pyproject.toml

[project]
name = "ledger-sync"
version = "2.17.0"
description = "Personal finance dashboard backend -- Excel import, financial analytics, multi-currency exchange rates"
authors = [{ name = "Sagar Gupta" }]
readme = "README.md"
requires-python = ">=3.13"
dependencies = [
    "sqlalchemy>=2.0.51",
    "alembic>=1.18.4",
    "pandas>=2.2.0",
    "openpyxl>=3.1.0",
    "typer>=0.21.0",
    "pydantic[email]>=2.13.0",
    "pydantic-settings>=2.2.0",
    "rich>=14.0.0",
    "fastapi>=0.138.0",
    "uvicorn[standard]>=0.49.0",
    "python-multipart>=0.0.22",
    "PyJWT>=2.12.0",
    "bcrypt>=4.0.1",
    "psycopg[binary]>=3.3.4",
    "slowapi>=0.1.10",
    "httpx>=0.28.0",
    "mangum>=0.21.0",
    "cryptography>=48.0.0",
    "boto3>=1.43.0",
]

[project.scripts]
ledger-sync = "ledger_sync.cli.main:app"

[dependency-groups]
dev = [
    "pytest>=9.1.0",
    "pytest-cov>=6.0.0",
    "ruff>=0.15.0",
    "mypy>=2.1.0",
    "pandas-stubs>=2.2.0",
    "types-openpyxl>=3.1.0",
    "pip-audit>=2.7.0",
    "pre-commit>=4.0.0",
]

[tool.uv]
package = true
# Transitive-dep CVE overrides:
#   pygments >=2.20.0      -- CVE-2026-4539
#   python-dotenv >=1.2.2  -- CVE-2026-28684
#   pillow >=12.2.0        -- CVE-2026-25990, CVE-2026-40192
#   pyasn1 >=0.6.3         -- CVE-2026-30922
#   mako >=1.3.12          -- CVE-2026-44307
#   urllib3 >=2.7.0        -- CVE-2026-44431, CVE-2026-44432
#   starlette >=1.3.1      -- CVE-2026-48710/48817/48818/54282/54283 (FastAPI allows >=0.46)
#   idna >=3.18            -- CVE-2026-45409
#   msgpack >=1.2.1        -- GHSA-6v7p-g79w-8964 (OOB read on Unpacker reuse; via cachecontrol)
constraint-dependencies = [
    "pygments>=2.20.0",
    "python-dotenv>=1.2.2",
    "pillow>=12.2.0",
    "pyasn1>=0.6.3",
    "mako>=1.3.12",
    "urllib3>=2.7.0",
    "starlette>=1.3.1",
    "idna>=3.18",
    "msgpack>=1.2.1",
]

[tool.ruff]
line-length = 100
target-version = "py313"

[tool.ruff.format]
quote-style = "double"
indent-style = "space"

[tool.ruff.lint]
select = ["E", "F", "I", "N", "W", "UP"]

[tool.ruff.lint.per-file-ignores]
# Allow asserts in tests
"tests/**/*.py" = ["S101"]
# Migration files are auto-generated
"**/migrations/**/*.py" = ["D100", "D103", "D104", "D400", "D415"]
# FastAPI dependency injection uses Depends() in defaults - this is the standard pattern
# Boolean params in Query() are also standard FastAPI patterns
# PERF401 - conditional appends in loops are more readable than list.extend alternatives
"src/ledger_sync/api/**/*.py" = ["B008", "FBT001", "FBT002", "FBT003", "PERF401"]
# CLI uses typer.Argument/Option in defaults - this is the standard pattern
"src/ledger_sync/cli/**/*.py" = ["B008", "FBT001", "FBT002", "FBT003"]
# Core module has boolean parameter in sync_engine.import_file which is intentional
# PERF401 - conditional appends in loops are more readable
"src/ledger_sync/core/sync_engine.py" = ["FBT001", "FBT002"]
"src/ledger_sync/core/analytics_engine.py" = ["PERF401"]

[tool.mypy]
python_version = "3.13"
strict = true
warn_return_any = true
warn_unused_configs = true
disallow_untyped_defs = true
plugins = ["pydantic.mypy"]

[[tool.mypy.overrides]]
module = "openpyxl.*"
ignore_missing_imports = true

[[tool.mypy.overrides]]
module = "slowapi.*"
ignore_missing_imports = true

[[tool.mypy.overrides]]
module = "boto3.*"
ignore_missing_imports = true

[[tool.mypy.overrides]]
module = "ledger_sync.db.migrations.*"
ignore_errors = true

[tool.pytest.ini_options]
testpaths = ["tests"]
python_files = ["test_*.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
addopts = "-v"

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src/ledger_sync"]