flowapy 0.4.0__tar.gz → 0.4.2__tar.gz

flowapy-0.4.2/.github/CODEOWNERS

@@ -0,0 +1,11 @@
+# Code review ownership for flowa.
+#
+# GitHub requests a review from the matching owner on every PR that touches
+# these paths — including Dependabot's. This replaces Dependabot's `reviewers:`
+# option, which GitHub retired in 2025 (it now silently ignores that key);
+# CODEOWNERS is the supported mechanism for auto-requesting reviewers.
+#
+# `main` requires only the `lint` status check (no required code-owner
+# approval), so this only *requests* review — it never blocks the auto-merge of
+# routine Dependabot bumps (dependabot-auto-merge.yml).
+* @lgruen-vcgs

{flowapy-0.4.0 → flowapy-0.4.2}/.github/dependabot.yml

@@ -12,8 +12,14 @@
 #   (`min-release-age=7d` in pnpm's global config, `exclude-newer = "7 days"`
 #   in each uv project). Without it Dependabot would happily open PRs that CI
 #   then rejects because the new version is too fresh.
-# - The reviewer assignment notifies @lgruen-vcgs on each PR; the weekly
-#   cadence keeps the inbox manageable.
+# - Review requests come from .github/CODEOWNERS. Dependabot's `reviewers:`
+#   option was retired by GitHub in 2025 (it is now silently ignored), so the
+#   code owner is what gets a review request on each PR. The weekly cadence
+#   keeps the inbox manageable.
+# - No explicit `labels:` — Dependabot applies its defaults (`dependencies`
+#   plus the `python:uv` / `javascript:npm` ecosystem label, which it
+#   auto-creates). Naming a label here that Dependabot does not auto-create
+#   makes it error whenever that label is missing from the repo.
 
 version: 2
 
@@ -26,15 +32,29 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
-    reviewers:
-      - "lgruen-vcgs"
-    labels:
-      - "dependencies"
-      - "npm"
     commit-message:
       prefix: "deps"
     cooldown:
       default-days: 7
+    # Hold the published UI peer deps on their current majors. @flowajs/react-
+    # viewer declares @mantine/* and react / react-dom as peer dependencies
+    # (^8 / ^18); downstream consumers of the published package are on those
+    # majors (Mantine 8 / React 18). A major bump here drags the peer range
+    # ahead of those consumers and forces them through a breaking upgrade, so
+    # block majors for the @mantine/* family and the react stack until they
+    # migrate in lockstep. Minor/patch within 8.x / 18.x still flow (the
+    # npm-non-major group below).
+    ignore:
+      - dependency-name: "@mantine/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-dom"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/react-dom"
+        update-types: ["version-update:semver-major"]
     groups:
       npm-non-major:
         patterns:
@@ -49,11 +69,6 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
-    reviewers:
-      - "lgruen-vcgs"
-    labels:
-      - "dependencies"
-      - "python"
     commit-message:
       prefix: "deps"
     cooldown:
@@ -73,11 +88,6 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
-    reviewers:
-      - "lgruen-vcgs"
-    labels:
-      - "dependencies"
-      - "python"
     commit-message:
       prefix: "deps"
     cooldown:

{flowapy-0.4.0 → flowapy-0.4.2}/.github/workflows/release-chat-service.yaml

@@ -75,8 +75,34 @@ jobs:
         working-directory: packages/chat-service
         run: pnpm pack --dry-run
 
+      # `npm publish --provenance` occasionally exits non-zero with a spurious
+      # `E401 … Failed to generate Web Auth URLs` from its post-publish web-auth
+      # step *after* the registry has already accepted the tarball + provenance.
+      # Verify the registry state on failure and treat a present version as
+      # success — this also makes a re-run over an already-published version pass.
       - name: Publish
         working-directory: packages/chat-service
-        run: npm publish --provenance --access=public
         env:
           NPM_CONFIG_PROVENANCE: true
+        run: |
+          name=$(node -p "require('./package.json').name")
+          version=$(node -p "require('./package.json').version")
+          set +e
+          npm publish --provenance --access=public
+          code=$?
+          set -e
+          if [ "$code" -eq 0 ]; then
+            echo "Published $name@$version."
+            exit 0
+          fi
+          echo "npm publish exited $code; verifying whether $name@$version reached the registry."
+          for attempt in 1 2 3; do
+            if npm view "$name@$version" version >/dev/null 2>&1; then
+              echo "$name@$version is present on the registry; treating as published."
+              exit 0
+            fi
+            echo "Not visible yet (attempt $attempt/3); waiting for registry propagation."
+            sleep 10
+          done
+          echo "Publish failed: $name@$version is not on the registry."
+          exit "$code"

{flowapy-0.4.0 → flowapy-0.4.2}/.github/workflows/release-flowapy.yaml

@@ -92,3 +92,7 @@ jobs:
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+        # Treat an already-present version as success so a re-run (e.g. after a
+        # transient registry error) doesn't fail on "file already exists".
+        with:
+          skip-existing: true

{flowapy-0.4.0 → flowapy-0.4.2}/.github/workflows/release-react-viewer.yaml

@@ -72,8 +72,34 @@ jobs:
         working-directory: packages/react-viewer
         run: pnpm pack --dry-run
 
+      # `npm publish --provenance` occasionally exits non-zero with a spurious
+      # `E401 … Failed to generate Web Auth URLs` from its post-publish web-auth
+      # step *after* the registry has already accepted the tarball + provenance.
+      # Verify the registry state on failure and treat a present version as
+      # success — this also makes a re-run over an already-published version pass.
       - name: Publish
         working-directory: packages/react-viewer
-        run: npm publish --provenance --access=public
         env:
           NPM_CONFIG_PROVENANCE: true
+        run: |
+          name=$(node -p "require('./package.json').name")
+          version=$(node -p "require('./package.json').version")
+          set +e
+          npm publish --provenance --access=public
+          code=$?
+          set -e
+          if [ "$code" -eq 0 ]; then
+            echo "Published $name@$version."
+            exit 0
+          fi
+          echo "npm publish exited $code; verifying whether $name@$version reached the registry."
+          for attempt in 1 2 3; do
+            if npm view "$name@$version" version >/dev/null 2>&1; then
+              echo "$name@$version is present on the registry; treating as published."
+              exit 0
+            fi
+            echo "Not visible yet (attempt $attempt/3); waiting for registry propagation."
+            sleep 10
+          done
+          echo "Publish failed: $name@$version is not on the registry."
+          exit "$code"

{flowapy-0.4.0 → flowapy-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowapy
-Version: 0.4.0
+Version: 0.4.2
 Summary: Variant literature assessment pipeline with AI extraction
 Project-URL: Homepage, https://github.com/populationgenomics/flowa
 Project-URL: Source, https://github.com/populationgenomics/flowa
@@ -37,27 +37,27 @@ Requires-Python: ==3.13.*
 Requires-Dist: anchorite>=0.5.1
 Requires-Dist: boto3
 Requires-Dist: defusedxml
-Requires-Dist: fsspec
-Requires-Dist: gcsfs
+Requires-Dist: fsspec>=2026.4.0
+Requires-Dist: gcsfs>=2026.4.0
 Requires-Dist: httpx
 Requires-Dist: jinja2
 Requires-Dist: logfire
 Requires-Dist: markitdown[docx,xls,xlsx]>=0.1.5
 Requires-Dist: pydantic-settings
 Requires-Dist: pypdf
-Requires-Dist: s3fs
+Requires-Dist: s3fs>=2026.4.0
 Requires-Dist: socksio>=1.0.0
 Requires-Dist: tenacity
 Requires-Dist: typer
 Requires-Dist: zstandard
 Provides-Extra: anthropic
-Requires-Dist: pydantic-ai-slim[anthropic]==1.101.0; extra == 'anthropic'
+Requires-Dist: pydantic-ai-slim[anthropic]<2,>=1.101.0; extra == 'anthropic'
 Provides-Extra: bedrock
-Requires-Dist: pydantic-ai-slim[bedrock]==1.101.0; extra == 'bedrock'
+Requires-Dist: pydantic-ai-slim[bedrock]<2,>=1.101.0; extra == 'bedrock'
 Provides-Extra: google
-Requires-Dist: pydantic-ai-slim[google]==1.101.0; extra == 'google'
+Requires-Dist: pydantic-ai-slim[google]<2,>=1.101.0; extra == 'google'
 Provides-Extra: openai
-Requires-Dist: pydantic-ai-slim[openai]==1.101.0; extra == 'openai'
+Requires-Dist: pydantic-ai-slim[openai]<2,>=1.101.0; extra == 'openai'
 Description-Content-Type: text/markdown
 
 # Flowa

{flowapy-0.4.0 → flowapy-0.4.2}/examples/demo/package.json

@@ -19,46 +19,46 @@
     "build": "next build"
   },
   "dependencies": {
-    "@ai-sdk/amazon-bedrock": "4.0.105",
-    "@ai-sdk/anthropic": "3.0.77",
-    "@ai-sdk/google": "3.0.73",
-    "@ai-sdk/google-vertex": "4.0.128",
-    "@ai-sdk/openai": "3.0.63",
-    "@ai-sdk/react": "3.0.184",
-    "@aws-sdk/client-s3": "3.1046.0",
-    "@aws-sdk/credential-providers": "3.1046.0",
+    "@ai-sdk/amazon-bedrock": "4.0.110",
+    "@ai-sdk/anthropic": "3.0.80",
+    "@ai-sdk/google": "3.0.80",
+    "@ai-sdk/google-vertex": "4.0.139",
+    "@ai-sdk/openai": "3.0.66",
+    "@ai-sdk/react": "3.0.193",
+    "@aws-sdk/client-s3": "3.1055.0",
+    "@aws-sdk/credential-providers": "3.1055.0",
     "@flowajs/chat-service": "workspace:*",
     "@flowajs/prompts": "workspace:*",
     "@flowajs/react-viewer": "workspace:*",
-    "@hono/node-server": "1.19.14",
+    "@hono/node-server": "2.0.4",
     "@mantine/core": "8.3.18",
     "@mantine/hooks": "8.3.18",
     "@tabler/icons-react": "3.44.0",
-    "ai": "6.0.182",
+    "ai": "6.0.191",
     "formidable": "3.5.4",
     "next": "16.2.6",
-    "react": "18.2.0",
-    "react-dom": "18.2.0",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
     "zod": "4.4.3",
-    "zustand": "4.5.6"
+    "zustand": "5.0.14"
   },
   "devDependencies": {
     "@testing-library/dom": "10.4.1",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",
     "@types/formidable": "3.5.1",
-    "@types/node": "24.12.2",
+    "@types/node": "25.9.1",
     "@types/react": "18.3.18",
     "@types/react-dom": "18.3.5",
     "autoprefixer": "10.5.0",
-    "concurrently": "9.2.1",
+    "concurrently": "10.0.0",
     "happy-dom": "20.9.0",
-    "pdfjs-dist": "4.8.69",
-    "postcss": "8.5.14",
+    "pdfjs-dist": "5.7.284",
+    "postcss": "8.5.15",
     "tailwindcss": "3.4.17",
-    "tsx": "4.22.0",
+    "tsx": "4.22.3",
     "typescript": "5.7.3",
-    "vite": "8.0.13",
-    "vitest": "4.1.6"
+    "vite": "8.0.14",
+    "vitest": "4.1.7"
   }
 }

{flowapy-0.4.0 → flowapy-0.4.2}/examples/demo/src/components/literature/LiteratureView.tsx

@@ -23,7 +23,7 @@ import type { LatestRunInfo } from "@/lib/runs";
 import type { ProgressResponse } from "@/lib/progressEvents";
 import { PaperStatusGroup } from "./PaperStatusGroup";
 import { ProgressLog } from "./ProgressLog";
-import { matchFiles } from "./matchFilename";
+import { matchFilesToPapers } from "@flowajs/react-viewer";
 
 const POLL_INTERVAL_ACTIVE_MS = 15_000;
 const POLL_INTERVAL_TERMINAL_MS = 60_000;
@@ -226,21 +226,30 @@ export function LiteratureView({ variantId }: LiteratureViewProps) {
   const handleBulkUpload = useCallback(
     async (files: File[]) => {
       if (!papersResp) return;
-      const matched = matchFiles(files, papersResp.papers);
-      const accepted = matched.filter((m) => m.paper !== null);
-      const skipped = matched.filter((m) => m.paper === null);
-      for (const { paper, file } of accepted) {
-        if (!paper) continue;
-        await uploadPaperPdf(paper, file);
+      const filesByName = new Map(files.map((f) => [f.name, f]));
+      const { mains, supplements, unmatched } = matchFilesToPapers(
+        files.map((f) => f.name),
+        papersResp.papers,
+      );
+      // Mains first: a supplement's POST requires the paper's main.pdf to exist.
+      for (const { filename, paper } of mains) {
+        const file = filesByName.get(filename);
+        if (file) await uploadPaperPdf(paper, file);
+      }
+      // Then supplements, in the lexicographic order the matcher returned, so
+      // their ingestion ordinals follow filename order.
+      for (const { filename, paper } of supplements) {
+        const file = filesByName.get(filename);
+        if (file) await uploadPaperSupplement(paper, file, variantId);
       }
       await fetchPapers();
-      if (skipped.length > 0) {
+      if (unmatched.length > 0) {
         setError(
-          `Could not match ${skipped.length} file(s) by PMID or encoded DOI: ${skipped.map((s) => s.file.name).join(", ")}`,
+          `Could not match ${unmatched.length} file(s) by PMID or encoded DOI: ${unmatched.join(", ")}`,
         );
       }
     },
-    [papersResp, fetchPapers],
+    [papersResp, fetchPapers, variantId],
   );
 
   const handleOpenAllUrls = useCallback(() => {
@@ -482,13 +491,14 @@ function BulkDropzone({ onFiles }: BulkDropzoneProps) {
     >
       <Group justify="space-between" align="center">
         <Text size="sm">
-          Drop PDFs here (named <code>&lt;PMID&gt;.pdf</code> or{" "}
-          <code>&lt;encoded-DOI&gt;.pdf</code>) to bulk-upload.
+          Drop papers (<code>&lt;PMID&gt;.pdf</code> or{" "}
+          <code>&lt;encoded-DOI&gt;.pdf</code>) and supplements (
+          <code>&lt;id&gt;_supp.*</code>) here to bulk-upload.
         </Text>
         <input
           ref={inputRef}
           type="file"
-          accept="application/pdf"
+          accept=".pdf,.xlsx,.xls,.docx"
           multiple
           style={{ display: "none" }}
           data-testid="bulk-dropzone-input"

{flowapy-0.4.0 → flowapy-0.4.2}/examples/demo-gateway/pyproject.toml

@@ -17,16 +17,10 @@ dependencies = [
 # Match the polyglot supply-chain posture of the parent flowa repo: only
 # install package versions ≥ 7 days old.
 exclude-newer = "7 days"
-# Bypass the gate for anchorite — flowa pulls it as a base dep and we need
-# to consume newly-cut versions immediately. seq-smith comes along because
-# new anchorite releases pin it tightly. pydantic-ai-slim is bypassed
-# temporarily so we can pick up 1.101.0's Bedrock native-output and adaptive-
-# thinking fixes ahead of the 7-day age threshold; the exact pin lives in
-# flowa's pyproject.toml. pydantic-graph rides along because pydantic-ai-slim
-# pins it via upstream equality. Drop these two entries (in lockstep with the
-# parent flowa pyproject) once 1.101.0 ages past 7 days on PyPI (around
-# 2026-05-29).
-exclude-newer-package = { anchorite = "0 days", seq-smith = "0 days", pydantic-ai-slim = "0 days", pydantic-graph = "0 days" }
+# Bypass the gate only for the first-party packages flowa pulls in and needs
+# fresh: anchorite (a base dep) and seq-smith, which new anchorite releases pin
+# tightly. Third-party packages always observe the 7-day floor.
+exclude-newer-package = { anchorite = "0 days", seq-smith = "0 days" }
 
 [tool.uv.sources]
 # flowapy (the PyPI distribution name; import is still `flowa`) lives one