lighthouse-cli 0.16.0__py3-none-any.whl

lighthouse/out.py

@@ -0,0 +1,169 @@
+# Copyright 2026 Atlantic Agentic Labs. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+"""What the command line prints, and where.
+
+Three rules, each of them something a pipeline depends on:
+
+- **`--json` is the whole of standard output.** One JSON document, nothing
+  else: no progress line, no spinner, no "signing you in…". Anything a person
+  would want to read goes to standard error instead, so `lighthouse spend
+  --json | jq` works even while the command is talking to the person running
+  it.
+- **No colour and no cursor control unless standard output is a terminal.**
+  Also honoured: `NO_COLOR` (any value), `TERM=dumb`, and `CI`. A log file
+  full of escape sequences is a log file nobody greps.
+- **Nothing secret is ever printed.** `redact()` is applied to every value on
+  its way out, and `tests/test_out.py` holds it to that.
+
+Tables are plain: two spaces between columns, no box drawing, so a column can
+be cut with `cut -f` after `tr -s ' ' '\\t'` and the output reads the same in a
+terminal, a pipe and a GitLab job log.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+import unicodedata
+from typing import Any, TextIO
+
+from lighthouse.i18n import label, t
+
+# A credential's shape, wherever it appears. The CLI holds tokens in the
+# keychain and never needs to print one, so anything matching here is a bug
+# caught before it reaches a terminal, a log or a bug report.
+_SECRET = re.compile(
+    r"\b(lhat|lhrt|lhdc|lhac|aalcp)-[A-Za-z0-9_-]{4,}"           # LightHouse credentials
+    r"|\bgh[pousr]_[A-Za-z0-9]{16,}"                              # GitHub tokens
+    r"|\bglpat-[A-Za-z0-9_-]{16,}"                                # GitLab tokens
+    r"|\bAKIA[0-9A-Z]{16}\b"                                      # AWS access key ids
+    r"|\bsk-[A-Za-z0-9]{20,}")                                    # model provider keys
+REDACTED = "[redacted]"
+
+_COLOURS = {"reset": "\x1b[0m", "bold": "\x1b[1m", "dim": "\x1b[2m",
+            "red": "\x1b[31m", "green": "\x1b[32m", "yellow": "\x1b[33m"}
+
+
+def width(text: str) -> int:
+    """Terminal columns `text` takes: two for each East Asian wide or fullwidth
+    character, none for a combining mark or a format character (Arabic
+    diacritics, bidi marks), one for the rest. Arabic is left as the service
+    sent it, in logical order: a terminal's own shaping shows it, and
+    reversing it here would break it."""
+    cols = 0
+    for ch in text:
+        if unicodedata.combining(ch) or unicodedata.category(ch) in ("Mn", "Me", "Cf"):
+            continue
+        cols += 2 if unicodedata.east_asian_width(ch) in ("W", "F") else 1
+    return cols
+
+
+def pad(text: str, cols: int) -> str:
+    """`text` left-aligned in `cols` terminal columns (`str.ljust` by width)."""
+    return text + " " * max(0, cols - width(text))
+
+
+def redact(value: Any) -> Any:
+    """`value` with anything shaped like a credential replaced."""
+    if isinstance(value, str):
+        return _SECRET.sub(REDACTED, value)
+    if isinstance(value, dict):
+        return {k: redact(v) for k, v in value.items()}
+    if isinstance(value, (list, tuple)):
+        return [redact(v) for v in value]
+    return value
+
+
+class Out:
+    """Where a command writes. One instance per run, on the parsed options."""
+
+    def __init__(self, *, as_json: bool = False, quiet: bool = False,
+                 stdout: TextIO | None = None, stderr: TextIO | None = None,
+                 env: dict[str, str] | None = None, isatty: bool | None = None) -> None:
+        self.as_json = as_json
+        self.quiet = quiet
+        self.stdout = stdout if stdout is not None else sys.stdout
+        self.stderr = stderr if stderr is not None else sys.stderr
+        self.env = env if env is not None else dict(os.environ)
+        if isatty is None:
+            isatty = bool(getattr(self.stdout, "isatty", lambda: False)())
+        # Set by a command that writes JSON Lines itself (`runs tail`), so
+        # `main` does not then print a closing document after it and leave
+        # standard output a mixture of the two.
+        self.streamed = False
+        self.colour = bool(isatty) and not self.as_json and not (
+            self.env.get("NO_COLOR") is not None
+            or self.env.get("TERM") == "dumb"
+            or self.env.get("CI"))
+
+    # -- the machine's channel ---------------------------------------------------
+
+    def json(self, body: Any) -> None:
+        """The one document `--json` prints. Sorted keys, so a golden test and
+        a `diff` both mean something."""
+        print(json.dumps(redact(body), indent=2, sort_keys=True, default=str),
+              file=self.stdout)
+
+    def json_line(self, body: Any) -> None:
+        """One JSON document on its own line, for a command that streams
+        (`runs tail`). Marks the stream, so no closing document follows."""
+        self.streamed = True
+        print(json.dumps(redact(body), sort_keys=True, default=str), file=self.stdout)
+
+    # -- the person's channel ----------------------------------------------------
+
+    def paint(self, text: str, colour: str) -> str:
+        if not self.colour or colour not in _COLOURS:
+            return text
+        return f"{_COLOURS[colour]}{text}{_COLOURS['reset']}"
+
+    def say(self, text: str = "") -> None:
+        """A line for the person. Standard output in human mode, standard error
+        under `--json`, so it never lands in the document."""
+        if self.quiet:
+            return
+        print(redact(text), file=self.stderr if self.as_json else self.stdout)
+
+    def note(self, text: str) -> None:
+        """Always to standard error: progress, prompts and advice, in both modes."""
+        if not self.quiet:
+            print(self.paint(redact(text), "dim"), file=self.stderr)
+
+    def warn(self, text: str) -> None:
+        print(self.paint(f"{t('out.warning')}: {redact(text)}", "yellow"), file=self.stderr)
+
+    def fail(self, text: str, *, hint: str | None = None) -> None:
+        print(self.paint(f"{t('out.error')}: {redact(text)}", "red"), file=self.stderr)
+        if hint:
+            print(self.paint(f"  {redact(hint)}", "dim"), file=self.stderr)
+
+    def done(self, text: str) -> None:
+        self.say(self.paint(text, "green"))
+
+    # -- tables --------------------------------------------------------------------
+
+    def table(self, headers: list[str], rows: list[list[Any]]) -> None:
+        """Columns padded to the widest cell, two spaces between. No borders:
+        nothing to strip before the output is useful to another program."""
+        if self.quiet:
+            return
+        headers = [label(h) for h in headers]
+        body = [[("" if c is None else str(redact(c))) for c in row] for row in rows]
+        if not body:
+            self.say(t("out.nothing"))
+            return
+        widths = [max(width(h), *(width(r[i]) for r in body)) for i, h in enumerate(headers)]
+        self.say("  ".join(self.paint(pad(h, widths[i]), "bold")
+                           for i, h in enumerate(headers)).rstrip())
+        for row in body:
+            self.say("  ".join(pad(cell, widths[i]) for i, cell in enumerate(row)).rstrip())
+
+    def pairs(self, items: list[tuple[str, Any]]) -> None:
+        if self.quiet or not items:
+            return
+        items = [(label(k), v) for k, v in items]
+        cols = max(width(k) for k, _ in items)
+        for key, value in items:
+            shown = "—" if value is None or value == "" else str(redact(value))
+            self.say(f"{self.paint(pad(key, cols), 'bold')}  {shown}")

lighthouse/sealing.py

@@ -0,0 +1,448 @@
+# Copyright 2026 Atlantic Agentic Labs. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+"""Sealing a credential on this machine to the client's own deployment
+(contract 1.18).
+
+`lighthouse connect <id> --credential-stdin` seals the token here, to the
+X25519 key the deployment advertised, so the control plane relays a blob it
+cannot open and the token never leaves this machine in the clear. The
+primitive is RFC 9180 HPKE, base mode (DHKEM(X25519, HKDF-SHA256),
+HKDF-SHA256, AES-256-GCM, empty AAD), from `cryptography`'s own `hpke.Suite`,
+with the `info` the engine binds:
+
+    aal-sealed/1\\n<tenant>/<deployment>\\n<connector>\\n<connection id>
+
+and the wire form `hpke1.<kid>.<base64url of enc || ciphertext>`.
+
+**Pinning.** The advertisement is signed with the deployment's own Ed25519
+key. Given that key as the client's own infrastructure printed it
+(`--deployment-key`, or `LIGHTHOUSE_DEPLOYMENT_KEY`), the CLI checks the
+signature against it and nothing else, so a sealing key substituted on the
+way (by anyone, AAL's control plane included) is caught before anything is
+sealed. Without a pin it checks against the keys the control plane says the
+deployment registered, which is the same trust as the Connect page's.
+
+The mapping from what is pasted to the fields the engine stores, the
+canonical bytes and the keyed fingerprint are the service's
+(`aal_control/sealing.py`) to the byte, and the tests hold both to the same
+vectors (docs/api/sealing-vectors.json).
+"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import re
+import secrets
+from collections.abc import Mapping
+from typing import Any
+
+PROTOCOL = "aal-sealed/1"
+SUITE = "hpke-base-x25519-hkdfsha256-aes256gcm"
+ADVERT_LINE = "aal-sealing-key/1"
+_KID = re.compile(r"^[0-9a-f]{16}$")
+_ARMOUR = re.compile(r"-----BEGIN PUBLIC KEY-----.*?-----END PUBLIC KEY-----", re.S)
+DATADOG_ENGINE_SITES = {"us1": "datadoghq.com", "us3": "us3.datadoghq.com",
+                        "us5": "us5.datadoghq.com", "eu1": "datadoghq.eu",
+                        "ap1": "ap1.datadoghq.com", "us1-fed": "ddog-gov.com"}
+CONNECTORS = ("confluence", "datadog", "gdrive", "github", "gitlab", "gmail", "jira",
+              # Contract 1.26: sealed here, never sent in the clear.
+              "dynamics", "hubspot", "monday", "netsuite", "notion", "oracle-db",
+              "oracle-fusion", "salesforce", "servicenow", "zendesk",
+              # 1.27: finance and aviation, sealed where pasted, read-only.
+              "bank-statements", "binance", "coinbase-prime", "dfns", "fireblocks", "kraken",
+              "kyriba", "quickbooks", "revolut", "stripe", "xero",
+              "amadeus", "cirium", "eccairs", "flightaware", "intelex", "oag", "qpulse",
+              "sabre", "sita-bags", "sita-flights", "xapi",
+              # 1.28: ERP and HR, sealed where pasted, read-only.
+              "sap-s4hana", "sap-successfactors", "workday")
+
+
+class SealingError(ValueError):
+    """A credential that cannot be sealed as given. Names a field, never a value."""
+
+
+def key_id(raw_public: bytes) -> str:
+    return hashlib.sha256(raw_public).hexdigest()[:16]
+
+
+def info_for(deployment: str, connector: str, name: str) -> bytes:
+    return "\n".join((PROTOCOL, deployment, connector, name)).encode("ascii")
+
+
+def advert_payload(deployment: str, kid: str, public_b64: str) -> bytes:
+    return "\n".join((ADVERT_LINE, deployment, kid, public_b64)).encode("ascii")
+
+
+def load_deployment_key(text: str) -> bytes:
+    """The deployment's Ed25519 public key as its infrastructure printed it:
+    the raw 32 bytes in base64, or a PEM `PUBLIC KEY` block."""
+    text = text.strip()
+    if _ARMOUR.search(text):
+        from cryptography.hazmat.primitives import serialization
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+        key = serialization.load_pem_public_key(text.encode("ascii"))
+        if not isinstance(key, Ed25519PublicKey):
+            raise SealingError("the deployment key is an Ed25519 public key")
+        return key.public_bytes(serialization.Encoding.Raw, serialization.PublicFormat.Raw)
+    try:
+        raw = base64.b64decode(text, validate=True)
+    except ValueError:
+        raise SealingError("the deployment key is 32 bytes in base64, or a PEM block") from None
+    if len(raw) != 32:
+        raise SealingError("the deployment key is 32 bytes in base64, or a PEM block")
+    return raw
+
+
+def verify_advert(advert: Any, deployment: str, keys: list[bytes]) -> bool:
+    """Whether the advertisement is the deployment's own: this suite, a
+    32-byte key whose id is `kid`, signed by one of `keys`."""
+    from cryptography.exceptions import InvalidSignature
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+    if not isinstance(advert, dict):
+        return False
+    public, kid, sig = advert.get("public"), advert.get("kid"), advert.get("signature")
+    if not (advert.get("protocol") == PROTOCOL and advert.get("suite") == SUITE
+            and isinstance(public, str) and isinstance(kid, str) and _KID.match(kid)
+            and isinstance(sig, str)):
+        return False
+    try:
+        raw = base64.b64decode(public, validate=True)
+        signature = base64.b64decode(sig, validate=True)
+    except ValueError:
+        return False
+    if len(raw) != 32 or key_id(raw) != kid:
+        return False
+    for k in keys:
+        try:
+            Ed25519PublicKey.from_public_bytes(k).verify(
+                signature, advert_payload(deployment, kid, public))
+            return True
+        except (InvalidSignature, ValueError):
+            continue
+    return False
+
+
+def seal(public_b64: str, plaintext: bytes, *, deployment: str, connector: str,
+         name: str) -> str:
+    from cryptography.hazmat.primitives import hpke
+    from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PublicKey
+    raw = base64.b64decode(public_b64, validate=True)
+    suite = hpke.Suite(hpke.KEM.X25519, hpke.KDF.HKDF_SHA256, hpke.AEAD.AES_256_GCM)
+    blob = suite.encrypt(plaintext, X25519PublicKey.from_public_bytes(raw),
+                         info=info_for(deployment, connector, name))
+    return f"hpke1.{key_id(raw)}." + base64.urlsafe_b64encode(blob).decode("ascii").rstrip("=")
+
+
+def canonical(fields: Mapping[str, str]) -> bytes:
+    return json.dumps(dict(fields), sort_keys=True, separators=(",", ":"),
+                      ensure_ascii=False).encode("utf-8")
+
+
+def fingerprint(fields: Mapping[str, str], key: bytes) -> str:
+    return hmac.new(key, canonical(fields), hashlib.sha256).hexdigest()[:32]
+
+
+def connection_id() -> str:
+    """A new connection's id, chosen here so the seal can be bound to it."""
+    alphabet = "abcdefghijklmnopqrstuvwxyz0123456789"
+    return "cx-" + "".join(secrets.choice(alphabet) for _ in range(12))
+
+
+def _two_lines(secret: str, first: str, second: str) -> tuple[str, str]:
+    a, sep, b = secret.strip().partition("\n")
+    if not sep or not a.strip() or not b.strip():
+        raise SealingError(f"the credential is two lines: {first}, then {second}")
+    return a.strip(), b.strip()
+
+
+def credential_fields(connector: str, secret: str, target: Mapping[str, Any]) -> dict[str, str]:
+    """What was piped in, and the identifiers named, as the engine stores them
+    (the service's `sealing.credential_fields`, line for line)."""
+    target = target or {}
+    if connector not in CONNECTORS:
+        raise SealingError("that connector's credential is not kept in a deployment")
+    secret = secret.strip()
+    if not secret:
+        raise SealingError("the credential is empty")
+    if connector == "github":
+        return {"token": secret}
+    if connector == "gitlab":
+        out = {"token": secret}
+        if target.get("instance_url"):
+            out["instance_url"] = str(target["instance_url"]).strip().rstrip("/")
+        return out
+    if connector in ("jira", "confluence"):
+        email, token = _two_lines(secret, "the account's email address", "the API token")
+        site = str(target.get("base_url") or "").strip().rstrip("/")
+        if not site:
+            raise SealingError("base_url is your site: --target base_url=https://your-site"
+                               ".atlassian.net")
+        return {"email": email, "token": token, "site": site}
+    if connector in ENTERPRISE:
+        return _enterprise_fields(connector, secret, target)
+    if connector in WAVE_046:
+        return _wave_fields(connector, secret, target)
+    if connector in WAVE_047:
+        return _erp_hr_fields(connector, secret, target)
+    if connector == "datadog":
+        api_key, app_key = _two_lines(secret, "the API key", "the application key")
+        engine_site = DATADOG_ENGINE_SITES.get(str(target.get("site") or "us1"))
+        if engine_site is None:
+            raise SealingError("site is one of Datadog's own sites")
+        return {"api_key": api_key, "app_key": app_key, "site": engine_site}
+    out = {"service_account": secret}
+    user = str(target.get("user") or "").strip()
+    if user:
+        out["subject"] = user
+    elif connector == "gmail":
+        raise SealingError("user is the mailbox to read: --target user=<address>")
+    return out
+
+
+ENTERPRISE = ("dynamics", "hubspot", "monday", "netsuite", "notion", "oracle-db",
+              "oracle-fusion", "salesforce", "servicenow", "zendesk")
+
+
+def _named(target: Mapping[str, Any], key: str, words: str) -> str:
+    got = str(target.get(key) or "").strip().rstrip("/")
+    if not got:
+        raise SealingError(f"{key} is {words}")
+    return got
+
+
+def _pem_after(secret: str, n: int, words: tuple[str, ...]) -> tuple[list[str], str]:
+    """`n` one-line fields, then a PEM: what a person pastes for a
+    certificate route that also needs an id or two."""
+    lines = secret.strip().split("\n")
+    head = [x.strip() for x in lines[:n]]
+    pem = "\n".join(lines[n:]).strip()
+    if len(head) < n or not all(head) or any(h.startswith("-----") for h in head) \
+            or not pem.startswith("-----BEGIN") or "PRIVATE KEY-----" not in pem:
+        raise SealingError("the credential is " + ", then ".join(words))
+    return head, pem
+
+
+def _enterprise_fields(connector: str, secret: str, target: Mapping[str, Any]) -> dict[str, str]:
+    """The 1.26 connectors' credentials as the engine stores them
+    (`connector_secrets.SHAPES`). Hosts and names come from what was named;
+    ids that look like secrets (a consumer key, a client id) are pasted with
+    the credential, never put in a target."""
+    if connector == "salesforce":
+        (key,), pem = _pem_after(secret, 1, ("the connected app's consumer key",
+                                             "the PEM of its private key"))
+        return {"instance_url": _named(target, "instance_url", "your My Domain"),
+                "client_id": key, "username": _named(target, "username",
+                                                      "the integration user"),
+                "certificate": pem}
+    if connector == "hubspot":
+        if not secret.startswith("pat-"):
+            raise SealingError("the credential is a HubSpot private app's access token, pat-")
+        return {"token": secret}
+    if connector == "servicenow":
+        a, b = _two_lines(secret, "the client id or user name", "its secret or password")
+        base = _named(target, "instance_url", "https://<instance>.service-now.com")
+        if target.get("sign_in") == "integration_user":
+            return {"instance_url": base, "username": a, "password": b}
+        if target.get("sign_in") == "oauth_client":
+            return {"instance_url": base, "client_id": a, "client_secret": b}
+        raise SealingError("sign_in is oauth_client or integration_user")
+    if connector == "monday":
+        return {"token": secret}
+    if connector == "zendesk":
+        email, token = _two_lines(secret, "the agent's email address", "the API token")
+        return {"subdomain": _named(target, "subdomain", "your Zendesk's name"),
+                "email": email, "token": token}
+    if connector == "notion":
+        if not secret.startswith(("ntn_", "secret_")):
+            raise SealingError("the credential is a Notion internal integration's secret, ntn_")
+        return {"token": secret}
+    if connector == "dynamics":
+        if "PRIVATE KEY-----" not in secret or "BEGIN CERTIFICATE" not in secret:
+            raise SealingError("the credential is the PEM of your app's private key and its "
+                               "certificate")
+        return {"tenant_id": _named(target, "tenant_id", "your directory's id"),
+                "client_id": _named(target, "client_id", "your app's id"),
+                "environment_url": _named(target, "environment_url",
+                                          "https://<org>.crm.dynamics.com"),
+                "certificate": secret}
+    if connector == "oracle-db":
+        lines = [x.strip() for x in secret.strip().split("\n")]
+        if len(lines) != 3 or not all(lines):
+            raise SealingError("the credential is three lines: the connect string, the user, "
+                               "then its password")
+        return {"dsn": lines[0], "user": lines[1], "password": lines[2]}
+    if connector == "netsuite":
+        (cid, kid), pem = _pem_after(secret, 2, ("the client id", "the certificate id",
+                                                 "the PEM of its private key"))
+        return {"account_id": _named(target, "account_id", "your NetSuite account id"),
+                "client_id": cid, "certificate_id": kid, "certificate": pem}
+    if "PRIVATE KEY-----" not in secret or "BEGIN CERTIFICATE" not in secret:
+        raise SealingError("the credential is the PEM of the private key and its certificate")
+    return {"pod_url": _named(target, "pod_url", "https://<pod>.fa.<region>.oraclecloud.com"),
+            "issuer": _named(target, "issuer", "the trusted issuer's name"),
+            "username": _named(target, "username", "the integration user"),
+            "certificate": secret}
+
+# Contract 1.27 (engine 0.46.0): finance and aviation, read-only, sealed where
+# pasted. The fields are the engine's `connector_secrets.SHAPES` and
+# `connector_secrets_aviation.SHAPES`; `view_only` (yes or no) is sealed as
+# `view_only_confirmed`, the client's word that a key whose permissions the
+# provider does not state can only read.
+WAVE_046 = ("bank-statements", "binance", "coinbase-prime", "dfns", "fireblocks", "kraken",
+            "kyriba", "quickbooks", "revolut", "stripe", "xero",
+            "amadeus", "cirium", "eccairs", "flightaware", "intelex", "oag", "qpulse", "sabre",
+            "sita-bags", "sita-flights", "xapi")
+_VIEW_ONLY = ("fireblocks", "dfns", "coinbase-prime", "kraken", "binance", "revolut", "kyriba",
+              "stripe")
+# Target field -> the engine's field, where the names differ or are optional.
+_OPTIONAL = {"fireblocks": ("region",), "dfns": ("region", "service_account_id"),
+             "binance": ("environment",), "revolut": ("environment",),
+             "quickbooks": ("environment",), "amadeus": ("environment",),
+             "sabre": ("environment",)}
+
+
+def _lines(secret: str, words: tuple[str, ...]) -> list[str]:
+    """Exactly len(words) one-line values, in order."""
+    got = [x.strip() for x in secret.strip().split("\n")]
+    if len(got) != len(words) or not all(got):
+        raise SealingError(f"the credential is {len(words)} lines: " + ", then ".join(words))
+    return got
+
+
+def _wave_fields(connector: str, secret: str, target: Mapping[str, Any]) -> dict[str, str]:
+    """The 1.27 connectors' credentials as the engine stores them."""
+    out = _wave_secret(connector, secret, target)
+    for k in _OPTIONAL.get(connector, ()):
+        if str(target.get(k) or "").strip():
+            out[k] = str(target[k]).strip()
+    if connector in _VIEW_ONLY and str(target.get("view_only") or "").strip():
+        if target["view_only"] not in ("yes", "no"):
+            raise SealingError("view_only is yes or no")
+        out["view_only_confirmed"] = str(target["view_only"])
+    return out
+
+
+def _wave_secret(connector: str, secret: str, target: Mapping[str, Any]) -> dict[str, str]:
+    if connector == "fireblocks":
+        (key,), pem = _pem_after(secret, 1, ("the API key", "the PEM of the API user's "
+                                                            "private key"))
+        return {"api_key": key, "private_key": pem}
+    if connector in ("dfns",):
+        return {"token": secret}
+    if connector == "coinbase-prime":
+        a, b, c = _lines(secret, ("the access key", "the passphrase", "the signing key"))
+        return {"access_key": a, "passphrase": b, "signing_key": c}
+    if connector == "kraken":
+        a, b = _two_lines(secret, "the API key", "its private key")
+        return {"api_key": a, "api_secret": b}
+    if connector == "binance":
+        if "PRIVATE KEY-----" in secret:
+            (key,), pem = _pem_after(secret, 1, ("the API key", "the PEM of its Ed25519 "
+                                                                "private key"))
+            return {"api_key": key, "private_key": pem}
+        a, b = _two_lines(secret, "the API key", "its secret")
+        return {"api_key": a, "api_secret": b}
+    if connector == "bank-statements":
+        (host_key,), pem = _pem_after(secret, 1, ("the server's host key fingerprint, "
+                                                  "SHA256:...", "the PEM of the drop "
+                                                                "account's private key"))
+        if not host_key.startswith("SHA256:"):
+            raise SealingError("the first line is the server's host key fingerprint, SHA256:...")
+        return {"location": _named(target, "location", "sftp://<user>@<host>/<path>"),
+                "host_key": host_key, "private_key": pem}
+    if connector == "revolut":
+        (cid, code), pem = _pem_after(secret, 2, ("the client ID", "the authorisation code "
+                                                  "or refresh token", "the PEM of the "
+                                                  "certificate's private key"))
+        grant = str(target.get("grant") or "authorization_code")
+        if grant not in ("authorization_code", "refresh_token"):
+            raise SealingError("grant is authorization_code or refresh_token")
+        return {"client_id": cid, grant: code, "private_key": pem,
+                "issuer": _named(target, "issuer", "the redirect domain you gave Revolut")}
+    if connector == "xero":
+        got = [x.strip() for x in secret.strip().split("\n")]
+        if len(got) not in (2, 3) or not all(got):
+            raise SealingError("the credential is the client ID, then the client secret, then "
+                               "a refresh token where the app was consented to")
+        return dict(zip(("client_id", "client_secret", "refresh_token"), got, strict=False))
+    if connector == "quickbooks":
+        a, b, c = _lines(secret, ("the client ID", "the client secret", "the refresh token"))
+        return {"client_id": a, "client_secret": b, "refresh_token": c,
+                "realm_id": _named(target, "realm_id", "your company's id")}
+    if connector == "kyriba":
+        a, b = _two_lines(secret, "the API client's id", "its secret")
+        return {"client_id": a, "client_secret": b,
+                "auth_url": _named(target, "auth_url", "https://<host>.kyriba.com"),
+                "api_url": _named(target, "api_url", "https://<host>.kyriba.com")}
+    if connector == "stripe":
+        if not secret.startswith(("rk_live_", "rk_test_")):
+            raise SealingError("the credential is a restricted key, rk_live_ or rk_test_; a "
+                               "secret key can move money")
+        return {"api_key": secret}
+    if connector in ("amadeus", "sabre", "eccairs"):
+        a, b = _two_lines(secret, "the client id", "its secret")
+        if connector == "sabre" and not a.startswith("V1:"):
+            raise SealingError("the first line is Sabre's V1:<user>:<group>:<domain>")
+        out = {"client_id": a, "client_secret": b}
+        if connector == "eccairs" and str(target.get("sign_in_url") or "").strip():
+            out["token_url"] = str(target["sign_in_url"]).strip()
+        return out
+    if connector in ("flightaware", "sita-bags"):
+        return {"api_key": secret}
+    if connector == "oag":
+        return {"subscription_key": secret}
+    if connector == "cirium":
+        a, b = _two_lines(secret, "the application id", "its key")
+        return {"app_id": a, "app_key": b}
+    if connector == "sita-flights":
+        got = [x.strip() for x in secret.strip().split("\n")]
+        if len(got) == 1 and got[0]:
+            return {"api_key": got[0]}
+        if len(got) == 3 and all(got):
+            return {"api_key": got[0], "client_id": got[1], "client_secret": got[2]}
+        raise SealingError("the credential is the API key, and for OAuth the client id and "
+                           "secret on two more lines")
+    if connector == "qpulse":
+        a, b = _two_lines(secret, "the integration user", "its password")
+        return {"base_url": _named(target, "base_url", "Q-Pulse's web services address"),
+                "user": a, "password": b,
+                "database": _named(target, "database", "the Q-Pulse database")}
+    if connector == "intelex":
+        return {"base_url": _named(target, "base_url", "your Intelex address"), "api_key": secret}
+    a, b = _two_lines(secret, "the LRS key", "its secret")
+    return {"endpoint": _named(target, "endpoint", "your LRS's xAPI endpoint"), "key": a,
+            "secret": b}
+
+
+# Contract 1.28 (engine 0.47.1): ERP and HR, read-only, sealed where pasted.
+# The fields are the engine's `connector_secrets.SHAPES`: `api_url`,
+# `token_url`, `client_id`, `client_secret`, `username`, `password`,
+# `company_id`, `host`, `tenant` and `refresh_token`. The token endpoint is
+# named as `sign_in_url` (a field called token_* is refused as a credential).
+WAVE_047 = ("sap-s4hana", "sap-successfactors", "workday")
+
+
+def _erp_hr_fields(connector: str, secret: str, target: Mapping[str, Any]) -> dict[str, str]:
+    if connector == "workday":
+        a, b, c = _lines(secret, ("the client id", "the client secret", "the refresh token"))
+        return {"host": _named(target, "host", "your Workday host, <name>.workday.com"),
+                "tenant": _named(target, "tenant", "your Workday tenant"),
+                "client_id": a, "client_secret": b, "refresh_token": c}
+    sign_in = ("oauth" if connector == "sap-successfactors"
+               else str(target.get("sign_in") or "oauth"))
+    if sign_in not in ("oauth", "user"):
+        raise SealingError("sign_in is oauth or user")
+    first, second = (("the client id", "its secret") if sign_in == "oauth"
+                     else ("the user", "its password"))
+    a, b = _two_lines(secret, first, second)
+    api = _named(target, "api_url", "your API host, https://<host>")
+    if connector == "sap-successfactors":
+        return {"api_url": api, "company_id": _named(target, "company_id", "your company id"),
+                "token_url": _named(target, "sign_in_url", "your tenant's token URL"),
+                "client_id": a, "client_secret": b}
+    if sign_in == "user":
+        return {"api_url": api, "username": a, "password": b}
+    return {"api_url": api, "token_url": _named(target, "sign_in_url", "your token URL"),
+            "client_id": a, "client_secret": b}

lighthouse_cli-0.16.0.dist-info/METADATA

@@ -0,0 +1,23 @@
+Metadata-Version: 2.4
+Name: lighthouse-cli
+Version: 0.16.0
+Summary: The LightHouse command line: sign in, connect your estate, deploy agents, watch runs
+License-Expression: Apache-2.0
+Classifier: Programming Language :: Python :: 3
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: httpx==0.28.1
+Requires-Dist: keyring==25.7.0
+Requires-Dist: cryptography==50.0.2
+Provides-Extra: dev
+Requires-Dist: pytest==9.1.1; extra == "dev"
+Requires-Dist: pytest-cov==7.1.0; extra == "dev"
+Requires-Dist: ruff==0.16.10; extra == "dev"
+Requires-Dist: mypy==2.4.0; extra == "dev"
+Requires-Dist: bandit[toml]==1.9.4; extra == "dev"
+Requires-Dist: jsonschema==4.25.1; extra == "dev"
+Provides-Extra: build
+Requires-Dist: pyinstaller==6.22.3; extra == "build"
+Dynamic: license-file