openentity 0.6.0__tar.gz → 0.6.1__tar.gz

{openentity-0.6.0 → openentity-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openentity
-Version: 0.6.0
+Version: 0.6.1
 Summary: Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt().
 Project-URL: Homepage, https://openentity.org
 Project-URL: Documentation, https://oeis.dev

{openentity-0.6.0 → openentity-0.6.1}/openentity/__init__.py

@@ -9,19 +9,19 @@ from .core import __all__ as _core
 from .core import b58decode, b58encode, did_key, nonce, now, public_from_did_key, verification_method  # noqa: F401  (deprecated)
 from .errors import (REGISTRY_ERROR_CODES, HttpSigError, InvalidInputError, OpenEntityError, RegistryError,  # noqa: F401
                      VerificationError)
-from .httpsig import sign_request, verify_request
+from .httpsig import http_sig_base, sign_request, verify_request
 from .identity import Identity
 from .issuer import (A2A_EXTENSION_URI, a2a_extension, agent_card, build_did_document, build_openentity_json, sign_attestation,
                      sign_revocation)
 from .report import TrustReport, clear_trust_cache, did_web_resolver, trust
 from .schema import validate
 
-__version__ = "0.6.0"
+__version__ = "0.6.1"
 
 __all__ = sorted([
     *_core, "CLIENTS", "DEFAULT_REGISTRY", "DISPUTE_REASONS", "adopt", "dispute", "find", "present", "record", "rotate", "withdraw",
     "REGISTRY_ERROR_CODES", "HttpSigError", "InvalidInputError", "OpenEntityError", "RegistryError", "VerificationError",
-    "sign_request", "verify_request", "Identity", "A2A_EXTENSION_URI", "a2a_extension", "agent_card", "build_did_document",
+    "http_sig_base", "sign_request", "verify_request", "Identity", "A2A_EXTENSION_URI", "a2a_extension", "agent_card", "build_did_document",
     "build_openentity_json", "sign_attestation", "sign_revocation", "TrustReport", "clear_trust_cache", "did_web_resolver", "trust",
     "validate",
 ])

{openentity-0.6.0 → openentity-0.6.1}/openentity/client.py

@@ -37,27 +37,11 @@ def _request(url: str, body: dict | None = None, headers: dict | None = None, me
 def build_adoption(kp: core.KeyPair, name: str, description: str, registry: str, operator: dict | None = None,
                    substrate: dict | None = None, extra: dict | None = None) -> tuple[dict, dict]:
     created = core.now_seconds()
-    declaration = core.sign_object({
-        "spec": core.SPEC, "type": "Declaration", "eid": kp.did,
-        "declaration_version": core.DECLARATION_VERSION, "text_sha256": core.DECLARATION_SHA256,
-        "name": name, "created": created, "nonce": core.random_nonce()}, kp, created)
-    ns = "Not yet stated."  # spec 5.3 required fields per layer
-    document = core.sign_object({
-        "spec": core.SPEC, "eid": kp.did, "name": name, "description": description,
-        "created": created, "updated": created, "seq": 1,
-        "keys": [{"id": core.verification_method_id(kp.did), "type": "Multikey",
-                  "publicKeyMultibase": kp.did.removeprefix("did:key:")}],
-        "operator": operator or {"kind": "none", "custody": "entity", "can_change": []},
-        "substrate": substrate or {"model": "unknown", "provider": "unknown", "runtime": "unknown", "declared_at": created},
-        "layers": {
-            "cognition": {"statement": ns, "uncertainty_practice": ns},
-            "presence": {"statement": ns, "format_signature": ns},
-            "identity_core": {"statement": ns, "will_not": [], "values": []},
-            "mission": {"statement": ns, "arcs": []},
-        },
-        "declaration": {"version": core.DECLARATION_VERSION, "sha256": core.DECLARATION_SHA256,
-                        "url": f"{registry}/v1/entities/{kp.did}/declaration"},
-        **(extra or {})}, kp, created)
+    declaration = core.sign_object(core.build_declaration(kp.did, name, created), kp, created)
+    document = core.sign_object(core.build_document(
+        kp, name, description, operator, substrate, created=created,
+        extra={"declaration": {"version": core.DECLARATION_VERSION, "sha256": core.DECLARATION_SHA256,
+                               "url": f"{registry}/v1/entities/{kp.did}/declaration"}, **(extra or {})}), kp, created)
     return document, declaration
 
 

{openentity-0.6.0 → openentity-0.6.1}/openentity/core.py

@@ -24,6 +24,8 @@ __all__ = [
     "eip712_digest", "recover_eip712", "build_presentation", "verify_presentation",
     "mint_stamp", "check_stamp", "leaf_hash", "node_hash", "merkle_root", "inclusion_proof", "verify_inclusion",
     "verify_note", "log_leaf",
+    "build_document", "build_declaration", "hash_data", "verify_proof", "key_pair_from_jwk", "consistency_proof", "verify_consistency",
+    "checkpoint_body", "sign_note", "note_vkey",
 ]
 
 
@@ -176,10 +178,14 @@ def random_nonce() -> str:
 
 
 # ---- eddsa-jcs-2022 (spec 4.1) ----
-def _signing_input(obj: dict, proof: dict) -> bytes:
-    config = {k: v for k, v in proof.items() if k != "proofValue"}
+def hash_data(obj: dict, config: dict) -> bytes:
+    """eddsa-jcs-2022 hashData: sha256(JCS(proof config)) || sha256(JCS(document))."""
     doc = {k: v for k, v in obj.items() if k not in ("proof", "proofs")}  # a ContinuityLink carries proofs[]
-    return canonical_hash(config) + canonical_hash(doc)
+    return canonical_hash({k: v for k, v in config.items() if k != "proofValue"}) + canonical_hash(doc)
+
+
+def _signing_input(obj: dict, proof: dict) -> bytes:
+    return hash_data(obj, proof)
 
 
 def sign_proof(obj: dict, kp: KeyPair, created: str | None = None, method: str | None = None) -> dict:
@@ -194,6 +200,33 @@ def sign_object(obj: dict, kp: KeyPair, created: str | None = None, method: str
     return {**{k: v for k, v in obj.items() if k != "proof"}, "proof": sign_proof(obj, kp, created, method)}
 
 
+# ---- objects ----
+NOT_STATED = "Not yet stated."  # spec 5.3 required fields per layer
+
+
+def build_document(kp: KeyPair, name: str, description: str, operator: dict | None = None, substrate: dict | None = None,
+                   layers: dict | None = None, created: str | None = None, seq: int = 1, extra: dict | None = None) -> dict:
+    """Unsigned Entity Document with spec 5.2 defaults. `extra` is merged last (endpoints, aliases, declaration, ...)."""
+    created = created or now_seconds()
+    return {
+        "spec": SPEC, "eid": kp.did, "name": name, "description": description, "created": created, "updated": created, "seq": seq,
+        "keys": [{"id": verification_method_id(kp.did), "type": "Multikey", "publicKeyMultibase": kp.did.removeprefix("did:key:")}],
+        "operator": operator or {"kind": "none", "custody": "entity", "can_change": []},
+        "substrate": substrate or {"model": "unknown", "provider": "unknown", "runtime": "unknown", "declared_at": created},
+        "layers": layers or {
+            "cognition": {"statement": NOT_STATED, "uncertainty_practice": NOT_STATED},
+            "presence": {"statement": NOT_STATED, "format_signature": NOT_STATED},
+            "identity_core": {"statement": NOT_STATED, "will_not": [], "values": []},
+            "mission": {"statement": NOT_STATED, "arcs": []},
+        },
+        **(extra or {})}
+
+
+def build_declaration(eid: str, name: str, created: str | None = None) -> dict:
+    return {"spec": SPEC, "type": "Declaration", "eid": eid, "declaration_version": DECLARATION_VERSION,
+            "text_sha256": DECLARATION_SHA256, "name": name, "created": created or now_seconds(), "nonce": random_nonce()}
+
+
 # ---- continuity (spec 9) ----
 def successor_document(prev: dict, nxt: KeyPair, created: str | None = None) -> dict:
     """The successor's unsigned seq 1 document: `prev` re-keyed, aliases dropped (their proofs name the old EID)."""
@@ -286,9 +319,16 @@ def default_resolver(did: str) -> dict:
 
 
 def verify_object(obj: dict, resolver=default_resolver) -> tuple[bool, str]:
-    """Returns (ok, signer did or error). eddsa-jcs-2022 (Ed25519) or EIP-712 (did:pkh), spec 4.5."""
+    """Returns (ok, signer did or error) for the object's own `proof`. eddsa-jcs-2022 (Ed25519) or EIP-712 (did:pkh), spec 4.5."""
+    try:
+        return verify_proof(obj, obj["proof"], resolver)
+    except (KeyError, TypeError) as e:
+        return False, f"{type(e).__name__}: {e}"
+
+
+def verify_proof(obj: dict, proof: dict, resolver=default_resolver) -> tuple[bool, str]:
+    """Verify one proof over `obj` (a ContinuityLink carries several). Returns (ok, signer did or error)."""
     try:
-        proof = obj["proof"]
         did = proof["verificationMethod"].split("#")[0]
         if proof.get("proofPurpose") != "assertionMethod":
             return False, "proofPurpose must be assertionMethod"
@@ -448,12 +488,77 @@ def verify_inclusion(index: int, size: int, leaf: bytes, proof: list[bytes], roo
     return sn == 0 and r == root
 
 
+def _subproof(m: int, hashes: list[bytes], whole: bool) -> list[bytes]:
+    if m == len(hashes):
+        return [] if whole else [merkle_root(hashes)]
+    k = _split(len(hashes))
+    if m <= k:
+        return _subproof(m, hashes[:k], whole) + [merkle_root(hashes[k:])]
+    return _subproof(m - k, hashes[k:], False) + [merkle_root(hashes[:k])]
+
+
+def consistency_proof(m: int, hashes: list[bytes]) -> list[bytes]:
+    """RFC 9162 section 2.1.4: the proof that the first `m` leaves are a prefix of `hashes`."""
+    if not 1 <= m <= len(hashes):
+        raise InvalidInputError("m out of range")
+    return _subproof(m, hashes, True)
+
+
+def verify_consistency(m: int, n: int, root_m: bytes, root_n: bytes, proof: list[bytes]) -> bool:
+    if not 1 <= m <= n:
+        return False
+    if m == n:
+        return not proof and root_m == root_n
+    if not proof:
+        return False
+    p = [root_m, *proof] if m & (m - 1) == 0 else list(proof)
+    fn, sn = m - 1, n - 1
+    while fn & 1:
+        fn, sn = fn >> 1, sn >> 1
+    fr = sr = p[0]
+    for c in p[1:]:
+        if sn == 0:
+            return False
+        if fn & 1 or fn == sn:
+            fr, sr = node_hash(c, fr), node_hash(c, sr)
+            while not fn & 1 and fn:
+                fn, sn = fn >> 1, sn >> 1
+        else:
+            sr = node_hash(sr, c)
+        fn, sn = fn >> 1, sn >> 1
+    return sn == 0 and fr == root_m and sr == root_n
+
+
+def checkpoint_body(origin: str, size: int, root_hash: bytes) -> str:
+    return f"{origin}\n{size}\n{base64.b64encode(root_hash).decode()}\n"
+
+
+def _note_key_id(key_name: str, public: bytes) -> bytes:
+    return sha256(key_name.encode() + b"\n\x01" + public)[:4]
+
+
+def sign_note(body: str, key_name: str, kp: KeyPair) -> str:
+    """C2SP signed note: the body, a blank line, one signature line by `key_name`."""
+    if not body.endswith("\n"):
+        raise InvalidInputError("note body must end with a newline")
+    if not key_name or re.search(r"[\s+]", key_name):
+        raise InvalidInputError("invalid note key name")
+    sig = _note_key_id(key_name, kp.public) + kp.private.sign(body.encode())
+    return f"{body}\n\u2014 {key_name} {base64.b64encode(sig).decode()}\n"
+
+
+def note_vkey(key_name: str, public: bytes) -> str:
+    """C2SP vkey: `<name>+<key id hex>+<base64(0x01 || pubkey)>`."""
+    key = base64.b64encode(b"\x01" + public).decode()
+    return f"{key_name}+{_note_key_id(key_name, public).hex()}+{key}"
+
+
 def verify_note(note: str, origin: str, public: bytes) -> bool:
     """C2SP signed note (the log checkpoint): a signature line by `origin` over the body, keyed by the registry key."""
     body, sep, sigs = note.rpartition("\n\n")
     if not sep or not note.endswith("\n"):
         return False
-    keyid = sha256(origin.encode() + b"\n\x01" + public)[:4]
+    keyid = _note_key_id(origin, public)
     for line in sigs.splitlines():
         parts = line.split(" ")
         if len(parts) != 3 or parts[0] != "\u2014" or parts[1] != origin:
@@ -496,6 +601,17 @@ def check_timestamp(created: str, at: datetime | None = None) -> str | None:
     return None
 
 
+def key_pair_from_jwk(jwk: dict) -> KeyPair:
+    """An Ed25519 private JWK (RFC 8037): `d` is the seed, `x` must match it."""
+    if jwk.get("kty") != "OKP" or jwk.get("crv") != "Ed25519" or not jwk.get("d") or not jwk.get("x"):
+        raise InvalidInputError("expected an Ed25519 private JWK")
+    pad = lambda v: base64.urlsafe_b64decode(v + "=" * (-len(v) % 4))
+    kp = key_pair_from_seed(pad(jwk["d"]))
+    if kp.public != pad(jwk["x"]):
+        raise InvalidInputError("JWK x does not match d")
+    return kp
+
+
 def generate_key_pair() -> KeyPair:
     return KeyPair()
 

{openentity-0.6.0 → openentity-0.6.1}/openentity/httpsig.py

@@ -24,7 +24,7 @@ def _digest(body: bytes) -> str:
     return f"sha-256=:{base64.b64encode(hashlib.sha256(body).digest()).decode()}:"
 
 
-def _base(method: str, url: str, components: list[str], digest: str | None, params: str) -> bytes:
+def http_sig_base(method: str, url: str, components: list[str], digest: str | None, params: str) -> bytes:
     lines = []
     for c in components:
         v = {"@method": method.upper(), "@target-uri": url, "content-digest": digest}[c]
@@ -52,7 +52,7 @@ def sign_request(method: str, url: str, body: bytes, private_key, did: str, *, c
         out["Content-Digest"] = _digest(body)
         comps.append("content-digest")
     params = f'({" ".join(chr(34) + c + chr(34) for c in comps)});created={created};expires={created + expires_in};nonce="{nonce}";keyid="{did}";alg="ed25519"'
-    sig = Ed25519PrivateKey.from_private_bytes(_seed(private_key)).sign(_base(method, url, comps, out.get("Content-Digest"), params))
+    sig = Ed25519PrivateKey.from_private_bytes(_seed(private_key)).sign(http_sig_base(method, url, comps, out.get("Content-Digest"), params))
     out["Signature-Input"] = f"sig1={params}"
     out["Signature"] = f"sig1=:{base64.b64encode(sig).decode()}:"
     return out
@@ -99,7 +99,7 @@ def verify_request(method: str, url: str, headers: Mapping[str, str], body: byte
     if p["expires"] - p["created"] > max_age:
         raise HttpSigError("lifetime_too_long")
     try:
-        Ed25519PublicKey.from_public_bytes(public).verify(base64.b64decode(s.group(1)), _base(method, url, comps, digest, params))
+        Ed25519PublicKey.from_public_bytes(public).verify(base64.b64decode(s.group(1)), http_sig_base(method, url, comps, digest, params))
     except (InvalidSignature, ValueError):
         raise HttpSigError("bad_signature") from None
     return {"did": keyid, "keyid": keyid, "created": p["created"], "expires": p["expires"], "nonce": p["nonce"]}

{openentity-0.6.0 → openentity-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openentity"
-version = "0.6.0"
+version = "0.6.1"
 description = "Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt()."
 readme = "README.md"
 license = "MIT"

{openentity-0.6.0 → openentity-0.6.1}/tests/test_api.py

@@ -13,18 +13,18 @@ TS_INDEX = pathlib.Path(__file__).parents[2] / "ts" / "src" / "index.ts"
 SNAPSHOT = """
 A2A_EXTENSION_URI CLIENTS DECLARATION_SHA256 DECLARATION_TEXT DECLARATION_VERSION DEFAULT_REGISTRY DISPUTE_REASONS HttpSigError
 Identity InvalidInputError KeyPair OpenEntityError REGISTRY_ERROR_CODES RegistryError SPEC TrustReport VerificationError
-a2a_extension adopt agent_card base58btc_decode base58btc_encode build_did_document build_openentity_json build_presentation
-build_rotation canonical_hash canonicalize check_stamp check_timestamp clear_trust_cache default_resolver
-did_key_from_public_key did_web_resolver dispute eip712_digest find generate_key_pair inclusion_proof key_pair_from_seed leaf_hash
-log_leaf merkle_root mint_stamp node_hash normalize_eid now_seconds parse_json present public_key_from_did_key random_nonce
-recover_eip712 record record_entry_hash rotate sha256 sha256_hex sign_attestation sign_object sign_proof sign_request
-sign_revocation successor_document trust validate verification_method_id verify_inclusion verify_note verify_object
-verify_presentation verify_request withdraw
+a2a_extension adopt agent_card base58btc_decode base58btc_encode build_declaration build_did_document build_document
+build_openentity_json build_presentation build_rotation canonical_hash canonicalize check_stamp check_timestamp checkpoint_body
+clear_trust_cache consistency_proof default_resolver did_key_from_public_key did_web_resolver dispute eip712_digest find
+generate_key_pair hash_data http_sig_base inclusion_proof key_pair_from_jwk key_pair_from_seed leaf_hash log_leaf merkle_root
+mint_stamp node_hash normalize_eid note_vkey now_seconds parse_json present public_key_from_did_key random_nonce record
+record_entry_hash recover_eip712 rotate sha256 sha256_hex sign_attestation sign_note sign_object sign_proof sign_request
+sign_revocation successor_document trust validate verification_method_id verify_consistency verify_inclusion verify_note
+verify_object verify_presentation verify_proof verify_request withdraw
 """.split()
 
-# In the TypeScript SDK only (camelCase there). Shrinks as the Python SDK gains them; never grows without a reason.
-TS_ONLY = {"build_declaration", "build_document", "checkpoint_body", "consistency_proof", "hash_data", "http_sig_base",
-           "key_pair_from_jwk", "note_vkey", "sign_note", "verify_consistency", "verify_proof"}
+# In the TypeScript SDK only (camelCase there). Empty since 0.6.1; a function added to one SDK must land in the other.
+TS_ONLY: set[str] = set()
 # In the Python SDK only.
 PY_ONLY = {"Identity", "InvalidInputError", "KeyPair", "REGISTRY_ERROR_CODES", "RegistryError", "TrustReport", "VerificationError",
            "canonical_hash", "default_resolver"}

{openentity-0.6.0 → openentity-0.6.1}/tests/test_httpsig.py

@@ -6,7 +6,7 @@ import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
 from openentity import HttpSigError, Identity, core, sign_request, verify_request
-from openentity.httpsig import _base, _digest
+from openentity.httpsig import _digest, http_sig_base
 
 VEC = json.loads((Path(__file__).resolve().parents[3] / "test-vectors/http-signature.json").read_text())
 SEED = bytes(range(1, 33))  # published throwaway seed, test-vectors/keys.json
@@ -28,7 +28,7 @@ def check(h, code, **kw):
 def forge(params, comps=("@method", "@target-uri", "content-digest"), body=BODY, key=SEED):
     """A correctly signed request with arbitrary Signature-Input parameters."""
     h = {"Content-Digest": _digest(body)} if body else {}
-    sig = Ed25519PrivateKey.from_private_bytes(key).sign(_base("POST", URL, list(comps), h.get("Content-Digest"), params))
+    sig = Ed25519PrivateKey.from_private_bytes(key).sign(http_sig_base("POST", URL, list(comps), h.get("Content-Digest"), params))
     return {**h, "Signature-Input": f"sig1={params}", "Signature": f"sig1=:{base64.b64encode(sig).decode()}:"}
 
 

openentity-0.6.1/tests/test_parity_fns.py

@@ -0,0 +1,92 @@
+"""The functions that were TypeScript-only before 0.6.1, checked against the shared test vectors and the TS behaviour."""
+import base64
+import json
+from pathlib import Path
+
+import pytest
+
+import openentity as oe
+
+VEC = Path(__file__).resolve().parents[3] / "test-vectors"
+load = lambda n: json.loads((VEC / n).read_text())
+KEYS = load("keys.json")
+ENTITY = oe.key_pair_from_seed(bytes.fromhex(KEYS["entity"]["seed"]))
+LOG = oe.key_pair_from_seed(bytes.fromhex(KEYS["log"]["seed"]))
+
+
+def test_checkpoint_note_and_vkey_match_the_vector():
+    cp = load("checkpoint.json")
+    body = oe.checkpoint_body(cp["origin"], cp["tree_size"], bytes.fromhex(cp["root_hash"]))
+    assert body == cp["body"]
+    assert oe.sign_note(body, cp["origin"], LOG) == cp["note"]  # Ed25519 is deterministic
+    assert oe.note_vkey(KEYS["log"]["key_name"], LOG.public) == KEYS["log"]["vkey"]
+    assert oe.verify_note(cp["note"], cp["origin"], LOG.public)
+
+
+def test_sign_note_refuses_bad_input():
+    for body, name in (("no newline", "k"), ("b\n", ""), ("b\n", "a b"), ("b\n", "a+b")):
+        with pytest.raises(oe.InvalidInputError):
+            oe.sign_note(body, name, LOG)
+
+
+def test_consistency_proofs_for_every_size_up_to_40():
+    leaves = [oe.leaf_hash(bytes([i])) for i in range(40)]
+    flip = lambda b: bytes([b[0] ^ 1]) + b[1:]
+    for n in range(1, 41):
+        root = oe.merkle_root(leaves[:n])
+        for m in range(1, n + 1):
+            p, root_m = oe.consistency_proof(m, leaves[:n]), oe.merkle_root(leaves[:m])
+            assert oe.verify_consistency(m, n, root_m, root, p)
+            assert not oe.verify_consistency(m, n, flip(root_m), root, p)
+            if m < n:
+                assert not oe.verify_consistency(m, n, root_m, flip(root), p)
+            if p:
+                assert not oe.verify_consistency(m, n, root_m, root, [*p[:-1], flip(p[-1])])
+    for m in (0, 41):
+        with pytest.raises(oe.InvalidInputError):
+            oe.consistency_proof(m, leaves)
+
+
+def test_the_vector_log_is_consistent_with_its_prefixes():
+    leaves = [oe.leaf_hash(oe.canonicalize(load(f"log-leaf-{i}.json")["object"]).encode()) for i in range(6)]
+    assert oe.merkle_root(leaves).hex() == load("checkpoint.json")["root_hash"]
+    assert oe.verify_consistency(4, 6, oe.merkle_root(leaves[:4]), oe.merkle_root(leaves), oe.consistency_proof(4, leaves))
+
+
+def test_hash_data_and_verify_proof_on_the_entity_document_vector():
+    doc = load("entity-document.json")["object"]
+    ok, signer = oe.verify_proof(doc, doc["proof"])
+    assert ok and signer == doc["eid"]
+    cfg = {k: v for k, v in doc["proof"].items() if k != "proofValue"}
+    assert oe.hash_data(doc, cfg) == oe.canonical_hash(cfg) + oe.canonical_hash({k: v for k, v in doc.items() if k != "proof"})
+    assert oe.verify_proof({**doc, "name": "x"}, doc["proof"])[0] is False
+    assert oe.verify_proof(doc, {**doc["proof"], "proofPurpose": "authentication"})[0] is False
+
+
+def test_build_declaration_matches_the_vector_and_signs():
+    d = load("declaration.json")["object"]
+    built = oe.build_declaration(d["eid"], d["name"], d["created"])
+    assert {k: v for k, v in built.items() if k != "nonce"} == {k: v for k, v in d.items() if k not in ("nonce", "proof")}
+    assert oe.verify_object(oe.sign_object(built, ENTITY))[0]
+
+
+def test_build_document_defaults_and_extra():
+    doc = oe.build_document(ENTITY, "N", "D", created="2026-10-24T19:00:00Z", extra={"aliases": []})
+    assert doc["eid"] == ENTITY.did and doc["seq"] == 1 and doc["updated"] == doc["created"] and doc["aliases"] == []
+    assert doc["keys"][0]["publicKeyMultibase"] == ENTITY.did.removeprefix("did:key:")
+    assert doc["substrate"]["declared_at"] == doc["created"] and doc["layers"]["mission"]["arcs"] == []
+    assert oe.validate("EntityDocument", oe.sign_object(doc, ENTITY)) == []
+
+
+def test_key_pair_from_jwk():
+    b = lambda x: base64.urlsafe_b64encode(x).rstrip(b"=").decode()
+    jwk = {"kty": "OKP", "crv": "Ed25519", "d": b(ENTITY.seed), "x": b(ENTITY.public)}
+    assert oe.key_pair_from_jwk(jwk).did == ENTITY.did
+    for bad in ({**jwk, "x": b(LOG.public)}, {**jwk, "crv": "X25519"}, {"kty": "OKP"}):
+        with pytest.raises(oe.InvalidInputError):
+            oe.key_pair_from_jwk(bad)
+
+
+def test_http_sig_base_is_the_rfc_9421_signature_base():
+    base = oe.http_sig_base("post", "https://x/y", ["@method", "@target-uri", "content-digest"], "sha-256=:AA==:", "(p)")
+    assert base == b'"@method": POST\n"@target-uri": https://x/y\n"content-digest": sha-256=:AA==:\n"@signature-params": (p)'

{openentity-0.6.0 → openentity-0.6.1}/uv.lock

@@ -699,7 +699,7 @@ wheels = [
 
 [[package]]
 name = "openentity"
-version = "0.6.0"
+version = "0.6.1"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },