# =============================================================================
# Python runtime for the CakePHP application image.
#
# WHY THESE LIVE IN THE PHP IMAGE AND NOT A SIDECAR
#   The application shells out:  exec('python3 <script> ... 2>/dev/null')
#   from ToolCatalog::runDeliveryInventory(), ReportsController,
#   TransactionsController, CustomComponent and AppController. exec() cannot
#   reach another container, so Python must be installed alongside PHP. Splitting
#   it out would mean rewriting every delivery/report tool to speak HTTP — a
#   redesign, not a packaging change.
#
# WHY EVERY VERSION IS PINNED
#   These are the HOST's actual versions, read off the running box rather than
#   guessed. The delivery sheet is a financial artefact and pandas 1.x vs 2.x
#   differ in ways that change output (append() removed, groupby defaults, dtype
#   inference), so "close enough" is not good enough. Unpinned installs also
#   drift silently: `2>/dev/null` on the exec swallows every ImportError, so a
#   bad resolve surfaces only as `tool_failed` with no error text anywhere.
#
# WHY numpy IS LISTED WHEN NOTHING IMPORTS IT DIRECTLY
#   pandas only requires `numpy>=1.17.3`, so an unpinned install resolves numpy
#   2.x, which is ABI-incompatible with a pandas wheel built against 1.x. It
#   fails at IMPORT time, not install time:
#       ValueError: numpy.dtype size changed, may indicate binary incompatibility.
#                   Expected 96 from C header, got 88 from PyObject
#
# WHY requests IS LISTED WHEN NOTHING IMPORTS IT DIRECTLY
#   Same reasoning, one layer up. No script does `import requests`; it arrives as
#   a dependency of google-auth (google.auth.transport.requests). Pinning it keeps
#   that resolve deterministic instead of taking whatever the Google stack happens
#   to pull on the day the image is rebuilt.
#
# WHAT IS DELIBERATELY ABSENT
#   flask_app/requirements.txt is a SEPARATE service (the Flask invoice/admin
#   utility) with its own dependency set and its own lifecycle. It is not
#   installed here — this file covers only what code/webroot/python_script/*.py
#   imports on the CakePHP request path.
#
# Derived from the actual imports in code/webroot/python_script/*.py AND
# code/webroot/csv-to-excel.py:
#   pymysql · pandas · openpyxl · xlsxwriter · requests
#   google-auth · google-auth-oauthlib · google-auth-httplib2 ·
#   google-api-python-client
#   (plus stdlib: argparse base64 binascii collections contextlib datetime decimal
#    email html io json os queue re smtplib subprocess sys threading time
#    traceback typing)
#
# csv-to-excel.py sits in webroot/ root rather than webroot/python_script/, so an
# earlier audit of this list missed it and the pandas 2.x bump silently broke the
# queued Sales/Transactions/customer-sales/one-time-orders exports. Include it in
# any future version bump.
#
# KNOWN DEVIATION: the image is Debian bullseye, so python3 is 3.9 while the
# host runs 3.12. All scripts in webroot/python_script were parsed against 3.9
# and every pin below supports it. A script adopting 3.10+ syntax (match/case,
# `X | Y` unions) fails at BUILD time here rather than as a swallowed runtime
# error.
# =============================================================================

pymysql==1.0.2
numpy==1.26.4
pandas==2.1.4
openpyxl==3.1.2
xlsxwriter==3.1.9
requests==2.31.0

# -----------------------------------------------------------------------------
# GOOGLE DRIVE / GMAIL EXPORT STACK
#
# Imported LAZILY, inside functions, by drive_email_utils.py (google.oauth2,
# google.auth.transport.requests, google.auth.exceptions, googleapiclient) and
# gdrive_reauth.py (google_auth_oauthlib.flow). Consumed by
# delivery_sheet_export.py, customer-report.py, failed_payments_export.py and
# gdrive_reauth.py.
#
# Because the imports are lazy AND the exec discards stderr, a missing wheel here
# is invisible until someone actually runs a Drive-backed export — at which point
# it is a silent tool_failed, not an error message. That combination is why these
# went unnoticed and why they are pinned rather than assumed present.
#
# NOT THE HOST VERSIONS, and deliberately so. The host runs Python 3.10, where
# pip resolves google-auth 2.53.0 / google-auth-oauthlib 1.4.0 /
# google-auth-httplib2 0.4.0. All three declare Requires-Python >=3.10 and will
# NOT install on this bullseye image's Python 3.9. The pins below are the newest
# releases of each that still accept 3.9; they satisfy every inter-dependency
# constraint of google-api-python-client 2.197.0 (google-auth >=1.32.0,<3.0.0)
# and google-auth-oauthlib 1.3.1 (google-auth >=2.15.0,<3.0.0, !=2.43-2.45).
# When python3 in this image moves to >=3.10, raise these to the host versions in
# the same commit — not before.
# -----------------------------------------------------------------------------
google-auth==2.50.0
google-auth-oauthlib==1.3.1
google-auth-httplib2==0.3.1
google-api-python-client==2.197.0