pyproject.toml

[build-system]
requires = ["setuptools>=61.0"]
build-backend = "setuptools.build_meta"

[project]
name = "muxi-runtime"
dynamic = ["version"]  # Version is read from src/muxi/runtime/.version file
authors = [
  {name = "MUXI Team", email = "dev@muxi.org"},
]
description = "Production-ready runtime for building and orchestrating intelligent multi-agent AI systems"
readme = "README.md"
license = {text = "Elastic License 2.0"}
requires-python = ">=3.10"
keywords = [
    "ai", "agents", "llm", "multi-agent", "orchestration", "mcp",
    "onellm", "formation", "runtime", "framework", "chatgpt",
    "openai", "anthropic", "agent-framework", "ai-agents",
    "agent-orchestration", "llm-framework", "ai-system"
]
classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
    "Topic :: Software Development :: Libraries :: Application Frameworks",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "License :: Other/Proprietary License",
    "Operating System :: OS Independent",
    "Operating System :: POSIX :: Linux",
    "Operating System :: MacOS :: MacOS X",
    "Operating System :: Microsoft :: Windows",
    "Framework :: AsyncIO",
    "Framework :: FastAPI",
    "Typing :: Typed",
]
dependencies = [
    # Build dependencies for setup.py
    "tomli>=1.2.0;python_version<'3.11'",  # For reading pyproject.toml in setup.py

    # Core dependencies
    "orjson>=3.9.0",
    "pyyaml>=6.0",
    "pydantic>=2.0.0",
    "httpx>=0.24.0",
    "anyio>=3.7.0",
    "python-dotenv>=1.0.0",
    "websockets>=11.0.3",
    "httpx-sse>=0.4.0",
    "rich>=13.6.0",
    "colorama>=0.4.6",
    "psutil>=5.9.0",  # System and process utilities

    # MCP Package
    "mcp>=1.23.0",  # Required for Streamable HTTP transport support (security fix)
    "fastmcp>=3.2.0",  # MCP server generation from FastAPI app

    # File processing and utilities
    "aiofiles>=23.2.0",
    "python-magic>=0.4.27",

    # Document processing dependencies
    # Targeted extras only: docx/pdf/pptx/xls/xlsx covers every file format
    # MUXI's knowledge ingest actually dispatches to MarkItDown for. The
    # [all] superset additionally pulls audio-transcription, az-doc-intel,
    # outlook, and youtube-transcription extras - none of which MUXI uses
    # (audio goes through OneLLM in services/multimodal/fusion_engine.py;
    # there is no .msg / Azure-DI / YouTube ingest path). The youtube extra
    # in particular pins youtube-transcript-api~=1.0.0, whose 1.0.x line
    # declares requires_python='<3.14' and blocks Python 3.14 installs even
    # though MUXI never imports it.
    "markitdown[docx,pdf,pptx,xls,xlsx]>=0.1.0",  # Convert various file formats to Markdown
    "pypdf>=6.10.0",  # PDF document processing (successor to PyPDF2); CVE-2026-33123 fixed in 6.9.1
    "python-docx>=1.1.0",  # Word document processing
    "markdownify>=0.11.6",  # HTML to Markdown conversion
    "beautifulsoup4>=4.12.0",  # HTML parsing and validation
    "nltk>=3.8.0",  # Natural language processing for chunking
    "spacy>=3.8.0",  # Advanced NLP for semantic chunking (compatible with NumPy 2.x)

    # Image processing dependencies
    "Pillow>=12.2.0",  # PIL/Pillow for image processing
    "pdf2image>=1.16.0",  # Convert PDF pages to images (requires Poppler)

    # LLM Package
    # 0.20260502.2 persists CoreML compiled .mlmodelc artifacts under
    # $HF_HOME/onellm-coreml so the macOS knowledge ingestion path no
    # longer triggers jetsam (the prior compile-on-every-load behavior
    # spiked RSS to ~8.7 GB on Apple Silicon). 0.20260422.3 added the
    # `local-cuda` extra used by Dockerfile.cuda and completed
    # revision= plumbing for the local/<repo>:<revision> slug.
    "onellm[cache]>=0.20260502.2",
    "boto3>=1.26.0",  # AWS SDK for OneLLM Bedrock provider
    "google-cloud-aiplatform>=1.25.0",  # Google Cloud for OneLLM Vertex AI provider

    # A2A (Agent-to-Agent) Communication
    # Native 1.0 migration landed 2026-04-21; services/a2a/_sdk_helpers.py
    # centralises protobuf glue (Part/Struct/Value wrapping, MessageToDict).
    "a2a-sdk>=1.0,<2.0",  # Google's Agent-to-Agent SDK for inter-agent communication
    "protobuf>=5.29.5,<8",  # a2a-sdk 1.0 uses protobuf; MessageToDict fallbacks handle any json_format API differences


    # Server components
    "fastapi>=0.108.0",
    "uvicorn>=0.24.0",
    "starlette>=0.49.1",  # Security fix for Range header DoS

    # Vector search
    "faiss-cpu>=1.13.0",  # 1.13+ fixes numpy deprecation warning
    "faissx>=0.20260403.0",  # Distributed FAISS for remote vector operations
    "pgvector>=0.3.6",
    "numpy>=1.24.0",
    "sqlite-vec>=0.1.6",  # SQLite vector extension for similarity search

    # Database
    "psycopg2-binary>=2.9.9",
    "asyncpg>=0.29.0",  # Async PostgreSQL driver for SQLAlchemy (required for persistent memory)
    "SQLAlchemy[asyncio]>=2.0.17",
    "aiosqlite>=0.19.0",  # Async SQLite driver for SQLAlchemy (required for default persistent memory)

    # Legacy dependencies (keeping for compatibility)
    "aiohttp>=3.13.4",  # Security fixes for DoS vulnerabilities
    "click>=8.1.0",
    "openai>=1.3.0",

    # File generation dependencies (now core requirements)
    # Data processing and analysis
    "pandas>=2.0.0",
    "scipy>=1.10.0",
    "statsmodels>=0.14.0",

    # Visualization
    "matplotlib>=3.7.0",
    "seaborn>=0.12.0",
    "plotly>=5.15.0",
    "bokeh>=3.8.2",  # Security fix for WebSocket origin validation
    "altair>=5.0.0",

    # Document generation
    "reportlab>=4.0.0",
    "fpdf2>=2.7.0",

    # Spreadsheet handling
    "openpyxl>=3.1.0",
    "xlsxwriter>=3.1.0",
    "xlrd>=2.0.0",
    "xlwt>=1.3.0",

    # Image processing (Pillow already included above)
    "qrcode>=7.4.0",
    "python-barcode>=0.15.0",

    # Presentation
    "python-pptx>=0.6.21",

    # File formats
    "lxml>=4.9.0",

    # Additional dependencies found in codebase
    "cachetools>=5.3.0",  # Caching for credential resolution (TTL, LRU)
    "croniter>=1.3.0",  # Cron expression parsing for scheduler
    "cryptography>=46.0.7",  # Encryption for secrets manager
    "PyJWT>=2.12.0",  # CVE-2026-32597: accepts unknown crit headers; fixed in 2.12.0
    "pyasn1>=0.6.3",  # CVE-2026-30922: unbounded recursion DoS; fixed in 0.6.3
    "msgpack>=1.0.0",  # Message pack format for observability
    "multitasking>=0.0.13",  # Multi-threading utilities; >=0.0.13 required for set_daemon() opt-in (prevents interpreter-exit hang on long-lived @task workers)
    "nanoid>=2.0.0",  # Nano ID generation
    "pytz>=2023.3",  # Timezone support for scheduler
    "requests>=2.33.0",  # HTTP client (used in observability)
    "typing-extensions>=4.8.0",  # Backport of typing features
    "pyzmq>=25.0.0",  # ZeroMQ for observability streaming
]

[project.optional-dependencies]
kafka = [
    "kafka-python>=2.0.0",  # Kafka streaming support for observability
]

# ---------------------------------------------------------------------------
# Runtime variants
# ---------------------------------------------------------------------------
# These extras mirror the Dockerfile matrix so operators can reproduce each
# SIF's Python dependency set with a single pip install:
#
#   pip install muxi-runtime                  # default (lean, ONNX + CPU FAISS)
#   pip install 'muxi-runtime[pytorch]'       # CPU torch + sentence-transformers
#   pip install 'muxi-runtime[cuda]'          # GPU ONNX + GPU FAISS + CUDA torch
#
# Core deps (see [project.dependencies]) already carry the default variant:
# onnxruntime (via onellm[cache]), faiss-cpu, faissx. The extras layer
# variant-specific packages on top. Dockerfile.pytorch / Dockerfile.cuda
# should be viewed as thin wrappers that install these extras after the
# lean base image is built.
# ---------------------------------------------------------------------------

# PyTorch variant — adds sentence-transformers (via onellm[local-pytorch]) and
# CPU-wheel torch/torchvision. Non-conflicting with core: faiss-cpu and the
# onnxruntime CPU wheel from core still work alongside. Users who want the
# CPU torch wheel specifically (vs. the default PyPI CUDA wheel on Linux
# x86_64) should pass ``--index-url https://download.pytorch.org/whl/cpu``.
pytorch = [
    "onellm[cache,local-pytorch]>=0.20260502.2",
    "torch>=2.0.0",
    "torchvision>=0.15.0",
]

# CUDA variant — GPU stack. ⚠️ This extra CONFLICTS with the core `faiss-cpu`
# and `faissx` dependencies (both own top-level module names that clash with
# `faiss-gpu-cu12` / `faissx-gpu`). Pip will install both sides and the
# last-imported wheel wins at runtime. To install cleanly via pip, run:
#
#     pip uninstall -y faiss-cpu faissx onnxruntime
#     pip install 'muxi-runtime[cuda]'
#
# Dockerfile.cuda handles this automatically (see its Step 1 uninstall block).
# Target: Linux + x86_64 + NVIDIA + CUDA 12.x only. On macOS/Windows or hosts
# without CUDA drivers, ``faiss-gpu-cu12`` has no installable wheel and pip
# will fail with a clear ``No matching distribution`` error.
cuda = [
    "onellm[local-cuda]>=0.20260502.2",
    "faissx-gpu>=0.20260422.2",
    "torch>=2.0.0",
    "torchvision>=0.15.0",
]

dev = [
    "pytest>=9.0.3",
    "pytest-asyncio>=0.21.0",
    "pytest-cov>=4.0.0",
    "pytest-timeout>=2.3.0",  # per-test timeout so a hanging test fails fast in CI instead of consuming the 6h job budget
    "black>=26.3.1",
    "isort>=5.12.0",
    "mypy>=1.0.0",
    "ruff>=0.1.0",
    "flake8>=6.0.0",
    "pyright>=1.1.0",
]

[project.urls]
"Homepage" = "https://muxi.org"
"Documentation" = "https://muxi.org/docs"
"Source Code" = "https://github.com/muxi-ai/runtime"
"Bug Tracker" = "https://github.com/muxi-ai/runtime/issues"
"Discussions" = "https://muxi.org/community"
"Changelog" = "https://github.com/muxi-ai/runtime/blob/main/CHANGELOG.md"
"Funding" = "https://github.com/sponsors/muxi-ai"
"Download" = "https://pypi.org/project/muxi/"


[tool.setuptools.dynamic]
version = {file = "src/muxi/runtime/.version"}

[tool.setuptools.packages.find]
where = ["src"]

[tool.black]
line-length = 100
target-version = ["py310", "py311", "py312", "py313"]
include = '\.pyi?$'
exclude = '''
/(
    \.git
  | \.hg
  | \.mypy_cache
  | \.tox
  | \.venv
  | _build
  | build
  | dist
)/
'''

[tool.isort]
profile = "black"
line_length = 100
combine_as_imports = true

[tool.mypy]
python_version = "3.10"
warn_return_any = true
warn_unused_configs = true
disallow_untyped_defs = true
disallow_incomplete_defs = true
check_untyped_defs = true
disallow_untyped_decorators = true
no_implicit_optional = true
warn_redundant_casts = true
warn_unused_ignores = true
warn_no_return = true
warn_unreachable = true
strict_optional = true

[tool.ruff]
target-version = "py310"
line-length = 100
src = ["src", "tests"]
exclude = [
    ".git",
    ".venv",
    "__pycache__",
    "build",
    "dist",
    "*.egg-info",
]

[tool.ruff.lint]
select = [
    "E",      # pycodestyle errors
    "W",      # pycodestyle warnings
    "F",      # pyflakes
    "I",      # isort
    "B",      # flake8-bugbear
    "C4",     # flake8-comprehensions
]
ignore = [
    "E501",   # line too long (handled by formatter)
    "B007",   # unused loop variable (use _var convention later)
    "B008",   # function call in default argument (common in FastAPI)
    "B019",   # lru_cache on methods (known pattern in codebase)
    "B023",   # function binding loop variable (complex to fix)
    "B026",   # star-arg unpacking (existing pattern)
    "B028",   # no stacklevel in warnings (low priority)
    "B034",   # re.sub keyword args (existing pattern)
    "B904",   # raise without from (too noisy)
    "B905",   # zip without strict (python 3.10+ feature)
    "C400",   # unnecessary generator (style preference)
    "C401",   # unnecessary generator for set (style preference)
    "C403",   # list comprehension to set (style preference)
    "C414",   # unnecessary list in sorted (style preference)
    "C416",   # unnecessary comprehension (style preference)
    "C420",   # dict.fromkeys (style preference)
]

[tool.ruff.lint.isort]
known-first-party = ["muxi"]
combine-as-imports = true

[tool.ruff.format]
quote-style = "double"
indent-style = "space"
skip-magic-trailing-comma = false