requirements.txt

# ---------------------------------------------------------------------------
# IMPORTANT — PyTorch CPU-only install (Stage 1 deployment target is CPU)
#
# Do NOT run plain `pip install torch` — that pulls the CUDA build (~2.5 GB).
# Use the CPU wheel index instead:
#
#   pip install torch torchvision --index-url https://download.pytorch.org/whl/cpu
#
# Then install the rest:
#   pip install -r requirements.txt
#
# All packages below are commercially licensed (MIT / Apache-2.0 / BSD-3 / HPND).
# ---------------------------------------------------------------------------

# Deep-learning runtime
torch>=2.3.0
torchvision>=0.18.0

# CLIP backbone & general HF model loading
transformers>=4.41.0,<5    # Apache-2.0 — pinned to 4.x: 5.x changed CLIPModel.get_image_features to return a wrapper object
accelerate>=0.30.0         # Apache-2.0 — recommended companion for transformers

# Image I/O & preprocessing
Pillow>=10.3.0
numpy>=1.26.4

# C2PA / Content Credentials verification
# Apache-2.0; native deps may not build on every platform — provenance/c2pa.py
# degrades gracefully if the import fails.
c2pa-python>=0.5.0

# API server
fastapi>=0.111.0
uvicorn[standard]>=0.29.0
python-multipart>=0.0.9    # required for FastAPI file uploads
pydantic>=2.7.0

# Testing
pytest>=8.2.0
httpx>=0.27.0              # required by FastAPI TestClient

# ---------------------------------------------------------------------------
# Optional dataset-curation deps (NOT installed by this file).
#
# This file is the consolidated Python dependency ledger, but the production
# Dockerfile installs it directly. Keep GPU/dataset-only packages commented so
# the inference image stays lean. On a rented GPU box, install the CUDA torch
# wheel first, then install the dataset packages listed below explicitly:
#
#   pip install torch torchvision --index-url https://download.pytorch.org/whl/cu121
#   pip install 'fiftyone>=0.24.0' 'diffusers>=0.30.0' 'sentencepiece>=0.2.0' 'protobuf>=4.25.0'
#
# Dataset-only packages, licenses, and purpose:
#   fiftyone>=0.24.0          # Apache-2.0 — Open Images V7 sampling
#   diffusers>=0.30.0         # Apache-2.0 — Flux/SDXL/SD3/AuraFlow pipelines
#   sentencepiece>=0.2.0      # Apache-2.0 — required by Flux's T5 tokenizer
#   protobuf>=4.25.0          # BSD-3 — required by sentencepiece
#
# Stage 2/3 head training itself runs on cached embeddings and uses only the
# installed runtime/test dependencies above.
# ---------------------------------------------------------------------------