fastapi>=0.115,<1.0
uvicorn[standard]>=0.30,<1.0

# Phase 2b OPTIONAL dependency.
# Uncomment the next line (and set POLICY_JWT_VERIFY=true + POLICY_JWT_PUBLIC_KEY
# or POLICY_JWKS_URL) to enable real JWT verification. Without it, the service
# decodes Bearer tokens WITHOUT verifying the signature and surfaces
# warnings: ['auth_not_verified'] on every such response.
# PyJWT>=2.8,<3.0