[build-system]
requires = ["setuptools>=64", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "paramify-fetchers"
version = "0.5.1"
description = "Paramify evidence fetcher framework — discover, build, run, and inspect evidence fetchers."
readme = "README.md"
requires-python = ">=3.10"
license = { text = "GPL-3.0-only" }
classifiers = [
    "License :: OSI Approved :: GNU General Public License v3 (GPLv3)",
]

# Base runtime: everything the headless `paramify` CLI and the runner need.
# The TUI is an optional front-end — install its extra to use `paramify tui`.
dependencies = [
    "python-dotenv",
    "requests",
    "pyyaml",
    "jsonschema",
    "typer>=0.12",
    "packaging",
]

[project.optional-dependencies]
# textual 8.x is what the TUI is developed and tested against (tests/test_tui_keys.py).
# The old >=1.0,<2.0 range was a fiction — nobody ran it, and focus/Input behaviour
# (select_on_focus, blurred cursor styles) differs enough that the TUI is not the
# same app on 1.x.
tui = ["textual>=8,<9"]
checkov = ["checkov"]
dev = ["pytest", "ruff", "mypy"]
# Azure category (fetchers/azure/*). Majors are pinned for the reasons spelled
# out in requirements.txt: six breaking changes across azure-mgmt majors, every
# one producing wrong or empty evidence rather than an error. Keep the two files
# in step. Deliberately NOT folded into `all` — 23 packages is heavier than
# everything else here combined, and it only matters if you run Azure fetchers.
azure = [
    "azure-identity>=1.25.3,<2",
    "azure-mgmt-subscription>=3.1.1,<4",
    "azure-mgmt-resource>=26.0.0,<27",
    "azure-mgmt-storage>=25.1.0,<26",
    "azure-mgmt-network>=31.0.1,<33",
    "azure-mgmt-security>=7.0.0,<8",
    "azure-mgmt-authorization>=4.0.0,<5",
    "msgraph-sdk>=1.61.0,<2",
    "azure-mgmt-sql>=4.0.0,<5",
    "azure-mgmt-rdbms>=10.1.1,<11",
    "azure-mgmt-postgresqlflexibleservers>=2.0.0,<3",
    "azure-mgmt-cosmosdb>=10.0.0,<11",
    "azure-mgmt-compute>=38.2.0,<39",
    "azure-mgmt-containerservice>=41.5.0,<42",
    "azure-mgmt-containerregistry>=15.0.0,<16",
    "azure-mgmt-keyvault>=14.0.1,<15",
    "azure-keyvault-keys>=4.11.1,<5",
    # <7 is load-bearing: 7.0.0 ships no diagnostic_settings operations at all.
    "azure-mgmt-monitor>=6.0.2,<7",
    "azure-mgmt-recoveryservices>=4.1.0,<5",
    "azure-mgmt-recoveryservicesbackup>=10.0.0,<12",
    "azure-mgmt-web>=11.0.1,<12",
    "azure-mgmt-databricks>=3.0.0,<4",
    # Exact: PolicyClient's new home publishes only pre-releases.
    "azure-mgmt-resource-policy==1.0.0b4",
]
# GCP category (fetchers/gcp/*). Auth is Application Default Credentials, so
# google-auth arrives transitively and there is no key file to install. Majors
# are left open, unlike Azure: the google-cloud-* clients have not moved evidence
# fields under us the way azure-mgmt did. Cloud SQL Admin and Cloud DNS have no
# stable GAPIC client and go through google-api-python-client. Keep in step with
# requirements.txt. Out of `all` for the same reason as Azure — twelve clients
# only matter if you run GCP fetchers.
gcp = [
    "google-cloud-compute",
    "google-cloud-storage",
    "google-api-python-client",
    "google-cloud-container",
    "google-cloud-resource-manager",
    "google-cloud-iam",
    "google-cloud-logging",
    "google-cloud-monitoring",
    "google-cloud-bigquery",
    # Distribution is hyphenated; the import is `google.cloud.secretmanager`.
    "google-cloud-secret-manager",
    "google-cloud-kms",
    "google-cloud-api-keys",
]
# Convenience: every front-end + dev tooling in one install.
all = ["textual>=8,<9", "checkov", "pytest", "ruff", "mypy"]

# The single entry point. `paramify` steers every front-end: the headless
# commands, plus `paramify tui`. (Renaming later is a one-line change here; add
# a second line to register an alias.)
[project.scripts]
paramify = "framework.cli:app"

# Supported install is editable/source: `pip install -e .` in the clone. Only
# the importable `framework` package's .py modules are shipped here. The data
# files (framework/schemas/*.json, framework/tui/styles/*.tcss) are NOT
# packaged: schemas resolve via the cwd-discovered repo root, while the TUI
# stylesheet is read relative to its own module file — both present in an
# editable/source tree. A pure built wheel therefore can't serve the TUI
# (missing data files) or run fetchers (they execute as subprocesses out of
# fetchers/, never shipped). If a non-editable wheel is ever needed, add
# [tool.setuptools.package-data] for those dirs.
[tool.setuptools.packages.find]
where = ["."]
include = ["framework*"]

# pytest: scope collection to the framework test suite. Per-fetcher tests/ dirs
# (e.g. the _template scaffold) are placeholders with no settled convention yet;
# without testpaths a bare `pytest` walks the whole tree and aborts at collection
# on duplicate test_fetcher.py basenames. importlib import-mode additionally makes
# duplicate basenames safe if a path outside tests/ is ever collected explicitly.
[tool.pytest.ini_options]
testpaths = ["tests"]
addopts = "--import-mode=importlib"

# Lint + import order for the framework's OWN code. Ported v0.x fetchers under
# fetchers/ are held to the schema contract (tests/test_contracts.py), not lint
# rules (CLAUDE.md); CI runs `ruff check framework/` so only that tree is gated.
[tool.ruff]
target-version = "py310"
extend-exclude = ["fetchers", ".venv"]

[tool.ruff.lint]
# Default lint set (pyflakes F + the E4/E7/E9 pycodestyle slice) plus import
# sorting (I). `ruff format` is intentionally NOT gated yet (would churn ~25
# files) — adopt as a separate pass.
select = ["E4", "E7", "E9", "F", "I"]

# Static typing gate for the core framework. The TUI subclasses textual's App and
# reads attributes mypy can't see on the base class — it needs its own typing
# pass, so it's suppressed here rather than gating CI. Third-party libs ship no
# stubs, hence ignore_missing_imports.
[tool.mypy]
python_version = "3.10"
ignore_missing_imports = true

[[tool.mypy.overrides]]
module = "framework.tui.*"
ignore_errors = true