# Workweaver Runtime Dependencies
# Used for Docker images / production runtime (keeps images small).
# Python 3.14+ compatible

# -----------------------------------------------------------------------------
# Web Framework & ASGI
# -----------------------------------------------------------------------------
fastapi==0.136.3
uvicorn[standard]==0.48.0
mangum==0.21.0
slowapi==0.1.9

# -----------------------------------------------------------------------------
# Data Validation
# -----------------------------------------------------------------------------
pydantic==2.13.4
pydantic-settings==2.14.1
email-validator==2.3.0

# -----------------------------------------------------------------------------
# HTTP Client (aiohttp required by Twilio mock, LiveKit integrations)
# -----------------------------------------------------------------------------
httpx==0.28.1
aiohttp==3.13.5

# -----------------------------------------------------------------------------
# AWS SDK
# -----------------------------------------------------------------------------
boto3==1.43.16
botocore==1.43.16

# -----------------------------------------------------------------------------
# PostgreSQL / pgvector-backed WorkMemory recall + durable metering
# -----------------------------------------------------------------------------
psycopg[binary]==3.3.4
psycopg-pool==3.3.1
# asyncpg powers (a) PostgresMeteringProvider's durable cost-attribution
# writes (#4217) and (b) the self-host migration applicator that creates
# the metering_events table on fresh deploys (#4240). MUST stay in the
# runtime requirements so the workweaver/backend image used by the
# self-host migrations init container can resolve `import asyncpg`.
asyncpg==0.31.0

# -----------------------------------------------------------------------------
# Third-Party Integrations (canonical product-contract dependencies)
# -----------------------------------------------------------------------------
# Telephony (legacy P1.2): Voice, WhatsApp, SMS
twilio==9.10.9

# Document Processing (legacy P1.7D): PDF, DOCX, TXT extraction
pypdf==6.12.2
python-docx==1.2.0
reportlab==4.5.1
python-pptx==1.0.2
openpyxl==3.1.5

# Audio processing (Python 3.13+ removed stdlib audioop; floor is 3.13)
audioop-lts==0.2.2

# xAI Grok (legacy P1.3): Voice Agent, LLM orchestration
websockets==16.0

# LiveKit (legacy P0.9.7): Real-time voice infrastructure, WebRTC, SFU
livekit==1.1.8
livekit-api==1.1.0

# Payments (legacy P1.10): Checkout, billing
stripe==15.1.0

# -----------------------------------------------------------------------------
# Cryptography & Security
# -----------------------------------------------------------------------------
cryptography==48.0.0
PyJWT==2.13.0
bcrypt==5.0.0
# Issue #3515 — portable_e2e per-tenant credential encryption (Argon2id KDF).
argon2-cffi==25.1.0
eth-hash[pycryptodome]==0.8.0
pycryptodome==3.23.0
# Issue #4216 — AWS Nitro Enclaves attestation document
# parsing (parent-side strict CBOR/COSE_Sign1 verifier).
# Pinned to 6.1.1 to address CVE-2025-68131 + CVE-2026-26209.
cbor2==6.1.1
# Issue #4216 — BLS12_381 (G2 ProofOfPossession) signing inside the
# Nitro Enclave child. Imported lazily from the keystore; bundled in
# the parent backend container so test fixtures can verify signatures.
py_ecc==8.0.0
# Issue #4216 — BIP340 Schnorr signing via libsecp256k1.
# Pinned below 21.x until upstream ships a Python 3.14-compatible release:
# 21.0.0 has no cp314 wheel and its sdist build fails while vendoring cffi.
# Skipped on Windows: coincurve has no cp314 Windows wheel, so pip builds the
# libsecp256k1 sdist via CMake/MSBuild and dies (MSB8066) on the Windows CI
# runners — failing every lane (Evals/Knowledge/Parity/Delta/Contract) that
# isn't the Performance job (which already passes skip-packages: coincurve).
# It's a lazy EIF-only import (apps/backend/services/key_custody/backends/
# _advanced_curves.py) for BIP340 Schnorr, which no CI job exercises, and
# production runs on Linux where the wheel exists — so skipping it on Windows
# is safe and removes the dep behind the recurring cross-platform CI reds.
# AGENTS.md §"Cross-platform CI code": portable, not a global hardcode.
coincurve==20.0.0; platform_system != "Windows"

# -----------------------------------------------------------------------------
# Utilities
# -----------------------------------------------------------------------------
python-dotenv==1.2.2
orjson==3.11.9
prompt-toolkit==3.0.52
python-multipart==0.0.29
PyYAML==6.0.3
jsonschema==4.26.0
ulid-py==1.1.0
structlog==25.5.0
croniter==6.2.2
phonenumbers==9.0.31
sqlite-vec==0.1.9
beautifulsoup4>=4.12.0
dnspython==2.8.0
# Canonical Agent Client Protocol SDK (issue #4338). Powers `ww acp start`
# and is imported by tests/integration/test_acp_daemon_canonical.py.
agent-client-protocol>=0.10.1
