pyproject.toml

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "async-trading-engine"
version = "1.0.0"
description = "Async algorithmic trading engine for IG spread betting, driven by a time-series foundation model"
license = { file = "LICENSE" }
authors = [{ name = "protereus" }]
requires-python = ">=3.12"
dependencies = [
    "pydantic>=2.0",
    "pydantic-settings>=2.14.2",  # >=2.14.2 clears GHSA-4xgf-cpjx-pc3j (secrets_dir symlink read)
    "python-dotenv",
    "aiohttp",
    "orjson",
    "lightstreamer-client-lib>=2.2.2",
    # Kronos / TopK runtime deps
    "torch>=2.0.0",
    "einops>=0.8.0",
    "safetensors>=0.4.0",
    "huggingface_hub>=0.33.0",
    # Lower bound matches the dev-group pin so dev and prod resolve the same
    # numpy major (2.x); uv.lock already resolves 2.4.4 everywhere.
    "numpy>=2.4.4",
    "pandas>=2.0.0",
    "defusedxml>=0.7.1",
    # Imported directly by bot.strategy._kronos_progress (progress-bar shim);
    # otherwise only transitively present via huggingface_hub/torch.
    "tqdm>=4.66.0",
]

[project.optional-dependencies]
dev = [
    "pytest",
    "pytest-asyncio",
    "mypy",
    "ruff",
]
webgui = [
    "fastapi>=0.110",
    "uvicorn>=0.27",
    "jinja2>=3.1",
]
finbert = [
    # Local ProsusAI/finbert via ONNX runtime — opt-in only (CPU contends
    # with Kronos).  Run `uv sync --extra finbert` to install.
    #
    # transformers is capped below the GHSA-fgcw-684q-jj6r (CVE-2026-5241)
    # fix version (5.5.0) because optimum-onnx 0.1.0 — the only released
    # version providing the ONNX runtime backend this module uses — pins
    # transformers<4.58.0 and has no newer release yet. Not exploitable
    # here regardless: the vulnerable path is LightGlue model loading with
    # attacker-controlled trust_remote_code; this module only ever calls
    # AutoTokenizer/ORTModelForSequenceClassification.from_pretrained on
    # the hardcoded _MODEL_ID ("ProsusAI/finbert"), never a caller-supplied
    # repo, and never sets trust_remote_code. Revisit when optimum-onnx
    # ships a transformers>=5.5 compatible release.
    "transformers>=4.40,<4.58.0",
    "optimum[onnxruntime]>=1.20",
]

[[tool.uv.index]]
name = "pytorch-cpu"
url = "https://download.pytorch.org/whl/cpu"
explicit = true

[tool.uv.sources]
torch = [{ index = "pytorch-cpu" }]

# Floor for a transitive dep we don't depend on directly but that carries
# a patched CVE (Dependabot #51): setuptools comes in via torch.
[tool.uv]
constraint-dependencies = [
    "setuptools>=83.0.0",  # GHSA-h35f-9h28-mq5c (sdist MANIFEST.in bypass)
]

[tool.hatch.build.targets.wheel]
packages = ["src/bot"]

[tool.ruff]
target-version = "py312"
line-length = 100
exclude = []

[tool.ruff.lint]
select = ["E", "F", "I", "UP", "B", "SIM", "ASYNC"]

[tool.mypy]
strict = true
python_version = "3.12"
mypy_path = "src"

# Third-party packages with no PEP-561 stubs and no usable types-* package
# on PyPI. Check for an installable stub package before adding anything here.
[[tool.mypy.overrides]]
module = [
    "lightstreamer",
    "lightstreamer.*",
    "model",
    "model.*",
    "optimum",
    "optimum.*",
    "transformers",
    "transformers.*",
]
ignore_missing_imports = true
disable_error_code = ["import-untyped", "import-not-found"]

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
# Chaos scenarios hit a live IG demo session through a fault-injection proxy;
# they are opt-in only. An explicit `-m chaos` overrides this default.
addopts = '-m "not chaos"'
markers = [
    "preflight: pre-go-live validation gate. Run with `uv run pytest -m preflight` to exercise the live-readiness checks as a single deterministic pass.",
    "chaos: live streaming fault-injection suite (toxiproxy + IG demo). Run with `uv run pytest -m chaos` — see docs/CHAOS_TESTING.md.",
]

[dependency-groups]
dev = [
    "pytest",
    "pytest-asyncio",
    "mypy",
    "ruff",
    # PEP-561 stub packages for runtime deps (bump alongside the package).
    "types-defusedxml",
    "pandas-stubs",
    "types-tqdm",
]