# Container dependency lock (dispatch 000310, Release N / N3).
#
# WHAT THIS IS. A pip CONSTRAINTS file -- the full resolved closure of the serve image's builder
# venv, pinned with `==`. The Dockerfile passes it to every `pip install` it runs, so torch,
# sentence-transformers and everything underneath them resolve to these exact versions on every
# build instead of to whatever the indexes serve that day.
#
# WHY pip CONSTRAINTS AND NOT A NEW TOOL. The repository's declared package manager is
# "`uv` if available, else `pip` + `venv`" and CLAUDE.md records `uv` as ABSENT on this box; the
# image itself builds with `python -m venv` + `pip` and nothing else. A pip-compile or uv.lock
# would have added a build-time tool for a file plain pip can already produce and already
# consume, which the charter's own open question forbids. `pip freeze` + `-c` uses what is
# already here.
#
# WHY CONSTRAINTS RATHER THAN REQUIREMENTS. The image's dependency SET is declared by
# pyproject.toml (`.[embeddings]`) and must stay declared there -- one source of truth for what
# the image contains. This file only fixes WHICH VERSION each member of that set resolves to. A
# `-r requirements.txt` would have duplicated the set and let the two drift.
#
# HOW IT WAS PRODUCED (dispatch 000310, 2026-09-05, measured):
#
#     docker build -t claude-archive:n3-phase0 --build-arg VERSION=1.13.0 .
#     docker run --rm --entrypoint /opt/venv/bin/python claude-archive:n3-phase0 -m pip freeze
#
# against the UNPINNED Dockerfile, with the local package (`claude-archive-mcp @ file:///src`)
# dropped -- it is built from the context, not resolved from an index, so a pin on it is
# meaningless -- and `pip` itself added, because `pip install --upgrade pip` floats otherwise and
# pip is part of what resolves everything else.
#
# HOW IT IS REFRESHED. Two supported paths, and neither is "edit a line by hand":
#   1. Dependabot (.github/dependabot.yml, pip ecosystem, weekly). It reads this file as a pip
#      manifest and opens a pull request per bump, which pr-python-gate.yml and docker-smoke.yml
#      then judge. This is the routine path: a pin moves because a reviewed PR merged.
#   2. A deliberate full re-resolve, when the closure itself changes (a new dependency, a new
#      extra, a Python bump). Delete the `-c` flags from the Dockerfile's pip steps, build, run
#      the `pip freeze` above, and regenerate this file from it. That is what created it.
#
# torch carries the `+cpu` local version because it comes from
# https://download.pytorch.org/whl/cpu -- see the Dockerfile's builder stage for why the GPU
# wheels must never be resolved.

annotated-doc==0.0.5
annotated-types==0.8.0
anyio==4.15.1
attrs==26.1.0
certifi==2026.7.22
cffi==2.1.1
click==8.5.0
cloudpickle==3.1.2
cryptography==50.0.1
filelock==3.32.3
fsspec==2026.7.0
h11==0.16.0
hf-xet==1.6.0
httpcore==1.0.9
httpcore2==2.12.0
httpx==0.28.1
httpx2==2.12.0
huggingface_hub==1.30.0
idna==3.19
ijson==3.5.1
Jinja2==3.1.6
joblib==1.6.0
jsonschema==4.26.0
jsonschema-specifications==2025.9.1
markdown-it-py==4.2.0
MarkupSafe==3.0.3
mcp==2.1.1
mcp-types==2.1.1
mdurl==0.1.2
mpmath==1.3.0
narwhals==2.25.0
networkx==3.6.1
numpy==2.5.2
opentelemetry-api==1.44.0
packaging==26.3
pip==26.2.1
pycparser==3.0
pydantic==2.13.5
pydantic_core==2.46.5
Pygments==2.21.0
PyJWT==2.13.0
python-multipart==0.0.32
PyYAML==6.0.3
referencing==0.37.0
regex==2026.9.3
rich==15.0.0
rpds-py==2026.6.3
safetensors==0.8.0
scikit-learn==1.9.0
scipy==1.18.1
sentence-transformers==6.0.1
setuptools==78.1.0
shellingham==1.5.4
sse-starlette==3.4.11
starlette==1.6.0
sympy==1.14.0
threadpoolctl==3.6.0
tokenizers==0.23.2
torch==2.14.0+cpu
tqdm==4.70.0
transformers==5.16.1
truststore==0.10.4
typer==0.27.2
typing-inspection==0.4.4
typing_extensions==4.16.0
uvicorn==0.52.4
