prismlib-plus 0.7.0__py3-none-any.whl

prism/__init__.py

@@ -0,0 +1,9 @@
+"""
+Prism Ecosystem — Tensor-Native Distributed Data Plane
+=======================================================
+PrismLib: Core mathematical primitives, wave-mechanics retrieval engine,
+state-compression/isolation layers, and CHORUS Fabric transport interface.
+"""
+
+__version__ = "0.7.0"
+__author__ = "InsightIts"

prism/api/__init__.py

@@ -0,0 +1,83 @@
+"""
+prism.api — Vector-native API layer for AI agents
+==================================================
+
+PrismAPI lets an API serve content that is ALREADY embedded and projected
+into PrismResonance space, delivered over CHORUS as raw float32 vectors.
+The consuming agent retrieves results directly with no JSON parsing and no
+re-embedding call.
+
+Quick start::
+
+    # Provider side (one line to adopt)
+    from prism.api import PrismAPIProvider
+    from prism.api.schema import SentenceTransformerEmbedder
+    from prism.lib.lang import PrismProjector, ProjectionConfig
+
+    projector = PrismProjector(ProjectionConfig(tenant_id="my-tenant"))
+    embedder  = SentenceTransformerEmbedder()
+    provider  = PrismAPIProvider(projector, embedder,
+                                 semantic_fields=["title", "body"],
+                                 id_field="doc_id")
+
+    @provider.expose
+    def search(query: str, top_k: int = 10) -> list[dict]:
+        return my_db.search(query, top_k)   # unchanged
+
+    # Consumer side
+    from prism.api import PrismAPIClient
+
+    client = PrismAPIClient(projector, embedder, loopback_provider=provider)
+    response = client.query("how does inflation affect bonds?", top_k=5)
+    # response.vectors  → np.ndarray (5, 64) — ready for PrismResonance
+    # response.sidecars → list of exact metadata dicts — no re-embedding
+
+See prism/api/README.md for full documentation and benchmark numbers.
+"""
+
+from prism.api.provider import ASGIAdapter, ExposedHandler, PrismAPIProvider
+from prism.api.consumer import LangGraphTool, PrismAPIClient, RetryConfig
+from prism.api.auth import AuthConfig, AuthError, generate_api_key
+from prism.api.multi_provider import MultiProviderClient, MultiProviderResponse
+from prism.api.schema import (
+    APIRequest,
+    APIResponse,
+    Embedder,
+    ExactSidecar,
+    SemanticItem,
+    SentenceTransformerEmbedder,
+)
+from prism.api.integrations.langgraph import (
+    PrismRetrieverNode,
+    MultiProviderRetrieverNode,
+    create_retriever_node,
+)
+
+__all__ = [
+    # Provider
+    "PrismAPIProvider",
+    "ExposedHandler",
+    "ASGIAdapter",
+    # Consumer
+    "PrismAPIClient",
+    "RetryConfig",
+    "LangGraphTool",
+    # Multi-provider
+    "MultiProviderClient",
+    "MultiProviderResponse",
+    # LangGraph integration
+    "PrismRetrieverNode",
+    "MultiProviderRetrieverNode",
+    "create_retriever_node",
+    # Schema
+    "Embedder",
+    "SentenceTransformerEmbedder",
+    "SemanticItem",
+    "ExactSidecar",
+    "APIRequest",
+    "APIResponse",
+    # Auth
+    "AuthConfig",
+    "AuthError",
+    "generate_api_key",
+]

prism/api/auth.py

@@ -0,0 +1,127 @@
+"""
+prism.api.auth — API key and bearer authentication for PrismAPI endpoints.
+"""
+
+from __future__ import annotations
+
+import hmac
+import os
+import secrets
+from dataclasses import dataclass, field
+from typing import Callable, Optional, TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from prism.security.audit import AuditLogger
+    from prism.security.rate_limit import RateLimiter
+
+
+class AuthError(Exception):
+    """Raised when authentication fails."""
+
+
+@dataclass
+class AuthConfig:
+    """
+    Authentication configuration for PrismAPI ASGI endpoints.
+
+    api_keys:
+        Valid API keys (plain strings).  Compared with timing-safe equality.
+    bearer_tokens:
+        Valid bearer tokens (without the 'Bearer ' prefix).
+    header_api_key:
+        Header name for API key auth (default X-API-Key).
+    require_auth:
+        If True, reject requests with no credentials.  If False, auth is
+        optional when api_keys/bearer_tokens are configured.
+    """
+
+    api_keys: tuple[str, ...] = field(default_factory=tuple)
+    bearer_tokens: tuple[str, ...] = field(default_factory=tuple)
+    header_api_key: str = "X-API-Key"
+    require_auth: bool = True
+    rate_limit_rpm: int = 120
+    rate_limit_burst: int = 30
+
+    @classmethod
+    def from_env(cls, *, prefix: str = "PRISM_API") -> "AuthConfig":
+        keys = os.environ.get(f"{prefix}_KEYS", "")
+        tokens = os.environ.get(f"{prefix}_BEARER_TOKENS", "")
+        require = os.environ.get(f"{prefix}_REQUIRE_AUTH", "true").lower() in (
+            "1", "true", "yes",
+        )
+        rpm = int(os.environ.get(f"{prefix}_RATE_LIMIT_RPM", "120"))
+        burst = int(os.environ.get(f"{prefix}_RATE_LIMIT_BURST", "30"))
+        return cls(
+            api_keys=tuple(k.strip() for k in keys.split(",") if k.strip()),
+            bearer_tokens=tuple(t.strip() for t in tokens.split(",") if t.strip()),
+            require_auth=require,
+            rate_limit_rpm=rpm,
+            rate_limit_burst=burst,
+        )
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self.api_keys or self.bearer_tokens)
+
+    def validate_headers(self, headers: dict[str, str]) -> bool:
+        """Return True if headers contain valid credentials."""
+        if not self.enabled:
+            return not self.require_auth
+
+        lowered = {k.lower(): v for k, v in headers.items()}
+
+        api_key = lowered.get(self.header_api_key.lower())
+        if api_key and any(_safe_eq(api_key, k) for k in self.api_keys):
+            return True
+
+        auth = lowered.get("authorization", "")
+        if auth.lower().startswith("bearer "):
+            token = auth[7:].strip()
+            if any(_safe_eq(token, t) for t in self.bearer_tokens):
+                return True
+
+        return False
+
+
+def _safe_eq(a: str, b: str) -> bool:
+    return hmac.compare_digest(a.encode(), b.encode())
+
+
+def generate_api_key() -> str:
+    """Generate a URL-safe API key."""
+    return secrets.token_urlsafe(32)
+
+
+def actor_from_headers(headers: dict[str, str], header_api_key: str = "X-API-Key") -> str:
+    """Derive audit actor id from request headers (API key prefix or client IP)."""
+    lowered = {k.lower(): v for k, v in headers.items()}
+    key = lowered.get(header_api_key.lower(), "")
+    if key:
+        return f"apikey:{key[:8]}"
+    auth = lowered.get("authorization", "")
+    if auth.lower().startswith("bearer "):
+        return f"bearer:{auth[7:13]}"
+    return lowered.get("x-forwarded-for", lowered.get("x-real-ip", "anonymous"))
+
+
+def auth_dependency(config: AuthConfig) -> Callable:
+    """
+    FastAPI dependency factory for PrismAPI routes.
+
+    Usage::
+
+        from fastapi import Depends
+        from prism.api.auth import AuthConfig, auth_dependency
+
+        auth = AuthConfig.from_env()
+        app.add_api_route("/chorus/search", handler, dependencies=[Depends(auth_dependency(auth))])
+    """
+    def _check(headers: dict[str, str]) -> None:
+        if not config.validate_headers(headers):
+            raise AuthError("Unauthorized")
+
+    async def _fastapi_dep(request: object) -> None:
+        hdrs = {k: v for k, v in getattr(request, "headers", {}).items()}
+        _check(hdrs)
+
+    return _fastapi_dep