[project]
name = "ai-api"
version = "0.1.0"
description = "AI API Manager — Gateway Core (Phase 1)"
requires-python = ">=3.11"
readme = "README.md"
dependencies = [
    "litellm>=1.55,<2",
    "cryptography>=48.0.1",  # 48.0.1: rebuilt wheel patches bundled OpenSSL (GHSA-537c-gmf6-5ccf)
    "fastapi>=0.115.0",
    "uvicorn[standard]>=0.32.0",
    "sqlalchemy[asyncio]>=2.0.36",
    "alembic>=1.14.0",
    "asyncpg>=0.30.0",
    "aiosqlite>=0.20.0",
    "pydantic>=2.9.0",
    "pydantic-settings>=2.6.0",
    "httpx>=0.27.0",
    "python-ulid>=3.0.0",
    "authlib>=1.3.0",
    # joserfc: transitive via authlib; floored for CVE-2026-119283 (HIGH, DoS via
    # unbounded recipient count in JWE), fixed in 1.7.5.
    "joserfc>=1.7.5",
    "argon2-cffi>=23.1.0",
    "itsdangerous>=2.2.0",
    "email-validator>=2.2.0",
    "aiosmtplib>=3.0,<4",
    # multipart form parsing — required by FastAPI for /v1/audio/transcriptions
    # (STT) audio file upload. FastAPI's official optional dependency.
    "python-multipart>=0.0.18",
    # async WebSocket client — required to relay /v1/realtime (live transcription)
    # directly to the upstream provider's realtime WS. Already present transitively
    # via uvicorn[standard]; declared directly so it can't vanish on an upstream
    # change (Constitution Deviation: justified — direct provider WS needs a client).
    "websockets>=13.0",
]

[project.optional-dependencies]
dev = [
    "pytest>=8.3.0",
    "pytest-asyncio>=0.24.0",
    "pytest-cov>=6.0.0",
    "schemathesis>=3.39.0",
    "testcontainers[postgres]>=4.8.0",
    "ruff>=0.7.0",
    "mypy>=1.13.0",
    "pre-commit>=4.0.0",
    "respx>=0.21.0",
    "pyyaml>=6.0.0",
    "aiosmtpd>=1.4,<2",
]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src/ai_api"]

[tool.ruff]
line-length = 100
target-version = "py311"

[tool.ruff.lint]
select = ["E", "F", "W", "I", "B", "UP", "N", "S", "C4", "PIE", "SIM", "RUF"]
ignore = ["E501", "S101", "B008", "S105", "N818"]  # B008/S105/N818: FastAPI Depends + constants + domain exception names

[tool.ruff.lint.per-file-ignores]
"tests/**/*.py" = ["S105", "S106", "S107", "S603", "S607"]
"src/ai_api/services/quota_pool.py" = ["N803", "N806"]  # T, N, D are math notation
"src/ai_api/api/quota_pool.py" = ["N806", "RUF001"]  # N806: math T; RUF001: Chinese pool-config messages
"tests/unit/test_compute_rebalance.py" = ["N803", "N806", "RUF003"]
"tests/integration/test_quota_pool_rebalance.py" = ["N803"]
"tests/contract/test_catalog_api.py" = ["RUF001"]  # Chinese deprecation note contains fullwidth comma
"src/ai_api/services/notifier_email.py" = ["RUF001"]  # Chinese user-facing email body
"src/ai_api/services/notifications.py" = ["RUF001"]  # Chinese user-facing messages
"src/ai_api/api/admin_notifications.py" = ["RUF001"]  # Chinese user-facing messages
"src/ai_api/api/usage.py" = ["RUF001"]  # Chinese quarantine-reason message (fullwidth comma)
"src/ai_api/proxy/responses.py" = ["RUF001"]  # Chinese continuation-reject message (開新對話)

[tool.mypy]
python_version = "3.11"
strict = true
plugins = ["pydantic.mypy"]

[[tool.mypy.overrides]]
module = ["litellm.*", "testcontainers.*", "schemathesis.*", "authlib.*", "argon2.*", "yaml.*"]
ignore_missing_imports = true

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
markers = [
    "integration: requires Postgres and (optionally) Azure OpenAI",
    "contract: OpenAPI conformance tests",
]