prodkit 0.1.0__tar.gz

prodkit-0.1.0/.gitignore

@@ -0,0 +1,27 @@
+# Byte-compiled / caches
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Environments
+.venv/
+venv/
+.env
+
+# Build artifacts
+build/
+dist/
+*.egg-info/
+
+# Editors / OS
+.vscode/
+.idea/
+.DS_Store
+Thumbs.db
+LI.MD
+PUB.MD
+EX.MD

prodkit-0.1.0/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-07-16
+
+### Added
+- Kernel: layered configuration (args > env > `prodkit.toml` > profile > defaults),
+  plugin manager with dependency topological sort, service registry, event bus,
+  lifespan composition, fail-fast config validation.
+- Plugin contract with async startup/shutdown hooks and prioritized middleware
+  registration.
+- Environment profiles: `development`, `staging`, `production`.
+- Built-in plugins: `request-id`, `logging` (structured JSON/console), `errors`
+  (RFC 9457 problem+json), `health` (`/health`, `/ready`, `/live`), `security`
+  (security headers, trusted hosts, HTTPS redirect), `cors`, `compression` (gzip).
+- `Production(app)` one-line entrypoint.

prodkit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pushkar Pant
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

prodkit-0.1.0/PKG-INFO

@@ -0,0 +1,264 @@
+Metadata-Version: 2.4
+Name: prodkit
+Version: 0.1.0
+Summary: The production framework for FastAPI. One line. Production ready.
+Project-URL: Homepage, https://github.com/Pushkarpant/PRODKIT
+Project-URL: Documentation, https://github.com/Pushkarpant/PRODKIT#readme
+Project-URL: Repository, https://github.com/Pushkarpant/PRODKIT
+Project-URL: Changelog, https://github.com/Pushkarpant/PRODKIT/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/Pushkarpant/PRODKIT/issues
+Author: ProdKit Contributors
+License-Expression: MIT
+License-File: LICENSE
+Keywords: fastapi,health-check,logging,middleware,observability,production,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: fastapi>=0.110
+Requires-Dist: pydantic-settings>=2.1
+Requires-Dist: pydantic>=2.5
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Provides-Extra: brotli
+Requires-Dist: brotli-asgi>=1.4; extra == 'brotli'
+Provides-Extra: dev
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: import-linter>=2.0; extra == 'dev'
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: pytest-cov>=5.0; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Requires-Dist: tomli>=2.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ProdKit
+
+> **One line. Production ready.**
+
+The production framework for [FastAPI](https://fastapi.tiangolo.com/).
+
+```python
+from fastapi import FastAPI
+from prodkit import Production
+
+app = FastAPI()
+Production(app)
+```
+
+That's it. Your app now has security headers, structured JSON logging with
+request-ID correlation, RFC 9457 error responses, Kubernetes-ready health
+endpoints, and gzip compression — configured to current best practice,
+hardened for production, and pleasant in development.
+
+[![CI](https://github.com/Pushkarpant/PRODKIT/actions/workflows/ci.yml/badge.svg)](https://github.com/Pushkarpant/PRODKIT/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/prodkit)](https://pypi.org/project/prodkit/)
+[![Python](https://img.shields.io/pypi/pyversions/prodkit)](https://pypi.org/project/prodkit/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+---
+
+## Why
+
+Every production FastAPI service re-implements the same ~500 lines of glue:
+middleware ordering, security headers, structured logging, health checks,
+error normalization, graceful shutdown. FastAPI deliberately doesn't ship
+this — it's a micro framework. **ProdKit is the batteries.**
+
+And unlike a project template, ProdKit is a library: when best practices
+evolve, `pip install -U prodkit` updates every app you own.
+
+## Installation
+
+[**`pip install prodkit`**](https://pypi.org/project/prodkit/)
+
+```bash
+pip install prodkit
+```
+
+Requires Python 3.10+ and FastAPI 0.110+. The base install depends only on
+FastAPI and Pydantic — nothing else.
+
+## Quick Start
+
+```python
+from fastapi import FastAPI
+from prodkit import Production
+
+app = FastAPI()
+Production(app)                      # production profile by default
+
+@app.get("/hello")
+def hello():
+    return {"message": "hello"}
+```
+
+```bash
+uvicorn main:app
+```
+
+```text
+$ curl -i localhost:8000/hello
+HTTP/1.1 200 OK
+x-request-id: 26fdc49565614c2a9ef1a3b8d4e0f712
+x-content-type-options: nosniff
+x-frame-options: DENY
+strict-transport-security: max-age=63072000; includeSubDomains
+referrer-policy: strict-origin-when-cross-origin
+...
+```
+
+For local development, flip the profile — pretty console logs, debug error
+details, no HSTS:
+
+```python
+Production(app, environment="development")
+```
+
+## What You Get
+
+| Feature | Details |
+|---|---|
+| 🆔 **Request IDs** | `X-Request-ID` on every response, propagated into every log line. Inbound IDs untrusted by default. |
+| 📋 **Structured logging** | One JSON object per request in production (Datadog/Loki/CloudWatch-ready); pretty console logs in development. |
+| 🛡️ **Security headers** | OWASP-aligned: `nosniff`, `X-Frame-Options`, HSTS, `Referrer-Policy`, `Permissions-Policy`. Your own headers always win. |
+| 🚨 **Error normalization** | [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `problem+json` responses. Unhandled 500s are **opaque to clients** — the traceback goes to logs, correlated by request ID. |
+| ❤️ **Health endpoints** | `/health`, `/live` (liveness) and `/ready` (readiness — aggregates checks from every plugin, 503 until all pass). Kubernetes-native. |
+| 🌐 **CORS** | Explicit origins only; the wildcard-with-credentials footgun is refused at boot. |
+| 📦 **Compression** | Gzip for responses over 500 bytes. |
+| 🔌 **Plugin system** | Every feature above is a plugin. Write your own with 6 optional hooks. |
+
+## Configuration
+
+Everything is configurable through four layers (highest wins):
+
+```
+Python args  >  environment variables  >  prodkit.toml  >  profile defaults
+```
+
+**Python:**
+
+```python
+Production(
+    app,
+    environment="production",
+    cors={"origins": ["https://app.example.com"]},   # dict = configure & enable
+    compression=False,                                # bool = toggle
+    security={"trusted_hosts": ["api.example.com"]},
+)
+```
+
+**Environment variables** (`__` descends into sections):
+
+```bash
+PRODKIT_ENVIRONMENT=production
+PRODKIT_LOGGING__LEVEL=WARNING
+PRODKIT_SECURITY__TRUSTED_HOSTS=api.example.com,admin.example.com
+```
+
+**`prodkit.toml`:**
+
+```toml
+[prodkit]
+environment = "production"
+
+[logging]
+level = "INFO"
+
+[cors]
+enabled = true
+origins = ["https://app.example.com"]
+```
+
+### Fail-fast, refuse-unsafe
+
+Misconfiguration fails **at startup with a named key**, never silently:
+
+```text
+ProdKitConfigError: Invalid ProdKit configuration:
+  - logging.levle: Extra inputs are not permitted
+```
+
+And configurations that would weaken a production deployment are refused,
+not warned about:
+
+- `debug=True` in production
+- error responses that would leak tracebacks in production
+- CORS `origins=["*"]` combined with `allow_credentials=True`
+
+## Writing a Plugin
+
+```python
+from prodkit import Check, Plugin, Production
+
+class DatabasePlugin(Plugin):
+    name = "database"
+
+    async def startup(self, ctx):
+        self.pool = await create_pool(...)
+        ctx.registry.provide("db", self.pool)
+
+    async def shutdown(self, ctx):
+        await self.pool.close()
+
+    def checks(self, ctx):
+        return [Check(name="database", passed=self.pool.is_alive())]
+
+Production(app, plugins=[DatabasePlugin()])
+```
+
+Your check now shows up in `/ready` automatically. Plugins can declare
+`requires = ("other-plugin",)` and the kernel activates them in dependency
+order — cycles and missing dependencies fail at boot.
+
+Middleware registered by plugins carries an explicit integer priority, so
+the middleware onion is always correctly ordered no matter what order
+plugins load in (request-id outermost, compression innermost).
+
+## Plays Nice With Your App
+
+- **Same app object.** Routes, dependencies, and existing middleware keep
+  working. Remove `Production(app)` and you have a plain FastAPI app again.
+- **Your lifespan survives.** ProdKit *composes* with an existing `lifespan`:
+  plugin startup → your lifespan → plugin shutdown (LIFO).
+- **Your headers win.** Security headers use set-if-absent semantics.
+- **Every feature can be turned off.** `Production(app, security=False, ...)`
+
+## Project Status
+
+**v0.1.0 — alpha.** Core kernel and seven built-in plugins, 60 tests, 98%
+coverage, strict mypy, CI across Python 3.10–3.13.
+
+Roadmap: `prodkit doctor` CLI with a production-readiness score (v0.2),
+Prometheus metrics + Redis backends (v0.3), Dockerfile/nginx/CI generators
+(v0.4), public plugin SDK (v0.5), auth helpers (v0.6), stable API (v1.0).
+Full details in [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
+
+## Contributing
+
+Contributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
+Security reports: see [SECURITY.md](SECURITY.md) (never open a public issue).
+
+```bash
+git clone https://github.com/Pushkarpant/PRODKIT
+cd PRODKIT
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+```
+
+## License
+
+[MIT](LICENSE)
+
+---
+
+*FastAPI builds APIs. ProdKit makes them production-ready.*

prodkit-0.1.0/README.md

@@ -0,0 +1,222 @@
+# ProdKit
+
+> **One line. Production ready.**
+
+The production framework for [FastAPI](https://fastapi.tiangolo.com/).
+
+```python
+from fastapi import FastAPI
+from prodkit import Production
+
+app = FastAPI()
+Production(app)
+```
+
+That's it. Your app now has security headers, structured JSON logging with
+request-ID correlation, RFC 9457 error responses, Kubernetes-ready health
+endpoints, and gzip compression — configured to current best practice,
+hardened for production, and pleasant in development.
+
+[![CI](https://github.com/Pushkarpant/PRODKIT/actions/workflows/ci.yml/badge.svg)](https://github.com/Pushkarpant/PRODKIT/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/prodkit)](https://pypi.org/project/prodkit/)
+[![Python](https://img.shields.io/pypi/pyversions/prodkit)](https://pypi.org/project/prodkit/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+---
+
+## Why
+
+Every production FastAPI service re-implements the same ~500 lines of glue:
+middleware ordering, security headers, structured logging, health checks,
+error normalization, graceful shutdown. FastAPI deliberately doesn't ship
+this — it's a micro framework. **ProdKit is the batteries.**
+
+And unlike a project template, ProdKit is a library: when best practices
+evolve, `pip install -U prodkit` updates every app you own.
+
+## Installation
+
+[**`pip install prodkit`**](https://pypi.org/project/prodkit/)
+
+```bash
+pip install prodkit
+```
+
+Requires Python 3.10+ and FastAPI 0.110+. The base install depends only on
+FastAPI and Pydantic — nothing else.
+
+## Quick Start
+
+```python
+from fastapi import FastAPI
+from prodkit import Production
+
+app = FastAPI()
+Production(app)                      # production profile by default
+
+@app.get("/hello")
+def hello():
+    return {"message": "hello"}
+```
+
+```bash
+uvicorn main:app
+```
+
+```text
+$ curl -i localhost:8000/hello
+HTTP/1.1 200 OK
+x-request-id: 26fdc49565614c2a9ef1a3b8d4e0f712
+x-content-type-options: nosniff
+x-frame-options: DENY
+strict-transport-security: max-age=63072000; includeSubDomains
+referrer-policy: strict-origin-when-cross-origin
+...
+```
+
+For local development, flip the profile — pretty console logs, debug error
+details, no HSTS:
+
+```python
+Production(app, environment="development")
+```
+
+## What You Get
+
+| Feature | Details |
+|---|---|
+| 🆔 **Request IDs** | `X-Request-ID` on every response, propagated into every log line. Inbound IDs untrusted by default. |
+| 📋 **Structured logging** | One JSON object per request in production (Datadog/Loki/CloudWatch-ready); pretty console logs in development. |
+| 🛡️ **Security headers** | OWASP-aligned: `nosniff`, `X-Frame-Options`, HSTS, `Referrer-Policy`, `Permissions-Policy`. Your own headers always win. |
+| 🚨 **Error normalization** | [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `problem+json` responses. Unhandled 500s are **opaque to clients** — the traceback goes to logs, correlated by request ID. |
+| ❤️ **Health endpoints** | `/health`, `/live` (liveness) and `/ready` (readiness — aggregates checks from every plugin, 503 until all pass). Kubernetes-native. |
+| 🌐 **CORS** | Explicit origins only; the wildcard-with-credentials footgun is refused at boot. |
+| 📦 **Compression** | Gzip for responses over 500 bytes. |
+| 🔌 **Plugin system** | Every feature above is a plugin. Write your own with 6 optional hooks. |
+
+## Configuration
+
+Everything is configurable through four layers (highest wins):
+
+```
+Python args  >  environment variables  >  prodkit.toml  >  profile defaults
+```
+
+**Python:**
+
+```python
+Production(
+    app,
+    environment="production",
+    cors={"origins": ["https://app.example.com"]},   # dict = configure & enable
+    compression=False,                                # bool = toggle
+    security={"trusted_hosts": ["api.example.com"]},
+)
+```
+
+**Environment variables** (`__` descends into sections):
+
+```bash
+PRODKIT_ENVIRONMENT=production
+PRODKIT_LOGGING__LEVEL=WARNING
+PRODKIT_SECURITY__TRUSTED_HOSTS=api.example.com,admin.example.com
+```
+
+**`prodkit.toml`:**
+
+```toml
+[prodkit]
+environment = "production"
+
+[logging]
+level = "INFO"
+
+[cors]
+enabled = true
+origins = ["https://app.example.com"]
+```
+
+### Fail-fast, refuse-unsafe
+
+Misconfiguration fails **at startup with a named key**, never silently:
+
+```text
+ProdKitConfigError: Invalid ProdKit configuration:
+  - logging.levle: Extra inputs are not permitted
+```
+
+And configurations that would weaken a production deployment are refused,
+not warned about:
+
+- `debug=True` in production
+- error responses that would leak tracebacks in production
+- CORS `origins=["*"]` combined with `allow_credentials=True`
+
+## Writing a Plugin
+
+```python
+from prodkit import Check, Plugin, Production
+
+class DatabasePlugin(Plugin):
+    name = "database"
+
+    async def startup(self, ctx):
+        self.pool = await create_pool(...)
+        ctx.registry.provide("db", self.pool)
+
+    async def shutdown(self, ctx):
+        await self.pool.close()
+
+    def checks(self, ctx):
+        return [Check(name="database", passed=self.pool.is_alive())]
+
+Production(app, plugins=[DatabasePlugin()])
+```
+
+Your check now shows up in `/ready` automatically. Plugins can declare
+`requires = ("other-plugin",)` and the kernel activates them in dependency
+order — cycles and missing dependencies fail at boot.
+
+Middleware registered by plugins carries an explicit integer priority, so
+the middleware onion is always correctly ordered no matter what order
+plugins load in (request-id outermost, compression innermost).
+
+## Plays Nice With Your App
+
+- **Same app object.** Routes, dependencies, and existing middleware keep
+  working. Remove `Production(app)` and you have a plain FastAPI app again.
+- **Your lifespan survives.** ProdKit *composes* with an existing `lifespan`:
+  plugin startup → your lifespan → plugin shutdown (LIFO).
+- **Your headers win.** Security headers use set-if-absent semantics.
+- **Every feature can be turned off.** `Production(app, security=False, ...)`
+
+## Project Status
+
+**v0.1.0 — alpha.** Core kernel and seven built-in plugins, 60 tests, 98%
+coverage, strict mypy, CI across Python 3.10–3.13.
+
+Roadmap: `prodkit doctor` CLI with a production-readiness score (v0.2),
+Prometheus metrics + Redis backends (v0.3), Dockerfile/nginx/CI generators
+(v0.4), public plugin SDK (v0.5), auth helpers (v0.6), stable API (v1.0).
+Full details in [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
+
+## Contributing
+
+Contributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
+Security reports: see [SECURITY.md](SECURITY.md) (never open a public issue).
+
+```bash
+git clone https://github.com/Pushkarpant/PRODKIT
+cd PRODKIT
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+```
+
+## License
+
+[MIT](LICENSE)
+
+---
+
+*FastAPI builds APIs. ProdKit makes them production-ready.*

prodkit-0.1.0/pyproject.toml

@@ -0,0 +1,111 @@
+[build-system]
+requires = ["hatchling>=1.25"]
+build-backend = "hatchling.build"
+
+[project]
+name = "prodkit"
+version = "0.1.0"
+description = "The production framework for FastAPI. One line. Production ready."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+authors = [{ name = "ProdKit Contributors" }]
+keywords = [
+    "fastapi",
+    "production",
+    "middleware",
+    "security",
+    "observability",
+    "logging",
+    "health-check",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Framework :: FastAPI",
+    "Topic :: Internet :: WWW/HTTP :: HTTP Servers",
+    "Topic :: Software Development :: Libraries :: Application Frameworks",
+    "Typing :: Typed",
+]
+dependencies = [
+    "fastapi>=0.110",
+    "pydantic>=2.5",
+    "pydantic-settings>=2.1",
+    "tomli>=2.0; python_version < '3.11'",
+]
+
+[project.optional-dependencies]
+brotli = ["brotli-asgi>=1.4"]
+dev = [
+    "pytest>=8.0",
+    "pytest-cov>=5.0",
+    "httpx>=0.27",
+    "ruff>=0.6",
+    "mypy>=1.11",
+    "import-linter>=2.0",
+    "tomli>=2.0",  # so mypy (python_version=3.10) can type-check the fallback import
+]
+
+[project.urls]
+Homepage = "https://github.com/Pushkarpant/PRODKIT"
+Documentation = "https://github.com/Pushkarpant/PRODKIT#readme"
+Repository = "https://github.com/Pushkarpant/PRODKIT"
+Changelog = "https://github.com/Pushkarpant/PRODKIT/blob/main/CHANGELOG.md"
+Issues = "https://github.com/Pushkarpant/PRODKIT/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/prodkit"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/prodkit", "tests", "README.md", "LICENSE", "CHANGELOG.md"]
+
+[tool.ruff]
+target-version = "py310"
+line-length = 99
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = [
+    "E",    # pycodestyle errors
+    "W",    # pycodestyle warnings
+    "F",    # pyflakes
+    "I",    # isort
+    "B",    # bugbear
+    "UP",   # pyupgrade
+    "S",    # bandit (security)
+    "N",    # pep8-naming
+    "C4",   # comprehensions
+    "SIM",  # simplify
+    "RUF",  # ruff-specific
+]
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["S101", "S106"]  # asserts and test credentials are fine in tests
+
+[tool.mypy]
+python_version = "3.10"
+strict = true
+packages = ["prodkit"]
+mypy_path = "src"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "--cov=prodkit --cov-report=term-missing --cov-fail-under=90"
+
+[tool.coverage.run]
+source = ["src/prodkit"]
+
+[tool.importlinter]
+root_package = "prodkit"
+
+[[tool.importlinter.contracts]]
+name = "Kernel must not depend on plugins"
+type = "forbidden"
+source_modules = ["prodkit.core", "prodkit.contracts"]
+forbidden_modules = ["prodkit.plugins"]