pyproject.toml

[build-system]
requires = ["setuptools>=61.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "supply-graph-ai"
version = "0.14.1"
description = "Open Hardware Manager (OHM) - A flexible, domain-agnostic framework for matching requirements with capabilities"
readme = "README.md"
requires-python = ">=3.12"
license = {text = "MIT"}
authors = [
    {name = "OHM Team"}
]
keywords = ["open-hardware", "okh", "okw", "matching", "manufacturing", "supply-chain"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
]
dependencies = [
    # Web framework
    "fastapi>=0.120.0",
    "uvicorn[standard]",
    "python-multipart>=0.0.31",
    # Data modeling
    "pydantic[email]>=2.0.0,<3.0.0",
    "pydantic-settings>=2.2.0,<3.0.0",
    # Graph
    "networkx",
    # Storage / cloud
    "aiofiles>=23.2.1",
    "aiohttp>=3.14.3",
    "boto3>=1.26.0",
    "azure-storage-blob>=12.14.0",
    "google-cloud-storage>=2.7.0",
    "google-cloud-secret-manager>=2.16.0",
    "PyYAML>=6.0",
    "python-dotenv>=1.0.0",
    # LLM providers
    "anthropic",
    "openai",
    "ollama",
    "google-cloud-aiplatform",
    "google-auth",
    # CLI
    "click",
    "tqdm",
    # NLP
    "spacy>=3.7.0",
    # spaCy English model, pinned as a locked dependency so `uv sync` installs and
    # preserves it. Installing via `python -m spacy download` leaves it untracked,
    # and uv's exact sync then deletes it on the next `uv run`/`uv sync`. The wheel
    # is py3-none-any (arch-independent), so it serves all platforms in multi-arch
    # builds. Bump in lockstep with spaCy's minor version (model is >=3.8,<3.9).
    "en_core_web_md @ https://github.com/explosion/spacy-models/releases/download/en_core_web_md-3.8.0/en_core_web_md-3.8.0-py3-none-any.whl",
    # Server
    "gunicorn>=21.0.0",
    "psutil>=5.9.0",
    # Auth
    "bcrypt>=4.0.0",
    # Cache (Redis protocol — optional backend via CACHE_BACKEND=redis)
    "redis>=5.0.0",
    # Async jobs (generate-from-url worker; broker/result typically Redis)
    "celery[redis]>=5.4.0",
    # Demo interface
    "streamlit>=1.28.0",
    "pandas>=1.5.0",
    "nest-asyncio>=1.5.0",
    "pydeck>=0.8.0",
    # Synthetic data
    "faker>=19.0.0",
    "geopy>=2.3.0",
    # Document parsing
    # >=6.15.0 fixes PYSEC-2026-3655 and PYSEC-2026-3656.
    # >=6.16.1 fixes CVE-2026-84309, CVE-2026-84310, CVE-2026-84311.
    "pypdf>=6.16.1",
    "python-docx>=1.0.0",
    # TOML
    "tomli_w>=1.2.0",
    # Federation
    "cryptography>=50.0.0",
    "jsonschema>=4.0.0",
    "zeroconf>=0.149.12",
]

# Entry points for console scripts
[project.scripts]
ohm = "src.cli.main:cli"

[project.optional-dependencies]
dev = [
    "pytest>=7.0.0",
    "pytest-asyncio>=0.21.0",
    "pytest-timeout>=2.3.1",
    "httpx>=0.24.0",
    # Pin to match .pre-commit-config.yaml so `make format` and the black hook agree.
    # 26.3.1+ required for CVE-2026-32274 (arbitrary cache path writes).
    "black==26.3.1",
]
docs = [
    # Pinned below 2.0 deliberately. MkDocs 2.0 (https://www.encode.io/mkdocs/)
    # is a pre-release that drops the plugin system, moves config from YAML to
    # TOML, and does not currently state a license — so an unpinned `mkdocs`
    # would silently break both sites on a routine `uv sync`. Revisit when 2.0
    # is licensed and its hook/theme story is settled.
    "mkdocs>=1.6,<2",
    "mkdocs-material>=9.7,<10",
    # Transitive via mkdocs-material; pinned directly since pip-audit flags it on
    # its own. Security pin: PYSEC-2026-2999, PYSEC-2026-3609, PYSEC-2026-3654
    # (fixed 11.0.1).
    "pymdown-extensions>=11.0.1",
]

[tool.setuptools.packages.find]
where = ["."]

[tool.setuptools.package-data]
"*" = ["*.yaml", "*.yml", "*.json"]

[tool.pytest.ini_options]
testpaths = ["tests"]
python_files = ["test_*.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
addopts = "-v --tb=short -m \"not quarantine\""
asyncio_mode = "strict"
timeout = 90
timeout_method = "thread"
markers = [
    "quarantine: legacy or environment-dependent tests excluded from default runs",
    "allow_network: opt-out marker for tests that intentionally require external network",
    "unit: deterministic unit tests with no external I/O",
    "contract: API/CLI contract tests with isolated dependencies",
    "e2e: end-to-end canonical workflow tests",
    "integration: integration tests that may require services or seeded data",
    "slow: tests that take more than 10 seconds",
    "llm: tests requiring LLM API access",
    "benchmark: performance benchmark tests",
    "okh_dataset: OKH generation dataset / clone manifest regression (tests/data/okh_generation)",
    "mom_live: live Maps of Making SPARQL smoke (requires MOM_LIVE=1)",
]

[tool.uv]
override-dependencies = [
    "starlette>=1.3.1",
    # >=6.5.8 fixes GHSA-wwv5-g3v4-889x and GHSA-8423-8fgw-73vq.
    "tornado>=6.5.8",
    "urllib3>=2.7.0",
    "idna>=3.15",
    # Security pins (pip-audit / OSV) — bump when CI security gate fails.
    # GHSA-fjr4-x663-mwxc, GHSA-6p8h-3wgx-97gf, GHSA-r9mr-m37c-5fr3 (fixed 3.1.54)
    # and GHSA-94p4-4cq8-9g67 (fixed 3.1.55).
    # >=3.1.58 fixes GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p,
    # GHSA-hh9p-6wh2-4mfc, GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr.
    # >=3.1.60 fixes PYSEC-2026-3982, PYSEC-2026-3983 and PYSEC-2026-3984.
    "gitpython>=3.1.60",
    "pillow>=12.3.0",
    "pyasn1>=0.6.4",
    "setuptools>=83.0.0",
]

[tool.black]
line-length = 88
target-version = ["py312"]
include = '\.pyi?$'
extend-exclude = '''
/(
  \.git
  | \.venv
  | build
  | dist
)/
'''

[tool.ruff]
line-length = 88
target-version = "py312"
extend-exclude = [
  "build",
  "dist",
  ".venv",
]

[tool.ruff.lint]
# Keep CI focused on high-signal correctness and import hygiene.
select = ["E9", "F63", "F7", "F82"]

[tool.ruff.lint.per-file-ignores]
"**/__init__.py" = ["F401"]

# Bandit (CI security job). Fix real issues in code; skip noisy rules for established patterns.
[tool.bandit]
exclude_dirs = ["tests", ".venv", "build", "dist"]
skips = [
  "B110",  # try/except/pass on best-effort cleanup paths
  "B112",  # try/except/continue on iterative recovery
  "B404",  # subprocess import (B603 covers invocation)
  "B603",  # subprocess.run with argv list, shell=False
  "B607",  # partial executable path for git in PATH
  "B105",  # false positives on enum names and dev-only default constant names
  "B608",  # false positives on large LLM prompt f-strings (not SQL)
  "B104",  # intentional 0.0.0.0 API bind / CLI localhost rewrite
  "B101",  # assert used for type-narrowing after _ensure_index() in identity stores
]

[dependency-groups]
dev = [
    "pytest-cov>=7.1.0",
]