pyproject.toml

[project]
name = "dppvalidator"
version = "0.5.1"
description = "Python library for validating Digital Product Passports (DPP) according to EU ESPR regulations and CIRPASS/UNECE ontologies"
readme = "README.md"
requires-python = ">=3.10"
license = { text = "MIT" }
authors = [{ name = "artiso-ai" }]
keywords = [
    "dpp",
    "digital-product-passport",
    "espr",
    "cirpass",
    "validation",
    "pydantic",
    "eu-regulation",
    "sustainability",
    "circular-economy",
    "textile",
    "battery-passport",
    "untp",
    "verifiable-credentials",
    "json-ld",
    "w3c",
    "supply-chain",
    "traceability",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Environment :: Console",
    "Framework :: Pydantic :: 2",
    "Intended Audience :: Developers",
    "Intended Audience :: Manufacturing",
    "License :: OSI Approved :: MIT License",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Topic :: Internet :: WWW/HTTP :: Indexing/Search",
    "Topic :: Scientific/Engineering :: Information Analysis",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Topic :: Software Development :: Quality Assurance",
    "Typing :: Typed",
]
dependencies = [
    "pydantic>=2.12.5",
    "httpx>=0.28.0",
    "jsonschema>=4.23.0",
    "pyld>=2.0.4",
    # cryptography: floor lifted to >=46.0.7 to pull in fixes for
    # CVE-2026-26007 (46.0.5), CVE-2026-34073 (46.0.6),
    # CVE-2026-39892 (46.0.7).
    "cryptography>=46.0.7",
    # PyJWT: floor lifted to >=2.12.0 for CVE-2026-32597.
    "PyJWT>=2.12.0",
    "base58>=2.1.0",
]

[project.scripts]
dppvalidator = "dppvalidator.cli:cli"
dppvalidator-precommit = "dppvalidator.cli.commands.precommit:main"

[project.optional-dependencies]
cli = ["rich>=13.0.0"]
rdf = ["rdflib>=7.0.0", "pyshacl>=0.25.0"]
all = ["dppvalidator[cli,rdf]"]

[project.urls]
Homepage = "https://github.com/artiso-ai/dppvalidator"
Repository = "https://github.com/artiso-ai/dppvalidator"
Documentation = "https://artiso-ai.github.io/dppvalidator/"
Changelog = "https://github.com/artiso-ai/dppvalidator/blob/main/CHANGELOG.md"
Issues = "https://github.com/artiso-ai/dppvalidator/issues"

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src/dppvalidator"]

[tool.hatch.build.targets.wheel.sources]
"src" = ""

[tool.hatch.build]
include = [
    "src/dppvalidator/**/*.py",
    "src/dppvalidator/**/*.json",
    "src/dppvalidator/**/*.ttl",
    "src/dppvalidator/**/*.xsd",
    "src/dppvalidator/**/*.yaml",
]
exclude = [
    "scripts/**",
]

[dependency-groups]
dev = [
    # Testing — pytest >=9.0.3 closes CVE-2025-71176.
    "pytest>=9.0.3",
    "pytest-cov>=4.1.0",
    "pytest-asyncio>=0.24.0",
    "hypothesis>=6.100.0",
    "mutmut>=3.0.0",
    # Linting & Type Checking
    "ruff>=0.8.0",
    "ty>=0.0.1a0",
    "pre-commit>=3.6.0",
    # Security & License Scanning
    "pip-audit>=2.7.0",
    "pip-licenses>=5.0.0",
    # ``pip-audit`` pulls in ``pip-api`` which transitively pins
    # ``pip`` itself. Without this floor, the resolver picks pip 25.3
    # (CVE-2026-1703 + CVE-2026-6357), which then surfaces during
    # ``pip-audit`` runs against the lockfile-exported requirements.
    "pip>=26.1",
    # SBOM Generation
    "cyclonedx-bom>=7.0.0",
    # Optional extras (include all for dev)
    "rich>=13.0.0",
    "rdflib>=7.0.0",
    "pyshacl>=0.25.0",
]
docs = [
    "mkdocs>=1.6.0",
    "mkdocs-material[imaging]>=9.5.0",
    "mkdocstrings[python]>=0.27.0",
]

[tool.ruff]
target-version = "py310"
line-length = 100
src = ["src", "tests"]

[tool.ruff.lint]
select = [
    "E",   # pycodestyle errors
    "W",   # pycodestyle warnings
    "F",   # Pyflakes
    "I",   # isort
    "B",   # flake8-bugbear
    "C4",  # flake8-comprehensions
    "UP",  # pyupgrade
    "ARG", # flake8-unused-arguments
    "SIM", # flake8-simplify
]
ignore = [
    "E501", # line too long (handled by formatter)
]

[tool.ruff.lint.isort]
known-first-party = ["dppvalidator"]

[tool.ruff.format]
quote-style = "double"
indent-style = "space"

[tool.pytest.ini_options]
testpaths = ["tests"]
python_files = ["test_*.py"]
python_functions = ["test_*"]
addopts = "-v --tb=short"
filterwarnings = [
    # rdflib internal deprecations (waiting for upstream fixes)
    "ignore:ConjunctiveGraph is deprecated:DeprecationWarning:rdflib.plugins.parsers.jsonld",
    "ignore::DeprecationWarning:rdflib.*",
    "ignore::DeprecationWarning:pyparsing.*",
]
asyncio_mode = "auto"
asyncio_default_fixture_loop_scope = "function"

[tool.coverage.run]
source = ["src/dppvalidator"]
branch = true

[tool.coverage.report]
fail_under = 90
exclude_lines = [
    "pragma: no cover",
    "if TYPE_CHECKING:",
    "raise NotImplementedError",
    "\\.\\.\\.",                 # Protocol stubs
]
omit = [
    "*/protocols.py", # Protocol definitions are abstract stubs
]

[tool.mutmut]
paths_to_mutate = ["src/dppvalidator/validators/"]
tests_dir = "tests/unit/"
runner = "uv run pytest tests/unit/ -x --tb=no -q"