pyproject.toml

[build-system]
requires = ["setuptools>=61.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "supply-graph-ai"
version = "0.9.0"
description = "Open Hardware Manager (OHM) - A flexible, domain-agnostic framework for matching requirements with capabilities"
readme = "README.md"
requires-python = ">=3.12"
license = {text = "MIT"}
authors = [
    {name = "OHM Team"}
]
keywords = ["open-hardware", "okh", "okw", "matching", "manufacturing", "supply-chain"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
]
dependencies = [
    # Web framework
    "fastapi>=0.120.0",
    "uvicorn[standard]",
    "python-multipart>=0.0.31",
    # Data modeling
    "pydantic[email]>=2.0.0,<3.0.0",
    "pydantic-settings>=2.2.0,<3.0.0",
    # Graph
    "networkx",
    # Storage / cloud
    "aiofiles>=23.2.1",
    "aiohttp>=3.14.1",
    "boto3>=1.26.0",
    "azure-storage-blob>=12.14.0",
    "google-cloud-storage>=2.7.0",
    "google-cloud-secret-manager>=2.16.0",
    "PyYAML>=6.0",
    "python-dotenv>=1.0.0",
    # LLM providers
    "anthropic",
    "openai",
    "ollama",
    "google-cloud-aiplatform",
    "google-auth",
    # CLI
    "click",
    "tqdm",
    # NLP
    "spacy>=3.7.0",
    # spaCy English model, pinned as a locked dependency so `uv sync` installs and
    # preserves it. Installing via `python -m spacy download` leaves it untracked,
    # and uv's exact sync then deletes it on the next `uv run`/`uv sync`. The wheel
    # is py3-none-any (arch-independent), so it serves all platforms in multi-arch
    # builds. Bump in lockstep with spaCy's minor version (model is >=3.8,<3.9).
    "en_core_web_md @ https://github.com/explosion/spacy-models/releases/download/en_core_web_md-3.8.0/en_core_web_md-3.8.0-py3-none-any.whl",
    # Server
    "gunicorn>=21.0.0",
    "psutil>=5.9.0",
    # Auth
    "bcrypt>=4.0.0",
    # Cache (Redis protocol — optional backend via CACHE_BACKEND=redis)
    "redis>=5.0.0",
    # Demo interface
    "streamlit>=1.28.0",
    "pandas>=1.5.0",
    "nest-asyncio>=1.5.0",
    "pydeck>=0.8.0",
    # Synthetic data
    "faker>=19.0.0",
    "geopy>=2.3.0",
    # Document parsing
    "pypdf>=6.13.3",
    "python-docx>=1.0.0",
    # TOML
    "tomli_w>=1.2.0",
    # Federation
    "cryptography>=48.0.1",
    "jsonschema>=4.0.0",
    "zeroconf>=0.149.12",
]

# Entry points for console scripts
[project.scripts]
ohm = "src.cli.main:cli"

[project.optional-dependencies]
dev = [
    "pytest>=7.0.0",
    "pytest-asyncio>=0.21.0",
    "pytest-timeout>=2.3.1",
    "httpx>=0.24.0",
    # Pin to match .pre-commit-config.yaml so `make format` and the black hook agree.
    # 26.3.1+ required for CVE-2026-32274 (arbitrary cache path writes).
    "black==26.3.1",
]
docs = [
    "mkdocs",
    "mkdocs-mermaid2-plugin",
    "mkdocs-material",
]

[tool.setuptools.packages.find]
where = ["."]

[tool.setuptools.package-data]
"*" = ["*.yaml", "*.yml", "*.json"]

[tool.pytest.ini_options]
testpaths = ["tests"]
python_files = ["test_*.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
addopts = "-v --tb=short -m \"not quarantine\""
asyncio_mode = "strict"
timeout = 90
timeout_method = "thread"
markers = [
    "quarantine: legacy or environment-dependent tests excluded from default runs",
    "allow_network: opt-out marker for tests that intentionally require external network",
    "unit: deterministic unit tests with no external I/O",
    "contract: API/CLI contract tests with isolated dependencies",
    "e2e: end-to-end canonical workflow tests",
    "integration: integration tests that may require services or seeded data",
    "slow: tests that take more than 10 seconds",
    "llm: tests requiring LLM API access",
    "benchmark: performance benchmark tests",
    "okh_dataset: OKH generation dataset / clone manifest regression (tests/data/okh_generation)",
]

[tool.uv]
override-dependencies = [
    "starlette>=1.3.1",
    "tornado>=6.5.7",
    "urllib3>=2.7.0",
    "idna>=3.15",
    "gitpython>=3.1.50",
]

[tool.black]
line-length = 88
target-version = ["py312"]
include = '\.pyi?$'
extend-exclude = '''
/(
  \.git
  | \.venv
  | build
  | dist
)/
'''

[tool.ruff]
line-length = 88
target-version = "py312"
extend-exclude = [
  "build",
  "dist",
  ".venv",
]

[tool.ruff.lint]
# Keep CI focused on high-signal correctness and import hygiene.
select = ["E9", "F63", "F7", "F82"]

[tool.ruff.lint.per-file-ignores]
"**/__init__.py" = ["F401"]

# Bandit (CI security job). Fix real issues in code; skip noisy rules for established patterns.
[tool.bandit]
exclude_dirs = ["tests", ".venv", "build", "dist"]
skips = [
  "B110",  # try/except/pass on best-effort cleanup paths
  "B112",  # try/except/continue on iterative recovery
  "B404",  # subprocess import (B603 covers invocation)
  "B603",  # subprocess.run with argv list, shell=False
  "B607",  # partial executable path for git in PATH
  "B105",  # false positives on enum names and dev-only default constant names
  "B608",  # false positives on large LLM prompt f-strings (not SQL)
  "B104",  # intentional 0.0.0.0 API bind / CLI localhost rewrite
]

[dependency-groups]
dev = [
    "pytest-cov>=7.1.0",
]