[project]
name = "api"
version = "0.128.11"
description = "Agenta API"
requires-python = ">=3.11,<3.14"
authors = [
    { name = "Mahmoud Mabrouk", email = "mahmoud@agenta.ai" },
    { name = "Juan Vega", email = "jp@agenta.ai" },
]
dependencies = [
    "agenta[server-tracing]",
    "fastapi>=0.139,<0.140",
    "pydantic[email]>=2,<3",
    # MCP OAuth uses the SDK's TokenStorage protocol and OAuth wire contracts directly.
    # Keep this exact: a range would silently change those contracts underneath us, and
    # the contract case beside the OAuth storage asserts this exact version, so a relock
    # that moved within a range turned the branch red (M16).
    "mcp==2.2.0",
    "uvicorn[standard]>=0.51,<0.52",
    "gunicorn>=26,<27",
    "httpx>=0.28,<0.29",
    "structlog>=26,<27",
    "python-dotenv>=1,<2",
    "python-multipart>=0.0.32,<0.0.33",
    "cryptography>=49,<51",
    "sqlalchemy>=2,<3",
    "sqlalchemy-utils>=0.42,<0.43",
    "sqlalchemy-json>=0.7,<0.8",
    "greenlet>=3,<4",
    "asyncpg>=0.31,<0.32",
    "alembic>=1,<2",
    "orjson>=3,<4",
    "jsonschema>=4,<5",
    "genson>=1,<2",
    "python-jsonpath>=2,<3",
    "uuid-utils>=0.17,<0.18",
    "taskiq>=0.12,<0.13",
    "taskiq-redis>=1,<2",
    "redis>=8,<9",
    "cachetools>=7,<8",
    "supertokens-python>=0.31,<0.32",
    "openai>=2,<3",
    "litellm>=1.98,<2,!=1.107.0",
    "sendgrid>=6,<7",
    "stripe>=15,<16",
    "posthog>=7,<8",
    "dnspython>=2,<3",
    "opentelemetry-proto>=1,<2",
    "croniter>=6,<7",
    "miniopy-async>=1.21.3,<1.22",
    "pathspec>=0.12,<0.13",
    "stream-zip>=0.0.83,<0.1",
    "puremagic>=1.30,<2",
    "pyyaml>=6,<7",
    "google-auth>=2.40",
]

[dependency-groups]
dev = [
    "watchdog[watchmedo]>=3,<4",
    "click>=8,<9",
    "pytest>=9,<10",
    "pytest-asyncio>=1,<2",
    "pytest-xdist>=3,<4",
    "pytest-mock>=3,<4",
    "pytest-html>=4,<5",
    "fakeredis>=2.34.1,<3",
    # Test-only: scoped-session cleanup tests run against in-memory SQLite
    # via aiosqlite; not needed at runtime (production uses asyncpg).
    "aiosqlite>=0.20,<1",
    # Starlette 1.2's TestClient prefers httpx2 and warns when only httpx is
    # present. Runtime code stays on httpx (0.28); this test-only dep silences
    # the deprecation without touching the runtime HTTP stack.
    "httpx2>=2.3,<3",
]

[tool.uv]
package = false
# miniopy-async 1.21.x caps certifi below 2026, which blocks the certifi security fix
# (GHSA-6q48-6c7w-9gw2). Its code only needs certifi's CA bundle, so lift the cap here.
# miniopy-async must stay on 1.21.3: 1.21.1 returns a tuple from remove_objects and
# storage.py iterates it with `async for`.
override-dependencies = ["certifi>=2026.10.18"]

[tool.uv.sources]
agenta = { path = "../sdks/python", editable = true }