Metadata-Version: 2.4
Name: juntai-iam-contracts
Version: 1.1.1
Summary: Language-neutral schemas and conformance fixtures for Juntai peer-principal IAM
Author: Juntai Platform Team
License-Expression: Apache-2.0
Project-URL: Homepage, https://github.com/zephytiju/JuntaiIAMContracts
Project-URL: Repository, https://github.com/zephytiju/JuntaiIAMContracts.git
Project-URL: Issues, https://github.com/zephytiju/JuntaiIAMContracts/issues
Keywords: iam,json-schema,casdoor,delegation,agent
Classifier: Development Status :: 4 - Beta
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Typing :: Typed
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Provides-Extra: test
Requires-Dist: build==1.3.0; extra == "test"
Requires-Dist: jsonschema[format]<5.0.0,>=4.23.0; extra == "test"
Requires-Dist: pytest<9.0.0,>=8.3.0; extra == "test"
Requires-Dist: ruff<1.0.0,>=0.12.0; extra == "test"
Dynamic: license-file

# Juntai IAM Contracts

juntai-iam-contracts is the language-neutral schema and conformance
publication for Juntai peer-principal IAM. Humans, agents, and services are
durable authorization peers. Authenticators, sessions, credentials, workloads,
delegators, and channels remain separate context.

The package publishes JSON Schema Draft 2020-12 definitions for:

- Principal/v2, AgentPrincipal/v1, and AuthenticatorBinding/v1;
- DelegationGrant/v1, including user consent and operator creation evidence;
- IdentityContext/v2, safe principal presentation, and assisting-agent views;
- agent credential claims and audience-narrowing requests;
- protected-resource metadata for remote MCP and ordinary APIs;
- common evaluation requests, authorization decisions, and stable errors; and
- the exact unmodified Casdoor 3.125 AgentPrincipal record mapping. Casdoor
  preserves the Application as token `sub`, emits its public `clientId` as
  both `azp` and standard credential `aud`, and emits the logical platform
  audience, resource, and binding attributes through native `JWT-Custom`
  `JwtItem[]` configuration; the secret is never part of the contract.

The contracts/fixtures documents and
contracts/conformance/authorization-cases.v1.json are canonical
cross-language inputs. In delegated mode, evaluators must use current grantor
authority intersected with the exact live grant and all remaining ceilings.
Agent self grants are absent from that equation and must never be unioned.

This repository contains no listener, token issuer, network client, secret,
database, policy or grant store, administration workflow, runtime registry,
domain resource vocabulary, or authorization implementation. Casdoor owns
durable persistence and primary OAuth issuance. Enforcement libraries and
domains consume this exact release.

## Install and verify

The wheel is a convenient immutable transport for the same neutral JSON files.
Install version 1.1.1, install the test extra, then run ruff, pytest, and build.

Every release records schema and fixture SHA-256 checksums. Consumers must pin
one immutable version and reject unsupported schemaVersion values.
