brainkit/pyproject.toml at main · joedanz/brainkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
[project]
name = "brainkit"
version = "0.9.2"
description = "Multi-tenant company brain on Obsidian-compatible vaults — each person's copy holds only the notes they may read"
readme = "README.md"
requires-python = ">=3.12"
license = "MIT"
license-files = ["LICENSE"]
authors = [{ name = "Joe Danziger", email = "joe@ticc.net" }]
keywords = [
  "obsidian",
  "knowledge-base",
  "markdown",
  "vault",
  "mcp",
  "multi-tenant",
  "permissions",
  "second-brain",
]
# No "License ::" classifier: `license` above is a PEP 639 SPDX expression, and
# PyPI rejects an upload that carries both. No "Typing :: Typed" either — that
# classifier promises PEP 561 inline types, which requires a py.typed marker
# this package does not ship.
classifiers = [
  "Development Status :: 3 - Alpha",
  "Environment :: Console",
  "Intended Audience :: Developers",
  "Intended Audience :: System Administrators",
  "Operating System :: MacOS",
  "Operating System :: POSIX :: Linux",
  "Programming Language :: Python :: 3 :: Only",
  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Programming Language :: Python :: 3.14",
  "Topic :: Office/Business :: Groupware",
  "Topic :: Text Processing :: Markup :: Markdown",
]
# aiohttp floor is a security bound: 3.14.1 fixes compressed request bodies
# bypassing client_max_size (CVE-2026-54278), which the webhook receiver's
# body-size cap depends on.
dependencies = ["pyyaml>=6.0", "sqlite-vec>=0.1.9", "aiohttp>=3.14.3"]

# These become the sidebar on the PyPI project page, which is the only
# navigation someone arriving from `pip install` gets.
[project.urls]
Homepage = "https://github.com/joedanz/brainkit"
Documentation = "https://brainkit-docs.vercel.app"
Changelog = "https://github.com/joedanz/brainkit/blob/main/CHANGELOG.md"
Issues = "https://github.com/joedanz/brainkit/issues"
Source = "https://github.com/joedanz/brainkit"

[project.optional-dependencies]
dev = ["pytest>=8.0", "pytest-aiohttp>=1.0", "pyjwt[crypto]>=2.10.1"]
# Remote MCP (`brain mcp --http`, `brain mcp-router`): verifies the signed
# identity assertion an edge such as Cloudflare Access adds to each request.
remote = ["pyjwt[crypto]>=2.10.1"]

[project.scripts]
brain = "brain.cli:main"

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src/brain"]
# Vendored JS/CSS and the HTML shell are data files under the package; list them
# explicitly so they land in the wheel even though they are not .py modules.
artifacts = ["src/brain/assets/**"]

# An allowlist, not a deny list. Hatchling reads only the ROOT .gitignore, so
# docs/.gitignore's entries do not reach it — without this the sdist was 133 MB
# and 24,990 files (a whole npm tree, a built docs site, and the local .claude/
# worktrees). /docs is enumerated by source path rather than wholesale for the
# same reason: the docs site is a Node app, and its toolchain drops build trees
# there under names we don't get to predict (node_modules/, dist/, .vercel/,
# .vite/). Naming what belongs fails closed on all of them, present and future.
[tool.hatch.build.targets.sdist]
include = [
  "/src",
  "/tests",
  "/docs/*.mdx",
  "/docs/concepts",
  "/docs/guides",
  "/docs/reference",
  "/docs/explainers",
  "/docs/docs.json",
  "/docs/package.json",
  "/docs/package-lock.json",
  "/docs/vite.config.ts",
  "/docs/README.md",
  "/deploy",
  "/scripts/demo/seed.sh",
  "/README.md",
  "/SECURITY.md",
  "/CHANGELOG.md",
  "/CONTRIBUTING.md",
  "/CODE_OF_CONDUCT.md",
  "/LICENSE",
  "/pyproject.toml",
  "/uv.lock",
]

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"