pyproject.toml

[build-system]
requires = ["setuptools>=65.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "sigmax"
version = "0.2.0-alpha"  # Synced with __version__.py
description = "SIGMAX - Research Software for AI Trading System Prototyping (Educational Use Only)"
authors = [
    {name = "SIGMAX Contributors"}
]
license = {text = "MIT"}
readme = "README.md"
requires-python = ">=3.10"
keywords = ["trading", "crypto", "research", "educational", "ai", "quantum", "multi-agent", "prototype"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "Intended Audience :: Education",
    "Intended Audience :: Science/Research",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3.11",
    "Topic :: Education",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
    "Topic :: Software Development :: Libraries :: Python Modules",
]

dependencies = [
    # Core async & networking
    "asyncio",
    "aiohttp>=3.13.3",  # Security: CVE-2025-69223 (zip bomb), CVE-2025-69224, CVE-2025-69225
    "uvloop>=0.19.0",

    # Web framework
    "fastapi>=0.115.0",
    "uvicorn[standard]>=0.32.0",
    "pydantic>=2.10.0",
    "httpx>=0.27.0",
    "httpx-sse>=0.4.0",
    "urllib3>=2.6.3",  # Security: CVE-2026-21441 (decompression bomb bypass)

    # LangChain ecosystem (required for agents)
    "langchain-core>=0.3.81",  # Security: CVE-2025-68664 (serialization injection)
    "langchain-ollama>=0.2.0",
    "langchain-openai>=0.2.0",
    "langchain-anthropic>=0.3.0",
    "langchain-groq>=0.2.0",

    # Trading & exchanges
    "ccxt>=4.4.0",
    "freqtrade>=2024.1",

    # AI & ML
    "gymnasium>=0.29.0",
    "qiskit>=1.3.0",
    "qiskit-aer>=0.15.0",
    "crewai>=0.86.0",

    # Databases & caching
    "psycopg2-binary>=2.9.0",
    "clickhouse-connect>=0.8.0",
    "redis>=5.2.0",
    "sqlalchemy>=2.0.0",

    # Message queue
    "pyzmq>=26.0.0",

    # Monitoring & observability
    "prometheus-client>=0.21.0",

    # Data processing
    "numpy>=2.2.0",
    "pandas>=2.2.0",

    # Config & serialization
    "pyyaml>=6.0",
    "orjson>=3.10.0",

    # Security constraints for transitive dependencies
    "pypdf>=6.4.0",  # Security: CVE-2025-55197, CVE-2025-66019
]

[project.optional-dependencies]
dev = [
    "pytest>=9.0.3",
    "pytest-asyncio>=0.24.0",
    "pytest-cov>=6.0.0",
    "pytest-mock>=3.14.0",
    "black>=24.10.0",
    "ruff>=0.8.0",
    "mypy>=1.13.0",
    "isort>=5.13.0",
    "pre-commit>=4.0.0",
    "bandit>=1.8.0",
]
cli = [
    "typer>=0.12.0",
    "rich>=13.7.0",
    "prompt_toolkit>=3.0.43",
    "httpx>=0.27.0",
    "httpx-sse>=0.4.0",
]

[project.urls]
Homepage = "https://github.com/I-Onlabs/SIGMAX"
Documentation = "https://github.com/I-Onlabs/SIGMAX/tree/main/docs"
Repository = "https://github.com/I-Onlabs/SIGMAX"
"Bug Tracker" = "https://github.com/I-Onlabs/SIGMAX/issues"

[project.scripts]
# CLI entry point
sigmax = "core.cli.main:app"

# Application entry points
sigmax-ingest = "apps.ingest_cex.main:main"
sigmax-book = "apps.book_shard.main:main"
sigmax-features = "apps.features.main:main"
sigmax-decision = "apps.decision.main:main"
sigmax-risk = "apps.risk.main:main"
sigmax-router = "apps.router.main:main"
sigmax-exec = "apps.exec_cex.main:main"
sigmax-obs = "apps.obs.main:main"
sigmax-replay = "apps.replay.main:main"

[tool.setuptools]
packages = ["pkg", "apps", "core"]

[tool.setuptools.package-data]
"*" = ["*.yaml", "*.yml", "*.json", "*.sql"]

[tool.black]
line-length = 100
target-version = ['py311']
include = '\.pyi?$'
extend-exclude = '''
/(
  # directories
  \.eggs
  | \.git
  | \.hg
  | \.mypy_cache
  | \.tox
  | \.venv
  | build
  | dist
)/
'''

[tool.isort]
profile = "black"
line_length = 100
multi_line_output = 3
include_trailing_comma = true
force_grid_wrap = 0
use_parentheses = true
ensure_newline_before_comments = true

[tool.pytest.ini_options]
minversion = "7.0"
testpaths = ["tests"]
python_files = ["test_*.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
addopts = [
    "-v",
    "--strict-markers",
    "--tb=short",
    "--cov=core",
    "--cov=pkg",
    "--cov=apps",
    "--cov=ui",
    "--cov-report=term-missing",
    "--cov-report=html",
]
markers = [
    "unit: Unit tests",
    "integration: Integration tests",
    "soak: Long-running soak tests",
    "slow: Slow tests",
]
asyncio_mode = "auto"

[tool.mypy]
python_version = "3.11"
warn_return_any = true
warn_unused_configs = true
disallow_untyped_defs = false
disallow_incomplete_defs = false
check_untyped_defs = true
no_implicit_optional = true
warn_redundant_casts = true
warn_unused_ignores = true
warn_no_return = true
strict_equality = true

[[tool.mypy.overrides]]
module = [
    "ccxt.*",
    "zmq.*",
    "clickhouse_connect.*",
    "prometheus_client.*",
    "orjson.*",
]
ignore_missing_imports = true

[tool.bandit]
exclude_dirs = ["tests", "test_*.py"]
skips = ["B101", "B601"]  # assert_used, paramiko_calls

[tool.coverage.run]
source = ["core", "pkg", "apps", "ui"]
omit = [
    "*/tests/*",
    "*/test_*.py",
    "*/__pycache__/*",
    "*/site-packages/*",
]

[tool.coverage.report]
precision = 2
show_missing = true
skip_covered = false
exclude_lines = [
    "pragma: no cover",
    "def __repr__",
    "raise AssertionError",
    "raise NotImplementedError",
    "if __name__ == .__main__.:",
    "if TYPE_CHECKING:",
    "class .*\\bProtocol\\):",
    "@(abc\\.)?abstractmethod",
]

[tool.coverage.html]
directory = "htmlcov"