# DEPS — mgf-auth's bidirectional dependency manifest

> **§1** — what mgf-auth depends on. **§2** — who depends on
> mgf-auth. Knowing both directions makes deprecation,
> breaking-change blast-radius, and feature-prioritisation tractable.
>
> **Per standard DOC-16** (v2.12): every project ships a `DEPS.md`.
> Replaces the former `USERS.md`.

Last verified: 2026-06-08.

---

## §1 What mgf-auth depends on

| Dependency | Window | Why | Tier |
|---|---|---|---|
| `mgf-common` | `>=0.41,<0.47` | typed exceptions (typed 401s subclass `HttpUnauthorizedError`) / bootstrap | runtime |
| `pyjwt` | `>=2.8` | Clerk session-JWT verification (`mgf.auth.clerk_session`) | `[clerk]` extra (lazy) |
| `svix` (HMAC, stdlib) | — | Svix-Signature webhook verification (`mgf.auth.clerk_webhook`) is **stdlib-only** HMAC-SHA256 — no `svix` runtime dep | runtime (stdlib) |
| `cryptography` | `>=42.0` | RS256 key handling for the test/dev suite | `[test]` / `[dev]` only |

*Federation siblings depended on: `mgf-common` — typed exception
hierarchy + bootstrap. (Cornerstone; the only `mgf-*` runtime dep.)*

**Import discipline.** The generic core
(`_protocols` / `_events` / `_errors` / `mock`) imports **no** vendor
SDK — import-linter forbids it pulling `mgf.auth.clerk_session` /
`mgf.auth.clerk_webhook`, so `import mgf.auth` never drags in PyJWT.
PyJWT lives only behind the `[clerk]` extra (DP-02 lazy-import).

---

## §2 Who depends on mgf-auth

Consumer projects + federation siblings that import this project.

| Project / sibling | Location | Import sites | Status | Surfaces used |
|---|---|---:|---|---|
| **PlasmaMapper** | `/home/bassam/PycharmProjects/PlasmaMapper` | 5 | Consumer #1 — multi-tenant FastAPI SaaS; pins `mgf-auth[clerk]` | `SessionVerifier` / `WebhookVerifier` / typed 401 errors / Clerk adapters |

**Newly extracted (2026-05-28)** from PlasmaMapper's core re-design,
which ISP-split the auth provider (ADR-016). PlasmaMapper is consumer
#1 and currently the only downstream.

*No federation siblings depend on mgf-auth.*

---

## §3 Maintenance

Updated every MINOR release + when a dependency or consumer changes.
Import-survey methodology:

```sh
grep -rE "(from|import) +mgf\.auth" /home/bassam/PycharmProjects/PlasmaMapper \
  --include='*.py' | wc -l
```
