# DIRECT requirements only. requirements.txt is COMPILED from this file:
#
#     uv pip compile requirements.in --universal --generate-hashes -o requirements.txt
#
# Upgrade one package without moving everything else:
#
#     uv pip compile requirements.in --universal --generate-hashes \
#         --upgrade-package <name> -o requirements.txt
#
# This explanation lives HERE, not in requirements.txt, because a compile
# rewrites that file from scratch. The same guidance was written into its
# header once and was silently wiped by the next `uv pip compile` - including
# the line warning that hand-edits vanish. It is restored there for readers,
# but this copy is the one that survives.
#
# Only DIRECT requirements belong in this file. A runtime import satisfied in
# dev only because some test dependency happens to pull it in will pass every
# test and then fail on a production venv: `packaging` reached this project
# through pytest, and the Windows install could not import shopdb at all until
# it was declared. tests/test_runtime_dependencies.py guards that.
#
# Check dependencies against published advisories before a release:
#
#     venv/bin/python scripts/scan_sbom.py --gate

# Flask and extensions
flask>=3.0
flask-sqlalchemy>=3.1
flask-migrate>=4.0
flask-jwt-extended>=4.6
flask-cors>=4.0
flask-caching>=2.0
flask-marshmallow>=1.2
marshmallow-sqlalchemy>=0.29

# Database
mysql-connector-python>=8.0
pymysql>=1.1
cryptography>=42.0   # pymysql needs it for MySQL 8 caching_sha2_password auth

# CLI and utilities
click>=8.1
python-dotenv>=1.0
tabulate>=0.9

# Plugin contract version checking (shopdb/plugins/loader.py).
# Declared explicitly because it reaches dev and CI only as a pytest
# dependency: every test passes while a production venv, which has no pytest,
# cannot import shopdb at all.
packaging>=23.0

# HTTP/API clients
requests>=2.31

# Security
werkzeug>=3.0

# Windows/IIS runtime
# waitress is the WSGI server IIS launches via HttpPlatformHandler.
# tzdata ships the IANA timezone database, which Windows does not provide;
# without it the notifications plugin fails on zoneinfo lookups.
# Both were previously hand-added to requirements.txt only, so a recompile
# would have silently dropped them from every Windows install.
waitress>=3.0
tzdata

# Validation
email-validator>=2.0