pyproject.toml

[project]
name = "foretop-lading"
version = "0.4.0"
description = "Traces licence obligations across code dependencies and model weights as one dependency graph — resolves each artifact's licence via Hugging Face / PyPI and prints a flat, honest table (unknown rather than guessed)."
readme = "README.md"
requires-python = ">=3.12"
license = "Apache-2.0"
license-files = ["LICENSE"]
dependencies = [
    "typer>=0.15",
    "rich>=13.9",
    "httpx>=0.28",
    # licences.py/model_overrides.py/obligations.py's LicenceEntry/ModelOverride/Obligation —
    # a real gap found this session: Session 22 used pydantic directly without ever declaring
    # it here, and it only worked by accident because `uv run` from the repo root shares one
    # workspace-wide venv that other apps (ebb, dispatcher) happen to pull pydantic into. A
    # standalone install of foretop-lading alone would have failed with ModuleNotFoundError.
    "pydantic>=2.9",
    # licences.py/model_overrides.py/policy.py's yaml.safe_load — same real, undeclared-until-
    # now gap as pydantic above.
    "pyyaml>=6.0",
    # keel.collect.walk's own real dependency (gitignore matching) — added here since it's
    # vendored as a sibling package below rather than depended on as foretop-keel.
    "pathspec>=0.12",
    # hf_cache.py's scan_cache_dir() — the official, battle-tested parser for the real
    # ~/.cache/huggingface/hub layout (no-namespace repos, non-symlink mode, xet/ chunk
    # dirs). Added this session (Session 23) with explicit approval — see apps/lading/
    # README.md's Slice 3a section.
    "huggingface_hub>=1.28",
]

[project.scripts]
lading = "lading.__main__:app"
# uv's `uvx <name>` runs the entry point matching the distribution name by default (no `--from`
# needed) — same reasoning as every other app's own pyproject.toml (telltale's own action.yml
# would have silently failed to resolve `uvx foretop-telltale` without this second entry point),
# so this one is added from day one instead of discovered later by building a wheel.
foretop-lading = "lading.__main__:app"

[dependency-groups]
dev = [
    "pytest>=8.3",
    "mypy>=2.3.0",
    "ruff>=0.16.2",
    "types-pyyaml>=6.0",
]

# No [tool.uv.sources]/foretop-keel here, unlike the monorepo's own copy of this file — this is
# the mirror-specific pyproject.toml (scripts/sync-mirror.sh copies this file instead of
# apps/lading/pyproject.toml). keel.collect.walk is vendored as a real sibling package at
# src/keel/ instead (see the sync script's own comment for why: no published foretop-keel PyPI
# package exists yet). module-name as a list is real, supported uv_build syntax for a project
# whose wheel contains more than one top-level package — verified live against uv's own
# build-backend docs this session, not guessed.
[tool.uv.build-backend]
module-name = ["lading", "keel"]

[build-system]
requires = ["uv_build>=0.11.32,<0.12.0"]
build-backend = "uv_build"

[tool.ruff]
line-length = 100
target-version = "py312"
extend-exclude = ["tests/fixtures", "tests/golden"]

[tool.ruff.lint]
select = ["E", "F", "I", "N", "UP", "B", "A", "C4", "SIM", "TCH", "RUF"]

[tool.ruff.lint.isort]
# keel is vendored as a sibling package under src/ (same root as lading itself), which ruff's
# own isort would otherwise auto-detect as first-party regardless of known-first-party — an
# explicit known-third-party pin keeps it grouped as third-party, matching the import order the
# vendored files already have as copied verbatim from the monorepo (where keel genuinely is a
# third-party workspace dependency). Without this, ruff would demand a reorder the sync script
# doesn't perform.
known-third-party = ["keel"]
known-first-party = ["lading"]

[tool.mypy]
strict = true
python_version = "3.12"

[tool.pytest.ini_options]
# R12: excludes test_the_real_public_apis_are_reachable_and_shaped_as_expected (a real network
# call to huggingface.co/pypi.org) from the public mirror's own CI — a third party's uptime
# must never fail an unrelated release build.
addopts = '-ra -m "not live_network"'
markers = ["live_network: makes a real network call to a third-party API; excluded by default"]