[build-system]
requires = ["uv_build>=0.8.13,<0.9.0"]
build-backend = "uv_build"

[project]
name = "openultrasast"
version = "2.0.1"
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
readme = "README.md"
license = "Apache-2.0"
license-files = ["LICENSE"]
requires-python = ">=3.11"
dependencies = ["pyyaml>=6.0"]

[project.optional-dependencies]
# Hunter learning research only; the core install stays PyYAML.
hunt = [
    "dspy>=3.4,<3.5",
    "pandas>=2.2,<3",
    "scipy>=1.13,<2",
    "scikit-learn>=1.6,<2",
    "statsmodels>=0.14,<1",
]
# The documentation site (mkdocs.yml, docs/). Mermaid renders client-side through Material's superfences fence.
docs = [
    "mkdocs>=1.6,<2",
    "mkdocs-material>=9.5,<10",
]
# The plane's memory store on an S3-compatible bucket (OUSAST_MEMORY=s3://<bucket>, plane/memory.py; RustFS is the
# tested server). Imported lazily; the core install and the file store need nothing beyond PyYAML.
s3 = [
    "boto3>=1.35,<2",
]
# Structured parse for overlay (JS/C/C++/Java/PHP/Python). Core install stays empty.
# Wheels are MIT; import is lazy via openultrasast.semantic.extra.
semantic = [
    "tree-sitter>=0.23,<0.27",
    "tree-sitter-python>=0.23",
    "tree-sitter-javascript>=0.23",
    "tree-sitter-typescript>=0.23",
    "tree-sitter-c>=0.23",
    "tree-sitter-cpp>=0.23",
    "tree-sitter-java>=0.23",
    "tree-sitter-php>=0.23",
]

[project.scripts]
ousast = "openultrasast.cli:main"

[tool.pytest.ini_options]
testpaths = ["tests"]
pythonpath = ["src"]
markers = [
    "docker: requires a docker daemon",
    "semantic: requires openultrasast[semantic] tree-sitter extra",
    "sandbox: needs bubblewrap isolation; skipped where the isolation preflight fails (CI's container has no bwrap)",
    "ax: requires the live ax cluster of ops/ax/up.sh (skipped unless `ousast plane doctor` passes)",
]

[tool.ruff]
line-length = 140
target-version = "py311"
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
extend-exclude = ["benchmarks/fixtures", "benchmarks/pairs"]

[tool.ruff.lint]
select = ["B", "E", "F", "I", "SIM", "UP"]

[tool.mypy]
python_version = "3.11"
files = ["src/openultrasast"]
check_untyped_defs = true
disallow_untyped_defs = true
no_implicit_optional = true
warn_redundant_casts = true
warn_return_any = true
warn_unused_configs = true

[[tool.mypy.overrides]]
module = "tree_sitter"
ignore_missing_imports = true

# boto3 is an optional extra without inline types, absent in the type-check environment (plane/memory.py imports
# it lazily).
[[tool.mypy.overrides]]
module = ["boto3", "botocore.*"]
ignore_missing_imports = true

# PyYAML ships no inline types and types-PyYAML is not a dev dependency.
[[tool.mypy.overrides]]
module = "yaml"
ignore_missing_imports = true

# dspy, pandas, statsmodels and scikit-learn ship no py.typed marker and no stub packages are dev dependencies;
# numpy, pydantic and litellm arrive with them and are absent in the type-check environment of CI.
[[tool.mypy.overrides]]
module = ["dspy", "dspy.*", "pandas", "pandas.*", "statsmodels.*", "sklearn.*", "numpy", "numpy.*", "pydantic", "pydantic.*", "litellm", "litellm.*"]
ignore_missing_imports = true

# The hunt package reaches the benchmark scorers and manifests lazily. benchmarks/ is not in `files` and has never
# been type-checked; src stays strict against its signatures while errors inside benchmarks/ are not reported.
[[tool.mypy.overrides]]
module = "benchmarks.*"
follow_imports = "silent"

[dependency-groups]
dev = [
    "dagger-io>=0.21.7",
    "mypy>=2.1.0",
    "pre-commit>=4.6.0",
    "pytest>=8",
    "ruff>=0.15.17",
]