anis-partners 1.0.0__tar.gz

anis_partners-1.0.0/.gitignore

@@ -0,0 +1,12 @@
+.venv/
+__pycache__/
+*.py[cod]
+dist/
+build/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.DS_Store
+.idea/
+.vscode/
+samples/console/work/

anis_partners-1.0.0/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## [1.0.0] - 2026-10-06
+
+First release of `anis-partners`. Partners get signed requests, verified responses, typed models and errors, synchronous and asynchronous operation groups, enrollment support, safe order recovery outcomes, bounded signing-key caching, and tests against the published wire vectors and contracts.

anis_partners-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Aniscom for Technical Services (Anis)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

anis_partners-1.0.0/PKG-INFO

@@ -0,0 +1,126 @@
+Metadata-Version: 2.5
+Name: anis-partners
+Version: 1.0.0
+Summary: The Python SDK for the Anis Partner API — signed requests, verified responses, typed operations.
+Project-URL: Homepage, https://developers.anis.ly
+Project-URL: Documentation, https://developers.anis.ly
+Project-URL: Source, https://github.com/anis-ly/anis.partners-sdk-python
+Project-URL: Issues, https://github.com/anis-ly/anis.partners-sdk-python/issues
+Project-URL: Changelog, https://github.com/anis-ly/anis.partners-sdk-python/blob/main/CHANGELOG.md
+Author-email: "Aniscom for Technical Services (Anis)" <support@anis.ly>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: anis,http-signatures,libya,partner-api,rfc9421,sdk
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Framework :: AsyncIO
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: cryptography>=42
+Requires-Dist: httpx<1,>=0.27
+Requires-Dist: opentelemetry-api>=1.25
+Description-Content-Type: text/markdown
+
+# Anis Partners for Python
+
+The Python client for the Anis Partner API. It signs every request, verifies every response, and gives each operation a typed result. The details that can cause duplicate purchases or expose unverified credentials are handled explicitly: caller-owned order ids, recovery outcomes, and response verification have no silent shortcuts.
+
+> **Disclaimer.** This SDK is an optional helper provided free of charge under the MIT License, "as is", without
+> warranty of any kind. Anis (Aniscom for Technical Services) accepts no responsibility or liability for its use or for
+> any loss arising from it. You remain responsible for your own integration — recording orders before you send them,
+> recovery, key custody and testing. The source code is public: read it to understand exactly what it does before you
+> rely on it. You do not need an SDK — you can integrate directly with the Anis Partner API using the documentation at
+> https://developers.anis.ly.
+
+```bash
+pip install anis-partners
+# or
+uv add anis-partners
+```
+
+- [Getting started](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/getting-started.md) — enrollment, configuration, first call, sync and async use
+- [Orders and recovery](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/orders-and-recovery.md) — read before placing an order
+- [Routes and permissions](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/routes-and-permissions.md) — routes, permissions, bodies, and limits
+- [Errors](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/errors.md) — stable error codes and typed exceptions
+- [Security and key custody](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/security.md)
+- [Observability](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/observability.md)
+- [Signing key cache](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/caching.md) — shared cache for multi-process applications
+- [Runnable sample](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/samples/console/README.md)
+
+## Quick start
+
+```python
+from anis_partners import AnisPartnersClient, ClientOptions, PemP256Signer
+
+options = ClientOptions("https://<authority Anis gave you>")
+signer = PemP256Signer.from_pem_file("/secure/partner-key.pem").for_key("<active key id>")
+
+with AnisPartnersClient(options, signer) as anis:
+    profile = anis.profile.get()
+    wallets = list(anis.wallets.list())  # follows every cursor page
+    print(profile.application.id if profile.application else "No application")
+    print(f"Found {len(wallets)} wallets")
+```
+
+The async client returns the same results. Run the whole flow inside an event loop:
+
+```python
+import asyncio
+
+from anis_partners import AsyncAnisPartnersClient, ClientOptions, PemP256Signer
+
+
+async def main() -> None:
+    options = ClientOptions("https://<authority Anis gave you>")
+    signer = PemP256Signer.from_pem_file("/secure/partner-key.pem").for_key("<active key id>")
+    async with AsyncAnisPartnersClient(options, signer) as anis:
+        profile = await anis.profile.get()
+        wallets = [wallet async for wallet in anis.wallets.list()]
+        print(profile.application.id if profile.application else "No application")
+        print(f"Found {len(wallets)} wallets")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
+```
+
+For order creation and recovery, persist the operation id and exact request before calling the SDK. See [Orders and recovery](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/orders-and-recovery.md) for the complete outcome rules.
+
+## Refusals built into the design
+
+The caller supplies the order id. A dropped answer followed by a new id could buy twice, so the SDK never invents this identity. The five order result types distinguish a completed sale, processing, a replay, a definitive refusal, and an unknown outcome. Only the first completion returns credentials; a replay never repeats them.
+
+An unknown result means the original sale may have completed. Resume with the same id and body. A new purchase uses a new id only after a definitive `OrderNotPlaced` result and a changed intent.
+
+Response verification cannot be disabled. If a read response cannot be verified, its body is discarded and `UnverifiableResponseError` is raised. An unverifiable order answer is `OrderOutcomeUnknown`, because the sale may already have completed.
+
+## What is covered
+
+The SDK covers all 19 published routes across `profile`, `wallets`, `catalogue`, `orders`, `owned_cards`, and `diagnostics`, plus the enrollment client. Public errors are generated from the error catalogue. Request, response, safety-code, and enrollment vectors are tested along with signed in-memory client flows and contract drift checks.
+
+This package follows the published Partner SDK contract. Supported Python versions are 3.11–3.14.
+
+### Live verification
+
+Verified end to end against a live Anis environment (October 2026).
+
+## Regenerating error types
+
+`src/anis_partners/errors/_codes.py` is generated from `contracts/error-catalogue.json`. Regenerate it with:
+
+```bash
+uv run python tools/generate_errors.py
+```
+
+Do not edit the generated file by hand; the contract drift test checks it.
+
+## License
+
+[MIT](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/LICENSE) © 2026 Aniscom for Technical Services (Anis).

anis_partners-1.0.0/README.md

@@ -0,0 +1,96 @@
+# Anis Partners for Python
+
+The Python client for the Anis Partner API. It signs every request, verifies every response, and gives each operation a typed result. The details that can cause duplicate purchases or expose unverified credentials are handled explicitly: caller-owned order ids, recovery outcomes, and response verification have no silent shortcuts.
+
+> **Disclaimer.** This SDK is an optional helper provided free of charge under the MIT License, "as is", without
+> warranty of any kind. Anis (Aniscom for Technical Services) accepts no responsibility or liability for its use or for
+> any loss arising from it. You remain responsible for your own integration — recording orders before you send them,
+> recovery, key custody and testing. The source code is public: read it to understand exactly what it does before you
+> rely on it. You do not need an SDK — you can integrate directly with the Anis Partner API using the documentation at
+> https://developers.anis.ly.
+
+```bash
+pip install anis-partners
+# or
+uv add anis-partners
+```
+
+- [Getting started](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/getting-started.md) — enrollment, configuration, first call, sync and async use
+- [Orders and recovery](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/orders-and-recovery.md) — read before placing an order
+- [Routes and permissions](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/routes-and-permissions.md) — routes, permissions, bodies, and limits
+- [Errors](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/errors.md) — stable error codes and typed exceptions
+- [Security and key custody](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/security.md)
+- [Observability](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/observability.md)
+- [Signing key cache](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/caching.md) — shared cache for multi-process applications
+- [Runnable sample](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/samples/console/README.md)
+
+## Quick start
+
+```python
+from anis_partners import AnisPartnersClient, ClientOptions, PemP256Signer
+
+options = ClientOptions("https://<authority Anis gave you>")
+signer = PemP256Signer.from_pem_file("/secure/partner-key.pem").for_key("<active key id>")
+
+with AnisPartnersClient(options, signer) as anis:
+    profile = anis.profile.get()
+    wallets = list(anis.wallets.list())  # follows every cursor page
+    print(profile.application.id if profile.application else "No application")
+    print(f"Found {len(wallets)} wallets")
+```
+
+The async client returns the same results. Run the whole flow inside an event loop:
+
+```python
+import asyncio
+
+from anis_partners import AsyncAnisPartnersClient, ClientOptions, PemP256Signer
+
+
+async def main() -> None:
+    options = ClientOptions("https://<authority Anis gave you>")
+    signer = PemP256Signer.from_pem_file("/secure/partner-key.pem").for_key("<active key id>")
+    async with AsyncAnisPartnersClient(options, signer) as anis:
+        profile = await anis.profile.get()
+        wallets = [wallet async for wallet in anis.wallets.list()]
+        print(profile.application.id if profile.application else "No application")
+        print(f"Found {len(wallets)} wallets")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
+```
+
+For order creation and recovery, persist the operation id and exact request before calling the SDK. See [Orders and recovery](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/docs/orders-and-recovery.md) for the complete outcome rules.
+
+## Refusals built into the design
+
+The caller supplies the order id. A dropped answer followed by a new id could buy twice, so the SDK never invents this identity. The five order result types distinguish a completed sale, processing, a replay, a definitive refusal, and an unknown outcome. Only the first completion returns credentials; a replay never repeats them.
+
+An unknown result means the original sale may have completed. Resume with the same id and body. A new purchase uses a new id only after a definitive `OrderNotPlaced` result and a changed intent.
+
+Response verification cannot be disabled. If a read response cannot be verified, its body is discarded and `UnverifiableResponseError` is raised. An unverifiable order answer is `OrderOutcomeUnknown`, because the sale may already have completed.
+
+## What is covered
+
+The SDK covers all 19 published routes across `profile`, `wallets`, `catalogue`, `orders`, `owned_cards`, and `diagnostics`, plus the enrollment client. Public errors are generated from the error catalogue. Request, response, safety-code, and enrollment vectors are tested along with signed in-memory client flows and contract drift checks.
+
+This package follows the published Partner SDK contract. Supported Python versions are 3.11–3.14.
+
+### Live verification
+
+Verified end to end against a live Anis environment (October 2026).
+
+## Regenerating error types
+
+`src/anis_partners/errors/_codes.py` is generated from `contracts/error-catalogue.json`. Regenerate it with:
+
+```bash
+uv run python tools/generate_errors.py
+```
+
+Do not edit the generated file by hand; the contract drift test checks it.
+
+## License
+
+[MIT](https://github.com/anis-ly/anis.partners-sdk-python/blob/main/LICENSE) © 2026 Aniscom for Technical Services (Anis).

anis_partners-1.0.0/contracts/error-catalogue.json

@@ -0,0 +1,271 @@
+{
+  "description": "Reduced copy of the Anis Partner API error catalogue: the public codes only, with their HTTP status, whether they are retryable and the retry guidance. Every code is documented at https://developers.anis.ly.",
+  "representations": [
+    {
+      "publicCode": "invalid_credentials",
+      "httpStatus": 401,
+      "retryable": false,
+      "retryGuidance": "Correct the signing credentials or profile before retrying; key and application state details are intentionally indistinguishable.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "signature_expired",
+      "httpStatus": 401,
+      "retryable": true,
+      "retryGuidance": "Reserved: the current API never sends this code. A signature outside its validity window is answered invalid_credentials (401); sign again with current timestamps.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "invalid_content_digest",
+      "httpStatus": 400,
+      "retryable": false,
+      "retryGuidance": "Reserved: the current API never sends this code. A Content-Digest that does not match the body is answered malformed_signed_request (400).",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "malformed_signed_request",
+      "httpStatus": 400,
+      "retryable": false,
+      "retryGuidance": "Rebuild how the request is signed: send both Signature and Signature-Input, cover the required components in the documented order, send every header the route requires, and compute Content-Digest over the exact body bytes. Repeating the same request unchanged fails the same way.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "replay_detected",
+      "httpStatus": 409,
+      "retryable": true,
+      "retryGuidance": "Use a fresh nonce and signature while preserving the idempotency key for the same business intent.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "source_ip_not_allowed",
+      "httpStatus": 403,
+      "retryable": false,
+      "retryGuidance": "Anis network protection blocked this source address. Contact Anis support with the address if it should be allowed.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "insufficient_scope",
+      "httpStatus": 403,
+      "retryable": false,
+      "retryGuidance": "The application is not permitted to make this call: check that it holds the permission the call needs and that you call from a network agreed with Anis, then ask Anis staff to change either.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "binding_not_authorized",
+      "httpStatus": 403,
+      "retryable": false,
+      "retryGuidance": "Restore the directly owned active account and Business subscription before making a new request.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "resource_not_found",
+      "httpStatus": 404,
+      "retryable": false,
+      "retryGuidance": "Verify the resource identifier and application ownership; inaccessible resources are intentionally indistinguishable from absence.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "card_not_found",
+      "httpStatus": 404,
+      "retryable": false,
+      "retryGuidance": "Verify the sold-card identifier and wallet; absent and inaccessible single cards return the same representation.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "wallet_not_granted",
+      "httpStatus": 404,
+      "retryable": false,
+      "retryGuidance": "Obtain an approved current wallet grant before making a new request.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "validation_failed",
+      "httpStatus": 422,
+      "retryable": false,
+      "retryGuidance": "The response never names the field: check the request against the documented rules before sending it again. How the request is sent counts too: a body over 64 KB, a chunked body (send Content-Length instead), headers over 32 KB in total, a path and query over 2,048 characters, a body on a call that takes none, or an order whose Idempotency-Key is missing or is not a UUID written with hyphens.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "idempotency_conflict",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Reuse the key only for identical intent; use a new UUID only for a genuinely new operation.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "operation_processing",
+      "httpStatus": 202,
+      "retryable": true,
+      "retryGuidance": "Not an error: the order was accepted and is still being processed. Wait for the Retry-After delay, then repeat the identical POST with the same Idempotency-Key.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "allowed_debt_consent_required",
+      "httpStatus": 402,
+      "retryable": false,
+      "retryGuidance": "Submit a new operation with explicit allowed-debt consent if the Partner intends to use debt.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "insufficient_balance",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Submit a new operation only after the authoritative balance or allowed-debt state changes.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "purchase_not_allowed",
+      "httpStatus": 403,
+      "retryable": false,
+      "retryGuidance": "The owner policy forbids this purchase; obtain authorization before submitting a new operation.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "purchase_not_allowed",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "The request conflicts with current owner business state; submit a new operation only after that state changes.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "owner_limit_exceeded",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Do not poll; submit a new operation and idempotency key only after the owner allowance is known to have changed.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "daily_limit_exceeded",
+      "httpStatus": 429,
+      "retryable": false,
+      "retryGuidance": "No reset time is available; submit a new operation and idempotency key only after the limit condition is known to have cleared.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "rate_limited",
+      "httpStatus": 429,
+      "retryable": true,
+      "retryGuidance": "honour Retry-After when present; otherwise use bounded exponential backoff.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "wallet_disabled",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Submit a new request only after the wallet has been re-enabled.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "wallet_expired",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Submit a new request only after the account or Business subscription expiry is resolved.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "business_subscription_required",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Restore an active Business subscription before making a new request.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "account_inactive",
+      "httpStatus": 403,
+      "retryable": false,
+      "retryGuidance": "Confirm or re-enable the owner account before making a new request.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "currency_not_supported",
+      "httpStatus": 422,
+      "retryable": false,
+      "retryGuidance": "Use the currency required by the authoritative wallet and Catalogue contract.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "card_unavailable",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Refresh Catalogue data and submit a new operation if the item becomes available.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "quantity_unavailable",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Refresh Catalogue data or submit a new operation with an available quantity.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "price_changed",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Refresh the current price and explicitly accept it in a new operation.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "reveal_not_allowed",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "The card-level reveal predicate refused disclosure; do not retry until the card state is known to have changed.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "invoice_reveal_limit_exceeded",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Use individual reveal for selected cards; invoice reveal is capped at 100.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "invitation_invalid",
+      "httpStatus": 401,
+      "retryable": false,
+      "retryGuidance": "Obtain a new enrollment invitation through the approved staff process.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "challenge_expired",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "Restart enrollment through the approved staff action and use the new challenge generation.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "key_proof_invalid",
+      "httpStatus": 422,
+      "retryable": false,
+      "retryGuidance": "Correct the P-256/P1363 proof for the active challenge generation.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "key_duplicate",
+      "httpStatus": 409,
+      "retryable": false,
+      "retryGuidance": "This invitation already took a key, so a newly generated key pair is refused too. Read the enrolment status first; to enrol a different key, ask Anis staff to restart the enrolment.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "dependency_unavailable",
+      "httpStatus": 503,
+      "retryable": true,
+      "retryGuidance": "Retry with the same idempotency key for the same mutation intent after bounded backoff.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "request_timeout",
+      "httpStatus": 504,
+      "retryable": true,
+      "retryGuidance": "Inspect operation status or repeat the identical request with the same idempotency key.",
+      "publicDocumentation": true
+    },
+    {
+      "publicCode": "internal_error",
+      "httpStatus": 500,
+      "retryable": true,
+      "retryGuidance": "Preserve the same accepted operation and idempotency key; retry only after bounded backoff or platform remediation.",
+      "publicDocumentation": true
+    }
+  ]
+}