pyproject.toml

Rama main · réplica de lectura del repositorio original.

# Repository tooling, not a service. Each service in packages/ is its own uv
# project with its own uv.lock, because each ships as its own image and their
# model stacks need not agree: one shared lock forced torch, transformers and
# huggingface-hub to a single version across all three. This project holds what
# spans them: ruff, the contract generator (which needs elide-core), the
# elide-core tests, and the Rust E2E harness's dependencies.
[project]
name = "elide-runtime-tools"
version = "0.1.0"
requires-python = "==3.12.*"
dependencies = ["elide-core"]

[tool.uv]
required-version = ">=0.7"
# Never built or installed, only synced: there is no package here.
package = false
# The E2E harness image (crates/adapter/elide-bentoml/tests/support) installs
# the `e2e` group on linux/amd64 and linux/arm64. Without this, a lock written
# on macOS records only macOS wheels and that install fails its hash check.
required-environments = [
    "sys_platform == 'linux' and platform_machine == 'x86_64'",
    "sys_platform == 'linux' and platform_machine == 'aarch64'",
]
# Security floors for packages that arrive only through bentoml's server stack
# (the `e2e` group), where the bentoml floor alone does not exclude a CVE.
# Each service lock carries the same list.
constraint-dependencies = [
    "aiohttp>=3.14.0",         # CVE-2026-34993, CVE-2026-47265
    "anyio>=4.14.2",           # CVE-2026-63374, CVE-2026-64847
    "python-multipart>=0.0.31",  # CVE-2026-53540
    "setuptools>=83.0.0",      # PYSEC-2026-3447
    "soupsieve>=2.9.0",        # CVE-2026-85999, CVE-2026-86000
    "starlette>=1.3.1",        # CVE-2026-54282, CVE-2026-54283
    "tornado>=6.6",            # GHSA-pw9p-v7r6-gx4p, -r4j5-9xpp-3985, -pcg2-g6cj-q92c
    "ujson>=5.13.0",           # CVE-2026-54911
]

[tool.uv.sources]
elide-core = { path = "packages/elide-core", editable = true }

[dependency-groups]
dev = [
    "pytest>=9.1.1",
    "ruff>=0.16.3",
]
# What the Rust E2E harness needs to run the real services with fake model
# libraries: the HTTP stack and the input decoders, no model runtimes.
e2e = [
    "bentoml>=1.4.39,<2",
    "librosa>=0.11,<2",
    "numpy>=2,<3",
    "pillow>=12.3,<14",
    "prometheus-client>=0.26.0",
    "pydantic-settings>=2.12,<3",
    "uvicorn>=0.35,<1",
]

# Shared by every package: ruff reads the nearest pyproject.toml that has a
# [tool.ruff] table, and the packages declare none.
[tool.ruff]
target-version = "py312"
line-length = 100

[tool.ruff.lint]
select = ["E", "F", "I", "UP", "B", "SIM", "RUF"]

[tool.ruff.format]
docstring-code-format = true

# elide-core's tests only: each service runs its own suite in its own
# environment, configured in its own pyproject.toml.
[tool.pytest.ini_options]
testpaths = ["packages/elide-core/tests"]