pywrit 0.1.0__py3-none-any.whl

pywrit-0.1.0.dist-info/METADATA

@@ -0,0 +1,63 @@
+Metadata-Version: 2.4
+Name: pywrit
+Version: 0.1.0
+Summary: Ask Writ before an agent writes — allow/deny gate with a tamper-evident audit log
+Project-URL: Homepage, https://withwrit.com
+Project-URL: Documentation, https://docs.withwrit.com
+Keywords: agents,audit-log,authorization,api-keys
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# writ-cli (PyPI packaging)
+
+Installable distribution of the Writ CLI. `pip install writ-cli` gives you the
+`writ` command — no `curl` + `chmod` dance.
+
+## Layout
+
+- `pyproject.toml` — package metadata, `writ` console-script entry point
+- `writ_cli/__init__.py` — version
+- `writ_cli/cli.py` — the CLI itself (stdlib-only: argparse, json, urllib)
+
+## Relationship to `gate/web/writ`
+
+`gate/web/writ` is the **self-contained single-file script** served by the Lambda
+at `/writ` (the `curl -fsSL ... -o writ` download path). It must stay a single
+file with no install step.
+
+`writ_cli/cli.py` is the **PyPI package source**. The two files are currently
+byte-identical by copy. If you change CLI behavior, update **both** and keep
+them in sync — the download path and the pip path must behave the same.
+
+## Build & test locally
+
+```bash
+cd cli
+python -m build                    # needs `pip install build`
+pip install -e .                   # editable install, creates the `writ` command
+writ --help
+```
+
+## Publish (needs Chad's approval + PyPI credentials)
+
+```bash
+cd cli
+python -m build
+twine upload dist/*
+```
+
+## Open decisions (before first publish)
+
+1. **Distribution name**: `writ` is taken on PyPI. `pyproject.toml` uses
+   `writ-cli` as a placeholder — Chad picks the final name.
+2. **License**: the repo has no LICENSE file yet. Pick one (MIT recommended)
+   and add `license = { text = "MIT" }` + trove classifier before publishing.
+3. **Docs**: once published, update `fern/pages/quickstart.mdx` and
+   `fern/pages/cli.mdx` to offer `pip install <name>` alongside the curl path
+   (per the repo docs rule — every change ships with its docs).

pywrit-0.1.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+pywrit-0.1.0.dist-info/licenses/LICENSE,sha256=K7HmV3Hw8W9Qw3C_EFmvxErqZbs7AZnFVKUCgJiI-no,1061
+writ_cli/__init__.py,sha256=nI5qTo0ebr5IfQVNfUeSUZIypa2RxRBuAKgG62YP_J8,47
+writ_cli/cli.py,sha256=K-YIKwmjdrdJnY8EaB4dSfIYAUrdyAA-ACvl8PaQFTg,10448
+pywrit-0.1.0.dist-info/METADATA,sha256=yA7EXxRgx8x1Vyqxx3ISKcsAeU5aLtRitM-EniqNSxA,2246
+pywrit-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+pywrit-0.1.0.dist-info/entry_points.txt,sha256=Z178SwFVAN2TAkK6fPQCcss2moCg6AY5iCz-0E75U3A,43
+pywrit-0.1.0.dist-info/top_level.txt,sha256=YJoJ_48DQajE7XWe3gXkjRJMgB5Wsdx2g_N7VpfcZMg,9
+pywrit-0.1.0.dist-info/RECORD,,

pywrit-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

pywrit-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+writ = writ_cli.cli:main

pywrit-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Writ
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

pywrit-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+writ_cli

writ_cli/__init__.py

@@ -0,0 +1,3 @@
+"""Writ CLI package."""
+
+__version__ = "0.1.0"

writ_cli/cli.py

@@ -0,0 +1,234 @@
+#!/usr/bin/env python3
+"""Writ CLI. Get a key and ask the gate before a write."""
+
+import argparse
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+
+BASE = os.environ.get(
+    "WRIT_BASE",
+    "https://j72ckh66ukck2kcbq3oiwxaalm0olxwb.lambda-url.us-east-1.on.aws",
+)
+
+
+def request(method, path, payload=None, key=None, token=None):
+    headers = {"content-type": "application/json"}
+    if key:
+        headers["authorization"] = "Bearer " + key
+    elif token:
+        headers["authorization"] = token
+    data = None if payload is None else json.dumps(payload).encode()
+    req = urllib.request.Request(BASE + path, data=data, headers=headers, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=20) as resp:
+            body = resp.read().decode()
+            print(body)
+            return 0
+    except urllib.error.HTTPError as exc:
+        print(exc.read().decode(), file=sys.stderr)
+        return exc.code
+
+
+def stream_cmd(args):
+    """Tail the tenant audit log via the SSE stream, reconnecting on each
+    long-poll expiry. Prints one line per receipt."""
+    import time
+    import urllib.parse
+
+    key = args.key
+    since = args.since
+    deadline = None if args.timeout == 0 else time.time() + args.timeout
+    try:
+        while deadline is None or time.time() < deadline:
+            params = {"apiKey": key, "timeout": "10", "replay": "20"}
+            if since:
+                params["since"] = since
+            url = BASE + "/v1/receipts/stream?" + urllib.parse.urlencode(params)
+            req = urllib.request.Request(url, method="GET")
+            try:
+                with urllib.request.urlopen(req, timeout=30) as resp:
+                    data_lines = []
+                    for raw in resp:
+                        line = raw.decode("utf-8", "replace").rstrip("\n")
+                        if line.startswith("data:"):
+                            data_lines.append(line[5:].strip())
+                        elif line == "" and data_lines:
+                            try:
+                                r = json.loads("".join(data_lines))
+                            except json.JSONDecodeError:
+                                data_lines = []
+                                continue
+                            ts = time.strftime("%H:%M:%S", time.localtime(r.get("createdAt", 0)))
+                            print(f"{ts} {r.get('decision','?'):7} {r.get('verb','')} {r.get('target','')} "
+                                  f"sponsor={r.get('sponsorId','')} agent={r.get('agentId','')} "
+                                  f"id={r.get('receiptId','')}", flush=True)
+                            since = r.get("receiptId", since)
+                            data_lines = []
+                        # ": ping" heartbeats and "id:"/"event:" lines are ignored
+            except urllib.error.HTTPError as exc:
+                print(exc.read().decode(), file=sys.stderr)
+                return exc.code
+            except (urllib.error.URLError, TimeoutError, ConnectionError) as exc:
+                print(f"stream reconnecting: {exc}", file=sys.stderr)
+                time.sleep(2)
+    except KeyboardInterrupt:
+        pass
+    return 0
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Ask Writ before an agent writes.")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+
+    key = sub.add_parser("key", help="Get a free API key + tenant")
+    key.add_argument("--email", required=True)
+    key.add_argument("--tenant-name", default="", help="Optional tenant name (defaults to email domain)")
+    key.add_argument("--invite-code", default="", help="Join an existing tenant instead of creating one")
+
+    me = sub.add_parser("me", help="Show tenant, key meta, and policy")
+    me.add_argument("--key", required=True)
+
+    MODES = ("allow", "deny", "require_grant", "step_up")
+    policy = sub.add_parser("policy", help="Get or set tenant verb policy")
+    policy.add_argument("--key", required=True)
+    policy.add_argument("--set", nargs=2, metavar=("VERB", "MODE"), action="append", default=[])
+
+    check = sub.add_parser("check", help="ALLOW or DENY a write")
+    check.add_argument("--key", required=True)
+    check.add_argument("--sponsor", required=True)
+    check.add_argument("--agent", required=True)
+    check.add_argument("--verb", required=True)
+    check.add_argument("--target", required=True)
+    check.add_argument("--purpose", required=True)
+
+    sandbox = sub.add_parser("sandbox", help="90-second grant for demo_write")
+    sandbox.add_argument("--sponsor", required=True)
+    sandbox.add_argument("--agent", required=True)
+    sandbox.add_argument("--target", required=True)
+    sandbox.add_argument("--purpose", required=True)
+
+    revoke = sub.add_parser("revoke", help="Kill switch: revoke a principal (sponsor token)")
+    revoke.add_argument("--sponsor", required=True)
+    revoke.add_argument("--agent", required=True)
+    revoke.add_argument("--reason", default="")
+    revoke.add_argument("--sponsor-token", default=os.environ.get("WRIT_SPONSOR_TOKEN", ""))
+
+    reinstate = sub.add_parser("reinstate", help="Undo a revocation (sponsor token)")
+    reinstate.add_argument("--sponsor", required=True)
+    reinstate.add_argument("--agent", required=True)
+    reinstate.add_argument("--sponsor-token", default=os.environ.get("WRIT_SPONSOR_TOKEN", ""))
+
+    revoked = sub.add_parser("revoked", help="List revoked principals (sponsor token)")
+    revoked.add_argument("--sponsor-token", default=os.environ.get("WRIT_SPONSOR_TOKEN", ""))
+
+    receipts = sub.add_parser("receipts", help="Latest receipts for your tenant")
+    receipts.add_argument("--key", required=True)
+
+    stream = sub.add_parser("stream", help="Tail the live audit log (SSE stream)")
+    stream.add_argument("--key", required=True)
+    stream.add_argument("--since", default="", help="receiptId to resume after")
+    stream.add_argument("--timeout", type=int, default=600, help="Seconds to stream before exiting (0 = forever)")
+
+    verify = sub.add_parser("verify-chain", help="Verify the tenant audit-log hash chain")
+    verify.add_argument("--key", required=True)
+    verify.add_argument("--limit", type=int, default=200, help="Max receipts to verify (1-1000)")
+
+    invite = sub.add_parser("invite", help="Create a team invite code for your tenant")
+    invite.add_argument("--key", required=True)
+
+    grant = sub.add_parser("grant", help="Sponsor approval: grant one write (sponsor token)")
+    grant.add_argument("--sponsor", required=True)
+    grant.add_argument("--agent", required=True)
+    grant.add_argument("--verb", required=True)
+    grant.add_argument("--target", required=True)
+    grant.add_argument("--purpose", required=True)
+    grant.add_argument("--ttl", type=int, default=90, help="Seconds the grant stays valid (1-3600)")
+    grant.add_argument("--sponsor-token", default=os.environ.get("WRIT_SPONSOR_TOKEN", ""))
+
+    tv = sub.add_parser("token-verify", help="Validate an ALLOW auth token")
+    tv.add_argument("--key", required=True)
+    tv.add_argument("--token", required=True)
+    tv.add_argument("--verb", default=None)
+    tv.add_argument("--target", default=None)
+    tv.add_argument("--purpose", default=None)
+
+    args = parser.parse_args()
+    if args.cmd == "key":
+        payload = {"email": args.email}
+        if args.tenant_name.strip():
+            payload["tenantName"] = args.tenant_name.strip()
+        if args.invite_code.strip():
+            payload["inviteCode"] = args.invite_code.strip()
+        return request("POST", "/v1/keys", payload)
+    if args.cmd == "invite":
+        return request("POST", "/v1/tenant/invites", key=args.key)
+    if args.cmd == "grant":
+        if not args.sponsor_token:
+            print("error: sponsor token required (--sponsor-token or WRIT_SPONSOR_TOKEN)", file=sys.stderr)
+            return 2
+        return request(
+            "POST",
+            "/v1/grants",
+            {
+                "sponsorId": args.sponsor,
+                "agentId": args.agent,
+                "verb": args.verb,
+                "target": args.target,
+                "purpose": args.purpose,
+                "ttlSeconds": args.ttl,
+            },
+            token="Bearer " + args.sponsor_token,
+        )
+    if args.cmd == "me":
+        return request("GET", "/v1/me", key=args.key)
+    if args.cmd == "policy":
+        if args.set:
+            for verb, mode in args.set:
+                if mode not in MODES:
+                    print(f"error: mode must be one of {', '.join(MODES)}", file=sys.stderr)
+                    return 2
+            return request("PUT", "/v1/policy", {verb: mode for verb, mode in args.set}, key=args.key)
+        return request("GET", "/v1/policy", key=args.key)
+    if args.cmd == "receipts":
+        return request("GET", "/v1/receipts", key=args.key)
+    if args.cmd == "stream":
+        return stream_cmd(args)
+    if args.cmd == "verify-chain":
+        return request("GET", f"/v1/receipts/verify?limit={args.limit}", key=args.key)
+    if args.cmd == "token-verify":
+        payload = {"token": args.token}
+        for field in ("verb", "target", "purpose"):
+            value = getattr(args, field)
+            if value is not None:
+                payload[field] = value
+        return request("POST", "/v1/tokens/verify", payload, key=args.key)
+    if args.cmd in ("revoke", "reinstate", "revoked"):
+        if not args.sponsor_token:
+            print("error: sponsor token required (--sponsor-token or WRIT_SPONSOR_TOKEN)", file=sys.stderr)
+            return 2
+        token = "Bearer " + args.sponsor_token
+        if args.cmd == "revoked":
+            return request("GET", "/v1/revoked", token=token)
+        payload = {"sponsorId": args.sponsor, "agentId": args.agent}
+        if args.cmd == "revoke":
+            if args.reason:
+                payload["reason"] = args.reason
+            return request("POST", "/v1/revoke", payload, token=token)
+        return request("POST", "/v1/reinstate", payload, token=token)
+    body = {
+        "sponsorId": args.sponsor,
+        "agentId": args.agent,
+        "verb": args.verb if args.cmd == "check" else "demo_write",
+        "target": args.target,
+        "purpose": args.purpose,
+    }
+    if args.cmd == "sandbox":
+        return request("POST", "/v1/sandbox", body)
+    return request("POST", "/v1/check", body, key=args.key)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())