# Constraints lockfile (STA-274 reproducao exata)
-c requirements-sta274.lock

# Core
Django==5.2.18
django-environ>=0.11,<1.0
psycopg[binary]>=3.1,<4.0
gunicorn>=22.0,<23.0

# Cache — Django's RedisCache (used whenever REDIS_URL is set) imports this
# client lazily; without it the first cache call raises and auth returns 500.
redis>=5.0,<9.0

# Auth
django-allauth[socialaccount]>=65.0,<66.0
bcrypt>=4.2,<5.0
# QR code on the 2FA setup page (pure Python, no dependencies)
segno>=1.6,<2.0

# Background tasks
django-background-tasks>=1.2,<2.0

# Frontend
django-tailwind[reload]>=3.8,<4.0
django-htmx>=1.19,<2.0

# Storage
django-storages[s3]>=1.14,<2.0
Pillow>=10.4,<11.0

# Security
django-csp>=3.8,<4.0
django-ratelimit>=4.1,<5.0
cryptography>=43.0,<44.0

# Static files
whitenoise>=6.7,<7.0

# HTTP client (provider API calls)
httpx>=0.27,<1.0

# Date utilities
python-dateutil>=2.9,<3.0
# zoneinfo reads the *system* tz database, which python:3.12-slim (our
# Dockerfile) does not reliably ship. providers/google_errors.py needs
# America/Los_Angeles to know when YouTube's daily quota resets; without this
# it silently falls back to a fixed UTC hour that drifts with daylight saving.
tzdata>=2024.1

# Agent API — Ninja for REST + Pydantic schemas + OpenAPI docs,
# mcp SDK for the /api/v1/mcp/ Streamable-HTTP transport that
# agentic clients (Claude Code, Codex, OpenClaw) connect to.
django-ninja>=1.3,<2.0
mcp>=1.0,<2.0

# OAuth 2.1 Authorization Server for the MCP endpoint — lets Claude
# Desktop (and other native MCP connectors) authenticate via the OAuth
# DCR + authorization-code + PKCE flow instead of a pre-shared bb_studio_
# key. Existing API keys keep working unchanged. See apps/oauth_server/.
django-oauth-toolkit>=3.0,<4.0


# Dev/Test
ruff>=0.6,<1.0
mypy>=1.11,<1.20
django-stubs>=5.0,<6.0
types-python-dateutil>=2.9,<3.0
pytest>=8.3,<9.0
# Capped below 4.13: it errors every class-based test that uses the ``db``
# fixture with "type object 'PytestDjangoTestCase' has no attribute
# '_pre_setup_ran_eagerly'" — 509 of ours. CI resolves the newest match, so
# every run since 2026-08-07 failed on this while local envs on 4.12 passed.
pytest-django>=4.8,<4.13
pytest-cov>=5.0,<6.0
pytest-socket>=0.7.0,<1.0
factory-boy>=3.3,<4.0

# Monitoring
sentry-sdk[django]>=2.13,<3.0

# Official Gemini text SDK (STA-274 AI-T3)
google-genai==2.31.0
