# DQIII8 — Python Dependencies

# Core (used by most scripts)
requests>=2.31.0
sqlite-vec==0.1.7
python-dotenv>=1.0.0
httpx>=0.27.0
PyYAML>=6.0.1
# rules_dispatcher.py's token_estimate() needs this for exact cl100k_base
# counts; its own docstring says the word-count fallback (30-40% undercount)
# "must never be the source of a number cited in docs" — so this dependency
# is load-bearing for every token-budget claim in CLAUDE.md/rules, not optional.
tiktoken>=0.12.0

# Telegram bot (optional — only for remote control)
python-telegram-bot>=21.0

# Dashboard (web UI)
fastapi>=0.110.0
uvicorn>=0.29.0

# Analysis tools (optional — only for media analysis)
numpy>=1.26.0
Pillow>=10.0.0

# Bot voice + dashboard features (deferred imports — missed by P2.1's dry-import
# gate, 2026-08-13 red-team review F3; must be present for real runtime, not just
# module-level import checks)
groq>=1.1.1
gTTS>=2.5.4
# click is a transitive dep of gTTS, unconstrained upstream — a bare `pip install
# --upgrade` pulled click 8.5.0 (2026-09-07) and broke gTTS's own `click<8.2,>=7.1`
# requirement (`pip check` failure, found during red-team RT-002 remediation).
# Pinned here explicitly so it's a first-class constraint, not silent transitive drift.
click<8.2,>=7.1
openpyxl>=3.1.5
python-docx>=1.1.0
python-pptx>=1.0.0
anthropic>=0.40.0

# Orchestration — StateGraph director, Agno AgentOS, MetaGPT-pattern pipeline
langgraph>=1.1.3
# websockets is a transitive dep of langgraph-sdk, unconstrained upstream — same
# drift as click above: a bare upgrade pulled 17.1 and broke langgraph-sdk's own
# `websockets<17,>=14` requirement. Pinned here for the same reason.
websockets<17,>=14
agno>=2.6.19
typing_extensions>=4.15.0

# Dev-only (test tooling — install via pyproject.toml's [project.optional-dependencies].dev)
pytest>=7.0.0

# Monitoring — CPU/RAM checks in bin/monitoring/health_watchdog.py (added 2026-08-25)
psutil>=5.9.0

# CDP investigation — bin/core/cdp_client.py (was installed manually on Hostinger,
# never documented here — found missing on Netcup via red-team skills audit 2026-09-07)
websocket-client>=1.8.0

# PDF reopen-and-verify cross-check — bin/tools/metadata_lib/validate.py:validate_pdf
# (production path, not test-only — never declared despite being a hard import)
pypdf>=5.0.0
