# DEPS — mgf-cloud-web's bidirectional dependency manifest

> **§1** — what mgf-cloud-web depends on. **§2** — who depends on mgf-cloud-web.
> Knowing both directions makes deprecation, breaking-change blast-radius, and
> feature-prioritisation tractable.
>
> **Maintained by:** the mgf-common owner (Bassam — mgf-common owns the
> federation per the one-big-library mindset).
> **Per standard DOC-16:** every project ships a `DEPS.md` at repo root.

Last verified: 2026-06-29.

---

## §1 What mgf-cloud-web depends on

This distribution **is** the web GUI, so the FastAPI stack is a core dependency
(not an extra). The provider, cost, models, and credential-resolution layers are
consumed from `mgf-cloud` — this app holds no provider logic of its own.

### Runtime (core — every install pays these)

| Dependency | Window | Why | Tier |
|---|---|---|---|
| `mgf-common` | `>=0.47,<0.50` | cornerstone — typed exceptions, structured logging, layered config, bootstrap | runtime |
| `mgf-cloud[infomaniak]` | `>=0.1.3,<0.2` | the provider/cost/models/credential layers (incl. openstacksdk for live Infomaniak) | runtime |
| `mgf-fastapi` | `>=0.6,<0.7` | `RequestIdMiddleware` + the federation FastAPI conventions | runtime |
| `mgf-brand-web` | `>=0.1,<0.2` | the shared Magogi brand-web kit (CSS/fonts/assets), mounted at `/static/brand` | runtime |
| `fastapi` | `>=0.110` | the web app framework | runtime |
| `uvicorn` | `>=0.30` | ASGI server for the local GUI | runtime |
| `jinja2` | `>=3.1,<4` | server-side HTML templates | runtime |
| `python-multipart` | `>=0.0.9` | form + file-upload parsing | runtime |

### Optional extras (pay only what you use)

| Extra | Dependency | Why |
|---|---|---|
| `standards` | `mgf-common[standards]>=0.47,<0.50` | the standards corpus for the federation CLI checks (dev/opt) |
| `dev` | pytest, ruff, mypy, import-linter, mgf-test-supervisor, … | the four green gates + the test supervisor |

*Federation siblings depended on: `mgf-common` (cornerstone), `mgf-cloud` (the
library this app fronts), `mgf-fastapi`, and `mgf-brand-web` (the shared brand kit). Per AP-03's 0.x discipline the pins
are walked one minor at a time. PKG-06: only the `mgf-*` names resolve from the
self-hosted devpi index; everything else is public PyPI.*

---

## §2 Who depends on mgf-cloud-web

| Project / sibling | Location | Import sites | Status | Surfaces used |
|---|---|---:|---|---|
| — | — | 0 | leaf application | — |

**Zero-consumer reality (today).** `mgf-cloud-web` is a **leaf application**, not
a library — it is run (`mgf-cloud-web`), not imported. No federation sibling
depends on it, and none is expected to: it sits at the top of the graph as an
operator-facing console.

---

## §3 Maintenance

Updated every MINOR release + when a dependency changes. Import-survey for
`mgf.cloud_web` (expected to stay zero — it is a leaf app):

```sh
grep -rE "(from|import) +mgf\.cloud_web" /home/bassam/PycharmProjects \
  --include='*.py' | grep -v '/mgf-cloud-web/' | wc -l
```
