pyproject.toml

[project]
name = "veridex"
version = "0.0.0"
description = "Veridex — TxLINE Agent Proof Arena"
requires-python = ">=3.11"
dependencies = ["pydantic>=2", "pydantic-settings>=2"]

# WD-3: the standalone agent ships as an installable console script (Dockerfile.agent pip-installs it).
[project.scripts]
veridex-agent = "veridex_agent.cli:main"

[build-system]
requires = ["setuptools>=61"]
build-backend = "setuptools.build_meta"

[tool.setuptools.packages.find]
include = ["veridex*", "veridex_agent*"]

[project.optional-dependencies]
# Postgres persistence (PostgresStore) — lazy-imported; not needed for the offline suite.
# psycopg-pool: the AsyncConnectionPool the public entrypoint (veridex.api.server) wires into the
# store for durable pooled connections (I-5). Also lazily imported (inside the server's pool factory).
postgres = ["psycopg[binary]>=3", "psycopg-pool>=3"]
# LLM agent layer (Agno via OpenRouter, OpenAI-compatible) — lazy-imported behind a seam;
# not needed for the offline suite. openai is the client Agno's OpenRouter model uses.
# PINNED to the I-9-validated version (fu-i9-pin-agno): II-4 hosts run_market_maker inside AgentOS and
# the AC-29 deployed-surface contract is calibrated against agno==2.7.3's exact native route table, so a
# future `uv lock` must never silently drift off the reviewed surface.
# python-multipart: agno's AgentOS routes (agno/remote, agno/client) declare Form/File params, so
# FastAPI requires python-multipart at route-registration time whenever the served app composes AgentOS
# (II-5f). Undeclared by agno itself; pin a floor here so the served image can boot.
agent = ["agno==2.7.3", "openai", "python-multipart>=0.0.9"]
# Live TxLINE SSE client (B2) — async HTTP.
live = ["httpx>=0.27"]
# FastAPI serving layer (B11 demo surface) — async read + trigger endpoints over the Store.
# websockets is Uvicorn's server-side RFC 6455 protocol implementation; plain uvicorn installs no
# WebSocket backend and treats Upgrade requests as ordinary HTTP.
# Includes the Privy ES256 access-token auth boundary (POST /agents/deploy; I-1, auth-contract@1):
# `veridex.api.deploy` unconditionally imports `veridex.api.auth_privy`, which does a top-level
# `import jwt`, so PyJWT is on the API import path and MUST ship with the api extra (dec-crit-i1-003,
# amends dec-crit-i1-002). PyJWT with the crypto extra installs `cryptography` for the ECDSA/ES256
# verify path. No network/JWKS: the static SPKI/PEM public key is passed straight to
# `jwt.decode(..., algorithms=["ES256"])`.
api = ["fastapi>=0.115", "uvicorn>=0.30", "websockets>=15,<16", "pyjwt[crypto]>=2,<3"]
# Vendored Polymarket CLOB client (veridex/venues/_vendor/polymarket_clob/) — signing, HTTP,
# and orderbook deps the vendored code imports (T12/REQ-2D-201).
polymarket = [
    "py-order-utils",
    "web3",
    "eth-account",
    "poly-eip712-structs",
    "httpx>=0.27",
    "aiohttp",
    "orjson",
    "numpy",
]
# Solana anchoring (veridex/chain/anchor.py) — lazy-imported inside anchor_memo.
# Declared so `uv sync` reconstructs the anchor-test environment (was previously
# a manually-installed, undeclared dep).
chain = ["solana", "solders"]

[dependency-groups]
# pyyaml: tests/test_deploy_scaffold.py parses compose.coolify.yml (D-0, dec-d0-dep-001).
dev = ["pytest>=8,<9", "pytest-asyncio>=0.24", "ruff>=0.6", "mypy>=1.11", "pyyaml>=6"]

[tool.pytest.ini_options]
pythonpath = ["."]
testpaths = ["tests"]
addopts = "-q"
# async shell uses asyncio; auto mode lets plain `async def test_*` run without per-test markers.
asyncio_mode = "auto"
# R4-A (E0-T1): mark ONLY tests that hit a real network/venue/provider endpoint. CI excludes them via
# `-m "not live_network"`. Do NOT use a name-substring like `-k "not live"` — that silently drops offline
# trust suites (e.g. test_live_recorder_*). Registering the marker makes `-m "not live_network"` clean.
markers = [
    "live_network: test performs real network I/O to a venue/provider; operator-run only, excluded from CI",
]

[tool.ruff]
line-length = 120
target-version = "py311"
# Phase-0 live-integration SPIKE scripts (reference/evidence only, not maintained package code).
extend-exclude = ["scripts/txline_live"]

[tool.ruff.lint]
select = ["E", "W", "F", "I", "B", "C4", "UP", "SIM"]
# E501: line length enforced by the formatter.
# UP042: `class X(str, Enum)` is a deliberate, behavior-stable choice (StrEnum changes
#        __str__/serialization semantics); migration intentionally deferred.
ignore = ["E501", "UP042"]

[tool.ruff.format]
quote-style = "double"
indent-style = "space"

[tool.mypy]
python_version = "3.11"
warn_redundant_casts = true
warn_unused_ignores = true
disallow_untyped_defs = true
check_untyped_defs = true
no_implicit_optional = true

[[tool.mypy.overrides]]
module = "tests.*"
disallow_untyped_defs = false

[[tool.mypy.overrides]]
# Optional, lazily-imported deps — don't fail typing when they're absent from the base install.
module = ["agno.*", "psycopg.*"]
ignore_missing_imports = true

[[tool.mypy.overrides]]
# Vendored third-party client (veridex/venues/_vendor/polymarket_clob/) — not maintained by
# this project; our code treats its exports as Any, so don't type-gate its internals.
module = "veridex.venues._vendor.*"
ignore_errors = true