fastapi-observer 1.0.0__tar.gz → 1.2.0__tar.gz

{fastapi_observer-1.0.0/src/fastapi_observer.egg-info → fastapi_observer-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 1.0.0
+Version: 1.2.0
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT
@@ -45,6 +45,10 @@ Provides-Extra: otel-httpx
 Requires-Dist: opentelemetry-instrumentation-httpx>=0.60b1; extra == "otel-httpx"
 Provides-Extra: otel-requests
 Requires-Dist: opentelemetry-instrumentation-requests>=0.60b1; extra == "otel-requests"
+Provides-Extra: audit
+Requires-Dist: cryptography>=46.0.5; extra == "audit"
+Provides-Extra: otel-sqlalchemy
+Requires-Dist: opentelemetry-instrumentation-sqlalchemy>=0.60b1; extra == "otel-sqlalchemy"
 Provides-Extra: all
 Requires-Dist: orjson>=3.11.7; extra == "all"
 Requires-Dist: prometheus-client>=0.24.1; extra == "all"
@@ -56,6 +60,8 @@ Requires-Dist: opentelemetry-instrumentation-fastapi>=0.60b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-logging>=0.60b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-httpx>=0.60b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-requests>=0.60b1; extra == "all"
+Requires-Dist: opentelemetry-instrumentation-sqlalchemy>=0.60b1; extra == "all"
+Requires-Dist: cryptography>=46.0.5; extra == "all"
 Provides-Extra: dev
 Requires-Dist: httpx>=0.28.1; extra == "dev"
 Requires-Dist: loguru>=0.7.2; extra == "dev"
@@ -645,6 +651,8 @@ The `examples/` directory contains runnable demos:
 | [`security_presets_app.py`](examples/security_presets_app.py) | Preset-based security policy |
 | [`allowlist_app.py`](examples/allowlist_app.py) | Allowlist-only sanitization |
 | [`otel_app.py`](examples/otel_app.py) | OTel tracing and resource attributes |
+| [`audit_app.py`](examples/audit_app.py) | Tamper-evident cryptographic log signatures |
+| [`db_tracing_app.py`](examples/db_tracing_app.py) | SQLCommenter and database trace injection |
 | [`graphql_app.py`](examples/graphql_app.py) | Native Strawberry GraphQL observability |
 | [`benchmarks/`](examples/benchmarks/) | Baseline vs observer benchmark harness |
 | [`k8s/`](examples/k8s/) | Kubernetes-native stack with Prometheus + Loki + Tempo + Grafana |
@@ -776,6 +784,111 @@ Notes:
 > [!TIP]
 > The Logtail Dead Letter Queue (DLQ) provides best-effort local durability. If the internal memory queue overflows under immense API pressure (`queue.Full`), or if an external network partition completely exhausts the outbound HTTP retry backoff, the dropped log payloads are immediately salvaged into local NDJSON envelopes. You can replay these files to BetterStack later using the provided `scripts/replay_dlq.py` utility.
 
+### Tamper-evident audit logging
+
+For regulated industries (Fintech, Healthcare, SOC 2) where you must prove logs were not altered, deleted, or reordered:
+
+```bash
+pip install "fastapi-observer[audit]"
+export OBS_AUDIT_SECRET_KEY="your-signing-secret"
+export OBS_AUDIT_LOGGING_ENABLED="true"
+```
+
+```python
+install_observability(app, settings)
+# Every JSON log now contains _audit_seq and _audit_sig fields
+```
+
+Each log record is chained via HMAC-SHA256: record B's signature includes the signature of record A. Breaking any link (tamper, delete, reorder) invalidates the chain.
+
+| Variable | Default | Description |
+|---|---|---|
+| `OBS_AUDIT_LOGGING_ENABLED` | `false` | Enable HMAC-SHA256 hash chain |
+| `OBS_AUDIT_KEY_ENV_VAR` | `OBS_AUDIT_SECRET_KEY` | Name of env var containing the signing key |
+| `OBS_AUDIT_SECRET_KEY` | - | The HMAC signing key (read by `LocalHMACProvider`) |
+
+Custom key provider (e.g. KMS / Vault):
+
+```python
+from fastapiobserver import AuditKeyProvider
+
+class VaultKeyProvider:
+    def get_key(self) -> bytes:
+        return vault_client.get_secret("audit-signing-key").encode()
+
+install_observability(app, settings, audit_key_provider=VaultKeyProvider())
+```
+
+Verify logs with the CLI:
+
+```bash
+export OBS_AUDIT_SECRET_KEY="your-signing-secret"
+python scripts/verify_audit_chain.py exported_logs.ndjson
+# PASS — 1042 records verified, chain intact.
+```
+
+### SQLCommenter & database tracing
+
+Bridges the gap between FastAPI application traces and database performance monitoring. When enabled, the `trace_id` is automatically injected into raw SQL queries as a comment:
+
+```sql
+SELECT * FROM users /*traceparent='00-abc123def456-01',route='/api/users'*/
+```
+
+This lets DBAs correlate slow Postgres/MySQL queries directly back to the originating HTTP request.
+
+```bash
+pip install "fastapi-observer[otel-sqlalchemy]"
+```
+
+**Automatic** (via `install_observability`):
+
+```python
+from sqlalchemy import create_engine
+
+engine = create_engine("postgresql://...")
+install_observability(app, settings, otel_settings=otel_settings, db_engine=engine)
+```
+
+Multiple engines (e.g. read/write replicas):
+
+```python
+write_engine = create_engine("postgresql://primary/...")
+read_engine = create_engine("postgresql://replica/...")
+install_observability(
+    app, settings,
+    otel_settings=otel_settings,
+    db_engine=[write_engine, read_engine],
+    db_commenter_options={"opentelemetry_values": True, "route": False},
+)
+```
+
+**Manual** (standalone):
+
+```python
+from fastapiobserver import instrument_sqlalchemy, instrument_sqlalchemy_async
+
+# Sync engine
+instrument_sqlalchemy(engine)
+
+# Async engine (extracts .sync_engine automatically)
+instrument_sqlalchemy_async(async_engine)
+```
+
+Custom commenter options:
+
+```python
+instrument_sqlalchemy(engine, commenter_options={
+    "opentelemetry_values": True,  # traceparent (default: True)
+    "db_driver": True,              # e.g. psycopg2 (default: True)
+    "route": True,                  # e.g. /api/users (default: True)
+    "db_framework": True,           # e.g. sqlalchemy (default: False)
+})
+```
+
+> [!CAUTION]
+> **Database statement PII risk:** The OpenTelemetry SQLAlchemy instrumentor captures raw SQL as the `db.statement` span attribute and exports it directly to your tracing backend (Jaeger, Tempo, Datadog). These span attributes are **not** scrubbed by `fastapi-observer`'s `SecurityPolicy`. If your application has poorly parameterized queries (e.g. `WHERE email = 'user@example.com'`), PII will leak into your trace storage. Always use parameterized queries and review your `db.statement` exports in production.
+
 ---
 
 ## Advanced Operations
@@ -1055,9 +1168,10 @@ Reproducible benchmark harness and methodology:
 - `0.2.x`: OTel interoperability, security presets, allowlists
 - `0.3.x`: GraphQL observability, error fingerprinting, and Logtail DLQ durability
 - `0.4.x`: package modularization, sink/registry hardening, and runtime control token rotation
-- `1.0.0`: first stable release contract for production deployments
+- `1.0.x`: first stable release contract for production deployments
+- `1.2.0`: tamper-evident audit logging and SQLAlchemy trace/commenter integration
 
-Current release version: `1.0.0`
+Current release version: `1.2.0`
 
 ## Changelog Policy
 
@@ -1070,7 +1184,7 @@ Breaking changes must be listed under a `Breaking Changes` section in `CHANGELOG
 Recommended release command (uses `.env` with `PYPI_TOKEN`):
 
 ```bash
-scripts/deploy_pypi.sh --tag v1.0.0 --push-tag
+scripts/deploy_pypi.sh --tag v1.2.0 --push-tag
 ```
 
 ### 1) Build distributions

{fastapi_observer-1.0.0 → fastapi_observer-1.2.0}/README.md

@@ -575,6 +575,8 @@ The `examples/` directory contains runnable demos:
 | [`security_presets_app.py`](examples/security_presets_app.py) | Preset-based security policy |
 | [`allowlist_app.py`](examples/allowlist_app.py) | Allowlist-only sanitization |
 | [`otel_app.py`](examples/otel_app.py) | OTel tracing and resource attributes |
+| [`audit_app.py`](examples/audit_app.py) | Tamper-evident cryptographic log signatures |
+| [`db_tracing_app.py`](examples/db_tracing_app.py) | SQLCommenter and database trace injection |
 | [`graphql_app.py`](examples/graphql_app.py) | Native Strawberry GraphQL observability |
 | [`benchmarks/`](examples/benchmarks/) | Baseline vs observer benchmark harness |
 | [`k8s/`](examples/k8s/) | Kubernetes-native stack with Prometheus + Loki + Tempo + Grafana |
@@ -706,6 +708,111 @@ Notes:
 > [!TIP]
 > The Logtail Dead Letter Queue (DLQ) provides best-effort local durability. If the internal memory queue overflows under immense API pressure (`queue.Full`), or if an external network partition completely exhausts the outbound HTTP retry backoff, the dropped log payloads are immediately salvaged into local NDJSON envelopes. You can replay these files to BetterStack later using the provided `scripts/replay_dlq.py` utility.
 
+### Tamper-evident audit logging
+
+For regulated industries (Fintech, Healthcare, SOC 2) where you must prove logs were not altered, deleted, or reordered:
+
+```bash
+pip install "fastapi-observer[audit]"
+export OBS_AUDIT_SECRET_KEY="your-signing-secret"
+export OBS_AUDIT_LOGGING_ENABLED="true"
+```
+
+```python
+install_observability(app, settings)
+# Every JSON log now contains _audit_seq and _audit_sig fields
+```
+
+Each log record is chained via HMAC-SHA256: record B's signature includes the signature of record A. Breaking any link (tamper, delete, reorder) invalidates the chain.
+
+| Variable | Default | Description |
+|---|---|---|
+| `OBS_AUDIT_LOGGING_ENABLED` | `false` | Enable HMAC-SHA256 hash chain |
+| `OBS_AUDIT_KEY_ENV_VAR` | `OBS_AUDIT_SECRET_KEY` | Name of env var containing the signing key |
+| `OBS_AUDIT_SECRET_KEY` | - | The HMAC signing key (read by `LocalHMACProvider`) |
+
+Custom key provider (e.g. KMS / Vault):
+
+```python
+from fastapiobserver import AuditKeyProvider
+
+class VaultKeyProvider:
+    def get_key(self) -> bytes:
+        return vault_client.get_secret("audit-signing-key").encode()
+
+install_observability(app, settings, audit_key_provider=VaultKeyProvider())
+```
+
+Verify logs with the CLI:
+
+```bash
+export OBS_AUDIT_SECRET_KEY="your-signing-secret"
+python scripts/verify_audit_chain.py exported_logs.ndjson
+# PASS — 1042 records verified, chain intact.
+```
+
+### SQLCommenter & database tracing
+
+Bridges the gap between FastAPI application traces and database performance monitoring. When enabled, the `trace_id` is automatically injected into raw SQL queries as a comment:
+
+```sql
+SELECT * FROM users /*traceparent='00-abc123def456-01',route='/api/users'*/
+```
+
+This lets DBAs correlate slow Postgres/MySQL queries directly back to the originating HTTP request.
+
+```bash
+pip install "fastapi-observer[otel-sqlalchemy]"
+```
+
+**Automatic** (via `install_observability`):
+
+```python
+from sqlalchemy import create_engine
+
+engine = create_engine("postgresql://...")
+install_observability(app, settings, otel_settings=otel_settings, db_engine=engine)
+```
+
+Multiple engines (e.g. read/write replicas):
+
+```python
+write_engine = create_engine("postgresql://primary/...")
+read_engine = create_engine("postgresql://replica/...")
+install_observability(
+    app, settings,
+    otel_settings=otel_settings,
+    db_engine=[write_engine, read_engine],
+    db_commenter_options={"opentelemetry_values": True, "route": False},
+)
+```
+
+**Manual** (standalone):
+
+```python
+from fastapiobserver import instrument_sqlalchemy, instrument_sqlalchemy_async
+
+# Sync engine
+instrument_sqlalchemy(engine)
+
+# Async engine (extracts .sync_engine automatically)
+instrument_sqlalchemy_async(async_engine)
+```
+
+Custom commenter options:
+
+```python
+instrument_sqlalchemy(engine, commenter_options={
+    "opentelemetry_values": True,  # traceparent (default: True)
+    "db_driver": True,              # e.g. psycopg2 (default: True)
+    "route": True,                  # e.g. /api/users (default: True)
+    "db_framework": True,           # e.g. sqlalchemy (default: False)
+})
+```
+
+> [!CAUTION]
+> **Database statement PII risk:** The OpenTelemetry SQLAlchemy instrumentor captures raw SQL as the `db.statement` span attribute and exports it directly to your tracing backend (Jaeger, Tempo, Datadog). These span attributes are **not** scrubbed by `fastapi-observer`'s `SecurityPolicy`. If your application has poorly parameterized queries (e.g. `WHERE email = 'user@example.com'`), PII will leak into your trace storage. Always use parameterized queries and review your `db.statement` exports in production.
+
 ---
 
 ## Advanced Operations
@@ -985,9 +1092,10 @@ Reproducible benchmark harness and methodology:
 - `0.2.x`: OTel interoperability, security presets, allowlists
 - `0.3.x`: GraphQL observability, error fingerprinting, and Logtail DLQ durability
 - `0.4.x`: package modularization, sink/registry hardening, and runtime control token rotation
-- `1.0.0`: first stable release contract for production deployments
+- `1.0.x`: first stable release contract for production deployments
+- `1.2.0`: tamper-evident audit logging and SQLAlchemy trace/commenter integration
 
-Current release version: `1.0.0`
+Current release version: `1.2.0`
 
 ## Changelog Policy
 
@@ -1000,7 +1108,7 @@ Breaking changes must be listed under a `Breaking Changes` section in `CHANGELOG
 Recommended release command (uses `.env` with `PYPI_TOKEN`):
 
 ```bash
-scripts/deploy_pypi.sh --tag v1.0.0 --push-tag
+scripts/deploy_pypi.sh --tag v1.2.0 --push-tag
 ```
 
 ### 1) Build distributions

{fastapi_observer-1.0.0 → fastapi_observer-1.2.0}/pyproject.toml

@@ -65,6 +65,12 @@ otel-httpx = [
 otel-requests = [
     "opentelemetry-instrumentation-requests>=0.60b1",
 ]
+audit = [
+    "cryptography>=46.0.5",
+]
+otel-sqlalchemy = [
+    "opentelemetry-instrumentation-sqlalchemy>=0.60b1",
+]
 all = [
     "orjson>=3.11.7",
     "prometheus-client>=0.24.1",
@@ -76,6 +82,8 @@ all = [
     "opentelemetry-instrumentation-logging>=0.60b1",
     "opentelemetry-instrumentation-httpx>=0.60b1",
     "opentelemetry-instrumentation-requests>=0.60b1",
+    "opentelemetry-instrumentation-sqlalchemy>=0.60b1",
+    "cryptography>=46.0.5",
 ]
 dev = [
     "httpx>=0.28.1",

{fastapi_observer-1.0.0 → fastapi_observer-1.2.0/src/fastapi_observer.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 1.0.0
+Version: 1.2.0
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT
@@ -45,6 +45,10 @@ Provides-Extra: otel-httpx
 Requires-Dist: opentelemetry-instrumentation-httpx>=0.60b1; extra == "otel-httpx"
 Provides-Extra: otel-requests
 Requires-Dist: opentelemetry-instrumentation-requests>=0.60b1; extra == "otel-requests"
+Provides-Extra: audit
+Requires-Dist: cryptography>=46.0.5; extra == "audit"
+Provides-Extra: otel-sqlalchemy
+Requires-Dist: opentelemetry-instrumentation-sqlalchemy>=0.60b1; extra == "otel-sqlalchemy"
 Provides-Extra: all
 Requires-Dist: orjson>=3.11.7; extra == "all"
 Requires-Dist: prometheus-client>=0.24.1; extra == "all"
@@ -56,6 +60,8 @@ Requires-Dist: opentelemetry-instrumentation-fastapi>=0.60b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-logging>=0.60b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-httpx>=0.60b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-requests>=0.60b1; extra == "all"
+Requires-Dist: opentelemetry-instrumentation-sqlalchemy>=0.60b1; extra == "all"
+Requires-Dist: cryptography>=46.0.5; extra == "all"
 Provides-Extra: dev
 Requires-Dist: httpx>=0.28.1; extra == "dev"
 Requires-Dist: loguru>=0.7.2; extra == "dev"
@@ -645,6 +651,8 @@ The `examples/` directory contains runnable demos:
 | [`security_presets_app.py`](examples/security_presets_app.py) | Preset-based security policy |
 | [`allowlist_app.py`](examples/allowlist_app.py) | Allowlist-only sanitization |
 | [`otel_app.py`](examples/otel_app.py) | OTel tracing and resource attributes |
+| [`audit_app.py`](examples/audit_app.py) | Tamper-evident cryptographic log signatures |
+| [`db_tracing_app.py`](examples/db_tracing_app.py) | SQLCommenter and database trace injection |
 | [`graphql_app.py`](examples/graphql_app.py) | Native Strawberry GraphQL observability |
 | [`benchmarks/`](examples/benchmarks/) | Baseline vs observer benchmark harness |
 | [`k8s/`](examples/k8s/) | Kubernetes-native stack with Prometheus + Loki + Tempo + Grafana |
@@ -776,6 +784,111 @@ Notes:
 > [!TIP]
 > The Logtail Dead Letter Queue (DLQ) provides best-effort local durability. If the internal memory queue overflows under immense API pressure (`queue.Full`), or if an external network partition completely exhausts the outbound HTTP retry backoff, the dropped log payloads are immediately salvaged into local NDJSON envelopes. You can replay these files to BetterStack later using the provided `scripts/replay_dlq.py` utility.
 
+### Tamper-evident audit logging
+
+For regulated industries (Fintech, Healthcare, SOC 2) where you must prove logs were not altered, deleted, or reordered:
+
+```bash
+pip install "fastapi-observer[audit]"
+export OBS_AUDIT_SECRET_KEY="your-signing-secret"
+export OBS_AUDIT_LOGGING_ENABLED="true"
+```
+
+```python
+install_observability(app, settings)
+# Every JSON log now contains _audit_seq and _audit_sig fields
+```
+
+Each log record is chained via HMAC-SHA256: record B's signature includes the signature of record A. Breaking any link (tamper, delete, reorder) invalidates the chain.
+
+| Variable | Default | Description |
+|---|---|---|
+| `OBS_AUDIT_LOGGING_ENABLED` | `false` | Enable HMAC-SHA256 hash chain |
+| `OBS_AUDIT_KEY_ENV_VAR` | `OBS_AUDIT_SECRET_KEY` | Name of env var containing the signing key |
+| `OBS_AUDIT_SECRET_KEY` | - | The HMAC signing key (read by `LocalHMACProvider`) |
+
+Custom key provider (e.g. KMS / Vault):
+
+```python
+from fastapiobserver import AuditKeyProvider
+
+class VaultKeyProvider:
+    def get_key(self) -> bytes:
+        return vault_client.get_secret("audit-signing-key").encode()
+
+install_observability(app, settings, audit_key_provider=VaultKeyProvider())
+```
+
+Verify logs with the CLI:
+
+```bash
+export OBS_AUDIT_SECRET_KEY="your-signing-secret"
+python scripts/verify_audit_chain.py exported_logs.ndjson
+# PASS — 1042 records verified, chain intact.
+```
+
+### SQLCommenter & database tracing
+
+Bridges the gap between FastAPI application traces and database performance monitoring. When enabled, the `trace_id` is automatically injected into raw SQL queries as a comment:
+
+```sql
+SELECT * FROM users /*traceparent='00-abc123def456-01',route='/api/users'*/
+```
+
+This lets DBAs correlate slow Postgres/MySQL queries directly back to the originating HTTP request.
+
+```bash
+pip install "fastapi-observer[otel-sqlalchemy]"
+```
+
+**Automatic** (via `install_observability`):
+
+```python
+from sqlalchemy import create_engine
+
+engine = create_engine("postgresql://...")
+install_observability(app, settings, otel_settings=otel_settings, db_engine=engine)
+```
+
+Multiple engines (e.g. read/write replicas):
+
+```python
+write_engine = create_engine("postgresql://primary/...")
+read_engine = create_engine("postgresql://replica/...")
+install_observability(
+    app, settings,
+    otel_settings=otel_settings,
+    db_engine=[write_engine, read_engine],
+    db_commenter_options={"opentelemetry_values": True, "route": False},
+)
+```
+
+**Manual** (standalone):
+
+```python
+from fastapiobserver import instrument_sqlalchemy, instrument_sqlalchemy_async
+
+# Sync engine
+instrument_sqlalchemy(engine)
+
+# Async engine (extracts .sync_engine automatically)
+instrument_sqlalchemy_async(async_engine)
+```
+
+Custom commenter options:
+
+```python
+instrument_sqlalchemy(engine, commenter_options={
+    "opentelemetry_values": True,  # traceparent (default: True)
+    "db_driver": True,              # e.g. psycopg2 (default: True)
+    "route": True,                  # e.g. /api/users (default: True)
+    "db_framework": True,           # e.g. sqlalchemy (default: False)
+})
+```
+
+> [!CAUTION]
+> **Database statement PII risk:** The OpenTelemetry SQLAlchemy instrumentor captures raw SQL as the `db.statement` span attribute and exports it directly to your tracing backend (Jaeger, Tempo, Datadog). These span attributes are **not** scrubbed by `fastapi-observer`'s `SecurityPolicy`. If your application has poorly parameterized queries (e.g. `WHERE email = 'user@example.com'`), PII will leak into your trace storage. Always use parameterized queries and review your `db.statement` exports in production.
+
 ---
 
 ## Advanced Operations
@@ -1055,9 +1168,10 @@ Reproducible benchmark harness and methodology:
 - `0.2.x`: OTel interoperability, security presets, allowlists
 - `0.3.x`: GraphQL observability, error fingerprinting, and Logtail DLQ durability
 - `0.4.x`: package modularization, sink/registry hardening, and runtime control token rotation
-- `1.0.0`: first stable release contract for production deployments
+- `1.0.x`: first stable release contract for production deployments
+- `1.2.0`: tamper-evident audit logging and SQLAlchemy trace/commenter integration
 
-Current release version: `1.0.0`
+Current release version: `1.2.0`
 
 ## Changelog Policy
 
@@ -1070,7 +1184,7 @@ Breaking changes must be listed under a `Breaking Changes` section in `CHANGELOG
 Recommended release command (uses `.env` with `PYPI_TOKEN`):
 
 ```bash
-scripts/deploy_pypi.sh --tag v1.0.0 --push-tag
+scripts/deploy_pypi.sh --tag v1.2.0 --push-tag
 ```
 
 ### 1) Build distributions

{fastapi_observer-1.0.0 → fastapi_observer-1.2.0}/src/fastapi_observer.egg-info/SOURCES.txt

@@ -10,6 +10,7 @@ src/fastapiobserver/__init__.py
 src/fastapiobserver/_version.py
 src/fastapiobserver/config.py
 src/fastapiobserver/control_plane.py
+src/fastapiobserver/db_tracing.py
 src/fastapiobserver/fastapi.py
 src/fastapiobserver/loguru.py
 src/fastapiobserver/plugins.py
@@ -17,6 +18,10 @@ src/fastapiobserver/propagation.py
 src/fastapiobserver/py.typed
 src/fastapiobserver/request_context.py
 src/fastapiobserver/utils.py
+src/fastapiobserver/audit/__init__.py
+src/fastapiobserver/audit/formatter.py
+src/fastapiobserver/audit/providers.py
+src/fastapiobserver/audit/verify.py
 src/fastapiobserver/integrations/__init__.py
 src/fastapiobserver/integrations/strawberry.py
 src/fastapiobserver/logging/__init__.py
@@ -72,8 +77,10 @@ src/fastapiobserver/sinks/logtail/__init__.py
 src/fastapiobserver/sinks/logtail/dlq.py
 src/fastapiobserver/sinks/logtail/handler.py
 src/fastapiobserver/sinks/logtail/sink.py
+tests/test_audit_chain.py
 tests/test_body_media_allowlist.py
 tests/test_config_settings.py
+tests/test_db_tracing.py
 tests/test_dx_parity.py
 tests/test_excluded_url_precedence.py
 tests/test_fastapi_install.py

{fastapi_observer-1.0.0 → fastapi_observer-1.2.0}/src/fastapi_observer.egg-info/requires.txt

@@ -13,6 +13,11 @@ opentelemetry-instrumentation-fastapi>=0.60b1
 opentelemetry-instrumentation-logging>=0.60b1
 opentelemetry-instrumentation-httpx>=0.60b1
 opentelemetry-instrumentation-requests>=0.60b1
+opentelemetry-instrumentation-sqlalchemy>=0.60b1
+cryptography>=46.0.5
+
+[audit]
+cryptography>=46.0.5
 
 [dev]
 httpx>=0.28.1
@@ -44,5 +49,8 @@ opentelemetry-instrumentation-httpx>=0.60b1
 [otel-requests]
 opentelemetry-instrumentation-requests>=0.60b1
 
+[otel-sqlalchemy]
+opentelemetry-instrumentation-sqlalchemy>=0.60b1
+
 [prometheus]
 prometheus-client>=0.24.1

{fastapi_observer-1.0.0 → fastapi_observer-1.2.0}/src/fastapiobserver/__init__.py

@@ -1,6 +1,18 @@
 from ._version import __version__
+from .audit import (
+    AuditChainFormatter,
+    AuditKeyProvider,
+    AuditVerificationResult,
+    LocalHMACProvider,
+    verify_audit_chain,
+)
 from .config import ObservabilitySettings
 from .control_plane import RuntimeControlSettings, mount_control_plane
+from .db_tracing import (
+    instrument_sqlalchemy,
+    instrument_sqlalchemy_async,
+    uninstrument_sqlalchemy,
+)
 from .fastapi import install_observability
 from .logging import (
     LOG_SCHEMA_VERSION,
@@ -165,4 +177,14 @@ __all__ = [
     "set_user_context",
     # Version
     "__version__",
+    # Audit
+    "AuditChainFormatter",
+    "AuditKeyProvider",
+    "AuditVerificationResult",
+    "LocalHMACProvider",
+    "verify_audit_chain",
+    # Database tracing
+    "instrument_sqlalchemy",
+    "instrument_sqlalchemy_async",
+    "uninstrument_sqlalchemy",
 ]

fastapi_observer-1.2.0/src/fastapiobserver/_version.py

@@ -0,0 +1 @@
+__version__ = "1.2.0"

fastapi_observer-1.2.0/src/fastapiobserver/audit/__init__.py

@@ -0,0 +1,14 @@
+"""Tamper-evident audit logging — optional HMAC-SHA256 hash chain."""
+from __future__ import annotations
+
+from .formatter import AuditChainFormatter
+from .providers import AuditKeyProvider, LocalHMACProvider
+from .verify import AuditVerificationResult, verify_audit_chain
+
+__all__ = [
+    "AuditChainFormatter",
+    "AuditKeyProvider",
+    "AuditVerificationResult",
+    "LocalHMACProvider",
+    "verify_audit_chain",
+]