sci-protocol 0.2.0__py3-none-any.whl

pysci/_cli/commands/check.py

@@ -0,0 +1,115 @@
+"""``sci check``: validate an unsigned draft without signing it."""
+
+from __future__ import annotations
+
+import argparse
+from typing import Any
+
+from pysci.draft import DraftReport, check_draft
+
+from ..checks import issue_lines
+from ..context import Context
+from ..errors import CliError, Exit, exit_for_outcome, issue_json, issue_record
+from ..output import Result
+from ..spec import Command, arg
+from ..storage.files import temp_names
+
+
+def draft_report_json(report: DraftReport) -> dict[str, Any]:
+    baseline: dict[str, Any]
+    if report.baseline is None:
+        baseline = {"status": "not_performed", "reason": "planned sizes could not be computed"}
+    else:
+        baseline = {
+            "status": "eligible" if report.baseline.eligible else "not_eligible",
+            "reasons": [issue_json(r) for r in report.baseline.reasons],
+        }
+    return {
+        "valid": report.valid,
+        "outcome": str(report.outcome),
+        "files": len(report.files),
+        "planned_manifest_bytes": report.manifest_bytes,
+        "planned_zip_bytes": report.zip_bytes,
+        "metadata": None
+        if report.metadata is None
+        else {"title": report.metadata.title, "display": [d.path for d in report.metadata.display]},
+        "baseline": baseline,
+        "signed_files_ignored": report.signed,
+        "issues": [issue_json(i) for i in report.issues],
+    }
+
+
+def describe(result: Result, report: DraftReport) -> None:
+    data = draft_report_json(report)
+    result.say(f"files:            {data['files']}")
+    result.say(f"planned manifest: {data['planned_manifest_bytes']} bytes")
+    result.say(f"planned ZIP:      {data['planned_zip_bytes']} bytes")
+    if report.valid:
+        result.say("protocol checks:  passed (§§2-4)")
+    else:
+        result.say(f"protocol checks:  {len(report.issues)} problem(s)")
+        result.lines.extend(issue_lines(data["issues"], "    "))
+    baseline = data["baseline"]
+    result.say(f"baseline:         {baseline['status']}")
+    result.lines.extend(issue_lines(baseline.get("reasons", []), "    "))
+    if report.signed:
+        result.say("note: manifest.json/manifest.json.sig present and ignored")
+
+
+def warn_display(result: Result, report: DraftReport) -> None:
+    """Report display images that may not render; they do not change the exit code."""
+    for issue in report.display_warnings:
+        result.warn(f"{issue.file}: display image does not decode: {issue.observed}")
+
+
+def run(args: argparse.Namespace, ctx: Context) -> Result:
+    draft = ctx.resolve(args.dir)
+    if not draft.is_dir():
+        raise CliError("draft_missing", f"{draft} is not a directory", Exit.USAGE, file=str(draft))
+    report = check_draft(draft, ignore=temp_names(draft))
+    result = Result("check")
+    result.data = {"path": str(draft), **draft_report_json(report)}
+    describe(result, report)
+    warn_display(result, report)
+    if report.issues:
+        result.exit_code = exit_for_outcome(report.outcome)
+        result.errors.extend(issue_record(i) for i in report.issues)
+    elif (
+        report.baseline is not None and not report.baseline.eligible and not args.allow_nonbaseline
+    ):
+        result.exit_code = Exit.REFUSED
+        result.errors.extend(issue_record(i) for i in report.baseline.reasons)
+    return result
+
+
+COMMAND = Command(
+    name="check",
+    usage_hint="check DIR [--allow-nonbaseline] [--json]",
+    summary="Check an unsigned draft without signing it.",
+    description="""
+Validates a draft under SCI protocol §§2-4: file paths and conflicts,
+required files, sci.json fields, README/LICENSE text rules, and absence of
+private-key material. Calculates the planned manifest and ZIP sizes with the
+signing serializer and evaluates baseline eligibility (§2.1). All
+independent problems are reported together, each with its file or JSON
+field, requirement, and observed value.
+""",
+    args=(
+        arg("dir", metavar="DIR", help="draft directory (sci.json, README.md, LICENSE, files/)"),
+        arg(
+            "--allow-nonbaseline",
+            action="store_true",
+            help="exit 0 for a protocol-valid draft that is outside the baseline",
+        ),
+    ),
+    outputs="Planned sizes, protocol problems, and baseline eligibility with reasons.",
+    files="None; reads no private key.",
+    network="None.",
+    exit_codes={
+        3: "the draft fails protocol checks",
+        5: "files could not be read or a local limit was exceeded",
+        6: "the draft is valid but not baseline (signing would refuse without override)",
+    },
+    examples=("sci check ./draft",),
+    run=run,
+)

pysci/_cli/commands/claim.py

@@ -0,0 +1,179 @@
+"""``sci claim``: create a signed account claim (§5.2)."""
+
+from __future__ import annotations
+
+import argparse
+import urllib.parse
+from datetime import UTC, datetime
+
+from pysci.accounts import AccountType, claim_urls, normalize_account
+from pysci.errors import SciError
+from pysci.keys import public_key_of
+from pysci.records import DEFAULT_CLAIM_VALIDITY, create_claim, verify_claim
+from pysci.rfc3339 import format_rfc3339, parse_rfc3339
+
+from ..clients.http import Deadline, HttpClient
+from ..context import Context
+from ..errors import CliError, Exit
+from ..output import Result
+from ..spec import Command, arg
+from ..storage.files import atomic_write_bytes
+from ..storage.keys import require_outside
+from .common import KEY_ARG_HELP, signing_key
+
+HF_API = "https://huggingface.co/api"
+
+
+def huggingface_spelling(http: HttpClient, name: str, deadline: Deadline) -> str:
+    """The user or organization name as spelled by the Hub API."""
+    quoted = urllib.parse.quote(name, safe="")
+    for kind, field in (("users", "user"), ("organizations", "name")):
+        response = http.get(f"{HF_API}/{kind}/{quoted}/overview", deadline=deadline)
+        if response.status == 404:
+            continue
+        if response.status != 200:
+            raise CliError(
+                "lookup_failed",
+                f"Hugging Face account lookup returned HTTP {response.status}",
+                Exit.INCOMPLETE,
+                retryable=True,
+            )
+        record = response.json_object("Hugging Face account overview")
+        value = record.get(field)
+        if isinstance(value, str) and value.lower() == name.lower():
+            return value
+        raise CliError(
+            "invalid_response", "Hugging Face overview has no matching name", Exit.INVALID
+        )
+    raise CliError(
+        "account_not_found",
+        f"Hugging Face account {name!r} was not found",
+        Exit.INVALID,
+        observed=name,
+    )
+
+
+def run(args: argparse.Namespace, ctx: Context) -> Result:
+    output = ctx.resolve(args.output)
+    key_path, key, warnings = signing_key(ctx, args)
+    require_outside(key_path, output)
+    try:
+        account = normalize_account(args.type, args.account)
+    except ValueError as exc:
+        raise CliError(
+            "invalid_account",
+            f"{args.type} account {args.account!r}: {exc}",
+            Exit.USAGE,
+            field="/account/id",
+            observed=args.account,
+        ) from None
+    result = Result("claim")
+    result.warnings.extend(warnings)
+    lookup = "not_required"
+    if account.type == AccountType.HUGGINGFACE:
+        if args.no_lookup:
+            lookup = "skipped"
+            result.warn("Hugging Face spelling not checked (--no-lookup)")
+        else:
+            spelled = huggingface_spelling(ctx.http, account.id, ctx.deadline(args.timeout))
+            account = normalize_account(account.type, spelled)
+            lookup = "huggingface_api"
+    now = datetime.now(UTC)
+    if args.expires:
+        try:
+            expires = parse_rfc3339(args.expires)
+        except ValueError as exc:
+            raise CliError(
+                "invalid_expires", f"--expires: {exc}", Exit.USAGE, observed=args.expires
+            ) from None
+        if expires <= now:
+            raise CliError("invalid_expires", "--expires must be in the future", Exit.USAGE)
+    else:
+        expires = now + DEFAULT_CLAIM_VALIDITY
+    if expires - now > DEFAULT_CLAIM_VALIDITY:
+        result.warn("the protocol recommends claims expire within 90 days of signing")
+    try:
+        record = create_claim(key, account, expires=expires, note=args.note, name=args.name)
+    except (ValueError, SciError) as exc:
+        raise CliError("invalid_claim", str(exc), Exit.USAGE) from None
+    public = public_key_of(key)
+    check = verify_claim(
+        record.record, record.signature, expected_public_key=public, requested_account=account
+    )
+    if not check.ok:  # pragma: no cover - library guarantees validity
+        raise CliError("invalid_claim", str(check.issues[0]), Exit.INVALID)
+    output.mkdir(parents=True, exist_ok=True)
+    claim_path = output / f"{public.x}.json"
+    signature_path = output / f"{public.x}.json.sig"
+    renewed = claim_path.exists()
+    atomic_write_bytes(signature_path, record.signature)
+    atomic_write_bytes(claim_path, record.record)
+    locations = [{"claim": c, "signature": s} for c, s in claim_urls(account, public.x)]
+    result.data = {
+        "account": account.to_json(),
+        "public_key": public.to_jwk(),
+        "expires": format_rfc3339(expires),
+        "files": {"claim": str(claim_path), "signature": str(signature_path)},
+        "status": "renewed" if renewed else "created",
+        "lookup": lookup,
+        "hosting_locations": locations,
+    }
+    result.say(f"claim:     {claim_path}")
+    result.say(f"signature: {signature_path}")
+    result.say(f"account:   {account.type}:{account.id} (expires {format_rfc3339(expires)})")
+    result.say("Host both files at" + (" one of:" if len(locations) > 1 else ":"))
+    for location in locations:
+        result.say(f"  {location['claim']}")
+        result.say(f"  {location['signature']}")
+    result.say("These files were not uploaded. Renew before expiry; publications are unchanged.")
+    return result
+
+
+COMMAND = Command(
+    name="claim",
+    usage_hint="claim TYPE ACCOUNT --output DIR [--expires RFC3339] [--key PATH] [--json]",
+    summary="Create a signed account claim.",
+    description="""
+Creates an SCI key claim (protocol §5.2) linking your public key to a domain,
+GitHub account, or Hugging Face user or organization. The account is
+normalized (domains to lowercase IDNA A-labels, GitHub logins to lowercase);
+Hugging Face names take the spelling returned by the Hub API. Writes
+<x>.json and <x>.json.sig and prints where to host them; nothing is
+uploaded. Renewal replaces the claim files, never publication bytes.
+""",
+    args=(
+        arg(
+            "type",
+            metavar="TYPE",
+            choices=("domain", "github", "huggingface"),
+            help="account method: domain, github, or huggingface",
+        ),
+        arg("account", metavar="ACCOUNT", help="domain name, GitHub login, or Hugging Face name"),
+        arg(
+            "--output", metavar="DIR", required=True, help="directory for <x>.json and <x>.json.sig"
+        ),
+        arg("--expires", metavar="RFC3339", help="claim expiry (default: 90 days from now)"),
+        arg(
+            "--name",
+            metavar="TEXT",
+            help="publisher display name, 1-80 Unicode code points",
+        ),
+        arg("--note", metavar="TEXT", help="optional note stored in the signed claim"),
+        arg("--key", metavar="PATH", help=KEY_ARG_HELP),
+        arg(
+            "--no-lookup",
+            action="store_true",
+            help="skip the Hugging Face spelling lookup (the given spelling must be exact)",
+        ),
+    ),
+    outputs="Account, expiry, written files, and the required hosting URLs.",
+    files="Writes DIR/<x>.json and DIR/<x>.json.sig (replacing an earlier claim for the key).",
+    network="Hugging Face accounts: one Hub API lookup unless --no-lookup. Otherwise none.",
+    exit_codes={
+        3: "the Hugging Face account does not exist",
+        5: "the account lookup failed temporarily",
+    },
+    examples=("sci claim domain lab.example --output ./claims",),
+    run=run,
+    timeout=True,
+)

pysci/_cli/commands/common.py

@@ -0,0 +1,91 @@
+"""Helpers shared by several commands."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+from typing import Any
+
+from pysci.errors import SciError
+from pysci.ids import parse_publication_id
+from pysci.timestamps import TrustConfig
+
+from ..clients.http import Deadline
+from ..clients.index import IndexClient
+from ..clients.tsa import build_trust
+from ..config import normalize_origin
+from ..context import Context
+from ..destinations import resolve_archive
+from ..errors import CliError, Exit
+from ..storage.keys import key_permission_warning, load_signing_key, resolve_key_path
+
+
+def looks_like_id(value: str) -> bool:
+    return value.startswith(("sha256:", "sci:sha256:"))
+
+
+def parse_id(value: str) -> str:
+    """Accept ``sha256:<digest>`` or ``sci:sha256:<digest>``; return the bare digest."""
+    try:
+        return parse_publication_id(value)
+    except ValueError as exc:
+        raise CliError(
+            "invalid_id",
+            f"{exc}",
+            Exit.USAGE,
+            observed=value,
+            requirement="sha256:<64 lowercase hex> or sci:sha256:<64 lowercase hex>",
+        ) from None
+
+
+def index_origin(ctx: Context, explicit: str | None, *, option: str = "--to") -> str:
+    if explicit:
+        return normalize_origin(explicit)
+    if ctx.config.index:
+        return ctx.config.index
+    raise CliError(
+        "missing_index",
+        f"no index configured; pass {option} URL or save one with `sci index URL`",
+        Exit.USAGE,
+    )
+
+
+def index_client(ctx: Context, explicit: str | None, *, option: str = "--to") -> IndexClient:
+    return IndexClient(ctx.http, index_origin(ctx, explicit, option=option))
+
+
+def archive_urls(values: list[str] | None) -> list[str]:
+    urls: list[str] = []
+    for value in values or []:
+        url = resolve_archive(value)
+        if url not in urls:
+            urls.append(url)
+    return urls
+
+
+def trust(ctx: Context, *, online: bool = False, deadline: Deadline | None = None) -> TrustConfig:
+    config, warnings = build_trust(
+        ctx.config.timestamp_trust, online=online, http=ctx.http, deadline=deadline
+    )
+    del warnings
+    return config
+
+
+def trust_with_warnings(
+    ctx: Context, *, online: bool = False, deadline: Deadline | None = None
+) -> tuple[TrustConfig, list[str]]:
+    return build_trust(ctx.config.timestamp_trust, online=online, http=ctx.http, deadline=deadline)
+
+
+def signing_key(ctx: Context, args: argparse.Namespace) -> tuple[Path, Any, list[str]]:
+    path = resolve_key_path(getattr(args, "key", None), ctx.config.key, ctx.home)
+    key = load_signing_key(path)
+    warnings = [w for w in [key_permission_warning(path)] if w]
+    return path, key, warnings
+
+
+def sci_failure(exc: SciError, message: str) -> CliError:
+    return CliError.from_sci(exc, message)
+
+
+KEY_ARG_HELP = "private key (PKCS#8 PEM); default: configured key, else <state>/key.pem"

pysci/_cli/commands/folders.py

@@ -0,0 +1,83 @@
+"""``sci folders``: manage the folders selected by ``@local``."""
+
+from __future__ import annotations
+
+import argparse
+import contextlib
+from pathlib import Path
+
+from ..context import Context
+from ..errors import CliError, Exit
+from ..output import Result
+from ..spec import Command, arg
+
+
+def run(args: argparse.Namespace, ctx: Context) -> Result:
+    config = ctx.config
+    result = Result("folders")
+    if args.action is None:
+        if args.dir is not None:
+            raise CliError("invalid_arguments", "use `sci folders add DIR` or `remove DIR`")
+        folders = [{"path": f, "available": Path(f).is_dir()} for f in config.folders]
+        result.data = {"folders": folders}
+        if not folders:
+            result.say("no known folders")
+        for entry in folders:
+            state = "available" if entry["available"] else "unavailable"
+            result.say(f"{entry['path']}  ({state})")
+        return result
+    if args.dir is None:
+        raise CliError("invalid_arguments", f"`sci folders {args.action}` requires DIR")
+    if args.action == "add":
+        folder = ctx.resolve(args.dir)
+        if not folder.is_dir():
+            raise CliError("folder_missing", f"{folder} is not an existing directory", Exit.USAGE)
+        canonical = str(folder.resolve())
+        changed = canonical not in config.folders
+        if changed:
+            config.folders.append(canonical)
+            ctx.save_config()
+        result.data = {"path": canonical, "status": "added" if changed else "unchanged"}
+        result.say(f"{canonical}: {result.data['status']}")
+        return result
+    raw = ctx.resolve(args.dir)
+    candidates = {str(raw.absolute())}
+    with contextlib.suppress(OSError):
+        candidates.add(str(raw.resolve()))
+    removed = [f for f in config.folders if f in candidates]
+    if removed:
+        config.folders = [f for f in config.folders if f not in candidates]
+        ctx.save_config()
+    result.data = {
+        "path": removed[0] if removed else str(raw),
+        "status": "removed" if removed else "unknown",
+    }
+    result.say(
+        f"{result.data['path']}: "
+        + ("forgotten (files were not deleted)" if removed else "not a known folder")
+    )
+    return result
+
+
+COMMAND = Command(
+    name="folders",
+    usage_hint="folders [add DIR | remove DIR] [--json]",
+    summary="Manage the folders selected by @local.",
+    description="""
+Without arguments, lists known folders and whether each is available. `add`
+saves an existing folder's canonical absolute path; `remove` forgets a path
+without deleting any files. Folders are also remembered after an explicit
+local search (`search --in DIR`) and after bundle writes by `sign --output`,
+`pull --zip`, and `publish`. The computer is never scanned for campaigns.
+""",
+    args=(
+        arg("action", metavar="ACTION", nargs="?", choices=("add", "remove"), help="add or remove"),
+        arg("dir", metavar="DIR", nargs="?", help="folder path"),
+    ),
+    outputs="The known folders and their availability, or the change made.",
+    files="`add` and `remove` update config.json; no bundle files are touched.",
+    network="None.",
+    exit_codes={2: "DIR is missing or not a directory"},
+    examples=("sci folders add ./campaign", "sci folders"),
+    run=run,
+)

pysci/_cli/commands/index.py

@@ -0,0 +1,51 @@
+"""``sci index``: show or save the default index origin."""
+
+from __future__ import annotations
+
+import argparse
+
+from ..config import CONFIG_FILE, normalize_origin
+from ..context import Context
+from ..output import Result
+from ..spec import Command, arg
+
+
+def run(args: argparse.Namespace, ctx: Context) -> Result:
+    result = Result("index")
+    config = ctx.config
+    if args.url is None:
+        result.data = {"index": config.index, "config": str(ctx.home / CONFIG_FILE)}
+        result.say(config.index or "no index configured (set one with `sci index URL`)")
+        return result
+    origin = normalize_origin(args.url)
+    changed = config.index != origin
+    config.index = origin
+    if changed:
+        ctx.save_config()
+    result.data = {
+        "index": origin,
+        "status": "saved" if changed else "unchanged",
+        "config": str(ctx.home / CONFIG_FILE),
+    }
+    result.say(f"index: {origin} ({'saved' if changed else 'unchanged'})")
+    return result
+
+
+COMMAND = Command(
+    name="index",
+    usage_hint="index [URL] [--json]",
+    summary="Show or save the default index origin.",
+    description="""
+Without URL, shows the configured index. With URL, saves that HTTPS origin
+(for example https://sciscape.io) as the default for `pull`, `read`,
+`submit`, `timestamp --submit`, `revoke --submit`, and `search --in @index`.
+The origin is not contacted. No public index is selected by default.
+""",
+    args=(arg("url", metavar="URL", nargs="?", help="HTTPS index origin to save"),),
+    outputs="The configured index origin.",
+    files="With URL, updates config.json in the state directory (~/.sci or $SCI_HOME).",
+    network="None.",
+    exit_codes={2: "URL is not an HTTPS origin, or config.json is invalid"},
+    examples=("sci index https://sciscape.io",),
+    run=run,
+)

pysci/_cli/commands/keygen.py

@@ -0,0 +1,58 @@
+"""``sci keygen``: create a signing key pair."""
+
+from __future__ import annotations
+
+import argparse
+
+from ..context import Context
+from ..output import Result
+from ..spec import Command, arg
+from ..storage.keys import create_key_pair, resolve_key_path
+
+
+def run(args: argparse.Namespace, ctx: Context) -> Result:
+    path = resolve_key_path(args.key, None, ctx.home)
+    if args.key is None:
+        ctx.home.mkdir(mode=0o700, parents=True, exist_ok=True)
+    public, public_path = create_key_pair(path)
+    result = Result("keygen")
+    result.data = {
+        "private_key": str(path),
+        "public_key_file": str(public_path),
+        "public_key": public.to_jwk(),
+        "x": public.x,
+    }
+    result.say(f"private key: {path} (owner-only access)")
+    result.say(f"public key:  {public_path}")
+    result.say(f"x:           {public.x}")
+    result.say("Keep the private key outside publication folders and back it up securely.")
+    return result
+
+
+COMMAND = Command(
+    name="keygen",
+    usage_hint="keygen [--key PATH] [--json]",
+    summary="Create an Ed25519 signing key pair.",
+    description="""
+Creates a PKCS#8 private key and a SubjectPublicKeyInfo public key (SCI
+protocol §5.1). The private key file is readable only by its owner. Existing
+files are never overwritten. The public key file name replaces a final .pem
+with .pub.pem, or appends .pub.pem. --key also selects the key for `sign`,
+`claim`, and `revoke`; to make a custom path the default, set "key" in
+config.json.
+""",
+    args=(
+        arg(
+            "--key",
+            metavar="PATH",
+            help="private key path to create (default: <state>/key.pem, state is ~/.sci or "
+            "$SCI_HOME)",
+        ),
+    ),
+    outputs="The public JWK and its x value, and both file paths.",
+    files="Creates PATH (mode 0600) and its .pub.pem companion; rejects existing outputs.",
+    network="None.",
+    exit_codes={2: "an output file already exists or the location is not writable"},
+    examples=("sci keygen", "sci keygen --key ~/keys/lab.pem --json"),
+    run=run,
+)

pysci/_cli/commands/license.py

@@ -0,0 +1,75 @@
+"""``sci license``: install the approved baseline license in a draft."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+
+from pysci.baseline import BASELINE_LICENSE_SHA256, baseline_license_bytes
+from pysci.manifest import LICENSE_PATH, MANIFEST_PATH, SIGNATURE_PATH
+
+from ..context import Context
+from ..errors import CliError, Exit
+from ..output import Result
+from ..spec import Command, arg
+from ..storage.files import store_bytes
+
+
+def run(args: argparse.Namespace, ctx: Context) -> Result:
+    draft = ctx.resolve(args.dir)
+    if not draft.is_dir():
+        raise CliError("draft_missing", f"{draft} is not a directory", Exit.USAGE, file=str(draft))
+    for generated in (MANIFEST_PATH, SIGNATURE_PATH):
+        if (draft / generated).exists():
+            raise CliError(
+                "signed_directory",
+                f"{draft} is signed ({generated} exists); signed publication bytes cannot change",
+                Exit.USAGE,
+                file=str(draft / generated),
+            )
+    target = draft / LICENSE_PATH
+    data = baseline_license_bytes()
+    if target.is_symlink():
+        raise CliError("license_conflict", f"{target} is a symbolic link", Exit.INVALID)
+    stored = store_bytes(target, data)
+    if stored.outcome == "conflict":
+        raise CliError(
+            "license_conflict",
+            f"{target} exists with different terms; it was left unchanged",
+            Exit.INVALID,
+            file=str(target),
+            requirement=f"sha256 {BASELINE_LICENSE_SHA256} (SCI baseline license 0.1)",
+            observed=f"sha256 {stored.existing_sha256}",
+        )
+    result = Result("license")
+    result.data = {
+        "path": str(target),
+        "status": str(stored.outcome),
+        "license": "SCI baseline license 0.1",
+        "sha256": hashlib.sha256(data).hexdigest(),
+    }
+    verb = "installed" if stored.outcome == "written" else "already present"
+    result.say(f"SCI baseline license 0.1 {verb}: {target}")
+    result.say("Terms: CC BY 4.0 for text, figures, and data; MIT for code.")
+    return result
+
+
+COMMAND = Command(
+    name="license",
+    usage_hint="license DIR [--json]",
+    summary="Install the SCI baseline license in a draft.",
+    description="""
+Copies the exact approved baseline license (SCI protocol §2.1: CC BY 4.0 for
+text, figures, and data; MIT for code) to DIR/LICENSE. Running this command
+selects those terms explicitly; signing never inserts a license. An identical
+LICENSE is kept; a different one is rejected and left unchanged. Signed
+directories are rejected.
+""",
+    args=(arg("dir", metavar="DIR", help="unsigned draft directory"),),
+    outputs="The license path, whether it was written or already present, and its SHA-256.",
+    files="Creates DIR/LICENSE if absent.",
+    network="None.",
+    exit_codes={3: "DIR/LICENSE exists with different bytes"},
+    examples=("sci license ./draft",),
+    run=run,
+)