jep-cli 0.6.1__tar.gz → 0.7.2__tar.gz

{jep_cli-0.6.1 → jep_cli-0.7.2}/NOTICE.md

@@ -1,6 +1,6 @@
 # Notice
 
-This repository contains an experimental CLI seed for the JEP v0.6 API.
+This repository contains an experimental CLI seed for the JEP reference API. Supported protocol revisions are documented in README.md.
 
 Internet-Draft text and excerpts are governed by the IETF Trust Legal Provisions and BCP 78 / BCP 79.
 

jep_cli-0.7.2/PKG-INFO

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: jep-cli
+Version: 0.7.2
+Summary: Command-line client for JEP Core 0.7 with explicit legacy compatibility
+Author-email: HJS Spec <signal@humanjudgment.org>
+License: MIT
+Project-URL: Homepage, https://github.com/hjs-spec/cli
+Project-URL: Repository, https://github.com/hjs-spec/cli
+Project-URL: Issues, https://github.com/hjs-spec/cli/issues
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE.md
+Requires-Dist: rfc8785==0.1.4
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Dynamic: license-file
+
+# JEP CLI — JEP Core 0.7
+
+Command-line client for creating and verifying current JEP Core 0.7 events
+through the JEP API.
+
+Default endpoints:
+
+```text
+POST /v0.7/events/create
+POST /v0.7/events/verify
+GET  /health
+```
+
+Historical pre-0.7 handling is explicit through `--legacy`; the CLI never
+retries a failed 0.7 event with a legacy decoder.
+
+## Status
+
+Experimental reference client. It does not define Core semantics or determine
+truth, authorization validity, legal effect, causality, or policy outcome.
+
+## Installation
+
+```bash
+pip install jep-cli
+```
+
+## Configuration
+
+```bash
+export JEP_API_URL=http://127.0.0.1:8000
+export JEP_API_KEY=
+```
+
+## Create
+
+Judgment:
+
+```bash
+jep create \
+  --verb J \
+  --who did:example:agent-789 \
+  --what '{"claim":"approve","subject":"demo"}'
+```
+
+Delegation:
+
+```bash
+jep create \
+  --verb D \
+  --who did:example:principal \
+  --what '{"delegatee":"did:example:agent","scope":{"actions":["read"]}}'
+```
+
+Termination and Verification require `--ref`. Pass a typed reference as
+JSON when the target is another JEP event.
+
+## Verify
+
+```bash
+jep verify event.json --mode archival
+```
+
+0.7 validation returns `status` plus independent `checks`, not a cumulative
+Validation Level.
+
+## Explicit legacy verification
+
+```bash
+jep verify old-event.json \
+  --legacy \
+  --legacy-format json-sorted-v1
+```
+
+Legacy selection must come from known artifact context. Do not use a failed 0.7
+validation as evidence that an event should be treated as 0.6.
+
+## JEP Core 0.7 model
+
+- Event Identity is `(who,id)`.
+- Event Hash identifies an exact signed artifact.
+- Core does not require a top-level nonce.
+- D requires `delegatee + scope`.
+- T requires target `ref + termination_scope`.
+- V requires target `ref + verification_scope + result`.
+- chain and policy semantics remain outside Core.
+
+## Related repositories
+
+- JEP Core: https://github.com/hjs-spec/jep-core
+- JEP API: https://github.com/hjs-spec/jep-api
+- Python SDK: https://github.com/hjs-spec/sdk-py
+- JavaScript SDK: https://github.com/hjs-spec/sdk-js
+- Go SDK: https://github.com/hjs-spec/sdk-go
+
+## Public draft
+
+- https://datatracker.ietf.org/doc/draft-wang-jep-judgment-event-protocol/
+
+## License
+
+MIT

jep_cli-0.7.2/README.md

@@ -0,0 +1,102 @@
+# JEP CLI — JEP Core 0.7
+
+Command-line client for creating and verifying current JEP Core 0.7 events
+through the JEP API.
+
+Default endpoints:
+
+```text
+POST /v0.7/events/create
+POST /v0.7/events/verify
+GET  /health
+```
+
+Historical pre-0.7 handling is explicit through `--legacy`; the CLI never
+retries a failed 0.7 event with a legacy decoder.
+
+## Status
+
+Experimental reference client. It does not define Core semantics or determine
+truth, authorization validity, legal effect, causality, or policy outcome.
+
+## Installation
+
+```bash
+pip install jep-cli
+```
+
+## Configuration
+
+```bash
+export JEP_API_URL=http://127.0.0.1:8000
+export JEP_API_KEY=
+```
+
+## Create
+
+Judgment:
+
+```bash
+jep create \
+  --verb J \
+  --who did:example:agent-789 \
+  --what '{"claim":"approve","subject":"demo"}'
+```
+
+Delegation:
+
+```bash
+jep create \
+  --verb D \
+  --who did:example:principal \
+  --what '{"delegatee":"did:example:agent","scope":{"actions":["read"]}}'
+```
+
+Termination and Verification require `--ref`. Pass a typed reference as
+JSON when the target is another JEP event.
+
+## Verify
+
+```bash
+jep verify event.json --mode archival
+```
+
+0.7 validation returns `status` plus independent `checks`, not a cumulative
+Validation Level.
+
+## Explicit legacy verification
+
+```bash
+jep verify old-event.json \
+  --legacy \
+  --legacy-format json-sorted-v1
+```
+
+Legacy selection must come from known artifact context. Do not use a failed 0.7
+validation as evidence that an event should be treated as 0.6.
+
+## JEP Core 0.7 model
+
+- Event Identity is `(who,id)`.
+- Event Hash identifies an exact signed artifact.
+- Core does not require a top-level nonce.
+- D requires `delegatee + scope`.
+- T requires target `ref + termination_scope`.
+- V requires target `ref + verification_scope + result`.
+- chain and policy semantics remain outside Core.
+
+## Related repositories
+
+- JEP Core: https://github.com/hjs-spec/jep-core
+- JEP API: https://github.com/hjs-spec/jep-api
+- Python SDK: https://github.com/hjs-spec/sdk-py
+- JavaScript SDK: https://github.com/hjs-spec/sdk-js
+- Go SDK: https://github.com/hjs-spec/sdk-go
+
+## Public draft
+
+- https://datatracker.ietf.org/doc/draft-wang-jep-judgment-event-protocol/
+
+## License
+
+MIT

jep_cli-0.7.2/jep_cli/__init__.py

@@ -0,0 +1,3 @@
+"""JEP Core 0.7 CLI."""
+
+__version__ = "0.7.2"

{jep_cli-0.6.1 → jep_cli-0.7.2}/jep_cli/client.py

@@ -1,4 +1,4 @@
-"""Small HTTP client for JEP CLI v0.6."""
+"""Small HTTP client for the JEP Core 0.7 CLI."""
 
 from __future__ import annotations
 
@@ -6,6 +6,8 @@ import json
 from typing import Any, Dict, Optional
 from urllib import request, error
 
+from . import strict_json
+
 
 class JEPCLIError(Exception):
     pass
@@ -26,10 +28,16 @@ class JEPClient:
         self.timeout = timeout
 
     def create_event(self, payload: Dict[str, Any]) -> Dict[str, Any]:
-        return self._json("POST", "/events/create", payload)
+        return self._json("POST", "/v0.7/events/create", payload)
 
     def verify_event(self, payload: Dict[str, Any]) -> Dict[str, Any]:
-        return self._json("POST", "/events/verify", payload)
+        return self._json("POST", "/v0.7/events/verify", payload)
+
+    def create_event_legacy(self, payload: Dict[str, Any]) -> Dict[str, Any]:
+        return self._json("POST", "/events/create", payload)
+
+    def verify_event_legacy(self, payload: Dict[str, Any]) -> Dict[str, Any]:
+        return self._json("POST", "/events/verify-legacy", payload)
 
     def health(self) -> Dict[str, Any]:
         return self._json("GET", "/health", None)
@@ -38,24 +46,24 @@ class JEPClient:
         data = None
         headers = {
             "content-type": "application/json",
-            "user-agent": "JEP-CLI/0.6.0",
+            "user-agent": "JEP-CLI/0.7.2",
         }
         if self.api_key:
             headers["authorization"] = f"Bearer {self.api_key}"
             headers["x-api-key"] = self.api_key
         if payload is not None:
-            data = json.dumps(payload).encode("utf-8")
+            data = strict_json.dumps(payload).encode("utf-8")
 
         req = request.Request(self.base_url + path, data=data, headers=headers, method=method)
         try:
             with request.urlopen(req, timeout=self.timeout) as resp:
                 body = resp.read().decode("utf-8")
-                return json.loads(body) if body else {}
+                return strict_json.loads(body) if body else {}
         except error.HTTPError as exc:
             body = exc.read().decode("utf-8")
             try:
                 parsed = json.loads(body)
             except Exception:
                 parsed = {"message": body}
-            msg = parsed.get("message") or parsed.get("error") or body
+            msg = parsed.get("message") or parsed.get("detail") or parsed.get("error") or body
             raise JEPAPIError(exc.code, msg, parsed) from exc

{jep_cli-0.6.1 → jep_cli-0.7.2}/jep_cli/main.py

@@ -1,4 +1,4 @@
-"""JEP CLI v0.6 command line interface."""
+"""JEP Core 0.7 command line interface with explicit legacy compatibility."""
 
 from __future__ import annotations
 
@@ -10,6 +10,7 @@ from pathlib import Path
 from typing import Any, Dict
 
 from .client import JEPClient, JEPCLIError
+from . import strict_json
 
 
 VALID_VERBS = {"J", "D", "T", "V"}
@@ -17,16 +18,26 @@ VALID_VERBS = {"J", "D", "T", "V"}
 
 def parse_json_value(value: str) -> Any:
     if value == "-":
-        return json.load(sys.stdin)
-
-    path = Path(value)
-    if path.exists() and path.is_file():
-        return json.loads(path.read_text(encoding="utf-8"))
+        # Read bytes when available: a text stream may replace malformed UTF-8.
+        stream = getattr(sys.stdin, "buffer", sys.stdin)
+        return strict_json.loads(stream.read())
 
     try:
-        return json.loads(value)
+        return strict_json.loads(value)
     except json.JSONDecodeError:
-        return value
+        # JSON-looking input must not become a plain string after a parse error.
+        if value.lstrip().startswith(("{", "[", '"')):
+            raise
+    # Inline event JSON may be longer than the filesystem filename limit.
+    path = Path(value)
+    try:
+        is_file = path.is_file()
+    except OSError:
+        is_file = False
+    if is_file:
+        return strict_json.loads(path.read_bytes())
+    strict_json.validate(value)
+    return value
 
 
 def parse_ext_items(items: list[str]) -> Dict[str, Any]:
@@ -35,12 +46,15 @@ def parse_ext_items(items: list[str]) -> Dict[str, Any]:
         if "=" not in item:
             raise ValueError(f"extension must be key=json_or_string, got: {item}")
         key, raw = item.split("=", 1)
+        if key in ext:
+            raise ValueError(f"duplicate extension: {key!r}")
+        strict_json.validate(key)
         ext[key] = parse_json_value(raw)
     return ext
 
 
 def print_json(data: Any) -> None:
-    print(json.dumps(data, indent=2, ensure_ascii=False))
+    print(strict_json.dumps(data))
 
 
 def build_client(args: argparse.Namespace) -> JEPClient:
@@ -72,7 +86,8 @@ def cmd_create(args: argparse.Namespace) -> int:
     if args.ext_crit:
         payload["ext_crit"] = args.ext_crit
 
-    result = build_client(args).create_event(payload)
+    client = build_client(args)
+    result = client.create_event_legacy(payload) if args.legacy else client.create_event(payload)
     print_json(result)
     return 0
 
@@ -81,18 +96,21 @@ def cmd_verify(args: argparse.Namespace) -> int:
     event = parse_json_value(args.event)
     if not isinstance(event, dict):
         raise ValueError("event must be JSON object or path to JSON event file")
-    payload = {
-        "event": event,
-        "mode": args.mode,
-        "consume_nonce": args.consume_nonce,
-    }
+    client = build_client(args)
+    if args.legacy:
+        payload = {"event": event, "format": args.legacy_format}
+        result = client.verify_event_legacy(payload)
+        print_json(result)
+        return 0 if result.get("valid") is True else 2
+
+    payload = {"event": event, "mode": args.mode}
     if args.expected_audience:
         payload["expected_audience"] = args.expected_audience
-    if args.mode == "acceptance" and not args.expected_audience:
-        raise ValueError("acceptance mode requires --expected-audience")
-    result = build_client(args).verify_event(payload)
+    if args.max_age_seconds is not None:
+        payload["max_age_seconds"] = args.max_age_seconds
+    result = client.verify_event(payload)
     print_json(result)
-    return 0 if result.get("valid") is True else 2
+    return 0 if result.get("status") == "valid" else 2
 
 
 def cmd_health(args: argparse.Namespace) -> int:
@@ -112,7 +130,7 @@ def cmd_extract_event(args: argparse.Namespace) -> int:
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         prog="jep",
-        description="JEP CLI v0.6 for creating and verifying JEP-Core events through the JEP API.",
+        description="JEP CLI for JEP Core 0.7. Legacy pre-0.7 paths require explicit flags.",
     )
     parser.add_argument("--base-url", default="", help="JEP API base URL. Default: JEP_API_URL or http://127.0.0.1:8000")
     parser.add_argument("--api-key", default="", help="API key. Default: JEP_API_KEY")
@@ -125,18 +143,21 @@ def build_parser() -> argparse.ArgumentParser:
     create.add_argument("--who", default="", help="Actor identifier")
     create.add_argument("--what", required=True, help="JSON value, string, file path, or '-' for stdin")
     create.add_argument("--aud", default="", help="Audience / validation context")
-    create.add_argument("--ref", default="", help="Reference event hash")
+    create.add_argument("--ref", default="", help="Reference JSON, string, or file path")
     create.add_argument("--ttl-minutes", type=int, default=None, help="Optional TTL extension in minutes")
     create.add_argument("--digest-only-who", action="store_true", help="Request digest-only privacy extension")
     create.add_argument("--ext", action="append", default=[], help="Extension key=json_or_string. May be repeated")
     create.add_argument("--ext-crit", action="append", default=[], help="Critical extension URI. May be repeated")
+    create.add_argument("--legacy", action="store_true", help="Use explicit pre-0.7 create endpoint")
     create.set_defaults(func=cmd_create)
 
     verify = sub.add_parser("verify", help="Verify a JEP event")
     verify.add_argument("event", help="Event JSON object, event JSON file path, or '-' for stdin")
     verify.add_argument("--mode", default="archival", choices=["archival", "acceptance"], help="Validation mode")
-    verify.add_argument("--expected-audience", default="", help="Required receiving audience for acceptance")
-    verify.add_argument("--consume-nonce", action="store_true", help="Ask verifier to consume nonce")
+    verify.add_argument("--expected-audience", default="", help="Optional audience required by the selected acceptance profile")
+    verify.add_argument("--max-age-seconds", type=int, default=None, help="Optional profile freshness window")
+    verify.add_argument("--legacy", action="store_true", help="Use explicit pre-0.7 legacy verifier")
+    verify.add_argument("--legacy-format", default="json-sorted-v1", choices=["json-sorted-v1", "hf-space-v06"], help="Historical decoder format; used only with --legacy")
     verify.set_defaults(func=cmd_verify)
 
     health = sub.add_parser("health", help="Check JEP API health")

jep_cli-0.7.2/jep_cli/strict_json.py

@@ -0,0 +1,78 @@
+"""Strict JSON input boundary; signature/profile validation stays with the API."""
+from __future__ import annotations
+
+import json
+import math
+from typing import Any
+
+import rfc8785
+
+
+def _pairs(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError(f"duplicate JSON member: {key!r}")
+        result[key] = value
+    return result
+
+
+def _constant(token):
+    raise ValueError(f"non-JSON numeric constant: {token}")
+
+
+def validate(value: Any) -> None:
+    """Reject lossy/invalid input without rewriting values or signed members.
+
+    Large integer policy matches Core 0.7.4: exact binary64 integers and their
+    JCS shortest-decimal spellings are supported. This is not signature checking.
+    """
+    if value is None or isinstance(value, bool):
+        return
+    if isinstance(value, str):
+        value.encode("utf-8", errors="strict")
+    elif isinstance(value, int):
+        if abs(value) > 2**53 - 1:
+            try:
+                number = float(value)
+                if not math.isfinite(number):
+                    raise ValueError("integer exceeds binary64 range")
+                if int(number) != value and rfc8785.dumps(number) != str(value).encode("ascii"):
+                    raise ValueError("integer is neither exact binary64 nor its JCS spelling")
+            except OverflowError as exc:
+                raise ValueError("integer exceeds binary64 range") from exc
+    elif isinstance(value, float):
+        if not math.isfinite(value):
+            raise ValueError("non-finite number")
+    elif isinstance(value, list):
+        for item in value:
+            validate(item)
+    elif isinstance(value, dict):
+        for key, item in value.items():
+            if not isinstance(key, str):
+                raise ValueError("JSON member names must be strings")
+            validate(key)
+            validate(item)
+    else:
+        raise ValueError("unsupported JSON value")
+
+
+def loads(text: str | bytes) -> Any:
+    if isinstance(text, bytes):
+        text = text.decode("utf-8", errors="strict")
+    # Reject raw surrogate code points even before JSON parsing.
+    text.encode("utf-8", errors="strict")
+    try:
+        value = json.loads(text, object_pairs_hook=_pairs, parse_constant=_constant)
+        validate(value)
+        return value
+    except RecursionError as exc:
+        raise ValueError("JSON nesting exceeds parser capacity") from exc
+
+
+def dumps(value: Any) -> str:
+    try:
+        validate(value)
+        return json.dumps(value, ensure_ascii=False, allow_nan=False)
+    except RecursionError as exc:
+        raise ValueError("JSON nesting exceeds parser capacity") from exc

jep_cli-0.7.2/jep_cli.egg-info/PKG-INFO

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: jep-cli
+Version: 0.7.2
+Summary: Command-line client for JEP Core 0.7 with explicit legacy compatibility
+Author-email: HJS Spec <signal@humanjudgment.org>
+License: MIT
+Project-URL: Homepage, https://github.com/hjs-spec/cli
+Project-URL: Repository, https://github.com/hjs-spec/cli
+Project-URL: Issues, https://github.com/hjs-spec/cli/issues
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE.md
+Requires-Dist: rfc8785==0.1.4
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Dynamic: license-file
+
+# JEP CLI — JEP Core 0.7
+
+Command-line client for creating and verifying current JEP Core 0.7 events
+through the JEP API.
+
+Default endpoints:
+
+```text
+POST /v0.7/events/create
+POST /v0.7/events/verify
+GET  /health
+```
+
+Historical pre-0.7 handling is explicit through `--legacy`; the CLI never
+retries a failed 0.7 event with a legacy decoder.
+
+## Status
+
+Experimental reference client. It does not define Core semantics or determine
+truth, authorization validity, legal effect, causality, or policy outcome.
+
+## Installation
+
+```bash
+pip install jep-cli
+```
+
+## Configuration
+
+```bash
+export JEP_API_URL=http://127.0.0.1:8000
+export JEP_API_KEY=
+```
+
+## Create
+
+Judgment:
+
+```bash
+jep create \
+  --verb J \
+  --who did:example:agent-789 \
+  --what '{"claim":"approve","subject":"demo"}'
+```
+
+Delegation:
+
+```bash
+jep create \
+  --verb D \
+  --who did:example:principal \
+  --what '{"delegatee":"did:example:agent","scope":{"actions":["read"]}}'
+```
+
+Termination and Verification require `--ref`. Pass a typed reference as
+JSON when the target is another JEP event.
+
+## Verify
+
+```bash
+jep verify event.json --mode archival
+```
+
+0.7 validation returns `status` plus independent `checks`, not a cumulative
+Validation Level.
+
+## Explicit legacy verification
+
+```bash
+jep verify old-event.json \
+  --legacy \
+  --legacy-format json-sorted-v1
+```
+
+Legacy selection must come from known artifact context. Do not use a failed 0.7
+validation as evidence that an event should be treated as 0.6.
+
+## JEP Core 0.7 model
+
+- Event Identity is `(who,id)`.
+- Event Hash identifies an exact signed artifact.
+- Core does not require a top-level nonce.
+- D requires `delegatee + scope`.
+- T requires target `ref + termination_scope`.
+- V requires target `ref + verification_scope + result`.
+- chain and policy semantics remain outside Core.
+
+## Related repositories
+
+- JEP Core: https://github.com/hjs-spec/jep-core
+- JEP API: https://github.com/hjs-spec/jep-api
+- Python SDK: https://github.com/hjs-spec/sdk-py
+- JavaScript SDK: https://github.com/hjs-spec/sdk-js
+- Go SDK: https://github.com/hjs-spec/sdk-go
+
+## Public draft
+
+- https://datatracker.ietf.org/doc/draft-wang-jep-judgment-event-protocol/
+
+## License
+
+MIT

{jep_cli-0.6.1 → jep_cli-0.7.2}/jep_cli.egg-info/SOURCES.txt

@@ -5,6 +5,7 @@ pyproject.toml
 jep_cli/__init__.py
 jep_cli/client.py
 jep_cli/main.py
+jep_cli/strict_json.py
 jep_cli.egg-info/PKG-INFO
 jep_cli.egg-info/SOURCES.txt
 jep_cli.egg-info/dependency_links.txt
@@ -12,4 +13,5 @@ jep_cli.egg-info/entry_points.txt
 jep_cli.egg-info/requires.txt
 jep_cli.egg-info/top_level.txt
 tests/test_acceptance.py
-tests/test_cli.py
+tests/test_cli.py
+tests/test_strict_json.py

{jep_cli-0.6.1 → jep_cli-0.7.2}/jep_cli.egg-info/requires.txt

@@ -1,3 +1,4 @@
+rfc8785==0.1.4
 
 [dev]
 pytest>=7.0.0

{jep_cli-0.6.1 → jep_cli-0.7.2}/pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "jep-cli"
-version = "0.6.1"
-description = "Command-line tool for creating and verifying JEP v0.6 events through the JEP API"
+version = "0.7.2"
+description = "Command-line client for JEP Core 0.7 with explicit legacy compatibility"
 readme = "README.md"
 license = { text = "MIT" }
 authors = [
     { name = "HJS Spec", email = "signal@humanjudgment.org" }
 ]
 requires-python = ">=3.9"
-dependencies = []
+dependencies = ["rfc8785==0.1.4"]
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",