ep-verify 0.1.0__py3-none-any.whl

ep_verify/__init__.py

@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: Apache-2.0
+"""ep-verify: thin CLI alias over emilia_verify (same verifier, one verb)."""
+from emilia_verify import verify_receipt  # re-export the real verifier
+
+__all__ = ["verify_receipt"]

ep_verify/cli.py

@@ -0,0 +1,87 @@
+# SPDX-License-Identifier: Apache-2.0
+"""ep-verify <receipt.json> [--keys keys.json]
+
+Verifies one EP-RECEIPT-v1 document fully offline against issuer public
+key(s) you pin (base64url SPKI, a JSON string, array, or {kid: key} map).
+Prints VERIFIED or REFUSED plus a machine-readable JSON line; exit 0 only
+on VERIFIED. Fail closed: any error, missing key, or malformed input
+refuses. Verification proves signature/binding/anchor integrity against
+the pinned keys; it never proves the action was correct or sufficient.
+"""
+import json
+import sys
+
+from emilia_verify import verify_receipt
+
+USAGE = "usage: ep-verify <receipt.json> [--keys keys.json]"
+
+
+def _load_keys(path):
+    with open(path, "r", encoding="utf-8") as f:
+        data = json.load(f)
+    if isinstance(data, str):
+        return [data]
+    if isinstance(data, list):
+        return [k for k in data if isinstance(k, str)]
+    if isinstance(data, dict):
+        return [v for v in data.values() if isinstance(v, str)]
+    return []
+
+
+def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    if not argv or argv[0] in ("-h", "--help"):
+        print(__doc__ if argv and argv[0] in ("-h", "--help") else USAGE)
+        return 0 if argv else 1
+    receipt_path, keys_path = argv[0], None
+    if "--keys" in argv:
+        i = argv.index("--keys")
+        if i + 1 >= len(argv):
+            print("REFUSED")
+            print(json.dumps({"result": "refused", "reason": "keys_flag_without_path"}))
+            return 1
+        keys_path = argv[i + 1]
+
+    try:
+        with open(receipt_path, "r", encoding="utf-8") as f:
+            doc = json.load(f)
+    except Exception:
+        print("REFUSED")
+        print(json.dumps({"result": "refused", "reason": "receipt_unreadable_or_malformed"}))
+        return 1
+
+    keys = []
+    if keys_path:
+        try:
+            keys = _load_keys(keys_path)
+        except Exception:
+            print("REFUSED")
+            print(json.dumps({"result": "refused", "reason": "keys_unreadable_or_malformed"}))
+            return 1
+    if not keys:
+        print("REFUSED")
+        print(json.dumps({"result": "refused", "reason": "no_pinned_keys"}))
+        return 1
+
+    last_error = None
+    for key in keys:
+        try:
+            result = verify_receipt(doc, key)
+        except Exception as e:  # verifier crash on hostile input = refusal
+            last_error = f"verifier_error:{type(e).__name__}"
+            continue
+        if getattr(result, "valid", False) or (isinstance(result, dict) and result.get("valid")):
+            checks = getattr(result, "checks", None) or (result.get("checks") if isinstance(result, dict) else None)
+            print("VERIFIED")
+            print(json.dumps({"result": "verified", "receipt_id": (doc.get("payload") or {}).get("receipt_id"), "checks": checks}, default=str))
+            return 0
+        err = getattr(result, "error", None) or (result.get("error") if isinstance(result, dict) else None)
+        last_error = err or "signature_invalid"
+
+    print("REFUSED")
+    print(json.dumps({"result": "refused", "reason": last_error or "no_key_verified"}, default=str))
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

ep_verify-0.1.0.dist-info/METADATA

@@ -0,0 +1,34 @@
+Metadata-Version: 2.4
+Name: ep-verify
+Version: 0.1.0
+Summary: One-line offline verifier for EMILIA Protocol authorization receipts (EP-RECEIPT-v1). Thin CLI over emilia-verify: proves signature, binding, and anchor integrity against keys you pin; never business correctness.
+Project-URL: Homepage, https://www.emiliaprotocol.ai
+Project-URL: Repository, https://github.com/emiliaprotocol/emilia-protocol
+Author-email: Iman Schrock <team@emiliaprotocol.ai>
+License: Apache-2.0
+Requires-Python: >=3.10
+Requires-Dist: emilia-verify>=2.2.0
+Description-Content-Type: text/markdown
+
+# ep-verify
+
+One-line offline verifier for EMILIA Protocol authorization receipts
+(EP-RECEIPT-v1). A thin CLI over [`emilia-verify`](https://pypi.org/project/emilia-verify/),
+so `ep-verify` is the same verb on PyPI and npm.
+
+```bash
+pip install ep-verify
+ep-verify receipt.json --keys keys.json
+```
+
+Prints `VERIFIED` or `REFUSED` plus one machine-readable JSON line;
+exit code 0 only on VERIFIED. Fully offline, fail closed: a missing key,
+unreadable file, or verifier error is a refusal, never a pass.
+
+What VERIFIED means: the Ed25519 signature over the canonical (RFC 8785)
+payload validates against a key **you** pinned, and any Merkle anchor is
+consistent. What it does NOT mean: that the action was correct, sufficient,
+or accepted by any relying party; acceptance is a relying-party decision.
+
+Apache-2.0. Part of the EMILIA Protocol reference tooling:
+https://github.com/emiliaprotocol/emilia-protocol

ep_verify-0.1.0.dist-info/RECORD

@@ -0,0 +1,6 @@
+ep_verify/__init__.py,sha256=5Zz0vQOwVBykyZA3d9aYh7ukHCBnfqpt3oGVgsUm5GY,218
+ep_verify/cli.py,sha256=q0DYcnnJMAOBPbDxJp3i8oFvbL33Sp0oN1592FYNmEg,3203
+ep_verify-0.1.0.dist-info/METADATA,sha256=D3w3jKKAdhonxn_zeg_HEfbuDh4RzxysU_SPnFRB0Xo,1487
+ep_verify-0.1.0.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+ep_verify-0.1.0.dist-info/entry_points.txt,sha256=_J9YEtB6NfeBBXirEmBuJbQcGL2HBzVbrWaL5dGUMA4,49
+ep_verify-0.1.0.dist-info/RECORD,,

ep_verify-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any

ep_verify-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+ep-verify = ep_verify.cli:main