_no_host(self) -> None:
-        self._make_self_signed("localhost")
+    def test_servername_callback_no_host(self) -> None:
+        self._make_self_signed("example.com")
         with (
             self.patch("ssl.create_default_context", count=0),
         ):
-            self.cert_manager.sni_callback(self.socket_mock, None, self.context_mock)
+            self.cert_manager.servername_callback(
+                self.socket_mock, None, self.context_mock
+            )
 
-    def test_sni_callback_fail(self) -> None:
-        self._make_self_signed("localhost")
+    def test_servername_callback_fail(self) -> None:
+        self._make_self_signed("example.com")
         with (
             self.patch("shutil.which", count=3),
             self.patch("ssl.create_default_context", count=0),
         ):
-            self.cert_manager.sni_callback(
-                self.socket_mock, "new_host", self.context_mock
+            self.cert_manager.servername_callback(
+                self.socket_mock, "example.fr", self.context_mock
             )
 
-    def test_sni_callback_create_context(self) -> None:
-        self._make_self_signed("localhost")
+    def test_servername_callback_create_context(self) -> None:
+        self._make_self_signed("example.com")
         with (
             self.patch("ssl.create_default_context", return_value=self.context_mock),
             self.mock_call(
                 self.context_mock.load_cert_chain,
                 [
-                    self.self_signed_path / "localhost" / CertManager.CRT_FILE,
-                    self.self_signed_path / "localhost" / CertManager.KEY_FILE,
+                    self.self_signed_path / "example.com" / CertManager.CRT_FILE,
+                    self.self_signed_path / "example.com" / CertManager.KEY_FILE,
                 ],
             ),
             self.patch("shutil.which", count=0),
         ):
-            self.cert_manager.sni_callback(
-                self.socket_mock, "localhost", self.context_mock
+            self.cert_manager.servername_callback(
+                self.socket_mock, "example.com", self.context_mock
             )
 
-    def test_sni_callback_create_context_fail(self) -> None:
-        self._make_self_signed("localhost")
+    def test_servername_callback_create_context_fail(self) -> None:
+        self._make_self_signed("example.com")
         with (
             self.patch("ssl.create_default_context", return_value=self.context_mock),
             self.patch("shutil.which", count=0),
         ):
             self.context_mock.load_cert_chain.side_effect = Exception
-            self.cert_manager.sni_callback(
-                self.socket_mock, "localhost", self.context_mock
+            self.cert_manager.servername_callback(
+                self.socket_mock, "example.com", self.context_mock
             )
             self.context_mock.load_cert_chain.assert_called_once_with(
-                self.self_signed_path / "localhost" / CertManager.CRT_FILE,
-                self.self_signed_path / "localhost" / CertManager.KEY_FILE,
+                self.self_signed_path / "example.com" / CertManager.CRT_FILE,
+                self.self_signed_path / "example.com" / CertManager.KEY_FILE,
             )
 
     def _make_self_signed(self, host: str) -> None:

tests/test_data_dir.py

@@ -59,11 +59,6 @@ class TestDataDir(BaseTestCase):
         self.__create_path("test_1")
         self.assertIsNone(self.data_dir.get_file("test_1", ".value"))
 
-    def test_get_file_cannot_read(self) -> None:
-        self.__create_path("test_1", {".value": "value"})
-        (self.tmp_path / "test_1" / ".value").chmod(0o333)
-        self.assertIsNone(self.data_dir.get_file("test_1", ".value"))
-
     def test_get_file_invalid_path(self) -> None:
         self.assertIsNone(self.data_dir.get_file("test_1", ".value"))
 

tests/test_handlers.py

@@ -36,6 +36,7 @@ class BaseHandlerTestCase(BaseTestCase, abc.ABC):
         code: int,
         message: str | None = None,
         headers: dict[str, str] | None = None,
+        content_length: int = 0,
     ) -> typing.Iterator[None]:
         if headers is None:
             headers = {}
@@ -46,7 +47,7 @@ class BaseHandlerTestCase(BaseTestCase, abc.ABC):
         send_response_mock.assert_called_once_with(code, message)
         send_header_mock.assert_has_calls(
             [
-                unittest.mock.call("Content-Length", "0"),
+                unittest.mock.call("Content-Length", str(content_length)),
             ]
             + [unittest.mock.call(header, value) for header, value in headers.items()],
             any_order=True,
@@ -136,6 +137,8 @@ class TestRequestHandler(BaseHandlerTestCase):
     ) -> RequestHandler:
         if headers is None:
             headers = {}
+        if "Accept" not in headers:
+            headers["Accept"] = "nothing"
         with self.patch("http.server.BaseHTTPRequestHandler.__init__"):
             handler = RequestHandler(
                 unittest.mock.MagicMock(),
@@ -160,9 +163,51 @@ class TestRequestHandler(BaseHandlerTestCase):
             handler.data_dir = self.data_dir
             return handler
 
-    def test_do_head_forward(self) -> None:
+    def test_handle_errors_silently(self) -> None:
+        with self.patch("http.server.BaseHTTPRequestHandler.__init__") as mock:
+            mock.side_effect = Exception
+            logging.basicConfig(level=logging.CRITICAL)
+            RequestHandler(
+                unittest.mock.MagicMock(),
+                "127.0.0.1",
+                unittest.mock.MagicMock(),
+                params=Parameters(
+                    data_dir=self.get_tmp_dir(), certbot_www=str(self.certbot_www)
+                ),
+                registry=self.registry,
+                token_manager=self.token_manager,
+            )
+
+    def test_handle_disconnect_silently(self) -> None:
+        with self.patch("http.server.BaseHTTPRequestHandler.__init__") as mock:
+            mock.side_effect = BrokenPipeError
+            logging.basicConfig(level=logging.CRITICAL)
+            RequestHandler(
+                unittest.mock.MagicMock(),
+                "127.0.0.1",
+                unittest.mock.MagicMock(),
+                params=Parameters(
+                    data_dir=self.get_tmp_dir(), certbot_www=str(self.certbot_www)
+                ),
+                registry=self.registry,
+                token_manager=self.token_manager,
+            )
+
+    def test_do_head_index(self) -> None:
         handler = self._get_handler()
         with (
+            self.expects_status_only(
+                handler, 200, content_length=len(handler.server_signature())
+            ),
+            self.patch("http.server.SimpleHTTPRequestHandler.do_HEAD", count=0),
+            self.seal_mocks(),
+        ):
+            handler.do_HEAD()
+
+    def test_do_head_forward(self) -> None:
+        handler = self._get_handler("/file")
+        with (
+            self.mock_call(self.registry.get_from_path, ["file"], Page("file")),
             self.patch("http.server.SimpleHTTPRequestHandler.do_HEAD"),
             self.seal_mocks(),
         ):
@@ -433,8 +478,9 @@ class TestRequestHandler(BaseHandlerTestCase):
             self.mock_call_unchecked(self.data_dir.extract_tar_bytes),
             self.mock_call(self.registry.add, ["path"]),
             self.mock_call(self.token_manager.set_token, ["path", "secret"]),
+            self.mock_call(self.registry.get_from_path, ["path"]),
             self.expects_status_only(
-                handler, http.HTTPStatus.CREATED, "Resource /path/ updated"
+                handler, http.HTTPStatus.CREATED, "Resource updated"
             ),
             self.seal_mocks(),
         ):
@@ -458,8 +504,33 @@ class TestRequestHandler(BaseHandlerTestCase):
             self.mock_call(self.registry.add, ["path"]),
             self.mock_call(self.token_manager.set_token, ["path", "secret"]),
             self.mock_call(self.registry.set_host, ["path", "example.com"]),
+            self.mock_call(self.registry.get_from_path, ["path"]),
             self.expects_status_only(
-                handler, http.HTTPStatus.CREATED, "Resource /path/ updated"
+                handler, http.HTTPStatus.CREATED, "Resource updated"
+            ),
+            self.seal_mocks(),
+        ):
+            handler.do_PUT()
+
+    def test_do_put_extract_with_spa(self) -> None:
+        handler = self._get_handler(
+            "/path", {"X-Token": "secret", "X-SPA": "index.html", "Content-Length": "1"}
+        )
+        handler.rfile.write(b"\0")
+        with (
+            self.mock_call(self.token_manager.is_valid, ["secret"], True),  # noqa: FBT003
+            self.mock_call(
+                self.token_manager.is_valid_for_path,
+                ["secret", "path"],
+                True,  # noqa: FBT003
+            ),
+            self.mock_call_unchecked(self.data_dir.extract_tar_bytes),
+            self.mock_call(self.registry.add, ["path"]),
+            self.mock_call(self.token_manager.set_token, ["path", "secret"]),
+            self.mock_call(self.registry.set_spa, ["path", "index.html"]),
+            self.mock_call(self.registry.get_from_path, ["path"]),
+            self.expects_status_only(
+                handler, http.HTTPStatus.CREATED, "Resource updated"
             ),
             self.seal_mocks(),
         ):
@@ -507,8 +578,9 @@ class TestRequestHandler(BaseHandlerTestCase):
             ),
             self.mock_call(self.registry.set_redirect, ["path", "https://example.com"]),
             self.mock_call(self.token_manager.set_token, ["path", "secret"]),
+            self.mock_call(self.registry.get_from_path, ["path"]),
             self.expects_status_only(
-                handler, http.HTTPStatus.CREATED, "Resource /path/ updated"
+                handler, http.HTTPStatus.CREATED, "Resource updated"
             ),
             self.seal_mocks(),
         ):
@@ -534,8 +606,9 @@ class TestRequestHandler(BaseHandlerTestCase):
             self.mock_call(self.registry.set_redirect, ["path", "https://example.com"]),
             self.mock_call(self.token_manager.set_token, ["path", "secret"]),
             self.mock_call(self.registry.set_host, ["path", "example.com"]),
+            self.mock_call(self.registry.get_from_path, ["path"]),
             self.expects_status_only(
-                handler, http.HTTPStatus.CREATED, "Resource /path/ updated"
+                handler, http.HTTPStatus.CREATED, "Resource updated"
             ),
             self.seal_mocks(),
         ):
@@ -561,8 +634,9 @@ class TestRequestHandler(BaseHandlerTestCase):
             self.mock_call(self.registry.set_redirect, ["path", "https://example.com"]),
             self.mock_call(self.token_manager.set_token, ["path", "secret"]),
             self.mock_call(self.registry.set_host_only, ["path", "example.com"]),
+            self.mock_call(self.registry.get_from_path, ["path"]),
             self.expects_status_only(
-                handler, http.HTTPStatus.CREATED, "Resource /path/ updated"
+                handler, http.HTTPStatus.CREATED, "Resource updated"
             ),
             self.seal_mocks(),
         ):
@@ -610,8 +684,9 @@ class TestRequestHandler(BaseHandlerTestCase):
             ),
             self.mock_call(self.registry.set_proxy, ["path", "https://example.com"]),
             self.mock_call(self.token_manager.set_token, ["path", "secret"]),
+            self.mock_call(self.registry.get_from_path, ["path"]),
             self.expects_status_only(
-                handler, http.HTTPStatus.CREATED, "Resource /path/ updated"
+                handler, http.HTTPStatus.CREATED, "Resource updated"
             ),
             self.seal_mocks(),
         ):
@@ -637,8 +712,9 @@ class TestRequestHandler(BaseHandlerTestCase):
             self.mock_call(self.registry.set_proxy, ["path", "https://example.com"]),
             self.mock_call(self.token_manager.set_token, ["path", "secret"]),
             self.mock_call(self.registry.set_host, ["path", "example.com"]),
+            self.mock_call(self.registry.get_from_path, ["path"]),
             self.expects_status_only(
-                handler, http.HTTPStatus.CREATED, "Resource /path/ updated"
+                handler, http.HTTPStatus.CREATED, "Resource updated"
             ),
             self.seal_mocks(),
         ):
@@ -760,9 +836,7 @@ class TestRequestHandler(BaseHandlerTestCase):
             self.mock_call(self.data_dir.exists, ["path"], True),  # noqa: FBT003
             self.mock_call(self.data_dir.remove, ["path"]),
             self.mock_call(self.registry.remove, ["path"]),
-            self.expects_error(
-                handler, http.HTTPStatus.NO_CONTENT, "Resource /path/ removed"
-            ),
+            self.expects_error(handler, http.HTTPStatus.OK, "Resource /path/ removed"),
             self.seal_mocks(),
         ):
             handler.do_DELETE()
@@ -790,6 +864,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     "data": None,
                     "headers": {
                         "Host": "example.com",
+                        "Accept": "nothing",
                         "X-Real-IP": "127.0.0.1",
                         "X-Forwarded-Host": "localhost",
                         "X-Forwarded-For": "127.0.0.1",
@@ -797,6 +872,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_status_only(handler, 200, "OK"),
@@ -832,6 +908,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     "data": b"hello",
                     "headers": {
                         "Host": "example.com",
+                        "Accept": "nothing",
                         "X-Real-IP": "127.0.0.1",
                         "X-Forwarded-Host": "localhost",
                         "X-Forwarded-For": "127.0.0.1",
@@ -840,6 +917,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_status_only(handler, 200, "OK"),
@@ -874,6 +952,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     "data": None,
                     "headers": {
                         "Host": "example.com",
+                        "Accept": "nothing",
                         "X-Real-IP": "127.0.0.1",
                         "X-Forwarded-Host": "localhost",
                         "X-Forwarded-For": "127.0.0.1",
@@ -881,6 +960,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_basic_body(handler, "hello", message="OK"),
@@ -907,6 +987,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     "data": None,
                     "headers": {
                         "Host": "example.com",
+                        "Accept": "nothing",
                         "X-Real-IP": "127.0.0.1",
                         "X-Forwarded-Host": "localhost",
                         "X-Forwarded-For": "127.0.0.1",
@@ -914,6 +995,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ) as request_mock,
             self.expects_status_only(
@@ -949,6 +1031,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     "data": None,
                     "headers": {
                         "Host": "example.com",
+                        "Accept": "nothing",
                         "X-Real-IP": "127.0.0.1",
                         "X-Forwarded-Host": "localhost",
                         "X-Forwarded-For": "127.0.0.1",
@@ -956,6 +1039,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_status_only(handler, 200, "OK"),
@@ -988,6 +1072,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     "data": None,
                     "headers": {
                         "Host": "example.com",
+                        "Accept": "nothing",
                         "X-Real-IP": "127.0.0.1",
                         "X-Forwarded-Host": "host",
                         "X-Forwarded-For": "127.0.0.1",
@@ -995,6 +1080,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_status_only(handler, 200, "OK"),
@@ -1125,6 +1211,21 @@ class TestRequestHandler(BaseHandlerTestCase):
                 None,
             )
 
+    def test_translate_path_with_host_favicon(self) -> None:
+        handler = self._get_handler(headers={"Host": "example.com"})
+        with (
+            self.mock_call(self.registry.get_from_host, ["example.com"], Page("path")),
+            self.patch_call(
+                "http.server.SimpleHTTPRequestHandler.translate_path",
+                ["/favicon.ico"],
+            ),
+            self.seal_mocks(),
+        ):
+            self.assertEqual(
+                handler.translate_path("/favicon.ico"),
+                None,
+            )
+
     def test_translate_path_default_host(self) -> None:
         handler = self._get_handler()
         with (
@@ -1166,6 +1267,23 @@ class TestRequestHandler(BaseHandlerTestCase):
                 "",
             )
 
+    def test_translate_path_spa(self) -> None:
+        handler = self._get_handler()
+        with (
+            self.mock_call(
+                self.registry.get_from_path, ["path"], Page("path", spa="index.html")
+            ),
+            self.patch_call(
+                "http.server.SimpleHTTPRequestHandler.translate_path",
+                ["/path/index.html"],
+            ),
+            self.seal_mocks(),
+        ):
+            self.assertEqual(
+                handler.translate_path("/path/to/thing"),
+                None,
+            )
+
 
 class TestUpgradeHandler(BaseHandlerTestCase):
     @typing.override
@@ -1199,6 +1317,7 @@ class TestUpgradeHandler(BaseHandlerTestCase):
             handler.headers = collections.defaultdict(lambda: None, headers)  # ty:ignore[invalid-assignment]
             handler.rfile = rfile if rfile is not None else io.BytesIO()
             handler.wfile = io.BytesIO()
+            handler.client_address = ("127.0.0.1", 12345)
             handler.logger = unittest.mock.Mock(logging.Logger)
             handler.data_dir = self.data_dir
             return handler

tests/test_page.py

@@ -33,3 +33,9 @@ class TestPage(BaseTestCase):
             str(Page("test_1", with_index=True, host_only=True)),
             "/test_1/ (host only)",
         )
+
+    def test_repr_with_spa(self) -> None:
+        self.assertEqual(
+            str(Page("test_1", with_index=True, spa="index.html")),
+            "/test_1/ (spa: index.html)",
+        )

tests/test_registry.py

@@ -32,11 +32,13 @@ class TestRegistry(BaseTestCase):
                     ["test_1", Registry.TOKEN_FILE],
                     ["test_1", Registry.REDIRECT_FILE],
                     ["test_1", Registry.PROXY_FILE],
+                    ["test_1", Registry.SPA_FILE],
                     ["test_2", Registry.HOST_FILE],
                     ["test_2", Registry.HOST_ONLY_FILE],
                     ["test_2", Registry.TOKEN_FILE],
                     ["test_2", Registry.REDIRECT_FILE],
                     ["test_2", Registry.PROXY_FILE],
+                    ["test_2", Registry.SPA_FILE],
                 ],
                 [
                     None,
@@ -46,9 +48,11 @@ class TestRegistry(BaseTestCase):
                     None,
                     None,
                     None,
+                    None,
                     "test_2_token",
                     "test_2_redirect",
                     None,
+                    None,
                 ],
             ),
             self.seal_mocks(),
@@ -257,6 +261,38 @@ class TestRegistry(BaseTestCase):
         self.assertIn("test_1", self.registry.pages)
         self.assertEqual(self.registry.pages["test_1"].proxy, "https://new-example.com")
 
+    def test_set_spa(self) -> None:
+        self.registry.pages["test_1"] = Page(
+            "test_1",
+            spa=None,
+        )
+        with (
+            self.mock_call(
+                self.data_dir.set_file,
+                ["test_1", Registry.SPA_FILE, "new_value"],
+            ),
+            self.seal_mocks(),
+        ):
+            self.registry.set_spa("test_1", "new_value")
+        self.assertEqual(self.registry.pages["test_1"].spa, "new_value")
+
+    def test_set_spa_no_change(self) -> None:
+        self.registry.pages["test_1"] = Page(
+            "test_1",
+            spa="value",
+        )
+        with (
+            self.seal_mocks(),
+        ):
+            self.registry.set_spa("test_1", "value")
+        self.assertEqual(self.registry.pages["test_1"].spa, "value")
+
+    def test_set_spa_not_found(self) -> None:
+        with (
+            self.seal_mocks(),
+        ):
+            self.registry.set_spa("test_1", "value")
+
     def test_remove(self) -> None:
         self.registry.pages["test_1"] = Page(
             "test_1",

tests/test_server.py

@@ -26,10 +26,8 @@ class TestStaplerServer(BaseTestCase):
     def test_renew(self) -> None:
         with (
             self.mock_call(self.registry.load_pages),
-            self.mock_calls(
-                self.registry.get_hosts, [[], []], [["host_1"], ["host_1"]]
-            ),
-            self.mock_call(self.cert_manager.init, [["localhost", "host_1"]]),
+            self.mock_calls(self.registry.get_hosts, [[]], [["host_1"]]),
+            self.mock_call(self.cert_manager.init),
             self.mock_calls(
                 self.cert_manager.create_or_update, [["localhost"], ["host_1"]]
             ),
@@ -67,16 +65,16 @@ class TestStaplerServer(BaseTestCase):
 
     def test_run_https(self) -> None:
         self.token_manager.detect_file_change.side_effect = KeyboardInterrupt
-        self.cert_manager.sni_callback = unittest.mock.Mock()
+        self.cert_manager.servername_callback = unittest.mock.Mock()
         with (
             self.mock_call(self.registry.load_pages),
-            self.mock_call(self.registry.get_hosts, [], []),
-            self.mock_call(self.cert_manager.init, [["localhost"]]),
+            self.mock_call(self.cert_manager.init),
             self.mock_call(self.data_dir.init),
             self.mock_call(self.token_manager.init),
             self.patch("ssl.create_default_context", return_value=self.context_mock),
             self.patch("http.server.ThreadingHTTPServer", self.server_mock, 2),
             self.mock_call_unchecked(self.context_mock.wrap_socket),
+            self.mock_call_unchecked(self.context_mock.set_servername_callback),
             self.mock_calls_unchecked(self.server_mock.serve_forever, 2),
             self.mock_call(self.server_mock.shutdown),
             self.seal_mocks(),

tests/test_strings.py

@@ -0,0 +1,22 @@
+import parameterized
+
+from stapler.strings import sanitize_string, valid_host
+
+from . import BaseTestCase
+
+
+class TestStrings(BaseTestCase):
+    def test_sanitize(self) -> None:
+        self.assertEqual("??A??", sanitize_string("\n\tA\x00\x99"))
+
+    @parameterized.parameterized.expand(
+        [("example.com"), ("test-test.com"), ("subdomain.example.com")]
+    )
+    def test_valid_host(self, host: str) -> None:
+        self.assertTrue(valid_host(host), host)
+
+    @parameterized.parameterized.expand(
+        [("example.c"), ("localhost"), ("127.0.0.1"), ("test..com"), ("www-.test.com")]
+    )
+    def test_invalid_host(self, host: str) -> None:
+        self.assertFalse(valid_host(host), host)

uv.lock

@@ -4,11 +4,11 @@ requires-python = ">=3.14"
 
 [[package]]
 name = "certifi"
-version = "2026.2.25"
+version = "2026.4.22"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/af/2d/7bf41579a8986e348fa033a31cdd0e4121114f6bce2457e8876010b092dd/certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7", size = 155029, upload-time = "2026-02-25T02:54:17.342Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/25/ee/6caf7a40c36a1220410afe15a1cc64993a1f864871f698c0f93acb72842a/certifi-2026.4.22.tar.gz", hash = "sha256:8d455352a37b71bf76a79caa83a3d6c25afee4a385d632127b6afb3963f1c580", size = 137077, upload-time = "2026-04-22T11:26:11.191Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9a/3c/c17fb3ca2d9c3acff52e30b309f538586f9f5b9c9cf454f3845fc9af4881/certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa", size = 153684, upload-time = "2026-02-25T02:54:15.766Z" },
+    { url = "https://files.pythonhosted.org/packages/22/30/7cd8fdcdfbc5b869528b079bfb76dcdf6056b1a2097a662e5e8c04f42965/certifi-2026.4.22-py3-none-any.whl", hash = "sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a", size = 135707, upload-time = "2026-04-22T11:26:09.372Z" },
 ]
 
 [[package]]
@@ -52,6 +52,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/db/8f/61959034484a4a7c527811f4721e75d02d653a35afb0b6054474d8185d4c/charset_normalizer-3.4.7-py3-none-any.whl", hash = "sha256:3dce51d0f5e7951f8bb4900c257dad282f49190fdbebecd4ba99bcc41fef404d", size = 61958, upload-time = "2026-04-02T09:28:37.794Z" },
 ]
 
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
 [[package]]
 name = "coverage"
 version = "7.13.5"
@@ -93,11 +102,72 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.12"
+version = "3.13"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/22/12/2948fbe5513d062169bd91f7d7b1cd97bc8894f32946b71fa39f6e63ca0c/idna-3.12.tar.gz", hash = "sha256:724e9952cc9e2bd7550ea784adb098d837ab5267ef67a1ab9cf7846bdbdd8254", size = 194350, upload-time = "2026-04-21T13:32:48.916Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/cc/762dfb036166873f0059f3b7de4565e1b5bc3d6f28a414c13da27e442f99/idna-3.13.tar.gz", hash = "sha256:585ea8fe5d69b9181ec1afba340451fba6ba764af97026f92a91d4eef164a242", size = 194210, upload-time = "2026-04-22T16:42:42.314Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/53/b2/acc33950394b3becb2b664741a0c0889c7ef9f9ffbfa8d47eddb53a50abd/idna-3.12-py3-none-any.whl", hash = "sha256:60ffaa1858fac94c9c124728c24fcde8160f3fb4a7f79aa8cdd33a9d1af60a67", size = 68634, upload-time = "2026-04-21T13:32:47.403Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/13/ad7d7ca3808a898b4612b6fe93cde56b53f3034dcde235acb1f0e1df24c6/idna-3.13-py3-none-any.whl", hash = "sha256:892ea0cde124a99ce773decba204c5552b69c3c67ffd5f232eb7696135bc8bb3", size = 68629, upload-time = "2026-04-22T16:42:40.909Z" },
+]
+
+[[package]]
+name = "iniconfig"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
+]
+
+[[package]]
+name = "packaging"
+version = "26.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d7/f1/e7a6dd94a8d4a5626c03e4e99c87f241ba9e350cd9e6d75123f992427270/packaging-26.2.tar.gz", hash = "sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661", size = 228134, upload-time = "2026-04-24T20:15:23.917Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
+]
+
+[[package]]
+name = "parameterized"
+version = "0.9.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ea/49/00c0c0cc24ff4266025a53e41336b79adaa5a4ebfad214f433d623f9865e/parameterized-0.9.0.tar.gz", hash = "sha256:7fc905272cefa4f364c1a3429cbbe9c0f98b793988efb5bf90aac80f08db09b1", size = 24351, upload-time = "2023-03-27T02:01:11.592Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/00/2f/804f58f0b856ab3bf21617cccf5b39206e6c4c94c2cd227bde125ea6105f/parameterized-0.9.0-py2.py3-none-any.whl", hash = "sha256:4e0758e3d41bea3bbd05ec14fc2c24736723f243b28d702081aef438c9372b1b", size = 20475, upload-time = "2023-03-27T02:01:09.31Z" },
+]
+
+[[package]]
+name = "pluggy"
+version = "1.6.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
+]
+
+[[package]]
+name = "pygments"
+version = "2.20.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
+]
+
+[[package]]
+name = "pytest"
+version = "9.0.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "iniconfig" },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
 ]
 
 [[package]]
@@ -117,32 +187,32 @@ wheels = [
 
 [[package]]
 name = "ruff"
-version = "0.15.11"
+version = "0.15.12"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e4/8d/192f3d7103816158dfd5ea50d098ef2aec19194e6cbccd4b3485bdb2eb2d/ruff-0.15.11.tar.gz", hash = "sha256:f092b21708bf0e7437ce9ada249dfe688ff9a0954fc94abab05dcea7dcd29c33", size = 4637264, upload-time = "2026-04-16T18:46:26.58Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/99/43/3291f1cc9106f4c63bdce7a8d0df5047fe8422a75b091c16b5e9355e0b11/ruff-0.15.12.tar.gz", hash = "sha256:ecea26adb26b4232c0c2ca19ccbc0083a68344180bba2a600605538ce51a40a6", size = 4643852, upload-time = "2026-04-24T18:17:14.305Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/02/1e/6aca3427f751295ab011828e15e9bf452200ac74484f1db4be0197b8170b/ruff-0.15.11-py3-none-linux_armv6l.whl", hash = "sha256:e927cfff503135c558eb581a0c9792264aae9507904eb27809cdcff2f2c847b7", size = 10607943, upload-time = "2026-04-16T18:46:05.967Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/26/1341c262e74f36d4e84f3d6f4df0ac68cd53331a66bfc5080daa17c84c0b/ruff-0.15.11-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:7a1b5b2938d8f890b76084d4fa843604d787a912541eae85fd7e233398bbb73e", size = 10988592, upload-time = "2026-04-16T18:46:00.742Z" },
-    { url = "https://files.pythonhosted.org/packages/03/71/850b1d6ffa9564fbb6740429bad53df1094082fe515c8c1e74b6d8d05f18/ruff-0.15.11-py3-none-macosx_11_0_arm64.whl", hash = "sha256:d4176f3d194afbdaee6e41b9ccb1a2c287dba8700047df474abfbe773825d1cb", size = 10338501, upload-time = "2026-04-16T18:46:03.723Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/11/cc1284d3e298c45a817a6aadb6c3e1d70b45c9b36d8d9cce3387b495a03a/ruff-0.15.11-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3b17c886fb88203ced3afe7f14e8d5ae96e9d2f4ccc0ee66aa19f2c2675a27e4", size = 10670693, upload-time = "2026-04-16T18:46:41.941Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/9e/f8288b034ab72b371513c13f9a41d9ba3effac54e24bfb467b007daee2ca/ruff-0.15.11-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:49fafa220220afe7758a487b048de4c8f9f767f37dfefad46b9dd06759d003eb", size = 10416177, upload-time = "2026-04-16T18:46:21.717Z" },
-    { url = "https://files.pythonhosted.org/packages/85/71/504d79abfd3d92532ba6bbe3d1c19fada03e494332a59e37c7c2dabae427/ruff-0.15.11-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f2ab8427e74a00d93b8bda1307b1e60970d40f304af38bccb218e056c220120d", size = 11221886, upload-time = "2026-04-16T18:46:15.086Z" },
-    { url = "https://files.pythonhosted.org/packages/43/5a/947e6ab7a5ad603d65b474be15a4cbc6d29832db5d762cd142e4e3a74164/ruff-0.15.11-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:195072c0c8e1fc8f940652073df082e37a5d9cb43b4ab1e4d0566ab8977a13b7", size = 12075183, upload-time = "2026-04-16T18:46:07.944Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/a1/0b7bb6268775fdd3a0818aee8efd8f5b4e231d24dd4d528ced2534023182/ruff-0.15.11-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a3a0996d486af3920dec930a2e7daed4847dfc12649b537a9335585ada163e9e", size = 11516575, upload-time = "2026-04-16T18:46:31.687Z" },
-    { url = "https://files.pythonhosted.org/packages/30/c3/bb5168fc4d233cc06e95f482770d0f3c87945a0cd9f614b90ea8dc2f2833/ruff-0.15.11-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1bef2cb556d509259f1fe440bb9cd33c756222cf0a7afe90d15edf0866702431", size = 11306537, upload-time = "2026-04-16T18:46:36.988Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/92/4cfae6441f3967317946f3b788136eecf093729b94d6561f963ed810c82e/ruff-0.15.11-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:030d921a836d7d4a12cf6e8d984a88b66094ccb0e0f17ddd55067c331191bf19", size = 11296813, upload-time = "2026-04-16T18:46:24.182Z" },
-    { url = "https://files.pythonhosted.org/packages/43/26/972784c5dde8313acde8ac71ba8ac65475b85db4a2352a76c9934361f9bc/ruff-0.15.11-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:0e783b599b4577788dbbb66b9addcef87e9a8832f4ce0c19e34bf55543a2f890", size = 10633136, upload-time = "2026-04-16T18:46:39.802Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/53/3985a4f185020c2f367f2e08a103032e12564829742a1b417980ce1514a0/ruff-0.15.11-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:ae90592246625ba4a34349d68ec28d4400d75182b71baa196ddb9f82db025ef5", size = 10424701, upload-time = "2026-04-16T18:46:10.381Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/57/bf0dfb32241b56c83bb663a826133da4bf17f682ba8c096973065f6e6a68/ruff-0.15.11-py3-none-musllinux_1_2_i686.whl", hash = "sha256:1f111d62e3c983ed20e0ca2e800f8d77433a5b1161947df99a5c2a3fb60514f0", size = 10873887, upload-time = "2026-04-16T18:46:29.157Z" },
-    { url = "https://files.pythonhosted.org/packages/02/05/e48076b2a57dc33ee8c7a957296f97c744ca891a8ffb4ffb1aaa3b3f517d/ruff-0.15.11-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:06f483d6646f59eaffba9ae30956370d3a886625f511a3108994000480621d1c", size = 11404316, upload-time = "2026-04-16T18:46:19.462Z" },
-    { url = "https://files.pythonhosted.org/packages/88/27/0195d15fe7a897cbcba0904792c4b7c9fdd958456c3a17d2ea6093716a9a/ruff-0.15.11-py3-none-win32.whl", hash = "sha256:476a2aa56b7da0b73a3ee80b6b2f0e19cce544245479adde7baa65466664d5f3", size = 10655535, upload-time = "2026-04-16T18:46:12.47Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/5e/c927b325bd4c1d3620211a4b96f47864633199feed60fa936025ab27e090/ruff-0.15.11-py3-none-win_amd64.whl", hash = "sha256:8b6756d88d7e234fb0c98c91511aae3cd519d5e3ed271cae31b20f39cb2a12a3", size = 11779692, upload-time = "2026-04-16T18:46:17.268Z" },
-    { url = "https://files.pythonhosted.org/packages/63/b6/aeadee5443e49baa2facd51131159fd6301cc4ccfc1541e4df7b021c37dd/ruff-0.15.11-py3-none-win_arm64.whl", hash = "sha256:063fed18cc1bbe0ee7393957284a6fe8b588c6a406a285af3ee3f46da2391ee4", size = 11032614, upload-time = "2026-04-16T18:46:34.487Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/6e/e78ffb61d4686f3d96ba3df2c801161843746dcbcbb17a1e927d4829312b/ruff-0.15.12-py3-none-linux_armv6l.whl", hash = "sha256:f86f176e188e94d6bdbc09f09bfd9dc729059ad93d0e7390b5a73efe19f8861c", size = 10640713, upload-time = "2026-04-24T18:17:22.841Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/08/a317bc231fb9e7b93e4ef3089501e51922ff88d6936ce5cf870c4fe55419/ruff-0.15.12-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:e3bcd123364c3770b8e1b7baaf343cc99a35f197c5c6e8af79015c666c423a6c", size = 11069267, upload-time = "2026-04-24T18:17:30.105Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/a4/f828e9718d3dce1f5f11c39c4f65afd32783c8b2aebb2e3d259e492c47bd/ruff-0.15.12-py3-none-macosx_11_0_arm64.whl", hash = "sha256:fe87510d000220aa1ed530d4448a7c696a0cae1213e5ec30e5874287b66557b5", size = 10397182, upload-time = "2026-04-24T18:17:07.177Z" },
+    { url = "https://files.pythonhosted.org/packages/71/e0/3310fc6d1b5e1fdea22bf3b1b807c7e187b581021b0d7d4514cccdb5fb71/ruff-0.15.12-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:84a1630093121375a3e2a95b4a6dc7b59e2b4ee76216e32d81aae550a832d002", size = 10758012, upload-time = "2026-04-24T18:16:55.759Z" },
+    { url = "https://files.pythonhosted.org/packages/11/c1/a606911aee04c324ddaa883ae418f3569792fd3c4a10c50e0dd0a2311e1e/ruff-0.15.12-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:fb129f40f114f089ebe0ca56c0d251cf2061b17651d464bb6478dc01e69f11f5", size = 10447479, upload-time = "2026-04-24T18:16:51.677Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/68/4201e8444f0894f21ab4aeeaee68aa4f10b51613514a20d80bd628d57e88/ruff-0.15.12-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b0c862b172d695db7598426b8af465e7e9ac00a3ea2a3630ee67eb82e366aaa6", size = 11234040, upload-time = "2026-04-24T18:17:16.529Z" },
+    { url = "https://files.pythonhosted.org/packages/34/ff/8a6d6cf4ccc23fd67060874e832c18919d1557a0611ebef03fdb01fff11e/ruff-0.15.12-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2849ea9f3484c3aca43a82f484210370319e7170df4dfe4843395ddf6c57bc33", size = 12087377, upload-time = "2026-04-24T18:17:04.944Z" },
+    { url = "https://files.pythonhosted.org/packages/85/f6/c669cf73f5152f623d34e69866a46d5e6185816b19fcd5b6dd8a2d299922/ruff-0.15.12-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9e77c7e51c07fe396826d5969a5b846d9cd4c402535835fb6e21ce8b28fef847", size = 11367784, upload-time = "2026-04-24T18:17:25.409Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/39/c61d193b8a1daaa8977f7dea9e8d8ba866e02ea7b65d32f6861693aa4c12/ruff-0.15.12-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:83b2f4f2f3b1026b5fb449b467d9264bf22067b600f7b6f41fc5958909f449d0", size = 11344088, upload-time = "2026-04-24T18:17:12.258Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/8d/49afab3645e31e12c590acb6d3b5b69d7aab5b81926dbaf7461f9441f37a/ruff-0.15.12-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:9ba3b8f1afd7e2e43d8943e55f249e13f9682fde09711644a6e7290eb4f3e339", size = 11271770, upload-time = "2026-04-24T18:17:02.457Z" },
+    { url = "https://files.pythonhosted.org/packages/46/06/33f41fe94403e2b755481cdfb9b7ef3e4e0ed031c4581124658d935d52b4/ruff-0.15.12-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:e852ba9fdc890655e1d78f2df1499efbe0e54126bd405362154a75e2bde159c5", size = 10719355, upload-time = "2026-04-24T18:17:27.648Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/59/18aa4e014debbf559670e4048e39260a85c7fcee84acfd761ac01e7b8d35/ruff-0.15.12-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:dd8aed930da53780d22fc70bdf84452c843cf64f8cb4eb38984319c24c5cd5fd", size = 10462758, upload-time = "2026-04-24T18:17:32.347Z" },
+    { url = "https://files.pythonhosted.org/packages/25/e7/cc9f16fd0f3b5fddcbd7ec3d6ae30c8f3fde1047f32a4093a98d633c6570/ruff-0.15.12-py3-none-musllinux_1_2_i686.whl", hash = "sha256:01da3988d225628b709493d7dc67c3b9b12c0210016b08690ef9bd27970b262b", size = 10953498, upload-time = "2026-04-24T18:17:20.674Z" },
+    { url = "https://files.pythonhosted.org/packages/72/7a/a9ba7f98c7a575978698f4230c5e8cc54bbc761af34f560818f933dafa0c/ruff-0.15.12-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:9cae0f92bd5700d1213188b31cd3bdd2b315361296d10b96b8e2337d3d11f53e", size = 11447765, upload-time = "2026-04-24T18:17:09.755Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/f9/0ae446942c846b8266059ad8a30702a35afae55f5cdc54c5adf8d7afdc27/ruff-0.15.12-py3-none-win32.whl", hash = "sha256:d0185894e038d7043ba8fd6aee7499ece6462dc0ea9f1e260c7451807c714c20", size = 10657277, upload-time = "2026-04-24T18:17:18.591Z" },
+    { url = "https://files.pythonhosted.org/packages/33/f1/9614e03e1cdcbf9437570b5400ced8a720b5db22b28d8e0f1bda429f660d/ruff-0.15.12-py3-none-win_amd64.whl", hash = "sha256:c87a162d61ab3adca47c03f7f717c68672edec7d1b5499e652331780fe74950d", size = 11837758, upload-time = "2026-04-24T18:17:00.113Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/98/6beb4b351e472e5f4c4613f7c35a5290b8be2497e183825310c4c3a3984b/ruff-0.15.12-py3-none-win_arm64.whl", hash = "sha256:a538f7a82d061cee7be55542aca1d86d1393d55d81d4fcc314370f4340930d4f", size = 11120821, upload-time = "2026-04-24T18:16:57.979Z" },
 ]
 
 [[package]]
 name = "stapler"
-version = "1.1.0"
+version = "1.4.0"
 source = { editable = "." }
 dependencies = [
     { name = "requests" },
@@ -151,6 +221,8 @@ dependencies = [
 [package.dev-dependencies]
 dev = [
     { name = "coverage" },
+    { name = "parameterized" },
+    { name = "pytest" },
     { name = "ruff" },
     { name = "ty" },
 ]
@@ -161,32 +233,34 @@ requires-dist = [{ name = "requests", specifier = ">=2.33.1" }]
 [package.metadata.requires-dev]
 dev = [
     { name = "coverage", specifier = ">=7.13.5" },
+    { name = "parameterized", specifier = ">=0.9.0" },
+    { name = "pytest", specifier = ">=9.0.3" },
     { name = "ruff", specifier = ">=0.15.10" },
     { name = "ty", specifier = ">=0.0.29" },
 ]
 
 [[package]]
 name = "ty"
-version = "0.0.32"
+version = "0.0.34"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/85/7e/2aa791c9ae7b8cd5024cd4122e92267f664ca954cea3def3211919fa3c1f/ty-0.0.32.tar.gz", hash = "sha256:8743174c5f920f6700a4a0c9de140109189192ba16226884cd50095b43b8a45c", size = 5522294, upload-time = "2026-04-20T19:29:01.626Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c4/69/e24eefe2c35c0fdbdec9b60e162727af669bb76d64d993d982eb67b24c38/ty-0.0.34.tar.gz", hash = "sha256:a6efe66b0f13c03a65e6c72ec9abfe2792e2fd063c74fa67e2c4930e29d661be", size = 5585933, upload-time = "2026-05-01T23:06:46.388Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/62/eb/1075dc6a49d7acbe2584ae4d5b410c41b1f177a5adcc567e09eca4c69000/ty-0.0.32-py3-none-linux_armv6l.whl", hash = "sha256:dacbc2f6cd698d488ae7436838ff929570455bf94bfa4d9fe57a630c552aff83", size = 10902959, upload-time = "2026-04-20T19:28:31.907Z" },
-    { url = "https://files.pythonhosted.org/packages/33/d2/c35fc8bc66e98d1ee9b0f8ed319bf743e450e1f1e997574b178fab75670f/ty-0.0.32-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:914bbc4f605ce2a9e2a78982e28fae1d3359a169d141f9dc3b4c7749cd5eca81", size = 10726172, upload-time = "2026-04-20T19:28:44.765Z" },
-    { url = "https://files.pythonhosted.org/packages/96/32/c827da3ca480456fb02d8cea68a2609273b6c220fea0be9a4c8d8470b86e/ty-0.0.32-py3-none-macosx_11_0_arm64.whl", hash = "sha256:4787ac9fe1f86b1f3133f5c6732adbe2df5668b50c679ac6e2d98cd284da812f", size = 10163701, upload-time = "2026-04-20T19:28:27.005Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/9e/2734478fbdb90c160cb2813a3916a16a2af5c1e231f87d635f6131d781fb/ty-0.0.32-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d8ea0a728af99fe40dd744cba6441a2404f80b7f4bde17aa6da393810af5ea57", size = 10656220, upload-time = "2026-04-20T19:29:03.814Z" },
-    { url = "https://files.pythonhosted.org/packages/44/9f/0007da2d35e424debe7e9f86ffbc1ab7f60983cfbc5f0411324ab2de5292/ty-0.0.32-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2850561f9b018ae33d7e5bbfa0ac414d3c518513edcffe43877dc9801446b9c5", size = 10696086, upload-time = "2026-04-20T19:28:46.829Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/5e/ce5fd4ec803222ae3e69a76d2a2db2eed55e19f5b131702b9789ef45f93d/ty-0.0.32-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b5fa2fb3c614349ee211d36476b49d88c5ef79a687cdb91b2872ad023b94d2f8", size = 11184800, upload-time = "2026-04-20T19:28:42.57Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/46/ebcf67a5999421331214aac51a7464db42de2be15bbe929c612a3ed0b039/ty-0.0.32-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2b89969307ab2417d41c9be8059dd79feea577234e1e10d35132f5495e0d42c6", size = 11718718, upload-time = "2026-04-20T19:28:36.433Z" },
-    { url = "https://files.pythonhosted.org/packages/18/2c/2141c86ed0ce0962b45cefb658a95e734f59759d47f20afdcd9c732910a1/ty-0.0.32-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9b59868ede9b1d69a088f0d695df52a0061f95fa7baa1d5e0dc6fc9cf06e1334", size = 11346369, upload-time = "2026-04-20T19:28:48.967Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/da/ed6f772339cf29bd9a46def9d6db5084689eb574ee4d150ff704224c1ed8/ty-0.0.32-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8300caf35345498e9b9b03e550bba03cee8f5f5f8ab4c83c3b1ff1b7403b7d3a", size = 11280714, upload-time = "2026-04-20T19:28:51.516Z" },
-    { url = "https://files.pythonhosted.org/packages/da/9b/c6813987edf4816a40e0c8e408b555f97d3f267c7b3a1688c8bbdf65609c/ty-0.0.32-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:583c7094f4574b02f724db924f98b804d1387a0bd9405ecb5e078cc0f47fbcfb", size = 10638806, upload-time = "2026-04-20T19:28:29.651Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/d4/0cefcbd2ad0f3d51762ccf58e652ec7da146eb6ae34f87228f6254bbb8be/ty-0.0.32-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:e44ebe1bb4143a5628bc4db67ac0dfebe14594af671e4ee66f6f2e983da56501", size = 10726106, upload-time = "2026-04-20T19:29:06.3Z" },
-    { url = "https://files.pythonhosted.org/packages/32/ad/2c8a97f91f06311f4367400f7d13534bbda2522c73c99a3e4c0757dff9b8/ty-0.0.32-py3-none-musllinux_1_2_i686.whl", hash = "sha256:06f17ada3e069cba6148342ef88e9929156beca8473e8d4f101b68f66c75643e", size = 10872951, upload-time = "2026-04-20T19:28:34.077Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/68/42293f9248106dd51875120971a5cc6ea315c2c4dcfb8e59aa063aa0af26/ty-0.0.32-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:e96e60fa556cec04f15d7ea62d2ceee5982bd389233e961ab9fd42304e278175", size = 11363334, upload-time = "2026-04-20T19:28:54.036Z" },
-    { url = "https://files.pythonhosted.org/packages/df/92/be9abf4d3e589ad5023e2ea965b93e204ec856420d46adf73c5c36c04678/ty-0.0.32-py3-none-win32.whl", hash = "sha256:2ff2ebb4986b24aebcf1444db7db5ca41b36086040e95eea9f8fb851c11e805c", size = 10260689, upload-time = "2026-04-20T19:28:56.541Z" },
-    { url = "https://files.pythonhosted.org/packages/14/61/dc86acea899349d2579cb8419aecedd83dc504d7d6a10df65eef546c8300/ty-0.0.32-py3-none-win_amd64.whl", hash = "sha256:ba7284a4a954b598c1b31500352b3ec1f89bff533825592b5958848226fdc7ee", size = 11255371, upload-time = "2026-04-20T19:28:39.917Z" },
-    { url = "https://files.pythonhosted.org/packages/43/01/beffec56d71ca25b343ede63adb076456b5b3e211f1c066452a44cd120b3/ty-0.0.32-py3-none-win_arm64.whl", hash = "sha256:7e10aadbdbda989a7d567ee6a37f8b98d4d542e31e3b190a2879fd581f75d658", size = 10658087, upload-time = "2026-04-20T19:28:59.286Z" },
+    { url = "https://files.pythonhosted.org/packages/83/7b/8b85003d6639ef17a97dcbb31f4511cfe78f1c81a964470db100c8c883e7/ty-0.0.34-py3-none-linux_armv6l.whl", hash = "sha256:9ecc3d14f07a95a6ceb88e07f8e62358dbd37325d3d5bd56da7217ff1fef7fb8", size = 11067094, upload-time = "2026-05-01T23:06:21.133Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/25/b0098f65b020b015c40567c763fc66fffbec88b2ba6f584bca1e92f05ebb/ty-0.0.34-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:0dccffd8a9d02321cd2dee3249df205e26d62694e741f4eeca36b157fd8b419f", size = 10840909, upload-time = "2026-05-01T23:06:18.409Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/55/5e4adcf7d2a1006b844903b27cb81244a9b748d850433a46a6c21776c401/ty-0.0.34-py3-none-macosx_11_0_arm64.whl", hash = "sha256:b0ea47a2998e167ab3b21d2f4b5309a9cf33c297809f6d7e3e753252223174d0", size = 10279378, upload-time = "2026-05-01T23:06:37.962Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/91/f537dca0db8fe2558e8ab04d8941d687b384fcc1df5eb9023b2db75ac26c/ty-0.0.34-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8b37da00b41a118a459ae56d8947e70651073fb33ebfbceb820e4a10b22d5023", size = 10817423, upload-time = "2026-05-01T23:06:26.247Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/c4/55a3ad1da2815af1009bdc1b8c90dc11a364cd314e4b48c5128ba9d38859/ty-0.0.34-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:81cbbb93c2342fe3de43e625d3a9eb149633e9f485e816ebf6395d08685355d8", size = 10851826, upload-time = "2026-05-01T23:06:24.198Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/8c/9c7606af22d73fb43ea4369472d9c66ece11231be73b0efe8e3c61655559/ty-0.0.34-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4c5b4dea1594a021289e172582df9cde7089dce14b276fc650e7b212b1772e12", size = 11356318, upload-time = "2026-05-01T23:06:51.139Z" },
+    { url = "https://files.pythonhosted.org/packages/20/54/bb423f663721ab4138b216425c6b55eaefd3a068243b24d6d8fe988f4e13/ty-0.0.34-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:030fb00aa2d2a5b5ae9d9183d574e0c82dae80566700a7490c43669d8ece40cd", size = 11902968, upload-time = "2026-05-01T23:06:35.82Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/22/01122b21ab6b534a2f618c6bbe5f1f7f49fd56f4b2ec8887cd6d40d08fb3/ty-0.0.34-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5ae9555e24e36c63a8218e037a5a63f15579eb6aa94f41017e57cd41d335cfb5", size = 11548860, upload-time = "2026-05-01T23:06:42.155Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/50/86008b1392ec64bed1957bbcc7aaa43b466b50dfc91bb131841c21d7c5c3/ty-0.0.34-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:99eb23df9ed129fc26d1ab00d6f0b8dfe5253b09c2ac6abdb11523fa70d67f10", size = 11457097, upload-time = "2026-05-01T23:06:53.477Z" },
+    { url = "https://files.pythonhosted.org/packages/92/3e/4558b2296963ba99c58d8409c57d7db4f3061b656c3613cb21c02c1ef4c2/ty-0.0.34-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:85de45382016eceae69e104815eb2cfa200787df104002e262a86cbd43ed2c02", size = 10798192, upload-time = "2026-05-01T23:06:40.004Z" },
+    { url = "https://files.pythonhosted.org/packages/76/bf/650d24402be2ef678528d60caac1d9477a40fc37e3792ecef07834fd7a4a/ty-0.0.34-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:14cb575fb8fa5131f5129d100cfe23c1575d23faf5dfc5158432749a3e38c9b5", size = 10890390, upload-time = "2026-05-01T23:06:33.076Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/ef/ccd2ca13906079f7935fd7e067661b24233017f57d987d51d6a121d85bb5/ty-0.0.34-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c6fc0b69d8450e6910ba9db34572b959b81329a97ae273c391f70e9fb6c1aade", size = 11031564, upload-time = "2026-05-01T23:06:55.812Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/2d/d27b72005b6f43599e3bcabab0d7135ac0c230b7a307bb99f9eea02c1cda/ty-0.0.34-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:30dfcec2f0fde3993f4f912ed0e057dcbebc8615299f610a4c2ddb7b5a3e1e06", size = 11553430, upload-time = "2026-05-01T23:06:31.096Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/12/20812e1ad930b8d4af70eebf19ad23cff6e31efcfa613ef884531fcdbaa1/ty-0.0.34-py3-none-win32.whl", hash = "sha256:97b77ddf007271b812a313a8f0a14929bc5590958433e1fb83ef585676f53342", size = 10436048, upload-time = "2026-05-01T23:06:49.108Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/6a/afa095c5987868fbda27c0f731146ac8e3d07b357adfa83daccaee5b1a16/ty-0.0.34-py3-none-win_amd64.whl", hash = "sha256:1f543968accb952705134028d1fda8656882787dbbc667ad4d6c3ba23791d604", size = 11462526, upload-time = "2026-05-01T23:06:28.514Z" },
+    { url = "https://files.pythonhosted.org/packages/63/8f/bf041a06260d77662c0605e56dacfe90b786bf824cbe1aed238d15fe5e84/ty-0.0.34-py3-none-win_arm64.whl", hash = "sha256:ea09108cbcb16b6b06d7596312b433bf49681e78d30e4dc7fb3c1b248a95e09a", size = 10846945, upload-time = "2026-05-01T23:06:44.428Z" },
 ]
 
 [[package]]