pyproject.toml

[project]
name = "medgraph-multimodal"
version = "0.1.0"
description = "Clinical decision support over medical literature, patient case reports, and diagnostic imaging using a Neo4j property graph, multimodal embeddings, OpenAI, and LangGraph orchestration."
readme = "README.md"
requires-python = ">=3.11,<3.13"
license = { text = "Proprietary" }
authors = [{ name = "MedGraph Team" }]

# Runtime dependencies. Pinned with lower bounds; exact versions are frozen in
# uv.lock and installed with hash verification (see [tool.uv] below).
dependencies = [
    # --- Orchestration -----------------------------------------------------
    "langgraph>=0.2.60,<0.3",
    "langgraph-checkpoint>=2.0.9,<3",
    "langchain-core>=0.3.28,<0.4",
    # --- LLM provider ------------------------------------------------------
    "openai>=1.60.0,<2",
    # --- Graph database ----------------------------------------------------
    "neo4j>=5.26.0,<6",
    # --- Vector database ---------------------------------------------------
    "qdrant-client>=1.12.1,<2",
    # --- Multimodal embeddings ---------------------------------------------
    "open-clip-torch>=2.29.0,<3",
    "torch>=2.5.1,<3",
    "pillow>=11.0.0,<12",
    # --- Config / validation ----------------------------------------------
    "pydantic>=2.10.4,<3",
    "pydantic-settings>=2.7.0,<3",
    "python-dotenv>=1.0.1,<2",
    "structlog>=24.4.0,<25",
]

[project.optional-dependencies]
# Kept out of the default install surface so the runtime image stays lean.
imaging = [
    "pydicom>=3.0.1,<4",   # DICOM parsing for diagnostic imaging ingestion
    "numpy>=2.1.3,<3",
]
# Optional web chat UI (Streamlit). Not part of the runtime image.
#   pip install -e ".[ui]"   then   streamlit run ui/app.py
ui = [
    "streamlit>=1.40,<2",
]

[dependency-groups]
# PEP 735 groups. Installed only in dev/CI — never shipped to production.
dev = [
    "ruff>=0.8.4",
    "mypy>=1.14.0",
    "pytest>=8.3.4",
    "pytest-asyncio>=0.25.0",
    "pytest-cov>=6.0.0",
    "pip-audit>=2.7.3",     # CVE scan of the resolved lockfile
]

[project.scripts]
medgraph = "medgraph.cli:main"

# ---------------------------------------------------------------------------
# uv configuration — strict dependency isolation + no build-time code execution
# ---------------------------------------------------------------------------
[tool.uv]
package = true
managed = true

# Reproducible, verifiable resolution.
resolution = "highest"
# Note: lockfile-freshness and hash verification are CLI flags, not persisted
# [tool.uv] settings — enforce them in CI with:
#   uv sync --locked --require-hashes

# --- Disable arbitrary code execution during builds ------------------------
# Force pre-built wheels for third-party packages. Source distributions run
# `setup.py` / PEP 517 build hooks (arbitrary Python) at install time; refusing
# sdists eliminates that execution path. NOTE: a global `no-build = true` also
# blocks building THIS first-party package (it has no published wheel), which
# breaks `uv sync`. uv has no per-package allow-list, so the global switch is
# dropped; dependency wheel-pinning is still enforced by the frozen uv.lock
# (exact wheel artifacts) plus `[tool.uv.pip] only-binary = [":all:"]` below.
# In CI, run `uv sync --locked` to guarantee the pinned wheels are installed.
no-binary = false               # always prefer the prebuilt wheels

# Never let a package build in an isolated env that could pull unpinned,
# unhashed build backends. (Redundant with no-build, kept explicit as defense
# in depth in case no-build is relaxed for a single package below.)
no-build-isolation = false

# Do not honor URLs/paths embedded in dependency metadata unless we declare
# them here — blocks dependency-confusion via arbitrary index redirection.
index-strategy = "first-index"

[[tool.uv.index]]
name = "pypi"
url = "https://pypi.org/simple"
default = true

# `uv pip` interface mirrors the resolver policy above for ad-hoc installs.
[tool.uv.pip]
only-binary = [":all:"]
require-hashes = false

# ---------------------------------------------------------------------------
# Build backend (for building *this* package only)
# ---------------------------------------------------------------------------
[build-system]
requires = ["hatchling>=1.27.0"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src/medgraph"]

# ---------------------------------------------------------------------------
# Tooling
# ---------------------------------------------------------------------------
[tool.ruff]
target-version = "py311"
line-length = 100
src = ["src", "tests"]

[tool.ruff.lint]
select = ["E", "F", "I", "B", "UP", "S", "ASYNC"]  # S = flake8-bandit security lints

[tool.mypy]
python_version = "3.11"
strict = true
packages = ["medgraph"]

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"
addopts = "--cov=medgraph --cov-report=term-missing"
markers = [
    "llm: test calls a live Claude model (needs ANTHROPIC_API_KEY); the LLM-as-judge deployment gate",
    "eval: deployment-gating evaluation test",
]