pyproject.toml

[tool.poetry]
name = "fortifyroot-ocelle"
version = "1.0.1"
description = "FortifyRoot Ocelle SDK for LLM observability"
authors = ["FortifyRoot <sdk@fortifyroot.com>"]
license = "Apache-2.0"
readme = "README.md"
repository = "https://github.com/FortifyRoot/ocelle-py"
documentation = "https://docs.fortifyroot.com"
keywords = ["ocelle", "llm", "genai", "observability", "tracing", "opentelemetry", "langchain", "openai", "anthropic"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Topic :: System :: Monitoring",
]
include = [
    { path = "README.md", format = "sdist" },
    { path = "CHANGELOG.md", format = "sdist" },
    { path = "LICENSE", format = "sdist" },
]
packages = [
    { include = "fortifyroot", from = "src" },
    { include = "ocelle", from = "src" },
]

# =============================================================================
# PRODUCTION DEPENDENCIES
# =============================================================================
# These dependencies are merged from all vendored OpenLLMetry packages.
# When upgrading the vendored version, run: ./scripts/vendor.sh <path-to-fork>
# The vendor script writes VENDOR_DEPENDENCIES.json as an informational
# reference manifest, but pyproject.toml is the authoritative dependency source
# for the published SDK package. Manually reconcile after re-vendoring.
#
# IMPORTANT: We DO NOT vendor the core OpenTelemetry packages.
# We only vendor:
#   - traceloop-sdk
#   - opentelemetry-instrumentation-* (LLM provider instrumentations)
#   - opentelemetry-semantic-conventions-ai
#
# The core OpenTelemetry packages below come from PyPI and are NOT modified.
# =============================================================================

[tool.poetry.dependencies]
python = ">=3.10,<4"

# -------------------------------------------------------------------------
# Core OpenTelemetry (FROM PyPI - NOT vendored)
# -------------------------------------------------------------------------
opentelemetry-api = "^1.38.0"
opentelemetry-sdk = "^1.38.0"
opentelemetry-exporter-otlp-proto-http = "^1.38.0"
opentelemetry-exporter-otlp-proto-grpc = "^1.38.0"

# -------------------------------------------------------------------------
# OpenTelemetry Instrumentation - Base (FROM PyPI - NOT vendored)
# -------------------------------------------------------------------------
opentelemetry-instrumentation = ">=0.59b0"
opentelemetry-semantic-conventions = ">=0.59b0"

# -------------------------------------------------------------------------
# OpenTelemetry Instrumentation - Standard Libraries (FROM PyPI - NOT vendored)
# These instrument standard Python libraries and are used by traceloop-sdk
# -------------------------------------------------------------------------
opentelemetry-instrumentation-logging = ">=0.59b0"
opentelemetry-instrumentation-requests = ">=0.59b0"
opentelemetry-instrumentation-sqlalchemy = ">=0.59b0"
opentelemetry-instrumentation-urllib3 = ">=0.59b0"
opentelemetry-instrumentation-threading = ">=0.59b0"
opentelemetry-instrumentation-redis = ">=0.59b0"

# -------------------------------------------------------------------------
# Runtime utilities (FROM PyPI - required by vendored packages)
# These are direct dependencies of traceloop-sdk and instrumentations
# -------------------------------------------------------------------------
colorama = "^0.4.6"
tenacity = ">=8.2.3,<10.0"
pydantic = ">=1,<3"
jinja2 = "^3.1.5"
deprecated = "^1.2.14"
aiohttp = "^3.11.11"
httpx = ">=0.27,<1"
cuid = "^0.4"
wrapt = "^1.14.0"
# inflection is a hard import of the vendored LlamaIndex instrumentor —
# TracerWrapper's auto-load path imports it even when the customer did
# not install the ``[llamaindex]`` extra. Keeping it optional caused the
# instrumentor to silently swallow ImportError and emit NO LlamaIndex
# spans for the customer; keep it as a hard dependency while the vendored
# LlamaIndex instrumentor is auto-loaded.
# It's a 40 KB pure-Python package — cheap to always install.
inflection = ">=0.5.1,<0.6.0"

# -------------------------------------------------------------------------
# Optional instrumented libraries (installed only via extras)
# e.g. pip install fortifyroot-ocelle[openai]  or  fortifyroot-ocelle[bedrock]
# NOT installed by default.  Each maps to a [tool.poetry.extras] group.
# Hard runtime deps of specific instrumentations (e.g. tokenizers for
# bedrock) are also declared here. NOTE: if an instrumentor's module-
# import always fires from the SDK's auto-load path (like inflection
# for llamaindex), declare the dep above as a TOP-LEVEL hard dep — not
# optional — so customers don't need to remember to install an extra.
# -------------------------------------------------------------------------
pandas = {version = ">=1.0.0", optional = true}
anthropic = {version = ">=0.49,<1.0.0", optional = true}
boto3 = {version = ">=1.34.120,<2", optional = true}
google-genai = {version = ">=1.0.0,<2", optional = true}
langchain = {version = ">=0.2.5,<2.0.0", optional = true}
langchain-openai = {version = ">=0.1.15,<2.0.0", optional = true}
litellm = {version = ">=1.71.2,<2,!=1.82.7,!=1.82.8", optional = true}
llama-index = {version = ">=0.14.12,<0.15.0", optional = true}
openai = {version = ">=1.31.1,<3", optional = true}
tokenizers = {version = ">=0.13.0", optional = true}

# -------------------------------------------------------------------------
# ReDoS-safe regex engine for safety rule evaluation
# -------------------------------------------------------------------------
google-re2 = ">=1.1"

# =============================================================================
# DEVELOPMENT DEPENDENCIES
# =============================================================================

[tool.poetry.group.dev.dependencies]
autopep8 = "^2.2.0"
flake8 = "7.0.0"
pytest = "^8.2.2"
pytest-sugar = "1.0.0"
pytest-cov = "^4.0.0"
pytest-asyncio = "^0.23.7"
mypy = "^1.18.2"
types-requests = "^2.31.0"
types-colorama = "^0.4.15"
black = ">=23.0.0"
isort = ">=5.12.0"
ruff = ">=0.1.0"

# =============================================================================
# TEST DEPENDENCIES
# =============================================================================

[tool.poetry.group.test.dependencies]
# Testing infrastructure
vcrpy = ">=7.0.0,<9"
pytest-recording = "^0.13.1"
pandas = ">=1.0.0"
# Instrumented libraries — all declared so tests run or fail, never silently skip.
# Versions reconciled with VENDOR_DEPENDENCIES.json (sourced from fork
# pyproject.toml files) and the MVP SDK extras below.
anthropic = ">=0.49,<1.0.0"
boto3 = ">=1.34.120,<2"
google-genai = ">=1.0.0,<2"
inflection = ">=0.5.1,<0.6.0"
langchain = ">=0.2.5,<2.0.0"
langchain-core = ">=0.2.0"
langchain-openai = ">=0.1.15,<2.0.0"
litellm = ">=1.71.2,<2,!=1.82.7,!=1.82.8"
llama-index = ">=0.14.12,<0.15.0"
openai = ">=1.31.1,<3"
tokenizers = ">=0.13.0"

# =============================================================================
# OPTIONAL EXTRAS
# =============================================================================

[tool.poetry.extras]
datasets = ["pandas"]
# Per-instrumentation extras — install via e.g. pip install fortifyroot-ocelle[openai,anthropic]
anthropic = ["anthropic"]
bedrock = ["boto3", "anthropic", "tokenizers"]
google-generativeai = ["google-genai"]
langchain = ["langchain", "langchain-openai"]
litellm = ["litellm"]
llamaindex = ["llama-index"]
openai = ["openai"]

# =============================================================================
# BUILD SYSTEM
# =============================================================================

[build-system]
requires = ["poetry-core>=1.0.0"]
build-backend = "poetry.core.masonry.api"

# =============================================================================
# TOOL CONFIGURATION
# =============================================================================

[tool.black]
line-length = 88
target-version = ["py310", "py311", "py312"]

[tool.isort]
profile = "black"
line_length = 88
skip = ["src/fortifyroot/_vendor"]

[tool.ruff]
line-length = 88
target-version = "py310"
exclude = ["src/fortifyroot/_vendor"]

[tool.ruff.lint]
select = ["E", "F", "W", "I", "N", "UP", "B", "C4"]
ignore = ["E501"]

[tool.mypy]
python_version = "3.10"
warn_return_any = true
warn_unused_configs = true
disallow_untyped_defs = true
exclude = ["src/fortifyroot/_vendor"]

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"
markers = [
    "vcr: tests using pytest-recording VCR cassettes",
    "default_cassette(name): override cassette path/name for a VCR test",
    "fr: FortifyRoot-authored tests (safety cassettes, instrumentation)",
]
filterwarnings = [
    "ignore::DeprecationWarning:fortifyroot._vendor.*",
    "ignore::PendingDeprecationWarning:fortifyroot._vendor.*",
    "ignore::DeprecationWarning:google.genai.*",
    # LiteLLM TPL: Pydantic v1->v2 migration debt (response.dict(), model_fields on instance)
    "ignore::UserWarning:pydantic.*",
    "ignore::DeprecationWarning:pydantic.*",
    "ignore::DeprecationWarning:litellm.*",
]

[tool.coverage.run]
branch = true
source = ["src/fortifyroot", "src/ocelle"]
omit = ["src/fortifyroot/_vendor/*"]

[tool.coverage.report]
exclude_lines = [
    "pragma: no cover",
    "if TYPE_CHECKING:",
    "raise NotImplementedError",
]
show_missing = true