eniyan 0.1.0__tar.gz

eniyan-0.1.0/.gitignore

@@ -0,0 +1,4 @@
+.venv/
+dist/
+*.egg-info/
+__pycache__/

eniyan-0.1.0/PKG-INFO

@@ -0,0 +1,85 @@
+Metadata-Version: 2.5
+Name: eniyan
+Version: 0.1.0
+Summary: Eniyan SDK — govern your AI agents wherever they run: identity, scoped authority, JIT windows, and self-reported run telemetry.
+Project-URL: Homepage, https://eniyantrust.com
+Project-URL: Documentation, https://eniyantrust.com/docs
+Author-email: Eniyan <stevland@eniyantrust.com>
+License-Expression: Apache-2.0
+Keywords: agent-identity,ai-agents,governance,mcp,rbac
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.24
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: mcp>=1.0; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# Eniyan SDK (Python)
+
+Govern your AI agents wherever they run. This SDK wraps the Eniyan API —
+agent identity verification, live scope decisions, JIT credential windows,
+short-lived OAuth tokens, and self-reported run telemetry — so any agent
+loop becomes Eniyan-governed in a few lines. Eniyan never hosts or observes
+your loop; your agent reports metadata-only telemetry (names, scopes, token
+counts, outcomes — never prompts, arguments, results, or model output).
+
+```bash
+pip install eniyan
+```
+
+## Quickstart
+
+```python
+import os
+from eniyan import EniyanClient, governed_run, EniyanScopeRefused
+
+client = EniyanClient(
+    base_url="https://api.eniyantrust.com",
+    api_key=os.environ["ENIYAN_API_KEY"],
+    credential_token=os.environ["ENIYAN_CREDENTIAL_TOKEN"],
+    agent_id=os.environ["ENIYAN_AGENT_ID"],
+)
+
+with governed_run(client, harness="my-loop", jit=True, scopes=["crm:read"]) as run:
+    fetch = run.tool("fetch_accounts", scope="crm:read")(fetch_accounts)
+    accounts = fetch()                      # refused under block mode BEFORE it runs
+    run.model_call("claude-sonnet-5", input_tokens=1200, output_tokens=300)
+```
+
+On exit — success or crash — the run is finished, buffered steps are
+flushed, and the JIT window is completed and attested.
+
+## What each piece maps to
+
+| SDK call | API |
+|---|---|
+| `client.verify()` / `client.check_scope()` | `POST /v1/credentials/verify` |
+| `client.mint_token()` / `client.introspect()` | `POST /v1/oauth/token` / `/introspect` |
+| `client.validate_grant()` | `POST /v1/agents/credentials/validate` |
+| `client.create_task()` / `complete_task()` / `attest_task()` | JIT task lifecycle |
+| `client.start_run()` / `append_steps()` / `finish_run()` | `POST /v1/runs` |
+
+Advisory-mode scope violations do not raise — the call proceeds and the
+violation is flagged server-side (`GovernanceDecision.advisory_flagged`).
+Block mode raises `EniyanScopeRefused` before the tool executes.
+
+## MCP server
+
+`pip install "eniyan[mcp]"` and run `eniyan-mcp` to expose the same
+governance operations as MCP tools for Claude Code or any MCP-capable
+harness. See the gated docs for configuration.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+`tests/integration_local.py` runs the full flow against a local Eniyan
+stack (`docker compose up` from the repo root).

eniyan-0.1.0/README.md

@@ -0,0 +1,64 @@
+# Eniyan SDK (Python)
+
+Govern your AI agents wherever they run. This SDK wraps the Eniyan API —
+agent identity verification, live scope decisions, JIT credential windows,
+short-lived OAuth tokens, and self-reported run telemetry — so any agent
+loop becomes Eniyan-governed in a few lines. Eniyan never hosts or observes
+your loop; your agent reports metadata-only telemetry (names, scopes, token
+counts, outcomes — never prompts, arguments, results, or model output).
+
+```bash
+pip install eniyan
+```
+
+## Quickstart
+
+```python
+import os
+from eniyan import EniyanClient, governed_run, EniyanScopeRefused
+
+client = EniyanClient(
+    base_url="https://api.eniyantrust.com",
+    api_key=os.environ["ENIYAN_API_KEY"],
+    credential_token=os.environ["ENIYAN_CREDENTIAL_TOKEN"],
+    agent_id=os.environ["ENIYAN_AGENT_ID"],
+)
+
+with governed_run(client, harness="my-loop", jit=True, scopes=["crm:read"]) as run:
+    fetch = run.tool("fetch_accounts", scope="crm:read")(fetch_accounts)
+    accounts = fetch()                      # refused under block mode BEFORE it runs
+    run.model_call("claude-sonnet-5", input_tokens=1200, output_tokens=300)
+```
+
+On exit — success or crash — the run is finished, buffered steps are
+flushed, and the JIT window is completed and attested.
+
+## What each piece maps to
+
+| SDK call | API |
+|---|---|
+| `client.verify()` / `client.check_scope()` | `POST /v1/credentials/verify` |
+| `client.mint_token()` / `client.introspect()` | `POST /v1/oauth/token` / `/introspect` |
+| `client.validate_grant()` | `POST /v1/agents/credentials/validate` |
+| `client.create_task()` / `complete_task()` / `attest_task()` | JIT task lifecycle |
+| `client.start_run()` / `append_steps()` / `finish_run()` | `POST /v1/runs` |
+
+Advisory-mode scope violations do not raise — the call proceeds and the
+violation is flagged server-side (`GovernanceDecision.advisory_flagged`).
+Block mode raises `EniyanScopeRefused` before the tool executes.
+
+## MCP server
+
+`pip install "eniyan[mcp]"` and run `eniyan-mcp` to expose the same
+governance operations as MCP tools for Claude Code or any MCP-capable
+harness. See the gated docs for configuration.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+`tests/integration_local.py` runs the full flow against a local Eniyan
+stack (`docker compose up` from the repo root).

eniyan-0.1.0/RELEASING.md

@@ -0,0 +1,21 @@
+# Releasing `eniyan` to PyPI
+
+Manual for now. One-time setup: create the PyPI project `eniyan` and an API
+token scoped to it; keep the token out of the repo.
+
+1. Bump `version` in `pyproject.toml` AND `__version__` in
+   `src/eniyan/__init__.py` (keep them identical).
+2. From `sdk/python/`:
+
+   ```bash
+   python -m pip install --upgrade build twine
+   python -m build
+   python -m twine upload dist/*
+   ```
+
+3. Tag: `git tag sdk-v<version> && git push origin sdk-v<version>`.
+4. Smoke test in a clean venv: `pip install eniyan==<version>` and run the
+   quickstart against staging.
+
+Until the PyPI project exists, early-access installs work from git:
+`pip install "git+https://github.com/Eniyan-Inc/eniyan.git#subdirectory=sdk/python"`.

eniyan-0.1.0/pyproject.toml

@@ -0,0 +1,34 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "eniyan"
+version = "0.1.0"
+description = "Eniyan SDK — govern your AI agents wherever they run: identity, scoped authority, JIT windows, and self-reported run telemetry."
+readme = "README.md"
+license = "Apache-2.0"
+requires-python = ">=3.10"
+authors = [{ name = "Eniyan", email = "stevland@eniyantrust.com" }]
+keywords = ["ai-agents", "agent-identity", "governance", "rbac", "mcp"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "Programming Language :: Python :: 3",
+  "Topic :: Security",
+]
+dependencies = ["httpx>=0.24"]
+
+[project.optional-dependencies]
+mcp = ["mcp>=1.0"]
+dev = ["pytest>=8"]
+
+[project.urls]
+Homepage = "https://eniyantrust.com"
+Documentation = "https://eniyantrust.com/docs"
+
+[project.scripts]
+eniyan-mcp = "eniyan.mcp.server:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/eniyan"]

eniyan-0.1.0/src/eniyan/__init__.py

@@ -0,0 +1,26 @@
+"""Eniyan SDK — govern your AI agents wherever they run."""
+
+from .client import EniyanClient, GovernanceDecision
+from .errors import (
+    EniyanAPIError,
+    EniyanAuthError,
+    EniyanError,
+    EniyanRunError,
+    EniyanScopeRefused,
+)
+from .runs import RunHandle, governed_run
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "EniyanClient",
+    "GovernanceDecision",
+    "EniyanError",
+    "EniyanAPIError",
+    "EniyanAuthError",
+    "EniyanRunError",
+    "EniyanScopeRefused",
+    "RunHandle",
+    "governed_run",
+    "__version__",
+]

eniyan-0.1.0/src/eniyan/client.py

@@ -0,0 +1,268 @@
+"""
+EniyanClient — a thin, typed wrapper over the Eniyan HTTP API.
+
+Nothing here is invented: every method maps 1:1 onto an existing endpoint.
+The client authenticates with an org API key; agent-scoped calls also carry
+the agent's credential JWT (issued at enrollment).
+
+Telemetry sent through this client is METADATA-ONLY by contract: step names,
+scopes, token counts, outcomes. Never send tool arguments, tool results,
+prompts, or model output — the server truncates labels defensively, but the
+contract is yours to honor.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+import httpx
+
+from .errors import EniyanAPIError, EniyanAuthError, EniyanRunError, EniyanScopeRefused
+
+
+@dataclass
+class GovernanceDecision:
+    """Outcome of a scope check against the agent's live permitted set."""
+
+    allowed: bool
+    scope: str
+    advisory_flagged: bool
+    reason: str | None
+    raw: dict
+
+
+class EniyanClient:
+    def __init__(
+        self,
+        base_url: str,
+        api_key: str,
+        credential_token: str | None = None,
+        agent_id: str | None = None,
+        timeout: float = 15.0,
+        transport: httpx.BaseTransport | None = None,
+    ):
+        self.base_url = base_url.rstrip("/")
+        self.api_key = api_key
+        self.credential_token = credential_token
+        self.agent_id = agent_id
+        self._http = httpx.Client(
+            base_url=self.base_url,
+            timeout=timeout,
+            headers={"Authorization": f"Bearer {api_key}"},
+            transport=transport,
+        )
+
+    def close(self) -> None:
+        self._http.close()
+
+    # ── Internals ─────────────────────────────────────────────────────────────
+
+    def _request(self, method: str, path: str, **kwargs) -> dict:
+        resp = self._http.request(method, path, **kwargs)
+        if resp.status_code >= 400:
+            code, message = None, resp.text[:500]
+            try:
+                detail = resp.json().get("detail")
+                if isinstance(detail, dict):
+                    code = detail.get("code")
+                    message = detail.get("message") or message
+                elif isinstance(detail, str):
+                    message = detail
+            except Exception:
+                pass
+            err_cls = EniyanAuthError if resp.status_code in (401, 403) else EniyanAPIError
+            raise err_cls(resp.status_code, code, message)
+        return resp.json() if resp.content else {}
+
+    def _require_credential(self) -> str:
+        if not self.credential_token:
+            raise EniyanAPIError(0, "NO_CREDENTIAL", "This call needs credential_token.")
+        return self.credential_token
+
+    def _require_agent(self, agent_id: str | None = None) -> str:
+        resolved = agent_id or self.agent_id
+        if not resolved:
+            raise EniyanAPIError(0, "NO_AGENT", "Pass agent_id or set it on the client.")
+        return resolved
+
+    # ── Identity & authority ──────────────────────────────────────────────────
+
+    def verify(self, requested_scope: str | None = None) -> dict:
+        """POST /v1/credentials/verify — online verification of this agent's credential."""
+        body: dict[str, Any] = {"credential_token": self._require_credential()}
+        if requested_scope is not None:
+            body["requested_scope"] = requested_scope
+        return self._request("POST", "/v1/credentials/verify", json=body)
+
+    def check_scope(self, scope: str) -> GovernanceDecision:
+        """
+        Scope decision against the agent's live permitted set (roles, live
+        delegations, approved exceptions — whatever the org policy composes).
+
+        Block mode refusal raises EniyanScopeRefused; advisory mode returns
+        allowed=True with advisory_flagged=True (the violation is recorded
+        server-side either way).
+        """
+        result = self.verify(requested_scope=scope)
+        authorized = result.get("scope_authorized")
+        valid = bool(result.get("valid"))
+        if not valid and result.get("reason") == "scope_not_authorized":
+            raise EniyanScopeRefused(scope, result.get("reason"))
+        if not valid:
+            raise EniyanAuthError(200, result.get("reason"), "credential not valid")
+        return GovernanceDecision(
+            allowed=True,
+            scope=scope,
+            advisory_flagged=(authorized is False),
+            reason=result.get("reason"),
+            raw=result,
+        )
+
+    def mint_token(self, scope: str | None = None) -> dict:
+        """POST /v1/oauth/token (client_credentials) — short-lived access token."""
+        data = {
+            "grant_type": "client_credentials",
+            "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+            "client_assertion": self._require_credential(),
+        }
+        if scope:
+            data["scope"] = scope
+        return self._request("POST", "/v1/oauth/token", data=data)
+
+    def introspect(self, token: str) -> dict:
+        """POST /v1/oauth/introspect (RFC 7662) — live re-evaluation."""
+        return self._request("POST", "/v1/oauth/introspect", data={"token": token})
+
+    def validate_grant(
+        self,
+        scope: str,
+        resource_type: str | None = None,
+        resource_id: str | None = None,
+        ttl_seconds: int | None = None,
+    ) -> dict:
+        """POST /v1/agents/credentials/validate — per-action access grant."""
+        body: dict[str, Any] = {
+            "credential_token": self._require_credential(),
+            "scope": scope,
+        }
+        if resource_type:
+            body["resource_type"] = resource_type
+        if resource_id:
+            body["resource_id"] = resource_id
+        if ttl_seconds:
+            body["ttl_seconds"] = ttl_seconds
+        return self._request("POST", "/v1/agents/credentials/validate", json=body)
+
+    # ── JIT task windows ──────────────────────────────────────────────────────
+
+    def create_task(
+        self,
+        task_label: str,
+        agent_id: str | None = None,
+        ttl_minutes: int = 15,
+        required_scopes: list[str] | None = None,
+    ) -> dict:
+        agent = self._require_agent(agent_id)
+        body: dict[str, Any] = {
+            "task_label": task_label,
+            "ttl_minutes": ttl_minutes,
+            "auto_activate": True,
+        }
+        if required_scopes is not None:
+            body["required_scopes"] = required_scopes
+        return self._request("POST", f"/v1/verifications/agents/{agent}/tasks", json=body)
+
+    def complete_task(
+        self, task_id: str, agent_id: str | None = None, reason: str = "completed"
+    ) -> dict:
+        agent = self._require_agent(agent_id)
+        return self._request(
+            "POST",
+            f"/v1/verifications/agents/{agent}/tasks/{task_id}/complete",
+            json={"reason": reason},
+        )
+
+    def attest_task(
+        self,
+        task_id: str,
+        outcome: str,
+        notes: str | None = None,
+        agent_id: str | None = None,
+    ) -> dict:
+        agent = self._require_agent(agent_id)
+        body: dict[str, Any] = {"outcome": outcome}
+        if notes:
+            body["notes"] = notes
+        return self._request(
+            "POST", f"/v1/verifications/agents/{agent}/tasks/{task_id}/attest", json=body
+        )
+
+    # ── Runs (self-reported telemetry) ────────────────────────────────────────
+
+    def start_run(
+        self,
+        agent_id: str | None = None,
+        harness: str = "custom",
+        model: str | None = None,
+        agent_task_id: str | None = None,
+    ) -> dict:
+        body: dict[str, Any] = {
+            "agent_id": self._require_agent(agent_id),
+            "harness": harness,
+        }
+        if model:
+            body["model"] = model
+        if agent_task_id:
+            body["agent_task_id"] = agent_task_id
+        return self._request("POST", "/v1/runs", json=body)
+
+    def append_steps(self, run_id: str, steps: list[dict]) -> dict:
+        if not steps:
+            return {"run_id": run_id, "steps": []}
+        try:
+            return self._request("POST", f"/v1/runs/{run_id}/steps", json={"steps": steps})
+        except EniyanAPIError as err:
+            if err.status_code in (404, 409):
+                raise EniyanRunError(str(err)) from err
+            raise
+
+    def finish_run(
+        self,
+        run_id: str,
+        status: str = "completed",
+        outcome: str | None = None,
+        cost_cents: int | None = None,
+    ) -> dict:
+        body: dict[str, Any] = {"status": status}
+        if outcome is not None:
+            body["outcome"] = outcome
+        if cost_cents is not None:
+            body["cost_cents"] = cost_cents
+        try:
+            return self._request("POST", f"/v1/runs/{run_id}/finish", json=body)
+        except EniyanAPIError as err:
+            if err.status_code in (404, 409):
+                raise EniyanRunError(str(err)) from err
+            raise
+
+    # ── RBAC exception workflow ───────────────────────────────────────────────
+
+    def request_scope_exception(
+        self,
+        scope: str,
+        justification: str,
+        agent_id: str | None = None,
+        expires_at: str | None = None,
+    ) -> dict:
+        """
+        POST /v1/agent-roles/agents/{agent_id}/exceptions — ask a human
+        approver for out-of-role authority. NOTE: this endpoint requires a
+        dashboard JWT (a member requests on the agent's behalf); with an
+        API key it returns 401 — surface the request to your operator.
+        """
+        agent = self._require_agent(agent_id)
+        body: dict[str, Any] = {"scope": scope, "justification": justification}
+        if expires_at:
+            body["expires_at"] = expires_at
+        return self._request("POST", f"/v1/agent-roles/agents/{agent}/exceptions", json=body)

eniyan-0.1.0/src/eniyan/errors.py

@@ -0,0 +1,39 @@
+"""Typed exceptions for the Eniyan SDK."""
+
+from __future__ import annotations
+
+
+class EniyanError(Exception):
+    """Base class for all SDK errors."""
+
+
+class EniyanAPIError(EniyanError):
+    """The API returned an error response."""
+
+    def __init__(self, status_code: int, code: str | None, message: str):
+        self.status_code = status_code
+        self.code = code
+        self.message = message
+        super().__init__(f"[{status_code}] {code or 'error'}: {message}")
+
+
+class EniyanAuthError(EniyanAPIError):
+    """API key or credential rejected (401/403)."""
+
+
+class EniyanScopeRefused(EniyanError):
+    """
+    The requested scope was refused under the org's block enforcement mode.
+
+    `advisory` refusals do NOT raise — the call proceeds and the violation
+    is flagged server-side; check GovernanceDecision.advisory_flagged.
+    """
+
+    def __init__(self, scope: str, reason: str | None = None):
+        self.scope = scope
+        self.reason = reason or "scope_not_authorized"
+        super().__init__(f"scope refused: {scope} ({self.reason})")
+
+
+class EniyanRunError(EniyanError):
+    """Run lifecycle failure (finish on a finished run, unknown run, ...)."""

eniyan-0.1.0/src/eniyan/mcp/__init__.py

@@ -0,0 +1 @@
+"""Eniyan MCP server — governance as MCP tools for any MCP-capable harness."""

eniyan-0.1.0/src/eniyan/mcp/server.py

@@ -0,0 +1,136 @@
+"""
+eniyan-mcp — stdio MCP server exposing Eniyan governance to any harness.
+
+Configuration (env):
+    ENIYAN_API_URL           default https://api.eniyantrust.com
+    ENIYAN_API_KEY           org API key (required)
+    ENIYAN_CREDENTIAL_TOKEN  the agent's credential JWT (required for
+                             scope checks, grants, and OAuth mints)
+    ENIYAN_AGENT_ID          the agent's public id (required for JIT + runs)
+
+Claude Code example (.mcp.json):
+    {
+      "mcpServers": {
+        "eniyan": {
+          "command": "eniyan-mcp",
+          "env": {
+            "ENIYAN_API_URL": "https://api.eniyantrust.com",
+            "ENIYAN_API_KEY": "...",
+            "ENIYAN_CREDENTIAL_TOKEN": "...",
+            "ENIYAN_AGENT_ID": "..."
+          }
+        }
+      }
+    }
+"""
+
+from __future__ import annotations
+
+import os
+
+from ..client import EniyanClient
+from . import tools
+
+
+def _client_from_env() -> EniyanClient:
+    api_key = os.environ.get("ENIYAN_API_KEY")
+    if not api_key:
+        raise SystemExit("eniyan-mcp: set ENIYAN_API_KEY")
+    return EniyanClient(
+        base_url=os.environ.get("ENIYAN_API_URL", "https://api.eniyantrust.com"),
+        api_key=api_key,
+        credential_token=os.environ.get("ENIYAN_CREDENTIAL_TOKEN"),
+        agent_id=os.environ.get("ENIYAN_AGENT_ID"),
+    )
+
+
+def build_server(client: EniyanClient):
+    """Bind the governance operations to a FastMCP server instance."""
+    try:
+        # mcp 2.x renamed FastMCP → MCPServer; support both.
+        try:
+            from mcp.server.mcpserver import MCPServer as _Server
+        except ImportError:
+            from mcp.server.fastmcp import FastMCP as _Server
+    except ImportError as exc:
+        raise SystemExit('eniyan-mcp needs the mcp extra: pip install "eniyan[mcp]"') from exc
+
+    server = _Server(
+        "eniyan",
+        instructions=(
+            "Eniyan governs this agent's identity and authority. Check scopes "
+            "before privileged actions, record metadata-only run telemetry "
+            "(names, scopes, token counts — never payloads or prompts), and "
+            "route refusals through the human exception workflow."
+        ),
+    )
+
+    @server.tool()
+    def eniyan_check_scope(scope: str) -> dict:
+        """Check whether this agent is currently permitted to use a scope (live decision)."""
+        return tools.check_scope(client, scope)
+
+    @server.tool()
+    def eniyan_open_jit_window(
+        task_label: str, ttl_minutes: int = 15, required_scopes: list[str] | None = None
+    ) -> dict:
+        """Open a just-in-time credential window for a task."""
+        return tools.open_jit_window(client, task_label, ttl_minutes, required_scopes)
+
+    @server.tool()
+    def eniyan_complete_task(task_id: str, reason: str = "completed") -> dict:
+        """Close a JIT window; the credential re-suspends."""
+        return tools.complete_task(client, task_id, reason)
+
+    @server.tool()
+    def eniyan_attest(task_id: str, outcome: str, notes: str | None = None) -> dict:
+        """File the post-task attestation (as_intended | partial | failed)."""
+        return tools.attest(client, task_id, outcome, notes)
+
+    @server.tool()
+    def eniyan_start_run(
+        harness: str = "eniyan-mcp", model: str | None = None, agent_task_id: str | None = None
+    ) -> dict:
+        """Start a self-reported run; record steps against the returned run_id."""
+        return tools.start_run(client, harness, model, agent_task_id)
+
+    @server.tool()
+    def eniyan_record_step(
+        run_id: str,
+        kind: str,
+        name: str,
+        scope: str | None = None,
+        input_tokens: int | None = None,
+        output_tokens: int | None = None,
+        outcome: str = "ok",
+        detail: str | None = None,
+    ) -> dict:
+        """Record one metadata-only run step. Labels only — never payloads or prompts."""
+        return tools.record_step(
+            client, run_id, kind, name, scope, input_tokens, output_tokens, outcome, detail
+        )
+
+    @server.tool()
+    def eniyan_finish_run(
+        run_id: str,
+        status: str = "completed",
+        outcome: str | None = None,
+        cost_cents: int | None = None,
+    ) -> dict:
+        """Finish the run (completed | failed)."""
+        return tools.finish_run(client, run_id, status, outcome, cost_cents)
+
+    @server.tool()
+    def eniyan_request_scope_exception(scope: str, justification: str) -> dict:
+        """Ask a human approver for authority outside this agent's roles."""
+        return tools.request_scope_exception(client, scope, justification)
+
+    return server
+
+
+def main() -> None:
+    build_server(_client_from_env()).run()
+
+
+if __name__ == "__main__":
+    main()