codeimprint 0.5.0a11__py3-none-any.whl

codeimprint-0.5.0a11.dist-info/METADATA

@@ -0,0 +1,92 @@
+Metadata-Version: 2.5
+Name: codeimprint
+Version: 0.5.0a11
+Summary: CodeImprint by Mudrika: seal your code with a CodeImprint server (tamper-evident, logged and timestamped) and verify seals offline.
+Project-URL: Homepage, https://codeimprint.ai
+Project-URL: Hub, https://app.codeimprint.ai
+Author: Mudrika
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Keywords: code provenance,code sealing,github actions,software birthmark,transparency log
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Version Control :: Git
+Requires-Python: >=3.10
+Requires-Dist: asn1crypto>=1.5
+Requires-Dist: cryptography>=42
+Requires-Dist: pathspec>=0.12
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff==0.17.2; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# CodeImprint by Mudrika — command-line client
+
+**Code provenance that survives AI.** CodeImprint seals your code: every seal is an
+**Imprint**, a compact signature of the code that is tamper-evident, recorded in a public
+transparency log and timestamped, so it cannot be altered or backdated without detection. An
+Imprint still matches when the code is renamed, reformatted, reordered or rewritten, and it
+does not contain your source.
+
+This package is the command-line client, `imprint`. It talks to a CodeImprint server, which
+does the analysis; the client sends your files, checks what the server returns and verifies
+seals offline. Learn more at [codeimprint.ai](https://codeimprint.ai).
+
+> **Pre-release (alpha).** Install with `--pre`. Python 3.10 or newer.
+
+## Install
+
+```bash
+pip install --pre codeimprint
+```
+
+(`pip install --pre code-imprint` installs the same package.)
+
+## Get started
+
+```bash
+imprint login --url https://api.codeimprint.ai    # sign in (browser or e-mail link)
+imprint init                                       # your developer key, the project and its first seal
+imprint seal .                                     # seal the current commit
+imprint verify                                     # check the seal offline
+```
+
+- **`imprint login`** saves the server and your sign-in in your user config folder, readable
+  by you only. In GitHub Actions, use an API token: `imprint login --token-stdin`, or the
+  `CODEIMPRINT_URL` and `CODEIMPRINT_TOKEN` environment variables.
+- **`imprint init`** creates your Ed25519 developer key in the user config folder (it is
+  never uploaded and never written to the repository), writes `.imprint/config.json` and a
+  GitHub Actions workflow, and creates the project, named `owner/repo` from the `origin`
+  remote.
+- **`imprint seal .`** shows what it is about to send and asks first (`--yes` skips the
+  question). Only the files that changed since the last seal are sent. It checks the server's
+  signature and log proof, signs the result with your developer key, and prints the Imprint
+  ID and a link to its public page on [app.codeimprint.ai](https://app.codeimprint.ai).
+- **`imprint verify`** checks a seal offline: digest, server attestation, your signature, log
+  inclusion and the RFC 3161 timestamp. `--online` also checks the live log.
+
+Other commands: `imprint check` (compare a project with a protected Imprint; similarity is
+evidence, not proof), `imprint chain`, `imprint hook install`, `imprint identity`,
+`imprint claim`, `imprint github link` and more. Run `imprint --help`.
+
+## What leaves your machine
+
+`imprint seal` and `imprint check` upload the project's files to the CodeImprint server you
+signed in to, which fingerprints them and deletes them at once; only the Imprint is kept.
+Your developer key never leaves your machine: only its public half is sent.
+
+## Licence
+
+Apache-2.0. The client contains no part of the CodeImprint engine, which runs on the server.
+"Mudrika" and "CodeImprint" are trademarks of their owner (see NOTICE).

codeimprint-0.5.0a11.dist-info/RECORD

@@ -0,0 +1,23 @@
+codeimprint_cli/__init__.py,sha256=VPYTP4Z6WgDkls1nDK8dO3Dm8TnyK-p0OgG97GXFubs,250
+codeimprint_cli/__main__.py,sha256=E6Gls0DNz8GQK2K-kOUIx8cYhgANW_CH54VKrfCfs14,52
+codeimprint_cli/api.py,sha256=wvsEQlJ05Nos3OwnjRFi4UL9mRmPYdFEfCu_drEb9Cw,16474
+codeimprint_cli/chainseal.py,sha256=A6eQAkDb3iwMmdRXgMAlaHnww2VEwJ_wgQL8fCs-gfQ,7980
+codeimprint_cli/cli.py,sha256=LwDSKb97CgUuzT5w-jTqTWIQeZOA8Tp8Oyy1hlIZlI4,106778
+codeimprint_cli/config.py,sha256=nuTNPAwBK2u40PkgOVp3mTydkDTNrNtEMzTCdTje1Qs,7038
+codeimprint_cli/gitrepo.py,sha256=BA8Lzl6l61j4lp5LVKR4OheStDNTvsu3yGV00xtklNE,5398
+codeimprint_cli/imprint_file.py,sha256=jQBLbupQsLbtiKLL7nt9Fd2aLOHB0lqupT_DOlzNe9M,5305
+codeimprint_cli/linecount.py,sha256=YNSITLtQZWc1fZ0-xgR78Vne58tFBNmR6sm3jadNF2Y,14854
+codeimprint_cli/ownership.py,sha256=ZfJA4VLosPfi1mt1z9E39Iu1ozMJq8UyG_Y06NqBuus,16584
+codeimprint_cli/project.py,sha256=0ASy8SLg5MMAceTjn5w8t_53LnqeO1syqq4CM3xPg8o,4620
+codeimprint_cli/receipt.py,sha256=-co0b1NE38HaLgioA21wz65P3-72uJbH-1UoK5z924A,35989
+codeimprint_cli/records.py,sha256=68xtLuxHzuDdE58fME50xL4lPETNHdOe_ZQyyPPG_GI,2805
+codeimprint_cli/timestamp.py,sha256=tFKheQqZYqTPVDtISKdVu_-SLpG8fKEO8tGzfzyNi8k,8108
+codeimprint_cli/transparency.py,sha256=ivkmIIma9svAc_XgAdI_RSqQ8BA4kezheJ0-STiqPHM,2274
+codeimprint_cli/trust.py,sha256=YUMpO-aJM0hS7sMXjJjDY9FP1AaMjbJwvaEYo6zp_nY,7540
+codeimprint_cli/tsa_roots.py,sha256=sAwqiN-bLlh9c6YMAlWW3FxlzMLxftRU8D1DS9u7TZU,7529
+codeimprint-0.5.0a11.dist-info/METADATA,sha256=xsEANgaIqsncS2RRGV1AT3SfiXgsAqfAfX8ZeeyMzNw,4403
+codeimprint-0.5.0a11.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+codeimprint-0.5.0a11.dist-info/entry_points.txt,sha256=G06DyvtqD6z-F1wGp5V7wPrVasEfOA-OPzMYgmq6YdU,53
+codeimprint-0.5.0a11.dist-info/licenses/LICENSE,sha256=fVRQyy0UJlG4r6MVtfI478gF2tgn2RujZ9hRa8nUnno,10175
+codeimprint-0.5.0a11.dist-info/licenses/NOTICE,sha256=ht4ZZ0ykUICENum0UdkZ71PAjaNLpYRJhm2oCKCi4Wk,480
+codeimprint-0.5.0a11.dist-info/RECORD,,

codeimprint-0.5.0a11.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

codeimprint-0.5.0a11.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+imprint = codeimprint_cli.cli:main

codeimprint-0.5.0a11.dist-info/licenses/LICENSE

@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

codeimprint-0.5.0a11.dist-info/licenses/NOTICE

@@ -0,0 +1,11 @@
+CodeImprint client by Mudrika
+Copyright 2026 Mudrika
+
+Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+This client calls a CodeImprint server. It contains no part of the IMP-1 engine, which is
+proprietary to Mudrika and is not covered by this licence.
+
+"Mudrika" and "CodeImprint" are trademarks of their owner. The Apache License does not grant
+permission to use these names except as required for reasonable and customary use in
+describing the origin of the work.

codeimprint_cli/__init__.py

@@ -0,0 +1,7 @@
+"""CodeImprint by Mudrika — command-line client.
+
+A thin client for a CodeImprint server: it zips a project, asks the server to seal or check
+it, and verifies Imprint files offline. All analysis happens on the server.
+"""
+
+__version__ = "0.5.0a11"

codeimprint_cli/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from .cli import main
+
+sys.exit(main())

codeimprint_cli/api.py

@@ -0,0 +1,315 @@
+"""HTTP calls to a CodeImprint server (standard library only)."""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.request
+import uuid
+from urllib.parse import quote
+
+from . import __version__, config
+
+USER_AGENT = f"codeimprint/{__version__}"
+ACCESS_HINT = ("the server is behind Cloudflare Access: set CODEIMPRINT_CF_ACCESS_CLIENT_ID and "
+               "CODEIMPRINT_CF_ACCESS_CLIENT_SECRET (a service token), or run `imprint login "
+               "--cf-access`")
+ACCESS_REFUSED = ("Cloudflare Access refused the service token: check "
+                  "CODEIMPRINT_CF_ACCESS_CLIENT_ID and CODEIMPRINT_CF_ACCESS_CLIENT_SECRET (or "
+                  "`imprint login --cf-access`) and that the token is in the Access policy")
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    """The API never redirects JSON calls; following one would copy the request's headers
+    (the token, an Access secret) to wherever it points. Redirects come back as errors."""
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+_OPENER = urllib.request.build_opener(_NoRedirect)
+
+
+class ApiError(Exception):
+    """The server answered with an error."""
+
+    def __init__(self, status: int, code: str, message: str) -> None:
+        super().__init__(f"{message} ({status} {code})")
+        self.status, self.code, self.message = status, code, message
+
+
+class NetworkError(Exception):
+    """The server could not be reached."""
+
+
+def _multipart(fields: dict[str, str], file_name: str, file_bytes: bytes) -> tuple[bytes, str]:
+    boundary = f"codeimprint-{uuid.uuid4().hex}"
+    parts = []
+    for name, value in fields.items():
+        parts.append(f'--{boundary}\r\nContent-Disposition: form-data; name="{name}"\r\n\r\n'
+                     f"{value}\r\n".encode())
+    parts.append(f'--{boundary}\r\nContent-Disposition: form-data; name="file"; '
+                 f'filename="{file_name}"\r\nContent-Type: application/zip\r\n\r\n'.encode())
+    parts.append(file_bytes)
+    parts.append(f"\r\n--{boundary}--\r\n".encode())
+    return b"".join(parts), f"multipart/form-data; boundary={boundary}"
+
+
+def _multipart_parts(parts: list[tuple[str, bytes]]) -> tuple[bytes, str]:
+    """One binary part per (field name, bytes): for blob uploads, the name is the blob ID."""
+    boundary = f"codeimprint-{uuid.uuid4().hex}"
+    out = []
+    for name, data in parts:
+        out.append(f'--{boundary}\r\nContent-Disposition: form-data; name="{name}"; '
+                   f'filename="{name}"\r\nContent-Type: application/octet-stream\r\n\r\n'
+                   .encode())
+        out.append(data)
+        out.append(b"\r\n")
+    out.append(f"--{boundary}--\r\n".encode())
+    return b"".join(out), f"multipart/form-data; boundary={boundary}"
+
+
+class Client:
+    def __init__(self, url: str, token: str | None = None, timeout: float = 300) -> None:
+        self.url, self.token, self.timeout = url.rstrip("/"), token, timeout
+        self.access = config.cf_access_for(self.url)        # this server's host only
+
+    def _request(self, method: str, path: str, body: bytes | None = None,
+                 content_type: str | None = None) -> dict:
+        headers = {"Accept": "application/json", "User-Agent": USER_AGENT}
+        if content_type:
+            headers["Content-Type"] = content_type
+        if self.token:
+            headers["Authorization"] = f"Bearer {self.token}"
+        if self.access:
+            headers["CF-Access-Client-Id"], headers["CF-Access-Client-Secret"] = self.access
+        req = urllib.request.Request(self.url + path, data=body, headers=headers, method=method)
+        try:
+            with _OPENER.open(req, timeout=self.timeout) as res:
+                return json.loads(res.read().decode("utf-8"))
+        except urllib.error.HTTPError as exc:
+            self._access_problem(exc)
+            code, message = "http_error", exc.reason or "Request failed"
+            try:
+                err = json.loads(exc.read().decode("utf-8"))["error"]
+                code, message = err["code"], err["message"]
+            except (ValueError, KeyError, TypeError):
+                pass
+            raise ApiError(exc.code, code, str(message)) from exc
+        except (urllib.error.URLError, TimeoutError, ConnectionError) as exc:
+            reason = getattr(exc, "reason", exc)
+            raise NetworkError(f"could not reach {self.url}: {reason}") from exc
+        except ValueError as exc:
+            raise NetworkError(f"{self.url} did not answer with JSON") from exc
+
+    def _access_problem(self, exc: urllib.error.HTTPError) -> None:
+        """Turn Cloudflare Access's answers (a redirect to its login, or its own 401/403
+        page) into a clear message; the engine's own errors are JSON and pass through."""
+        location = exc.headers.get("Location") or ""
+        if 300 <= exc.code < 400:
+            if "cloudflareaccess.com" in location:
+                raise NetworkError(ACCESS_REFUSED if self.access else ACCESS_HINT) from exc
+            raise NetworkError(f"{self.url} answered with a redirect to {location or '?'}; "
+                               "use the server's final https:// URL") from exc
+        servers = [s.lower() for s in exc.headers.get_all("Server") or []]
+        if exc.code in (401, 403) and "json" not in (exc.headers.get("Content-Type") or "") \
+                and "cloudflare" in servers:
+            raise NetworkError(ACCESS_REFUSED if self.access else ACCESS_HINT) from exc
+
+    def health(self) -> dict:
+        return self._request("GET", "/health")
+
+    def seal(self, zip_bytes: bytes, name: str | None = None, lines: dict | None = None,
+             project_id: str | None = None) -> dict:
+        fields = {k: v for k, v in (("name", name), ("project_id", project_id)) if v}
+        if lines is not None:
+            fields["lines"] = json.dumps(lines, sort_keys=True, separators=(",", ":"))
+        body, ctype = _multipart(fields, "project.zip", zip_bytes)
+        return self._request("POST", "/api/v1/seal", body, ctype)
+
+    def _json(self, method: str, path: str, payload: dict | None = None) -> dict:
+        body = json.dumps(payload).encode() if payload is not None else None
+        return self._request(method, path, body, "application/json" if body else None)
+
+    # Git-aware sealing: projects, plan -> blobs -> prepare -> finalise ------------------
+    def create_project(self, public_key: str, signature: str, name: str | None = None) -> dict:
+        return self._json("POST", "/api/v1/projects",
+                          {"public_key": public_key, "signature": signature,
+                           **({"name": name} if name else {})})
+
+    def rename_project(self, project: str, name: str, public: bool, public_key: str,
+                       signature: str) -> dict:
+        return self._json("POST", f"/api/v1/projects/{quote(project)}/name",
+                          {"name": name, "public": public, "public_key": public_key,
+                           "signature": signature})
+
+    # the GitHub App: the owner's key for a repository's project ------------------------
+    def github_link_prepare(self, repository: str, public_key: str,
+                            project: str | None = None) -> dict:
+        return self._json("POST", "/api/v1/integrations/github/link/prepare",
+                          {"repository": repository, "public_key": public_key,
+                           **({"project_id": project} if project else {})})
+
+    def github_link_finalise(self, repository: str, public_key: str, project: str | None,
+                             signature: str, key_signature: str | None = None) -> dict:
+        return self._json("POST", "/api/v1/integrations/github/link/finalise",
+                          {"repository": repository, "public_key": public_key,
+                           **({"project_id": project} if project else {}),
+                           "signature": signature,
+                           **({"key_signature": key_signature} if key_signature else {})})
+
+    def plan(self, project: str, payload: dict) -> dict:
+        return self._json("POST", f"/api/v1/projects/{quote(project)}/seal/plan", payload)
+
+    def upload_blobs(self, project: str, blobs: list[tuple[str, bytes]]) -> dict:
+        body, ctype = _multipart_parts(blobs)
+        return self._request("POST", f"/api/v1/projects/{quote(project)}/seal/blobs", body,
+                             ctype)
+
+    def prepare(self, project: str, plan_id: str) -> dict:
+        return self._json("POST", f"/api/v1/projects/{quote(project)}/seal/prepare",
+                          {"plan_id": plan_id})
+
+    def job(self, job_id: str) -> dict:
+        return self._json("GET", f"/api/v1/jobs/{quote(job_id)}")
+
+    def finalise(self, project: str, pending_id: str, public_key: str, signature: str) -> dict:
+        return self._json("POST", f"/api/v1/projects/{quote(project)}/seal/finalise",
+                          {"pending_id": pending_id, "public_key": public_key,
+                           "signature": signature})
+
+    def export(self, imprint_id: str) -> dict:
+        return self._json("GET", f"/api/v1/imprints/{quote(imprint_id)}/export")
+
+    def public_project(self, project: str) -> dict:
+        return self._json("GET", f"/api/v1/public/projects/{quote(project)}")
+
+    def public_chain(self, project: str, after: int | None = None) -> dict:
+        query = f"?after={int(after)}" if after is not None else ""
+        return self._json("GET", f"/api/v1/public/projects/{quote(project)}/chain{query}")
+
+    def check(self, zip_bytes: bytes, reference: str) -> dict:
+        body, ctype = _multipart({"reference": reference}, "project.zip", zip_bytes)
+        return self._request("POST", "/api/v1/check", body, ctype)
+
+    def add_signature(self, imprint_id: str, signature: dict) -> dict:
+        body = json.dumps(signature).encode()
+        return self._request("POST", f"/api/v1/imprints/{quote(imprint_id)}/signatures", body,
+                             "application/json")
+
+    # public, no token needed -----------------------------------------------------------
+    def published_keys(self) -> dict:
+        return self._request("GET", "/.well-known/codeimprint-keys.json")
+
+    def log_checkpoint(self) -> dict:
+        return self._request("GET", "/api/v1/public/log/checkpoint")
+
+    def log_consistency(self, first: int, second: int) -> dict:
+        return self._request("GET", f"/api/v1/public/log/consistency?from={int(first)}"
+                                    f"&to={int(second)}")
+
+    # sign-in and verified identity (engine 0.7.0a2) ---------------------------------------
+    def login_providers(self) -> dict:
+        return self._request("GET", "/api/v1/auth/providers")
+
+    def login_start(self, provider: str, email: str | None = None) -> dict:
+        return self._json("POST", "/api/v1/auth/cli/start",
+                          {"provider": provider, **({"email": email} if email else {})})
+
+    def login_poll(self, login_id: str, device_secret: str) -> dict:
+        return self._json("POST", "/api/v1/auth/cli/poll",
+                          {"login_id": login_id, "device_secret": device_secret})
+
+    def session_info(self) -> dict:
+        return self._request("GET", "/api/v1/auth/session")
+
+    def me(self) -> dict:
+        """The signed-in account (engine 0.7.0a8): new_account, terms_required, ..."""
+        return self._request("GET", "/api/v1/me")
+
+    def identity_challenge(self, public_key: str, level: str,
+                           show_email_domain: bool = False) -> dict:
+        return self._json("POST", "/api/v1/identity/challenges",
+                          {"public_key": public_key, "level": level,
+                           "show_email_domain": show_email_domain})
+
+    def identity_attest(self, challenge_id: str, signature: str) -> dict:
+        return self._json("POST", "/api/v1/identity/attestations",
+                          {"challenge_id": challenge_id, "signature": signature})
+
+    def revoke(self, document: dict, signatures: list[dict]) -> dict:
+        return self._json("POST", "/api/v1/revocations",
+                          {"document": document, "signatures": signatures})
+
+    def key_identity(self, fingerprint: str) -> dict:
+        return self._request("GET", f"/api/v1/public/keys/{quote(fingerprint)}/identity")
+
+    def public_record(self, record_id: str) -> dict:
+        return self._request("GET", f"/api/v1/public/records/{quote(record_id)}")
+
+    def public_imprint(self, imprint_id: str) -> dict:
+        return self._request("GET", f"/api/v1/public/imprints/{quote(imprint_id)}")
+
+    # ownership claims and coverage (engine 0.7.0a4) --------------------------------------
+    def claim_prepare(self, project: str, document: dict) -> dict:
+        return self._json("POST", f"/api/v1/projects/{quote(project)}/claims/prepare",
+                          {"document": document})
+
+    def claim_finalise(self, project: str, document: dict, signatures: list[dict]) -> dict:
+        return self._json("POST", f"/api/v1/projects/{quote(project)}/claims/finalise",
+                          {"document": document, "signatures": signatures})
+
+    def claim_key(self, project: str, claim: str, document: dict,
+                  signatures: list[dict]) -> dict:
+        return self._json("POST", f"/api/v1/projects/{quote(project)}/claims/{quote(claim)}"
+                                  "/keys", {"document": document, "signatures": signatures})
+
+    def assignment(self, project: str, document: dict, signatures: list[dict]) -> dict:
+        return self._json("POST", f"/api/v1/projects/{quote(project)}/assignments",
+                          {"document": document, "signatures": signatures})
+
+    def public_ownership(self, project: str, after: int | None = None) -> dict:
+        query = f"?after={int(after)}" if after is not None else ""
+        return self._json("GET", f"/api/v1/public/projects/{quote(project)}/ownership{query}")
+
+    def public_org(self, org: str) -> dict:
+        return self._request("GET", f"/api/v1/public/orgs/{quote(org)}")
+
+    # organisations, domains, memberships, disclosure, contributors (engine 0.7.0a3+) -----
+    def org_create(self, public_key: str, signature: str) -> dict:
+        return self._json("POST", "/api/v1/orgs", {"public_key": public_key,
+                                                   "signature": signature})
+
+    def org_domain_challenge(self, org: str, domain: str, public_key: str) -> dict:
+        return self._json("POST", f"/api/v1/orgs/{quote(org)}/domains",
+                          {"domain": domain, "public_key": public_key})
+
+    def org_domain_verify(self, org: str, domain: str, signature: str) -> dict:
+        return self._json("POST", f"/api/v1/orgs/{quote(org)}/domains/verify",
+                          {"domain": domain, "signature": signature})
+
+    def org_disclosure_document(self, org: str, domain: str) -> dict:
+        return self._json("GET", f"/api/v1/orgs/{quote(org)}/disclosures/document?domain="
+                                 f"{quote(domain)}")
+
+    def org_disclose(self, org: str, domain: str, public_key: str, signature: str) -> dict:
+        return self._json("POST", f"/api/v1/orgs/{quote(org)}/disclosures",
+                          {"domain": domain, "public_key": public_key, "signature": signature})
+
+    def org_member_prepare(self, org: str, member_public_key: str, basis: str) -> dict:
+        return self._json("POST", f"/api/v1/orgs/{quote(org)}/members/prepare",
+                          {"member_public_key": member_public_key, "basis": basis})
+
+    def org_member_finalise(self, org: str, pending_id: str, signatures: list[dict]) -> dict:
+        return self._json("POST", f"/api/v1/orgs/{quote(org)}/members/finalise",
+                          {"pending_id": pending_id, "signatures": signatures})
+
+    def org_member_end(self, org: str, membership: str, valid_until: str,
+                       signatures: list[dict]) -> dict:
+        return self._json("POST", f"/api/v1/orgs/{quote(org)}/members/end",
+                          {"membership": membership, "valid_until": valid_until,
+                           "signatures": signatures})
+
+    def contributor(self, project: str, document: dict, signatures: list[dict]) -> dict:
+        return self._json("POST", f"/api/v1/projects/{quote(project)}/contributors",
+                          {"document": document, "signatures": signatures})