prismal-server 0.2.0__tar.gz

prismal_server-0.2.0/.gitignore

@@ -0,0 +1,224 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# Ignore JetBrains IDE project files
+.idea/
+
+# Engine runtime artifacts (checkpointer db, etc.)
+data/

prismal_server-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 prismal-ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

prismal_server-0.2.0/PKG-INFO

@@ -0,0 +1,173 @@
+Metadata-Version: 2.5
+Name: prismal-server
+Version: 0.2.0
+Summary: Reference host for the prismal agent engine — a thin FastAPI/ASGI process serving prismal over REST/SSE and inbound A2A.
+Project-URL: Homepage, https://github.com/prismal-ai/prismal-server
+Project-URL: Repository, https://github.com/prismal-ai/prismal-server
+Project-URL: Engine, https://github.com/prismal-ai/prismal
+Project-URL: SDK, https://github.com/prismal-ai/prismal-sdk
+Author-email: Ernesto Crespo <ecrespo@gmail.com>
+License: MIT License
+        
+        Copyright (c) 2026 prismal-ai
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Keywords: a2a,agent,asgi,fastapi,prismal,sse
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Requires-Python: >=3.13
+Requires-Dist: aiosqlite>=0.20
+Requires-Dist: fastapi>=0.115
+Requires-Dist: prismal-ai<4,>=3.17
+Requires-Dist: pydantic-settings>=2.5
+Requires-Dist: pydantic>=2.10
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: uvicorn[standard]>=0.30
+Provides-Extra: dev
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# prismal-server
+
+Reference **host** for the [`prismal`](https://github.com/prismal-ai/prismal)
+agent engine — a thin FastAPI/ASGI process that exposes prismal over
+**REST · SSE · WebSocket** (opt-in, `host_ws_enabled`) plus the inbound **A2A** endpoints, so
+non-Python clients and the front-end ecosystem can build against it.
+
+`prismal` is a pure library (no web server by design). `prismal-server` is the
+missing process that binds a port, boots the engine once, and serves it — while
+**reimplementing none of its logic**.
+
+## Status
+
+**v0.2: usage, gateways and AG-UI.** On top of the v0.1 host (streaming chat,
+inbound A2A, auth/tenancy seams, health, release plumbing), v0.2 adds per-tenant
+engine config and gateways, `done.usage` plus `/v1/usage` and `/v1/budget`, AG-UI 1.0
+streaming, the A2A v1.0 dual stack, an opt-in WebSocket transport, a deterministic
+fake-LLM mode and read-only admin endpoints. Specs:
+[`specs/reference-host-bootstrap/`](./specs/reference-host-bootstrap/) (v0.1) and
+[`specs/host-v0.2-usage-gateways-agui/`](./specs/host-v0.2-usage-gateways-agui/)
+(v0.2). Release notes are in [`CHANGELOG.md`](./CHANGELOG.md).
+
+## Quickstart
+
+```bash
+uv pip install -e ".[dev]"
+uvicorn prismal_server.app:app --reload
+curl localhost:8000/healthz          # {"status":"ok"}
+curl localhost:8000/readyz           # {"status":"ready"} once the runtime composes
+```
+
+Stream a chat turn (SSE):
+
+```bash
+tid=$(curl -sX POST localhost:8000/threads | python -c 'import sys,json;print(json.load(sys.stdin)["thread_id"])')
+curl -N -X POST "localhost:8000/threads/$tid/messages" \
+  -H 'content-type: application/json' \
+  -d '{"content":"Hello!"}'
+```
+
+Or with Docker:
+
+```bash
+docker compose up --build
+curl localhost:8000/healthz
+```
+
+> The image bundles the engine, which pulls heavy ML deps (embeddings, vector
+> store) — the first build is large and slow. See
+> [`docs/running.md`](./docs/running.md).
+
+## HTTP surface
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/healthz` · `/readyz` | Liveness / readiness |
+| `POST` | `/threads` | Mint a new `thread_id` |
+| `POST` | `/threads/{id}/messages` | Stream a chat turn (SSE: `token`/`tool_call`/`state`/`done`/`error`; `?protocol=ag-ui` for AG-UI) |
+| `POST` | `/v1/agui` | AG-UI `RunAgentInput` → AG-UI event stream |
+| `GET` | `/ws/threads/{id}` | WebSocket chat (opt-in, `host_ws_enabled`) |
+| `GET` | `/v1/usage` · `/v1/budget` | Per-turn usage history · budget status and gateway quotas |
+| `GET` | `/v1/admin/{tenants,audit,decisions,routing}` | Admin read endpoints (opt-in, admin scope) |
+| `GET` | `/.well-known/agent-card.json` | A2A Agent Card (`?protocolVersion=0.3\|1.0`) |
+| `POST` | `/a2a` · `{base}/{tenant}` | A2A JSON-RPC / SSE, v0.3 and v1.0 (delegates to `A2AServerHandler`) |
+| `GET` | `/openapi.json` | OpenAPI with examples (for `prismal-sdk` generation) |
+
+## Docs
+
+| Doc | Covers |
+|---|---|
+| [`docs/running.md`](./docs/running.md) | Local run, Docker/compose, config, health/readiness |
+| [`docs/auth.md`](./docs/auth.md) | The auth seam: `none` / `bearer` / `oidc`, strict mode |
+| [`docs/tenancy.md`](./docs/tenancy.md) | `org_id` resolution (fail-closed), per-tenant runtimes, `tenant.yaml` and secrets |
+| [`docs/usage.md`](./docs/usage.md) | `done.usage`, `/v1/usage`, `/v1/budget`, `402 budget_exceeded` |
+| [`docs/agui.md`](./docs/agui.md) | AG-UI stream mode and `POST /v1/agui` |
+| [`docs/websocket.md`](./docs/websocket.md) | WebSocket frames, close codes, handshake auth |
+| [`docs/a2a.md`](./docs/a2a.md) | Inbound A2A: Agent Card, v0.3/v1.0 dual stack, tenant routes |
+| [`docs/admin.md`](./docs/admin.md) | Admin read endpoints and their scopes |
+| [`docs/fake-mode.md`](./docs/fake-mode.md) | Deterministic fake-LLM mode for contract tests |
+
+## The contract with the engine
+
+The host calls the engine only through its **public host read surface** (HRS §3)
+plus the v0.1 entry points. Everything else it reads is a `RuntimeContext` method.
+A static import-guard test enforces an exact per-module symbol allowlist
+(`tests/unit/test_import_guard.py`); the rule and the review checklist live in
+[`CLAUDE.md`](./CLAUDE.md).
+
+- `build_runtime(...)` / `build_test_runtime(...)` → `RuntimeContext` (all ports, coordinated `aclose()`)
+- `get_async_compiled_graph(...)` → the graph to `astream()`
+- `A2AServerHandler` + `build_agent_card(...)` → inbound A2A
+- `prismal.identity` `IdentityPort` / `OidcIdentityProvider` → request → identity
+- `prismal.events.agui` (AG-UI translator) and `prismal.monitoring.get_run_summary` (usage wire)
+
+## Development
+
+```bash
+uv pip install -e ".[dev]"
+uv run pytest                      # unit suite (no live provider I/O)
+uv run pytest -m contract          # opt-in: against a released engine
+uv run ruff check . && uv run ruff format --check .
+uv run mypy src
+```
+
+The unit suite runs fully offline against engine fakes (`build_test_runtime`); the
+`contract` suite boots a real `build_runtime()`, serves a real Agent Card, runs the
+v0.2 surfaces (native, AG-UI, usage, A2A v1) against the released engine in fake-LLM
+mode, and, when an LLM provider credential is present in the environment,
+round-trips a full chat turn over SSE.
+
+## Related repos
+
+- [`prismal-ai/prismal`](https://github.com/prismal-ai/prismal) — the engine (pip dependency `prismal-ai`, pinned `>=3.17,<4`).
+- [`prismal-ai/prismal-sdk`](https://github.com/prismal-ai/prismal-sdk) — thin client generated against this host's wire contract (`/openapi.json` + the A2A surface).
+
+## License
+
+See [`LICENSE`](./LICENSE).

prismal_server-0.2.0/README.md

@@ -0,0 +1,118 @@
+# prismal-server
+
+Reference **host** for the [`prismal`](https://github.com/prismal-ai/prismal)
+agent engine — a thin FastAPI/ASGI process that exposes prismal over
+**REST · SSE · WebSocket** (opt-in, `host_ws_enabled`) plus the inbound **A2A** endpoints, so
+non-Python clients and the front-end ecosystem can build against it.
+
+`prismal` is a pure library (no web server by design). `prismal-server` is the
+missing process that binds a port, boots the engine once, and serves it — while
+**reimplementing none of its logic**.
+
+## Status
+
+**v0.2: usage, gateways and AG-UI.** On top of the v0.1 host (streaming chat,
+inbound A2A, auth/tenancy seams, health, release plumbing), v0.2 adds per-tenant
+engine config and gateways, `done.usage` plus `/v1/usage` and `/v1/budget`, AG-UI 1.0
+streaming, the A2A v1.0 dual stack, an opt-in WebSocket transport, a deterministic
+fake-LLM mode and read-only admin endpoints. Specs:
+[`specs/reference-host-bootstrap/`](./specs/reference-host-bootstrap/) (v0.1) and
+[`specs/host-v0.2-usage-gateways-agui/`](./specs/host-v0.2-usage-gateways-agui/)
+(v0.2). Release notes are in [`CHANGELOG.md`](./CHANGELOG.md).
+
+## Quickstart
+
+```bash
+uv pip install -e ".[dev]"
+uvicorn prismal_server.app:app --reload
+curl localhost:8000/healthz          # {"status":"ok"}
+curl localhost:8000/readyz           # {"status":"ready"} once the runtime composes
+```
+
+Stream a chat turn (SSE):
+
+```bash
+tid=$(curl -sX POST localhost:8000/threads | python -c 'import sys,json;print(json.load(sys.stdin)["thread_id"])')
+curl -N -X POST "localhost:8000/threads/$tid/messages" \
+  -H 'content-type: application/json' \
+  -d '{"content":"Hello!"}'
+```
+
+Or with Docker:
+
+```bash
+docker compose up --build
+curl localhost:8000/healthz
+```
+
+> The image bundles the engine, which pulls heavy ML deps (embeddings, vector
+> store) — the first build is large and slow. See
+> [`docs/running.md`](./docs/running.md).
+
+## HTTP surface
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/healthz` · `/readyz` | Liveness / readiness |
+| `POST` | `/threads` | Mint a new `thread_id` |
+| `POST` | `/threads/{id}/messages` | Stream a chat turn (SSE: `token`/`tool_call`/`state`/`done`/`error`; `?protocol=ag-ui` for AG-UI) |
+| `POST` | `/v1/agui` | AG-UI `RunAgentInput` → AG-UI event stream |
+| `GET` | `/ws/threads/{id}` | WebSocket chat (opt-in, `host_ws_enabled`) |
+| `GET` | `/v1/usage` · `/v1/budget` | Per-turn usage history · budget status and gateway quotas |
+| `GET` | `/v1/admin/{tenants,audit,decisions,routing}` | Admin read endpoints (opt-in, admin scope) |
+| `GET` | `/.well-known/agent-card.json` | A2A Agent Card (`?protocolVersion=0.3\|1.0`) |
+| `POST` | `/a2a` · `{base}/{tenant}` | A2A JSON-RPC / SSE, v0.3 and v1.0 (delegates to `A2AServerHandler`) |
+| `GET` | `/openapi.json` | OpenAPI with examples (for `prismal-sdk` generation) |
+
+## Docs
+
+| Doc | Covers |
+|---|---|
+| [`docs/running.md`](./docs/running.md) | Local run, Docker/compose, config, health/readiness |
+| [`docs/auth.md`](./docs/auth.md) | The auth seam: `none` / `bearer` / `oidc`, strict mode |
+| [`docs/tenancy.md`](./docs/tenancy.md) | `org_id` resolution (fail-closed), per-tenant runtimes, `tenant.yaml` and secrets |
+| [`docs/usage.md`](./docs/usage.md) | `done.usage`, `/v1/usage`, `/v1/budget`, `402 budget_exceeded` |
+| [`docs/agui.md`](./docs/agui.md) | AG-UI stream mode and `POST /v1/agui` |
+| [`docs/websocket.md`](./docs/websocket.md) | WebSocket frames, close codes, handshake auth |
+| [`docs/a2a.md`](./docs/a2a.md) | Inbound A2A: Agent Card, v0.3/v1.0 dual stack, tenant routes |
+| [`docs/admin.md`](./docs/admin.md) | Admin read endpoints and their scopes |
+| [`docs/fake-mode.md`](./docs/fake-mode.md) | Deterministic fake-LLM mode for contract tests |
+
+## The contract with the engine
+
+The host calls the engine only through its **public host read surface** (HRS §3)
+plus the v0.1 entry points. Everything else it reads is a `RuntimeContext` method.
+A static import-guard test enforces an exact per-module symbol allowlist
+(`tests/unit/test_import_guard.py`); the rule and the review checklist live in
+[`CLAUDE.md`](./CLAUDE.md).
+
+- `build_runtime(...)` / `build_test_runtime(...)` → `RuntimeContext` (all ports, coordinated `aclose()`)
+- `get_async_compiled_graph(...)` → the graph to `astream()`
+- `A2AServerHandler` + `build_agent_card(...)` → inbound A2A
+- `prismal.identity` `IdentityPort` / `OidcIdentityProvider` → request → identity
+- `prismal.events.agui` (AG-UI translator) and `prismal.monitoring.get_run_summary` (usage wire)
+
+## Development
+
+```bash
+uv pip install -e ".[dev]"
+uv run pytest                      # unit suite (no live provider I/O)
+uv run pytest -m contract          # opt-in: against a released engine
+uv run ruff check . && uv run ruff format --check .
+uv run mypy src
+```
+
+The unit suite runs fully offline against engine fakes (`build_test_runtime`); the
+`contract` suite boots a real `build_runtime()`, serves a real Agent Card, runs the
+v0.2 surfaces (native, AG-UI, usage, A2A v1) against the released engine in fake-LLM
+mode, and, when an LLM provider credential is present in the environment,
+round-trips a full chat turn over SSE.
+
+## Related repos
+
+- [`prismal-ai/prismal`](https://github.com/prismal-ai/prismal) — the engine (pip dependency `prismal-ai`, pinned `>=3.17,<4`).
+- [`prismal-ai/prismal-sdk`](https://github.com/prismal-ai/prismal-sdk) — thin client generated against this host's wire contract (`/openapi.json` + the A2A surface).
+
+## License
+
+See [`LICENSE`](./LICENSE).

prismal_server-0.2.0/pyproject.toml

@@ -0,0 +1,101 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "prismal-server"
+version = "0.2.0"
+description = "Reference host for the prismal agent engine — a thin FastAPI/ASGI process serving prismal over REST/SSE and inbound A2A."
+readme = "README.md"
+# The engine (prismal-ai) requires Python >=3.13, so the host does too.
+requires-python = ">=3.13"
+license = { file = "LICENSE" }
+authors = [{ name = "Ernesto Crespo", email = "ecrespo@gmail.com" }]
+keywords = ["prismal", "agent", "fastapi", "a2a", "sse", "asgi"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Framework :: FastAPI",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Internet :: WWW/HTTP :: HTTP Servers",
+]
+
+# The engine. PyPI distribution is `prismal-ai`; the import module is `prismal`.
+# Pinned per SPEC-RHB-NFR-004: the host couples only to the four engine seams.
+dependencies = [
+    "prismal-ai>=3.17,<4",
+    "fastapi>=0.115",
+    "uvicorn[standard]>=0.30",
+    "pydantic>=2.10",
+    "pydantic-settings>=2.5",
+    # Per-tenant `tenant.yaml` (RH2-01-03); parsed with `yaml.safe_load` only.
+    "pyyaml>=6.0",
+    # SQLite usage store (RH2-02-03, host_usage_store="sqlite").
+    "aiosqlite>=0.20",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0",
+    "pytest-asyncio>=0.24",
+    "httpx>=0.27",
+    "ruff>=0.6",
+    "mypy>=1.11",
+    "types-PyYAML>=6.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/prismal-ai/prismal-server"
+Repository = "https://github.com/prismal-ai/prismal-server"
+Engine = "https://github.com/prismal-ai/prismal"
+SDK = "https://github.com/prismal-ai/prismal-sdk"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/prismal_server"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/prismal_server", "README.md", "LICENSE"]
+
+# ── Tooling ────────────────────────────────────────────────────────────────
+
+[tool.ruff]
+src = ["src", "tests"]
+line-length = 88
+target-version = "py313"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "ASYNC", "W"]
+
+[tool.ruff.lint.isort]
+known-first-party = ["prismal_server"]
+
+[tool.mypy]
+python_version = "3.13"
+mypy_path = "src"
+packages = ["prismal_server"]
+strict = true
+warn_unused_ignores = true
+warn_return_any = true
+no_implicit_reexport = true
+
+[[tool.mypy.overrides]]
+# The engine ships its own types; if a released build lacks a py.typed marker,
+# don't fail the host's type check on it.
+module = ["prismal.*"]
+ignore_missing_imports = true
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]
+addopts = "-ra --strict-markers"
+filterwarnings = [
+    # Starlette's TestClient (WebSocket tests) still runs on httpx.
+    "ignore:Using `httpx` with `starlette.testclient` is deprecated",
+]
+markers = [
+    "contract: opt-in smoke tests against a released prismal engine (deselected by default)",
+]
+# Unit suite runs with no live provider I/O; the contract suite is opt-in.
+# Run unit only:      uv run pytest -m 'not contract'
+# Run contract suite: uv run pytest -m contract

prismal_server-0.2.0/src/prismal_server/__init__.py

@@ -0,0 +1,15 @@
+"""prismal-server — reference host for the prismal engine.
+
+A thin FastAPI/ASGI process that boots the engine once and serves it over
+REST/SSE plus the inbound A2A endpoints. It orchestrates the engine through
+exactly four seams and reimplements none of its logic (see ``CLAUDE.md``).
+"""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("prismal-server")
+except PackageNotFoundError:  # pragma: no cover - source checkout without install
+    __version__ = "0.0.0.dev0"
+
+__all__ = ["__version__"]