contextwall-sdk 0.1.1__py3-none-any.whl

contextwall_sdk/__init__.py

@@ -0,0 +1,59 @@
+"""CRE SDK - drop-in context firewall for Anthropic and OpenAI agents.
+
+Quick start::
+
+    pip install 'contextwall-sdk[anthropic]'
+
+    from contextwall_sdk import SafeAnthropic, CREBlockedError
+
+    client = SafeAnthropic()   # reads CRE_KEY and CRE_URL from env
+
+    try:
+        response = client.messages.create(
+            model="claude-opus-4-5",
+            max_tokens=1024,
+            messages=[{"role": "user", "content": "Hello"}],
+        )
+    except CREBlockedError as e:
+        print(f"Blocked: {e.violations}")
+
+Provisioning a key (admin)::
+
+    from contextwall_sdk import CREClient
+
+    cre = CREClient(api_key="...", base_url="http://localhost:8080")
+    result = cre.keys.create(
+        project_id="my-agent",
+        upstream_key="sk-ant-...",
+    )
+    print(result.key)   # sk-cre-xxx  - store this securely
+"""
+
+from .exceptions import CREError, CREBlockedError, CREUnavailableError, CREAuthError
+from ._anthropic import SafeAnthropic, AsyncSafeAnthropic
+from ._openai import SafeOpenAI, AsyncSafeOpenAI
+from .client import CREClient, AsyncCREClient, Source, ProxyKeyResult, HealthStatus, AnalyticsSummary
+
+__version__ = "0.1.0"
+
+__all__ = [
+    # Exceptions
+    "CREError",
+    "CREBlockedError",
+    "CREUnavailableError",
+    "CREAuthError",
+    # Anthropic wrappers
+    "SafeAnthropic",
+    "AsyncSafeAnthropic",
+    # OpenAI wrappers
+    "SafeOpenAI",
+    "AsyncSafeOpenAI",
+    # Admin client
+    "CREClient",
+    "AsyncCREClient",
+    # Response models
+    "Source",
+    "ProxyKeyResult",
+    "HealthStatus",
+    "AnalyticsSummary",
+]

contextwall_sdk/_anthropic.py

@@ -0,0 +1,269 @@
+"""SafeAnthropic - drop-in Anthropic client with CRE enforcement.
+
+Usage::
+
+    # Before
+    import anthropic
+    client = anthropic.Anthropic(api_key="sk-ant-...")
+
+    # After (one line change, everything else identical)
+    from contextwall_sdk import SafeAnthropic
+    client = SafeAnthropic(cre_key="sk-cre-...", cre_url="http://localhost:8080")
+
+    # Same API
+    response = client.messages.create(
+        model="claude-opus-4-5",
+        max_tokens=1024,
+        messages=[{"role": "user", "content": "Hello"}],
+    )
+
+Environment variables (no code changes needed)::
+
+    CRE_KEY=sk-cre-...
+    CRE_URL=http://localhost:8080
+
+    from contextwall_sdk import SafeAnthropic
+    client = SafeAnthropic()  # reads from env
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Any, Iterator, AsyncIterator
+
+from .exceptions import CREBlockedError, CREUnavailableError, CREAuthError
+
+
+def _check_cre_block(body: Any) -> None:
+    """Raise CREBlockedError if the response body is a CRE policy violation."""
+    if not isinstance(body, dict):
+        return
+    err = body.get("error", {})
+    if isinstance(err, dict) and err.get("type") == "cre_policy_violation":
+        raise CREBlockedError(
+            blocked_reason=err.get("message", "policy violation"),
+            violations=err.get("violations", []),
+            raw_body=body,
+        )
+
+
+def _wrap_exception(exc: Exception, cre_url: str) -> None:
+    """Convert underlying SDK exceptions into CRE-specific ones where applicable."""
+    try:
+        import httpx
+        if isinstance(exc, httpx.ConnectError):
+            raise CREUnavailableError(cre_url, cause=exc) from exc
+    except ImportError:
+        pass
+
+    # Anthropic SDK exception inspection
+    exc_type = type(exc).__name__
+    if exc_type in ("AuthenticationError",):
+        raise CREAuthError() from exc
+
+    if exc_type in ("BadRequestError", "APIStatusError"):
+        body = getattr(exc, "body", None)
+        _check_cre_block(body)
+
+
+class _StreamContextWrapper:
+    """Wraps an Anthropic stream context manager to catch CRE blocks on entry."""
+
+    def __init__(self, stream_cm: Any, cre_url: str) -> None:
+        self._cm = stream_cm
+        self._cre_url = cre_url
+
+    def __enter__(self) -> Any:
+        try:
+            return self._cm.__enter__()
+        except Exception as exc:
+            _wrap_exception(exc, self._cre_url)
+            raise
+
+    def __exit__(self, *args: Any) -> Any:
+        return self._cm.__exit__(*args)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._cm, name)
+
+
+class _AsyncStreamContextWrapper:
+    def __init__(self, stream_cm: Any, cre_url: str) -> None:
+        self._cm = stream_cm
+        self._cre_url = cre_url
+
+    async def __aenter__(self) -> Any:
+        try:
+            return await self._cm.__aenter__()
+        except Exception as exc:
+            _wrap_exception(exc, self._cre_url)
+            raise
+
+    async def __aexit__(self, *args: Any) -> Any:
+        return await self._cm.__aexit__(*args)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._cm, name)
+
+
+class _MessagesWrapper:
+    """Wraps anthropic.resources.Messages to surface CRE-specific errors."""
+
+    def __init__(self, messages: Any, cre_url: str, fallback: bool) -> None:
+        self._messages = messages
+        self._cre_url = cre_url
+        self._fallback = fallback
+
+    def create(self, **kwargs: Any) -> Any:
+        try:
+            return self._messages.create(**kwargs)
+        except Exception as exc:
+            _wrap_exception(exc, self._cre_url)
+            raise
+
+    def stream(self, **kwargs: Any) -> _StreamContextWrapper:
+        # stream() returns a context manager; errors from CRE surface on __enter__
+        return _StreamContextWrapper(self._messages.stream(**kwargs), self._cre_url)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._messages, name)
+
+
+class _AsyncMessagesWrapper:
+    def __init__(self, messages: Any, cre_url: str, fallback: bool) -> None:
+        self._messages = messages
+        self._cre_url = cre_url
+        self._fallback = fallback
+
+    async def create(self, **kwargs: Any) -> Any:
+        try:
+            return await self._messages.create(**kwargs)
+        except Exception as exc:
+            _wrap_exception(exc, self._cre_url)
+            raise
+
+    def stream(self, **kwargs: Any) -> _AsyncStreamContextWrapper:
+        return _AsyncStreamContextWrapper(self._messages.stream(**kwargs), self._cre_url)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._messages, name)
+
+
+class SafeAnthropic:
+    """Drop-in replacement for ``anthropic.Anthropic`` with CRE enforcement.
+
+    Args:
+        cre_key:               Your ``sk-cre-xxx`` key. Falls back to
+                               ``CRE_KEY`` then ``ANTHROPIC_API_KEY`` env vars.
+        cre_url:               CRE daemon URL. Falls back to ``CRE_URL`` env var,
+                               then ``http://localhost:8080``.
+        fallback_on_unavailable: If True and CRE is unreachable, raises
+                               ``CREUnavailableError`` (default False = fail fast).
+        **kwargs:              Passed through to ``anthropic.Anthropic()``.
+
+    Raises:
+        CREBlockedError:       When CRE blocks the request (policy violation).
+        CREUnavailableError:   When CRE cannot be reached (and fallback is off).
+        CREAuthError:          When the CRE key is rejected.
+        ImportError:           If ``anthropic`` package is not installed.
+    """
+
+    def __init__(
+        self,
+        cre_key: str | None = None,
+        cre_url: str | None = None,
+        fallback_on_unavailable: bool = False,
+        **kwargs: Any,
+    ) -> None:
+        try:
+            import anthropic
+        except ImportError as e:
+            raise ImportError(
+                "anthropic package is required: pip install 'contextwall-sdk[anthropic]'"
+            ) from e
+
+        self._cre_url = (
+            cre_url or os.environ.get("CRE_URL") or "http://localhost:8080"
+        ).rstrip("/")
+        self._fallback = fallback_on_unavailable
+
+        key = (
+            cre_key
+            or os.environ.get("CRE_KEY")
+            or os.environ.get("ANTHROPIC_API_KEY")
+            or ""
+        )
+
+        self._client = anthropic.Anthropic(
+            api_key=key,
+            base_url=f"{self._cre_url}/proxy/anthropic",
+            **kwargs,
+        )
+
+    @property
+    def messages(self) -> _MessagesWrapper:
+        return _MessagesWrapper(self._client.messages, self._cre_url, self._fallback)
+
+    @property
+    def beta(self) -> Any:
+        return self._client.beta
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._client, name)
+
+
+class AsyncSafeAnthropic:
+    """Async version of SafeAnthropic. Drop-in for ``anthropic.AsyncAnthropic``.
+
+    Example::
+
+        client = AsyncSafeAnthropic()
+        response = await client.messages.create(
+            model="claude-opus-4-5",
+            max_tokens=1024,
+            messages=[{"role": "user", "content": "Hello"}],
+        )
+    """
+
+    def __init__(
+        self,
+        cre_key: str | None = None,
+        cre_url: str | None = None,
+        fallback_on_unavailable: bool = False,
+        **kwargs: Any,
+    ) -> None:
+        try:
+            import anthropic
+        except ImportError as e:
+            raise ImportError(
+                "anthropic package is required: pip install 'contextwall-sdk[anthropic]'"
+            ) from e
+
+        self._cre_url = (
+            cre_url or os.environ.get("CRE_URL") or "http://localhost:8080"
+        ).rstrip("/")
+        self._fallback = fallback_on_unavailable
+
+        key = (
+            cre_key
+            or os.environ.get("CRE_KEY")
+            or os.environ.get("ANTHROPIC_API_KEY")
+            or ""
+        )
+
+        self._client = anthropic.AsyncAnthropic(
+            api_key=key,
+            base_url=f"{self._cre_url}/proxy/anthropic",
+            **kwargs,
+        )
+
+    @property
+    def messages(self) -> _AsyncMessagesWrapper:
+        return _AsyncMessagesWrapper(self._client.messages, self._cre_url, self._fallback)
+
+    @property
+    def beta(self) -> Any:
+        return self._client.beta
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._client, name)

contextwall_sdk/_openai.py

@@ -0,0 +1,268 @@
+"""SafeOpenAI - drop-in OpenAI client with CRE enforcement.
+
+Usage::
+
+    # Before
+    import openai
+    client = openai.OpenAI(api_key="sk-...")
+
+    # After (one line change)
+    from contextwall_sdk import SafeOpenAI
+    client = SafeOpenAI(cre_key="sk-cre-...", cre_url="http://localhost:8080")
+
+    # Same API
+    response = client.chat.completions.create(
+        model="gpt-4o",
+        messages=[{"role": "user", "content": "Hello"}],
+    )
+
+Environment variables::
+
+    CRE_KEY=sk-cre-...
+    CRE_URL=http://localhost:8080
+
+    from contextwall_sdk import SafeOpenAI
+    client = SafeOpenAI()
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Any
+
+from .exceptions import CREBlockedError, CREUnavailableError, CREAuthError
+
+
+def _check_cre_block(body: Any) -> None:
+    if not isinstance(body, dict):
+        return
+    err = body.get("error", {})
+    if isinstance(err, dict) and err.get("type") == "cre_policy_violation":
+        raise CREBlockedError(
+            blocked_reason=err.get("message", "policy violation"),
+            violations=err.get("violations", []),
+            raw_body=body,
+        )
+
+
+def _wrap_exception(exc: Exception, cre_url: str) -> None:
+    try:
+        import httpx
+        if isinstance(exc, httpx.ConnectError):
+            raise CREUnavailableError(cre_url, cause=exc) from exc
+    except ImportError:
+        pass
+
+    exc_type = type(exc).__name__
+    if exc_type == "AuthenticationError":
+        raise CREAuthError() from exc
+
+    if exc_type in ("BadRequestError", "APIStatusError", "APIError"):
+        # OpenAI SDK stores the body differently
+        body = getattr(exc, "body", None) or getattr(exc, "response", {})
+        if hasattr(body, "json"):
+            try:
+                body = body.json()
+            except Exception:
+                pass
+        _check_cre_block(body)
+
+
+class _StreamContextWrapper:
+    """Wraps an OpenAI stream context manager to catch CRE blocks on entry."""
+
+    def __init__(self, stream_cm: Any, cre_url: str) -> None:
+        self._cm = stream_cm
+        self._cre_url = cre_url
+
+    def __enter__(self) -> Any:
+        try:
+            return self._cm.__enter__()
+        except Exception as exc:
+            _wrap_exception(exc, self._cre_url)
+            raise
+
+    def __exit__(self, *args: Any) -> Any:
+        return self._cm.__exit__(*args)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._cm, name)
+
+
+class _AsyncStreamContextWrapper:
+    def __init__(self, stream_cm: Any, cre_url: str) -> None:
+        self._cm = stream_cm
+        self._cre_url = cre_url
+
+    async def __aenter__(self) -> Any:
+        try:
+            return await self._cm.__aenter__()
+        except Exception as exc:
+            _wrap_exception(exc, self._cre_url)
+            raise
+
+    async def __aexit__(self, *args: Any) -> Any:
+        return await self._cm.__aexit__(*args)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._cm, name)
+
+
+class _CompletionsWrapper:
+    def __init__(self, completions: Any, cre_url: str) -> None:
+        self._completions = completions
+        self._cre_url = cre_url
+
+    def create(self, **kwargs: Any) -> Any:
+        try:
+            return self._completions.create(**kwargs)
+        except Exception as exc:
+            _wrap_exception(exc, self._cre_url)
+            raise
+
+    def stream(self, **kwargs: Any) -> _StreamContextWrapper:
+        return _StreamContextWrapper(self._completions.stream(**kwargs), self._cre_url)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._completions, name)
+
+
+class _AsyncCompletionsWrapper:
+    def __init__(self, completions: Any, cre_url: str) -> None:
+        self._completions = completions
+        self._cre_url = cre_url
+
+    async def create(self, **kwargs: Any) -> Any:
+        try:
+            return await self._completions.create(**kwargs)
+        except Exception as exc:
+            _wrap_exception(exc, self._cre_url)
+            raise
+
+    def stream(self, **kwargs: Any) -> _AsyncStreamContextWrapper:
+        return _AsyncStreamContextWrapper(self._completions.stream(**kwargs), self._cre_url)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._completions, name)
+
+
+class _ChatWrapper:
+    def __init__(self, chat: Any, cre_url: str) -> None:
+        self._chat = chat
+        self._cre_url = cre_url
+
+    @property
+    def completions(self) -> _CompletionsWrapper:
+        return _CompletionsWrapper(self._chat.completions, self._cre_url)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._chat, name)
+
+
+class _AsyncChatWrapper:
+    def __init__(self, chat: Any, cre_url: str) -> None:
+        self._chat = chat
+        self._cre_url = cre_url
+
+    @property
+    def completions(self) -> _AsyncCompletionsWrapper:
+        return _AsyncCompletionsWrapper(self._chat.completions, self._cre_url)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._chat, name)
+
+
+class SafeOpenAI:
+    """Drop-in replacement for ``openai.OpenAI`` with CRE enforcement.
+
+    Args:
+        cre_key:               Your ``sk-cre-xxx`` key. Falls back to
+                               ``CRE_KEY`` then ``OPENAI_API_KEY`` env vars.
+        cre_url:               CRE daemon URL. Falls back to ``CRE_URL`` env var,
+                               then ``http://localhost:8080``.
+        **kwargs:              Passed through to ``openai.OpenAI()``.
+
+    Raises:
+        CREBlockedError:       When CRE blocks the request.
+        CREUnavailableError:   When CRE cannot be reached.
+        CREAuthError:          When the CRE key is rejected.
+        ImportError:           If ``openai`` package is not installed.
+    """
+
+    def __init__(
+        self,
+        cre_key: str | None = None,
+        cre_url: str | None = None,
+        **kwargs: Any,
+    ) -> None:
+        try:
+            import openai
+        except ImportError as e:
+            raise ImportError(
+                "openai package is required: pip install 'contextwall-sdk[openai]'"
+            ) from e
+
+        self._cre_url = (
+            cre_url or os.environ.get("CRE_URL") or "http://localhost:8080"
+        ).rstrip("/")
+
+        key = (
+            cre_key
+            or os.environ.get("CRE_KEY")
+            or os.environ.get("OPENAI_API_KEY")
+            or ""
+        )
+
+        self._client = openai.OpenAI(
+            api_key=key,
+            base_url=f"{self._cre_url}/proxy/openai/v1",
+            **kwargs,
+        )
+
+    @property
+    def chat(self) -> _ChatWrapper:
+        return _ChatWrapper(self._client.chat, self._cre_url)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._client, name)
+
+
+class AsyncSafeOpenAI:
+    """Async version of SafeOpenAI. Drop-in for ``openai.AsyncOpenAI``."""
+
+    def __init__(
+        self,
+        cre_key: str | None = None,
+        cre_url: str | None = None,
+        **kwargs: Any,
+    ) -> None:
+        try:
+            import openai
+        except ImportError as e:
+            raise ImportError(
+                "openai package is required: pip install 'contextwall-sdk[openai]'"
+            ) from e
+
+        self._cre_url = (
+            cre_url or os.environ.get("CRE_URL") or "http://localhost:8080"
+        ).rstrip("/")
+
+        key = (
+            cre_key
+            or os.environ.get("CRE_KEY")
+            or os.environ.get("OPENAI_API_KEY")
+            or ""
+        )
+
+        self._client = openai.AsyncOpenAI(
+            api_key=key,
+            base_url=f"{self._cre_url}/proxy/openai/v1",
+            **kwargs,
+        )
+
+    @property
+    def chat(self) -> _AsyncChatWrapper:
+        return _AsyncChatWrapper(self._client.chat, self._cre_url)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._client, name)

contextwall_sdk/client.py

@@ -0,0 +1,475 @@
+"""ContextWallClient - admin HTTP client for the ContextWall daemon.
+
+Used for provisioning proxy keys, registering sources, checking health,
+and querying analytics/lint results.
+
+Example::
+
+    from contextwall_sdk import CREClient
+
+    cre = CREClient(api_key="...", base_url="http://localhost:8080")
+
+    # Provision a key for an agent
+    result = cre.keys.create(
+        project_id="my-agent",
+        project_name="Production Agent",
+        upstream_key="sk-ant-...",
+        provider="anthropic",
+    )
+    print(result.key)  # sk-cre-xxx - save this
+
+    # Register a web search source as untrusted
+    cre.sources.register(
+        id="brave-search",
+        type="web_search",
+        trust_tier="untrusted",
+        owner="research-team",
+    )
+
+    # Trigger a lint audit
+    report = cre.lint.run(window_days=30)
+    print(report["summary"])
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from datetime import datetime
+from typing import Any, Literal
+
+import httpx
+
+
+# ── Response models ────────────────────────────────────────────────────────────
+
+@dataclass
+class ProxyKeyResult:
+    key: str
+    key_preview: str
+    project_id: str
+    project_name: str
+    provider: str
+    created_at: str
+    warning: str
+
+
+@dataclass
+class ProxyKey:
+    key_id: str
+    project_id: str
+    project_name: str
+    provider: str
+    scopes: list[str]
+    created_at: str
+
+
+@dataclass
+class HealthStatus:
+    status: Literal["healthy", "degraded", "down"]
+    subsystems: dict[str, Any]
+    timestamp: str
+    version: str | None = None
+
+
+@dataclass
+class AnalyticsSummary:
+    total_requests: int
+    blocked_artifacts: int
+    policy_violations: int
+    active_sessions: int
+    window_hours: int
+
+
+@dataclass
+class Source:
+    id: str
+    type: str
+    trust_tier: str
+    owner: str
+    region: str
+    data_classification: str
+    registered_at: str
+
+
+# ── Keys sub-client ────────────────────────────────────────────────────────────
+
+class _KeysClient:
+    def __init__(self, http: httpx.Client) -> None:
+        self._http = http
+
+    def create(
+        self,
+        project_id: str,
+        upstream_key: str,
+        project_name: str | None = None,
+        provider: Literal["anthropic", "openai", "any"] = "anthropic",
+        scopes: list[str] | None = None,
+    ) -> ProxyKeyResult:
+        resp = self._http.post(
+            "/v1/keys",
+            json={
+                "project_id": project_id,
+                "project_name": project_name or project_id,
+                "upstream_key": upstream_key,
+                "provider": provider,
+                "scopes": scopes,
+            },
+        )
+        resp.raise_for_status()
+        d = resp.json()
+        return ProxyKeyResult(**{k: v for k, v in d.items()})
+
+    def list(self, project_id: str | None = None) -> list[ProxyKey]:
+        params = {"project_id": project_id} if project_id else {}
+        resp = self._http.get("/v1/keys", params=params)
+        resp.raise_for_status()
+        return [ProxyKey(**k) for k in resp.json().get("keys", [])]
+
+    def revoke(self, key_prefix: str) -> bool:
+        resp = self._http.delete(f"/v1/keys/{key_prefix}")
+        if resp.status_code == 404:
+            return False
+        resp.raise_for_status()
+        return True
+
+
+class _AsyncKeysClient:
+    def __init__(self, http: httpx.AsyncClient) -> None:
+        self._http = http
+
+    async def create(
+        self,
+        project_id: str,
+        upstream_key: str,
+        project_name: str | None = None,
+        provider: Literal["anthropic", "openai", "any"] = "anthropic",
+        scopes: list[str] | None = None,
+    ) -> ProxyKeyResult:
+        resp = await self._http.post(
+            "/v1/keys",
+            json={
+                "project_id": project_id,
+                "project_name": project_name or project_id,
+                "upstream_key": upstream_key,
+                "provider": provider,
+                "scopes": scopes,
+            },
+        )
+        resp.raise_for_status()
+        d = resp.json()
+        return ProxyKeyResult(**{k: v for k, v in d.items()})
+
+    async def list(self, project_id: str | None = None) -> list[ProxyKey]:
+        params = {"project_id": project_id} if project_id else {}
+        resp = await self._http.get("/v1/keys", params=params)
+        resp.raise_for_status()
+        return [ProxyKey(**k) for k in resp.json().get("keys", [])]
+
+    async def revoke(self, key_prefix: str) -> bool:
+        resp = await self._http.delete(f"/v1/keys/{key_prefix}")
+        if resp.status_code == 404:
+            return False
+        resp.raise_for_status()
+        return True
+
+
+# ── Sources sub-client ────────────────────────────────────────────────────────
+
+class _SourcesClient:
+    def __init__(self, http: httpx.Client) -> None:
+        self._http = http
+
+    def register(
+        self,
+        id: str,
+        type: str,
+        trust_tier: Literal["internal", "external", "untrusted", "regulated"],
+        owner: str = "",
+        region: str = "",
+        data_classification: str = "internal",
+    ) -> Source:
+        resp = self._http.post(
+            "/v1/sources",
+            json={
+                "id": id,
+                "type": type,
+                "trust_tier": trust_tier,
+                "owner": owner,
+                "region": region,
+                "data_classification": data_classification,
+            },
+        )
+        resp.raise_for_status()
+        return _parse_source(resp.json())
+
+    def list(self) -> list[Source]:
+        resp = self._http.get("/v1/sources")
+        resp.raise_for_status()
+        return [_parse_source(s) for s in resp.json().get("sources", [])]
+
+    def get(self, source_id: str) -> Source:
+        resp = self._http.get(f"/v1/sources/{source_id}")
+        resp.raise_for_status()
+        return _parse_source(resp.json())
+
+    def update_tier(
+        self,
+        source_id: str,
+        trust_tier: Literal["internal", "external", "untrusted", "regulated"],
+    ) -> Source:
+        resp = self._http.patch(
+            f"/v1/sources/{source_id}",
+            json={"trust_tier": trust_tier},
+        )
+        resp.raise_for_status()
+        return _parse_source(resp.json())
+
+    def delete(self, source_id: str) -> bool:
+        resp = self._http.delete(f"/v1/sources/{source_id}")
+        if resp.status_code == 404:
+            return False
+        resp.raise_for_status()
+        return True
+
+
+class _AsyncSourcesClient:
+    def __init__(self, http: httpx.AsyncClient) -> None:
+        self._http = http
+
+    async def register(
+        self,
+        id: str,
+        type: str,
+        trust_tier: Literal["internal", "external", "untrusted", "regulated"],
+        owner: str = "",
+        region: str = "",
+        data_classification: str = "internal",
+    ) -> Source:
+        resp = await self._http.post(
+            "/v1/sources",
+            json={
+                "id": id,
+                "type": type,
+                "trust_tier": trust_tier,
+                "owner": owner,
+                "region": region,
+                "data_classification": data_classification,
+            },
+        )
+        resp.raise_for_status()
+        return _parse_source(resp.json())
+
+    async def list(self) -> list[Source]:
+        resp = await self._http.get("/v1/sources")
+        resp.raise_for_status()
+        return [_parse_source(s) for s in resp.json().get("sources", [])]
+
+    async def get(self, source_id: str) -> Source:
+        resp = await self._http.get(f"/v1/sources/{source_id}")
+        resp.raise_for_status()
+        return _parse_source(resp.json())
+
+    async def update_tier(
+        self,
+        source_id: str,
+        trust_tier: Literal["internal", "external", "untrusted", "regulated"],
+    ) -> Source:
+        resp = await self._http.patch(
+            f"/v1/sources/{source_id}",
+            json={"trust_tier": trust_tier},
+        )
+        resp.raise_for_status()
+        return _parse_source(resp.json())
+
+    async def delete(self, source_id: str) -> bool:
+        resp = await self._http.delete(f"/v1/sources/{source_id}")
+        if resp.status_code == 404:
+            return False
+        resp.raise_for_status()
+        return True
+
+
+def _parse_source(d: dict) -> Source:
+    return Source(
+        id=d.get("id", ""),
+        type=d.get("type", ""),
+        trust_tier=d.get("trust_tier", ""),
+        owner=d.get("owner", ""),
+        region=d.get("region", ""),
+        data_classification=d.get("data_classification", ""),
+        registered_at=d.get("registered_at", ""),
+    )
+
+
+# ── Lint sub-client ────────────────────────────────────────────────────────────
+
+class _LintClient:
+    def __init__(self, http: httpx.Client) -> None:
+        self._http = http
+
+    def latest(self) -> dict[str, Any]:
+        resp = self._http.get("/v1/lint/latest")
+        resp.raise_for_status()
+        return resp.json()
+
+    def run(self, window_days: int = 30) -> dict[str, Any]:
+        resp = self._http.post("/v1/lint/run", params={"window_days": window_days})
+        resp.raise_for_status()
+        return resp.json()
+
+
+class _AsyncLintClient:
+    def __init__(self, http: httpx.AsyncClient) -> None:
+        self._http = http
+
+    async def latest(self) -> dict[str, Any]:
+        resp = await self._http.get("/v1/lint/latest")
+        resp.raise_for_status()
+        return resp.json()
+
+    async def run(self, window_days: int = 30) -> dict[str, Any]:
+        resp = await self._http.post("/v1/lint/run", params={"window_days": window_days})
+        resp.raise_for_status()
+        return resp.json()
+
+
+# ── Main clients ───────────────────────────────────────────────────────────────
+
+class CREClient:
+    """Synchronous admin client for the ContextWall daemon.
+
+    Args:
+        api_key:  ContextWall admin API key (set in ctxfw.yaml). Falls back to
+                  ``CRE_API_KEY`` env var, then ``CRE_API_TOKEN``.
+        base_url: ContextWall daemon URL. Falls back to ``CTXFW_URL`` env var,
+                  then ``http://localhost:8080``.
+        timeout:  Request timeout in seconds (default 30).
+    """
+
+    def __init__(
+        self,
+        api_key: str | None = None,
+        base_url: str | None = None,
+        timeout: float = 30.0,
+    ) -> None:
+        key = (
+            api_key
+            or os.environ.get("CRE_API_KEY")
+            or os.environ.get("CRE_API_TOKEN")
+            or ""
+        )
+        url = (
+            base_url
+            or os.environ.get("CRE_URL")
+            or "http://localhost:8080"
+        ).rstrip("/")
+
+        self._http = httpx.Client(
+            base_url=url,
+            headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
+            timeout=timeout,
+        )
+        self.keys = _KeysClient(self._http)
+        self.sources = _SourcesClient(self._http)
+        self.lint = _LintClient(self._http)
+
+    def health(self) -> HealthStatus:
+        resp = self._http.get("/health")
+        resp.raise_for_status()
+        d = resp.json()
+        return HealthStatus(
+            status=d["status"],
+            subsystems=d.get("subsystems", {}),
+            timestamp=d.get("timestamp", ""),
+            version=d.get("version"),
+        )
+
+    def analytics(self, window_hours: int = 24) -> AnalyticsSummary:
+        resp = self._http.get("/analytics/summary", params={"window_hours": window_hours})
+        resp.raise_for_status()
+        d = resp.json()
+        return AnalyticsSummary(
+            total_requests=d.get("total_requests", 0),
+            blocked_artifacts=d.get("blocked_artifacts", 0),
+            policy_violations=d.get("policy_violations", 0),
+            active_sessions=d.get("active_sessions", 0),
+            window_hours=window_hours,
+        )
+
+    def proxy_health(self) -> dict:
+        resp = self._http.get("/proxy/health")
+        resp.raise_for_status()
+        return resp.json()
+
+    def close(self) -> None:
+        self._http.close()
+
+    def __enter__(self) -> "CREClient":
+        return self
+
+    def __exit__(self, *args: Any) -> None:
+        self.close()
+
+
+class AsyncCREClient:
+    """Async admin client for the ContextWall daemon. Same API as CREClient but awaitable."""
+
+    def __init__(
+        self,
+        api_key: str | None = None,
+        base_url: str | None = None,
+        timeout: float = 30.0,
+    ) -> None:
+        key = (
+            api_key
+            or os.environ.get("CRE_API_KEY")
+            or os.environ.get("CRE_API_TOKEN")
+            or ""
+        )
+        url = (
+            base_url
+            or os.environ.get("CRE_URL")
+            or "http://localhost:8080"
+        ).rstrip("/")
+
+        self._http = httpx.AsyncClient(
+            base_url=url,
+            headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
+            timeout=timeout,
+        )
+        self.keys = _AsyncKeysClient(self._http)
+        self.sources = _AsyncSourcesClient(self._http)
+        self.lint = _AsyncLintClient(self._http)
+
+    async def health(self) -> HealthStatus:
+        resp = await self._http.get("/health")
+        resp.raise_for_status()
+        d = resp.json()
+        return HealthStatus(
+            status=d["status"],
+            subsystems=d.get("subsystems", {}),
+            timestamp=d.get("timestamp", ""),
+            version=d.get("version"),
+        )
+
+    async def analytics(self, window_hours: int = 24) -> AnalyticsSummary:
+        resp = await self._http.get("/analytics/summary", params={"window_hours": window_hours})
+        resp.raise_for_status()
+        d = resp.json()
+        return AnalyticsSummary(
+            total_requests=d.get("total_requests", 0),
+            blocked_artifacts=d.get("blocked_artifacts", 0),
+            policy_violations=d.get("policy_violations", 0),
+            active_sessions=d.get("active_sessions", 0),
+            window_hours=window_hours,
+        )
+
+    async def close(self) -> None:
+        await self._http.aclose()
+
+    async def __aenter__(self) -> "AsyncCREClient":
+        return self
+
+    async def __aexit__(self, *args: Any) -> None:
+        await self.close()

contextwall_sdk/exceptions.py

@@ -0,0 +1,53 @@
+"""ContextWall SDK exceptions."""
+
+from __future__ import annotations
+
+
+class CREError(Exception):
+    """Base class for all ContextWall SDK errors."""
+
+
+class CREBlockedError(CREError):
+    """Raised when ContextWall blocks a request due to a policy violation.
+
+    This replaces the generic ``BadRequestError`` the underlying SDK would raise,
+    giving you structured access to what was detected and why.
+
+    Example::
+
+        try:
+            client.messages.create(...)
+        except CREBlockedError as e:
+            print(e.violations)      # ["prompt_injection"]
+            print(e.blocked_reason)  # "prompt_injection detected in message content"
+    """
+
+    def __init__(
+        self,
+        blocked_reason: str,
+        violations: list[str],
+        raw_body: dict | None = None,
+    ) -> None:
+        self.blocked_reason = blocked_reason
+        self.violations = violations
+        self.raw_body = raw_body or {}
+        super().__init__(f"ContextWall blocked request: {blocked_reason}")
+
+
+class CREUnavailableError(CREError):
+    """Raised when the ContextWall daemon cannot be reached and fallback is disabled."""
+
+    def __init__(self, url: str, cause: Exception | None = None) -> None:
+        self.url = url
+        self.cause = cause
+        super().__init__(
+            f"ContextWall daemon unreachable at {url}. "
+            "Set fallback_on_unavailable=True to fall through to the real API."
+        )
+
+
+class CREAuthError(CREError):
+    """Raised when the ContextWall key is invalid or revoked."""
+
+    def __init__(self, message: str = "Invalid or revoked ContextWall key") -> None:
+        super().__init__(message)

contextwall_sdk-0.1.1.dist-info/METADATA

@@ -0,0 +1,57 @@
+Metadata-Version: 2.4
+Name: contextwall-sdk
+Version: 0.1.1
+Summary: ContextWall SDK - drop-in wrapper for Anthropic and OpenAI with context firewall enforcement
+Author-email: Context Firewall <sumesh.punakkal@gmail.com>
+License: Apache-2.0
+Keywords: ai,anthropic,context-firewall,governance,openai,security
+Requires-Python: >=3.11
+Requires-Dist: httpx>=0.27
+Requires-Dist: pydantic>=2.0
+Provides-Extra: all
+Requires-Dist: anthropic>=0.25; extra == 'all'
+Requires-Dist: openai>=1.0; extra == 'all'
+Provides-Extra: anthropic
+Requires-Dist: anthropic>=0.25; extra == 'anthropic'
+Provides-Extra: dev
+Requires-Dist: anthropic>=0.25; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: openai>=1.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Provides-Extra: openai
+Requires-Dist: openai>=1.0; extra == 'openai'
+Description-Content-Type: text/markdown
+
+# contextwall-sdk
+
+Drop-in wrapper for Anthropic and OpenAI that routes calls through a local [ContextWall](https://contextwall.io) daemon, enforcing your context firewall policy with no other code changes.
+
+## Install
+
+```bash
+pip install 'contextwall-sdk[anthropic]'
+pip install 'contextwall-sdk[openai]'
+pip install 'contextwall-sdk[all]'
+```
+
+## Usage
+
+```python
+from contextwall_sdk import SafeAnthropic
+
+client = SafeAnthropic(api_key="sk-ant-...", ctxfw_url="http://localhost:8080")
+# use exactly like the standard Anthropic client
+```
+
+```python
+from contextwall_sdk import SafeOpenAI
+
+client = SafeOpenAI(api_key="sk-...", ctxfw_url="http://localhost:8080")
+```
+
+Blocked requests raise `contextwall_sdk.ContextWallBlockedError` with the policy violation detail.
+
+## Daemon setup
+
+The SDK requires a running ContextWall daemon. See the [quickstart](https://contextwall.io/quickstart) or the [GitHub repo](https://github.com/bytewise-ca/context-wall).

contextwall_sdk-0.1.1.dist-info/RECORD

@@ -0,0 +1,8 @@
+contextwall_sdk/__init__.py,sha256=RkO_uJB9K3vg6CHqo8weF0lf9ip_44M3u7hCTJzT6UY,1570
+contextwall_sdk/_anthropic.py,sha256=aqGbxE-5nJE60b6dnwHrrtylK-L68ohw8ca2VzPH2fU,8347
+contextwall_sdk/_openai.py,sha256=vcZYAmYKTkiCWaKzSpedXr-y3v9-75rDbTL61OYm1Hs,7818
+contextwall_sdk/client.py,sha256=5zzJI4F01payxQ1-SA17sBg9-dImKo0TGJlSglVpo8g,14738
+contextwall_sdk/exceptions.py,sha256=1wxFI2X3TztGp-D141h_MrkC-hPqX0ru24ugAuhe7-8,1653
+contextwall_sdk-0.1.1.dist-info/METADATA,sha256=ZeGYK71g7y3ioDsjH3e_d2prxO4boXiyswLodkhmX2o,1893
+contextwall_sdk-0.1.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+contextwall_sdk-0.1.1.dist-info/RECORD,,

contextwall_sdk-0.1.1.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any