pyproject.toml

# Initial pyproject.toml for Phentrieve

[build-system]
requires = ["setuptools>=82.0.1", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "phentrieve"
version = "0.21.6"
description = "A CLI tool for retrieving Human Phenotype Ontology (HPO) terms from clinical text using multilingual embeddings."
readme = "README.md"
license = { file = "LICENSE" }
authors = [
    { name = "Bernt Popp", email = "bernt.popp@example.com" }, # Placeholder: Update email
]
# NOTE: Python 3.11+ is required by the current dependency stack.
# Previous versions supported Python 3.10
requires-python = ">=3.11"
classifiers = [
    "Development Status :: 3 - Alpha",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "License :: OSI Approved :: MIT License",
    "Operating System :: OS Independent",
    "Intended Audience :: Science/Research",
    "Topic :: Scientific/Engineering :: Bio-Informatics",
    "Topic :: Scientific/Engineering :: Medical Science Apps.",
    "Environment :: Console",
]
dependencies = [
    "sentence-transformers>=4.1.0,<6.0.0",
    "chromadb>=0.6.3,<1.0.0",              # Security: avoid GHSA-f4j7-r4q5-qw2c until ChromaDB 1.x has a patched release
    "requests>=2.31.0",
    "urllib3>=2.7.0",                        # Security: CVE fixes (GHSA-48p4-8xcf-vxj5, GHSA-pq67-6m6q-mj2v, PYSEC-2026-141, PYSEC-2026-142)
    "pysbd>=0.3.4",
    "tqdm>=4.66.1",
    "pandas>=2.0.0",
    "torch>=2.11.0,<3.0.0",                 # Pin to 2.x (PyTorch major versions)
    "numpy>=2.0.0,<3.0.0",                  # NumPy 2.x for modern library compatibility (spacy 3.8+, thinc 8.3+)
    "matplotlib>=3.10.8",
    "seaborn>=0.12.0",
    "typer>=0.24.1,<0.26.0",        # 0.26 vendors click (typer._click) and breaks the lazy CLI groups in phentrieve/cli
    "rich>=10.0.0",                         # Required for typer CLI features
    "shellingham>=1.3.0",                   # Required for typer shell completion
    "PyYAML>=6.0",
    "phenopackets>=2.0.2.post5,<3.0.0",
    "protobuf>=4.25.3",
    "scikit-learn>=1.4.0",
    "networkx>=3.0",
    # Text processing (required for assertion detection in all CLI commands)
    "spacy>=3.8.0,<4.0.0",                  # spaCy 3.8+ supports NumPy 2.x and typer 0.16+
    "en_core_web_sm @ https://github.com/explosion/spacy-models/releases/download/en_core_web_sm-3.8.0/en_core_web_sm-3.8.0-py3-none-any.whl",
    "cachetools>=6.2.2",
]

[project.scripts]
phentrieve = "phentrieve.cli:app"
phentrieve-mcp = "api.mcp.cli:main"

[project.optional-dependencies]
# API server dependencies (for running the FastAPI backend)
api = [
    "fastapi>=0.115.0",
    "uvicorn[standard]>=0.32.0",
    "python-dotenv>=1.0.0",
]
# MCP server dependencies (for Model Context Protocol integration)
mcp = [
    "fastapi-mcp>=0.4.0,<1.0.0",
    "mcp[cli]>=1.22.0,<2.0.0",
    "fastapi>=0.115.0",
    "uvicorn[standard]>=0.32.0",
    "python-dotenv>=1.0.0",
    "pydantic-settings>=2.0.0",
]
llm = [
    "google-genai>=1.22.0,<3.0.0",
    "anthropic>=0.73.0,<1.0.0",
    "openai>=2.0.0,<3.0.0",
]
benchmarks = [
    "openpyxl>=3.1.0",
]
phenopackets = [
    "jsonschema>=4.25.1,<5.0.0",
]
energy = [
    "codecarbon>=3.2,<4.0",
]
analysis = [
    "umap-learn>=0.5.6",
    "plotly>=5.22.0",
]
# Install CLI + API with: uv sync --extra api
# Install CLI + MCP with: uv sync --extra mcp

[tool.uv]
constraint-dependencies = [
    # ChromaDB 0.6.x declares posthog>=2.4.0 but emits runtime errors with
    # PostHog 6+ telemetry APIs.
    "posthog>=2.4.0,<6.0.0",
]

[tool.setuptools]

[tool.setuptools.packages.find]
where = ["."]
include = ["phentrieve*", "api*"]
# exclude = ["tests*"] # Uncomment if/when you add tests

[tool.setuptools.package-data]
"phentrieve.phenopackets" = ["schemas/*.json"]
"phentrieve.text_processing.default_lang_resources" = ["*.json"]
"phentrieve.llm.prompts" = [
    "templates/*.txt",
    "templates/direct_text/*.yaml",
    "templates/tool_guided/*.yaml",
    "templates/two_phase/*.yaml",
    "templates/postprocess/*.yaml",
]

[tool.ruff]
line-length = 88
target-version = "py311"
fix = true
exclude = [
    ".git",
    ".mypy_cache",
    ".pytest_cache",
    ".venv",
    "__pycache__",
    "_build",
    "build",
    "dist",
    "venv",
    "data",
]

[tool.ruff.lint]
select = [
    "E",   # pycodestyle errors
    "W",   # pycodestyle warnings
    "F",   # pyflakes
    "I",   # isort
    "B",   # flake8-bugbear
    "C4",  # flake8-comprehensions
    "UP",  # pyupgrade
    "S",   # bandit security checks
]
ignore = [
    "E501",  # line too long (handled by formatter)
    "S101",  # use of assert (common in tests)
    "B904",  # raise without from (can be addressed later)
    "B007",  # unused loop control variable (intentional in some cases)
    "B008",  # function call in default arg (pandas/dataframe patterns)
    "S301",  # pickle usage (needed for model loading)
    "S104",  # hardcoded bind all interfaces (local dev only)
    "S112",  # try-except-continue (acceptable pattern)
    "F823",  # false positive - detect_language is imported
]

[tool.ruff.lint.per-file-ignores]
"tests/*" = ["S101"]  # Allow asserts in tests
"tests/e2e/*" = ["S101", "S108"]  # Allow asserts and /tmp path references in E2E tests

[tool.ruff.format]
quote-style = "double"
indent-style = "space"
skip-magic-trailing-comma = false
line-ending = "auto"

[tool.mypy]
python_version = "3.11"
warn_return_any = true
warn_unused_configs = true
disallow_untyped_defs = false  # Gradual typing - start permissive
check_untyped_defs = true
warn_redundant_casts = true
warn_unused_ignores = true
no_implicit_optional = true
strict_optional = true
show_error_codes = true

# Performance optimizations
cache_dir = ".mypy_cache"
sqlite_cache = true
incremental = true
# skip_version_check = true  # Uncomment if switching mypy versions frequently
# skip_cache_mtime_checks = true  # Uncomment for extra speed (less safety)

# Allow incremental adoption
ignore_missing_imports = true
allow_untyped_calls = true
allow_untyped_decorators = true

[[tool.mypy.overrides]]
module = [
    "sentence_transformers.*",
    "chromadb.*",
    "spacy.*",
    "pysbd.*",
    "matplotlib.*",
    "seaborn.*",
]
ignore_missing_imports = true

[[tool.mypy.overrides]]
module = [
    "google",
    "google.*",
    "google.genai",
    "google.genai.*",
]
follow_imports = "skip"

[tool.pytest.ini_options]
python_files = ["test_*.py"]
testpaths = ["tests"]
# pythonpath = "."  # Temporarily disabled - using PYTHONPATH env var instead
addopts = [
    "--strict-markers",
    "--tb=short",

    # Execution - Skip slow and e2e tests by default
    "-m", "not slow and not e2e",  # E2E tests require Docker, run separately
]
markers = [
    "unit: Fast unit tests (mocked dependencies)",
    "integration: Integration tests (real dependencies)",
    "benchmark: Benchmark dataset and evaluation tests",
    "e2e: End-to-end Docker tests",
    "slow: Slow tests (>5s)",
]
norecursedirs = [
    ".*",
    "build",
    "dist",
    "docs",
    "data",
    "venv",
    "env",
    "*.egg-info",
]

# Bandit security scanner configuration (standalone, complements Ruff "S" rules)
# Used for SARIF output in CI and detailed security reports
[tool.bandit]
exclude_dirs = ["tests", "docs", "data", ".venv", "venv", "build", "dist"]
# Skip tests that overlap with Ruff or produce false positives
skips = [
    "B101",  # assert_used - acceptable in tests (Ruff S101)
    "B104",  # hardcoded_bind_all_interfaces - local dev only (Ruff S104)
    "B301",  # pickle - needed for model loading (Ruff S301)
]

[dependency-groups]
dev = [
    "ruff>=0.9.1",
    "mypy>=1.20.1",
    "pytest>=8.0.0",
    "pytest-cov>=7.1.0",
    "pytest-mock>=3.14.0",
    "pytest-xdist>=3.8.0",  # Parallel test execution
    "pytest-timeout>=2.4.0",
    "pytest-asyncio>=0.21.0",
    "pytest-docker>=3.2.5",  # For Docker E2E tests (Phase 3)
    "docker>=7.0.0",  # Docker SDK for E2E tests
    "types-requests>=2.33.0.20260408",  # Type stubs for requests library
    "types-PyYAML>=6.0.0",  # Type stubs for PyYAML library
    # Security scanning
    "pip-audit>=2.9.0",  # Python dependency vulnerability scanner
    "bandit[toml,sarif]>=1.9.0",  # Python SAST with TOML config and SARIF output
    "mkdocs-glightbox>=0.5.2",
    "mkdocs-material>=9.7.6",
    "pre-commit>=4.6.0",
]

[tool.semantic_release]
# Enable alpha versioning (0.x.x)
allow_zero_version = true
major_on_zero = false  # Breaking changes bump MINOR during 0.x

# Version location (for semantic-release to update)
version_toml = ["pyproject.toml:project.version"]

# Version variables to update across codebase
version_variables = [
    "phentrieve/__init__.py:__version__",
]

# Commit message parsing (Conventional Commits)
commit_parser = "angular"