truss-sdk 0.1.0__py3-none-any.whl

truss_sdk/__init__.py

@@ -0,0 +1,30 @@
+from .crypto import generate_keypair, sign_payload, verify_signature
+from .client import TrussClient, ActionContext
+from .models import (
+    Keypair,
+    Mandate,
+    ActionRecord,
+    IssuingPrincipal,
+    Scope,
+    JurisdictionContext,
+    Validity,
+    JurisdictionEvaluation,
+    JurisdictionFlag,
+)
+
+__all__ = [
+    "generate_keypair",
+    "sign_payload",
+    "verify_signature",
+    "TrussClient",
+    "ActionContext",
+    "Keypair",
+    "Mandate",
+    "ActionRecord",
+    "IssuingPrincipal",
+    "Scope",
+    "JurisdictionContext",
+    "Validity",
+    "JurisdictionEvaluation",
+    "JurisdictionFlag",
+]

truss_sdk/client.py

@@ -0,0 +1,178 @@
+import json
+import uuid
+from datetime import datetime, timezone
+from urllib.request import Request, urlopen
+from urllib.error import HTTPError
+from typing import Optional
+from .crypto import sign_payload, generate_keypair
+from .models import Keypair
+
+
+class TrussClientError(Exception):
+    pass
+
+
+class TrussClient:
+    def __init__(
+        self,
+        api_key: str,
+        base_url: str = "http://localhost:4000",
+        agent_id: Optional[str] = None,
+    ):
+        self.api_key = api_key
+        self.base_url = base_url.rstrip("/")
+        self.agent_id = agent_id
+
+    @staticmethod
+    def generate_keypair() -> Keypair:
+        return generate_keypair()
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        body: Optional[dict] = None,
+    ) -> dict:
+        url = f"{self.base_url}{path}"
+        headers = {
+            "Authorization": f"Bearer {self.api_key}",
+            "Content-Type": "application/json",
+        }
+        data = json.dumps(body, separators=(",", ":"), sort_keys=True).encode("utf-8") if body else None
+        req = Request(url, data=data, headers=headers, method=method)
+        try:
+            with urlopen(req) as resp:
+                return json.loads(resp.read().decode("utf-8"))
+        except HTTPError as e:
+            error_body = e.read().decode("utf-8")
+            raise TrussClientError(
+                f"HTTP {e.code}: {error_body}"
+            ) from e
+
+    def create_mandate(
+        self,
+        mandate_id: str,
+        agent_id: str,
+        agent_name: str,
+        issuing_principal: dict,
+        scope: dict,
+        jurisdiction_context: dict,
+        validity: dict,
+        private_key: str,
+    ) -> dict:
+        body = {
+            "mandate_id": mandate_id,
+            "agent_id": agent_id,
+            "agent_name": agent_name,
+            "issuing_principal": issuing_principal,
+            "scope": scope,
+            "jurisdiction_context": jurisdiction_context,
+            "validity": validity,
+            "version": "1.0",
+            "issuer_public_key": "",
+            "signature": "",
+        }
+        sig_payload = {k: v for k, v in body.items() if k != "signature"}
+        body["signature"] = sign_payload(sig_payload, private_key)
+        return self._request("POST", "/mandates", body)
+
+    def record_action(
+        self,
+        record_id: str,
+        mandate_id: str,
+        action_type: str,
+        timestamp: str,
+        agent_id: str,
+        input_hash: str,
+        output_hash: str,
+        chain_position: int,
+        prev_record_hash: Optional[str],
+        private_key: str,
+    ) -> dict:
+        body = {
+            "record_id": record_id,
+            "mandate_id": mandate_id,
+            "action_type": action_type,
+            "timestamp": timestamp,
+            "agent_id": agent_id,
+            "input_hash": input_hash,
+            "output_hash": output_hash,
+            "chain_position": chain_position,
+            "prev_record_hash": prev_record_hash,
+            "within_mandate": True,
+            "signature": "",
+        }
+        sig_payload = {k: v for k, v in body.items() if k != "signature"}
+        body["signature"] = sign_payload(sig_payload, private_key)
+        return self._request("POST", "/actions", body)
+
+    def get_mandate(self, mandate_id: str) -> dict:
+        return self._request("GET", f"/mandates/{mandate_id}")
+
+    def get_action(self, record_id: str) -> dict:
+        return self._request("GET", f"/actions/{record_id}")
+
+    def get_mandate_chain(self, mandate_id: str) -> dict:
+        return self._request("GET", f"/mandates/{mandate_id}/chain")
+
+    def action(
+        self,
+        action_type: str,
+        mandate_id: str,
+        private_key: str,
+    ) -> "ActionContext":
+        return ActionContext(
+            client=self,
+            action_type=action_type,
+            mandate_id=mandate_id,
+            private_key=private_key,
+        )
+
+
+class ActionContext:
+    def __init__(
+        self,
+        client: TrussClient,
+        action_type: str,
+        mandate_id: str,
+        private_key: str,
+    ):
+        self._client = client
+        self._action_type = action_type
+        self._mandate_id = mandate_id
+        self._private_key = private_key
+        self._input_hash: Optional[str] = None
+        self._output_hash: Optional[str] = None
+
+    def record_input(self, input_hash: str) -> None:
+        self._input_hash = input_hash
+
+    def record_output(self, output_hash: str) -> None:
+        self._output_hash = output_hash
+
+    def commit(
+        self,
+        agent_id: str,
+        chain_position: int,
+        prev_record_hash: Optional[str],
+    ) -> dict:
+        if self._input_hash is None:
+            raise TrussClientError("input_hash not set. Call record_input() before commit.")
+        if self._output_hash is None:
+            raise TrussClientError("output_hash not set. Call record_output() before commit.")
+
+        record_id = f"act_{uuid.uuid4().hex[:24]}"
+        timestamp = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+        return self._client.record_action(
+            record_id=record_id,
+            mandate_id=self._mandate_id,
+            action_type=self._action_type,
+            timestamp=timestamp,
+            agent_id=agent_id,
+            input_hash=self._input_hash,
+            output_hash=self._output_hash,
+            chain_position=chain_position,
+            prev_record_hash=prev_record_hash,
+            private_key=self._private_key,
+        )

truss_sdk/crypto.py

@@ -0,0 +1,47 @@
+import json
+from nacl.signing import SigningKey, VerifyKey
+from nacl.encoding import HexEncoder
+from nacl.exceptions import BadSignatureError
+from .models import Keypair
+
+
+def generate_keypair() -> Keypair:
+    signing_key = SigningKey.generate()
+    public_key = signing_key.verify_key.encode(encoder=HexEncoder).decode("ascii")
+    seed = signing_key.encode(encoder=HexEncoder).decode("ascii")
+    private_key = seed + public_key
+    return Keypair(public_key=public_key, private_key=private_key)
+
+
+def _canonical_json(payload: dict) -> bytes:
+    return json.dumps(payload, separators=(",", ":"), sort_keys=True).encode("utf-8")
+
+
+def _hex_to_seed(key_hex: str) -> bytes:
+    raw = bytes.fromhex(key_hex)
+    if len(raw) == 32:
+        return raw
+    if len(raw) == 64:
+        return raw[:32]
+    raise ValueError(
+        f"Invalid key length: expected 32 or 64 bytes, got {len(raw)}"
+    )
+
+
+def sign_payload(payload: dict, private_key_hex: str) -> str:
+    canonical = _canonical_json(payload)
+    seed = _hex_to_seed(private_key_hex)
+    signing_key = SigningKey(seed)
+    signed = signing_key.sign(canonical)
+    return signed.signature.hex()
+
+
+def verify_signature(payload: dict, signature_hex: str, public_key_hex: str) -> bool:
+    canonical = _canonical_json(payload)
+    signature = bytes.fromhex(signature_hex)
+    verify_key = VerifyKey(public_key_hex, encoder=HexEncoder)
+    try:
+        verify_key.verify(canonical, signature)
+        return True
+    except BadSignatureError:
+        return False

truss_sdk/models.py

@@ -0,0 +1,85 @@
+from dataclasses import dataclass, field
+from typing import Optional
+
+
+@dataclass
+class Keypair:
+    public_key: str
+    private_key: str
+
+
+@dataclass
+class IssuingPrincipal:
+    entity: str
+    human_id: str
+    role: str
+
+
+@dataclass
+class Scope:
+    permitted_actions: list[str]
+    forbidden_actions: list[str] = field(default_factory=list)
+    permitted_data_classes: list[str] = field(default_factory=list)
+    max_delegation_depth: int = 0
+    resource_bounds: list[str] = field(default_factory=list)
+
+
+@dataclass
+class JurisdictionContext:
+    deploying_org_jurisdiction: str
+    operating_jurisdictions: list[str]
+    regulatory_frameworks: list[str] = field(default_factory=list)
+
+
+@dataclass
+class Validity:
+    issued_at: str
+    expires_at: str
+    single_use: bool = False
+
+
+@dataclass
+class Mandate:
+    mandate_id: str
+    version: str
+    agent_id: str
+    agent_name: str
+    issuing_principal: IssuingPrincipal
+    scope: Scope
+    jurisdiction_context: JurisdictionContext
+    validity: Validity
+    signature: str
+    issuer_public_key: str
+
+
+@dataclass
+class JurisdictionFlag:
+    framework: str
+    obligation: str
+    severity: str
+    article: Optional[str] = None
+    guidance: Optional[str] = None
+
+
+@dataclass
+class JurisdictionEvaluation:
+    evaluated_at: str
+    frameworks_applied: list[str] = field(default_factory=list)
+    status: str = "unknown"
+    flags: list[JurisdictionFlag] = field(default_factory=list)
+
+
+@dataclass
+class ActionRecord:
+    record_id: str
+    mandate_id: str
+    action_type: str
+    timestamp: str
+    agent_id: str
+    input_hash: str
+    output_hash: str
+    within_mandate: bool = True
+    jurisdiction_evaluation: Optional[JurisdictionEvaluation] = None
+    chain_position: int = 0
+    prev_record_hash: Optional[str] = None
+    signature: str = ""

truss_sdk-0.1.0.dist-info/METADATA

@@ -0,0 +1,10 @@
+Metadata-Version: 2.4
+Name: truss-sdk
+Version: 0.1.0
+Summary: Python SDK for the Truss trust infrastructure API
+License: Apache-2.0
+Requires-Python: >=3.9
+Requires-Dist: pynacl>=1.6
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: pytest-mock>=3; extra == "dev"

truss_sdk-0.1.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+truss_sdk/__init__.py,sha256=OzGHyEwhqfoDcQdop3mx_aZuqRu3KYDvEps09HxjF0I,613
+truss_sdk/client.py,sha256=S1YLjs5KLlDny2cuauORCvxmxipINiN428aiVJQ2C4I,5528
+truss_sdk/crypto.py,sha256=dFdEyMCGbofAUwEsGTOiRMPZpt2BPuJM3BTZ25cIOQo,1517
+truss_sdk/models.py,sha256=aaBu_DtJKcWI6t0S_geL9ZvVhYNsVu4vJo5nErV2b28,1813
+truss_sdk-0.1.0.dist-info/METADATA,sha256=dJy2viOivfOVHWYyGyE12tg7HadHMWmQylJ-9vL7uaQ,289
+truss_sdk-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+truss_sdk-0.1.0.dist-info/top_level.txt,sha256=aM4ULz8m7W-gNF8EaYRGi9hojX-hd3tLubapTjs1yVA,10
+truss_sdk-0.1.0.dist-info/RECORD,,

truss_sdk-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

truss_sdk-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+truss_sdk