pyproject.toml

[project]
name = "become"
version = "1.0.0b1"
description = "Python implementation of the BeCoMe group decision-making method"
authors = [{ name = "Ekaterina Kuzmina" }]
license = { text = "PolyForm-Noncommercial-1.0.0" }
readme = "README.md"
requires-python = ">=3.13"

dependencies = [
    "pydantic==2.14.1",
]

[project.optional-dependencies]
dev = [
    "pytest==9.1.1",
    "pytest-asyncio==1.4.0",
    "pytest-cov==7.1.0",
    "pytest-postgresql==9.1.1",
    "pytest-xdist==3.8.0",
    "hypothesis==6.170.1",
    "ruff==0.17.1",
    "mypy==2.4.0",
    "pip-audit==2.10.1",
    "bandit[toml]==1.9.4",
    "detect-secrets==1.5.0",
    "pre-commit==4.7.0",
    "pip==26.2.1",
    "types-passlib==1.7.7.20260211",
    "boto3-stubs[s3]==1.43.114",
    "mutmut==3.8.0",
    "locust==2.46.7",
    "fakeredis==2.40.0",
]
viz = [
    "numpy==2.5.4",
    "pandas==3.0.6",
    "matplotlib==3.11.2",
    "plotly==7.1.0",
    "seaborn==0.13.2",
    "openpyxl==3.1.5",
    "graphviz==0.21",
]
notebook = [
    "jupyter==1.1.1",
    "ipykernel==7.4.0",
    "ipywidgets==8.1.9",
    "notebook==7.6.3",
]
docs = [
    "mkdocs==1.6.1",
    "mkdocs-material==9.7.7",
    # Ships with mkdocs-material, pinned here because the snippets extension is what
    # pulls the per-directory READMEs onto the site instead of copying them, and because
    # `scripts/docs/toc.py` imports its slug function to get the same anchors the site
    # and GitHub use.
    "pymdown-extensions==12.3",
    # Arrives with mkdocs anyway. Named because that same script imports it directly,
    # and an undeclared import is one dependency bump away from a puzzling failure.
    "markdown==3.11.1",
]
api = [
    "fastapi==0.143.3",
    "uvicorn[standard]==0.54.0",
    "pydantic-settings==2.16.0",
    "httpx==0.28.1",
    "sqlmodel==0.0.44",
    "alembic==1.20.0",
    "psycopg2==2.9.13",
    # Lowercase on purpose: Dependabot's uv updater matches names case-sensitively.
    "pyjwt==2.15.1",
    "passlib[bcrypt]==1.7.4",
    "python-multipart==0.0.32",
    "email-validator==2.3.0",
    "boto3==1.43.114",
    "slowapi==0.1.10",
    "bleach==6.4.0",
    "pillow==13.0.0",
    "sentry-sdk[fastapi]==2.72.0",
    "logtail-python==0.5.1",
    "reportlab==5.0.1",
    "redis==8.1.0",
    "dnspython==2.9.0",
]
assistant = [
    # Newest mutually compatible releases, audited with pip-audit: the agent stack
    # (langchain, langgraph, langsmith, openai) on 2026-09-29, the rest on 2026-09-23.
    # pgvector is intentionally absent: langchain-postgres 0.0.18 requires pgvector<0.4 and pulls it
    # in transitively; our code never imports it directly.
    # Keep this order: each package comes after the packages it depends on. Dependabot
    # bumps a group one package at a time in the order listed here, so a package listed
    # before its dependency is tried against the old pin and the whole run fails.
    "langsmith==0.14.11",
    "langchain-core==1.6.12",
    "langchain-text-splitters==1.1.3",
    "openai==3.34.0",
    "langchain-openai==1.7.2",
    "psycopg[binary]==3.3.6",
    "langchain-postgres==0.0.19",
    "langgraph==1.2.16",
    "langchain==1.4.6",
    "pypdf==6.21.2",  # security fixes
    "pylatexenc==2.11",
    # langchain_core.embeddings.fake wraps its own `import numpy as np` in
    # contextlib.suppress(ImportError), so DeterministicFakeEmbedding - which the
    # dense-search test uses - raises NameError at call time without
    # this, not an ImportError at import time. Same pin already used by the viz extra.
    "numpy==2.5.4",
    "rank-bm25==0.2.2",
]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src"]

[tool.ruff]
line-length = 100
target-version = "py313"
exclude = [".venv", "venv", "__pycache__"]

[tool.ruff.lint]
select = [
    "E",      # pycodestyle errors
    "W",      # pycodestyle warnings
    "F",      # pyflakes
    "I",      # isort
    "N",      # pep8-naming
    "UP",     # pyupgrade
    "B",      # flake8-bugbear
    "S",      # flake8-bandit (security)
    "SIM",    # flake8-simplify
    "RUF",    # ruff-specific rules
]
ignore = [
    "E501",     # line too long (handled by formatter)
    "RUF022",   # `__all__` is not sorted
    "N999",     # invalid module name (BeCoMe has capitals)
    "E402",     # module level import not at top of cell
    "B008",     # function call in default argument (FastAPI Depends pattern)
]

[tool.ruff.lint.per-file-ignores]
# Tests intentionally use assert, hardcoded test credentials, and non-crypto randomness.
"tests/**" = ["S101", "S105", "S106", "S311"]

[tool.ruff.format]
quote-style = "double"
indent-style = "space"

[tool.bandit]
# bandit is the authoritative security gate in CI; ruff "S" gives fast local feedback.
# Tests and autogenerated migrations are excluded (assert and test creds are expected there).
exclude_dirs = ["tests", "migrations", ".venv"]

[tool.mypy]
python_version = "3.13"
strict = true
show_error_codes = true
exclude = [
    "examples/visualizations/",
    "migrations/",
]

[[tool.mypy.overrides]]
module = "tests.*"
disallow_untyped_defs = false

[[tool.mypy.overrides]]
module = "reportlab.*"
ignore_missing_imports = true

[[tool.mypy.overrides]]
module = "pylatexenc.*"
ignore_missing_imports = true

[[tool.mypy.overrides]]
module = "rank_bm25.*"
ignore_missing_imports = true

[tool.pytest.ini_options]
# Unit before integration, and the two named rather than the "tests" root. Both
# matter: xdist hands tests to workers in collection order, and putting the heavy
# integration tests first costs about half again as long: 72s against 48s for the
# same 1727 tests on eight workers. Naming the root walks the directories
# alphabetically, which puts integration first, so `pytest tests/` pays that.
testpaths = ["tests/unit", "tests/integration"]
# `logical` rather than `auto`: for `auto`, xdist asks psutil for *physical* cores,
# and the CI runner is a hyperthreaded VM, four logical cores over two physical,
# so `auto` resolved to 2 and ran the suite on half the machine. This Mac has no
# SMT, where the two counts agree, so the switch changes nothing locally and
# doubles the workers in CI. To pick a different number on one machine, set
# PYTEST_XDIST_AUTO_NUM_WORKERS: xdist reads it before it ever reaches psutil.
addopts = ["-v", "-n", "logical", "--cov=src", "--cov=api"]
asyncio_mode = "strict"
markers = [
    "e2e: end-to-end tests requiring running server and PostgreSQL",
]
filterwarnings = [
    # SQLite in-memory database cleanup during GC is uncontrollable
    # Warning may come from inspect module when analyzing sqlite objects
    "ignore:unclosed database:ResourceWarning",
]

[tool.coverage.run]
# Out of the repository root: the root is the first thing a newcomer reads, and a
# machine-written data file competes there with the files that actually explain the
# project. coverage.py creates the parent directory itself, verified 02.09.
data_file = ".cache/coverage/.coverage"

[tool.mutmut]
paths_to_mutate = "src/"
runner = "python -m pytest -x -q --assert=plain -c /dev/null tests/unit/models tests/unit/calculators tests/unit/interpreters tests/integration/test_excel_reference.py tests/integration/test_data_loading.py"