# UML Forge — API Layer Dependencies
# Python 3.12.x required
# All packages verified: actively maintained, mutually compatible, no deprecated libs
# See 12_uml_forge_dependency_matrix.md for full rationale

# ── Web Framework ──────────────────────────────────────
fastapi>=0.136.0,<1.0.0
uvicorn[standard]>=0.29.0,<1.0.0
python-multipart>=0.0.31,<1.0.0

# ── Data Validation ────────────────────────────────────
pydantic[email]>=2.7.0,<3.0.0
pydantic-settings>=2.14.2,<3.0.0

# ── Database ───────────────────────────────────────────
sqlalchemy[asyncio]>=2.0.30,<3.0.0
asyncpg>=0.29.0,<1.0.0
alembic>=1.13.0,<2.0.0
greenlet>=3.0.0,<4.0.0

# ── Security ───────────────────────────────────────────
# NOTE: passlib is BANNED (abandoned 2020, breaks Python 3.13)
# NOTE: python-jose is BANNED (unmaintained, open CVEs)
bcrypt>=4.2.0,<5.0.0
PyJWT[crypto]>=2.15.0,<3.0.0
cryptography>=46.0.6,<51.0.0

# ── HTTP Client ────────────────────────────────────────
# NOTE: requests is BANNED for async code (sync-only, blocks event loop)
httpx>=0.27.0,<1.0.0

# ── AI / MCP ───────────────────────────────────────────
# NOTE: FastMCP is built into the mcp SDK — no separate fastmcp package needed
# Default provider — always required
anthropic>=0.105.0,<1.0.0
# Optional providers — install when LLM_PROVIDER=openai or LLM_PROVIDER=google
openai>=1.50.0,<2.0.0
google-genai>=0.8.0,<1.0.0
mcp[cli]>=1.30.0,<2.0.0

# ── Rate Limiting ──────────────────────────────────────
slowapi>=0.1.9,<1.0.0

# ── Config ─────────────────────────────────────────────
python-dotenv>=1.0.0,<2.0.0

# ── Security floors (transitive deps with published advisories) ─────────────
# Pinned as minimums so a stale build cache cannot resolve to a vulnerable version.
starlette>=1.3.1
anyio>=4.14.2
urllib3>=2.8.0
pyasn1>=0.6.4
