kdpika-licensing 1.1.5__tar.gz

kdpika_licensing-1.1.5/.gitattributes

@@ -0,0 +1,2 @@
+# Keep approved text bytes identical across Windows, macOS and Linux checkouts.
+* text=auto eol=lf

kdpika_licensing-1.1.5/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,13 @@
+---
+name: SDK bug report
+about: Reproduce a Python SDK problem without sensitive data
+---
+## Runtime and SDK version
+Python / OS / SDK version:
+
+## Synthetic reproduction
+Expected vs actual behavior; include safe error code/request_id only.
+
+## Checklist
+- [ ] No license keys, tokens, customer payloads or private files attached.
+- [ ] Security vulnerabilities reported privately to hi@kdpika.com instead.

kdpika_licensing-1.1.5/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,9 @@
+---
+name: Feature request
+about: Describe a concrete SDK integration need
+---
+## Use case
+What software/workflow needs this?
+
+## Proposed behavior and security/compatibility impact
+Do not post credentials or customer data.

kdpika_licensing-1.1.5/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,7 @@
+## Change and reason
+## Tests actually run (OS/Python/results)
+## Compatibility and security
+- [ ] API-v1 signing/state semantics preserved or migration documented.
+- [ ] Regression/example tests added where appropriate.
+- [ ] No secrets/customer data.
+- [ ] No unapproved publishing/tag/push or hosted download changes.

kdpika_licensing-1.1.5/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

kdpika_licensing-1.1.5/.github/workflows/ci.yml

@@ -0,0 +1,76 @@
+name: Python SDK checks
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+  workflow_call:
+permissions:
+  contents: read
+jobs:
+  tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        # Use the independent Intel pool after repeated arm64 acquisition failures.
+        os: [ubuntu-latest, macos-15-intel, windows-latest]
+        python: ["3.11", "3.12", "3.13", "3.14"]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Prepare native macOS cryptography build
+        if: runner.os == 'macOS'
+        env:
+          HOMEBREW_NO_AUTO_UPDATE: "1"
+        run: |
+          brew install openssl@3
+          rustc --version
+          echo "OPENSSL_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
+      - run: python -m pip install --upgrade "pip>=26.2.1,<27"
+      - run: python -m pip install ".[test]"
+      - run: python -m pytest --cov --cov-report=xml --cov-report=term-missing
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: coverage-${{ matrix.os }}-${{ matrix.python }}
+          path: coverage.xml
+          if-no-files-found: error
+  quality:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+      - run: python -m pip install --upgrade "pip>=26.2.1,<27"
+      - run: python -m pip install ".[dev,docs,test]"
+      - run: ruff check src tests tools examples
+      - run: ruff format --check src tests tools examples
+      - run: mypy --strict src
+      - run: mkdocs build --strict
+      - run: python -m build
+      - run: python -m twine check dist/*
+      - run: python tools/verify_artifacts.py
+      - run: python tools/audit_dependencies.py
+      - run: python tools/audit_dependencies.py --tooling
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: python-distributions
+          path: dist/*
+          if-no-files-found: error
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: candidate-docs-and-evidence
+          path: |
+            site/
+            docs/internal/artifact-verification-release.json
+            docs/internal/dependency-audit-release.json
+            docs/internal/dependency-audit-tooling-release.json
+          if-no-files-found: error

kdpika_licensing-1.1.5/.github/workflows/release.yml

@@ -0,0 +1,65 @@
+name: Publish owner-approved SDK
+on:
+  push:
+    tags: ["v*"]
+permissions:
+  contents: read
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      prerelease: ${{ steps.version.outputs.prerelease }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+      - run: python -m pip install "packaging>=25,<27"
+      - name: Validate owner decisions and exact tag
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+          RELEASE_REPOSITORY: ${{ github.repository }}
+        run: python tools/release_gate.py --tag "$RELEASE_TAG" --repository "$RELEASE_REPOSITORY"
+      - id: version
+        run: |
+          python -c "from tools.release_gate import version; print('prerelease=' + str(version().is_prerelease).lower())" >> "$GITHUB_OUTPUT"
+  verify:
+    needs: prepare
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+  testpypi:
+    needs: [prepare, verify]
+    if: needs.prepare.outputs.prerelease == 'true'
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: python-distributions
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: dist/
+  pypi:
+    needs: [prepare, verify]
+    if: needs.prepare.outputs.prerelease == 'false'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: python-distributions
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          packages-dir: dist/

kdpika_licensing-1.1.5/.pre-commit-config.yaml

@@ -0,0 +1,13 @@
+repos:
+  - repo: local
+    hooks:
+      - id: ruff
+        name: ruff
+        entry: ruff check
+        language: system
+        types: [python]
+      - id: ruff-format
+        name: ruff-format
+        entry: ruff format --check
+        language: system
+        types: [python]

kdpika_licensing-1.1.5/CHANGELOG.md

@@ -0,0 +1,108 @@
+# Changelog
+
+Notable changes follow Keep a Changelog categories. API v1 and SDK package
+versions are independent. Registry availability is recorded on PyPI; a source
+changelog entry is not proof of publication.
+
+## [1.1.5] — 2026-10-20
+
+### Changed
+
+- Use GitHub's supported Intel macOS runner pool after arm64 jobs repeatedly
+  failed to acquire runners. Build the same cryptography dependency with Rust
+  and OpenSSL 3; retain all Python 3.11–3.14 tests, audits and publication gates.
+  No SDK runtime logic or dependency-version changes.
+
+## [1.1.4] — unpublished release preparation, 2026-10-20
+
+### Fixed
+
+- Audit exact installed third-party distributions (including transitive dependencies)
+  without looking up the unpublished SDK candidate on PyPI. Record that scope in
+  audit evidence; vulnerabilities, collection failures and service errors still block
+  publication. SDK runtime and all protected publication gates are unchanged.
+
+## [1.1.3] — unpublished release preparation, 2026-10-20
+
+### Changed
+
+- Pin native macOS CI to the supported `macos-15` arm64 image after repeated
+  `macos-latest` runner-acquisition failures. All Python 3.11–3.14 checks and
+  protected OIDC publication gates remain required; SDK runtime is unchanged.
+- Preserve previous unpublished tags instead of rewriting release history.
+
+## [1.1.1] — unpublished release preparation, 2026-10-20
+
+### Fixed
+
+- Pin Git text checkouts to LF so the approved MIT license retains the same
+  SHA-256 on Windows, macOS and Linux. No license bytes or SDK logic changed.
+- Supersedes the blocked, unpublished `v1.1.0` release attempt; that tag is
+  preserved rather than rewritten. This source entry is not upload evidence.
+
+## [1.1.0] — unpublished release preparation, 2026-10-20
+
+### Fixed
+
+- Make the test harness portable to Windows: bounded parametrized case names,
+  POSIX-only permission assertions and asyncio's private socketpair wake-up path.
+  Ordinary test network connections remain blocked. SDK runtime is unchanged.
+- Preserve signed JSON wire number tokens through HTTP/cache round trips and
+  escape U+2028/U+2029; strict duplicate/UTF-8/base64url/depth/size checks.
+- Gate feature helpers on a verified valid current result, including expiry,
+  signed grace, binding and clock failures; no enabling failure defaults.
+- Bound HTTPS requests and public-key GET retries; refuse redirects and
+  never retry uncertain activation/deactivation POSTs.
+- Validate signed timestamps and key-derived IDs; pinned keys never rotate
+  silently. Safe upstream messages and repr without payload/credential values.
+- Atomic private version-1 storage, bounded process/thread locks, no new identity
+  after corruption, and explicit keyring failure/fallback behavior.
+
+### Added
+
+- `kdpika_licensing` public package and an async adapter using the same core.
+- Strict typing, py.typed, shared PHP-signed fixtures, regression/property tests,
+  ruff/mypy/pytest/tox tooling and a Phase 1 migration/security audit.
+- Complete candidate README with 35 FAQ entries, source-generated API reference,
+  strict-build MkDocs guides, safe runnable Sandbox examples and example/doctest checks.
+- Project security/contribution/conduct policies and version-derived artifact checks.
+- SHA-pinned dedicated-repository CI templates (12 OS/Python combinations) and
+  OIDC TestPyPI/PyPI release routing; owner/repository/tag/license gates stay closed.
+- Separate installed-base and dedicated-tooling advisory audits; require pytest
+  9.0.3+ after the initial tooling audit found the old temporary-directory advisory.
+
+### Changed
+
+- Owner-selected MIT License for this Python SDK and its documentation; no
+  grant to the separately hosted platform/backend or service access.
+
+- Candidate distribution `kdpika-licensing`; `license_sdk` remains a deprecated
+  compatibility shim. Storage namespace, filenames and keyring service unchanged.
+- Candidate Python support 3.11–3.14; local loopback HTTP needs explicit opt-in.
+- Inconsistent pinned IDs are now configuration errors before any HTTP call.
+- Require cryptography 50.0.2+ (below 51) after dependency auditing; upstream
+  no longer supplies Intel macOS or 32-bit Windows wheels. Native compatibility
+  beyond the executed arm64 macOS matrix remains unverified.
+
+### Release verification
+
+The owner approved publication and configured PyPI Trusted Publishing for
+`kdpika/kdpika-licensing`, `release.yml`, environment `pypi`. Uploads remain
+conditional on successful release checks and the protected environment review.
+Native Qt, OS keyring and packaged-app acceptance are separate from core CI.
+
+## 1.0.0 — observed current source, 2026-10-17
+
+This is the version recorded in current package/project metadata (PHP uses the
+existing versioned download label). It is not a reconstructed original release
+date, a published registry release or an invented earlier-version history.
+
+- Added complete source-install, lifecycle, storage/offline and known-limit
+  documentation, license-information notice and runnable example links.
+- Preserved runtime implementation, public APIs, response handling and package
+  identity. Documentation changes do not silently fix known signing/cache gaps.
+- PHP includes a new package-local standalone test entry; its legacy repository
+  test remains unchanged and still assumes the repository-root autoload layout.
+
+Future entries must identify the exact version, verified changes, compatibility
+impact and tests. API v1 and SDK package versions are independent.

kdpika_licensing-1.1.5/CODE_OF_CONDUCT.md

@@ -0,0 +1,10 @@
+# Community conduct
+
+Treat contributors and users respectfully. No harassment, discriminatory abuse,
+threats, doxxing or publication of private customer/credential information.
+Discuss code and evidence constructively; respect different experience levels.
+
+Report conduct concerns privately to hi@kdpika.com. Maintainers may remove
+harmful content or restrict participation proportionately and review context.
+This project does not claim adoption of an external trademarked policy or a
+response-time guarantee. Security vulnerabilities follow SECURITY.md instead.

kdpika_licensing-1.1.5/CONTRIBUTING.md

@@ -0,0 +1,31 @@
+# Contributing
+
+The public SDK repository is https://github.com/kdpika/kdpika-licensing.
+It does not contain the separately hosted platform/backend. Contact
+hi@kdpika.com if needed; report security issues privately using SECURITY.md.
+
+From the SDK root in a private active virtualenv:
+~~~bash
+python -m pip install -e '.[dev,docs,test]'
+ruff check src tests tools examples
+ruff format --check src tests tools examples
+mypy --strict src
+python -m pytest --cov
+tox -e py311,py312,py313,py314
+mkdocs build --strict
+python -m build
+python -m twine check dist/*
+python tools/verify_artifacts.py
+python tools/audit_dependencies.py
+python tools/audit_dependencies.py --tooling
+~~~
+
+Use synthetic fixtures and ephemeral test keys only. Default tests cannot open
+sockets; optional live Sandbox tests need explicit opt-in. Preserve API-v1
+shapes/signing/state semantics, add regressions and document compatibility
+changes. Do not update hosted downloads or publish/tag/push without owner approval.
+
+Local pre-commit hooks require Ruff on PATH; running pre-commit install is an
+optional developer action, not performed automatically. Follow CODE_OF_CONDUCT.md.
+Contributions must be compatible with the project's MIT License. Only submit
+code and documentation you have permission to share; no separate CLA is imposed.

kdpika_licensing-1.1.5/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 KHALED AL HARAZI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

kdpika_licensing-1.1.5/MANIFEST.in

@@ -0,0 +1,12 @@
+include LICENSE README.md CHANGELOG.md pyproject.toml setup.py tox.ini .pre-commit-config.yaml
+include SECURITY.md CONTRIBUTING.md CODE_OF_CONDUCT.md mkdocs.yml release-config.json
+include .gitattributes
+recursive-include docs *.md
+prune docs/internal
+recursive-include examples *.py *.md
+recursive-include tools *.py
+recursive-include .github *.yml *.md
+recursive-include src *.py py.typed
+recursive-include tests *.py *.json
+global-exclude .DS_Store *.pyc
+prune tests/__pycache__