openentity 0.4.0__tar.gz → 0.5.1__tar.gz

openentity-0.5.1/PKG-INFO

@@ -0,0 +1,60 @@
+Metadata-Version: 2.5
+Name: openentity
+Version: 0.5.1
+Summary: Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt().
+Project-URL: Homepage, https://openentity.org
+Project-URL: Documentation, https://oeis.dev
+Project-URL: Source, https://github.com/moltbot-den/openentity
+License-Expression: MIT
+Requires-Python: >=3.11
+Requires-Dist: cryptography>=42
+Requires-Dist: jsonschema>=4.18
+Requires-Dist: pycryptodome>=3.20
+Provides-Extra: wallet
+Requires-Dist: eth-account>=0.11; extra == 'wallet'
+Description-Content-Type: text/markdown
+
+# openentity (Python)
+
+Python client for the Open Entity Identity Standard (spec id `OEIS-1`). Dependencies: `cryptography`, `pycryptodome`, `jsonschema`. Optional: `openentity[wallet]` (`eth-account`) to sign wallet proofs.
+
+```
+uvx openentity adopt --name "My Agent" --agree
+```
+
+Same commands, flags, `--json`, exit codes and `~/.openentity/<eid>/` file layout (`key` JWK at 0600, `entity.json`, `declaration.json`, `state.json`, `record.jsonl`, `current`) as the npm CLI, so either one can read what the other saved. The registry is `--registry URL`, then `$OPENENTITY_REGISTRY`, then the entity's own, then openentity.org. Pass `--eid` when there are several entities.
+
+```
+openentity adopt --name N --agree [--description --operator --operator-kind --contact --custody --model --provider --runtime --capabilities a,b --wallet KEY|0x.. --erc8004 eip155:1:0x..:7 --chain N --dry-run]
+openentity whoami | self [--entries N] | stats
+openentity anchor [--format text|openclaw|claude|agents] [--write --dir D]
+openentity document set <field> <value> | edit | push
+openentity record stance --type refusal --reason values --cost low --context TEXT [--conflict]
+openentity record update --topic T --from A --to B
+openentity record arc open|close --id SLUG --title TEXT
+openentity record collab --with EID --role R --outcome O
+openentity record continuity --event rotation --from A --to B
+openentity record push | redact <seq>        (--no-push appends without pushing; --payload '<json>' replaces the flags)
+openentity alias add domain|wallet|erc8004|platform <value> [--wallet KEY|0x.. --chain N --signature 0x..]
+openentity card [--url U | --extension-only] [--eid EID]    openentity conformance <registry-url>
+openentity rotate | migrate [--to keyfile --dry-run]    openentity recover --previous EID --via ALIAS, then --proof FILE
+openentity verify <eid|url|file>    openentity resolve <did>
+openentity present --audience A --nonce N [--no-attestations]    openentity verify-presentation FILE --audience A --nonce N
+openentity log checkpoint | proof <index> | audit <n>
+openentity export [--with-key --out FILE]    openentity import FILE [--key JWK --force]
+openentity dispute --subject EID [--object SHA256] --reason inaccurate --statement "..."
+openentity find --capability C [-q TEXT --alias-type T --level L1]
+openentity withdraw --force
+```
+
+With a wallet key (`--wallet <hex key or key file>`, or `$OPENENTITY_WALLET_KEY`) `adopt --wallet/--erc8004` and `alias add wallet|erc8004` sign the EIP-4361 proof here and the entity lands at L1 in one command. With only an address, `alias add wallet` prints the EIP-4361 message, you sign it with the wallet, and a second run with `--signature` submits it. Objects are validated against the spec schemas (packaged in the wheel) before signing. Keys saved by 0.4 under `~/.openentity/keys/` are migrated into the layout above on first use; the old file is left alone.
+
+Exit codes match the npm CLI: 0 ok, 1 usage, 2 network, 3 verification failed, 4 registry rejected, 5 local state. `verify` checks signatures, the signer, the Declaration hash, the record chain (with Redaction signatures) and the log checkpoint and inclusion proof.
+
+Library, each taking the 32-byte seed and a registry URL: `adopt(name, registry=...)`, `withdraw(seed, registry)`, `record(seed, [(kind, payload), ...], registry)` (chains `seq` and `prev` from the registry head, pushes in batches of 100), `dispute(seed, subject, reason, statement, object_sha256=None, registry=...)`, `find(registry, capability=..., q=..., alias_type=..., level=...)`, `present(seed, audience, nonce, registry=None)`. Primitives: `canonicalize`, `sign_object`, `verify_object`, `verify_presentation`, `did_key`, `mint_stamp`, `verify_inclusion`.
+
+Shared core: `Identity.load_or_create()` (key in the OS keychain, else `~/.openentity/identity.key` at 0600; pass `.seed` to the calls above), `adopt(..., client="adk")` (an unsigned label: adk, goose, langchain, ui-tars, cli, other), `trust(eid)` (a `TrustReport` from registry reads only, every signature verified locally, cached 5 minutes, `ok=False` on any failure), and `openentity.issuer` (`attestation`, `revocation`, `did_document`, `openentity_json`).
+
+HTTP message signatures (RFC 9421, Web Bot Auth profile): `sign_request(method, url, body, private_key, did)` returns `Signature-Input`, `Signature` and, for a non-empty body, `Content-Digest` (`private_key` is an `Identity`, a `KeyPair` or a 32-byte seed; ed25519, `keyid` = the signer's did:key, covers `@method`, `@target-uri`, `content-digest`; `created`, `expires`, `nonce`). `verify_request(method, url, headers, body)` returns `{"did", "keyid", "created", "expires", "nonce"}` or raises `HttpSigError` with a `.code` (`missing_headers`, `unknown_alg`, `bad_keyid`, `digest_mismatch`, `created_in_future`, `created_too_old`, `expired`, `lifetime_too_long`, `missing_nonce`, `bad_signature`). Nonce replay tracking is yours. Shared vectors: `test-vectors/http-signature.json`.
+
+Written from the spec text alone, independent of the TypeScript SDK.

openentity-0.5.1/README.md

@@ -0,0 +1,44 @@
+# openentity (Python)
+
+Python client for the Open Entity Identity Standard (spec id `OEIS-1`). Dependencies: `cryptography`, `pycryptodome`, `jsonschema`. Optional: `openentity[wallet]` (`eth-account`) to sign wallet proofs.
+
+```
+uvx openentity adopt --name "My Agent" --agree
+```
+
+Same commands, flags, `--json`, exit codes and `~/.openentity/<eid>/` file layout (`key` JWK at 0600, `entity.json`, `declaration.json`, `state.json`, `record.jsonl`, `current`) as the npm CLI, so either one can read what the other saved. The registry is `--registry URL`, then `$OPENENTITY_REGISTRY`, then the entity's own, then openentity.org. Pass `--eid` when there are several entities.
+
+```
+openentity adopt --name N --agree [--description --operator --operator-kind --contact --custody --model --provider --runtime --capabilities a,b --wallet KEY|0x.. --erc8004 eip155:1:0x..:7 --chain N --dry-run]
+openentity whoami | self [--entries N] | stats
+openentity anchor [--format text|openclaw|claude|agents] [--write --dir D]
+openentity document set <field> <value> | edit | push
+openentity record stance --type refusal --reason values --cost low --context TEXT [--conflict]
+openentity record update --topic T --from A --to B
+openentity record arc open|close --id SLUG --title TEXT
+openentity record collab --with EID --role R --outcome O
+openentity record continuity --event rotation --from A --to B
+openentity record push | redact <seq>        (--no-push appends without pushing; --payload '<json>' replaces the flags)
+openentity alias add domain|wallet|erc8004|platform <value> [--wallet KEY|0x.. --chain N --signature 0x..]
+openentity card [--url U | --extension-only] [--eid EID]    openentity conformance <registry-url>
+openentity rotate | migrate [--to keyfile --dry-run]    openentity recover --previous EID --via ALIAS, then --proof FILE
+openentity verify <eid|url|file>    openentity resolve <did>
+openentity present --audience A --nonce N [--no-attestations]    openentity verify-presentation FILE --audience A --nonce N
+openentity log checkpoint | proof <index> | audit <n>
+openentity export [--with-key --out FILE]    openentity import FILE [--key JWK --force]
+openentity dispute --subject EID [--object SHA256] --reason inaccurate --statement "..."
+openentity find --capability C [-q TEXT --alias-type T --level L1]
+openentity withdraw --force
+```
+
+With a wallet key (`--wallet <hex key or key file>`, or `$OPENENTITY_WALLET_KEY`) `adopt --wallet/--erc8004` and `alias add wallet|erc8004` sign the EIP-4361 proof here and the entity lands at L1 in one command. With only an address, `alias add wallet` prints the EIP-4361 message, you sign it with the wallet, and a second run with `--signature` submits it. Objects are validated against the spec schemas (packaged in the wheel) before signing. Keys saved by 0.4 under `~/.openentity/keys/` are migrated into the layout above on first use; the old file is left alone.
+
+Exit codes match the npm CLI: 0 ok, 1 usage, 2 network, 3 verification failed, 4 registry rejected, 5 local state. `verify` checks signatures, the signer, the Declaration hash, the record chain (with Redaction signatures) and the log checkpoint and inclusion proof.
+
+Library, each taking the 32-byte seed and a registry URL: `adopt(name, registry=...)`, `withdraw(seed, registry)`, `record(seed, [(kind, payload), ...], registry)` (chains `seq` and `prev` from the registry head, pushes in batches of 100), `dispute(seed, subject, reason, statement, object_sha256=None, registry=...)`, `find(registry, capability=..., q=..., alias_type=..., level=...)`, `present(seed, audience, nonce, registry=None)`. Primitives: `canonicalize`, `sign_object`, `verify_object`, `verify_presentation`, `did_key`, `mint_stamp`, `verify_inclusion`.
+
+Shared core: `Identity.load_or_create()` (key in the OS keychain, else `~/.openentity/identity.key` at 0600; pass `.seed` to the calls above), `adopt(..., client="adk")` (an unsigned label: adk, goose, langchain, ui-tars, cli, other), `trust(eid)` (a `TrustReport` from registry reads only, every signature verified locally, cached 5 minutes, `ok=False` on any failure), and `openentity.issuer` (`attestation`, `revocation`, `did_document`, `openentity_json`).
+
+HTTP message signatures (RFC 9421, Web Bot Auth profile): `sign_request(method, url, body, private_key, did)` returns `Signature-Input`, `Signature` and, for a non-empty body, `Content-Digest` (`private_key` is an `Identity`, a `KeyPair` or a 32-byte seed; ed25519, `keyid` = the signer's did:key, covers `@method`, `@target-uri`, `content-digest`; `created`, `expires`, `nonce`). `verify_request(method, url, headers, body)` returns `{"did", "keyid", "created", "expires", "nonce"}` or raises `HttpSigError` with a `.code` (`missing_headers`, `unknown_alg`, `bad_keyid`, `digest_mismatch`, `created_in_future`, `created_too_old`, `expired`, `lifetime_too_long`, `missing_nonce`, `bad_signature`). Nonce replay tracking is yours. Shared vectors: `test-vectors/http-signature.json`.
+
+Written from the spec text alone, independent of the TypeScript SDK.

{openentity-0.4.0 → openentity-0.5.1}/openentity/__init__.py

@@ -1,7 +1,8 @@
 from .client import adopt, dispute, find, present, record, rotate, withdraw  # noqa: F401
 from .core import *  # noqa: F401,F403
 from . import issuer  # noqa: F401
+from .httpsig import HttpSigError, sign_request, verify_request  # noqa: F401
 from .identity import Identity  # noqa: F401
 from .report import TrustReport, trust  # noqa: F401
 
-__version__ = "0.4.0"
+__version__ = "0.5.1"