# DEPS — mgf-http's bidirectional dependency manifest

> **§1** — what mgf-http depends on. **§2** — who depends on mgf-http.
> Knowing both directions makes deprecation, breaking-change
> blast-radius, and feature-prioritisation tractable.
>
> **Maintained by:** the mgf-common owner (Bassam — mgf-common owns the
> federation per the one-big-library mindset).
> **Per standard DOC-16** (v2.12): every project ships a `DEPS.md`.
> Replaces the former `USERS.md` (its roster is now §2 below).

Last verified: 2026-06-07.

---

## §1 What mgf-http depends on

| Dependency           | Window         | Why                                                   | Tier |
|----------------------|----------------|-------------------------------------------------------|------|
| `mgf-common`         | `>=0.41,<0.47` | `AppError` / `OperationError` / observability + settings + identity | runtime |
| `httpx`              | `>=0.27`       | async HTTP transport — the library mgf-http wraps      | runtime |
| `respx`              | `>=0.21`       | httpx mocking for consumers testing `AsyncHttpClient`  | `[test]` extra (lazy) |

*Federation siblings depended on: `mgf-common` — typed exceptions
(`AppError` / `OperationError`), observability, settings, and identity.
It is the only `mgf-*` sibling mgf-http imports at runtime.*

Runtime core is kept deliberately tight: only `mgf-common` + `httpx`.
The httpx mocking helper lives behind the `[test]` extra so consumers
without test dependencies don't pull it in.

---

## §2 Who depends on mgf-http

Consumer projects + federation siblings that import `mgf.http.*`.
(Inverse of each consumer's `MGF_ADOPTION.md`.)

### Consumer projects (external users)

| Project        | Location                                  | Import sites | Status      | Surfaces used        |
|----------------|-------------------------------------------|-------------:|-------------|----------------------|
| **inthewords** | `/home/bassam/PycharmProjects/inthewords` | 1            | Single use  | `mgf.http` client    |

**Single-direct-consumer reality.** Only inthewords imports `mgf.http`
directly today. **vm-vmanager-app, PlasmaMapper, and iosRecovery are expected
adopters** — the v0.4.0 `download(...)` API was shipped specifically to
close their resumable-download pain (see Wave 2 H-NEW-1 evidence in
`/home/bassam/PycharmProjects/mgf_common/docs/inprogress/pre_release_additions.md`
§12). They haven't migrated yet; the surface is ready when they do.

### Federation siblings (`mgf-*` libraries)

No siblings depend on mgf-http today. Each handles its own HTTP needs
(mgf-fastapi via Starlette, mgf-apiprobe via its own transport adapter).

**On a §2 change.** When vm-vmanager-app / PlasmaMapper / iosRecovery finish
their migration to `mgf.http.download(...)`, update the table in the
same PR that bumps their pyproject pins. Their migration will also feed
back into `MGF_ADOPTION.md` deltas.

---

## §3 Maintenance

Updated every MINOR release + when a dependency or consumer changes.
Import-survey methodology for `mgf.http`:

```sh
for proj in vm-vmanager-app inthewords PlasmaMapper iosRecovery; do
  grep -rE "(from|import) +mgf\.http" "/home/bassam/PycharmProjects/$proj" \
    --include='*.py' | wc -l
done
```

The three planned migrations (vm-vmanager-app + PlasmaMapper + iosRecovery)
will roughly quadruple the import count.
