# Flask core
Flask==3.1.3
Werkzeug==3.1.9

# Database
Flask-SQLAlchemy==3.1.1
# >=2.0.31 is REQUIRED for Python 3.13. Older releases raise at import time:
# "SQLCoreOperations directly inherits TypingOnly but has additional attributes
# {'__static_attributes__', '__firstlineno__'}" — 3.13 adds those class
# attributes and SQLAlchemy's TypingOnly guard rejected them. Debian 13 ships
# only 3.13, so this pin is what lets the panel install there at all.
# Verified: 3542 passed / 0 failed on 3.11 with 2.0.52, identical to 2.0.23.
SQLAlchemy==2.0.55
Flask-Migrate==4.1.0

# Authentication
Flask-JWT-Extended==4.7.4
PyJWT==2.15.1

# CORS
Flask-Cors==6.0.5

# WebSocket support
Flask-SocketIO==5.7.0
python-socketio==5.17.1
python-engineio==4.15.1
# WebSocket CLIENT for the ServerKit Cloud relay (see
# app/services/connect_client.py). The server-side stack above cannot dial out.
websockets==16.1.1

# System monitoring
psutil==5.9.7

# Production server. WebSocket is served by simple-websocket (engineio's
# threading driver) under a plain threaded gunicorn worker — do NOT deploy
# with the gevent-websocket worker class; it double-answers the WS handshake
# against async_mode='threading' (browser: "Invalid frame header").
gunicorn==26.2.0
simple-websocket==1.1.0

# Environment variables
python-dotenv==1.2.4

# YAML / TOML parsing (for Docker Compose and repository manifests)
PyYAML==6.0.3
tomli>=2.0.0; python_version < '3.11'

# Rate limiting
Flask-Limiter==3.5.0

# CLI
click==8.5.0

croniter==6.2.4
bcrypt==5.0.0

# Encryption for env vars
cryptography==50.0.2

# Two-Factor Authentication
pyotp==2.10.0
qrcode[pil]==7.4.2

# WebAuthn / Passkeys
webauthn==2.5.0

# HTTP Requests (for webhooks & notifications)
requests==2.34.2

# S3-compatible storage (AWS S3, Backblaze B2, MinIO, Wasabi)
boto3==1.43.123

# SSO / OAuth
Authlib==1.9.1
python3-saml==1.16.0

# Cross-platform local IANA timezone resolution (SystemService.get_server_time
# falls back to this on hosts without /etc/timezone or timedatectl, e.g. Windows
# dev boxes) so the panel never reports a non-IANA zone the UI can't format.
tzlocal>=5.0

# OpenAPI documentation
apispec==6.10.0
marshmallow==4.3.1

# AI assistant (core primitive — powered by Prompture)
# Multi-provider LLM orchestration: Conversation, ToolRegistry, ask_live streaming,
# ProviderEnvironment, guardrails. Native OpenAI and Anthropic SDKs ship with the
# panel; compatible gateways use Prompture's raw-HTTP driver. Other SDKs remain
# optional. Pin the tested descriptor, streaming, and conversation APIs.
prompture[openai,anthropic]==1.16.0