pywrit 0.1.2__tar.gz → 0.2.0__tar.gz

{pywrit-0.1.2 → pywrit-0.2.0}/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Writ
+Copyright (c) 2026 Avenue D
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

pywrit-0.2.0/PKG-INFO

@@ -0,0 +1,97 @@
+Metadata-Version: 2.4
+Name: pywrit
+Version: 0.2.0
+Summary: Python client + CLI for Writ — the gate before the write
+License: MIT
+Project-URL: Homepage, https://github.com/AvenueDAdmin/pywrit
+Project-URL: Documentation, https://withwrit.com/docs
+Keywords: ai-agents,policy,audit-log,guardrails
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: httpx>=0.27
+Dynamic: license-file
+
+# pywrit
+
+Python client + CLI for [Writ](https://withwrit.com) — the gate before the write.
+Put a policy gate in front of your agent's dangerous actions.
+
+## Install
+
+```bash
+pip install pywrit
+```
+
+## Python client
+
+```python
+from pywrit import WritClient
+
+client = WritClient(api_key="writ_...")
+
+result = client.check(
+    sponsor_id="acme",
+    agent_id="agent-7",
+    verb="db.write",
+    target="prod.customers",
+    purpose="backfill region field",
+)
+
+if result.decision == "ALLOW":
+    # result.auth_token is a short-lived token bound to this exact write
+    perform_write(...)
+elif result.decision == "STEP_UP":
+    # a human sponsor must approve first: client.grant(...), then re-check
+    ...
+else:
+    # DENY
+    ...
+```
+
+No API key yet? Try the keyless sandbox:
+
+```python
+client = WritClient()
+client.sandbox({
+    "sponsorId": "acme",
+    "agentId": "agent-7",
+    "verb": "demo_write",       # sandbox only allows demo_write ...
+    "target": "demo-customers", # ... on targets starting with demo-
+    "purpose": "trying the gate",
+})
+```
+
+### What's covered
+
+- `check(...)` — the gate: `ALLOW` / `DENY` / `STEP_UP`, plus a receipt every time
+- `verify_token(...)` — validate an `ALLOW` auth token (catches purpose drift)
+- `grant(...)` — human-sponsor approval for the `STEP_UP` path
+- `get_policy()` / `set_policy(...)` — manage the tenant policy
+- `revoke(...)` / `reinstate(...)` / `revoked()` — the kill switch
+- `receipts()` / `receipt(id)` / `verify_chain()` / `stream_receipts()` — the audit log
+- `sandbox(...)` — keyless trial, no API key required
+
+Every decision writes a receipt, so the audit log is the meter.
+
+## CLI
+
+The same package ships the `writ` command:
+
+```bash
+writ check --key writ_... --sponsor acme --agent agent-7 \
+  --verb db.write --target prod.customers --purpose "backfill region field"
+writ scan ./my-repo
+writ receipts --key writ_...
+writ verify-chain --key writ_...
+```
+
+Run `writ --help` for the full command list.
+
+## Docs
+
+Full API reference: [withwrit.com/docs](https://withwrit.com/docs)
+
+## License
+
+MIT

pywrit-0.2.0/README.md

@@ -0,0 +1,83 @@
+# pywrit
+
+Python client + CLI for [Writ](https://withwrit.com) — the gate before the write.
+Put a policy gate in front of your agent's dangerous actions.
+
+## Install
+
+```bash
+pip install pywrit
+```
+
+## Python client
+
+```python
+from pywrit import WritClient
+
+client = WritClient(api_key="writ_...")
+
+result = client.check(
+    sponsor_id="acme",
+    agent_id="agent-7",
+    verb="db.write",
+    target="prod.customers",
+    purpose="backfill region field",
+)
+
+if result.decision == "ALLOW":
+    # result.auth_token is a short-lived token bound to this exact write
+    perform_write(...)
+elif result.decision == "STEP_UP":
+    # a human sponsor must approve first: client.grant(...), then re-check
+    ...
+else:
+    # DENY
+    ...
+```
+
+No API key yet? Try the keyless sandbox:
+
+```python
+client = WritClient()
+client.sandbox({
+    "sponsorId": "acme",
+    "agentId": "agent-7",
+    "verb": "demo_write",       # sandbox only allows demo_write ...
+    "target": "demo-customers", # ... on targets starting with demo-
+    "purpose": "trying the gate",
+})
+```
+
+### What's covered
+
+- `check(...)` — the gate: `ALLOW` / `DENY` / `STEP_UP`, plus a receipt every time
+- `verify_token(...)` — validate an `ALLOW` auth token (catches purpose drift)
+- `grant(...)` — human-sponsor approval for the `STEP_UP` path
+- `get_policy()` / `set_policy(...)` — manage the tenant policy
+- `revoke(...)` / `reinstate(...)` / `revoked()` — the kill switch
+- `receipts()` / `receipt(id)` / `verify_chain()` / `stream_receipts()` — the audit log
+- `sandbox(...)` — keyless trial, no API key required
+
+Every decision writes a receipt, so the audit log is the meter.
+
+## CLI
+
+The same package ships the `writ` command:
+
+```bash
+writ check --key writ_... --sponsor acme --agent agent-7 \
+  --verb db.write --target prod.customers --purpose "backfill region field"
+writ scan ./my-repo
+writ receipts --key writ_...
+writ verify-chain --key writ_...
+```
+
+Run `writ --help` for the full command list.
+
+## Docs
+
+Full API reference: [withwrit.com/docs](https://withwrit.com/docs)
+
+## License
+
+MIT

pywrit-0.2.0/pyproject.toml

@@ -0,0 +1,26 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pywrit"
+version = "0.2.0"
+description = "Python client + CLI for Writ — the gate before the write"
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.9"
+dependencies = ["httpx>=0.27"]
+keywords = ["ai-agents", "policy", "audit-log", "guardrails"]
+
+[project.urls]
+Homepage = "https://github.com/AvenueDAdmin/pywrit"
+Documentation = "https://withwrit.com/docs"
+
+[project.scripts]
+writ = "pywrit.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

pywrit-0.2.0/src/pywrit/__init__.py

@@ -0,0 +1,41 @@
+"""pywrit — Python client for Writ, the gate before the write.
+
+Put a policy gate in front of your agent's dangerous actions:
+
+    from pywrit import WritClient
+
+    client = WritClient(api_key="writ_...")
+    result = client.check(
+        sponsor_id="acme",
+        agent_id="agent-7",
+        verb="db.write",
+        target="prod.customers",
+        purpose="backfill region field",
+    )
+    if result.decision == "ALLOW":
+        ...  # perform the write, result.auth_token proves it was gated
+    elif result.decision == "STEP_UP":
+        ...  # a human sponsor must approve via client.grant(...)
+"""
+
+from .client import CheckResult, WritClient
+from .errors import (
+    AuthenticationError,
+    NotFoundError,
+    PaymentRequiredError,
+    RateLimitError,
+    WritError,
+)
+
+__version__ = "0.2.0"
+
+__all__ = [
+    "WritClient",
+    "CheckResult",
+    "WritError",
+    "AuthenticationError",
+    "PaymentRequiredError",
+    "NotFoundError",
+    "RateLimitError",
+    "__version__",
+]

{pywrit-0.1.2/writ_cli → pywrit-0.2.0/src/pywrit}/cli.py

@@ -391,20 +391,49 @@ def _find_func(tree, func_name, site_lineno):
 
 
 def _helper_insert_index(lines, tree):
+    """Return line index after which to splice the helper (module level).
+
+    Always inserts before the first module-level function or class.
+    Returns -1 to insert at the start of the file (before line 0).
+    `_apply_edits` splices at ``idx + 1``, so -1 → position 0.
+    """
+    first_def = None
+    for node in tree.body:
+        if isinstance(node, (_ast.FunctionDef, _ast.AsyncFunctionDef,
+                             _ast.ClassDef)):
+            first_def = node.lineno - 1
+            break
+
+    def _cap(idx):
+        # Never insert at or after the first def/class (would IndentationError).
+        if first_def is None:
+            return idx
+        return min(idx, first_def - 1)
+
     last_import_end = -1
     for node in tree.body:
         if isinstance(node, (_ast.Import, _ast.ImportFrom)):
-            last_import_end = node.end_lineno - 1
+            end = node.end_lineno - 1
+            if first_def is not None and end >= first_def:
+                continue
+            last_import_end = end
     if last_import_end >= 0:
-        return last_import_end
+        return _cap(last_import_end)
+
     if tree.body and isinstance(tree.body[0], _ast.Expr) and \
             isinstance(tree.body[0].value, _ast.Constant) and \
             isinstance(tree.body[0].value.value, str):
-        return tree.body[0].end_lineno - 1
+        return _cap(tree.body[0].end_lineno - 1)
+
     idx = -1
     if lines and lines[0].startswith("#!"):
         idx = 0
-    return idx
+    # PEP 263 encoding cookie on line 1 or 2
+    enc = 1 if idx == 0 else 0
+    if (len(lines) > enc and lines[enc].lstrip().startswith("#")
+            and "coding" in lines[enc]):
+        idx = enc
+    return _cap(idx)
 
 
 def _build_edits(path, rel_path, source, sites, gated):

pywrit-0.2.0/src/pywrit/client.py

@@ -0,0 +1,249 @@
+"""Synchronous Python client for the Writ gate API."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Dict, Iterator, List, Optional
+
+import httpx
+
+from .errors import (
+    AuthenticationError,
+    NotFoundError,
+    PaymentRequiredError,
+    RateLimitError,
+    WritError,
+)
+
+DEFAULT_BASE_URL = "https://j72ckh66ukck2kcbq3oiwxaalm0olxwb.lambda-url.us-east-1.on.aws"
+
+
+@dataclass
+class CheckResult:
+    """The outcome of a gate check."""
+
+    decision: str  # ALLOW | DENY | STEP_UP
+    receipt: Dict[str, Any] = field(default_factory=dict)
+    auth_token: Optional[str] = None
+    token_expires_in: Optional[int] = None
+    raw: Dict[str, Any] = field(default_factory=dict)
+
+    @property
+    def allowed(self) -> bool:
+        return self.decision == "ALLOW"
+
+    @property
+    def receipt_id(self) -> Optional[str]:
+        return self.receipt.get("receiptId") or self.raw.get("receiptId")
+
+
+class WritClient:
+    """Client for the Writ policy gate.
+
+    Args:
+        api_key: Your ``writ_`` API key. Not required for the keyless
+            sandbox (``sandbox()``).
+        base_url: Gate base URL. Defaults to the hosted gate.
+        timeout: HTTP timeout in seconds.
+        http_client: Optional pre-configured ``httpx.Client`` (useful for tests).
+    """
+
+    def __init__(
+        self,
+        api_key: Optional[str] = None,
+        base_url: str = DEFAULT_BASE_URL,
+        timeout: float = 30.0,
+        http_client: Optional[httpx.Client] = None,
+    ):
+        self.api_key = api_key
+        self.base_url = base_url.rstrip("/")
+        self._client = http_client or httpx.Client(timeout=timeout)
+
+    # -- internals --------------------------------------------------------
+
+    def _headers(self, authenticated: bool = True) -> Dict[str, str]:
+        headers = {"Content-Type": "application/json"}
+        if authenticated:
+            if not self.api_key:
+                raise AuthenticationError("An API key is required for this call.")
+            headers["Authorization"] = f"Bearer {self.api_key}"
+        return headers
+
+    def _request(self, method: str, path: str, authenticated: bool = True, **kwargs) -> Any:
+        try:
+            resp = self._client.request(
+                method, self.base_url + path, headers=self._headers(authenticated), **kwargs
+            )
+        except httpx.HTTPError as exc:
+            raise WritError(f"Request failed: {exc}") from exc
+        if resp.status_code == 401:
+            raise AuthenticationError("Invalid or missing API key.", 401, _safe_json(resp))
+        if resp.status_code == 402:
+            raise PaymentRequiredError(
+                "Free tier exhausted or billing past due — no receipt was written.",
+                402,
+                _safe_json(resp),
+            )
+        if resp.status_code == 404:
+            raise NotFoundError("Not found.", 404, _safe_json(resp))
+        if resp.status_code == 429:
+            raise RateLimitError("Rate limited — slow down and retry.", 429, _safe_json(resp))
+        if resp.status_code >= 400:
+            body = _safe_json(resp)
+            raise WritError(
+                f"Writ API error {resp.status_code}: {body or resp.text}",
+                resp.status_code,
+                body,
+            )
+        if not resp.content:
+            return None
+        return resp.json()
+
+    # -- the gate ----------------------------------------------------------
+
+    def check(
+        self,
+        sponsor_id: str,
+        agent_id: str,
+        verb: str,
+        target: str,
+        purpose: str,
+        ttl_seconds: Optional[int] = None,
+    ) -> CheckResult:
+        """Ask the gate whether an agent may perform a write.
+
+        Returns a :class:`CheckResult` with ``decision`` of ``ALLOW``,
+        ``DENY``, or ``STEP_UP``. On ``ALLOW`` the result also carries
+        ``auth_token`` — a short-lived token bound to this exact
+        sponsor/agent/verb/target/purpose. On ``STEP_UP`` a human sponsor
+        must approve via :meth:`grant`, then the agent re-checks.
+        """
+        payload: Dict[str, Any] = {
+            "sponsorId": sponsor_id,
+            "agentId": agent_id,
+            "verb": verb,
+            "target": target,
+            "purpose": purpose,
+        }
+        if ttl_seconds is not None:
+            payload["ttlSeconds"] = ttl_seconds
+        raw = self._request("POST", "/v1/check", json=payload)
+        return CheckResult(
+            decision=raw.get("decision", "DENY"),
+            receipt=raw.get("receipt", {}),
+            auth_token=raw.get("authToken"),
+            token_expires_in=raw.get("tokenExpiresIn"),
+            raw=raw,
+        )
+
+    def verify_token(
+        self,
+        token: str,
+        verb: Optional[str] = None,
+        target: Optional[str] = None,
+        purpose: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        """Validate an ``ALLOW`` auth token.
+
+        When verb/target/purpose are given, the token must be bound to
+        exactly that write — anything else is purpose drift and returns
+        ``{"valid": False, ...}``.
+        """
+        payload: Dict[str, Any] = {"token": token}
+        if verb is not None:
+            payload["verb"] = verb
+        if target is not None:
+            payload["target"] = target
+        if purpose is not None:
+            payload["purpose"] = purpose
+        return self._request("POST", "/v1/tokens/verify", json=payload)
+
+    def grant(self, payload: Dict[str, Any]) -> Dict[str, Any]:
+        """Mint a human-sponsor grant (the STEP_UP approval path)."""
+        return self._request("POST", "/v1/grants", json=payload)
+
+    # -- policy ------------------------------------------------------------
+
+    def get_policy(self) -> Dict[str, Any]:
+        """Fetch the tenant's current policy document."""
+        return self._request("GET", "/v1/policy")
+
+    def set_policy(self, policy: Dict[str, Any]) -> Dict[str, Any]:
+        """Replace the tenant's policy document."""
+        return self._request("PUT", "/v1/policy", json=policy)
+
+    # -- kill switch ---------------------------------------------------------
+
+    def revoke(self, sponsor_id: str, agent_id: str, **kwargs: Any) -> Dict[str, Any]:
+        """Revoke an agent's ability to write."""
+        return self._request(
+            "POST", "/v1/revoke", json={"sponsorId": sponsor_id, "agentId": agent_id, **kwargs}
+        )
+
+    def reinstate(self, sponsor_id: str, agent_id: str, **kwargs: Any) -> Dict[str, Any]:
+        """Reinstate a previously revoked agent."""
+        return self._request(
+            "POST", "/v1/reinstate", json={"sponsorId": sponsor_id, "agentId": agent_id, **kwargs}
+        )
+
+    def revoked(self) -> List[Dict[str, Any]]:
+        """List currently revoked agents."""
+        return self._request("GET", "/v1/revoked")
+
+    # -- audit log -----------------------------------------------------------
+
+    def receipts(self, limit: int = 50) -> List[Dict[str, Any]]:
+        """List recent receipts (the audit log)."""
+        return self._request("GET", "/v1/receipts", params={"limit": limit})
+
+    def receipt(self, receipt_id: str) -> Dict[str, Any]:
+        """Fetch a single receipt by id."""
+        return self._request("GET", f"/v1/receipts/{receipt_id}")
+
+    def verify_chain(self, limit: int = 200) -> Dict[str, Any]:
+        """Verify the tamper-evident audit-log hash chain.
+
+        Recomputes every chained receipt's HMAC and checks each link.
+        Returns ``{"ok": True, ...}`` when the chain is intact.
+        """
+        return self._request("GET", "/v1/receipts/verify", params={"limit": limit})
+
+    def stream_receipts(self) -> Iterator[Dict[str, Any]]:
+        """Yield receipts as they are written (server-sent events)."""
+        with self._client.stream(
+            "GET", self.base_url + "/v1/receipts/stream", headers=self._headers()
+        ) as resp:
+            if resp.status_code != 200:
+                raise WritError(f"Stream failed: HTTP {resp.status_code}", resp.status_code)
+            import json
+
+            for line in resp.iter_lines():
+                if line.startswith("data:"):
+                    yield json.loads(line[5:].strip())
+
+    # -- keyless trial ---------------------------------------------------------
+
+    def sandbox(self, payload: Dict[str, Any]) -> Dict[str, Any]:
+        """Run a check against the keyless sandbox. No API key required.
+
+        The sandbox only allows verb ``demo_write`` and targets starting
+        with ``demo-``. The payload needs ``sponsorId``, ``agentId``,
+        ``verb``, ``target`` and ``purpose``.
+        """
+        return self._request("POST", "/v1/sandbox", authenticated=False, json=payload)
+
+    def close(self) -> None:
+        self._client.close()
+
+    def __enter__(self) -> "WritClient":
+        return self
+
+    def __exit__(self, *exc: Any) -> None:
+        self.close()
+
+
+def _safe_json(resp: httpx.Response) -> Any:
+    try:
+        return resp.json()
+    except Exception:
+        return None

pywrit-0.2.0/src/pywrit/errors.py

@@ -0,0 +1,30 @@
+"""Typed errors for the Writ API."""
+
+
+class WritError(Exception):
+    """Base error for Writ API failures."""
+
+    def __init__(self, message, status_code=None, body=None):
+        super().__init__(message)
+        self.status_code = status_code
+        self.body = body
+
+
+class AuthenticationError(WritError):
+    """401 — missing or invalid API key."""
+
+
+class PaymentRequiredError(WritError):
+    """402 — free tier exhausted or billing past due. No receipt is written."""
+
+    def __init__(self, message, status_code=None, body=None):
+        super().__init__(message, status_code, body)
+        self.portal_endpoint = (body or {}).get("portal_endpoint")
+
+
+class NotFoundError(WritError):
+    """404 — the requested resource does not exist."""
+
+
+class RateLimitError(WritError):
+    """429 — slow down and retry."""

pywrit-0.2.0/src/pywrit.egg-info/PKG-INFO

@@ -0,0 +1,97 @@
+Metadata-Version: 2.4
+Name: pywrit
+Version: 0.2.0
+Summary: Python client + CLI for Writ — the gate before the write
+License: MIT
+Project-URL: Homepage, https://github.com/AvenueDAdmin/pywrit
+Project-URL: Documentation, https://withwrit.com/docs
+Keywords: ai-agents,policy,audit-log,guardrails
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: httpx>=0.27
+Dynamic: license-file
+
+# pywrit
+
+Python client + CLI for [Writ](https://withwrit.com) — the gate before the write.
+Put a policy gate in front of your agent's dangerous actions.
+
+## Install
+
+```bash
+pip install pywrit
+```
+
+## Python client
+
+```python
+from pywrit import WritClient
+
+client = WritClient(api_key="writ_...")
+
+result = client.check(
+    sponsor_id="acme",
+    agent_id="agent-7",
+    verb="db.write",
+    target="prod.customers",
+    purpose="backfill region field",
+)
+
+if result.decision == "ALLOW":
+    # result.auth_token is a short-lived token bound to this exact write
+    perform_write(...)
+elif result.decision == "STEP_UP":
+    # a human sponsor must approve first: client.grant(...), then re-check
+    ...
+else:
+    # DENY
+    ...
+```
+
+No API key yet? Try the keyless sandbox:
+
+```python
+client = WritClient()
+client.sandbox({
+    "sponsorId": "acme",
+    "agentId": "agent-7",
+    "verb": "demo_write",       # sandbox only allows demo_write ...
+    "target": "demo-customers", # ... on targets starting with demo-
+    "purpose": "trying the gate",
+})
+```
+
+### What's covered
+
+- `check(...)` — the gate: `ALLOW` / `DENY` / `STEP_UP`, plus a receipt every time
+- `verify_token(...)` — validate an `ALLOW` auth token (catches purpose drift)
+- `grant(...)` — human-sponsor approval for the `STEP_UP` path
+- `get_policy()` / `set_policy(...)` — manage the tenant policy
+- `revoke(...)` / `reinstate(...)` / `revoked()` — the kill switch
+- `receipts()` / `receipt(id)` / `verify_chain()` / `stream_receipts()` — the audit log
+- `sandbox(...)` — keyless trial, no API key required
+
+Every decision writes a receipt, so the audit log is the meter.
+
+## CLI
+
+The same package ships the `writ` command:
+
+```bash
+writ check --key writ_... --sponsor acme --agent agent-7 \
+  --verb db.write --target prod.customers --purpose "backfill region field"
+writ scan ./my-repo
+writ receipts --key writ_...
+writ verify-chain --key writ_...
+```
+
+Run `writ --help` for the full command list.
+
+## Docs
+
+Full API reference: [withwrit.com/docs](https://withwrit.com/docs)
+
+## License
+
+MIT

pywrit-0.2.0/src/pywrit.egg-info/SOURCES.txt

@@ -0,0 +1,14 @@
+LICENSE
+README.md
+pyproject.toml
+src/pywrit/__init__.py
+src/pywrit/cli.py
+src/pywrit/client.py
+src/pywrit/errors.py
+src/pywrit.egg-info/PKG-INFO
+src/pywrit.egg-info/SOURCES.txt
+src/pywrit.egg-info/dependency_links.txt
+src/pywrit.egg-info/entry_points.txt
+src/pywrit.egg-info/requires.txt
+src/pywrit.egg-info/top_level.txt
+tests/test_client.py

pywrit-0.2.0/src/pywrit.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+writ = pywrit.cli:main

pywrit-0.2.0/src/pywrit.egg-info/requires.txt

@@ -0,0 +1 @@
+httpx>=0.27

pywrit-0.2.0/src/pywrit.egg-info/top_level.txt

@@ -0,0 +1 @@
+pywrit

pywrit-0.2.0/tests/test_client.py

@@ -0,0 +1,99 @@
+"""Tests for pywrit. Run with: python -m pytest"""
+
+import json
+
+import httpx
+
+from pywrit import PaymentRequiredError, WritClient, WritError
+
+
+def _client(handler):
+    transport = httpx.MockTransport(handler)
+    return WritClient(api_key="writ_test", http_client=httpx.Client(transport=transport))
+
+
+def test_check_allow():
+    def handler(request):
+        assert request.url.path == "/v1/check"
+        body = json.loads(request.content)
+        assert body["verb"] == "db.write"
+        return httpx.Response(
+            200,
+            json={
+                "decision": "ALLOW",
+                "receipt": {"receiptId": "r_123"},
+                "authToken": "tok_abc",
+                "tokenExpiresIn": 90,
+            },
+        )
+
+    result = _client(handler).check("acme", "agent-7", "db.write", "prod.customers", "backfill")
+    assert result.decision == "ALLOW"
+    assert result.allowed
+    assert result.receipt_id == "r_123"
+    assert result.auth_token == "tok_abc"
+
+
+def test_check_step_up():
+    def handler(request):
+        return httpx.Response(200, json={"decision": "STEP_UP", "receipt": {}})
+
+    result = _client(handler).check("acme", "agent-7", "db.write", "prod.customers", "backfill")
+    assert result.decision == "STEP_UP"
+    assert not result.allowed
+
+
+def test_payment_required():
+    def handler(request):
+        return httpx.Response(402, json={"portal_endpoint": "/v1/billing/portal"})
+
+    try:
+        _client(handler).check("acme", "agent-7", "db.write", "t", "p")
+    except PaymentRequiredError as exc:
+        assert exc.status_code == 402
+        assert exc.portal_endpoint == "/v1/billing/portal"
+    else:
+        raise AssertionError("expected PaymentRequiredError")
+
+
+def test_server_error():
+    def handler(request):
+        return httpx.Response(500, json={"error": "boom"})
+
+    try:
+        _client(handler).receipts()
+    except WritError as exc:
+        assert exc.status_code == 500
+    else:
+        raise AssertionError("expected WritError")
+
+
+def test_verify_chain():
+    def handler(request):
+        assert request.url.path == "/v1/receipts/verify"
+        return httpx.Response(200, json={"ok": True, "checked": 42, "complete": True})
+
+    report = _client(handler).verify_chain()
+    assert report["ok"] is True
+    assert report["checked"] == 42
+
+
+def test_cli_help():
+    import io
+    import sys
+    from contextlib import redirect_stdout
+
+    from pywrit.cli import main
+
+    buf = io.StringIO()
+    old = sys.argv
+    sys.argv = ["writ", "--help"]
+    try:
+        with redirect_stdout(buf):
+            main()
+    except SystemExit as exc:
+        assert exc.code == 0
+    finally:
+        sys.argv = old
+    assert "check" in buf.getvalue()
+    assert "scan" in buf.getvalue()

pywrit-0.1.2/PKG-INFO

@@ -1,80 +0,0 @@
-Metadata-Version: 2.4
-Name: pywrit
-Version: 0.1.2
-Summary: Ask Writ before an agent writes — allow/deny gate with a tamper-evident audit log
-Project-URL: Homepage, https://withwrit.com
-Project-URL: Documentation, https://docs.withwrit.com
-Keywords: agents,audit-log,authorization,api-keys
-Classifier: Programming Language :: Python :: 3
-Classifier: Operating System :: OS Independent
-Classifier: Topic :: Security
-Classifier: Topic :: System :: Systems Administration
-Requires-Python: >=3.9
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Dynamic: license-file
-
-# pywrit 🏴‍☠️
-
-*Arrr!* The Writ CLI — ask before yer agent writes.
-
-```bash
-pip install pywrit
-writ key --email you@company.com
-```
-
-Writ is an allow/deny gate that sits in front of every write your AI agent makes. Each check writes a tamper-evident receipt to your audit log. No more wondering who called what, or when.
-
-Shiver me timbers, it's that simple.
-
-## What it does
-
-- `writ key` — Get a free API key (1,000 receipts/month, no card)
-- `writ check` — Ask the gate before a write (ALLOW or DENY)
-- `writ revoke` — Kill switch: revoke a principal's tokens in one click
-- `writ receipts` — See your audit log
-- `writ scan` — Find every write in your repo and instrument it
-
-## Docs
-
-Full docs at [docs.withwrit.com](https://docs.withwrit.com). Quickstart at [docs.withwrit.com/quickstart](https://docs.withwrit.com/quickstart).
-
----
-
-## Packaging notes (for maintainers)
-
-Installable distribution of the Writ CLI. `pip install pywrit` gives you the
-`writ` command — no `curl` + `chmod` dance.
-
-### Layout
-
-- `pyproject.toml` — package metadata, `writ` console-script entry point
-- `writ_cli/__init__.py` — version
-- `writ_cli/cli.py` — the CLI itself (stdlib-only: argparse, json, urllib)
-
-### Relationship to `gate/web/writ`
-
-`gate/web/writ` is the **self-contained single-file script** served by the Lambda
-at `/writ` (the `curl -fsSL ... -o writ` download path). It must stay a single
-file with no install step.
-
-`writ_cli/cli.py` is the **PyPI package source**. The two files are currently
-byte-identical by copy. If you change CLI behavior, update **both** and keep
-them in sync — the download path and the pip path must behave the same.
-
-### Build & test locally
-
-```bash
-cd cli
-python -m build                    # needs `pip install build`
-pip install -e .                   # editable install, creates the `writ` command
-writ --help
-```
-
-### Publish
-
-```bash
-cd cli
-python -m build
-twine upload dist/*
-```

pywrit-0.1.2/README.md

@@ -1,64 +0,0 @@
-# pywrit 🏴‍☠️
-
-*Arrr!* The Writ CLI — ask before yer agent writes.
-
-```bash
-pip install pywrit
-writ key --email you@company.com
-```
-
-Writ is an allow/deny gate that sits in front of every write your AI agent makes. Each check writes a tamper-evident receipt to your audit log. No more wondering who called what, or when.
-
-Shiver me timbers, it's that simple.
-
-## What it does
-
-- `writ key` — Get a free API key (1,000 receipts/month, no card)
-- `writ check` — Ask the gate before a write (ALLOW or DENY)
-- `writ revoke` — Kill switch: revoke a principal's tokens in one click
-- `writ receipts` — See your audit log
-- `writ scan` — Find every write in your repo and instrument it
-
-## Docs
-
-Full docs at [docs.withwrit.com](https://docs.withwrit.com). Quickstart at [docs.withwrit.com/quickstart](https://docs.withwrit.com/quickstart).
-
----
-
-## Packaging notes (for maintainers)
-
-Installable distribution of the Writ CLI. `pip install pywrit` gives you the
-`writ` command — no `curl` + `chmod` dance.
-
-### Layout
-
-- `pyproject.toml` — package metadata, `writ` console-script entry point
-- `writ_cli/__init__.py` — version
-- `writ_cli/cli.py` — the CLI itself (stdlib-only: argparse, json, urllib)
-
-### Relationship to `gate/web/writ`
-
-`gate/web/writ` is the **self-contained single-file script** served by the Lambda
-at `/writ` (the `curl -fsSL ... -o writ` download path). It must stay a single
-file with no install step.
-
-`writ_cli/cli.py` is the **PyPI package source**. The two files are currently
-byte-identical by copy. If you change CLI behavior, update **both** and keep
-them in sync — the download path and the pip path must behave the same.
-
-### Build & test locally
-
-```bash
-cd cli
-python -m build                    # needs `pip install build`
-pip install -e .                   # editable install, creates the `writ` command
-writ --help
-```
-
-### Publish
-
-```bash
-cd cli
-python -m build
-twine upload dist/*
-```

pywrit-0.1.2/pyproject.toml

@@ -1,32 +0,0 @@
-[build-system]
-requires = ["setuptools>=61"]
-build-backend = "setuptools.build_meta"
-
-[project]
-# Distribution name: pywrit (approved by Chad 2026-09-27).
-# The bare name "writ" is taken on PyPI.
-name = "pywrit"
-version = "0.1.2"
-description = "Ask Writ before an agent writes — allow/deny gate with a tamper-evident audit log"
-readme = "README.md"
-requires-python = ">=3.9"
-keywords = ["agents", "audit-log", "authorization", "api-keys"]
-classifiers = [
-    "Programming Language :: Python :: 3",
-    "Operating System :: OS Independent",
-    "Topic :: Security",
-    "Topic :: System :: Systems Administration",
-]
-# No third-party dependencies — the CLI is stdlib-only (argparse, json, urllib).
-dependencies = []
-
-[project.urls]
-Homepage = "https://withwrit.com"
-Documentation = "https://docs.withwrit.com"
-
-[project.scripts]
-writ = "writ_cli.cli:main"
-
-[tool.setuptools.packages.find]
-where = ["."]
-include = ["writ_cli*"]

pywrit-0.1.2/pywrit.egg-info/PKG-INFO

@@ -1,80 +0,0 @@
-Metadata-Version: 2.4
-Name: pywrit
-Version: 0.1.2
-Summary: Ask Writ before an agent writes — allow/deny gate with a tamper-evident audit log
-Project-URL: Homepage, https://withwrit.com
-Project-URL: Documentation, https://docs.withwrit.com
-Keywords: agents,audit-log,authorization,api-keys
-Classifier: Programming Language :: Python :: 3
-Classifier: Operating System :: OS Independent
-Classifier: Topic :: Security
-Classifier: Topic :: System :: Systems Administration
-Requires-Python: >=3.9
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Dynamic: license-file
-
-# pywrit 🏴‍☠️
-
-*Arrr!* The Writ CLI — ask before yer agent writes.
-
-```bash
-pip install pywrit
-writ key --email you@company.com
-```
-
-Writ is an allow/deny gate that sits in front of every write your AI agent makes. Each check writes a tamper-evident receipt to your audit log. No more wondering who called what, or when.
-
-Shiver me timbers, it's that simple.
-
-## What it does
-
-- `writ key` — Get a free API key (1,000 receipts/month, no card)
-- `writ check` — Ask the gate before a write (ALLOW or DENY)
-- `writ revoke` — Kill switch: revoke a principal's tokens in one click
-- `writ receipts` — See your audit log
-- `writ scan` — Find every write in your repo and instrument it
-
-## Docs
-
-Full docs at [docs.withwrit.com](https://docs.withwrit.com). Quickstart at [docs.withwrit.com/quickstart](https://docs.withwrit.com/quickstart).
-
----
-
-## Packaging notes (for maintainers)
-
-Installable distribution of the Writ CLI. `pip install pywrit` gives you the
-`writ` command — no `curl` + `chmod` dance.
-
-### Layout
-
-- `pyproject.toml` — package metadata, `writ` console-script entry point
-- `writ_cli/__init__.py` — version
-- `writ_cli/cli.py` — the CLI itself (stdlib-only: argparse, json, urllib)
-
-### Relationship to `gate/web/writ`
-
-`gate/web/writ` is the **self-contained single-file script** served by the Lambda
-at `/writ` (the `curl -fsSL ... -o writ` download path). It must stay a single
-file with no install step.
-
-`writ_cli/cli.py` is the **PyPI package source**. The two files are currently
-byte-identical by copy. If you change CLI behavior, update **both** and keep
-them in sync — the download path and the pip path must behave the same.
-
-### Build & test locally
-
-```bash
-cd cli
-python -m build                    # needs `pip install build`
-pip install -e .                   # editable install, creates the `writ` command
-writ --help
-```
-
-### Publish
-
-```bash
-cd cli
-python -m build
-twine upload dist/*
-```

pywrit-0.1.2/pywrit.egg-info/SOURCES.txt

@@ -1,10 +0,0 @@
-LICENSE
-README.md
-pyproject.toml
-pywrit.egg-info/PKG-INFO
-pywrit.egg-info/SOURCES.txt
-pywrit.egg-info/dependency_links.txt
-pywrit.egg-info/entry_points.txt
-pywrit.egg-info/top_level.txt
-writ_cli/__init__.py
-writ_cli/cli.py

pywrit-0.1.2/pywrit.egg-info/entry_points.txt

@@ -1,2 +0,0 @@
-[console_scripts]
-writ = writ_cli.cli:main

pywrit-0.1.2/pywrit.egg-info/top_level.txt

@@ -1 +0,0 @@
-writ_cli

pywrit-0.1.2/writ_cli/__init__.py

@@ -1,3 +0,0 @@
-"""Writ CLI package."""
-
-__version__ = "0.1.0"