# python 2 -> 3 compat.
six

# Python 3.12+ no longer bundles setuptools in venvs.
setuptools

# Pyramid.
plaster_pastedeploy
# 2.1 is current. Note it does NOT drop pkg_resources — asset.py and path.py
# still import it — so remarkbox/_vendor/pkg_resources stays load-bearing for
# our themes, whose templates and static assets are package-relative asset
# specs that pyramid resolves through pkg_resources.resource_filename.
pyramid>=2.1
pyramid_jinja2
pyramid_debugtoolbar
pyramid_retry
pyramid_tm

# Model.
SQLAlchemy
SQLAlchemy-Utils
transaction
zope.sqlalchemy
alembic

# PostgreSQL database connections.
# requires postgresql-devel on Fedora for `pg_config` binary.
psycopg2-binary

# Template renderer.
#jinja2
jinja2

# MarkDown is a popular and familair WYSIWYM markup language.
markdown
python-markdown-math
html5lib
BeautifulSoup4

# Bleach sanitizes MarkDown (removes HTML/Javascript) to prevent XSS.
# Pin >=6.0.0: bleach <3.3.0 had CVE-2021-23980 (ReDoS in linkifier URL regex);
# bleach <6.0.0 had LinkifyFilter API differences that break sanitize_html.py.
bleach>=6.0.0
bleach-allowlist

# codehilite.
pygments

# Human readable time deltas.
ago

# light weight URI attribute parser.
miniuri

# the official Remarkbox "meta" theme.
remarkbox-theme-meta @ git+ssh://git@git.unturf.com:2222/engineering/remarkbox/remarkbox-theme-meta.git

# chaostheory theme (foxhop.net).
remarkbox-chaostheory @ git+ssh://git@git.unturf.com:2222/engineering/remarkbox/remarkbox-theme-chaostheory.git

# another example theme.
#git+https://github.com/russellballestrini/remarkbox-westworld.git#egg-remarkbox-westworld
#git+https://git.unturf.com/engineering/remarkbox/remarkbox-westworld.git#egg-remarkbox-westworld
#remarkbox-westworld @ git+https://git.unturf.com/engineering/remarkbox/remarkbox-westworld.git

# Create URI slugs from titles.
python-slugify

# Future proof, computationally complex password hashes.
bcrypt

# reach out to verify public rb_owner_key.
requests[security]
# request library pins this dependency too low.
# idna==2.6

# credit card storage and processing.
stripe

# slack: bot notifications.

# DKIM Signed Email from Python.
dkimpy

# QR codes for export provenance (links printed PDFs back to their living source).
# Pure Python, zero deps, BSD license.
segno

# Authenticator app login (time-based one-time password, TOTP)
pyotp
qrcode

# Authenticated encryption (ChaCha20-Poly1305) for enrolled factor secrets
# at rest, plus HKDF to derive that key from our session secret. A shared
# secret cannot be hashed the way a paper code is: verifying a time-based
# code needs the secret back, so it rides encrypted instead.
cryptography
