cred-auth 1.0.0__py3-none-any.whl

cred/__init__.py

@@ -0,0 +1,33 @@
+"""Cred — credential delegation SDK for AI agents."""
+
+from .client import AsyncCred, Cred
+from .exceptions import (
+    AgentRevokedException,
+    ConsentRequiredError,
+    CredError,
+    RateLimitException,
+    ScopeCeilingException,
+)
+from .identity import (
+    AgentIdentity,
+    CRED_PUBLIC_KEY_HEX,
+    generate_agent_identity,
+    verify_delegation_receipt,
+)
+from .models import DelegationResult, Connection
+
+__all__ = [
+    "Cred",
+    "AsyncCred",
+    "CredError",
+    "ConsentRequiredError",
+    "AgentRevokedException",
+    "ScopeCeilingException",
+    "RateLimitException",
+    "AgentIdentity",
+    "generate_agent_identity",
+    "verify_delegation_receipt",
+    "CRED_PUBLIC_KEY_HEX",
+    "DelegationResult",
+    "Connection",
+]

cred/client.py

@@ -0,0 +1,335 @@
+"""Cred SDK — Main client classes."""
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from typing import Any, Optional
+from urllib.parse import urlencode, urlparse
+
+import httpx
+
+from .exceptions import (
+    AgentRevokedException,
+    ConsentRequiredError,
+    CredError,
+    RateLimitException,
+    ScopeCeilingException,
+)
+from .models import Connection, DelegationResult
+
+DEFAULT_BASE_URL = "https://api.cred.ninja"
+_LOCALHOSTS = {"localhost", "127.0.0.1", "::1"}
+
+
+def _parse_expires_at(raw_value: Any, expires_in: int) -> datetime:
+    if isinstance(raw_value, str):
+        parsed_value = raw_value.replace("Z", "+00:00")
+        try:
+            return datetime.fromisoformat(parsed_value)
+        except ValueError:
+            pass
+    return datetime.now(timezone.utc) + timedelta(seconds=expires_in)
+
+
+class _CredBase:
+    def __init__(self, agent_token: str, base_url: str = DEFAULT_BASE_URL) -> None:
+        if not agent_token:
+            raise CredError("agent_token is required", "invalid_config", 0)
+        self._agent_token = agent_token
+        self._base_url = self._validate_base_url(base_url)
+
+    @staticmethod
+    def _validate_base_url(url: str) -> str:
+        try:
+            parsed = urlparse(url)
+        except Exception:
+            raise CredError(f'Invalid base_url: "{url}" — must be a valid HTTPS URL', "invalid_config", 0)
+
+        if parsed.scheme == "https":
+            return url.rstrip("/")
+
+        if parsed.scheme == "http" and parsed.hostname in _LOCALHOSTS:
+            return url.rstrip("/")
+
+        raise CredError(
+            "Invalid base_url: must use HTTPS except for localhost development URLs",
+            "invalid_config",
+            0,
+        )
+
+    def _auth_headers(self) -> dict[str, str]:
+        return {
+            "Authorization": f"Bearer {self._agent_token}",
+            "Content-Type": "application/json",
+            "Accept": "application/json",
+        }
+
+    @staticmethod
+    def _build_delegation_result(data: dict[str, Any]) -> DelegationResult:
+        raw_expires_in = data.get("expires_in")
+        expires_in = int(raw_expires_in) if raw_expires_in is not None else 900
+        expires_at = _parse_expires_at(data.get("expires_at") or data.get("expiresAt"), expires_in)
+        return DelegationResult(
+            access_token=data["access_token"],
+            token_type=data["token_type"],
+            expires_in=expires_in,
+            expires_at=expires_at,
+            service=data["service"],
+            scopes=data["scopes"],
+            delegation_id=data["delegation_id"],
+            receipt=data.get("receipt"),
+        )
+
+    @staticmethod
+    def _build_connections(data: dict[str, Any]) -> list[Connection]:
+        connections = data.get("connections", [])
+        return [
+            Connection(
+                slug=connection["slug"],
+                scopes_granted=connection["scopesGranted"],
+                app_client_id=connection.get("appClientId"),
+                consented_at=connection.get("consentedAt"),
+            )
+            for connection in connections
+        ]
+
+    @staticmethod
+    def _error_payload(response: httpx.Response) -> tuple[dict[str, Any], str, str]:
+        body: dict[str, Any] = {}
+        try:
+            parsed = response.json()
+            if isinstance(parsed, dict):
+                body = parsed
+        except Exception:
+            pass
+
+        message = body.get("message") or body.get("error") or f"Request failed with status {response.status_code}"
+        error_code = str(body.get("error", "unknown"))
+        return body, str(message), error_code
+
+    def _handle_response(self, response: httpx.Response) -> Any:
+        if response.status_code == 204:
+            return {}
+
+        if response.is_success:
+            return response.json()
+
+        body, message, error_code = self._error_payload(response)
+
+        if response.status_code == 403 and error_code == "consent_required":
+            raise ConsentRequiredError(message, str(body.get("consent_url", "")))
+        if response.status_code == 403 and error_code == "agent_revoked":
+            raise AgentRevokedException(message)
+        if response.status_code == 403 and error_code == "scope_ceiling_exceeded":
+            raise ScopeCeilingException(message)
+        if response.status_code == 429 and error_code == "rate_limited":
+            raise RateLimitException(message)
+
+        raise CredError(message, error_code, response.status_code)
+
+    def get_consent_url(
+        self,
+        service: str,
+        user_id: str,
+        app_client_id: str,
+        scopes: list[str],
+        redirect_uri: str,
+    ) -> str:
+        params = urlencode(
+            {
+                "app_client_id": app_client_id,
+                "scopes": ",".join(scopes),
+                "redirect_uri": redirect_uri,
+            },
+        )
+        return f"{self._base_url}/api/connect/{service}/authorize?{params}"
+
+
+class Cred(_CredBase):
+    """Synchronous client for the Cred credential delegation API."""
+
+    def __init__(
+        self,
+        agent_token: str,
+        base_url: str = DEFAULT_BASE_URL,
+    ) -> None:
+        super().__init__(agent_token=agent_token, base_url=base_url)
+        self._client = httpx.Client(
+            base_url=self._base_url,
+            headers=self._auth_headers(),
+            timeout=30.0,
+        )
+
+    def delegate(
+        self,
+        service: str,
+        user_id: str,
+        app_client_id: Optional[str] = None,
+        scopes: Optional[list[str]] = None,
+        agent_did: Optional[str] = None,
+    ) -> DelegationResult:
+        body: dict[str, Any] = {
+            "service": service,
+            "user_id": user_id,
+        }
+        if app_client_id:
+            body["appClientId"] = app_client_id
+        if scopes:
+            body["scopes"] = scopes
+        if agent_did:
+            body["agent_did"] = agent_did
+
+        data = self._request_json("POST", "/api/v1/delegate", body)
+        return self._build_delegation_result(data)
+
+    def list_connections(
+        self,
+        user_id: str,
+        app_client_id: Optional[str] = None,
+    ) -> list[dict[str, Any]]:
+        params: dict[str, str] = {"user_id": user_id}
+        if app_client_id:
+            params["app_client_id"] = app_client_id
+
+        data = self._request_json("GET", f"/api/v1/connections?{urlencode(params)}")
+        return list(data.get("connections", []))
+
+    def get_user_connections(
+        self,
+        user_id: str,
+        app_client_id: Optional[str] = None,
+    ) -> list[Connection]:
+        return self._build_connections(
+            {"connections": self.list_connections(user_id, app_client_id)},
+        )
+
+    def revoke(
+        self,
+        service: str,
+        user_id: str,
+        app_client_id: Optional[str] = None,
+    ) -> None:
+        params: dict[str, str] = {"user_id": user_id}
+        if app_client_id:
+            params["app_client_id"] = app_client_id
+
+        self._request_no_content("DELETE", f"/api/v1/connections/{service}?{urlencode(params)}")
+
+    def revoke_agent(self, agent_id: str) -> None:
+        self._request_no_content("POST", f"/api/v1/agents/{agent_id}/revoke-all", {})
+
+    def _request_json(self, method: str, path: str, body: Optional[dict[str, Any]] = None) -> dict[str, Any]:
+        response = self._client.request(method, path, json=body)
+        payload = self._handle_response(response)
+        if not isinstance(payload, dict):
+            raise CredError("Expected JSON object response", "invalid_response", response.status_code)
+        return payload
+
+    def _request_no_content(self, method: str, path: str, body: Optional[dict[str, Any]] = None) -> None:
+        response = self._client.request(method, path, json=body)
+        if response.status_code != 204:
+            self._handle_response(response)
+
+    def close(self) -> None:
+        self._client.close()
+
+    def __enter__(self) -> "Cred":
+        return self
+
+    def __exit__(self, *args: Any) -> None:
+        self.close()
+
+
+class AsyncCred(_CredBase):
+    """Asynchronous client for the Cred credential delegation API."""
+
+    def __init__(
+        self,
+        agent_token: str,
+        base_url: str = DEFAULT_BASE_URL,
+    ) -> None:
+        super().__init__(agent_token=agent_token, base_url=base_url)
+        self._client = httpx.AsyncClient(
+            base_url=self._base_url,
+            headers=self._auth_headers(),
+            timeout=30.0,
+        )
+
+    async def delegate(
+        self,
+        service: str,
+        user_id: str,
+        app_client_id: Optional[str] = None,
+        scopes: Optional[list[str]] = None,
+        agent_did: Optional[str] = None,
+    ) -> DelegationResult:
+        body: dict[str, Any] = {
+            "service": service,
+            "user_id": user_id,
+        }
+        if app_client_id:
+            body["appClientId"] = app_client_id
+        if scopes:
+            body["scopes"] = scopes
+        if agent_did:
+            body["agent_did"] = agent_did
+
+        data = await self._request_json("POST", "/api/v1/delegate", body)
+        return self._build_delegation_result(data)
+
+    async def list_connections(
+        self,
+        user_id: str,
+        app_client_id: Optional[str] = None,
+    ) -> list[dict[str, Any]]:
+        params: dict[str, str] = {"user_id": user_id}
+        if app_client_id:
+            params["app_client_id"] = app_client_id
+
+        data = await self._request_json("GET", f"/api/v1/connections?{urlencode(params)}")
+        return list(data.get("connections", []))
+
+    async def get_user_connections(
+        self,
+        user_id: str,
+        app_client_id: Optional[str] = None,
+    ) -> list[Connection]:
+        return self._build_connections(
+            {"connections": await self.list_connections(user_id, app_client_id)},
+        )
+
+    async def revoke(
+        self,
+        service: str,
+        user_id: str,
+        app_client_id: Optional[str] = None,
+    ) -> None:
+        params: dict[str, str] = {"user_id": user_id}
+        if app_client_id:
+            params["app_client_id"] = app_client_id
+
+        await self._request_no_content("DELETE", f"/api/v1/connections/{service}?{urlencode(params)}")
+
+    async def revoke_agent(self, agent_id: str) -> None:
+        await self._request_no_content("POST", f"/api/v1/agents/{agent_id}/revoke-all", {})
+
+    async def _request_json(self, method: str, path: str, body: Optional[dict[str, Any]] = None) -> dict[str, Any]:
+        response = await self._client.request(method, path, json=body)
+        payload = self._handle_response(response)
+        if not isinstance(payload, dict):
+            raise CredError("Expected JSON object response", "invalid_response", response.status_code)
+        return payload
+
+    async def _request_no_content(self, method: str, path: str, body: Optional[dict[str, Any]] = None) -> None:
+        response = await self._client.request(method, path, json=body)
+        if response.status_code != 204:
+            self._handle_response(response)
+
+    async def close(self) -> None:
+        await self._client.aclose()
+
+    async def __aenter__(self) -> "AsyncCred":
+        return self
+
+    async def __aexit__(self, *args: Any) -> None:
+        await self.close()

cred/exceptions.py

@@ -0,0 +1,46 @@
+"""Cred SDK — Exception classes."""
+
+
+class CredError(Exception):
+    """Base exception for all Cred API errors."""
+
+    def __init__(self, message: str, code: str, status_code: int) -> None:
+        super().__init__(message)
+        self.code = code
+        self.status_code = status_code
+
+    def __repr__(self) -> str:
+        return f"{self.__class__.__name__}(message={str(self)!r}, code={self.code!r}, status_code={self.status_code})"
+
+
+class ConsentRequiredError(CredError):
+    """Raised when a user has not yet consented to a service.
+
+    The ``consent_url`` attribute contains the URL to redirect the user to
+    complete the OAuth consent flow.
+    """
+
+    def __init__(self, message: str, consent_url: str) -> None:
+        super().__init__(message, "consent_required", 403)
+        self.consent_url = consent_url
+
+
+class AgentRevokedException(CredError):
+    """Raised when the agent token has been revoked server-side."""
+
+    def __init__(self, message: str) -> None:
+        super().__init__(message, "agent_revoked", 403)
+
+
+class ScopeCeilingException(CredError):
+    """Raised when requested scopes exceed the agent's ceiling."""
+
+    def __init__(self, message: str) -> None:
+        super().__init__(message, "scope_ceiling_exceeded", 403)
+
+
+class RateLimitException(CredError):
+    """Raised when the API rate limits the request."""
+
+    def __init__(self, message: str) -> None:
+        super().__init__(message, "rate_limited", 429)

cred/identity.py

@@ -0,0 +1,329 @@
+"""Agent Identity — DID:key generation and management.
+
+Uses Ed25519 key pairs with did:key encoding (RFC draft-multiformats-multibase).
+Uses `cryptography` package for Ed25519 operations.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from typing import Optional
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey,
+    Ed25519PublicKey,
+)
+from cryptography.hazmat.primitives import serialization
+
+# ── Cred Public Key (pinned at build time) ───────────────────────────────────
+
+CRED_PUBLIC_KEY_HEX = "ed50f12caeed3e3054be071c2884fda47752a02b5d98e37dfd79db5fd502699f"
+
+# ── Base58btc alphabet (Bitcoin) ─────────────────────────────────────────────
+
+_BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+
+
+def _encode_base58(data: bytes) -> str:
+    """Encode bytes to base58btc string."""
+    if len(data) == 0:
+        return ""
+
+    # Count leading zeros
+    zeros = 0
+    for byte in data:
+        if byte != 0:
+            break
+        zeros += 1
+
+    # Convert to big integer and repeatedly divide by 58
+    size = (len(data) * 138 // 100) + 1
+    b58 = [0] * size
+    length = 0
+
+    for byte in data:
+        carry = byte
+        i = 0
+        for j in range(size - 1, -1, -1):
+            if carry == 0 and i >= length:
+                break
+            carry += 256 * b58[j]
+            b58[j] = carry % 58
+            carry //= 58
+            i += 1
+        length = i
+
+    # Skip leading zeros in base58 result
+    start = size - length
+    while start < size and b58[start] == 0:
+        start += 1
+
+    # Build result string
+    result = "1" * zeros
+    for i in range(start, size):
+        result += _BASE58_ALPHABET[b58[i]]
+
+    return result
+
+
+def _decode_base58(s: str) -> bytes:
+    """Decode base58btc string to bytes."""
+    if len(s) == 0:
+        return b""
+
+    # Build alphabet lookup
+    lookup = {char: i for i, char in enumerate(_BASE58_ALPHABET)}
+
+    # Count leading '1's (zeros)
+    zeros = 0
+    for char in s:
+        if char != "1":
+            break
+        zeros += 1
+
+    # Decode to bytes
+    size = (len(s) * 733 // 1000) + 1
+    result = [0] * size
+    length = 0
+
+    for char in s:
+        value = lookup.get(char)
+        if value is None:
+            raise ValueError(f"Invalid base58 character: {char}")
+
+        carry = value
+        i = 0
+        for j in range(size - 1, -1, -1):
+            if carry == 0 and i >= length:
+                break
+            carry += 58 * result[j]
+            result[j] = carry % 256
+            carry //= 256
+            i += 1
+        length = i
+
+    # Skip leading zeros in byte array
+    start = size - length
+    while start < size and result[start] == 0:
+        start += 1
+
+    # Prepend zeros and return
+    return bytes([0] * zeros + result[start:])
+
+
+# ── Ed25519 multicodec prefix ────────────────────────────────────────────────
+
+# did:key multicodec prefix for Ed25519 public keys: 0xed01
+# Encoded as varint: [0xed, 0x01]
+_ED25519_MULTICODEC_PREFIX = bytes([0xED, 0x01])
+
+
+# ── Types ────────────────────────────────────────────────────────────────────
+
+
+@dataclass
+class ExportedIdentity:
+    """Exported identity for persistence."""
+
+    did: str
+    private_key_hex: str
+
+
+class AgentIdentity:
+    """Agent identity with Ed25519 key pair and DID.
+
+    Attributes:
+        did: DID in did:key format: did:key:z6Mk<base58-encoded-public-key>
+        public_key: Raw 32-byte Ed25519 public key
+        private_key: Raw 32-byte Ed25519 private key
+    """
+
+    def __init__(
+        self,
+        did: str,
+        public_key: bytes,
+        private_key: bytes,
+    ) -> None:
+        self._did = did
+        self._public_key = bytes(public_key)
+        self._private_key = bytes(private_key)
+
+    @property
+    def did(self) -> str:
+        return self._did
+
+    @property
+    def public_key(self) -> bytes:
+        return bytes(self._public_key)
+
+    @property
+    def private_key(self) -> bytes:
+        return bytes(self._private_key)
+
+    def export(self) -> dict[str, str]:
+        """Export identity for persistence.
+
+        Returns:
+            Dict with 'did' and 'private_key_hex' keys.
+        """
+        return {
+            "did": self._did,
+            "private_key_hex": self._private_key.hex(),
+        }
+
+    @classmethod
+    def from_export(cls, data: dict[str, str]) -> "AgentIdentity":
+        """Import a persisted agent identity.
+
+        Args:
+            data: Dict with 'did' and 'private_key_hex' keys.
+
+        Returns:
+            AgentIdentity with full key pair.
+
+        Raises:
+            ValueError: If DID format is invalid or private key is wrong size.
+        """
+        did = data["did"]
+        private_key_hex = data["private_key_hex"]
+
+        # Validate DID format
+        if not did.startswith("did:key:z"):
+            raise ValueError("Invalid DID format: must start with did:key:z")
+
+        # Decode private key from hex
+        private_key_bytes = bytes.fromhex(private_key_hex)
+        if len(private_key_bytes) != 32:
+            raise ValueError("Invalid private key: must be 32 bytes")
+
+        # Derive public key from private key using cryptography
+        private_key_obj = Ed25519PrivateKey.from_private_bytes(private_key_bytes)
+        public_key_obj = private_key_obj.public_key()
+        public_key_bytes = public_key_obj.public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        )
+
+        # Verify DID matches derived public key
+        derived_did = _public_key_to_did(public_key_bytes)
+        if derived_did != did:
+            raise ValueError("DID does not match derived public key")
+
+        return cls(did, public_key_bytes, private_key_bytes)
+
+
+def _public_key_to_did(public_key: bytes) -> str:
+    """Convert raw Ed25519 public key to did:key format."""
+    # Prepend multicodec prefix and encode as base58btc
+    prefixed = _ED25519_MULTICODEC_PREFIX + public_key
+    # 'z' is the multibase prefix for base58btc
+    return f"did:key:z{_encode_base58(prefixed)}"
+
+
+def generate_agent_identity() -> AgentIdentity:
+    """Generate a new agent identity with Ed25519 key pair.
+
+    Returns:
+        AgentIdentity with DID, public key, private key, and export function.
+    """
+    # Generate new Ed25519 key pair
+    private_key_obj = Ed25519PrivateKey.generate()
+    public_key_obj = private_key_obj.public_key()
+
+    # Extract raw key bytes
+    private_key_bytes = private_key_obj.private_bytes(
+        encoding=serialization.Encoding.Raw,
+        format=serialization.PrivateFormat.Raw,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    public_key_bytes = public_key_obj.public_bytes(
+        encoding=serialization.Encoding.Raw,
+        format=serialization.PublicFormat.Raw,
+    )
+
+    # Build did:key from public key
+    did = _public_key_to_did(public_key_bytes)
+
+    return AgentIdentity(did, public_key_bytes, private_key_bytes)
+
+
+# ── Receipt Verification ─────────────────────────────────────────────────────
+
+
+def _base64url_decode(s: str) -> bytes:
+    """Decode base64url string to bytes."""
+    import base64
+
+    # Replace URL-safe characters and add padding
+    s = s.replace("-", "+").replace("_", "/")
+    # Add padding
+    padding = 4 - (len(s) % 4)
+    if padding != 4:
+        s += "=" * padding
+    return base64.b64decode(s)
+
+
+def verify_delegation_receipt(
+    receipt: Optional[str],
+    expected_did: str,
+    cred_public_key: Optional[str] = None,
+) -> bool:
+    """Verify a delegation receipt from the Cred API.
+
+    Receipts are JWS compact serialization (header.payload.signature) signed
+    by Cred's Ed25519 key. Returns True if signature is valid and DID matches.
+
+    Args:
+        receipt: JWS compact serialization string (or None).
+        expected_did: Expected agent DID (sub claim in receipt payload).
+        cred_public_key: Cred's public key in hex format (defaults to CRED_PUBLIC_KEY_HEX).
+
+    Returns:
+        True if receipt is valid and matches expected DID, False otherwise.
+
+    Raises:
+        ValueError: If CRED_PUBLIC_KEY_HEX is still placeholder.
+    """
+    # Return False for missing receipts (don't throw)
+    if not receipt:
+        return False
+
+    cred_public_key_hex = cred_public_key or CRED_PUBLIC_KEY_HEX
+
+    # Placeholder check — can't verify without real key
+    if cred_public_key_hex == "PLACEHOLDER_REPLACE_BEFORE_LAUNCH":
+        raise ValueError("CRED_PUBLIC_KEY_HEX is placeholder — cannot verify receipts")
+
+    try:
+        # Parse JWS compact serialization: header.payload.signature
+        parts = receipt.split(".")
+        if len(parts) != 3:
+            return False
+
+        header_b64, payload_b64, signature_b64 = parts
+
+        # Decode and validate header
+        header = json.loads(_base64url_decode(header_b64).decode("utf-8"))
+        if header.get("alg") != "EdDSA" or header.get("typ") != "JWT":
+            return False
+
+        # Decode payload and verify DID matches
+        payload = json.loads(_base64url_decode(payload_b64).decode("utf-8"))
+        if payload.get("sub") != expected_did:
+            return False
+
+        # Verify signature
+        signature_input = f"{header_b64}.{payload_b64}".encode("utf-8")
+        signature = _base64url_decode(signature_b64)
+
+        # Build Ed25519 public key object from raw bytes
+        cred_public_key_bytes = bytes.fromhex(cred_public_key_hex)
+        if len(cred_public_key_bytes) != 32:
+            return False
+
+        public_key_obj = Ed25519PublicKey.from_public_bytes(cred_public_key_bytes)
+        public_key_obj.verify(signature, signature_input)
+        return True
+    except Exception:
+        return False

cred/models.py

@@ -0,0 +1,31 @@
+"""Cred SDK — Response model dataclasses."""
+
+from __future__ import annotations
+
+from datetime import datetime
+from dataclasses import dataclass
+from typing import Optional
+
+
+@dataclass
+class DelegationResult:
+    """Result of a successful delegation request."""
+
+    access_token: str
+    token_type: str
+    expires_in: int
+    expires_at: datetime
+    service: str
+    scopes: list[str]
+    delegation_id: str
+    receipt: Optional[str] = None
+
+
+@dataclass
+class Connection:
+    """A user's active service connection."""
+
+    slug: str
+    scopes_granted: list[str]
+    app_client_id: Optional[str] = None
+    consented_at: Optional[str] = None

cred_auth-1.0.0.dist-info/METADATA

@@ -0,0 +1,92 @@
+Metadata-Version: 2.4
+Name: cred-auth
+Version: 1.0.0
+Summary: Cred — credential delegation SDK for AI agents
+Project-URL: Homepage, https://cred.ninja
+Project-URL: Repository, https://github.com/cred-ninja/sdk
+Project-URL: Documentation, https://docs.cred.ninja
+Author-email: Cred <hello@cred.ninja>
+License: Apache-2.0
+Keywords: ai-agents,cred,credentials,delegation,oauth
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries
+Requires-Python: >=3.9
+Requires-Dist: cryptography>=42.0
+Requires-Dist: httpx>=0.24
+Provides-Extra: dev
+Requires-Dist: hatchling; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: respx>=0.20; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# cred-auth
+
+Python SDK for Cred. OAuth2 credential delegation for AI agents. Tokens are brokered, never exposed.
+
+## Install
+
+```bash
+pip install cred-auth
+```
+
+## Quick Start
+
+```python
+import os
+from cred import Cred, ConsentRequiredError
+
+cred = Cred(agent_token=os.environ["CRED_AGENT_TOKEN"])
+
+try:
+    result = cred.delegate(
+        service="google",
+        user_id="user_123",
+        app_client_id="my_app_client_id",
+        scopes=["calendar.readonly"],
+    )
+    print(result.access_token)
+except ConsentRequiredError as e:
+    # Redirect user to e.consent_url to complete OAuth consent
+    print(f"Redirect user to: {e.consent_url}")
+```
+
+## API
+
+### `Cred(agent_token, base_url=...)`
+
+### `delegate(service, user_id, app_client_id, scopes=None) → DelegationResult`
+
+Get a delegated access token for a service on behalf of a user.
+
+Raises `ConsentRequiredError` (with `.consent_url`) if the user hasn't connected the service.
+
+### `get_user_connections(user_id, app_client_id=None) → list[Connection]`
+
+List all active service connections for a user.
+
+### `get_consent_url(service, user_id, app_client_id, scopes, redirect_uri) → str`
+
+Build a consent URL. Pure URL construction, no HTTP call.
+
+### `revoke(service, user_id, app_client_id=None) → None`
+
+Revoke a user's connection to a service.
+
+## Context Manager
+
+```python
+with Cred(agent_token=token) as cred:
+    result = cred.delegate(service="github", user_id="u1", app_client_id="app1")
+```
+
+## Self-Hosted Server Mode
+
+Point `base_url` at your own `@credninja/server` deployment when you want a separate credential broker instead of local-only usage.

cred_auth-1.0.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+cred/__init__.py,sha256=detfphK_u0GBcnE2qyxcZU9Au1qO3nej76PYEoUB4zs,746
+cred/client.py,sha256=6x4vqGXUhy-B8A4Q4iV-hWRYyevq-ho0V1SRjvkwWnU,11293
+cred/exceptions.py,sha256=_U64mjaMAY6q5PxyO5-ud0xOJ11N6IqddoS-suXc3vY,1460
+cred/identity.py,sha256=ka9ZV8fNrQJtO1vJ6tev6Ltg7KFRU74OKLOCFFrZmg0,10240
+cred/models.py,sha256=i2O6SQRkpq5EhXvzW5rA8p8-Q4UF2cUjeu5yCsngPwc,651
+cred_auth-1.0.0.dist-info/METADATA,sha256=3w3yui_PHY081tC7TMSyhdbiZWHTVbHrqS9wOLFwPZY,2780
+cred_auth-1.0.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+cred_auth-1.0.0.dist-info/RECORD,,

cred_auth-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any