refaudit 0.1.0__tar.gz

refaudit-0.1.0/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Every change needs review from a code owner before it can reach main.
+# Branch protection enforces this; see CONTRIBUTING.md.
+*       @jeevanp03

refaudit-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -e ".[dev]"
+      # The suite is offline by design: it uses fake resolvers and never makes a
+      # network call, so CI cannot be flaked by a rate-limited upstream.
+      - run: pytest -q
+      - run: ruff check .
+      - run: mypy src --ignore-missing-imports

refaudit-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,39 @@
+name: release
+
+# Publishes to PyPI via Trusted Publishing (OIDC). There is deliberately no API
+# token stored in this repository: PyPI verifies the workflow's identity
+# directly, so there is no long-lived credential to leak or rotate.
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install build
+      - run: python -m build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi          # add required reviewers here to gate releases
+    permissions:
+      id-token: write          # required for Trusted Publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

refaudit-0.1.0/.gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+refaudit-out/
+.DS_Store

refaudit-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing
+
+`main` is protected. Nobody pushes to it directly — changes arrive by pull
+request with a review from a code owner (see `.github/CODEOWNERS`).
+
+```bash
+git checkout -b your-change
+# ...
+git push -u origin your-change
+gh pr create --fill
+```
+
+CI runs the test suite on Python 3.10–3.13 plus `ruff` and `mypy`, and must be
+green before merge.
+
+## Running the tests
+
+```bash
+pip install -e ".[dev]"
+pytest -q
+```
+
+The suite is **offline by design**: it exercises the checker through fake
+resolvers and never makes a network call. This is deliberate — the services this
+tool talks to rate-limit aggressively, and a test suite that depended on them
+would fail for reasons that have nothing to do with the change under review.
+
+If you add a resolver, add it to `AVAILABLE` in `src/refaudit/resolvers/__init__.py`
+and give it a `RateSpec` whose `rationale` cites the service's own documented
+limit. Please do not guess a rate.
+
+## The invariant to preserve
+
+**"We could not check" and "this is wrong" must never collapse into each other.**
+
+A resolver returns `Found`, `NotFound` or `Unavailable`, and only `Found` may
+produce a negative verdict. `UNVERIFIED` results are reported separately from
+findings and are never cached. If you are tempted to simplify this, read the
+tests in `tests/test_checker.py` under "the central guarantee" first — they
+exist because both failure modes happened during development.
+
+## Releasing
+
+1. Bump `version` in `pyproject.toml` and `__version__` in `src/refaudit/__init__.py`.
+2. Merge to `main`.
+3. Publish a GitHub release with a tag like `v0.1.1`.
+
+The `release` workflow builds and publishes to PyPI using Trusted Publishing.
+There is no API token in this repository; PyPI verifies the workflow's identity
+over OIDC, so there is no long-lived credential to leak.

refaudit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SHARE Lab, University of Waterloo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

refaudit-0.1.0/PKG-INFO

@@ -0,0 +1,223 @@
+Metadata-Version: 2.5
+Name: refaudit
+Version: 0.1.0
+Summary: Verify bibliography entries against Crossref, arXiv and OpenAlex before you submit.
+Project-URL: Homepage, https://github.com/uw-share-lab/refaudit
+Project-URL: Issues, https://github.com/uw-share-lab/refaudit/issues
+License: MIT
+License-File: LICENSE
+Keywords: arxiv,bibtex,citations,crossref,openalex,research-integrity
+Classifier: Intended Audience :: Science/Research
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Text Processing :: Markup :: LaTeX
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: mypy>=1.5; extra == 'dev'
+Requires-Dist: pytest>=7; extra == 'dev'
+Requires-Dist: ruff>=0.4; extra == 'dev'
+Provides-Extra: xml
+Requires-Dist: defusedxml>=0.7; extra == 'xml'
+Description-Content-Type: text/markdown
+
+# refaudit
+
+Verify the entries in a `.bib` against Crossref, arXiv and OpenAlex, and report
+the ones a human needs to look at.
+
+Written for venues that run automated checks for hallucinated or malformed
+references. The failure it is built to catch is not a missing DOI — it is a DOI
+that resolves to **a different paper than the entry claims**. That one is
+invisible when you read the reference list, because the title and authors look
+fine and only the identifier is wrong.
+
+## Install
+
+```bash
+pip install git+https://github.com/uw-share-lab/refaudit.git
+```
+
+Python 3.10+. No runtime dependencies.
+
+> PyPI publishing is wired up (Trusted Publishing, see `.github/workflows/release.yml`)
+> but no release has been cut yet, so `pip install refaudit` will not work until
+> the first tagged release. Use the command above in the meantime.
+
+## Quick start
+
+```bash
+# every entry in the file
+refaudit refs.bib --email you@uwaterloo.ca
+
+# only the entries actually cited in the paper, which is usually what you want
+refaudit refs.bib --email you@uwaterloo.ca --tex paper/sections --only-cited
+```
+
+`--email` is required. Crossref and OpenAlex give identified callers a separate,
+more reliable request pool, and it is the courtesy their documentation asks for.
+Set it once instead of typing it each time:
+
+```bash
+export REFAUDIT_EMAIL=you@uwaterloo.ca
+```
+
+Results are written to `refaudit-out/` as `reference_check.txt` (readable) and
+`reference_check.csv` (sortable), and printed to stdout.
+
+### Working from Overleaf
+
+Download the `.bib` (Menu → Download → Source, or just the file), then point
+`--tex` at the unzipped `sections/` directory so `--only-cited` can tell which
+keys actually reach the PDF:
+
+```bash
+refaudit sample-base.bib --email you@uwaterloo.ca --tex sections/ --only-cited
+```
+
+## What it reports
+
+| Verdict | Meaning |
+|---|---|
+| `TITLE_MISMATCH` | an identifier resolved to a different paper — check first |
+| `DEAD_DOI` | the DOI is not registered |
+| `AUTHOR_MISMATCH` | titles agree, first author does not |
+| `YEAR_MISMATCH` | titles agree, year is off by more than one |
+| `NOT_FOUND` | no identifier, and no title match anywhere |
+| `UNVERIFIED` | **a source was unreachable — this says nothing about the entry** |
+| `SKIPPED` | `@misc`/`@online` with no identifier; nothing to check against |
+| `OK` | resolved and consistent |
+
+Exit status is `1` if there is at least one finding, `0` if not, `2` on a usage
+error — so it drops into CI or a pre-submission script.
+
+## Options
+
+| Flag | Effect |
+|---|---|
+| `--email` | contact address sent to the APIs (or `REFAUDIT_EMAIL`). Required. |
+| `--tex PATH` | LaTeX file or directory, used to work out which keys are cited |
+| `--only-cited` | check only cited keys; requires `--tex` |
+| `--resolvers` | comma-separated subset of `crossref:doi`, `arxiv:id`, `openalex`, `crossref:title` |
+| `--out DIR` | output directory (default `refaudit-out`) |
+| `--cache PATH` / `--no-cache` | cache location, or disable it |
+| `--ttl-days N` | how long cached results stay valid (default 90) |
+| `--timeout N` | per-request timeout in seconds (default 20) |
+| `--title-match N` | similarity at or above which two titles are the same work (default 0.75) |
+| `--quiet` | suppress per-entry progress, print only the summary |
+
+A run over a few hundred references takes minutes, because it is deliberately
+paced. Successful lookups are cached, so it is safe to interrupt with Ctrl-C and
+re-run — it picks up where it stopped.
+
+## The one design rule
+
+**"We could not check" and "this is wrong" are different answers and never
+collapse into each other.**
+
+This sounds obvious and is easy to get wrong. arXiv rate-limits whole networks;
+when that happens, a naive checker either silently passes the entry (false
+comfort, the worse failure) or falls back to a title search, finds something
+loosely related, and reports a mismatch (false alarm, which trains you to ignore
+it). Both are worse than saying "I could not check this one."
+
+So every resolver returns exactly one of `Found`, `NotFound`, or `Unavailable`,
+and only `Found` can produce a negative verdict. `UNVERIFIED` results are listed
+separately from findings and are never cached, so a transient outage does not
+get baked into later runs.
+
+Relatedly, evidence is weighted by strength: a DOI that Crossref does not
+recognise is a finding, but a title search returning something different is only
+a finding when there was no identifier to go on. Otherwise every arXiv-only
+workshop paper that Crossref does not index would be flagged.
+
+## Rate limiting
+
+Each source declares the limit its own documentation specifies, next to the code
+that calls it:
+
+| Source | Rate used | Why |
+|---|---|---|
+| Crossref | 2/s, then whatever the response headers say | Crossref publishes `X-Rate-Limit-Limit` / `-Interval`; the client reads and obeys them |
+| arXiv | 1 per 3s | [arXiv's terms of use](https://info.arxiv.org/help/api/tou.html) specify exactly this |
+| OpenAlex | 3/s | [documented](https://docs.openalex.org/how-to-use-the-api/rate-limits-and-authentication) ceiling is 10/s and 100k/day; we use a third of it |
+
+A `429` is treated as instruction rather than noise: `Retry-After` is honoured,
+the token bucket is permanently halved, and after repeated refusals a circuit
+breaker stops asking that host so the rest of the run still finishes. Retries use
+exponential backoff with full jitter.
+
+`--email` is required because Crossref and OpenAlex give identified callers a
+separate, more reliable pool, and it is the courtesy their docs ask for.
+
+## Security
+
+- **HTTPS only.** Plain-`http` URLs are refused, not silently upgraded.
+- **Bounded redirects**, kept on https, so a redirect cannot downgrade transport
+  or forward the `mailto` identifier somewhere unexpected.
+- **Response size cap and per-request timeouts** on every call.
+- **XML is parsed with entity declarations refused**, blocking billion-laughs and
+  XXE. Uses `defusedxml` when installed, otherwise a hardened stdlib path; both
+  raise the same exception type so callers cannot miss one.
+- **DOIs and arXiv ids are validated against a pattern before being interpolated
+  into a request path**, so a malformed field cannot steer the URL.
+- **No credentials in code.** Optional API keys come from the environment and are
+  sent as headers, never query parameters, so they stay out of logs.
+- **No runtime dependencies.** This gets installed in a hurry near a deadline,
+  often on a machine someone else administers; that is the wrong moment to widen
+  the supply chain.
+
+## Troubleshooting
+
+**Lots of `UNVERIFIED` results.** A source refused your network. arXiv in
+particular rate-limits by IP and will 429 an entire institution or VPN
+regardless of your own pace. These are not findings — the entries were simply
+not checked. Try again later, from a different network, or lean on OpenAlex,
+which indexes arXiv identifiers too:
+
+```bash
+refaudit refs.bib --email you@uwaterloo.ca --resolvers crossref:doi,openalex
+```
+
+**A correct entry is flagged `NOT_FOUND`.** Workshop papers, theses and
+tech reports are often in no citation index. If the entry has no DOI and no
+arXiv id there is nothing to verify it against; confirm it by hand and move on.
+
+**A correct entry is flagged `TITLE_MISMATCH`.** This one is worth taking
+seriously: it means the DOI or arXiv id in your `.bib` resolves to a different
+paper. Usually the identifier was copied from the wrong row, or generated rather
+than looked up. Check the `found` line in the report against what you meant to
+cite.
+
+**Everything is `SKIPPED`.** `@misc` and `@online` entries with no identifier
+cannot be checked. That is expected for datasets, blog posts and software.
+
+## Library use
+
+```python
+from refaudit import Checker, default_resolvers, parse_file
+
+entries = parse_file("refs.bib")
+checker = Checker(default_resolvers("you@university.edu"))
+
+for result in checker.check_all(entries):
+    if result.verdict.is_finding:
+        print(result.key, result.verdict.value, result.note)
+```
+
+`Resolver` is a `Protocol`: implement `name`, `rate`, `can_handle` and `resolve`
+to add a source, and pass it to `Checker` alongside the built-ins.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest          # offline: the suite uses fake resolvers and never hits a network
+ruff check .
+mypy src
+```
+
+`main` is protected: changes go through a pull request with a code-owner review,
+and CI must pass on Python 3.10-3.13. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Licence
+
+MIT.

refaudit-0.1.0/README.md

@@ -0,0 +1,202 @@
+# refaudit
+
+Verify the entries in a `.bib` against Crossref, arXiv and OpenAlex, and report
+the ones a human needs to look at.
+
+Written for venues that run automated checks for hallucinated or malformed
+references. The failure it is built to catch is not a missing DOI — it is a DOI
+that resolves to **a different paper than the entry claims**. That one is
+invisible when you read the reference list, because the title and authors look
+fine and only the identifier is wrong.
+
+## Install
+
+```bash
+pip install git+https://github.com/uw-share-lab/refaudit.git
+```
+
+Python 3.10+. No runtime dependencies.
+
+> PyPI publishing is wired up (Trusted Publishing, see `.github/workflows/release.yml`)
+> but no release has been cut yet, so `pip install refaudit` will not work until
+> the first tagged release. Use the command above in the meantime.
+
+## Quick start
+
+```bash
+# every entry in the file
+refaudit refs.bib --email you@uwaterloo.ca
+
+# only the entries actually cited in the paper, which is usually what you want
+refaudit refs.bib --email you@uwaterloo.ca --tex paper/sections --only-cited
+```
+
+`--email` is required. Crossref and OpenAlex give identified callers a separate,
+more reliable request pool, and it is the courtesy their documentation asks for.
+Set it once instead of typing it each time:
+
+```bash
+export REFAUDIT_EMAIL=you@uwaterloo.ca
+```
+
+Results are written to `refaudit-out/` as `reference_check.txt` (readable) and
+`reference_check.csv` (sortable), and printed to stdout.
+
+### Working from Overleaf
+
+Download the `.bib` (Menu → Download → Source, or just the file), then point
+`--tex` at the unzipped `sections/` directory so `--only-cited` can tell which
+keys actually reach the PDF:
+
+```bash
+refaudit sample-base.bib --email you@uwaterloo.ca --tex sections/ --only-cited
+```
+
+## What it reports
+
+| Verdict | Meaning |
+|---|---|
+| `TITLE_MISMATCH` | an identifier resolved to a different paper — check first |
+| `DEAD_DOI` | the DOI is not registered |
+| `AUTHOR_MISMATCH` | titles agree, first author does not |
+| `YEAR_MISMATCH` | titles agree, year is off by more than one |
+| `NOT_FOUND` | no identifier, and no title match anywhere |
+| `UNVERIFIED` | **a source was unreachable — this says nothing about the entry** |
+| `SKIPPED` | `@misc`/`@online` with no identifier; nothing to check against |
+| `OK` | resolved and consistent |
+
+Exit status is `1` if there is at least one finding, `0` if not, `2` on a usage
+error — so it drops into CI or a pre-submission script.
+
+## Options
+
+| Flag | Effect |
+|---|---|
+| `--email` | contact address sent to the APIs (or `REFAUDIT_EMAIL`). Required. |
+| `--tex PATH` | LaTeX file or directory, used to work out which keys are cited |
+| `--only-cited` | check only cited keys; requires `--tex` |
+| `--resolvers` | comma-separated subset of `crossref:doi`, `arxiv:id`, `openalex`, `crossref:title` |
+| `--out DIR` | output directory (default `refaudit-out`) |
+| `--cache PATH` / `--no-cache` | cache location, or disable it |
+| `--ttl-days N` | how long cached results stay valid (default 90) |
+| `--timeout N` | per-request timeout in seconds (default 20) |
+| `--title-match N` | similarity at or above which two titles are the same work (default 0.75) |
+| `--quiet` | suppress per-entry progress, print only the summary |
+
+A run over a few hundred references takes minutes, because it is deliberately
+paced. Successful lookups are cached, so it is safe to interrupt with Ctrl-C and
+re-run — it picks up where it stopped.
+
+## The one design rule
+
+**"We could not check" and "this is wrong" are different answers and never
+collapse into each other.**
+
+This sounds obvious and is easy to get wrong. arXiv rate-limits whole networks;
+when that happens, a naive checker either silently passes the entry (false
+comfort, the worse failure) or falls back to a title search, finds something
+loosely related, and reports a mismatch (false alarm, which trains you to ignore
+it). Both are worse than saying "I could not check this one."
+
+So every resolver returns exactly one of `Found`, `NotFound`, or `Unavailable`,
+and only `Found` can produce a negative verdict. `UNVERIFIED` results are listed
+separately from findings and are never cached, so a transient outage does not
+get baked into later runs.
+
+Relatedly, evidence is weighted by strength: a DOI that Crossref does not
+recognise is a finding, but a title search returning something different is only
+a finding when there was no identifier to go on. Otherwise every arXiv-only
+workshop paper that Crossref does not index would be flagged.
+
+## Rate limiting
+
+Each source declares the limit its own documentation specifies, next to the code
+that calls it:
+
+| Source | Rate used | Why |
+|---|---|---|
+| Crossref | 2/s, then whatever the response headers say | Crossref publishes `X-Rate-Limit-Limit` / `-Interval`; the client reads and obeys them |
+| arXiv | 1 per 3s | [arXiv's terms of use](https://info.arxiv.org/help/api/tou.html) specify exactly this |
+| OpenAlex | 3/s | [documented](https://docs.openalex.org/how-to-use-the-api/rate-limits-and-authentication) ceiling is 10/s and 100k/day; we use a third of it |
+
+A `429` is treated as instruction rather than noise: `Retry-After` is honoured,
+the token bucket is permanently halved, and after repeated refusals a circuit
+breaker stops asking that host so the rest of the run still finishes. Retries use
+exponential backoff with full jitter.
+
+`--email` is required because Crossref and OpenAlex give identified callers a
+separate, more reliable pool, and it is the courtesy their docs ask for.
+
+## Security
+
+- **HTTPS only.** Plain-`http` URLs are refused, not silently upgraded.
+- **Bounded redirects**, kept on https, so a redirect cannot downgrade transport
+  or forward the `mailto` identifier somewhere unexpected.
+- **Response size cap and per-request timeouts** on every call.
+- **XML is parsed with entity declarations refused**, blocking billion-laughs and
+  XXE. Uses `defusedxml` when installed, otherwise a hardened stdlib path; both
+  raise the same exception type so callers cannot miss one.
+- **DOIs and arXiv ids are validated against a pattern before being interpolated
+  into a request path**, so a malformed field cannot steer the URL.
+- **No credentials in code.** Optional API keys come from the environment and are
+  sent as headers, never query parameters, so they stay out of logs.
+- **No runtime dependencies.** This gets installed in a hurry near a deadline,
+  often on a machine someone else administers; that is the wrong moment to widen
+  the supply chain.
+
+## Troubleshooting
+
+**Lots of `UNVERIFIED` results.** A source refused your network. arXiv in
+particular rate-limits by IP and will 429 an entire institution or VPN
+regardless of your own pace. These are not findings — the entries were simply
+not checked. Try again later, from a different network, or lean on OpenAlex,
+which indexes arXiv identifiers too:
+
+```bash
+refaudit refs.bib --email you@uwaterloo.ca --resolvers crossref:doi,openalex
+```
+
+**A correct entry is flagged `NOT_FOUND`.** Workshop papers, theses and
+tech reports are often in no citation index. If the entry has no DOI and no
+arXiv id there is nothing to verify it against; confirm it by hand and move on.
+
+**A correct entry is flagged `TITLE_MISMATCH`.** This one is worth taking
+seriously: it means the DOI or arXiv id in your `.bib` resolves to a different
+paper. Usually the identifier was copied from the wrong row, or generated rather
+than looked up. Check the `found` line in the report against what you meant to
+cite.
+
+**Everything is `SKIPPED`.** `@misc` and `@online` entries with no identifier
+cannot be checked. That is expected for datasets, blog posts and software.
+
+## Library use
+
+```python
+from refaudit import Checker, default_resolvers, parse_file
+
+entries = parse_file("refs.bib")
+checker = Checker(default_resolvers("you@university.edu"))
+
+for result in checker.check_all(entries):
+    if result.verdict.is_finding:
+        print(result.key, result.verdict.value, result.note)
+```
+
+`Resolver` is a `Protocol`: implement `name`, `rate`, `can_handle` and `resolve`
+to add a source, and pass it to `Checker` alongside the built-ins.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest          # offline: the suite uses fake resolvers and never hits a network
+ruff check .
+mypy src
+```
+
+`main` is protected: changes go through a pull request with a code-owner review,
+and CI must pass on Python 3.10-3.13. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Licence
+
+MIT.

refaudit-0.1.0/pyproject.toml

@@ -0,0 +1,48 @@
+[build-system]
+requires = ["hatchling>=1.20"]
+build-backend = "hatchling.build"
+
+[project]
+name = "refaudit"
+version = "0.1.0"
+description = "Verify bibliography entries against Crossref, arXiv and OpenAlex before you submit."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+keywords = ["bibtex", "citations", "crossref", "openalex", "arxiv", "research-integrity"]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Intended Audience :: Science/Research",
+  "Topic :: Text Processing :: Markup :: LaTeX",
+]
+# No runtime dependencies on purpose: this gets installed in a hurry, close to a
+# deadline, often on a machine someone else administers. defusedxml is used if
+# present but a hardened stdlib parser is built in.
+dependencies = []
+
+[project.optional-dependencies]
+xml = ["defusedxml>=0.7"]
+dev = ["pytest>=7", "mypy>=1.5", "ruff>=0.4"]
+
+[project.scripts]
+refaudit = "refaudit.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/uw-share-lab/refaudit"
+Issues = "https://github.com/uw-share-lab/refaudit/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/refaudit"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q"
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+
+[tool.mypy]
+python_version = "3.10"
+warn_unused_ignores = true
+disallow_untyped_defs = false

refaudit-0.1.0/src/refaudit/__init__.py

@@ -0,0 +1,39 @@
+"""refaudit -- verify bibliography entries against external indexes.
+
+Built for the case where a venue runs an automated check for hallucinated or
+malformed references and a false entry costs you a desk reject.
+
+    from refaudit import Checker, parse_file, default_resolvers
+
+    entries = parse_file("refs.bib")
+    checker = Checker(default_resolvers("you@example.org"))
+    for result in checker.check_all(entries):
+        print(result.key, result.verdict.value)
+"""
+
+from .bibtex import cited_keys, find_tex, parse_file, parse_string
+from .cache import Cache
+from .checker import Checker, Thresholds
+from .models import CheckResult, Entry, Found, NotFound, Record, Unavailable, Verdict
+from .resolvers import default_resolvers
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "Cache",
+    "CheckResult",
+    "Checker",
+    "Entry",
+    "Found",
+    "NotFound",
+    "Record",
+    "Thresholds",
+    "Unavailable",
+    "Verdict",
+    "__version__",
+    "cited_keys",
+    "default_resolvers",
+    "find_tex",
+    "parse_file",
+    "parse_string",
+]

refaudit-0.1.0/src/refaudit/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())