# Flask core
Flask==3.1.3
Werkzeug==3.1.9

# Database
Flask-SQLAlchemy==3.1.1
# >=2.0.31 is REQUIRED for Python 3.13. Older releases raise at import time:
# "SQLCoreOperations directly inherits TypingOnly but has additional attributes
# {'__static_attributes__', '__firstlineno__'}" — 3.13 adds those class
# attributes and SQLAlchemy's TypingOnly guard rejected them. Debian 13 ships
# only 3.13, so this pin is what lets the panel install there at all.
# Verified: 3542 passed / 0 failed on 3.11 with 2.0.52, identical to 2.0.23.
SQLAlchemy==2.0.52
Flask-Migrate==4.0.7

# Authentication
Flask-JWT-Extended==4.6.0
PyJWT==2.15.1

# CORS
Flask-Cors==6.0.2

# WebSocket support
Flask-SocketIO==5.6.1
python-socketio==5.16.3
python-engineio==4.13.3
# WebSocket CLIENT for the ServerKit Cloud relay (see
# app/services/connect_client.py). The server-side stack above cannot dial out.
websockets==15.0.1

# System monitoring
psutil==5.9.7

# Production server. WebSocket is served by simple-websocket (engineio's
# threading driver) under a plain threaded gunicorn worker — do NOT deploy
# with the gevent-websocket worker class; it double-answers the WS handshake
# against async_mode='threading' (browser: "Invalid frame header").
gunicorn==23.0.0
simple-websocket==1.1.0

# Environment variables
python-dotenv==1.2.2

# YAML / TOML parsing (for Docker Compose and repository manifests)
PyYAML==6.0.1
tomli>=2.0.0; python_version < '3.11'

# Rate limiting
Flask-Limiter==3.5.0

# CLI
click==8.3.3

schedule==1.2.2
croniter==6.0.0
passlib==1.7.4
bcrypt==4.2.1

# Encryption for env vars
cryptography==50.0.0

# Two-Factor Authentication
pyotp==2.9.0
qrcode[pil]==7.4.2

# WebAuthn / Passkeys
webauthn==2.5.0

# HTTP Requests (for webhooks & notifications)
requests==2.33.1

# S3-compatible storage (AWS S3, Backblaze B2, MinIO, Wasabi)
boto3==1.35.0

# SSO / OAuth
Authlib==1.6.12
python3-saml==1.16.0

# Cross-platform local IANA timezone resolution (SystemService.get_server_time
# falls back to this on hosts without /etc/timezone or timedatectl, e.g. Windows
# dev boxes) so the panel never reports a non-IANA zone the UI can't format.
tzlocal>=5.0

# OpenAPI documentation
apispec==6.4.0
marshmallow==3.26.2

# AI assistant (core primitive — powered by Prompture)
# Multi-provider LLM orchestration: Conversation, ToolRegistry, ask_live streaming,
# ProviderEnvironment, guardrails. Native OpenAI and Anthropic SDKs ship with the
# panel; compatible gateways use Prompture's raw-HTTP driver. Other SDKs remain
# optional. Pin the tested descriptor, streaming, and conversation APIs.
prompture[openai,anthropic]==1.11.0
