# DEPS — mgf-fastapi's bidirectional dependency manifest

> **§1** — what mgf-fastapi depends on. **§2** — who depends on
> mgf-fastapi. Knowing both directions makes deprecation,
> breaking-change blast-radius, and feature-prioritisation tractable.
>
> **Maintained by:** the mgf-common owner (Bassam — mgf-common owns the
> federation per the one-big-library mindset).
> **Per standard DOC-16** (v2.12): every project ships a `DEPS.md`.
> Replaces the former `USERS.md` (its roster is now §2 below).

Last verified: 2026-05-28.

---

## §1 What mgf-fastapi depends on

| Dependency        | Window           | Why                                                      | Tier |
|-------------------|------------------|----------------------------------------------------------|------|
| `mgf-common`      | `>=0.41,<0.47`   | `AppError`/`HttpError` hierarchy, bootstrap, observability, settings | runtime |
| `fastapi`         | `>=0.110`        | the framework these adapters integrate against           | runtime |
| `uvicorn`         | `>=0.30`         | `run_test_app` (`mgf.fastapi.testing`) needs uvicorn programmatically | `[testing]` (lazy) |
| `httpx`           | `>=0.27`         | test-client for the `run_test_app` helper path           | `[testing]` (lazy) |
| `mgf-sqlalchemy`  | `>=0.4,<0.5`     | `mgf.fastapi.db` imports `mgf.sqlalchemy` for the Depends-shaped DB session helper + lifespan | `[sqlalchemy]` (lazy) |

*Federation siblings depended on: `mgf-common` (runtime cornerstone) and
`mgf-sqlalchemy` (only via the `[sqlalchemy]` extra — without it,
`import mgf.fastapi.db` raises `ImportError`). Optional capabilities live
behind extras so consumers pay only for what they use.*

---

## §2 Who depends on mgf-fastapi

Consumer projects + federation siblings that import `mgf.fastapi.*`.
(Inverse of each consumer's `MGF_ADOPTION.md`.)

| Project / sibling | Location                                    | Import sites | Status                                               | Surfaces used                                                  |
|-------------------|---------------------------------------------|-------------:|------------------------------------------------------|----------------------------------------------------------------|
| **PlasmaMapper**  | `/home/bassam/PycharmProjects/PlasmaMapper` | 8            | Active — multi-tenant FastAPI SaaS, heaviest adopter | `mgf.fastapi` core / `webhooks` / `security` / `db` / `testing` |

**Single-consumer reality.** PlasmaMapper drives the mgf-fastapi roadmap.
Every shipped surface (10 in `mgf.fastapi`, 4 in `webhooks`, 4 in
`security`, 2 in `db`, 1 in `testing`) was extracted from PlasmaMapper's
in-tree code. Adoption will broaden once a second FastAPI consumer arrives.
The single-consumer status today means breaking changes need only check
PlasmaMapper — but mgf-fastapi is the most-likely-to-grow library in the
federation (SaaS use cases stack up fast). Treat every PUBLIC_API change
with "would a second FastAPI consumer be surprised?" review.

---

## §3 Maintenance

Updated every MINOR release + when a dependency or consumer changes.
Import-survey methodology (the second non-zero count is the signal to
formalise more of the experimental surface as stable):

```sh
for proj in vm-vmanager-app inthewords PlasmaMapper iosRecovery; do
  grep -rE "(from|import) +mgf\.fastapi" "/home/bassam/PycharmProjects/$proj" \
    --include='*.py' | wc -l
done
```
