ummaya 0.2.3 → 0.2.5

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ummaya"
-version = "0.2.3"
+version = "0.2.5"
 description = "Conversational multi-agent platform for Korean public APIs"
 readme = "README.md"
 license = "Apache-2.0"
@@ -52,6 +52,21 @@ dependencies = [
     # (`uv sync --frozen`) do not install dev/extras groups, so yaml MUST be
     # a core runtime dependency or those entrypoints crash at import.
     "pyyaml>=6.0.3",
+    "python-docx>=1.2.0",
+    "openpyxl>=3.1.5",
+    "python-pptx>=1.0.2",
+    "defusedxml>=0.7.1",
+    "pypdf>=6.13.3",
+    "pypdfium2>=5.9.0",
+    # spec 2802 — local-only read engine for legacy HWP inspection. Direct HWP
+    # writing remains blocked until a separate conversion/write ADR passes.
+    "unhwp>=0.5.0,<0.6",
+    # spec 2802 — pypdf uses fontTools to build embedded TrueType appearance
+    # streams for Korean AcroForm text without viewer-side regeneration.
+    "fonttools>=4.60",
+    # spec 2802 — ODF writer for bounded ODT/ODS/ODP public-form derivatives.
+    # LibreOffice layout-oracle rendering remains a separate optional bridge.
+    "odfdo>=3.22.8,<4",
 ]
 
 [project.scripts]
@@ -87,11 +102,7 @@ dev = [
     "pip-audit>=2.10.0",
     "vulture>=2.16",
     "pip-licenses>=5.0",
-    # Spec 2521 — TUI Layer 5 (asciinema cast → per-frame text snapshot).
-    # Dev-only: replays asciicast v2/v3 byte streams through a real VT-100
-    # emulator so LLM agents can grep deterministic cell-grid text frames
-    # instead of OCR'ing PNG keyframes. See AGENTS.md § TUI verification.
-    "pyte>=0.8.2",
+    "httpx2>=2.4.0",
 ]
 # spec 026 FR-C09 — Langfuse Prompt Management is an OPT-IN integration.
 # It must never be a core runtime dependency (AGENTS.md hard rule: no new
@@ -102,6 +113,9 @@ langfuse = [
 ]
 gateway = [
     "fastapi>=0.115",
+    # Security floor for the ASGI layer; keep explicit even though FastAPI
+    # pulls Starlette transitively so vulnerability audits cannot resolve lower.
+    "starlette>=1.3.1",
     "uvicorn[standard]>=0.30",
 ]
 
@@ -117,6 +131,7 @@ include = [
     "/src/ummaya",
     "/prompts",
     "/docs/plugins/security-review.md",
+    "/specs/2803-document-production-hardening/contracts/document-tools.schema.json",
     "/tests/fixtures/plugin_validation/checklist_manifest.yaml",
 ]
 
@@ -136,6 +151,9 @@ packages = ["src/ummaya"]
 # (default packages= only ships src/ummaya; without this include the
 # ummaya.plugins import fails at module load).
 "docs/plugins/security-review.md" = "ummaya/_canonical/security-review.md"
+# Bundle the document production hardening tool contract so installed wheels
+# can register model-visible document tools without depending on the source tree.
+"specs/2803-document-production-hardening/contracts/document-tools.schema.json" = "ummaya/_canonical/document-tools.schema.json"
 # Bundle the 50-item validation checklist YAML so ummaya-plugin-validate
 # CLI can find it without depending on the source-tree layout.
 "tests/fixtures/plugin_validation/checklist_manifest.yaml" = "ummaya/_canonical/checklist_manifest.yaml"
@@ -314,7 +332,7 @@ min_confidence = 80
 
 [tool.commitizen]
 name = "cz_conventional_commits"
-version = "0.2.3"
+version = "0.2.5"
 tag_format = "v$version"
 
 # PyTorch CPU-only wheel for Docker image size discipline (SC-1: ≤ 2 GB).
@@ -348,4 +366,5 @@ dev = [
     "vulture>=2.16",
     "pip-licenses>=5.0",
     "types-pyyaml>=6.0.12",
+    "reportlab>=4.5.1",
 ]