ceramic-fwk 0.1.2__tar.gz

ceramic_fwk-0.1.2/.codegraph/.gitignore

@@ -0,0 +1,5 @@
+# CodeGraph data files — local to each machine, not for committing.
+# Ignore everything in .codegraph/ except this file itself, so transient
+# files (the database, daemon.pid, sockets, logs) never show up in git.
+*
+!.gitignore

ceramic_fwk-0.1.2/.github/ISSUE_TEMPLATE/architecture_proposal.md

@@ -0,0 +1,74 @@
+---
+name: Architecture Proposal
+about: Propose a significant architectural change requiring an ADR
+title: "[Architecture] "
+labels: architecture
+assignees: ''
+---
+
+## Summary
+
+One-paragraph description of the proposed change.
+
+## Motivation
+
+Why is this change needed? What problem does it solve?
+
+## Current Architecture
+
+How does the relevant part of the system work today?
+
+## Proposed Architecture
+
+How should it work after this change?
+
+## Design Details
+
+### Components Affected
+
+- [ ] `ceramic/server.py` (CeramicFastMCP)
+- [ ] `ceramic/middleware/` (pipeline)
+- [ ] `ceramic/auth/` (OAuth/OIDC)
+- [ ] `ceramic/config.py` (configuration models)
+- [ ] `ceramic/identity.py` (identity propagation)
+- [ ] `ceramic/resilience.py` (circuit breaker)
+- [ ] `ceramic/security.py` (TLS/redaction)
+- [ ] Public API (`ceramic/__init__.py`)
+- [ ] Other: 
+
+### Migration Path
+
+How do existing users migrate? Is it backward compatible?
+
+### Security Impact
+
+Does this change affect authentication, authorization, or data protection?
+
+## ADR Draft
+
+```markdown
+# ADR-XXX: [Title]
+
+## Status
+Proposed
+
+## Context
+[Why this decision is needed]
+
+## Decision
+[What was decided]
+
+## Rationale
+[Why this approach over alternatives]
+
+## Consequences
+[Positive and negative effects]
+```
+
+## Risks
+
+What could go wrong? How do we mitigate it?
+
+## Alternatives Rejected
+
+Other approaches considered and why they don't fit.

ceramic_fwk-0.1.2/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,51 @@
+---
+name: Bug Report
+about: Report a bug in Ceramic
+title: "[Bug] "
+labels: bug
+assignees: ''
+---
+
+## Description
+
+A clear description of the bug.
+
+## Steps to Reproduce
+
+1. 
+2. 
+3. 
+
+## Expected Behavior
+
+What you expected to happen.
+
+## Actual Behavior
+
+What actually happened. Include error messages or stack traces if available.
+
+## Environment
+
+- **Python version**: 
+- **Ceramic version**: 
+- **OS**: 
+- **FastMCP version**: 
+- **Identity Provider** (if auth-related): 
+
+## Configuration
+
+Relevant `ceramic.yaml` sections (redact secrets):
+
+```yaml
+
+```
+
+## Minimal Reproducing Example
+
+```python
+
+```
+
+## Additional Context
+
+Any other relevant information (logs, screenshots, related issues).

ceramic_fwk-0.1.2/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,48 @@
+---
+name: Feature Request
+about: Propose a new feature for Ceramic
+title: "[Feature] "
+labels: enhancement
+assignees: ''
+---
+
+## Problem Statement
+
+What problem does this solve? Who needs it?
+
+## Proposed Solution
+
+Describe the feature you'd like.
+
+## Configuration (if applicable)
+
+How would this be configured in `ceramic.yaml`?
+
+```yaml
+
+```
+
+## API (if applicable)
+
+How would users interact with this feature in code?
+
+```python
+
+```
+
+## Alternatives Considered
+
+Other approaches you've considered and why they don't fit.
+
+## Design Considerations
+
+- Does this affect the public API?
+- Does this require a new ADR?
+- Are there security implications?
+- Does this need a new dependency?
+
+## Acceptance Criteria
+
+- [ ] 
+- [ ] 
+- [ ] 

ceramic_fwk-0.1.2/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,63 @@
+## Summary
+
+Brief description of what this PR does.
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that changes existing behavior)
+- [ ] Documentation update
+- [ ] Refactoring (no functional change)
+- [ ] CI/CD or tooling change
+
+## Related Issues
+
+Closes #
+
+## Changes
+
+- 
+- 
+- 
+
+## How to Test
+
+Steps to verify this change:
+
+1. 
+2. 
+3. 
+
+## Checklist
+
+### General
+- [ ] Code follows the project style (ruff check + ruff format pass)
+- [ ] Type annotations on all new public functions
+- [ ] Docstrings on all new public classes/functions
+- [ ] CHANGELOG.md updated under `[Unreleased]` (if user-facing)
+
+### Testing
+- [ ] Unit tests added/updated
+- [ ] Property-based tests added (if security-sensitive)
+- [ ] All tests pass (`pytest -v`)
+- [ ] No real HTTP calls in tests (mocked or test utilities used)
+
+### Security (if touching auth, tokens, or IDP communication)
+- [ ] Read `.ai/security.md` before making changes
+- [ ] No tokens/secrets logged
+- [ ] TLS enforcement preserved
+- [ ] Circuit breaker protection preserved
+- [ ] Relevant ADR read and respected
+
+### Architecture
+- [ ] Public API (`ceramic/__init__.py`) unchanged (or ADR written)
+- [ ] Middleware execution order preserved
+- [ ] No new dependencies without justification in PR description
+- [ ] Configuration changes have defaults (backward compatible)
+
+## Screenshots / Logs (if applicable)
+
+## Additional Notes
+
+Anything reviewers should know.

ceramic_fwk-0.1.2/.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  push:
+    branches: [main, "release/**"]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest -v --tb=short
+
+      - name: Run property-based tests with extended examples
+        run: pytest tests/properties/ -v --hypothesis-seed=0
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dev dependencies
+        run: pip install -e ".[dev]" ruff mypy
+
+      - name: Ruff check
+        run: ruff check ceramic/ tests/
+
+      - name: Ruff format check
+        run: ruff format --check ceramic/ tests/
+
+      - name: Type check
+        run: mypy ceramic/ --ignore-missing-imports

ceramic_fwk-0.1.2/.github/workflows/pages.yml

@@ -0,0 +1,37 @@
+name: Deploy Landing Page
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v4
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs/
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

ceramic_fwk-0.1.2/.github/workflows/publish.yml

@@ -0,0 +1,86 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  id-token: write
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest -v --tb=short
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: dist/*

ceramic_fwk-0.1.2/.github/workflows/release.yml

@@ -0,0 +1,75 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: "Version bump type"
+        required: false
+        default: "patch"
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Get current version
+        id: current
+        run: |
+          VERSION=$(grep '^version' pyproject.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Calculate new version
+        id: new
+        run: |
+          CURRENT="${{ steps.current.outputs.version }}"
+          BUMP="${{ inputs.bump || 'patch' }}"
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
+
+          case "$BUMP" in
+            patch) NEW_VERSION="$MAJOR.$MINOR.$((PATCH + 1))" ;;
+            minor) NEW_VERSION="$MAJOR.$((MINOR + 1)).0" ;;
+            major) NEW_VERSION="$((MAJOR + 1)).0.0" ;;
+          esac
+
+          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Bumping $CURRENT → $NEW_VERSION ($BUMP)"
+
+      - name: Bump version in pyproject.toml
+        run: |
+          sed -i "s/^version = \"${{ steps.current.outputs.version }}\"/version = \"${{ steps.new.outputs.version }}\"/" pyproject.toml
+
+      - name: Update CHANGELOG
+        run: |
+          DATE=$(date +%Y-%m-%d)
+          sed -i "s/## \[Unreleased\]/## [Unreleased]\n\n---\n\n## [${{ steps.new.outputs.version }}] — $DATE/" CHANGELOG.md
+          echo "" >> CHANGELOG.md
+          echo "[${{ steps.new.outputs.version }}]: https://github.com/enzomar/ceramic-fwk/compare/v${{ steps.current.outputs.version }}...v${{ steps.new.outputs.version }}" >> CHANGELOG.md
+
+      - name: Commit and tag
+        run: |
+          git add pyproject.toml CHANGELOG.md
+          git commit -m "release: v${{ steps.new.outputs.version }}"
+          git tag -a "v${{ steps.new.outputs.version }}" -m "Release v${{ steps.new.outputs.version }}"
+
+      - name: Push
+        run: |
+          git push origin main
+          git push origin "v${{ steps.new.outputs.version }}"

ceramic_fwk-0.1.2/.github/workflows/security.yml

@@ -0,0 +1,85 @@
+name: Security Checks
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Run weekly on Monday at 06:00 UTC
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  dependency-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install pip-audit
+        run: pip install pip-audit
+
+      - name: Install project dependencies
+        run: pip install -e "."
+
+      - name: Audit dependencies for known vulnerabilities
+        run: pip-audit --strict --desc --skip-editable
+
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: TruffleHog secret scan
+        uses: trufflesecurity/trufflehog@main
+        with:
+          extra_args: --only-verified
+
+  security-sensitive-files:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check for security-sensitive file changes
+        run: |
+          SECURITY_FILES=(
+            "ceramic/auth/oauth.py"
+            "ceramic/middleware/authentication.py"
+            "ceramic/auth/jwks_manager.py"
+            "ceramic/auth/token_storage.py"
+            "ceramic/security.py"
+            "ceramic/resilience.py"
+            "ceramic/identity.py"
+          )
+
+          CHANGED_FILES=$(git diff --name-only origin/main...HEAD 2>/dev/null || echo "")
+
+          SECURITY_CHANGES=""
+          for file in "${SECURITY_FILES[@]}"; do
+            if echo "$CHANGED_FILES" | grep -q "^${file}$"; then
+              SECURITY_CHANGES="${SECURITY_CHANGES}\n- ${file}"
+            fi
+          done
+
+          if [ -n "$SECURITY_CHANGES" ]; then
+            echo "⚠️ Security-sensitive files modified:"
+            echo -e "$SECURITY_CHANGES"
+            echo ""
+            echo "These files require careful review. Ensure:"
+            echo "  - No tokens/secrets are logged"
+            echo "  - TLS enforcement is preserved"
+            echo "  - Circuit breaker protection is intact"
+            echo "  - Tests cover rejection/failure cases"
+          fi

ceramic_fwk-0.1.2/.github/workflows/test.yml

@@ -0,0 +1,77 @@
+name: Test Suite
+
+on:
+  push:
+    branches: [main, "release/**"]
+  pull_request:
+    branches: [main]
+
+jobs:
+  unit-tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run unit tests
+        run: pytest tests/unit/ -v --tb=short
+
+  property-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run property-based tests
+        run: pytest tests/properties/ -v --hypothesis-seed=0
+
+  integration-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run integration tests
+        run: pytest tests/integration/ -v --tb=short
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dev dependencies
+        run: pip install -e ".[dev]" ruff mypy
+
+      - name: Ruff check
+        run: ruff check ceramic/ tests/
+
+      - name: Ruff format check
+        run: ruff format --check ceramic/ tests/
+
+      - name: Type check
+        run: mypy ceramic/ --ignore-missing-imports

ceramic_fwk-0.1.2/.gitignore

@@ -0,0 +1,36 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+*.egg-info/
+dist/
+build/
+*.egg
+
+# Virtual environments
+.venv/
+.venv-demo/
+venv/
+env/
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+.hypothesis/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Ceramic
+ceramic.yaml
+!ceramic.yaml.example
+!examples/zitadel/ceramic.yaml

ceramic_fwk-0.1.2/.kiro/specs/ceramic-framework/.config.kiro

@@ -0,0 +1 @@
+{"specId": "02a335c8-4bf9-4916-b33d-e1245d3d1172", "workflowType": "requirements-first", "specType": "feature"}