# AIOS web API — the FastAPI backend + the platform data-layer deps it reuses.
#
# ⛔ STREAMLIT IS GONE (EXIT-6, 2026-08-04) — do not add it back. The line here read
# `streamlit==1.58.0` with the comment "included only because the shared modules/core may import
# it at load; it is never served". That stopped being true when the shared layer was cleaned, and
# it stayed in THIS file — the one the Dockerfile actually installs — while `api/requirements.txt`
# had already dropped it and a gate reported the omission "verified". ~250 MB of image for a
# package nothing imported.
#
# The lesson is the file, not the package: the PINNED intent and the SHIPPED manifest are two
# different documents, and checking only the one you wrote is how the other rots.
# `api/verify_no_streamlit.py` now checks BOTH, and proves the API imports with streamlit,
# plotly, altair, openpyxl, reportlab and jinja2 all blocked at sys.meta_path.
# No altair/plotly/reportlab either — those were Streamlit UI/export only. openpyxl RETURNED in
# wave 21 (C5) as a LAZY dep of routes_uploads.py — the boot proof above still holds because the
# import lives inside the handler, and the gate now asserts this line exists here.
fastapi>=0.139
uvicorn[standard]>=0.30
python-dotenv>=1.0
pandas>=2.0
requests>=2.28
huggingface_hub>=0.20
duckdb>=1.0
pyyaml>=6.0
pillow>=10.0
beautifulsoup4>=4.12
lxml>=5.0
cryptography>=42.0
# ⭐ WAVE 20 (R1 / D-4) — THE POSTGRES DRIVER, AND IT IS LOAD-BEARING IN THIS FILE SPECIFICALLY.
# `core/store_pg.py` is the store backend from this wave on, and it is deliberately FAIL-CLOSED:
# `_pool()` raises rather than falling back to the HF file store, so a container that gets
# `STORE_BACKEND=pg` without this line does not degrade — it refuses every request that touches
# the store, which is every authenticated request.
#
# ⛔ AND THIS IS THE FILE THAT MATTERS: the Dockerfile does `COPY requirements.txt` from the
# Space root, i.e. THIS manifest, not `api/requirements.txt`. That header's own streamlit story
# is the same defect in the other direction — the pinned intent and the shipped manifest are two
# documents. psycopg is now in BOTH, and `ops/verify_portability.py` gates the pair.
psycopg[binary,pool]>=3.2
# ⭐ WAVE 21 (item 11, C5) — .xlsx preview for Select-from-file; lazy-imported in
# routes_uploads.py only. verify_no_streamlit asserts this line in BOTH manifests.
openpyxl>=3.1
# ⛔ AND ITS TRANSPORT, learned from a RUNTIME_ERROR on the first v6 boot: FastAPI demands
# python-multipart AT IMPORT TIME for any route declaring File(...)/Form(...). Every local gate
# was green because the dev box happens to have it for unrelated reasons — the container
# installs exactly this file. The environment-parity twin of the streamlit lesson above.
python-multipart>=0.0.20