pywrit 0.1.7__tar.gz → 0.1.8__tar.gz

{pywrit-0.1.7/pywrit.egg-info → pywrit-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.1.7
+Version: 0.1.8
 Summary: Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log
 Project-URL: Homepage, https://withwrit.com
 Project-URL: Documentation, https://docs.withwrit.com

{pywrit-0.1.7 → pywrit-0.1.8}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 # Distribution name: pywrit (approved by Chad 2026-09-27).
 # The bare name "writ" is taken on PyPI.
 name = "pywrit"
-version = "0.1.7"
+version = "0.1.8"
 description = "Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log"
 readme = "README.md"
 requires-python = ">=3.9"

{pywrit-0.1.7 → pywrit-0.1.8/pywrit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.1.7
+Version: 0.1.8
 Summary: Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log
 Project-URL: Homepage, https://withwrit.com
 Project-URL: Documentation, https://docs.withwrit.com

{pywrit-0.1.7 → pywrit-0.1.8}/writ_cli/cli.py

@@ -11573,6 +11573,7 @@ def main():
     policy.add_argument("--key", default=config.api_key())
     policy.add_argument("--set", nargs=2, metavar=("VERB", "MODE"), action="append", default=[])
     policy.add_argument("--env", default="", help="Environment override to get/set: dev, staging, or prod (default: tenant policy)")
+    policy.add_argument("--principal", default="", help="Principal id for a per-principal policy override")
 
     check = sub.add_parser("check", help="ALLOW or DENY a write")
     check.add_argument("--key", default=config.api_key())
@@ -11603,7 +11604,8 @@ def main():
     revoked = sub.add_parser("revoked", help="List revoked principals (sponsor token)")
     revoked.add_argument("--sponsor-token", default=config.sponsor_token())
 
-    receipts = sub.add_parser("receipts", help="Latest receipts for your tenant")
+    receipts = sub.add_parser("receipts", help="Latest receipts for your tenant, or one receipt by id")
+    receipts.add_argument("receipt_id", nargs="?", default="", help="Fetch a single receipt by id; omit to list")
     receipts.add_argument("--key", default=config.api_key())
 
     stream = sub.add_parser("stream", help="Tail the live audit log (SSE stream)")
@@ -11718,6 +11720,90 @@ def main():
     gh_disc.add_argument("--totp-code", default="", help="TOTP step-up code")
     gh_disc.add_argument("--key", default=config.api_key())
 
+    principals = sub.add_parser("principals", help="Manage the tenant identity directory")
+    pr_sub = principals.add_subparsers(dest="principals_cmd", required=True)
+    pr_list = pr_sub.add_parser("list", help="List principals")
+    pr_list.add_argument("--key", default=config.api_key())
+    pr_create = pr_sub.add_parser("create", help="Create a principal")
+    pr_create.add_argument("name")
+    pr_create.add_argument("--key", default=config.api_key())
+    pr_rename = pr_sub.add_parser("rename", help="Rename a principal")
+    pr_rename.add_argument("principal_id")
+    pr_rename.add_argument("new_name")
+    pr_rename.add_argument("--key", default=config.api_key())
+    pr_disable = pr_sub.add_parser("disable", help="Disable a principal (pauses its keys)")
+    pr_disable.add_argument("principal_id")
+    pr_disable.add_argument("--key", default=config.api_key())
+    pr_enable = pr_sub.add_parser("enable", help="Re-enable a principal")
+    pr_enable.add_argument("principal_id")
+    pr_enable.add_argument("--key", default=config.api_key())
+    pr_del = pr_sub.add_parser("delete", help="Delete a principal")
+    pr_del.add_argument("principal_id")
+    pr_del.add_argument("--force", action="store_true", help="Revoke remaining keys first")
+    pr_del.add_argument("--key", default=config.api_key())
+    pr_rev = pr_sub.add_parser("revoke-keys", help="Revoke all API keys for a principal")
+    pr_rev.add_argument("principal_id")
+    pr_rev.add_argument("--key", default=config.api_key())
+
+    verbs = sub.add_parser("verbs", help="Manage the tenant verb vocabulary")
+    vb_sub = verbs.add_subparsers(dest="verbs_cmd", required=True)
+    vb_list = vb_sub.add_parser("list", help="List custom verbs")
+    vb_list.add_argument("--key", default=config.api_key())
+    vb_add = vb_sub.add_parser("add", help="Add a custom verb")
+    vb_add.add_argument("name")
+    vb_add.add_argument("--description", default="")
+    vb_add.add_argument("--resolved-verb", default="", help="Canonical verb this aliases")
+    vb_add.add_argument("--key", default=config.api_key())
+    vb_rename = vb_sub.add_parser("rename", help="Rename or redescribe a custom verb")
+    vb_rename.add_argument("name")
+    vb_rename.add_argument("--new-name", default="")
+    vb_rename.add_argument("--description", default="")
+    vb_rename.add_argument("--key", default=config.api_key())
+    vb_retire = vb_sub.add_parser("retire", help="Retire a custom verb")
+    vb_retire.add_argument("name")
+    vb_retire.add_argument("--key", default=config.api_key())
+
+    keys = sub.add_parser("keys", help="Manage tenant API keys")
+    keys_sub = keys.add_subparsers(dest="keys_cmd", required=True)
+    keys_list = keys_sub.add_parser("list", help="List key metadata")
+    keys_list.add_argument("--key", default=config.api_key())
+    keys_create = keys_sub.add_parser("create", help="Create a new API key (TOTP-gated)")
+    keys_create.add_argument("--label", default="", help="Optional label")
+    keys_create.add_argument("--principal-id", default="", help="Assign to a principal")
+    keys_create.add_argument("--totp-code", default="", help="TOTP step-up code")
+    keys_create.add_argument("--key", default=config.api_key())
+    keys_revoke = keys_sub.add_parser("revoke", help="Revoke an API key by id")
+    keys_revoke.add_argument("key_id")
+    keys_revoke.add_argument("--key", default=config.api_key())
+
+    badge = sub.add_parser("badge", help="Dynamic README badge tokens")
+    badge_sub = badge.add_subparsers(dest="badge_cmd", required=True)
+    badge_create = badge_sub.add_parser("create", help="Create a public badge token")
+    badge_create.add_argument("--label", default="gated")
+    badge_create.add_argument("--key", default=config.api_key())
+    badge_revoke = badge_sub.add_parser("revoke", help="Revoke a badge token")
+    badge_revoke.add_argument("token")
+    badge_revoke.add_argument("--key", default=config.api_key())
+
+    vault = sub.add_parser("vault", help="Credential vault")
+    vault_sub = vault.add_subparsers(dest="vault_cmd", required=True)
+    vault_list = vault_sub.add_parser("list", help="List enrolled credentials")
+    vault_list.add_argument("--key", default=config.api_key())
+
+    stats = sub.add_parser("stats", help="24-hour receipt decision counters")
+    stats.add_argument("--key", default=config.api_key())
+
+    lease = sub.add_parser("lease", help="Create a single-use gated-execution lease")
+    lease.add_argument("--verb", required=True)
+    lease.add_argument("--target", required=True)
+    lease.add_argument("--purpose", required=True)
+    lease.add_argument("--ttl", type=int, default=60, help="Lease TTL in seconds")
+    lease.add_argument("--key", default=config.api_key())
+
+    execute = sub.add_parser("execute", help="Execute a gated upstream request using a lease")
+    execute.add_argument("lease_id")
+    execute.add_argument("--key", default=config.api_key())
+
     args = parser.parse_args()
     if args.cmd == "key":
         payload = {"email": args.email}
@@ -11764,7 +11850,8 @@ def main():
 
     _KEY_COMMANDS = {"me", "policy", "check", "receipts", "stream",
                      "verify-chain", "invite", "token-verify", "manifest-key",
-                     "manifests", "github"}
+                     "manifests", "github", "principals", "verbs", "keys",
+                     "badge", "vault", "stats", "lease", "execute"}
     if args.cmd in _KEY_COMMANDS and not _require_key(args.key):
         return 2
 
@@ -11789,7 +11876,12 @@ def main():
     if args.cmd == "me":
         return _request_and_print("GET", "/v1/me", key=args.key)
     if args.cmd == "policy":
-        url = "/v1/policy" if not args.env else f"/v1/policies/environments/{args.env}"
+        if args.principal:
+            url = "/v1/policies/principals/" + urllib.parse.quote(args.principal, safe="")
+            if args.env:
+                url += "?environment=" + urllib.parse.quote(args.env, safe="")
+        else:
+            url = "/v1/policy" if not args.env else f"/v1/policies/environments/{args.env}"
         if args.set:
             for verb, mode in args.set:
                 if mode not in MODES:
@@ -11798,6 +11890,8 @@ def main():
             return _request_and_print("PUT", url, {verb: mode for verb, mode in args.set}, key=args.key)
         return _request_and_print("GET", url, key=args.key)
     if args.cmd == "receipts":
+        if args.receipt_id:
+            return _request_and_print("GET", "/v1/receipts/" + urllib.parse.quote(args.receipt_id, safe=""), key=args.key)
         return _request_and_print("GET", "/v1/receipts", key=args.key)
     if args.cmd == "stream":
         return stream_cmd(args)
@@ -11849,6 +11943,72 @@ def main():
         if args.github_cmd == "disconnect":
             return _request_and_print("POST", "/v1/github/disconnect",
                 {"installationId": args.installation_id, "totpCode": args.totp_code}, key=args.key)
+    if args.cmd == "principals":
+        if args.principals_cmd == "list":
+            return _request_and_print("GET", "/v1/principals", key=args.key)
+        if args.principals_cmd == "create":
+            return _request_and_print("POST", "/v1/principals", {"name": args.name}, key=args.key)
+        if args.principals_cmd == "rename":
+            return _request_and_print("PATCH", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe=""),
+                {"name": args.new_name}, key=args.key)
+        if args.principals_cmd == "disable":
+            return _request_and_print("PATCH", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe=""),
+                {"disabled": True}, key=args.key)
+        if args.principals_cmd == "enable":
+            return _request_and_print("PATCH", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe=""),
+                {"disabled": False}, key=args.key)
+        if args.principals_cmd == "delete":
+            qs = "?force=1" if args.force else ""
+            return _request_and_print("DELETE", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe="") + qs, key=args.key)
+        if args.principals_cmd == "revoke-keys":
+            return _request_and_print("POST", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe="") + "/revoke",
+                {}, key=args.key)
+    if args.cmd == "verbs":
+        if args.verbs_cmd == "list":
+            return _request_and_print("GET", "/v1/verbs", key=args.key)
+        if args.verbs_cmd == "add":
+            body = {"name": args.name}
+            if args.description:
+                body["description"] = args.description
+            if args.resolved_verb:
+                body["resolvedVerb"] = args.resolved_verb
+            return _request_and_print("POST", "/v1/verbs", body, key=args.key)
+        if args.verbs_cmd == "rename":
+            body = {}
+            if args.new_name:
+                body["name"] = args.new_name
+            if args.description:
+                body["description"] = args.description
+            return _request_and_print("PATCH", "/v1/verbs/" + urllib.parse.quote(args.name, safe=""), body, key=args.key)
+        if args.verbs_cmd == "retire":
+            return _request_and_print("DELETE", "/v1/verbs/" + urllib.parse.quote(args.name, safe=""), key=args.key)
+    if args.cmd == "keys":
+        if args.keys_cmd == "list":
+            return _request_and_print("GET", "/v1/keys", key=args.key)
+        if args.keys_cmd == "create":
+            body = {"totpCode": args.totp_code}
+            if args.label:
+                body["label"] = args.label
+            if args.principal_id:
+                body["principalId"] = args.principal_id
+            return _request_and_print("POST", "/v1/keys", body, key=args.key)
+        if args.keys_cmd == "revoke":
+            return _request_and_print("DELETE", "/v1/keys/" + urllib.parse.quote(args.key_id, safe=""), key=args.key)
+    if args.cmd == "badge":
+        if args.badge_cmd == "create":
+            return _request_and_print("POST", "/v1/badge/tokens", {"label": args.label}, key=args.key)
+        if args.badge_cmd == "revoke":
+            return _request_and_print("POST", "/v1/badge/tokens/revoke", {"token": args.token}, key=args.key)
+    if args.cmd == "vault":
+        if args.vault_cmd == "list":
+            return _request_and_print("GET", "/v1/vault", key=args.key)
+    if args.cmd == "stats":
+        return _request_and_print("GET", "/v1/receipts/stats", key=args.key)
+    if args.cmd == "lease":
+        return _request_and_print("POST", "/v1/leases",
+            {"verb": args.verb, "target": args.target, "purpose": args.purpose, "ttlSeconds": args.ttl}, key=args.key)
+    if args.cmd == "execute":
+        return _request_and_print("POST", "/v1/execute", {"leaseId": args.lease_id}, key=args.key)
     if args.cmd in ("revoke", "reinstate", "revoked"):
         if not _require_sponsor_token(args.sponsor_token):
             return 2