3tears-iam 0.20.0__tar.gz

3tears_iam-0.20.0/.gitignore

@@ -0,0 +1,220 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+# Anchored: these name top-level build output. Unanchored, `lib/` matches at ANY depth --
+# it swallowed a vendored `.../pako/lib/` tree, and hatchling reads this file with its own
+# matcher that does NOT honour `!` re-inclusion, so the miss reached built artifacts.
+/lib/
+/lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+#poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+#pdm.lock
+#pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+#pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+# Abstra
+# Abstra is an AI-powered process automation framework.
+# Ignore directories containing user credentials, local state, and settings.
+# Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#  Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#  that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#  and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#  you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Cursor
+#  Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
+#  exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
+#  refer to https://docs.cursor.com/context/ignore-files
+.cursorignore
+.cursorindexingignore
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Claude Code local state
+.claude/
+
+# prawduct session evidence (local governance artifacts, never shipped)
+.prawduct/
+
+# macOS folder metadata
+.DS_Store
+

3tears_iam-0.20.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mark Pace
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

3tears_iam-0.20.0/PKG-INFO

@@ -0,0 +1,141 @@
+Metadata-Version: 2.4
+Name: 3tears-iam
+Version: 0.20.0
+Summary: Identity and access primitives: OAuth2/OIDC, SAML, passwords, JWT sessions, DPoP, TOTP, WebAuthn, and the anti-automation controls that guard them
+Project-URL: Repository, https://github.com/pacepace/3tears
+Author: pace
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: AsyncIO
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Typing :: Typed
+Requires-Python: >=3.14
+Requires-Dist: 3tears-agent-acl<0.21.0,>=0.20.0
+Requires-Dist: 3tears-nats[client]<0.21.0,>=0.20.0
+Requires-Dist: 3tears-observe<0.21.0,>=0.20.0
+Requires-Dist: 3tears<0.21.0,>=0.20.0
+Requires-Dist: argon2-cffi>=25.1.0
+Requires-Dist: bcrypt>=5.0.0
+Requires-Dist: cryptography>=43.0
+Requires-Dist: httpx>=0.27
+Requires-Dist: joserfc>=1.0
+Requires-Dist: pydantic>=2
+Requires-Dist: pyjwt[crypto]>=2.8
+Requires-Dist: pyotp>=2.9
+Provides-Extra: saml
+Requires-Dist: defusedxml>=0.7; extra == 'saml'
+Requires-Dist: pysaml2>=7.5.0; extra == 'saml'
+Provides-Extra: webauthn
+Requires-Dist: webauthn>=3.0; extra == 'webauthn'
+Description-Content-Type: text/markdown
+
+# 3tears-iam
+
+`threetears.iam` -- the identity and access primitives every authenticating
+service in the platform needs: password handling, OAuth2/OIDC, SAML, GitHub
+sign-in, session tokens, DPoP, TOTP, WebAuthn, and the anti-automation
+controls that keep all of it from being brute-forced.
+
+## Why this exists
+
+Two services in this ecosystem grew their own identity layers independently.
+Both wrote argon2id password hashing with anti-enumeration timing. Both wrote
+a GitHub OAuth2 authorization-code flow. Both wrote a NATS-KV login throttle,
+a single-use SHA-256 ticket store, and a JWT mint/verify pair that pins its
+claim set. Neither could use the other's, because each was welded to its own
+database schema, its own transport, and its own config prefix.
+
+That is the failure this package exists to stop. The protocol work -- RFC 7636
+PKCE, RFC 9449 DPoP, RFC 6238 TOTP, OIDC discovery and `id_token` verification,
+SAML assertion handling, the OAuth2 code exchange -- is the same everywhere.
+Getting it subtly wrong is a security bug, and getting it subtly wrong twice
+means fixing it twice, in two repos, on two schedules, and finding out the
+second one was missed during an incident.
+
+## Model
+
+The package owns **protocol, crypto, and policy**. It owns nobody's database
+schema and nobody's wire DTOs.
+
+That line is deliberate. The two services that seeded this package disagree on
+almost everything below the protocol layer -- one is NATS-RPC-native with a
+multi-tenant Postgres `identity` schema, the other is a FastAPI app with its own
+control plane -- and any attempt to unify their persistence would have produced
+an abstraction neither could use. So state lives behind narrow Protocols
+(`SingleUseTicketStore`, `AttemptLimiter`, `StateStore`), with a NATS-KV
+implementation shipped for the common case and nothing stopping a caller from
+supplying its own.
+
+Everything else follows from that:
+
+- **Pure functions where the protocol allows it.** PKCE verification, password
+  policy, step-up freshness, claim mapping, and API-key hashing take arguments
+  and return answers. No I/O, no clock you cannot inject, no global state.
+- **Algorithms are pinned from literals, never read from the input.** A DPoP
+  proof does not get to say which algorithm verifies it. An `id_token` does not
+  get to select `none`. This mirrors `threetears.core.security.identity_token`'s
+  discipline, and the pins are written so a static reader can audit them.
+- **Fail closed by default, and without a side channel.** A malformed stored hash is an
+  authentication failure, not a 500. The one place a caller may choose otherwise is
+  `NatsKvAttemptLimiter`'s `fail_open`, which exists for a cheap throttle sitting in front
+  of an authoritative check -- it defaults to closed, and a counter with nothing behind it
+  must leave it that way. A rejected password never says *which*
+  rule it broke when saying so would build an oracle. Errors carry structural
+  reasons only -- never token strings, key material, or credentials -- so they
+  are safe to log at a verification boundary.
+- **Builds on core, does not fork it.** `jwk_thumbprint`, `build_jwks`,
+  `generate_signing_keypair`, `ReplayGuard`, `RevocationGuard`, `WindowedCounter`
+  and `seal`/`open_secret` already exist in `threetears.core`. This package
+  imports them.
+
+## Public surface
+
+Imported per module -- `threetears.iam` itself exports only `__version__`, so reach for the
+submodule that owns the thing:
+
+```python
+from threetears.iam.passwords import hash_password
+from threetears.iam.tokens import SessionClaims, mint_session_token
+from threetears.iam.stores.nats_kv import state_store, ticket_store
+```
+
+- **Passwords** (`.passwords`, `.breach`) -- `hash_password`, `verify_password`, `validate_new_password`,
+  `normalize_password`, `PasswordVerifyResult`, `PasswordPolicyError`, plus
+  `BreachCorpus` for k-anonymity breach screening. argon2id for new hashes,
+  bcrypt verify-then-upgrade for migrated ones, NFKC normalization always.
+- **OAuth2 / OIDC** (`.pkce`, `.oidc`, `.github`) -- `PkceChallenge` and the RFC 7636 verifier, `OidcDiscoveryClient`,
+  `verify_id_token`, `OidcIdentity`, `GithubOAuth2Client`, `GithubProfile`.
+- **SAML** (`.saml`, extra: `saml`) -- `SamlMetadataResolver`, assertion identity
+  extraction, relay-state validation.
+- **Sessions** (`.tokens`, `.rotation`) -- `SessionClaims`, `mint_session_token`,
+  `verify_session_token` over EdDSA or HS256, `mint_token_pair`, `TokenPair`,
+  `sole_audience`, and `rotate_refresh_token` with reuse detection.
+- **Proof of possession** (`.dpop`) -- `validate_dpop_proof` (RFC 9449, ES256/P-256).
+- **Second factors** (`.totp`, `.webauthn`) -- TOTP enrolment and verification, backup codes, and
+  (extra: `webauthn`) passkey registration/assertion helpers.
+- **Anti-automation** (`.stores`, `.clientip`) -- the `AttemptLimiter` Protocol and its
+  `NatsKvAttemptLimiter` implementation over `threetears.core.coordination.WindowedCounter`,
+  plus `resolve_client_ip` for trusted-proxy-aware rate-limit keying.
+- **Storage seams** (`.stores`) -- `SingleUseTicketStore` and `StateStore` Protocols,
+  `hash_ticket`/`new_ticket_secret`, the `threetears.iam.stores.nats_kv` implementations with
+  their `state_store`/`ticket_store` factories, and in-memory doubles in
+  `threetears.iam.stores.memory` for consumer tests.
+
+## Install
+
+```bash
+pip install 3tears-iam
+pip install '3tears-iam[saml]'      # adds pysaml2; needs the xmlsec1 system binary
+pip install '3tears-iam[webauthn]'  # adds passkey support
+```
+
+## Versioning policy
+
+`3tears-iam` versions in lockstep with the rest of the 3tears monorepo: every
+package shares one version, tracking the framework git tag. All packages move
+together.

3tears_iam-0.20.0/README.md

@@ -0,0 +1,105 @@
+# 3tears-iam
+
+`threetears.iam` -- the identity and access primitives every authenticating
+service in the platform needs: password handling, OAuth2/OIDC, SAML, GitHub
+sign-in, session tokens, DPoP, TOTP, WebAuthn, and the anti-automation
+controls that keep all of it from being brute-forced.
+
+## Why this exists
+
+Two services in this ecosystem grew their own identity layers independently.
+Both wrote argon2id password hashing with anti-enumeration timing. Both wrote
+a GitHub OAuth2 authorization-code flow. Both wrote a NATS-KV login throttle,
+a single-use SHA-256 ticket store, and a JWT mint/verify pair that pins its
+claim set. Neither could use the other's, because each was welded to its own
+database schema, its own transport, and its own config prefix.
+
+That is the failure this package exists to stop. The protocol work -- RFC 7636
+PKCE, RFC 9449 DPoP, RFC 6238 TOTP, OIDC discovery and `id_token` verification,
+SAML assertion handling, the OAuth2 code exchange -- is the same everywhere.
+Getting it subtly wrong is a security bug, and getting it subtly wrong twice
+means fixing it twice, in two repos, on two schedules, and finding out the
+second one was missed during an incident.
+
+## Model
+
+The package owns **protocol, crypto, and policy**. It owns nobody's database
+schema and nobody's wire DTOs.
+
+That line is deliberate. The two services that seeded this package disagree on
+almost everything below the protocol layer -- one is NATS-RPC-native with a
+multi-tenant Postgres `identity` schema, the other is a FastAPI app with its own
+control plane -- and any attempt to unify their persistence would have produced
+an abstraction neither could use. So state lives behind narrow Protocols
+(`SingleUseTicketStore`, `AttemptLimiter`, `StateStore`), with a NATS-KV
+implementation shipped for the common case and nothing stopping a caller from
+supplying its own.
+
+Everything else follows from that:
+
+- **Pure functions where the protocol allows it.** PKCE verification, password
+  policy, step-up freshness, claim mapping, and API-key hashing take arguments
+  and return answers. No I/O, no clock you cannot inject, no global state.
+- **Algorithms are pinned from literals, never read from the input.** A DPoP
+  proof does not get to say which algorithm verifies it. An `id_token` does not
+  get to select `none`. This mirrors `threetears.core.security.identity_token`'s
+  discipline, and the pins are written so a static reader can audit them.
+- **Fail closed by default, and without a side channel.** A malformed stored hash is an
+  authentication failure, not a 500. The one place a caller may choose otherwise is
+  `NatsKvAttemptLimiter`'s `fail_open`, which exists for a cheap throttle sitting in front
+  of an authoritative check -- it defaults to closed, and a counter with nothing behind it
+  must leave it that way. A rejected password never says *which*
+  rule it broke when saying so would build an oracle. Errors carry structural
+  reasons only -- never token strings, key material, or credentials -- so they
+  are safe to log at a verification boundary.
+- **Builds on core, does not fork it.** `jwk_thumbprint`, `build_jwks`,
+  `generate_signing_keypair`, `ReplayGuard`, `RevocationGuard`, `WindowedCounter`
+  and `seal`/`open_secret` already exist in `threetears.core`. This package
+  imports them.
+
+## Public surface
+
+Imported per module -- `threetears.iam` itself exports only `__version__`, so reach for the
+submodule that owns the thing:
+
+```python
+from threetears.iam.passwords import hash_password
+from threetears.iam.tokens import SessionClaims, mint_session_token
+from threetears.iam.stores.nats_kv import state_store, ticket_store
+```
+
+- **Passwords** (`.passwords`, `.breach`) -- `hash_password`, `verify_password`, `validate_new_password`,
+  `normalize_password`, `PasswordVerifyResult`, `PasswordPolicyError`, plus
+  `BreachCorpus` for k-anonymity breach screening. argon2id for new hashes,
+  bcrypt verify-then-upgrade for migrated ones, NFKC normalization always.
+- **OAuth2 / OIDC** (`.pkce`, `.oidc`, `.github`) -- `PkceChallenge` and the RFC 7636 verifier, `OidcDiscoveryClient`,
+  `verify_id_token`, `OidcIdentity`, `GithubOAuth2Client`, `GithubProfile`.
+- **SAML** (`.saml`, extra: `saml`) -- `SamlMetadataResolver`, assertion identity
+  extraction, relay-state validation.
+- **Sessions** (`.tokens`, `.rotation`) -- `SessionClaims`, `mint_session_token`,
+  `verify_session_token` over EdDSA or HS256, `mint_token_pair`, `TokenPair`,
+  `sole_audience`, and `rotate_refresh_token` with reuse detection.
+- **Proof of possession** (`.dpop`) -- `validate_dpop_proof` (RFC 9449, ES256/P-256).
+- **Second factors** (`.totp`, `.webauthn`) -- TOTP enrolment and verification, backup codes, and
+  (extra: `webauthn`) passkey registration/assertion helpers.
+- **Anti-automation** (`.stores`, `.clientip`) -- the `AttemptLimiter` Protocol and its
+  `NatsKvAttemptLimiter` implementation over `threetears.core.coordination.WindowedCounter`,
+  plus `resolve_client_ip` for trusted-proxy-aware rate-limit keying.
+- **Storage seams** (`.stores`) -- `SingleUseTicketStore` and `StateStore` Protocols,
+  `hash_ticket`/`new_ticket_secret`, the `threetears.iam.stores.nats_kv` implementations with
+  their `state_store`/`ticket_store` factories, and in-memory doubles in
+  `threetears.iam.stores.memory` for consumer tests.
+
+## Install
+
+```bash
+pip install 3tears-iam
+pip install '3tears-iam[saml]'      # adds pysaml2; needs the xmlsec1 system binary
+pip install '3tears-iam[webauthn]'  # adds passkey support
+```
+
+## Versioning policy
+
+`3tears-iam` versions in lockstep with the rest of the 3tears monorepo: every
+package shares one version, tracking the framework git tag. All packages move
+together.

3tears_iam-0.20.0/pyproject.toml

@@ -0,0 +1,107 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "3tears-iam"
+version = "0.20.0"
+description = "Identity and access primitives: OAuth2/OIDC, SAML, passwords, JWT sessions, DPoP, TOTP, WebAuthn, and the anti-automation controls that guard them"
+readme = "README.md"
+requires-python = ">=3.14"
+authors = [{name = "pace"}]
+license = "MIT"
+license-files = ["LICENSE"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Framework :: AsyncIO",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries",
+    "Typing :: Typed",
+]
+dependencies = [
+    # core supplies the crypto this package builds ON rather than beside:
+    # jwk_thumbprint/build_jwks/generate_signing_keypair (identity_token),
+    # ReplayGuard/RevocationGuard/WindowedCounter (coordination), and
+    # seal/open_secret (encryption) for TOTP seed material at rest. Forking
+    # any of those would give the platform two answers to the same question.
+    "3tears>=0.20.0,<0.21.0",
+    "3tears-observe>=0.20.0,<0.21.0",
+    # the sensitive-action taxonomy. agent-acl's ImpersonationCategory and
+    # identity-core's SensitiveActionCategory declared the same six strings
+    # independently, each documenting that the copy existed only because no
+    # import path connected them. This package is that path, so the enum is
+    # imported here and the second declaration goes away.
+    "3tears-agent-acl>=0.20.0,<0.21.0",
+    # the KV adapters in threetears.iam.stores.nats_kv. Every state this
+    # package keeps (auth codes, OAuth state, single-use tickets, attempt
+    # counters) is short-lived and TTL'd, which is a KV bucket's job, not a
+    # table's -- and both first consumers already run NATS.
+    "3tears-nats[client]>=0.20.0,<0.21.0",
+    # argon2id for password hashing, bcrypt for verify-then-upgrade of hashes
+    # migrated in from an older system. bcrypt is verify-only here: nothing in
+    # this package ever WRITES a bcrypt hash.
+    "argon2-cffi>=25.1.0",
+    "bcrypt>=5.0.0",
+    # session tokens (EdDSA or HS256), DPoP proofs, and OIDC id_token
+    # verification. [crypto] pulls the asymmetric backends.
+    "pyjwt[crypto]>=2.8",
+    # Ed25519/EC key handling, and AES-256-GCM for TOTP seeds at rest.
+    "cryptography>=43.0",
+    # OIDC discovery, the OAuth2 token exchange, provider userinfo/profile
+    # fetches, and the k-anonymity breach-corpus range query. Used directly
+    # rather than through authlib: the flows here are small enough that a
+    # second OAuth framework would be more surface than saved code.
+    "httpx>=0.27",
+    # TOTP code generation/verification (RFC 6238).
+    "pyotp>=2.9",
+    # OIDC id_token verification. joserfc rather than pyjwt for this one path: it models a
+    # JWKS KeySet and a claims registry directly, which is what an id_token needs, and
+    # authlib's own jose module -- the obvious alternative -- is deprecated.
+    "joserfc>=1.0",
+    # SecretStr on the seed-sealing surface, and the type core's seal/open_secret speak.
+    # Declared directly rather than leaned on transitively: this package names it in a
+    # public signature, so it is a real dependency of this API, not an implementation detail.
+    "pydantic>=2",
+]
+
+[project.optional-dependencies]
+# SAML drags pysaml2 AND the xmlsec1 SYSTEM binary in with it. A consumer that
+# only needs OAuth/OIDC should not inherit an apt-get line, so the SAML service
+# provider lives behind this extra and threetears.iam.saml raises a pointed
+# ImportError when it is missing.
+saml = [
+    "pysaml2>=7.5.0",
+    "defusedxml>=0.7",
+]
+# WebAuthn/passkey registration + assertion verification. Optional for the same
+# reason: a consumer doing password + OIDC only should not carry it.
+webauthn = [
+    "webauthn>=3.0",
+]
+
+[project.urls]
+Repository = "https://github.com/pacepace/3tears"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/threetears"]
+
+[tool.uv.sources]
+3tears = { workspace = true }
+3tears-observe = { workspace = true }
+3tears-agent-acl = { workspace = true }
+3tears-nats = { workspace = true }
+
+[tool.mypy]
+strict = true
+mypy_path = "src"
+packages = ["threetears.iam"]
+explicit_package_bases = true
+ignore_missing_imports = true
+
+# no [tool.pytest.ini_options] block: pytest's rootdir detection picks the
+# closest pyproject with that block, so a per-package one would hide the
+# workspace conftest.py and unregister the canonical pytest_plugins line.
+# inherit from the workspace instead.

3tears_iam-0.20.0/src/threetears/iam/__init__.py

@@ -0,0 +1,20 @@
+"""3tears-iam: identity and access primitives.
+
+Protocol, crypto, and policy for authenticating callers -- passwords, OAuth2/
+OIDC, SAML, session tokens, DPoP, TOTP, WebAuthn, and the anti-automation
+controls that guard them.
+
+This package owns no database schema and no wire DTOs. State lives behind the
+Protocols in :mod:`threetears.iam.stores`, with a NATS-KV implementation
+supplied for the common case.
+"""
+
+from importlib.metadata import PackageNotFoundError as _PackageNotFoundError
+from importlib.metadata import version as _version
+
+try:
+    __version__ = _version("3tears-iam")
+except _PackageNotFoundError:  # pragma: no cover - dev fallback
+    __version__ = "unknown"
+
+__all__ = ["__version__"]

3tears_iam-0.20.0/src/threetears/iam/_digest.py

@@ -0,0 +1,33 @@
+"""The one place this package turns a high-entropy secret into its stored form.
+
+Two public functions need it -- :func:`threetears.iam.stores.base.hash_ticket` and
+:func:`threetears.iam.apikeys.hash_api_key_secret` -- and they had the same body written
+out twice. They keep separate public names because they are separate contracts with
+separate call sites, and because a future decision to pepper one is a decision about that
+one; what they share is the digest, and sharing it means a change to how this package
+hashes cannot land in one of them and miss the other.
+
+**SHA-256, not a password KDF, and that is deliberate for both.** Every value passed here
+is 256 bits of generated randomness, so there is no dictionary for an attacker to run and
+nothing for a slow KDF to slow down. What the stores need instead is an equality lookup,
+which a per-candidate KDF run would make impossible. A user-chosen password is the opposite
+case in every respect and goes through :mod:`threetears.iam.passwords`, which uses
+argon2id. Nothing in this module is appropriate for one.
+"""
+
+from __future__ import annotations
+
+import hashlib
+
+__all__ = ["sha256_hex"]
+
+
+def sha256_hex(secret: str) -> str:
+    """SHA-256 hex digest of ``secret``'s UTF-8 bytes.
+
+    :param secret: the raw, high-entropy secret.
+    :ptype secret: str
+    :return: the lowercase hex digest.
+    :rtype: str
+    """
+    return hashlib.sha256(secret.encode("utf-8")).hexdigest()