From bb9010cd40308ddeafe51cf390c05d170aaadd72 Mon Sep 17 00:00:00 2001 From: Jer Miller Date: Mon, 27 Jul 2026 22:46:56 -0600 Subject: [PATCH] chore(packaging): collapse thin base dependencies Move cryptography, pyOpenSSL, argon2-cffi, and websockets out of the base project dependencies and into the journal-host extra now that the caller-side Python link CLI is gone. pip install solstone no longer carries the compiled crypto/TLS/WebSocket stack for the thin base surface. Keep THIN_BASE in lockstep and add the import-family blockers as import names: cryptography, OpenSSL, argon2, and websockets. Regenerate uv.lock so the committed package metadata matches the dependency move. Co-Authored-By: Claude Opus 5 (1M context) --- pyproject.toml | 21 +++++++++++++-------- scripts/check_access_imports_clean.py | 7 +++++++ scripts/check_extras_consistency.py | 4 ---- uv.lock | 16 ++++++++-------- 4 files changed, 28 insertions(+), 20 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index ca6a8f277..d9fa025e8 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -41,14 +41,6 @@ dependencies = [ "setproctitle", "typer", "requests", - # Link tunnel client (`sol link serve`/`join`, think/link/): TLS 1.3 in - # memory-BIO mode over an opaque WebSocket; pyOpenSSL supplies the - # handshake-time verify callback that stdlib ssl can't express. - "cryptography>=42,<47", - "pyOpenSSL>=24.0", - # argon2id for the journal-mark work factor (think/link/mark.py). - "argon2-cffi", - "websockets>=13.0", "psutil", "userpath>=1.9.2,<2", "solstone-core==1.0.17; sys_platform == 'linux' and platform_machine == 'x86_64'", @@ -99,6 +91,19 @@ journal-host = [ "solstone-journal-models==1.0.0", "python-dotenv", "pyhpke==0.6.4", + # Private-link host/runtime helpers: local CA, CSR/cert handling, secure + # listener pairing, and PL transfer. Public `sol link` caller commands are + # native. + "cryptography>=42,<47", + # Host/shared private-link TLS memory-BIO support. Public caller CLI is + # native; Python keeps the home-side and test/runtime TLS helpers. + "pyOpenSSL>=24.0", + # Journal mark derivation (`solstone/think/link/mark.py`) remains + # host/shared, not thin access. + "argon2-cffi", + # SPL relay/browser-pairing and PL tunnel runtime. Native `sol link` owns + # caller CLI dispatch. + "websockets>=13.0", "Flask[async]", "Markdown", "mistune", diff --git a/scripts/check_access_imports_clean.py b/scripts/check_access_imports_clean.py index 6ac1ed95f..1b3a6faba 100644 --- a/scripts/check_access_imports_clean.py +++ b/scripts/check_access_imports_clean.py @@ -31,6 +31,10 @@ BLOCKED_FAMILIES = ( "av", "pypdfium2", "frontmatter", + "cryptography", + "OpenSSL", + "argon2", + "websockets", ) try: @@ -80,6 +84,9 @@ NATIVE_CASES: tuple[tuple[str, list[str]], ...] = ( ("sol status", ["sol", "status"]), ("sol chat --help", ["sol", "chat", "--help"]), ("sol import --help", ["sol", "import", "--help"]), + ("sol link --help", ["sol", "link", "--help"]), + ("sol link join --help", ["sol", "link", "join", "--help"]), + ("sol link serve --help", ["sol", "link", "serve", "--help"]), ("sol notify --help", ["sol", "notify", "--help"]), ("sol call --help", ["sol", "call", "--help"]), ("sol call activities --help", ["sol", "call", "activities", "--help"]), diff --git a/scripts/check_extras_consistency.py b/scripts/check_extras_consistency.py index 3382fed32..b0fe6589e 100755 --- a/scripts/check_extras_consistency.py +++ b/scripts/check_extras_consistency.py @@ -62,10 +62,6 @@ THIN_BASE = { "setproctitle", "typer", "requests", - "cryptography>=42,<47", - "pyOpenSSL>=24.0", - "argon2-cffi", - "websockets>=13.0", "psutil", "userpath>=1.9.2,<2", } diff --git a/uv.lock b/uv.lock index 8ff8bc5d3..35ae1fbfb 100644 --- a/uv.lock +++ b/uv.lock @@ -4249,22 +4249,20 @@ name = "solstone" version = "1.0.17" source = { editable = "." } dependencies = [ - { name = "argon2-cffi" }, - { name = "cryptography" }, { name = "psutil" }, - { name = "pyopenssl" }, { name = "requests" }, { name = "setproctitle" }, { name = "solstone-core", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "typer" }, { name = "userpath" }, - { name = "websockets" }, ] [package.optional-dependencies] journal-host = [ + { name = "argon2-cffi" }, { name = "av" }, { name = "blessed" }, + { name = "cryptography" }, { name = "flask", extra = ["async"] }, { name = "genai-prices" }, { name = "h2" }, @@ -4292,6 +4290,7 @@ journal-host = [ { name = "packaging" }, { name = "pillow" }, { name = "pyhpke" }, + { name = "pyopenssl" }, { name = "pypdfium2" }, { name = "python-dotenv" }, { name = "python-frontmatter" }, @@ -4303,6 +4302,7 @@ journal-host = [ { name = "tokenizers" }, { name = "tzlocal" }, { name = "weasyprint" }, + { name = "websockets" }, ] pdf = [ { name = "pillow" }, @@ -4340,10 +4340,10 @@ journal-cuda = [ [package.metadata] requires-dist = [ - { name = "argon2-cffi" }, + { name = "argon2-cffi", marker = "extra == 'journal-host'" }, { name = "av", marker = "extra == 'journal-host'" }, { name = "blessed", marker = "extra == 'journal-host'", specifier = ">=1.20.0" }, - { name = "cryptography", specifier = ">=42,<47" }, + { name = "cryptography", marker = "extra == 'journal-host'", specifier = ">=42,<47" }, { name = "flask", extras = ["async"], marker = "extra == 'journal-host'" }, { name = "genai-prices", marker = "extra == 'journal-host'" }, { name = "h2", marker = "extra == 'journal-host'" }, @@ -4373,7 +4373,7 @@ requires-dist = [ { name = "pillow", marker = "extra == 'pdf-import'", specifier = ">=11.0.0" }, { name = "psutil" }, { name = "pyhpke", marker = "extra == 'journal-host'", specifier = "==0.6.4" }, - { name = "pyopenssl", specifier = ">=24.0" }, + { name = "pyopenssl", marker = "extra == 'journal-host'", specifier = ">=24.0" }, { name = "pypdfium2", marker = "extra == 'pdf-import'", specifier = ">=5.11,<6" }, { name = "python-dotenv", marker = "extra == 'journal-host'" }, { name = "python-frontmatter", marker = "extra == 'journal-host'" }, @@ -4398,7 +4398,7 @@ requires-dist = [ { name = "tzlocal", marker = "extra == 'journal-host'" }, { name = "userpath", specifier = ">=1.9.2,<2" }, { name = "weasyprint", marker = "extra == 'pdf-export'", specifier = ">=60.0" }, - { name = "websockets", specifier = ">=13.0" }, + { name = "websockets", marker = "extra == 'journal-host'", specifier = ">=13.0" }, ] provides-extras = ["pdf-import", "pdf-export", "pdf", "journal-host", "journal", "journal-cuda"] -- 2.51.2