pyproject.toml

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "aces-sdl"
version = "0.19.1"
description = "Backend-agnostic cyber range scenario description language and runtime."
dynamic = ["readme"]
requires-python = ">=3.11"
dependencies = [
    "typer>=0.12.0",
    "pydantic>=2.0.0",
    "rich>=13.0.0",
    "PyYAML>=6.0",
    "cryptography>=46.0.7",
    "fastapi>=0.115.0",
    "uvicorn[standard]>=0.34.0",
    "sse-starlette>=2.0.0",
    "asyncssh>=2.23.0",
    "mcp>=1.0.0",
    "packaging>=23.0",
]

[project.optional-dependencies]
dev = [
    "pytest>=9.0.3",
    "pytest-mock>=3.12.0",
    "coverage>=7.0.0",
    "httpx>=0.27.0",
    "hypothesis>=6.0.0",
]
docs = [
    "sphinx>=7.3.0",
    "furo>=2024.5.6",
    "myst-parser>=3.0.0",
    "sphinx-copybutton>=0.5.2",
    "sphinx-autobuild>=2024.4.16",
]

[project.scripts]
aces = "aces.cli.main:app"
aces-mcp = "aces_mcp.server:main"

# Version is the static `[project] version` above (#684) — the single source of
# truth, rewritten by release-please on each release. Hatchling reads it directly;
# `aces.__version__` derives from the installed distribution metadata.

# The PyPI long description (`readme`) is injected from the repo-root README.md by
# a custom metadata hook (hatch_build.py), so there is a single README source and
# no duplicate copy under implementations/python. `[project] dynamic = ["readme"]`.
[tool.hatch.metadata.hooks.custom]
path = "hatch_build.py"

[tool.hatch.build.targets.wheel]
packages = [
    "src/aces",
    "packages/aces_contracts",
    "packages/aces_backend_protocols",
    "packages/aces_backend_stubs",
    "packages/aces_backend_libvirt",
    "packages/aces_operations",
    "packages/aces_reference_backend",
    "packages/aces_cli",
    "packages/aces_conformance",
    "packages/aces_mcp",
    "packages/aces_processor",
    "packages/aces_runtime",
    "packages/aces_sdl",
]

# Ship the published contract corpus (the ADR-009 normative authority at the
# repo-root `contracts/` tree) as package data so conformance + SDL semantic
# validation work from an installed wheel. The corpus is resolved at runtime
# via `importlib.resources` in `aces_contracts.corpus`; `contracts/` stays the
# single source of truth — this is a build-time distribution copy only.
#
# A custom build hook (hatch_build.py) force-includes the corpus into the wheel
# at `aces_contracts/_corpus`, resolving it from the source checkout
# (`../../contracts`) or from the corpus vendored into the sdist below — so both
# a direct wheel build and `uv build`'s sdist→wheel path produce a wheel that
# contains the corpus. The sdist vendors the corpus at top-level `_corpus/`.
[tool.hatch.build.targets.wheel.hooks.custom]
path = "hatch_build.py"

[tool.hatch.build.targets.sdist.force-include]
"../../contracts" = "_corpus"
"../../README.md" = "README.md"

[tool.pytest.ini_options]
testpaths = ["tests"]
pythonpath = ["src", "packages", "tests"]
markers = [
    "fuzz: property-based fuzz tests (run with: pytest -m fuzz)",
    "integration: integration-style tests that read the real repo on disk (run with: pytest -m integration)",
    "docker: opt-in tests that require a real container runtime (run with: pytest -m docker / nox -s integration_docker)",
]
addopts = "-m 'not fuzz and not integration and not docker'"

[tool.coverage.run]
source = [
    "aces",
    "aces_contracts",
    "aces_backend_protocols",
    "aces_backend_stubs",
    "aces_backend_libvirt",
    "aces_operations",
    "aces_reference_backend",
    "aces_cli",
    "aces_conformance",
    "aces_mcp",
    "aces_processor",
    "aces_runtime",
    "aces_sdl",
]

[tool.coverage.report]
show_missing = true
exclude_also = [
    # The reference backend's OCI subprocess leaf (RUN-314): real container
    # IO, exercised only by the opt-in docker integration tests, never in the
    # hermetic suite.
    "def _default_runner",
]

[tool.coverage.xml]
output = "coverage.xml"

[tool.ruff]
target-version = "py311"
line-length = 120

[tool.ruff.lint]
select = [
    "E",    # pycodestyle errors
    "W",    # pycodestyle warnings
    "F",    # pyflakes
    "I",    # isort
    "UP",   # pyupgrade
    "B",    # flake8-bugbear
    "SIM",  # flake8-simplify
    "S",    # flake8-bandit (security)
]
ignore = [
    "S101",   # assert is fine in tests and dataclass contracts
    "S603",   # subprocess without shell=True is fine
    "S607",   # partial executable path is fine
    "E501",   # line length handled by formatter, not linter
    "UP042",  # (str, Enum) is the established pattern; StrEnum migration is separate
    "SIM102", # nested if merging — harms readability in complex conditionals
]

[tool.ruff.lint.per-file-ignores]
"tests/**" = ["S101", "S105", "S106", "S108", "E402", "SIM105", "F841"]
"packages/aces_cli/**" = ["B008"]      # typer requires function calls in defaults
"packages/aces_runtime/control_plane_api.py" = ["B008"]  # fastapi Depends() pattern
"packages/aces_runtime/control_plane.py" = ["S112"]      # intentional exception suppression
"packages/aces_sdl/module_registry.py" = ["S310", "S202"]  # explicit OCI URL fetch and tarball extract