sanka-cli 0.2.4__tar.gz → 0.2.6__tar.gz

{sanka_cli-0.2.4 → sanka_cli-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sanka-cli
-Version: 0.2.4
+Version: 0.2.6
 Summary: Sanka command-line interface and migration runtime
 Project-URL: Repository, https://github.com/sankaHQ/sanka
 Project-URL: Issues, https://github.com/sankaHQ/sanka/issues
@@ -16,6 +16,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: click<9,>=8.1
+Requires-Dist: cryptography<52,>=43
 Requires-Dist: httpx<1,>=0.27
 Requires-Dist: keyring<26,>=25
 Requires-Dist: packaging<27,>=24
@@ -107,6 +108,17 @@ workflows, AI, Custom Code, and explicitly cloud-selected migrations retain
 their existing authentication requirements. Add `--json` to local lifecycle
 commands for the stable `sanka-cli/v1` response envelope.
 
+## Hosted repository runs
+
+`sanka cloud` uploads reviewed repository ZIPs, starts runs with an explicit
+credit cap, and reads status, receipts, and retained artifacts. When enabled by
+the operator, `cloud repair` makes one bounded patch attempt and `cloud certify`
+compares selected HTTP cases in a fresh worker. `cloud certificate-verify`
+verifies signed evidence online or with an explicitly trusted offline key ring.
+Every hosted command pins its workspace; paid operations require confirmation.
+See [Hosted repository runs](../../docs/cloud-runs.md) for inputs, pricing,
+verification scope, and revocation limits.
+
 ## Extension trust
 
 The manager verifies a trusted marketplace snapshot, manifest schema,

{sanka_cli-0.2.4 → sanka_cli-0.2.6}/README.md

@@ -77,6 +77,17 @@ workflows, AI, Custom Code, and explicitly cloud-selected migrations retain
 their existing authentication requirements. Add `--json` to local lifecycle
 commands for the stable `sanka-cli/v1` response envelope.
 
+## Hosted repository runs
+
+`sanka cloud` uploads reviewed repository ZIPs, starts runs with an explicit
+credit cap, and reads status, receipts, and retained artifacts. When enabled by
+the operator, `cloud repair` makes one bounded patch attempt and `cloud certify`
+compares selected HTTP cases in a fresh worker. `cloud certificate-verify`
+verifies signed evidence online or with an explicitly trusted offline key ring.
+Every hosted command pins its workspace; paid operations require confirmation.
+See [Hosted repository runs](../../docs/cloud-runs.md) for inputs, pricing,
+verification scope, and revocation limits.
+
 ## Extension trust
 
 The manager verifies a trusted marketplace snapshot, manifest schema,

{sanka_cli-0.2.4 → sanka_cli-0.2.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sanka-cli"
-version = "0.2.4"
+version = "0.2.6"
 description = "Sanka command-line interface and migration runtime"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -16,6 +16,7 @@ classifiers = [
 ]
 dependencies = [
   "click>=8.1,<9",
+  "cryptography>=43,<52",
   "httpx>=0.27,<1",
   "keyring>=25,<26",
   "packaging>=24,<27",

{sanka_cli-0.2.4 → sanka_cli-0.2.6}/src/sanka/runtime/execution/report_codec.py

@@ -207,6 +207,15 @@ def canonical_route_manifest(raw: Any) -> MappingRouteManifest:
                 code="SANKA_MIGRATE_ROUTE_MANIFEST_INVALID",
             )
         seen.add(route_key)
+        identity_fields = item.get("identityFields", [])
+        if not isinstance(identity_fields, list) or any(
+            not isinstance(value, str) or not value.strip() or value != value.strip()
+            for value in identity_fields
+        ):
+            raise ExecutionFault(
+                "The saved Sanka route manifest contains invalid identity fields.",
+                code="SANKA_MIGRATE_ROUTE_MANIFEST_INVALID",
+            )
         normalized.append(
             {
                 "routeKey": route_key,
@@ -215,6 +224,7 @@ def canonical_route_manifest(raw: Any) -> MappingRouteManifest:
                 "sourceFilter": (
                     _source_filter_payload(source_filter) if source_filter is not None else None
                 ),
+                **({"identityFields": sorted(set(identity_fields))} if identity_fields else {}),
             }
         )
     return sorted(normalized, key=lambda row: str(row["routeKey"]))

{sanka_cli-0.2.4 → sanka_cli-0.2.6}/src/sanka_cli/__init__.py

@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: Apache-2.0
 __all__ = ["__version__"]
 
-__version__ = "0.2.4"
+__version__ = "0.2.6"

sanka_cli-0.2.6/src/sanka_cli/certificates.py

@@ -0,0 +1,98 @@
+# SPDX-License-Identifier: Apache-2.0
+"""Public certificate input and verification helpers; no hosted execution code."""
+
+from __future__ import annotations
+
+import base64
+import json
+import re
+from pathlib import Path
+from typing import Any
+from urllib.parse import unquote, urlsplit
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+
+def canonical_bytes(value: Any) -> bytes:
+    return json.dumps(
+        value, sort_keys=True, separators=(",", ":"), ensure_ascii=True, allow_nan=False
+    ).encode("utf-8")
+
+
+def read_json(path: Path, maximum: int = 192 * 1024) -> Any:
+    with path.open("rb") as stream:
+        data = stream.read(maximum + 1)
+    if len(data) > maximum:
+        raise ValueError("JSON file exceeds its size limit")
+    return json.loads(data)
+
+
+def load_scenarios(path: Path) -> list[dict[str, Any]]:
+    cases = read_json(path, 48 * 1024)
+    if not isinstance(cases, list) or not 1 <= len(cases) <= 50:
+        raise ValueError("Cases must be a JSON array containing 1 to 50 requests")
+    seen, normalized = set(), []
+    for case in cases:
+        if not isinstance(case, dict) or set(case) - {"id", "method", "path", "json_body"}:
+            raise ValueError("Each case accepts only id, method, path and json_body")
+        identifier, method, value = case.get("id"), case.get("method"), case.get("path")
+        if (
+            not isinstance(identifier, str)
+            or not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_-]{0,63}", identifier)
+            or identifier in seen
+            or method not in {"GET", "POST", "PUT", "PATCH", "DELETE"}
+            or not isinstance(value, str)
+            or not 1 <= len(value) <= 1000
+        ):
+            raise ValueError("Each case needs a unique ID, supported method and local HTTP path")
+        seen.add(identifier)
+        parsed, decoded = urlsplit(value), unquote(value)
+        if (
+            not value.startswith("/")
+            or value.startswith("//")
+            or parsed.scheme
+            or parsed.netloc
+            or parsed.fragment
+            or "\\" in decoded
+            or any(ord(char) < 32 or ord(char) > 126 for char in decoded)
+            or ".." in decoded.split("?", 1)[0].split("/")
+        ):
+            raise ValueError("Case paths must be local ASCII HTTP paths without traversal")
+        body = case.get("json_body")
+        if len(canonical_bytes({"body": body})) > 8192 or (method == "GET" and body is not None):
+            raise ValueError("Case bodies are limited to 8 KiB; GET cannot have a body")
+        normalized.append({"id": identifier, "method": method, "path": value, "json_body": body})
+    if len(canonical_bytes(normalized)) > 47 * 1024:
+        raise ValueError("The normalized certificate scope exceeds its size limit")
+    return normalized
+
+
+def verify_certificate(document: dict[str, Any], key_document: dict[str, Any]) -> dict[str, Any]:
+    """Verify using keys supplied by the caller's chosen trusted source only."""
+    signed = document.get("certificate", document)
+    key_document = key_document.get("data", key_document)
+    try:
+        payload = signed["payload"]
+        if (
+            signed["algorithm"] != "Ed25519"
+            or signed["encoding"] != "sorted-ascii-json-v1"
+            or payload["schema_version"] != "developer-certificate-v1"
+            or payload["issuer"] != "https://api-v2.sanka.com"
+            or not isinstance(payload, dict)
+        ):
+            raise ValueError("Unsupported certificate issuer or signature format")
+        matches = [row for row in key_document["keys"] if row["key_id"] == signed["key_id"]]
+        if len(matches) != 1 or matches[0].get("algorithm") != "Ed25519":
+            raise ValueError("The signing key is not in the selected trusted key ring")
+        key = Ed25519PublicKey.from_public_bytes(
+            base64.b64decode(matches[0]["public_key_base64"], validate=True)
+        )
+        key.verify(
+            base64.b64decode(signed["signature_base64"], validate=True), canonical_bytes(payload)
+        )
+    except InvalidSignature as error:
+        raise ValueError("Certificate signature is invalid") from error
+    except (KeyError, TypeError, AttributeError) as error:
+        raise ValueError("Certificate or trusted key ring has an invalid format") from error
+    return payload