# Origin's runtime dependencies, and the single source for them.
#
# `pyproject.toml` reads this file for `[project.dependencies]`, so `pip install
# agience-origin` resolves exactly these pins and the package is installable by name.
# Test-only dependencies are not here — they are `[project.optional-dependencies].test`.
#
# Use: pip install -r requirements.txt

# The trust floor. Origin imports `prism.trust` (authority_trust, key_manager, service_identity),
# `prism.grounding` and `prism.mass` in five modules, three of them on the `origin.main` import
# path — so this is the one dependency without which the process cannot bind a socket.
#
# The `trust` extra is requested rather than relied upon: `prism.trust` needs `jose`, which the base
# install does not carry. Origin's own python-jose and cryptography pins below satisfy the extra's
# floors, so asking for it declares the need without moving a version.
#
# A FLOOR, never an exact pin. This file IS origin's published metadata — `pyproject.toml` declares
# `dynamic = ["dependencies"]` reading it — so whatever is written here is what every installer
# resolves against. An exact pin cannot be co-installed with a sibling that asks for anything else:
# crystal, ember and chorus all floor prism at >=0.1.2, and an `==` here makes
# `pip install agience-origin agience-crystal` unsatisfiable. A floor still installs the newest
# prism; it only refuses to resolve BACKWARDS past the version origin needs.
#
# 0.1.2 is the floor because 0.1.0 and 0.1.1 are yanked on PyPI, and PEP 592 ignores a yanked
# release only when the requirement is not a pinned exact match — so an `==` on a yanked version
# installs it and reads as working.
agience-prism[trust]>=0.1.2

# Authentication & Security
authlib==1.6.9
bcrypt==5.0.0
cryptography==46.0.7
webauthn>=2.5.0

# Email (transactional)
aiosmtplib==3.0.2

# Core Web Framework
#
# `starlette` is pinned exactly while fastapi selects starlette by range. Today the two resolve
# together; raising fastapi means checking that the pinned starlette still satisfies its floor, or
# the install becomes unsatisfiable with nobody having edited this file.
fastapi==0.135.1
starlette==0.49.3
itsdangerous==2.2.0
uvicorn[standard]==0.37.0
python-multipart==0.0.26
python-dotenv>=1.0.0

# Data Validation
pydantic==2.12.0
# The extra of an already-pinned base, written with the same pin: pip takes the union, and a bare
# extra beside an exact base quietly widens it.
pydantic[email]==2.12.0
pydantic-core==2.41.1
annotated-types==0.7.0
email-validator==2.2.0

# Database — relational (identity, OIDC). SQLite via stdlib sqlite3.
sqlalchemy>=2.0,<3.0
alembic>=1.13

# Manifest loader
pyyaml>=6.0

# Cloud Storage
boto3==1.40.50
botocore==1.40.50

# HTTP & Utilities
httpx==0.28.1
anyio==4.11.0
typing-extensions==4.15.0
python-dateutil==2.9.0.post0
python-jose==3.5.0
