requirements.txt

# Runtime dependencies for the server tier.
#
# The project's founding rule was zero external dependencies, stdlib only. That
# rule ended deliberately when the product became client-server: a browser
# console and a durable finding store cannot be built on the standard library.
#
# The discipline that REPLACES it is a single-digit dependency count. Every
# addition below is load-bearing. Notably absent: an ORM (SQL is written by
# hand and reviewed) and a graph database (recursive CTEs in PostgreSQL are
# ample at SAP landscape scale).
#
# THE CONSOLE IS A REACT SPA AND THIS LIST WENT DOWN. frontend/ is compiled by
# Vite at BUILD time into server/spa/ and served as static files by the same
# FastAPI process — one app container, one PostgreSQL, no Node at runtime. React
# and its toolchain live in frontend/package.json and never here. If a "runtime"
# dependency ever appears below because of the frontend, the deployment has
# quietly grown a second service; see tests/test_spa_mount.py, which asserts this
# list verbatim.
#
# JINJA2 LEFT WHEN THE SERVER-RENDERED CONSOLE DID. It was here for thirteen
# templates in server/templates/, all of which the React screens replaced; the
# pages and the directory were deleted in the same commit that gave the SPA the
# root, and nothing imports jinja2 any more — not fastapi.templating, not
# server/prose.py, which is now a plain library the TypeScript port is checked
# against. Four is the count, and it is a real reduction rather than a shuffle:
# nothing took its place.
#
# The CLI scanner still runs on the standard library alone.
fastapi>=0.110
uvicorn[standard]>=0.27
psycopg[binary,pool]>=3.1
python-multipart>=0.0.9